Express.js

const requestTimer: RequestHandler = (req, res, next) => {
  const start = process.hrtime.bigint();
  res.on("finish", () => {
    const ms = Number(process.hrtime.bigint() - start) / 1e6;
    logger.info({ method: req.method, path: req.path, status: res.statusCode, ms });
  });
  next();
};

const orders = express.Router({ mergeParams: true });
orders.get("/:orderId", (req, res) => {
  res.json({ tenantId: req.params.tenantId, orderId: req.params.orderId });
});
app.use("/tenants/:tenantId/orders", orders);

app.get("/orders/:id", async (req, res) => {
  const order = await repo.find(req.params.id);
  if (!order) res.status(404).json({ error: "not found" }); // missing return
  res.json(order); // throws ERR_HTTP_HEADERS_SENT when not found
});

// Express 4
const asyncHandler = (fn: (req: Request, res: Response, next: NextFunction) => Promise<unknown>) =>
  (req: Request, res: Response, next: NextFunction) => { fn(req, res, next).catch(next); };
app.get("/users/:id", asyncHandler(async (req, res) => {
  res.json(await users.get(req.params.id));
}));
// Express 5: the plain async handler is enough

app.get("/checkout", (req, res, next) => (flags.newCheckout(req) ? next("route") : next()), legacyCheckout);
app.get("/checkout", newCheckout);

const app = express();
app.use("/api/orders", ordersRouter);
app.use(express.json());
app.use(cors({ origin: "https://shop.example.com", credentials: true }));
app.use(authenticate);
app.use("/api/admin", adminRouter);
app.use(errorHandler);

const validate = <S extends z.ZodTypeAny>(schema: S, where: "body" | "query" | "params") =>
  (req: Request, res: Response, next: NextFunction) => {
    const r = schema.safeParse(req[where]);
    if (!r.success) return next(new ValidationError(r.error.issues));
    res.locals[where] = r.data; // don't reassign req.query in Express 5
    next();
  };
router.post("/orders", validate(CreateOrder, "body"), createOrder);

app.set("trust proxy", 1); // exactly one proxy (e.g. ALB) in front
app.use(rateLimit({ windowMs: 60_000, limit: 100, keyGenerator: (req) => req.user?.id ?? req.ip! }));

app.get("*", spaFallback);                     // catch-all
app.get("/files/*", serveFile);                // nested path
app.get("/export/:id.:format?", exportOrder);   // optional format
app.get("/:lang(en|vi)/products", products);    // inline regex

app.get("/invoices/:id/pdf", async (req, res) => {
  const inv = await invoices.findForTenant(req.tenantId, req.params.id);
  if (!inv) return res.sendStatus(404);
  res.sendFile(inv.storageKey, { root: "/data/invoices", dotfiles: "deny" });
});

app.use((err: unknown, req: Request, res: Response, next: NextFunction) => {
  if (res.headersSent) return next(err);
  const e = toAppError(err); // maps known libs (zod, DB driver) to AppError
  if (e.status >= 500) logger.error({ err, requestId: res.locals.requestId }, "unhandled");
  res.status(e.status).json({ type: e.code, title: e.expose ? e.message : "Internal error", requestId: res.locals.requestId });
});

// express@4
app.get("/orders/:id", async (req, res) => {
  const order = await orders.get(req.params.id); // throws when DB times out
  res.json(order);
});
app.use((err, req, res, next) => res.status(500).json({ error: "internal" }));

const requirePermission = (perm: string): RequestHandler => (req, res, next) => {
  permissions.forUser(req.user.id).then((perms) => {
    if (!perms.includes(perm)) {
      res.status(403).json({ error: "forbidden" });
    }
    next();
  });
  next();
};

app.use((err: AppError, req: Request, res: Response) => {
  res.status(err.status ?? 500).json({ code: err.code });
});
app.use("/api", apiRouter);

app.use((req, _res, next) => {
  req.query = sanitize(req.query);     // worked on Express 4
  req.body = sanitize(req.body);
  next();
});

app.patch("/me", async (req, res) => {
  await db.user.update({ where: { id: req.user.id }, data: req.body }); // client sends {"role":"admin"}
  res.sendStatus(204);
});

let ready = true;
app.get("/readyz", (_req, res) => res.sendStatus(ready ? 200 : 503));
process.once("SIGTERM", async () => {
  ready = false;
  await sleep(5_000);
  server.close(async () => { await db.end(); process.exit(0); });
  server.closeIdleConnections();
  setTimeout(() => process.exit(1), 20_000).unref();
});