It's a source of problems and pain points...
Can we use the non forked version of league/oauth2-server in release branches, or have we got code inside the OAuth extension that depends on it?
https://doc.wikimedia.org/cover-extensions/OAuth/ is very low, so I wouldn't like to just use "do the tests pass" as the benchmark...
See also:
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| Don't use fork of league/oauth2-server | mediawiki/extensions/OAuth | REL1_39 | +1 -7 |
I don't think the changes to the OAuth extensions were too big, so shouldn't be too hard to dig out the commits...
rEOAU5cae17e0f8ca: Add private claims via new OAuthClaimStoreGetClaims hook and rEOAU0425da62f86f: Emit `iss` claims for oauth2 access token. are the two commits..
And they seem to have tests...
Change 839570 had a related patch set uploaded (by Reedy; author: Reedy):
[mediawiki/extensions/OAuth@REL1_39] Don't use fork of league/oauth2-server
17:50:01 Error: Interface 'League\OAuth2\Server\Repositories\ClaimRepositoryInterface' not found
Not going to be easy :/
I would decline this. I don't think the release branches are better served by running a different version of the library than the one in production. That will just make it harder to diagnose issues and easier to accidentally break them.