class AuthorizeHandler extends HttpResource {

   protected FullHttpResponse doRespond(UUID loggedInPerson, Map<String,String> params) {
      OAuthMetrics.incAuthorizeRequests();
      String clientId = params.get(OAuthUtil.ATTR_CLIENT_ID);

      Application app = appRegistry.getApplication(clientId);

      String responseType = params.get(OAuthUtil.ATTR_RESPONSETYPE);
      String redirect = params.get(OAuthUtil.ATTR_REDIRECT_URI);

      if(StringUtils.isBlank(redirect)) {
         redirect = app.getRedirect();
      }

      if(!OAuthUtil.validateRedirect(redirect, app.getRedirect())) {
         OAuthMetrics.incAuthorizeInvalidRedirect();
         return OAuthUtil.badRequest("invalid redirect uri");
      }

      String state = params.get(OAuthUtil.ATTR_STATE);
      String scope = params.get(OAuthUtil.ATTR_SCOPE);

      Map<String,String> attrs = extractAttrs(app, params);

      if(app.getExtraQueryParams().size() != attrs.size()) {
         OAuthMetrics.incAuthorizeMissingExtraData();
         return redirectError(redirect, state, OAuthUtil.ERR_INVALID_REQUEST);
      }

      if(!Objects.equal(OAuthUtil.ATTR_CODE, responseType)) {
         OAuthMetrics.incAuthorizeUnsupportedType();
         return redirectError(redirect, state, OAuthUtil.ERR_UNSUPPORTED_RESPONSE_TYPE);
      }

      if(!validScope(scope, app)) {
         OAuthMetrics.incAuthorizeInvalidScope();
         return redirectError(redirect, state, OAuthUtil.ERR_INVALID_SCOPE);
      }

      try {
         String code = IrisUUID.randomUUID().toString();
         oauthDao.insertCode(clientId, code, loggedInPerson, attrs);

         OAuthMetrics.incAuthorizeSuccess();
         return redirectSuccess(redirect, state, code);
      } catch(Exception e) {
         OAuthMetrics.incAuthorizeCannotCreateCode();
         logger.error("failed to create code", e);
         return redirectError(redirect, state, OAuthUtil.ERR_SERVER_ERROR);
      }
   }

   @Inject public  AuthorizeHandler(ClientFactory clientFactory, SessionAuthDelegate authorizer, BridgeMetrics metrics, OAuthDAO oauthDao, AppRegistry appRegistry);

}