Automatic renew facebook token

.github/workflows/renew.yml

@@ -0,0 +1,25 @@
+name: Renew facebook token
+
+on:
+  schedule:
+    - cron: "0 0 1 * *"
+
+permissions:
+  actions: read
+
+jobs:
+  renew:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - uses: ruby/[email protected]
+        with:
+          ruby-version: '2.7'
+          bundler-cache: true
+      - name: Update the facebook token
+        env:
+          FACEBOOK_APP_ID: ${{ secrets.FACEBOOK_APP_ID }}
+          FACEBOOK_CLIENT_SECRET: ${{ secrets.FACEBOOK_CLIENT_SECRET }}
+          FACEBOOK_TOKEN: ${{ secrets.FACEBOOK_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.REPO_ACCESS_TOKEN }}
+        run: bundle exec ruby renew.rb

Gemfile

@@ -5,7 +5,7 @@ source 'https://rubygems.org'
 gem 'jekyll', '~> 4.2'
 gem 'koala', '~> 3.1.0'
 gem 'mini_magick', '~> 4.11'
-gem 'octokit', '~> 4.0'
+gem 'octokit', '~> 5.0'
 gem 'rake', '~> 13.0.1'
 gem 'rbnacl', '~> 7.1.1'
 gem 'rubocop', '~> 1.22.3'

Gemfile.lock

@@ -105,9 +105,9 @@ GEM
       racc (~> 1.4)
     nokogumbo (2.0.5)
       nokogiri (~> 1.8, >= 1.8.4)
-    octokit (4.22.0)
-      faraday (>= 0.9)
-      sawyer (~> 0.8.0, >= 0.5.3)
+    octokit (5.6.1)
+      faraday (>= 1, < 3)
+      sawyer (~> 0.9)
     parallel (1.21.0)
     parser (3.0.2.0)
       ast (~> 2.4.1)
@@ -141,9 +141,9 @@ GEM
     safe_yaml (1.0.5)
     sassc (2.4.0)
       ffi (~> 1.9)
-    sawyer (0.8.2)
+    sawyer (0.9.2)
       addressable (>= 2.3.5)
-      faraday (> 0.8, < 2.0)
+      faraday (>= 0.17.3, < 3)
     stringex (2.8.5)
     terminal-table (2.0.0)
       unicode-display_width (~> 1.1, >= 1.1.1)
@@ -166,7 +166,7 @@ DEPENDENCIES
   jekyll-tidy (~> 0.2.2)
   koala (~> 3.1.0)
   mini_magick (~> 4.11)
-  octokit (~> 4.0)
+  octokit (~> 5.0)
   rake (~> 13.0.1)
   rbnacl (~> 7.1.1)
   rubocop (~> 1.22.3)

README.md

@@ -20,6 +20,8 @@ bundle exec jekyll serve
 - Setup page id in `.github/workflows/deploy.yml`
 - Setup application: <https://stackoverflow.com/questions/17197970/facebook-permanent-page-access-token>
 
+The facebook token has to be refresh according to this link: <https://developers.facebook.com/docs/facebook-login/access-tokens/refreshing/>
+
 ## VSCode configuration
 
 These plugin will help writing CSS respecting the rules: <https://marketplace.visualstudio.com/items?itemName=stylelint.vscode-stylelint>

renew.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'octokit'
+require 'rbnacl'
+require 'base64'
+
+require './env_utils'
+
+access_token = get_env_or_exit('FACEBOOK_TOKEN')
+app_id = get_env_or_exit('FACEBOOK_APP_ID')
+app_secret = get_env_or_exit('FACEBOOK_CLIENT_SECRET')
+
+uri = URI('https://graph.facebook.com/oauth/access_token')
+uri.query = URI.encode_www_form({
+                                  grant_type: 'fb_exchange_token',
+                                  client_id: app_id,
+                                  client_secret: app_secret,
+                                  fb_exchange_token: access_token
+                                })
+
+res = Net::HTTP.get_response(uri)
+if res.is_a?(Net::HTTPSuccess)
+  new_token = JSON.parse(res.body)['access_token']
+else
+  puts "Bad response: #{res}"
+  exit(-1)
+end
+
+github_token = get_env_or_exit('GITHUB_TOKEN')
+
+# Provide authentication credentials
+client = Octokit::Client.new(access_token: github_token)
+
+def create_box(public_key)
+  b64_key = RbNaCl::PublicKey.new(Base64.decode64(public_key[:key]))
+  {
+    key_id: public_key[:key_id],
+    box: RbNaCl::Boxes::Sealed.from_public_key(b64_key)
+  }
+end
+
+repo = client.repo 'atelierdesmedias/atelierdesmedias.github.io'
+
+secret = { name: 'FACEBOOK_TOKEN', value: new_token }
+public_key = client.get_public_key(repo.id)
+puts 'public key:', public_key, public_key[:key], public_key[:key_id]
+box = create_box(public_key)
+puts 'box:', box[:key_id], box[:box]
+puts 'after'
+encrypted = box[:box].encrypt(secret[:value])
+encrypted_value = Base64.strict_encode64(encrypted)
+puts 'encrypted_value:', encrypted_value
+puts client.create_or_update_secret(
+  repo.id, secret[:name],
+  key_id: box[:key_id], encrypted_value: encrypted_value
+)
+puts client.last_response.status