library/Garp/3rdParty/facebook/src/base_facebook.php
protected function getUserAccessToken() {
    // first, consider a signed request if it's supplied.
    // if there is a signed request, then it alone determines
    // the access token.
    $signed_request = $this->getSignedRequest();
    if ($signed_request) {
      // apps.facebook.com hands the access_token in the signed_request
      if (array_key_exists('oauth_token', $signed_request)) {
        $access_token = $signed_request['oauth_token'];
        $this->setPersistentData('access_token', $access_token);
        return $access_token;
      }

      // the JS SDK puts a code in with the redirect_uri of ''
      if (array_key_exists('code', $signed_request)) {
        $code = $signed_request['code'];
        if ($code && $code == $this->getPersistentData('code')) {
          // short-circuit if the code we have is the same as the one presented
          return $this->getPersistentData('access_token');
        }

        $access_token = $this->getAccessTokenFromCode($code, '');
        if ($access_token) {
          $this->setPersistentData('code', $code);
          $this->setPersistentData('access_token', $access_token);
          return $access_token;
        }
      }

      // signed request states there's no access token, so anything
      // stored should be cleared.
      $this->clearAllPersistentData();
      return false; // respect the signed request's data, even
                    // if there's an authorization code or something else
    }

    $code = $this->getCode();
    if ($code && $code != $this->getPersistentData('code')) {
      $access_token = $this->getAccessTokenFromCode($code);
      if ($access_token) {
        $this->setPersistentData('code', $code);
        $this->setPersistentData('access_token', $access_token);
        return $access_token;
      }

      // code was bogus, so everything based on it should be invalidated.
      $this->clearAllPersistentData();
      return false;
    }

    // as a fallback, just return whatever is in the persistent
    // store, knowing nothing explicit (signed request, authorization
    // code, etc.) was present to shadow it (or we saw a code in $_REQUEST,
    // but it's the same as what's in the persistent store)
    return $this->getPersistentData('access_token');
  }
protected function getUserAccessToken() {
    // first, consider a signed request if it's supplied.
    // if there is a signed request, then it alone determines
    // the access token.
    $signed_request = $this->getSignedRequest();
    if ($signed_request) {
      // apps.facebook.com hands the access_token in the signed_request
      if (array_key_exists('oauth_token', $signed_request)) {
        $access_token = $signed_request['oauth_token'];
        $this->setPersistentData('access_token', $access_token);
        return $access_token;
      }

      // the JS SDK puts a code in with the redirect_uri of ''
      if (array_key_exists('code', $signed_request)) {
        $code = $signed_request['code'];
        if ($code && $code == $this->getPersistentData('code')) {
          // short-circuit if the code we have is the same as the one presented
          return $this->getPersistentData('access_token');
        }

        $access_token = $this->getAccessTokenFromCode($code, '');
        if ($access_token) {
          $this->setPersistentData('code', $code);
          $this->setPersistentData('access_token', $access_token);
          return $access_token;
        }
      }

      // signed request states there's no access token, so anything
      // stored should be cleared.
      $this->clearAllPersistentData();
      return false; // respect the signed request's data, even
                    // if there's an authorization code or something else
    }

    $code = $this->getCode();
    if ($code && $code != $this->getPersistentData('code')) {
      $access_token = $this->getAccessTokenFromCode($code);
      if ($access_token) {
        $this->setPersistentData('code', $code);
        $this->setPersistentData('access_token', $access_token);
        return $access_token;
      }

      // code was bogus, so everything based on it should be invalidated.
      $this->clearAllPersistentData();
      return false;
    }

    // as a fallback, just return whatever is in the persistent
    // store, knowing nothing explicit (signed request, authorization
    // code, etc.) was present to shadow it (or we saw a code in $_REQUEST,
    // but it's the same as what's in the persistent store)
    return $this->getPersistentData('access_token');
  }
protected function getUserAccessToken ( ) { // first, consider a signed request if it's supplied. // if there is a signed request, then it alone determines // the access token. $ signed_request = $ this -> getSignedRequest ( ) ; if ( $ signed_request ) { // apps.facebook.com hands the access_token in the signed_request if ( array_key_exists ( 'oauth_token' , $ signed_request ) ) { $ access_token = $ signed_request [ 'oauth_token' ] ; $ this -> setPersistentData ( 'access_token' , $ access_token ) ; return $ access_token ; } // the JS SDK puts a code in with the redirect_uri of '' if ( array_key_exists ( 'code' , $ signed_request ) ) { $ code = $ signed_request [ 'code' ] ; if ( $ code && $ code == $ this -> getPersistentData ( 'code' ) ) { // short-circuit if the code we have is the same as the one presented return $ this -> getPersistentData ( 'access_token' ) ; } $ access_token = $ this -> getAccessTokenFromCode ( $ code , '' ) ; if ( $ access_token ) { $ this -> setPersistentData ( 'code' , $ code ) ; $ this -> setPersistentData ( 'access_token' , $ access_token ) ; return $ access_token ; } } // signed request states there's no access token, so anything // stored should be cleared. $ this -> clearAllPersistentData ( ) ; return false ; // respect the signed request's data, even // if there's an authorization code or something else } $ code = $ this -> getCode ( ) ; if ( $ code && $ code != $ this -> getPersistentData ( 'code' ) ) { $ access_token = $ this -> getAccessTokenFromCode ( $ code ) ; if ( $ access_token ) { $ this -> setPersistentData ( 'code' , $ code ) ; $ this -> setPersistentData ( 'access_token' , $ access_token ) ; return $ access_token ; } // code was bogus, so everything based on it should be invalidated. $ this -> clearAllPersistentData ( ) ; return false ; } // as a fallback, just return whatever is in the persistent // store, knowing nothing explicit (signed request, authorization // code, etc.) was present to shadow it (or we saw a code in $_REQUEST, // but it's the same as what's in the persistent store) return $ this -> getPersistentData ( 'access_token' ) ; }
Determines and returns the user access token, first using
the signed request if present, and then falling back on
the authorization code if present.  The intent is to
return a valid user access token, or false if one is determined
to not be available.

@return string A valid user access token, or false if one
could not be determined.
Determines and returns the user access token first using the signed request if present and then falling back on the authorization code if present . The intent is to return a valid user access token or false if one is determined to not be available .