def request_authorization( self, client_id, user_id, response_type,<EOL>redirect_uri=None, scope=None, state=None,<EOL>expires=<NUM_LIT> ):
if response_type != '<STR_LIT:code>':<EOL><INDENT>raise Proauth2Error( '<STR_LIT>',<EOL>'<STR_LIT>', state=state )<EOL><DEDENT>client = self.data_store.fetch( '<STR_LIT>', client_id=client_id )<EOL>if not client: raise Proauth2Error( '<STR_LIT>' )<EOL>if redirect_uri and client['<STR_LIT>'] != redirect_uri:<EOL><INDENT>raise Proauth2Error( '<STR_LIT>', "<STR_LIT>" )<EOL><DEDENT>nonce_code = self._generate_token()<EOL>expires = time() + expires<EOL>try:<EOL><INDENT>self.data_store.store( '<STR_LIT>', code=nonce_code,<EOL>client_id=client_id, expires=expires,<EOL>user_id=user_id, scope=scope )<EOL><DEDENT>except Proauth2Error as e:<EOL><INDENT>e.state = state<EOL>raise e<EOL><DEDENT>return { '<STR_LIT:code>':nonce_code, '<STR_LIT:state>':state }<EOL>
request_authorization generates a nonce, and stores it in the data_store along with the
client_id, user_id, and expiration timestamp.
It then returns a dictionary containing the nonce as "code," and the passed
state.
---
response_type MUST be "code." this is directly from the OAuth2 spec.
this probably doesn't need to be checked here, but if it's in the spec I
guess it should be verified somewhere.
scope has not been implemented here. it will be stored, but there is no
scope-checking built in here at this time.
if a redirect_uri is passed, it must match the registered redirect_uri.
again, this is per spec.