fix: return null user when access token is expired in withAuth

[nicknisi]

Summary

• Changed withAuth to return { user: null } when access token is expired
• Updated warning message to be more descriptive with [AuthKit] prefix
• This prevents developers from accidentally using expired tokens

Problem

Users reported that withAuth returns expired access tokens with just a console warning, making it difficult to know the token is expired without manually decoding it. This leads to confusing errors downstream when the expired token is used with WorkOS APIs.

Solution

When the access token is expired, withAuth now returns { user: null } instead of returning the expired token data. This provides:

• Consistent API: Expired auth is treated the same as no auth
• Safe by default: No risk of using expired tokens
• Simple mental model: Either you have valid auth or you don't
• Backward compatible: Code checking if (auth.user) continues to work correctly

Test plan

• Updated test to verify new behavior
• All existing tests pass
• Manual testing confirms expired tokens return null user

[greptile-apps]

Greptile Summary

This PR modifies the withAuth function in the AuthKit React Router library to handle expired access tokens more safely. Previously, when an access token was expired, withAuth would return the expired token data along with a console warning, allowing developers to accidentally use invalid tokens downstream.

The change updates the behavior so that when an access token is expired (determined by comparing the current timestamp against the token's exp claim), the function now returns { user: null } instead of the expired token data. This aligns the behavior with cases where no session exists at all, creating a consistent API where expired authentication is treated the same as no authentication.

The warning message has also been improved with an [AuthKit] prefix and more descriptive text that guides developers to ensure authkitLoader is used in a parent/root route for automatic token refresh handling.

This change integrates well with the existing codebase architecture where authentication state is checked via if (auth.user) patterns throughout applications. The modification maintains backward compatibility since existing conditional checks will continue to work correctly, but provides a safer default by preventing the accidental use of expired tokens that could cause confusing API errors downstream.

Confidence score: 4/5

• This PR is safe to merge with low risk as it improves security and user experience
• Score reflects well-tested changes with clear benefits, though it's a behavioral change that could affect some edge cases
• Pay close attention to src/auth.ts to ensure the token expiration logic is correct

_{2 files reviewed, no comments}

_{Edit Code Review Bot Settings | Greptile}