diff --git a/lib/permission-middleware.js b/lib/permission-middleware.js
index 53e1cad..423c6e3 100644
--- a/lib/permission-middleware.js
+++ b/lib/permission-middleware.js
@@ -13,11 +13,14 @@ export async function getUserFromRequest(req) {
     if (!authHeader || !authHeader.startsWith('Bearer ')) {
       // For development, return user ID 1 if no token (should be removed in production)
       console.warn('⚠️  Development mode: Using fallback user authentication');
+      console.warn('⚠️  No auth header found:', authHeader);
       return { userId: 1, email: 'admin@tcgvault.com', role: 'admin' };
     }
 
     const token = authHeader.substring(7);
+    console.log('🔍 Attempting to verify token:', token.substring(0, 20) + '...');
     const decoded = jwt.verify(token, JWT_SECRET);
+    console.log('✅ Token decoded successfully:', decoded);
     
     // Get user data from database
     const result = await sql`