Custom Oauth seems to not respect token lifetime

Description:

RocketChat server seems to be handling the session lifetime on it's own, as opposed to respecting the accessToken lifetime, using the refreshToken to update the accessToken, and forcing the user to re-login in the case that they have both expired.

Steps to reproduce:

1. Configure login via custom Oauth
2. In Oauth (in our case keyclaok) set i.e. accessToken lifetime to 8h and refreshToken lifetime to 5 min
3. After both token expire user is still logged

Expected behavior:

• server should respect the accessToken lifetime (in our case 2 hours).
• when a client opens a new session, if the accessToken has expired, the RC server should request a new access token from the Oauth provider, using the refreshToken The RC server would then receive both a new accessToken and refreshToken in the response

Actual behavior:

User is logged after tokens expired

Server Setup Information:

• Version of Rocket.Chat Server: 3.6.3
• Operating System: Centos7
• Deployment Method: docker-compose
• Number of Running Instances: 30
• DB Replicaset Oplog: YES
• NodeJS Version: v12.16.1
• MongoDB Version: 4.0.16

Client Setup Information

• Desktop App or Browser Version: both
• Operating System: Windows 10

Additional context

Relevant logs:

Start by reproducing the custom OAuth flow with the stated Keycloak token lifetimes and checking how Rocket.Chat handles sessions after accessToken and refreshToken expiry. Trace the server-side session and token handling, then verify that expired tokens trigger refresh or re-login as described.