Lunny Xiao f3bdcc58af

Fix OAuth2 authorization code expiry and reuse handling (#36797) ...

- set OAuth2 authorization code `ValidUntil` on creation and add expiry
checks during exchange
- return a specific error when codes are invalidated twice to prevent
concurrent reuse
- add unit tests covering validity timestamps, expiration, and double
invalidation

---
Generate by a coding agent with Codex 5.2

---------

Signed-off-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

2026-03-06 05:00:44 +00:00

..

admin

Use "Enable Gravatar" but not "Disable" (#36771)

2026-02-27 16:39:26 +00:00

auth

Fix OAuth2 authorization code expiry and reuse handling (#36797)

2026-03-06 05:00:44 +00:00

devtest

feat: Add workflow dependencies visualization (#36248)

2026-02-23 21:11:33 +08:00

events

…

explore

Convert locale files from ini to json format (#35489)

2025-12-19 09:50:48 -08:00

feed

Fix mirror sync parser and fix mirror messages (#36504)

2026-02-11 00:16:05 +00:00

healthcheck

Correct spelling (#36783)

2026-02-28 11:23:20 -08:00

misc

Instance-wide (global) info banner and maintenance mode (#36571)

2026-02-26 23:16:11 +08:00

org

Deprecate RenderWithErr (#36769)

2026-02-27 12:38:44 +00:00

repo

fix(repo): unify DEFAULT_SHOW_FULL_NAME output in templates and dropdown (#36597)

2026-03-04 21:23:17 +08:00

shared

Enable nilnil linter for new code (#36591)

2026-02-16 09:57:18 +00:00

user

Deprecate RenderWithErr (#36769)

2026-02-27 12:38:44 +00:00

base.go

Refactor avatar package, support default avatar fallback (#36788)

2026-03-01 13:32:35 +00:00

githttp.go

add support for archive-upload rpc (#36391)

2026-01-17 15:17:00 +00:00

goget.go

Enable addtional linters (#34085)

2025-04-01 10:14:01 +00:00

home.go

Support actions and reusable workflows from private repos (#32562)

2025-10-25 17:37:33 +00:00

metrics.go

…

nodeinfo.go

Enable addtional linters (#34085)

2025-04-01 10:14:01 +00:00

passkey.go

…

swagger_json.go

Improve OAuth2 provider (correct Issuer, respect ENABLED) (#34966)

2025-07-06 13:36:45 +08:00

web.go

Implements OIDC RP-Initiated Logout (#36724)

2026-03-01 06:28:26 +00:00

webfinger.go

Fix context usages (#35348)

2025-08-27 11:00:01 +00:00