ErrorHandling.apply(async (req: express.Request,
                               res: express.Response,
                               next: express.NextFunction): Promise<void> => {
      const cookies = new Cookies(req, res)
      let user

      try {
        const authenticationToken = await getAuthToken(req)
        if (authenticationToken) {
          user = await IdamClient.retrieveUserFor(authenticationToken)
          res.locals.isLoggedIn = true
          res.locals.user = user
          setAuthCookie(cookies, authenticationToken)
        }
      } catch (err) {
        return loginErrorHandler(req, res, cookies, next, err)
      }

      if (res.locals.isLoggedIn) {
        if (isDefendantFirstContactPinLogin(req)) {
          // re-set state cookie as it was cleared above, we need it in this case
          cookies.set(stateCookieName, req.query.state)
          return res.redirect(FirstContactPaths.claimSummaryPage.uri)
        } else {
          await claimStoreClient.linkDefendant(user)
          res.redirect(await retrieveRedirectForLandingPage(req, res))
        }
      } else {
        if (res.locals.code) {
          trackCustomEvent('Authentication token undefined (jwt defined)',
            { requestValue: req.query.state })
        }
        res.redirect(OAuthHelper.forLogin(req, res))
      }
    }))

async function authorizationRequestHandler (req: express.Request, res: express.Response, next: express.NextFunction) {
  const jwt: string = JwtExtractor.extract(req)
  if (jwt) {
    try {
      await IdamClient.retrieveUserFor(jwt)
      res.locals.isLoggedIn = true
    } catch (err) {
      if (!hasTokenExpired(err)) {
        next(err)
        return
      }
    }
  }
  next()
}

    ErrorHandling.apply(async (req: express.Request, res: express.Response, next: express.NextFunction): Promise<void> => {
      const jwt: string = JwtExtractor.extract(req)

      if (jwt) {
        try {
          await IdamClient.invalidateSession(jwt)
        } catch (error) {
          const { id } = JwtUtils.decodePayload(jwt)
          logger.error(`Failed invalidating JWT for userId  ${id}`)
        }

        const cookies = new Cookies(req, res)
        cookies.set(sessionCookie, '')
      }

      res.redirect(Paths.homePage.uri)
    })

async function getOAuthAccessToken (req: express.Request, receiver: RoutablePath): Promise<string> {
  if (req.query.state !== OAuthHelper.getStateCookie(req)) {
    trackCustomEvent('State cookie mismatch (citizen)',
      {
        requestValue: req.query.state,
        cookieValue: OAuthHelper.getStateCookie(req)
      })
  }
  const authToken: AuthToken = await IdamClient.exchangeCode(
    req.query.code,
    buildURL(req, receiver.uri)
  )
  if (authToken) {
    return authToken.accessToken
  }
  return Promise.reject()
}

    return (req: express.Request, res: express.Response, next: express.NextFunction) => {
      const jwt: string = JwtExtractor.extract(req)

      if (isPathUnprotected(req.path)) {
        logger.debug(`Unprotected path - access to ${req.path} granted`)
        return next()
      }

      if (!jwt) {
        logger.debug(`Protected path - no JWT - access to ${req.path} rejected`)
        return accessDeniedCallback(req, res)
      } else {
        IdamClient
          .retrieveUserFor(jwt)
          .then((user: User) => {
            if (!user.isInRoles(...requiredRoles)) {
              logger.error(`Protected path - valid JWT but user not in ${requiredRoles} roles - redirecting to access denied page`)
              return accessDeniedCallback(req, res)
            } else {
              res.locals.isLoggedIn = true
              res.locals.user = user
              logger.debug(`Protected path - valid JWT & role - access to ${req.path} granted`)
              return next()
            }
          })
          .catch((err) => {
            if (hasTokenExpired(err)) {
              const cookies = new Cookies(req, res)
              cookies.set(sessionCookieName, '')
              logger.debug(`Protected path - invalid JWT - access to ${req.path} rejected`)
              return accessDeniedCallback(req, res)
            }
            return next(err)
          })
      }
    }

 async get (): Promise<ServiceAuthToken> {
   if (token === undefined || token.hasExpired()) {
     token = await IdamClient.retrieveServiceToken()
   }
   return token
 }