fix(core): return user and expires in session

[halvaradop]

Description

This pull request fixes the session returned by the refreshUserInfo() APIs (both the server-side API and the HTTP endpoint).

Previously, refreshUserInfo() returned an incomplete session object that omitted the user and expires fields, making its response inconsistent with other session-related APIs such as api.getSession() and api.updateSession().

With this change, refreshUserInfo() now returns the complete session object, providing a consistent API across all session management functions.

Key Changes

• Fixed the session returned by refreshUserInfo().
• Added the missing user field to the returned session.
• Added the missing expires field to the returned session.
• Standardized the response format with api.getSession() and api.updateSession().

Comparison

{
+ user: {
    sub: "1234567890",
    name: "John Doe",
    email: "john@example.com",
    image: "https://image.com",
  },
+ expires: "2026-01-01T00:00:00Z"
}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
auth	Skipped		Jul 26, 2026 2:28am

[coderabbitai]

📝 Walkthrough

Walkthrough

Session parsing now returns structured { user, expires } data, refresh responses derive success from session presence, and stateless session and user-info tests validate the updated response, token, cookie, and CSRF behavior.

Changes

Stateless session contract

Layer / File(s)	Summary
Session shaping and refresh response packages/core/src/shared/utils.ts, packages/core/src/api/refreshUserInfo.ts	Verified claims are converted into nested user sessions with expiration data, while refresh responses report success based on session creation.
Session retrieval validation packages/core/test/api/stateless/getSession.test.ts	Tests validate structured success and failure responses, filtered claims, cookie clearing, and refreshed token contents.
Refresh user info integration packages/core/test/actions/providers/user/stateless.test.ts, packages/core/test/api/stateless/refreshUserInfo.test.ts	Provider refresh, cookie update, response serialization, custom profiles, and CSRF scenarios now assert the nested session shape.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• aura-stack-ts/auth#219: Introduces the related refreshUserInfo API and session shaping changes.
• aura-stack-ts/auth#222: Refactors the refreshUserInfo and getStandardSession validation pipeline.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly matches the main change: sessions now return user and expires instead of raw claims.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/return-user

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/core/src/api/refreshUserInfo.ts`:
- Around line 94-106: Update the refresh response construction around
getStandardSession so a null parsed session is treated as a refresh failure
instead of returning status 200 with success false. Before returning the
RefreshUserInfoAPIReturn, either throw the parsing error or clear the newly
issued session cookie and return an appropriate error response; ensure malformed
provider profiles cannot replace a valid session with an unusable token.

In `@packages/core/test/api/stateless/getSession.test.ts`:
- Around line 104-105: Update both decoded-cookie assertions in
packages/core/test/api/stateless/getSession.test.ts at lines 104-105 and 135-136
to explicitly verify the refreshed session cookies do not contain role or
permissions, while retaining the existing sessionPayload matching. Apply the
same absence checks to the rolling-refresh cookie assertion.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 813312f1-93cb-48e3-9125-ee1fc761a29c

📥 Commits

Reviewing files that changed from the base of the PR and between 55ec1c9 and 710c19a.

📒 Files selected for processing (5)

• packages/core/src/api/refreshUserInfo.ts
• packages/core/src/shared/utils.ts
• packages/core/test/actions/providers/user/stateless.test.ts
• packages/core/test/api/stateless/getSession.test.ts
• packages/core/test/api/stateless/refreshUserInfo.test.ts