feat(auth): revoke OAuth tokens at the authorization server on clear (RFC 7009) - #2186

Merged

cliffhall merged 24 commits into

v2/mainfrom

v2/feat/2144-oauth-revocation

Aug 28, 2026

Commits on Aug 28, 2026

feat(auth): revoke OAuth tokens at the authorization server on clear (#2144)

cliffhall
and
claude
committed
65fd2b9
test(auth): cover the no-window guard in getWebProxiedFetch (#2144)

cliffhall
and
claude
committed
15f381c
fix(auth): address Copilot review round 1 on the RFC 7009 revocation (#2144)

cliffhall
and
claude
committed
7f27d7e
fix(auth): address Copilot review round 2 on the RFC 7009 revocation (#2144)

cliffhall
and
claude
committed
4a24c48
fix(auth): revoke every issuer-bound grant, not just the active one (#2144)

cliffhall
and
claude
committed
781aa69
fix(auth): read enumerated issuers exactly, and stop the TUI tone going stale (#2144)

cliffhall
and
claude
committed
6c499f3
fix(auth): key grant dedup by issuer, and isolate per-slot read failures (#2144)

cliffhall
and
claude
committed
e9cd678
fix(auth): RFC-encode the Basic credential; make the TUI clear await its work (#2144)

cliffhall
and
claude
committed
56ac830
fix(auth): bound the whole teardown, and scope the TUI clear to its server (#2144)

cliffhall
and
claude
committed
43c817c
fix(auth): close the fail-open issuer check and the remaining clear races (#2144)

cliffhall
and
claude
committed
5170cc4
fix(web): surface a failed OAuth clear instead of floating its rejection (#2144)

cliffhall
and
claude
committed
1661f09
fix(web): lock the OAuth clear so a double click cannot run it twice (#2144)

cliffhall
and
claude
committed
e2cbf0d
fix(tui): forward the clear promise from App, so AuthTab can actually await it (#2144)

cliffhall
and
claude
committed
c0bcdc7
fix(auth): clear before waiting on the network, not after (#2144)

cliffhall
and
claude
committed
69fcdd3
fix(auth): keep the failure path total, and align the docs with the new order (#2144)

cliffhall
and
claude
committed
4429c0c
fix(auth): refuse a grant whose authorization server cannot be established (#2144)

cliffhall
and
claude
committed
a4ee263
fix: close three stale-completion holes from the round-16 suppressed block (#2144)

cliffhall
and
claude
committed
b9012da
fix(auth): revoke with the registration bound to the grant, not the current one (#2144)

cliffhall
and
claude
committed
0ded02b
fix(auth): make snapshot-and-clear one atomic storage step (#2144)

cliffhall
and
claude
committed
463227c
fix(auth): salvage a malformed fallback registration, and correct the stale API names (#2144)

cliffhall
and
claude
committed
579a3ee
fix: address the four suppressed findings from review round 20 (#2144)

cliffhall
and
claude
committed
1f2e3e1
Merge branch 'v2/main' into v2/feat/2144-oauth-revocation
cliffhall
authored
5ba2fad
fix: use Node storage in the revocation e2e, and drop the now-dead storage API (#2144)

cliffhall
and
claude
committed
eede9c1
Merge remote-tracking branch 'origin/v2/feat/2144-oauth-revocation' into v2/feat/2144-oauth-revocation
cliffhall
committed
c7b18ad

Navigation Menu

Uh oh!

feat(auth): revoke OAuth tokens at the authorization server on clear (RFC 7009) - #2186

feat(auth): revoke OAuth tokens at the authorization server on clear (RFC 7009)#2186
cliffhall merged 24 commits into
v2/mainfrom
v2/feat/2144-oauth-revocation

Commits on Aug 28, 2026

feat(auth): revoke OAuth tokens at the authorization server on clear (#2144)

test(auth): cover the no-window guard in getWebProxiedFetch (#2144)

fix(auth): address Copilot review round 1 on the RFC 7009 revocation (#2144)

fix(auth): address Copilot review round 2 on the RFC 7009 revocation (#2144)

fix(auth): revoke every issuer-bound grant, not just the active one (#2144)

fix(auth): read enumerated issuers exactly, and stop the TUI tone going stale (#2144)

fix(auth): key grant dedup by issuer, and isolate per-slot read failures (#2144)

fix(auth): RFC-encode the Basic credential; make the TUI clear await its work (#2144)

fix(auth): bound the whole teardown, and scope the TUI clear to its server (#2144)

fix(auth): close the fail-open issuer check and the remaining clear races (#2144)

fix(web): surface a failed OAuth clear instead of floating its rejection (#2144)

fix(web): lock the OAuth clear so a double click cannot run it twice (#2144)

fix(tui): forward the clear promise from App, so AuthTab can actually await it (#2144)

fix(auth): clear before waiting on the network, not after (#2144)

fix(auth): keep the failure path total, and align the docs with the new order (#2144)

fix(auth): refuse a grant whose authorization server cannot be established (#2144)

fix: close three stale-completion holes from the round-16 suppressed block (#2144)

fix(auth): revoke with the registration bound to the grant, not the current one (#2144)

fix(auth): make snapshot-and-clear one atomic storage step (#2144)

fix(auth): salvage a malformed fallback registration, and correct the stale API names (#2144)

fix: address the four suppressed findings from review round 20 (#2144)

Merge branch 'v2/main' into v2/feat/2144-oauth-revocation

fix: use Node storage in the revocation e2e, and drop the now-dead storage API (#2144)

Merge remote-tracking branch 'origin/v2/feat/2144-oauth-revocation' into v2/feat/2144-oauth-revocation