Failed refreshToken in jwt should be considered as the same as invalid JWT token

if the refreshToken fails in this below code, it throws new WIKI.Error.AuthGenericError(). This will show the internal error on user's screen.

function authenticate in server\core\auth.js

// Expired but still valid within N days, just renew
...
    try {
        const newToken = await WIKI.models.users.refreshToken(jwtPayload.id)
...
    } catch (errc) {
        WIKI.logger.warn(errc)
        **return next()**
    }
}
// JWT is NOT valid, set as guest
if (!user) {
...
}

My suggestion is to set user to null, skip next(). That means the token is considered invalid.

// Expired but still valid within N days, just renew
...
    try {
        const newToken = await WIKI.models.users.refreshToken(jwtPayload.id)
...
    } catch (errc) {
        WIKI.logger.warn(errc)
        // return next()
        user = null // JWT token is invalid, continue with no user is set
    }
}
// JWT is NOT valid, set as guest
if (!user) {
...
}

Edited: fix formatting