What is the best way to do nested API calls with oauth in node.js?

Question

I am writing an API that fetches data from twitter using the oauth v1 API and serves it for my webapp.

I have one api endpoint that fetches from Twitter an array of objects representing each of the lists a user has created.

I have another api endpoint that, given a list ID, fetched an array of all the members of that list.

I want to combine these two endpoints into one, so my webapp can request '/api/getAllLists' and it will receive an array of list objects (API 1), with one of the properties of the object being a full list of members (API 2).

I have got myself tangled up trying to work out how to do this - I have used promises and async functions before but I don't know the best way to accomplish this.

router.get('/getAllLists', isLoggedIn, (req, res) => {

//oauth access credentials
    let {oauthAccessToken, oauthAccessTokenSecret, username, user_id} = req.cookies.twitter || '';

//first api call to get array of list objects
    consumer.get("https://api.twitter.com/1.1/lists/list.json?user_id="+user_id, oauthAccessToken, oauthAccessTokenSecret, (error, data, response) => {

        if (error) {

            console.log(error)

        } else {

            data = JSON.parse(data).map((list) => {
                let newList = list;

//second API call, using list.id_str fromt he first call
                consumer.get("https://api.twitter.com/1.1/lists/members.json?list_id="+list.id_str, oauthAccessToken, oauthAccessTokenSecret, (error, data, response) => {
                    if (error) {
                        console.log(error);
                    } else {
                        newList.contents = data;
                        return newList;
                    }
                });
                return newList;
            })
            res.send(data);
        }
    });
});

Answer 1

I have accomplished what I was aiming for like this:

        //oauth access credentials
        let { oauthAccessToken, oauthAccessTokenSecret, username, user_id } = req.cookies.twitter || '';

        consumer.get("https://api.twitter.com/1.1/lists/list.json?user_id=" + user_id, oauthAccessToken, oauthAccessTokenSecret, (error, data, response) => {
            if (error) {
                console.log(error)
            } else {

                    let allLists = [];
                    let allListLength = JSON.parse(data).length;
                    let listCounter = 0;
                    const addToAllLists = (list) => {
                        allLists.push(list)
                        listCounter ++;
                        if(listCounter === allListLength) {
                            res.send(allLists)
                        }
                    }

                    JSON.parse(data).map((list,i) => {
                        let newList = list;
                        consumer.get("https://api.twitter.com/1.1/lists/members.json?count=4999&list_id=" + list.id_str, oauthAccessToken, oauthAccessTokenSecret, (error, data2, response) => {
                            if (error) {
                                console.log(error);
                            } else {
                                newList.users = JSON.parse(data2).users;
                                addToAllLists(newList)
                                return newList;
                            }
                        })
                    })
            }
        });

I definitely don't think theis is the best practice method though, and I'd still love to see anyone else's suggestions or corrections, thanks.