🐛 Catch invalid user refresh

src/ohmyapi/builtin/auth/routes.py

@@ -6,6 +6,7 @@ from fastapi import APIRouter, Body, Depends, Header, HTTPException, Request, st
 from fastapi.security import OAuth2, OAuth2PasswordBearer, OAuth2PasswordRequestForm
 from fastapi.security.utils import get_authorization_scheme_param
 from pydantic import BaseModel
+from tortoise.exceptions import DoesNotExist
 
 from ohmyapi.builtin.auth.models import Group, User
 
@@ -214,7 +215,11 @@ async def refresh_token(refresh_token: TokenRefresh = Body(...)):
         )
 
     user_id = payload.get("sub")
+    try:
         user = await User.get(id=user_id)
+    except DoesNotExist:
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED)
+
     if not user:
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED, detail="User not found"