Styjun

Let's say I have a POST request in my API POST /api/comments where I create a comment. Comments are received in array tree structure (each comment has a children property, which can have subcomments). I have multiple "events" that occur before response is sent.

I can put all the required code into one middleware function like this.

function postComments(req, res, next) 
 // handle general authentication
 if (!isAuthenticated()) 
 next("not authenticated ...");
 

 // handle more specific authentication (ex. admin)
 if (!isAdmin()) 
 next("not admin ...")
 

 // validate req.body.comments so that each comment has allowed form
 if (!areCommentsValid()) 
 next("not valid ...");
 

 // modify comments for database insertion
 const modifiedComments = modifyComments();

 // database insertion
 db.insert(modifiedComments)

 res.sendStatus(201);

In above example general auth and admin authentication can be used in multiple routes and next middlewares are not relying on them, code is still working. So code those 2 makes sense.

In this example my middleware does multiple things.

What I thought I could do was split the following code into multiple middleware.

function userAuth(req, res, next) 
 // handle user authentication


function adminAuth(req, res, next) 
 // handle admin auth


function validateComments(req, res, next) 
 // handle req.body.comments validation


function modifyComments(req, res, next) 
 // modify comments
 // req.commentsForDb = modifiedComments;


function postComments(req, res, next) 
 // insert req.commentsForDb into database

So now I split my middleware into 4 different middlewares, but the problem is middlewares depend on each other.

postComments requires modifyComments to set req.commentsForDb, modifyComments requires validateComments etc.

Which is the preferred method?

It's perfectly valid and it is actually the way middleware are intended to be used.
As long as you properly call next with an error code when something goes wrong in a middleware where you should stop forwarding to the next one.

The added value here is that you can reuse your middlewares in many different routes. Another thing you can do, is a middleware closure generator, for example an auth middleware based on the role:

function auth(role) 
 return function(req, res, next) 
 // get my user
 // ...
 // check user role
 if user.role != role 
 return next(new Error("Auth failed"))
 
 return next()
 


// this route is for admins
app.get(
 "/foo", 
 auth("admin"),
 foo
)

// this one for users
app.get(
 "/bar", 
 auth("user"),
 foo
)