Jozef Chúťka's blog » facebook api

Neverending Facebook API changes

Jozef Chúťka — Wed, 21 Jul 2010 11:35:09 +0000

Believe it or not, facebook changed part of its api again. Since today, authorizing for iframe applications does not work the same way it used to. Previously it was enough to redirect:

https://graph.facebook.com/oauth/authorize
    ?client_id=268718683475
    &redirect_uri=http://apps.facebook.com/blogoauthgraph/
    &scope=publish_stream,user_photos,user_photo_video_tags

… where facebook authorized your app and redirects back to the:

http://apps.facebook.com/blogoauthgraph/
    ?session=123456...

… where session was valid access_token.

Since today the mechanism changed into something like this:

https://graph.facebook.com/oauth/authorize
    ?client_id=268718683475
    &redirect_uri=http://apps.facebook.com/blogoauthgraph/
    &scope=publish_stream,user_photos,user_photo_video_tags

… redirects you to the:

http://apps.facebook.com/blogoauthgraph/
    ?code=2.YndguK...

… while you do not have valid session (access_token), you have to do the following request:

https://graph.facebook.com/oauth/access_token
    ?client_id=268718683475
    &redirect_uri=http://apps.facebook.com/blogoauthgraph/
    &client_secret=YOURSECRET
    &code=2.YndguK...

… now facebook responds with:

access_token=268718683475|2.Yndgu...&expires=86183

Notice, this is the response, not the redirect! Now its time to grab the access_token and use it in your app. This change has direct impact on Authorizing Iframe Facebook Applications For Graph API article.

There have also been some other unannounced changes e.g. in facebook app settings in migrations tab “Remove fb_sig” toggler…

Credits goes to my readers Adam Cousins, David Bardos, Garcimore, Etienne for noticing the changes.

I have just spotted quick fix. All you need to do is add type=user_agent into your auth request:

https://graph.facebook.com/oauth/authorize
    ?client_id=268718683475
    &redirect_uri=http://apps.facebook.com/blogoauthgraph/
    &scope=publish_stream,user_photos,user_photo_video_tags
    &type=user_agent

… now facebook redirects you to:

http://apps.facebook.com/blogoauthgraph/
    ?access_token=123456...
    &expires_in=86729

This token is valid! I have updated the article with this quickfix.

updated Jul 22, 2010: Facebook rollbacked the change and added “Canvas Session Parameter” parameter in facebook app settings / Migrations tab. With this setting enabled, your apps should work normally as they previously did.

Extending FacebookOAuthGraph Class

Jozef Chúťka — Tue, 22 Jun 2010 10:03:06 +0000

While The Facebook Graph API article becomes pretty popular and a lot of developers keep asking me to publish some practices I use, I managed to create this blog post. Here is a list o some functions you may want to extend FacebookOAuthGraph Class with.

Extending & Singletonize

First, lets make our class singleton, so the whole flash project can simply access and use one instance

public class Facebook extends FacebookOAuthGraph
{
    private static const _instance:Facebook = new Facebook();
    public function Facebook()
    {
        super();
        useSecuredPath = true;
        if(instance)
            throw new Error("Use Facebook.instance!");
    }

    public static function get instance():Facebook
    {
        return _instance;
    }
    ....
}

Now anywhere in your project:

var facebook:Facebook = Facebook.instance;

Auto Execution After Authorization:

Lets say, when user clicks on publish post before your application is connected, just make connect() followed by desired function:

if(!facebook.authorized)
    facebook.connect();
facebook.publishPost(...)

publishPost() automatically executes again after connected thanks to Callbacks class

import sk.yoz.utils.Callbacks;

private function onAuthorized(event:FacebookOAuthGraphEvent):void
{
	Callbacks.execute("FBstuff");
}

public function publishPost(...):void
{
    if(!authorized)
        return Callbacks.add(this, arguments.callee, arguments, "FBstuff");

    // here continues the function code
    ...
}

Application Friends

Lets get list of friends using the application:

private function getAppFriends():void
{
	var data:URLVariables = new URLVariables();
	data.query = "SELECT uid, name, pic_square " +
			"FROM user " +
			"WHERE uid IN " +
				"(SELECT uid2 FROM friend WHERE uid1=" + me.id + ") " +
				"AND is_app_user";

	var loader:URLLoader = call("method/fql.query", data,
		URLRequestMethod.POST, null, "https://api.facebook.com");
	loader.addEventListener(FacebookOAuthGraphEvent.DATA, onGetAppFriends);
}

private function onGetAppFriends(event:FacebookOAuthGraphEvent):void
{
	var xml:XML = new XML(event.rawData);
	var ns:Namespace = xml.namespace();
	default xml namespace = ns;
	xml.namespace(ns.prefix);
	xml.ignoreWhite = true;
	for each(var user:XML in xml.user)
	{
		user.uid.toString();
        user.name.toString();
		...
    }
    default xml namespace = new Namespace("");
}

Publishing Feeds

Publish feed with image:

public function publishPost(message:String, attachmentName:String,
	attachmentDescription:String):void
{
	var media:Object = {};
	media.src = "http://mydomain.com/feedimage.jpg";
	media.href = "http://apps.facebook.com/myapp";
	media.type = "image";

	var attachment:Object = {};
	attachment.name = attachmentName;
	attachment.href = "http://apps.facebook.com/myapp";
	attachment.description = attachmentDescription;
	//attachment.caption = "test caption";
	attachment.media = [media];

	var data:URLVariables = new URLVariables();
	data.message = message;
	data.attachment = JSON.encode(attachment);

	call("method/stream.publish", data, URLRequestMethod.POST,
		null, "https://api.facebook.com");
}

Publish feed with flash:

public function publishFlash(message:String, href:String, swfSrc:String,
	mediaSrc:String, attachmentName:String, attachmentCaption:String,
	attachmentDescription:String, properties:Object=null):void
{
	var media:Object = {};
	media.type = "flash";
	media.swfsrc = swfSrc;
	media.imgsrc = mediaSrc;
	//media.width = "80";
	//media.height = "80";
	media.expanded_width = "460";
	media.expanded_height = "460";

	var attachment:Object = {};
	attachment.name = attachmentName;
	attachment.href = href;
	attachment.caption = attachmentCaption;
	attachment.description = attachmentDescription;
	attachment.media = [media];
	attachment.properties = properties; // action links
	// properties {prop1:{text: "value 1", href:"http://"}, prop2:...};

	var data:URLVariables = new URLVariables();
	data.message = message;
	data.attachment = JSON.encode(attachment);

	call("method/stream.publish", data, URLRequestMethod.POST, null,
		"https://api.facebook.com");
}

Publish feed with action links:

var properties:Object = {};
properties.MOVE = {
	text: "mouse drag",
	href:config.urlManager.boardURL};
properties.ZOOM = {
	text: "double click, [Page Up], [Page Down]",
	href:config.urlManager.boardURL};
properties.ROTATE = {
	text: "[Ctrl] + mouse move",
	href:config.urlManager.boardURL};

attachment.properties = properties;

Publishing feed using Graph API (docs, from facebook bugzilla):

forget everything related to the old “media” stuff of the attachment
put what you had in ~~swfsrc~~ into source (mandatory)
put what you had in ~~imgsrc~~ into picture (mandatory)
link is mandatory also and must points to the connect or canvas URL
Feed arguments: message, picture, link, name, caption, description, source

Uploading Photo

This is a piece of working code from Sean, more upload handling functions and album creating can be found here. thnx Sean:

// MultipartURLLoader by Eugene Zatepyakin can be found here: http://bit.ly/9wx4q7
public function uploadImageCall(bytes:ByteArray, message:String):MultipartURLLoader
{
    var mpLoader:MultipartURLLoader = new MultipartURLLoader();
    mpLoader.addVariable("message", message);
    mpLoader.addFile(bytes, "image.jpg", "image");
    loaderAddListeners(mpLoader.loader);
    mpLoader.load(apiSecuredPath + "/me/photos?access_token="+ token);
    return mpLoader;
}

Palming Token

When localy debuging your app you may want to palm off custom access_token:

if(parameters.debug)
    facebook.hackToken(parameters, "110363ABXY..."); // copypaste from callback.html hash
facebook.autoConnect(parameters);

in Facebook.as:

public function hackToken(parameters:Object, token:String):Object
{
	if(!parameters.session)
		parameters.session = JSON.encode({
			access_token:String(token).replace(/\%7C/g, "|")});
	return parameters;
}

Advanced Crossdomain Working Authorization

Or if you prefer or need advanced callback, that works crossdomain, and also for local debuging: callback.html

You may now close this window.

universal callback.swf (741 Bytes) main class:

package
{
    import flash.display.Sprite;
    import flash.net.LocalConnection;

    public class Callback extends Sprite
    {
        public function Callback()
        {
            super();
            var parameters:Object = loaderInfo.parameters
            var localConnection:LocalConnection = new LocalConnection();
            localConnection.send(
                parameters.connectionName,
                parameters.methodName,
                parameters.hash);
        }
    }
}

facebook.as class:

private var localConnection:LocalConnection;

override public function connect():void
{
	super.connect();

	if(!localConnection)
	{
		localConnection = new LocalConnection();
		localConnection.client = this;
		localConnection.allowDomain("*");
		localConnection.allowInsecureDomain("*");
		localConnection.connect("_facebookConnector");
	}
}

private function onAuthorized(event:FacebookOAuthGraphEvent):void
{
	// listener defined in Facebook constructor:
	// addEventListener(FacebookOAuthGraphEvent.AUTHORIZED, onAuthorized);

	try
	{
		localConnection.close();
		localConnection = null;
	}
	catch(error:Error){}
}

Getting All The Photos Of All Albums Of 1 User

Credits to Etienne, thnx

function getAllphotos(uid:String):void {
	var data:URLVariables = new URLVariables();
	data.query = "SELECT src_small, src_big " +
		"FROM photo " +
		"WHERE aid IN ( SELECT aid FROM album WHERE owner='"+HERE PUT THE USER ID+"' )"
	var loader:URLLoader = facebook.call("method/fql.query", data,URLRequestMethod.POST,
		null, "https://api.facebook.com");
	loader.addEventListener(FacebookOAuthGraphEvent.DATA, onGetAllphotos);
}

Tagging photos

This script uses photos.addTag – part of old REST api (some more reading):

var data:URLVariables = new URLVariables();
data.pid = photoID;
data.tag_uid = userID; // user on photo we are tagging
data.x = 50; // 50% means center
data.y = 50; // 50% means middle
call("method/photos.addTag", data, URLRequestMethod.GET, null, "https://api.facebook.com");

Important: Graph API upload call returns the object_id. In order to get pid you have to lookup in photo table:

SELECT pid FROM photo WHERE object_id=response.id

Catching verify token error

In order to catch the ERROR event with verifyToken() method Nils suggested the following:

override public function verifyToken(token:String):URLLoader
{
    var loader:URLLoader = super.verifyToken(token);
    loader.addEventListener(FacebookOAuthGraphEvent.ERROR,
        function(event:FacebookOAuthGraphEvent):void
        {
            _authorized = false;
            _me = null;
            _token = null;
            EventDispatcher(event.currentTarget)
                .removeEventListener(event.type, arguments.callee);
            var type:String = FacebookOAuthGraphEvent.UNAUTHORIZED;
            dispatchEvent(new FacebookOAuthGraphEvent(type));
        });
    return loader;
}

Authorizing Iframe Facebook Applications For Graph API

Jozef Chúťka — Thu, 03 Jun 2010 11:48:09 +0000

This article continues my exploration of best facebook graph api integration into your flash app. Before continue reading, make sure you understand the previous article. Due to huge interest, I am adding codes that makes your flash app working with graph api within facebook iframe. Try this app live on http://apps.facebook.com/blogoauthgraph/, notice once you get there, you are redirected to grant permissions (if not authorized or granted already) and then redirected back to the app, where you are connected and ready to use graph api.

What I did was changing one line of ActionScript, I added autoConnect() methods that sends app flashvars directly into FacebookOAuthGraph object.

var facebook:FacebookOAuthGraph = new FacebookOAuthGraph();
...
facebook.autoConnect(parameters); // passing flashvars

See full ActionScript code for details.

Now there is a different html wrapper for facebook iframe – facebook.php:




    
    
    FacebookOAuthGraphTest

There are few lines of code to be mentioned:

~~getRequestParameter(name) – returns GET parameter from iframe url, you can use your own functions~~
allRequestParameters() – returns object consisting of all iframe GET parameters, used to pass flashvars into our flash
php code to define javascript signed_request variable containing valid token
window.top.location – if there is no token parameter found (not authorized yet), you are redirected to the facebook authorization. Do not forget to change client_id and redirect_uri when using for your app.

Facebook settings:

App ID: 268718683475
Site URL: http://blog.yoz.sk/examples/FacebookOAuthGraph/
Site Domain: yoz.sk
Canvas Page: http://apps.facebook.com/blogoauthgraph/
Canvas URL: http://blog.yoz.sk/examples/FacebookOAuthGraph/facebook.php?a=b
Canvas FBML/iframe: iframe

Disable Deprecated Auth Methods: Enabled
Stream post URL security: Disabled
OAuth 2.0 for Canvas: Enabled
POST for Canvas: Enabled
Canvas Session Parameter (Deprecated): Disabled
November 2010 Rollup: Enabled
Timezone-less events: Enabled
Upgrade to Requests 2.0: Enabled
JSON Encoding Empty Arrays: Enabled

Here is the final facebook app http://apps.facebook.com/blogoauthgraph/

~~updated Jul 21, 2010: Quickfix for late facebook changes:~~

updated Mar 16, 2011: Catching token from POST parameter.

Facebook Graph API & OAuth 2.0 & Flash (update)

Jozef Chúťka — Wed, 05 May 2010 15:04:22 +0000

As previously mentioned, facebook released a new Graph API. It is based on OAuth 2.0 protocol (old authorization token also works). While it is fresh thing, there is no much ActionScript stuff around, so I came with FacebookOAuthGraph class. This class is meant to be used as an abstract class, while it contains just the basic authentication algorithm and call method to request data. It stores access token in SharedObject, so next time you came into app, you get connected on background without noticing (no popup etc.). Your token should expire in 24 hours.

Here is the code for the following flex app, to make it work, get latest FacebookOAuthGraph and FacebookOAuthGraphEvent classes.




 see result\n";

        if(event.rawData is ByteArray)
        {
            var loader:Loader = new Loader();
            loader.loadBytes(event.rawData as ByteArray);
            loader.contentLoaderInfo.addEventListener(Event.COMPLETE,
                function():void
                {
                    image.source = loader;
                });
        }
        else
        {
            result.text = event.rawData.toString();
        }
    }
]]>

Make sure your html wrapper defines correct allowScriptAccess and both id and name for tag. This enables ExternalInterface.objectID. With swfobject use:

var params = {
    allowScriptAccess: "sameDomain"
};

var attributes = {
    id: "FacebookOAuthGraphTest",
    name: "FacebookOAuthGraphTest"
};
swfobject.embedSWF("FacebookOAuthGraphTest.swf", "alternative", "100%", "100%", "10.0.0",
    "expressInstall.swf", flashvars, params, attributes);

callback.html pushes url hash into flash app. When running this application from desktop (creating/debugging), your callback.html located on public domain has no access to its opener (different domain – XSS), so you need to pass access_token manualy into , but once your flash application is on the same domain with callback, it works automaticaly.

callback.html:

You may now close this window.

Click connect and allow facebook application. Facebook redirects to callback.html that pastes hash into flash and closes popup. Now you are authenticated. Next time you visit this flash application (refresh this page) you will get authenticated in background (if your access token is still valid). Notice, some graph api calls returns JSON objects (me), other may return binary data (me/picture). For now it may take some time to finish calls (5 second or more), but I hope facebook will soon make it fast.

You get your JSON decoded data via event.data. Just make sure you do not try to decode ByteArray (eg. me/picture)

// call("me")
private function callComplete(event:FacebookOAuthGraphEvent):void
{
    trace(event.data.name);
}

Some calls to test:

Friends:             me/friends
News feed:           me/home
Profile feed (Wall): me/feed
Likes:               me/likes
Movies:              me/movies
Books:               me/books
Notes:               me/notes
Photos:              me/photos
Videos:              me/videos
Events:              me/events
Groups:              me/groups

Additional information about my facebook app (see all settings):

Application ID:         268718683475
App Domain:              yoz.sk
Website / Site URL:      http://blog.yoz.sk/examples/FacebookOAuthGraph/
App on FB / Canvas URL:  http://blog.yoz.sk/examples/FacebookOAuthGraph/facebook.php?a=b
Page Tab / Page Tab URL: http://blog.yoz.sk/examples/FacebookOAuthGraph/facebook.html?
Canvas type:             iframe
Developer Mode:          Off
App Type:                Native/Desktop
Sandbox Mode:            Disabled
Remove Deprecated APIs:  Enabled
signed_request for Canvas: Enabled
Timezone-less events:    Enabled
Encrypted Access Token:  Enabled
...other Migrations:     Disabled

Based on facebook access token, it should be valid approximately for 24 hours. Notice the bold part, works as expiration time (unix time format). Use FacebookOAuthGraph.tokenToExpiration() to parse Date:

access_token=268718683475%7C2.w3fjqz80Xi1CdBXt7Ygh6A__.86400.1273158000-1215645368%7CDGv2l2HtTymd6cM6Fy_8k6P_8CQ.

Important update: May 19, 2010: Application is working again. Due to massive support in bug tracker (thanks all for your votes), facebook devs changed secured crossdomain.xml, so it allows unsecured requests. changeStatus() method added into example and some minor changes in FacebookOAuthGraph class (please update).

Here is what happend and why this app was not working for a while:

May 11, 2010: facebook changed rules, so requests on unsecured graph service (via http://graph.facebook.com…) were limited to just those without access_token parameter. Requets to secured service (https://graph.facebook.com) resulted in security violation due to missing secure=”false” parameter in crossdomain.xml
May 12, 2010: bug submitted
May 12, 2010 – May 14, 2010: massive bug voting
May 14, 2010: Bug confirmed by facebook dev team
May 19, 2010: Bug fixed, crossdomain file changed

I am glad that facebook devs listens and care.

FAQ

Is there a .fla version available?

Yes, there is a simple working Flash CS4 archive available for download (.fla + all sources). The demo connects the facebook application and once connected, it uploads generated picture into photo album.

How can I use this class in my iframe canvas page?

Please read article Authorizing Iframe Facebook Applications For Graph API

How can I make this class do more advanced things and what are the best practices?

Please read article Extending FacebookOAuthGraph Class, where all the most comon extendings are described.

When I connect with this app in one browser (firefox), and I run another browser (chrome) I get automatically connected. Why?

Your authorization token is stored in SharedObject, that is OS-user persistent (eg. windows user). No matter what browser you run, all of those reads data from one SharedObject. If you need cookie or session persistent authorization, please extend my class and override methods that use SharedObject.

How to add request parameters into my call?

Pass URLVariables object as a second parameter to call() method:

// eg. in order to make this call "me/picture?type=large", do the following:
var data:URLVariables = new URLVariables();
data.type = "large"
call("me/picture", data);

Why I can not access me/photos?

Facebook has changed rules again. You also need “user_photo_video_tags” permission within your app. I have already added it into my app, so please remove your browser cache, refresh and click connect button again (even if you are connected already). Now it should work.

How to upload photo with graph api?

This is a piece of working code from Sean, thnx Sean:

// MultipartURLLoader by Eugene Zatepyakin can be found here: http://bit.ly/9wx4q7
public function uploadImageCall(path:String, ba:ByteArray, message:String, token:String=null):MultipartURLLoader
{
    var mpLoader:MultipartURLLoader = new MultipartURLLoader();
    mpLoader.addVariable("message", message);
    mpLoader.addFile(ba, "image.jpg", "image");
    loaderAddListeners(mpLoader.loader);
    mpLoader.load(apiSecuredPath + "/me/photos?access_token="+ token);
    return mpLoader;
}

Can I make fql calls with this class?

However graph api does not implement fql calls, you can make fql calls using this class. The resulted data are not JSON but XML:

var data:URLVariables = new URLVariables();
data.query = "SELECT uid, name FROM user WHERE uid = XXX"; // insert your uid
var loader:URLLoader = facebook.call("method/fql.query", data,
    URLRequestMethod.POST, null, "https://api.facebook.com");
loader.addEventListener(FacebookOAuthGraphEvent.DATA, fqlComplete);

private function fqlComplete(event:FacebookOAuthGraphEvent):void{
        var xml:XML = new XML(event.rawData);

For fqlComplete method, please read Parsing FQL result article.

Can I post feeds with attachments?

Graph API has not documented attachment functionality for feeds, anyway, you can publish streams with attachments with this class as simple as:

var media:Object = {};
media.type = "flash";
media.swfsrc = "http://zombo.com/inrozxa.swf";
media.imgsrc = "http://blog.yoz.sk/wp-content/uploads/3d-150x150.jpg";
media.width = "80";
media.height = "80";
media.expanded_width = "120";
media.expanded_height = "120";

var attachment:Object = {};
attachment.name = "test name";
attachment.href = "http://blog.yoz.sk"
attachment.description = "test description";
attachment.caption = "test caption";
attachment.media = [media];

var data:URLVariables = new URLVariables();
data.message = "test message";
data.attachment = JSON.encode(attachment);

facebook.call("method/stream.publish", data, URLRequestMethod.POST, null, "https://api.facebook.com");

How can I develop my app locally when callback only works on the domain?

While callback is not able to push access_token into your app on runtime, I just copy access_token value into my code and publish again:

if(!parameters.session)
parameters.session = JSON.encode({
    access_token:String("123864964303507%7C2._pSS7WlemeGB9M0RV8Vnuw__.3600.1276246800-1215645368%7C-kYjWPx4MR6DXc5Clcnv5kXX3t4.")
        .replace(/\%7C/g, "|")
});
facebook.autoConnect(parameters);

Hi Is there a way to implement a “i Like” button with your class?

Sorry, you can not use graph API to like stuff, there is no method for that. Even by testing like request:

href: http://www.facebook.com/pages/***
node_type: page
edge_type: like
page_id: 12345
action_text
now_connected: true
nctr[_mod]: connect
post_form_id: 123ABF***********
fb_dtsg: TAfAJ
post_form_id_source: AsyncRequest

… post_form_id is some static required parameter that you can not guess.

This example app works with Internet Explorer, but my one results in Error #2032

~~Please complie your app to Flash Player 10 (or later). It should fix this issue. Credits goes to Garcimore , thnx~~. The issue has been identified as header Content-Type: application/json, that is returned from facebook. Suggested workaround (by facebook dev team) is to use POST variables with your requests, however it is reported as not working solution.

I can not make it run in my Mac-Safari sonfiguration

It seems there is a bug in Safari on Mac that does not let you open popup via ExternalInterface. You should use navigateToURL() in that case. Credits goes to Beans, thank you. More instructions here.

var js:String = "return window.navigator.userAgent.indexOf('Safari') > -1);"
if(ExternalInterface.call("function(){" + js + "}")){
   // safari specific code

Facebook now with OAuth and Open Graph (update)

Jozef Chúťka — Thu, 22 Apr 2010 09:11:20 +0000

Few days before while I was working on TwitterLogger Class for ActionScript 3 I discovered OAuth – an open protocol to allow secure API authorization . While reading all the stuff about OAuth and PHP SDKs, I noticed one statement somewhere (can’t find it nowhere) that Facebook was in fact using OAuth for its Facebook Connect tool but some derived version. This has now changed! Facebook is standardizing communication and authorization by introducing Open Graph and OAtuh 2.0.

F8 is a Facebook conference to bring together the developers and entrepreneurs who are building the social Web by moving fast, taking risks, and hacking traditional systems. In April 21, 2010, in F8 conference a few interesting things have been mentioned about the new Facebook API. Facebook CEO Mark Zuckerberg announced that the Facebook Connect brand would be eliminated as part of the launch of Open Graph.

Update (May 5, 2010): I have created Facebook Graph API & OAuth 2.0 & Flash – FacebookOAuthGraph ActionScript 3 class to use with OAuth 2.0 and Graph

Open Graph

The Open Graph API will allow any page on the Web to have all the features of a Facebook Page – users will be able to become a Fan of the page, it will show up on that user’s profile and in search results, and that page will be able to publish stories to the stream of its fans. (Facebook Roadmap Open Graph API)

Open Graph protocol also introduces tags, that allows you to specify structured information about your web page when used with like button etc.

Here are some url examples of Graph API usage:

http://graph.facebook.com/[USERID]          - user’s graph for your app
http://graph.facebook.com/[USERID]/friends  - access to user’s friends
http://graph.facebook.com/[USERID]/likes    - access user’s likes

By default these requests return JSON objects, but I guess there is a parameter to be passed to get xml instead (my guess).

Cool thing about this is there is a benevolent crossdomain file on http://graph.facebook.com/crossdomain.xml:

Some of those returns “OAuthAccessTokenException” thats where new OAuth comes in scene.

OAuth 2.0

Second thing noticed was that the company is standardizing the authorization via the OAuth 2.0 standard. The important thing here is, OAuth is already available for all existing Facebook APIs, and there are multiple methods to get authenticated with OAuth in Facebook. Check out the PHP example code example code for authentication on GitHub. Difference to previous connect is that sessions may last longer than 24 hours.

Lets hope there will be new version of Facebook ActionScript API released soon enough with all these new features…

Where to go from here:

Inviting Friends into Facebook Application (update)

Jozef Chúťka — Tue, 09 Mar 2010 11:51:26 +0000

Those are hard times. Facebook discontinued support for Notifications.send method March 1, 2010. Calling this method returns error code 3 (Unknown method). Instead, developers are directed to use other communication channels. From those some are not yet even a part of facebook-actionscript-api yet (dashboard) other not published from facebook (invites) and those that may work via api are experimental and may change any day (activities).

Excluding streams as communication channel, the only usable way, these days, to acquire some new facebook application users is using (part of FBML). When your application is IFrame, you may find interesting that you are able to use FBML within your HTML files. In order to make this happen, you have to use (renders the FBML on a Facebook server inside an iframe). Now, lets see how to open request form in your Facebook Iframe application:

First thing you need is Cross Domain Communication Channel file . It is simple static file, you should name it xd_receiver.htm




    Cross-Domain Receiver Page

now your application index.html file with request form:

Place both files in the same folder (or specify xd_receiver.htm path correctly in FB.Facebook.init() function). Now make sure you setup your application correctly:

Canvas Callback URL: http://facebook.yoz.sk/Test/
Connect URL: http://facebook.yoz.sk/Test/
Base Domain: yoz.sk
Canvas URL: http://apps.facebook.com/facebookyoztest/
FBML/iframe: iframe
Application Type: Website

Now request form should be generated when you visit canvas url.

Important:

Your application must be iframe type
URLs used in this article are not to be used in your apps
This article was written and is valid on March 9, 2010

Using Invitations in light popup (iframe)

If you need to show invitation module over your application, you can use this procedure. If you plan to open iframe over flash app make sure your flash is in wmode transparent or opaque so iframe can overlay it… index.html

...

...

invite.html

invite_callback.html

Continue reading:

Parsing FQL result

Jozef Chúťka — Mon, 25 Jan 2010 11:43:00 +0000

Facebook Query Language, or FQL, allows you to use a SQL-style interface to more easily query the same Facebook social data that you can access through other Facebook API methods (assuming your application has access!). Data returned for Facebook ActionScript Api are XML. You can access data via E4X after setting correct namespace. As for now (January 25, 2010), Facebook result defines xmlns=”http://api.facebook.com/1.0/” , but it may change in future, so lets make it dynamic…

Use e.g. extended FacebookLogger and add these lines

public function fql(query:String):void
{
	var call:FacebookCall = facebook.post(new FqlQuery(query));
	call.addEventListener(FacebookEvent.COMPLETE, fqlCallComplete);
}

private function fqlComplete(event:FacebookEvent):void
{
	var data:FacebookData = FacebookData(event.data);
	var xml:XML = XML(data.rawResult);
	var ns:Namespace = xml.namespace();
	default xml namespace = ns;

	var result:Array = [];
	for each(var user:XML in xml.user)
		result.push({uid:user.uid.toString(), name:user.name.toString()});

	default xml namespace = new Namespace("");
	dispatchEvent(new ResultEvent(ResultEvent.RESULT, false, true, result));
}

Notice xml.namespace() line. This method returns Namespace object used in main node (“http://api.facebook.com/1.0/”), so we can define it as default xml namespace. If you do not set empty default namespace after you finish parsing this XML, it may throw some errors later in parsing another XMLs.

this is our fql query:

FB.fql("SELECT uid, name FROM user WHERE uid = XXX")

and data.rawResult contains following XML object



  
    12345678
    Some John Smith
  
  
    12345679
    Another John Smith
  ...

Notice xmlns attribute in main node.

Elegant Facebook Login For Desktop Application

Jozef Chúťka — Fri, 22 Jan 2010 11:24:29 +0000

Default facebook login page is usualy opened in new browser window or popup window, so user lose focus from your page. This application opens facebook login page within your flash application, so user will not lose your page. In fact little iframe trick is used.

This post connects my 3 previous posts: Flex IFrame – Web browser in flash, FacebookLogger and Facebook Extended Permissions With Authorization by Overriding Class in swc in order to create elegant solution for facebook connect with your desktop application (means outside facebook iframe or fbml). I recomend to read all previous mentioned posts before trying to run this app.

Final application (view source enabled)

FB class. Read more about FacebookLogger class here.

package
{
    import flash.net.URLRequest;
    import flash.net.URLVariables;

    import mx.core.Application;

    import sk.yoz.events.FacebookLoggerEvent;
    import sk.yoz.net.FacebookLogger;

    public class FB extends FacebookLogger
    {
        private static const SINGLETON_LOCK:Object = {};
        private static const _instence:FB = new FB(SINGLETON_LOCK);

        protected var API_KEY:String = "bc55511efba53af7a3529ea9e7d1989b";
        protected var APP_SECRET:String = "727616ab7a9acb969e7cec3c7de04d79";

        private var initCallback:Function;

        public function FB(lock:Object)
        {
            super();

            if(lock != SINGLETON_LOCK)
                throw new Error("Use FB.instance!");

            addEventListener(FacebookLoggerEvent.CONNECTED, loggerConnectedHandler)
        }

        public static function get instance():FB
        {
            return _instence;
        }

        public function init2(application:Application):void
        {
            if(public::connected)
                return;
            init(API_KEY, APP_SECRET, application.loaderInfo);
        }

        public function initWithCallback(application:Application, callback:Function):void
        {
            initCallback = callback;
            init2(application);
        }

        private function loggerConnectedHandler(event:FacebookLoggerEvent):void
        {
            if(initCallback != null)
                initCallback();
            initCallback = null;
            // now we are connected, your code may go here
        }

        public function openPopup(login_url:String, auth_token:String):void
        {
            var request:URLRequest = new URLRequest(login_url);
            var variables:URLVariables = new URLVariables();

            variables.req_perms = 'publish_stream';
            variables.api_key = facebook.api_key;
            variables.v = facebook.api_version;
            variables.auth_token = auth_token;
            variables.fbconnect = "true";
            variables.connect_display = "popup";

            request.data = variables;

            FacebookPopup.open(request);
        }
    }
}

DesktopSession class. Read more about Overriding Class in swc.

... some code ...

protected function onLogin(p_event:FacebookEvent):void {
	p_event.target.removeEventListener(FacebookEvent.COMPLETE, onLogin);

	if (p_event.success) {
		_auth_token = (p_event.data as StringResultData).value;

		FB.instance.openPopup(login_url, _auth_token);

		_waiting_for_login = true;
		dispatchEvent(new FacebookEvent(FacebookEvent.WAITING_FOR_LOGIN));
	} else {
		onConnectionError(p_event.error);
	}
}

... some code ...

FacebookPopup class. Read more about Flex IFrame.

Application (do not forget to add facebook flex .swc, version 3.4 used in example)

Application html template. More about flexiframe.js here.

... some code ...

... some code ...

Facebook Extended Permissions With Authorization by Overriding Class in swc

Jozef Chúťka — Thu, 21 Jan 2010 12:27:10 +0000

It may be not popular, but it is possible to substitute / override whole class from .swc file. Lets say you are using some public api, in our case Facebook actionscript api. I admire work of developer team, but I would like to have some things different. My facebook application requires publish_stream extended permission right after user login (authorize) my application. Even if official facebook api documentation says it is possible to ask for extended permission with login.php call (req_perms parameter), our facebook actionscript api does not offer setting this parameter.

After few moments of research it was clear that login.php call makes DesktopSession class, method onLogin()…

... some code ...

protected function onLogin(p_event:FacebookEvent):void {
	p_event.target.removeEventListener(FacebookEvent.COMPLETE, onLogin);

	if (p_event.success) {
		_auth_token = (p_event.data as StringResultData).value;

		//now that we have an auth_token we need the user to login with it
		var request:URLRequest = new URLRequest();
		var loginParams:String = '?';

		if (_offline_access) {
				loginParams += 'ext_perm=offline_access&';
		}

		request.url = login_url+loginParams+"api_key="+api_key+"&v="+api_version+"&auth_token="+_auth_token;

		navigateToURL(request, "_blank");

		_waiting_for_login = true;
		dispatchEvent(new FacebookEvent(FacebookEvent.WAITING_FOR_LOGIN));
	} else {
		onConnectionError(p_event.error);
	}
}

... some code ...

Now lets do the dirty work. If it were possible, I would extend DesktopSession class and override just onLogin function, but api creates and uses DesktopSession inside its whole logic, so there is no way to succeed. However, it is possible to override whole class. First, in your flex project (with facebook swc in library path), create directory structure com/facebook/session/ (the same as DesktopSession package defines), than copy DesktopSession.as file inside. Well, thats it … From now, when you publish your application, compilator uses your DesktopSession instead of the one in .swc.

To make the new class working for my needs, onLogin function needs to be changed into something like this:

... some code ...

protected function onLogin(p_event:FacebookEvent):void {
	p_event.target.removeEventListener(FacebookEvent.COMPLETE, onLogin);

	if (p_event.success) {
		_auth_token = (p_event.data as StringResultData).value;

		//now that we have an auth_token we need the user to login with it
		var request:URLRequest = new URLRequest(login_url);
		var variables:URLVariables = new URLVariables();

		variables.req_perms = 'publish_stream';
		variables.api_key = api_key;
		variables.v = api_version;
		variables.auth_token = _auth_token;
		variables.fbconnect = "true";
		variables.connect_display = "page";

		request.data = variables;
		navigateToURL(request, "_blank");

		_waiting_for_login = true;
		dispatchEvent(new FacebookEvent(FacebookEvent.WAITING_FOR_LOGIN));
	} else {
		onConnectionError(p_event.error);
	}
}

... some code ...

By asking extended permissions with login.php, facebook opens more step authorization dialog where each permissions is separated into own step and user can allow or dont allow each.

Important:

Even if you send req_perms=publish_stream with login.php, facebook only accepts it when your app is live (not from your desktop testing) … Functionality already bugged in facebook bugzilla
Even if it is possible to override class this way, consider using it. Next time there may be newer version of .swc with some changes in your overriden class!

FacebookLogger

Jozef Chúťka — Tue, 08 Dec 2009 15:22:34 +0000

In a last couple of weeks I have been working on a lot of facebook applications. It did not took long to realize that there is always the same logic behind logging/connecting to facebook. So I came to FacebookLogger abstraction class that handles these basic steps. It only contains login/connection logic, so its pretty much the core that is usable only after extending.

FacebookLogger class look like this:

package sk.yoz.net
{
    import com.facebook.Facebook;
    import com.facebook.events.FacebookEvent;
    import com.facebook.utils.FacebookSessionUtil;

    import flash.display.LoaderInfo;
    import flash.events.EventDispatcher;

    import sk.yoz.events.FacebookLoggerEvent;

    public class FacebookLogger extends EventDispatcher
    {
        protected var facebook:Facebook;
        protected var session:FacebookSessionUtil;

        private var _connected:Boolean = false;

        public function FacebookLogger()
        {
            super();
        }

        [Bindable(event="FacebookLoggerEventCONNECTED")]
        public function get connected():Boolean
        {
            return _connected;
        }

        protected function set connected(value:Boolean):void
        {
            _connected = value;
            var type:String = FacebookLoggerEvent.CONNECTED;
            dispatchEvent(new FacebookLoggerEvent(type));
        }

        public function init(apiKey:String, appSecret:String,
            loaderInfo:LoaderInfo):void
        {
            session = new FacebookSessionUtil(apiKey, appSecret, loaderInfo);
            session.addEventListener(FacebookEvent.CONNECT, connectHandler);
            facebook = session.facebook;

            if(loaderInfo.parameters.fb_sig_session_key)
                 session.verifySession();
            else
                login();
        }

        protected function login():void
        {
            session.login();
        }

        public function validate():void
        {
            session.validateLogin();
        }

        protected function connectHandler(event:FacebookEvent):void
        {
            if(!event.success)
                return login();

            protected::connected = true;
        }
    }
}

… and you also gonna require FacebookLoggerEvent class …

package sk.yoz.events
{
    import flash.events.Event;

    public class FacebookLoggerEvent extends Event
    {
        public static const CONNECTED:String = "FacebookLoggerEventCONNECTED";

        public function FacebookLoggerEvent(type:String, bubbles:Boolean=false, cancelable:Boolean=false)
        {
            super(type, bubbles, cancelable);
        }

    }
}

Now, lets extend the core class. This class should hold all the required logic and communication with facebook, its fine to make it singleton:

package
{
    import mx.controls.Alert;
    import mx.core.Application;
    import mx.events.CloseEvent;

    import sk.yoz.events.FacebookLoggerEvent;
    import sk.yoz.net.FacebookLogger;

    public class FB extends FacebookLogger
    {
        public static const NOT_LOGGED:String = "Seems like not logged, click when logged!";

        private static const SINGLETON_LOCK:Object = {};
        private static const _instence:FB = new FB(SINGLETON_LOCK);

        protected var API_KEY:String = "***";
        protected var APP_SECRET:String = "***";

		private var initCallback:Function;

        public function FB(lock:Object)
        {
            super();

            if(lock != SINGLETON_LOCK)
                throw new Error("Use FB.instance!");

            addEventListener(FacebookLoggerEvent.CONNECTED, loggerConnectedHandler)
        }

        public static function get instance():FB
        {
            return _instence;
        }

        public function init2(application:Application):void
        {
			if(public::connected)
                return;
            init(API_KEY, APP_SECRET, application.loaderInfo, application.parameters);
        }

        public function initWithCallback(application:Application, callback:Function):void
        {
            initCallback = callback;
            init2(application);
        }

        override protected function login():void
        {
            super.login();
            Alert.show(NOT_LOGGED, null, 4, null, loggedClose);
        }

        protected function loggedClose(event:CloseEvent):void
        {
            validate();
        }

        private function loggerConnectedHandler(event:FacebookLoggerEvent):void
        {
			if(initCallback != null)
                initCallback();
			initCallback = null;
            // now we are connected, your code may go here
        }
    }
}

Update (Jan 6, 2009): Suggested initWithCallback() function where you can define callback function that is called after successful connect.

… so we can use in application as simple as possible: