quarkus-oidc loses a refresh token if the provider does not recycle it during the refresh token grant

[sberyozkin]

Describe the bug

quarkus-oidc, once it completes the code flow, keeps ID, access and refresh tokens concatenated in a single cookie or split into 3 separate cookies. The lifetime of all of these cookies is set to the age of the ID token plus some extra configurable duration.
If the session is about to expire and quarkus-oidc is allowed to auto-refresh it then it will use the refresh token to refresh ID and access tokens, and if a provider such as Keycloak supports a recommended RT recycling (to minimize the risk of RT being stolen), a new refresh token will be returned.

However if a provider does not return a RT with a RT grant, then the original RT, if it is still valid should stay around - but unfortunately it is gone since quarkus-oidc deletes the session related cookies when auto-refreshing.

It needs to be investigated if it can be properly addressed by default - it is not a real blocker since if RT is not available - the side-affect is that the user will have to re-authenticate manually when the session has expired - but it does effect a user experience.

Perhaps the best option is to use a custom TokenStateManager in such cases

Expected behavior

No response

Actual behavior

No response

How to Reproduce?

No response

Output of uname -a or ver

No response

Output of java -version

No response

GraalVM version (if different from Java)

No response

Quarkus version or git rev

No response

Build tool (ie. output of mvnw --version or gradlew --version)

No response

Additional information

No response

[quarkus-bot]

/cc @pedroigor