koala 1.0.0 → 1.1.0rc2

data/spec/fixtures/mock_facebook_responses.yml

@@ -24,6 +24,18 @@ rest_api:
         with_token: '[{"read_stream":1}]' 
         no_token: '{"error_code":104,"error_msg":"Requires valid signature","request_args":[{"key":"method","value":"fql.query"},{"key":"format","value":"json"},{"key":"query","value":"select read_stream from permissions where uid = 216743"}]}'
 
+  /method/fql.multiquery:
+    'queries={"query1":"select post_id from stream where source_id = me()","query2":"select fromid from comment where post_id in (select post_id from #query1)","query3":"select uid, name from user where uid in (select fromid from #query2)"}':
+      get: 
+        with_token: '[{"name":"query1", "fql_result_set":[]},{"name":"query2", "fql_result_set":[]},{"name":"query3", "fql_result_set":[]}]'
+        no_token: '{"error_code":104,"error_msg":"Requires valid signature","request_args":[{"key":"method","value":"fql.query"},{"key":"format","value":"json"},{"key":"query","value":"select read_stream from permissions where uid = 216743"}]}'
+    'queries={"query1":"select first_name from user where uid = 216743","query2":"select first_name from user where uid = 2905623"}':
+      get:
+        with_token: '[{"name":"query1", "fql_result_set":[{"first_name":"Chris"}]},{"name":"query2", "fql_result_set":[{"first_name":"Alex"}]}]' 
+        no_token: '[{"name":"query1", "fql_result_set":[{"first_name":"Chris"}]},{"name":"query2", "fql_result_set":[{"first_name":"Alex"}]}]'
+
+
+
 
 # ====== GRAPH API =====
 graph_api:
@@ -49,7 +61,7 @@ graph_api:
     
   test_user_no_perms: &test_user_no_perms
     post:
-      with_token: '{"id": "777777777", "access_token":"<%= ACCESS_TOKEN %>", "login_url":"https://www.facebook.com/platform/test_account.."}'
+      with_token: '{"id": "777777777", "access_token":"<%= APP_ACCESS_TOKEN %>", "login_url":"https://www.facebook.com/platform/test_account.."}'
   
   test_user_befriended: &test_user_befriended
     post:
@@ -59,8 +71,59 @@ graph_api:
   root:
     ids=contextoptional,naitik: 
       get:
-        with_token: '[{}, {}]'
-        no_token: '[{}, {}]'
+        with_token: '{"contextoptional":"{}","naitik":"{}"}'
+        no_token: '{"contextoptional":"{}","naitik":"{}"}'
+    # Ruby 1.8.7 and 1.9.2 generate JSON with different key ordering, hence we have to dynamically generate it here 
+    batch=<%= [{"method" => "get", "relative_url" => "me"},{"method" => "get", "relative_url" => "koppel"}].to_json %>:
+      post:
+        with_token: '[{"body":"{\"id\":\"123\"}"}, {"body":"{\"id\":\"456\"}"}]'
+    batch=<%= [{"method" => "get", "relative_url" => "me/picture"}].to_json %>:
+      post:
+        with_token: '[{"headers":[{"name":"Location","value":"http://google.com"}]}]'
+    batch=<%= [{"method" => "get", "relative_url" => "me"},{"method" => "get", "relative_url" => "me/friends"}].to_json %>:
+      post:
+        with_token: '[{"body":"{\"id\":\"123\"}"}, {"body":"{\"data\":[]}"}]'
+    batch=<%= [{"method"=>"get", "relative_url"=>"me"}, {"method"=>"get", "relative_url"=>"#{OAUTH_DATA["app_id"]}/insights?access_token=#{CGI.escape APP_ACCESS_TOKEN}"}].to_json %>:
+      post:
+        with_token: '[{"body":"{\"id\":\"123\"}"}, {"body":"{\"data\":[]}"}]'
+    batch=<%= [{"method"=>"get", "relative_url"=>"#{OAUTH_DATA["app_id"]}/insights"}, {"method"=>"get", "relative_url"=>"koppel?access_token=#{CGI.escape APP_ACCESS_TOKEN}"}].to_json %>:
+      post:
+        with_token: '[{"body": "{\"error\":{\"type\":\"AnError\", \"message\":\"An error occurred!.\"}}"},{"body":"{\"id\":\"123\"}"}]'
+    batch=<%= [{"method"=>"post", "relative_url"=>"FEED_ITEM_BATCH/likes"}, {"method"=>"delete", "relative_url"=> "FEED_ITEM_BATCH"}].to_json %>:
+      post:
+        with_token: '[{"body": "{\"id\": \"MOCK_LIKE\"}"},{"body":true}]'
+    batch=<%= [{"method" => "get", "relative_url" => "me/friends?limit=5", "name" => "get-friends"}, {"method" => "get", "relative_url" => "?ids=#{CGI.escape "{result=get-friends:$.data.*.id}"}"}].to_json %>:
+      post:
+        with_token: '[null,{"body":"{}"}]'
+    batch=<%= [{"method" => "get", "relative_url" => "me/friends?limit=5", "name" => "get-friends", "omit_response_on_success" => false}, {"method" => "get", "relative_url" => "?ids=#{CGI.escape "{result=get-friends:$.data.*.id}"}"}].to_json %>:
+      post:
+        with_token: '[{"body":"{\"data\":[]}"},{"body":"{}"}]'
+    batch=<%= [{"method" => "get", "relative_url" => "me/friends?limit=5"}, {"method" => "get", "relative_url" => "?ids=#{CGI.escape "{result=i-dont-exist:$.data.*.id}"}"}].to_json %>:
+      post:
+        with_token: '{"error":190,"error_description":"Error validating access token."}'
+    batch=<%= [{"method" => "post", "relative_url" => "method/fql.query", "body" => "query=select+name+from+user+where+uid%3D4"}].to_json %>:
+      post:
+        with_token: '[{"body":"[{\"name\":\"Mark Zuckerberg\"}]"}]'
+    batch=<%= [{"method"=>"get", "relative_url"=>"me", "name" => "getme"}, {"method"=>"get", "relative_url"=>"koppel", "depends_on" => "getme"}].to_json %>:
+      post:
+        with_token: '[null,{"body":"{\"id\":\"123\"}"}]'
+    batch=<%= [{"method"=>"get", "relative_url"=>"#{OAUTH_DATA["app_id"]}/insights", "name" => "getdata"}, {"method"=>"get", "relative_url"=>"koppel", "depends_on" => "getdata"}].to_json %>:
+      post:
+        with_token: '[{"body": "{\"error\":{\"type\":\"AnError\", \"message\":\"An error occurred!.\"}}"},null]'
+    batch=<%= [{"method"=>"get", "relative_url"=>"#{OAUTH_DATA["app_id"]}/insights", "name" => "getdata"}, {"method"=>"get", "relative_url"=>"koppel", "depends_on" => "getdata"}].to_json %>:
+      post:
+        with_token: '[{"body": "{\"error\":{\"type\":\"AnError\", \"message\":\"An error occurred!.\"}}"},null]'
+    batch=<%= [{"method"=>"post", "relative_url"=>"me/photos", "attached_files" => "file0_0"}].to_json %>&file0_0=[FILE]:
+      post:
+        with_token: '[{"body": "{\"error\":{\"type\":\"AnError\", \"message\":\"An error occurred!.\"}}"},null]'
+    batch=<%= [{"method"=>"post", "relative_url"=>"me/photos", "attached_files" => "file0_0"}].to_json %>&file0_0=[FILE]:
+      post:
+        with_token: '[{"body":"{\"id\": \"MOCK_PHOTO\"}"}]'
+    batch=<%= [{"method"=>"post", "relative_url"=>"me/photos", "attached_files" => "file0_0"}, {"method"=>"post", "relative_url"=>"koppel/photos", "attached_files" => "file1_0"}].to_json %>&file0_0=[FILE]&file1_0=[FILE]:
+      post:
+        with_token: '[{"body":"{\"id\": \"MOCK_PHOTO\"}"}, {"body":"{\"id\": \"MOCK_PHOTO\"}"}]'
+
+
   /me:
     no_args:
       get:
@@ -83,6 +146,9 @@ graph_api:
     message=Hello, world, from the test suite delete method!: 
       post: 
         with_token: '{"id": "FEED_ITEM_DELETE"}'
+    message=Hello, world, from the test suite batch API!: 
+      post: 
+        with_token: '{"id": "FEED_ITEM_BATCH"}'
     link=http://oauth.twoalex.com/&message=Hello, world, from the test suite again!&name=OAuth Playground:
       post:
         with_token: '{"id": "FEED_ITEM_CONTEXT"}'
@@ -144,6 +210,24 @@ graph_api:
           headers:
             Location: http://facebook.com/
 
+  /comments:
+    ids=http://developers.facebook.com/blog/post/472:
+      get: 
+        with_token: '{"http://developers.facebook.com/blog/post/472": []}'
+        no_token: '{"http://developers.facebook.com/blog/post/472": []}'
+    ids=http://developers.facebook.com/blog/post/490,http://developers.facebook.com/blog/post/472:
+      get: 
+        with_token: '{"http://developers.facebook.com/blog/post/490": [], "http://developers.facebook.com/blog/post/472": []}'
+        no_token: '{"http://developers.facebook.com/blog/post/490": [], "http://developers.facebook.com/blog/post/472": []}'
+    ids=:
+      get:
+        body: '{"error": {"type": "OAuthException","message": "Cannot specify an empty identifier"}}'
+        code: 400
+    no_args:
+      get:
+        body: '{"error": {"type": "Exception","message": "No node specified"}}'
+        code: 500        
+
   /search:
     q=facebook:
       get: 
@@ -169,7 +253,7 @@ graph_api:
         <<: *oauth_error
     client_id=<%= APP_ID %>&client_secret=<%= SECRET %>&type=client_cred:
       post:
-        no_token: access_token=<%= ACCESS_TOKEN %>
+        no_token: access_token=<%= APP_ACCESS_TOKEN %>
   /oauth/exchange_sessions:
     client_id=<%= APP_ID %>&client_secret=<%= SECRET %>&sessions=<%= OAUTH_DATA["session_key"] %>&type=client_cred: 
       post:
@@ -311,4 +395,4 @@ graph_api:
 
   /777777777:
     no_args:
-      <<: *item_deleted
+      <<: *item_deleted

data/spec/support/graph_api_shared_examples.rb

@@ -51,9 +51,19 @@ shared_examples_for "Koala GraphAPI" do
     (result["id"] && result["name"]).should
   end
 
+  it "should return [] from get_objects if passed an empty array" do
+    results = @api.get_objects([])
+    results.should == []
+  end
+  
   it "should be able to get multiple objects" do
     results = @api.get_objects(["contextoptional", "naitik"])
-    results.length.should == 2
+    results.should have(2).items
+  end
+
+  it "should be able to get multiple objects if they're a string" do
+    results = @api.get_objects("contextoptional,naitik")
+    results.should have(2).items
   end
 
   it "should be able to access a user's picture" do
@@ -69,6 +79,16 @@ shared_examples_for "Koala GraphAPI" do
     result.should be_a(Array)
   end
 
+  it "should be able to access comments for a URL" do
+    result = @api.get_comments_for_urls(["http://developers.facebook.com/blog/post/472"])
+    (result["http://developers.facebook.com/blog/post/472"]).should
+  end
+
+  it "should be able to access comments for 2 URLs" do
+    result = @api.get_comments_for_urls(["http://developers.facebook.com/blog/post/490", "http://developers.facebook.com/blog/post/472"])
+    (result["http://developers.facebook.com/blog/post/490"] && result["http://developers.facebook.com/blog/post/472"]).should
+  end
+
   # SEARCH
   it "should be able to search" do
     result = @api.search("facebook")
@@ -86,7 +106,6 @@ end
 
 
 shared_examples_for "Koala GraphAPI with an access token" do
-
   it "should get private data about a user" do
     result = @api.get_object("koppel")
     # updated_time should be a pretty fixed test case
@@ -156,6 +175,14 @@ shared_examples_for "Koala GraphAPI with an access token" do
     @temporary_object_id.should_not be_nil
   end
   
+  it "uses the base HTTP service if the upload is a StringIO or similar" do
+    source = stub("UploadIO")
+    Koala::UploadableIO.stub(:new).and_return(source)
+    source.stub(:requires_base_http_service).and_return(true)
+    Koala.should_receive(:make_request).with(anything, anything, anything, hash_including(:http_service => Koala.base_http_service)).and_return(Koala::Response.new(200, "[]", {}))
+    @api.put_picture(StringIO.new)
+  end
+  
   it "should be able to post photos to the user's wall without an open file object" do
     content_type = "image/jpg",
     file_path = File.join(File.dirname(__FILE__), "..", "fixtures", "beach.jpg")
@@ -330,18 +357,18 @@ shared_examples_for "Koala GraphAPI with GraphCollection" do
 
         it "should return the previous page of results" do
           @result.should_receive(:previous_page_params).and_return([@base, @args])
-          @api.should_receive(:graph_call).with(@base, @args).and_return(@second_page)
+          @api.should_receive(:graph_call).with(@base, @args).and_yield(@second_page)
           Koala::Facebook::GraphCollection.should_receive(:new).with(@second_page, @api).and_return(@page_of_results)
 
-          @result.previous_page.should == @page_of_results
+          @result.previous_page#.should == @page_of_results
         end
 
         it "should return the next page of results" do
           @result.should_receive(:next_page_params).and_return([@base, @args])
-          @api.should_receive(:graph_call).with(@base, @args).and_return(@second_page)
+          @api.should_receive(:graph_call).with(@base, @args).and_yield(@second_page)
           Koala::Facebook::GraphCollection.should_receive(:new).with(@second_page, @api).and_return(@page_of_results)
 
-          @result.next_page.should == @page_of_results
+          @result.next_page#.should == @page_of_results
         end
 
         it "should return nil it there are no other pages" do
@@ -421,4 +448,4 @@ shared_examples_for "Koala GraphAPI without an access token" do
   it "should not be able to delete a like" do
     lambda { @api.delete_like("7204941866_119776748033392") }.should raise_error(Koala::Facebook::APIError)
   end
-end
+end

data/spec/support/mock_http_service.rb

@@ -3,11 +3,12 @@ require 'yaml'
 
 module Koala
   module MockHTTPService
-    # Mocks all HTTP requests for with koala_spec_with_mocks.rb
-    IS_MOCK = true # this lets our tests figure out if we want to stub methods
+    include Koala::HTTPService
 
+    # Mocks all HTTP requests for with koala_spec_with_mocks.rb
     # Mocked values to be included in TEST_DATA used in specs
     ACCESS_TOKEN = '*'
+    APP_ACCESS_TOKEN = "**"
     OAUTH_CODE = 'OAUTHCODE'
 
     # Loads testing data
@@ -18,7 +19,7 @@ module Koala
     # Useful in mock_facebook_responses.yml
     OAUTH_DATA = TEST_DATA['oauth_test_data']
     OAUTH_DATA.merge!({
-      'app_access_token' => Koala::MockHTTPService::ACCESS_TOKEN,
+      'app_access_token' => APP_ACCESS_TOKEN,
       'session_key' => "session_key",
       'multiple_session_keys' => ["session_key", "session_key_2"]
     })
@@ -30,66 +31,63 @@ module Koala
     mock_response_file_path = File.join(File.dirname(__FILE__), '..', 'fixtures', 'mock_facebook_responses.yml')
     RESPONSES = YAML.load(ERB.new(IO.read(mock_response_file_path)).result(binding))
 
-    def self.included(base)
-      base.class_eval do
-
-        include Koala::HTTPService
-
-        def self.make_request(path, args, verb, options = {})
-          path = 'root' if path == '' || path == '/'
-          verb ||= 'get'
-          server = options[:rest_api] ? 'rest_api' : 'graph_api'
-          with_token = args.delete('access_token') == ACCESS_TOKEN ? 'with_token' : 'no_token'
-
-          # Assume format is always JSON
-          args.delete('format')
+    def self.make_request(path, args, verb, options = {})
+      path = 'root' if path == '' || path == '/'
+      verb ||= 'get'
+      server = options[:rest_api] ? 'rest_api' : 'graph_api'
+      token = args.delete('access_token') 
+      with_token = (token == ACCESS_TOKEN || token == APP_ACCESS_TOKEN) ? 'with_token' : 'no_token'
 
-          # Create a hash key for the arguments
-          args = create_params_key(args)
+      # Assume format is always JSON
+      args.delete('format')
 
-          begin
-            response = RESPONSES[server][path][args][verb][with_token]
+      # Create a hash key for the arguments
+      args = create_params_key(args)
 
-            # Raises an error of with_token/no_token key is missing
-            raise NoMethodError unless response
-
-            # create response class object
-            response_object = if response.is_a? String
-                Koala::Response.new(200, response, {})
-              else
-                Koala::Response.new(response["code"] || 200, response["body"] || "", response["headers"] || {})
-              end
-
-          rescue NoMethodError
-            # Raises an error message with the place in the data YML
-            # to place a mock as well as a URL to request from
-            # Facebook's servers for the actual data
-            # (Don't forget to replace ACCESS_TOKEN with a real access token)
-            data_trace = [server, path, args, verb, with_token] * ': '
-
-            args = args == 'no_args' ? '' : "#{args}&"
-            args += 'format=json'
-            args += "&access_token=#{ACCESS_TOKEN}" if with_token
-
-            raise "Missing a mock response for #{data_trace}\nAPI PATH: #{[path, args].join('?')}"
-          end
+      begin
+        response = RESPONSES[server][path][args][verb][with_token]
 
-          response_object
-        end
+        # Raises an error of with_token/no_token key is missing
+        raise NoMethodError unless response
 
-        protected
-        def self.create_params_key(params_hash)
-          if params_hash.empty?
-            'no_args'
+        # create response class object
+        response_object = if response.is_a? String
+            Koala::Response.new(200, response, {})
           else
-            params_hash.sort{ |a,b| a[0].to_s <=> b[0].to_s}.map do |arr|
-              arr[1] = '[FILE]' if arr[1].kind_of?(Koala::UploadableIO)
-              arr.join('=')
-            end.join('&')
+            Koala::Response.new(response["code"] || 200, response["body"] || "", response["headers"] || {})
           end
-        end
 
-      end # class_eval
-    end # included
+      rescue NoMethodError
+        # Raises an error message with the place in the data YML
+        # to place a mock as well as a URL to request from
+        # Facebook's servers for the actual data
+        # (Don't forget to replace ACCESS_TOKEN with a real access token)
+        data_trace = [server, path, args, verb, with_token] * ': '
+
+        args = args == 'no_args' ? '' : "#{args}&"
+        args += 'format=json'
+        args += "&access_token=#{ACCESS_TOKEN}" if with_token
+
+        raise "Missing a mock response for #{data_trace}\nAPI PATH: #{[path, args].join('?')}"
+      end
+
+      response_object
+    end
+
+    def self.mock?
+      true
+    end
+
+    protected
+    def self.create_params_key(params_hash)
+      if params_hash.empty?
+        'no_args'
+      else
+        params_hash.sort{ |a,b| a[0].to_s <=> b[0].to_s}.map do |arr|
+          arr[1] = '[FILE]' if arr[1].kind_of?(Koala::UploadableIO)
+          arr.join('=')
+        end.join('&')
+      end
+    end
   end
 end

data/spec/support/rest_api_shared_examples.rb

@@ -87,6 +87,29 @@ shared_examples_for "Koala RestAPI" do
 
       @api.rest_call('anything', {}, options)
     end
+    
+    it "uses get by default" do
+      @api.should_receive(:api).with(
+        anything,
+        anything,
+        "get",
+        anything
+      )
+
+      @api.rest_call('anything')
+    end
+    
+    it "allows you to specify other http methods as the last argument" do
+      method = 'bar'
+      @api.should_receive(:api).with(
+        anything,
+        anything,
+        method,
+        anything
+      )
+
+      @api.rest_call('anything', {}, {}, method)
+    end
 
     it "should throw an APIError if the result hash has an error key" do
       Koala.stub(:make_request).and_return(Koala::Response.new(500, {"error_code" => "An error occurred!"}, {}))
@@ -96,8 +119,7 @@ shared_examples_for "Koala RestAPI" do
     describe "when making a FQL request" do
       it "should call fql.query method" do
         @api.should_receive(:rest_call).with(
-          "fql.query",
-          anything
+          "fql.query", anything, anything
         ).and_return(Koala::Response.new(200, "2", {}))
 
         @api.fql_query stub('query string')
@@ -107,17 +129,78 @@ shared_examples_for "Koala RestAPI" do
         query = stub('query string')
 
         @api.should_receive(:rest_call).with(
-          anything,
-          hash_including("query" => query)
+          anything, hash_including(:query => query), anything
         )
 
         @api.fql_query(query)
       end
+      
+      it "should pass on any other arguments provided" do
+        args = {:a => 2}
+        @api.should_receive(:rest_call).with(anything, hash_including(args), anything)
+        @api.fql_query("a query", args)
+      end
+      
+      it "should pass on any http options provided" do
+        opts = {:a => 2}
+        @api.should_receive(:rest_call).with(anything, anything, hash_including(opts))
+        @api.fql_query("a query", {}, opts)
+      end
+    end
+    
+    describe "when making a FQL-multiquery request" do
+      it "should call fql.multiquery method" do
+        @api.should_receive(:rest_call).with(
+          "fql.multiquery", anything, anything
+        ).and_return({})
+
+        @api.fql_multiquery stub('query string')
+      end
+
+      it "should pass a queries argument" do
+        queries = stub('query string')
+        queries_json = "some JSON"
+        queries.stub(:to_json).and_return(queries_json)
+        
+        @api.should_receive(:rest_call).with(
+          anything,
+          hash_including(:queries => queries_json),
+          anything
+        )
+
+        @api.fql_multiquery(queries)
+      end
+      
+      it "simplifies the response format" do
+        raw_results = [
+          {"name" => "query1", "fql_result_set" => [1, 2, 3]},
+          {"name" => "query2", "fql_result_set" => [:a, :b, :c]}
+        ]
+        expected_results = {
+          "query1" => [1, 2, 3],
+          "query2" => [:a, :b, :c]
+        }
+        
+        @api.stub(:rest_call).and_return(raw_results)
+        results = @api.fql_multiquery({:query => true})
+        results.should == expected_results
+      end
+      
+      it "should pass on any other arguments provided" do
+        args = {:a => 2}
+        @api.should_receive(:rest_call).with(anything, hash_including(args), anything)
+        @api.fql_multiquery("a query", args)
+      end
+      
+      it "should pass on any http options provided" do
+        opts = {:a => 2}
+        @api.should_receive(:rest_call).with(anything, anything, hash_including(opts))
+        @api.fql_multiquery("a query", {}, opts)
+      end
     end
   end
 end
 
-
 shared_examples_for "Koala RestAPI with an access token" do
   # FQL
   it "should be able to access public information via FQL" do
@@ -126,6 +209,16 @@ shared_examples_for "Koala RestAPI with an access token" do
     result.first['first_name'].should == 'Chris'
   end
 
+  it "should be able to access public information via FQL.multiquery" do
+    result = @api.fql_multiquery(
+      :query1 => 'select first_name from user where uid = 216743',
+      :query2 => 'select first_name from user where uid = 2905623'
+    )
+    result.size.should == 2
+    result["query1"].first['first_name'].should == 'Chris'
+    result["query2"].first['first_name'].should == 'Alex'
+  end
+
   it "should be able to access protected information via FQL" do
     # Tests agains the permissions fql table
 
@@ -138,10 +231,21 @@ shared_examples_for "Koala RestAPI with an access token" do
     result = @api.fql_query("select read_stream from permissions where uid = #{id}")
 
     result.size.should == 1
-    # we assume that you have read_stream permissions, so we can test against that
-    # (should we keep this?)
+    # we've verified that you have read_stream permissions, so we can test against that
     result.first["read_stream"].should == 1
   end
+  
+  
+  it "should be able to access protected information via FQL.multiquery" do
+    result = @api.fql_multiquery(
+      :query1 => "select post_id from stream where source_id = me()", 
+      :query2 => "select fromid from comment where post_id in (select post_id from #query1)", 
+      :query3 => "select uid, name from user where uid in (select fromid from #query2)"
+    )
+    result.size.should == 3 
+    result.keys.should include("query1", "query2", "query3")
+  end
+
 end
 
 
@@ -153,9 +257,29 @@ shared_examples_for "Koala RestAPI without an access token" do
       @result.size.should == 1
       @result.first["first_name"].should == "Chris"
     end
+    
+    it "should be able to access public information via FQL.multiquery" do
+      result = @api.fql_multiquery(
+        :query1 => 'select first_name from user where uid = 216743',
+        :query2 => 'select first_name from user where uid = 2905623'
+      )
+      result.size.should == 2
+      result["query1"].first['first_name'].should == 'Chris'
+      result["query2"].first['first_name'].should == 'Alex'
+    end
 
     it "should not be able to access protected information via FQL" do
       lambda { @api.fql_query("select read_stream from permissions where uid = 216743") }.should raise_error(Koala::Facebook::APIError)
     end
+    
+    it "should not be able to access protected information via FQL.multiquery" do
+      lambda { 
+        @api.fql_multiquery(
+          :query1 => "select post_id from stream where source_id = me()", 
+          :query2 => "select fromid from comment where post_id in (select post_id from #query1)", 
+          :query3 => "select uid, name from user where uid in (select fromid from #query2)"
+        ) 
+      }.should raise_error(Koala::Facebook::APIError)
+    end
   end
 end

data/spec/support/setup_mocks_or_live.rb

@@ -5,11 +5,11 @@ module KoalaTest
     # make sure we have the necessary permissions
     api = Koala::Facebook::GraphAndRestAPI.new(token)
     uid = api.get_object("me")["id"]
-    perms = api.fql_query("select read_stream, publish_stream, user_photos from permissions where uid = #{uid}")[0]
+    perms = api.fql_query("select read_stream, publish_stream, user_photos, read_insights from permissions where uid = #{uid}")[0]
     perms.each_pair do |perm, value|
-      unless value == 1
+      if value == (perm == "read_insights" ? 1 : 0) # live testing depends on insights calls failing 
         puts "failed!\n" # put a new line after the print above
-        raise ArgumentError, "Your access token must have the read_stream, publish_stream, and user_photos permissions.  You have: #{perms.inspect}"
+        raise ArgumentError, "Your access token must have the read_stream, publish_stream, and user_photos permissions, and lack read_insights.  You have: #{perms.inspect}"
       end
     end
     puts "done!"