`scripts/meta-token-health.js`

72 lines
#!/usr/bin/env node
/*
 * meta-token-health.js — canary for the MCC META_ACCESS_TOKEN that powers the
 * Vendor IG panel's Business-Discovery post fetch. Born 2026-06-16 (Officer
 * Council #4): the panel went dark on 2026-06-15 when the token silently
 * expired with zero alert. This GETs /me with the token; on auth failure
 * (code 190 / expired) it alerts (CNCP card + George email). Best-effort reads
 * token expiry for an early <7d warning. Writes a heartbeat stamp on every run
 * (Council #2 lesson) so the meta-watchdog can confirm it actually fired.
 * READ-ONLY: never writes Shopify/DB, never rotates the token (Steve-gated).
 */
const fs = require('fs');
const path = require('path');
const GRAPH = 'https://graph.facebook.com/v23.0';
const ROOT = path.join(__dirname, '..');
const env = (f, k) => { try { return (fs.readFileSync(f, 'utf8').match(new RegExp('^' + k + '=(.+)$', 'm')) || [])[1]; } catch { return null; } };
const TOKEN = env(path.join(ROOT, '.env'), 'META_ACCESS_TOKEN');
const GEORGE_AUTH = env('/Users/macstudio3/Projects/secrets-manager/.env', 'GEORGE_AUTH');
const STAMP = path.join(ROOT, 'data', 'meta-token-health-latest.json');

async function alert(subject, body) {
  // CNCP parking-lot (local, reliable)
  try {
    await fetch('http://127.0.0.1:3333/api/parking-lot', { method: 'POST', headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ url: 'http://127.0.0.1:9661/#vendors', note: `⚠️ META token: ${subject} — ${body}` }) });
  } catch {}
  // George email (best-effort). George flipped to HTTPS-only 2026-06-17 — the
  // raw http://<ip> now 400s; use the Tailscale MagicDNS host + raw GEORGE_AUTH
  // + body field, matching the working dw-canary-watchdog sender.
  if (GEORGE_AUTH) {
    try {
      const G = process.env.GEORGE_URL || 'https://kamatera.tail79cb8e.ts.net:9850';
      await fetch(`${G}/api/send`, { method: 'POST', headers: { 'Content-Type': 'application/json; charset=utf-8', 'Authorization': GEORGE_AUTH },
        body: JSON.stringify({ to: 'steve@designerwallcoverings.com', subject: 'MCC META token — ' + subject, body }) });
    } catch {}
  }
}

(async () => {
  const stamp = (status, detail) => { try { fs.writeFileSync(STAMP, JSON.stringify({ ok: status === 'ok', status, detail, checkedAt: new Date().toISOString() }, null, 2)); } catch {} };
  if (!TOKEN) { console.log('DEAD: no META_ACCESS_TOKEN in .env'); stamp('missing', 'no token in .env'); await alert('NOT SET', 'No META_ACCESS_TOKEN in MCC .env — Vendor IG panel cannot fetch posts.'); process.exit(0); }

  let r, j;
  try { r = await fetch(`${GRAPH}/me?fields=id,name&access_token=${encodeURIComponent(TOKEN)}`); j = await r.json(); }
  catch (e) { console.log('NET ERR', e.message); stamp('neterr', e.message); process.exit(0); }

  if (j.error) {
    const m = j.error.message || '';
    const expired = j.error.code === 190 || /expired|session|validating access token/i.test(m);
    console.log('DEAD:', m);
    stamp('expired', m);
    await alert(expired ? 'EXPIRED / INVALID' : 'ERROR',
      `${m}\n\nThe Vendor IG panel (last-10 posts) is dark until you paste a fresh long-lived META_ACCESS_TOKEN (scopes: instagram_basic, pages_read_engagement, business_management) → route via the secrets skill into MCC .env, then click Refresh on the panel.`);
    process.exit(0);
  }

  // token live — best-effort expiry read (debug_token self-inspect; may be unsupported without app token)
  let expiryNote = 'expiry unknown (no app token)';
  try {
    const dr = await fetch(`${GRAPH}/debug_token?input_token=${encodeURIComponent(TOKEN)}&access_token=${encodeURIComponent(TOKEN)}`);
    const dj = await dr.json();
    const exp = dj?.data?.expires_at;
    if (exp && exp > 0) {
      const days = Math.round((exp * 1000 - Date.now()) / 86400000);
      expiryNote = `expires in ~${days}d`;
      if (days <= 7) { stamp('expiring', expiryNote); await alert('EXPIRING SOON', `META_ACCESS_TOKEN ${expiryNote} — refresh it before the Vendor IG panel goes dark.`); console.log('LIVE but', expiryNote); return; }
    }
  } catch {}
  console.log(`LIVE: @${j.name || j.id} OK (${expiryNote})`);
  stamp('ok', `live as ${j.name || j.id}; ${expiryNote}`);
})().catch(e => { console.error('FATAL', e.message); process.exit(1); });