That's fair. I don't think that it's right to say that you can't make any assumptions, but you should have code that is prepared to handle failure cases. Facebo

That's fair. I don't think that it's right to say that you can't make any assumptions, but you should have code that is prepared to handle failure cases. Facebook users can revoke permissions (or revoke access wholesale) without going through your app, so you have to be prepared to handle failures. The question is how to handle them in a way that doesn't leave the user dissatisfied with your product. Here's the next question, though - if it's as simple as checking the authed permissions and forcing a re-auth if permissions you wanted weren't granted, what value does this extension provide? It's effectively the same as clicking the "Don't Allow" button. (This conversation has been very productive, though; it's made me think more about the "ask permission when needed" flow, rather than the "ask up front" model we currently use. The former effectively sidesteps the issue by never presuming that the permission is present.)