Feature/use get method for get

[nayakravi]

We have encountered issues with certain Graph API calls where in we encounter an error of the form (#3) Application does not have the capability to make this API call". There have been multiple tickets logged with facebook for this, but there's been no resolution. In our case, we were able to resolve this by used the GET http method to make GET API calls rather than the POST method used by default in this library. Its impossible to figure out if this is systemic or triggered under specific circumstances.
This PR provides an option to use the GET HTTP method to make GET API calls to at least provide an option to work around these errors.

[huandu]

I don't quite understand what's the problem. Can you please give me a sample case in which a graph API must be called with HTTP GET request?

[AlphaB]

Hi! We got exactly the same problem. For some reason sometimes requesting info about ad account using POST method instead of GET method results in (#3) Application does not have the capability to make this API call. error.
I couldn't find any similar issues in facebook bug reporting system. But I think Facebook will respond with something like "Just use GET when you mean GET".
BTW why did you decided to use POST instead of plain GET request in the first place?

[nayakravi]

Sorry, this fell off my radar until I saw this last comment in my email.
So @huandu - just as an example, if we run:

POST https://graph.facebook.com/v3.0/<fb user ID>/adaccounts with the body containing:
fields: id,name,account_status,business
format: json
method: GET
access_token: <user access token with appropriate permissions>

for my user account, this works fine. However, for another user in our company, it generates the error I specified in the original report. Like I said earlier, its hard to figure out why this happens - the only thing we could find is that when we use the GET method, the problem never occurs. We have now been running this code in production since the day I submitted this PR and never had a single problem. Whereas, prior to this, we had multiple users report this. Note that if this problem does occur for a user, it consistently occurs - so there's something about user access tokens that triggers this, but its hard to determine what that is.
Also, just as a note, I tried with various permutations to determine what causes this - for example, I tried to only retrieve the id field to determine if we were running into some permission issues with one of the fields, but the only way I could reproduce this problem was to use the POST method.
HTH.

Ravi

[robbiet480]

Just a thought on why you are seeing different behavior depending on the user: Possibly because some are Facebook developers (or for that matter, verified developers) and some aren't?

[nayakravi]

Interesting theory - I just tested this, but that's not it.
I could reproduce the problem using my co-workers FB account - the exact error is:

{
    "error": {
        "message": "(#3) Application does not have the capability to make this API call.",
        "type": "OAuthException",
        "code": 3,
        "fbtrace_id": "DlGUBOs3mZF"
    }
}

He and I both have verified facebook developer accounts and the problem does not occur for my account.

[robbiet480]

Different access levels on the ad account?

I'd search the bugs and open one if you can't find anything instead of modifying the library as POSTing every call is accepted behavior and this feels more like a bug then some intended edge case.

[huandu]

@nayakravi Your case looks quite interesting.

If this design introduces some bad cases, I can update code to send all GET request with HTTP GET. Sending GET request with HTTP POST is a design choice to make code of this package a bit simpler. It can be changed easily.

I don't think it's OK to add an option like UseGetMethodForGetRequests as it's quite confusing and not necessary. I read facebook official PHP SDK. A GET request is always sent by HTTP GET in this SDK.

[robbiet480]

@nayakravi Oh, three other questions:

1. Are you using the same application for both your user account and co-workers? Just noticed the error is about the application specifically.
2. Do you and your co-worker have different roles on the application?
3. Is the application owned by the business?

I ask all of this because I can try to get a repro case together and provide you for a FB bug submission, which I still think this belongs as.

I agree with @huandu though, follow the PHP SDK standards when at all possible, do not add this extra option to control GET vs. POST behavior.

[nayakravi]

Thank you @huandu - that is the best solution - my approach was to ensure I encountered least resistance to this change.

• ravi

[nayakravi]

@robbiet480 - here's answers to your questions:

Are you using the same application for both your user account and co-workers? Just noticed the error is about the application specifically. - both use the same application
Do you and your co-worker have different roles on the application? - both have admin roles on the app
Is the application owned by the business? - yes