generateAccessToken(client,user,scope)

Invoked to generate a new access token.

This model function isoptional. If not implemented, a default handler is used that generates access tokens consisting of 40 characters in the range ofa..z0..9.

Invoked during:

• authorization_code grant

• client_credentials grant

• refresh_token grant

• password grant

Arguments:

Return value:

AString to be used as access token.

RFC 6749 Appendix A.12 specifies that access tokens must consist of characters inside the range0x20..0x7E (i.e. only printable US-ASCII characters).

Remarks:

client is the object previously obtained throughModel#getClient().

user is the user object previously obtained throughModel#getAuthorizationCode() (code.user; authorization code grant),Model#getUserFromClient() (client credentials grant),Model#getRefreshToken() (token.user; refresh token grant) orModel#getUser() (password grant).

generateRefreshToken(client,user,scope)

Invoked to generate a new refresh token.

This model function isoptional. If not implemented, a default handler is used that generates refresh tokens consisting of 40 characters in the range ofa..z0..9.

Invoked during:

• authorization_code grant

• refresh_token grant

• password grant

Arguments:

Return value:

AString to be used as refresh token.

RFC 6749 Appendix A.17 specifies that refresh tokens must consist of characters inside the range0x20..0x7E (i.e. only printable US-ASCII characters).

Remarks:

client is the object previously obtained throughModel#getClient().

user is the user object previously obtained throughModel#getAuthorizationCode() (code.user; authorization code grant),Model#getRefreshToken() (token.user; refresh token grant) orModel#getUser() (password grant).

generateAuthorizationCode(client,user,scope)

Invoked to generate a new authorization code.

This model function isoptional. If not implemented, a default handler is used that generates authorization codes consisting of 40 characters in the range ofa..z0..9.

Invoked during:

• authorization_code grant

Arguments:

Return value:

AString to be used as authorization code.

RFC 6749 Appendix A.11 specifies that authorization codes must consist of characters inside the range0x20..0x7E (i.e. only printable US-ASCII characters).

getAccessToken(accessToken)

Invoked to retrieve an existing access token previously saved throughModel#saveToken().

This model function isrequired ifOAuth2Server#authenticate() is used.

Invoked during:

• request authentication

Arguments:

Return value:

AnObject representing the access token and associated data.

token.client andtoken.user can carry additional properties that will be ignored byoauth2-server.

Remarks:

functiongetAccessToken(accessToken){// imaginary DB queriesreturndb.queryAccessToken({access_token:accessToken}).then(function(token){returnPromise.all([token,db.queryClient({id:token.client_id}),db.queryUser({id:token.user_id})]);}).spread(function(token,client,user){return{accessToken:token.access_token,accessTokenExpiresAt:token.expires_at,scope:token.scope,client:client,// with 'id' propertyuser:user};});}

getRefreshToken(refreshToken)

Invoked to retrieve an existing refresh token previously saved throughModel#saveToken().

This model function isrequired if therefresh_token grant is used.

Invoked during:

• refresh_token grant

Arguments:

Return value:

AnObject representing the refresh token and associated data.

token.client andtoken.user can carry additional properties that will be ignored byoauth2-server.

Remarks:

functiongetRefreshToken(refreshToken){// imaginary DB queriesreturndb.queryRefreshToken({refresh_token:refreshToken}).then(function(token){returnPromise.all([token,db.queryClient({id:token.client_id}),db.queryUser({id:token.user_id})]);}).spread(function(token,client,user){return{refreshToken:token.refresh_token,refreshTokenExpiresAt:token.expires_at,scope:token.scope,client:client,// with 'id' propertyuser:user};});}

getAuthorizationCode(authorizationCode)

Invoked to retrieve an existing authorization code previously saved throughModel#saveAuthorizationCode().

This model function isrequired if theauthorization_code grant is used.

Invoked during:

• authorization_code grant

Arguments:

Return value:

AnObject representing the authorization code and associated data.

code.client andcode.user can carry additional properties that will be ignored byoauth2-server.

Remarks:

functiongetAuthorizationCode(authorizationCode){// imaginary DB queriesreturndb.queryAuthorizationCode({authorization_code:authorizationCode}).then(function(code){returnPromise.all([code,db.queryClient({id:code.client_id}),db.queryUser({id:code.user_id})]);}).spread(function(code,client,user){return{authorizationCode:code.authorization_code,expiresAt:code.expires_at,redirectUri:code.redirect_uri,scope:code.scope,client:client,// with 'id' propertyuser:user};});}

getClient(clientId,clientSecret)

Invoked to retrieve a client using a client id or a client id/client secret combination, depending on the grant type.

This model function isrequired for all grant types.

Invoked during:

• authorization_code grant

• client_credentials grant

• refresh_token grant

• password grant

Arguments:

Return value:

AnObject representing the client and associated data, or a falsy value if no such client could be found.

The return value (client) can carry additional properties that will be ignored byoauth2-server.

Remarks:

functiongetClient(clientId,clientSecret){// imaginary DB queryletparams={client_id:clientId};if(clientSecret){params.client_secret=clientSecret;}returndb.queryClient(params).then(function(client){return{id:client.id,redirectUris:client.redirect_uris,grants:client.grants};});}

getUser(username,password,client)

Invoked to retrieve a user using a username/password combination.

This model function isrequired if thepassword grant is used.

Invoked during:

• password grant

Arguments:

Return value:

AnObject representing the user, or a falsy value if no such user could be found. The user object is completely transparent tooauth2-server and is simply used as input to other model functions.

Remarks:

functiongetUser(username,password){// imaginary DB queryreturndb.queryUser({username:username,password:password});}

getUserFromClient(client)

Invoked to retrieve the user associated with the specified client.

This model function isrequired if theclient_credentials grant is used.

Invoked during:

• client_credentials grant

Arguments:

Return value:

AnObject representing the user, or a falsy value if the client does not have an associated user. The user object is completely transparent tooauth2-server and is simply used as input to other model functions.

Remarks:

client is the object previously obtained throughModel#getClient().

functiongetUserFromClient(client){// imaginary DB queryreturndb.queryUser({id:client.user_id});}

saveToken(token,client,user)

Invoked to save an access token and optionally a refresh token, depending on the grant type.

This model function isrequired for all grant types.

Invoked during:

• authorization_code grant

• client_credentials grant

• refresh_token grant

• password grant

Arguments:

Return value:

AnObject representing the token(s) and associated data.

token.client andtoken.user can carry additional properties that will be ignored byoauth2-server.

If theallowExtendedTokenAttributes server option is enabled (seeOAuth2Server#token()) any additional attributes set on the result are copied to the token response sent to the client.

Remarks:

functionsaveToken(token,client,user){// imaginary DB queriesletfns=[db.saveAccessToken({access_token:token.accessToken,expires_at:token.accessTokenExpiresAt,scope:token.scope,client_id:client.id,user_id:user.id}),db.saveRefreshToken({refresh_token:token.refreshToken,expires_at:token.refreshTokenExpiresAt,scope:token.scope,client_id:client.id,user_id:user.id})];returnPromise.all(fns);.spread(function(accessToken,refreshToken){return{accessToken:accessToken.access_token,accessTokenExpiresAt:accessToken.expires_at,refreshToken:refreshToken.refresh_token,refreshTokenExpiresAt:refreshToken.expires_at,scope:accessToken.scope,client:{id:accessToken.client_id},user:{id:accessToken.user_id}};});}

saveAuthorizationCode(code,client,user)

Invoked to save an authorization code.

This model function isrequired if theauthorization_code grant is used.

Invoked during:

• authorization_code grant

Arguments:

Return value:

AnObject representing the authorization code and associated data.

code.client andcode.user can carry additional properties that will be ignored byoauth2-server.

Remarks:

functionsaveAuthorizationCode(code,client,user){// imaginary DB queriesletauthCode={authorization_code:code.authorizationCode,expires_at:code.expiresAt,redirect_uri:code.redirectUri,scope:code.scope,client_id:client.id,user_id:user.id};returndb.saveAuthorizationCode(authCode).then(function(authorizationCode){return{authorizationCode:authorizationCode.authorization_code,expiresAt:authorizationCode.expires_at,redirectUri:authorizationCode.redirect_uri,scope:authorizationCode.scope,client:{id:authorizationCode.client_id},user:{id:authorizationCode.user_id}};});}

revokeToken(token)

Invoked to revoke a refresh token.

This model function isrequired if therefresh_token grant is used.

Invoked during:

• refresh_token grant

Arguments:

Return value:

Returntrue if the revocation was successful orfalse if the refresh token could not be found.

Remarks:

token is the refresh token object previously obtained throughModel#getRefreshToken().

functionrevokeToken(token){// imaginary DB queriesreturndb.deleteRefreshToken({refresh_token:token.refreshToken}).then(function(refreshToken){return!!refreshToken;});}

revokeAuthorizationCode(code)

Invoked to revoke an authorization code.

This model function isrequired if theauthorization_code grant is used.

Invoked during:

• authorization_code grant

Arguments:

Return value:

Returntrue if the revocation was successful orfalse if the authorization code could not be found.

Remarks:

code is the authorization code object previously obtained throughModel#getAuthorizationCode().

functionrevokeAuthorizationCode(code){// imaginary DB queriesreturndb.deleteAuthorizationCode({authorization_code:code.authorizationCode}).then(function(authorizationCode){return!!authorizationCode;});}

validateScope(user,client,scope)

Invoked to check if the requestedscope is valid for a particularclient/user combination.

This model function isoptional. If not implemented, any scope is accepted.

Invoked during:

• authorization_code grant

• client_credentials grant

• password grant

Arguments:

Return value:

Validated scopes to be used or a falsy value to reject the requested scopes.

Remarks:

user is the user object previously obtained throughModel#getAuthorizationCode() (code.user; authorization code grant),Model#getUserFromClient() (client credentials grant) orModel#getUser() (password grant).

client is the object previously obtained throughModel#getClient (all grants).

You can decide yourself whether you want to reject or accept partially valid scopes by simply filtering out invalid scopes and returning only the valid ones.

To reject invalid or only partially valid scopes:

// list of valid scopesconstVALID_SCOPES=['read','write'];functionvalidateScope(user,client,scope){if(!scope.every(s=>VALID_SCOPES.indexOf(s)>=0)){returnfalse;}returnscope;}

To accept partially valid scopes:

// list of valid scopesconstVALID_SCOPES=['read','write'];functionvalidateScope(user,client,scope){returnscope.filter(s=>VALID_SCOPES.indexOf(s)>=0);}

verifyScope(accessToken,scope)

Invoked during request authentication to check if the provided access token was authorized the requested scopes.

This model function isrequired if scopes are used withOAuth2Server#authenticate()but it’s never called, if you provide your ownauthenticateHandler to the options.

Invoked during:

• request authentication

Arguments:

Return value:

Returnstrue if the access token passes,false otherwise.

Remarks:

token is the access token object previously obtained throughModel#getAccessToken().

scope is the required scope as given toOAuth2Server#authenticate() asoptions.scope.

functionverifyScope(token,requestedScopes){if(!token.scope){returnfalse;}letauthorizedScopes=token.scope;returnrequestedScopes.every(s=>token.scope.includes(scope));}

validateRedirectUri(redirectUri,client)

Invoked to check if the providedredirectUri is valid for a particularclient.

This model function isoptional. If not implemented, theredirectUri should be included in the providedredirectUris of the client.

Invoked during:

• authorization_code grant

Arguments:

Return value:

Returnstrue if theredirectUri is valid,false otherwise.

Remarks:When implementing this method you should take care of possible security risks related toredirectUri... _rfc6819:https://datatracker.ietf.org/doc/html/rfc6819

Section-5.2.3.5 is implemented by default... _Section-5.2.3.5:https://datatracker.ietf.org/doc/html/rfc6819#section-5.2.3.5

functionvalidateRedirectUri(redirectUri,client){returnclient.redirectUris.includes(redirectUri);}