Optionally force a refresh token grant at spawn time

[jnywong]

For multiple use cases, I have become more dependent on JupyterHub groups being up to date at spawn time, and these group memberships are derived from some auth state key decoded from an access token. However, the refresh_user routine does not pull in an updated auth state from the identity provider if the access token is still valid, so there is a drift between JupyterHub groups at spawn time and the derived group coming from the identity provider.

Proposed change

I could get around this by using the refresh_user_hook and re-use some code from refresh_user to force a refresh token grant, but given some of the discussion in

• Buffer for renewing both id_tokens and access_tokens when they are about to expire, but not actually expired. #790
• "Unable to decode id token" on singleuser pod spawn with short-lived id tokens #793

maybe it's worth introducing this functionality more formally as a configurable option?

I've not thought about potential rate-limiting from the IdP yet.

Alternative options

I could continue passing in custom config into the refresh_user_hook above.

Who would use this feature?

I think quite a lot of people would use this feature, especially since when I first tried the refresh_pre_spawn = True config expecting it to perform the refresh token grant, when actually it was just running refresh_user and continuing to use the valid access token as described above.

(Optional): Suggest a solution