From 8a2e6a98c20e34048df198da1b1957e0920cd24b Mon Sep 17 00:00:00 2001
From: TheHollidayInn <krh121791@gmail.com>
Date: Tue, 11 Apr 2017 16:36:45 -0600
Subject: [PATCH] Added email invite limit

---
 .../groups/POST-groups_invite.test.js         | 28 +++++++++++++++++++
 website/common/locales/en/groups.json         |  3 +-
 website/server/controllers/api-v3/groups.js   |  6 ++++
 website/server/models/user/schema.js          |  1 +
 4 files changed, 37 insertions(+), 1 deletion(-)

diff --git a/test/api/v3/integration/groups/POST-groups_invite.test.js b/test/api/v3/integration/groups/POST-groups_invite.test.js
index ecaea4c74f..2491ecf63c 100644
--- a/test/api/v3/integration/groups/POST-groups_invite.test.js
+++ b/test/api/v3/integration/groups/POST-groups_invite.test.js
@@ -7,6 +7,7 @@ import { v4 as generateUUID } from 'uuid';
 
 const INVITES_LIMIT = 100;
 const PARTY_LIMIT_MEMBERS = 30;
+const MAX_EMAIL_INVITES_BY_USER = 200;
 
 describe('Post /groups/:groupId/invite', () => {
   let inviter;
@@ -205,13 +206,37 @@ describe('Post /groups/:groupId/invite', () => {
       });
     });
 
+    it('returns an error when a user has sent the max number of email invites', async () => {
+      let inviterWithMax = await generateUser({
+        invitesSent: MAX_EMAIL_INVITES_BY_USER,
+        balance: 4,
+      });
+      let tmpGroup = await inviterWithMax.post('/groups', {
+        name: groupName,
+        type: 'guild',
+      });
+
+      await expect(inviterWithMax.post(`/groups/${tmpGroup._id}/invite`, {
+        emails: [testInvite],
+        inviter: 'inviter name',
+      }))
+      .to.eventually.be.rejected.and.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('inviteLimitReached'),
+      });
+    });
+
     it('invites a user to a group by email', async () => {
       let res = await inviter.post(`/groups/${group._id}/invite`, {
         emails: [testInvite],
         inviter: 'inviter name',
       });
 
+      let updatedUser = await inviter.sync();
+
       expect(res).to.exist;
+      expect(updatedUser.invitesSent).to.eql(1);
     });
 
     it('invites multiple users to a group by email', async () => {
@@ -219,7 +244,10 @@ describe('Post /groups/:groupId/invite', () => {
         emails: [testInvite, {name: 'test2', email: 'test2@habitica.com'}],
       });
 
+      let updatedUser = await inviter.sync();
+
       expect(res).to.exist;
+      expect(updatedUser.invitesSent).to.eql(2);
     });
   });
 
diff --git a/website/common/locales/en/groups.json b/website/common/locales/en/groups.json
index 87c82d5152..80c0b62865 100644
--- a/website/common/locales/en/groups.json
+++ b/website/common/locales/en/groups.json
@@ -270,5 +270,6 @@
   "confirmCancelGroupPlan": "Are you sure you want to cancel the group plan and remove its benefits from all members, including their free subscriptions?",
   "canceledGroupPlan": "Canceled Group Plan",
   "groupPlanCanceled": "Group Plan will become inactive on",
-  "purchasedGroupPlanPlanExtraMonths": "You have <%= months %> months of extra group plan credit."
+  "purchasedGroupPlanPlanExtraMonths": "You have <%= months %> months of extra group plan credit.",
+  "inviteLimitReached": "You have already sent the max number of email invites."
 }
diff --git a/website/server/controllers/api-v3/groups.js b/website/server/controllers/api-v3/groups.js
index cc4997384e..e4fcf564bf 100644
--- a/website/server/controllers/api-v3/groups.js
+++ b/website/server/controllers/api-v3/groups.js
@@ -27,6 +27,8 @@ import amzLib from '../../libs/amazonPayments';
 import shared from '../../../common';
 import apiMessages from '../../libs/apiMessages';
 
+const MAX_EMAIL_INVITES_BY_USER = 200;
+
 /**
  * @apiDefine GroupBodyInvalid
  * @apiError (400) {BadRequest} GroupBodyInvalid A parameter in the group body was invalid.
@@ -1056,6 +1058,8 @@ api.inviteToGroup = {
 
     req.checkParams('groupId', res.t('groupIdRequired')).notEmpty();
 
+    if (user.invitesSent >= MAX_EMAIL_INVITES_BY_USER) throw new NotAuthorized(res.t('inviteLimitReached'));
+
     let validationErrors = req.validationErrors();
     if (validationErrors) throw validationErrors;
 
@@ -1079,6 +1083,8 @@ api.inviteToGroup = {
 
     if (emails) {
       let emailInvites = emails.map((invite) => _inviteByEmail(invite, group, user, req, res));
+      user.invitesSent += emails.length;
+      await user.save();
       let emailResults = await Bluebird.all(emailInvites);
       results.push(...emailResults);
     }
diff --git a/website/server/models/user/schema.js b/website/server/models/user/schema.js
index 3cb7c9ecd4..364d4d1958 100644
--- a/website/server/models/user/schema.js
+++ b/website/server/models/user/schema.js
@@ -550,6 +550,7 @@ let schema = new Schema({
   }},
   webhooks: [WebhookSchema],
   loginIncentives: {type: Number, default: 0},
+  invitesSent: {type: Number, default: 0},
 }, {
   strict: true,
   minimize: false, // So empty objects are returned