Facebook rejected app integration for publish_actions

[Zelex]

Web
For the login dialog, please use the JavaScript SDK without specifying an explicit display type. If you have special requirements precluding use of the SDK, set height and width on your window.open() call to properly size the dialog. People must have the complete option to change their audience settings. Learn more about Facebook Login.

[jaywink]

Why did you need to request this permission?

Did you follow this guide? AFAIK there should be no permissions requested.

[Zelex]

Yeah, they now require explicit verification for posting to people's timelines. Must be new.

[Zelex]

Btw, straight up Diaspora install requests this permission. I didn't modify anything. Makes sense to if you want to post to Facebook from Diaspora

[jaywink]

Did you at some point click some "Start submission" etc button? Because I created a new app recently and it didn't require anything. The already approved "email, public_profile, user_friends" is enough for diaspora*. Are you sure you have chosen "Website" as the "Platform"?

[qtheuret]

I have the same problem, and I think it's because, when you send the submission to Facebook, you need to describe how the user connects itself to Diaspora* with it's Facebook login. But, there is no way to create an account on Diaspora* with a Facebook account.
There is also a field to define the test user that will be used by Facebook team to validate the submission.

[Flaburgan]

I added this item to discuss in the next community meeting. See the wiki page

[TwizzyDizzy]

Hi folks,

I'm gonna weigh in on this one: I recently tried to get publish_actions (see [1] why we need this) for my facebook app (the purpose of which is solely to cross-post from Diaspora) and failed for the second time despite following the guide at [2].

Still, we need "publish_actions" (see [3]) to be able to post via the 2.x API.

The aforementioned community meeting produced this:

Help podmins create the bridge with Facebook

Fla will post a message with his account, reshared by DHQ, to ask if podmins successfully submitted
their app with the APIv2 of Facebook, and if they can improve the wiki page to help next podmins.
The message will also be posted on diasporaforum.org. It will also contain a warning, in case
podmins don't know that the APIv1 will be down soon.

@Flaburgan: did you post and ask and was there any helpful feedback? :)

I'd be glad the help out on this one, but I really don't get what facebook wants me to do. I created the App as "Website" and added "publish_actions" as permission to be included in review. I added images for the app as well as screenshots providing a walkthrough on how to connect your account to facebook up until how it would look like to publish a post to facebook (activating the [F] image in the textarea when posting).

Still... the app did not make it through the review process :|

[1] default permissions include "user_friends", "public_profile", "email". Neither of these provide the ability to cross-post from Diaspora.
[2] https://wiki.diasporafoundation.org/Integrating_other_social_networks#Facebook
[3] https://developers.facebook.com/docs/facebook-login/permissions/v2.2#reference-publish_actions

Cheers
Thomas

[Flaburgan]

@TwizzyDizzy unfortunately, no helpful response from podmins. I think we should contact Facebook directly because the 31th of December is coming very soon and the Facebook connection will be broken for everyone...

[TwizzyDizzy]

I agree, this might become a major issue when APIv1 will be shut down. Anyone at DHQ available for tackling that issue? I'd write a text which could then be used by DHQ to contact FB - I guess getting in contact with FB as DHQ would have a bigger impact than me, complaining in the review process of just my app.

• Do you know to whom I may send the text?
• Can we roule out the possibility that the issue is either on Diaspora side (in terms of technical obstacles) or on my/our side not having followed the review procedure correctly?

Cheers
Thomas

[Flaburgan]

I have access to the diaspora HQ account, if you want to write a draft of the message here.
About contact facebook, we should probably use the team@diasporafoundation.org email, I don't have access to it. Or we could ping them on twitter?

[jaywink]

I can help with contacting Facebook via the official team email. Just no
time to make a good text right now :(

On 22.12.2014 11:55, Fla wrote:

I have access to the diaspora HQ account, if you want to write a draft
of the message here.
About contact facebook, we should probably use the
team@diasporafoundation.org mailto:team@diasporafoundation.org
email, I don't have access to it. Or we could ping them on twitter?

—
Reply to this email directly or view it on GitHub
#5085 (comment).

[Flaburgan]

@jaywink I don't think that we need a really official mail. We should only reach their support, saying:

• Describing shortly what is diaspora, with a link to the diasporafoundation website
• Explaining how and why we connect to facebook, and the permissions the app needs
• Explaining that every pod will have to create an app and ask for these permissions
• Asking why the validation fails, and what can we do about it
• Optionally asking if there could be a way to automatize the validation for diaspora*, because it will be for each pod the exact same request, with the same screenshots, etc.

[TwizzyDizzy]

Well... that is odd. I just tried to re-submit my application for publish_actions (detailing the above facts) and therefore tested whether it still does not work. Obviously it did work - as you can see:

https://www.facebook.com/permalink.php?story_fbid=1528305794106210&id=100007804127198&pnref=story

The facebook app created for my diaspora pod obviously still has no publish_actions permission.

I am somewhat puzzled...

[jaywink]

Well they never before requested "publish_actions" - and that has never been a part of our instructions. At some point people started saying new integrations cannot be made without this permission which never before was required. I'm still guessing it's not requested and podmins just assume it's required ;)

[TwizzyDizzy]

I, in fact, assumed that we need that permission, obviously because the post I made back then had not been posted to facebook.

So we're basically back to Post 1, because the error itself is still displayed (I just verified that).

I am kind of embarassed for making such a fuss.

[jaywink]

I hope you were wrong and no such permissions are required ;) And no worries, no need to be embarrased about anything. 💃 These things happen all the time..

@Zelex would you like to try crossposting without this permission, ie strictly following the guide in our wiki and just 1) creating the app, 2) adding keys to diaspora config, 3) connecting diaspora account to facebook account and 4) crossposting?

[Flaburgan]

@jaywink I think we need the permission, the facebook API changed and is now the 2.0, the 1.0 is not working anymore. Btw I'm not even sure that we are compatible with the 2.0 API see #5260

[jaywink]

Well I just went through the effort of creating a pod, creating a facebook app and following our wiki to make the integration - and everything worked smoothly - there was at no point any need to submit anything for review.

So closing this unless someone can prove that our current documentation is somehow out of date and publish_actions needs to be requested.

[qtheuret]

@jaywink Did you try to link your Diaspora account with a Facebook account that is not an administrator of the Facebook application ?
I did that and if I link my Diaspora account with a Facbook account that is an administrator of the FB app, it works well but if I link it with a normal Facebook account, no message were sent to Facebook.

[jaywink]

@qtheuret OK I'll try that too and report back.

[jaywink]

Reopening due to popular demand. Several reports indicate @qtheuret is correct, didn't have time to test myself.

[jaywink]

Btw, this is more of a documentation issue, not a code issue. This should be closed once the wiki instructions are fool proof.

[qtheuret]

To add more information to solve this issue, I read this on http://www.nextscripts.com/instructions/facebook-social-networks-auto-poster-setup-installation/ :

[Update – May 2014] Facebook changed some rules regarding the apps. This means that the Facebook App, Facebook profile or page and the user who authorizes the app MUST belong to the same Facebook account. So please make sure you are logged to Facebook as the same user who created the app.

[ghostnegotiator]

Well it seems I was right after all after a whole discussion of 'Yes' and 'No' and a shit ton of anger (Sorry still pissed off about it and I won't call their names right @jaywink ). Also when confronting of a new fact which did not quite taken serious with 'corrections' towards me from @jhass wile it was a literal copy/paste from Facebook. At least we got this stuff got out of the way and yet I want to throw in another issue which came on 28th of March.

As of March 28 Facebook has rolled out Facebook API V2.3 (Bit earlier but the rules apply from 28th) they have applied several NEW rules. There is a requirement of having a JavaScript SDK which is connected straight to Facebook their tracking system. This includes having a 'Signup with Facebook!' on the landing page and a bonus of privacy stab in the back you have to install Facebook JavaScript SDK which has the ability to track the activity on your pod. As a joke on 1st of April of team@pod.geraspora.de at 'post guid' posts/a0b4d6f0ba3e013283b04860008dbc6c came quite close to what the features of the JavaScript SDK offers (feel the irony?).

Every thing in a list:

• You are required to have a Sign up with Facebook button on the landing page,
• Install JavaScript SDK from Facebook,
• Agree with their "Privacy Policy",
• Allow them to track your users and your self on Facebook.

This info came from an old friend that continuously makes money with Facebook apps. And he has recently informed a lawyer for an explanation which I got confirmed trough phone. Because of the reason I kind of felt stabbed in the back (last time and I am still feeling it) you have to verify it your own at http://developers.facebook.com / Well known privacy policy. Or simply use a search engine or ask a common developer from Facebook which is already familiar with this system and policies (what I did).

[sameignatovich]

I turned off facebook api on my pod. Not working anyway. Facebook have a very aggressive policy of spying

[jaywink]

It's unlikely there will be an easy permanent fix for allowing pod users (not app owner) to post to facebook via diaspora.

The only real option we have then is to make sure we don't show the "connect with facebook" button in the d* UI if there is possibility for users to post. I was thinking we could add a third setting to the Facebook services setting in diaspora.yml called visibility with options false, all or a username. False would mean it the buttons is not visible of course, all would mean the podmin has checked the FB app permissions (publish_actions) and thus guarantees the service works for all users. As a third option, a username can be provided, who the button would show for. This is expected to be the user who has created the FB app, since this user can always post, as has been tried.

This would allow podmins to set themselves cross-posting without having to worry about allowing non-working service linking to other users on their pod.

I can gladly do the change, if no one opposes. This would mean all podmins would need to check their current FB app when the change is deployed and set the correct value. Then we would really be able to tell users which pods really have working FB link, since some have the approval done already.

[denschub]

Closing this. Additional configuration available with 7c0e50c, additional information regarding this change and issues is above. Feel free to reopen if you feel the urge of doing so.