fix: keep apiKey encrypted in refresh operation (#13063)

[contip]

What?

Prevents decrypted apiKey from being saved back to database on the auth refresh operation.

Why?

References issue #13063: refreshing a token for a logged-in user decrypted apiKey and wrote it back in plaintext, corrupting the user record.

How?

The user is now fetched with db.findOne instead of findByID, preserving the encryption of the key when saved back to the database using db.updateOne. The user record is then re-fetched using findByID, allowing for the decrypted key to be provided in the response.

Tests

• ✅ keeps apiKey encrypted in DB after refresh
• ✅ returns user with decrypted apiKey after refresh

Fixes #13063

[andershermansen]

@contip I created a PR in your repo to simplify this fix. It just leaves out the ...user and just updates the session. I think that fix is simpler and avoids the double find. See https://github.com/contip/payload/pull/1/files

Removed as this does not work with drizzle/sql, only for mongodb.

[contip]

@contip I created a PR in your repo to simplify this fix. It just leaves out the ...user and just updates the session. I think that fix is simpler and avoids the double find. See https://github.com/contip/payload/pull/1/files

Removed as this does not work with drizzle/sql, only for mongodb.

Yes, I noticed the issue with db.updateOne when looking at this initially, which is why I had to do it like this. I wish this would get reviewed, as this issue affects my production app!