Read Facebook Pages with a session, not a Page Access Token

[ralyodio]

/fb/ shipped as connected-Pages-only, on the grounds that Graph reaches only Pages the caller administers. That was true and it was also inconsistent: X is read with an auth_token cookie and Instagram with an IG_COOKIE, and refusing Facebook the same bargain made /fb/ a namespace almost nobody could add to.

So a Page is now read the way the other two are — a logged-in session against mbasic.facebook.com, which still renders server-side HTML and which 302s to login.php rather than 404ing, so it is gated rather than gone.

Graph is kept and preferred where a token happens to exist, because a supported API beats guessing at markup. It is never required. Both paths key on the post id, so a Page that gains a token later keeps its identity and nobody's reader marks the feed unread.

/fb/ now takes open submissions like the other three.

This is the least dependable thing in the directory

RSSHub maintains Twitter and Instagram and has no Facebook namespace. That is a verdict, not an oversight. So the fragility is handled in code rather than promised away in the README:

• Every selector is in one SELECTORS object, so the inevitable break is one edit in one known place — fetch a page with a live cookie, look at the HTML, edit that object.
• A login wall or checkpoint retires the session, never the Page. Ten failures retire a feed; getting this wrong would delete the whole namespace in an afternoon.
• Each platform now has its own floor rather than sharing X's five minutes: X 5, Instagram 30, Facebook 60. The cost of asking Facebook too often is a locked account, not a 429 — and a Page that posts twice a week loses nothing to an hourly floor.

Two real bugs found on the way

Bug	Effect
Vanity regex required 5 chars	That's Facebook's rule for new usernames. facebook.com/NASA is four — real Pages were rejected outright
"No session configured" classified as an upstream anomaly	Retried every 20 min instead of hourly; it is a deployment that hasn't happened, not a service that's down

Also a layering fix: packages/db no longer imports @rssamplifier/social for the interval — the caller supplies it, since social reads nothing from db and db has no reason to know what a platform is.

Verified

97 tests in packages/social (9 new, against an mbasic-shaped fixture), 1,354 across 12 packages, all green. Build clean.

The selectors themselves are not verified — only a live cookie proves those, and they will change regardless. What is verified is everything around them: the login wall classifies correctly, a post with no id is dropped rather than stored undeduplicatable, relative mbasic links come out pointing at facebook.com, and an unparseable relative date stays null rather than being stamped now.

Collects nothing until FB_COOKIE is set.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Q6QEgpuS4MLamogXtr2ZX6