Can Buddy‑Auth safely add an auto‑refresh flow for expired JWTs?

Goal

Evaluate the feasibility of integrating an automatic token‑refresh mechanism into Buddy‑Auth while maintaining least‑privilege principles.

Constraints & Uncertainty

Buddy‑Auth currently relies on a custom :unauthenticated handler that either rejects or redirects on expired credentials. No built‑in auto‑refresh exists; developers expose a separate /refresh endpoint. The open issue in the repository debates whether a default refresh flow should be added, but the design is unfinished. A key concern is that refreshing a token without re‑checking scopes could inadvertently grant elevated privileges.

Unresolved Questions

1. Can the auto‑refresh mechanism enforce strict scope validation to prevent privilege escalation?
2. Does Buddy‑Auth’s current :unauthenticated handler support a seamless refresh without redirecting to login?
3. Which approach—mandatory re‑authentication versus an auto‑refresh flow—aligns better with best practices for short‑lived access tokens and separate refresh tokens?