Closes AGENTS.md gotcha #2: getUserFromRequest no longer returns a
hardcoded { userId: 1, email: 'admin@tcgvault.com', role: 'admin' }
when the Authorization header is missing or malformed.
lib/permission-middleware.js
- getUserFromRequest now returns null for missing/malformed Bearer
headers. No console.warn, no NODE_ENV gate — the fallback is gone,
period.
- Token-verify path and DB lookup unchanged.
pages/api/auth/verify.js
- No-token branch now returns 401 instead of fetching the seed admin
via `WHERE email = 'admin@tcgvault.com'`. Closes the admin-record-
leak side of the same bypass.
- JWT-verify branch unchanged.
Known follow-up (flagged but NOT addressed in this PR):
pages/api/collections/[identifier]/cards.js POST/PUT/DELETE handlers
dereference user.userId without a null guard. Previously masked by
the synthetic admin (anonymous-write-as-admin on collections owned
by user 1 was the security hole). Now degrades to NPE → 500 instead
of a clean 401. Security is improved either way; cosmetic 500-vs-401
fix lives in a separate one-line follow-up PR.
Convoy: fix-auth-bypass / Brief 2
Co-authored-by: Cursor <cursoragent@cursor.com>
