check user exists when refresh token

src/webapi/router/router_login.go

@@ -3,6 +3,7 @@ package router
 import (
 	"fmt"
 	"net/http"
+	"strconv"
 	"strings"
 	"time"
 
@@ -116,6 +117,24 @@ func refreshPost(c *gin.Context) {
 			return
 		}
 
+		userid, err := strconv.ParseInt(strings.Split(userIdentity, "-")[0], 10, 64)
+		if err != nil {
+			ginx.NewRender(c, http.StatusUnauthorized).Message("failed to parse user_identity from jwt")
+			return
+		}
+
+		u, err := models.UserGetById(userid)
+		if err != nil {
+			ginx.NewRender(c, http.StatusInternalServerError).Message("failed to query user by id")
+			return
+		}
+
+		if u == nil {
+			// user already deleted
+			ginx.NewRender(c, http.StatusUnauthorized).Message("user already deleted")
+			return
+		}
+
 		// Delete the previous Refresh Token
 		err = deleteAuth(c.Request.Context(), refreshUuid)
 		if err != nil {