Facebook is ignoring our scope parameters that are being requested from our app. We're using Firebase authentication which provides an SDK that allows us to request a series of permission scopes from Facebook.
Here is an example of what this looks like:
import firebase from 'firebase/app';
// instantiate new Facebook provider
export const fbProviderRedirect = new firebase.auth.FacebookAuthProvider();
// add business_manager scope to access user's business manager data
fbProviderRedirect.addScope('business_management');
fbProviderRedirect.addScope('public_profile');
fbProviderRedirect.addScope('email');
fbProviderRedirect.addScope('ads_read');
fbProviderRedirect.addScope('ads_management');
fbProviderRedirect.setCustomParameters({ auth_type: 'reauthenticate' });
We then call our auth function and pass in the 'fbProviderRedirect instance as an arg
const linkToProvider = (provider) => {
return auth.currentUser.linkWithRedirect(provider);
};
Once a user selects our btn, they are redirected to the facebook dialog screen and are presented with a request to grant our app access. However, here is the part that we cannot figure out.
While testing, when we use our FB app admin account, when we select the btn two dialog screens appear. First screen contains permissions: public_profile and email, and the second dialog screen covers all of the remaining permissions.
When regular users attempt this, they only see the first screen, not the second. They are then given an access token which does NOT contain any of the explicitly set permissions from firebase.
Our app within facebook was reviewed and approved via advanced access for the following permissions: pages_show_list, business_management, ads_read, pages_read_engagement, ads_management
Additionally, our app was also verified as a business. So we've been both approved and verified by facebook for our app and business.
We cannot figure out what we're missing or doing wrong. Any suggestions on how to proceed?
oAuth screen:
Review approved:
Business Verified:
