[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_110":111,"_112":113},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","ziadamr","name","Facebook_mcb","path","lib/oauth.ts","project",{"_22":48,"_11":12,"_35":49,"_50":-5,"_51":44,"_52":53,"_54":53,"_55":56,"_57":-5,"_58":59,"_60":61,"_62":34,"_63":-5,"_64":-5,"_65":38,"_66":67,"_68":-5,"_69":-5,"_70":-5,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":44},"file",{"_22":23,"_11":24,"_25":26,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":44,"_45":-5,"_13":46},"permalink","https://www.val.town/x/ziadamr/Facebook_mcb/code/lib/oauth.ts","extension","id","9c36cf7f-f4fb-4cbc-b68c-e6fba518ee05","oauth.ts","fileId","d7e18706-aac0-11f1-8f30-1607ee4eb77e","parentId","01a07c13-0c2d-7032-880a-47221c586f28","branchId","5bf01db9-de60-4d39-a5fd-c18c8ddc5a30","branchVersion",2,"latest",true,"createdAt",["D",1788788065740],"version",0,"fileType","script","content","// Facebook OAuth login flow → long-lived user token → never-expiring page tokens\n// Implements the modern scopes the user requested:\n// pages_show_list, pages_manage_posts, pages_read_engagement\n// Flow: visit /connect → FB dialog grants scopes → /callback exchanges\n// code → short-lived token → 60-day user token → /me/accounts → page token\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\n\nconst GRAPH = \"https://graph.facebook.com/v21.0\";\nconst DIALOG = \"https://www.facebook.com/v21.0/dialog/oauth\";\nconst SCOPES = \"pages_show_list,pages_manage_posts,pages_read_engagement\";\n\nfunction appId(): string {\n const id = Deno.env.get(\"FB_APP_ID\");\n if (!id || id === \"your_app_id\") {\n throw new Error(\n \"FB_APP_ID is not set. Add it here: https://www.val.town/x/ziadamr/Facebook_mcb/environment-variables?key=FB_APP_ID\",\n );\n }\n return id;\n}\n\nfunction appSecret(): string {\n const s = Deno.env.get(\"FB_APP_SECRET\");\n if (!s || s === \"your_app_secret\") {\n throw new Error(\n \"FB_APP_SECRET is not set. Add it here: https://www.val.town/x/ziadamr/Facebook_mcb/environment-variables?key=FB_APP_SECRET\",\n );\n }\n return s;\n}\n\nfunction origin(req: Request): string {\n return new URL(req.url).origin;\n}\nfunction callbackUrl(req: Request): string {\n return `${origin(req)}/callback`;\n}\n\n// ── Token storage (project-scoped blobs) ──────────────────────────────\n\n/** The page token currently used by the MCP server for Graph calls. */\nexport async function getActivePageToken(): Promise {\n const a = await blob.getJSON(\"fb_active\");\n return a && a.token ? a.token : null;\n}\nasync function setActivePage(p: { id: string; name: string; access_token: string }) {\n await blob.setJSON(\"fb_active\", {\n pageId: p.id,\n pageName: p.name,\n token: p.access_token,\n savedAt: Date.now(),\n });\n}\n\n// ── Route handlers ────────────────────────────────────────────────────\n\n/** GET /connect → redirect user to Facebook's login dialog with the new scopes. */\nexport async function handleConnect(req: Request): Promise {\n try {\n appId();\n } catch (e) {\n return errPage((e as Error).message.replace(/\\. Add.*$/, \"\"));\n }\n const state = crypto.randomUUID();\n await blob.setJSON(\"fb_oauth_state\", state);\n\n const u = new URL(DIALOG);\n u.searchParams.set(\"client_id\", appId());\n u.searchParams.set(\"redirect_uri\", callbackUrl(req));\n u.searchParams.set(\"state\", state);\n u.searchParams.set(\"scope\", SCOPES);\n u.searchParams.set(\"response_type\", \"code\");\n u.searchParams.set(\"auth_type\", \"rerequest\");\n return Response.redirect(u.toString(), 302);\n}\n\n/** GET /callback → finish the flow and store a never-expiring page token. */\nexport async function handleCallback(req: Request): Promise {\n const url = new URL(req.url);\n const code = url.searchParams.get(\"code\");\n const fbErr = url.searchParams.get(\"error_description\") || url.searchParams.get(\"error\");\n\n if (fbErr) {\n return errPage(`Facebook returned an error: ${fbErr}`);\n }\n if (!code) {\n return errPage(\"No authorization code was returned by Facebook.\");\n }\n\n // CSRF check via state\n const state = url.searchParams.get(\"state\");\n const savedState = await blob.getJSON(\"fb_oauth_state\");\n if (!state || !savedState || state !== savedState) {\n return errPage(\"State mismatch — please restart from /connect.\");\n }\n\n try {\n // 1) code → short-lived user token\n const short = await exchangeCode(code, callbackUrl(req));\n // 2) short-lived → long-lived user token (60 days)\n const long = await exchangeLongLived(short.access_token);\n // 3) long-lived user token → list managed pages (tokens here are long-lived)\n const pages = await listPages(long.access_token);\n\n await blob.setJSON(\"fb_pages\", pages);\n\n if (!pages || pages.length === 0) {\n return htmlPage(\n \"Connect succeeded, but no Pages were found.\",\n \"Make sure your Facebook account is an admin of a Page, then try again. \" +\n \"If you were already an admin, re-run /connect and review the exact page permissions you grant.\",\n );\n }\n\n // If a preferred page is past as ?page_id, select it; else pick the first.\n const want = url.searchParams.get(\"page_id\");\n const chosen = pages.find((p: any) => String(p.id) === want) ?? pages[0];\n await setActivePage(chosen);\n\n return htmlPage(\n `✅ Connected as Page: ${chosen.name}`,\n `The never-expiring page token is now saved and the MCP server will use it for all Graph calls.` +\n (pages.length > 1\n ? \"

You manage multiple pages. Pick which one the bot should act as:\" +\n pages\n .map(\n (p: any) =>\n ` [${p.name}]`,\n )\n .join(\"\")\n : \"\"),\n );\n } catch (e) {\n return errPage(`Failed to complete OAuth: ${(e as Error).message}`);\n }\n}\n\n// ── Graph API helpers ─────────────────────────────────────────────────\n\nasync function exchangeCode(code: string, redirectUri: string): Promise {\n const u = new URL(`${GRAPH}/oauth/access_token`);\n u.searchParams.set(\"client_id\", appId());\n u.searchParams.set(\"client_secret\", appSecret());\n u.searchParams.set(\"redirect_uri\", redirectUri);\n u.searchParams.set(\"code\", code);\n const res = await fetch(u);\n const data = await res.json();\n if (data.error) throw new Error(data.error?.message || \"Graph API error\");\n return data;\n}\n\nasync function exchangeLongLived(shortToken: string): Promise {\n const u = new URL(`${GRAPH}/oauth/access_token`);\n u.searchParams.set(\"grant_type\", \"fb_exchange_token\");\n u.searchParams.set(\"client_id\", appId());\n u.searchParams.set(\"client_secret\", appSecret());\n u.searchParams.set(\"fb_exchange_token\", shortToken);\n const res = await fetch(u);\n const data = await res.json();\n if (data.error) throw new Error(data.error?.message || \"Graph API error\");\n return data;\n}\n\nasync function listPages(longToken: string): Promise {\n const u = new URL(`${GRAPH}/me/accounts`);\n u.searchParams.set(\"access_token\", longToken);\n u.searchParams.set(\"fields\", \"id,name,category,access_token,tasks\");\n const res = await fetch(u);\n const data = await res.json();\n if (data.error) throw new Error(data.error?.message || \"Graph API error\");\n return data?.data ?? [];\n}\n\n// ── Simple HTML responses ─────────────────────────────────────────────\n\nfunction htmlPage(title: string, body: string): Response {\n return new Response(\n `` +\n `` +\n `Facebook Connect` +\n `

${title}

${body}

` +\n `

⚠️ Reconnect with Facebook

` +\n ``,\n { status: 200, headers: { \"Content-Type\": \"text/html; charset=utf-8\" } },\n );\n}\n\nfunction errPage(message: string): Response {\n return new Response(\n `` +\n `` +\n `Connect Error` +\n `

❌ Connect Error

` +\n      `

${message}

` +\n `

↩️ Try again

` +\n ``,\n { status: 200, headers: { \"Content-Type\": \"text/html; charset=utf-8\" } },\n );\n}\n","deleted",false,"label",[47,24],"lib","b7a4258a-c711-453f-bddd-9f24b15c3666",["D",1788788018136],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Facebook MCP server + token generator","imageUrl","userId","4a74ac34-26a3-4a70-91d7-9a97b99edf45","pinnedFileId","01a07c13-0c2d-7032-880a-4cae429ebb16","pinPreview","pinMigrated","screenshotVersion","likeCount","orgId","01a002fd-7580-765a-a2e8-e8c5a04605ad","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_109":105},"org",{"_9":10,"_102":103,"_104":105,"_58":59,"_106":107,"_108":44},"branch",{"_37":88,"_11":89,"_22":30,"_90":48,"_91":92,"_93":94,"_95":53,"_96":97,"_98":99,"_100":12,"_101":10},"isOwned",10,"main","projectId","forkedBranchId","71340148-177c-489b-8704-736e86f6dccc","forkedBranchVersion",11,"forkedProjectPrivacy","forkedProjectId","6fe5efe8-a039-4cae-97fb-7b2fc1b18499","forkedProjectOrgId","019fc8f8-958b-72ef-ae4e-1fb26b6ba267","projectName","userHandle","displayName","Ziad Amr","avatar","https://lh3.googleusercontent.com/a/ACg8ocLaZuiaE_-6J7HRNnQ6ge4EpfmgIOvPpiFHdsd0bFaYuQu2Ac0=s96-c","tier","free","canRestrictVals","profileImageUrl","ctx",{"_81":-5,"_143":144,"_145":146,"_147":148,"_149":44,"_150":44,"_151":44,"_152":34,"_153":-5,"_154":-7,"_155":-7,"_156":38,"_157":44,"_158":44,"_159":-5,"_160":44,"_161":44,"_162":44,"_163":-5},"ENV",{"_114":115,"_116":117,"_118":89,"_119":120,"_121":122,"_123":124,"_125":126,"_127":128,"_129":130,"_131":132,"_133":134,"_135":136,"_137":138,"_139":140,"_141":142},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]