Devise + omniauth-facebook Add permissions

Question

we are letting the users sign up with minimum permissions like this:

Devise.setup do |config|
  config.omniauth :facebook, ENV['FACEBOOK_KEY'], ENV['FACEBOOK_SECRET'],
              :scope => 'email,offline_access,user_about_me'
end

We do this to increase signup rate (the less permissions you ask for the higher the conversion).

But later when for example the user wants to fb share something we need the publish_stream permission.

Does anyone know how to elevate the fb permissions? to for example: 'email,offline_access,user_about_me,publish_stream'

I'm aware that the user has to go through the oauth dialog again..but how to do this?

thanks

Answer 1

First you need to add setup: true to be able to upgrade the list of permissions of the service:

Devise.setup do |config|
  config.omniauth :facebook, ENV['FACEBOOK_KEY'], ENV['FACEBOOK_SECRET'],
                  :scope => 'email,offline_access,user_about_me',
                  :setup => true
end

Add two routes in routes.rb:

devise_scope :user do
  get '/users/auth/:provider/upgrade' => 'omniauth_callbacks#upgrade', as: :user_omniauth_upgrade
  get '/users/auth/:provider/setup', :to => 'omniauth_callbacks#setup'
end

The first route is where the user should be linked to by using user_omniauth_upgrade_path(:facebook). The second setup route is the callback which omniauth will call internally and we can use to change the scope parameter.

These go into omniauth_callbacks_controller.rb:

def upgrade
  scope = nil

  if params[:provider] == "facebook"
    scope = 'email,offline_access,user_about_me,publish_stream'
  end

  redirect_to user_omniauth_authorize_path(params[:provider]), flash: {scope: scope}
end

When you specify setup: true inside of the omniauth configuration setup_path is called by default. We will use this to change the scope from the default in the strategy. Add this to omniauth_callbacks_controller.rb:

def setup
  request.env['omniauth.strategy'].options['scope'] = flash[:scope] || request.env['omniauth.strategy'].options['scope']
  render :text => "Setup complete.", :status => 404
end

Finally, in your views you can add:

<%= link_to "Upgrade Access", user_omniauth_upgrade_path(:facebook) %>

Source: http://willschenk.com/setting-up-devise-with-twitter-and-facebook-and-other-omniauth-schemes-without-email-addresses/#passing-dynamic-scopes-to-omniauth