Express Middleware

const express = require('express')
const app = express()

// 1. Application-level middleware (runs on every request)
app.use((req, res, next) => {
  console.log(`${new Date().toISOString()} ${req.method} ${req.url}`)
  next()  // pass to next middleware
})

// 2. Built-in middleware
app.use(express.json())            // parse JSON bodies
app.use(express.static('public')) // serve static files

// 3. Third-party middleware
// npm install cors helmet morgan
const cors   = require('cors')
const helmet = require('helmet')
const morgan = require('morgan')
app.use(cors())             // enable CORS
app.use(helmet())           // security headers
app.use(morgan('combined')) // HTTP request logging

// 4. Error handling middleware (4 parameters)
app.use((err, req, res, next) => {
  console.error(err.stack)
  res.status(500).json({
    error: 'Internal Server Error',
    message: process.env.NODE_ENV === 'development' ? err.message : undefined
  })
})

// 5. Route-specific middleware
const authenticate = (req, res, next) => {
  const token = req.headers.authorization?.split(' ')[1]
  if (!token) return res.status(401).json({ error: 'Unauthorized' })
  // verify token...
  req.user = { id: 1 }  // attach user to request
  next()
}

app.get('/profile', authenticate, (req, res) => {
  res.json({ user: req.user })
})