test: assert refresh token rotation and old-token invalidation

internal/services/session_service_test.go

@@ -398,12 +398,23 @@ func TestSessionService_RefreshAccessToken(t *testing.T) {
 		if result.AccessToken == "" {
 			t.Error("expected non-empty access token")
 		}
-		if result.RefreshToken != refreshToken {
+		if result.RefreshToken == "" {
-			t.Errorf("expected refresh token to remain unchanged")
+			t.Error("expected non-empty refresh token")
+		}
+		if result.RefreshToken == refreshToken {
+			t.Errorf("expected refresh token to rotate")
 		}
 		if result.User == nil {
 			t.Fatal("expected non-nil user")
 		}
+
+		_, err = service.RefreshAccessToken(refreshToken)
+		if err == nil {
+			t.Fatal("expected error when using rotated refresh token")
+		}
+		if !errors.Is(err, ErrRefreshTokenInvalid) {
+			t.Errorf("expected ErrRefreshTokenInvalid, got %v", err)
+		}
 	})
 
 	t.Run("invalid refresh token", func(t *testing.T) {