Description

Fixes an authentication bypass in the judge Bearer token middleware. models.NewJudge initializes
Token: "", so any judge inserted via CSV import or single-add (server/router/judge.go:64, :1088,
server/funcs/csv.go:62) sits in Mongo with token: "" until they call /judge/login. The middleware
in server/router/middleware.go only checks len(authHeader) < 7, so an Authorization: Bearer
header (literal "Bearer" + one space) passes the format check, slices to an empty token, and
FindJudgeByToken(db, "") runs FindOne({"token": ""}) — matching the first not-yet-logged-in judge
and authenticating the request as them.

Fix:

• server/router/middleware.go: reject empty token after slicing the Bearer prefix.
• server/database/judge.go: defense-in-depth — FindJudgeByToken short-circuits on empty token so any
  future caller is safe.

Fixes #[Issue]

Type of Change

Delete options that do not apply:

• Bug fix (change which fixes an issue)

Is this a breaking change?

• Yes
• No