As answered in this question, Single Page Applications shouldn't be given a refresh token with the OIDC Authorization Code Flow.
Can you indicate some way of getting a new access token when it expires (without interrupting the SPA UX state (no redirects...)?
If the use refresh tokens were the only solutions, what are the ways we can minimize the risk of leakeage? E.g: is storing it in the browser's session storage safe enough? Do IdPs provide a some form of refresh_token expiration, etc.