fb_graph 1.9.5 → 2.0.0.alpha

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    fb_graph (1.9.4)
+    fb_graph (1.9.5)
       httpclient (>= 2.2.0.2)
       rack-oauth2 (>= 0.8.0)
 
@@ -37,10 +37,11 @@ GEM
     jruby-openssl (0.7.4)
       bouncy-castle-java
     json (1.5.3)
+    json (1.5.3-java)
     rack (1.2.3)
     rack-mount (0.6.14)
       rack (>= 1.0.0)
-    rack-oauth2 (0.8.5)
+    rack-oauth2 (0.8.7)
       activesupport (>= 2.3)
       attr_required (>= 0.0.3)
       httpclient (>= 2.2.0.2)
@@ -50,8 +51,8 @@ GEM
     rack-test (0.5.7)
       rack (>= 1.0)
     rake (0.9.2)
-    rcov (0.9.9)
-    rcov (0.9.9-java)
+    rcov (0.9.10)
+    rcov (0.9.10-java)
     rspec (2.6.0)
       rspec-core (~> 2.6.0)
       rspec-expectations (~> 2.6.0)

data/VERSION

@@ -1 +1 @@
-1.9.5
+2.0.0.alpha

data/lib/fb_graph/auth/cookie.rb

@@ -6,38 +6,14 @@ module FbGraph
     # If you want access token, use FbGraph::Auth.new(APP_ID, APP_SECRET, :cookie => {..}) instead
     class Cookie
       def self.parse(client, cookie)
-        fb_cookie_string = case cookie
+        signed_request = case cookie
         when String
           cookie
         else
-          cookie["fbs_#{client.identifier}"]
+          cookie["fbsr_#{client.identifier}"]
         end
-
-        raise VerificationFailed.new(401, 'Facebook cookie not found') if fb_cookie_string.blank?
-
-        fb_cookie_string.gsub!(/[\\"]/, '')
-        signature, fb_cookie = '', {}
-        fb_cookie_string.split('&').each do |kv|
-          k, v = kv.split('=')
-          if k == 'sig'
-            signature = v
-          else
-            v = v.to_i if k == 'expires'
-            fb_cookie[k] = v
-          end
-        end
-
-        signature_base_string = fb_cookie.to_a.sort do |a, b|
-          a[0] <=> b[0] || a[1] <=> b[1]
-        end.map do |(k, v)|
-          "#{k}=#{v}"
-        end.join
-
-        unless Digest::MD5.hexdigest("#{signature_base_string}#{client.secret}") == signature
-          raise VerificationFailed.new(401, 'Facebook cookie signature invalid')
-        end
-
-        fb_cookie.with_indifferent_access
+        raise VerificationFailed.new('Facebook cookie not found') if signed_request.blank?
+        SignedRequest.verify(client, signed_request)
       end
     end
   end

data/lib/fb_graph/auth/signed_request.rb

@@ -8,27 +8,27 @@ module FbGraph
 
       def self.verify(client, signed_request)
         signature, payload = signed_request.split('.')
-        raise VerificationFailed.new(401, 'No Signature') if signature.blank?
-        raise VerificationFailed.new(401, 'No Payload') if payload.blank?
+        raise VerificationFailed.new('No Signature') if signature.blank?
+        raise VerificationFailed.new('No Payload') if payload.blank?
         signature = base64_url_decode signature
         data = decode_json base64_url_decode(payload)
-        raise VerificationFailed.new(401, 'Unexpected Signature Algorithm') unless data[:algorithm] == 'HMAC-SHA256'
+        raise VerificationFailed.new('Unexpected Signature Algorithm') unless data[:algorithm] == 'HMAC-SHA256'
         _signature_ = sign(client.secret, payload)
-        raise VerificationFailed.new(401, 'Signature Invalid') unless signature == _signature_
+        raise VerificationFailed.new('Signature Invalid') unless signature == _signature_
         data
       end
 
       private
 
-      def self.sign(key, data)
+      def self.sign(key, payload)
         klass = OpenSSL::Digest::SHA256.new
-        OpenSSL::HMAC.digest(klass, key, data)
+        OpenSSL::HMAC.digest(klass, key, payload)
       end
 
       def self.decode_json(json)
         JSON.parse(json).with_indifferent_access
       rescue => e
-        raise VerificationFailed.new(400, 'Invalid JSON')
+        raise VerificationFailed.new('Invalid JSON')
       end
 
       def self.base64_url_decode(str)

data/lib/fb_graph/auth.rb

@@ -1,6 +1,6 @@
 module FbGraph
   class Auth
-    class VerificationFailed < Exception; end
+    class VerificationFailed < BadRequest; end
 
     attr_accessor :client, :access_token, :user, :data
 
@@ -35,25 +35,31 @@ module FbGraph
     end
 
     def from_cookie(cookie)
-      data = Cookie.parse(self.client, cookie)
-      self.access_token = build_access_token(data)
-      self.user = User.new(data[:uid], :access_token => self.access_token)
-      self.data = data
+      self.data = Cookie.parse(client, cookie)
+      get_access_token! data[:code]
       self
     end
 
     def from_signed_request(signed_request)
-      data = SignedRequest.verify(self.client, signed_request)
-      if data[:oauth_token]
+      self.data = SignedRequest.verify(client, signed_request)
+      if self.data[:oauth_token]
         self.access_token = build_access_token(data)
         self.user = User.new(data[:user_id], :access_token => self.access_token)
       end
-      self.data = data
       self
     end
 
     private
 
+    def get_access_token!(code)
+      raise Unauthorized.new('No Authorization Code') unless code
+      client.redirect_uri = ''
+      client.authorization_code = code
+      self.access_token = client.access_token!
+      self.user = User.new(data[:user_id], :access_token => access_token)
+      self
+    end
+
     def build_access_token(data)
       expires_in = unless data[:expires].zero?
         data[:expires] - Time.now.to_i

data/lib/fb_graph.rb

@@ -1,5 +1,6 @@
 require 'httpclient'
 require 'rack/oauth2'
+require 'patch/rack/oauth2/util'
 
 module FbGraph
   ROOT_URL = "https://graph.facebook.com"

data/lib/patch/rack/oauth2/util.rb

@@ -0,0 +1,14 @@
+# NOTE: Authorization code given via FB JS SDK needs blank string as redirect_uri
+module Rack::OAuth2::Util
+  class << self
+    def compact_hash_with_blank_redirect_uri(hash)
+      original_redirect_uri = hash[:redirect_uri]
+      result = compact_hash_without_blank_redirect_uri hash
+      if original_redirect_uri
+        result[:redirect_uri] ||= original_redirect_uri
+      end
+      result
+    end
+    alias_method_chain :compact_hash, :blank_redirect_uri
+  end
+end

data/spec/fb_graph/auth/cookie_spec.rb

@@ -1,30 +1,29 @@
 require 'spec_helper'
 
 describe FbGraph::Auth::Cookie, '.parse' do
-  before do
-    @client = Rack::OAuth2::Client.new(:identifier => 'client_id', :secret => 'client_secret')
-    @cookie = {
-      'fbs_client_id' => "access_token=t&expires=0&secret=s&session_key=k&sig=f4bae8ec88ba11440e3bdcc1bcf78317&uid=12345"
+  let(:client) { Rack::OAuth2::Client.new(:identifier => 'client_id', :secret => 'client_secret') }
+  let :cookie do
+    {
+      'fbsr_client_id' => "9heZHFs6tDH/Nif4CqmBaMQ8nKEOc5g2WgVJa10LF00.eyJhbGdvcml0aG0iOiJITUFDLVNIQTI1NiIsImNvZGUiOiI4ZDYwZDY4NDA4MmQ1NjczMjY3MWUxNzAuMS01Nzk2MTIyNzZ8N2pkVlp6MlNLNUY2b0gtQ21FQWtZZVpuVjEwIiwiaXNzdWVkX2F0IjoxMzEyOTUzOTcxLCJ1c2VyX2lkIjo1Nzk2MTIyNzZ9"
     }
   end
 
   shared_examples_for :parsable_cookie do
     it 'should be parsable' do
-      cookie[:access_token].should == 't'
-      cookie[:expires].should      == 0
-      cookie[:secret].should       == 's'
-      cookie[:session_key].should  == 'k'
-      cookie[:uid].should          == '12345'
+      data[:algorithm].should == 'HMAC-SHA256'
+      data[:code].should      == '8d60d684082d56732671e170.1-579612276|7jdVZz2SK5F6oH-CmEAkYeZnV10'
+      data[:issued_at].should == 1312953971
+      data[:user_id].should   == 579612276
     end
   end
 
   context 'when whole cookie is given' do
-    let(:cookie) { FbGraph::Auth::Cookie.parse(@client, @cookie) }
+    let(:data) { FbGraph::Auth::Cookie.parse(client, cookie) }
     it_behaves_like :parsable_cookie
   end
 
   context 'when actual cookie string is given' do
-    let(:cookie) { FbGraph::Auth::Cookie.parse(@client, @cookie['fbs_client_id']) }
+    let(:data) { FbGraph::Auth::Cookie.parse(client, cookie['fbsr_client_id']) }
     it_behaves_like :parsable_cookie
   end
 end

data/spec/fb_graph/auth_spec.rb

@@ -1,107 +1,52 @@
 require 'spec_helper'
 
-describe FbGraph::Auth, '.new' do
-  it 'should setup Rack::OAuth2::Client' do
-    auth = FbGraph::Auth.new('client_id', 'client_secret')
-    auth.client.should be_a(Rack::OAuth2::Client)
-    auth.client.identifier.should     == 'client_id'
-    auth.client.secret.should == 'client_secret'
+describe FbGraph::Auth do
+  let :optional_attributes do
+    {}
   end
-
-  context 'when invalid cookie given' do
-    it 'should raise FbGraph::VerificationFailed' do
-      lambda do
-        FbGraph::Auth.new('client_id', 'client_secret', :cookie => 'invalid')
-      end.should raise_exception(FbGraph::Auth::VerificationFailed)
-    end
+  let(:auth) { FbGraph::Auth.new('client_id', 'client_secret', optional_attributes) }
+  subject { auth }
+
+  its(:client) { should be_a(Rack::OAuth2::Client) }
+  describe 'client' do
+    subject { auth.client }
+    its(:identifier) { should == 'client_id' }
+    its(:secret) { should == 'client_secret' }
   end
 
   context 'when invalid cookie given' do
+    let :optional_attributes do
+      {:cookie => 'invalid'}
+    end
     it 'should raise FbGraph::VerificationFailed' do
-      lambda do
-        FbGraph::Auth.new('client_id', 'client_secret', :signed_request => 'invalid')
+      expect do
+        auth
       end.should raise_exception(FbGraph::Auth::VerificationFailed)
     end
   end
-end
-
-describe FbGraph::Auth, '#from_cookie' do
-  before do
-    @auth = FbGraph::Auth.new('client_id', 'client_secret')
-    @expires_at = Time.parse('2020-12-31 12:00:00')
-    @cookie = {
-      'fbs_client_id' => "access_token=t&expires=#{@expires_at.to_i}&secret=s&session_key=k&sig=b06a0540959470e731cc3bc2ef31a007&uid=12345"
-    }
-  end
-
-  it 'should fetch user and access_token from fbs_APP_ID cookie' do
-    @auth.access_token.should be_nil
-    @auth.user.should be_nil
-    @auth.from_cookie(@cookie)
-    @auth.access_token.access_token.should      == 't'
-    @auth.access_token.expires_in.should        be_within(1).of(@expires_at - Time.now)
-    @auth.user.identifier.should                == '12345'
-    @auth.user.access_token.access_token.should == 't'
-  end
 
   context 'when invalid cookie given' do
-    it 'should raise FbGraph::VerificationFailed' do
-      lambda do
-        @auth.from_cookie('invalid')
-      end.should raise_exception(FbGraph::Auth::VerificationFailed)
+    let :optional_attributes do
+      {:signed_request => 'invalid'}
     end
-  end
-end
 
-describe FbGraph::Auth, '#from_signed_request' do
-  before do
-    @signed_request = "LqsgnfcsRdfjOgyW6ZuSLpGBVsxUBegEqai4EcrWS0A=.eyJhbGdvcml0aG0iOiJITUFDLVNIQTI1NiIsImV4cGlyZXMiOjAsImlzc3VlZF9hdCI6MTI5ODc4MzczOSwib2F1dGhfdG9rZW4iOiIxMzQxNDU2NDMyOTQzMjJ8MmI4YTZmOTc1NTJjNmRjZWQyMDU4MTBiLTU3OTYxMjI3NnxGS1o0akdKZ0JwN2k3bFlrOVhhUk1QZ3lhNnMiLCJ1c2VyIjp7ImNvdW50cnkiOiJqcCIsImxvY2FsZSI6ImVuX1VTIiwiYWdlIjp7Im1pbiI6MjF9fSwidXNlcl9pZCI6IjU3OTYxMjI3NiJ9"
-    @auth = FbGraph::Auth.new('client_id', 'client_secret')
-  end
-
-  it 'should fetch user and access_token from signed_request' do
-    @auth.access_token.should be_nil
-    @auth.user.should be_nil
-    @auth.from_signed_request(@signed_request)
-    @auth.access_token.access_token.should      == '134145643294322|2b8a6f97552c6dced205810b-579612276|FKZ4jGJgBp7i7lYk9XaRMPgya6s'
-    @auth.user.identifier.should                == '579612276'
-    @auth.user.access_token.access_token.should == '134145643294322|2b8a6f97552c6dced205810b-579612276|FKZ4jGJgBp7i7lYk9XaRMPgya6s'
-    @auth.data.should include(
-      "expires"=>0,
-      "algorithm"=>"HMAC-SHA256",
-      "issued_at"=>1298783739
-    )
-    @auth.data['user'].should include(
-      "country"=>"jp",
-      "locale"=>"en_US",
-      "age"=>{"min"=>21}
-    )
-  end
-
-  context 'when invalid signed_request given' do
     it 'should raise FbGraph::VerificationFailed' do
-      lambda do
-        @auth.from_signed_request('invalid.signed_request')
+      expect do
+        auth
       end.should raise_exception(FbGraph::Auth::VerificationFailed)
     end
   end
-end
-
-describe FbGraph::Auth do
-  let(:auth) { FbGraph::Auth.new('client_id', 'client_secret') }
 
   describe '#authorized?' do
-    subject { auth.authorized? }
-
     context 'when access_token is given' do
       before do
         auth.access_token = 'access_token'
       end
-      it { should be_true }
+      its(:authorized?) { should be_true }
     end
 
     context 'otherwise' do
-      it { should be_false }
+      its(:authorized?) { should be_false }
     end
   end
 
@@ -115,5 +60,81 @@ describe FbGraph::Auth do
       it { should == "https://www.facebook.com/dialog/oauth?client_id=client_id&redirect_uri=#{CGI.escape canvas_uri}&scope=#{CGI.escape "scope1,scope2"}&state=state1" }
     end
   end
+
+  describe '#from_cookie' do
+    let :cookie do
+      {
+        'fbsr_client_id' => "9heZHFs6tDH/Nif4CqmBaMQ8nKEOc5g2WgVJa10LF00.eyJhbGdvcml0aG0iOiJITUFDLVNIQTI1NiIsImNvZGUiOiI4ZDYwZDY4NDA4MmQ1NjczMjY3MWUxNzAuMS01Nzk2MTIyNzZ8N2pkVlp6MlNLNUY2b0gtQ21FQWtZZVpuVjEwIiwiaXNzdWVkX2F0IjoxMzEyOTUzOTcxLCJ1c2VyX2lkIjo1Nzk2MTIyNzZ9"
+      }
+    end
+
+    it 'should exchange code with access token' do
+      expect {
+        auth.from_cookie(cookie)
+      }.should request_to '/oauth/access_token', :post
+    end
+
+    it 'should setup user and access_token' do
+      mock_graph :post, '/oauth/access_token', 'token_response' do
+        auth.access_token.should be_nil
+        auth.user.should be_nil
+        auth.from_cookie(cookie)
+        auth.access_token.should be_a Rack::OAuth2::AccessToken::Legacy
+        auth.access_token.access_token.should      == 'token'
+        auth.user.should be_a FbGraph::User
+        auth.user.identifier.should                == 579612276
+        auth.user.access_token.access_token.should == 'token'
+        auth.data.should == {
+          "algorithm" => "HMAC-SHA256",
+          "code" => "8d60d684082d56732671e170.1-579612276|7jdVZz2SK5F6oH-CmEAkYeZnV10",
+          "issued_at" => 1312953971,
+          "user_id" => 579612276
+        }
+      end
+    end
+
+    context 'when invalid cookie given' do
+      it 'should raise FbGraph::VerificationFailed' do
+        lambda do
+          auth.from_cookie('invalid')
+        end.should raise_exception(FbGraph::Auth::VerificationFailed)
+      end
+    end
+  end
+
+  describe '#from_signed_request' do
+    let :signed_request do
+      "LqsgnfcsRdfjOgyW6ZuSLpGBVsxUBegEqai4EcrWS0A=.eyJhbGdvcml0aG0iOiJITUFDLVNIQTI1NiIsImV4cGlyZXMiOjAsImlzc3VlZF9hdCI6MTI5ODc4MzczOSwib2F1dGhfdG9rZW4iOiIxMzQxNDU2NDMyOTQzMjJ8MmI4YTZmOTc1NTJjNmRjZWQyMDU4MTBiLTU3OTYxMjI3NnxGS1o0akdKZ0JwN2k3bFlrOVhhUk1QZ3lhNnMiLCJ1c2VyIjp7ImNvdW50cnkiOiJqcCIsImxvY2FsZSI6ImVuX1VTIiwiYWdlIjp7Im1pbiI6MjF9fSwidXNlcl9pZCI6IjU3OTYxMjI3NiJ9"
+    end
+
+    it 'should setup user and access_token' do
+      auth.access_token.should be_nil
+      auth.user.should be_nil
+      auth.from_signed_request(signed_request)
+      auth.access_token.should be_a Rack::OAuth2::AccessToken::Legacy
+      auth.access_token.access_token.should      == '134145643294322|2b8a6f97552c6dced205810b-579612276|FKZ4jGJgBp7i7lYk9XaRMPgya6s'
+      auth.user.should be_a FbGraph::User
+      auth.user.identifier.should                == '579612276'
+      auth.user.access_token.access_token.should == '134145643294322|2b8a6f97552c6dced205810b-579612276|FKZ4jGJgBp7i7lYk9XaRMPgya6s'
+      auth.data.should include(
+        "expires"=>0,
+        "algorithm"=>"HMAC-SHA256",
+        "issued_at"=>1298783739
+      )
+      auth.data['user'].should include(
+        "country"=>"jp",
+        "locale"=>"en_US",
+        "age"=>{"min"=>21}
+      )
+    end
+
+    context 'when invalid signed_request given' do
+      it 'should raise FbGraph::VerificationFailed' do
+        lambda do
+          auth.from_signed_request('invalid.signed_request')
+        end.should raise_exception(FbGraph::Auth::VerificationFailed)
+      end
+    end
+  end
 end
 

metadata

@@ -1,8 +1,14 @@
 --- !ruby/object:Gem::Specification 
 name: fb_graph
 version: !ruby/object:Gem::Version 
-  prerelease: 
-  version: 1.9.5
+  hash: -1851332194
+  prerelease: 6
+  segments: 
+  - 2
+  - 0
+  - 0
+  - alpha
+  version: 2.0.0.alpha
 platform: ruby
 authors: 
 - nov matake
@@ -10,7 +16,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2011-08-08 00:00:00 Z
+date: 2011-08-10 00:00:00 Z
 dependencies: 
 - !ruby/object:Gem::Dependency 
   name: httpclient
@@ -20,6 +26,12 @@ dependencies:
     requirements: 
     - - ">="
       - !ruby/object:Gem::Version 
+        hash: 123
+        segments: 
+        - 2
+        - 2
+        - 0
+        - 2
         version: 2.2.0.2
   type: :runtime
   version_requirements: *id001
@@ -31,6 +43,11 @@ dependencies:
     requirements: 
     - - ">="
       - !ruby/object:Gem::Version 
+        hash: 63
+        segments: 
+        - 0
+        - 8
+        - 0
         version: 0.8.0
   type: :runtime
   version_requirements: *id002
@@ -42,6 +59,10 @@ dependencies:
     requirements: 
     - - ">="
       - !ruby/object:Gem::Version 
+        hash: 27
+        segments: 
+        - 0
+        - 8
         version: "0.8"
   type: :development
   version_requirements: *id003
@@ -53,6 +74,10 @@ dependencies:
     requirements: 
     - - ">="
       - !ruby/object:Gem::Version 
+        hash: 25
+        segments: 
+        - 0
+        - 9
         version: "0.9"
   type: :development
   version_requirements: *id004
@@ -64,6 +89,9 @@ dependencies:
     requirements: 
     - - ">="
       - !ruby/object:Gem::Version 
+        hash: 7
+        segments: 
+        - 2
         version: "2"
   type: :development
   version_requirements: *id005
@@ -75,6 +103,11 @@ dependencies:
     requirements: 
     - - ">="
       - !ruby/object:Gem::Version 
+        hash: 11
+        segments: 
+        - 1
+        - 6
+        - 2
         version: 1.6.2
   type: :development
   version_requirements: *id006
@@ -86,6 +119,11 @@ dependencies:
     requirements: 
     - - ">="
       - !ruby/object:Gem::Version 
+        hash: 11
+        segments: 
+        - 3
+        - 0
+        - 6
         version: 3.0.6
   type: :development
   version_requirements: *id007
@@ -215,6 +253,7 @@ files:
 - lib/fb_graph/venue.rb
 - lib/fb_graph/video.rb
 - lib/fb_graph/work.rb
+- lib/patch/rack/oauth2/util.rb
 - spec/fb_graph/album_spec.rb
 - spec/fb_graph/app_request_spec.rb
 - spec/fb_graph/application_spec.rb
@@ -462,13 +501,21 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements: 
   - - ">="
     - !ruby/object:Gem::Version 
+      hash: 3
+      segments: 
+      - 0
       version: "0"
 required_rubygems_version: !ruby/object:Gem::Requirement 
   none: false
   requirements: 
-  - - ">="
+  - - ">"
     - !ruby/object:Gem::Version 
-      version: "0"
+      hash: 25
+      segments: 
+      - 1
+      - 3
+      - 1
+      version: 1.3.1
 requirements: []
 
 rubyforge_project: