react-express.tsx

import { Forbidden, Router, Route } from 'react-express'

function App() {
  return (
    <Router>
      <Route path="/api">
        <Route path="/todos">
          <Route path="/:id">{({id}) => <FetchTodo id={id} />}</Route>
        </Route>
      </Route>
    </Router>
  )
}

const FetchTodo = ({id}) => {
  const currentUser = useCurrentUser()

  const permissions = usePermissions(currentUser)
    
  if (!permissions.canRead(Todo, id)) {
      return <Forbidden />
  }

  return Todo.getById(id, currentUser) 
}