diff -ur fb-7.x-3.x-dev/contrib/fb_user_app.module fb/contrib/fb_user_app.module --- fb-7.x-3.x-dev/contrib/fb_user_app.module 2011-09-09 14:12:44.000000000 -0500 +++ fb/contrib/fb_user_app.module 2011-09-13 21:25:35.555831993 -0500 @@ -123,11 +123,16 @@ } /** - * Keep track of when the user has visited the app, and whether they've - * authorized the app or not. + * Keep track of when the user has visited the app. * - * Historically this supported infinite sessions. I believe if this data is - * no longer necessary for the offline access extended permission. + * Historically we could learn a user's ID even if they hadn't authorized + * ("added") the app. No longer the case, so all entries in fb_user_app + * should be for authorized users. + * + * A "signed request" should be fully-formed (have an oauth_token) on canvas + * pages, and on post authorize events (for as long as facebook continues to + * support them). So this tracking will work best for canvas page apps and + * less reliably for connect. */ function fb_user_app_track($fb, $fb_app) { // Coming from a user adding the app or a page adding the app? @@ -139,28 +144,38 @@ $fbu = $_REQUEST['fb_sig_page_id']; } + $sr = $fb->getSignedRequest(); + watchdog('fb_user_app', __FUNCTION__ . " signed request is 
" . print_r($sr,1) . "
"); // debug - // test if we are tracking only those apps that have been granted offline - // access. - $fb_session = $fb->getSession(); + if (isset($sr['oauth_token'])) { + $access_token = $sr['oauth_token']; + $expires = $sr['expires']; + $fbu = $sr['user_id']; + } + else { + // @TODO: with new SDK, is there any useful tracking info? + return; + } // when 'expires' == 0 app has been granted offline access if ($fb_user_type == 'user' && - $fb_session["expires"] <> 0 && - variable_get(FB_USER_APP_VAR_USERS_THAT_GRANT_OFFLINE, FALSE)) + $expires <> 0 && + variable_get(FB_USER_APP_VAR_USERS_THAT_GRANT_OFFLINE, FALSE)) { + // Note, with new SDK, facebook provides 'expires' date even when user HAS GRANTED offline_access! + // @TODO: find some way to tell whether an access token will actually expire! return; + } // Track this event only if allowed to and only for users, not pages if ((variable_get(FB_USER_APP_VAR_TRACK_USERS, TRUE) && $fb_user_type = "user") || (variable_get(FB_USER_APP_VAR_TRACK_PAGES, TRUE) && $fb_user_type = "page")) { - $access_token = isset($fb_session['access_token']) ? $fb_session['access_token'] : ''; $result1 = db_query("UPDATE {fb_user_app} SET time_access=:time, session_key=:token, session_key_expires=:expires, user_type=:type WHERE apikey=:apikey AND fbu=:fbu", array( ':time' => REQUEST_TIME, ':token' => $access_token, - ':expires' => $fb_session['expires'], + ':expires' => $expires, ':type' => $fb_user_type, - ':apikey' => $fb_app->apikey, + ':apikey' => $fb_app->id, ':fbu' => fb_facebook_user($fb), )); @@ -168,7 +183,7 @@ // The row for this user was never inserted, or it was deleted, or the times were the same. $fbu = fb_facebook_user($fb); if ($fbu) { - //First make sure it was not just the same time + // First make sure it was not just the same time $result = db_query("SELECT * FROM {fb_user_app} WHERE apikey=:apikey AND fbu=:fbu", array( ':apikey' => $fb_app->apikey, ':fbu' => $fbu, @@ -184,7 +199,7 @@ ':added' => $data['is_app_user'], ':user_type' => $fb_user_type, ':session_key' => $access_token, - ':session_key_expires' => $fb_session['expires'], + ':session_key_expires' => $expires, ':time_access' => REQUEST_TIME, ':proxied_email' => $data['email'] ? $data['email'] : ($data['proxied_email'] ? $data['proxied_email'] : ''), // test accounts will not have ':time_cron' => 0, @@ -212,7 +227,7 @@ $mail = $data->proxied_email; } - if (!$mail) { + if (!isset($mail) || !$mail) { // Ask facebook for info. $fb = fb_api_init($fb_app); $info = fb_users_getInfo(array($fbu), $fb); diff -ur fb-7.x-3.x-dev/fb_connect.js fb/fb_connect.js --- fb-7.x-3.x-dev/fb_connect.js 2011-09-09 14:12:44.000000000 -0500 +++ fb/fb_connect.js 2011-09-13 20:13:38.840100459 -0500 @@ -55,10 +55,11 @@ }); // Facebook's invalid cookies persist if third-party cookies disabled. // Let's try to clean up the mess. + // @TODO: is this still needed with newer oauth SDK??? FB_JS.deleteCookie('fbs_' + FB._apiKey, '/', ''); // app id FB_JS.deleteCookie('fbs_' + Drupal.settings.fb.apikey, '/', ''); // apikey } - if (FB.getSession()) { + if (FB.getUser()) { // @TODO: still needed with newer oauth SDK??? // Facebook needs more time to log us out. (http://drupal.org/node/1164048) Drupal.settings.fb.reload_url = Drupal.settings.fb_connect.front_url; return false; diff -ur fb-7.x-3.x-dev/fb_connect.module fb/fb_connect.module --- fb-7.x-3.x-dev/fb_connect.module 2011-09-09 14:12:44.000000000 -0500 +++ fb/fb_connect.module 2011-09-13 20:19:21.385794076 -0500 @@ -148,15 +148,12 @@ // @TODO fb.module should have a helper to make this cleaner. $settings['fb_init_settings']['appId'] = $fb_app->id; - $settings['fb_init_settings']['session'] = $fb->getSession(); fb_js_settings('apikey', $fb_app->apikey); fb_js_settings('fbu', fb_facebook_user($fb)); fb_js_settings('fb_init_settings', $settings['fb_init_settings']); - //$js = drupal_add_js(array('fb' => fb_js_settings()), 'setting'); // fb.module will add settings to footer. } } - } @@ -166,11 +163,11 @@ function _fb_connect_block_login_defaults() { return array('anon_not_connected' => array( 'title' => t('Facebook Connect'), - 'body' => array('value' => 'Connect'), + 'body' => array('value' => 'Connect'), ), 'user_not_connected' => array( 'title' => t('Facebook Connect'), - 'body' => array('value' => 'Connect'), + 'body' => array('value' => 'Connect'), ), 'connected' => array( 'title' => t('Facebook Connect'), diff -ur fb-7.x-3.x-dev/fb_devel.js fb/fb_devel.js --- fb-7.x-3.x-dev/fb_devel.js 2011-09-09 14:12:44.000000000 -0500 +++ fb/fb_devel.js 2011-09-13 20:13:38.840100459 -0500 @@ -15,9 +15,18 @@ // before fb.js has a chance to initilize it! To fix: use browser // to view page source, find all \n"; + return $output; +} + + + /** * Provides a page with useful debug info. * @@ -339,12 +356,15 @@ // TODO: determine whether connect page or canvas. drupal_set_message(t("session name: " . session_name())); - drupal_set_message(t("cookie domain: " . fb_settings(FB_SETTINGS_COOKIE_DOMAIN))); drupal_set_message(t("session id: " . session_id())); + drupal_set_message(t("cookie domain: " . fb_settings(FB_SETTINGS_COOKIE_DOMAIN))); + if (isset($_COOKIE['fbs_' . $_fb_app->apikey])) drupal_set_message(t("fbs_" . $_fb_app->apikey . ": " . $_COOKIE["fbs_" . $_fb_app->apikey])); + drupal_set_message(t("processed link, unprocessed", array('!url' => url('fb/devel')))); drupal_set_message(t("getUser() returns " . $_fb->getUser())); + drupal_set_message(t("getAccessToken() returns " . $_fb->getAccessToken())); drupal_set_message(t("base_url: " . $GLOBALS['base_url'])); drupal_set_message(t("base_path: " . $GLOBALS['base_path'])); @@ -368,7 +388,6 @@ dpm($_COOKIE, 'cookie'); dpm($_REQUEST, "Request"); //dpm($_fb_app, "fb_app"); - drupal_set_message(t("session_id returns " . session_id())); dpm($_SESSION, "session:"); foreach ($items as $key => $val) { @@ -457,8 +476,15 @@ function fb_devel_fbu_page($fbu = NULL) { global $_fb, $_fb_app; if ($fbu) { + // Uses FQL + $info = fb_users_getInfo(array($fbu), $_fb); + $output = "

Debug FQL info about facebook id $fbu ({$info[0]['name']}):

\n"; + $output .= ""; + $output .= "
" . print_r($info[0], 1) . "
"; + + // Use new graph api $info = $_fb->api($fbu, array('metadata' => 1)); - $output = "

Debug info about facebook id $fbu ({$info[name]}):

\n"; + $output .= "

Debug info about facebook id $fbu ({$info['name']}):

\n"; $output .= ""; $output .= "
" . print_r($info, 1) . "
"; @@ -479,7 +505,7 @@ //dpm($friends, "$fbu/friends returned"); $items = array(); foreach ($friends['data'] as $data) { - $items[] = l($data['name'], "fb/devel/fbu/{$data[id]}"); + $items[] = l($data['name'], "fb/devel/fbu/{$data['id']}"); } if (count($items)) { $output .= "\n

Known friends: