Validity checks for a user signup process
This is only a partial review. 

I would declare your constants outside of your functions, as they are constant.
Also, the constants you did declare outside of your functions should be chained.
Finally, you should never call a function more than once. If you are truly using functional-programming then you should do the following:

const required = joi.string().required(),
      loginSchema = joi
  .object({
    appname: required,
    email: required,
    password: required,
  })
  .required();


because a given function must return the same output for the same input.

Rewrite

'use strict';

const bcrypt = require('bcrypt'),
      boom = require('boom'),
      joi = require('joi'),
      flatten = require('lodash/flatten'),
      pick = require('lodash/pick');

const models = require('../../models'),
      { AccessToken, App, User } = models;

const debug = require('debug')('microauth:test');

const userFields = [
    'device',
    'email',
    'firstname',
    'language',
    'lastname',
    'phone',
    'uid',
  ],
      roleFields = ['name', 'description'],
      permissionFields = ['name', 'object', 'action'];

const required = joi.string().required(),
      loginSchema = joi
  .object({
    appname: required,
    email: required,
    password: required,
  })
  .required();

async function run(req, res, next) {
  const { appname, email, password } = await joi.attempt(req.body, loginSchema);

  const app = await getApp(appname);
  (!app) &amp;&amp; (throw boom.badRequest(`Invalid app name: ${appname}.`);)

  (app.isInactive()) &amp;&amp; (throw boom.badRequest('App is not active.');)

  const { isAuthorized, user } = await authorize({ email, password });
  (!user) &amp;&amp; (throw boom.notFound('User not found.');)

  debug(`User ${user.get('email')} is authorised? ${isAuthorized}`);
  (!isAuthorized) &amp;&amp; (throw boom.unauthorized('Invalid email or password.');)

  const { result } = await isUserBelongsToApp(user, app.get('name'));
  (!result) &amp;&amp; (throw boom.badRequest(`User is not authorised to access app.`);)

  return successResponse(email, app.get('secret'), res);
}

async function getApp(name) {
  return await App.findOne({ name });
}

async function authorize({ email, password }) {
  const user = await User.findOne(
    { email, status: 'active' },
    { withRelated: ['apps', 'roles.permissions'] }
  );

  let isAuthorized = false;
  if (user) {
    isAuthorized = await bcrypt.compare(password, user.get('password'));
  }
  return { isAuthorized, user };
}

async function isUserBelongsToApp(user, appname) {
  let result = false;
  let app = null;
  app = user.related('apps').findWhere({ name: appname });
  if (app) {
    result = true;
  }
  return { result, app };
}

async function successResponse(email, secret, res) {

  let user = await User.findOne(
    {
      email: email,
    },
    {
      withRelated: ['roles.permissions'],
    }
  );
  user = user.toJSON();
  const result = Object.assign({}, { ...user });
  result.roles = [];
  result.permissions = [];

  if (user.roles) {
    result.roles = user.roles.map(role =&gt; pick(role, roleFields));
    result.permissions = user.roles.map(role =&gt; {
      return role.permissions.map(permission =&gt;
        pick(permission, permissionFields)
      );
    });
  }
  result.permissions = flatten(result.permissions);
  const { token, expiration } = new AccessToken(secret).create(result);
  res.json({ token, expiration });
}

module.exports = run;