| 67 | 67 |
end
|
| 68 | 68 |
|
| 69 | 69 |
def callback_phase
|
| 70 | |
super
|
| 71 | |
rescue NoAuthorizationCodeError => e
|
| 72 | |
fail!(:no_authorization_code, e)
|
| 73 | |
rescue UnknownSignatureAlgorithmError => e
|
| 74 | |
fail!(:unknown_signature_algoruthm, e)
|
| 75 | |
end
|
| 76 | |
|
| 77 | |
def request_phase
|
| 78 | |
if signed_request_contains_access_token?
|
| 79 | |
# If we already have an access token, we can just hit the callback URL directly and pass the signed request.
|
| 80 | |
params = { :signed_request => raw_signed_request }
|
| 81 | |
query = Rack::Utils.build_query(params)
|
| 82 | |
|
| 83 | |
url = callback_url
|
| 84 | |
url << "?" unless url.match(/\?/)
|
| 85 | |
url << "&" unless url.match(/[\&\?]$/)
|
| 86 | |
url << query
|
| 87 | |
|
| 88 | |
redirect url
|
| 89 | |
else
|
| 90 | |
super
|
|
70 |
with_authorization_code! do
|
|
71 |
begin
|
|
72 |
super
|
|
73 |
rescue NoAuthorizationCodeError => e
|
|
74 |
fail!(:no_authorization_code, e)
|
|
75 |
rescue UnknownSignatureAlgorithmError => e
|
|
76 |
fail!(:unknown_signature_algoruthm, e)
|
|
77 |
end
|
| 91 | 78 |
end
|
| 92 | 79 |
end
|
| 93 | 80 |
|
| 94 | 81 |
# NOTE If we're using code from the signed request then FB sets the redirect_uri to '' during the authorize
|
| 95 | 82 |
# phase and it must match during the access_token phase:
|
| 96 | |
# https://github.com/facebook/php-sdk/blob/master/src/base_facebook.php#L348
|
|
83 |
# https://github.com/facebook/facebook-php-sdk/blob/master/src/base_facebook.php#L477
|
| 97 | 84 |
def callback_url
|
| 98 | |
if @authorization_code_from_signed_request
|
|
85 |
if @authorization_code_from_signed_request_in_cookie
|
| 99 | 86 |
''
|
| 100 | 87 |
else
|
| 101 | 88 |
options[:callback_url] || super
|
|
| 109 | 96 |
# You can pass +display+, +scope+, or +auth_type+ params to the auth request, if you need to set them dynamically.
|
| 110 | 97 |
# You can also set these options in the OmniAuth config :authorize_params option.
|
| 111 | 98 |
#
|
| 112 | |
# /auth/facebook?display=popup
|
|
99 |
# For example: /auth/facebook?display=popup
|
| 113 | 100 |
def authorize_params
|
| 114 | 101 |
super.tap do |params|
|
| 115 | 102 |
%w[display scope auth_type].each do |v|
|
|
| 122 | 109 |
end
|
| 123 | 110 |
end
|
| 124 | 111 |
|
| 125 | |
# Parse signed request in order, from:
|
| 126 | |
#
|
| 127 | |
# 1. The request 'signed_request' param (server-side flow from canvas pages) or
|
| 128 | |
# 2. A cookie (client-side flow via JS SDK)
|
| 129 | |
def signed_request
|
| 130 | |
@signed_request ||= raw_signed_request && parse_signed_request(raw_signed_request)
|
| 131 | |
end
|
| 132 | |
|
| 133 | 112 |
protected
|
| 134 | 113 |
|
| 135 | 114 |
def build_access_token
|
| 136 | |
if signed_request_contains_access_token?
|
| 137 | |
hash = signed_request.clone
|
| 138 | |
::OAuth2::AccessToken.new(
|
| 139 | |
client,
|
| 140 | |
hash.delete('oauth_token'),
|
| 141 | |
hash.merge!(access_token_options.merge(:expires_at => hash.delete('expires')))
|
| 142 | |
)
|
| 143 | |
else
|
| 144 | |
with_authorization_code! { super }.tap do |token|
|
| 145 | |
token.options.merge!(access_token_options)
|
| 146 | |
end
|
|
115 |
super.tap do |token|
|
|
116 |
token.options.merge!(access_token_options)
|
| 147 | 117 |
end
|
| 148 | 118 |
end
|
| 149 | 119 |
|
| 150 | 120 |
private
|
| 151 | 121 |
|
| 152 | |
def raw_signed_request
|
| 153 | |
request.params['signed_request'] || request.cookies["fbsr_#{client.id}"]
|
| 154 | |
end
|
| 155 | |
|
| 156 | |
# If the signed_request comes from a FB canvas page and the user has already authorized your application, the JSON
|
| 157 | |
# object will be contain the access token.
|
| 158 | |
#
|
| 159 | |
# https://developers.facebook.com/docs/authentication/canvas/
|
| 160 | |
def signed_request_contains_access_token?
|
| 161 | |
signed_request && signed_request['oauth_token']
|
|
122 |
def signed_request_from_cookie
|
|
123 |
@signed_request_from_cookie ||= raw_signed_request_from_cookie && parse_signed_request(raw_signed_request_from_cookie)
|
|
124 |
end
|
|
125 |
|
|
126 |
def raw_signed_request_from_cookie
|
|
127 |
request.cookies["fbsr_#{client.id}"]
|
| 162 | 128 |
end
|
| 163 | 129 |
|
| 164 | 130 |
# Picks the authorization code in order, from:
|
| 165 | 131 |
#
|
| 166 | 132 |
# 1. The request 'code' param (manual callback from standard server-side flow)
|
| 167 | |
# 2. A signed request (see #signed_request for more)
|
|
133 |
# 2. A signed request from cookie (passed from the client during the client-side flow)
|
| 168 | 134 |
def with_authorization_code!
|
| 169 | 135 |
if request.params.key?('code')
|
| 170 | 136 |
yield
|
| 171 | |
elsif code_from_signed_request = signed_request && signed_request['code']
|
|
137 |
elsif code_from_signed_request = signed_request_from_cookie && signed_request_from_cookie['code']
|
| 172 | 138 |
request.params['code'] = code_from_signed_request
|
| 173 | |
@authorization_code_from_signed_request = true
|
|
139 |
@authorization_code_from_signed_request_in_cookie = true
|
|
140 |
original_provider_ignores_state = options.provider_ignores_state
|
|
141 |
options.provider_ignores_state = true
|
| 174 | 142 |
begin
|
| 175 | 143 |
yield
|
| 176 | 144 |
ensure
|
| 177 | 145 |
request.params.delete('code')
|
| 178 | |
@authorization_code_from_signed_request = false
|
|
146 |
@authorization_code_from_signed_request_in_cookie = false
|
|
147 |
options.provider_ignores_state = original_provider_ignores_state
|
| 179 | 148 |
end
|
| 180 | 149 |
else
|
| 181 | |
raise NoAuthorizationCodeError, 'must pass either a `code` parameter or a signed request (via `signed_request` parameter or a `fbsr_XXX` cookie)'
|
|
150 |
raise NoAuthorizationCodeError, 'must pass either a `code` (via URL or by an `fbsr_XXX` signed request cookie)'
|
| 182 | 151 |
end
|
| 183 | 152 |
end
|
| 184 | 153 |
|