docs: Update upstream OAuth status with completed oidc app PRs [skip ci]

Update oauth-upstream-status.md to clarify patch requirements and document
completed upstream work:

**Clarifications:**
- CORSMiddleware patch is for Nextcloud core server (not user_oidc app)
- Root cause: CORS middleware logs out sessions without CSRF tokens
- Solution: Allow Bearer tokens to bypass CORS/CSRF checks
- Updated all references with actual PR number: nextcloud/server#55878

**Completed oidc app PRs (now documented):**
- ✅ H2CK/oidc#586: User consent management (v1.11.0+)
- ✅ H2CK/oidc#585: JWT tokens, introspection, scope validation (v1.10.0+)
- ✅ H2CK/oidc#584: PKCE support (RFC 7636) (v1.10.0+)

**Updated sections:**
- "What Works Without Patches" - Added JWT, scopes, consent features
- "Upstream PRs Status" - Added completed PRs table
- "Monitoring Upstream Progress" - Focus on remaining work
- Last updated date: 2025-11-02

All OAuth features except app-specific APIs now work out of the box
with oidc app v1.10.0+. Only CORSMiddleware patch remains pending.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

This commit is contained in:

Chris Coutinho

2025-11-02 22:03:21 +01:00

co-authored by

Claude

parent 23360485a8

commit e81c2ad33d

2 changed files with 85 additions and 27 deletions

									
										app-hooks/post-installation/20-apply-cors-bearer-token-patch.sh
									
		+1
		-1
	
												View File
												
				@@ -6,7 +6,7 @@

				# authentication issues with app-specific APIs (Notes, Calendar, etc.)

				# when using OAuth/OIDC Bearer tokens.

				#

				# Upstream PR: https://github.com/nextcloud/server/pull/XXXXX

				# Upstream PR: https://github.com/nextcloud/server/pull/55878

				# Commit: 8fb5e77db82 (fix(cors): Allow Bearer token authentication)

				#