Fixed a nasty async race condition

server/utilities/token-destroy.js

@@ -1,7 +1,7 @@
 const { tokens } = require('../database/models');
 
-module.exports = (refreshToken) => {
-	tokens.destroy({
+module.exports = async (refreshToken) => {
+	await tokens.destroy({
 		where: {
 			token: refreshToken || ''
 		}

server/utilities/token-generate-refresh.js

@@ -2,7 +2,7 @@ const jwt = require('jsonwebtoken');
 const { tokens } = require('../database/models');
 
 //generates a JWT token based on the given arguments
-module.exports = (index, email, username, type, admin, mod) => {
+module.exports = async (index, email, username, type, admin, mod) => {
 	const content = {
 		index,
 		email,
@@ -16,7 +16,7 @@ module.exports = (index, email, username, type, admin, mod) => {
 	const accessToken = jwt.sign(content, process.env.SECRET_ACCESS, { expiresIn: '10m', issuer: 'auth' });
 	const refreshToken = jwt.sign(content, process.env.SECRET_REFRESH, { expiresIn: '30d', issuer: 'auth' });
 
-	tokens.create({ token: refreshToken, email: email });
+	await tokens.create({ token: refreshToken, email: email });
 
 	return { accessToken, refreshToken };
 };

server/utilities/token-refresh.js

@@ -19,15 +19,15 @@ module.exports = async (oldRefreshToken, callback) => {
 		return callback(403);
 	}
 
-	jwt.verify(oldRefreshToken, process.env.SECRET_REFRESH, (err, user) => {
+	jwt.verify(oldRefreshToken, process.env.SECRET_REFRESH, async (err, user) => {
 		if (err) {
 			return callback(403);
 		}
 
-		const { accessToken, refreshToken } = generate(user.index, user.email, user.username, user.type, user.admin, user.mod);
+		await destroy(oldRefreshToken);
 
-		destroy(oldRefreshToken);
+		const { accessToken, refreshToken } = await generate(user.index, user.email, user.username, user.type, user.admin, user.mod);
 
-		return callback(null, accessToken, refreshToken);
+		return await callback(null, accessToken, refreshToken);
 	});
 };