a bug in sessionMiddleware.js?

Line 46 in fe060c0

const needsToUpdate = !expiresIn || expiresIn < Date.now() - 10 * 60 * 1000;

I think that what you want to do is "when there is no expiresIn or now > 10 minutes before expiresIn, you need to refresh token", so the code should be const needsToUpdate = !expiresIn || expiresIn - 10 * 60 * 1000 < Date.now();.

Ignore me if I'm wrong.

I believe they are equivalent.

If the expiration date is set to a time before now minus 10 minutes? then update

It might be clearer saying

const diff = expiresIn - Date.now();
if (diff < 10 * 60 * 1000) {
  // update, since we always want to have a token that lasts at least for 10 minutes.
}

If expiresIn is 5 minutes before now, then const needsToUpdate = !expiresIn || expiresIn < Date.now() - 10 * 60 * 1000; is false, but actually, we should update the token, because the access token is expired.

True!

Feel free to send a PR so I can merge it.

okay.

#10