Hello. I am trying to manually test the auth route (http://localhost:3500/auth) using Thunder Client. and I'm getting the following error:

POST /auth
cookie available at login: {}
/refresh_token_rotation/controllers/authController.js:67
        foundUser.refreshToken = [...newRefreshTokenArray, newRefreshToken];
                                     ^

TypeError: newRefreshTokenArray is not iterable
    at handleLogin (/refresh_token_rotation/controllers/authController.js:67:38)

Node.js v18.12.1
[nodemon] app crashed - waiting for file changes before starting...

It appears to be happening here:

        // Saving refreshToken with current user
        foundUser.refreshToken = [...newRefreshTokenArray, newRefreshToken];
        const result = await foundUser.save();
        console.log(result);
        console.log(roles);

Hello dear Dave, In the authController.js you set cookie like
res.cookie('jwt', newRefreshToken, { httpOnly: true, secure: true, sameSite: 'None', maxAge: 24 * 60 * 60 * 1000 });
But you don't specify Path, so refresh token will be send on every http request. Isn't this a problem? Doesn't this increase the risk that the token will be stolen?

And if you did it on purpose, why not add to verifyJWT an update of the access token if it expired. It would be better for the user, because he would update his token silently, and would not get any error

P.S. I am a beginner in backend, sorry if this question is silly