Adding support for /debug_token endpoint

[weyus]

I would like to add support for the /debug_token endpoint that can be used to retrieve information about an existing access token - see: https://developers.facebook.com/docs/authentication/access-token-debug/ for details.

Because this endpoint is so simple, I don't think it would really qualify as a Node subclass. I think I will give it it's own Rack::OAuth2::Client. I'm looking at FbGraph::Auth as an example, although the object I'm proposing FbGraph::AccessToken would of course be much simpler.

What would be the most similar type of object that already exists in FbGraph that I can use as a model to help me develop AccessToken? There's only one endpoint, all the attributes are required, etc.

Thanks, Wes

[weyus]

Looks like Rack::OAuth2::Client requires an 'identifier' attribute. Perhaps I should use something else as a client to pull the data - should I just use the regular FbGraph.http_client?

[nov]

Hum, how about something like this? I'm thinking putting it at lib/patch/rack/oauth2/access_token/.

module Rack
  module OAuth2
    class AccessToken
      module Debugger
        attr_accessor :application, :expires_at, :issued_at, :is_valid, :metadata, :scopes, :user_id
        class Result < FbGraph::Node
          def initialize(attributes = {})
            super :debug_token
            if (data = attributes[:data])
              self.application = FbGraph::Application.new data[:app_id], :name => data[:application]
              [:expires_at, :issued_at, :is_valid, :metadata, :scopes, :user_id].each do |key|
                self.send :"#{key}=", data[key]
              end
            end
          end
        end

        def debug(_access_token_)
          Result.fetch :access_token => _access_token_, :input_token => self.access_token
        end
      end
      Legacy.send :include, Debugger
    end
  end
end

BTW, I can't make the call working using Graph API Explorer. Did you need any app setting change to play with the endpoint?

I'm just getting this error now..

{
  "error": {
    "message": "(#100) ",
    "type": "OAuthException",
    "code": 100
  }
}

[nov]

Ah, it's just because "Graph API Explorer" app isn't permitted to access the endpoint. Using my another FB app, I could use it.

[weyus]

From https://developers.facebook.com/docs/authentication/access-token-debug/ :

access_token: your app token or a valid user token of a developer of your app.

...

You can quickly retrieve your app or user tokens with the access token tool (https://developers.facebook.com/tools/access_token). If you plan to call this endpoint on a regular basis, you should use your app token because it never expires.

[weyus]

I didn't try with the GAE, I just did it in the URL :).

Your code looks great - what is the rationale for putting it in Rack::OAuth2?

[nov]

It's because I wanted to ask token details to access_token instance itself. I'm also thinking something like below which will require another code structure.

access_token.introspect!(app_token)
access_token.application # => FbGraph::Application
access_token.user # => FbGraph::User
access_token.scopes # => Array
access_token.issued_at # => Time
access_token.expires_at # => Time
access_token.expires_in # => Integer, unix timestamp
access_token.metadata # => Hash

Which do you prefer?

[weyus]

Hmm - I don't know. Is introspect! already an existing idiom elsewhere in the codebase? I do like the idea of it though.

[nov]

OAuth/OpenID spec writers often use the word introspection. Token introspection is required for security reason in some cases. ref.) http://www.thread-safe.com/2012/01/problem-with-oauth-for-authentication.html

[nov]

Sorry, I stopped adding those attributes AccessToken class itself. I'm a bit afraid that other users think AccessToken#user fetches FbGraph::User.me :(

I'll release this change with wiki update soon. Thanks!

[weyus]

No, thank you!