Instagram connection via Meta Graph API OAuth (no username/password)

[Abby263]

Summary

Pivots the Instagram connection model to Facebook Login OAuth. Users click Connect with Facebook on the Connections page, grant publishing + insights scopes, and we resolve the IG Business Account via their Page picker. Username/password storage is gone — both from the schema and the UI.

Posting now uses the Meta Graph API two-step protocol (/media → /media_publish). Because the Graph API requires a public image URL (no base64, no auth), every generated image is re-uploaded to Supabase Storage before publish — both in the auto-publish LangGraph agent path and in the approval route on Vercel.

A weekly refresh-tokens cron pre-emptively exchanges long-lived tokens before their 60-day expiry; expired ones get connection_status='expired' and the UI surfaces a Reconnect button.

Breaking change

migrations/004_instagram_oauth.sql deletes existing username/password Instagram connections. Workflows that referenced them have their connection_id set to NULL (existing FK) and need to be re-pointed at a new OAuth connection. Acknowledged tradeoff per the design discussion: cleanest schema, harshest UX.

What's where

• migrations/004_instagram_oauth.sql — drops legacy IG password rows; adds access_token_encrypted, page_id, token_expires_at, connection_status; drops the old plaintext graph_access_token column.
• frontend/lib/encryption.ts — AES-256-GCM helpers (v1:iv:tag:ct wire format) keyed by TOKEN_ENCRYPTION_KEY.
• frontend/lib/meta-oauth.ts — authorize URL, code → short-lived token, short-lived → long-lived (60-day), Pages list, IG username lookup.
• frontend/app/api/auth/instagram/start/route.ts — kicks off OAuth, sets a short-lived state cookie.
• frontend/app/api/auth/instagram/callback/route.ts — validates state, exchanges tokens, lists Pages with attached IG accounts, persists if exactly one (else stashes a candidate list cookie for the picker).
• frontend/app/api/auth/instagram/select-page/route.ts — multi-Page picker (GET = list, POST = save).
• frontend/lib/supabase-storage.ts + backend/utils/supabase-storage.ts — re-host any image (URL or base64) to a public Supabase Storage URL keyed by user/post.
• frontend/lib/instagram-graph.ts + backend/clients/instagram/graph-client.ts — added publishImage() to both copies; the existing listRecentMedia/getMediaInsights keep working.
• frontend/app/api/cron/refresh-tokens/route.ts — weekly token refresh + expiry sweep. Schedule added to vercel.json.
• frontend/app/dashboard/connections/page.tsx — IG form replaced with a single Connect with Facebook button, requirements callout, multi-Page picker UI, status badges, Reconnect action.
• Auto-publish path: publishToInstagram in content-automation-advanced/index.ts and content-automation/index.ts now upload to Supabase then call InstagramGraphClient.publishImage.
• Approval path: /api/posts/[id]/approve decrypts the token, uploads the image, and calls publishImage directly (no longer routes through the upload-post LangGraph).
• /api/trigger-workflow and /api/cron/run-due-workflows decrypt the token before passing {accessToken, igUserId, pageId} to the agent. Workflows targeting non-active IG connections short-circuit with a clear error.
• instagram-private-api dropped from package.json; backend/clients/instagram/client.ts deleted.

New env required

META_APP_ID
META_APP_SECRET
TOKEN_ENCRYPTION_KEY
SUPABASE_URL
SUPABASE_SERVICE_ROLE_KEY
SUPABASE_STORAGE_BUCKET           (default 'post-media')

OAuth redirect URI in your Meta App must be ${NEXT_PUBLIC_APP_URL}/api/auth/instagram/callback. The post-media Supabase Storage bucket needs Public access ON so Meta's servers can fetch image URLs.

The same env vars (minus the Meta ones) need to be set on the LangGraph runtime so the agent can call uploadImageToSupabase from inside a run.

Test plan

• yarn lint, yarn typecheck, yarn test, yarn lint:langgraph-json, yarn format:check — all clean
• pnpm lint (frontend) — no new errors, only pre-existing warnings
• pnpm test:ci (frontend) — 22 pass
• pnpm build (frontend) — all new routes compile (/api/auth/instagram/{start,callback,select-page}, /api/cron/refresh-tokens)
• Pre-merge manual checks:
  • Run migration 004 against Supabase
  • Create the post-media bucket in Supabase Storage (Public ON)
  • Set env vars on Vercel + LangGraph
  • Register Meta App, add yourself as a test user, configure redirect URI
  • Walk through Connect with Facebook → confirm a connection row appears
  • Trigger an auto-publish workflow → confirm a post lands on IG
  • Trigger an approval workflow → approve → confirm post lands on IG

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
flowpost	Ready	Preview, Comment	May 8, 2026 1:48am

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 18d25eb66a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Verify OAuth page cookie belongs to signed-in user

POST /api/auth/instagram/select-page trusts ig_oauth_pages without checking that the cookie was created for the current account, even though the callback keeps ig_oauth_user for that purpose. In a shared browser/session-switch scenario (user A starts OAuth, user B signs in before cookie expiry), user B can select A’s pending page and bind A’s page token to B’s connection. Bind the pending payload to the current userId before accepting pageId.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Preserve upload_post credential compatibility

This change makes upload_post require credentials.accessToken and credentials.igUserId, but existing callers like frontend/app/api/schedule-post/route.ts still pass connection.credentials directly, and new OAuth connections are saved with credentials = {} in the callback/select-page routes. As a result, Instagram “post now” (and any path using upload_post) fails with the new missing-credentials error until those callers are updated to pass decrypted OAuth fields.

Useful? React with 👍 / 👎.