ExpressAuthTagger

if (!req.headers.authorization) { return next(); }: a caller without the credential is let through before anything can refuse it.

x.use(authMiddleware) — no path argument. Which routes this guards is a property of the object x, not of any URL, so the receiver is captured.

The name an express-basic-auth import is bound to in a file.

What the guarded branch does to the caller it stops, and how that reads in the tag: throws (the app's error handler answers), answers 401/403 (res.status(401) alone sends nothing), hands an error to next(err), or redirects to a login page.

The last field of a negated read that names who is calling: !req.user, !req.accountability?.user, !req.session.userId, !req.isAuthenticated(). The first field must not be request data (!req.params.userId refuses a bad URL, not an anonymous caller).

Request fields that carry what the caller sent or what the app looked up, not who the caller is: a check on them refuses bad input.

Anything that can answer, pass the request on or change state before a later check runs; a check after one of these is not what every caller meets first.

(err, req, res, next): an error handler answers 401 for a guard; it is not one.

A definition that answers the request itself, refusals aside: in the handler position that is the handler (login() answers 401 to a wrong password), not a guard in front of one.

Where code runs an express-basic-auth middleware: the factory (as the file imports it) called and the result called on the request (basicAuth({…})(req, res, next)) or returned, or the variable it is assigned to called on the request or returned. Each is a 401 for a caller without credentials, under the conditions around the run: one built and never run, or a local basicAuth({ user, pass }) that builds an outbound header, refuses nothing.

throw new ForbiddenError() under an if that reads who the caller is (if (!isAdmin(req.accountability))): every anonymous caller takes it. A throw on request data (req.params.collection in req.schema…) is a 4xx for bad input, not a guard.

ponytail: brace/paren-counted spans; a registration whose closure runs past 60 lines or a definition past 40 is read truncated, not re-parsed.

!req.user, !req.session.userId, !req.session: no caller. Not !req.session.cart, a session without a cart.

The calls the mount pre-scan reads: a file with neither is skipped whole.

Passport strategies that are the login flow — local checks the submitted password on POST /login, the OAuth/OIDC/SAML ones start or finish a provider redirect. The route they sit on is the anonymous entry point, not a protected resource.

if (req.member && req.member.banned): the refusal needs something present first, which an anonymous caller does not have.

Promise.all( / Promise.all (: the builtin, never a mount. A large TS codebase carries thousands of them, and each one used to be read as a .all() registration whose every argument was followed to its definition (n8n: ~3,200 lines, over a second of tagging).

What a middleware's definition must be able to do to count as a guard whatever it is called: refuse the request. jwt.verify( alone is deliberately absent — a function that verifies a token and then calls next() unconditionally (juice-shop's updateAuthenticatedUsers) is not a guard, and it is app.use()d over every route.

sendError(res, 401, …) hands the response and a 401 to a reply helper (a helper's 403 is as often about the payload as the caller). An express-basic-auth middleware refuses where it is run, not where it is built: see basic_auth_runs.

The start of a route registration, used as a statement boundary so a window around one route never reads the next one's middleware.

A route registration, and who it was registered on: app.get('/x', …), router.post(…), app.route('/x').

The receiver a helper is handed, by the names the route-helper scanner accepts for it.

A read of configuration: Settings.get("disableAuth"), config.x, getSetting("y"), process.env.Z.

A 4xx answer as a definition writes it: res.status(413), res.sendStatus(400), or a reply helper handed the response and the code (responseError(res, '413', …)).

A response that is not a refusal: anything sent without a 4xx status chained before it.

The per-endpoint shape: look at each endpoint, tag in place, hand the array back. Taggers declare only check_endpoint; those that need a pass over the whole set first (a project pre-scan, mcp's legacy prefixes) override perform and call super or loop themselves.