refactor(frontend): require refresh/id token in Session, validate at callback boundary

frontend/src/lib/server/auth.ts

@@ -12,8 +12,8 @@ export const RETURN_COOKIE = 'mf_oidc_return';
 
 export interface Session extends SessionUser {
 	accessToken: string;
-	refreshToken?: string;
+	refreshToken: string;
-	idToken?: string;
+	idToken: string;
 	expiresAt: number;
 }
 
@@ -89,7 +89,6 @@ export function toSessionUser(claims: Record<string, unknown>, fallback?: Sessio
 }
 
 export async function refreshSession(session: Session): Promise<Session | null> {
-	if (!session.refreshToken) return null;
 	try {
 		const config = await getOidcConfig();
 		const tokens = await client.refreshTokenGrant(config, session.refreshToken);

frontend/src/routes/auth/callback/+server.ts

@@ -40,9 +40,12 @@ export const GET: RequestHandler = async ({ url, cookies }) => {
 	}
 
 	const claims = tokens.claims();
-	if (!claims) {
+	if (!claims || !tokens.id_token) {
 		error(401, 'El proveedor no devolvió el token de identidad.');
 	}
+	if (!tokens.refresh_token) {
+		error(401, 'El proveedor no devolvió un refresh token; revisa el scope offline_access.');
+	}
 
 	const session: Session = {
 		...toSessionUser(claims),