rest-more 0.7.0

data/example/sinatra/config.ru

@@ -0,0 +1,16 @@
+
+require 'sinatra'
+require 'rest-core'
+
+app_id = '123'
+secret = 'abc'
+config = {:app_id => app_id,
+          :secret => secret}
+
+post '/' do
+  fb = RestCore::Facebook.new(config)
+  fb.parse_signed_request!(params['signed_request'])
+  "#{fb.get('me').inspect.gsub('<', '&lt;')}\n"
+end
+
+run Sinatra::Application

data/lib/rest-core/client/facebook.rb

@@ -0,0 +1,265 @@
+
+require 'rest-core'
+require 'rest-core/util/hmac'
+
+RestCore::Facebook = RestCore::Builder.client(
+  :data, :app_id, :secret, :old_site) do
+
+  s = self.class # this is only for ruby 1.8!
+  use s::Timeout       , 10
+
+  use s::DefaultSite   , 'https://graph.facebook.com/'
+  use s::DefaultHeaders, {'Accept'          => 'application/json',
+                          'Accept-Language' => 'en-us'}
+  use s::Oauth2Query   , nil
+
+  use s::CommonLogger  , nil
+  use s::Cache         , nil, 600 do
+    use s::ErrorHandler,  lambda{ |env|
+                            raise ::RestCore::Facebook::Error.call(env) }
+    use s::ErrorDetector, lambda{ |env|
+      if env[s::RESPONSE_BODY].kind_of?(Hash)
+        env[s::RESPONSE_BODY]['error'] ||
+        env[s::RESPONSE_BODY]['error_code']
+      end}
+
+    use s::JsonDecode  , true
+  end
+
+  use s::Defaults      , :data     => lambda{{}},
+                         :old_site => 'https://api.facebook.com/'
+end
+
+class RestCore::Facebook::Error < RestCore::Error
+  include RestCore
+  class AccessToken        < Facebook::Error; end
+  class InvalidAccessToken < AccessToken     ; end
+  class MissingAccessToken < AccessToken     ; end
+
+  attr_reader :error, :url
+  def initialize error, url=''
+    @error, @url = error, url
+    super("#{error.inspect} from #{url}")
+  end
+
+  def self.call env
+    error, url = env[RESPONSE_BODY], Middleware.request_uri(env)
+    return new(env[FAIL], url) unless error.kind_of?(Hash)
+    if    invalid_token?(error)
+      InvalidAccessToken.new(error, url)
+    elsif missing_token?(error)
+      MissingAccessToken.new(error, url)
+    else
+      new(error, url)
+    end
+  end
+
+  def self.invalid_token? error
+    (%w[OAuthInvalidTokenException
+        OAuthException].include?((error['error'] || {})['type'])) ||
+    (error['error_code'] == 190) # Invalid OAuth 2.0 Access Token
+  end
+
+  def self.missing_token? error
+    (error['error'] || {})['message'] =~ /^An active access token/ ||
+    (error['error_code'] == 104) # Requires valid signature
+  end
+end
+
+module RestCore::Facebook::Client
+  include RestCore
+
+  def access_token
+    data['access_token'] || data['oauth_token'] if data.kind_of?(Hash)
+  end
+
+  def access_token=  token
+    data['access_token'] = token if data.kind_of?(Hash)
+  end
+
+  def secret_access_token; "#{app_id}|#{secret}"           ; end
+  def accept             ; headers['Accept']               ; end
+  def accept=         val; headers['Accept']          = val; end
+  def lang               ; headers['Accept-Language']      ; end
+  def lang=           val; headers['Accept-Language'] = val; end
+
+  def authorized?        ; !!access_token                  ; end
+
+  def next_page hash, opts={}, &cb
+    if hash['paging'].kind_of?(Hash) && hash['paging']['next']
+      get(hash['paging']['next'], {}, opts, &cb)
+    else
+      yield(nil) if block_given?
+    end
+  end
+
+  def prev_page hash, opts={}, &cb
+    if hash['paging'].kind_of?(Hash) && hash['paging']['previous']
+      get(hash['paging']['previous'], {}, opts, &cb)
+    else
+      yield(nil) if block_given?
+    end
+  end
+  alias_method :previous_page, :prev_page
+
+  def for_pages hash, pages=1, opts={}, kind=:next_page, &cb
+    if pages > 1
+      merge_data(send(kind, hash, opts){ |result|
+        yield(result.freeze) if block_given?
+        for_pages(result, pages - 1, opts, kind, &cb) if result
+      }, hash)
+    else
+      yield(nil) if block_given?
+      hash
+    end
+  end
+
+  # cookies, app_id, secrect related below
+
+  def parse_rack_env! env
+    env['HTTP_COOKIE'].to_s =~ /fbs_#{app_id}=([^\;]+)/
+    self.data = parse_fbs!($1)
+  end
+
+  def parse_cookies! cookies
+    self.data = if   fbsr = cookies["fbsr_#{app_id}"]
+                  parse_fbsr!(fbsr)
+                else fbs  = cookies["fbs_#{app_id}"]
+                  parse_fbs!(fbs)
+                end
+  end
+
+  def parse_fbs! fbs
+    self.data = check_sig_and_return_data(
+      # take out facebook sometimes there but sometimes not quotes in cookies
+      Vendor.parse_query(fbs.to_s.sub(/^"/, '').sub(/"$/, '')))
+  end
+
+  def parse_fbsr! fbsr
+    old_data = parse_signed_request!(fbsr)
+    # beware! maybe facebook would take out the code someday
+    return self.data = old_data unless old_data && old_data['code']
+    # passing empty redirect_uri is needed!
+    authorize!(:code => old_data['code'], :redirect_uri => '')
+    self.data = old_data.merge(data)
+  end
+
+  def parse_json! json
+    self.data = json &&
+      check_sig_and_return_data(JsonDecode.json_decode(json))
+  rescue JsonDecode::ParseError
+    self.data = nil
+  end
+
+  def fbs
+    "#{fbs_without_sig(data).join('&')}&sig=#{calculate_sig(data)}"
+  end
+
+  # facebook's new signed_request...
+
+  def parse_signed_request! request
+    sig_encoded, json_encoded = request.split('.')
+    return self.data = nil unless sig_encoded && json_encoded
+    sig,  json = [sig_encoded, json_encoded].map{ |str|
+      "#{str.tr('-_', '+/')}==".unpack('m').first
+    }
+    self.data = check_sig_and_return_data(
+                  JsonDecode.json_decode(json).merge('sig' => sig)){
+                    Hmac.sha256(secret, json_encoded)
+                  }
+  rescue JsonDecode::ParseError
+    self.data = nil
+  end
+
+  # oauth related
+
+  def authorize_url opts={}
+    url('oauth/authorize',
+        {:client_id => app_id, :access_token => nil}.merge(opts))
+  end
+
+  def authorize! opts={}
+    query = {:client_id => app_id, :client_secret => secret}.merge(opts)
+    self.data = Vendor.parse_query(
+                  get(url('oauth/access_token'), query,
+                      {:json_decode => false}.merge(opts)))
+  end
+
+  # old rest facebook api, i will definitely love to remove them someday
+
+  def old_rest path, query={}, opts={}, &cb
+    uri = url("method/#{path}", {:format => 'json'}.merge(query),
+              {:site => old_site}.merge(opts))
+    if opts[:post]
+      post(url("method/#{path}", {:format => 'json'},
+               {:site => old_site}.merge(opts)),
+           query,
+           {}   ,
+           opts.merge('cache.key' => uri, 'cache.post' => true),
+           &cb)
+    else
+      get(uri, {}, opts, &cb)
+    end
+  end
+
+  def secret_old_rest path, query={}, opts={}, &cb
+    old_rest(path, query, {:secret => true}.merge(opts), &cb)
+  end
+
+  def fql code, query={}, opts={}, &cb
+    old_rest('fql.query', {:query => code}.merge(query), opts, &cb)
+  end
+
+  def fql_multi codes, query={}, opts={}, &cb
+    old_rest('fql.multiquery',
+      {:queries => JsonDecode.json_encode(codes)}.merge(query), opts, &cb)
+  end
+
+  def exchange_sessions query={}, opts={}, &cb
+    q = {:client_id => app_id, :client_secret => secret,
+         :type => 'client_cred'}.merge(query)
+    post(url('oauth/exchange_sessions', q),
+         {}, {}, opts, &cb)
+  end
+
+  protected
+  def build_env env={}
+    super(env.inject({}){ |r, (k, v)|
+      case k.to_s
+        when 'secret'     ; r['access_token'] = secret_access_token
+        when 'cache'      ; r['cache.update'] = !!!v
+        else              ; r[k.to_s]         = v
+      end
+      r
+    })
+  end
+
+  def check_sig_and_return_data cookies
+    cookies if secret && if block_given?
+                           yield
+                         else
+                           calculate_sig(cookies)
+                         end == cookies['sig']
+  end
+
+  def calculate_sig cookies
+    Digest::MD5.hexdigest(fbs_without_sig(cookies).join + secret)
+  end
+
+  def fbs_without_sig cookies
+    cookies.reject{ |(k, v)| k == 'sig' }.sort.map{ |a| a.join('=') }
+  end
+
+  def merge_data lhs, rhs
+    [lhs, rhs].each{ |hash|
+      return rhs.reject{ |k, v| k == 'paging' } if
+        !hash.kind_of?(Hash) || !hash['data'].kind_of?(Array)
+    }
+    lhs['data'].unshift(*rhs['data'])
+    lhs
+  end
+end
+
+RestCore::Facebook.send(:include, RestCore::Facebook::Client)
+require 'rest-core/client/facebook/rails_util' if
+  Object.const_defined?(:Rails)

data/lib/rest-core/client/facebook/rails_util.rb

@@ -0,0 +1,334 @@
+
+require 'rest-core/util/rails_util_util'
+
+require 'cgi'
+require 'uri'
+
+module RestCore::Facebook::DefaultAttributes
+  def default_log_method            ; Rails.logger.method(:debug); end
+  def default_cache                 ; Rails.cache                ; end
+  def default_canvas                ; ''                         ; end
+  def default_iframe                ; false                      ; end
+  def default_auto_authorize        ; false                      ; end
+  def default_auto_authorize_options; {}                         ; end
+  def default_auto_authorize_scope  ; ''                         ; end
+  def default_ensure_authorized     ; false                      ; end
+  def default_write_session         ; false                      ; end
+  def default_write_cookies         ; false                      ; end
+  def default_write_handler         ;   nil                      ; end
+  def default_check_handler         ;   nil                      ; end
+end
+
+module RestCore::Facebook::RailsUtil
+  def self.init app=Rails
+    RestCore::Config.load_for_rails(RestCore::Facebook, 'facebook', app)
+  end
+
+  module Helper
+    def rc_facebook
+      controller.send(:rc_facebook)
+    end
+  end
+
+  def self.included controller
+    # skip if included already, any better way to detect this?
+    return if controller.respond_to?(:rc_facebook, true)
+
+    controller.rescue_from(RestCore::Facebook::Error::AccessToken,
+                           :with => :rc_facebook_on_access_token_error)
+    controller.helper(RestCore::Facebook::RailsUtil::Helper)
+    controller.instance_methods.select{ |method|
+      method.to_s =~ /^rc_facebook/
+    }.each{ |method| controller.send(:protected, method) }
+  end
+
+  def rc_facebook_setup options={}
+    rc_facebook_options_ctl.merge!(
+      RestCore::RailsUtilUtil.extract_options(
+        RestCore::Facebook.members, options, :reject))
+    rc_facebook_options_new.merge!(
+      RestCore::RailsUtilUtil.extract_options(
+        RestCore::Facebook.members, options, :select))
+
+    # we'll need to reinitialize rc_facebook with the new options,
+    # otherwise if you're calling rc_facebook before rc_facebook_setup,
+    # you'll end up with default options without the ones you've passed
+    # into rc_facebook_setup.
+    rc_facebook.send(:initialize, rc_facebook_options_new)
+
+    rc_facebook_check_params_signed_request # canvas
+    rc_facebook_check_params_session        # i think it would be deprecated
+    rc_facebook_check_cookie                # for js sdk (canvas or not)
+    rc_facebook_check_code                  # oauth api
+
+    # there are above 4 ways to check the user identity!
+    # if nor of them passed, then we can suppose the user
+    # didn't authorize for us, but we can check if user has authorized
+    # before, in that case, the fbs would be inside session,
+    # as we just saved it there
+
+    rc_facebook_check_rg_fbs # check rc_facebook storage
+
+    if rc_facebook_oget(:ensure_authorized) && !rc_facebook.authorized?
+      rc_facebook_authorize('ensure authorized')
+      false # action halt, redirect to do authorize,
+            # eagerly, as opposed to auto_authorize
+    else
+      true  # keep going
+    end
+  end
+
+  # override this if you need different app_id and secret
+  def rc_facebook
+    @rc_facebook ||= RestCore::Facebook.new(rc_facebook_options_new)
+  end
+
+  def rc_facebook_on_access_token_error error=nil
+    rc_facebook_authorize(error, false)
+  end
+
+  def rc_facebook_authorize error=nil, force_redirect=true
+    logger.warn("WARN: Facebook: #{error.inspect}")
+
+    if force_redirect || rc_facebook_auto_authorize?
+      @rc_facebook_authorize_url = rc_facebook.authorize_url(
+        {:redirect_uri => rc_facebook_normalized_request_uri,
+         :scope        => rc_facebook_oget(:auto_authorize_scope)}.
+        merge(rc_facebook_oget(:auto_authorize_options)))
+
+      logger.debug(
+      "DEBUG: Facebook: redirect to #{@rc_facebook_authorize_url}")
+
+      cookies.delete("fbs_#{rc_facebook.app_id}")
+      rc_facebook_authorize_redirect
+    end
+  end
+
+  # override this if you want the simple redirect_to
+  def rc_facebook_authorize_redirect
+    unless rc_facebook_in_canvas?
+      redirect_to @rc_facebook_authorize_url
+    else
+      rc_facebook_js_redirect(@rc_facebook_authorize_url,
+                               rc_facebook_authorize_body)
+    end
+  end
+
+  def rc_facebook_js_redirect redirect_url, body=''
+    render :inline => <<-HTML
+    <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+    <html>
+      <head>
+      <script type="text/javascript">
+        window.top.location.href = '#{redirect_url}'
+      </script>
+      <noscript>
+        <meta http-equiv="refresh" content="0;url=#{
+          CGI.escapeHTML(redirect_url)}"/>
+        <meta http-equiv="window-target" content="_top"/>
+      </noscript>
+      </head>
+      <body>
+        #{body}
+      </bodt>
+    </html>
+    HTML
+  end
+
+  def rc_facebook_authorize_body redirect_url=@rc_facebook_authorize_url
+    <<-HTML
+    <div>
+      Please
+      <a href="#{CGI.escapeHTML(redirect_url)}" target="_top">authorize</a>
+      if this page is not automatically redirected.
+    </div>
+    HTML
+  end
+
+  module_function
+
+  # ==================== begin options utility =======================
+  def rc_facebook_oget key
+    if rc_facebook_options_ctl.has_key?(key)
+      rc_facebook_options_ctl[key]
+    else
+      RestCore::Facebook.send("default_#{key}")
+    end
+  end
+
+  def rc_facebook_options_ctl
+    @rc_facebook_options_ctl ||= {}
+  end
+
+  def rc_facebook_options_new
+    @rc_facebook_options_new ||= {}
+  end
+  # ==================== end options utility =======================
+
+
+
+  # ==================== begin facebook check ======================
+  def rc_facebook_check_params_signed_request
+    return if rc_facebook.authorized? || !params[:signed_request]
+
+    rc_facebook.parse_signed_request!(params[:signed_request])
+    logger.debug("DEBUG: Facebook: detected signed_request,"  \
+                 " parsed: #{rc_facebook.data.inspect}")
+
+    if rc_facebook.authorized?
+      rc_facebook_write_rg_fbs
+    else
+      logger.warn(
+        "WARN: Facebook: bad signed_request: #{params[:signed_request]}")
+    end
+  end
+
+  # if the code is bad or not existed,
+  # check if there's one in session,
+  # meanwhile, there the sig and access_token is correct,
+  # that means we're in the context of canvas
+  def rc_facebook_check_params_session
+    return if rc_facebook.authorized? || !params[:session]
+
+    rc_facebook.parse_json!(params[:session])
+    logger.debug("DEBUG: Facebook: detected session, parsed:" \
+                 " #{rc_facebook.data.inspect}")
+
+    if rc_facebook.authorized?
+      rc_facebook_write_rg_fbs
+    else
+      logger.warn("WARN: Facebook: bad session: #{params[:session]}")
+    end
+  end
+
+  # if we're not in canvas nor code passed,
+  # we could check out cookies as well.
+  def rc_facebook_check_cookie
+    return if rc_facebook.authorized?                 ||
+              (!cookies["fbsr_#{rc_facebook.app_id}"] &&
+               !cookies["fbs_#{rc_facebook.app_id}"])
+
+    rc_facebook.parse_cookies!(cookies)
+    logger.debug("DEBUG: Facebook: detected cookies, parsed:" \
+                 " #{rc_facebook.data.inspect}")
+  end
+
+  # exchange the code with access_token
+  def rc_facebook_check_code
+    return if rc_facebook.authorized? || !params[:code]
+
+    rc_facebook.authorize!(
+      :code         => params[:code],
+      :redirect_uri => rc_facebook_normalized_request_uri)
+
+    logger.debug(
+      "DEBUG: Facebook: detected code with "   \
+      "#{rc_facebook_normalized_request_uri}," \
+      " parsed: #{rc_facebook.data.inspect}")
+
+    rc_facebook_write_rg_fbs if rc_facebook.authorized?
+  end
+  # ==================== end facebook check ======================
+
+
+
+  # ==================== begin check ================================
+  def rc_facebook_storage_key
+    "rc_facebook_fbs_#{rc_facebook_oget(:app_id)}"
+  end
+
+  def rc_facebook_check_rg_fbs
+    rc_facebook_check_rg_handler # custom method to store fbs
+    rc_facebook_check_rg_session # prefered way to store fbs
+    rc_facebook_check_rg_cookies # in canvas, session might not work..
+  end
+
+  def rc_facebook_check_rg_handler handler=rc_facebook_oget(:check_handler)
+    return if rc_facebook.authorized? || !handler
+    rc_facebook.parse_fbs!(handler.call)
+    logger.debug("DEBUG: Facebook: called check_handler, parsed:" \
+                 " #{rc_facebook.data.inspect}")
+  end
+
+  def rc_facebook_check_rg_session
+    return if rc_facebook.authorized? || !rc_facebook_oget(:write_session) ||
+              !(fbs = session[rc_facebook_storage_key])
+    rc_facebook.parse_fbs!(fbs)
+    logger.debug("DEBUG: Facebook: detected rc_facebook session, parsed:" \
+                 " #{rc_facebook.data.inspect}")
+  end
+
+  def rc_facebook_check_rg_cookies
+    return if rc_facebook.authorized? || !rc_facebook_oget(:write_cookies) ||
+              !(fbs = cookies[rc_facebook_storage_key])
+    rc_facebook.parse_fbs!(fbs)
+    logger.debug("DEBUG: Facebook: detected rc_facebook cookies, parsed:" \
+                 " #{rc_facebook.data.inspect}")
+  end
+  # ====================   end check ================================
+  # ==================== begin write ================================
+  def rc_facebook_write_rg_fbs
+    cookies.delete("fbs_#{rc_facebook.app_id}")
+    rc_facebook_write_rg_handler
+    rc_facebook_write_rg_session
+    rc_facebook_write_rg_cookies
+  end
+
+  def rc_facebook_write_rg_handler handler=rc_facebook_oget(:write_handler)
+    return if !handler
+    handler.call(fbs = rc_facebook.fbs)
+    logger.debug("DEBUG: Facebook: called write_handler: fbs => #{fbs}")
+  end
+
+  def rc_facebook_write_rg_session
+    return if !rc_facebook_oget(:write_session)
+    session[rc_facebook_storage_key] = fbs = rc_facebook.fbs
+    logger.debug("DEBUG: Facebook: wrote session: fbs => #{fbs}")
+  end
+
+  def rc_facebook_write_rg_cookies
+    return if !rc_facebook_oget(:write_cookies)
+    cookies[rc_facebook_storage_key] = fbs = rc_facebook.fbs
+    logger.debug("DEBUG: Facebook: wrote cookies: fbs => #{fbs}")
+  end
+  # ==================== end write ================================
+
+
+
+  # ==================== begin misc ================================
+  def rc_facebook_normalized_request_uri
+    uri = if rc_facebook_in_canvas?
+            # rails 3 uses newer rack which has fullpath
+            "http://apps.facebook.com/#{rc_facebook_oget(:canvas)}" +
+            (request.respond_to?(:fullpath) ?
+              request.fullpath : request.request_uri)
+          else
+            request.url
+          end
+
+    rc_facebook_filter_uri(uri)
+  end
+
+  def rc_facebook_filter_uri uri
+    URI.parse(URI.encode(uri)).tap{ |uri|
+      uri.query = uri.query.split('&').reject{ |q|
+                    q =~ /^(code|session|signed_request)\=/
+                  }.join('&') if uri.query
+      uri.query = nil if uri.query.blank?
+    }.to_s
+  end
+
+  def rc_facebook_in_canvas?
+    !rc_facebook_oget(:canvas).blank?
+  end
+
+  def rc_facebook_auto_authorize?
+    !rc_facebook_oget(:auto_authorize_scope)  .blank? ||
+    !rc_facebook_oget(:auto_authorize_options).blank? ||
+     rc_facebook_oget(:auto_authorize)
+  end
+  # ==================== end misc ================================
+end
+
+RestCore::Facebook::RailsUtil.init(Rails)