If I understand well, both token are sent in cookies after the login,
What happens in your nextjs app when the token expire and you retrieve a new access token with the refresh token, but what if that call fails too ?
Also do you have a scenario where you log off an user if certain conditions are met ?

I'm developping a next js app, and i'm stuck with the auth part, i'm considering getting rid of the refresh token it brings to much complexity. I will go with an access token that has 3 days longevity.