When a user accepts a request that was sent to him, they are redirected to the canvas URL of your application. It is your application's responsibility to check and see if that user has authenticated your application and whether or not they have granted your application the correct permissions.
What you'll need to do is check to see if a user landing on your canvas URL is authenticated. Usually one would request permissions as part of the authentication process but this is not required.
You can test for permissions like this -
FB.api('/me/permissions', function (response) {
console.log(response);
});
If the user has not granted all the required permissions then you can simply prompt them with the permissions dialog -
FB.ui({
method: 'permissions.request',
perms: 'user_likes',
display: 'popup'
},function(response) {
if (response && response.perms) {
alert('Permissions granted');
} else if (!response.perms){
alert('User did not authorize permission(s).');
}
});
If you want to simply authenticate the user and request permissions as part of the login process then you can use some code similar to this -
FB.login(function(response) {
// handle the response
}, {scope: 'email,user_likes'});