feat(oauth): add MCP / RFC 8707 + RFC 8414 compatibility#187

Merged

appleboy merged 19 commits into

mainfrom

May 17, 2026

Commits on May 15, 2026

fix(oauth): bind device-code resource, fix introspection aud, close residual open-redirect

appleboy
and
claude
committed
fix(oauth): make UserAuthorization resource-aware, close 7 more Copilot threads

appleboy
and
claude
committed
fix(oauth): close 6 more Copilot threads — device confirm, cascade-revoke, swagger, docs

appleboy
and
claude
committed
fix(oauth): close 7 more Copilot threads — POST deny redirect, resource validation, race, snapshot aud

appleboy
and
claude
committed
fix(oauth): close 4 more Copilot threads — deny PKCE, refresh aud, atomic device consent, tokeninfo aud

appleboy
and
claude
committed
fix(oauth): close 5 more Copilot threads — txn expiry, introspect aud fallback, unsupported response_type redirect, DCR doc, revocation auth methods

appleboy
and
claude
committed
fix(oauth): close 3 more Copilot threads — revert unsafe introspect aud fallback, use JWT-signed aud on refresh, test device confirm page

appleboy
and
claude
committed

Commits on May 16, 2026

Commits on May 17, 2026