refactor(frontend): require refresh/id token in Session, validate at callback boundary

2026-07-05 23:57:19 +02:00
parent 757c74b899
commit dadeac3571
2 changed files with 6 additions and 4 deletions
@@ -40,9 +40,12 @@ export const GET: RequestHandler = async ({ url, cookies }) => {
 	}

 	const claims = tokens.claims();
-	if (!claims) {
+	if (!claims || !tokens.id_token) {
 		error(401, 'El proveedor no devolvió el token de identidad.');
 	}
+	if (!tokens.refresh_token) {
+		error(401, 'El proveedor no devolvió un refresh token; revisa el scope offline_access.');
+	}

 	const session: Session = {
 		...toSessionUser(claims),