nl_tokens: POST / oauth2 / authc nickname = ... &password = ... &response_type = code&redirect_uri = ... &client_id = ... &scope = ... &state = ...
pl_tokens: function ( req , res , next ) { var props = getProps ( req . body ) ; var retry = function ( message ) { req . session . oauth2AuthcError = message ; res . redirect ( 303 , "/oauth2/authc?" + qs . stringify ( props ) ) ; } ; // if we're logged in (back button?) just go to /oauth2/authz if ( req . principal ) { // XXX make sure we don't have a mutual redirect loop here. res . redirect ( 303 , "/oauth2/authz?" + qs . stringify ( props ) ) ; return ; } // Check all the passed-in properties verifyProps ( props , function ( err , client ) { if ( err ) { // At this point in the flow, they should have all been checked // already. So any validation problem is due to naughty behaviour. return next ( err ) ; } else { var nickname = req . body . nickname ; var password = req . body . password ; if ( ! nickname || ! password ) { return retry ( "nickname and password are required." ) ; } Step ( function ( ) { User . checkCredentials ( nickname , password , this ) ; } , function ( err , user ) { if ( err ) throw err ; if ( ! user ) { retry ( "No match for that nickname and password." ) ; } else { req . principal = user . profile ; req . principalUser = user ; res . locals . principal = user . profile ; res . locals . principalUser = user ; authc . setPrincipal ( req . session , <mask> . profile , this ) ; } } , function ( err ) { if ( err ) return next ( err ) ; // XXX make sure we don't have a mutual redirect loop here. res . redirect ( 303 , "/oauth2/authz?" + qs . stringify ( props ) ) ; } ) ; } } ) ; }