User will return undefined here:

async jwt({ token, user, account, profile }) {

or here:

async session({ session, token }) {

Because 'user' is only available the first time a user signs in

or when the user object is explicitly passed to the session update method