I've been testing the auth/login code for the javascript sdk and I've noticed that facebook only detects the cancelled permissions request when a user arrives at my app not logged into facebook, but if a user is already logged in to facebook and they cancel the same permissions request, FB.login doesn't return the "unknown" status the way it does under the first condition.
$("button").click(function(){
FB.login(function(response) {
/*when the user clicks the button but isn't logged in, fb will prompt
them to log in and then shows the dialogue where I request
permissions. If I hit cancel, the response status will return
"unknown" and I redirect to another page. */
if(response.status === "unknown"){
top.location.href = "https://developers.facebook.com/docs/facebook-login/access-tokens/";
}else{
/*However if the user is already logged in and the permissions
request is cancelled, the code goes into this block that is meant to
handle a "connected" response */
console.log("connected");
},{scope: 'user_location,user_likes'});
});
I figured out what I was overlooking while trying to test the auth response I'd get if I arrived at my app already logged in and then cancelled authorization. I needed to make sure I hadn't already authorized the app!!! DUH right?!! Anywho, I needed to remove the app from my person app listing on my fb home page, and then I could arrive at my landing page as if I was a fresh new user.
If you want to verify that you've been granted all the needed permissions, then you can make an api call like
FB.api('/me/permissions', function(perms) { ... });