Token properties only update on page reload

[R3M0TED]

Hey all, this has been driving me absolutely insane lately trying to figure out whats going on. For some reason, when the JWT callback on my app runs, and the access/refresh token is refreshed, its not actually updating the properties on the token, user and session objects. Weirdly enough - if I refresh the actual page, the tokens seem to update perfectly fine, this only doesn't work when the JWT callback updates naturally or by making requests

auth-options.ts:

import { AuthOptions } from "next-auth";
import CredentialsProvider from "next-auth/providers/credentials";
import { serverApiPost } from "@/lib/api/helpers/server-api-methods";
import { PostAuthenticationRequestDto } from "@/lib/api/dtos/authentication/requests/post-authentication-request-dto";
import { PostAuthenticationResponseDto } from "@/lib/api/dtos/authentication/responses/post-authentication-response-dto";
import { PostRefreshTokenRequestDto } from "@/lib/api/dtos/authentication/requests/post-refresh-token-request-dto";
import { PostRefreshTokenResponseDto } from "@/lib/api/dtos/authentication/responses/post-refresh-token-response-dto";

const refreshToken = async (refreshToken: string) => {
  console.log(`Refreshing token with refresh token: ${refreshToken}`);

  const body: PostRefreshTokenRequestDto = {
    refreshToken: refreshToken,
  };
  const response = await serverApiPost<
    PostRefreshTokenResponseDto,
    PostRefreshTokenRequestDto
  >("/auth/refresh", body, { auth: false, service: "authentication" });

  console.log(`Recieved refresh token ${response.refreshToken}`)
  return response
}


export const authOptions: AuthOptions = {
  providers: [
    CredentialsProvider({
      name: "Credentials",
      credentials: {
        username: { label: "Username", type: "text" },
        password: { label: "Password", type: "password" },
      },
      async authorize(credentials) {
        if (!credentials?.username || !credentials?.password) return null;

        const response = await serverApiPost<
          PostAuthenticationResponseDto,
          PostAuthenticationRequestDto
        >(
          "/auth/login",
          { username: credentials.username, password: credentials.password },
          { auth: false, service: "authentication" }
        );

        console.log(`Authenticated and received refresh token: ${response.refreshToken}`);

        return {
          id: response.userId.toString(),
          accessToken: response.accessToken,
          refreshToken: response.refreshToken,
          expiresAt: response.expiresAt,
        };
      },
    }),
  ],

  session: { strategy: "jwt", maxAge: 60 * 300 },
  callbacks: {
    async jwt({ token, user, account }) {

      if (account && user) {
        token.accessToken = user.accessToken
        token.refreshToken = user.refreshToken
        token.expiresAt = user.expiresAt
      }

      const REFRESH_BUFFER_MS = 5_000;
      if (!token.expiresAt || Date.now() >= token.expiresAt - REFRESH_BUFFER_MS) {
        console.log(`TOKEN ABOUT TO EXPIRE: ${token.expiresAt}`)
        const response = await refreshToken(token.refreshToken || '')
        token.accessToken = response.accessToken
        token.refreshToken = response.refreshToken
        token.expiresAt = response.expiresAt
      }

      return token
    },

    async session({ session, token }) {
      session.accessToken = token.accessToken;
      session.refreshToken = token.refreshToken;
      session.expiresAt = token.expiresAt

      return session;
    },
  },
};

next-auth.d.ts:

import NextAuth from "next-auth";
import "next-auth/jwt";

declare module "next-auth" {
  interface Session {
    accessToken?: string;
    refreshToken?: string;
    expiresAt?: number;
  }

  interface User {
    accessToken?: string;
    refreshToken?: string;
    expiresAt?: number;
  }

}

declare module "next-auth/jwt" {
  interface JWT {
    accessToken?: string;
    refreshToken?: string;
    expiresAt?: number;
  }
}

Logs:

 GET /api/user/search?username=wwwwww 200 in 34ms (compile: 1925µs, render: 32ms)
Current access token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiI0MThiNjZmYS1mMDg4LTRkYjgtYWYyNC00ZGFlOTAxMDg4MTUiLCJ1bmlxdWVfbmFtZSI6ImN3MDMiLCJqdGkiOiIzYzQyY2Y0Ni0yZWUxLTQxZjQtOWUzNy1hNzdiZjQ4MjAwYmUiLCJlbWFpbCI6ImNocmlzd2VsbHMyMDAxMjNAb3V0bG9vay5jb20iLCJleHAiOjE3NjU4MDE5MjUsImlzcyI6IlRlc3RGbHV4U2VydmVyIiwiYXVkIjoiVGVzdEZsdXhDbGllbnQifQ.NVxLnLYD8tz3Mjez1ZDwgYJgLdqE4x3ZiUKrhfeK_Bo
TOKEN ABOUT TO EXPIRE: 1765801925296
Refreshing token with refresh token: Lo7sO2Nt0Al/RSGtIHBlI9cP6LOkcPMYBeCbJzsAS/4=
Recieved refresh token JNrRIlHcAj6ITB9yrKSSWRkoP4dsmGma40SPGzaTJL0=
New access token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiI0MThiNjZmYS1mMDg4LTRkYjgtYWYyNC00ZGFlOTAxMDg4MTUiLCJ1bmlxdWVfbmFtZSI6ImN3MDMiLCJqdGkiOiI1MjNmNWQxZS1kMzZkLTQ4ZDQtOTE1ZC1hN2MyZTU0OWZlZjMiLCJlbWFpbCI6ImNocmlzd2VsbHMyMDAxMjNAb3V0bG9vay5jb20iLCJleHAiOjE3NjU4MDE5ODUsImlzcyI6IlRlc3RGbHV4U2VydmVyIiwiYXVkIjoiVGVzdEZsdXhDbGllbnQifQ.2qXTPpYAVGZikGC-Ehn2xNvXrFTzln8PQ8YkDuobatM
 GET /api/user/search?username=wwwwwww 200 in 49ms (compile: 1709µs, render: 47ms)
Current access token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiI0MThiNjZmYS1mMDg4LTRkYjgtYWYyNC00ZGFlOTAxMDg4MTUiLCJ1bmlxdWVfbmFtZSI6ImN3MDMiLCJqdGkiOiIzYzQyY2Y0Ni0yZWUxLTQxZjQtOWUzNy1hNzdiZjQ4MjAwYmUiLCJlbWFpbCI6ImNocmlzd2VsbHMyMDAxMjNAb3V0bG9vay5jb20iLCJleHAiOjE3NjU4MDE5MjUsImlzcyI6IlRlc3RGbHV4U2VydmVyIiwiYXVkIjoiVGVzdEZsdXhDbGllbnQifQ.NVxLnLYD8tz3Mjez1ZDwgYJgLdqE4x3ZiUKrhfeK_Bo
TOKEN ABOUT TO EXPIRE: 1765801925296
Refreshing token with refresh token: Lo7sO2Nt0Al/RSGtIHBlI9cP6LOkcPMYBeCbJzsAS/4=
Recieved refresh token 1SCwi8Nib+dPcMDc0VgVZY6dK7/uRUrLcOwh6bsQL5k=
New access token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiI0MThiNjZmYS1mMDg4LTRkYjgtYWYyNC00ZGFlOTAxMDg4MTUiLCJ1bmlxdWVfbmFtZSI6ImN3MDMiLCJqdGkiOiIyNWJlNjRmZS1mMmQ2LTQwZjUtOTg5ZS00OGVlYWJjZTg0ZWQiLCJlbWFpbCI6ImNocmlzd2VsbHMyMDAxMjNAb3V0bG9vay5jb20iLCJleHAiOjE3NjU4MDE5ODUsImlzcyI6IlRlc3RGbHV4U2VydmVyIiwiYXVkIjoiVGVzdEZsdXhDbGllbnQifQ.xHhPG50PfbeTzSUfcG9hknMNHITZqW3ayCMnu-DtD3Y
 GET /api/user/search?username=wwwwwwww 200 in 44ms (compile: 1934µs, render: 42ms)

From the logs, we can clearly see that the old refresh/tokens are still being used in subsequent requests - does anyone have any ideas on this? I'm using getServerSession to make the calls from my frontend server to my backend server.