REST API connected to Facebook - php

Question

I'm currently developing a REST API on my webserver for handling calls towards a Facebook application. This way I can check if the user has a valid license in our license database before allowing him/her to post to Facebook.
I'm using two separate calls at the moment, one to authorize the client with Facebook and store his/her access token in our license database. And another to actually publish to Facebook (and also other social platforms).
The Authorization seems to work. But the publishing always returns
{
"success": false,
"error": {
"message": "(#200) User must have accepted TOS",
"type": "FacebookRequestAppException",
"code": 200
}
}
I am currently working with a development app (on Facebook), without the proper permissions submitted, would this be the issue? And if so, how can I test it if I'm not allowed to use it?
The PHP code that triggers the Exception:
try {
$app = ( new FacebookRequest($app_session, 'POST', $post_url, array( 'appsecret_proof' => $appsecret_proof ) ) )->execute()->getGraphObject();
$output = array_merge( array( 'success' => true ), $output );
} catch(FacebookRequestException $e) {
$output = array_merge( $output, array( 'success' => false, 'error' => array( 'message' => $e->getMessage(), 'type'=> 'FacebookRequestAppException', 'code' => $e->getCode() ) ) );
}
Edit:
The call:
$app_id = '1503912413161954';
$app_secret = '<app_secret_censored>';
$user_access_token = (string)$this->getIdentity()->facebook_token;
$app_access_token = (string)$this->getIdentity()->facebook_app_token;
$license_id = (int)$this->getIdentity()->license_id;
$user_account_type = (string)$this->getIdentity()->user_account_type;
$redirect_url = 'http://api.example.com/authorize';
include 'lib/fb_authorize.php';
The authorization code - have in mind that it's not yet complete, and that I'm using Yii Framwork as well to add connectivity to our database:
<?php
$http_session = new CHttpSession;
$http_session->setTimeout(60);
$http_session->setSessionName('fb_session');
$http_session->open();
require( 'vendor/autoload.php' );
use Facebook\FacebookRedirectLoginHelper;
use Facebook\FacebookSession;
use Facebook\FacebookRequest;
use Facebook\FacebookResponse;
use Facebook\FacebookSDKException;
use Facebook\FacebookRequestException;
use Facebook\FacebookAuthorizationException;
use Facebook\GraphObject;
use Facebook\GraphUser;
use Facebook\FacebookHttpable;
use Facebook\FacebookCurl;
use Facebook\FacebookCurlHttpClient;
FacebookSession::setDefaultApplication($app_id, $app_secret);
$helper = new FacebookRedirectLoginHelper($redirect_url, $app_id, $app_secret);
if ( isset( $user_access_token ) ) {
$user_session = new FacebookSession( $user_access_token );
try {
if ( !$user_session->validate() ) {
$user_session = null;
}
} catch ( Exception $e ) {
$user_session = null;
$output = array_merge( $output, array( 'success' => false, 'error' => array( 'message' => $e->getMessage(), 'type'=> 'ExxicaUserSessionException', 'code' => $e->getCode() ) ) );
}
} else {
try {
$user_session = $helper->getSessionFromRedirect();
} catch( Exception $e ) {
$user_session = null;
$output = array_merge( $output, array( 'success' => false, 'error' => array( 'message' => $e->getMessage(), 'type'=> 'ExxicaUserSessionException', 'code' => $e->getCode() ) ) );
}
}
if( isset( $user_session ) ) {
$appsecret_proof= hash_hmac('sha256', $user_session->getToken(), $app_secret);
if( isset( $http_session['getpages'] ) ) {
try {
// Get Page ID
$user = ( new FacebookRequest($user_session, 'GET', '/me/accounts', array( 'appsecret_proof' => $appsecret_proof ) ) )->execute()->getGraphObject();
$output = array( 'success' => true, 'user' => $user );
} catch(FacebookRequestException $e) {
$output = array( 'success' => false, 'error' => array( 'message' => $e->getMessage(), 'type'=> 'FacebookRequestUserException', 'code' => $e->getCode() ) );
}
}
try {
$app_session = new FacebookSession( $app_access_token );
} catch ( Exception $e ) {
$app_session = null;
$output = array_merge( $output, array( 'success' => false, 'error' => array( 'message' => $e->getMessage(), 'type'=> 'ExxicaAppSessionException', 'code' => $e->getCode() ) ) );
}
$c = new CDbCriteria();
$c->compare( 'id', $license_id );
$l = _Licenses::model()->find( $c );
$l->facebook_token = $user_session->getToken();
$l->facebook_app_token = $app_session->getToken();
$l->save();
$output = array_merge( $output, array( 'success' => true, 'user_token' => $l->facebook_token ) );
} else {
header( 'Location: '.$helper->getLoginUrl( array( 'manage_pages','publish_actions','public_profile' ) ) );
}
?>