What's Changed
- Refuse an OAuth parameter that arrives as a list where one value is meant by @jeremy in #3236
- Lock the reviewer's email address so revocation can't be bypassed by @jeremy in #3239
- Refuse a join code that was reset while it was being redeemed by @jeremy in #3244
- Pin fizzy-mcp-server v0.2.0 by @jeremy in #3245
- Give the load balancer the real client IP by @lewispb in #3127
- dep: update sqlite3, net-ssh and faraday by @flavorjones in #3248
- Minimal modern OAuth 2.1 stack by @jeremy in #2296
- Accept https redirect URIs for dynamically registered clients by @jeremy in #3080
- Expire OAuth access tokens and rotate refresh tokens by @jeremy in #3081
- Support confidential clients with client_secret_post by @jeremy in #3082
- Answer API authentication failures with a Bearer challenge by @jeremy in #3158
- Revoke the grant when a rotated refresh token is replayed, with a 60s retry grace by @jeremy in #3160
- Lapse OAuth grants left idle for 90 days by @jeremy in #3161
- Sweep self-registered OAuth clients left without a grant for 30 days by @jeremy in #3159
- Prefix newly issued access tokens, refresh tokens and personal access tokens by @jeremy in #3163
- End an app's own plumbing with its grant; keep what it set up for the account by @jeremy in #3169
- Store tokens and client secrets as digests (D1 of 3: read by digest, plaintext fallback) by @jeremy in #3192
- Record each redeemed authorization code, so one can't mint again once its grant is gone by @jeremy in #3206
- Report OAuth audit events and export OAuth metrics by @jeremy in #3204
- Issue personal access tokens from a first-party client, and backfill existing ones onto it by @jeremy in #3205
- Audience grants for the hosted MCP server and bind each to one account (phase B) by @jeremy in #3213
- OAuth: delegation exchange for the hosted MCP server (RFC 8693) by @jeremy in #3214
- Identify OAuth clients by their metadata document URL, from allowlisted hosts by @jeremy in #3228
- Accept self-registered redirects only on loopback, cursor:// and claude://, and allowlisted https hosts by @jeremy in #3229
- Limit OAuth to 37signals staff while it's piloted by @jeremy in #3249
- Design the OAuth consent screen and Connected apps (Decision 8) by @jeremy in #3212
- Pin today's token and session authentication for shipped clients by @jeremy in #3191
- Keep beta1's staff-only OAuth and MCP exchange setup on main by @jeremy in #3250
- Converge Fizzy's first-party OAuth clients from one registry by @jeremy in #3252
- Switch the MySQL adapter from Trilogy to mysql2 by @flavorjones in #3240
Full Changelog: https://github.com/basecamp/fizzy/compare/fizzy@683d0da...fizzy@ffcc618