Question

Probably obvious and simple. I have an application that should access a Facebook users friends information. After a user have been authenticated using PassportJS and my application receives the accesstoken how do I fetch the users friends information? Or any protected information that is? And what is the scope parameter for users friends access?

EDIT:
Just want to mention that the original question wasn’t really answered, but the answer was enough to make me continue with my investigations.

My solution was to use PassportJS for managing the login flow, and when I receive the accessToken I use it for my Facebook Graph API calls, which are extremely easy to do. I will do some rework on my module for this and publish it on GitHub to be used as is.

Answer 1

In order to modify the scope, you do this when you setup your route for the Facebook Strategy.

For example, if I want the user’s email to be part of my scope, mine would look like the following:

app.get('/auth/facebook', passport.authenticate('facebook',  { scope: 'email' }));
app.get('/auth/facebook/callback',
  passport.authenticate('facebook', { successRedirect: '/',
                                      failureRedirect: '/' }));

I am saving my information to MongoDB with Mongoose, but you can just as easily stick their friends inside the req.user. Here is an example of how I map my Facebook user’s data:

passport.use(new FacebookStrategy({
    clientID: Common.conf.fb.appId,
    clientSecret: Common.conf.fb.appSecret,
    callbackURL: Common.conf.site_url + "/auth/facebook/callback"
  },
  function(accessToken, refreshToken, profile, done) {
    Model.User.findOne({uid: profile.id}, function(err, user) {
      if (err) { return done(err); }
      if (user) { done(null, user); } else {
        var user_data = {
          provider:   profile.provider
          , alias:  profile.username
          , email:      profile.emails[0].value
          , uid:      profile.id
          , created:  new Date().getTime()
          , name: {
            first:  profile.name.givenName
            , last: profile.name.familyName
          }
          , alerts: {
            email:      true
            , mobile:   false
            , features: true
          }
        };
        new Model.User(user_data).save(function(err, user) {
          if(err) { throw err; }
          done(null, user);
        });
      }
    });
  }
));

Sometimes it is helpful to put a console.log(profile) like so:

   function(accessToken, refreshToken, profile, done) {
        console.log(profile);

in order to help you see the raw output of what the Facebook API is giving you and to check that your custom scope variables exist.