⭐ Middleware

authentication.js, errorHandler.js, and rateLimiter.ts (added later, see Security Hardening).

A real double-next() bug in authentication.js: a missing return after next(new NotFoundError("User")) meant that when a verified JWT belonged to a user no longer in the DB, execution fell through anyway and tried to set a property on a null object — throwing a TypeError that the outer catch then passed to next() a second time. Fixed by returning after the first call. Confirmed real by deliberately reintroducing it and watching next() fire twice before restoring the fix.

errorHandler.js's generic 500 fallback used to send error.message straight to API clients for any unexpected error, not just this app's own error classes — a real information-leak risk for genuine failures (DB errors, bugs). Now responds with a fixed "Internal server error" message on 500s while still logging the full error server-side.

Both fixes follow the same standard as everywhere else in this repo: reverted deliberately, confirmed the test suite catches the regression, then restored.