Facebook Graph API访问令牌未包含scope指定权限求助

我正在使用Next.js开发一款用户主页帖子调度应用，用于测试的账号已设置为应用的Tester角色，理论上权限不应存在问题。但在Facebook登录按钮的scope参数中添加pages_show_list权限后，生成的短期和长期访问令牌均未包含该权限，仅默认授予public_profile权限。我通过Node.js脚本验证令牌权限，返回结果如下：

Data: { data: [ { permission: 'public_profile', status: 'granted' } ] }

我预期至少能看到该权限的记录（无论状态是否为granted），恳请协助排查问题。相关代码如下：

Facebook异步初始化代码 #

useEffect(() => {
        window.fbAsyncInit = function () {
            // @ts-ignore
            FB.init({
                appId: process.env.NEXT_PUBLIC_FACEBOOK_APP_ID,
                cookie: true,
                xfbml: true,
                version: process.env.NEXT_PUBLIC_FACEBOOK_API_VERSION, // v20.0
            });

            // @ts-ignore
            FB.AppEvents.logPageView();

            // @ts-ignore
            FB.getLoginStatus(function (response) {
                console.log('login status:', response)
            });
        };

        (function (d, s, id) {
            var js, fjs = d.getElementsByTagName(s)[0];
            if (d.getElementById(id)) { return; }
            js = d.createElement(s); js.id = id;
            // @ts-ignore
            js.src = "https://connect.facebook.net/en_US/sdk.js";
            // @ts-ignore
            fjs.parentNode.insertBefore(js, fjs);
        }(document, 'script', 'facebook-jssdk'));
    }, []);

登录按钮点击事件处理函数 #

const loginWithShowListPerm = () => {
        // @ts-ignore
        FB.login(function (response) {
            (async () => {
                console.log('login response:', response)
                if (response.status === 'connected') {
                    const params: GraphApiParams = {
                        accessToken: response.authResponse.accessToken,
                        platformUserId: response.authResponse.userID,
                    }

                    await saveAccessToken(params);

                    const accessTokenData = await getAccessTokenData(params);

                    console.log('accessTokenData:', accessTokenData);


                    // User is logged in and authorized
                    // Execute your function here
                }
            })();
        }, { scope: 'pages_show_list' });

转换为长期访问令牌的后端方法（由saveAccessToken服务端动作调用） #

export async function convertToLongLivedAccessToken({
    userAccessToken,
}: {
    userAccessToken: string,
}) {
    try {
        const response = await fetch(`https://graph.facebook.com/${process.env.NEXT_PUBLIC_FACEBOOK_API_VERSION}/oauth/access_token`, {
            method: 'POST',
            headers: {
                'Content-Type': 'application/json',
            },
            body: JSON.stringify({
                grant_type: 'fb_exchange_token',
                client_id: process.env.NEXT_PUBLIC_FACEBOOK_APP_ID,
                client_secret: process.env.FACEBOOK_APP_SECRET,
                fb_exchange_token: userAccessToken,
            }),
        });

        const data = await response.json();
        console.log('data:', data);
        return data.access_token;
    } catch (error) {
        console.error('Error converting to Long Lived Access Token:', error);
        return null;
    }
}

检查令牌权限的Node.js脚本 #

async function main() {
try {
const response = await fetch(`https://graph.facebook.com/v20.0/me/permissions?access_token=${accessToken}`);

        if (!response.ok) {
            throw new Error(`HTTP error! status: ${response.status}`);
        }
    
        const data = await response.json();
    
        console.log('Data:', data);
    
    } catch (error) {
        console.error('Error fetching user permissions:', error);
    }

}

main();

内容的提问来源于stack exchange，提问作者Rik Puts