Merge remote-tracking branch 'refs/remotes/agriffis/exchange-facebook…

…-token'
pennersr · Jul 21, 2015 · b8aeec8 · b8aeec8
2 parents f4a5140 + 3a22303
commit b8aeec8
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 2 deletions.
diff --git a/allauth/socialaccount/providers/facebook/views.py b/allauth/socialaccount/providers/facebook/views.py
@@ -68,6 +68,14 @@ def login_by_token(request):
                     ok = nonce and nonce == info.get('auth_nonce')
                 else:
                     ok = True
+                if ok and provider.get_settings().get('EXCHANGE_TOKEN'):
+                    resp = requests.get(
+                        GRAPH_API_URL + '/oauth/access_token',
+                        params={'grant_type': 'fb_exchange_token',
+                                'client_id': app.client_id,
+                                'client_secret': app.secret,
+                                'fb_exchange_token': access_token}).json()
+                    access_token = resp['access_token']
                 if ok:
                     token = SocialToken(app=app,
                                         token=access_token)

diff --git a/docs/providers.rst b/docs/providers.rst
@@ -95,15 +95,16 @@ The following Facebook settings are available::
 
     SOCIALACCOUNT_PROVIDERS = \
         {'facebook':
-           {'SCOPE': ['email', 'public_profile', 'user_friends'],
+           {'METHOD': 'oauth2',
+            'SCOPE': ['email', 'public_profile', 'user_friends'],
             'AUTH_PARAMS': {'auth_type': 'reauthenticate'},
             'FIELDS': [
 	        'id',
                 'email',
                 'name',
                 'first_name',
                 'last_name'],
-            'METHOD': 'oauth2',
+            'EXCHANGE_TOKEN': True,
             'LOCALE_FUNC': 'path.to.callable',
             'VERIFIED_EMAIL': False,
             'VERSION': 'v2.4'}}
@@ -124,6 +125,12 @@ AUTH_PARAMS:
 FIELDS:
     The fields to fetch from the Graph API `/me/?fields=` endpoint.
 
+EXCHANGE_TOKEN:
+    The JS SDK returns a short-lived token suitable for client-side use. Set
+    `EXCHANGE_TOKEN = True` to make a server-side request to upgrade to a
+    long-lived token before storing in the `SocialToken` record. See
+    `Expiration and Extending Tokens <https://developers.facebook.com/docs/facebook-login/access-tokens#extending>`_.
+
 LOCALE_FUNC:
     The locale for the JS SDK is chosen based on the current active language of
     the request, taking a best guess. This can be customized using the