Promises would make sense to me, but first step would be to extract stuff into functions.

You don't really need promises for this, though. Here's one way to just do it with plain callbacks:

exports.auth = (request, response, next) ->
  getUsername = (cb) ->
    return cb null, request.body.username unless request.body.email
    
    users.findByEmail request.body.email, (error, result) ->
      cb new InternalServerError(error) if error
      cb null, result[0].username
  
  authenticate = (username) ->
    auth.auth username, request.body.password, (error, result) ->
      return next new InternalServerError(error) if error
      response.json responseData
  
  getUsername (err, username) ->
    return next err if err
    authenticate username

Promises would make sense to me, but first step would be to extract stuff into functions.

You don't really need promises for this, though. Here's one way to just do it with plain callbacks:

exports.auth = (request, response, next) ->
  getUsername = (request, cb) ->
    email = request.body.email
    return cb null, request.body.username unless email
    
    users.findByEmail email, (error, result) ->
      return cb new InternalServerError(error) if error
      cb null, result[0].username
  
  getUsername (err, username) ->
    return next err if err
    auth.auth username, request.body.password, (err, json) ->
      return next err if err
      response.json json