routes/oauth2.js
function(req, res, next) {

    var props = getProps(req.body);

    // Closure to make this a little shorter
    var redirectError = function(type) {
        var qp = {error: type, state: props.state};
        res.redirect(props.redirect_uri + "?" + qs.stringify(qp));
    };

    verifyProps(props, function(err, client) {

        if (err) {
            next(err);
        } else {

            if (!req.principal || !req.principalUser) {
                return next(new Error("Unexpected login state"));
            }

            if (req.body.denied) {
                req.log.info("OAuth 2.0 access denied");
                redirectError("access_denied");
            } else {
                Step(
                    function() {
                        var acprops = {
                            nickname: req.principalUser.nickname,
                            client_id: client.consumer_key,
                            redirect_uri: props.redirect_uri,
                            scope: props.scope
                        };
                        AuthorizationCode.create(acprops, this);
                    },
                    function(err, ac) {
                        if (err) {
                          req.log.error({err: err}, err.message);
                          return redirectError("server_error");
                        }
                        var rprops = {
                            code: ac.code,
                            state: props.state
                        };
                        var rurl = props.redirect_uri +
                            "?" +
                             qs.stringify(rprops);
                        res.redirect(303, rurl);
                    }
                );
            }
        }
    });
}
function(req, res, next) {

    var props = getProps(req.body);

    // Closure to make this a little shorter
    var redirectError = function(type) {
        var qp = {error: type, state: props.state};
        res.redirect(props.redirect_uri + "?" + qs.stringify(qp));
    };

    verifyProps(props, function(err, client) {

        if (err) {
            next(err);
        } else {

            if (!req.principal || !req.principalUser) {
                return next(new Error("Unexpected login state"));
            }

            if (req.body.denied) {
                req.log.info("OAuth 2.0 access denied");
                redirectError("access_denied");
            } else {
                Step(
                    function() {
                        var acprops = {
                            nickname: req.principalUser.nickname,
                            client_id: client.consumer_key,
                            redirect_uri: props.redirect_uri,
                            scope: props.scope
                        };
                        AuthorizationCode.create(acprops, this);
                    },
                    function(err, ac) {
                        if (err) {
                          req.log.error({err: err}, err.message);
                          return redirectError("server_error");
                        }
                        var rprops = {
                            code: ac.code,
                            state: props.state
                        };
                        var rurl = props.redirect_uri +
                            "?" +
                             qs.stringify(rprops);
                        res.redirect(303, rurl);
                    }
                );
            }
        }
    });
}
POST /oauth2/authz response_type=code&redirect_uri=...&client_id=...&scope=...&state=...