autoLogin user cannot refresh token when sessions are enabled

Describe the Bug

With admin autoLogin enabled, the admin UI can appear logged in, but a forced token refresh fails with 403 when the auth collection uses the default useSessions: true.

Observed request:

POST /api/users/refresh-token?refresh 403

This happened on Payload 3.80.0 with config like:

admin: {
  user: Users.slug,
  autoLogin: {
    email: 'user@example.com',
    password: 'user@example.com',
  },
  autoRefresh: true,
}

Some of our code called refreshCookie(true). This resulted in a 403->autoLogin->403 loop.

Removing autoLogin / autoRefresh and doing a real login fixed it.

Suspected Cause

autoLogin in auth/strategies/jwt returns a user object, but does not create a session, sign a JWT, set a cookie, or attach _sid.

For auth collections, useSessions defaults to true. The refresh operation then requires req.user._sid:

• JWTAuthentication.autoLogin returns only { user }
• real login creates a session via addSessionToUser and signs sid into the JWT
• refreshOperation throws Forbidden when sessions are enabled and _sid is missing

So the admin can be treated as authenticated via auto-login, but refresh-token cannot refresh because there is no session-backed token to refresh.

Expected Behavior

autoLogin should create a refreshable session/token compatible with refresh-token

Environment

Payload 3.80.0

Start in auth/strategies/jwt at JWTAuthentication.autoLogin, then trace addSessionToUser and refreshOperation to compare auto-login with real login when useSessions is enabled. Done means autoLogin produces a session-backed refreshable token and the forced refresh no longer returns 403 or enters the reported loop.