# Posts on the networks

**Posts → On the networks** (`/posts/live`, `Livewire\Tenant\Posts\Live`) lists what is live on clients' pages and accounts, including posts made directly in the Facebook, Instagram or Threads apps. Posts made in this app are marked "Made in this app" and link back to their post.

## What each network allows (official APIs only)

| Network | Read posts | Edit text | Delete |
|---|---|---|---|
| Facebook Pages | ✅ `/{page-id}/published_posts` (`pages_read_engagement`) | ✅ `POST /{post-id}` (`pages_manage_posts`); Meta may refuse some post types | ✅ `DELETE /{post-id}` (`pages_manage_posts`) |
| Instagram (Business/Creator) | ✅ `/{ig-user-id}/media` (`instagram_basic`) | ❌ not offered by the API | ❌ not offered by the API |
| Threads | ✅ `/{user-id}/threads` (`threads_basic`) | ❌ | ⏳ `configurable`: needs `threads_delete`; not implemented yet |

The rows live in `config/social/capabilities/*.json` as `read_posts`, `edit_posts` and `delete_posts`, and the `CapabilityResolver` combines them with the adapter (`ReadsPublishedPosts::publishedPostOperations()`), the integration status, the account's health and its granted scopes. After changing the files, run `php artisan social:sync-capabilities`. The page hides Edit/Delete where they are not available and says why.

Editing or deleting also needs the member's `posts.update` / `posts.delete` permission for that client (`ClientAccess`). Both are audited (`network_post.updated`, `network_post.deleted`). Deleting a post made here also marks its delivery target `external_deleted_at`.

## Sync

- `network_posts` (tenant DB) is a cached copy; the network stays the source of truth.
- `posts:sync-network` (every 15 minutes) queues `SyncNetworkPosts` for active accounts not refreshed in the last `NETWORK_POSTS_SYNC_MINUTES` (60). "Get latest posts" on the page refreshes the visible accounts at once.
- `NetworkPostSync` reads the last `NETWORK_POSTS_WINDOW_DAYS` (90) days, up to `NETWORK_POSTS_LIMIT` (100) posts per account. When the network returned fewer than the limit (the whole window), cached posts it no longer reports are marked removed (deleted directly on the network).
- Disconnecting an account deletes its cached posts.
- Pictures load from Meta's CDNs (`*.fbcdn.net`, `*.cdninstagram.com`), which are allowed in the CSP `img-src`.

## Sandbox

`FakeProvider` mirrors the real rules (only Facebook can edit/delete). Unscripted accounts get two sample "posted directly" posts; tests script their own with `FakeProvider::nativePost()` and inspect `$editedPosts` / `$removedPosts`.