Hi @samk,
Welcome to the Auth0 Community!
The code snippet you shared looks fine for setting the app_metadata. However, I recommend using custom namespace claims to set custom claims. For an example, take a look at our Adding custom claims to tokens knowledge solution.
The equivalent method in Actions would be event.transaction.protocol === "oauth2-refresh-token").
(Reference: Actions Triggers: post-login - Event Object)
I also suggest testing your Actions using the built-in debugger interface to ensure your script runs correctly before deploying it to your login flow.
Thanks,
Rueben