Issues

New issue

Open-issue triage and roadmap (post-2.9.0)
#278 · heskew opened on Oct 2, 2026

Open-issue triage and roadmap (post-2.9.0)
HarperFast/oauth#278 · opened on Oct 2, 2026
Session docs overstate expiry: no default lifetime, and invalidation clears fields rather than deleting the row
HarperFast/oauth#277 · opened on Oct 2, 2026
Azure ?appid= form of the shared-alias keys URL isn't recognized
Bug
HarperFast/oauth#275 · opened on Oct 2, 2026
Roleless OAuth session can inherit a role when a matching account is created later
Bug
HarperFast/oauth#273 · opened on Oct 2, 2026
Azure multi-tenant: allow account adoption for an allowlist of tenants without restricting sign-in
Feature
HarperFast/oauth#272 · opened on Oct 2, 2026
Remove the transition-era typ: JWT acceptance on MCP access tokens
Task
HarperFast/oauth#258 · opened on Oct 2, 2026
CIMD: ChatGPT is refused with invalid_client (lists none in token_endpoint_auth_methods_supported, prefers private_key_jwt)
Bug
HarperFast/oauth#244 · opened on Sep 30, 2026
4
Follow-up hardening after the account-adoption gate (GHSA-vf58 / 2.6.0)
HarperFast/oauth#231 · opened on Sep 14, 2026
2
A request that invalidates an OAuth session still runs once as the old user (global middleware next() without clearing request.user)
Bug
HarperFast/oauth#213 · opened on Aug 24, 2026
Session invalidation is not atomic vs a concurrent token refresh — logout/expiry can be resurrected (no CAS)
Bug
HarperFast/oauth#212 · opened on Aug 24, 2026
1
MCP OAuth v1.1: remaining 2026-07-28 spec forward-work (SEP-2350 scope step-up)
HarperFast/oauth#156 · opened on Jul 2, 2026
3