refresh-token: You are not allowed to perform this action

[engincannot]

Plugin version

0.8.4

Payload version

3.42.0

Auth.js version

5.0.0-beta.28

Describe the bug

When I am signing in successfully and calling refresh() from usePayloadSession(); I am getting a 403 Forbidden with {"errors":[{"message":"You are not allowed to perform this action."}]}. Any clue why? This wasn't the case before...

To Reproduce

Additional context / Screenshots

No response

[CrawlerCode]

Do you use other auth strategies or just payload-authjs?

If your are using the local strategy, an 403 error was returned. The fix will be included in the next release.
But otherwise, I couldn't reproduce it.

[engincannot]

Yeah, I was referring to 403 in local strat. Any clue what caused it?

[CrawlerCode]

It was because my refresh hook checks the auth.js session and returns 403 if the user is not found. But I added a check (b2d5469) so that this hook only runs if the user is authenticated using Auth.js.

I'm not sure why this didn't happen earlier.

Should be fixed in v0.9.0

[engincannot]

I've upgraded to v0.9.0 but it's still occurring

[CrawlerCode]

I was unable to reproduce the issue. It works perfectly for me. Please provide a reproduction.