/**
 * Module dependencies.
 */
var passport = require('passport-strategy')
  , util = require('util');


/**
 * `Strategy` constructor.
 *
 * The HTTP Bearer authentication strategy authenticates requests based on
 * a bearer token contained in the `Authorization` header field, `access_token`
 * body parameter, or `access_token` query parameter.
 *
 * Applications must supply a `verify` callback which accepts a `token`, and
 * then calls the `done` callback supplying a `user`, which should be set to
 * `false` if the token is not valid.  Additional token `info` can optionally be
 * passed as a third argument, which will be set by Passport at `req.authInfo`,
 * where it can be used by later middleware for access control.  This is
 * typically used to pass any scope associated with the token.
 *
 * Options:
 *   - `realm`  authentication realm, defaults to "Users"
 *   - `scope`  list of scope values indicating the required scope of the access token for accessing the requested resource
 *
 * Examples:
 *
 *     passport.use(new BearerStrategy(
 *       function(token, done) {
 *         User.findByToken({ token: token }, function (err, user) {
 *           if (err) { return done(err); }
 *           if (!user) { return done(null, false); }
 *           return done(null, user, { scope: 'all' });
 *         });
 *       }
 *     ));
 *
 * For further details on HTTP Bearer authentication, refer to [The OAuth 2.0 Authorization Protocol: Bearer Tokens](http://tools.ietf.org/html/draft-ietf-oauth-v2-bearer)
 *
 * @param {Object} options
 * @param {Function} verify
 * @api public
 */
function Strategy(options, verify) {
  if (typeof options == 'function') {
    verify = options;
    options = {};
  }
  if (!verify) throw new TypeError('passport-http-bearer.Strategy requires a verify callback');
  
  passport.Strategy.call(this);
  this.name = 'bearer';
  this._verify = verify;
  this._realm = options.realm || 'Users';
  if (options.scope) {
    this._scope = (Array.isArray(options.scope)) ? options.scope : [ options.scope ];
  }
  this._passReqToCallback = options.passReqToCallback;
}

/**
 * Inherit from `passport.Strategy`.
 */
util.inherits(Strategy, passport.Strategy);

/**
 * Authenticate request based on the contents of a HTTP Bearer authorization
 * header, body parameter, or query parameter.
 *
 * @param {Object} req
 * @api protected
 */
Strategy.prototype.authenticate = function(req) {
  var token = undefined;
  
  if (req.headers && req.headers['authorization']) {
    var parts = req.headers['authorization'].split(' ');
    if (parts.length == 2) {
      var scheme = parts[0]
        , credentials = parts[1];
        
      if (/^Bearer$/i.test(scheme)) {
        token = credentials;
      }
    } else {
      return this.fail(400);
    }
  }

  if (req.body && req.body['access_token']) {
    if (token) { return this.fail(400); }
    token = req.body['access_token'];
  }

  if (req.query && req.query['access_token']) {
    if (token) { return this.fail(400); }
    token = req.query['access_token'];
  }
  
  if (!token) { return this.fail(this._challenge()); }
  
  var self = this;
  
  function verified(err, user, info) {
    if (err) { return self.error(err); }
    if (!user) { return self.fail(self._challenge('invalid_token')); }
    self.success(user, info);
  } 
  
  if (self._passReqToCallback) {
    this._verify(req, token, verified);
  } else {
    this._verify(token, verified);
  }  
 
}

/**
 * Authentication challenge.
 *
 * @api private
 */
Strategy.prototype._challenge = function(code, desc, uri) {
  var challenge = 'Bearer realm="' + this._realm + '"';
  if (this._scope) {
    challenge += ', scope="' + this._scope.join(' ') + '"';
  }
  if (code) {
    challenge += ', error="' + code + '"';
  }
  if (desc && desc.length) {
    challenge += ', error_description="' + desc + '"';
  }
  if (uri && uri.length) {
    challenge += ', error_uri="' + uri + '"';
  }
  
  return challenge;
}


/**
 * Expose `Strategy`.
 */ 
module.exports = Strategy;

@@ -110,30 +110,41 @@
 %0A * 
-%60Strategy%60 constructor
+Creates an instance of %60Strategy%60
 .%0A *
@@ -407,151 +407,425 @@
 back
+, for
  which 
-accepts a %60
+the function%0A * signature is:%0A *%0A *     function(
 token
-%60
 , 
-and%0A * then calls the %60done%60 callback supplying a %60user%60, which should be set to%0A * %60false%60 if the token is not valid
+done) %7B ... %7D%0A *%0A * %60token%60 is the bearer token provided as a credential.  The verify callback%0A * is responsible for finding the user who posesses the token, and invoking%0A * %60done%60 with the following arguments:%0A *%0A *     done(err, user, info);%0A *%0A * If the token is not valid, %60user%60 should be set to %60false%60 to indicate an%0A * authentication failure
 .  A
@@ -864,19 +864,16 @@
 nally be
-%0A *
  passed 
@@ -874,16 +874,19 @@
 assed as
+%0A *
  a third
@@ -944,19 +944,16 @@
 thInfo%60,
-%0A *
  where i
@@ -953,16 +953,19 @@
 where it
+%0A *
  can be 
@@ -1017,19 +1017,16 @@
  This is
-%0A *
  typical
@@ -1032,16 +1032,19 @@
 lly used
+%0A *
  to pass
@@ -1096,16 +1096,19 @@
 ptions:%0A
+ *%0A
  *   - %60
@@ -1237,16 +1237,32 @@
 e access
+%0A *             
  token f
@@ -1603,19 +1603,20 @@
 scope: '
-all
+read
 ' %7D);%0A *
@@ -1824,24 +1824,40 @@
 -bearer)%0A *%0A
+ * @constructor%0A
  * @param %7BO
@@ -1863,23 +1863,25 @@
 Object%7D 
+%5B
 options
+%5D
 %0A * @par
@@ -2763,20 +2763,8 @@
 oken
- = undefined
 ;%0A  
@@ -3767,33 +3767,39 @@
 %7D  %0A %0A%7D%0A%0A/**%0A * 
-A
+Build a
 uthentication ch

Clarify documentation.