HOTFIX: how long was this broken?

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "auth-server",
-  "version": "1.8.4",
+  "version": "1.8.6",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "auth-server",
-      "version": "1.8.4",
+      "version": "1.8.6",
       "license": "ISC",
       "dependencies": {
         "bcryptjs": "^2.4.3",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "auth-server",
-  "version": "1.8.4",
+  "version": "1.8.6",
   "description": "An API centric auth server. Uses Sequelize and mariaDB by default.",
   "main": "server/server.js",
   "scripts": {

server/auth/index.js

@@ -27,7 +27,7 @@ router.use(tokenDecode);
 router.use(async (req, res, next) => {
 	const record = await accounts.findOne({
 		where: {
-			email: req.user.email || ''
+			email: req.user?.email || ''
 		}
 	});
 

server/utilities/token-decode.js

@@ -11,7 +11,7 @@ module.exports = (req, res, next) => {
 
 	const decoded = jwt.decode(accessToken);
 
-	req.user = decoded.payload;
+	req.user = decoded;
 
 	return next();
 };