We have a standard microservices setup (Identity Server, API Gateway, services, etc).
Some of the services schedule events to be dispatched in the future (future = anything from mins to months ahead) - the underlying mechanism is an AWS SQS queue. We are looking to implement a feature that means that something might happen to the user/account that would mean the action shouldn't be executed (e.g. the user is deleted, or the account is closed). The timescale would beyond the usual lifetime of an access token.
To support this, we are considering either -
Add the user/account GUIDs to a header on the message in the queue, create an endpoint for the service to check the user/account status when the scheduled event is received. If this returns false, the message is discarded, else retrieve an access token for the service (using the client credentials flow) and pass the user/account on in a non-standard header (as the token will no longer contain the sub).
At the point of scheduling the event, use token delegation to generate an access token and a refresh token - the refresh token with an infinite lifetime, store the refresh token in the event body. If in the meantime something happens to the user/account we revoke the refresh token. When the scheduled event is received the service simply uses the refresh token to get a new access token (scoped for their specific requirements) and carries on as normal (contains the sub). If the token exchange fails the event is discarded.
Having discussed the options internally, some of the team feel it is "wrong" to store a refresh token (although this is how most client applications work), or having an infinite lifetime refresh token is a "hack" (Spotify seems to use infinite lifetime refresh tokens). My feeling is the first option is replicating the purpose of a refresh token, and having to "fallback" to checking the header for the sub on every endpoint a bit "hacky" (and potentially an attack vector).
I've not been able to find any specific guidance on handling authorization in this circumstance (possible Google-fu malfunction), so any guidance/input helpful.