Use old id_token if new id_token not in refresh response

[wryrye]

Description

In the case where a new id_token is not present in a refresh response, let's avoid setting id_token to undefined and instead use the old id_token!

References

Issue: #628

Testing

1. Make a refresh request (req.oidc.accessToken.refresh()) where the response is missing an id_token
2. Confirm subsequent accesses of req.oidc.idToken and req.oidc.user are NOT undefined

• This change adds test coverage for new/changed/fixed functionality

Checklist

• I have added documentation for new/changed functionality in this PR or in auth0.com/docs
• All active GitHub checks for tests, formatting, and security are passing
• The correct base branch is being used, if not the default branch

[Copilot]

Pull Request Overview

This PR fixes an issue where the id_token would be set to undefined when a refresh response doesn't include a new ID token. The change ensures the existing valid ID token is preserved in such cases.

• Updates the token refresh logic to fallback to the old id_token when a new one isn't provided
• Maintains consistency with the existing fallback pattern used for refresh_token

Comments suppressed due to low confidence (1)

lib/context.js:54

• The new fallback logic for ID tokens lacks test coverage. Based on the PR description, tests should be added to verify that req.oidc.idToken and req.oidc.user remain accessible when refresh responses don't include an id_token.

    id_token: newTokenSet.id_token || oldTokenSet.id_token,

[Copilot]

Using the old ID token without validating its expiration could lead to security issues. Consider checking if the old ID token is still valid (not expired) before using it as a fallback.

Suggested change

	id_token: newTokenSet.id_token || oldTokenSet.id_token,
	id_token: newTokenSet.id_token || (isTokenValid(oldTokenSet.id_token) ? oldTokenSet.id_token : undefined),