Central vs per-route token validation in Astro middleware for expired credentials

Goal is to enforce least-privilege authentication in an Astro app using documented middleware as the integration point for auth checks, with expired credentials rejected consistently across server-rendered pages and endpoints.

Astro has no built-in authentication. Middleware defined in src/middleware.ts runs only for SSR-rendered routes and can validate a session or token, attach a minimal identity to context.locals, and return a Response for expired or invalid credentials. Endpoints can return raw Response objects for 401/403. Static prerendered pages do not execute middleware per request.

The unresolved design choice is whether to validate and refresh tokens centrally in middleware or perform checks per route. Central validation simplifies handling of expired credentials but couples routes to a single strategy and may expose more identity than needed. Per-route checks support finer least-privilege but risk inconsistent expiry handling.

Which pattern preserves least-privilege while ensuring expired credentials are rejected uniformly across SSR pages and Astro endpoints? Does attaching a minimal identity in middleware remove the need for per-route expiry checks? When output mixes static and server-rendered routes, how should expired credential handling be documented to avoid gaps on prerendered pages?