       else res.json {success: false, error: 'incomplete request'}
     else res.json {success: false, error: 'invalid session'}
 
+
 # read the oauth stuff
 # https://developer.github.com/v3/oauth/
 # https://developer.github.com/v3/#current-version
-config.oauth = {}
-
-fs.readFile './oauth-config.json', "utf8", (err, data) ->
-  if err
-    console.log "failed to read OAuth config from file " + err
-  else
-    config.oauth = JSON.parse(data)
-    config.oauth.states = {}
 
 newRandomState = (length = 64) ->
     buf = new Buffer length

else
  console.log "config file not found"
  return

# nodejs' http cannot deal with a chain in one file ->
# quickfix according to http://stackoverflow.com/a/31629223/1518225

        code = eresp.statusCode
      cb {}, {errortype: "request", error: "#{err}", code: code}

checkOAuthState = (req, res) ->
  #console.log "current oauth states", config.oauth.states
  stateIdCookie = 'ctfpad-oauth-state-id'
  clientStateKey = req.cookies[stateIdCookie]
  unless req.query.state
    console.log "checkOAuthState - No state passed for #{clientStateKey} -", req.query
    res.send 500, "No state passed for #{clientStateKey}"
    return
  unless config.oauth.states and config.oauth.states[clientStateKey]
    console.log "checkOAuthState - No state configured for #{clientStateKey} in ", config.oauth.states
    res.send 500, "No state exists for #{clientStateKey}"
    return
  unless req.query.state == config.oauth.states[clientStateKey]
    console.log "checkOAuthState - possible CSRF attempt at #{clientStateKey} - ", req.query, config.oauth.states
    res.send 500, "Github Login failed (state mismatch)"
    return

  delete config.oauth.states[clientStateKey]
  res.clearCookie stateIdCookie

app.get '/oauthcb', (req, res) ->
  unless config.oauth
    res.send 500, "Github Login is disabled"
    return
  unless checkOAuthState req, res
    return
  # get the code from github
  unless req.query.code
    res.send 500, "Github Login failed (missing code)"
    return
  code = req.query.code
  #state = req.params.state
  url = 'https://github.com/login/oauth/access_token'
  data = {client_id: config.oauth.id, \
