app/controllers/accounts/auth_deletions_controller.rb

   1 # frozen_string_literal: true
   2
   3 module Accounts
   4   class AuthDeletionsController < ApplicationController
   5     layout :site_layout
   6
   7     skip_before_action :verify_authenticity_token
   8
   9     before_action :set_locale
  10
  11     authorize_resource :class => :auth_deletion
  12
  13     def show
  14       @auth_provider = params.expect(:provider)
  15       @auth_uid, @time = Rails
  16                          .application
  17                          .message_verifier(:social_login_deletion)
  18                          .verify(params.expect(:confirmation_code))
  19     rescue ActiveSupport::MessageVerifier::InvalidSignature
  20       head :bad_request
  21     end
  22
  23     def create
  24       if params.expect(:provider) == "facebook"
  25         create_facebook
  26       else
  27         head :not_found
  28       end
  29     end
  30
  31     private
  32
  33     def create_facebook
  34       encoded_signature, payload = params.expect(:signed_request).split(".", 2)
  35       signature = Base64.urlsafe_decode64(encoded_signature)
  36
  37       raise ActionController::BadRequest unless signature == OpenSSL::HMAC.digest("SHA256", Settings.facebook_auth_secret, payload)
  38
  39       data = JSON.parse(Base64.urlsafe_decode64(payload))
  40       user = User.find_by!(:auth_provider => "facebook", :auth_uid => data["user_id"])
  41
  42       user.auth_provider = nil
  43       user.auth_uid = nil
  44       user.save!
  45
  46       @confirmation_code = Rails
  47                            .application
  48                            .message_verifier(:social_login_deletion)
  49                            .generate([data["user_id"], Time.now.to_i])
  50
  51       render :formats => [:json]
  52     end
  53   end
  54 end