domenic/restify-oauth2 — pull request #20 by ebymatthew (2014-04-14 03:35:57+00:00)
Title:  add a clientType option for ROPC flows to allow for public client types

I'm working on a client application where confidentiality of the client credentials cannot be maintained and therefore falls under the OAuth2 definition of a public client type. I've found *restify-oauth2* very helpful and would love to see this change integrated (or some form of support for public clients). Below is a summary of the relevant OAuth2 sections and a summary of my changes...

OAuth2 describes [two types of clients](http://tools.ietf.org/html/rfc6749#section-2.1) **public** and **confidential**.

The [CC flow](http://tools.ietf.org/html/rfc6749#section-4.4) must only be used by **confidential** client types.

The [ROPC flow](http://tools.ietf.org/html/rfc6749#section-4.3) allows either **public** or **private** client types.

With this pull request, I've added an additional option **clientType** that can be passed to *restifyOAuth2.ropc*. Valid values are **public** or **confidential**. It defaults to **confidential** to preserve compatibility with previous versions.