require 'facebook_signed_request.rb'

class FacebookCreditsController < ApplicationController

skip_before_filter :verify_authenticity_token
layout nil

  def index
    facebook_request = FacebookSignedRequest.new(request.params['signed_request'])
    data = { "content" => {} }
    # handle invalid request
    if !facebook_request.valid?
      return
    end

    signed_request = facebook_request.signed_request

    # handle invalid signed request
    if signed_request.nil?
      return
    end

    method = request.params['method']

    order_id = request.params['order_id']

    # second state response from facebook
    if method == 'payments_status_update'
      status = request.params['status']

      if status == 'placed'
        next_state = 'settled'
        data['content']['status'] = next_state
      elsif status == 'settled'
        redirect_to '/lots'
        return
      end

      # compose returning data array_change_key_case
      data['content']['order_id'] = order_id

    # first stage response from facebook
    elsif method == 'payments_get_items'

      order_info = request.params['order_info']

      item = JSON.parse(order_info)
      item['price'] = item['price'].to_i

      # for url fields,if not prefixed by http://,prefix them
      url_key = [ 'product_url','image_url' ]
      url_key.each do |key|
        if item[key][0..6] != 'http://'
          item[key] = "http://#{item[key]}"
        end
      end

      # if payload['test_mode']
      if request.params['test_mode']
        update_keys = ['title','description']
        update_keys.each do |key|
            item[key] = '[Test Mode] ' + item[key]
        end
      end

      data['content'] = [item]  
    end

    data['method'] = method

    render :json => data
  end

end

那么除此之外还有：

require 'base64'
require 'json'
require 'openssl'

class FacebookSignedRequest

  attr_reader :signed_request

  def initialize(signed_request)
    @signed_request = signed_request
  end

  def base64_url_decode str
    encoded_str = str.gsub('-','+').gsub('_','/')
    encoded_str += '=' while !(encoded_str.size % 4).zero?
    Base64.decode64(encoded_str)
  end

  def valid?
    # TODO: move it to some configuration
    secret = " << my secret is here >>"

    # decode data
    encoded_sig,payload = signed_request.split('.')
    sig = base64_url_decode(encoded_sig).unpack("H*")[0]
    data = JSON.parse base64_url_decode(payload)

    if data['algorithm'].to_s.upcase != 'HMAC-SHA256'
    # Rails.logger.error 'Unknown algorithm. Expected HMAC-SHA256'
      return false
    end

    #check sig
    expected_sig = OpenSSL::HMAC.hexdigest('sha256',secret,payload)
    if expected_sig != sig
    # Rails.logger.error 'Bad Signed JSON signature!'
      return false
    end

    data
  end

我不知道这是否有助于任何人,但它都适用于我.对不起,花了很长时间才记得回来并发布我的工作代码…

根据要求查看相关代码：

#view
<%= javascript_include_tag "premium_signup" %>
<script type="text/javascript">
    $(document).ready(function() {
        $('#premium_signup_button').click(function() {
            signupAsPremiumMember('Premium Membership','Create unlimited auctions with no extra charge at all for 1 year.',"1",'','');
        });
    });
</script>
...
<button id="premium_signup_button">Signup as a premium member</button>

#premium_signup.js
function signupAsPremiumMember(title,desc,price,imageURL,productURL) {
var order_info = {
    "title": title,"description": desc,"price": price,"image_url": imageURL,"product_url": productURL
};

var payload = {
    "method": 'pay',"order_info": order_info,"purchase_type": 'item'
};

console.log(FB.ui(payload,facebookPurchaseCompletionCallback));
}

function facebookPurchaseCompletionCallback(data) {
    if (data['order_id']) {
        console.log(data['order_id']);
    }
    else if (data['error_code']) {
        console.log(data['error_code']);
    }
    else {
        console.log("Failed");
    }
}

#in the layout
#in head
<script src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js"></script>
<script src="http://connect.facebook.net/en_US/all.js"></script>
<%= javascript_include_tag 'application' %>
#in body
  <div id="fb-root"></div>
    <script>
      FB.init({
        appId  : '############',status : true,// check login status
        cookie : true,// enable cookies to allow the server to access the session
        xfbml  : true  // parse XFBML
      });

现在所有这一切都来自一个坐下来学习如何在Ruby On Rails中编程的人,而在去年的大约12个星期里,Ruby On Rails几乎没有支持JavaScript知识,而且在今年的大约12个星期里,还有几个星期在这个时候被抛出了测量.我说,谨慎 – 我发布的代码可能是垃圾…但它的工作原理:-)

如果有人真的发现任何这个有用的一个投票在答案将不胜感激 – 只是sayin’:-)