Repository navigation
Restore native OAuth HTTP interoperability and release 26.10.3 - #183
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The stock authorization-server token route does not forward the code, redirect URI or PKCE verifier, so the public acquisition client cannot redeem an authorization code through the HTTP endpoint. Forward those fields and reject missing bindings or malformed verifiers before redemption. Invalid Unicode input now returns a protocol error.
Decode OAuth Basic credentials once after splitting the encoded pair, and form-encode credentials from the existing opaque-token introspector. This keeps reserved characters, spaces and Unicode consistent with the public OAuth client. Ordinary ASCII wires, the direct server API, grant-store behavior and existing machine/refresh profiles retain their contracts. Update the current version and installer references for v26.10.03.
Validation: 45 new native ASGI/loopback TCP interoperability cases, 495 installed related cases, 9,190 configured installed core cases (seven existing prerequisite/platform skips), 83 book checks, EN/ES examples, strict docs, Ruff, mypy and package checks passed. Independent review ran 59 cases and verified all 922 package entries against source and the installed wheel. Original protocol failures and harness prerequisites remain in private qualification evidence.