From f58f6a0aa56f7e7806c74d7e5f1330b5717e237c Mon Sep 17 00:00:00 2001
From: XShine555 <xshine555@gmail.com>
Date: Sun, 5 Jul 2026 23:57:19 +0200
Subject: [PATCH] refactor(frontend): require refresh/id token in Session,
 validate at callback boundary

---
 frontend/src/lib/server/auth.ts              | 5 ++---
 frontend/src/routes/auth/callback/+server.ts | 5 ++++-
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/frontend/src/lib/server/auth.ts b/frontend/src/lib/server/auth.ts
index a4fc9c7..fe2d907 100644
--- a/frontend/src/lib/server/auth.ts
+++ b/frontend/src/lib/server/auth.ts
@@ -12,8 +12,8 @@ export const RETURN_COOKIE = 'mf_oidc_return';
 
 export interface Session extends SessionUser {
 	accessToken: string;
-	refreshToken?: string;
-	idToken?: string;
+	refreshToken: string;
+	idToken: string;
 	expiresAt: number;
 }
 
@@ -89,7 +89,6 @@ export function toSessionUser(claims: Record<string, unknown>, fallback?: Sessio
 }
 
 export async function refreshSession(session: Session): Promise<Session | null> {
-	if (!session.refreshToken) return null;
 	try {
 		const config = await getOidcConfig();
 		const tokens = await client.refreshTokenGrant(config, session.refreshToken);
diff --git a/frontend/src/routes/auth/callback/+server.ts b/frontend/src/routes/auth/callback/+server.ts
index 1a65f23..cb6d7f3 100644
--- a/frontend/src/routes/auth/callback/+server.ts
+++ b/frontend/src/routes/auth/callback/+server.ts
@@ -40,9 +40,12 @@ export const GET: RequestHandler = async ({ url, cookies }) => {
 	}
 
 	const claims = tokens.claims();
-	if (!claims) {
+	if (!claims || !tokens.id_token) {
 		error(401, 'El proveedor no devolvió el token de identidad.');
 	}
+	if (!tokens.refresh_token) {
+		error(401, 'El proveedor no devolvió un refresh token; revisa el scope offline_access.');
+	}
 
 	const session: Session = {
 		...toSessionUser(claims),