api.js

const express = require('express');
const passport = require('passport');
const router = express.Router();

const { fbAuth, fbCb } = require('../lib/facebook');

// this doesn't work:
// router.get('/oauth/:id/facebook', fbAuth);
// router.get('/oauth/:id/facebook', fbAuth());

// this is the only way it works
router.get('/oauth/:id/facebook', (req, res) => fbAuth(req, res)(req, res));
router.get('/oauth/facebook/callback', (req, res) => fbCb(req, res)(req, res));

module.exports = router;

app.js

const passport = require('passport');
const apiRouter = require('./routes/api');

const app = express();

app.use(passport.initialize());
app.use(passport.session());

app.use('/api', apiRouter);

facebook.js

const models = require('../models');
const email = require('../utils/email');
const passportFacebook = require('../auth/facebook');

const fbAuth = (req, res) => {
    // const url = `https://www.facebook.com/v3.1/dialog/oauth`;
    // const callback =
    //     (req.headers['x-forwarded-proto'] || req.protocol) + '://' + req.headers.host + '/api/oauth/facebook/callback';
    // const redirectTo = `${url}?response_type=code&redirect_uri=${callback}&client_id=${process.env.FACEBOOK_APP_ID}`;

    req.session.isRegisterUser = req.query.isRegisterUser || false;
    req.session.regUserId = req.params.id > 0 ? req.params.id : null;
    req.session.redirectUrlAfterSignIn = req.query.redirectUrl ? req.query.redirectUrl : null;

    // the same way as passportFacebook.authenticate :
    // res.redirect(redirectTo);

    return passportFacebook.authenticate('facebook', {}, function() {
        // NEVER called
        console.log('auth cb');
    });
};

const fbCb = (req, res) => {
    return console.log(req.session.regUserId);
};

module.exports = {
    fbCb,
    fbAuth
};

fbInit.js

const passport = require('passport');
const Strategy = require('@passport-next/passport-facebook').Strategy;

passport.use(new Strategy({
        clientID: process.env.FACEBOOK_APP_ID,
        clientSecret: process.env.FACEBOOK_SECRET,
        callbackURL: 'http://localhost:3001/api/oauth/facebook/callback',
        graphApiVersion: 'v3.1',
        // scope: ['email']
    },
    function(accessToken, refreshToken, profile, cb) {
        // NEVER called
        console.log(`accessToken`, accessToken);
        console.log(`profile`, profile);
        return cb(null, profile);
    }
));

passport.serializeUser(function(user, done) {
    done(null, user.id);
});

passport.deserializeUser(function(id, done) {
    return models.User.findById(id).then(user=>{
        done(null, user);
    }).catch(function (err) {
        done(null, null);
    });
});

module.exports = passport;