Interestingly enough, this is something I've been thinking a lot about lately. I recognize that Spring Social doesn't clearly define (either in code or with any guidance) on how to "up" the permissions for a user. And I'd like to fix that. Honestly, although I've been thinking about it, I haven't had opportunity to try anything yet. It's also the subject of https://jira.springsource.org/browse/SOCIAL-135.
My initial thought is that you'd need to go through the connection flow again, only with a new set of scopes. Can you do this by triggering the connection flow on ConnectController again? Probably, but you'd probably run into trouble at the end when it tries to create that connection again.
Of course, you could always do it manually, without Spring Social's help. The upgrade permissions flow is simpler than the connection flow in that you simply redirect to Facebook (or whatever provider) with the new scope and then handle the callback. The access token should be the same as before (at least this is the case with Facebook...unsure about other providers), so there's no need to do anything with the callback other than have an endpoint to handle it. I still think that it'd be nice if ConnectController or some other controller provided this more seamlessly for Spring Social.
I realize that's not a definitive answer, but it is a good starting point for discussion on this topic. I'll keep thinking about it and may even run a few experiments in the next few days to see what I can come up with.
As for tracking what permissions have been enabled, you can do this for Facebook with UserOperations.getUserPermissions(). I'd recommend that you avoid keeping your own local DB of permissions, as the user can always go into Facebook and turn off individual permissions, making your local list of permissions invalid. For performance reasons, you could keep a local cache of permissions, but I'd make a point of sync'ing your local list up with what getUserPermissions() says often to avoid having a local list that's incorrect.
Spring Social Project Lead