oidc/verifyAuthorizationCode.js
function verifyAuthorizationCode (req, res, next) {
  var params = req.connectParams

  if (params.grant_type === 'authorization_code') {
    AuthorizationCode.getByCode(params.code, function (err, ac) {
      if (err) { return next(err) }

      // Can't find authorization code
      if (!ac) {
        return next(new AuthorizationError({
          error: 'invalid_grant',
          error_description: 'Authorization not found',
          statusCode: 400
        }))
      }

      // Authorization code has been previously used
      if (ac.used === true) {
        return next(new AuthorizationError({
          error: 'invalid_grant',
          error_description: 'Authorization code invalid',
          statusCode: 400
        }))
      }

      // Authorization code is expired
      if (nowSeconds() > ac.expires_at) {
        return next(new AuthorizationError({
          error: 'invalid_grant',
          error_description: 'Authorization code expired',
          statusCode: 400
        }))
      }

      // Mismatching redirect uri
      if (ac.redirect_uri !== params.redirect_uri) {
        return next(new AuthorizationError({
          error: 'invalid_grant',
          error_description: 'Mismatching redirect uri',
          statusCode: 400
        }))
      }

      // Mismatching client id
      if (ac.client_id !== req.client._id) {
        return next(new AuthorizationError({
          error: 'invalid_grant',
          error_description: 'Mismatching client id',
          statusCode: 400
        }))
      }

      // Mismatching user id
      // if (ac.user_id !== req.user._id) {
      //  return next(new AuthorizationError({
      //    error: 'invalid_grant',
      //    error_description: 'Mismatching client id',
      //    statusCode: 400
      //  }))
      // }

      req.code = ac

      // Update the code to show that it's been used.
      AuthorizationCode.patch(ac._id, { used: true }, function (err) {
        next(err)
      })
    })
  } else {
    next()
  }
}
function verifyAuthorizationCode (req, res, next) {
  var params = req.connectParams

  if (params.grant_type === 'authorization_code') {
    AuthorizationCode.getByCode(params.code, function (err, ac) {
      if (err) { return next(err) }

      // Can't find authorization code
      if (!ac) {
        return next(new AuthorizationError({
          error: 'invalid_grant',
          error_description: 'Authorization not found',
          statusCode: 400
        }))
      }

      // Authorization code has been previously used
      if (ac.used === true) {
        return next(new AuthorizationError({
          error: 'invalid_grant',
          error_description: 'Authorization code invalid',
          statusCode: 400
        }))
      }

      // Authorization code is expired
      if (nowSeconds() > ac.expires_at) {
        return next(new AuthorizationError({
          error: 'invalid_grant',
          error_description: 'Authorization code expired',
          statusCode: 400
        }))
      }

      // Mismatching redirect uri
      if (ac.redirect_uri !== params.redirect_uri) {
        return next(new AuthorizationError({
          error: 'invalid_grant',
          error_description: 'Mismatching redirect uri',
          statusCode: 400
        }))
      }

      // Mismatching client id
      if (ac.client_id !== req.client._id) {
        return next(new AuthorizationError({
          error: 'invalid_grant',
          error_description: 'Mismatching client id',
          statusCode: 400
        }))
      }

      // Mismatching user id
      // if (ac.user_id !== req.user._id) {
      //  return next(new AuthorizationError({
      //    error: 'invalid_grant',
      //    error_description: 'Mismatching client id',
      //    statusCode: 400
      //  }))
      // }

      req.code = ac

      // Update the code to show that it's been used.
      AuthorizationCode.patch(ac._id, { used: true }, function (err) {
        next(err)
      })
    })
  } else {
    next()
  }
}
function verifyAuthorizationCode ( req , res , next ) { var params = req . connectParams if ( params . grant_type === 'authorization_code' ) { AuthorizationCode . getByCode ( params . code , function ( err , ac ) { if ( err ) { return next ( err ) } // Can't find authorization code if ( ! ac ) { return next ( new AuthorizationError ( { error : 'invalid_grant' , error_description : 'Authorization not found' , statusCode : 400 } ) ) } // Authorization code has been previously used if ( ac . used === true ) { return next ( new AuthorizationError ( { error : 'invalid_grant' , error_description : 'Authorization code invalid' , statusCode : 400 } ) ) } // Authorization code is expired if ( nowSeconds ( ) > ac . expires_at ) { return next ( new AuthorizationError ( { error : 'invalid_grant' , error_description : 'Authorization code expired' , statusCode : 400 } ) ) } // Mismatching redirect uri if ( ac . redirect_uri !== params . redirect_uri ) { return next ( new AuthorizationError ( { error : 'invalid_grant' , error_description : 'Mismatching redirect uri' , statusCode : 400 } ) ) } // Mismatching client id if ( ac . client_id !== req . client . _id ) { return next ( new AuthorizationError ( { error : 'invalid_grant' , error_description : 'Mismatching client id' , statusCode : 400 } ) ) } // Mismatching user id // if (ac.user_id !== req.user._id) { //  return next(new AuthorizationError({ //    error: 'invalid_grant', //    error_description: 'Mismatching client id', //    statusCode: 400 //  })) // } req . code = ac // Update the code to show that it's been used. AuthorizationCode . patch ( ac . _id , { used : true } , function ( err ) { next ( err ) } ) } ) } else { next ( ) } }
Verify authorization code
Verify authorization code