Bobby Ho 7a57b17b7b fix: make OAuth2 refresh token redemption single-use under concurrency (#28752) ...

Make OAuth2 refresh token redemption single-use under concurrency using DELETE ... RETURNING, ensuring exactly one request succeeds and losing requests return invalid_grant. Remove the redundant API-key lookup to prevent 500s on missing keys, explicitly use READ COMMITTED for both grant transactions, and replace whitespace-only stored-scope echoes with a fixed error message. Add regression coverage for concurrent redemption, revoked or missing keys, and invalid stored scopes.

2026-09-11 12:47:55 -07:00

..

oauth2providertest

fix: match OAuth2 redirect_uri against every registered redirect URI (#29014)

2026-09-09 11:25:17 -07:00

app_secrets.go

feat: reject secret creation and fix reporting for public clients (#28097)

2026-09-01 08:58:01 -07:00

apps.go

feat: derive OAuth2 client type from token_endpoint_auth_method (#28043)

2026-08-18 21:12:44 -07:00

authorize_internal_test.go

fix: match OAuth2 redirect_uri against every registered redirect URI (#29014)

2026-09-09 11:25:17 -07:00

authorize_test.go

fix: ignore unrecognized parameters at the token endpoint (#29139)

2026-09-09 11:42:57 -07:00

authorize.go

fix: ignore unrecognized parameters at the token endpoint (#29139)

2026-09-09 11:42:57 -07:00

metadata_test.go

feat: accept PKCE-only token exchange for public clients (#28047)

2026-08-31 09:55:58 -07:00

metadata.go

feat: register public clients without a secret (#28046)

2026-08-20 12:49:47 -07:00

nostore_test.go

fix: deliver the rest of the invalid_request class to the client (#28736)

2026-09-03 10:54:34 -07:00

pkce_test.go

fix: reject PKCE code_verifier below RFC 7636 length floor (#28003)

2026-08-12 13:36:52 -07:00

pkce.go

fix: reject PKCE code_verifier below RFC 7636 length floor (#28003)

2026-08-12 13:36:52 -07:00

provider_test.go

…

registration_test.go

feat: reject secret creation and fix reporting for public clients (#28097)

2026-09-01 08:58:01 -07:00

registration.go

feat: reject secret creation and fix reporting for public clients (#28097)

2026-09-01 08:58:01 -07:00

revoke.go

feat: accept PKCE-only token exchange for public clients (#28047)

2026-08-31 09:55:58 -07:00

secrets.go

…

tokens_internal_test.go

fix: make OAuth2 refresh token redemption single-use under concurrency (#28752)

2026-09-11 12:47:55 -07:00

tokens_test.go

fix: make OAuth2 refresh token redemption single-use under concurrency (#28752)

2026-09-11 12:47:55 -07:00

tokens.go

fix: make OAuth2 refresh token redemption single-use under concurrency (#28752)

2026-09-11 12:47:55 -07:00

validation_test.go

feat: negotiate and persist authorization scope (#28178)

2026-08-31 09:29:27 -07:00