Initial Checks
Release line
v2 (v1 shares the code)
Description
RFC 6749 §3.3 separates scopes with spaces, but real-world authorization servers (e.g. Linear) return comma-separated scope values in token responses and WWW-Authenticate challenges. union_scopes and the offline_access membership checks split on whitespace only, so a comma-separated grant is treated as one opaque scope: the SEP-2350 step-up union stops deduplicating (scopes accumulate as read,write read write) and offline_access/prompt=consent handling misfires.
I have a fix rebased onto current main: a parse_scopes helper accepting both separators, used in union_scopes and the offline_access membership checks, with parametrized tests. Please assign so the PR stays open.
🤖 Generated with Claude Code
Initial Checks
mainand 2.2.0)Release line
v2 (v1 shares the code)
Description
RFC 6749 §3.3 separates scopes with spaces, but real-world authorization servers (e.g. Linear) return comma-separated
scopevalues in token responses andWWW-Authenticatechallenges.union_scopesand theoffline_accessmembership checks split on whitespace only, so a comma-separated grant is treated as one opaque scope: the SEP-2350 step-up union stops deduplicating (scopes accumulate asread,write read write) andoffline_access/prompt=consenthandling misfires.I have a fix rebased onto current
main: aparse_scopeshelper accepting both separators, used inunion_scopesand theoffline_accessmembership checks, with parametrized tests. Please assign so the PR stays open.🤖 Generated with Claude Code