Deauthorize user when deleting its account

As far as I know, it's not possible for Drupal to send a deauthorization request to Facebook, the user must deauthorize the application themselves (either through Drupal or Facebook). Because an administrator deleting a Drupal user account cannot send requests to Facebook on behalf of that user, I don't think that Drupal can even deauthorize its own application.

Note that on the Drupal side, FBOAuth definitely cleans up the association between Facebook and Drupal in the Drupal database when user accounts are deleted, it's just Facebook's record that we have no ability to clean up.

Most Facebook queries require that you send a token to Facebook authenticating you to act on behalf of the user. The documentation doesn't seem to indicate it directly, but the description implies that it would be necessary (emphasis mine):

You can de-authorize an application or revoke a specific extended permissions on behalf of a user by issuing an HTTP DELETE request to PROFILE_ID/permissions with a user access_token for that app.

It's worth looking into though, I haven't tried to do the query without a token.

You absolutely cannot impersonate a user through FBOAuth. The entire point of Facebook using OAuth is to prevent unauthorized accessing/modification of user data without the user's consent. Each time you perform an action against Facebook, that user themselves needs to log into Facebook or be logged in already. The exchange process typically looks like this:

1. User clicks button/link on the Drupal site to initiate the action.
2. The link redirects the user to Facebook, which either asks them to login and authorize the application, or if they've already authorized the app, immediately redirects the user back to Drupal.
3. Facebook's redirect gives Drupal an access token, which Drupal can use to perform actions on behalf of the user, but only for a short period of time (typically a few hours).
4. Drupal uses this access token to perform an action against Facebook, such as authenticate or import data.

If you don't know the user's Facebook password (as you shouldn't), FBOAuth won't be able to get past step 2, since Facebook has to grant FBOAuth a token before it can do anything on behalf of the user.

All these processes aside, what's the reason for wanting to deauthorize your application with the user's Facebook account at all? The only thing authorization does is allow your website to query information from the user's Facebook account, the user is not granted any sort of access based on the fact that they have authorized your application access to their account. Facebook authorization is a one-way approval process, where the user is saying "I trust this website". There's no reason why your site would say "I trust this user" based on their Facebook authorization. By deleting the user's account, FBOAuth will delete the user's Facebook association, so any kind of data on the Drupal side is removed.

Does that allow means that a user blocked on the Drupal site can't access it though it is authorized by FB?

Yes the user cannot access the site if their Drupal account has been deleted. It's important to not that the user is never "authorized by Facebook". The only thing that is happening is that the user is authorizing your site to use their personal Facebook data. Given the information from Facebook, Drupal decides whether or not to let the user log into the site.

I am reopening this post because I really need this functionality. I am using drupalgap alongside my website and need a way making a users access tokens invalid if I manually delete their account on the server side. If this is not done, the user's account is just recreated when they open the app on their phone because they still have a valid access token stored on their phone. According to the API documentation this is possible to do using the following command:

DELETE /{user-id}/permissions

According to their documentation the access token for the app can be used to complete this operation.

This request must be made with a valid user access token or an app access token for the current app. If the request is successful, your app receives a response of true. If the call is successful, any user access token for the person will be invalidated and they will have to log in again. Because you're de-authorizing your app, they will also have to grant access to your app as if they were logging in for the first time.

Can you direct me how to implement this with this module? Perhaps a checkbox can be added to the modules settings that deauthorizes the user's account when the user account is deleted.