class TokenHandler extends HttpResource {

   protected FullHttpResponse doHandleAuthorizationCode(String code, String redirect, String appId) throws Exception {
      // app shouldn't be null here because the ApplicationAuth implementation would reject the call
      // if the application couldn't be found
      Application app = appRegistry.getApplication(appId);
      if(!OAuthUtil.validateRedirect(redirect, app.getRedirect())) {
         OAuthMetrics.incAccessTokenInvalidRedirect();
         return OAuthUtil.badRequest();
      }

      Pair<UUID, Integer> personWithTtl = oauthDao.getPersonWithCode(appId, code);
      if(personWithTtl  == null) {
         OAuthMetrics.incAccessTokenExpiredCode();
         return OAuthUtil.badRequest();
      }

      oauthDao.removeCode(appId, code);
      try {
         FullHttpResponse response = updateTokensAndRespond(personWithTtl.getKey(), 0, appId, null);
         triggerPlaceAuthorizedIfNecessary(appId, personWithTtl.getKey());
         OAuthMetrics.incAccessTokenSuccess();
         return response;
      } catch(Exception e) {
         logger.warn("Failed to update tokens", e);
         OAuthMetrics.incAccessTokenException();
         throw e;
      }
   }

   @Inject public  TokenHandler(
         ApplicationAuth authorizer,
         BridgeMetrics metrics,
         AppRegistry appRegistry,
         OAuthDAO oauthDao,
         OAuthConfig config,
         PlaceSelectionHandler placeSelectionHandler
   );

}