node.js – 使用范围保护API(oauth2orize,passport,express,Nodejs)

oauth2orize令牌hander-outer：

server.exchange(oauth2orize.exchange.password(function (client,username,password,scope,donE) {
scope = scope || ['unauthorized'];
db.collection('oauth_users').findOne({username: usernamE},function (err,user) {
    if (err) return done(err);
    if (!user) return done(null,falsE);
    for (i in scopE)
        if(user.scope.indexOf(scope[i]) < 0) return done(null,falsE);
    bcrypt.compare(password,user.password,res) {
        if (!res) return done(null,falsE);

        var token = utilS.Uid(256)
        var refreshToken = utilS.Uid(256)
        var tokenHash = crypto.createHash('sha1').update(token).digest('hex')
        var refreshTokenHash = crypto.createHash('sha1').update(refreshToken).digest('hex')

        var expirationDate = new Date(new Date().getTime() + (3600 * 1000))

        db.collection('oauth_access_tokens').save({token: tokenHash,expirationDate: expirationDate,clientId: client.clientId,userId: username,scope: scopE},function (err) {
            if (err) return done(err)
            db.collection('oauth_refresh_tokens').save({refreshToken: refreshTokenHash,userId: usernamE},function (err) {
                if (err) return done(err)
                done(null,token,refreshToken,{expires_in: expirationDatE})
            })
        })
    })
}) }))

护照持票人令牌检查员：

passport.use("accessToken",new BearerStrategy(
{passReqToCallBACk: truE},function (req,accessToken,donE) {
    console.dir(req.params);
    var accessTokenHash = crypto.createHash('sha1').update(accessToken).digest('hex')
    db.collection('oauth_access_tokens').findOne({token: accessTokenHash},token) {
        if (err) return done(err);
        if (!token) return done(null,falsE);
        if (new Date() > token.expirationDatE) {
            db.collection('oauth_access_tokens').remove({token: accessTokenHash},function (err) { done(err) });
        } else {
            db.collection('oauth_users').findOne({username: token.userID},user) {
                if (err) return done(err);
                if (!user) return done(null,falsE);
                // no use of scopes for no
                var info = { scope: '*' }
                done(null,user,info);
            })
        }
    })
}))

API安全性：

router.get('/reStricted',passport.authenticate('accessToken',{ scope: "unauthorized",session: false }),res) {
res.send("ReStricted Function");})

我找不到访问passport.authenticate中传递给passport.use的“范围”选项的示例.我以为它是在req对象中,但我找不到它.有帮助吗？