server.js

passport.use(new BasicStrategy(
      function(username, password, done){
        // TODO: Check if the credentials are correct.
        // TODO: If not: done(null, false)
        // TODO: Else done(null, userObject)
      }
));
// Exchange resource owner credentials for an oauth key.
// FOR USE BY FIRST-PARTY APPS ONLY
server.exchange(oauth2orize.exchange.password(
      function(client, username, password, scope, done){
        // TODO: Check if the credentials are correct.
        // TODO: If credentials are valid, create an access token.
        // TODO: Send to client refresh/access token.
      }
))

// Refresh a token using a refreshToken
// Used to prevent expiration of oauth keys.
server.exchange(oauth2orize.exchange.refreshToken(
      function(client, refreshToken, scope, done){
        // TODO: Create an access token.
        // TODO: Send to client refresh/access token.
      }
))