is it wrong to get oauth code

[Garfield-yin]

when i want to get auth code,but need access token in authenticate.

[maxtruxa]

I agree, the authorization_code grant flow seems to be broken. I'm currently writing up an overview of the problem that I will post in #304 once I'm done. I'll provide a fix if nobody tells me that there is a better one (something that works with the current implementation.

[maxtruxa]

Correction: Broken was a bit of a strong wording. You can override the default behavior by providing your own authenticateHandler to OAuth2Server#authorize. It has to implement a handle function like this:

....authorize({
  authenticateHandler: {
    handle: function(req, res) {
      // get authenticated user or return falsy value, e.g.:
      return req.session.user;
    }
  }
});

[juandiegopalomino]

@maxtruxa , your response is very insightful, but I would like to add a small clarification/explanation: when the authorize handler object attempts to get the user, it defaults to the original authenticate handler (as in the authenticate handler object in the library). This handler, in turn does its job by looking for tokens throughout the http request. Here, we have the chicken-before-the-egg conundrum between the token and code. The solution @maxtruxa is suggesting (which I really like), is to reset the "authenticate handler" to one that just looks at the current session (courtesy of passport or whatever session middleware there's available). I think this is a good approach because by this point, you're POSTing to the oauth server (they already clicked the "yes, let so-and-so app see my data" button), meaning that you must have already gotten the person logged in, so you should have their session.
These are my thoughts after scrambling around for a couple of hours. I'm pretty sure I got a couple of things wrong, and would love feedback!

[maxtruxa]

You're absolutely right. The default handler would work if you already had an existing access token, but I don't think it's a good idea to allow refreshing of said access token by just posting it to the token endpoint. That's what refresh tokens are for.

Depending on feedback I'll probably propose to remove the default handling; simply because it doesn't make sense.

[lfk]

Personally I'm all for removing that default, and it might be worth pointing out that this is not the first time similar thoughts and questions have been raised: #264 :)

[maxtruxa]

Closing in favor of #264.