"use strict";

var db = require('../models');

var requestHelper = require('../lib/request-helper');

module.exports = function(app, options) {
  app.post('/authorized', function(req, res) {
    if (!requestHelper.isContentType(req, 'application/x-www-form-urlencoded')) {
      res.json(400, { error: 'invalid_request' });
      return;
    }

    var accessToken = req.body.token;

    if (!accessToken) {
      res.json(400, { error: 'invalid_request' });
      return;
    }

    var serviceProviderId = req.body.service_provider_id;

    if (!serviceProviderId) {
      res.json(400, { error: 'invalid_request' });
      return;
    }

    // TODO: do this in a single query?

    db.ServiceProvider
      .find({ where: { name: serviceProviderId } })
      .complete(function(err, serviceProvider) {
        if (err) {
          res.send(500);
          return;
        }

        if (!serviceProvider) {
          res.send(401, { error: 'unauthorized' });
          return;
        }

        var query = {
          token: accessToken,
          service_provider_id: serviceProvider.id
        };

        db.ServiceAccessToken
          .find({ where: query })
          .complete(function(err, accessToken) {
            if (err) {
              res.send(500);
              return;
            }

            if (!accessToken) {
              res.send(401, { error: 'unauthorized' });
              return;
            }

            var query = {
              id: accessToken.user_id
            };

            db.User
              .find({ where: query })
              .complete(function(err, user) {
                if (err) {
                  res.send(500);
                  return;
                }

                if (!user) {
                  res.send(500);
                  return;
                }

                var rsp = {
                  client_id: accessToken.client_id,
                  user_id:   user.id
                };

                if (user.display_name) rsp.display_name = user.display_name;
                if (user.photo) rsp.photo = user.photo;

                res.json(rsp);
              });
          });
      });
  });
};

@@ -1735,18 +1735,17 @@
     
-if (!user)
+var rsp =
  %7B%0A 
@@ -1765,48 +1765,40 @@
     
-res.send(500);%0A                  return;
+client_id: accessToken.client_id
 %0A   
@@ -1803,32 +1803,33 @@
                %7D
+;
 %0A%0A              
@@ -1826,33 +1826,33 @@
             
-var rsp =
+if (user)
  %7B%0A         
@@ -1864,78 +1864,29 @@
     
-client_id: accessToken.client_id,%0A                  
+rsp.
 user_id
-: 
  
+=
  user.id
 %0A   
@@ -1881,37 +1881,20 @@
  user.id
+;
 %0A  
-              %7D;%0A%0A
         
@@ -1923,16 +1923,38 @@
 ay_name)
+ %7B%0A                   
  rsp.dis
@@ -2004,47 +2004,129 @@
     
-if (user.photo) rsp.photo = user.photo;
+  %7D%0A                  if (user.photo) %7B%0A                    rsp.photo = user.photo;%0A                  %7D%0A                %7D
 %0A%0A  

Fix 500 when a service provider tries to authorize a device in client_mode