text: // client.js
  
  app.get('/authorize', function (req, res) {
  
      access_token = null;
      refresh_token = null;
      scope = null;
      state = randomstring.generate();
  
      var authorizeUrl = buildUrl(authServer.authorizationEndpoint, {
          response_type: 'code',
          scope: client.scope,
          client_id: client.client_id,
          redirect_uri: client.redirect_uris[0],
          state: state
      });
  
      console.log("redirect", authorizeUrl);
      res.redirect(authorizeUrl);
      return;
  });
  
  // authorizationServer.js
  
  app.get("/authorize", function (req, res) {
  
      var client = getClient(req.query.client_id);
  
      if (!client) {
          console.log('Unknown client %s', req.query.client_id);
          res.render('error', {error: 'Unknown client'});
          return;
      } else if (!__.contains(client.redirect_uris, req.query.redirect_uri)) {
          console.log('Mismatched redirect URI, expected %s got %s', client.redirect_uris, req.query.redirect_uri);
          res.render('error', {error: 'Invalid redirect URI'});
          return;
      } else {
  
          var rscope = req.query.scope ? req.query.scope.split(' ') : undefined;
          var cscope = client.scope ? client.scope.split(' ') : undefined;
          if (__.difference(rscope, cscope).length > 0) {
              // client asked for a scope it couldn't have
              var urlParsed = buildUrl(req.query.redirect_uri, {
                  error: 'invalid_scope'
              });
              res.redirect(urlParsed);
              return;
          }
  
          var reqid = randomstring.generate(8);
  
          requests[reqid] = req.query;
  
          res.render('approve', {client: client, reqid: reqid, scope: rscope});
          return;
      }
  
  });
  
  
  app.post('/approve', function (req, res) {
  
      var reqid = req.body.reqid;
      var query = requests[reqid];
      delete requests[reqid];
  
      if (!query) {
          // there was no matching saved request, this is an error
          res.render('error', {error: 'No matching authorization request'});
          return;
      }
  
      if (req.body.approve) {
          if (query.response_type == 'code') {
              // user approved access
              var code = randomstring.generate(8);
  
              var user = getUser(req.body.user);
  
              var scope = getScopesFromForm(req.body);
  
              var client = getClient(query.client_id);
              var cscope = client.scope ? client.scope.split(' ') : undefined;
              if (__.difference(scope, cscope).length > 0) {
                  // client asked for a scope it couldn't have
                  var urlParsed = buildUrl(query.redirect_uri, {
                      error: 'invalid_scope'
                  });
                  res.redirect(urlParsed);
                  return;
              }
  
              // save the code and request for later
              codes[code] = {request: query, scope: scope, user: user};
  
              var urlParsed = buildUrl(query.redirect_uri, {
                  code: code,
                  state: query.state
              });
              res.redirect(urlParsed);
              return;
          } else {
              // we got a response type we don't understand
              var urlParsed = buildUrl(query.redirect_uri, {
                  error: 'unsupported_response_type'
              });
              res.redirect(urlParsed);
              return;
          }
      } else {
          // user denied access
          var urlParsed = buildUrl(query.redirect_uri, {
              error: 'access_denied'
          });
          res.redirect(urlParsed);
          return;
      }
  
  });
  