HarperFast/oauth

View on GitHub

A Harper plugin for OAuth 2.0 and OpenID Connect authentication with multi-provider support.

Stars: 1
Forks: 2
Open beginner issues: 2
Indexed issues: 13
Avg merge: 2d 16h
Merged PRs (30d): 12

Dominant language: JavaScript
License: Apache-2.0
Last GitHub push: Sep 19, 2026
Latest indexed: Sep 17, 2026
Contributing guide: Contributing guide
Code of conduct: Code of conduct
Beginner labels: No beginner labels indexed

Beginner friendly Everything

Open All

13 open issues indexed

Follow-up hardening after the account-adoption gate (GHSA-vf58 / 2.6.0) Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

HarperFast/oauth#231 · 1 comment · Opened Sep 14, 2026
Integration test: prove a verified login adopts an existing account and inherits its role Open

enhancement

Difficulty 4/5 3-5 days Newbie friendliness 68/100

HarperFast/oauth#230 · 1 comment · Opened Sep 14, 2026
MCP: reject pre-provenance refresh families at refresh time (lazy migration, defense in depth) Open

enhancement

Difficulty 4/5 3-5 days Newbie friendliness 52/100

HarperFast/oauth#229 · Opened Sep 14, 2026
Support selecting which email becomes the login identity when a provider returns several (e.g. GitHub) Open

enhancement

Difficulty 4/5 3-5 days Newbie friendliness 48/100

HarperFast/oauth#228 · Opened Sep 10, 2026
/login propagates CSRF-state storage failures as a raw error response; /callback redirects with a reason code Open

Difficulty 3/5 1-2 days Newbie friendliness 70/100

HarperFast/oauth#227 · Opened Sep 2, 2026
Harden the sessionValidator periodic-validation regression test to assert persistence (follow-up to #223) Open

Difficulty 2/5 1-3 hours Newbie friendliness 82/100

HarperFast/oauth#224 · Opened Sep 1, 2026
mcp.signingKeyPem resolving to empty string silently switches from pinned key to self-generated (no startup validation) Open

Difficulty 3/5 1-2 days Newbie friendliness 68/100

HarperFast/oauth#221 · Opened Aug 29, 2026
A request that invalidates an OAuth session still runs once as the old user (global middleware next() without clearing request.user) Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 35/100

HarperFast/oauth#213 · Opened Aug 24, 2026
Session invalidation is not atomic vs a concurrent token refresh — logout/expiry can be resurrected (no CAS) Open

bug

Difficulty 5/5 Over a week Newbie friendliness 35/100

HarperFast/oauth#212 · 1 comment · Opened Aug 24, 2026
Remove the http://localhost:9926 redirectUri fallback — silent loopback default turns missing config into an authorization-code interception hazard Open

Difficulty 4/5 3-5 days Newbie friendliness 55/100

HarperFast/oauth#208 · Opened Aug 14, 2026
2.5.0: unresolved env placeholder on an mcp boolean gate now drops to its default (behavior change not in CHANGELOG) Open

Difficulty 1/5 Under an hour Newbie friendliness 82/100

HarperFast/oauth#207 · Opened Aug 14, 2026
Conformance audit: MCP authorization spec 2026-07-28 (docs pin 2025-06-18 — two revisions stale) Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

HarperFast/oauth#202 · 1 comment · Opened Aug 13, 2026
MCP OAuth v1.1: remaining 2026-07-28 spec forward-work (SEP-2350 scope step-up) Open

enhancement

HarperFast/oauth#156 · 2 comments · 1 assignee · Opened Jul 2, 2026

HarperFast/oauth

Get new issues in your inbox