refractor code,

apps/api/src/middleware/requireTenant.ts

@@ -1,22 +1,23 @@
 import { Request, Response, NextFunction } from 'express'
 import { prisma } from '../lib/prisma'
+import { sendUnauthorized } from './authHelpers'
 
+/**
+ * Loads the company record and validates it exists.
+ * Must be applied after `requireCompanyAuth`.
+ *
+ * Guarantees on success:
+ *   req.company   — full Company record
+ *   req.companyId — string id (already set by requireCompanyAuth)
+ */
 export async function requireTenant(req: Request, res: Response, next: NextFunction) {
   if (!req.companyId) {
-    return res.status(401).json({
-      error: 'unauthenticated',
-      message: 'Tenant context missing — requireCompanyAuth must run first',
-      statusCode: 401,
-    })
+    return sendUnauthorized(res, 'unauthenticated', 'Tenant context missing — requireCompanyAuth must run first')
   }
 
   const company = await prisma.company.findUnique({ where: { id: req.companyId } })
   if (!company) {
-    return res.status(401).json({
-      error: 'company_not_found',
-      message: 'Company not found',
-      statusCode: 401,
-    })
+    return sendUnauthorized(res, 'company_not_found', 'Company not found')
   }
 
   req.company = company