Allow passing access token to callback about assent

[danschultzer]

Yeah, that makes sense.

Currently Assent OAuth 2.0 strategy only supports authorization code grant flow. I'm not sure if this is implicit grant flow, but I'll dig into the facebook docs to see how I should deal with the callback phase.

[danschultzer]

So it looks like this would be specific to facebook instead of implicit grant flow:

https://github.com/simi/omniauth-facebook/blob/48cdde26c5fffab4fcc0f2a27e88601b245c0b9b/lib/omniauth/strategies/facebook.rb#L127-L151

https://github.com/facebookarchive/facebook-php-sdk/blob/8e7e7951e99d86b68ce1135537d559663d759af0/src/base_facebook.php#L477-L491

As I understand it, this decodes the short lived access token from a cookie using the client secret, and then uses it to generate a long lived access token. Not sure if necessary with Assent, but I guess it can't hurt.

Edit: Facebook also suggests using code grant flow https://developers.facebook.com/docs/facebook-login/security#codeflow. I'll have to test this manually to see how it all works.

Also, this lib is probably the best reference: https://github.com/facebook/php-graph-sdk/blob/6d1eb5a3861624cd0ff40c67e517de891d78134a/docs/reference/FacebookJavaScriptHelper.md

[danschultzer]

I've set up instructions for how to deal with Facebook JS SDK here: #44

[danschultzer]

I'll close this as I believe both #44 and changes in the OAuth 2.0 strategy has made it very easy to handle with already fetched access token in client.

To recap:

1. The Facebook strategy docs now highlights how to fetch the code client side to submit server side
2. The Assent OAuth 2.0 strategy now supports any grant type with Assent.Strategy.OAuth2.get_access_token/3 to fetch the access token. Callback still uses the authorization code flow.
3. Assent.Strategy.Facebook.get_user/2 could be used to fetch the user data with the access token.
4. Passing an access token straight to the backend is not recommended unless you reverify: https://developers.facebook.com/docs/facebook-login/web/accesstokens#confirm There might need to be a special method in the facebook strategy to handle this case, as I believe this is a facebook feature and not part of the oauth2 specs.