Discord.js Bot Gateway and OAuth2 User Auth: Integrating Least-Privilege Intent Enforcement

When building a Discord.js application, developers rely on gateway intents to enforce least‑privilege access for bot events and on the OAuth2 client to obtain user access tokens that act on behalf of users. The library currently filters gateway payloads based on the declared intents set at login, but it does not provide a runtime mechanism to verify that those intents remain appropriate as the bot’s functionality evolves, nor does it automatically refresh expired user tokens. This leaves the responsibility of maintaining least‑privilege guarantees to the developer, creating uncertainty about whether a shared middleware could enforce intent‑based checks consistently across both the bot and OAuth2 flows.

What would be the benefits and drawbacks of exposing a built‑in intent‑validation middleware in discord.js? How could such middleware be integrated without interfering with existing token‑exchange or refresh logic? What minimal API surface would be needed to allow developers to declare required intents once and have the library enforce them at runtime for both bot and user‑token operations?