social: add validated meta-go-live.sh (Graph-verify token → deploy to Kamatera → confirm backend:meta); gitignore meta-creds.env

c6baf4f4040d7ce719456c962d17e52c4518e7cf · 2026-06-12 10:48:36 -0700 · SteveStudio2
Files touched

M .gitignore
A scripts/meta-go-live.sh
Diff

commit c6baf4f4040d7ce719456c962d17e52c4518e7cf
Author: SteveStudio2 <stevestudio2@SteveStacStudio.lan>
Date:   Fri Jun 12 10:48:36 2026 -0700

    social: add validated meta-go-live.sh (Graph-verify token → deploy to Kamatera → confirm backend:meta); gitignore meta-creds.env
---
 .gitignore              |  3 ++
 scripts/meta-go-live.sh | 75 +++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 78 insertions(+)

diff --git a/.gitignore b/.gitignore
index adff6dc..fe01fdf 100644
--- a/.gitignore
+++ b/.gitignore
@@ -13,3 +13,6 @@ data/assets.json
 data/assets/
 data/channels-tokens.json
 data/social-publish-log.json
+
+# Meta go-live creds — real Page token, never commit
+scripts/meta-creds.env
diff --git a/scripts/meta-go-live.sh b/scripts/meta-go-live.sh
new file mode 100755
index 0000000..730b729
--- /dev/null
+++ b/scripts/meta-go-live.sh
@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+# meta-go-live.sh — flip the Social module's live backend to the FREE Meta Graph
+# API (Instagram + Facebook). Validates the token against Graph BEFORE writing
+# anything, then deploys the creds to the Kamatera live env and confirms the
+# /connection endpoint reports backend:meta.
+#
+# Usage:
+#   1) Create a creds file (gitignored): scripts/meta-creds.env  with:
+#        META_ACCESS_TOKEN=EAA...
+#        META_IG_USER_ID=17841400000000000
+#        META_FB_PAGE_ID=999999999
+#        # optional: META_GRAPH_VERSION=v21.0
+#   2) bash scripts/meta-go-live.sh scripts/meta-creds.env
+#
+# It NEVER prints the token. It does NOT auto-enable the scheduler — posting
+# still requires confirm:true + an approved post. Run with SCHEDULER_LIVE=1 to
+# also set SOCIAL_SCHEDULER_LIVE=true on the live box.
+set -euo pipefail
+
+CREDS="${1:-scripts/meta-creds.env}"
+REMOTE_HOST="my-server"
+REMOTE_DIR="/root/DW-Agents/marketing-command-center"
+PM2_NAME="marketing-command-center"
+LIVE_URL="https://marketing.agentabrams.com"
+AUTH='admin:DWMarketing2026!'
+GVER_DEFAULT="v21.0"
+
+[ -f "$CREDS" ] || { echo "✗ creds file not found: $CREDS"; exit 1; }
+# shellcheck disable=SC1090
+set -a; . "$CREDS"; set +a
+: "${META_ACCESS_TOKEN:?META_ACCESS_TOKEN missing in $CREDS}"
+GVER="${META_GRAPH_VERSION:-$GVER_DEFAULT}"
+last4() { printf '…%s' "${1: -4}"; }
+
+echo "── 1. validate token against Graph API (no write yet) ──"
+if [ -n "${META_IG_USER_ID:-}" ]; then
+  R=$(curl -s "https://graph.facebook.com/${GVER}/${META_IG_USER_ID}?fields=username&access_token=${META_ACCESS_TOKEN}")
+  echo "$R" | grep -q '"username"' \
+    && echo "  ✓ IG reachable: $(echo "$R" | sed -n 's/.*"username":"\([^"]*\)".*/\1/p')  (id $(last4 "$META_IG_USER_ID"))" \
+    || { echo "  ✗ IG check failed: $R"; exit 2; }
+fi
+if [ -n "${META_FB_PAGE_ID:-}" ]; then
+  R=$(curl -s "https://graph.facebook.com/${GVER}/${META_FB_PAGE_ID}?fields=name&access_token=${META_ACCESS_TOKEN}")
+  echo "$R" | grep -q '"name"' \
+    && echo "  ✓ FB Page reachable: $(echo "$R" | sed -n 's/.*"name":"\([^"]*\)".*/\1/p')  (id $(last4 "$META_FB_PAGE_ID"))" \
+    || { echo "  ✗ FB Page check failed: $R"; exit 2; }
+fi
+echo "  token $(last4 "$META_ACCESS_TOKEN") validated"
+
+echo "── 2. write creds into the live Kamatera .env (idempotent) ──"
+TMP=$(mktemp)
+{
+  echo "META_ACCESS_TOKEN=${META_ACCESS_TOKEN}"
+  [ -n "${META_IG_USER_ID:-}" ] && echo "META_IG_USER_ID=${META_IG_USER_ID}"
+  [ -n "${META_FB_PAGE_ID:-}" ] && echo "META_FB_PAGE_ID=${META_FB_PAGE_ID}"
+  [ "$GVER" != "$GVER_DEFAULT" ] && echo "META_GRAPH_VERSION=${GVER}"
+  [ "${SCHEDULER_LIVE:-0}" = "1" ] && echo "SOCIAL_SCHEDULER_LIVE=true"
+} > "$TMP"
+# strip any prior META_*/scheduler lines on the remote, then append fresh ones
+ssh "$REMOTE_HOST" "cd $REMOTE_DIR && touch .env && \
+  sed -i '/^META_ACCESS_TOKEN=/d;/^META_IG_USER_ID=/d;/^META_FB_PAGE_ID=/d;/^META_GRAPH_VERSION=/d;/^SOCIAL_SCHEDULER_LIVE=/d' .env"
+scp -q "$TMP" "$REMOTE_HOST:$REMOTE_DIR/.env.meta-append"
+ssh "$REMOTE_HOST" "cd $REMOTE_DIR && cat .env.meta-append >> .env && rm -f .env.meta-append && chmod 600 .env"
+rm -f "$TMP"
+echo "  ✓ creds appended to $REMOTE_DIR/.env"
+
+echo "── 3. restart pm2 with new env ──"
+ssh "$REMOTE_HOST" "pm2 restart $PM2_NAME --update-env >/dev/null 2>&1 && echo '  ✓ restarted'"
+sleep 3
+
+echo "── 4. confirm /connection reports backend:meta ──"
+curl -s -u "$AUTH" "$LIVE_URL/api/social/connection"
+echo
+echo "Done. Posting still requires confirm:true + an approved post."
+echo "Scheduler auto-post is $([ "${SCHEDULER_LIVE:-0}" = "1" ] && echo ON || echo "OFF (set SCHEDULER_LIVE=1 to enable)")."
← 0f9d596 social: add free Meta Graph (IG+FB) publish backend behind a · back to Marketing Command Center · MCC shell: fix auth-cookie so fetch() works (was hanging on c79449d →