diff --git a/src/routes/oauth2.js b/src/routes/oauth2.js index 0f381a491..78fd0223e 100644 --- a/src/routes/oauth2.js +++ b/src/routes/oauth2.js @@ -377,7 +377,17 @@ var authorization = [ }); }), function (req, res, next) { - appdb.get(req.oauth2.client.appId, function (error, appObject) { + // Handle our different types of oauth clients + var appId = req.oauth2.client.appId; + + // TODO find a smarter way to test these + if (appId === constants.ADMIN_CLIENT_ID) return next(); + if (appId === constants.TEST_CLIENT_ID) return next(); + if (appId.indexOf('external-') === 0) return next(); + if (appId.indexOf('addon-oauth-') === 0) appId = appId.slice('addon-oauth-'.length); + if (appId.indexOf('proxy-') === 0) appId = appId.slice('proxy-'.length); + + appdb.get(appId, function (error, appObject) { if (error) return sendErrorPageOrRedirect(req, res, 'Invalid request. Unknown app for this client_id.'); if (!apps.hasAccessTo(appObject, req.oauth2.user)) return sendErrorPageOrRedirect(req, res, 'No access to this app.');