view release on metacpan or  search on metacpan

lib/Net/Facebook/Oauth2.pm  view on Meta::CPAN

package Net::Facebook::Oauth2;

use strict;
use warnings;
use LWP::UserAgent;
use URI;
use URI::Escape;
use JSON::MaybeXS;
use Carp;

our $VERSION = '0.12';

sub new {
    my ($class,%options) = @_;
    my $self = {};
    $self->{options} = \%options;

    my $api_version = defined $options{api_version} ? $options{api_version} : 'v4.0';

    if (!defined $options{access_token}){
        croak "You must provide your application id in new()\nNet::Facebook::Oauth2->new( application_id => '...' )" unless defined $self->{options}->{application_id};
        croak "You must provide your application secret in new()\nNet::Facebook::Oauth2->new( application_secret => '...' )" unless defined $self->{options}->{application_secret};
    }

    if (defined $options{access_token_url}) {
        croak "cannot pass access_token_url AND api_version" if defined $options{api_version};
        $self->{access_token_url} = $options{access_token_url};
    }
    else {
        $self->{access_token_url} = "https://graph.facebook.com/$api_version/oauth/access_token";
    }

    if (defined $options{authorize_url}) {
        croak "cannot pass authorize_url AND api_version" if defined $options{api_version};
        $self->{authorize_url} = $options{authorize_url};
    }
    else {
        $self->{authorize_url} = "https://www.facebook.com/$api_version/dialog/oauth";
    }

    if (defined $options{debug_token_url}) {
        croak "cannot pass debug_token_url AND api_version" if defined $options{api_version};
        $self->{debug_token_url} = $options{debug_token_url};
    }
    else {
        $self->{debug_token_url} = "https://graph.facebook.com/$api_version/debug_token";
    }

    $self->{browser}      = $options{browser} || LWP::UserAgent->new;
    $self->{display}      = $options{display} || 'page'; ## other values popup and wab
    $self->{access_token} = $options{access_token};

    return bless($self, $class);
}

sub get_authorization_url {
    my ($self,%params) = @_;

    $params{callback} ||= $self->{options}->{callback};
    croak "You must pass a callback parameter with Oauth v2.0" unless defined $params{callback};

    $params{display} = $self->{display} unless defined $params{display};
    $self->{options}->{callback} = $params{callback};

    my $url = $self->{authorize_url}
    ."?client_id="
    .uri_escape($self->{options}->{application_id})
    ."&redirect_uri="
    .uri_escape($params{callback});

    if ($params{scope}) {
        my $scope = join(',', @{$params{scope}});
        $url .= '&scope=' . $scope if $scope;
    }
    # state is now required:
    $url .= '&state=' . (defined $params{state} ? $params{state} : time);

    $url .= '&response_type=' . $params{response_type} if $params{response_type};
    $url .= '&auth_type=' . $params{auth_type}         if $params{auth_type};
    $url .= "&display=".$params{display};

    return $url;
}


sub get_access_token {
    my ($self,%params) = @_;
    $params{callback} ||= $self->{options}->{callback};
    $params{code} ||= $self->{options}->{code};

    croak "You must pass a code parameter with Oauth v2.0" unless defined $params{code};
    croak "You must pass callback URL" unless defined $params{callback};
    $self->{options}->{code} = $params{code};

    ###generating access token URL
    my $getURL = $self->{access_token_url}
    ."?client_id="
    .uri_escape($self->{options}->{application_id})
    ."&redirect_uri="
    .uri_escape($params{callback})
    ."&client_secret="
    .uri_escape($self->{options}->{application_secret})
    ."&code=$params{code}";

    my $response = $self->{browser}->get($getURL);
    my $json     = decode_json($response->content());

    if (!$response->is_success || exists $json->{error}){
        ##got an error response from facebook. die and display error message
        croak "'" . $json->{error}->{type}. "'" . " " .$json->{error}->{message};

lib/Net/Facebook/Oauth2.pm  view on Meta::CPAN

=over 4

=item * C<callback>

    callback => 'http://example.com/login/facebook/success'

The callback URL, where Facebook will send users after they authorize
your application. YOU MUST CONFIRM THIS URL ON FACEBOOK'S APP DASHBOARD.

To do that, go to the App Dashboard, click Facebook Login in the right-hand
menu, and check the B<Valid OAuth redirect URIs> in the Client OAuth Settings
section.

=back

This method also accepts the following I<OPTIONAL> arguments:

=over 4

=item * C<scope>

    scope => ['user_birthday','user_friends', ...]

Array of Extended permissions as described by the Facebook Oauth API.
You can get more information about scope/Extended Permission from

L<https://developers.facebook.com/docs/facebook-login/permissions/>

Please note that requesting information other than C<name>, C<email> and
C<profile_picture> B<will require your app to be reviewed by Facebook!>

=item * C<state>

    state => '123456abcde'

An arbitrary unique string provided by you to guard against Cross-site Request
Forgery. This value will be returned to you by Facebook, unchanged. Note that,
as of Facebook API v3.0, this argument is I<mandatory>, so if you don't
provide a 'state' argument, we will default to C<time()>.

=item * C<auth_type>

When a user declines a given permission, you must reauthorize them. But when
you do so, any previously declined permissions will not be asked again by
Facebook. Set this argument to C<'rerequest'> to explicitly tell the dialog
you're re-asking for a declined permission.

=item * C<display>

    display => 'page'

How to display Facebook Authorization page. Defaults to C<page>.
Can be any of the following:

=over 4

=item * C<page>

This will display facebook authorization page as full page

=item * C<popup>

This option is useful if you want to popup authorization page
as this option tell facebook to reduce the size of the authorization page

=item * C<wab>

From the name, for wab and mobile applications this option is the best, as
the facebook authorization page will fit there :)

=back

=item * C<response_type>

    response_type => 'code'

When the redirect back to the app occurs, determines whether the response
data is in URL parameters or fragments. Defaults to C<code>, which is
Facebook's default and useful for cases where the server handles the token
(which is most likely why you are using this module), but can be also be
C<token>, C<code%20token>, or C<granted_scopes>. Note that changing this to
anything other than 'code' might change the login flow described in this
documentation, rendering calls to C<get_access_token()> pointless.
Please see
L<< Facebook's login documentation|https://developers.facebook.com/docs/facebook-login/manually-build-a-login-flow >>
for more information.

=back

=head2 C<$fb-E<gt>get_access_token( %args )>

This method issues a GET request to Facebook's API to retrieve the
access token string for the specified code (passed as an argument).

Returns the access token string or raises an exception in case of errors
(B<make sure to trap calls with eval blocks or a try/catch module>). Note
that Facebook's access tokens are short-lived, around 2h of idle time
before expiring. If you want to "upgrade" the token to a long lived one
(with around 60 days of idle time), use this token to feed the
C<get_long_lived_token()> method.

You should call this method inside the route for the callback URI defined
in the C<get_authorization_url> method. It receives the following arguments:

=over 4

=item * C<code>

This is the verifier code that Facebook sends back to your
callback URL once user authorize your app, you need to capture
this code and pass to this method in order to get the access token.

Verifier code will be presented with your callback URL as code
parameter as the following:

http://your-call-back-url.com?code=234er7y6fdgjdssgfsd...

Note that if you have fiddled with the C<response_type> argument,
you might not get this parameter properly.

=back

When the access token is returned you need to save it in a secure