add comments

backend/app/rest/auth/dev_provider.go

@@ -17,6 +17,10 @@ import (
 const devAuthPort = 8084
 
 // DevAuthServer is a fake oauth server for development
+// it provides stand-alone server running on its own port and pretending to be the real oauth2. It also provides
+// Dev Provider the same way as normal providers di, i.e. github, google and others.
+// can run in interractive and non-interactive mode. In interactive mode login attempts will show login form to select
+// desired user name.
 type DevAuthServer struct {
 	Provider Provider
 
@@ -38,7 +42,7 @@ func (d *DevAuthServer) Run() {
 			switch {
 
 			case strings.HasPrefix(r.URL.Path, "/login/oauth/authorize"):
-
+				// first time it will be called without usernam and will ask for onw
 				if !d.nonInteractive && (r.ParseForm() != nil || r.Form.Get("username") == "") {
 					if _, err := w.Write([]byte(fmt.Sprintf(devUserForm, r.URL.RawQuery))); err != nil {
 						log.Printf("[WARN] can't write, %s", err)

backend/app/rest/auth/jwt.go

@@ -24,7 +24,7 @@ type CustomClaims struct {
 	jwt.StandardClaims
 	User *store.User `json:"user,omitempty"`
 
-	// state and from used for oauth handshake
+	// used for oauth handshake
 	State       string `json:"state,omitempty"`
 	From        string `json:"from,omitempty"`
 	SiteID      string `json:"site_id,omitempty"`