Sails.js dynamic protected folder with EJS

I have the following folder structure:

USERS
|-USER1
| |-HTML_TEMPLATE_X
| | |-CSS_FOLDER
| | |-JS_FOLDER
| | |-IMG_FOLDER
| | `-INDEX.EJS
| |-HTML_TEMPLATE_Y
| `-HTML_TEMPLATE_Z
|-USER2
`-USER3

The idea is to give an user a route to access its HTML template, the route can be like this:

myapp.com/user-slug/template-slug/index.html

I am stuck on this with sails.js, initially i provided access serving USERS folder as a static folder on sails.js using express middleware, but this doesnt protect any user to get into other user directory. And this doesnt allow index.ejs being parsed to respond with a index.html file, modified by user's custom settings from the database.

How can i approach this two problems?

1 - Creating a protected static folder for each user. So the user has access only to its folder.

2 - When express capture any request to the index.ejs file in the user's template folder parse it and inject custom user settings from the database? Just like sails.js does when serving an EJS file on views directory.

Thanks!