fix: make sure beforeSessionSaved hook gets the updated token after refresh

[tusharpandey13]

Fixes: #2370

beforeSessionSaved was not provided with the updated access token in getAccessToken() and connectAccount(), leading to it operating on stale AT.

Changes

• auth-client.ts: merged sessionChanges with existing session and THEN passed to finalizeSession (this calls beforeSessionSaved)
• beforeSessionSaved-token-refresh-flow.test.ts: added flow test cases that ensure that beforeSessionSaved is called with updated tokens after token refresh.

References

• https://github.com/auth0/nextjs-auth0/blob/main/EXAMPLES.md#beforesessionsaved

Tests

PASSING

[tusharpandey13]

@claude please review this PR

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.65%. Comparing base (df1725e) to head (6e41313).
⚠️ Report is 9 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2387      +/-   ##
==========================================
+ Coverage   87.61%   87.65%   +0.04%     
==========================================
  Files          37       37              
  Lines        4086     4084       -2     
  Branches      809      809              
==========================================
  Hits         3580     3580              
+ Misses        503      501       -2     
  Partials        3        3              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Claude finished @tusharpandey13's task —— View job

---

PR Review

• Read PR diff
• Read project documentation
• Analyze changed files
• Perform code quality review
• Perform security review
• Perform performance review
• Provide inline feedback
• Post overall assessment

Overall Assessment

✅ This PR is ready to be merged. The fix correctly addresses a bug where beforeSessionSaved was receiving stale session data instead of the updated session with refreshed tokens. The implementation is clean, the test coverage is comprehensive, and no security or performance concerns were identified.

What was fixed:

• Root cause: In handleAccessToken and completeConnectAccountCallback, the finalizeSession method was called with the original session object, then the sessionChanges were merged afterward. This meant beforeSessionSaved hook received outdated token data.
• Solution: Merge sessionChanges into session before calling finalizeSession, ensuring hooks receive the complete updated session with refreshed tokens.
• Test coverage: Added a comprehensive integration test (164 lines) that validates the fix across HTTP, session hook, and persistence layers.

Changes reviewed:

• src/server/auth-client.ts: Two locations fixed (lines 936-940 and 1059-1067)
• src/server/auth-client.test.ts: Comprehensive test added with multi-layer validation

---

Job Run | Branch: bugfix/beforesessionsaved-behaviour