Question

I’m working on integrating Facebook support into a blogging engine. I registered an app on the Facebook developers page.
I’d like to implement four different kind of use cases:

• Visitors on the site can log in with Facebook.
  I’m not interested in any of their private data, and I don’t want my site to access any of their stuff, so I don’t like to request any special permissions from them.
• Owners of the site can display their Facebook status.
  I’d like the blogging engine to be able to retrieve the site owners’ latest status updates from Facebook and display the last few of them.
• Posting a new status update when a new article is posted on the site.
  The site should be able to post a status update onto the owners’ Facebook account when s/he posts a new article onto the site.
• Gallery
  The site’s gallery should be able to display pictures from the owners’ Facebook accounts.

For the first use case, I don’t require any permissions. For the others, some permissions are needed. How can I request different permissions for different users for my app?

Answer 1

Facebook’s API allows the permissions of a user to progressively increase over time. In fact, that is Facebook guideline for getting permissions from user – get permissions as much as you want for current operation to be completed.

You can log-in users into your system with default permissions level ” and then increase when needed. There is nothing in FB’s API which forces all users of your app to be at the same set of permissions.

The code for this would look like:

FB.login(function(response) {
   // handle the response
 });

You can ask the API for the user’s current permissions by querying the “/me/permissions” API endpoint and passing the current access token granted to your app.

On server side, call:

https://graph.facebook.com/me/permissions?access_token=XXX

// Sample JSON response:

{
  "data": [
    {
      "installed": 1, 
      "status_update": 1, 
      "photo_upload": 1, 
      "video_upload": 1, 
      "offline_access": 1, 
      "email": 1, 
      "create_note": 1, 
      "share_item": 1, 
      "publish_stream": 1, 
      "user_location": 1, 
      "user_interests": 1, 
      "user_online_presence": 1, 
      "user_website": 1, 
      "user_photos": 1, 
      "user_videos": 1, 
      "user_photo_video_tags": 1, 
      "user_checkins": 1
    }
  ]
}

// or use the following JS snippet:
FB.api('/me/permissions', function(response) {
    // handle the response
});

If you wish to get more permissions, just conduct a FB.login operation (if done through JS SDk) or the appropriate operation in your choice implementation method.

The second FB.login would like the following:

FB.login(function(response) {
   // handle the response
 }, {scope: 'email,user_likes'});