lib/token/index.js
async function __send_token_for_authorization_code(request_params, request, h) {

    function __process_authorization_code(request_params) {
        return authorization_endpoint
            .authorization_request_registrar_module
            .get_authorization_request(request_params.code);
    }

    try {
        const authorization_request_record = await promiseSequencer([
            __process_authorization_header_for_client, __process_authorization_code
        ], request_params);

        if (authorization_request_record.granted) {
            if ((authorization_request_record.client_id === request_params.client_id) && (authorization_request_record.redirect_uri === request_params.redirect_uri)) {

                //send token for authorization_code grant_type
                let oidc_claims = {
                    audience: [authorization_request_record.client_id],
                    subject: authorization_request_record.subject
                };

                if (authorization_request_record.nonce) {
                    oidc_claims.nonce = authorization_request_record.nonce;
                }

                return __send_oidc_token(request, h, oidc_claims, token_endpoint.authorization_code_grant_type.token_duration_seconds);
            }
        }

        /**
             * if we get here, then either the authorization_code has expired,
             * invalid, or used already
             */
        return h
            .response({"error": "access_denied", "error_description": "Invalid, denied, or expired authorization code"})
            .type("application/json")
            .code(401);
    } catch (err) {
        return h
            .response({"error": "access_denied", "error_description": "Invalid, denied, expired authorization code, or incorrect Basic authorization header"})
            .type("application/json")
            .code(401);
    }
}
async function __send_token_for_authorization_code(request_params, request, h) {

    function __process_authorization_code(request_params) {
        return authorization_endpoint
            .authorization_request_registrar_module
            .get_authorization_request(request_params.code);
    }

    try {
        const authorization_request_record = await promiseSequencer([
            __process_authorization_header_for_client, __process_authorization_code
        ], request_params);

        if (authorization_request_record.granted) {
            if ((authorization_request_record.client_id === request_params.client_id) && (authorization_request_record.redirect_uri === request_params.redirect_uri)) {

                //send token for authorization_code grant_type
                let oidc_claims = {
                    audience: [authorization_request_record.client_id],
                    subject: authorization_request_record.subject
                };

                if (authorization_request_record.nonce) {
                    oidc_claims.nonce = authorization_request_record.nonce;
                }

                return __send_oidc_token(request, h, oidc_claims, token_endpoint.authorization_code_grant_type.token_duration_seconds);
            }
        }

        /**
             * if we get here, then either the authorization_code has expired,
             * invalid, or used already
             */
        return h
            .response({"error": "access_denied", "error_description": "Invalid, denied, or expired authorization code"})
            .type("application/json")
            .code(401);
    } catch (err) {
        return h
            .response({"error": "access_denied", "error_description": "Invalid, denied, expired authorization code, or incorrect Basic authorization header"})
            .type("application/json")
            .code(401);
    }
}
async function __send_token_for_authorization_code ( request_params , request , h ) { function __process_authorization_code ( request_params ) { return authorization_endpoint . authorization_request_registrar_module . get_authorization_request ( request_params . code ) ; } try { const authorization_request_record = await promiseSequencer ( [ __process_authorization_header_for_client , __process_authorization_code ] , request_params ) ; if ( authorization_request_record . granted ) { if ( ( authorization_request_record . client_id === request_params . client_id ) && ( authorization_request_record . redirect_uri === request_params . redirect_uri ) ) { //send token for authorization_code grant_type let oidc_claims = { audience : [ authorization_request_record . client_id ] , subject : authorization_request_record . subject } ; if ( authorization_request_record . nonce ) { oidc_claims . nonce = authorization_request_record . nonce ; } return __send_oidc_token ( request , h , oidc_claims , token_endpoint . authorization_code_grant_type . token_duration_seconds ) ; } } /**
             * if we get here, then either the authorization_code has expired,
             * invalid, or used already
             */ return h . response ( { "error" : "access_denied" , "error_description" : "Invalid, denied, or expired authorization code" } ) . type ( "application/json" ) . code ( 401 ) ; } catch ( err ) { return h . response ( { "error" : "access_denied" , "error_description" : "Invalid, denied, expired authorization code, or incorrect Basic authorization header" } ) . type ( "application/json" ) . code ( 401 ) ; } }
5.1.  Successful Response

The authorization server issues an access token and optional refresh
token, and constructs the response by adding the following parameters
to the entity-body of the HTTP response with a 200 (OK) status code:

access_token
REQUIRED.  The access token issued by the authorization server.

token_type
REQUIRED.  The type of the token issued as described in
Section 7.1.  Value is case insensitive.

expires_in
RECOMMENDED.  The lifetime in seconds of the access token.  For
example, the value "3600" denotes that the access token will
expire in one hour from the time the response was generated.
If omitted, the authorization server SHOULD provide the
expiration time via other means or document the default value.





Hardt                        Standards Track                   [Page 43]

RFC 6749                        OAuth 2.0                   October 2012


refresh_token
OPTIONAL.  The refresh token, which can be used to obtain new
access tokens using the same authorization grant as described
in Section 6.

scope
OPTIONAL, if identical to the scope requested by the client;
otherwise, REQUIRED.  The scope of the access token as
described by Section 3.3.


response:
{
"access_token":"2YotnFZFEjr1zCsicMWpAA",
"token_type":"example",
"expires_in":3600,
"refresh_token":"tGzv3JOkF0XG5Qx2TlKWIA",
"example_parameter":"example_value"
}


 

@param  {[type]} request_params [description]
@return {[type]}                [description]
5 . 1 . Successful Response