Failed refreshToken in jwt should be considered as the same as invalid JWT token

[quangld]

if the refreshToken fails in this below code, it throws new WIKI.Error.AuthGenericError(). This will show the internal error on user's screen.

function authenticate in server\core\auth.js

// Expired but still valid within N days, just renew
...
    try {
        const newToken = await WIKI.models.users.refreshToken(jwtPayload.id)
...
    } catch (errc) {
        WIKI.logger.warn(errc)
        **return next()**
    }
}
// JWT is NOT valid, set as guest
if (!user) {
...
}

My suggestion is to set user to null, skip next(). That means the token is considered invalid.

// Expired but still valid within N days, just renew
...
    try {
        const newToken = await WIKI.models.users.refreshToken(jwtPayload.id)
...
    } catch (errc) {
        WIKI.logger.warn(errc)
        // return next()
        user = null // JWT token is invalid, continue with no user is set
    }
}
// JWT is NOT valid, set as guest
if (!user) {
...
}

Edited: fix formatting