Auth Patterns

How auth works in this project

Auth is JWT-based. Protected routes call getUserFromRequest(req) from lib/auth.ts at the top of the handler — it verifies the token and returns { id }, or throws an HttpError(401) which handleError maps to a 401 response.

There is no Next.js middleware doing auth globally. Each route is explicitly protected.

import { getUserFromRequest } from '@/lib/auth';