Extra-Chill · chubes4 · Apr 3, 2026 · Apr 3, 2026
diff --git a/DataMachineSocials/Abilities/Traits/HasCheckPermission.php b/DataMachineSocials/Abilities/Traits/HasCheckPermission.php
@@ -0,0 +1,16 @@
+<?php
+
+namespace DataMachineSocials\Abilities\Traits;
+
+use DataMachine\Abilities\PermissionHelper;
+
+/**
+ * Shared trait for the `checkPermission` method.
+ *
+ * Extracted by homeboy audit --fix from duplicate implementations.
+ */
+trait HasCheckPermission {
+	public function checkPermission(): bool {
+		return PermissionHelper::can_manage();
+	}
+}
diff --git a/DataMachineSocials/Handlers/Traits/HasGetAccountDetails.php b/DataMachineSocials/Handlers/Traits/HasGetAccountDetails.php
@@ -0,0 +1,23 @@
+<?php
+
+namespace DataMachineSocials\Handlers\Traits;
+
+/**
+ * Shared trait for the `get_account_details` method.
+ *
+ * Extracted by homeboy audit --fix from duplicate implementations.
+ */
+trait HasGetAccountDetails {
+	/**
+	* Get stored Threads account details
+	*
+	* @return array|null Account details or null
+	*/
+	public function get_account_details(): ?array {
+		$account = $this->get_account();
+		if ( empty( $account ) || ! is_array( $account ) ) {
+			return null;
+		}
+		return $account;
+	}
+}
diff --git a/DataMachineSocials/Handlers/Traits/HasRemoveAccount.php b/DataMachineSocials/Handlers/Traits/HasRemoveAccount.php
@@ -0,0 +1,19 @@
+<?php
+
+namespace DataMachineSocials\Handlers\Traits;
+
+/**
+ * Shared trait for the `remove_account` method.
+ *
+ * Extracted by homeboy audit --fix from duplicate implementations.
+ */
+trait HasRemoveAccount {
+	/**
+	 * Remove stored Reddit account details
+	 *
+	 * @return bool Success status
+	 */
+	public function remove_account(): bool {
+		return $this->clear_account();
+	}
+}
diff --git a/homeboy.json b/homeboy.json
diff --git a/inc/Abilities/Bluesky/BlueskyDeleteAbility.php b/inc/Abilities/Bluesky/BlueskyDeleteAbility.php
@@ -13,10 +13,13 @@
 
 use DataMachine\Abilities\PermissionHelper;
 use DataMachineSocials\Handlers\Bluesky\BlueskyAuth;
+use DataMachineSocials\Abilities\Traits\HasCheckPermission;
 
 defined( 'ABSPATH' ) || exit;
 
 class BlueskyDeleteAbility {
+	use HasCheckPermission;
+
 
 	private static bool $registered = false;
 
@@ -73,10 +76,6 @@ private function registerAbilities(): void {
 		}
 	}
 
-	public function checkPermission(): bool {
-		return PermissionHelper::can_manage();
-	}
-
 	public function execute( array $input ): array|\WP_Error {
 		$auth = $this->getAuthProvider();
 		if ( ! $auth ) {

diff --git a/inc/Abilities/Bluesky/BlueskyPublishAbility.php b/inc/Abilities/Bluesky/BlueskyPublishAbility.php
@@ -434,4 +434,85 @@ private static function fetch_og_tags( string $url ): array|\WP_Error {
 
 		return $og;
 	}
+
+	public function checkPermission(): bool {
+		return PermissionHelper::can_manage();
+	}
+
+	private function getAuthProvider(): ?BlueskyAuth {
+		if ( ! class_exists( '\DataMachine\Abilities\AuthAbilities' ) ) {
+			return null;
+		}
+
+		$auth     = new \DataMachine\Abilities\AuthAbilities();
+		$provider = $auth->getProvider( 'bluesky' );
+
+		if ( ! $provider instanceof BlueskyAuth ) {
+			return null;
+		}
+
+		return $provider;
+	}
+
+	public function execute( array $input ): array|\WP_Error {
+		$auth = $this->getAuthProvider();
+		if ( ! $auth ) {
+			return new \WP_Error( 'missing_auth', 'Bluesky auth provider not available', array( 'status' => 401 ) );
+		}
+
+		$session = $auth->get_session();
+		if ( empty( $session['accessJwt'] ) ) {
+			return new \WP_Error( 'missing_auth', 'Bluesky session not available', array( 'status' => 401 ) );
+		}
+
+		if ( empty( $input['post_uri'] ) ) {
+			return new \WP_Error( 'missing_param', 'post_uri is required', array( 'status' => 400 ) );
+		}
+
+		$did = $session['did'];
+
+		// Parse rkey from AT URI: at://did:plc:xxx/app.bsky.feed.post/rkey
+		$post_uri  = $input['post_uri'];
+		$uri_parts = explode( '/', $post_uri );
+		$rkey      = end( $uri_parts );
+
+		if ( empty( $rkey ) ) {
+			return new \WP_Error( 'api_error', 'Could not extract rkey from post URI: ' . $post_uri, array( 'status' => 500 ) );
+		}
+
+		$response = wp_remote_post(
+			'https://bsky.social/xrpc/com.atproto.repo.deleteRecord',
+			array(
+				'timeout' => 30,
+				'headers' => array(
+					'Authorization' => 'Bearer ' . $session['accessJwt'],
+					'Content-Type'  => 'application/json',
+				),
+				'body'    => wp_json_encode( array(
+					'repo'       => $did,
+					'collection' => 'app.bsky.feed.post',
+					'rkey'       => $rkey,
+				) ),
+			)
+		);
+
+		if ( is_wp_error( $response ) ) {
+			return new \WP_Error( 'api_error', $response->get_error_message(), array( 'status' => 500 ) );
+		}
+
+		$status_code = wp_remote_retrieve_response_code( $response );
+
+		if ( 200 === $status_code || 204 === $status_code ) {
+			return array(
+				'success' => true,
+				'data'    => array(
+					'post_uri' => $input['post_uri'],
+					'deleted'  => true,
+				),
+			);
+		}
+
+		$body = json_decode( wp_remote_retrieve_body( $response ), true );
+		return new \WP_Error( 'api_error', $body['error'] ?? 'Failed to delete post', array( 'status' => 500 ) );
+	}
 }
diff --git a/inc/Abilities/Bluesky/BlueskyReadAbility.php b/inc/Abilities/Bluesky/BlueskyReadAbility.php
@@ -15,10 +15,13 @@
 use DataMachine\Abilities\PermissionHelper;
 use DataMachine\Core\HttpClient;
 use DataMachineSocials\Handlers\Bluesky\BlueskyAuth;
+use DataMachineSocials\Abilities\Traits\HasCheckPermission;
 
 defined( 'ABSPATH' ) || exit;
 
 class BlueskyReadAbility {
+	use HasCheckPermission;
+
 
 	private static bool $registered = false;
 
@@ -89,10 +92,6 @@ private function registerAbilities(): void {
 		}
 	}
 
-	public function checkPermission(): bool {
-		return PermissionHelper::can_manage();
-	}
-
 	public function execute( array $input ): array|\WP_Error {
 		$action = $input['action'] ?? 'list';
 

diff --git a/inc/Abilities/Bluesky/BlueskyUpdateAbility.php b/inc/Abilities/Bluesky/BlueskyUpdateAbility.php
@@ -14,10 +14,14 @@
 
 use DataMachine\Abilities\PermissionHelper;
 use DataMachineSocials\Handlers\Bluesky\BlueskyAuth;
+use DataMachineSocials\Abilities\Traits\HasCheckPermission;
+use DataMachineSocials\Abilities\Bluesky\BlueskyDeleteAbility;
 
 defined( 'ABSPATH' ) || exit;
 
 class BlueskyUpdateAbility {
+	use HasCheckPermission;
+
 
 	private static bool $registered = false;
 
@@ -79,10 +83,6 @@ private function registerAbilities(): void {
 		}
 	}
 
-	public function checkPermission(): bool {
-		return PermissionHelper::can_manage();
-	}
-
 	public function execute( array $input ): array|\WP_Error {
 		$action = $input['action'] ?? '';
 
@@ -117,21 +117,6 @@ public function execute( array $input ): array|\WP_Error {
 		}
 	}
 
-	private function getAuthProvider(): ?BlueskyAuth {
-		if ( ! class_exists( '\DataMachine\Abilities\AuthAbilities' ) ) {
-			return null;
-		}
-
-		$auth     = new \DataMachine\Abilities\AuthAbilities();
-		$provider = $auth->getProvider( 'bluesky' );
-
-		if ( ! $provider instanceof BlueskyAuth ) {
-			return null;
-		}
-
-		return $provider;
-	}
-
 	private function deletePost( array $session, string $post_uri ): array|\WP_Error {
 		$pds_url = $session['pds_url'];
 		$did     = $session['did'];

diff --git a/inc/Abilities/Facebook/FacebookDeleteAbility.php b/inc/Abilities/Facebook/FacebookDeleteAbility.php
@@ -13,10 +13,13 @@
 
 use DataMachine\Abilities\PermissionHelper;
 use DataMachineSocials\Handlers\Facebook\FacebookAuth;
+use DataMachineSocials\Abilities\Traits\HasCheckPermission;
 
 defined( 'ABSPATH' ) || exit;
 
 class FacebookDeleteAbility {
+	use HasCheckPermission;
+
 
 	private static bool $registered = false;
 
@@ -75,10 +78,6 @@ private function registerAbilities(): void {
 		}
 	}
 
-	public function checkPermission(): bool {
-		return PermissionHelper::can_manage();
-	}
-
 	public function execute( array $input ): array|\WP_Error {
 		$auth = $this->getAuthProvider();
 		if ( ! $auth ) {

diff --git a/inc/Abilities/Facebook/FacebookPublishAbility.php b/inc/Abilities/Facebook/FacebookPublishAbility.php
@@ -358,4 +358,54 @@ private static function post_comment( string $post_id, string $message, string $
 	private static function build_graph_url( string $path ): string {
 		return 'https://graph.facebook.com/v23.0/' . ltrim( $path, '/' );
 	}
+
+	private function getAuthProvider(): ?FacebookAuth {
+		$auth_abilities = new \DataMachine\Abilities\AuthAbilities();
+		$provider       = $auth_abilities->getProvider( 'facebook' );
+
+		if ( $provider instanceof FacebookAuth ) {
+			return $provider;
+		}
+
+		return null;
+	}
+
+	public function checkPermission(): bool {
+		return PermissionHelper::can_manage();
+	}
+
+	public function execute( array $input ): array|\WP_Error {
+		$action = $input['action'] ?? 'list';
+
+		$auth = $this->getAuthProvider();
+		if ( ! $auth ) {
+			return new \WP_Error( 'missing_auth', 'Facebook auth provider not available', array( 'status' => 401 ) );
+		}
+
+		// Facebook uses page_access_token for page operations.
+		$page_token = $auth->get_page_access_token();
+		if ( empty( $page_token ) ) {
+			return new \WP_Error( 'missing_auth', 'Facebook page access token unavailable (expired or refresh failed)', array( 'status' => 401 ) );
+		}
+
+		switch ( $action ) {
+			case 'list':
+				return $this->listPosts( $auth, $page_token, $input );
+
+			case 'get':
+				if ( empty( $input['post_id'] ) ) {
+					return new \WP_Error( 'missing_param', 'post_id is required for the get action', array( 'status' => 400 ) );
+				}
+				return $this->getPost( $page_token, $input['post_id'] );
+
+			case 'comments':
+				if ( empty( $input['post_id'] ) ) {
+					return new \WP_Error( 'missing_param', 'post_id is required for the comments action', array( 'status' => 400 ) );
+				}
+				return $this->getComments( $page_token, $input['post_id'], $input );
+
+			default:
+				return new \WP_Error( 'api_error', "Unknown action: {$action}. Use list, get, or comments.", array( 'status' => 500 ) );
+		}
+	}
 }
diff --git a/inc/Abilities/Facebook/FacebookReadAbility.php b/inc/Abilities/Facebook/FacebookReadAbility.php
@@ -15,10 +15,13 @@
 use DataMachine\Abilities\PermissionHelper;
 use DataMachine\Core\HttpClient;
 use DataMachineSocials\Handlers\Facebook\FacebookAuth;
+use DataMachineSocials\Abilities\Traits\HasCheckPermission;
 
 defined( 'ABSPATH' ) || exit;
 
 class FacebookReadAbility {
+	use HasCheckPermission;
+
 
 	private static bool $registered = false;
 
@@ -93,10 +96,6 @@ private function registerAbilities(): void {
 		}
 	}
 
-	public function checkPermission(): bool {
-		return PermissionHelper::can_manage();
-	}
-
 	public function execute( array $input ): array|\WP_Error {
 		$action = $input['action'] ?? 'list';