send empty array for user permissions if null

ref #12

src/models/actions/RefreshAuth.ts

@@ -28,6 +28,7 @@ export class RefreshAuth {
         if (found_user.refreshTokenCount !== decoded["refreshtokencount"]) {
             throw new RefreshTokenCountInvalidError()
         }
+        found_user.permissions = found_user.permissions || []
         delete found_user.password;
         const timestamp_accesstoken_expiry = Math.floor(Date.now() / 1000) + 5 * 60
         delete found_user.password;