routes/oauth2.js
function(req, res, next) {

    var props = getProps(req.body);

    var retry = function(message) {
        req.session.oauth2AuthcError = message;
        res.redirect(303, "/oauth2/authc?" + qs.stringify(props));
    };

    // if we're logged in (back button?) just go to /oauth2/authz

    if (req.principal) {
        // XXX make sure we don't have a mutual redirect loop here.
        res.redirect(303, "/oauth2/authz?" + qs.stringify(props));
        return;
    }

    // Check all the passed-in properties

    verifyProps(props, function(err, client) {
        if (err) {
            // At this point in the flow, they should have all been checked
            // already. So any validation problem is due to naughty behaviour.
            return next(err);
        } else {
            var nickname = req.body.nickname;
            var password = req.body.password;

            if (!nickname || !password) {
                return retry("nickname and password are required.");
            }

            Step(
                function() {
                    User.checkCredentials(nickname, password, this);
                },
                function(err, user) {
                    if (err) throw err;
                    if (!user) {
                        retry("No match for that nickname and password.");
                    } else {
                        req.principal = user.profile;
                        req.principalUser = user;
                        res.locals.principal = user.profile;
                        res.locals.principalUser = user;
                        authc.setPrincipal(req.session, user.profile, this);
                    }
                },
                function(err) {
                    if (err) return next(err);
                    // XXX make sure we don't have a mutual redirect loop here.
                    res.redirect(303, "/oauth2/authz?" + qs.stringify(props));
                }
            );
        }
    });
}
function(req, res, next) {

    var props = getProps(req.body);

    var retry = function(message) {
        req.session.oauth2AuthcError = message;
        res.redirect(303, "/oauth2/authc?" + qs.stringify(props));
    };

    // if we're logged in (back button?) just go to /oauth2/authz

    if (req.principal) {
        // XXX make sure we don't have a mutual redirect loop here.
        res.redirect(303, "/oauth2/authz?" + qs.stringify(props));
        return;
    }

    // Check all the passed-in properties

    verifyProps(props, function(err, client) {
        if (err) {
            // At this point in the flow, they should have all been checked
            // already. So any validation problem is due to naughty behaviour.
            return next(err);
        } else {
            var nickname = req.body.nickname;
            var password = req.body.password;

            if (!nickname || !password) {
                return retry("nickname and password are required.");
            }

            Step(
                function() {
                    User.checkCredentials(nickname, password, this);
                },
                function(err, user) {
                    if (err) throw err;
                    if (!user) {
                        retry("No match for that nickname and password.");
                    } else {
                        req.principal = user.profile;
                        req.principalUser = user;
                        res.locals.principal = user.profile;
                        res.locals.principalUser = user;
                        authc.setPrincipal(req.session, user.profile, this);
                    }
                },
                function(err) {
                    if (err) return next(err);
                    // XXX make sure we don't have a mutual redirect loop here.
                    res.redirect(303, "/oauth2/authz?" + qs.stringify(props));
                }
            );
        }
    });
}
function ( req , res , next ) { var props = getProps ( req . body ) ; var retry = function ( message ) { req . session . oauth2AuthcError = message ; res . redirect ( 303 , "/oauth2/authc?" + qs . stringify ( props ) ) ; } ; // if we're logged in (back button?) just go to /oauth2/authz if ( req . principal ) { // XXX make sure we don't have a mutual redirect loop here. res . redirect ( 303 , "/oauth2/authz?" + qs . stringify ( props ) ) ; return ; } // Check all the passed-in properties verifyProps ( props , function ( err , client ) { if ( err ) { // At this point in the flow, they should have all been checked // already. So any validation problem is due to naughty behaviour. return next ( err ) ; } else { var nickname = req . body . nickname ; var password = req . body . password ; if ( ! nickname || ! password ) { return retry ( "nickname and password are required." ) ; } Step ( function ( ) { User . checkCredentials ( nickname , password , this ) ; } , function ( err , user ) { if ( err ) throw err ; if ( ! user ) { retry ( "No match for that nickname and password." ) ; } else { req . principal = user . profile ; req . principalUser = user ; res . locals . principal = user . profile ; res . locals . principalUser = user ; authc . setPrincipal ( req . session , user . profile , this ) ; } } , function ( err ) { if ( err ) return next ( err ) ; // XXX make sure we don't have a mutual redirect loop here. res . redirect ( 303 , "/oauth2/authz?" + qs . stringify ( props ) ) ; } ) ; } } ) ; }
POST /oauth2/authc nickname=...&password=...&response_type=code&redirect_uri=...&client_id=...&scope=...&state=...
POST / oauth2 / authc nickname = ... &password = ... &response_type = code&redirect_uri = ... &client_id = ... &scope = ... &state = ...