{{ pp.publish_error }}
{% endif %} - {# Published, but its first comment never landed — amber, not red: - the post itself went out fine. #} + {% comment %} + Published, but its first comment never landed — amber, not red: + the post itself went out fine. + {% endcomment %} {% if pp.first_comment_status == "failed" %}First comment failed
{% endif %} diff --git a/templates/social_accounts/partials/_account_card.html b/templates/social_accounts/partials/_account_card.html index c1d15b1f..1bb9c166 100644 --- a/templates/social_accounts/partials/_account_card.html +++ b/templates/social_accounts/partials/_account_card.html @@ -54,7 +54,20 @@Disconnect {{ account.account_name|default:account.account_handle }}? Historical data will be preserved.
+Disconnect {{ account.account_name|default:account.account_handle }}? Historical data will be preserved.
+ {% comment %} + Disconnecting drops our copy of the credentials; it cannot + revoke the grant, because the only endpoint that would do so + revokes this app for the whole person and would sever their + other connected accounts. Say so rather than let "Disconnect" + imply a revocation it never performs. + {% endcomment %} + {% if account.keeps_platform_grant_on_disconnect %} ++ This removes the account from BrightBean only. To revoke our access entirely, + remove BrightBean in Facebook › Settings › Apps and Websites. +
+ {% endif %}+ Some features are unavailable. + This account was connected without {{ account.missing_scopes|join:", " }}. + Anything relying on them will fail until the permission is granted — reconnect to try again. +
+{{ account.last_error }}
diff --git a/tests/providers/test_facebook.py b/tests/providers/test_facebook.py index 57f2d088..9e6c7cdd 100644 --- a/tests/providers/test_facebook.py +++ b/tests/providers/test_facebook.py @@ -1,4 +1,4 @@ -from datetime import UTC, datetime +from datetime import UTC, datetime, timedelta from unittest.mock import MagicMock, call import httpx @@ -890,9 +890,13 @@ def test_fetch_post_comments_uses_field_expansion_and_does_not_pass_caller_since """`since` on /feed filters by POST time, so passing the caller's `since` would hide every new comment on an older post.""" provider = FacebookProvider({"client_id": "id", "client_secret": "secret", "page_id": "page-1"}) - provider._request = MagicMock(return_value=_feed_response([_comment()])) + # Both dates relative to now. Fixed ones silently invert this test once they + # drift past FACEBOOK_FEED_WINDOW_DAYS: the 30-day window floor then lands + # *after* the caller's `since`, and the comment falls outside the lookback. + recent = (datetime.now(UTC) - timedelta(days=1)).strftime("%Y-%m-%dT%H:%M:%S+0000") + provider._request = MagicMock(return_value=_feed_response([_comment(created=recent)])) - since = datetime(2026, 8, 7, 8, 0, tzinfo=UTC) + since = datetime.now(UTC) - timedelta(days=2) messages = provider._fetch_post_comments("page-token", since=since) assert [m.platform_message_id for m in messages] == ["comment-1"] diff --git a/tests/providers/test_meta_replies.py b/tests/providers/test_meta_replies.py index 1112bdc3..3f2c61ad 100644 --- a/tests/providers/test_meta_replies.py +++ b/tests/providers/test_meta_replies.py @@ -6,6 +6,7 @@ """ from unittest.mock import MagicMock +from urllib.parse import parse_qs, urlparse import pytest @@ -463,3 +464,87 @@ def test_instagram_login_without_its_own_id_keeps_every_message(): provider._fetch_media_comments = MagicMock(return_value=[]) assert len(provider.get_messages("token")) == 1 + + +# --------------------------------------------------- re-requesting permissions + + +def test_facebook_auth_url_rerequests_declined_permissions(): + """Without auth_type=rerequest Meta skips the dialog on a reconnect. + + A user who declined a scope could then never be asked again, and the + connection silently lacks the ability it advertises. + """ + provider = FacebookProvider(CREDS) + url = provider.get_auth_url("https://studio.example/cb", "state-1") + + assert parse_qs(urlparse(url).query)["auth_type"] == ["rerequest"] + + +def test_instagram_auth_url_rerequests_declined_permissions(): + provider = InstagramProvider(CREDS) + url = provider.get_auth_url("https://studio.example/cb", "state-1") + + assert parse_qs(urlparse(url).query)["auth_type"] == ["rerequest"] + + +def test_instagram_login_auth_url_carries_no_facebook_only_params(): + """auth_type belongs to the facebook.com dialog, not Instagram's own. + + Sending parameters the Instagram-hosted dialog does not document risks it + rejecting the request outright, so the shared helper must not reach here. + """ + provider = InstagramLoginProvider(CREDS) + query = parse_qs(urlparse(provider.get_auth_url("https://studio.example/cb", "state-1")).query) + + assert "auth_type" not in query + + +# ------------------------------------------------------ granted-scope readback + + +def test_granted_scopes_inspect_the_token_not_me_permissions(): + """These accounts hold a *Page* token, so /me resolves to the Page, which + has no permissions edge. debug_token reports any token's scopes.""" + provider = FacebookProvider(CREDS) + provider._request = MagicMock( + return_value=_resp({"data": {"is_valid": True, "scopes": ["pages_show_list", "pages_manage_posts"]}}) + ) + + assert provider.get_granted_scopes("page-token") == {"pages_show_list", "pages_manage_posts"} + provider._request.assert_called_once_with( + "GET", + "https://graph.facebook.com/v25.0/debug_token", + params={"input_token": "page-token", "access_token": "id|secret"}, + ) + + +def test_granted_scopes_need_app_credentials_to_ask(): + """debug_token requires an app token; without one the answer is unknown.""" + provider = FacebookProvider({"client_id": "id"}) + + assert provider.get_granted_scopes("token") is None + + +def test_a_token_meta_will_not_describe_is_unknown_not_unscoped(): + """An empty set would report every scope as missing and demand a reconnect.""" + provider = FacebookProvider(CREDS) + provider._request = MagicMock(return_value=_resp({"data": {"is_valid": False}})) + + assert provider.get_granted_scopes("token") is None + + +def test_a_failed_readback_is_unknown_not_empty(): + from providers.exceptions import RateLimitError + + provider = FacebookProvider(CREDS) + provider._request = MagicMock(side_effect=RateLimitError("slow down", platform="facebook")) + + assert provider.get_granted_scopes("token") is None + + +def test_providers_that_cannot_be_asked_report_unknown(): + from providers.bluesky import BlueskyProvider + + assert BlueskyProvider(CREDS).get_granted_scopes("token") is None + assert InstagramLoginProvider(CREDS).get_granted_scopes("token") is None