addition of new dashboard

backend/common/http.js

@@ -0,0 +1,14 @@
+export const fail = (res, status, code, message) =>
+  res.status(status).json({ error: { code, message } });
+
+// Requires a logged-in user (401) and turns a throw into a 500 envelope, so a
+// data-layer failure never masquerades as empty-but-200 data.
+export const sessionRoute = (label, fn) => async (req, res) => {
+  if (!req.user) return fail(res, 401, "unauthorized", "Not logged in");
+  try {
+    await fn(req, res);
+  } catch (e) {
+    console.error(`${label} ${req.method} ${req.path}:`, e);
+    fail(res, 500, "internal", "Internal error");
+  }
+};