Merge branch '0.9.x' of gitorious.org:statusnet/mainline into 0.9.x

8 files changed, 570 insertions, 418 deletions

diff --git a/plugins/Facebook/FBConnectAuth.php b/plugins/Facebook/FBConnectAuth.php
index 51bfc3865..8eba7fc13 100644
--- a/plugins/Facebook/FBConnectAuth.php
+++ b/plugins/Facebook/FBConnectAuth.php
@@ -138,6 +138,11 @@ class FBConnectauthAction extends Action
         parent::showPage();
     }
 
+    /**
+     * @fixme much of this duplicates core code, which is very fragile.
+     * Should probably be replaced with an extensible mini version of
+     * the core registration form.
+     */
     function showContent()
     {
         if (!empty($this->message_text)) {
@@ -159,10 +164,15 @@ class FBConnectauthAction extends Action
                                       'name' => 'license',
                                       'value' => 'true'));
         $this->elementStart('label', array('class' => 'checkbox', 'for' => 'license'));
-        $this->text(_m('My text and files are available under '));
-        $this->element('a', array('href' => common_config('license', 'url')),
-                       common_config('license', 'title'));
-        $this->text(_m(' except this private data: password, email address, IM address, phone number.'));
+        $message = _('My text and files are available under %s ' .
+                     'except this private data: password, ' .
+                     'email address, IM address, and phone number.');
+        $link = '<a href="' .
+                htmlspecialchars(common_config('license', 'url')) .
+                '">' .
+                htmlspecialchars(common_config('license', 'title')) .
+                '</a>';
+        $this->raw(sprintf(htmlspecialchars($message), $link));
         $this->elementEnd('label');
         $this->elementEnd('li');
         $this->elementEnd('ul');
diff --git a/plugins/Facebook/FacebookPlugin.php b/plugins/Facebook/FacebookPlugin.php
index 443cb396f..19989a952 100644
--- a/plugins/Facebook/FacebookPlugin.php
+++ b/plugins/Facebook/FacebookPlugin.php
@@ -80,6 +80,25 @@ class FacebookPlugin extends Plugin
     }
 
     /**
+     * Check to see if there is an API key and secret defined
+     * for Facebook integration.
+     *
+     * @return boolean result
+     */
+
+    static function hasKeys()
+    {
+        $apiKey    = common_config('facebook', 'apikey');
+        $apiSecret = common_config('facebook', 'secret');
+
+        if (!empty($apiKey) && !empty($apiSecret)) {
+            return true;
+        }
+
+        return false;
+    }
+
+    /**
      * Add Facebook app actions to the router table
      *
      * Hook for RouterInitialized event.
@@ -91,23 +110,26 @@ class FacebookPlugin extends Plugin
 
     function onStartInitializeRouter($m)
     {
+        $m->connect('admin/facebook', array('action' => 'facebookadminpanel'));
 
-        // Facebook App stuff
+        if (self::hasKeys()) {
 
-        $m->connect('facebook/app', array('action' => 'facebookhome'));
-        $m->connect('facebook/app/index.php', array('action' => 'facebookhome'));
-        $m->connect('facebook/app/settings.php',
-                    array('action' => 'facebooksettings'));
-        $m->connect('facebook/app/invite.php', array('action' => 'facebookinvite'));
-        $m->connect('facebook/app/remove', array('action' => 'facebookremove'));
-        $m->connect('admin/facebook', array('action' => 'facebookadminpanel'));
+            // Facebook App stuff
 
-        // Facebook Connect stuff
+            $m->connect('facebook/app', array('action' => 'facebookhome'));
+            $m->connect('facebook/app/index.php', array('action' => 'facebookhome'));
+            $m->connect('facebook/app/settings.php',
+                        array('action' => 'facebooksettings'));
+            $m->connect('facebook/app/invite.php', array('action' => 'facebookinvite'));
+            $m->connect('facebook/app/remove', array('action' => 'facebookremove'));
 
-        $m->connect('main/facebookconnect', array('action' => 'FBConnectAuth'));
-        $m->connect('main/facebooklogin', array('action' => 'FBConnectLogin'));
-        $m->connect('settings/facebook', array('action' => 'FBConnectSettings'));
-        $m->connect('xd_receiver.html', array('action' => 'FBC_XDReceiver'));
+            // Facebook Connect stuff
+
+            $m->connect('main/facebookconnect', array('action' => 'FBConnectAuth'));
+            $m->connect('main/facebooklogin', array('action' => 'FBConnectLogin'));
+            $m->connect('settings/facebook', array('action' => 'FBConnectSettings'));
+            $m->connect('xd_receiver.html', array('action' => 'FBC_XDReceiver'));
+        }
 
         return true;
     }
@@ -338,6 +360,9 @@ class FacebookPlugin extends Plugin
 
     function reqFbScripts($action)
     {
+        if (!self::hasKeys()) {
+            return false;
+        }
 
         // If you're logged in w/FB Connect, you always need the FB stuff
 
@@ -410,42 +435,35 @@ class FacebookPlugin extends Plugin
 
     function onStartPrimaryNav($action)
     {
-        $user = common_current_user();
+        if (self::hasKeys()) {
+            $user = common_current_user();
+            if (!empty($user)) {
 
-        $connect = 'FBConnectSettings';
-        if (common_config('xmpp', 'enabled')) {
-            $connect = 'imsettings';
-        } else if (common_config('sms', 'enabled')) {
-            $connect = 'smssettings';
-        }
+                $fbuid = $this->loggedIn();
 
-        if (!empty($user)) {
+                if (!empty($fbuid)) {
 
-            $fbuid = $this->loggedIn();
+                    /* Default FB silhouette pic for FB users who haven't
+                       uploaded a profile pic yet. */
 
-            if (!empty($fbuid)) {
-
-                /* Default FB silhouette pic for FB users who haven't
-                   uploaded a profile pic yet. */
-
-                $silhouetteUrl =
-                    'http://static.ak.fbcdn.net/pics/q_silhouette.gif';
+                    $silhouetteUrl =
+                        'http://static.ak.fbcdn.net/pics/q_silhouette.gif';
 
-                $url = $this->getProfilePicURL($fbuid);
+                    $url = $this->getProfilePicURL($fbuid);
 
-                $action->elementStart('li', array('id' => 'nav_fb'));
+                    $action->elementStart('li', array('id' => 'nav_fb'));
 
-                $action->element('img', array('id' => 'fbc_profile-pic',
-                    'src' => (!empty($url)) ? $url : $silhouetteUrl,
-                    'alt' => 'Facebook Connect User',
-                    'width' => '16'), '');
+                    $action->element('img', array('id' => 'fbc_profile-pic',
+                        'src' => (!empty($url)) ? $url : $silhouetteUrl,
+                        'alt' => 'Facebook Connect User',
+                        'width' => '16'), '');
 
-                $iconurl =  common_path('plugins/Facebook/fbfavicon.ico');
-                $action->element('img', array('id' => 'fb_favicon',
-                    'src' => $iconurl));
-
-                $action->elementEnd('li');
+                    $iconurl =  common_path('plugins/Facebook/fbfavicon.ico');
+                    $action->element('img', array('id' => 'fb_favicon',
+                        'src' => $iconurl));
 
+                    $action->elementEnd('li');
+                }
             }
         }
 
@@ -462,14 +480,15 @@ class FacebookPlugin extends Plugin
 
     function onEndLoginGroupNav(&$action)
     {
+        if (self::hasKeys()) {
 
-        $action_name = $action->trimmed('action');
-
-        $action->menuItem(common_local_url('FBConnectLogin'),
-                                           _m('Facebook'),
-                                           _m('Login or register using Facebook'),
-                                           'FBConnectLogin' === $action_name);
+            $action_name = $action->trimmed('action');
 
+            $action->menuItem(common_local_url('FBConnectLogin'),
+                                               _m('Facebook'),
+                                               _m('Login or register using Facebook'),
+                                               'FBConnectLogin' === $action_name);
+        }
         return true;
     }
 
@@ -483,13 +502,15 @@ class FacebookPlugin extends Plugin
 
     function onEndConnectSettingsNav(&$action)
     {
-        $action_name = $action->trimmed('action');
+        if (self::hasKeys()) {
 
-        $action->menuItem(common_local_url('FBConnectSettings'),
-                          _m('Facebook'),
-                          _m('Facebook Connect Settings'),
-                          $action_name === 'FBConnectSettings');
+            $action_name = $action->trimmed('action');
 
+            $action->menuItem(common_local_url('FBConnectSettings'),
+                              _m('Facebook'),
+                              _m('Facebook Connect Settings'),
+                              $action_name === 'FBConnectSettings');
+        }
         return true;
     }
 
@@ -503,20 +524,22 @@ class FacebookPlugin extends Plugin
 
     function onStartLogout($action)
     {
-        $action->logout();
-        $fbuid = $this->loggedIn();
+        if (self::hasKeys()) {
 
-        if (!empty($fbuid)) {
-            try {
-                $facebook = getFacebook();
-                $facebook->expire_session();
-            } catch (Exception $e) {
-                common_log(LOG_WARNING, 'Facebook Connect Plugin - ' .
-                           'Could\'t logout of Facebook: ' .
-                           $e->getMessage());
+            $action->logout();
+            $fbuid = $this->loggedIn();
+
+            if (!empty($fbuid)) {
+                try {
+                    $facebook = getFacebook();
+                    $facebook->expire_session();
+                } catch (Exception $e) {
+                    common_log(LOG_WARNING, 'Facebook Connect Plugin - ' .
+                               'Could\'t logout of Facebook: ' .
+                               $e->getMessage());
+                }
             }
         }
-
         return true;
     }
 
@@ -562,7 +585,9 @@ class FacebookPlugin extends Plugin
 
     function onStartEnqueueNotice($notice, &$transports)
     {
-        array_push($transports, 'facebook');
+        if (self::hasKeys() && $notice->isLocal()) {
+            array_push($transports, 'facebook');
+        }
         return true;
     }
 
@@ -575,7 +600,9 @@ class FacebookPlugin extends Plugin
      */
     function onEndInitializeQueueManager($manager)
     {
-        $manager->connect('facebook', 'FacebookQueueHandler');
+        if (self::hasKeys()) {
+            $manager->connect('facebook', 'FacebookQueueHandler');
+        }
         return true;
     }
 
diff --git a/plugins/Facebook/README b/plugins/Facebook/README
index 14c1d3241..532f1d82e 100644
--- a/plugins/Facebook/README
+++ b/plugins/Facebook/README
@@ -38,11 +38,11 @@ editor or write them down.
 
 In Facebook's application editor, specify the following URLs for your app:
 
-- Canvas Callback URL     : http://example.net/mublog/facebook/app/
-- Post-Remove Callback URL: http://example.net/mublog/facebook/app/remove
-- Post-Add Redirect URL   : http://apps.facebook.com/yourapp/
-- Canvas Page URL         : http://apps.facebook.com/yourapp/
-- Connect URL             : http://example.net/mublog/
+- Canvas Callback URL         : http://example.net/mublog/facebook/app/
+- Post-Remove Callback URL    : http://example.net/mublog/facebook/app/remove
+- Post-Authorize Redirect URL : http://apps.facebook.com/yourapp/
+- Canvas Page URL             : http://apps.facebook.com/yourapp/
+- Connect URL                 : http://example.net/mublog/
 
     *** ATTENTION ***
     These URLs have changed slightly since StatusNet version 0.8.1,
diff --git a/plugins/Facebook/facebook/facebook.php b/plugins/Facebook/facebook/facebook.php
index 440706cbc..76696c1d5 100644
--- a/plugins/Facebook/facebook/facebook.php
+++ b/plugins/Facebook/facebook/facebook.php
@@ -45,7 +45,9 @@ class Facebook {
   public $user;
   public $profile_user;
   public $canvas_user;
+  public $ext_perms = array();
   protected $base_domain;
+
   /*
    * Create a Facebook client like this:
    *
@@ -104,17 +106,17 @@ class Facebook {
    *
    * For nitty-gritty details of when each of these is used, check out
    * http://wiki.developers.facebook.com/index.php/Verifying_The_Signature
-   *
-   * @param bool  resolve_auth_token  convert an auth token into a session
    */
-  public function validate_fb_params($resolve_auth_token=true) {
+  public function validate_fb_params() {
     $this->fb_params = $this->get_valid_fb_params($_POST, 48 * 3600, 'fb_sig');
 
     // note that with preload FQL, it's possible to receive POST params in
     // addition to GET, so use a different prefix to differentiate them
     if (!$this->fb_params) {
       $fb_params = $this->get_valid_fb_params($_GET, 48 * 3600, 'fb_sig');
-      $fb_post_params = $this->get_valid_fb_params($_POST, 48 * 3600, 'fb_post_sig');
+      $fb_post_params = $this->get_valid_fb_params($_POST,
+                                                   48 * 3600, // 48 hours
+                                                   'fb_post_sig');
       $this->fb_params = array_merge($fb_params, $fb_post_params);
     }
 
@@ -128,6 +130,9 @@ class Facebook {
                             $this->fb_params['canvas_user'] : null;
       $this->base_domain  = isset($this->fb_params['base_domain']) ?
                             $this->fb_params['base_domain'] : null;
+      $this->ext_perms    = isset($this->fb_params['ext_perms']) ?
+                            explode(',', $this->fb_params['ext_perms'])
+                            : array();
 
       if (isset($this->fb_params['session_key'])) {
         $session_key =  $this->fb_params['session_key'];
@@ -141,13 +146,11 @@ class Facebook {
       $this->set_user($user,
                       $session_key,
                       $expires);
-    }
-    // if no Facebook parameters were found in the GET or POST variables,
-    // then fall back to cookies, which may have cached user information
-    // Cookies are also used to receive session data via the Javascript API
-    else if ($cookies =
-             $this->get_valid_fb_params($_COOKIE, null, $this->api_key)) {
-
+    } else if ($cookies =
+               $this->get_valid_fb_params($_COOKIE, null, $this->api_key)) {
+      // if no Facebook parameters were found in the GET or POST variables,
+      // then fall back to cookies, which may have cached user information
+      // Cookies are also used to receive session data via the Javascript API
       $base_domain_cookie = 'base_domain_' . $this->api_key;
       if (isset($_COOKIE[$base_domain_cookie])) {
         $this->base_domain = $_COOKIE[$base_domain_cookie];
@@ -160,25 +163,6 @@ class Facebook {
                       $cookies['session_key'],
                       $expires);
     }
-    // finally, if we received no parameters, but the 'auth_token' GET var
-    // is present, then we are in the middle of auth handshake,
-    // so go ahead and create the session
-    else if ($resolve_auth_token && isset($_GET['auth_token']) &&
-             $session = $this->do_get_session($_GET['auth_token'])) {
-      if ($this->generate_session_secret &&
-          !empty($session['secret'])) {
-        $session_secret = $session['secret'];
-      }
-
-      if (isset($session['base_domain'])) {
-        $this->base_domain = $session['base_domain'];
-      }
-
-      $this->set_user($session['uid'],
-                      $session['session_key'],
-                      $session['expires'],
-                      isset($session_secret) ? $session_secret : null);
-    }
 
     return !empty($this->fb_params);
   }
@@ -309,11 +293,28 @@ class Facebook {
 
   // require_add and require_install have been removed.
   // see http://developer.facebook.com/news.php?blog=1&story=116 for more details
-  public function require_login() {
-    if ($user = $this->get_loggedin_user()) {
+  public function require_login($required_permissions = '') {
+    $user = $this->get_loggedin_user();
+    $has_permissions = true;
+
+    if ($required_permissions) {
+      $this->require_frame();
+      $permissions = array_map('trim', explode(',', $required_permissions));
+      foreach ($permissions as $permission) {
+        if (!in_array($permission, $this->ext_perms)) {
+          $has_permissions = false;
+          break;
+        }
+      }
+    }
+
+    if ($user && $has_permissions) {
       return $user;
     }
-    $this->redirect($this->get_login_url(self::current_url(), $this->in_frame()));
+
+    $this->redirect(
+      $this->get_login_url(self::current_url(), $this->in_frame(),
+                           $required_permissions));
   }
 
   public function require_frame() {
@@ -342,10 +343,11 @@ class Facebook {
     return $page . '?' . http_build_query($params);
   }
 
-  public function get_login_url($next, $canvas) {
+  public function get_login_url($next, $canvas, $req_perms = '') {
     $page = self::get_facebook_url().'/login.php';
-    $params = array('api_key' => $this->api_key,
-                    'v'       => '1.0');
+    $params = array('api_key'   => $this->api_key,
+                    'v'         => '1.0',
+                    'req_perms' => $req_perms);
 
     if ($next) {
       $params['next'] = $next;
diff --git a/plugins/Facebook/facebook/facebookapi_php5_restlib.php b/plugins/Facebook/facebook/facebookapi_php5_restlib.php
index fa1088cd0..e249a326b 100755
--- a/plugins/Facebook/facebook/facebookapi_php5_restlib.php
+++ b/plugins/Facebook/facebook/facebookapi_php5_restlib.php
@@ -569,7 +569,7 @@ function toggleDisplay(id, type) {
     return $this->call_method('facebook.events.invite',
                               array('eid' => $eid,
                                     'uids' => $uids,
-                                    'personal_message', $personal_message));
+                                    'personal_message' => $personal_message));
   }
 
   /**
@@ -1350,53 +1350,6 @@ function toggleDisplay(id, type) {
     );
   }
 
-  /**
-   * Dashboard API
-   */
-
-  /**
-   * Set the news for the specified user.
-   *
-   * @param int    $uid     The user for whom you are setting news for
-   * @param string $news    Text of news to display
-   *
-   * @return bool   Success
-   */
-  public function dashboard_setNews($uid, $news) {
-    return $this->call_method('facebook.dashboard.setNews',
-                              array('uid'  => $uid,
-                                    'news' => $news)
-                             );
-  }
-
-  /**
-   * Get the current news of the specified user.
-   *
-   * @param int    $uid     The user to get the news of
-   *
-   * @return string   The text of the current news for the user
-   */
-  public function dashboard_getNews($uid) {
-    return json_decode(
-      $this->call_method('facebook.dashboard.getNews',
-                         array('uid' => $uid)
-                        ), true);
-  }
-
-  /**
-   * Set the news for the specified user.
-   *
-   * @param int    $uid     The user you are clearing the news of
-   *
-   * @return bool   Success
-   */
-  public function dashboard_clearNews($uid) {
-    return $this->call_method('facebook.dashboard.clearNews',
-                              array('uid' => $uid)
-                             );
-  }
-
-
 
   /**
    * Creates a note with the specified title and content.
@@ -2005,7 +1958,7 @@ function toggleDisplay(id, type) {
    * @return  array  A list of strings describing any compile errors for the
    *                 submitted FBML
    */
-  function profile_setFBML($markup,
+  public function profile_setFBML($markup,
                            $uid=null,
                            $profile='',
                            $profile_action='',
@@ -3267,9 +3220,8 @@ function toggleDisplay(id, type) {
     } else {
       $get['v'] = '1.0';
     }
-    if (isset($this->use_ssl_resources) &&
-        $this->use_ssl_resources) {
-      $post['return_ssl_resources'] = true;
+    if (isset($this->use_ssl_resources)) {
+      $post['return_ssl_resources'] = (bool) $this->use_ssl_resources;
     }
     return array($get, $post);
   }
diff --git a/plugins/Facebook/facebooksettings.php b/plugins/Facebook/facebooksettings.php
index 766d0e199..f94a346b5 100644
--- a/plugins/Facebook/facebooksettings.php
+++ b/plugins/Facebook/facebooksettings.php
@@ -54,22 +54,11 @@ class FacebooksettingsAction extends FacebookAction
 
         $noticesync = $this->boolean('noticesync');
         $replysync  = $this->boolean('replysync');
-        $prefix     = $this->trimmed('prefix');
 
         $original = clone($this->flink);
         $this->flink->set_flags($noticesync, false, $replysync, false);
         $result = $this->flink->update($original);
 
-        if ($prefix == '' || $prefix == '0') {
-            // Facebook bug: saving empty strings to prefs now fails
-            // http://bugs.developers.facebook.com/show_bug.cgi?id=7110
-            $trimmed = $prefix . ' ';
-        } else {
-            $trimmed = substr($prefix, 0, 128);
-        }
-        $this->facebook->api_client->data_setUserPreference(FACEBOOK_NOTICE_PREFIX,
-            $trimmed);
-
         if ($result === false) {
             $this->showForm(_m('There was a problem saving your sync preferences!'));
         } else {
@@ -110,16 +99,6 @@ class FacebooksettingsAction extends FacebookAction
 
             $this->elementStart('li');
 
-            $prefix = trim($this->facebook->api_client->data_getUserPreference(FACEBOOK_NOTICE_PREFIX));
-
-            $this->input('prefix', _m('Prefix'),
-                         ($prefix) ? $prefix : null,
-                         _m('A string to prefix notices with.'));
-
-            $this->elementEnd('li');
-
-            $this->elementStart('li');
-
             $this->submit('save', _m('Save'));
 
             $this->elementEnd('li');
diff --git a/plugins/Facebook/facebookutil.php b/plugins/Facebook/facebookutil.php
index ac532e18b..1290fed55 100644
--- a/plugins/Facebook/facebookutil.php
+++ b/plugins/Facebook/facebookutil.php
@@ -81,97 +81,251 @@ function isFacebookBound($notice, $flink) {
 function facebookBroadcastNotice($notice)
 {
     $facebook = getFacebook();
-    $flink = Foreign_link::getByUserID($notice->profile_id, FACEBOOK_SERVICE);
+    $flink = Foreign_link::getByUserID(
+        $notice->profile_id,
+        FACEBOOK_SERVICE
+    );
 
     if (isFacebookBound($notice, $flink)) {
 
         // Okay, we're good to go, update the FB status
 
-        $status = null;
         $fbuid = $flink->foreign_id;
         $user = $flink->getUser();
-        $attachments  = $notice->attachments();
 
         try {
 
-            // Get the status 'verb' (prefix) the user has set
-
-            // XXX: Does this call count against our per user FB request limit?
-            // If so we should consider storing verb elsewhere or not storing
-
-            $prefix = trim($facebook->api_client->data_getUserPreference(FACEBOOK_NOTICE_PREFIX,
-                                                                         $fbuid));
-
-            $status = "$prefix $notice->content";
-
-            $can_publish = $facebook->api_client->users_hasAppPermission('publish_stream',
-                                                                         $fbuid);
-
-            $can_update  = $facebook->api_client->users_hasAppPermission('status_update',
-                                                                         $fbuid);
-            if (!empty($attachments) && $can_publish == 1) {
-                $fbattachment = format_attachments($attachments);
-                $facebook->api_client->stream_publish($status, $fbattachment,
-                                                      null, null, $fbuid);
-                common_log(LOG_INFO,
-                           "Posted notice $notice->id w/attachment " .
-                           "to Facebook user's stream (fbuid = $fbuid).");
-            } elseif ($can_update == 1 || $can_publish == 1) {
-                $facebook->api_client->users_setStatus($status, $fbuid, false, true);
-                common_log(LOG_INFO,
-                           "Posted notice $notice->id to Facebook " .
-                           "as a status update (fbuid = $fbuid).");
+            // Check permissions
+
+            common_debug(
+                'FacebookPlugin - checking for publish_stream permission for user '
+                . "$user->nickname ($user->id), Facebook UID: $fbuid"
+            );
+
+            // NOTE: $facebook->api_client->users_hasAppPermission('publish_stream', $fbuid)
+            // has been returning bogus results, so we're using FQL to check for
+            // publish_stream permission now
+
+            $fql = "SELECT publish_stream FROM permissions WHERE uid = $fbuid";
+            $result = $facebook->api_client->fql_query($fql);
+
+            $canPublish = 0;
+
+            if (!empty($result)) {
+                $canPublish = $result[0]['publish_stream'];
+            }
+
+            if ($canPublish == 1) {
+                common_debug(
+                    "FacebookPlugin - $user->nickname ($user->id), Facebook UID: $fbuid "
+                    . 'has publish_stream permission.'
+                );
+            } else {
+                common_debug(
+                    "FacebookPlugin - $user->nickname ($user->id), Facebook UID: $fbuid "
+                    . 'does NOT have publish_stream permission. Facebook '
+                    . 'returned: ' . var_export($result, true)
+                );
+            }
+
+            common_debug(
+                'FacebookPlugin - checking for status_update permission for user '
+                . "$user->nickname ($user->id), Facebook UID: $fbuid. "
+            );
+
+            $canUpdate = $facebook->api_client->users_hasAppPermission(
+                'status_update',
+                $fbuid
+            );
+
+            if ($canUpdate == 1) {
+                common_debug(
+                    "FacebookPlugin - $user->nickname ($user->id), Facebook UID: $fbuid "
+                    . 'has status_update permission.'
+                );
             } else {
-                $msg = "Not sending notice $notice->id to Facebook " .
-                  "because user $user->nickname hasn't given the " .
+                common_debug(
+                    "FacebookPlugin - $user->nickname ($user->id), Facebook UID: $fbuid "
+                    .'does NOT have status_update permission. Facebook '
+                    . 'returned: ' . var_export($canPublish, true)
+                );
+            }
+
+            // Post to Facebook
+
+            if ($notice->hasAttachments() && $canPublish == 1) {
+                publishStream($notice, $user, $fbuid);
+            } elseif ($canUpdate == 1 || $canPublish == 1) {
+                statusUpdate($notice, $user, $fbuid);
+            } else {
+                $msg = "FacebookPlugin - Not sending notice $notice->id to Facebook " .
+                  "because user $user->nickname has not given the " .
                   'Facebook app \'status_update\' or \'publish_stream\' permission.';
                 common_log(LOG_WARNING, $msg);
             }
 
             // Finally, attempt to update the user's profile box
 
-            if ($can_publish == 1 || $can_update == 1) {
-                updateProfileBox($facebook, $flink, $notice);
+            if ($canPublish == 1 || $canUpdate == 1) {
+                updateProfileBox($facebook, $flink, $notice, $user);
             }
 
         } catch (FacebookRestClientException $e) {
+            return handleFacebookError($e, $notice, $flink);
+        }
+    }
 
-            $code = $e->getCode();
-
-            $msg = "Facebook returned error code $code: " .
-              $e->getMessage() . ' - ' .
-              "Unable to update Facebook status (notice $notice->id) " .
-              "for $user->nickname (user id: $user->id)!";
+    return true;
+}
 
-            common_log(LOG_WARNING, $msg);
+function handleFacebookError($e, $notice, $flink)
+{
+    $fbuid  = $flink->foreign_id;
+    $user   = $flink->getUser();
+    $code   = $e->getCode();
+    $errmsg = $e->getMessage();
+
+    // XXX: Check for any others?
+    switch($code) {
+     case 100: // Invalid parameter
+        $msg = "FacebookPlugin - Facebook claims notice %d was posted with an invalid parameter (error code 100):"
+            . "\"%s\" (Notice details: nickname=%s, user ID=%d, Facebook ID=%d, notice content=\"%s\"). "
+            . "Removing notice from the Facebook queue for safety.";
+        common_log(
+            LOG_ERR, sprintf(
+                $msg,
+                $notice->id,
+                $errmsg,
+                $user->nickname,
+                $user->id,
+                $fbuid,
+                $notice->content
+            )
+        );
+        return true;
+        break;
+     case 200: // Permissions error
+     case 250: // Updating status requires the extended permission status_update
+        remove_facebook_app($flink);
+        return true; // dequeue
+        break;
+     case 341: // Feed action request limit reached
+            $msg = "FacebookPlugin - User %s (User ID=%d, Facebook ID=%d) has exceeded "
+                   . "his/her limit for posting notices to Facebook today. Dequeuing "
+                   . "notice %d.";
+            common_log(
+                LOG_INFO, sprintf(
+                    $msg,
+                    $user->nickname,
+                    $user->id,
+                    $fbuid,
+                    $notice->id
+                )
+            );
+	// @fixme: We want to rety at a later time when the throttling has expired
+	// instead of just giving up.
+        return true;
+        break;
+     default:
+        $msg = "FacebookPlugin - Facebook returned an error we don't know how to deal with while trying to "
+            . "post notice %d. Error code: %d, error message: \"%s\". (Notice details: "
+            . "nickname=%s, user ID=%d, Facebook ID=%d, notice content=\"%s\"). Removing notice "
+	    . "from the Facebook queue for safety.";
+        common_log(
+            LOG_ERR, sprintf(
+                $msg,
+                $notice->id,
+                $code,
+                $errmsg,
+                $user->nickname,
+                $user->id,
+                $fbuid,
+                $notice->content
+            )
+        );
+        return true; // dequeue
+        break;
+    }
+}
 
-            if ($code == 100 || $code == 200 || $code == 250) {
+function statusUpdate($notice, $user, $fbuid)
+{
+    common_debug(
+        "FacebookPlugin - Attempting to post notice $notice->id "
+        . "as a status update for $user->nickname ($user->id), "
+        . "Facebook UID: $fbuid"
+    );
 
-                // 100 The account is 'inactive' (probably - this is not well documented)
-                // 200 The application does not have permission to operate on the passed in uid parameter.
-                // 250 Updating status requires the extended permission status_update or publish_stream.
-                // see: http://wiki.developers.facebook.com/index.php/Users.setStatus#Example_Return_XML
+    $facebook = getFacebook();
+    $result = $facebook->api_client->users_setStatus(
+         $notice->content,
+         $fbuid,
+         false,
+         true
+    );
+
+    common_debug('Facebook returned: ' . var_export($result, true));
+
+    common_log(
+        LOG_INFO,
+        "FacebookPlugin - Posted notice $notice->id as a status "
+        . "update for $user->nickname ($user->id), "
+        . "Facebook UID: $fbuid"
+    );
+}
 
-                remove_facebook_app($flink);
+function publishStream($notice, $user, $fbuid)
+{
+    common_debug(
+        "FacebookPlugin - Attempting to post notice $notice->id "
+        . "as stream item with attachment for $user->nickname ($user->id), "
+        . "Facebook UID: $fbuid"
+    );
 
-        } else {
+    $fbattachment = format_attachments($notice->attachments());
 
-                // Try sending again later.
+    $facebook = getFacebook();
+    $facebook->api_client->stream_publish(
+        $notice->content,
+        $fbattachment,
+        null,
+        null,
+        $fbuid
+    );
+
+    common_log(
+        LOG_INFO,
+        "FacebookPlugin - Posted notice $notice->id as a stream "
+        . "item with attachment for $user->nickname ($user->id), "
+        . "Facebook UID: $fbuid"
+    );
+}
 
-                return false;
-            }
+function updateProfileBox($facebook, $flink, $notice, $user) {
 
-        }
-    }
+    $facebook = getFacebook();
+    $fbaction = new FacebookAction(
+        $output = 'php://output',
+        $indent = null,
+        $facebook,
+        $flink
+    );
 
-    return true;
+    $fbuid = $flink->foreign_id;
 
-}
+    common_debug(
+          'FacebookPlugin - Attempting to update profile box with '
+          . "content from notice $notice->id for $user->nickname ($user->id), "
+          . "Facebook UID: $fbuid"
+    );
 
-function updateProfileBox($facebook, $flink, $notice) {
-    $fbaction = new FacebookAction($output = 'php://output',
-                                   $indent = null, $facebook, $flink);
     $fbaction->updateProfileBox($notice);
+
+    common_debug(
+        'FacebookPlugin - finished updating profile box for '
+        . "$user->nickname ($user->id) Facebook UID: $fbuid"
+    );
+
 }
 
 function format_attachments($attachments)
@@ -272,12 +426,12 @@ function remove_facebook_app($flink)
 
 function mail_facebook_app_removed($user)
 {
-    common_init_locale($user->language);
-
     $profile = $user->getProfile();
 
     $site_name = common_config('site', 'name');
 
+    common_switch_locale($user->language);
+
     $subject = sprintf(
         _m('Your %1$s Facebook application access has been disabled.',
             $site_name));
@@ -291,7 +445,7 @@ function mail_facebook_app_removed($user)
         "re-installing the %2\$s Facebook application.\n\nRegards,\n\n%2\$s"),
         $user->nickname, $site_name);
 
-    common_init_locale();
+    common_switch_locale();
     return mail_to_user($user, $subject, $body);
 
 }
diff --git a/plugins/Facebook/locale/Facebook.po b/plugins/Facebook/locale/Facebook.pot
index 4bc00248c..dce10d230 100644
--- a/plugins/Facebook/locale/Facebook.po
+++ b/plugins/Facebook/locale/Facebook.pot
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2010-03-01 14:58-0800\n"
+"POT-Creation-Date: 2010-04-29 23:39+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -16,72 +16,129 @@ msgstr ""
 "Content-Type: text/plain; charset=CHARSET\n"
 "Content-Transfer-Encoding: 8bit\n"
 
-#: facebookaction.php:171
-msgid "Home"
+#: facebookutil.php:285
+#, php-format
+msgid ""
+"Hi, %1$s. We're sorry to inform you that we are unable to update your "
+"Facebook status from %2$s, and have disabled the Facebook application for "
+"your account. This may be because you have removed the Facebook "
+"application's authorization, or have deleted your Facebook account.  You can "
+"re-enable the Facebook application and automatic status updating by re-"
+"installing the %2$s Facebook application.\n"
+"\n"
+"Regards,\n"
+"\n"
+"%2$s"
 msgstr ""
 
-#: facebookaction.php:179
-msgid "Invite"
+#: FBConnectAuth.php:51
+msgid "You must be logged into Facebook to use Facebook Connect."
 msgstr ""
 
-#: facebookaction.php:188
-msgid "Settings"
+#: FBConnectAuth.php:77
+msgid "There is already a local user linked with this Facebook."
 msgstr ""
 
-#: facebookaction.php:228
+#: FBConnectAuth.php:90 FBConnectSettings.php:164
+msgid "There was a problem with your session token. Try again, please."
+msgstr ""
+
+#: FBConnectAuth.php:95
+msgid "You can't register if you don't agree to the license."
+msgstr ""
+
+#: FBConnectAuth.php:105
+msgid "Something weird happened."
+msgstr ""
+
+#: FBConnectAuth.php:119
 #, php-format
 msgid ""
-"To use the %s Facebook Application you need to login with your username and "
-"password. Don't have a username yet? "
+"This is the first time you've logged into %s so we must connect your "
+"Facebook to a local account. You can either create a new account, or connect "
+"with your existing account, if you have one."
 msgstr ""
 
-#: facebookaction.php:230
-msgid " a new account."
+#: FBConnectAuth.php:125
+msgid "Facebook Account Setup"
 msgstr ""
 
-#: facebookaction.php:236
-msgid "Register"
+#: FBConnectAuth.php:158
+msgid "Connection options"
 msgstr ""
 
-#: facebookaction.php:249 facebookaction.php:275 facebooklogin.php:91
-msgid "Login"
+#: FBConnectAuth.php:183
+msgid "Create new account"
 msgstr ""
 
-#: facebookaction.php:268
-msgid "Nickname"
+#: FBConnectAuth.php:185
+msgid "Create a new user with this nickname."
 msgstr ""
 
-#: facebookaction.php:271 FBConnectAuth.php:196
+#: FBConnectAuth.php:188
+msgid "New nickname"
+msgstr ""
+
+#: FBConnectAuth.php:190
+msgid "1-64 lowercase letters or numbers, no punctuation or spaces"
+msgstr ""
+
+#: FBConnectAuth.php:193
+msgid "Create"
+msgstr ""
+
+#: FBConnectAuth.php:198
+msgid "Connect existing account"
+msgstr ""
+
+#: FBConnectAuth.php:200
+msgid ""
+"If you already have an account, login with your username and password to "
+"connect it to your Facebook."
+msgstr ""
+
+#: FBConnectAuth.php:203
+msgid "Existing nickname"
+msgstr ""
+
+#: FBConnectAuth.php:206 facebookaction.php:271
 msgid "Password"
 msgstr ""
 
-#: facebookaction.php:281
-msgid "Lost or forgotten password?"
+#: FBConnectAuth.php:209
+msgid "Connect"
 msgstr ""
 
-#: facebookaction.php:330 facebookhome.php:248
-msgid "Pagination"
+#: FBConnectAuth.php:225 FBConnectAuth.php:234
+msgid "Registration not allowed."
 msgstr ""
 
-#: facebookaction.php:339 facebookhome.php:257
-msgid "After"
+#: FBConnectAuth.php:241
+msgid "Not a valid invitation code."
 msgstr ""
 
-#: facebookaction.php:347 facebookhome.php:265
-msgid "Before"
+#: FBConnectAuth.php:251
+msgid "Nickname must have only lowercase letters and numbers and no spaces."
 msgstr ""
 
-#: facebookaction.php:365
-msgid "No notice content!"
+#: FBConnectAuth.php:256
+msgid "Nickname not allowed."
 msgstr ""
 
-#: facebookaction.php:371
-#, php-format
-msgid "That's too long. Max notice size is %d chars."
+#: FBConnectAuth.php:261
+msgid "Nickname already in use. Try another one."
 msgstr ""
 
-#: facebookaction.php:430
-msgid "Notices"
+#: FBConnectAuth.php:279 FBConnectAuth.php:313 FBConnectAuth.php:333
+msgid "Error connecting user to Facebook."
+msgstr ""
+
+#: FBConnectAuth.php:299
+msgid "Invalid username or password."
+msgstr ""
+
+#: facebooklogin.php:91 facebookaction.php:249 facebookaction.php:275
+msgid "Login"
 msgstr ""
 
 #: facebookhome.php:111
@@ -117,6 +174,18 @@ msgstr ""
 msgid "Skip"
 msgstr ""
 
+#: facebookhome.php:248 facebookaction.php:330
+msgid "Pagination"
+msgstr ""
+
+#: facebookhome.php:257 facebookaction.php:339
+msgid "After"
+msgstr ""
+
+#: facebookhome.php:265 facebookaction.php:347
+msgid "Before"
+msgstr ""
+
 #: facebookinvite.php:72
 #, php-format
 msgid "Thanks for inviting your friends to use %s"
@@ -145,208 +214,123 @@ msgstr ""
 msgid "Send invitations"
 msgstr ""
 
-#: FacebookPlugin.php:413 FacebookPlugin.php:433
+#: FacebookPlugin.php:195 FacebookPlugin.php:488 FacebookPlugin.php:510
+#: facebookadminpanel.php:54
 msgid "Facebook"
 msgstr ""
 
-#: FacebookPlugin.php:414
+#: FacebookPlugin.php:196
+msgid "Facebook integration configuration"
+msgstr ""
+
+#: FacebookPlugin.php:489
 msgid "Login or register using Facebook"
 msgstr ""
 
-#: FacebookPlugin.php:434 FBConnectSettings.php:56
+#: FacebookPlugin.php:511 FBConnectSettings.php:56
 msgid "Facebook Connect Settings"
 msgstr ""
 
-#: FacebookPlugin.php:533
+#: FacebookPlugin.php:617
 msgid ""
 "The Facebook plugin allows you to integrate your StatusNet instance with <a "
 "href=\"http://facebook.com/\">Facebook</a> and Facebook Connect."
 msgstr ""
 
-#: facebookremove.php:58
-msgid "Couldn't remove Facebook user."
-msgstr ""
-
-#: facebooksettings.php:74
-msgid "There was a problem saving your sync preferences!"
-msgstr ""
-
-#: facebooksettings.php:76
-msgid "Sync preferences saved."
-msgstr ""
-
-#: facebooksettings.php:99
-msgid "Automatically update my Facebook status with my notices."
-msgstr ""
-
-#: facebooksettings.php:106
-msgid "Send \"@\" replies to Facebook."
+#: FBConnectLogin.php:33
+msgid "Already logged in."
 msgstr ""
 
-#: facebooksettings.php:115
-msgid "Prefix"
+#: FBConnectLogin.php:41
+msgid "Login with your Facebook Account"
 msgstr ""
 
-#: facebooksettings.php:117
-msgid "A string to prefix notices with."
+#: FBConnectLogin.php:55
+msgid "Facebook Login"
 msgstr ""
 
-#: facebooksettings.php:123
-msgid "Save"
+#: facebookremove.php:58
+msgid "Couldn't remove Facebook user."
 msgstr ""
 
-#: facebooksettings.php:133
-#, php-format
-msgid ""
-"If you would like %s to automatically update your Facebook status with your "
-"latest notice, you need to give it permission."
+#: facebookaction.php:171
+msgid "Home"
 msgstr ""
 
-#: facebooksettings.php:146
-#, php-format
-msgid "Allow %s to update my Facebook status"
+#: facebookaction.php:179
+msgid "Invite"
 msgstr ""
 
-#: facebooksettings.php:156
-msgid "Sync preferences"
+#: facebookaction.php:188
+msgid "Settings"
 msgstr ""
 
-#: facebookutil.php:285
+#: facebookaction.php:228
 #, php-format
 msgid ""
-"Hi, %1$s. We're sorry to inform you that we are unable to update your "
-"Facebook status from %2$s, and have disabled the Facebook application for "
-"your account. This may be because you have removed the Facebook "
-"application's authorization, or have deleted your Facebook account.  You can "
-"re-enable the Facebook application and automatic status updating by re-"
-"installing the %2$s Facebook application.\n"
-"\n"
-"Regards,\n"
-"\n"
-"%2$s"
+"To use the %s Facebook Application you need to login with your username and "
+"password. Don't have a username yet? "
 msgstr ""
 
-#: FBConnectAuth.php:51
-msgid "You must be logged into Facebook to use Facebook Connect."
+#: facebookaction.php:230
+msgid " a new account."
 msgstr ""
 
-#: FBConnectAuth.php:77
-msgid "There is already a local user linked with this Facebook."
+#: facebookaction.php:236
+msgid "Register"
 msgstr ""
 
-#: FBConnectAuth.php:90 FBConnectSettings.php:164
-msgid "There was a problem with your session token. Try again, please."
+#: facebookaction.php:268
+msgid "Nickname"
 msgstr ""
 
-#: FBConnectAuth.php:95
-msgid "You can't register if you don't agree to the license."
+#: facebookaction.php:281
+msgid "Lost or forgotten password?"
 msgstr ""
 
-#: FBConnectAuth.php:105
-msgid "Something weird happened."
+#: facebookaction.php:365
+msgid "No notice content!"
 msgstr ""
 
-#: FBConnectAuth.php:119
+#: facebookaction.php:371
 #, php-format
-msgid ""
-"This is the first time you've logged into %s so we must connect your "
-"Facebook to a local account. You can either create a new account, or connect "
-"with your existing account, if you have one."
-msgstr ""
-
-#: FBConnectAuth.php:125
-msgid "Facebook Account Setup"
-msgstr ""
-
-#: FBConnectAuth.php:153
-msgid "Connection options"
-msgstr ""
-
-#: FBConnectAuth.php:162
-msgid "My text and files are available under "
-msgstr ""
-
-#: FBConnectAuth.php:165
-msgid ""
-" except this private data: password, email address, IM address, phone number."
-msgstr ""
-
-#: FBConnectAuth.php:173
-msgid "Create new account"
-msgstr ""
-
-#: FBConnectAuth.php:175
-msgid "Create a new user with this nickname."
-msgstr ""
-
-#: FBConnectAuth.php:178
-msgid "New nickname"
-msgstr ""
-
-#: FBConnectAuth.php:180
-msgid "1-64 lowercase letters or numbers, no punctuation or spaces"
-msgstr ""
-
-#: FBConnectAuth.php:183
-msgid "Create"
-msgstr ""
-
-#: FBConnectAuth.php:188
-msgid "Connect existing account"
-msgstr ""
-
-#: FBConnectAuth.php:190
-msgid ""
-"If you already have an account, login with your username and password to "
-"connect it to your Facebook."
-msgstr ""
-
-#: FBConnectAuth.php:193
-msgid "Existing nickname"
-msgstr ""
-
-#: FBConnectAuth.php:199
-msgid "Connect"
-msgstr ""
-
-#: FBConnectAuth.php:215 FBConnectAuth.php:224
-msgid "Registration not allowed."
+msgid "That's too long. Max notice size is %d chars."
 msgstr ""
 
-#: FBConnectAuth.php:231
-msgid "Not a valid invitation code."
+#: facebookaction.php:430
+msgid "Notices"
 msgstr ""
 
-#: FBConnectAuth.php:241
-msgid "Nickname must have only lowercase letters and numbers and no spaces."
+#: facebookadminpanel.php:65
+msgid "Facebook integration settings"
 msgstr ""
 
-#: FBConnectAuth.php:246
-msgid "Nickname not allowed."
+#: facebookadminpanel.php:129
+msgid "Invalid Facebook API key. Max length is 255 characters."
 msgstr ""
 
-#: FBConnectAuth.php:251
-msgid "Nickname already in use. Try another one."
+#: facebookadminpanel.php:135
+msgid "Invalid Facebook API secret. Max length is 255 characters."
 msgstr ""
 
-#: FBConnectAuth.php:269 FBConnectAuth.php:303 FBConnectAuth.php:323
-msgid "Error connecting user to Facebook."
+#: facebookadminpanel.php:188
+msgid "Facebook application settings"
 msgstr ""
 
-#: FBConnectAuth.php:289
-msgid "Invalid username or password."
+#: facebookadminpanel.php:194
+msgid "API key"
 msgstr ""
 
-#: FBConnectLogin.php:33
-msgid "Already logged in."
+#: facebookadminpanel.php:195
+msgid "API key provided by Facebook"
 msgstr ""
 
-#: FBConnectLogin.php:41
-msgid "Login with your Facebook Account"
+#: facebookadminpanel.php:203
+msgid "Secret"
 msgstr ""
 
-#: FBConnectLogin.php:55
-msgid "Facebook Login"
+#: facebookadminpanel.php:204
+msgid "API secret provided by Facebook"
 msgstr ""
 
 #: FBConnectSettings.php:67
@@ -393,3 +377,47 @@ msgstr ""
 #: FBConnectSettings.php:197
 msgid "Not sure what you're trying to do."
 msgstr ""
+
+#: facebooksettings.php:74
+msgid "There was a problem saving your sync preferences!"
+msgstr ""
+
+#: facebooksettings.php:76
+msgid "Sync preferences saved."
+msgstr ""
+
+#: facebooksettings.php:99
+msgid "Automatically update my Facebook status with my notices."
+msgstr ""
+
+#: facebooksettings.php:106
+msgid "Send \"@\" replies to Facebook."
+msgstr ""
+
+#: facebooksettings.php:115
+msgid "Prefix"
+msgstr ""
+
+#: facebooksettings.php:117
+msgid "A string to prefix notices with."
+msgstr ""
+
+#: facebooksettings.php:123
+msgid "Save"
+msgstr ""
+
+#: facebooksettings.php:133
+#, php-format
+msgid ""
+"If you would like %s to automatically update your Facebook status with your "
+"latest notice, you need to give it permission."
+msgstr ""
+
+#: facebooksettings.php:146
+#, php-format
+msgid "Allow %s to update my Facebook status"
+msgstr ""
+
+#: facebooksettings.php:156
+msgid "Sync preferences"
+msgstr ""