Inconsistent auth/error patterns

What it is

Auth checks and error handling are done differently from one route to the next — some guard early, some guard mid-function, some not at all; some return structured errors, others leak a raw exception.

Why it matters

Inconsistency is where gaps hide. When there is no single pattern, a missing check does not look wrong, and reviewers cannot tell a deliberate exception from an oversight.

How to fix it

Settle on one shape — a middleware or wrapper that every handler goes through — and move the routes onto it. Once the pattern is uniform, a route that does not use it stands out on sight.