oidc/verifyClientRegistration.js
function verifyClientRegistration (req, res, next) {
  // check if we have a token and a token is required
  var registration = req.body
  var claims = req.claims
  var clientRegType = settings.client_registration
  var required = (registration.trusted || clientRegType !== 'dynamic')
  var trustedRegScope = settings.trusted_registration_scope
  var regScope = settings.registration_scope

  // can't continue because we don't have a token
  if (!(claims && claims.sub) && required) {
    return next(new UnauthorizedError({
      realm: 'user',
      error: 'invalid_request',
      error_description: 'Missing access token',
      statusCode: 400
    }))
  }

  // we have a token, so let's verify it
  if (claims && claims.sub) {
    // verify the trusted registration scope
    if (registration.trusted && !hasScope(claims, trustedRegScope)) {
      return next(new UnauthorizedError({
        realm: 'user',
        error: 'insufficient_scope',
        error_description: 'User does not have permission',
        statusCode: 403
      }))
    }

    // verify the registration scope
    if (!registration.trusted &&
      clientRegType === 'scoped' && !hasScope(claims, regScope)) {
      return next(new UnauthorizedError({
        realm: 'user',
        error: 'insufficient_scope',
        error_description: 'User does not have permission',
        statusCode: 403
      }))
    }

    next()

  // authorization not required/provided
  } else {
    next()
  }
}
function verifyClientRegistration (req, res, next) {
  // check if we have a token and a token is required
  var registration = req.body
  var claims = req.claims
  var clientRegType = settings.client_registration
  var required = (registration.trusted || clientRegType !== 'dynamic')
  var trustedRegScope = settings.trusted_registration_scope
  var regScope = settings.registration_scope

  // can't continue because we don't have a token
  if (!(claims && claims.sub) && required) {
    return next(new UnauthorizedError({
      realm: 'user',
      error: 'invalid_request',
      error_description: 'Missing access token',
      statusCode: 400
    }))
  }

  // we have a token, so let's verify it
  if (claims && claims.sub) {
    // verify the trusted registration scope
    if (registration.trusted && !hasScope(claims, trustedRegScope)) {
      return next(new UnauthorizedError({
        realm: 'user',
        error: 'insufficient_scope',
        error_description: 'User does not have permission',
        statusCode: 403
      }))
    }

    // verify the registration scope
    if (!registration.trusted &&
      clientRegType === 'scoped' && !hasScope(claims, regScope)) {
      return next(new UnauthorizedError({
        realm: 'user',
        error: 'insufficient_scope',
        error_description: 'User does not have permission',
        statusCode: 403
      }))
    }

    next()

  // authorization not required/provided
  } else {
    next()
  }
}
function verifyClientRegistration ( req , res , next ) { // check if we have a token and a token is required var registration = req . body var claims = req . claims var clientRegType = settings . client_registration var required = ( registration . trusted || clientRegType !== 'dynamic' ) var trustedRegScope = settings . trusted_registration_scope var regScope = settings . registration_scope // can't continue because we don't have a token if ( ! ( claims && claims . sub ) && required ) { return next ( new UnauthorizedError ( { realm : 'user' , error : 'invalid_request' , error_description : 'Missing access token' , statusCode : 400 } ) ) } // we have a token, so let's verify it if ( claims && claims . sub ) { // verify the trusted registration scope if ( registration . trusted && ! hasScope ( claims , trustedRegScope ) ) { return next ( new UnauthorizedError ( { realm : 'user' , error : 'insufficient_scope' , error_description : 'User does not have permission' , statusCode : 403 } ) ) } // verify the registration scope if ( ! registration . trusted && clientRegType === 'scoped' && ! hasScope ( claims , regScope ) ) { return next ( new UnauthorizedError ( { realm : 'user' , error : 'insufficient_scope' , error_description : 'User does not have permission' , statusCode : 403 } ) ) } next ( ) // authorization not required/provided } else { next ( ) } }
Verify Client Registration

NOTE:
verifyAccessToken and its dependencies should be used upstream.
This middleware assumes that if a token is present, it has already
been verified.

It will invoke the error handler if any of the following are true
1. a token is required, but not present
2. registration contains the "trusted" property
3. specific scope is required to register a client
Verify Client Registration