fix: await async validateToken in auth middleware (#36)

tokenValidator.validateToken() is async but was not being awaited in
authMiddleware. The returned Promise is truthy, so the null-check never
triggered — causing token auth to silently proceed with undefined
ownerEmail, undefined scopes, and isAdmin=false for all API tokens.

Adds regression tests with an async mock to match real-world behavior.

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: accorvin

shared/server/__tests__/auth-tokens.test.js

@@ -240,6 +240,81 @@ describe('requireScope', () => {
   })
 })
 
+describe('authMiddleware with async tokenValidator (real-world behavior)', () => {
+  let storage, authMiddleware, requireAdmin
+
+  beforeEach(() => {
+    storage = createMockStorage()
+    // The real tokenValidator.validateToken is async — the mock must match
+    const tokenValidator = {
+      async validateToken(rawToken) {
+        if (rawToken === 'tt_validtoken00000000000000000000') {
+          return { id: 'tok-1', ownerEmail: 'admin@test.com', name: 'Test', scopes: null }
+        }
+        if (rawToken === 'tt_scopedtoken000000000000000000000') {
+          return { id: 'tok-2', ownerEmail: 'admin@test.com', name: 'Scoped', scopes: ['roster:read'] }
+        }
+        return null
+      },
+      touchLastUsed() {}
+    }
+    const result = createAuthMiddleware(
+      storage.readFromStorage.bind(storage),
+      storage.writeToStorage.bind(storage),
+      { tokenValidator }
+    )
+    authMiddleware = result.authMiddleware
+    requireAdmin = result.requireAdmin
+  })
+
+  it('resolves ownerEmail from async validateToken', async () => {
+    const req = createMockReq({
+      headers: { authorization: 'Bearer tt_validtoken00000000000000000000' }
+    })
+    const res = createMockRes()
+    let nextCalled = false
+    await authMiddleware(req, res, () => { nextCalled = true })
+    expect(nextCalled).toBe(true)
+    expect(req.userEmail).toBe('admin@test.com')
+    expect(req.authMethod).toBe('token')
+  })
+
+  it('grants admin to token owner who is in the admin allowlist', async () => {
+    const req = createMockReq({
+      headers: { authorization: 'Bearer tt_validtoken00000000000000000000' }
+    })
+    const res = createMockRes()
+    await authMiddleware(req, res, () => {})
+    expect(req.isAdmin).toBe(true)
+
+    // requireAdmin should pass
+    const res2 = createMockRes()
+    let adminNextCalled = false
+    requireAdmin(req, res2, () => { adminNextCalled = true })
+    expect(adminNextCalled).toBe(true)
+  })
+
+  it('rejects invalid token with 401 when validateToken is async', async () => {
+    const req = createMockReq({
+      headers: { authorization: 'Bearer tt_garbage0000000000000000000000' }
+    })
+    const res = createMockRes()
+    let nextCalled = false
+    await authMiddleware(req, res, () => { nextCalled = true })
+    expect(nextCalled).toBe(false)
+    expect(res.statusCode).toBe(401)
+  })
+
+  it('preserves scopes from async validateToken', async () => {
+    const req = createMockReq({
+      headers: { authorization: 'Bearer tt_scopedtoken000000000000000000000' }
+    })
+    const res = createMockRes()
+    await authMiddleware(req, res, () => {})
+    expect(req.tokenScopes).toEqual(['roster:read'])
+  })
+})
+
 describe('proxySecretGuard with Bearer tokens', () => {
   let originalEnv, tokenValidator
 

shared/server/auth.js

@@ -182,7 +182,7 @@ function createAuthMiddleware(readFromStorage, writeToStorage, options = {}) {
     if (authHeader && authHeader.startsWith('Bearer tt_')) {
       const rawToken = authHeader.slice('Bearer '.length);
       if (tokenValidator) {
-        const tokenRecord = tokenValidator.validateToken(rawToken);
+        const tokenRecord = await tokenValidator.validateToken(rawToken);
         if (!tokenRecord) {
           // HARD STOP: invalid/expired token must NEVER fall through
           return res.status(401).json({ error: 'Invalid or expired API token' });