backend/src/middleware/requireUser.js

import { UnauthorizedError } from "../shared/errors/index.js";

export function requireUser(req, res, next) {
  const userId = req.user?.sub;
  if (!userId) return next(new UnauthorizedError());
  req.userId = userId;
  next();
}