class SessionAuthDelegate implements RequestAuthorizer {

   protected Application validateAndGetApplication(Map<String,String> params) throws ErrorEventException {
      String clientId = params.get(OAuthUtil.ATTR_CLIENT_ID);
      if(StringUtils.isBlank(clientId)) {
         throw new ErrorEventException(Errors.CODE_MISSING_PARAM, "Missing or invalid client_id");
      }

      Application app = appRegistry.getApplication(params.get(OAuthUtil.ATTR_CLIENT_ID));
      if(app == null) {
         throw new ErrorEventException(Errors.CODE_MISSING_PARAM, "Missing or invalid client_id");
      }

      if(app.isSendsRedirectQueryParam()) {
         String redirectUri = params.get(OAuthUtil.ATTR_REDIRECT_URI);
         if(StringUtils.isBlank(redirectUri)) {
            throw new ErrorEventException(Errors.CODE_MISSING_PARAM, "Missing or invalid redirect_uri");
         }
         if(!Objects.equal(redirectUri, app.getRedirect())) {
            throw new ErrorEventException(Errors.CODE_MISSING_PARAM, "Missing or invalid redirect_uri");
         }
      }
      return app;
   }

   @Inject public  SessionAuthDelegate(
         SessionAuth sessionAuth,
         Authenticator authenticator,
         TemplateService tmplSvc,
         OAuthConfig config,
         AppRegistry appRegistry,
         BridgeMetrics metrics);

}