feat(oauth): make the refresh_token grant opt-out per server - #2114

Merged

cliffhall merged 16 commits into

v2/mainfrom

v2/feat/2068-refresh-token-toggle

Aug 25, 2026

Commits on Aug 24, 2026

feat(oauth): make the refresh_token grant opt-out per server

cliffhall
and
claude
committed
e2fb78d

Commits on Aug 25, 2026

docs(oauth): scope what the refresh-token opt-out actually changes

cliffhall
and
claude
committed
f6fca59
fix(oauth): stop claiming the opt-out removes every offline_access

cliffhall
and
claude
committed
fca3f1c
test(oauth): prove the opt-out against a real authorization server

cliffhall
and
claude
committed
6303f8a
fix(oauth): drop an inherited offline_access when the grant is declined

cliffhall
and
claude
committed
89dedd8
fix(oauth): keep the scope filter from overwriting persisted storage

cliffhall
and
claude
committed
1bbdef0
fix(oauth): honor a newly configured offline_access against stale storage

cliffhall
and
claude
committed
f153591
refactor(web): extract the refresh-token change handler

cliffhall
and
claude
committed
87fe7b2
refactor(web): shorten the refresh-token checkbox description

cliffhall
and
claude
committed
d29ff8b
Merge branch 'v2/main' into v2/feat/2068-refresh-token-toggle
cliffhall
authored
6968738
fix(oauth): filter the step-up scope union too, not just the provider

cliffhall
and
claude
committed
26b6f03
fix(web): name the Scopes control in the offline_access warning

cliffhall
and
claude
committed
40149a2
fix(oauth): pass the raw challenge scopes to the step-up scope filter

cliffhall
and
claude
committed
fef8f5c
fix(oauth): persist the filtered scope after an ordinary grant

cliffhall
and
claude
committed
b339ad4
docs: say when the filtered scope reaches storage

cliffhall
and
claude
committed
99a0748
Merge branch 'v2/main' into v2/feat/2068-refresh-token-toggle
cliffhall
authored
40cfb51

Navigation Menu

Uh oh!

feat(oauth): make the refresh_token grant opt-out per server - #2114

feat(oauth): make the refresh_token grant opt-out per server#2114
cliffhall merged 16 commits into
v2/mainfrom
v2/feat/2068-refresh-token-toggle

Commits on Aug 24, 2026

feat(oauth): make the refresh_token grant opt-out per server

Commits on Aug 25, 2026

docs(oauth): scope what the refresh-token opt-out actually changes

fix(oauth): stop claiming the opt-out removes every offline_access

test(oauth): prove the opt-out against a real authorization server

fix(oauth): drop an inherited offline_access when the grant is declined

fix(oauth): keep the scope filter from overwriting persisted storage

fix(oauth): honor a newly configured offline_access against stale storage

refactor(web): extract the refresh-token change handler

refactor(web): shorten the refresh-token checkbox description

Merge branch 'v2/main' into v2/feat/2068-refresh-token-toggle

fix(oauth): filter the step-up scope union too, not just the provider

fix(web): name the Scopes control in the offline_access warning

fix(oauth): pass the raw challenge scopes to the step-up scope filter

fix(oauth): persist the filtered scope after an ordinary grant

docs: say when the filtered scope reaches storage

Merge branch 'v2/main' into v2/feat/2068-refresh-token-toggle