In spite of scope, still do not have permissions to user data

[withinhealth]

I'm using Rails and even though i have my scope set in my code, if the user does not share the code with everyone in their settings, I cannot get access to it. 

Rails.application.config.middleware.use OmniAuth::Builder do
  provider :fitbit, ENV['FITBIT_CLIENT_ID'], ENV['FITBIT_CLIENT_SECRET'], scope: "profile activity weight heartrate location nutrition settings social weight", redirect_uri: "http://localhost:3000/auth/fitbit/callback", expires_in: 604800
end

This shows the appropriate checkboxes, for everything, but then I get an error:

=> {"errors"=>
  [{"errorType"=>"request",
    "fieldName"=>"n/a",
    "message"=>
     "API client is not authorized to access the resource requested."}]}

Does that mean that the oauth is not working properly?

[JeremiahFitbit]

Is the user actually giving you the scope? The authorized scope is returned with the access token.

[withinhealth]

I can tell from testing that it's being checked off, but I don't know how to tell if its in the access token.  

class FitbitAuthController < ApplicationController

  # this is the callback information from fitbit
  def get_response
    @user = current_user
    # Access Credentials
    oauth_token = params[:oauth_token]
    oauth_verifier = params[:oauth_verifier]

    # creates a variable we can pass as an argument below
    data = request.env['omniauth.auth']

    # the data we'll be receiving, activity data
    set_up_client(data)
    height = data["extra"]["raw_info"]["user"]["height"]
    distance_unit = data["extra"]["raw_info"]["user"]["distanceUnit"]
    # @user.update_attributes!(height: height)
    calories = get_user_calories(data)
    calories["activities-log-calories"].each do |a|
      UserCalorie.where(:user => @user, :date => a["dateTime"]).first_or_create(:calories => a["value"])
    end
    steps = get_user_steps(data)
    steps["activities-log-steps"].each do |a|
      UserStep.where(:user => @user, :date => a["dateTime"]).first_or_create(:steps => a["value"])
    end
    distance = get_user_distance(data)
    distance["activities-log-distance"].each do |a|
      UserDistance.where(:user => @user, :date => a["dateTime"]).first_or_create(:distance => a["value"])
    end
    weight = get_body_weight(data)
    weight["body-weight"].each do |a|
      UserWeight.where(:user => @user, :date => a["dateTime"]).first_or_create(:weight => a["value"])
    end
    fat = get_body_fat(data)
    fat["body-fat"].each do |a|
      UserFat.where(:user => @user, :date => a["dateTime"]).first_or_create(:fat => a["value"])
    end
    bmi = get_body_bmi(data)
    bmi["body-bmi"].each do |a|
      UserBmi.where(:user => @user, :date => a["dateTime"]).first_or_create(:bmi => a["value"])
    end

    redirect_to root_path
  end

private
  def set_up_client(data)
    fitbit_user_id = data["uid"]
    user_secret = data["credentials"]["secret"]
    user_token = data["credentials"]["token"]
    binding.pry

    @client = Fitgem::Client.new({
      consumer_key: ENV['FITBIT_CLIENT_KEY'],
      consumer_secret: ENV['FITBIT_CLIENT_SECRET'],
      token: user_token,
      secret: user_secret,
      user_id: fitbit_user_id,
    })

    @access_token = @client.reconnect(user_token, user_secret)
  end

  def get_user_calories(data)
    @client.data_by_time_range('/activities/log/calories', {:base_date => DateTime.now.strftime("%F"), :period => "1m"})
  end

  def get_user_steps(data)
    @client.data_by_time_range('/activities/log/steps', {:base_date => DateTime.now.strftime("%F"), :period => "1m"})
  end

  def get_user_distance(data)
    @client.data_by_time_range('/activities/log/distance', {:base_date => DateTime.now.strftime("%F"), :period => "1m"})
  end

  def get_body_weight(data)
    @client.data_by_time_range('/body/weight', {:base_date => DateTime.now.strftime("%F"), :period => "1m"})
  end

  def get_body_fat(data)
    @client.data_by_time_range('/body/fat', {:base_date => DateTime.now.strftime("%F"), :period => "1m"})
  end

  def get_body_bmi(data)
    @client.data_by_time_range('/body/bmi', {:base_date => DateTime.now.strftime("%F"), :period => "1m"})
  end
end

[JeremiahFitbit]

I'm not going to debug your code.

Examine all of the parameters returned with in your redirect URI if using the Implicit Grant Flow or the Access Token Request if you're using the Authorization Code Grant flow. You'll see the 'scope' parameter contains a space delimited list of the scope actually granted by the user.

[withinhealth]

I'm realizing that there is no value for this:

    user_secret = data["credentials"]["secret"]

[JeremiahFitbit]

There is no access token secret with OAuth 2.0. That is an OAuth 1.0a feature.