Issues

• Return a non-success HTTP status when no OAuth providers are configured

  P2Filter by Priority: P2
  Bug

  HarperFast/oauth#284 · Filter by author hdbjeff opened on Oct 20, 2026

• Existing replay suite leaks its fixture directory when Harper setup fails

  bug

  P3Filter by Priority: P3
  Bug

  HarperFast/oauth#283 · Filter by author hdbjeff opened on Oct 20, 2026

• Linked accounts: bind several providers to one Harper user and keep provider tokens for server-side use

  P3Filter by Priority: P3
  Feature

  HarperFast/oauth#280 · Filter by author kriszyp opened on Oct 17, 2026

• Open-issue triage and roadmap (post-2.9.0)

  HarperFast/oauth#278 · Filter by author heskew opened on Oct 2, 2026
  

• Session docs overstate expiry: no default lifetime, and invalidation clears fields rather than deleting the row

  HarperFast/oauth#277 · Filter by author heskew opened on Oct 2, 2026
  

• Azure ?appid= form of the shared-alias keys URL isn't recognized

  P2Filter by Priority: P2
  Bug

  HarperFast/oauth#275 · Filter by author heskew opened on Oct 2, 2026
  

• Roleless OAuth session can inherit a role when a matching account is created later

  P2Filter by Priority: P2
  Bug

  HarperFast/oauth#273 · Filter by author heskew opened on Oct 2, 2026
  

• Azure multi-tenant: allow account adoption for an allowlist of tenants without restricting sign-in

  P3Filter by Priority: P3
  Feature

  HarperFast/oauth#272 · Filter by author heskew opened on Oct 2, 2026
  

• Remove the transition-era typ: JWT acceptance on MCP access tokens

  P3Filter by Priority: P3
  Task

  HarperFast/oauth#258 · Filter by author heskew opened on Oct 2, 2026

• CIMD: ChatGPT is refused with invalid_client (lists none in token_endpoint_auth_methods_supported, prefers private_key_jwt)

  P1Filter by Priority: P1
  Bug

  HarperFast/oauth#244 · Filter by author tps-flint opened on Sep 30, 2026
  4

  

• Follow-up hardening after the account-adoption gate (GHSA-vf58 / 2.6.0)

  HarperFast/oauth#231 · Filter by author heskew opened on Sep 14, 2026
  2

  

• A request that invalidates an OAuth session still runs once as the old user (global middleware next() without clearing request.user)

  bug

  P3Filter by Priority: P3
  Bug

  HarperFast/oauth#213 · Filter by author heskew opened on Aug 24, 2026

• Session invalidation is not atomic vs a concurrent token refresh — logout/expiry can be resurrected (no CAS)

  bug

  P2Filter by Priority: P2
  Bug

  HarperFast/oauth#212 · Filter by author heskew opened on Aug 24, 2026
  1

• MCP OAuth v1.1: remaining 2026-07-28 spec forward-work (SEP-2350 scope step-up)

  enhancement
  HarperFast/oauth#156 · Filter by author heskew opened on Jul 2, 2026
  3