koala 1.2.0 → 1.3.0

data/spec/support/graph_api_shared_examples.rb

@@ -2,27 +2,27 @@ shared_examples_for "Koala GraphAPI" do
   # all Graph API instances should pass these tests, regardless of configuration
 
   # API
-  it "should never use the rest api server" do
+  it "never uses the rest api server" do
     Koala.should_receive(:make_request).with(
       anything,
       anything,
       anything,
       hash_not_including(:rest_api => true)
-    ).and_return(Koala::Response.new(200, "", {}))
+    ).and_return(Koala::HTTPService::Response.new(200, "", {}))
 
     @api.api("anything")
   end
 
   # GRAPH CALL
   describe "graph_call" do
-    it "should pass all arguments to the api method" do
+    it "passes all arguments to the api method" do
       args = [KoalaTest.user1, {}, "get", {:a => :b}]
       @api.should_receive(:api).with(*args)
       @api.graph_call(*args)
     end
 
-    it "should throw an APIError if the result hash has an error key" do
-      Koala.stub(:make_request).and_return(Koala::Response.new(500, {"error" => "An error occurred!"}, {}))
+    it "throws an APIError if the result hash has an error key" do
+      Koala.stub(:make_request).and_return(Koala::HTTPService::Response.new(500, {"error" => "An error occurred!"}, {}))
       lambda { @api.graph_call(KoalaTest.user1, {}) }.should raise_exception(Koala::Facebook::APIError)
     end
     
@@ -49,7 +49,7 @@ shared_examples_for "Koala GraphAPI" do
   end
 
   # SEARCH
-  it "should be able to search" do
+  it "can search" do
     result = @api.search("facebook")
     result.length.should be_an(Integer)
   end
@@ -58,109 +58,173 @@ shared_examples_for "Koala GraphAPI" do
   # access public info
 
   # get_object
-  it "should get public data about a user" do
+  it "gets public data about a user" do
     result = @api.get_object(KoalaTest.user1)
     # the results should have an ID and a name, among other things
     (result["id"] && result["name"]).should_not be_nil
   end
 
-  it "should get public data about a Page" do
+  it "gets public data about a Page" do
     result = @api.get_object(KoalaTest.page)
     # the results should have an ID and a name, among other things
     (result["id"] && result["name"]).should
   end
 
-  it "should return [] from get_objects if passed an empty array" do
+  it "returns [] from get_objects if passed an empty array" do
     results = @api.get_objects([])
     results.should == []
   end
 
-  it "should be able to get multiple objects" do
+  it "gets multiple objects" do
     results = @api.get_objects([KoalaTest.page, KoalaTest.user1])
     results.should have(2).items
   end
 
-  it "should be able to get multiple objects if they're a string" do
+  it "gets multiple objects if they're a string" do
     results = @api.get_objects("contextoptional,#{KoalaTest.user1}")
     results.should have(2).items
   end
 
-  it "should be able to access a user's picture" do
-    @api.get_picture("chris.baclig").should =~ /http[s]*\:\/\//
+  it "can access a user's picture" do
+    @api.get_picture(KoalaTest.user2).should =~ /http[s]*\:\/\//
   end
 
-  it "should be able to access a user's picture, given a picture type"  do
+  it "can access a user's picture, given a picture type"  do
     @api.get_picture(KoalaTest.user2, {:type => 'large'}).should =~ /^http[s]*\:\/\//
   end
 
-  it "should be able to access connections from public Pages" do
+  it "can access connections from public Pages" do
     result = @api.get_connections(KoalaTest.page, "photos")
     result.should be_a(Array)
   end
 
-  it "should be able to access comments for a URL" do
+  it "can access comments for a URL" do
     result = @api.get_comments_for_urls(["http://developers.facebook.com/blog/post/472"])
     (result["http://developers.facebook.com/blog/post/472"]).should
   end
 
-  it "should be able to access comments for 2 URLs" do
+  it "can access comments for 2 URLs" do
     result = @api.get_comments_for_urls(["http://developers.facebook.com/blog/post/490", "http://developers.facebook.com/blog/post/472"])
     (result["http://developers.facebook.com/blog/post/490"] && result["http://developers.facebook.com/blog/post/472"]).should
   end
 
   # SEARCH
-  it "should be able to search" do
+  it "can search" do
     result = @api.search("facebook")
     result.length.should be_an(Integer)
   end
 
   # PAGING THROUGH COLLECTIONS
   # see also graph_collection_tests
-  it "should make a request for a page when provided a specific set of page params" do
+  it "makes a request for a page when provided a specific set of page params" do
     query = [1, 2]
     @api.should_receive(:graph_call).with(*query)
     @api.get_page(query)
   end
+  
+  # Beta tier
+  it "can use the beta tier" do
+    result = @api.get_object(KoalaTest.user1, {}, :beta => true)
+    # the results should have an ID and a name, among other things
+    (result["id"] && result["name"]).should_not be_nil
+  end
+  
+  # FQL  
+  describe "#fql_query" do
+    it "makes a request to /fql" do
+      @api.should_receive(:get_object).with("fql", anything, anything)
+      @api.fql_query stub('query string')
+    end
+
+    it "passes a query argument" do
+      query = stub('query string')
+      @api.should_receive(:get_object).with(anything, hash_including(:q => query), anything)
+      @api.fql_query(query)
+    end
+
+    it "passes on any other arguments provided" do
+      args = {:a => 2}
+      @api.should_receive(:get_object).with(anything, hash_including(args), anything)
+      @api.fql_query("a query", args)
+    end
+  end
+
+  describe "#fql_multiquery" do
+    it "makes a request to /fql" do
+      @api.should_receive(:get_object).with("fql", anything, anything)
+      @api.fql_multiquery 'query string'
+    end
+
+    it "passes a queries argument" do
+      queries = stub('query string')
+      queries_json = "some JSON"
+      MultiJson.stub(:encode).with(queries).and_return(queries_json)
+
+      @api.should_receive(:get_object).with(anything, hash_including(:q => queries_json), anything)
+      @api.fql_multiquery(queries)
+    end
+
+    it "simplifies the response format" do
+      raw_results = [
+        {"name" => "query1", "fql_result_set" => [1, 2, 3]},
+        {"name" => "query2", "fql_result_set" => [:a, :b, :c]}
+      ]
+      expected_results = {
+        "query1" => [1, 2, 3],
+        "query2" => [:a, :b, :c]
+      }
+
+      @api.stub(:get_object).and_return(raw_results)
+      results = @api.fql_multiquery({:query => true})
+      results.should == expected_results
+    end
+
+    it "passes on any other arguments provided" do
+      args = {:a => 2}
+      @api.should_receive(:get_object).with(anything, hash_including(args), anything)
+      @api.fql_multiquery("a query", args)
+    end
+  end
 end
 
 
 shared_examples_for "Koala GraphAPI with an access token" do
-  it "should get private data about a user" do
+  it "gets private data about a user" do
     result = @api.get_object(KoalaTest.user1)
     # updated_time should be a pretty fixed test case
     result["updated_time"].should_not be_nil
   end
 
-  it "should get data about 'me'" do
+  it "gets data about 'me'" do
     result = @api.get_object("me")
     result["updated_time"].should
   end
 
-  it "should be able to get multiple objects" do
+  it "gets multiple objects" do
     result = @api.get_objects([KoalaTest.page, KoalaTest.user1])
     result.length.should == 2
   end
-  it "should be able to access connections from users" do
+  it "can access connections from users" do
     result = @api.get_connections(KoalaTest.user2, "friends")
     result.length.should > 0
   end
 
   # PUT
-  it "should be able to write an object to the graph" do
+  it "can write an object to the graph" do
     result = @api.put_wall_post("Hello, world, from the test suite!")
     @temporary_object_id = result["id"]
     @temporary_object_id.should_not be_nil
   end
 
   # DELETE
-  it "should be able to delete posts" do
+  it "can delete posts" do
     result = @api.put_wall_post("Hello, world, from the test suite delete method!")
     object_id_to_delete = result["id"]
     delete_result = @api.delete_object(object_id_to_delete)
     delete_result.should == true
   end
 
-  it "should be able to delete likes" do
+  it "can delete likes" do
     result = @api.put_wall_post("Hello, world, from the test suite delete method!")
     @temporary_object_id = result["id"]
     @api.put_like(@temporary_object_id)
@@ -169,7 +233,7 @@ shared_examples_for "Koala GraphAPI with an access token" do
   end
 
   # additional put tests
-  it "should be able to verify messages posted to a wall" do
+  it "can verify messages posted to a wall" do
     message = "the cats are asleep"
     put_result = @api.put_wall_post(message)
     @temporary_object_id = put_result["id"]
@@ -179,14 +243,33 @@ shared_examples_for "Koala GraphAPI with an access token" do
     get_result["message"].should == message
   end
 
-  it "should be able to post a message with an attachment to a feed" do
+  it "can post a message with an attachment to a feed" do
     result = @api.put_wall_post("Hello, world, from the test suite again!", {:name => "OAuth Playground", :link => "http://oauth.twoalex.com/"})
     @temporary_object_id = result["id"]
     @temporary_object_id.should_not be_nil
   end
+  
+  it "can post a message whose attachment has a properties dictionary" do
+    url = KoalaTest.oauth_test_data["callback_url"]
+    options = {
+    "picture" => "#{KoalaTest.oauth_test_data["callback_url"]}/images/logo.png",
+    "name" => "It's a big question",
+    "type" => "link",
+    "link" => KoalaTest.oauth_test_data["callback_url"],
+    "properties" => [
+        {"name" => "Link1'", "text" => "Left", "href" => url},
+        {"name" => "other", "text" => "Straight ahead"}
+      ]    
+    }
+
+    result = @api.put_wall_post("body", options)
+    @temporary_object_id = result["id"]
+    @temporary_object_id.should_not be_nil
+  end
+  
 
-  describe ".put_picture" do
-    it "should be able to post photos to the user's wall with an open file object" do
+  describe "#put_picture" do
+    it "can post photos to the user's wall with an open file object" do
       content_type = "image/jpg"
       file = File.open(File.join(File.dirname(__FILE__), "..", "fixtures", "beach.jpg"))
 
@@ -195,7 +278,7 @@ shared_examples_for "Koala GraphAPI with an access token" do
       @temporary_object_id.should_not be_nil
     end
 
-    it "should be able to post photos to the user's wall without an open file object" do
+    it "can post photos to the user's wall without an open file object" do
       content_type = "image/jpg",
       file_path = File.join(File.dirname(__FILE__), "..", "fixtures", "beach.jpg")
 
@@ -204,7 +287,7 @@ shared_examples_for "Koala GraphAPI with an access token" do
       @temporary_object_id.should_not be_nil
     end
 
-    it "should be able to verify a photo posted to a user's wall" do
+    it "can verify a photo posted to a user's wall" do
       content_type = "image/jpg",
       file_path = File.join(File.dirname(__FILE__), "..", "fixtures", "beach.jpg")
 
@@ -224,13 +307,13 @@ shared_examples_for "Koala GraphAPI with an access token" do
         @url = "http://img.slate.com/images/redesign2008/slate_logo.gif"
       end
 
-      it "should be able to post photo to the user's wall using a URL" do
+      it "can post photo to the user's wall using a URL" do
         result = @api.put_picture(@url)
         @temporary_object_id = result["id"]
         @temporary_object_id.should_not be_nil
       end
 
-      it "should be able to post photo to the user's wall using a URL and an additional param" do
+      it "can post photo to the user's wall using a URL and an additional param" do
         result = @api.put_picture(@url, :message => "my message")
         @temporary_object_id = result["id"]
         @temporary_object_id.should_not be_nil
@@ -238,21 +321,21 @@ shared_examples_for "Koala GraphAPI with an access token" do
     end
   end
 
-  describe ".put_video" do
+  describe "#put_video" do
     before :each do
       @cat_movie = File.join(File.dirname(__FILE__), "..", "fixtures", "cat.m4v")
       @content_type = "video/mpeg4"
     end
 
-    it "should set options[:video] to true" do
+    it "sets options[:video] to true" do
       source = stub("UploadIO")
       Koala::UploadableIO.stub(:new).and_return(source)
       source.stub(:requires_base_http_service).and_return(false)
-      Koala.should_receive(:make_request).with(anything, anything, anything, hash_including(:video => true)).and_return(Koala::Response.new(200, "[]", {}))
+      Koala.should_receive(:make_request).with(anything, anything, anything, hash_including(:video => true)).and_return(Koala::HTTPService::Response.new(200, "[]", {}))
       @api.put_video("foo")
     end
 
-    it "should be able to post videos to the user's wall with an open file object" do
+    it "can post videos to the user's wall with an open file object" do
       file = File.open(@cat_movie)
 
       result = @api.put_video(file, @content_type)
@@ -261,7 +344,7 @@ shared_examples_for "Koala GraphAPI with an access token" do
     end
 
 
-    it "should be able to post videos to the user's wall without an open file object" do
+    it "can post videos to the user's wall without an open file object" do
       result = @api.put_video(@cat_movie, @content_type)
       @temporary_object_id = result["id"]
       @temporary_object_id.should_not be_nil
@@ -272,7 +355,7 @@ shared_examples_for "Koala GraphAPI with an access token" do
     # hence we can't do the same verify test we do for photos
   end
 
-  it "should be able to verify a message with an attachment posted to a feed" do
+  it "can verify a message with an attachment posted to a feed" do
     attachment = {"name" => "OAuth Playground", "link" => "http://oauth.twoalex.com/"}
     result = @api.put_wall_post("Hello, world, from the test suite again!", attachment)
     @temporary_object_id = result["id"]
@@ -283,7 +366,7 @@ shared_examples_for "Koala GraphAPI with an access token" do
     it_matches.should == true
   end
 
-  it "should be able to comment on an object" do
+  it "can comment on an object" do
     result = @api.put_wall_post("Hello, world, from the test suite, testing comments!")
     @temporary_object_id = result["id"]
 
@@ -292,8 +375,8 @@ shared_examples_for "Koala GraphAPI with an access token" do
     comment_result.should_not be_nil
   end
 
-  it "should be able to verify a comment posted about an object" do
-    message_text = "Hello, world, from the test suite, testing comments!"
+  it "can verify a comment posted about an object" do
+    message_text = "Hello, world, from the test suite, testing comments again!"
     result = @api.put_wall_post(message_text)
     @temporary_object_id = result["id"]
 
@@ -306,18 +389,103 @@ shared_examples_for "Koala GraphAPI with an access token" do
     get_result["message"].should == comment_text
   end
 
-  it "should be able to like an object" do
-    result = @api.put_wall_post("Hello, world, from the test suite, testing comments!")
+  it "can like an object" do
+    result = @api.put_wall_post("Hello, world, from the test suite, testing liking!")
     @temporary_object_id = result["id"]
     like_result = @api.put_like(@temporary_object_id)
     like_result.should be_true
   end
 
   # Page Access Token Support
-  it "gets a page's access token" do
-    # we can't test this live since test users (or random real users) can't be guaranteed to have pages to manage
-    @api.should_receive(:api).with("my_page", {:fields => "access_token"}, "get", anything)
-    @api.get_page_access_token("my_page")
+  describe "#get_page_access_token" do
+    it "gets the page object with the access_token field" do
+      # we can't test this live since test users (or random real users) can't be guaranteed to have pages to manage
+      @api.should_receive(:api).with("my_page", hash_including({:fields => "access_token"}), "get", anything)
+      @api.get_page_access_token("my_page")
+    end
+    
+    it "merges in any other arguments" do
+      # we can't test this live since test users (or random real users) can't be guaranteed to have pages to manage
+      args = {:a => 3}
+      @api.should_receive(:api).with("my_page", hash_including(args), "get", anything)
+      @api.get_page_access_token("my_page", args)
+    end    
+  end
+
+  describe "#set_app_restrictions" do
+    before :all do
+      oauth = Koala::Facebook::OAuth.new(KoalaTest.app_id, KoalaTest.secret)
+      app_token = oauth.get_app_access_token
+      @app_api = Koala::Facebook::API.new(app_token)
+      @restrictions = {"age_distr" => "13+"}
+    end
+
+    it "makes a POST to /app_id" do
+      @app_api.should_receive(:graph_call).with(KoalaTest.app_id, anything, "post", anything)
+      @app_api.set_app_restrictions(KoalaTest.app_id, @restrictions)
+    end
+    
+    it "JSON-encodes the restrictions" do
+      @app_api.should_receive(:graph_call).with(anything, hash_including(:restrictions => MultiJson.encode(@restrictions)), anything, anything)
+      @app_api.set_app_restrictions(KoalaTest.app_id, @restrictions)
+    end
+    
+    it "includes the other arguments" do
+      args = {:a => 2}
+      @app_api.should_receive(:graph_call).with(anything, hash_including(args), anything, anything)
+      @app_api.set_app_restrictions(KoalaTest.app_id, @restrictions, args)
+    end
+    
+    it "works" do
+      @app_api.set_app_restrictions(KoalaTest.app_id, @restrictions).should be_true
+    end
+  end
+
+  it "changes tests to first_name when FB repairs its bug" 
+
+  it "can access public information via FQL" do
+    result = @api.fql_query("select uid, first_name from user where uid = #{KoalaTest.user2_id}")
+    result.size.should == 1
+    # result.first['first_name'].should == KoalaTest.user2_name
+    result.first['uid'].should == KoalaTest.user2_id.to_i
+  end
+  
+  it "can access public information via FQL.multiquery" do
+    result = @api.fql_multiquery(
+      :query1 => "select uid, first_name from user where uid = #{KoalaTest.user2_id}",
+      :query2 => "select uid, first_name from user where uid = #{KoalaTest.user1_id}"
+    )
+    result.size.should == 2
+    # this should check for first_name, but there's an FB bug currently
+    result["query1"].first['uid'].should == KoalaTest.user2_id.to_i
+    # result["query1"].first['first_name'].should == KoalaTest.user2_name
+    result["query2"].first['first_name'].should == KoalaTest.user1_name
+  end
+
+  it "can access protected information via FQL" do
+    # Tests agains the permissions fql table
+
+    # get the current user's ID
+    # we're sneakily using the Graph API, which should be okay since it has its own tests
+    g = Koala::Facebook::API.new(@token)
+    id = g.get_object("me", :fields => "id")["id"]
+
+    # now send a query about your permissions
+    result = @api.fql_query("select read_stream from permissions where uid = #{id}")
+
+    result.size.should == 1
+    # we've verified that you have read_stream permissions, so we can test against that
+    result.first["read_stream"].should == 1
+  end
+
+  it "can access protected information via FQL.multiquery" do
+    result = @api.fql_multiquery(
+      :query1 => "select post_id from stream where source_id = me()",
+      :query2 => "select fromid from comment where post_id in (select post_id from #query1)",
+      :query3 => "select uid, name from user where uid in (select fromid from #query2)"
+    )
+    result.size.should == 3
+    result.keys.should include("query1", "query2", "query3")
   end
 
   # test all methods to make sure they pass data through to the API
@@ -337,12 +505,16 @@ shared_examples_for "Koala GraphAPI with an access token" do
       :put_comment => 3,
       :put_like => 2, :delete_like => 2,
       :search => 3,
+      :set_app_restrictions => 4,
+      :get_page_access_token => 3,
+      :fql_query => 3, :fql_multiquery => 3,
       # methods that have special arguments
+      :get_comments_for_urls => [["url1", "url2"], {}],
       :put_picture => ["x.jpg", "image/jpg", {}, "me"],
       :put_video => ["x.mp4", "video/mpeg4", {}, "me"],
       :get_objects => [["x"], {}]
     }.each_pair do |method_name, params|
-      it "should pass http options through for #{method_name}" do
+      it "passes http options through for #{method_name}" do
         options = {:a => 2}
         # graph call should ultimately receive options as the fourth argument
         @api.should_receive(:graph_call).with(anything, anything, anything, options)
@@ -356,7 +528,7 @@ shared_examples_for "Koala GraphAPI with an access token" do
     end
 
     # also test get_picture, which merges a parameter into options
-    it "should pass http options through for get_picture" do
+    it "passes http options through for get_picture" do
       options = {:a => 2}
       # graph call should ultimately receive options as the fourth argument
       @api.should_receive(:graph_call).with(anything, anything, anything, hash_including(options)).and_return({})
@@ -370,34 +542,34 @@ end
 shared_examples_for "Koala GraphAPI with GraphCollection" do
   describe "when getting a collection" do
     # GraphCollection methods
-    it "should get a GraphCollection when getting connections" do
+    it "gets a GraphCollection when getting connections" do
       @result = @api.get_connections(KoalaTest.page, "photos")
       @result.should be_a(Koala::Facebook::GraphCollection)
     end
 
-    it "should return nil if the get_collections call fails with nil" do
+    it "returns nil if the get_collections call fails with nil" do
       # this happens sometimes
       @api.should_receive(:graph_call).and_return(nil)
       @api.get_connections(KoalaTest.page, "photos").should be_nil
     end
 
-    it "should get a GraphCollection when searching" do
+    it "gets a GraphCollection when searching" do
       result = @api.search("facebook")
       result.should be_a(Koala::Facebook::GraphCollection)
     end
 
-    it "should return nil if the search call fails with nil" do
+    it "returns nil if the search call fails with nil" do
       # this happens sometimes
       @api.should_receive(:graph_call).and_return(nil)
       @api.search("facebook").should be_nil
     end
 
-    it "should get a GraphCollection when paging through results" do
+    it "gets a GraphCollection when paging through results" do
       @results = @api.get_page(["search", {"q"=>"facebook", "limit"=>"25", "until"=> KoalaTest.search_time}])
       @results.should be_a(Koala::Facebook::GraphCollection)
     end
 
-    it "should return nil if the page call fails with nil" do
+    it "returns nil if the page call fails with nil" do
       # this happens sometimes
       @api.should_receive(:graph_call).and_return(nil)
       @api.get_page(["search", {"q"=>"facebook", "limit"=>"25", "until"=> KoalaTest.search_time}]).should be_nil
@@ -407,49 +579,81 @@ end
 
 
 shared_examples_for "Koala GraphAPI without an access token" do
-
-  it "should not get private data about a user" do
-    result = @api.get_object("koppel")
+  it "can't get private data about a user" do
+    result = @api.get_object(KoalaTest.user1)
     # updated_time should be a pretty fixed test case
     result["updated_time"].should be_nil
   end
 
-  it "should not be able to get data about 'me'" do
+  it "can't get data about 'me'" do
     lambda { @api.get_object("me") }.should raise_error(Koala::Facebook::APIError)
   end
 
-  it "shouldn't be able to access connections from users" do
-    lambda { @api.get_connections("lukeshepard", "friends") }.should raise_error(Koala::Facebook::APIError)
+  it "can't access connections from users" do
+    lambda { @api.get_connections(KoalaTest.user2, "friends") }.should raise_error(Koala::Facebook::APIError)
   end
 
-  it "should not be able to put an object" do
-    lambda { @result = @api.put_object("lukeshepard", "feed", :message => "Hello, world") }.should raise_error(Koala::Facebook::APIError)
+  it "can't put an object" do
+    lambda { @result = @api.put_object(KoalaTest.user2, "feed", :message => "Hello, world") }.should raise_error(Koala::Facebook::APIError)
   end
 
   # these are not strictly necessary as the other put methods resolve to put_object, but are here for completeness
-  it "should not be able to post to a feed" do
+  it "can't post to a feed" do
     (lambda do
       attachment = {:name => "OAuth Playground", :link => "http://oauth.twoalex.com/"}
       @result = @api.put_wall_post("Hello, world", attachment, "contextoptional")
     end).should raise_error(Koala::Facebook::APIError)
   end
 
-  it "should not be able to comment on an object" do
+  it "can't comment on an object" do
     # random public post on the ContextOptional wall
     lambda { @result = @api.put_comment("7204941866_119776748033392", "The hackathon was great!") }.should raise_error(Koala::Facebook::APIError)
   end
 
-  it "should not be able to like an object" do
+  it "can't like an object" do
     lambda { @api.put_like("7204941866_119776748033392") }.should raise_error(Koala::Facebook::APIError)
   end
 
   # DELETE
-  it "should not be able to delete posts" do
+  it "can't delete posts" do
     # test post on the Ruby SDK Test application
     lambda { @result = @api.delete_object("115349521819193_113815981982767") }.should raise_error(Koala::Facebook::APIError)
   end
 
-  it "should not be able to delete a like" do
+  it "can't delete a like" do
     lambda { @api.delete_like("7204941866_119776748033392") }.should raise_error(Koala::Facebook::APIError)
   end
+  
+  # FQL_QUERY
+  describe "when making a FQL request" do
+    it "can access public information via FQL" do
+      result = @api.fql_query("select uid, first_name from user where uid = #{KoalaTest.user2_id}")
+      result.size.should == 1
+      result.first['first_name'].should == KoalaTest.user2_name
+    end
+
+    it "can access public information via FQL.multiquery" do
+      result = @api.fql_multiquery(
+        :query1 => "select uid, first_name from user where uid = #{KoalaTest.user2_id}",
+        :query2 => "select uid, first_name from user where uid = #{KoalaTest.user1_id}"
+      )
+      result.size.should == 2
+      result["query1"].first['first_name'].should == KoalaTest.user2_name
+      result["query2"].first['first_name'].should == KoalaTest.user1_name
+    end
+
+    it "can't access protected information via FQL" do
+      lambda { @api.fql_query("select read_stream from permissions where uid = #{KoalaTest.user2_id}") }.should raise_error(Koala::Facebook::APIError)
+    end
+
+    it "can't access protected information via FQL.multiquery" do
+      lambda {
+        @api.fql_multiquery(
+          :query1 => "select post_id from stream where source_id = me()",
+          :query2 => "select fromid from comment where post_id in (select post_id from #query1)",
+          :query3 => "select uid, name from user where uid in (select fromid from #query2)"
+        )
+      }.should raise_error(Koala::Facebook::APIError)
+    end
+  end
 end