From ddf56db31666314ba45851d5ce898240286eae8a Mon Sep 17 00:00:00 2001
From: Danny Avila <110412045+danny-avila@users.noreply.github.com>
Date: Tue, 17 Oct 2023 08:34:14 -0400
Subject: [PATCH] fix(auth/refresh): send 403 res for invalid token to properly
 invalidate session (#1068)

---
 api/server/controllers/AuthController.js |  4 +++-
 packages/data-provider/src/request.ts    | 19 +++++++++----------
 2 files changed, 12 insertions(+), 11 deletions(-)

diff --git a/api/server/controllers/AuthController.js b/api/server/controllers/AuthController.js
index 240fff465e..96cb526f9f 100644
--- a/api/server/controllers/AuthController.js
+++ b/api/server/controllers/AuthController.js
@@ -112,7 +112,9 @@ const refreshController = async (req, res) => {
       res.status(401).send('Refresh token expired or not found for this user');
     }
   } catch (err) {
-    res.status(401).send('Invalid refresh token');
+    console.error('Refresh token error', refreshToken);
+    console.error(err);
+    res.status(403).send('Invalid refresh token');
   }
 };
 
diff --git a/packages/data-provider/src/request.ts b/packages/data-provider/src/request.ts
index 57d9372f1b..ee2cafa33f 100644
--- a/packages/data-provider/src/request.ts
+++ b/packages/data-provider/src/request.ts
@@ -21,20 +21,19 @@ const processQueue = (error: AxiosError | null, token: string | null = null) =>
 
 axios.interceptors.response.use(
   (response) => response,
-  (error) => {
+  async (error) => {
     const originalRequest = error.config;
     if (error.response.status === 401 && !originalRequest._retry) {
       if (isRefreshing) {
-        return new Promise(function (resolve, reject) {
-          failedQueue.push({ resolve, reject });
-        })
-          .then((token) => {
-            originalRequest.headers['Authorization'] = 'Bearer ' + token;
-            return axios(originalRequest);
-          })
-          .catch((err) => {
-            return Promise.reject(err);
+        try {
+          const token = await new Promise(function (resolve, reject) {
+            failedQueue.push({ resolve, reject });
           });
+          originalRequest.headers['Authorization'] = 'Bearer ' + token;
+          return await axios(originalRequest);
+        } catch (err) {
+          return await Promise.reject(err);
+        }
       }
 
       originalRequest._retry = true;