Auto-wired container services.
Run the handler, then shape what it returned.
It handles both of the things a handler may hand back, which is the part that used to be wrong. A
handler carrying a response decorator (@JsonHttpResponse(201)) has already been turned into a
response by the time any route middleware runs, because that decorator wraps the method itself.
Projecting the response object produced an empty payload and dropped the status with it. So a
response is now projected through its content, in place: the payload is shaped and the status,
the headers and everything else the handler chose are left exactly as they were.
The incoming event.
The next middleware.
The shaped output, or the untouched result when the route declares no resource.
Route middleware: shapes what a route returns, after its handler ran.
A route says what it exposes, once, where the route is defined:
The handler returns its domain model, whole, and this applies the resource on the way out. That is the point: a service should not have to know which fields are public, and a handler should not have to remember to strip them.