routes/oauth2.js
function(req, res, next) {

    var props = getProps(req.query);

    // Closure to make this a little shorter
    var redirectError = function(type) {
        var qp = {error: type, state: props.state};
        res.redirect(props.redirect_uri + "?" + qs.stringify(qp));
    };

    verifyProps(props, function(err, client) {
        if (err) {
            if (err instanceof RedirectError) {
                req.log.error({err: err}, "Couldn't verify props");
                redirectError(err.type);
            } else {
                next(err);
            }
        } else {

            // Check login state

            if (!req.principal) {
                // Not logged in; login and come back
                res.redirect("/oauth2/authc?" + qs.stringify(props));
            } else if (!req.principalUser) {
                // Remote user
                req.log.error("OAuth 2.0 authorization for remote user");
                return redirectError("invalid_request");
            } else {
                var aprops = _.extend(props, {
                    client: client
                });
                res.render("oauth2-authorize", aprops);
            }
        }
    });
}
function(req, res, next) {

    var props = getProps(req.query);

    // Closure to make this a little shorter
    var redirectError = function(type) {
        var qp = {error: type, state: props.state};
        res.redirect(props.redirect_uri + "?" + qs.stringify(qp));
    };

    verifyProps(props, function(err, client) {
        if (err) {
            if (err instanceof RedirectError) {
                req.log.error({err: err}, "Couldn't verify props");
                redirectError(err.type);
            } else {
                next(err);
            }
        } else {

            // Check login state

            if (!req.principal) {
                // Not logged in; login and come back
                res.redirect("/oauth2/authc?" + qs.stringify(props));
            } else if (!req.principalUser) {
                // Remote user
                req.log.error("OAuth 2.0 authorization for remote user");
                return redirectError("invalid_request");
            } else {
                var aprops = _.extend(props, {
                    client: client
                });
                res.render("oauth2-authorize", aprops);
            }
        }
    });
}
GET /oauth2/authz?response_type=code&redirect_uri=...&client_id=...&scope=...&state=...