As answered in this question, Single Page Applications shouldn't be given a refresh token with the OIDC Authorization Code Flow.
Can you indicate some way of getting a new access token when it expires (without interrupting the SPA UX state (no redirects...)?
If the use of refresh tokens is the only solution, what are the ways we can minimize the risk of leakage? E.g., is storing it in the browser's session storage safe enough? Do IdPs provide some form of refresh_token expiration, etc.