auth.js

// auth.js

var auth = express();

var checkToken = function(req, res, next) {
    var token = tokens.decode(req.cookies.token || req.query.token);
    
    if (!token) return res.error(403);
    
    req.user = token;
    next();
};

// login does not have a token check
auth.post('/login', function(req, res) {
    ... login ...    
    res.cookie('token', tokens.encode(...))
});

// logout does not have a token check
auth.post('/logout', function(req, res) {
    ... logout ...
    res.cookie('token', null);
});

// all other routes we mount on auth have one
auth.all(checkToken);

module.exports = auth;

// main.js

var auth = require('./auth');
var main = express();

auth.get('/my-auth-call', function(req, res) {
    
});

main.use(auth);
main.listen(80)

inlined.js

var main = express();

var checkToken = function(req, res, next) {
    var token = tokens.decode(req.cookies.token || req.query.token);
    
    if (!token) return res.error(403);
    
    req.user = token;
    next();
};

// login does not have a token check
main.post('/login', function(req, res) {
    ... login ...    
    res.cookie('token', tokens.encode(...))
});

// logout does not have a token check
main.post('/logout', function(req, res) {
    ... logout ...
    res.cookie('token', null);
});

// all other routes we mount on auth have one
main.all(checkToken);

main.get('/my-auth-call', function(req, res) {
    
});

main.listen(80)

main2.js

var app = express();

app.post('/login', function() {
    ...
});

app.post('/logout', function() {
   ... 
});

var auth = express();

auth.all(checkToken);

auth.get('/my-auth-call', function(req, res) {
   ... 
});

app.use(auth)