Google.retrieveCredential should take a secret.

[tmeasday]

Google OAuth credentials are stored with a secret, yet https://github.com/meteor/meteor/blob/devel/packages/google/google_server.js#L81-L83 doesn't take a secret as an argument.

[estark37]

Thanks @tmeasday! Fixed in all the OAuth service provider packages.

[tmeasday]

No worries. PS, while we are on the subject, it'd be nice to be able to get the credential secrets (on the client) and the credential result (on the server) more than once.

Some use cases:

1. In DM [1] we want to check that the MD user exists before logging them in (try logging in here http://book.discovermeteor.com) -- right now we do that with a second method call that checks the DM account they are trying to use.
2. When a user signs up to DM, we already have a passwords account for them, and they click a link from Gumroad. We want to pop the oauth dialog, attach the MD user to the passwords account, then log them in as the user. Again, we do it with a second method call that inspects the credentials.

[1] We just launched with MD accounts btw :)

[jordangarside]

Do either of you, @estark37 or @tmeasday, know how I can get access to the credential secret on the server when I use requestCredential() on the client?
After this fix I need it for retrieveCredential. :p

For more detail I posted the question on stackoverflow http://stackoverflow.com/questions/24428130/how-can-i-get-the-credential-secret-in-meteor-when-i-do-facebook-requestcredent

[tmeasday]

@jordangarside I think what you want is OAuth._retrieveCredentialSecret(token); -- underscored so use at your own risk...

[jordangarside]

@tmeasday That'll do it, thanks so much!
Why use at your own risk though?
I'm just calling it on the client and immediately passing it to the server, are there any dangers in that?

[tmeasday]

Oh, I just meant that it's an _ underscore method so can change at any time in a future release without warning.

[jordangarside]

Ohh, for sure, thanks a ton!

[keslert]

@tmeasday This method no longer exists. What is the recommended way for retrieving the credential secret now?

[edit] Looks like it has to be called from the client.