lib/permission-middleware.js

@@ -10,9 +10,7 @@ export async function getUserFromRequest(req) {
     const authHeader = req.headers.authorization;
     
     if (!authHeader || !authHeader.startsWith('Bearer ')) {
-      // For development, return user ID 1 if no token (should be removed in production)
+      return null;
-      console.warn('⚠️  Development mode: Using fallback user authentication');
-      return { userId: 1, email: 'admin@tcgvault.com', role: 'admin' };
     }
 
     const token = authHeader.substring(7);

pages/api/auth/verify.js

@@ -22,19 +22,7 @@ export default async function handler(req, res) {
     const authHeader = req.headers.authorization;
     
     if (!authHeader || !authHeader.startsWith('Bearer ')) {
-      // For development, return admin user if no token provided
+      return res.status(401).json({ error: 'Authentication required' });
-      // In production, this should return 401
-      const result = await sql`
-        SELECT id, email, role, created_at 
-        FROM users 
-        WHERE email = 'admin@tcgvault.com'
-      `;
-
-      if (result.rows.length > 0) {
-        return res.status(200).json(result.rows[0]);
-      } else {
-        return res.status(401).json({ error: 'No admin user found' });
-      }
     }
 
     const token = authHeader.substring(7);