HOTFIX: how long was this broken?

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "auth-server",
-  "version": "1.8.3",
+  "version": "1.8.6",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "auth-server",
-      "version": "1.8.3",
+      "version": "1.8.6",
       "license": "ISC",
       "dependencies": {
         "bcryptjs": "^2.4.3",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "auth-server",
-  "version": "1.8.3",
+  "version": "1.8.6",
   "description": "An API centric auth server. Uses Sequelize and mariaDB by default.",
   "main": "server/server.js",
   "scripts": {

server/auth/index.js

@@ -27,7 +27,7 @@ router.use(tokenDecode);
 router.use(async (req, res, next) => {
 	const record = await accounts.findOne({
 		where: {
-			email: req.user.email || ''
+			email: req.user?.email || ''
 		}
 	});
 

server/utilities/token-decode.js

@@ -9,13 +9,9 @@ module.exports = (req, res, next) => {
 		return res.status(401).send('No access token provided');
 	}
 
-	return jwt.decode(accessToken, process.env.SECRET_ACCESS, (err, user) => {
-		if (err) {
-			return res.status(403).send(err);
-		}
+	const decoded = jwt.decode(accessToken);
 
-		req.user = user;
+	req.user = decoded;
 
-		return next();
-	});
+	return next();
 };

tools/react/token-provider.jsx

@@ -48,6 +48,9 @@ const TokenProvider = props => {
 			//ping the auth server for a new access token
 			const response = await fetch(`${process.env.AUTH_URI}/auth/token`, {
 				method: 'POST',
+				headers: {
+					'Authorization': `Bearer ${bearer}`
+				},
 				credentials: 'include'
 			});
 
@@ -79,6 +82,9 @@ const TokenProvider = props => {
 
 	//access the refreshed token via callback
 	const tokenCallback = async (cb) => {
+		//use this?
+		let bearer = accessToken;
+
 		//if expired (10 minutes, normally)
 		const expired = new Date(decode(accessToken).exp) < Date.now() / 1000;
 
@@ -86,6 +92,9 @@ const TokenProvider = props => {
 			//ping the auth server for a new token
 			const response = await fetch(`${process.env.AUTH_URI}/auth/token`, {
 				method: 'POST',
+				headers: {
+					'Authorization': `Bearer ${bearer}`
+				},
 				credentials: 'include'
 			});