I wonder how refresh work in https://packagist.org/packages/php-open-source-saver/jwt-auth. What I know about JWT is that when a user logs in, the system should give them an access token and a refresh token.

For example, if the access token’s lifetime is 5 minutes and the refresh token’s lifetime is one day, then when the access token expires, the frontend automatically sends a request to the refresh link with the refresh token as a parameter. The backend checks the refresh token, and if it’s valid and not expired, it updates the access token.

protected function respondWithToken($token){
        return response()->json([
        'access_token' => $token,
        'token_type' => 'bearer',
        'expires_in' => auth()->factory()->getTTL() * 60
    ]);
}

Then, when sending a request to refresh, it updates it like this:

public function refresh()
{
    return $this->respondWithToken(auth()->refresh());
}

So, I wonder how it checks if it’s the correct user. Why is there no refresh token? How does it work? Also, I need to add claims like permissions and roles to the JWT payload. Can I do it with this package?