Inconsistency in permissions

[Ricardo1980]

My app uses 2 permissions, public_profile and email.

I set up them using:

<string-array name="my_facebook_permissions" translatable="false">
        <item>public_profile</item>
        <item>email</item>
    </string-array>

and

<meta-data
                android:name="com.parse.ui.ParseLoginActivity.FACEBOOK_LOGIN_PERMISSIONS"
                android:resource="@array/my_facebook_permissions" />

I see the native and web dialog properly, asking the user these 2 permissions. I also see in the debugger that those 2 permissions are passed properly to facebook.

This is what I see in the debugger inside FacebookAuthentificationProvider, authenticateAsync, accessToken (it seems right, well, I see contact_email, but it doesn't matter)

But if I continue with the debugging... once in my app, after the login, in onActivityResult, if I call
AccessToken accessToken=AccessToken.getCurrentAccessToken();

I see that that access token doesn't have granted permissions or rejected permissions (they are empty), but if I use GraphRequest I can get the user email with String emailFromFacebook = object.optString("email"); without problems.

It doesn't make any sense that those permission variables have different values in those places.

BTW I'm using ParseUI and facebook sdk version 4.0.1

Apart from that, if I reject the email permission in the login dialog, I see inside FacebookAuthentificationProvider that has been rejected by the user:

However, in my app code, in onActivityResult, I see exactly the same than the other case... just nothing, no granted or declined permissions, so accessToken.getDeclinedPermissions().contains("email") is completely useless and when I try to get the user email like before, I receive null (probably because the app doesn't have permission).

I guess this behavior is not normal. BTW I'm supposing that accesstoken.permissions contains granted permissions and accesToken.declinedPermissions contains declined permissions, is that right?

Thanks in advance.

[lukas1994]

Hi @Ricardo1980,
Can you upload a small sample project that reproduces this behavior?

[mchun]

I am facing the same problem. Just using the latest ParseUI and Facebok android sdk 4.4.
The dialoge correctly shows that I am requesting email and public profile. But when getting the current AccessToken in ParseLoginFragment.java, there is no permission attached in the Token, and the newMeRequest returns only the facebook id and facebook name. :(
GraphRequest.newMeRequest(AccessToken.getCurrentAccessToken(), new GraphRequest.GraphJSONObjectCallback() {

[mchun]

It's strange that the token itself can be retreived, but the permissions with it are stripped off.

[grantland]

Parse only handles authentication, so we only persist authentication related metadata such as access token, user id, etc. and not any unnecessary data such as granted/rejected permissions.

However, clearing this this metadata unnecessarily is a valid bug and it will be fixed in the next Parse SDK release. The extra data on AccessToken will exist as long as they authenticated with FB, however, this information might be missing if they authenticate with another method such as email/password with a FB account linked. With this in mind, you should not expect these fields to exist under all conditions.

Closing this since it is a bug in ParseFacebookUtils, not ParseUI.

[mchun]

Thanks, Grantland.
But is that a facebook sdk bug?
I tried modifying the following code in AccessToken.java
this.permissions = Collections.unmodifiableSet(
permissions != null ? new HashSet(permissions) : new HashSet());
to
this.permissions = Collections.unmodifiableSet(new HashSet(permissions));
And now I can read the permissions by AccessToken.getCurrentAccessToken().getPermissions()
But the response of newMeRequest is still the same as above. I have no idea why.
I understand that I shouldn't expect the extra data to be available all the time, but I just want to read the user's email when using facebook login to create a new user.

[grantland]

It's a bug in ParseFacebookUtil and will be fixed in the next release. You'll need to account for AccessToken#getPermissions() being null anyway so I wouldn't rely on it always being set.

[Ricardo1980]

Hello @grantland. Is there source code for that or at least a task manager? This is the only thing I found:
parse-community/Parse-SDK-Android#1
Thanks in advance.

[grantland]

It's not currently open sourced, so the only task we have for it in internal right now.

[Ricardo1980]

Thanks a lot, then we will wait the new version.