text: const express = require('express');
  const request = require('request');
  const hbs = require('express-handlebars');
  const uuid = require('uuid/v4');
  
  const app = express();
  app.engine('.hbs', hbs({ extname: '.hbs' }));
  app.set('view engine', '.hbs');
  
  const E_UNABLE_TO_PARSE = 'Bad Request: unable to parse result.';
  
  const clientId = process.env['CLIENT_ID'] || 'DE516D90-B63E-4994-BA64-881EA988A9D2';
  const clientSecret = process.env['CLIENT_SECRET'] || process.env.clientSecret;
  const port = process.env['SERVER_PORT'] || process.env.port;
  let host = process.env['WEBSITE_HOSTNAME'] || process.env.host;
  let getHostUri = () => `https://${host}/`;
  let getFullUriForPath = path => getHostUri() + path;
  let getCallbackUri = () => getFullUriForPath('oauth-callback');
  
  // validate critical variables
  if (!clientSecret) {
      throw new Error('Missing CLIENT_SECRET variable!');
  }
  if (!port) {
      throw new Error('Missing PORT variable!');
  }
  if (!host) {
      throw new Error('Missing HOST variable!')
  } else {
      host = process.env.DEV ? host + ':' + port : host;
      console.log('set "host" to', host);
  }
  
  // propertybag getter & setter
  let getProperty;
  let setProperty;
  // property keys
  const OAUTH_RESULT = 'oauth_result';
  const FORM_DATA = 'form_data';
  
  // set up middleware for propertybag
  app.use((req, res, next) => {
      res.propertyBag = res.propertyBag || {};
  
      getProperty = key => res.propertyBag[key];
      setProperty = (key, val) => res.propertyBag[key] = val;
  
      next();
  });
  
  const getFormBody = (assertion, grantType) => `client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer&client_assertion=${clientSecret}&grant_type=${grantType}&assertion=${assertion}&redirect_uri=${getCallbackUri()}`;
  const getFormBodyForAuthorization = assertion => getFormBody(assertion, 'urn:ietf:params:oauth:grant-type:jwt-bearer');
  const getFormBodyForRefresh = assertion => getFormBody(assertion, 'refresh_token');
  const processQuery = (req, res, next) => {
      if (!req.query || !req.query.code) {
          return res.status(400).send('Bad Request: no code parameter in the request!');
      } else {
          next();
      }
  };
  
  const handleVstsOauth = (req, res, next) => {
      request.post({
          url: 'https://app.vssps.visualstudio.com/oauth2/token',
          body: getProperty(FORM_DATA),
          headers: {
              'Content-Type': 'application/x-www-form-urlencoded'
          }
      }, (err, response, body) => {
          if (err) {
              res.status(400).send(err);
          } else {
              let result;
              try {
                  result = JSON.parse(body);
  
                  if (!result) {
                      res.status(400).send(E_UNABLE_TO_PARSE);
                  } else if (result && result.Error) {
                      res.status(400).send(body);
                  } else {
                      // stuff successful result into propertybag
                      setProperty(OAUTH_RESULT, result);
                      next();
                  }
              } catch (e) {
                  res.status(400).send(E_UNABLE_TO_PARSE);
              }
          }
      });
  };
  
  app.get('/oauth-callback', processQuery, (req, res, next) => {
      let formData = getFormBodyForAuthorization(req.query.code);
      setProperty(FORM_DATA, formData);
      next();
  }, handleVstsOauth, (req, res) => {
      let result = getProperty(OAUTH_RESULT);
  
      res.render('token', {
          refreshToken: result['refresh_token']
      });
  });
  
  app.post('/token-refresh', processQuery, (req, res, next) => {
      let formData = getFormBodyForRefresh(req.query.code);
      setProperty(FORM_DATA, formData);
      next();
  }, handleVstsOauth, (req, res) => {
      let result = getProperty(OAUTH_RESULT);
      res.setHeader('Content-Encoding', 'application/json');
      res.status(200).send(result);
  });
  
  app.get('/', (req, res) => {
      res.render('welcome', {
          clientId: clientId,
          state: uuid(),
          redirectUri: getCallbackUri()
      });
  });
  
  app.listen(port, () => {
      console.log(`app listening on port ${port}!`)
  });