The changes required here are more significant, but still straightforward:

import { ensureAuthenticated } from './users'; 

We need to use the ensureAuthenticated function to protect certain routes from being used by users who are not logged in. Notice how ES6 modules let us import just the function(s) we require. Since that function is in the user router module, we need to import it from there:

router.get('/add', ensureAuthenticated, (req, res, next) => {
    try {
        res.render('noteedit', {
            title: "Add a Note",
            docreate: true, notekey: "",
            user: req.user, note: undefined
        });
    } catch (e) { next(e); }
});

The first thing we added is to call usersRouter.ensureAuthenticated in the route definition. If the user is not logged in, they'll redirect to /users/login, thanks to that function.

Because we've ensured that the user is authenticated, we know that req.user will already have their profile information. We can then simply pass it to the view template.

For the other routes, we need to make similar changes:

router.post('/save', ensureAuthenticated, (req, res, next) => { 
  .. 
}); 

The /save route requires only this change to call ensureAuthenticated to make sure that the user is logged in:

router.get('/view', (req, res, next) => {
    try {
        var note = await notes.read(req.query.key);
        res.render('noteview', {
            title: note ? note.title : "",
            notekey: req.query.key,
            user: req.user ? req.user : undefined, 
            note: note
        });
    } catch (e) { next(e); }
}); 

For this route, we don't require the user to be logged in. We do need the user's profile information, if any, sent to the view template:

router.get('/edit', ensureAuthenticated, (req, res, next) => { 
    try {
        var note = await notes.read(req.query.key);
        res.render('noteedit', {
            title: note ? ("Edit " + note.title) : "Add a Note",
            docreate: false,
            notekey: req.query.key,
            user: req.user ? req.user : undefined, 
            note: note
        });
    } catch (e) { next(e); }
}); 
router.get('/destroy', ensureAuthenticated, (req, res, next) => { 
    try {
        var note = await notes.read(req.query.key);
        res.render('notedestroy', {
            title: note ? `Delete ${note.title}` : "",
            notekey: req.query.key,
            user: req.user ? req.user : undefined, 
            note: note
        });
    } catch (e) { next(e); }
}); 
router.post('/destroy/confirm', ensureAuthenticated, (req, res, next) => { 
  .. 
}); 

For these routes, we require the user to be logged in. In most cases, we need to send the req.user value to the view template.