0

I'm using Laravel 5.4 and Socialite to allow the visitor of my site to log in.

Situation

I recently obtained the user_events permission cause I wanted to add some functionalities to my website.

Before this, some users got registered in my database along with their user token in the database. (token than includes the default permissions but not user_events)

I updated the SocialAuthController.php to reflect the new permission on the new created user and this is working great

return Socialite::driver('facebook') ->scopes(['public_profile', 'user_events']) ->redirect();

Problem

If a user is already registered in the database with his token, it is impossible to run this command $fb->get('me/events') since the token does not include the user_events permissions.

Questions

Is there a way to force a user to grab a new token with a new permission without having to remove him from the database ? ( I have data associated with users) ?

SocialAuthController

public function handleProviderCallback(SocialAccountService $service)
{
   $user = $service->createOrGetUser(Socialite::driver('facebook')->user());
}

SocialeAccountService

public function createOrGetUser(ProviderUser $providerUser)
{
        $account = SocialAccount::whereProvider('facebook')
            ->whereProviderUserId($providerUser->getId())
            ->first();

        if ($account) {
            return $account->user;
        } else {

            $account = new SocialAccount([
                'provider_user_id' => $providerUser->getId(),
                'provider' => 'facebook',
                'nickname' => $providerUser->getNickname(),
                'avatar' => $providerUser->avatar_original,
                'token' => $providerUser->token,
            ]);

            $user = User::whereEmail($providerUser->getEmail())->first();

            if (!$user) {

                $user = User::create([
                    'email' => $providerUser->getEmail(),
                    'name' => $providerUser->getName(),

                ]);
              }
          $account->user()->associate($user);
          $account->save();

          return $user;
}
Léo Coco
  • 4,022
  • 11
  • 52
  • 97
  • All you need to do is send them through the login flow again, that will ask for all permissions that have not been asked for previously. (Whether you need to do some additional stuff in socialite to get it to store this new token, I don’t know. But I guess it should, because tokens expire, so it would need a mechanism to overwrite an old one with a fresh one anyway.) – CBroe Jul 26 '17 at 07:49
  • I'm not sure if it is because I'm in test, or because it is me the owner of the app, but my token does not expires. – Léo Coco Jul 26 '17 at 13:13

0 Answers0