You just have to write function per operation that is it:

    var auth = promised(function(user, data) {
      var isAdmin = user.role === admin
      return  isAdmin ? render(open("yay.xml"), db.send(data.request))
                      : render(open("no_permissions.xml"), {})
    })
    
    var puser = getUser(data.session)
    return auth(user, data)