Your commit message here

src/app/api/projects/route.js

@@ -1,11 +1,12 @@
 import { getAllProjects, createProject } from "@/lib/queries/projects";
 import initializeDatabase from "@/lib/init-db";
 import { NextResponse } from "next/server";
+import { withReadAuth, withUserAuth } from "@/lib/middleware/auth";
 
 // Make sure the DB is initialized before queries run
 initializeDatabase();
 
-export async function GET(req) {
+async function getProjectsHandler(req) {
 	const { searchParams } = new URL(req.url);
 	const contractId = searchParams.get("contract_id");
 
@@ -13,8 +14,12 @@ export async function GET(req) {
 	return NextResponse.json(projects);
 }
 
-export async function POST(req) {
+async function createProjectHandler(req) {
 	const data = await req.json();
 	createProject(data);
 	return NextResponse.json({ success: true });
 }
+
+// Protected routes - require authentication
+export const GET = withReadAuth(getProjectsHandler);
+export const POST = withUserAuth(createProjectHandler);