Setting Session-Based Permissions via Connected App

Question

Here's my use case: We have API-only users who authenticate using the OAuth 2 web server flow and access SF via a ConnectedApp . At the time of auth / refresh, we want to activate a session-based permission set for the user. This provides them the requisite permissions required to perform actions against REST endpoints.

We have a connected app handler class that extends Auth.ConnectedAppPlugin. The issue is, when providing implementation for the authorize() and refresh() methods, I try to make a call to UserInfo.getSessionId() and Auth.SessionManagement().getCurrentSession which return null and throws an exception, respectively.

I can't activate the permissions from the endpoints themselves because then I get the mixed-DML operations exception. I realize I could use a normal permission set but I'd prefer session-based.

A copy of the genericized code for my connected app plugin class is below. Any thoughts would be greatly appreciated!

public class CustomCloudConnectedAppPlugin extends Auth.ConnectedAppPlugin {

    public override Boolean authorize(Id userId, Id connectedAppId, Boolean isAdminApproved, Auth.InvocationContext context) {
        if (!isAdminApproved)
            return false;

        // custom class to encapsulate assignment logic 
        ConnectedAppPermissioner cap = ConnectedAppPermissioner.getAppPermissioner(PhynCloudConnectedAppPlugin.class, userId); 
        cap.assignAppPermissions();

        // sanity check - throws exception
        system.debug(Auth.SessionManagement.getCurrentSession()); 

        return true; 
    }

    public override void refresh(Id userId, Id connectedAppId, Auth.InvocationContext context) {
        // returns null
        system.debug(UserInfo.getSessionId()); 
    }

}