auth-node: Refresh handler not returning persisted scope in response

The refresh handler is returning an empty scope if scope was previously
saved in a cookie. The session is successfully refreshed but the client
receives a response without the scope it requested, prompting a new
login.

Resolves #20322

Signed-off-by: Adam Kunicki <kunickiaj@gmail.com>

.changeset/stale-stingrays-explode.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-node': patch
+---
+
+Fixed cookie persisted scope not returned in OAuth refresh handler response.

plugins/auth-node/src/oauth/createOAuthRouteHandlers.ts

@@ -320,7 +320,9 @@ export function createOAuthRouteHandlers<TProfile>(
           providerInfo: {
             idToken: result.session.idToken,
             accessToken: result.session.accessToken,
-            scope: result.session.scope,
+            scope: authenticator.shouldPersistScopes
+              ? scope
+              : result.session.scope,
             expiresInSeconds: result.session.expiresInSeconds,
           },
         };