{"action":"created","issue":{"url":"https://api.github.com/repos/thomseddon/node-oauth2-server/issues/203","repository_url":"https://api.github.com/repos/thomseddon/node-oauth2-server","labels_url":"https://api.github.com/repos/thomseddon/node-oauth2-server/issues/203/labels{/name}","comments_url":"https://api.github.com/repos/thomseddon/node-oauth2-server/issues/203/comments","events_url":"https://api.github.com/repos/thomseddon/node-oauth2-server/issues/203/events","html_url":"https://github.com/thomseddon/node-oauth2-server/pull/203","id":96437283,"number":203,"title":"Refactor project","user":{"login":"nunofgs","id":92085,"avatar_url":"https://avatars.githubusercontent.com/u/92085?v=3","gravatar_id":"","url":"https://api.github.com/users/nunofgs","html_url":"https://github.com/nunofgs","followers_url":"https://api.github.com/users/nunofgs/followers","following_url":"https://api.github.com/users/nunofgs/following{/other_user}","gists_url":"https://api.github.com/users/nunofgs/gists{/gist_id}","starred_url":"https://api.github.com/users/nunofgs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nunofgs/subscriptions","organizations_url":"https://api.github.com/users/nunofgs/orgs","repos_url":"https://api.github.com/users/nunofgs/repos","events_url":"https://api.github.com/users/nunofgs/events{/privacy}","received_events_url":"https://api.github.com/users/nunofgs/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":58,"created_at":"2015-07-21T23:14:51Z","updated_at":"2016-02-03T10:40:17Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/thomseddon/node-oauth2-server/pulls/203","html_url":"https://github.com/thomseddon/node-oauth2-server/pull/203","diff_url":"https://github.com/thomseddon/node-oauth2-server/pull/203.diff","patch_url":"https://github.com/thomseddon/node-oauth2-server/pull/203.patch"},"body":"This PR completely restructures the project into a more modern Promise-based approach. Among many many fixes, it also adds support for scopes, changes the license to MIT, validates user input according to the OAuth spec, removes express-specific middlewares, improves error handling and is fully tested.\r\n\r\nI know this is a monumental PR and is quite a big shift in style and approach, it is my opinion that it greatly enhances this library and further establishes it as the de-facto OAuth server library for node.\r\n\r\nI'd love to know what you think.\r\n\r\n# OAuth2-Server\r\n\r\nIntroduces a new OAuth server implementation with the following changes:\r\n\r\n  * Added a promise-based API which supports both promises and *node-style* callbacks.\r\n  * Added support for scopes for all grant types.\r\n  * Added syntax-checking to all user input as defined in the [spec](https://tools.ietf.org/html/rfc6749#appendix-A).\r\n  * Added OAuth client validation to authorization requests which fixes an edge-case where an auth code would be generated even if the OAuth client did not support *authorization codes*.\r\n  * Fixed authorization requests now defer to the authentication middleware in order to verify that the request is authenticated (in the process, multiple bugs were fixed since the original library was doing this in place and consequently skipping many important checks).\r\n  * Fixed incorrect (non-spec compliant) validation of the *redirectUri* in the *authorization_code* grant.\r\n  * Fixed incorrect handling of custom grant types (the spec requires that extended grants be specified in the form of a *uri*).\r\n  * Fixed non-spec compliant behavior when validating unsupported grant types.\r\n  * Fixed non-[spec](https://tools.ietf.org/html/rfc6749) compliant errors being returned to the response.\r\n  * Fixed objects retrieved from the model are no longer injected into the current execution context and are instead returned in the original promise.\r\n  * Fixed parameters given to model calls are now objects previously fetched from the model which reduces the number of database queries per OAuth request.\r\n  * Fixed tokens are no longer allowed to be passed by GET parameter as recommended by the OAuth spec, for security reasons.\r\n  * Improved *authorization_code* grant by allowing the *redirect_uri* parameter to be omitted (as required by the spec).\r\n  * Improved *authorization_code* grant type by revoking the authorization code immediately upon issuing an access token (as required by the spec).\r\n  * Improved *refresh_token* grant type by revoking the previous *refresh_token* immediately upon issuing an access token (as required by the spec).\r\n  * Improved architecture by separating the *grant-types*, *response-types* and *token-types* into strongly typed classes.\r\n  * Improved error handling by throwing strongly-typed errors so they can be caught in our backend.\r\n  * Improved error handling by wrapping model errors in a *server_error*, as required by the [spec](https://tools.ietf.org/html/rfc6749).\r\n  * Improved validation of all objects retrieved from the model (no validation was being done on expiry dates, for example).\r\n  * Removed dependency on the *express* framework.\r\n  * Removed injection of response body and headers in favor of strongly-typed *Request* and *Response* classes.\r\n  * Renamed *authorise*, *grant* and *authCodeGrant* middlewares to more OAuth spec-friendly *authenticate*, *token* and *authorize*, respectively."},"comment":{"url":"https://api.github.com/repos/thomseddon/node-oauth2-server/issues/comments/179158570","html_url":"https://github.com/thomseddon/node-oauth2-server/pull/203#issuecomment-179158570","issue_url":"https://api.github.com/repos/thomseddon/node-oauth2-server/issues/203","id":179158570,"user":{"login":"nunofgs","id":92085,"avatar_url":"https://avatars.githubusercontent.com/u/92085?v=3","gravatar_id":"","url":"https://api.github.com/users/nunofgs","html_url":"https://github.com/nunofgs","followers_url":"https://api.github.com/users/nunofgs/followers","following_url":"https://api.github.com/users/nunofgs/following{/other_user}","gists_url":"https://api.github.com/users/nunofgs/gists{/gist_id}","starred_url":"https://api.github.com/users/nunofgs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nunofgs/subscriptions","organizations_url":"https://api.github.com/users/nunofgs/orgs","repos_url":"https://api.github.com/users/nunofgs/repos","events_url":"https://api.github.com/users/nunofgs/events{/privacy}","received_events_url":"https://api.github.com/users/nunofgs/received_events","type":"User","site_admin":false},"created_at":"2016-02-03T10:40:17Z","updated_at":"2016-02-03T10:40:17Z","body":"@djMax: I don't think we need to go as far as forking. Clearly the node-oauth2-server community (and maintainers) are open to this change.\r\n\r\nThis is more of a failing on my part. I have a demanding job and personal responsibilities and the more time I leave this PR open, the harder it is to wrap my head around it when I have time to work on it.\r\n\r\nThat said, I agree we need to get this thing out the door. I'll get to work on it this week."}}