I want to use Ash again (I tried it a year ago but I’m now returning to try out 3.0) but I’m a little bit unsure about Ash Authentication. I am far from a security expert so maybe my concerns are not valid but I was wondering about how to implement refresh tokens using Ash Auth. As far as I understand it is not very good practice to use long lived stateless jwt tokens since it is impossible (or very hard) to invalidate them if they need to be invalidated before expiry. So most people seems to recommend a short lived access token (seconds or minutes) and a refresh token that is stored in the database.

In the docs to ash auth it says: “Since refresh tokens are not yet included in ash_authentication, you should set the token lifetime to a reasonably long time to ensure a good user experience. Alternatively, refresh tokens can be implemented on your own.”

How would one add refresh tokens to an app using ash-authentication? I know how I could do it in a “vanilla” Phoenix app but not with Ash (my macro skills are very poor). Is it possible without forking ash-authentication and rewriting a large part of the library? If so any hints on how one would do it?