Don't return 401 if refresh token is invalid, continue like unauthorized

The user don't care if their refresh token expired, the right approach
is to treat them like unauthorized and either allow anonymous access or
redirect to the authorization endpoint.

integration-tests/authorize.test.ts

@@ -48,7 +48,10 @@ describe('Authorize', () => {
 
       when("I make a request to a secured page")
 
-      then("the response status should be {status}", 401)
+      then("the proxy should redirect me to $oidc_server_url/authorize", ({ resp, oauthServerUrl }) => {
+        assert(resp.statusCode === 303)
+        assert(resp.headers.location!.split('?')[0] === `${oauthServerUrl}/authorize`)
+      })
 
       and("session variable {varName} should be cleared", Session.RefreshToken)
     })

src/handlers/auth-access.ts

@@ -26,10 +26,20 @@ export const auth_access: RequestHandler = async (ctx) => {
   const refreshToken = vars[Session.RefreshToken]
   if (refreshToken) {
     log.info?.(`authorize: refreshing token for user ${getCookie(Cookie.Username)}`)
-    const { idToken } = await refreshTokens(ctx, refreshToken)
 
-    exposeClaims(ctx, idToken)
-    return authorizeAccess(ctx, idToken, conf)
+    const tokenSet = await refreshTokens(ctx, refreshToken).catch(err => {
+      if (err.status === 401) {
+        // The refresh token probably just expired, so let's act like the user
+        // is unauthenticated.
+        log.info?.(`authorize: invalid refresh token: ${err.detail ?? err.message}`)
+      } else {
+        throw err
+      }
+    })
+    if (tokenSet) {
+      exposeClaims(ctx, tokenSet.idToken)
+      return authorizeAccess(ctx, tokenSet.idToken, conf)
+    }
   }
 
   if (isAnonymousAllowed(conf)) {

src/handlers/auth-pages.ts

@@ -53,9 +53,19 @@ export const auth_pages: RequestHandler = async (ctx) => {
   const refreshToken = vars[Session.RefreshToken]
   if (refreshToken) {
     log.info?.(`authorize: refreshing token for user ${getCookie(Cookie.Username)}`)
-    const { idToken } = await refreshTokens(ctx, refreshToken)
 
-    return await authorizeAccess(ctx, idToken, accessRule)
+    const tokenSet = await refreshTokens(ctx, refreshToken).catch(err => {
+      if (err.status === 401) {
+        // The refresh token probably just expired, so let's act like the user
+        // is unauthenticated.
+        log.info?.(`authorize: invalid refresh token: ${err.detail ?? err.message}`)
+      } else {
+        throw err
+      }
+    })
+    if (tokenSet) {
+      return await authorizeAccess(ctx, tokenSet.idToken, accessRule)
+    }
   }
 
   if (isAnonymousAllowed(accessRule)) {