I'm using authorizer with generic oauth & using custom authorizer_custom_role filter (basically mapping role from some oauth attribute). When I change the roles in the oauth server, this does not fully get reflected in wordpress, resulting in a somewhat funny behaviour when the user gets either old role or new role every second login.

I believe the core issue is that auth_settings_access_users_approved is only saved when the user is initially approved, so when the role changes, it does not get updated.

Or maybe something is wrong here - I observe that $default_role and $approved_role are both the new role, but $user_info['role'] is the old role (from auth_settings_access_users_approved, from when the user was created), and that's the one that ends up being used.