demo-middleware-3-good.js

const restaurantOwnerOnlyMiddleware = async (req, res, next) => {
    const {restaurantId} = req.params;
    const user = req.user;

    const restaurantDoc = await db.collection("restaurants").doc(restaurantId).get(); // db-read
    const restaurant = restaurantDoc.data();

    if (restaurant.owner !== req.user.uid) {
        res.status(403).send("Unauthorized");
        return;
    }
  
    req.restaurant = restaurant; // extending request object

    next();
};

app.put("/:restaurantId/stars", [onlyLoggedInUsers, restaurantOwnerOnlyMiddleware], (req, res) => {
    // const restaurantDoc = await db.collection("restaurants").doc(restaurantId).get(); // avoided db-read!
    const {cook} = req.restaurant;
  
    await writeToSomeWallOfFame(cook);
  
    res.send();
});