tenderlove-facebooker 1.0.16.20090319151701

data/lib/facebooker/rails/controller.rb

@@ -0,0 +1,304 @@
+require 'facebooker'
+require 'facebooker/rails/profile_publisher_extensions'
+module Facebooker
+  module Rails
+    module Controller
+      include Facebooker::Rails::ProfilePublisherExtensions
+      def self.included(controller)
+        controller.extend(ClassMethods)
+        #controller.before_filter :set_adapter <-- security hole noted by vchu
+        controller.before_filter :set_facebook_request_format
+        controller.helper_attr :facebook_session_parameters
+        controller.helper_method :request_comes_from_facebook?
+      end
+
+    
+      def facebook_session
+        @facebook_session
+      end
+      
+      def facebook_session_parameters
+        {:fb_sig_session_key=>params[:fb_sig_session_key]}
+      end
+      
+      def create_facebook_session
+        secure_with_facebook_params! || secure_with_cookies! || secure_with_token!
+      end
+      
+      def set_facebook_session
+        # first, see if we already have a session
+        session_set = session_already_secured?
+        # if not, see if we can load it from the environment
+        unless session_set
+          session_set = create_facebook_session
+          session[:facebook_session] = @facebook_session if session_set
+        end
+        if session_set
+          capture_facebook_friends_if_available! 
+          Session.current = facebook_session
+        end
+        return session_set
+      end
+      
+      
+      def facebook_params
+        @facebook_params ||= verified_facebook_params
+      end      
+      
+      def redirect_to(*args)
+        if request_is_for_a_facebook_canvas? and !request_is_facebook_tab?
+          render :text => fbml_redirect_tag(*args)
+        else
+          super
+        end
+      end
+            
+      private
+      
+      def session_already_secured?
+        (@facebook_session = session[:facebook_session]) && session[:facebook_session].secured? if valid_session_key_in_session?
+      end
+      
+      def user_has_deauthorized_application?
+        # if we're inside the facebook session and there is no session key,
+        # that means the user revoked our access
+        # we don't want to keep using the old expired key from the cookie. 
+        request_comes_from_facebook? and params[:fb_sig_session_key].blank?
+      end
+      
+      def clear_facebook_session_information
+        session[:facebook_session] = nil
+        @facebook_session=nil        
+      end
+      
+      def valid_session_key_in_session?
+        #before we access the facebook_params, make sure we have the parameters
+        #otherwise we will blow up trying to access the secure parameters
+        if user_has_deauthorized_application?
+          clear_facebook_session_information
+          false
+        else
+          !session[:facebook_session].blank? &&  (params[:fb_sig_session_key].blank? || session[:facebook_session].session_key == facebook_params[:session_key])
+        end
+      end
+      
+      def clear_fb_cookies!
+        domain_cookie_tag = "base_domain_#{Facebooker.api_key}"
+        cookie_domain = ".#{cookies[domain_cookie_tag]}" if cookies[domain_cookie_tag]
+        fb_cookie_names.each {|name| cookies.delete(name, :domain=>cookie_domain)}
+        cookies.delete Facebooker.api_key
+      end
+
+      def fb_cookie_prefix
+        Facebooker.api_key+"_"
+      end
+
+      def fb_cookie_names
+        fb_cookie_names = cookies.keys.select{|k| k.starts_with?(fb_cookie_prefix)}
+      end
+
+      def secure_with_cookies!
+          parsed = {}
+          
+          fb_cookie_names.each { |key| parsed[key[fb_cookie_prefix.size,key.size]] = cookies[key] }
+ 
+          #returning gracefully if the cookies aren't set or have expired
+          return unless parsed['session_key'] && parsed['user'] && parsed['expires'] && parsed['ss'] 
+          return unless Time.at(parsed['expires'].to_f) > Time.now || (parsed['expires'] == "0")
+          
+          #if we have the unexpired cookies, we'll throw an exception if the sig doesn't verify
+          verify_signature(parsed,cookies[Facebooker.api_key])
+          
+          @facebook_session = new_facebook_session
+          @facebook_session.secure_with!(parsed['session_key'],parsed['user'],parsed['expires'],parsed['ss'])
+          @facebook_session
+      end
+    
+      def secure_with_token!
+        if params['auth_token']
+          @facebook_session = new_facebook_session
+          @facebook_session.auth_token = params['auth_token']
+          @facebook_session.secure!
+          @facebook_session
+        end
+      end
+      
+      def secure_with_facebook_params!
+        return unless request_comes_from_facebook?
+        
+        if ['user', 'session_key'].all? {|element| facebook_params[element]}
+          @facebook_session = new_facebook_session
+          @facebook_session.secure_with!(facebook_params['session_key'], facebook_params['user'], facebook_params['expires'])
+          @facebook_session
+        end
+      end
+      
+      #override to specify where the user should be sent after logging in
+      def after_facebook_login_url
+        nil
+      end
+      
+      def create_new_facebook_session_and_redirect!
+        session[:facebook_session] = new_facebook_session
+        url_params = after_facebook_login_url.nil? ? {} : {:next=>after_facebook_login_url}
+        redirect_to session[:facebook_session].login_url(url_params) unless @installation_required
+        false
+      end
+      
+      def new_facebook_session
+        Facebooker::Session.create(Facebooker.api_key, Facebooker.secret_key)
+      end
+      
+      def capture_facebook_friends_if_available!
+        return unless request_comes_from_facebook?
+        if friends = facebook_params['friends']
+          facebook_session.user.friends = friends.map do |friend_uid|
+            User.new(friend_uid, facebook_session)
+          end
+        end
+      end
+            
+      def blank?(value)
+        (value == '0' || value.nil? || value == '')        
+      end
+
+      def verified_facebook_params
+        facebook_sig_params = params.inject({}) do |collection, pair|
+          collection[pair.first.sub(/^fb_sig_/, '')] = pair.last if pair.first[0,7] == 'fb_sig_'
+          collection
+        end
+        verify_signature(facebook_sig_params,params['fb_sig'])
+
+        facebook_sig_params.inject(HashWithIndifferentAccess.new) do |collection, pair| 
+          collection[pair.first] = facebook_parameter_conversions[pair.first].call(pair.last)
+          collection
+        end
+      end
+      
+      def earliest_valid_session
+        48.hours.ago
+      end
+      
+      def verify_signature(facebook_sig_params,expected_signature)
+        raw_string = facebook_sig_params.map{ |*args| args.join('=') }.sort.join
+        actual_sig = Digest::MD5.hexdigest([raw_string, Facebooker::Session.secret_key].join)
+        raise Facebooker::Session::IncorrectSignature if actual_sig != expected_signature
+        raise Facebooker::Session::SignatureTooOld if facebook_sig_params['time'] && Time.at(facebook_sig_params['time'].to_f) < earliest_valid_session
+        true
+      end
+      
+      def facebook_parameter_conversions
+        @facebook_parameter_conversions ||= Hash.new do |hash, key| 
+          lambda{|value| value}
+        end.merge(
+          'time' => lambda{|value| Time.at(value.to_f)},
+          'in_canvas' => lambda{|value| !blank?(value)},
+          'added' => lambda{|value| !blank?(value)},
+          'expires' => lambda{|value| blank?(value) ? nil : Time.at(value.to_f)},
+          'friends' => lambda{|value| value.split(/,/)}
+        )
+      end
+      
+      def fbml_redirect_tag(url)
+        "<fb:redirect url=\"#{url_for(url)}\" />"
+      end
+      
+      def request_comes_from_facebook?
+        request_is_for_a_facebook_canvas? || request_is_facebook_ajax? || request_is_fb_ping?
+      end
+
+      def request_is_fb_ping?
+        !params['fb_sig'].blank?
+      end
+      
+      def request_is_for_a_facebook_canvas?
+        !params['fb_sig_in_canvas'].blank?
+      end
+      
+      def request_is_facebook_tab?
+        !params["fb_sig_in_profile_tab"].blank?
+      end
+      
+      def request_is_facebook_ajax?
+        params["fb_sig_is_mockajax"]=="1" || params["fb_sig_is_ajax"]=="1"
+      end
+      def xml_http_request?
+        request_is_facebook_ajax? || super
+      end
+      
+      
+      
+      def application_is_installed?
+        facebook_params['added']
+      end
+      
+      def ensure_has_status_update
+        has_extended_permission?("status_update") || application_needs_permission("status_update")
+      end
+      def ensure_has_photo_upload
+        has_extended_permission?("photo_upload") || application_needs_permission("photo_upload")
+      end
+      def ensure_has_video_upload
+        has_extended_permission?("video_upload") || application_needs_permission("video_upload")
+      end
+      def ensure_has_create_listing
+        has_extended_permission?("create_listing") || application_needs_permission("create_listing")
+      end
+      
+      def application_needs_permission(perm)
+        redirect_to(facebook_session.permission_url(perm))
+      end
+      
+      def has_extended_permission?(perm)
+        params["fb_sig_ext_perms"] and params["fb_sig_ext_perms"].include?(perm)
+      end
+      
+      def ensure_authenticated_to_facebook
+        set_facebook_session || create_new_facebook_session_and_redirect!
+      end
+      
+      def ensure_application_is_installed_by_facebook_user
+        @installation_required = true
+        returning ensure_authenticated_to_facebook && application_is_installed? do |authenticated_and_installed|
+           application_is_not_installed_by_facebook_user unless authenticated_and_installed
+        end
+      end
+      
+      def application_is_not_installed_by_facebook_user
+        url_params = after_facebook_login_url.nil? ? {} : { :next => after_facebook_login_url }
+        redirect_to session[:facebook_session].install_url(url_params)
+      end
+      
+      def set_facebook_request_format
+        if request_is_facebook_ajax?
+          params[:format] = 'fbjs'
+        elsif request_comes_from_facebook?
+          params[:format] = 'fbml'
+        end
+      end
+      
+      def set_adapter
+        Facebooker.load_adapter(params) if(params[:fb_sig_api_key])
+      end
+
+      
+      module ClassMethods
+        #
+        # Creates a filter which reqires a user to have already authenticated to
+        # Facebook before executing actions.  Accepts the same optional options hash which
+        # before_filter and after_filter accept.
+        def ensure_authenticated_to_facebook(options = {})
+          before_filter :ensure_authenticated_to_facebook, options
+        end
+        
+        def ensure_application_is_installed_by_facebook_user(options = {})
+          before_filter :ensure_application_is_installed_by_facebook_user, options
+        end
+        
+        def request_comes_from_facebook?
+          request_is_for_a_facebook_canvas? || request_is_facebook_ajax?
+        end
+      end
+    end
+  end
+end

data/lib/facebooker/rails/cucumber/world.rb

@@ -0,0 +1,46 @@
+require 'cucumber/rails/world'
+require 'facebooker/rails/integration_session'
+
+module Facebooker
+  module Rails
+    module Cucumber
+      class World < ::Cucumber::Rails::World
+        def open_session
+          session = Facebooker::Rails::IntegrationSession.new
+
+          # delegate the fixture accessors back to the test instance
+          extras = Module.new { attr_accessor :delegate, :test_result }
+          if self.class.respond_to?(:fixture_table_names)
+            self.class.fixture_table_names.each do |table_name|
+              name = table_name.tr(".", "_")
+              next unless respond_to?(name)
+              extras.__send__(:define_method, name) { |*args| delegate.send(name, *args) }
+            end
+          end
+
+          # delegate add_assertion to the test case
+          extras.__send__(:define_method, :add_assertion) { test_result.add_assertion }
+          session.extend(extras)
+          session.delegate = self
+          session.test_result = @_result
+
+          yield session if block_given?
+          session
+        end
+        
+        def without_canvas
+          in_canvas = @integration_session.canvas
+          @integration_session.canvas = false
+          yield
+          @integration_session.canvas = in_canvas
+        end
+      end
+    end
+  end
+end
+
+World do
+  w = Facebooker::Rails::Cucumber::World.new
+  w.reset!
+  w
+end

data/lib/facebooker/rails/cucumber.rb

@@ -0,0 +1,28 @@
+require 'facebooker/rails/cucumber/world'
+require 'facebooker/mock/session'
+require 'facebooker/mock/service'
+
+Facebooker::MockService.fixture_path = File.join(RAILS_ROOT, 'features', 'support', 'facebook')
+
+module Facebooker
+  class << self
+    # prevent Facebooker from adding canvas name as prefix to URLs
+    def request_for_canvas(arg)
+      yield
+    end
+  end
+  
+  module Rails
+    module Controller
+      # prevent Facebooker from rendering fb:redirect
+      def redirect_to(*args)
+        super
+      end
+      
+      # Return the mock session
+      def new_facebook_session
+        Facebooker::MockSession.create
+      end
+    end
+  end
+end

data/lib/facebooker/rails/facebook_form_builder.rb

@@ -0,0 +1,112 @@
+module Facebooker
+  module Rails
+    class FacebookFormBuilder < ActionView::Helpers::FormBuilder
+      
+      
+      second_param = %w(password_field file_field check_box date_select datetime_select time_select)
+      third_param = %w(radio_button country_select select time_zone_select)
+      fifth_param = %w(collection_select)
+      
+      def self.create_with_offset(name,offset)
+        define_method name do |field,*args|
+          options = args[offset] || {}
+          build_shell(field,options) do
+            super
+          end
+        end    
+      end
+
+      second_param.each do |name|
+        create_with_offset(name,0)
+      end
+      third_param.each do |name|
+        create_with_offset(name,1)
+      end
+      fifth_param.each do |name|
+        create_with_offset(name,3)
+      end
+      
+      def build_shell(field,options)
+        @template.content_tag "fb:editor-custom", :label=>label_for(field,options) do
+          yield
+        end
+      end
+      
+      def label_for(field,options)
+        options[:label] || field.to_s.humanize
+      end
+      
+      def text(string,options={})
+        @template.content_tag "fb:editor-custom",string, :label=>label_for("",options)
+      end
+      
+      
+      def text_field(method, options = {})
+        options[:label] ||= label_for(method,options)
+        add_default_name_and_id(options,method)
+        options["value"] ||= value_before_type_cast(object,method)
+        @template.content_tag("fb:editor-text","",options)
+      end
+      
+      
+      def text_area(method, options = {})
+        options[:label] ||= label_for(method,options)
+        add_default_name_and_id(options,method)
+        @template.content_tag("fb:editor-textarea",value_before_type_cast(object,method),options)        
+      end
+      
+      #
+      # Build a text input area that uses typeahed
+      # options are like collection_select
+      def collection_typeahead(method,collection,value_method,text_method,options={})
+        build_shell(method,options) do
+          collection_typeahead_internal(method,collection,value_method,text_method,options)
+        end
+      end
+      
+      def collection_typeahead_internal(method,collection,value_method,text_method,options={})
+        option_values = collection.map do |item|
+          value=item.send(value_method)
+          text=item.send(text_method)
+          @template.content_tag "fb:typeahead-option",text,:value=>value
+        end.join
+        add_default_name_and_id(options,method)
+        options["value"] ||= value_before_type_cast(object,method)
+        @template.content_tag("fb:typeahead-input",option_values,options)        
+      end
+      
+      def value_before_type_cast(object,method)
+        unless object.nil?
+          method_name = method.to_s
+          object.respond_to?(method_name + "_before_type_cast") ?
+          object.send(method_name + "_before_type_cast") :
+          object.send(method_name)
+        end
+      end
+      
+      def multi_friend_input(options={})
+        build_shell(:friends,options) do
+          @template.content_tag("fb:multi-friend-input","",options)
+        end
+      end
+
+      def buttons(*names)
+        buttons=names.map do |name|
+          create_button(name)
+        end.join
+        
+        @template.content_tag "fb:editor-buttonset",buttons
+      end
+      
+      def create_button(name)
+        @template.content_tag("fb:editor-button","",:value=>name,:name=>"commit")
+      end
+      
+      def add_default_name_and_id(options,method)
+        options[:name] ||= "#{object.class.name.underscore}[#{method}]"
+        options[:id] ||= "#{object.class.name.underscore}_#{method}"
+      end
+
+    end
+  end
+end

data/lib/facebooker/rails/facebook_pretty_errors.rb

@@ -0,0 +1,22 @@
+class ActionController::Base
+  def rescues_path_with_facebooker(template_name)
+    t = "#{RAILS_ROOT}/vendor/plugins/facebooker/templates/#{template_name}.erb"
+    if pretty_facebook_errors? && File.exist?(t)
+      t
+    else
+      rescues_path_without_facebooker(template_name)
+    end
+  end
+  alias_method_chain :rescues_path, :facebooker
+
+  def response_code_for_rescue_with_facebooker(exception)
+    pretty_facebook_errors? ? 200 : response_code_for_rescue_without_facebooker(exception)
+  end
+  alias_method_chain :response_code_for_rescue, :facebooker
+  
+  
+  def pretty_facebook_errors?
+    Facebooker.facebooker_config['pretty_errors'] ||
+      (Facebooker.facebooker_config['pretty_errors'].nil? && RAILS_ENV=="development")
+  end
+end

data/lib/facebooker/rails/facebook_request_fix.rb

@@ -0,0 +1,24 @@
+module ::ActionController
+  class AbstractRequest
+    def request_method_with_facebooker
+      if parameters[:fb_sig_request_method]=="GET" and parameters[:_method].blank?
+        parameters[:_method]="GET"
+      end
+      request_method_without_facebooker
+    end
+    
+    if new.methods.include?("request_method")
+      alias_method_chain :request_method, :facebooker 
+    end
+    
+    def xml_http_request_with_facebooker?
+      parameters["fb_sig_is_mockajax"] == "1"  ||
+      parameters["fb_sig_is_ajax"] == "1" ||
+      xml_http_request_without_facebooker?
+    end
+    alias_method_chain :xml_http_request?, :facebooker
+    # we have to re-alias xhr? since it was pointing to the old method
+    alias xhr? :xml_http_request?
+    
+  end
+end

data/lib/facebooker/rails/facebook_session_handling.rb

@@ -0,0 +1,69 @@
+module ActionController
+  class CgiRequest
+    alias :initialize_aliased_by_facebooker :initialize
+
+    def initialize(cgi, session_options = {})
+      initialize_aliased_by_facebooker(cgi, session_options)
+      @cgi.instance_variable_set("@request_params", request_parameters.merge(query_parameters))
+    end
+    
+    DEFAULT_SESSION_OPTIONS[:cookie_only] = false
+  end 
+end
+
+module ActionController
+  class RackRequest < AbstractRequest #:nodoc:
+    alias :initialize_aliased_by_facebooker :initialize
+
+    def initialize(cgi, session_options = {})
+      initialize_aliased_by_facebooker(cgi, session_options)
+      @cgi.instance_variable_set("@request_params", request_parameters.merge(query_parameters))
+    end
+  end 
+end
+
+class CGI  
+  class Session
+    private
+      alias :initialize_aliased_by_facebooker :initialize
+      attr_reader :request, :initialization_options
+
+      def initialize(request, option={})
+        @request = request
+        @initialization_options = option
+        option['session_id'] ||= set_session_id
+        initialize_aliased_by_facebooker(request, option)
+      end
+      
+      def set_session_id
+        if session_key_should_be_set_with_facebook_session_key? 
+          request_parameters[facebook_session_key]
+        else 
+          request_parameters[session_key]
+        end
+      end
+
+      def request_parameters
+        request.instance_variable_get("@request_params")
+      end
+
+      def session_key_should_be_set_with_facebook_session_key?
+        request_parameters[session_key].blank? && !request_parameters[facebook_session_key].blank?
+      end
+
+      def session_key
+        initialization_options['session_key'] || '_session_id'
+      end
+
+      def facebook_session_key
+        'fb_sig_session_key'
+      end
+
+      alias :create_new_id_aliased_by_facebooker :create_new_id
+
+      def create_new_id
+        @new_session = true
+        @session_id || create_new_id_aliased_by_facebooker
+      end
+  end
+end