Router
Middleware
Keep auth and permission middleware local to the app where auth options and access control are known.
Router middleware should stay close to the app.
Tulip packages do not force one global protectedProcedure model because apps differ in session shape, permission rules, OAuth flows, and feature-level access control.
Common middleware
- session middleware
- permission middleware
- organization or tenant middleware
- logging and telemetry middleware
- feature-flag middleware
Pattern
Define middleware in server/router/middleware.ts, then compose procedure presets in server/router/procedures.ts.