Description

handleProfile will use the a stale session if getAccessToken updates the session.

On the whole a user should be able to continue to use a refrence to the session after getAccessToken is called, without having to call getSession again.

const session = getSession(req, res);
const { accessToken } = await getAccessToken(req, res);

// If AT was updated, session.accessToken should be updated too
session.accessToken === accessToken;

References

See #294 (comment)

Testing

Given I have Refresh Token Rotation enabled
And I have an expired Access Token
When I visit handleProfile with refetch true
Then I should get an updated profile
And I should get an updated Access Token and Refresh Token

• This change adds test coverage for new/changed/fixed functionality

Checklist

• I have added documentation for new/changed functionality in this PR or in auth0.com/docs
• All active GitHub checks for tests, formatting, and security are passing
• The correct base branch is being used, if not main