title: NodeJS REST authentication using Passport and OAuth2 + social network
body: <p>I'm working on <code>REST</code> api using <code>NodeJS</code>. For authentication I decided to use <code>Passport</code>. I want truly RESTful api. So it means I have to use tokens instead of sessions. </p>
  
  <p>I want to let users login using username and password, or using social networks like Facebook, Google and Twitter. </p>
  
  <p>I make my own <code>OAuth2.0</code> server for issuing <code>Access</code> and <code>Refresh tokens</code> using <code>oauth2orize</code> module. So now I can register new user and then issue them tokens. 
  I followed this tutorial: </p>
  
  <p><a href="http://aleksandrov.ws/2013/09/12/restful-api-with-nodejs-plus-mongodb/">http://aleksandrov.ws/2013/09/12/restful-api-with-nodejs-plus-mongodb/</a></p>
  
  <p>Verifying user for route:</p>
  
  <pre><code>// api ------------------------------------------------------------------------------------
      app.get('/api/userInfo',
          passport.authenticate('bearer', { session: false }),
          function(req, res) {
              // req.authInfo is set using the `info` argument supplied by
              // `BearerStrategy`.  It is typically used to indicate scope of the token,
              // and used in access control checks.  For illustrative purposes, this
              // example simply returns the scope in the response.
              res.json({ user_id: req.user.userId, name: req.user.username, scope: req.authInfo.scope })
          }
      );
  </code></pre>
  
  <p>All this works quite well. Unfortunately I don't know how to implement social authentication.</p>
  
  <p>I was reading this tutorial:</p>
  
  <pre><code>http://scotch.io/tutorials/javascript/easy-node-authentication-facebook 
  </code></pre>
  
  <p>But in this tutorial they are not making a truly RESTful api. I already implemented user schema according this tutorial where tokens for local user are stored in separated models.</p>
  
  <pre><code>// define the schema for our user model
  var userSchema = mongoose.Schema({
      local: {
          username: {
              type: String,
              unique: true,
              required: true
          },
          hashedPassword: {
              type: String,
              required: true
          },
          created: {
              type: Date,
              default: Date.now
          }
      },
      facebook: {
          id: String,
          token: String,
          email: String,
          name: String
      },
      twitter: {
          id: String,
          token: String,
          displayName: String,
          username: String
      },
      google: {
          id: String,
          token: String,
          email: String,
          name: String
      }
  });
  </code></pre>
  
  <p>But now, how can I verify user?</p>
  
  <pre><code>passport.authenticate('bearer', { session: false }),
  </code></pre>
  
  <p>this is verifying only bearer token against to my db, but how can I verify social tokens? Am I missing something? </p>