Auth Middleware Null User Crash

Version: 1.1.0 Date: 2026-07-15

Goal: Fix an unhandled crash when getApiTokenUser returned null instead of rejecting the request, which could surface as a 500 on authenticated routes (including certificate ZIP during early Hotep integration testing).

Solution: getApiTokenUser now throws Error('Api token not found') instead of returning null. The authorization middleware .catch path maps this to a proper 401.

Implementation Details:

• Removes ambiguous null user on req.user — middleware always either attaches a user or rejects
• Simplifies the catch flow in authorization.middleware.ts (no null-guard branches downstream)

Files Modified:

• src/core/auth/auth.service.ts - Throw instead of return null
• src/core/auth/middleware/authorization.middleware.ts - Simplified catch flow