demo-middleware-3-bad.js

const restaurantOwnerOnlyMiddleware = async (req, res, next) => {
    const {restaurantId} = req.params;
    const user = req.user;

    const restaurantDoc = await db.collection("restaurants").doc(restaurantId).get(); // db-read
    const {owner} = restaurantDoc.data();

    if (owner !== req.user.uid) {
        res.status(403).send("Unauthorized");
        return;
    }

    next();
};

app.put("/:restaurantId/stars", [onlyLoggedInUsers, restaurantOwnerOnlyMiddleware], (req, res) => {
    const restaurantDoc = await db.collection("restaurants").doc(restaurantId).get(); // unnecessary db-read!
    const {cook} = restaurantDoc.data();
  
    await writeToSomeWallOfFame(cook);
  
    res.send();
});