Express-Like Middleware in Next.js API Route Handler

export const handler: Handler = (...middleware) => async (request, params) => {
  const result = await execMiddleware(middleware, request, params);
  if (result) {
    return result;
  }
  return ErrorResponse('Your handler or middleware must return a NextResponse!', 400);
};

const execMiddleware: ExecMiddleware = async (middleware, request, params) => {
  for (const middlewareFn of middleware) {
    let nextInvoked = false;
    const next = async () => {
      nextInvoked = true;
    };
    const result = await middlewareFn(request, params, next);
    if (!nextInvoked) {
      return result;
    }
  }
};

export const protect: AuthorizeUser = async (req, params, next) => {
  let token = '';
  const authorization = req.headers.get('authorization');
  const cookie = req.cookies.get('auth')?.value;

  if (!authorization && !cookie) {
    return ErrorResponse('You are not logged in. Please log in to get access', 401);
  }

  if (authorization && authorization.startsWith('Bearer')) 
    token = authorization.split(' ')[1];

  if (cookie) 
    token = cookie;

  try {
    const user = (await verifyToken(token, process.env.JWT_SECRET!)) as User;
    if (!isEmpty(user)) 
      req.user = user;
  } catch (error) {
    return handleTokenError(error);
  }

  if (isEmpty(req.user)) {
    return ErrorResponse('Not authorized to access this route', 401);
  }

  next();
};

* It first checks if an authentication token is provided either in:

    * The `Authorization` header (`Bearer <token>`)

    * The `auth` cookie.

* If no token is found, it returns a `401 Unauthorized` error.

* If the token exists, it verifies it using `verifyToken(token, process.env.JWT_SECRET!)`.

* If the token is valid, it extracts the user information and attaches it to `req.user`.

* If an error occurs (invalid or expired token), it calls `handleTokenError(error)`.

* If no valid user is found, it returns a `401 Unauthorized` error.

* If authentication succeeds, it calls `next()` to allow access to the next middleware or the handler itself if no other middleware.

export const authorize: AuthorizeRoles = (...roles) => {
  return async (req, params, next) => {
    if (!roles.includes(req.user.role)) 
      return ErrorResponse('Forbidden: Access denied', 401);
    next();
  };
};

* It takes an array of roles (e.g., `'ADMIN', 'USER'`).

* If `req.user.role` is not included in the allowed roles, it returns a `401 Forbidden` error.

* If the user has a valid role, it calls `next()` to proceed to the next middleware or the handler itself if no other middleware.

// Example protected route
const handleGetLoggedinUser = asyncHandler(async (req: CustomRequest) => {
  const user = await prisma.user.findUnique({ 
    where: { id: req.user.id } 
  });

  return ApiResponse(user);
});

const GET = handler(protect, handleGetLoggedinUser);

* Retrieves the currently logged-in user from the database.

// Example authorized route
const handleDeleteUser = asyncHandler(async (req: CustomRequest, params: { id: string }) => {
  const { id } = params;
  const user = await prisma.user.findUnique({ where: { id } });
  if (!user) {
    return ErrorResponse('User not found', 404);
  }
  await prisma.user.delete({ where: { id } });
  return ApiResponse(null, 'User deleted successfully');
});



const DELETE = handler(protect, authorize('ADMIN'), handleDeleteUser);

export { GET, DELETE };

* Deletes a user based on the provided `id`.

* `DELETE /user/:id` → Uses both `protect` and `authorize('ADMIN')`, ensuring the request is first authenticated and only admin users can delete user accounts.

const signUpSchema = z.object({
  email: z.string().email(),
  password: z.string().min(8),
});

export const validateSignupBody: ValidateCreateUser = async (req, params, next) => {
  const data = await req.clone().json();
  const response = signUpSchema.safeParse(data) as ValidateParseResponse;
  if (!response.success) {
    const { errors } = response.error;
    const errorMessage = generateErrorMessage(errors, options);
    return ErrorResponse(errorMessage, 422);
    }
  next();
};

* Uses `zod` to define a validation schema for signup data:

    * `email` must be a valid email.

    * `password` must have at least 8 characters.

* Extracts JSON data from the request.

* Uses `safeParse(data)` to validate the request body.

* If validation fails, it generates an error message and returns a `422 Unprocessable Entity` error.

* If validation passes, it calls `next()` function.

const handleSignup = asyncHandler(async (req: CustomRequest) => {
  const { email, password } = await req.json();

  const hashedPassword = await bcrypt.hash(password, 10);

  const user = await prisma.user.create({ 
    data: { email, password: hashedPassword } 
  });

  return ApiResponse(user);
});

const POST = handler(validateSignupBody, handleSignup);

export { POST };

* Extracts `email` and `password` from the request body.

* Hashes the password using `bcrypt` before storing it in the database.

* Saves the new user using Prisma ORM.

* Ensures the request body is valid before calling `handleSignup`.

export const asyncHandler = <T extends ObjectData>(handler: AsyncHandler<T>) => {
  return async (req: CustomRequest, params?: { params: Promise<T> }) => {
    try {
      const resolvedParams = (await params?.params) ?? ({} as T);
      const resp = await handler(req, resolvedParams);
      return resp;
    } catch (error) {
      if (error?.isApiException) {
        const { message, statusCode, data } = error;
        return ErrorResponse(message, statusCode, data);
      } else if ( error instanceof PrismaClientKnownRequestError || error instanceof PrismaClientValidationError) {
        // Return Custom error here: e.g db-related errors
        return handlePrismaError(error);
      } else {
        return ErrorResponse('Internal Server Error', 500);
      }
    }
  };
};

* Wraps the request processing logic in a `try-catch` block.

* If an API exception occurs, it returns an error response.


If a Prisma ORM error occurs, it calls handlePrismaError(error).
Otherwise, it returns a 500 Internal Server Error.