facebook_controller.rb

class FacebookController < ApplicationController
  def login
    # send the user to the FB page for this application, redirect to do_login
    # client ID is the FB app id
    # scope=publish_stream lets us make feed posts
    redirect_to %{https://graph.facebook.com/oauth/authorize?client_id=115446458515992&redirect_uri=#{do_login_facebook_index_url.to_param}&scope=publish_stream}
  end

  def do_login
    # Get the cookie code passed in
    session[:code] = params[:code]

    # Server does a curl request to FB to exchange the code for an access token
    opts = [
      %{redirect_uri=#{do_login_facebook_index_url.to_param}},
      'client_id=115446458515992',
      'client_secret=6ef6a6dd301cfb52d90c123bbf46a122',
      %{code=#{params[:code]}}
    ].collect{|o| %{-F '#{o}'}}.join(' ')
    response = `curl https://graph.facebook.com/oauth/access_token #{opts}`
    session[:access_token] = response.split('&')[0].split('=')[1]

    # This curl command posts to John's feed, even though the access token is for
    # Nick. This is possible because John has allowed posting by friends
    `curl -F 'access_token=115446458515992|2.gI9U08g4Gg49jPVwdBzMsw__.3600.1286827200PyM51mg' -F 'message=You just got facepunched' https://graph.facebook.com/jtrupiano/feed`

    # Send them back to the index, just for this app's sake.
    redirect_to facebook_index_path
  end
end