HOTFIX: kick banned accounts

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "auth-server",
-  "version": "1.8.0",
+  "version": "1.8.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "auth-server",
-      "version": "1.8.0",
+      "version": "1.8.1",
       "license": "ISC",
       "dependencies": {
         "bcryptjs": "^2.4.3",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "auth-server",
-  "version": "1.8.0",
+  "version": "1.8.1",
   "description": "An API centric auth server. Uses Sequelize and mariaDB by default.",
   "main": "server/server.js",
   "scripts": {

server/auth/index.js

@@ -11,9 +11,6 @@ router.post('/signup', require('./signup'));
 router.get('/validation', require('./validation'));
 router.post('/login', require('./login'));
 
-//refresh token
-router.post('/token', require('./token'));
-
 //password recover and reset
 router.post('/recover', require('./password-recover'));
 router.get('/reset', require('./password-redirect'));
@@ -23,8 +20,6 @@ router.patch('/reset', require('./password-reset'));
 router.delete('/logout', require('./logout'));
 
 //middleware
-router.use(tokenAuth);
-
 router.use(async (req, res, next) => {
 	const record = await accounts.findOne({
 		where: {
@@ -43,6 +38,12 @@ router.use(async (req, res, next) => {
 	next();
 });
 
+//refresh token
+router.post('/token', require('./token'));
+
+//authenticate token
+router.use(tokenAuth);
+
 //basic account management (needs a token)
 router.get('/account', require('./account-query'));
 router.patch('/account', require('./account-update'));

tools/react/token-provider.jsx

@@ -31,7 +31,7 @@ const TokenProvider = props => {
 		let bearer = accessToken;
 
 		//if expired (10 minutes, normally)
-		const expired = new Date(decode(accessToken).exp * 1000) < Date.now();
+		const expired = new Date(decode(accessToken).exp) < Date.now() / 1000;
 
 		if (expired) {
 			//BUGFIX: if logging out, just skip over the refresh token
@@ -80,7 +80,7 @@ const TokenProvider = props => {
 	//access the refreshed token via callback
 	const tokenCallback = async (cb) => {
 		//if expired (10 minutes, normally)
-		const expired = new Date(decode(accessToken).exp * 1000) < Date.now();
+		const expired = new Date(decode(accessToken).exp) < Date.now() / 1000;
 
 		if (expired) {
 			//ping the auth server for a new token