[Question] Project status/activity

[allistercsmith]

Hi guys,

Let me preface this conversation by first giving a big thumbs up for all the effort that's gone into this module - it's really appreciated!

Nevertheless, looking around this repository (and the others in the oauthjs organisation), I can't help but notice that activity has dwindled since the big PR (#203) in March. Some common symptoms I'm seeing are:

• A number of open issues and useful pull requests, which seem to have died out
• Lack of proper/updated documentation (Confusing docs / Mixed versions ?  #305)
• Confusion around published versions on NPM (I've resorted to pointing directly to this repo instead)
• No transparency on the project roadmap/progress

So with the above being noted, what is the general status of this project? As somebody who's keen to make active use of this module in my projects going forward, I can't help but feel a little concerned around the project being in a state of limbo. I've seen many people mention that it's transitioning to v3, which is why all the documentation, examples and NPM versions are out of sync. However, I'm just not seeing any sign of this transition going on.

Is there perhaps activity going on that I'm not seeing, or do not have visibility over? Or is it a case of the maintainers not having enough time at the moment? @mjsalinger - you seem to be the primary maintainer at the moment, so I guess this is more directed at you.

Please don't consider the above as a dig at all the hard work that's gone into this project - I say these things with respect. I do however think it's a good idea to chat about this and let people know, as there are a flood of issues being opened around some of these points.

Thanks again for all the hard work 👍

[maxtruxa]

I second this. The project is great but v2 was missing essential features (like scopes) and v3 currently is in an not-so-usable state. Even if you pull directly from GitHub and get by without documentation and examples, there are still some fundamental bugs (like missing lifetimes for the authorization_code flow; #304). A lot of these bugs are already fixed by some pending PR.

I'm trying to keep the issues alive as good as I can, but it would be great to get some insight on the roadmap and get PRs actually merged. With (clearly useful!) PRs lying around for this long, eventually merging them gets more and more work, as new PRs are based on the current master and merging them one by one can result in a lot of merge conflicts.

A bunch of isses and PRs are still around from v2. Some of them can just be closed because they are already resolved/implemented on the current master, others would be useful to keep around, e.g. requested features that are not implemented yet. How about a requested-feature tag? Adding tags for v2/v3 in general would make it easier to differentiate between old issues/PRs and new ones.

Once we have a stable, correctly functioning version it will be a lot easier to add proper documentation and update dependent projects (express-oauth-server, koa-oauth-server) to a usable state.

Like @allistercsmith, I really appreciate the hard work everyone put into this project so far, so I would hate to see it die down!

[fcanela]

I am in the same boat that OP. Wanted to use the module as it looks wonderful but wandered about it status.

I do not want to be a jerk. I know you guys probably devote your free time on this: we should not be any expectation from us and we could also resolve our issues by our own. There is any chance @mjsalinger (who have PR pending from March), @lfk or @ruimarinho (lastest commiters and members of oauthjs org) could give us any clue about the v3 and their involvement status? What is needed so the useful PRs get merged and the project advances? Is there anything that we as users or devs can do?

Thanks.

[ruimarinho]

@allistercsmith, we really appreciate yours words and kind feedback. As a regular contributor, I've been in both sides of the story and I empathise with you and others on this thread.

So v3 was a complete refactor and the result of many months of development going back-and-forth on the direction of the original PR which ultimately led to this organization. Part of that work was company sponsored, which meant we had time allocated for it during work time. Since the v3 merge happened, the interest increased even more and we simply haven't been able to keep up with the demand due to work load.

Please know that we are still fully committed to the project and v3 has proven to work very reliably in production environments. The documentation is indeed difficult to find/parse as it is mixed with v2 and express-oauth-server as well as koa-oauth-server are in need of some love.

We are (mostly) aware of the current issues and we plan on dedicating our time soon to skim through all the issues, close the deprecated ones and review/merge existing PR. We will likely need your help reviewing those (cc @fcanela).

We ask you for a little more patience as we strive to organise our personal and work lives to accommodate a weekend for this project.

@maxtruxa is #304 a blocker in your opinion?

[maxtruxa]

@ruimarinho, great to hear from you!

Yes, I think it is.. Currently there are no token lifetimes generated for the authorization grant which means access tokens never expire. I have a working fix but still need to write some tests. Expect me to create a PR within the next few days.

[johnf]

@ruimarinho any update here? It has been a few months now with no progress. I'm currently using my own branch based on @maxtruxa's branch.

Would you like some assistance from the community here? I'm sure there a couple of folks who would be happy to help.

[nunofgs]

@johnf: we'll be doing a major push this week and activity should be steady after that.

[mjsalinger]

+1, I'm ready to help get this out the door.

[mjsalinger]

Just to update this thread - targeting a 3.0.0-b3 release with some of the PRs by 10/25; there will also likely be a b4 release and then final. I'd love it if we can get the final out by end of November. Also, if anyone else would like to help (issue triage, code reviews, etc), please let me know. I have a channel set up on Freenode, #oauthjs where we can discuss the project in a more chat-based manner.

[maxtruxa]

I'm definitely interested in helping out wherever I can. Just joined the freenode channel.
I'm currently working on docs for v3 (which might change a bit, depending on which PRs get merged and which don't).

[mjsalinger]

Hey @maxtruxa if you've done any work on docs, can you submit as a PR? Would be good to get those in there. Happy to help augment your work on them if needed.

[mjsalinger]

3.0.0-b3 has been pushed to next.

[maxtruxa]

@mjsalinger There's still a few sections marked as TODO, but I'll try to get those done during the weekend.