[api] Refreshing access token works but causes error to be logged

[mhilbush]

• Version of ZoneMinder: 1.34.5
• How you installed ZoneMinder: PPA
• Full name and version of OS: Ubuntu 18.04 LTS
• Browser name and version: N/A
• API Version: 2.0

The documentation recommends refreshing an access token prior to it expiring. However, while the refresh is successful, refreshing an access token before it expires generates an error in the log.

To Reproduce

1. POST to the login API with content of user id and password. The API responds with a JSON object containing both the refresh and access tokens.
2. Just prior to the access token expiring (in my case I used 5 minutes before expiration), GET the login API with the refresh token as the query parameter (i.e. /zm/api/host/login.json?token=. The API responds with a JSON object containing the new access token.
3. The access token is successfully refreshed, but an error is logged.

03/03/20 07:40:34.255301 web_php[22152].ERR [192.168.xxx.yyy] [Token type mismatch. Expected access but got refresh] at /usr/share/zoneminder/www/includes/auth.php line 129

Here's the decoded refresh token used in step 2 above.

{
  "iss": "ZoneMinder",
  "iat": 1583174342,
  "exp": 1583260742,
  "user": "xxxxx",
  "type": "refresh"
}

I'm not sure why it's expecting the access token. The code looks like it's setting the allowed token type to refresh in the call to validateToken.

Expected behavior
Refreshing an access token should not generate an error in the log

[mhilbush]

Confirming this is fixed in 1.34.6. Thank you.