validating that the user has granted the requested permissions using FB.getLoginStatus - facebook

Question

In my app, I have my user connect with FB and grant my app permissions.
When they click the Connect button , the FB popup is displayed and they get the
"Login with facebook" and then they need to grand permissions to publish_stream, manage_pages, email.
the problem i am having with my code, is if they remove one of the permissions (like manage_pages ) checkLoginStatus still lets the user continue.
So how to i verify that the user has granted the requested permissions?
<div id="fb-root"></div>
<script src="//connect.facebook.net/en_US/all.js"></script>
<script type="text/javascript">
FB.init({
appId: '<?=FB_APP_ID?>',
status: true,
cookie: true
});
FB.getLoginStatus(checkLoginStatus);
function authUser() {
FB.login(checkLoginStatus, {scope:'publish_stream, manage_pages, email'});
}
function checkLoginStatus(response) {
if(response && response.status == 'connected') {
$('#connbut').hide();
FB.api('/me', function(user) {
if (user) {
$('#fbuser-name').text(user.name);
$('#fbuserpict').attr('src', 'https://graph.facebook.com/' + user.id + '/picture');
$('#fbname').val(user.name);
$('#fbpict').val('https://graph.facebook.com/' + user.id + '/picture');
}
});
} else {
// Display the login button
$('#connbut').show();
}
}
</script>

Answer 1

the problem i am having with my code, is if they remove one of the permissions (like manage_pages ) checkLoginStatus still lets the user continue.
Of course it does, because FB.getLoginStatus says nothing about permissions – it only tells you whether the user is connected to your app or not.
So how to i verify that the user has granted the requested permissions?
You can ask about the permissions the user has currently given your app by requesting /me/permissions (or even just ask for specific permissions using field expansion).
But doing so client-side via JS seems to be cached somehow – asking for permissions, seeing there’s one missing, calling FB.login and asking again will, from my experience, most likely still show the same permissions as before, even if the user has given additional permissions in between. The only way to get reliable information in real time seems to be to do it server-side.