import { requirePolicy } from '@aporthq/express-middleware';

// Protect any route with policy enforcement
app.post('/api/payments/refund',
  requirePolicy({
    policyId: 'finance.payment.refund.v1',
    mode: 'simple', // or 'secure' for enterprise
  }),
  async (req, res) => {
    // Your route logic here
    // APort has already verified the agent passport
    // and enforced policy limits
    res.json({ success: true });
  }
);