API v4 (WIP) (#10453)

API v4

test/api/unit/libs/payments/amazon/cancel.test.js

@@ -0,0 +1,180 @@
+import moment from 'moment';
+
+import {
+  generateGroup,
+} from '../../../../../helpers/api-unit.helper.js';
+import { model as User } from '../../../../../../website/server/models/user';
+import amzLib from '../../../../../../website/server/libs/payments/amazon';
+import payments from '../../../../../../website/server/libs/payments/payments';
+import common from '../../../../../../website/common';
+import { createNonLeaderGroupMember } from '../paymentHelpers';
+
+const i18n = common.i18n;
+
+describe('Amazon Payments - Cancel Subscription', () => {
+  const subKey = 'basic_3mo';
+
+  let user, group, headers, billingAgreementId, subscriptionBlock, subscriptionLength;
+  let getBillingAgreementDetailsSpy;
+  let paymentCancelSubscriptionSpy;
+
+  function expectAmazonStubs () {
+    expect(getBillingAgreementDetailsSpy).to.be.calledOnce;
+    expect(getBillingAgreementDetailsSpy).to.be.calledWith({
+      AmazonBillingAgreementId: billingAgreementId,
+    });
+  }
+
+  function expectAmazonCancelSubscriptionSpy (groupId, lastBillingDate) {
+    expect(paymentCancelSubscriptionSpy).to.be.calledWith({
+      user,
+      groupId,
+      nextBill: moment(lastBillingDate).add({ days: subscriptionLength }),
+      paymentMethod: amzLib.constants.PAYMENT_METHOD,
+      headers,
+      cancellationReason: undefined,
+    });
+  }
+
+  function expectAmazonCancelUserSubscriptionSpy () {
+    expect(paymentCancelSubscriptionSpy).to.be.calledOnce;
+    expectAmazonCancelSubscriptionSpy(undefined, user.purchased.plan.lastBillingDate);
+  }
+
+  function expectAmazonCancelGroupSubscriptionSpy (groupId) {
+    expect(paymentCancelSubscriptionSpy).to.be.calledOnce;
+    expectAmazonCancelSubscriptionSpy(groupId, group.purchased.plan.lastBillingDate);
+  }
+
+  function expectBillingAggreementDetailSpy () {
+    getBillingAgreementDetailsSpy = sinon.stub(amzLib, 'getBillingAgreementDetails')
+      .returnsPromise()
+      .resolves({
+        BillingAgreementDetails: {
+          BillingAgreementStatus: {State: 'Open'},
+        },
+      });
+  }
+
+  beforeEach(async () => {
+    user = new User();
+    user.profile.name = 'sender';
+    user.purchased.plan.customerId = 'customer-id';
+    user.purchased.plan.planId = subKey;
+    user.purchased.plan.lastBillingDate = new Date();
+
+    group = generateGroup({
+      name: 'test group',
+      type: 'guild',
+      privacy: 'public',
+      leader: user._id,
+    });
+    group.purchased.plan.customerId = 'customer-id';
+    group.purchased.plan.planId = subKey;
+    group.purchased.plan.lastBillingDate = new Date();
+    await group.save();
+
+    subscriptionBlock = common.content.subscriptionBlocks[subKey];
+    subscriptionLength = subscriptionBlock.months * 30;
+
+    headers = {};
+
+    getBillingAgreementDetailsSpy = sinon.stub(amzLib, 'getBillingAgreementDetails');
+    getBillingAgreementDetailsSpy.returnsPromise().resolves({
+      BillingAgreementDetails: {
+        BillingAgreementStatus: {State: 'Closed'},
+      },
+    });
+
+    paymentCancelSubscriptionSpy = sinon.stub(payments, 'cancelSubscription');
+    paymentCancelSubscriptionSpy.returnsPromise().resolves({});
+  });
+
+  afterEach(function () {
+    amzLib.getBillingAgreementDetails.restore();
+    payments.cancelSubscription.restore();
+  });
+
+  it('should throw an error if we are missing a subscription', async () => {
+    user.purchased.plan.customerId = undefined;
+
+    await expect(amzLib.cancelSubscription({user}))
+      .to.eventually.be.rejected.and.to.eql({
+        httpCode: 401,
+        name: 'NotAuthorized',
+        message: i18n.t('missingSubscription'),
+      });
+  });
+
+  it('should cancel a user subscription', async () => {
+    billingAgreementId = user.purchased.plan.customerId;
+
+    await amzLib.cancelSubscription({user, headers});
+
+    expectAmazonCancelUserSubscriptionSpy();
+    expectAmazonStubs();
+  });
+
+  it('should close a user subscription if amazon not closed', async () => {
+    amzLib.getBillingAgreementDetails.restore();
+    expectBillingAggreementDetailSpy();
+    let closeBillingAgreementSpy = sinon.stub(amzLib, 'closeBillingAgreement').returnsPromise().resolves({});
+    billingAgreementId = user.purchased.plan.customerId;
+
+    await amzLib.cancelSubscription({user, headers});
+
+    expectAmazonStubs();
+    expect(closeBillingAgreementSpy).to.be.calledOnce;
+    expect(closeBillingAgreementSpy).to.be.calledWith({
+      AmazonBillingAgreementId: billingAgreementId,
+    });
+    expectAmazonCancelUserSubscriptionSpy();
+    amzLib.closeBillingAgreement.restore();
+  });
+
+  it('should throw an error if group is not found', async () => {
+    await expect(amzLib.cancelSubscription({user, groupId: 'fake-id'}))
+      .to.eventually.be.rejected.and.to.eql({
+        httpCode: 404,
+        name: 'NotFound',
+        message: i18n.t('groupNotFound'),
+      });
+  });
+
+  it('should throw an error if user is not group leader', async () => {
+    let nonLeader = await createNonLeaderGroupMember(group);
+
+    await expect(amzLib.cancelSubscription({user: nonLeader, groupId: group._id}))
+      .to.eventually.be.rejected.and.to.eql({
+        httpCode: 401,
+        name: 'NotAuthorized',
+        message: i18n.t('onlyGroupLeaderCanManageSubscription'),
+      });
+  });
+
+  it('should cancel a group subscription', async () => {
+    billingAgreementId = group.purchased.plan.customerId;
+
+    await amzLib.cancelSubscription({user, groupId: group._id, headers});
+
+    expectAmazonCancelGroupSubscriptionSpy(group._id);
+    expectAmazonStubs();
+  });
+
+  it('should close a group subscription if amazon not closed', async () => {
+    amzLib.getBillingAgreementDetails.restore();
+    expectBillingAggreementDetailSpy();
+    let closeBillingAgreementSpy = sinon.stub(amzLib, 'closeBillingAgreement').returnsPromise().resolves({});
+    billingAgreementId = group.purchased.plan.customerId;
+
+    await amzLib.cancelSubscription({user, groupId: group._id, headers});
+
+    expectAmazonStubs();
+    expect(closeBillingAgreementSpy).to.be.calledOnce;
+    expect(closeBillingAgreementSpy).to.be.calledWith({
+      AmazonBillingAgreementId: billingAgreementId,
+    });
+    expectAmazonCancelGroupSubscriptionSpy(group._id);
+    amzLib.closeBillingAgreement.restore();
+  });
+});

test/api/unit/libs/payments/amazon/checkout.test.js

@@ -0,0 +1,193 @@
+import { model as User } from '../../../../../../website/server/models/user';
+import amzLib from '../../../../../../website/server/libs/payments/amazon';
+import payments from '../../../../../../website/server/libs/payments/payments';
+import common from '../../../../../../website/common';
+
+const i18n = common.i18n;
+
+describe('Amazon Payments - Checkout', () => {
+  const subKey = 'basic_3mo';
+  let user, orderReferenceId, headers;
+  let setOrderReferenceDetailsSpy;
+  let confirmOrderReferenceSpy;
+  let authorizeSpy;
+  let closeOrderReferenceSpy;
+
+  let paymentBuyGemsStub;
+  let paymentCreateSubscritionStub;
+  let amount = 5;
+
+  function expectOrderReferenceSpy () {
+    expect(setOrderReferenceDetailsSpy).to.be.calledOnce;
+    expect(setOrderReferenceDetailsSpy).to.be.calledWith({
+      AmazonOrderReferenceId: orderReferenceId,
+      OrderReferenceAttributes: {
+        OrderTotal: {
+          CurrencyCode: amzLib.constants.CURRENCY_CODE,
+          Amount: amount,
+        },
+        SellerNote: amzLib.constants.SELLER_NOTE,
+        SellerOrderAttributes: {
+          SellerOrderId: common.uuid(),
+          StoreName: amzLib.constants.STORE_NAME,
+        },
+      },
+    });
+  }
+
+  function expectAuthorizeSpy () {
+    expect(authorizeSpy).to.be.calledOnce;
+    expect(authorizeSpy).to.be.calledWith({
+      AmazonOrderReferenceId: orderReferenceId,
+      AuthorizationReferenceId: common.uuid().substring(0, 32),
+      AuthorizationAmount: {
+        CurrencyCode: amzLib.constants.CURRENCY_CODE,
+        Amount: amount,
+      },
+      SellerAuthorizationNote: amzLib.constants.SELLER_NOTE,
+      TransactionTimeout: 0,
+      CaptureNow: true,
+    });
+  }
+
+  function expectAmazonStubs () {
+    expectOrderReferenceSpy();
+
+    expect(confirmOrderReferenceSpy).to.be.calledOnce;
+    expect(confirmOrderReferenceSpy).to.be.calledWith({ AmazonOrderReferenceId: orderReferenceId });
+
+    expectAuthorizeSpy();
+
+    expect(closeOrderReferenceSpy).to.be.calledOnce;
+    expect(closeOrderReferenceSpy).to.be.calledWith({ AmazonOrderReferenceId: orderReferenceId });
+  }
+
+  beforeEach(function () {
+    user = new User();
+    headers = {};
+    orderReferenceId = 'orderReferenceId';
+
+    setOrderReferenceDetailsSpy = sinon.stub(amzLib, 'setOrderReferenceDetails');
+    setOrderReferenceDetailsSpy.returnsPromise().resolves({});
+
+    confirmOrderReferenceSpy = sinon.stub(amzLib, 'confirmOrderReference');
+    confirmOrderReferenceSpy.returnsPromise().resolves({});
+
+    authorizeSpy = sinon.stub(amzLib, 'authorize');
+    authorizeSpy.returnsPromise().resolves({});
+
+    closeOrderReferenceSpy = sinon.stub(amzLib, 'closeOrderReference');
+    closeOrderReferenceSpy.returnsPromise().resolves({});
+
+    paymentBuyGemsStub = sinon.stub(payments, 'buyGems');
+    paymentBuyGemsStub.returnsPromise().resolves({});
+
+    paymentCreateSubscritionStub = sinon.stub(payments, 'createSubscription');
+    paymentCreateSubscritionStub.returnsPromise().resolves({});
+
+    sinon.stub(common, 'uuid').returns('uuid-generated');
+  });
+
+  afterEach(function () {
+    amzLib.setOrderReferenceDetails.restore();
+    amzLib.confirmOrderReference.restore();
+    amzLib.authorize.restore();
+    amzLib.closeOrderReference.restore();
+    payments.buyGems.restore();
+    payments.createSubscription.restore();
+    common.uuid.restore();
+  });
+
+  function expectBuyGemsStub (paymentMethod, gift) {
+    expect(paymentBuyGemsStub).to.be.calledOnce;
+
+    let expectedArgs = {
+      user,
+      paymentMethod,
+      headers,
+    };
+    if (gift) expectedArgs.gift = gift;
+    expect(paymentBuyGemsStub).to.be.calledWith(expectedArgs);
+  }
+
+  it('should purchase gems', async () => {
+    sinon.stub(user, 'canGetGems').returnsPromise().resolves(true);
+    await amzLib.checkout({user, orderReferenceId, headers});
+
+    expectBuyGemsStub(amzLib.constants.PAYMENT_METHOD);
+    expectAmazonStubs();
+    expect(user.canGetGems).to.be.calledOnce;
+    user.canGetGems.restore();
+  });
+
+  it('should error if gem amount is too low', async () => {
+    let receivingUser = new User();
+    receivingUser.save();
+    let gift = {
+      type: 'gems',
+      gems: {
+        amount: 0,
+        uuid: receivingUser._id,
+      },
+    };
+
+    await expect(amzLib.checkout({gift, user, orderReferenceId, headers}))
+      .to.eventually.be.rejected.and.to.eql({
+        httpCode: 400,
+        message: 'Amount must be at least 1.',
+        name: 'BadRequest',
+      });
+  });
+
+  it('should error if user cannot get gems gems', async () => {
+    sinon.stub(user, 'canGetGems').returnsPromise().resolves(false);
+    await expect(amzLib.checkout({user, orderReferenceId, headers})).to.eventually.be.rejected.and.to.eql({
+      httpCode: 401,
+      message: i18n.t('groupPolicyCannotGetGems'),
+      name: 'NotAuthorized',
+    });
+    user.canGetGems.restore();
+  });
+
+  it('should gift gems', async () => {
+    let receivingUser = new User();
+    await receivingUser.save();
+    let gift = {
+      type: 'gems',
+      uuid: receivingUser._id,
+      gems: {
+        amount: 16,
+      },
+    };
+    amount = 16 / 4;
+    await amzLib.checkout({gift, user, orderReferenceId, headers});
+
+    expectBuyGemsStub(amzLib.constants.PAYMENT_METHOD_GIFT, gift);
+    expectAmazonStubs();
+  });
+
+  it('should gift a subscription', async () => {
+    let receivingUser = new User();
+    receivingUser.save();
+    let gift = {
+      type: 'subscription',
+      subscription: {
+        key: subKey,
+        uuid: receivingUser._id,
+      },
+    };
+    amount = common.content.subscriptionBlocks[subKey].price;
+
+    await amzLib.checkout({user, orderReferenceId, headers, gift});
+
+    gift.member = receivingUser;
+    expect(paymentCreateSubscritionStub).to.be.calledOnce;
+    expect(paymentCreateSubscritionStub).to.be.calledWith({
+      user,
+      paymentMethod: amzLib.constants.PAYMENT_METHOD_GIFT,
+      headers,
+      gift,
+    });
+    expectAmazonStubs();
+  });
+});

test/api/unit/libs/payments/amazon/subscribe.test.js

@@ -0,0 +1,275 @@
+import cc from 'coupon-code';
+
+import {
+  generateGroup,
+} from '../../../../../helpers/api-unit.helper.js';
+import { model as User } from '../../../../../../website/server/models/user';
+import { model as Coupon } from '../../../../../../website/server/models/coupon';
+import amzLib from '../../../../../../website/server/libs/payments/amazon';
+import payments from '../../../../../../website/server/libs/payments/payments';
+import common from '../../../../../../website/common';
+
+const i18n = common.i18n;
+
+describe('Amazon Payments - Subscribe', () => {
+  const subKey = 'basic_3mo';
+  let user, group, amount, billingAgreementId, sub, coupon, groupId, headers;
+  let amazonSetBillingAgreementDetailsSpy;
+  let amazonConfirmBillingAgreementSpy;
+  let amazonAuthorizeOnBillingAgreementSpy;
+  let createSubSpy;
+
+  beforeEach(async () => {
+    user = new User();
+    user.profile.name = 'sender';
+    user.purchased.plan.customerId = 'customer-id';
+    user.purchased.plan.planId = subKey;
+    user.purchased.plan.lastBillingDate = new Date();
+
+    group = generateGroup({
+      name: 'test group',
+      type: 'guild',
+      privacy: 'public',
+      leader: user._id,
+    });
+    group.purchased.plan.customerId = 'customer-id';
+    group.purchased.plan.planId = subKey;
+    await group.save();
+
+    amount = common.content.subscriptionBlocks[subKey].price;
+    billingAgreementId = 'billingAgreementId';
+    sub = {
+      key: subKey,
+      price: amount,
+    };
+    groupId = group._id;
+    headers = {};
+
+    amazonSetBillingAgreementDetailsSpy = sinon.stub(amzLib, 'setBillingAgreementDetails');
+    amazonSetBillingAgreementDetailsSpy.returnsPromise().resolves({});
+
+    amazonConfirmBillingAgreementSpy = sinon.stub(amzLib, 'confirmBillingAgreement');
+    amazonConfirmBillingAgreementSpy.returnsPromise().resolves({});
+
+    amazonAuthorizeOnBillingAgreementSpy = sinon.stub(amzLib, 'authorizeOnBillingAgreement');
+    amazonAuthorizeOnBillingAgreementSpy.returnsPromise().resolves({});
+
+    createSubSpy = sinon.stub(payments, 'createSubscription');
+    createSubSpy.returnsPromise().resolves({});
+
+    sinon.stub(common, 'uuid').returns('uuid-generated');
+  });
+
+  afterEach(function () {
+    amzLib.setBillingAgreementDetails.restore();
+    amzLib.confirmBillingAgreement.restore();
+    amzLib.authorizeOnBillingAgreement.restore();
+    payments.createSubscription.restore();
+    common.uuid.restore();
+  });
+
+  function expectAmazonAuthorizeBillingAgreementSpy () {
+    expect(amazonAuthorizeOnBillingAgreementSpy).to.be.calledOnce;
+    expect(amazonAuthorizeOnBillingAgreementSpy).to.be.calledWith({
+      AmazonBillingAgreementId: billingAgreementId,
+      AuthorizationReferenceId: common.uuid().substring(0, 32),
+      AuthorizationAmount: {
+        CurrencyCode: amzLib.constants.CURRENCY_CODE,
+        Amount: amount,
+      },
+      SellerAuthorizationNote: amzLib.constants.SELLER_NOTE_ATHORIZATION_SUBSCRIPTION,
+      TransactionTimeout: 0,
+      CaptureNow: true,
+      SellerNote: amzLib.constants.SELLER_NOTE_ATHORIZATION_SUBSCRIPTION,
+      SellerOrderAttributes: {
+        SellerOrderId: common.uuid(),
+        StoreName: amzLib.constants.STORE_NAME,
+      },
+    });
+  }
+
+  function expectAmazonSetBillingAgreementDetailsSpy () {
+    expect(amazonSetBillingAgreementDetailsSpy).to.be.calledOnce;
+    expect(amazonSetBillingAgreementDetailsSpy).to.be.calledWith({
+      AmazonBillingAgreementId: billingAgreementId,
+      BillingAgreementAttributes: {
+        SellerNote: amzLib.constants.SELLER_NOTE_SUBSCRIPTION,
+        SellerBillingAgreementAttributes: {
+          SellerBillingAgreementId: common.uuid(),
+          StoreName: amzLib.constants.STORE_NAME,
+          CustomInformation: amzLib.constants.SELLER_NOTE_SUBSCRIPTION,
+        },
+      },
+    });
+  }
+
+  function expectCreateSpy () {
+    expect(createSubSpy).to.be.calledOnce;
+    expect(createSubSpy).to.be.calledWith({
+      user,
+      customerId: billingAgreementId,
+      paymentMethod: amzLib.constants.PAYMENT_METHOD,
+      sub,
+      headers,
+      groupId,
+    });
+  }
+
+  it('should throw an error if we are missing a subscription', async () => {
+    await expect(amzLib.subscribe({
+      billingAgreementId,
+      coupon,
+      user,
+      groupId,
+      headers,
+    }))
+      .to.eventually.be.rejected.and.to.eql({
+        httpCode: 400,
+        name: 'BadRequest',
+        message: i18n.t('missingSubscriptionCode'),
+      });
+  });
+
+  it('should throw an error if we are missing a billingAgreementId', async () => {
+    await expect(amzLib.subscribe({
+      sub,
+      coupon,
+      user,
+      groupId,
+      headers,
+    }))
+      .to.eventually.be.rejected.and.to.eql({
+        httpCode: 400,
+        name: 'BadRequest',
+        message: 'Missing req.body.billingAgreementId',
+      });
+  });
+
+  it('should throw an error when coupon code is missing', async () => {
+    sub.discount = 40;
+
+    await expect(amzLib.subscribe({
+      billingAgreementId,
+      sub,
+      coupon,
+      user,
+      groupId,
+      headers,
+    }))
+      .to.eventually.be.rejected.and.to.eql({
+        httpCode: 400,
+        name: 'BadRequest',
+        message: i18n.t('couponCodeRequired'),
+      });
+  });
+
+  it('should throw an error when coupon code is invalid', async () => {
+    sub.discount = 40;
+    sub.key = 'google_6mo';
+    coupon = 'example-coupon';
+
+    let couponModel = new Coupon();
+    couponModel.event = 'google_6mo';
+    await couponModel.save();
+
+    sinon.stub(cc, 'validate').returns('invalid');
+
+    await expect(amzLib.subscribe({
+      billingAgreementId,
+      sub,
+      coupon,
+      user,
+      groupId,
+      headers,
+    }))
+      .to.eventually.be.rejected.and.to.eql({
+        httpCode: 401,
+        name: 'NotAuthorized',
+        message: i18n.t('invalidCoupon'),
+      });
+    cc.validate.restore();
+  });
+
+  it('subscribes with amazon with a coupon', async () => {
+    sub.discount = 40;
+    sub.key = 'google_6mo';
+    coupon = 'example-coupon';
+
+    let couponModel = new Coupon();
+    couponModel.event = 'google_6mo';
+    let updatedCouponModel = await couponModel.save();
+
+    sinon.stub(cc, 'validate').returns(updatedCouponModel._id);
+
+    await amzLib.subscribe({
+      billingAgreementId,
+      sub,
+      coupon,
+      user,
+      groupId,
+      headers,
+    });
+
+    expectCreateSpy();
+
+    cc.validate.restore();
+  });
+
+  it('subscribes with amazon', async () => {
+    user.guilds.push(groupId);
+    await user.save();
+
+    await amzLib.subscribe({
+      billingAgreementId,
+      sub,
+      coupon,
+      user,
+      groupId,
+      headers,
+    });
+
+    expectAmazonSetBillingAgreementDetailsSpy();
+
+    expect(amazonConfirmBillingAgreementSpy).to.be.calledOnce;
+    expect(amazonConfirmBillingAgreementSpy).to.be.calledWith({
+      AmazonBillingAgreementId: billingAgreementId,
+    });
+
+    expectAmazonAuthorizeBillingAgreementSpy();
+
+    expectCreateSpy();
+  });
+
+  it('subscribes with amazon with price to existing users', async () => {
+    user = new User();
+    user.guilds.push(groupId);
+    await user.save();
+
+    // Add existing users
+    user = new User();
+    user.guilds.push(groupId);
+    await user.save();
+
+    // Set expected amount
+    sub.key = 'group_monthly';
+    sub.price = 9;
+    amount = 12;
+
+    await amzLib.subscribe({
+      billingAgreementId,
+      sub,
+      coupon,
+      user,
+      groupId,
+      headers,
+    });
+
+    expectAmazonSetBillingAgreementDetailsSpy();
+    expect(amazonConfirmBillingAgreementSpy).to.be.calledOnce;
+    expect(amazonConfirmBillingAgreementSpy).to.be.calledWith({
+      AmazonBillingAgreementId: billingAgreementId,
+    });
+    expectAmazonAuthorizeBillingAgreementSpy();
+    expectCreateSpy();
+  });
+});

test/api/unit/libs/payments/amazon/upgrade-groupplan.test.js

@@ -0,0 +1,83 @@
+import uuid from 'uuid';
+
+import {
+  generateGroup,
+} from '../../../../../helpers/api-unit.helper.js';
+import { model as User } from '../../../../../../website/server/models/user';
+import { model as Group } from '../../../../../../website/server/models/group';
+import amzLib from '../../../../../../website/server/libs/payments/amazon';
+import payments from '../../../../../../website/server/libs/payments/payments';
+
+describe('#upgradeGroupPlan', () => {
+  let spy, data, user, group, uuidString;
+
+  beforeEach(async function () {
+    user = new User();
+    user.profile.name = 'sender';
+
+    data = {
+      user,
+      sub: {
+        key: 'basic_3mo', // @TODO: Validate that this is group
+      },
+      customerId: 'customer-id',
+      paymentMethod: 'Payment Method',
+      headers: {
+        'x-client': 'habitica-web',
+        'user-agent': '',
+      },
+    };
+
+    group = generateGroup({
+      name: 'test group',
+      type: 'guild',
+      privacy: 'public',
+      leader: user._id,
+    });
+    await group.save();
+
+    spy = sinon.stub(amzLib, 'authorizeOnBillingAgreement');
+    spy.returnsPromise().resolves([]);
+
+    uuidString = 'uuid-v4';
+    sinon.stub(uuid, 'v4').returns(uuidString);
+
+    data.groupId = group._id;
+    data.sub.quantity = 3;
+  });
+
+  afterEach(function () {
+    amzLib.authorizeOnBillingAgreement.restore();
+    uuid.v4.restore();
+  });
+
+  it('charges for a new member', async () => {
+    data.paymentMethod = amzLib.constants.PAYMENT_METHOD;
+    await payments.createSubscription(data);
+
+    let updatedGroup = await Group.findById(group._id).exec();
+
+    updatedGroup.memberCount += 1;
+    await updatedGroup.save();
+
+    await amzLib.chargeForAdditionalGroupMember(updatedGroup);
+
+    expect(spy.calledOnce).to.be.true;
+    expect(spy).to.be.calledWith({
+      AmazonBillingAgreementId: updatedGroup.purchased.plan.customerId,
+      AuthorizationReferenceId: uuidString.substring(0, 32),
+      AuthorizationAmount: {
+        CurrencyCode: amzLib.constants.CURRENCY_CODE,
+        Amount: 3,
+      },
+      SellerAuthorizationNote: amzLib.constants.SELLER_NOTE_GROUP_NEW_MEMBER,
+      TransactionTimeout: 0,
+      CaptureNow: true,
+      SellerNote: amzLib.constants.SELLER_NOTE_GROUP_NEW_MEMBER,
+      SellerOrderAttributes: {
+        SellerOrderId: uuidString,
+        StoreName: amzLib.constants.STORE_NAME,
+      },
+    });
+  });
+});

test/api/unit/libs/payments/apple.test.js

@@ -0,0 +1,386 @@
+/* eslint-disable camelcase */
+import iapModule from '../../../../../website/server/libs/inAppPurchases';
+import payments from '../../../../../website/server/libs/payments/payments';
+import applePayments from '../../../../../website/server/libs/payments/apple';
+import iap from '../../../../../website/server/libs/inAppPurchases';
+import {model as User} from '../../../../../website/server/models/user';
+import common from '../../../../../website/common';
+import moment from 'moment';
+
+const i18n = common.i18n;
+
+describe('Apple Payments', ()  => {
+  let subKey = 'basic_3mo';
+
+  describe('verifyGemPurchase', () => {
+    let sku, user, token, receipt, headers;
+    let iapSetupStub, iapValidateStub, iapIsValidatedStub, paymentBuyGemsStub, iapGetPurchaseDataStub;
+
+    beforeEach(() => {
+      token = 'testToken';
+      sku = 'com.habitrpg.ios.habitica.iap.21gems';
+      user = new User();
+      receipt = `{"token": "${token}", "productId": "${sku}"}`;
+      headers = {};
+
+      iapSetupStub = sinon.stub(iapModule, 'setup')
+        .returnsPromise().resolves();
+      iapValidateStub = sinon.stub(iapModule, 'validate')
+        .returnsPromise().resolves({});
+      iapIsValidatedStub = sinon.stub(iapModule, 'isValidated')
+        .returns(true);
+      iapGetPurchaseDataStub = sinon.stub(iapModule, 'getPurchaseData')
+        .returns([{productId: 'com.habitrpg.ios.Habitica.21gems',
+                   transactionId: token,
+        }]);
+      paymentBuyGemsStub = sinon.stub(payments, 'buyGems').returnsPromise().resolves({});
+    });
+
+    afterEach(() => {
+      iapModule.setup.restore();
+      iapModule.validate.restore();
+      iapModule.isValidated.restore();
+      iapModule.getPurchaseData.restore();
+      payments.buyGems.restore();
+    });
+
+    it('should throw an error if receipt is invalid', async () => {
+      iapModule.isValidated.restore();
+      iapIsValidatedStub = sinon.stub(iapModule, 'isValidated')
+        .returns(false);
+
+      await expect(applePayments.verifyGemPurchase(user, receipt, headers))
+        .to.eventually.be.rejected.and.to.eql({
+          httpCode: 401,
+          name: 'NotAuthorized',
+          message: applePayments.constants.RESPONSE_INVALID_RECEIPT,
+        });
+    });
+
+    it('should throw an error if getPurchaseData is invalid', async () => {
+      iapGetPurchaseDataStub.restore();
+      iapGetPurchaseDataStub = sinon.stub(iapModule, 'getPurchaseData').returns([]);
+
+      await expect(applePayments.verifyGemPurchase(user, receipt, headers))
+        .to.eventually.be.rejected.and.to.eql({
+          httpCode: 401,
+          name: 'NotAuthorized',
+          message: applePayments.constants.RESPONSE_NO_ITEM_PURCHASED,
+        });
+    });
+
+    it('errors if the user cannot purchase gems', async () => {
+      sinon.stub(user, 'canGetGems').returnsPromise().resolves(false);
+      await expect(applePayments.verifyGemPurchase(user, receipt, headers))
+        .to.eventually.be.rejected.and.to.eql({
+          httpCode: 401,
+          name: 'NotAuthorized',
+          message: i18n.t('groupPolicyCannotGetGems'),
+        });
+
+      user.canGetGems.restore();
+    });
+
+    it('errors if amount does not exist', async () => {
+      sinon.stub(user, 'canGetGems').returnsPromise().resolves(true);
+      iapGetPurchaseDataStub.restore();
+      iapGetPurchaseDataStub = sinon.stub(iapModule, 'getPurchaseData')
+        .returns([{productId: 'badProduct',
+                   transactionId: token,
+        }]);
+
+      await expect(applePayments.verifyGemPurchase(user, receipt, headers))
+        .to.eventually.be.rejected.and.to.eql({
+          httpCode: 401,
+          name: 'NotAuthorized',
+          message: applePayments.constants.RESPONSE_INVALID_ITEM,
+        });
+
+      user.canGetGems.restore();
+    });
+
+    const gemsCanPurchase = [
+      {
+        productId: 'com.habitrpg.ios.Habitica.4gems',
+        amount: 1,
+      },
+      {
+        productId: 'com.habitrpg.ios.Habitica.20gems',
+        amount: 5.25,
+      },
+      {
+        productId: 'com.habitrpg.ios.Habitica.21gems',
+        amount: 5.25,
+      },
+      {
+        productId: 'com.habitrpg.ios.Habitica.42gems',
+        amount: 10.5,
+      },
+      {
+        productId: 'com.habitrpg.ios.Habitica.84gems',
+        amount: 21,
+      },
+    ];
+
+    gemsCanPurchase.forEach(gemTest => {
+      it(`purchases ${gemTest.productId} gems`, async () => {
+        iapGetPurchaseDataStub.restore();
+        iapGetPurchaseDataStub = sinon.stub(iapModule, 'getPurchaseData')
+          .returns([{productId: gemTest.productId,
+                     transactionId: token,
+          }]);
+
+        sinon.stub(user, 'canGetGems').returnsPromise().resolves(true);
+        await applePayments.verifyGemPurchase(user, receipt, headers);
+
+        expect(iapSetupStub).to.be.calledOnce;
+        expect(iapValidateStub).to.be.calledOnce;
+        expect(iapValidateStub).to.be.calledWith(iap.APPLE, receipt);
+        expect(iapIsValidatedStub).to.be.calledOnce;
+        expect(iapIsValidatedStub).to.be.calledWith({});
+        expect(iapGetPurchaseDataStub).to.be.calledOnce;
+
+        expect(paymentBuyGemsStub).to.be.calledOnce;
+        expect(paymentBuyGemsStub).to.be.calledWith({
+          user,
+          paymentMethod: applePayments.constants.PAYMENT_METHOD_APPLE,
+          amount: gemTest.amount,
+          headers,
+        });
+        expect(user.canGetGems).to.be.calledOnce;
+        user.canGetGems.restore();
+      });
+    });
+  });
+
+  describe('subscribe', () => {
+    let sub, sku, user, token, receipt, headers, nextPaymentProcessing;
+    let iapSetupStub, iapValidateStub, iapIsValidatedStub, paymentsCreateSubscritionStub, iapGetPurchaseDataStub;
+
+    beforeEach(() => {
+      sub = common.content.subscriptionBlocks[subKey];
+      sku = 'com.habitrpg.ios.habitica.subscription.3month';
+
+      token = 'test-token';
+      headers = {};
+      receipt = `{"token": "${token}"}`;
+      nextPaymentProcessing = moment.utc().add({days: 2});
+
+      iapSetupStub = sinon.stub(iapModule, 'setup')
+        .returnsPromise().resolves();
+      iapValidateStub = sinon.stub(iapModule, 'validate')
+        .returnsPromise().resolves({});
+      iapIsValidatedStub = sinon.stub(iapModule, 'isValidated')
+        .returns(true);
+      iapGetPurchaseDataStub = sinon.stub(iapModule, 'getPurchaseData')
+        .returns([{
+          expirationDate: moment.utc().subtract({day: 1}).toDate(),
+          productId: sku,
+          transactionId: token,
+        }, {
+          expirationDate: moment.utc().add({day: 1}).toDate(),
+          productId: 'wrongsku',
+          transactionId: token,
+        }, {
+          expirationDate: moment.utc().add({day: 1}).toDate(),
+          productId: sku,
+          transactionId: token,
+        }]);
+      paymentsCreateSubscritionStub = sinon.stub(payments, 'createSubscription').returnsPromise().resolves({});
+    });
+
+    afterEach(() => {
+      iapModule.setup.restore();
+      iapModule.validate.restore();
+      iapModule.isValidated.restore();
+      iapModule.getPurchaseData.restore();
+      if (payments.createSubscription.restore) payments.createSubscription.restore();
+    });
+
+    it('should throw an error if sku is empty', async () => {
+      await expect(applePayments.subscribe('', user, receipt, headers, nextPaymentProcessing))
+        .to.eventually.be.rejected.and.to.eql({
+          httpCode: 400,
+          name: 'BadRequest',
+          message: i18n.t('missingSubscriptionCode'),
+        });
+    });
+
+    it('should throw an error if receipt is invalid', async () => {
+      iapModule.isValidated.restore();
+      iapIsValidatedStub = sinon.stub(iapModule, 'isValidated')
+        .returns(false);
+
+      await expect(applePayments.subscribe(sku, user, receipt, headers, nextPaymentProcessing))
+        .to.eventually.be.rejected.and.to.eql({
+          httpCode: 401,
+          name: 'NotAuthorized',
+          message: applePayments.constants.RESPONSE_INVALID_RECEIPT,
+        });
+    });
+
+    const subOptions = [
+      {
+        sku: 'subscription1month',
+        subKey: 'basic_earned',
+      },
+      {
+        sku: 'com.habitrpg.ios.habitica.subscription.3month',
+        subKey: 'basic_3mo',
+      },
+      {
+        sku: 'com.habitrpg.ios.habitica.subscription.6month',
+        subKey: 'basic_6mo',
+      },
+      {
+        sku: 'com.habitrpg.ios.habitica.subscription.12month',
+        subKey: 'basic_12mo',
+      },
+    ];
+    subOptions.forEach(option => {
+      it(`creates a user subscription for ${option.sku}`, async () => {
+        iapModule.getPurchaseData.restore();
+        iapGetPurchaseDataStub = sinon.stub(iapModule, 'getPurchaseData')
+          .returns([{
+            expirationDate: moment.utc().add({day: 1}).toDate(),
+            productId: option.sku,
+            transactionId: token,
+          }]);
+        sub = common.content.subscriptionBlocks[option.subKey];
+
+        await applePayments.subscribe(option.sku, user, receipt, headers, nextPaymentProcessing);
+
+        expect(iapSetupStub).to.be.calledOnce;
+        expect(iapValidateStub).to.be.calledOnce;
+        expect(iapValidateStub).to.be.calledWith(iap.APPLE, receipt);
+        expect(iapIsValidatedStub).to.be.calledOnce;
+        expect(iapIsValidatedStub).to.be.calledWith({});
+        expect(iapGetPurchaseDataStub).to.be.calledOnce;
+
+        expect(paymentsCreateSubscritionStub).to.be.calledOnce;
+        expect(paymentsCreateSubscritionStub).to.be.calledWith({
+          user,
+          customerId: token,
+          paymentMethod: applePayments.constants.PAYMENT_METHOD_APPLE,
+          sub,
+          headers,
+          additionalData: receipt,
+          nextPaymentProcessing,
+        });
+      });
+    });
+
+    it('errors when a user is already subscribed', async () => {
+      payments.createSubscription.restore();
+      user = new User();
+
+      await applePayments.subscribe(sku, user, receipt, headers, nextPaymentProcessing);
+
+      await expect(applePayments.subscribe(sku, user, receipt, headers, nextPaymentProcessing))
+        .to.eventually.be.rejected.and.to.eql({
+          httpCode: 401,
+          name: 'NotAuthorized',
+          message: applePayments.constants.RESPONSE_ALREADY_USED,
+        });
+    });
+  });
+
+  describe('cancelSubscribe ', () => {
+    let user, token, receipt, headers, customerId, expirationDate;
+    let iapSetupStub, iapValidateStub, iapIsValidatedStub, iapGetPurchaseDataStub, paymentCancelSubscriptionSpy;
+
+    beforeEach(async () => {
+      token = 'test-token';
+      headers = {};
+      receipt = `{"token": "${token}"}`;
+      customerId = 'test-customerId';
+      expirationDate = moment.utc();
+
+      iapSetupStub = sinon.stub(iapModule, 'setup')
+        .returnsPromise().resolves();
+      iapValidateStub = sinon.stub(iapModule, 'validate')
+        .returnsPromise().resolves({
+          expirationDate,
+        });
+      iapGetPurchaseDataStub = sinon.stub(iapModule, 'getPurchaseData')
+        .returns([{expirationDate: expirationDate.toDate()}]);
+      iapIsValidatedStub = sinon.stub(iapModule, 'isValidated')
+        .returns(true);
+
+      user = new User();
+      user.profile.name = 'sender';
+      user.purchased.plan.paymentMethod = applePayments.constants.PAYMENT_METHOD_APPLE;
+      user.purchased.plan.customerId = customerId;
+      user.purchased.plan.planId = subKey;
+      user.purchased.plan.additionalData = receipt;
+
+      paymentCancelSubscriptionSpy = sinon.stub(payments, 'cancelSubscription').returnsPromise().resolves({});
+    });
+
+    afterEach(function () {
+      iapModule.setup.restore();
+      iapModule.validate.restore();
+      iapModule.isValidated.restore();
+      iapModule.getPurchaseData.restore();
+      payments.cancelSubscription.restore();
+    });
+
+    it('should throw an error if we are missing a subscription', async () => {
+      user.purchased.plan.paymentMethod = undefined;
+
+      await expect(applePayments.cancelSubscribe(user, headers))
+        .to.eventually.be.rejected.and.to.eql({
+          httpCode: 401,
+          name: 'NotAuthorized',
+          message: i18n.t('missingSubscription'),
+        });
+    });
+
+    it('should throw an error if subscription is still valid', async () => {
+      iapModule.getPurchaseData.restore();
+      iapGetPurchaseDataStub = sinon.stub(iapModule, 'getPurchaseData')
+        .returns([{expirationDate: expirationDate.add({day: 1}).toDate()}]);
+
+      await expect(applePayments.cancelSubscribe(user, headers))
+        .to.eventually.be.rejected.and.to.eql({
+          httpCode: 401,
+          name: 'NotAuthorized',
+          message: applePayments.constants.RESPONSE_STILL_VALID,
+        });
+    });
+
+    it('should throw an error if receipt is invalid', async () => {
+      iapModule.isValidated.restore();
+      iapIsValidatedStub = sinon.stub(iapModule, 'isValidated')
+        .returns(false);
+
+      await expect(applePayments.cancelSubscribe(user, headers))
+        .to.eventually.be.rejected.and.to.eql({
+          httpCode: 401,
+          name: 'NotAuthorized',
+          message: applePayments.constants.RESPONSE_INVALID_RECEIPT,
+        });
+    });
+
+    it('should cancel a user subscription', async () => {
+      await applePayments.cancelSubscribe(user, headers);
+
+      expect(iapSetupStub).to.be.calledOnce;
+      expect(iapValidateStub).to.be.calledOnce;
+      expect(iapValidateStub).to.be.calledWith(iap.APPLE, receipt);
+      expect(iapIsValidatedStub).to.be.calledOnce;
+      expect(iapIsValidatedStub).to.be.calledWith({
+        expirationDate,
+      });
+      expect(iapGetPurchaseDataStub).to.be.calledOnce;
+
+      expect(paymentCancelSubscriptionSpy).to.be.calledOnce;
+      expect(paymentCancelSubscriptionSpy).to.be.calledWith({
+        user,
+        paymentMethod: applePayments.constants.PAYMENT_METHOD_APPLE,
+        nextBill: expirationDate.toDate(),
+        headers,
+      });
+    });
+  });
+});

test/api/unit/libs/payments/google.test.js

@@ -0,0 +1,285 @@
+/* eslint-disable camelcase */
+import iapModule from '../../../../../website/server/libs/inAppPurchases';
+import payments from '../../../../../website/server/libs/payments/payments';
+import googlePayments from '../../../../../website/server/libs/payments/google';
+import iap from '../../../../../website/server/libs/inAppPurchases';
+import {model as User} from '../../../../../website/server/models/user';
+import common from '../../../../../website/common';
+import moment from 'moment';
+
+const i18n = common.i18n;
+
+describe('Google Payments', ()  => {
+  let subKey = 'basic_3mo';
+
+  describe('verifyGemPurchase', () => {
+    let sku, user, token, receipt, signature, headers;
+    let iapSetupStub, iapValidateStub, iapIsValidatedStub, paymentBuyGemsStub;
+
+    beforeEach(() => {
+      sku = 'com.habitrpg.android.habitica.iap.21gems';
+      user = new User();
+      receipt = `{"token": "${token}", "productId": "${sku}"}`;
+      signature = '';
+      headers = {};
+
+      iapSetupStub = sinon.stub(iapModule, 'setup')
+        .returnsPromise().resolves();
+      iapValidateStub = sinon.stub(iapModule, 'validate')
+        .returnsPromise().resolves({});
+      iapIsValidatedStub = sinon.stub(iapModule, 'isValidated')
+        .returns(true);
+      paymentBuyGemsStub = sinon.stub(payments, 'buyGems').returnsPromise().resolves({});
+    });
+
+    afterEach(() => {
+      iapModule.setup.restore();
+      iapModule.validate.restore();
+      iapModule.isValidated.restore();
+      payments.buyGems.restore();
+    });
+
+    it('should throw an error if receipt is invalid', async () => {
+      iapModule.isValidated.restore();
+      iapIsValidatedStub = sinon.stub(iapModule, 'isValidated')
+        .returns(false);
+
+      await expect(googlePayments.verifyGemPurchase(user, receipt, signature, headers))
+        .to.eventually.be.rejected.and.to.eql({
+          httpCode: 401,
+          name: 'NotAuthorized',
+          message: googlePayments.constants.RESPONSE_INVALID_RECEIPT,
+        });
+    });
+
+    it('should throw an error if productId is invalid', async () => {
+      receipt = `{"token": "${token}", "productId": "invalid"}`;
+
+      await expect(googlePayments.verifyGemPurchase(user, receipt, signature, headers))
+        .to.eventually.be.rejected.and.to.eql({
+          httpCode: 401,
+          name: 'NotAuthorized',
+          message: googlePayments.constants.RESPONSE_INVALID_ITEM,
+        });
+    });
+
+    it('should throw an error if user cannot purchase gems', async () => {
+      sinon.stub(user, 'canGetGems').returnsPromise().resolves(false);
+
+      await expect(googlePayments.verifyGemPurchase(user, receipt, signature, headers))
+        .to.eventually.be.rejected.and.to.eql({
+          httpCode: 401,
+          name: 'NotAuthorized',
+          message: i18n.t('groupPolicyCannotGetGems'),
+        });
+
+      user.canGetGems.restore();
+    });
+
+    it('purchases gems', async () => {
+      sinon.stub(user, 'canGetGems').returnsPromise().resolves(true);
+      await googlePayments.verifyGemPurchase(user, receipt, signature, headers);
+
+      expect(iapSetupStub).to.be.calledOnce;
+      expect(iapValidateStub).to.be.calledOnce;
+      expect(iapValidateStub).to.be.calledWith(iap.GOOGLE, {
+        data: receipt,
+        signature,
+      });
+      expect(iapIsValidatedStub).to.be.calledOnce;
+      expect(iapIsValidatedStub).to.be.calledWith({});
+
+      expect(paymentBuyGemsStub).to.be.calledOnce;
+      expect(paymentBuyGemsStub).to.be.calledWith({
+        user,
+        paymentMethod: googlePayments.constants.PAYMENT_METHOD_GOOGLE,
+        amount: 5.25,
+        headers,
+      });
+      expect(user.canGetGems).to.be.calledOnce;
+      user.canGetGems.restore();
+    });
+  });
+
+  describe('subscribe', () => {
+    let sub, sku, user, token, receipt, signature, headers, nextPaymentProcessing;
+    let iapSetupStub, iapValidateStub, iapIsValidatedStub, paymentsCreateSubscritionStub;
+
+    beforeEach(() => {
+      sub = common.content.subscriptionBlocks[subKey];
+      sku = 'com.habitrpg.android.habitica.subscription.3month';
+
+      token = 'test-token';
+      headers = {};
+      receipt = `{"token": "${token}"}`;
+      signature = '';
+      nextPaymentProcessing = moment.utc().add({days: 2});
+
+      iapSetupStub = sinon.stub(iapModule, 'setup')
+        .returnsPromise().resolves();
+      iapValidateStub = sinon.stub(iapModule, 'validate')
+        .returnsPromise().resolves({});
+      iapIsValidatedStub = sinon.stub(iapModule, 'isValidated')
+        .returns(true);
+      paymentsCreateSubscritionStub = sinon.stub(payments, 'createSubscription').returnsPromise().resolves({});
+    });
+
+    afterEach(() => {
+      iapModule.setup.restore();
+      iapModule.validate.restore();
+      iapModule.isValidated.restore();
+      payments.createSubscription.restore();
+    });
+
+    it('should throw an error if receipt is invalid', async () => {
+      iapModule.isValidated.restore();
+      iapIsValidatedStub = sinon.stub(iapModule, 'isValidated')
+        .returns(false);
+
+      await expect(googlePayments.subscribe(sku, user, receipt, signature, headers, nextPaymentProcessing))
+        .to.eventually.be.rejected.and.to.eql({
+          httpCode: 401,
+          name: 'NotAuthorized',
+          message: googlePayments.constants.RESPONSE_INVALID_RECEIPT,
+        });
+    });
+
+    it('should throw an error if sku is invalid', async () => {
+      sku = 'invalid';
+
+      await expect(googlePayments.subscribe(sku, user, receipt, signature, headers, nextPaymentProcessing))
+        .to.eventually.be.rejected.and.to.eql({
+          httpCode: 401,
+          name: 'NotAuthorized',
+          message: googlePayments.constants.RESPONSE_INVALID_ITEM,
+        });
+    });
+
+    it('creates a user subscription', async () => {
+      await googlePayments.subscribe(sku, user, receipt, signature, headers, nextPaymentProcessing);
+
+      expect(iapSetupStub).to.be.calledOnce;
+      expect(iapValidateStub).to.be.calledOnce;
+      expect(iapValidateStub).to.be.calledWith(iap.GOOGLE, {
+        data: receipt,
+        signature,
+      });
+      expect(iapIsValidatedStub).to.be.calledOnce;
+      expect(iapIsValidatedStub).to.be.calledWith({});
+
+      expect(paymentsCreateSubscritionStub).to.be.calledOnce;
+      expect(paymentsCreateSubscritionStub).to.be.calledWith({
+        user,
+        customerId: token,
+        paymentMethod: googlePayments.constants.PAYMENT_METHOD_GOOGLE,
+        sub,
+        headers,
+        additionalData: {data: receipt, signature},
+        nextPaymentProcessing,
+      });
+    });
+  });
+
+  describe('cancelSubscribe ', () => {
+    let user, token, receipt, signature, headers, customerId, expirationDate;
+    let iapSetupStub, iapValidateStub, iapIsValidatedStub, iapGetPurchaseDataStub, paymentCancelSubscriptionSpy;
+
+    beforeEach(async () => {
+      token = 'test-token';
+      headers = {};
+      receipt = `{"token": "${token}"}`;
+      signature = '';
+      customerId = 'test-customerId';
+      expirationDate = moment.utc();
+
+      iapSetupStub = sinon.stub(iapModule, 'setup')
+        .returnsPromise().resolves();
+      iapValidateStub = sinon.stub(iapModule, 'validate')
+        .returnsPromise().resolves({
+          expirationDate,
+        });
+      iapGetPurchaseDataStub = sinon.stub(iapModule, 'getPurchaseData')
+        .returns([{expirationDate: expirationDate.toDate()}]);
+      iapIsValidatedStub = sinon.stub(iapModule, 'isValidated')
+        .returns(true);
+
+      user = new User();
+      user.profile.name = 'sender';
+      user.purchased.plan.customerId = customerId;
+      user.purchased.plan.paymentMethod = googlePayments.constants.PAYMENT_METHOD_GOOGLE;
+      user.purchased.plan.planId = subKey;
+      user.purchased.plan.additionalData = {data: receipt, signature};
+
+      paymentCancelSubscriptionSpy = sinon.stub(payments, 'cancelSubscription').returnsPromise().resolves({});
+    });
+
+    afterEach(function () {
+      iapModule.setup.restore();
+      iapModule.validate.restore();
+      iapModule.isValidated.restore();
+      iapModule.getPurchaseData.restore();
+      payments.cancelSubscription.restore();
+    });
+
+    it('should throw an error if we are missing a subscription', async () => {
+      user.purchased.plan.paymentMethod = undefined;
+
+      await expect(googlePayments.cancelSubscribe(user, headers))
+        .to.eventually.be.rejected.and.to.eql({
+          httpCode: 401,
+          name: 'NotAuthorized',
+          message: i18n.t('missingSubscription'),
+        });
+    });
+
+    it('should throw an error if subscription is still valid', async () => {
+      iapModule.getPurchaseData.restore();
+      iapGetPurchaseDataStub = sinon.stub(iapModule, 'getPurchaseData')
+        .returns([{expirationDate: expirationDate.add({day: 1}).toDate()}]);
+
+      await expect(googlePayments.cancelSubscribe(user, headers))
+        .to.eventually.be.rejected.and.to.eql({
+          httpCode: 401,
+          name: 'NotAuthorized',
+          message: googlePayments.constants.RESPONSE_STILL_VALID,
+        });
+    });
+
+    it('should throw an error if receipt is invalid', async () => {
+      iapModule.isValidated.restore();
+      iapIsValidatedStub = sinon.stub(iapModule, 'isValidated')
+        .returns(false);
+
+      await expect(googlePayments.cancelSubscribe(user, headers))
+        .to.eventually.be.rejected.and.to.eql({
+          httpCode: 401,
+          name: 'NotAuthorized',
+          message: googlePayments.constants.RESPONSE_INVALID_RECEIPT,
+        });
+    });
+
+    it('should cancel a user subscription', async () => {
+      await googlePayments.cancelSubscribe(user, headers);
+
+      expect(iapSetupStub).to.be.calledOnce;
+      expect(iapValidateStub).to.be.calledOnce;
+      expect(iapValidateStub).to.be.calledWith(iap.GOOGLE, {
+        data: receipt,
+        signature,
+      });
+      expect(iapIsValidatedStub).to.be.calledOnce;
+      expect(iapIsValidatedStub).to.be.calledWith({
+        expirationDate,
+      });
+      expect(iapGetPurchaseDataStub).to.be.calledOnce;
+
+      expect(paymentCancelSubscriptionSpy).to.be.calledOnce;
+      expect(paymentCancelSubscriptionSpy).to.be.calledWith({
+        user,
+        paymentMethod: googlePayments.constants.PAYMENT_METHOD_GOOGLE,
+        nextBill: expirationDate.toDate(),
+        headers,
+      });
+    });
+  });
+});

test/api/unit/libs/payments/group-plans/group-payments-cancel.test.js

@@ -0,0 +1,326 @@
+import moment from 'moment';
+
+import * as sender from '../../../../../../website/server/libs/email';
+import * as api from '../../../../../../website/server/libs/payments/payments';
+import { model as User } from '../../../../../../website/server/models/user';
+import { model as Group } from '../../../../../../website/server/models/group';
+import {
+  generateGroup,
+} from '../../../../../helpers/api-unit.helper.js';
+import i18n from '../../../../../../website/common/script/i18n';
+
+describe('Canceling a subscription for group', () => {
+  let plan, group, user, data;
+
+  beforeEach(async () => {
+    user = new User();
+    user.profile.name = 'sender';
+    await user.save();
+
+    group = generateGroup({
+      name: 'test group',
+      type: 'guild',
+      privacy: 'public',
+      leader: user._id,
+    });
+    await group.save();
+
+    data = {
+      user,
+      sub: {
+        key: 'basic_3mo',
+      },
+      customerId: 'customer-id',
+      paymentMethod: 'Payment Method',
+      headers: {
+        'x-client': 'habitica-web',
+        'user-agent': '',
+      },
+    };
+
+    plan = {
+      planId: 'basic_3mo',
+      customerId: 'customer-id',
+      dateUpdated: new Date(),
+      gemsBought: 0,
+      paymentMethod: 'paymentMethod',
+      extraMonths: 0,
+      dateTerminated: null,
+      lastBillingDate: new Date(),
+      dateCreated: new Date(),
+      mysteryItems: [],
+      consecutive: {
+        trinkets: 0,
+        offset: 0,
+        gemCapExtra: 0,
+      },
+    };
+
+    sandbox.stub(sender, 'sendTxn');
+  });
+
+  afterEach(() => {
+    sender.sendTxn.restore();
+  });
+
+  it('adds a month termination date by default', async () => {
+    data.groupId = group._id;
+    await api.cancelSubscription(data);
+
+    let now = new Date();
+    let updatedGroup = await Group.findById(group._id).exec();
+    let daysTillTermination = moment(updatedGroup.purchased.plan.dateTerminated).diff(now, 'days');
+
+    expect(daysTillTermination).to.be.within(29, 30); // 1 month +/- 1 days
+  });
+
+  it('adds extraMonths to dateTerminated value', async () => {
+    group.purchased.plan.extraMonths = 2;
+    await group.save();
+    data.groupId = group._id;
+
+    await api.cancelSubscription(data);
+
+    let now = new Date();
+    let updatedGroup = await Group.findById(group._id).exec();
+    let daysTillTermination = moment(updatedGroup.purchased.plan.dateTerminated).diff(now, 'days');
+
+    expect(daysTillTermination).to.be.within(89, 90); // 3 months +/- 1 days
+  });
+
+  it('handles extra month fractions', async () => {
+    group.purchased.plan.extraMonths = 0.3;
+    await group.save();
+    data.groupId = group._id;
+
+    await api.cancelSubscription(data);
+
+    let now = new Date();
+    let updatedGroup = await Group.findById(group._id).exec();
+    let daysTillTermination = moment(updatedGroup.purchased.plan.dateTerminated).diff(now, 'days');
+
+    expect(daysTillTermination).to.be.within(38, 39); // should be about 1 month + 1/3 month
+  });
+
+  it('terminates at next billing date if it exists', async () => {
+    data.nextBill = moment().add({ days: 15 });
+    data.groupId = group._id;
+
+    await api.cancelSubscription(data);
+
+    let now = new Date();
+    let updatedGroup = await Group.findById(group._id).exec();
+    let daysTillTermination = moment(updatedGroup.purchased.plan.dateTerminated).diff(now, 'days');
+
+    expect(daysTillTermination).to.be.within(13, 15);
+  });
+
+  it('resets plan.extraMonths', async () => {
+    group.purchased.plan.extraMonths = 5;
+    await group.save();
+    data.groupId = group._id;
+
+    await api.cancelSubscription(data);
+
+    let updatedGroup = await Group.findById(group._id).exec();
+    expect(updatedGroup.purchased.plan.extraMonths).to.eql(0);
+  });
+
+  it('sends an email', async () => {
+    data.groupId = group._id;
+    await api.cancelSubscription(data);
+
+    expect(sender.sendTxn).to.be.calledOnce;
+    expect(sender.sendTxn.firstCall.args[0]._id).to.equal(user._id);
+    expect(sender.sendTxn.firstCall.args[1]).to.equal('group-cancel-subscription');
+    expect(sender.sendTxn.firstCall.args[2]).to.eql([
+      {name: 'GROUP_NAME', content: group.name},
+    ]);
+  });
+
+  it('prevents non group leader from managing subscription', async () => {
+    let groupMember = new User();
+    data.user = groupMember;
+    data.groupId = group._id;
+
+    await expect(api.cancelSubscription(data))
+      .eventually.be.rejected.and.to.eql({
+        httpCode: 401,
+        message: i18n.t('onlyGroupLeaderCanManageSubscription'),
+        name: 'NotAuthorized',
+      });
+  });
+
+  it('allows old group leader to cancel if they created the subscription', async () => {
+    data.groupId = group._id;
+    data.sub = {
+      key: 'group_monthly',
+    };
+    data.paymentMethod = 'Payment Method';
+    await api.createSubscription(data);
+
+    let updatedGroup = await Group.findById(group._id).exec();
+    let newLeader = new User();
+    updatedGroup.leader = newLeader._id;
+    await updatedGroup.save();
+
+    await api.cancelSubscription(data);
+
+    updatedGroup = await Group.findById(group._id).exec();
+
+    expect(updatedGroup.purchased.plan.dateTerminated).to.exist;
+  });
+
+  it('cancels member subscriptions', async () => {
+    data = {
+      user,
+      sub: {
+        key: 'basic_3mo',
+      },
+      customerId: 'customer-id',
+      paymentMethod: 'Payment Method',
+      headers: {
+        'x-client': 'habitica-web',
+        'user-agent': '',
+      },
+    };
+    user.guilds.push(group._id);
+    await user.save();
+    expect(group.purchased.plan.planId).to.not.exist;
+    data.groupId = group._id;
+    await api.createSubscription(data);
+
+    await api.cancelSubscription(data);
+
+    let now = new Date();
+    now.setHours(0, 0, 0, 0);
+    let updatedLeader = await User.findById(user._id).exec();
+    let daysTillTermination = moment(updatedLeader.purchased.plan.dateTerminated).diff(now, 'days');
+    expect(daysTillTermination).to.be.within(2, 3); // only a few days
+  });
+
+  it('sends an email to members of group', async () => {
+    let recipient = new User();
+    recipient.profile.name = 'recipient';
+    recipient.guilds.push(group._id);
+    await recipient.save();
+
+    data.groupId = group._id;
+
+    await api.createSubscription(data);
+    await api.cancelSubscription(data);
+
+    expect(sender.sendTxn).to.be.have.callCount(4);
+    expect(sender.sendTxn.thirdCall.args[0]._id).to.equal(recipient._id);
+    expect(sender.sendTxn.thirdCall.args[1]).to.equal('group-member-cancel');
+    expect(sender.sendTxn.thirdCall.args[2]).to.eql([
+      {name: 'LEADER', content: user.profile.name},
+      {name: 'GROUP_NAME', content: group.name},
+    ]);
+  });
+
+  it('does not cancel member subscriptions when member does not have a group plan sub (i.e. UNLIMITED_CUSTOMER_ID)', async () => {
+    plan.key = 'basic_earned';
+    plan.customerId = api.constants.UNLIMITED_CUSTOMER_ID;
+
+    let recipient = new User();
+    recipient.profile.name = 'recipient';
+    recipient.purchased.plan = plan;
+    recipient.guilds.push(group._id);
+    await recipient.save();
+
+    data.groupId = group._id;
+
+    await api.cancelSubscription(data);
+
+    let updatedLeader = await User.findById(user._id).exec();
+    expect(updatedLeader.purchased.plan.dateTerminated).to.not.exist;
+  });
+
+  it('does not cancel a user subscription if they are still in another active group plan', async () => {
+    let recipient = new User();
+    recipient.profile.name = 'recipient';
+    plan.key = 'basic_earned';
+    recipient.purchased.plan = plan;
+    recipient.guilds.push(group._id);
+    await recipient.save();
+
+    user.guilds.push(group._id);
+    await user.save();
+    data.groupId = group._id;
+
+    await api.createSubscription(data);
+
+    let updatedUser = await User.findById(recipient._id).exec();
+    let firstDateCreated = updatedUser.purchased.plan.dateCreated;
+    let extraMonthsBeforeSecond = updatedUser.purchased.plan.extraMonths;
+
+    let group2 = generateGroup({
+      name: 'test group2',
+      type: 'guild',
+      privacy: 'public',
+      leader: user._id,
+    });
+    data.groupId = group2._id;
+    await group2.save();
+    recipient.guilds.push(group2._id);
+    await recipient.save();
+
+    await api.createSubscription(data);
+
+    await api.cancelSubscription(data);
+
+    updatedUser = await User.findById(recipient._id).exec();
+
+    expect(updatedUser.purchased.plan.planId).to.eql('group_plan_auto');
+    expect(updatedUser.purchased.plan.customerId).to.eql('group-plan');
+    expect(updatedUser.purchased.plan.dateUpdated).to.exist;
+    expect(updatedUser.purchased.plan.gemsBought).to.eql(0);
+    expect(updatedUser.purchased.plan.paymentMethod).to.eql('Group Plan');
+    expect(updatedUser.purchased.plan.extraMonths).to.eql(extraMonthsBeforeSecond);
+    expect(updatedUser.purchased.plan.dateTerminated).to.eql(null);
+    expect(updatedUser.purchased.plan.lastBillingDate).to.not.exist;
+    expect(updatedUser.purchased.plan.dateCreated).to.eql(firstDateCreated);
+  });
+
+  it('does cancel a leader subscription with two cancelled group plans', async () => {
+    user.guilds.push(group._id);
+    await user.save();
+    data.groupId = group._id;
+
+    await api.createSubscription(data);
+
+    let updatedUser = await User.findById(user._id).exec();
+    let firstDateCreated = updatedUser.purchased.plan.dateCreated;
+    let extraMonthsBeforeSecond = updatedUser.purchased.plan.extraMonths;
+
+    let group2 = generateGroup({
+      name: 'test group2',
+      type: 'guild',
+      privacy: 'public',
+      leader: user._id,
+    });
+    user.guilds.push(group2._id);
+    await user.save();
+    data.groupId = group2._id;
+    await group2.save();
+
+    await api.createSubscription(data);
+    await api.cancelSubscription(data);
+
+    data.groupId = group._id;
+    await api.cancelSubscription(data);
+
+    updatedUser = await User.findById(user._id).exec();
+
+    expect(updatedUser.purchased.plan.planId).to.eql('group_plan_auto');
+    expect(updatedUser.purchased.plan.customerId).to.eql('group-plan');
+    expect(updatedUser.purchased.plan.dateUpdated).to.exist;
+    expect(updatedUser.purchased.plan.gemsBought).to.eql(0);
+    expect(updatedUser.purchased.plan.paymentMethod).to.eql('Group Plan');
+    expect(updatedUser.purchased.plan.extraMonths).to.eql(extraMonthsBeforeSecond);
+    expect(updatedUser.purchased.plan.dateTerminated).to.exist;
+    expect(updatedUser.purchased.plan.lastBillingDate).to.not.exist;
+    expect(updatedUser.purchased.plan.dateCreated).to.eql(firstDateCreated);
+  });
+});

test/api/unit/libs/payments/group-plans/group-payments-create.test.js

@@ -0,0 +1,870 @@
+import moment from 'moment';
+import stripeModule from 'stripe';
+import nconf from 'nconf';
+
+import * as sender from '../../../../../../website/server/libs/email';
+import * as api from '../../../../../../website/server/libs/payments/payments';
+import amzLib from '../../../../../../website/server/libs/payments/amazon';
+import paypalPayments from '../../../../../../website/server/libs/payments/paypal';
+import stripePayments from '../../../../../../website/server/libs/payments/stripe';
+import { model as User } from '../../../../../../website/server/models/user';
+import { model as Group } from '../../../../../../website/server/models/group';
+import {
+  generateGroup,
+} from '../../../../../helpers/api-unit.helper.js';
+
+describe('Purchasing a group plan for group', () => {
+  const EMAIL_TEMPLATE_SUBSCRIPTION_TYPE_GOOGLE = 'Google_subscription';
+  const EMAIL_TEMPLATE_SUBSCRIPTION_TYPE_IOS = 'iOS_subscription';
+  const EMAIL_TEMPLATE_SUBSCRIPTION_TYPE_NORMAL = 'normal_subscription';
+  const EMAIL_TEMPLATE_SUBSCRIPTION_TYPE_NONE = 'no_subscription';
+
+  let plan, group, user, data;
+  let stripe = stripeModule('test');
+  let groupLeaderName = 'sender';
+  let groupName = 'test group';
+
+  beforeEach(async () => {
+    user = new User();
+    user.profile.name = groupLeaderName;
+    await user.save();
+
+    group = generateGroup({
+      name: groupName,
+      type: 'guild',
+      privacy: 'public',
+      leader: user._id,
+    });
+    await group.save();
+
+    data = {
+      user,
+      sub: {
+        key: 'basic_3mo',
+      },
+      customerId: 'customer-id',
+      paymentMethod: 'Payment Method',
+      headers: {
+        'x-client': 'habitica-web',
+        'user-agent': '',
+      },
+    };
+
+    plan = {
+      planId: 'basic_3mo',
+      customerId: 'customer-id',
+      dateUpdated: new Date(),
+      gemsBought: 0,
+      paymentMethod: 'paymentMethod',
+      extraMonths: 0,
+      dateTerminated: null,
+      lastBillingDate: new Date(),
+      dateCreated: new Date(),
+      mysteryItems: [],
+      consecutive: {
+        trinkets: 0,
+        offset: 0,
+        gemCapExtra: 0,
+      },
+    };
+
+    let subscriptionId = 'subId';
+    sinon.stub(stripe.customers, 'del').returnsPromise().resolves({});
+
+    let currentPeriodEndTimeStamp = moment().add(3, 'months').unix();
+    sinon.stub(stripe.customers, 'retrieve')
+      .returnsPromise().resolves({
+        subscriptions: {
+          data: [{id: subscriptionId, current_period_end: currentPeriodEndTimeStamp}], // eslint-disable-line camelcase
+        },
+      });
+
+    stripePayments.setStripeApi(stripe);
+    sandbox.stub(sender, 'sendTxn');
+  });
+
+  afterEach(() => {
+    stripe.customers.del.restore();
+    stripe.customers.retrieve.restore();
+    sender.sendTxn.restore();
+  });
+
+  it('creates a group plan', async () => {
+    expect(group.purchased.plan.planId).to.not.exist;
+    data.groupId = group._id;
+
+    await api.createSubscription(data);
+
+    let updatedGroup = await Group.findById(group._id).exec();
+
+    expect(updatedGroup.purchased.plan.planId).to.eql('basic_3mo');
+    expect(updatedGroup.purchased.plan.customerId).to.eql('customer-id');
+    expect(updatedGroup.purchased.plan.dateUpdated).to.exist;
+    expect(updatedGroup.purchased.plan.gemsBought).to.eql(0);
+    expect(updatedGroup.purchased.plan.paymentMethod).to.eql('Payment Method');
+    expect(updatedGroup.purchased.plan.extraMonths).to.eql(0);
+    expect(updatedGroup.purchased.plan.dateTerminated).to.eql(null);
+    expect(updatedGroup.purchased.plan.lastBillingDate).to.not.exist;
+    expect(updatedGroup.purchased.plan.dateCreated).to.exist;
+  });
+
+  it('sends an email', async () => {
+    expect(group.purchased.plan.planId).to.not.exist;
+    data.groupId = group._id;
+
+    await api.createSubscription(data);
+
+    expect(sender.sendTxn).to.be.calledWith(user, 'group-subscription-begins');
+  });
+
+  it('sets extraMonths if plan has dateTerminated date', async () => {
+    group.purchased.plan = plan;
+    group.purchased.plan.dateTerminated = moment(new Date()).add(2, 'months');
+    await group.save();
+    expect(group.purchased.plan.extraMonths).to.eql(0);
+    data.groupId = group._id;
+
+    await api.createSubscription(data);
+
+    let updatedGroup = await Group.findById(group._id).exec();
+    expect(updatedGroup.purchased.plan.extraMonths).to.within(1.9, 2);
+  });
+
+  it('does not set negative extraMonths if plan has past dateTerminated date', async () => {
+    group.purchased.plan = plan;
+    group.purchased.plan.dateTerminated = moment(new Date()).subtract(2, 'months');
+    await group.save();
+    expect(group.purchased.plan.extraMonths).to.eql(0);
+    data.groupId = group._id;
+
+    await api.createSubscription(data);
+
+    let updatedGroup = await Group.findById(group._id).exec();
+    expect(updatedGroup.purchased.plan.extraMonths).to.eql(0);
+  });
+
+  it('grants all members of a group a subscription', async () => {
+    user.guilds.push(group._id);
+    await user.save();
+    expect(group.purchased.plan.planId).to.not.exist;
+    data.groupId = group._id;
+
+    await api.createSubscription(data);
+    let updatedLeader = await User.findById(user._id).exec();
+
+    expect(updatedLeader.purchased.plan.planId).to.eql('group_plan_auto');
+    expect(updatedLeader.purchased.plan.customerId).to.eql('group-plan');
+    expect(updatedLeader.purchased.plan.dateUpdated).to.exist;
+    expect(updatedLeader.purchased.plan.gemsBought).to.eql(0);
+    expect(updatedLeader.purchased.plan.paymentMethod).to.eql('Group Plan');
+    expect(updatedLeader.purchased.plan.extraMonths).to.eql(0);
+    expect(updatedLeader.purchased.plan.dateTerminated).to.eql(null);
+    expect(updatedLeader.purchased.plan.lastBillingDate).to.not.exist;
+    expect(updatedLeader.purchased.plan.dateCreated).to.exist;
+
+    expect(updatedLeader.items.mounts['Jackalope-RoyalPurple']).to.be.true;
+  });
+
+  it('sends an email to member of group who was not a subscriber', async () => {
+    let recipient = new User();
+    recipient.profile.name = 'recipient';
+    recipient.guilds.push(group._id);
+    await recipient.save();
+
+    data.groupId = group._id;
+
+    await api.createSubscription(data);
+
+    expect(sender.sendTxn).to.be.calledTwice;
+    expect(sender.sendTxn.firstCall.args[0]._id).to.equal(recipient._id);
+    expect(sender.sendTxn.firstCall.args[1]).to.equal('group-member-join');
+    expect(sender.sendTxn.firstCall.args[2]).to.eql([
+      {name: 'LEADER', content: user.profile.name},
+      {name: 'GROUP_NAME', content: group.name},
+      {name: 'PREVIOUS_SUBSCRIPTION_TYPE', content: EMAIL_TEMPLATE_SUBSCRIPTION_TYPE_NONE},
+    ]);
+    // confirm that the other email sent is appropriate:
+    expect(sender.sendTxn.secondCall.args[0]._id).to.equal(group.leader);
+    expect(sender.sendTxn.secondCall.args[1]).to.equal('group-subscription-begins');
+  });
+
+  it('sends one email to subscribed member of group, stating subscription is cancelled (Stripe)', async () => {
+    let recipient = new User();
+    recipient.profile.name = 'recipient';
+    plan.key = 'basic_earned';
+    plan.paymentMethod = stripePayments.constants.PAYMENT_METHOD;
+    recipient.purchased.plan = plan;
+    recipient.guilds.push(group._id);
+    await recipient.save();
+
+    data.groupId = group._id;
+
+    await api.createSubscription(data);
+
+    expect(sender.sendTxn).to.be.calledTwice;
+    expect(sender.sendTxn.firstCall.args[0]._id).to.equal(recipient._id);
+    expect(sender.sendTxn.firstCall.args[1]).to.equal('group-member-join');
+    expect(sender.sendTxn.firstCall.args[2]).to.eql([
+      {name: 'LEADER', content: user.profile.name},
+      {name: 'GROUP_NAME', content: group.name},
+      {name: 'PREVIOUS_SUBSCRIPTION_TYPE', content: EMAIL_TEMPLATE_SUBSCRIPTION_TYPE_NORMAL},
+    ]);
+    // confirm that the other email sent is not a cancel-subscription email:
+    expect(sender.sendTxn.secondCall.args[0]._id).to.equal(group.leader);
+    expect(sender.sendTxn.secondCall.args[1]).to.equal('group-subscription-begins');
+  });
+
+  it('sends one email to subscribed member of group, stating subscription is cancelled (Amazon)', async () => {
+    sinon.stub(amzLib, 'getBillingAgreementDetails')
+      .returnsPromise()
+      .resolves({
+        BillingAgreementDetails: {
+          BillingAgreementStatus: {State: 'Closed'},
+        },
+      });
+
+    let recipient = new User();
+    recipient.profile.name = 'recipient';
+    plan.planId = 'basic_earned';
+    plan.paymentMethod = amzLib.constants.PAYMENT_METHOD;
+    recipient.purchased.plan = plan;
+    recipient.guilds.push(group._id);
+    await recipient.save();
+
+    data.groupId = group._id;
+
+    await api.createSubscription(data);
+
+    expect(sender.sendTxn).to.be.calledTwice;
+    expect(sender.sendTxn.firstCall.args[0]._id).to.equal(recipient._id);
+    expect(sender.sendTxn.firstCall.args[1]).to.equal('group-member-join');
+    expect(sender.sendTxn.firstCall.args[2]).to.eql([
+      {name: 'LEADER', content: user.profile.name},
+      {name: 'GROUP_NAME', content: group.name},
+      {name: 'PREVIOUS_SUBSCRIPTION_TYPE', content: EMAIL_TEMPLATE_SUBSCRIPTION_TYPE_NORMAL},
+    ]);
+    // confirm that the other email sent is not a cancel-subscription email:
+    expect(sender.sendTxn.secondCall.args[0]._id).to.equal(group.leader);
+    expect(sender.sendTxn.secondCall.args[1]).to.equal('group-subscription-begins');
+
+    amzLib.getBillingAgreementDetails.restore();
+  });
+
+  it('sends one email to subscribed member of group, stating subscription is cancelled (PayPal)', async () => {
+    sinon.stub(paypalPayments, 'paypalBillingAgreementCancel').returnsPromise().resolves({});
+    sinon.stub(paypalPayments, 'paypalBillingAgreementGet')
+      .returnsPromise().resolves({
+        agreement_details: { // eslint-disable-line camelcase
+          next_billing_date: moment().add(3, 'months').toDate(), // eslint-disable-line camelcase
+          cycles_completed: 1, // eslint-disable-line camelcase
+        },
+      });
+
+    let recipient = new User();
+    recipient.profile.name = 'recipient';
+    plan.planId = 'basic_earned';
+    plan.paymentMethod = paypalPayments.constants.PAYMENT_METHOD;
+    recipient.purchased.plan = plan;
+    recipient.guilds.push(group._id);
+    await recipient.save();
+
+    data.groupId = group._id;
+
+    await api.createSubscription(data);
+
+    expect(sender.sendTxn).to.be.calledTwice;
+    expect(sender.sendTxn.firstCall.args[0]._id).to.equal(recipient._id);
+    expect(sender.sendTxn.firstCall.args[1]).to.equal('group-member-join');
+    expect(sender.sendTxn.firstCall.args[2]).to.eql([
+      {name: 'LEADER', content: user.profile.name},
+      {name: 'GROUP_NAME', content: group.name},
+      {name: 'PREVIOUS_SUBSCRIPTION_TYPE', content: EMAIL_TEMPLATE_SUBSCRIPTION_TYPE_NORMAL},
+    ]);
+    // confirm that the other email sent is not a cancel-subscription email:
+    expect(sender.sendTxn.secondCall.args[0]._id).to.equal(group.leader);
+    expect(sender.sendTxn.secondCall.args[1]).to.equal('group-subscription-begins');
+
+    paypalPayments.paypalBillingAgreementGet.restore();
+    paypalPayments.paypalBillingAgreementCancel.restore();
+  });
+
+  it('sends appropriate emails when subscribed member of group must manually cancel recurring Android subscription', async () => {
+    const TECH_ASSISTANCE_EMAIL = nconf.get('TECH_ASSISTANCE_EMAIL');
+    plan.customerId = 'random';
+    plan.paymentMethod = api.constants.GOOGLE_PAYMENT_METHOD;
+
+    let recipient = new User();
+    recipient.profile.name = 'recipient';
+    recipient.purchased.plan = plan;
+    recipient.guilds.push(group._id);
+    await recipient.save();
+
+    user.guilds.push(group._id);
+    await user.save();
+    data.groupId = group._id;
+
+    await api.createSubscription(data);
+
+    expect(sender.sendTxn).to.have.callCount(4);
+    expect(sender.sendTxn.args[0][0]._id).to.equal(TECH_ASSISTANCE_EMAIL);
+    expect(sender.sendTxn.args[0][1]).to.equal('admin-user-subscription-details');
+    expect(sender.sendTxn.args[1][0]._id).to.equal(recipient._id);
+    expect(sender.sendTxn.args[1][1]).to.equal('group-member-join');
+    expect(sender.sendTxn.args[1][2]).to.eql([
+      {name: 'LEADER', content: groupLeaderName},
+      {name: 'GROUP_NAME', content: groupName},
+      {name: 'PREVIOUS_SUBSCRIPTION_TYPE', content: EMAIL_TEMPLATE_SUBSCRIPTION_TYPE_GOOGLE},
+    ]);
+    expect(sender.sendTxn.args[2][0]._id).to.equal(group.leader);
+    expect(sender.sendTxn.args[2][1]).to.equal('group-member-join');
+    expect(sender.sendTxn.args[3][0]._id).to.equal(group.leader);
+    expect(sender.sendTxn.args[3][1]).to.equal('group-subscription-begins');
+  });
+
+  it('sends appropriate emails when subscribed member of group must manually cancel recurring iOS subscription', async () => {
+    const TECH_ASSISTANCE_EMAIL = nconf.get('TECH_ASSISTANCE_EMAIL');
+    plan.customerId = 'random';
+    plan.paymentMethod = api.constants.IOS_PAYMENT_METHOD;
+
+    let recipient = new User();
+    recipient.profile.name = 'recipient';
+    recipient.purchased.plan = plan;
+    recipient.guilds.push(group._id);
+    await recipient.save();
+
+    user.guilds.push(group._id);
+    await user.save();
+    data.groupId = group._id;
+
+    await api.createSubscription(data);
+
+    expect(sender.sendTxn).to.have.callCount(4);
+    expect(sender.sendTxn.args[0][0]._id).to.equal(TECH_ASSISTANCE_EMAIL);
+    expect(sender.sendTxn.args[0][1]).to.equal('admin-user-subscription-details');
+    expect(sender.sendTxn.args[1][0]._id).to.equal(recipient._id);
+    expect(sender.sendTxn.args[1][1]).to.equal('group-member-join');
+    expect(sender.sendTxn.args[1][2]).to.eql([
+      {name: 'LEADER', content: groupLeaderName},
+      {name: 'GROUP_NAME', content: groupName},
+      {name: 'PREVIOUS_SUBSCRIPTION_TYPE', content: EMAIL_TEMPLATE_SUBSCRIPTION_TYPE_IOS},
+    ]);
+    expect(sender.sendTxn.args[2][0]._id).to.equal(group.leader);
+    expect(sender.sendTxn.args[2][1]).to.equal('group-member-join');
+    expect(sender.sendTxn.args[3][0]._id).to.equal(group.leader);
+    expect(sender.sendTxn.args[3][1]).to.equal('group-subscription-begins');
+  });
+
+  it('adds months to members with existing gift subscription', async () => {
+    let recipient = new User();
+    recipient.profile.name = 'recipient';
+    recipient.purchased.plan = plan;
+    recipient.guilds.push(group._id);
+    plan.planId = 'basic_earned';
+    plan.paymentMethod = 'paymentMethod';
+    data.gift = {
+      member: recipient,
+      subscription: {
+        key: 'basic_earned',
+        months: 1,
+      },
+    };
+    await api.createSubscription(data);
+    await recipient.save();
+
+    data.gift = undefined;
+
+    user.guilds.push(group._id);
+    await user.save();
+    data.groupId = group._id;
+
+    await api.createSubscription(data);
+
+    let updatedUser = await User.findById(recipient._id).exec();
+
+    expect(updatedUser.purchased.plan.planId).to.eql('group_plan_auto');
+    expect(updatedUser.purchased.plan.customerId).to.eql('group-plan');
+    expect(updatedUser.purchased.plan.dateUpdated).to.exist;
+    expect(updatedUser.purchased.plan.gemsBought).to.eql(0);
+    expect(updatedUser.purchased.plan.paymentMethod).to.eql('Group Plan');
+    expect(updatedUser.purchased.plan.extraMonths).to.within(1, 3);
+    expect(updatedUser.purchased.plan.dateTerminated).to.eql(null);
+    expect(updatedUser.purchased.plan.lastBillingDate).to.not.exist;
+    expect(updatedUser.purchased.plan.dateCreated).to.exist;
+  });
+
+  it('adds months to members with existing multi-month gift subscription', async () => {
+    let recipient = new User();
+    recipient.profile.name = 'recipient';
+    recipient.purchased.plan = plan;
+    recipient.guilds.push(group._id);
+    data.gift = {
+      member: recipient,
+      subscription: {
+        key: 'basic_3mo',
+        months: 3,
+      },
+    };
+    await api.createSubscription(data);
+    await recipient.save();
+
+    data.gift = undefined;
+
+    user.guilds.push(group._id);
+    await user.save();
+    data.groupId = group._id;
+
+    await api.createSubscription(data);
+
+    let updatedUser = await User.findById(recipient._id).exec();
+
+    expect(updatedUser.purchased.plan.planId).to.eql('group_plan_auto');
+    expect(updatedUser.purchased.plan.customerId).to.eql('group-plan');
+    expect(updatedUser.purchased.plan.dateUpdated).to.exist;
+    expect(updatedUser.purchased.plan.gemsBought).to.eql(0);
+    expect(updatedUser.purchased.plan.paymentMethod).to.eql('Group Plan');
+    expect(updatedUser.purchased.plan.extraMonths).to.within(3, 5);
+    expect(updatedUser.purchased.plan.dateTerminated).to.eql(null);
+    expect(updatedUser.purchased.plan.lastBillingDate).to.not.exist;
+    expect(updatedUser.purchased.plan.dateCreated).to.exist;
+  });
+
+  it('adds months to members with existing recurring subscription (Stripe)', async () => {
+    let recipient = new User();
+    recipient.profile.name = 'recipient';
+    plan.key = 'basic_earned';
+    plan.paymentMethod = stripePayments.constants.PAYMENT_METHOD;
+    recipient.purchased.plan = plan;
+    recipient.guilds.push(group._id);
+    await recipient.save();
+
+    user.guilds.push(group._id);
+    await user.save();
+    data.groupId = group._id;
+
+    await api.createSubscription(data);
+
+    const updatedUser = await User.findById(recipient._id).exec();
+    expect(updatedUser.purchased.plan.extraMonths).to.within(2, 3);
+  });
+
+  it('adds months to members with existing recurring subscription (Amazon)', async () => {
+    sinon.stub(amzLib, 'getBillingAgreementDetails')
+      .returnsPromise()
+      .resolves({
+        BillingAgreementDetails: {
+          BillingAgreementStatus: {State: 'Closed'},
+        },
+      });
+
+    let recipient = new User();
+    recipient.profile.name = 'recipient';
+    plan.planId = 'basic_earned';
+    plan.paymentMethod = amzLib.constants.PAYMENT_METHOD;
+    plan.lastBillingDate = moment().add(3, 'months');
+    recipient.purchased.plan = plan;
+    recipient.guilds.push(group._id);
+
+    await recipient.save();
+
+    user.guilds.push(group._id);
+    await user.save();
+    data.groupId = group._id;
+
+    await api.createSubscription(data);
+
+    let updatedUser = await User.findById(recipient._id).exec();
+
+    expect(updatedUser.purchased.plan.extraMonths).to.within(3, 5);
+  });
+
+  it('adds months to members with existing recurring subscription (Paypal)', async () => {
+    sinon.stub(paypalPayments, 'paypalBillingAgreementCancel').returnsPromise().resolves({});
+    sinon.stub(paypalPayments, 'paypalBillingAgreementGet')
+      .returnsPromise().resolves({
+        agreement_details: { // eslint-disable-line camelcase
+          next_billing_date: moment().add(3, 'months').toDate(), // eslint-disable-line camelcase
+          cycles_completed: 1, // eslint-disable-line camelcase
+        },
+      });
+
+    let recipient = new User();
+    recipient.profile.name = 'recipient';
+    plan.planId = 'basic_earned';
+    plan.paymentMethod = paypalPayments.constants.PAYMENT_METHOD;
+    recipient.purchased.plan = plan;
+    recipient.guilds.push(group._id);
+
+    await recipient.save();
+
+    user.guilds.push(group._id);
+    await user.save();
+    data.groupId = group._id;
+
+    await api.createSubscription(data);
+
+    let updatedUser = await User.findById(recipient._id).exec();
+
+    expect(updatedUser.purchased.plan.extraMonths).to.within(2, 3);
+    paypalPayments.paypalBillingAgreementGet.restore();
+    paypalPayments.paypalBillingAgreementCancel.restore();
+  });
+
+  it('adds months to members with existing recurring subscription (Android)');
+  it('adds months to members with existing recurring subscription (iOS)');
+
+  it('adds months to members who already cancelled but not yet terminated recurring subscription', async () => {
+    let recipient = new User();
+    recipient.profile.name = 'recipient';
+    plan.key = 'basic_earned';
+    plan.paymentMethod = stripePayments.constants.PAYMENT_METHOD;
+    recipient.purchased.plan = plan;
+    recipient.guilds.push(group._id);
+    await recipient.save();
+
+    user.guilds.push(group._id);
+    await user.save();
+    data.groupId = group._id;
+
+    await recipient.cancelSubscription();
+
+    await api.createSubscription(data);
+
+    let updatedUser = await User.findById(recipient._id).exec();
+
+    expect(updatedUser.purchased.plan.extraMonths).to.within(2, 3);
+  });
+
+  it('adds months to members who already cancelled but not yet terminated group plan subscription', async () => {
+    let recipient = new User();
+    recipient.profile.name = 'recipient';
+    plan.key = 'basic_earned';
+    plan.paymentMethod = api.constants.GROUP_PLAN_PAYMENT_METHOD;
+    plan.extraMonths = 2.94;
+    recipient.purchased.plan = plan;
+    recipient.guilds.push(group._id);
+    await recipient.save();
+
+    user.guilds.push(group._id);
+    await user.save();
+    data.groupId = group._id;
+
+    await recipient.cancelSubscription();
+
+    await api.createSubscription(data);
+
+    let updatedUser = await User.findById(recipient._id).exec();
+    expect(updatedUser.purchased.plan.extraMonths).to.within(3, 4);
+  });
+
+  it('resets date terminated if user has old subscription', async () => {
+    let recipient = new User();
+    recipient.profile.name = 'recipient';
+    plan.key = 'basic_earned';
+    plan.paymentMethod = stripePayments.constants.PAYMENT_METHOD;
+    plan.dateTerminated = moment().subtract(1, 'days').toDate();
+    recipient.purchased.plan = plan;
+    recipient.guilds.push(group._id);
+    await recipient.save();
+
+    user.guilds.push(group._id);
+    await user.save();
+    data.groupId = group._id;
+
+    await api.createSubscription(data);
+
+    let updatedUser = await User.findById(recipient._id).exec();
+
+    expect(updatedUser.purchased.plan.dateTerminated).to.not.exist;
+  });
+
+  it('adds months to members with existing recurring subscription and includes existing extraMonths', async () => {
+    let recipient = new User();
+    recipient.profile.name = 'recipient';
+    plan.key = 'basic_earned';
+    plan.paymentMethod = stripePayments.constants.PAYMENT_METHOD;
+    plan.extraMonths = 5;
+    recipient.purchased.plan = plan;
+    recipient.guilds.push(group._id);
+    await recipient.save();
+
+    user.guilds.push(group._id);
+    await user.save();
+    data.groupId = group._id;
+
+    await api.createSubscription(data);
+
+    let updatedUser = await User.findById(recipient._id).exec();
+
+    expect(updatedUser.purchased.plan.extraMonths).to.within(7, 9);
+  });
+
+  it('adds months to members with existing recurring subscription and ignores existing negative extraMonths', async () => {
+    let recipient = new User();
+    recipient.profile.name = 'recipient';
+    plan.key = 'basic_earned';
+    plan.paymentMethod = stripePayments.constants.PAYMENT_METHOD;
+    plan.extraMonths = -5;
+    recipient.purchased.plan = plan;
+    recipient.guilds.push(group._id);
+    await recipient.save();
+
+    user.guilds.push(group._id);
+    await user.save();
+    data.groupId = group._id;
+
+    await api.createSubscription(data);
+
+    let updatedUser = await User.findById(recipient._id).exec();
+
+    expect(updatedUser.purchased.plan.extraMonths).to.within(2, 3);
+  });
+
+  it('does not override gemsBought, mysteryItems, dateCreated, and consective fields', async () => {
+    let planCreatedDate = moment().toDate();
+    let mysteryItem = {title: 'item'};
+    let mysteryItems = [mysteryItem];
+    let consecutive = {
+      trinkets: 3,
+      gemCapExtra: 20,
+      offset: 1,
+      count: 13,
+    };
+
+    let recipient = new User();
+    recipient.profile.name = 'recipient';
+
+    plan.key = 'basic_earned';
+    plan.gemsBought = 3;
+    plan.dateCreated = planCreatedDate;
+    plan.mysteryItems = mysteryItems;
+    plan.consecutive = consecutive;
+
+    recipient.purchased.plan = plan;
+    recipient.guilds.push(group._id);
+    await recipient.save();
+
+    user.guilds.push(group._id);
+    await user.save();
+    data.groupId = group._id;
+
+    await api.createSubscription(data);
+
+    let updatedUser = await User.findById(recipient._id).exec();
+
+    expect(updatedUser.purchased.plan.gemsBought).to.equal(3);
+    expect(updatedUser.purchased.plan.mysteryItems[0]).to.eql(mysteryItem);
+    expect(updatedUser.purchased.plan.consecutive.count).to.equal(consecutive.count);
+    expect(updatedUser.purchased.plan.consecutive.offset).to.equal(consecutive.offset);
+    expect(updatedUser.purchased.plan.consecutive.gemCapExtra).to.equal(consecutive.gemCapExtra);
+    expect(updatedUser.purchased.plan.consecutive.trinkets).to.equal(consecutive.trinkets);
+    expect(updatedUser.purchased.plan.dateCreated).to.eql(planCreatedDate);
+  });
+
+  it('does not modify a user with a group subscription when they join another group', async () => {
+    let recipient = new User();
+    recipient.profile.name = 'recipient';
+    plan.key = 'basic_earned';
+    recipient.purchased.plan = plan;
+    recipient.guilds.push(group._id);
+    await recipient.save();
+
+    user.guilds.push(group._id);
+    await user.save();
+    data.groupId = group._id;
+
+    await api.createSubscription(data);
+
+    let updatedUser = await User.findById(recipient._id).exec();
+    let firstDateCreated = updatedUser.purchased.plan.dateCreated;
+    let extraMonthsBeforeSecond = updatedUser.purchased.plan.extraMonths;
+
+    let group2 = generateGroup({
+      name: 'test group2',
+      type: 'guild',
+      privacy: 'public',
+      leader: user._id,
+    });
+    data.groupId = group2._id;
+    await group2.save();
+    recipient.guilds.push(group2._id);
+    await recipient.save();
+
+    await api.createSubscription(data);
+
+    updatedUser = await User.findById(recipient._id).exec();
+
+    expect(updatedUser.purchased.plan.planId).to.eql('group_plan_auto');
+    expect(updatedUser.purchased.plan.customerId).to.eql('group-plan');
+    expect(updatedUser.purchased.plan.dateUpdated).to.exist;
+    expect(updatedUser.purchased.plan.gemsBought).to.eql(0);
+    expect(updatedUser.purchased.plan.paymentMethod).to.eql('Group Plan');
+    expect(updatedUser.purchased.plan.extraMonths).to.eql(extraMonthsBeforeSecond);
+    expect(updatedUser.purchased.plan.dateTerminated).to.eql(null);
+    expect(updatedUser.purchased.plan.lastBillingDate).to.not.exist;
+    expect(updatedUser.purchased.plan.dateCreated).to.eql(firstDateCreated);
+  });
+
+  it('does not remove a user who is in two groups plans and leaves one', async () => {
+    let recipient = new User();
+    recipient.profile.name = 'recipient';
+    plan.key = 'basic_earned';
+    recipient.purchased.plan = plan;
+    recipient.guilds.push(group._id);
+    await recipient.save();
+
+    user.guilds.push(group._id);
+    await user.save();
+    data.groupId = group._id;
+
+    await api.createSubscription(data);
+
+    let updatedUser = await User.findById(recipient._id).exec();
+    let firstDateCreated = updatedUser.purchased.plan.dateCreated;
+    let extraMonthsBeforeSecond = updatedUser.purchased.plan.extraMonths;
+
+    let group2 = generateGroup({
+      name: 'test group2',
+      type: 'guild',
+      privacy: 'public',
+      leader: user._id,
+    });
+    data.groupId = group2._id;
+    await group2.save();
+    recipient.guilds.push(group2._id);
+    await recipient.save();
+
+    await api.createSubscription(data);
+
+    let updatedGroup = await Group.findById(group._id).exec();
+    await updatedGroup.leave(recipient);
+
+    updatedUser = await User.findById(recipient._id).exec();
+
+    expect(updatedUser.purchased.plan.planId).to.eql('group_plan_auto');
+    expect(updatedUser.purchased.plan.customerId).to.eql('group-plan');
+    expect(updatedUser.purchased.plan.dateUpdated).to.exist;
+    expect(updatedUser.purchased.plan.gemsBought).to.eql(0);
+    expect(updatedUser.purchased.plan.paymentMethod).to.eql('Group Plan');
+    expect(updatedUser.purchased.plan.extraMonths).to.eql(extraMonthsBeforeSecond);
+    expect(updatedUser.purchased.plan.dateTerminated).to.eql(null);
+    expect(updatedUser.purchased.plan.lastBillingDate).to.not.exist;
+    expect(updatedUser.purchased.plan.dateCreated).to.eql(firstDateCreated);
+  });
+
+  it('does not modify a user with an unlimited subscription', async () => {
+    plan.key = 'basic_earned';
+    plan.customerId = api.constants.UNLIMITED_CUSTOMER_ID;
+
+    let recipient = new User();
+    recipient.profile.name = 'recipient';
+    recipient.purchased.plan = plan;
+    recipient.guilds.push(group._id);
+    await recipient.save();
+
+    user.guilds.push(group._id);
+    await user.save();
+    data.groupId = group._id;
+
+    await api.createSubscription(data);
+
+    let updatedUser = await User.findById(recipient._id).exec();
+
+    expect(updatedUser.purchased.plan.planId).to.eql('basic_3mo');
+    expect(updatedUser.purchased.plan.customerId).to.eql(api.constants.UNLIMITED_CUSTOMER_ID);
+    expect(updatedUser.purchased.plan.dateUpdated).to.exist;
+    expect(updatedUser.purchased.plan.gemsBought).to.eql(0);
+    expect(updatedUser.purchased.plan.paymentMethod).to.eql('paymentMethod');
+    expect(updatedUser.purchased.plan.extraMonths).to.eql(0);
+    expect(updatedUser.purchased.plan.dateTerminated).to.eql(null);
+    expect(updatedUser.purchased.plan.lastBillingDate).to.exist;
+    expect(updatedUser.purchased.plan.dateCreated).to.exist;
+  });
+
+  it('does not modify a user with an Android subscription', async () => {
+    plan.customerId = 'random';
+    plan.paymentMethod = api.constants.GOOGLE_PAYMENT_METHOD;
+
+    let recipient = new User();
+    recipient.profile.name = 'recipient';
+    recipient.purchased.plan = plan;
+    recipient.guilds.push(group._id);
+    await recipient.save();
+
+    user.guilds.push(group._id);
+    await user.save();
+    data.groupId = group._id;
+
+    await api.createSubscription(data);
+
+    let updatedUser = await User.findById(recipient._id).exec();
+
+    expect(updatedUser.purchased.plan.planId).to.eql('basic_3mo');
+    expect(updatedUser.purchased.plan.customerId).to.eql('random');
+    expect(updatedUser.purchased.plan.dateUpdated).to.exist;
+    expect(updatedUser.purchased.plan.gemsBought).to.eql(0);
+    expect(updatedUser.purchased.plan.paymentMethod).to.eql(api.constants.GOOGLE_PAYMENT_METHOD);
+    expect(updatedUser.purchased.plan.extraMonths).to.eql(0);
+    expect(updatedUser.purchased.plan.dateTerminated).to.eql(null);
+    expect(updatedUser.purchased.plan.lastBillingDate).to.exist;
+    expect(updatedUser.purchased.plan.dateCreated).to.exist;
+  });
+
+  it('does not modify a user with an iOS subscription', async () => {
+    plan.customerId = 'random';
+    plan.paymentMethod = api.constants.IOS_PAYMENT_METHOD;
+
+    let recipient = new User();
+    recipient.profile.name = 'recipient';
+    recipient.purchased.plan = plan;
+    recipient.guilds.push(group._id);
+    await recipient.save();
+
+    user.guilds.push(group._id);
+    await user.save();
+    data.groupId = group._id;
+
+    await api.createSubscription(data);
+
+    let updatedUser = await User.findById(recipient._id).exec();
+
+    expect(updatedUser.purchased.plan.planId).to.eql('basic_3mo');
+    expect(updatedUser.purchased.plan.customerId).to.eql('random');
+    expect(updatedUser.purchased.plan.dateUpdated).to.exist;
+    expect(updatedUser.purchased.plan.gemsBought).to.eql(0);
+    expect(updatedUser.purchased.plan.paymentMethod).to.eql(api.constants.IOS_PAYMENT_METHOD);
+    expect(updatedUser.purchased.plan.extraMonths).to.eql(0);
+    expect(updatedUser.purchased.plan.dateTerminated).to.eql(null);
+    expect(updatedUser.purchased.plan.lastBillingDate).to.exist;
+    expect(updatedUser.purchased.plan.dateCreated).to.exist;
+  });
+
+  it('updates a user with a cancelled but active group subscription', async () => {
+    plan.key = 'basic_earned';
+    plan.customerId = api.constants.GROUP_PLAN_CUSTOMER_ID;
+    plan.dateTerminated = moment().add(1, 'months');
+
+    let recipient = new User();
+    recipient.profile.name = 'recipient';
+    recipient.purchased.plan = plan;
+    recipient.guilds.push(group._id);
+    await recipient.save();
+
+    user.guilds.push(group._id);
+    await user.save();
+    data.groupId = group._id;
+
+    await api.createSubscription(data);
+
+    let updatedUser = await User.findById(recipient._id).exec();
+
+    expect(updatedUser.purchased.plan.planId).to.eql('group_plan_auto');
+    expect(updatedUser.purchased.plan.customerId).to.eql(api.constants.GROUP_PLAN_CUSTOMER_ID);
+    expect(updatedUser.purchased.plan.dateUpdated).to.exist;
+    expect(updatedUser.purchased.plan.gemsBought).to.eql(0);
+    expect(updatedUser.purchased.plan.paymentMethod).to.eql('Group Plan');
+    expect(updatedUser.purchased.plan.extraMonths).to.within(0, 2);
+    expect(updatedUser.purchased.plan.dateTerminated).to.eql(null);
+    expect(updatedUser.purchased.plan.lastBillingDate).to.not.exist;
+    expect(updatedUser.purchased.plan.dateCreated).to.exist;
+  });
+});

test/api/unit/libs/payments/paymentHelpers.js

@@ -0,0 +1,7 @@
+import { model as User } from '../../../../../website/server/models/user';
+
+export async function createNonLeaderGroupMember (group) {
+  let nonLeader = new User();
+  nonLeader.guilds.push(group._id);
+  return await nonLeader.save();
+}

test/api/unit/libs/payments/payments.test.js

@@ -0,0 +1,730 @@
+import moment from 'moment';
+
+import * as sender from '../../../../../website/server/libs/email';
+import * as api from '../../../../../website/server/libs/payments/payments';
+import analytics from '../../../../../website/server/libs/analyticsService';
+import notifications from '../../../../../website/server/libs/pushNotifications';
+import { model as User } from '../../../../../website/server/models/user';
+import { translate as t } from '../../../../helpers/api-integration/v3';
+import {
+  generateGroup,
+} from '../../../../helpers/api-unit.helper.js';
+
+describe('payments/index', () => {
+  let user, group, data, plan;
+
+  beforeEach(async () => {
+    user = new User();
+    user.profile.name = 'sender';
+    await user.save();
+
+    group = generateGroup({
+      name: 'test group',
+      type: 'guild',
+      privacy: 'public',
+      leader: user._id,
+    });
+    await group.save();
+
+    sandbox.stub(sender, 'sendTxn');
+    sandbox.stub(user, 'sendMessage');
+    sandbox.stub(analytics, 'trackPurchase');
+    sandbox.stub(analytics, 'track');
+    sandbox.stub(notifications, 'sendNotification');
+
+    data = {
+      user,
+      sub: {
+        key: 'basic_3mo',
+      },
+      customerId: 'customer-id',
+      paymentMethod: 'Payment Method',
+      headers: {
+        'x-client': 'habitica-web',
+        'user-agent': '',
+      },
+    };
+
+    plan = {
+      planId: 'basic_3mo',
+      customerId: 'customer-id',
+      dateUpdated: new Date(),
+      gemsBought: 0,
+      paymentMethod: 'paymentMethod',
+      extraMonths: 0,
+      dateTerminated: null,
+      lastBillingDate: new Date(),
+      dateCreated: new Date(),
+      mysteryItems: [],
+      consecutive: {
+        trinkets: 0,
+        offset: 0,
+        gemCapExtra: 0,
+      },
+    };
+  });
+
+  afterEach(() => {
+    sandbox.restore();
+  });
+
+  describe('#createSubscription', () => {
+    context('Purchasing a subscription as a gift', () => {
+      let recipient;
+
+      beforeEach(() => {
+        recipient = new User();
+        recipient.profile.name = 'recipient';
+        data.gift = {
+          member: recipient,
+          subscription: {
+            key: 'basic_3mo',
+            months: 3,
+          },
+        };
+      });
+
+      it('awards the Royal Purple Jackalope pet', async () => {
+        await api.createSubscription(data);
+
+        expect(recipient.items.pets['Jackalope-RoyalPurple']).to.eql(5);
+      });
+
+      it('adds extra months to an existing subscription', async () => {
+        recipient.purchased.plan = plan;
+
+        expect(recipient.purchased.plan.extraMonths).to.eql(0);
+
+        await api.createSubscription(data);
+
+        expect(recipient.purchased.plan.extraMonths).to.eql(3);
+      });
+
+      it('does not set negative extraMonths if plan has past dateTerminated date', async () => {
+        let dateTerminated = moment().subtract(2, 'months').toDate();
+        recipient.purchased.plan.dateTerminated = dateTerminated;
+
+        await api.createSubscription(data);
+
+        expect(recipient.purchased.plan.extraMonths).to.eql(0);
+      });
+
+      it('does not reset Gold-to-Gems cap on an existing subscription', async () => {
+        recipient.purchased.plan = plan;
+        recipient.purchased.plan.gemsBought = 12;
+
+        await api.createSubscription(data);
+
+        expect(recipient.purchased.plan.gemsBought).to.eql(12);
+      });
+
+      it('adds to date terminated for an existing plan with a future terminated date', async () => {
+        let dateTerminated = moment().add(1, 'months').toDate();
+        recipient.purchased.plan = plan;
+        recipient.purchased.plan.dateTerminated = dateTerminated;
+
+        await api.createSubscription(data);
+
+        expect(recipient.purchased.plan.dateTerminated).to.eql(moment(dateTerminated).add(3, 'months').toDate());
+      });
+
+      it('replaces date terminated for an account with a past terminated date', async () => {
+        let dateTerminated = moment().subtract(1, 'months').toDate();
+        recipient.purchased.plan.dateTerminated = dateTerminated;
+
+        await api.createSubscription(data);
+
+        expect(moment(recipient.purchased.plan.dateTerminated).format('YYYY-MM-DD')).to.eql(moment().add(3, 'months').format('YYYY-MM-DD'));
+      });
+
+      it('sets a dateTerminated date for a user without an existing subscription', async () => {
+        expect(recipient.purchased.plan.dateTerminated).to.not.exist;
+
+        await api.createSubscription(data);
+
+        expect(recipient.purchased.plan.dateTerminated).to.exist;
+      });
+
+      it('sets plan.dateUpdated if it did not previously exist', async () => {
+        expect(recipient.purchased.plan.dateUpdated).to.not.exist;
+
+        await api.createSubscription(data);
+
+        expect(recipient.purchased.plan.dateUpdated).to.exist;
+      });
+
+      it('sets plan.dateUpdated if it did exist but the user has cancelled', async () => {
+        recipient.purchased.plan.dateUpdated = moment().subtract(1, 'days').toDate();
+        recipient.purchased.plan.dateTerminated = moment().subtract(1, 'days').toDate();
+        recipient.purchased.plan.customerId = 'testing';
+
+        await api.createSubscription(data);
+
+        expect(moment(recipient.purchased.plan.dateUpdated).date()).to.eql(moment().date());
+      });
+
+      it('sets plan.dateUpdated if it did exist but the user has a corrupt plan', async () => {
+        recipient.purchased.plan.dateUpdated = moment().subtract(1, 'days').toDate();
+
+        await api.createSubscription(data);
+
+        expect(moment(recipient.purchased.plan.dateUpdated).date()).to.eql(moment().date());
+      });
+
+      it('sets plan.dateCreated if it did not previously exist', async () => {
+        expect(recipient.purchased.plan.dateCreated).to.not.exist;
+
+        await api.createSubscription(data);
+
+        expect(recipient.purchased.plan.dateCreated).to.exist;
+      });
+
+      it('does not change plan.customerId if it already exists', async () => {
+        recipient.purchased.plan = plan;
+        data.customerId = 'purchaserCustomerId';
+
+        expect(recipient.purchased.plan.customerId).to.eql('customer-id');
+        await api.createSubscription(data);
+
+        expect(recipient.purchased.plan.customerId).to.eql('customer-id');
+      });
+
+      it('sets plan.customerId to "Gift" if it does not already exist', async () => {
+        expect(recipient.purchased.plan.customerId).to.not.exist;
+
+        await api.createSubscription(data);
+
+        expect(recipient.purchased.plan.customerId).to.eql('Gift');
+      });
+
+      it('increases the buyer\'s transaction count', async () => {
+        expect(user.purchased.txnCount).to.eql(0);
+
+        await api.createSubscription(data);
+
+        expect(user.purchased.txnCount).to.eql(1);
+      });
+
+      it('sends a private message about the gift', async () => {
+        await api.createSubscription(data);
+        let msg = '\`Hello recipient, sender has sent you 3 months of subscription!\`';
+
+        expect(user.sendMessage).to.be.calledOnce;
+        expect(user.sendMessage).to.be.calledWith(recipient, { receiverMsg: msg, senderMsg: msg, save: false });
+      });
+
+      it('sends an email about the gift', async () => {
+        await api.createSubscription(data);
+
+        expect(sender.sendTxn).to.be.calledWith(recipient, 'gifted-subscription', [
+          {name: 'GIFTER', content: 'sender'},
+          {name: 'X_MONTHS_SUBSCRIPTION', content: 3},
+        ]);
+      });
+
+      it('sends a push notification about the gift', async () => {
+        await api.createSubscription(data);
+        expect(notifications.sendNotification).to.be.calledOnce;
+      });
+
+      it('tracks subscription purchase as gift', async () => {
+        await api.createSubscription(data);
+
+        expect(analytics.trackPurchase).to.be.calledOnce;
+        expect(analytics.trackPurchase).to.be.calledWith({
+          uuid: user._id,
+          groupId: undefined,
+          itemPurchased: 'Subscription',
+          sku: 'payment method-subscription',
+          purchaseType: 'subscribe',
+          paymentMethod: data.paymentMethod,
+          quantity: 1,
+          gift: true,
+          purchaseValue: 15,
+          headers: {
+            'x-client': 'habitica-web',
+            'user-agent': '',
+          },
+        });
+      });
+    });
+
+    context('Purchasing a subscription for self', () => {
+      it('creates a subscription', async () => {
+        expect(user.purchased.plan.planId).to.not.exist;
+
+        await api.createSubscription(data);
+
+        expect(user.purchased.plan.planId).to.eql('basic_3mo');
+        expect(user.purchased.plan.customerId).to.eql('customer-id');
+        expect(user.purchased.plan.dateUpdated).to.exist;
+        expect(user.purchased.plan.gemsBought).to.eql(0);
+        expect(user.purchased.plan.paymentMethod).to.eql('Payment Method');
+        expect(user.purchased.plan.extraMonths).to.eql(0);
+        expect(user.purchased.plan.dateTerminated).to.eql(null);
+        expect(user.purchased.plan.lastBillingDate).to.not.exist;
+        expect(user.purchased.plan.dateCreated).to.exist;
+      });
+
+      it('awards the Royal Purple Jackalope pet', async () => {
+        await api.createSubscription(data);
+
+        expect(user.items.pets['Jackalope-RoyalPurple']).to.eql(5);
+      });
+
+      it('sets extraMonths if plan has dateTerminated date', async () => {
+        user.purchased.plan = plan;
+        user.purchased.plan.dateTerminated = moment(new Date()).add(2, 'months');
+        expect(user.purchased.plan.extraMonths).to.eql(0);
+
+        await api.createSubscription(data);
+
+        expect(user.purchased.plan.extraMonths).to.within(1.9, 2);
+      });
+
+      it('does not set negative extraMonths if plan has past dateTerminated date', async () => {
+        user.purchased.plan = plan;
+        user.purchased.plan.dateTerminated = moment(new Date()).subtract(2, 'months');
+        expect(user.purchased.plan.extraMonths).to.eql(0);
+
+        await api.createSubscription(data);
+
+        expect(user.purchased.plan.extraMonths).to.eql(0);
+      });
+
+      it('does not reset Gold-to-Gems cap on additional subscription', async () => {
+        user.purchased.plan = plan;
+        user.purchased.plan.gemsBought = 10;
+
+        await api.createSubscription(data);
+
+        expect(user.purchased.plan.gemsBought).to.eql(10);
+      });
+
+      it('sets lastBillingDate if payment method is "Amazon Payments"', async () => {
+        data.paymentMethod = 'Amazon Payments';
+
+        await api.createSubscription(data);
+
+        expect(user.purchased.plan.lastBillingDate).to.exist;
+      });
+
+      it('increases the user\'s transaction count', async () => {
+        expect(user.purchased.txnCount).to.eql(0);
+
+        await api.createSubscription(data);
+
+        expect(user.purchased.txnCount).to.eql(1);
+      });
+
+      it('sends a transaction email', async () => {
+        await api.createSubscription(data);
+
+        expect(sender.sendTxn).to.be.calledOnce;
+        expect(sender.sendTxn).to.be.calledWith(data.user, 'subscription-begins');
+      });
+
+      it('tracks subscription purchase', async () => {
+        await api.createSubscription(data);
+
+        expect(analytics.trackPurchase).to.be.calledOnce;
+        expect(analytics.trackPurchase).to.be.calledWith({
+          uuid: user._id,
+          groupId: undefined,
+          itemPurchased: 'Subscription',
+          sku: 'payment method-subscription',
+          purchaseType: 'subscribe',
+          paymentMethod: data.paymentMethod,
+          quantity: 1,
+          gift: false,
+          purchaseValue: 15,
+          headers: {
+            'x-client': 'habitica-web',
+            'user-agent': '',
+          },
+        });
+      });
+    });
+
+    context('Block subscription perks', () => {
+      it('adds block months to plan.consecutive.offset', async () => {
+        await api.createSubscription(data);
+
+        expect(user.purchased.plan.consecutive.offset).to.eql(3);
+      });
+
+      it('does not add to plans.consecutive.offset if 1 month subscription', async () => {
+        await api.createSubscription(data);
+
+        expect(user.purchased.plan.extraMonths).to.eql(0);
+      });
+
+      it('adds 5 to plan.consecutive.gemCapExtra for 3 month block', async () => {
+        await api.createSubscription(data);
+
+        expect(user.purchased.plan.consecutive.gemCapExtra).to.eql(5);
+      });
+
+      it('adds 10 to plan.consecutive.gemCapExtra for 6 month block', async () => {
+        data.sub.key = 'basic_6mo';
+
+        await api.createSubscription(data);
+
+        expect(user.purchased.plan.consecutive.gemCapExtra).to.eql(10);
+      });
+
+      it('adds 20 to plan.consecutive.gemCapExtra for 12 month block', async () => {
+        data.sub.key = 'basic_12mo';
+
+        await api.createSubscription(data);
+
+        expect(user.purchased.plan.consecutive.gemCapExtra).to.eql(20);
+      });
+
+      it('does not raise plan.consecutive.gemCapExtra higher than 25', async () => {
+        data.sub.key = 'basic_12mo';
+
+        await api.createSubscription(data);
+        await api.createSubscription(data);
+
+        expect(user.purchased.plan.consecutive.gemCapExtra).to.eql(25);
+      });
+
+      it('adds a plan.consecutive.trinkets for 3 month block', async () => {
+        await api.createSubscription(data);
+
+        expect(user.purchased.plan.consecutive.trinkets).to.eql(1);
+      });
+
+      it('adds 2 plan.consecutive.trinkets for 6 month block', async () => {
+        data.sub.key = 'basic_6mo';
+
+        await api.createSubscription(data);
+
+        expect(user.purchased.plan.consecutive.trinkets).to.eql(2);
+      });
+
+      it('adds 4 plan.consecutive.trinkets for 12 month block', async () => {
+        data.sub.key = 'basic_12mo';
+
+        await api.createSubscription(data);
+
+        expect(user.purchased.plan.consecutive.trinkets).to.eql(4);
+      });
+    });
+
+    context('Mystery Items', () => {
+      it('awards mystery items when within the timeframe for a mystery item', async () => {
+        let mayMysteryItemTimeframe = 1464725113000; // May 31st 2016
+        let fakeClock = sinon.useFakeTimers(mayMysteryItemTimeframe);
+
+        data = { paymentMethod: 'PaymentMethod', user, sub: { key: 'basic_3mo' } };
+
+        const oldNotificationsCount = user.notifications.length;
+
+        await api.createSubscription(data);
+
+        expect(user.notifications.find(n => n.type === 'NEW_MYSTERY_ITEMS')).to.not.be.undefined;
+        expect(user.purchased.plan.mysteryItems).to.have.a.lengthOf(2);
+        expect(user.purchased.plan.mysteryItems).to.include('armor_mystery_201605');
+        expect(user.purchased.plan.mysteryItems).to.include('head_mystery_201605');
+        expect(user.notifications.length).to.equal(oldNotificationsCount + 1);
+        expect(user.notifications[0].type).to.equal('NEW_MYSTERY_ITEMS');
+
+        fakeClock.restore();
+      });
+
+      it('does not awards mystery items when not within the timeframe for a mystery item', async () => {
+        const noMysteryItemTimeframe = 1462183920000; // May 2nd 2016
+        let fakeClock = sinon.useFakeTimers(noMysteryItemTimeframe);
+        data = { paymentMethod: 'PaymentMethod', user, sub: { key: 'basic_3mo' } };
+
+        await api.createSubscription(data);
+
+        expect(user.purchased.plan.mysteryItems).to.have.a.lengthOf(0);
+
+        fakeClock.restore();
+      });
+
+      it('does not award mystery item when user already owns the item', async () => {
+        let mayMysteryItemTimeframe = 1464725113000; // May 31st 2016
+        let fakeClock = sinon.useFakeTimers(mayMysteryItemTimeframe);
+        let mayMysteryItem = 'armor_mystery_201605';
+        user.items.gear.owned[mayMysteryItem] = true;
+
+        data = { paymentMethod: 'PaymentMethod', user, sub: { key: 'basic_3mo' } };
+
+        await api.createSubscription(data);
+
+        expect(user.purchased.plan.mysteryItems).to.have.a.lengthOf(1);
+        expect(user.purchased.plan.mysteryItems).to.include('head_mystery_201605');
+
+        fakeClock.restore();
+      });
+
+      it('does not award mystery item when user already has the item in the mystery box', async () => {
+        let mayMysteryItemTimeframe = 1464725113000; // May 31st 2016
+        let fakeClock = sinon.useFakeTimers(mayMysteryItemTimeframe);
+        let mayMysteryItem = 'armor_mystery_201605';
+        user.purchased.plan.mysteryItems = [mayMysteryItem];
+
+        sandbox.spy(user.purchased.plan.mysteryItems, 'push');
+
+        data = { paymentMethod: 'PaymentMethod', user, sub: { key: 'basic_3mo' } };
+        await api.createSubscription(data);
+
+        expect(user.purchased.plan.mysteryItems.push).to.be.calledOnce;
+        expect(user.purchased.plan.mysteryItems.push).to.be.calledWith('head_mystery_201605');
+
+        fakeClock.restore();
+      });
+    });
+  });
+
+  describe('#cancelSubscription', () => {
+    beforeEach(() => {
+      data = { user };
+    });
+
+    context('Canceling a subscription for self', () => {
+      it('adds a month termination date by default', async () => {
+        await api.cancelSubscription(data);
+
+        let now = new Date();
+        let daysTillTermination = moment(user.purchased.plan.dateTerminated).diff(now, 'days');
+
+        expect(daysTillTermination).to.be.within(29, 30); // 1 month +/- 1 days
+      });
+
+      it('adds extraMonths to dateTerminated value', async () => {
+        user.purchased.plan.extraMonths = 2;
+
+        await api.cancelSubscription(data);
+
+        let now = new Date();
+        let daysTillTermination = moment(user.purchased.plan.dateTerminated).diff(now, 'days');
+
+        expect(daysTillTermination).to.be.within(89, 90); // 3 months +/- 1 days
+      });
+
+      it('handles extra month fractions', async () => {
+        user.purchased.plan.extraMonths = 0.3;
+
+        await api.cancelSubscription(data);
+
+        let now = new Date();
+        let daysTillTermination = moment(user.purchased.plan.dateTerminated).diff(now, 'days');
+
+        expect(daysTillTermination).to.be.within(38, 39); // should be about 1 month + 1/3 month
+      });
+
+      it('terminates at next billing date if it exists', async () => {
+        data.nextBill = moment().add({ days: 15 });
+
+        await api.cancelSubscription(data);
+
+        let now = new Date();
+        let daysTillTermination = moment(user.purchased.plan.dateTerminated).diff(now, 'days');
+
+        expect(daysTillTermination).to.be.within(13, 15);
+      });
+
+      it('terminates at next billing date even if dateUpdated is prior to now', async () => {
+        data.nextBill = moment().add({ days: 15 });
+        data.user.purchased.plan.dateUpdated = moment().subtract({ days: 10 });
+
+        await api.cancelSubscription(data);
+
+        let now = new Date();
+        let daysTillTermination = moment(user.purchased.plan.dateTerminated).diff(now, 'days');
+
+        expect(daysTillTermination).to.be.within(13, 15);
+      });
+
+      it('resets plan.extraMonths', async () => {
+        user.purchased.plan.extraMonths = 5;
+
+        await api.cancelSubscription(data);
+
+        expect(user.purchased.plan.extraMonths).to.eql(0);
+      });
+
+      it('sends an email', async () => {
+        await api.cancelSubscription(data);
+
+        expect(sender.sendTxn).to.be.calledOnce;
+        expect(sender.sendTxn).to.be.calledWith(user, 'cancel-subscription');
+      });
+    });
+  });
+
+  describe('#buyGems', () => {
+    beforeEach(() => {
+      data = {
+        user,
+        paymentMethod: 'payment',
+        headers: {
+          'x-client': 'habitica-web',
+          'user-agent': '',
+        },
+      };
+    });
+
+    context('Self Purchase', () => {
+      it('amount property defaults to 5', async () => {
+        expect(user.balance).to.eql(0);
+
+        await api.buyGems(data);
+
+        expect(user.balance).to.eql(5);
+      });
+
+      it('can set amount that is purchased', async () => {
+        data.amount = 13;
+
+        await api.buyGems(data);
+
+        expect(user.balance).to.eql(13);
+      });
+
+      it('sends a donation email', async () => {
+        await api.buyGems(data);
+
+        expect(sender.sendTxn).to.be.calledOnce;
+        expect(sender.sendTxn).to.be.calledWith(data.user, 'donation');
+      });
+    });
+
+    context('Gift', () => {
+      let recipient;
+
+      beforeEach(() => {
+        recipient = new User();
+        recipient.profile.name = 'recipient';
+
+        data.gift = {
+          gems: {
+            amount: 4,
+          },
+          member: recipient,
+        };
+      });
+
+      it('calculates balance from gem amount if gift', async () => {
+        expect(recipient.balance).to.eql(0);
+
+        await api.buyGems(data);
+
+        expect(recipient.balance).to.eql(1);
+      });
+
+      it('sends a gifted-gems email', async () => {
+        await api.buyGems(data);
+
+        expect(sender.sendTxn).to.be.calledOnce;
+        expect(sender.sendTxn).to.be.calledWith(data.gift.member, 'gifted-gems');
+      });
+
+      it('sends a message from purchaser to recipient', async () => {
+        await api.buyGems(data);
+        let msg = '\`Hello recipient, sender has sent you 4 gems!\`';
+
+        expect(user.sendMessage).to.be.calledWith(recipient, { receiverMsg: msg, senderMsg: msg, save: false });
+      });
+
+      it('sends a message from purchaser to recipient wtih custom message', async () => {
+        data.gift.message = 'giftmessage';
+
+        await api.buyGems(data);
+
+        const msg = `\`Hello recipient, sender has sent you 4 gems!\` ${data.gift.message}`;
+        expect(user.sendMessage).to.be.calledWith(recipient, { receiverMsg: msg, senderMsg: msg, save: false });
+      });
+
+      it('sends a push notification if user did not gift to self', async () => {
+        await api.buyGems(data);
+        expect(notifications.sendNotification).to.be.calledOnce;
+      });
+
+      it('sends gem donation message in each participant\'s language', async () => {
+        // TODO using english for both users because other languages are not loaded
+        // for api.buyGems
+        await recipient.update({
+          'preferences.language': 'en',
+        });
+        await user.update({
+          'preferences.language': 'en',
+        });
+        await api.buyGems(data);
+
+        let [recipientsMessageContent, sendersMessageContent] = ['en', 'en'].map((lang) => {
+          let messageContent = t('giftedGemsFull', {
+            username: recipient.profile.name,
+            sender: user.profile.name,
+            gemAmount: data.gift.gems.amount,
+          }, lang);
+
+          return `\`${messageContent}\``;
+        });
+
+        expect(user.sendMessage).to.be.calledWith(recipient, { receiverMsg: recipientsMessageContent, senderMsg: sendersMessageContent, save: false });
+      });
+    });
+  });
+
+  describe('addSubToGroupUser', () => {
+    it('adds a group subscription to a new user', async () => {
+      expect(group.purchased.plan.planId).to.not.exist;
+      data.groupId = group._id;
+
+      await api.addSubToGroupUser(user, group);
+
+      let updatedUser = await User.findById(user._id).exec();
+
+      expect(updatedUser.purchased.plan.planId).to.eql('group_plan_auto');
+      expect(updatedUser.purchased.plan.customerId).to.eql('group-plan');
+      expect(updatedUser.purchased.plan.dateUpdated).to.exist;
+      expect(updatedUser.purchased.plan.gemsBought).to.eql(0);
+      expect(updatedUser.purchased.plan.paymentMethod).to.eql('Group Plan');
+      expect(updatedUser.purchased.plan.extraMonths).to.eql(0);
+      expect(updatedUser.purchased.plan.dateTerminated).to.eql(null);
+      expect(updatedUser.purchased.plan.lastBillingDate).to.not.exist;
+      expect(updatedUser.purchased.plan.dateCreated).to.exist;
+    });
+
+    it('awards the Royal Purple Jackalope pet', async () => {
+      await api.addSubToGroupUser(user, group);
+
+      let updatedUser = await User.findById(user._id).exec();
+
+      expect(updatedUser.items.pets['Jackalope-RoyalPurple']).to.eql(5);
+    });
+
+    it('saves previously unused Mystery Items and Hourglasses for an expired subscription', async () => {
+      let planExpirationDate = new Date();
+      planExpirationDate.setDate(planExpirationDate.getDate() - 2);
+      let mysteryItem = 'item';
+      let mysteryItems = [mysteryItem];
+      let consecutive = {
+        trinkets: 3,
+      };
+
+      // set expired plan with unused items
+      plan.mysteryItems = mysteryItems;
+      plan.consecutive = consecutive;
+      plan.dateCreated = planExpirationDate;
+      plan.dateTerminated = planExpirationDate;
+      plan.customerId = null;
+
+      user.purchased.plan = plan;
+
+      await user.save();
+      await api.addSubToGroupUser(user, group);
+
+      let updatedUser = await User.findById(user._id).exec();
+
+      expect(updatedUser.purchased.plan.mysteryItems[0]).to.eql(mysteryItem);
+      expect(updatedUser.purchased.plan.consecutive.trinkets).to.equal(consecutive.trinkets);
+    });
+  });
+});

test/api/unit/libs/payments/paypal/checkout-success.test.js

@@ -0,0 +1,87 @@
+/* eslint-disable camelcase */
+import paypalPayments from '../../../../../../website/server/libs/payments/paypal';
+import payments from '../../../../../../website/server/libs/payments/payments';
+import { model as User } from '../../../../../../website/server/models/user';
+
+describe('checkout success', () => {
+  const subKey = 'basic_3mo';
+  let user, gift, customerId, paymentId;
+  let paypalPaymentExecuteStub, paymentBuyGemsStub, paymentsCreateSubscritionStub;
+
+  beforeEach(() => {
+    user = new User();
+    customerId = 'customerId-test';
+    paymentId = 'paymentId-test';
+
+    paypalPaymentExecuteStub = sinon.stub(paypalPayments, 'paypalPaymentExecute').returnsPromise().resolves({});
+    paymentBuyGemsStub = sinon.stub(payments, 'buyGems').returnsPromise().resolves({});
+    paymentsCreateSubscritionStub = sinon.stub(payments, 'createSubscription').returnsPromise().resolves({});
+  });
+
+  afterEach(() => {
+    paypalPayments.paypalPaymentExecute.restore();
+    payments.buyGems.restore();
+    payments.createSubscription.restore();
+  });
+
+  it('purchases gems', async () => {
+    await paypalPayments.checkoutSuccess({user, gift, paymentId, customerId});
+
+    expect(paypalPaymentExecuteStub).to.be.calledOnce;
+    expect(paypalPaymentExecuteStub).to.be.calledWith(paymentId, { payer_id: customerId });
+    expect(paymentBuyGemsStub).to.be.calledOnce;
+    expect(paymentBuyGemsStub).to.be.calledWith({
+      user,
+      customerId,
+      paymentMethod: 'Paypal',
+    });
+  });
+
+  it('gifts gems', async () => {
+    let receivingUser = new User();
+    await receivingUser.save();
+    gift = {
+      type: 'gems',
+      gems: {
+        amount: 16,
+        uuid: receivingUser._id,
+      },
+    };
+
+    await paypalPayments.checkoutSuccess({user, gift, paymentId, customerId});
+
+    expect(paypalPaymentExecuteStub).to.be.calledOnce;
+    expect(paypalPaymentExecuteStub).to.be.calledWith(paymentId, { payer_id: customerId });
+    expect(paymentBuyGemsStub).to.be.calledOnce;
+    expect(paymentBuyGemsStub).to.be.calledWith({
+      user,
+      customerId,
+      paymentMethod: 'PayPal (Gift)',
+      gift,
+    });
+  });
+
+  it('gifts subscription', async () => {
+    let receivingUser = new User();
+    await receivingUser.save();
+    gift = {
+      type: 'subscription',
+      subscription: {
+        key: subKey,
+        uuid: receivingUser._id,
+      },
+    };
+
+    await paypalPayments.checkoutSuccess({user, gift, paymentId, customerId});
+
+    expect(paypalPaymentExecuteStub).to.be.calledOnce;
+    expect(paypalPaymentExecuteStub).to.be.calledWith(paymentId, { payer_id: customerId });
+    expect(paymentsCreateSubscritionStub).to.be.calledOnce;
+    expect(paymentsCreateSubscritionStub).to.be.calledWith({
+      user,
+      customerId,
+      paymentMethod: 'PayPal (Gift)',
+      gift,
+    });
+  });
+});

test/api/unit/libs/payments/paypal/checkout.test.js

@@ -0,0 +1,127 @@
+/* eslint-disable camelcase */
+import nconf from 'nconf';
+
+import paypalPayments from '../../../../../../website/server/libs/payments/paypal';
+import { model as User } from '../../../../../../website/server/models/user';
+import common from '../../../../../../website/common';
+
+const BASE_URL = nconf.get('BASE_URL');
+const i18n = common.i18n;
+
+describe('checkout', () => {
+  const subKey = 'basic_3mo';
+  let paypalPaymentCreateStub;
+  let approvalHerf;
+
+  function getPaypalCreateOptions (description, amount) {
+    return {
+      intent: 'sale',
+      payer: { payment_method: 'Paypal' },
+      redirect_urls: {
+        return_url: `${BASE_URL}/paypal/checkout/success`,
+        cancel_url: `${BASE_URL}`,
+      },
+      transactions: [{
+        item_list: {
+          items: [{
+            name: description,
+            price: amount,
+            currency: 'USD',
+            quantity: 1,
+          }],
+        },
+        amount: {
+          currency: 'USD',
+          total: amount,
+        },
+        description,
+      }],
+    };
+  }
+
+  beforeEach(() => {
+    approvalHerf = 'approval_href';
+    paypalPaymentCreateStub = sinon.stub(paypalPayments, 'paypalPaymentCreate')
+      .returnsPromise().resolves({
+        links: [{ rel: 'approval_url', href: approvalHerf }],
+      });
+  });
+
+  afterEach(() => {
+    paypalPayments.paypalPaymentCreate.restore();
+  });
+
+  it('creates a link for gem purchases', async () => {
+    let link = await paypalPayments.checkout({user: new User()});
+
+    expect(paypalPaymentCreateStub).to.be.calledOnce;
+    expect(paypalPaymentCreateStub).to.be.calledWith(getPaypalCreateOptions('Habitica Gems', 5.00));
+    expect(link).to.eql(approvalHerf);
+  });
+
+  it('should error if gem amount is too low', async () => {
+    let receivingUser = new User();
+    receivingUser.save();
+    let gift = {
+      type: 'gems',
+      gems: {
+        amount: 0,
+        uuid: receivingUser._id,
+      },
+    };
+
+    await expect(paypalPayments.checkout({gift}))
+      .to.eventually.be.rejected.and.to.eql({
+        httpCode: 400,
+        message: 'Amount must be at least 1.',
+        name: 'BadRequest',
+      });
+  });
+
+  it('should error if the user cannot get gems', async () => {
+    let user = new User();
+    sinon.stub(user, 'canGetGems').returnsPromise().resolves(false);
+
+    await expect(paypalPayments.checkout({user})).to.eventually.be.rejected.and.to.eql({
+      httpCode: 401,
+      message: i18n.t('groupPolicyCannotGetGems'),
+      name: 'NotAuthorized',
+    });
+  });
+
+  it('creates a link for gifting gems', async () => {
+    let receivingUser = new User();
+    await receivingUser.save();
+    let gift = {
+      type: 'gems',
+      uuid: receivingUser._id,
+      gems: {
+        amount: 16,
+      },
+    };
+
+    let link = await paypalPayments.checkout({gift});
+
+    expect(paypalPaymentCreateStub).to.be.calledOnce;
+    expect(paypalPaymentCreateStub).to.be.calledWith(getPaypalCreateOptions('Habitica Gems (Gift)', '4.00'));
+    expect(link).to.eql(approvalHerf);
+  });
+
+  it('creates a link for gifting a subscription', async () => {
+    let receivingUser = new User();
+    receivingUser.save();
+    let gift = {
+      type: 'subscription',
+      subscription: {
+        key: subKey,
+        uuid: receivingUser._id,
+      },
+    };
+
+    let link = await paypalPayments.checkout({gift});
+
+    expect(paypalPaymentCreateStub).to.be.calledOnce;
+    expect(paypalPaymentCreateStub).to.be.calledWith(getPaypalCreateOptions('mo. Habitica Subscription (Gift)', '15.00'));
+    expect(link).to.eql(approvalHerf);
+  });
+});

test/api/unit/libs/payments/paypal/ipn.test.js

@@ -0,0 +1,66 @@
+/* eslint-disable camelcase */
+import paypalPayments from '../../../../../../website/server/libs/payments/paypal';
+import payments from '../../../../../../website/server/libs/payments/payments';
+import {
+  generateGroup,
+} from '../../../../../helpers/api-unit.helper.js';
+import { model as User } from '../../../../../../website/server/models/user';
+
+describe('ipn', () => {
+  const subKey = 'basic_3mo';
+  let user, group, txn_type, userPaymentId, groupPaymentId;
+  let ipnVerifyAsyncStub, paymentCancelSubscriptionSpy;
+
+  beforeEach(async () => {
+    txn_type = 'recurring_payment_profile_cancel';
+    userPaymentId = 'userPaymentId-test';
+    groupPaymentId = 'groupPaymentId-test';
+
+    user = new User();
+    user.profile.name = 'sender';
+    user.purchased.plan.customerId = userPaymentId;
+    user.purchased.plan.planId = subKey;
+    user.purchased.plan.lastBillingDate = new Date();
+    await user.save();
+
+    group = generateGroup({
+      name: 'test group',
+      type: 'guild',
+      privacy: 'public',
+      leader: user._id,
+    });
+    group.purchased.plan.customerId = groupPaymentId;
+    group.purchased.plan.planId = subKey;
+    group.purchased.plan.lastBillingDate = new Date();
+    await group.save();
+
+    ipnVerifyAsyncStub = sinon.stub(paypalPayments, 'ipnVerifyAsync').returnsPromise().resolves({});
+    paymentCancelSubscriptionSpy = sinon.stub(payments, 'cancelSubscription').returnsPromise().resolves({});
+  });
+
+  afterEach(function () {
+    paypalPayments.ipnVerifyAsync.restore();
+    payments.cancelSubscription.restore();
+  });
+
+  it('should cancel a user subscription', async () => {
+    await paypalPayments.ipn({txn_type, recurring_payment_id: userPaymentId});
+
+    expect(ipnVerifyAsyncStub).to.be.calledOnce;
+    expect(ipnVerifyAsyncStub).to.be.calledWith({txn_type, recurring_payment_id: userPaymentId});
+
+    expect(paymentCancelSubscriptionSpy).to.be.calledOnce;
+    expect(paymentCancelSubscriptionSpy.args[0][0].user._id).to.eql(user._id);
+    expect(paymentCancelSubscriptionSpy.args[0][0].paymentMethod).to.eql('Paypal');
+  });
+
+  it('should cancel a group subscription', async () => {
+    await paypalPayments.ipn({txn_type, recurring_payment_id: groupPaymentId});
+
+    expect(ipnVerifyAsyncStub).to.be.calledOnce;
+    expect(ipnVerifyAsyncStub).to.be.calledWith({txn_type, recurring_payment_id: groupPaymentId});
+
+    expect(paymentCancelSubscriptionSpy).to.be.calledOnce;
+    expect(paymentCancelSubscriptionSpy).to.be.calledWith({ groupId: group._id, paymentMethod: 'Paypal' });
+  });
+});

test/api/unit/libs/payments/paypal/subscribe-cancel.test.js

@@ -0,0 +1,124 @@
+/* eslint-disable camelcase */
+import paypalPayments from '../../../../../../website/server/libs/payments/paypal';
+import payments from '../../../../../../website/server/libs/payments/payments';
+import {
+  generateGroup,
+} from '../../../../../helpers/api-unit.helper.js';
+import { model as User } from '../../../../../../website/server/models/user';
+import common from '../../../../../../website/common';
+import { createNonLeaderGroupMember } from '../paymentHelpers';
+
+const i18n = common.i18n;
+
+describe('subscribeCancel', () => {
+  const subKey = 'basic_3mo';
+  let user, group, groupId, customerId, groupCustomerId, nextBillingDate;
+  let paymentCancelSubscriptionSpy, paypalBillingAgreementCancelStub, paypalBillingAgreementGetStub;
+
+  beforeEach(async () => {
+    customerId = 'customer-id';
+    groupCustomerId = 'groupCustomerId-test';
+
+    user = new User();
+    user.profile.name = 'sender';
+    user.purchased.plan.customerId = customerId;
+    user.purchased.plan.planId = subKey;
+    user.purchased.plan.lastBillingDate = new Date();
+
+    group = generateGroup({
+      name: 'test group',
+      type: 'guild',
+      privacy: 'public',
+      leader: user._id,
+    });
+    group.purchased.plan.customerId = groupCustomerId;
+    group.purchased.plan.planId = subKey;
+    group.purchased.plan.lastBillingDate = new Date();
+    await group.save();
+
+    nextBillingDate = new Date();
+
+    paypalBillingAgreementCancelStub = sinon.stub(paypalPayments, 'paypalBillingAgreementCancel').returnsPromise().resolves({});
+    paypalBillingAgreementGetStub = sinon.stub(paypalPayments, 'paypalBillingAgreementGet')
+      .returnsPromise().resolves({
+        agreement_details: {
+          next_billing_date: nextBillingDate,
+          cycles_completed: 1,
+        },
+      });
+    paymentCancelSubscriptionSpy = sinon.stub(payments, 'cancelSubscription').returnsPromise().resolves({});
+  });
+
+  afterEach(function () {
+    paypalPayments.paypalBillingAgreementGet.restore();
+    paypalPayments.paypalBillingAgreementCancel.restore();
+    payments.cancelSubscription.restore();
+  });
+
+  it('should throw an error if we are missing a subscription', async () => {
+    user.purchased.plan.customerId = undefined;
+
+    await expect(paypalPayments.subscribeCancel({user}))
+      .to.eventually.be.rejected.and.to.eql({
+        httpCode: 401,
+        name: 'NotAuthorized',
+        message: i18n.t('missingSubscription'),
+      });
+  });
+
+  it('should throw an error if group is not found', async () => {
+    await expect(paypalPayments.subscribeCancel({user, groupId: 'fake-id'}))
+      .to.eventually.be.rejected.and.to.eql({
+        httpCode: 404,
+        name: 'NotFound',
+        message: i18n.t('groupNotFound'),
+      });
+  });
+
+  it('should throw an error if user is not group leader', async () => {
+    let nonLeader = await createNonLeaderGroupMember(group);
+
+    await expect(paypalPayments.subscribeCancel({user: nonLeader, groupId: group._id}))
+      .to.eventually.be.rejected.and.to.eql({
+        httpCode: 401,
+        name: 'NotAuthorized',
+        message: i18n.t('onlyGroupLeaderCanManageSubscription'),
+      });
+  });
+
+  it('should cancel a user subscription', async () => {
+    await paypalPayments.subscribeCancel({user});
+
+    expect(paypalBillingAgreementGetStub).to.be.calledOnce;
+    expect(paypalBillingAgreementGetStub).to.be.calledWith(customerId);
+    expect(paypalBillingAgreementCancelStub).to.be.calledOnce;
+    expect(paypalBillingAgreementCancelStub).to.be.calledWith(customerId, { note: i18n.t('cancelingSubscription') });
+
+    expect(paymentCancelSubscriptionSpy).to.be.calledOnce;
+    expect(paymentCancelSubscriptionSpy).to.be.calledWith({
+      user,
+      groupId,
+      paymentMethod: 'Paypal',
+      nextBill: nextBillingDate,
+      cancellationReason: undefined,
+    });
+  });
+
+  it('should cancel a group subscription', async () => {
+    await paypalPayments.subscribeCancel({user, groupId: group._id});
+
+    expect(paypalBillingAgreementGetStub).to.be.calledOnce;
+    expect(paypalBillingAgreementGetStub).to.be.calledWith(groupCustomerId);
+    expect(paypalBillingAgreementCancelStub).to.be.calledOnce;
+    expect(paypalBillingAgreementCancelStub).to.be.calledWith(groupCustomerId, { note: i18n.t('cancelingSubscription') });
+
+    expect(paymentCancelSubscriptionSpy).to.be.calledOnce;
+    expect(paymentCancelSubscriptionSpy).to.be.calledWith({
+      user,
+      groupId: group._id,
+      paymentMethod: 'Paypal',
+      nextBill: nextBillingDate,
+      cancellationReason: undefined,
+    });
+  });
+});

test/api/unit/libs/payments/paypal/subscribe-success.test.js

@@ -0,0 +1,77 @@
+/* eslint-disable camelcase */
+import paypalPayments from '../../../../../../website/server/libs/payments/paypal';
+import payments from '../../../../../../website/server/libs/payments/payments';
+import {
+  generateGroup,
+} from '../../../../../helpers/api-unit.helper.js';
+import { model as User } from '../../../../../../website/server/models/user';
+import common from '../../../../../../website/common';
+
+describe('subscribeSuccess', () => {
+  const subKey = 'basic_3mo';
+  let user, group, block, groupId, token, headers, customerId;
+  let paypalBillingAgreementExecuteStub, paymentsCreateSubscritionStub;
+
+  beforeEach(async () => {
+    user = new User();
+
+    group = generateGroup({
+      name: 'test group',
+      type: 'guild',
+      privacy: 'public',
+      leader: user._id,
+    });
+
+    token = 'test-token';
+    headers = {};
+    block = common.content.subscriptionBlocks[subKey];
+    customerId = 'test-customerId';
+
+    paypalBillingAgreementExecuteStub = sinon.stub(paypalPayments, 'paypalBillingAgreementExecute')
+      .returnsPromise({}).resolves({
+        id: customerId,
+      });
+    paymentsCreateSubscritionStub = sinon.stub(payments, 'createSubscription').returnsPromise().resolves({});
+  });
+
+  afterEach(() => {
+    paypalPayments.paypalBillingAgreementExecute.restore();
+    payments.createSubscription.restore();
+  });
+
+  it('creates a user subscription', async () => {
+    await paypalPayments.subscribeSuccess({user, block, groupId, token, headers});
+
+    expect(paypalBillingAgreementExecuteStub).to.be.calledOnce;
+    expect(paypalBillingAgreementExecuteStub).to.be.calledWith(token, {});
+
+    expect(paymentsCreateSubscritionStub).to.be.calledOnce;
+    expect(paymentsCreateSubscritionStub).to.be.calledWith({
+      user,
+      groupId,
+      customerId,
+      paymentMethod: 'Paypal',
+      sub: block,
+      headers,
+    });
+  });
+
+  it('create a group subscription', async () => {
+    groupId = group._id;
+
+    await paypalPayments.subscribeSuccess({user, block, groupId, token, headers});
+
+    expect(paypalBillingAgreementExecuteStub).to.be.calledOnce;
+    expect(paypalBillingAgreementExecuteStub).to.be.calledWith(token, {});
+
+    expect(paymentsCreateSubscritionStub).to.be.calledOnce;
+    expect(paymentsCreateSubscritionStub).to.be.calledWith({
+      user,
+      groupId,
+      customerId,
+      paymentMethod: 'Paypal',
+      sub: block,
+      headers,
+    });
+  });
+});

test/api/unit/libs/payments/paypal/subscribe.test.js

@@ -0,0 +1,112 @@
+/* eslint-disable camelcase */
+import moment from 'moment';
+import cc from 'coupon-code';
+
+import paypalPayments from '../../../../../../website/server/libs/payments/paypal';
+import { model as Coupon } from '../../../../../../website/server/models/coupon';
+import common from '../../../../../../website/common';
+
+const i18n = common.i18n;
+
+describe('subscribe', () => {
+  const subKey = 'basic_3mo';
+  let coupon, sub, approvalHerf;
+  let paypalBillingAgreementCreateStub;
+
+  beforeEach(() => {
+    approvalHerf = 'approvalHerf-test';
+    sub = Object.assign({}, common.content.subscriptionBlocks[subKey]);
+
+    paypalBillingAgreementCreateStub = sinon.stub(paypalPayments, 'paypalBillingAgreementCreate')
+      .returnsPromise().resolves({
+        links: [{ rel: 'approval_url', href: approvalHerf }],
+      });
+  });
+
+  afterEach(() => {
+    paypalPayments.paypalBillingAgreementCreate.restore();
+  });
+
+  it('should throw an error when coupon code is missing', async () => {
+    sub.discount = 40;
+
+    await expect(paypalPayments.subscribe({sub, coupon}))
+      .to.eventually.be.rejected.and.to.eql({
+        httpCode: 400,
+        name: 'BadRequest',
+        message: i18n.t('couponCodeRequired'),
+      });
+  });
+
+  it('should throw an error when coupon code is invalid', async () => {
+    sub.discount = 40;
+    sub.key = 'google_6mo';
+    coupon = 'example-coupon';
+
+    let couponModel = new Coupon();
+    couponModel.event = 'google_6mo';
+    await couponModel.save();
+
+    sinon.stub(cc, 'validate').returns('invalid');
+
+    await expect(paypalPayments.subscribe({sub, coupon}))
+      .to.eventually.be.rejected.and.to.eql({
+        httpCode: 401,
+        name: 'NotAuthorized',
+        message: i18n.t('invalidCoupon'),
+      });
+    cc.validate.restore();
+  });
+
+  it('subscribes with paypal with a coupon', async () => {
+    sub.discount = 40;
+    sub.key = 'google_6mo';
+    coupon = 'example-coupon';
+
+    let couponModel = new Coupon();
+    couponModel.event = 'google_6mo';
+    let updatedCouponModel = await couponModel.save();
+
+    sinon.stub(cc, 'validate').returns(updatedCouponModel._id);
+
+    let link = await paypalPayments.subscribe({sub, coupon});
+
+    expect(link).to.eql(approvalHerf);
+    expect(paypalBillingAgreementCreateStub).to.be.calledOnce;
+    let billingPlanTitle = `Habitica Subscription ($${sub.price} every ${sub.months} months, recurring)`;
+    expect(paypalBillingAgreementCreateStub).to.be.calledWith({
+      name: billingPlanTitle,
+      description: billingPlanTitle,
+      start_date: moment().add({ minutes: 5 }).format(),
+      plan: {
+        id: sub.paypalKey,
+      },
+      payer: {
+        payment_method: 'Paypal',
+      },
+    });
+
+    cc.validate.restore();
+  });
+
+  it('creates a link for a subscription', async () => {
+    delete sub.discount;
+
+    let link = await paypalPayments.subscribe({sub, coupon});
+
+    expect(link).to.eql(approvalHerf);
+    expect(paypalBillingAgreementCreateStub).to.be.calledOnce;
+    let billingPlanTitle = `Habitica Subscription ($${sub.price} every ${sub.months} months, recurring)`;
+    expect(paypalBillingAgreementCreateStub).to.be.calledWith({
+      name: billingPlanTitle,
+      description: billingPlanTitle,
+      start_date: moment().add({ minutes: 5 }).format(),
+      plan: {
+        id: sub.paypalKey,
+      },
+      payer: {
+        payment_method: 'Paypal',
+      },
+    });
+  });
+});

test/api/unit/libs/payments/stripe/cancel-subscription.test.js

@@ -0,0 +1,143 @@
+import stripeModule from 'stripe';
+
+import {
+  generateGroup,
+} from '../../../../../helpers/api-unit.helper.js';
+import { model as User } from '../../../../../../website/server/models/user';
+import stripePayments from '../../../../../../website/server/libs/payments/stripe';
+import payments from '../../../../../../website/server/libs/payments/payments';
+import common from '../../../../../../website/common';
+
+const i18n = common.i18n;
+
+describe('cancel subscription', () => {
+  const subKey = 'basic_3mo';
+  const stripe = stripeModule('test');
+  let user, groupId, group;
+
+  beforeEach(async () => {
+    user = new User();
+    user.profile.name = 'sender';
+    user.purchased.plan.customerId = 'customer-id';
+    user.purchased.plan.planId = subKey;
+    user.purchased.plan.lastBillingDate = new Date();
+
+    group = generateGroup({
+      name: 'test group',
+      type: 'guild',
+      privacy: 'public',
+      leader: user._id,
+    });
+    group.purchased.plan.customerId = 'customer-id';
+    group.purchased.plan.planId = subKey;
+    await group.save();
+
+    groupId = group._id;
+  });
+
+  it('throws an error if there is no customer id', async () => {
+    user.purchased.plan.customerId = undefined;
+
+    await expect(stripePayments.cancelSubscription({
+      user,
+      groupId: undefined,
+    }))
+      .to.eventually.be.rejected.and.to.eql({
+        httpCode: 401,
+        name: 'NotAuthorized',
+        message: i18n.t('missingSubscription'),
+      });
+  });
+
+  it('throws an error if the group is not found', async () => {
+    await expect(stripePayments.cancelSubscription({
+      user,
+      groupId: 'fake-group',
+    }))
+      .to.eventually.be.rejected.and.to.eql({
+        httpCode: 404,
+        name: 'NotFound',
+        message: i18n.t('groupNotFound'),
+      });
+  });
+
+  it('throws an error if user is not the group leader', async () => {
+    let nonLeader = new User();
+    nonLeader.guilds.push(groupId);
+    await nonLeader.save();
+
+    await expect(stripePayments.cancelSubscription({
+      user: nonLeader,
+      groupId,
+    }))
+      .to.eventually.be.rejected.and.to.eql({
+        httpCode: 401,
+        name: 'NotAuthorized',
+        message: i18n.t('onlyGroupLeaderCanManageSubscription'),
+      });
+  });
+
+  describe('success', () => {
+    let stripeDeleteCustomerStub, paymentsCancelSubStub, stripeRetrieveStub, subscriptionId, currentPeriodEndTimeStamp;
+
+    beforeEach(() => {
+      subscriptionId = 'subId';
+      stripeDeleteCustomerStub = sinon.stub(stripe.customers, 'del').returnsPromise().resolves({});
+      paymentsCancelSubStub = sinon.stub(payments, 'cancelSubscription').returnsPromise().resolves({});
+
+      currentPeriodEndTimeStamp = (new Date()).getTime();
+      stripeRetrieveStub = sinon.stub(stripe.customers, 'retrieve')
+        .returnsPromise().resolves({
+          subscriptions: {
+            data: [{id: subscriptionId, current_period_end: currentPeriodEndTimeStamp}], // eslint-disable-line camelcase
+          },
+        });
+    });
+
+    afterEach(() => {
+      stripe.customers.del.restore();
+      stripe.customers.retrieve.restore();
+      payments.cancelSubscription.restore();
+    });
+
+    it('cancels a user subscription', async () => {
+      await stripePayments.cancelSubscription({
+        user,
+        groupId: undefined,
+      }, stripe);
+
+      expect(stripeDeleteCustomerStub).to.be.calledOnce;
+      expect(stripeDeleteCustomerStub).to.be.calledWith(user.purchased.plan.customerId);
+      expect(stripeRetrieveStub).to.be.calledOnce;
+      expect(stripeRetrieveStub).to.be.calledWith(user.purchased.plan.customerId);
+      expect(paymentsCancelSubStub).to.be.calledOnce;
+      expect(paymentsCancelSubStub).to.be.calledWith({
+        user,
+        groupId: undefined,
+        nextBill: currentPeriodEndTimeStamp * 1000, // timestamp in seconds
+        paymentMethod: 'Stripe',
+        cancellationReason: undefined,
+      });
+    });
+
+    it('cancels a group subscription', async () => {
+      await stripePayments.cancelSubscription({
+        user,
+        groupId,
+      }, stripe);
+
+      expect(stripeDeleteCustomerStub).to.be.calledOnce;
+      expect(stripeDeleteCustomerStub).to.be.calledWith(group.purchased.plan.customerId);
+      expect(stripeRetrieveStub).to.be.calledOnce;
+      expect(stripeRetrieveStub).to.be.calledWith(user.purchased.plan.customerId);
+      expect(paymentsCancelSubStub).to.be.calledOnce;
+      expect(paymentsCancelSubStub).to.be.calledWith({
+        user,
+        groupId,
+        nextBill: currentPeriodEndTimeStamp * 1000, // timestamp in seconds
+        paymentMethod: 'Stripe',
+        cancellationReason: undefined,
+      });
+    });
+  });
+});

test/api/unit/libs/payments/stripe/checkout-subscription.test.js

@@ -0,0 +1,318 @@
+import stripeModule from 'stripe';
+import cc from 'coupon-code';
+
+import {
+  generateGroup,
+} from '../../../../../helpers/api-unit.helper.js';
+import { model as User } from '../../../../../../website/server/models/user';
+import { model as Coupon } from '../../../../../../website/server/models/coupon';
+import stripePayments from '../../../../../../website/server/libs/payments/stripe';
+import payments from '../../../../../../website/server/libs/payments/payments';
+import common from '../../../../../../website/common';
+
+const i18n = common.i18n;
+
+describe('checkout with subscription', () => {
+  const subKey = 'basic_3mo';
+  const stripe = stripeModule('test');
+  let user, group, data, gift, sub, groupId, email, headers, coupon, customerIdResponse, subscriptionId, token;
+  let spy;
+  let stripeCreateCustomerSpy;
+  let stripePaymentsCreateSubSpy;
+
+  beforeEach(async () => {
+    user = new User();
+    user.profile.name = 'sender';
+    user.purchased.plan.customerId = 'customer-id';
+    user.purchased.plan.planId = subKey;
+    user.purchased.plan.lastBillingDate = new Date();
+
+    group = generateGroup({
+      name: 'test group',
+      type: 'guild',
+      privacy: 'public',
+      leader: user._id,
+    });
+    group.purchased.plan.customerId = 'customer-id';
+    group.purchased.plan.planId = subKey;
+    await group.save();
+
+    sub = {
+      key: 'basic_3mo',
+    };
+
+    data = {
+      user,
+      sub,
+      customerId: 'customer-id',
+      paymentMethod: 'Payment Method',
+    };
+
+    email = 'example@example.com';
+    customerIdResponse = 'test-id';
+    subscriptionId = 'test-sub-id';
+    token = 'test-token';
+
+    spy = sinon.stub(stripe.subscriptions, 'update');
+    spy.returnsPromise().resolves;
+
+    stripeCreateCustomerSpy = sinon.stub(stripe.customers, 'create');
+    let stripCustomerResponse = {
+      id: customerIdResponse,
+      subscriptions: {
+        data: [{id: subscriptionId}],
+      },
+    };
+    stripeCreateCustomerSpy.returnsPromise().resolves(stripCustomerResponse);
+
+    stripePaymentsCreateSubSpy = sinon.stub(payments, 'createSubscription');
+    stripePaymentsCreateSubSpy.returnsPromise().resolves({});
+
+    data.groupId = group._id;
+    data.sub.quantity = 3;
+  });
+
+  afterEach(function () {
+    stripe.subscriptions.update.restore();
+    stripe.customers.create.restore();
+    payments.createSubscription.restore();
+  });
+
+  it('should throw an error if we are missing a token', async () => {
+    await expect(stripePayments.checkout({
+      user,
+      gift,
+      sub,
+      groupId,
+      email,
+      headers,
+      coupon,
+    }))
+      .to.eventually.be.rejected.and.to.eql({
+        httpCode: 400,
+        name: 'BadRequest',
+        message: 'Missing req.body.id',
+      });
+  });
+
+  it('should throw an error when coupon code is missing', async () => {
+    sub.discount = 40;
+
+    await expect(stripePayments.checkout({
+      token,
+      user,
+      gift,
+      sub,
+      groupId,
+      email,
+      headers,
+      coupon,
+    }))
+      .to.eventually.be.rejected.and.to.eql({
+        httpCode: 400,
+        name: 'BadRequest',
+        message: i18n.t('couponCodeRequired'),
+      });
+  });
+
+  it('should throw an error when coupon code is invalid', async () => {
+    sub.discount = 40;
+    sub.key = 'google_6mo';
+    coupon = 'example-coupon';
+
+    let couponModel = new Coupon();
+    couponModel.event = 'google_6mo';
+    await couponModel.save();
+
+    sinon.stub(cc, 'validate').returns('invalid');
+
+    await expect(stripePayments.checkout({
+      token,
+      user,
+      gift,
+      sub,
+      groupId,
+      email,
+      headers,
+      coupon,
+    }))
+      .to.eventually.be.rejected.and.to.eql({
+        httpCode: 400,
+        name: 'BadRequest',
+        message: i18n.t('invalidCoupon'),
+      });
+    cc.validate.restore();
+  });
+
+  it('subscribes with stripe with a coupon', async () => {
+    sub.discount = 40;
+    sub.key = 'google_6mo';
+    coupon = 'example-coupon';
+
+    let couponModel = new Coupon();
+    couponModel.event = 'google_6mo';
+    let updatedCouponModel = await couponModel.save();
+
+    sinon.stub(cc, 'validate').returns(updatedCouponModel._id);
+
+    await stripePayments.checkout({
+      token,
+      user,
+      gift,
+      sub,
+      groupId,
+      email,
+      headers,
+      coupon,
+    }, stripe);
+
+    expect(stripeCreateCustomerSpy).to.be.calledOnce;
+    expect(stripeCreateCustomerSpy).to.be.calledWith({
+      email,
+      metadata: { uuid: user._id },
+      card: token,
+      plan: sub.key,
+    });
+
+    expect(stripePaymentsCreateSubSpy).to.be.calledOnce;
+    expect(stripePaymentsCreateSubSpy).to.be.calledWith({
+      user,
+      customerId: customerIdResponse,
+      paymentMethod: 'Stripe',
+      sub,
+      headers,
+      groupId: undefined,
+      subscriptionId: undefined,
+    });
+
+    cc.validate.restore();
+  });
+
+  it('subscribes a user', async () => {
+    sub = data.sub;
+
+    await stripePayments.checkout({
+      token,
+      user,
+      gift,
+      sub,
+      groupId,
+      email,
+      headers,
+      coupon,
+    }, stripe);
+
+    expect(stripeCreateCustomerSpy).to.be.calledOnce;
+    expect(stripeCreateCustomerSpy).to.be.calledWith({
+      email,
+      metadata: { uuid: user._id },
+      card: token,
+      plan: sub.key,
+    });
+
+    expect(stripePaymentsCreateSubSpy).to.be.calledOnce;
+    expect(stripePaymentsCreateSubSpy).to.be.calledWith({
+      user,
+      customerId: customerIdResponse,
+      paymentMethod: 'Stripe',
+      sub,
+      headers,
+      groupId: undefined,
+      subscriptionId: undefined,
+    });
+  });
+
+  it('subscribes a group', async () => {
+    token = 'test-token';
+    sub = data.sub;
+    groupId = group._id;
+    email = 'test@test.com';
+
+    // Add user to group
+    user.guilds.push(groupId);
+    await user.save();
+
+    headers = {};
+
+    await stripePayments.checkout({
+      token,
+      user,
+      gift,
+      sub,
+      groupId,
+      email,
+      headers,
+      coupon,
+    }, stripe);
+
+    expect(stripeCreateCustomerSpy).to.be.calledOnce;
+    expect(stripeCreateCustomerSpy).to.be.calledWith({
+      email,
+      metadata: { uuid: user._id },
+      card: token,
+      plan: sub.key,
+      quantity: 3,
+    });
+
+    expect(stripePaymentsCreateSubSpy).to.be.calledOnce;
+    expect(stripePaymentsCreateSubSpy).to.be.calledWith({
+      user,
+      customerId: customerIdResponse,
+      paymentMethod: 'Stripe',
+      sub,
+      headers,
+      groupId,
+      subscriptionId,
+    });
+  });
+
+  it('subscribes a group with the correct number of group members', async () => {
+    token = 'test-token';
+    sub = data.sub;
+    groupId = group._id;
+    email = 'test@test.com';
+    headers = {};
+
+    // Add user to group
+    user.guilds.push(groupId);
+    await user.save();
+
+    user = new User();
+    user.guilds.push(groupId);
+    await user.save();
+
+    group.memberCount = 2;
+    await group.save();
+
+    await stripePayments.checkout({
+      token,
+      user,
+      gift,
+      sub,
+      groupId,
+      email,
+      headers,
+      coupon,
+    }, stripe);
+
+    expect(stripeCreateCustomerSpy).to.be.calledOnce;
+    expect(stripeCreateCustomerSpy).to.be.calledWith({
+      email,
+      metadata: { uuid: user._id },
+      card: token,
+      plan: sub.key,
+      quantity: 4,
+    });
+
+    expect(stripePaymentsCreateSubSpy).to.be.calledOnce;
+    expect(stripePaymentsCreateSubSpy).to.be.calledWith({
+      user,
+      customerId: customerIdResponse,
+      paymentMethod: 'Stripe',
+      sub,
+      headers,
+      groupId,
+      subscriptionId,
+    });
+  });
+});

test/api/unit/libs/payments/stripe/checkout.test.js

@@ -0,0 +1,208 @@
+import stripeModule from 'stripe';
+
+import { model as User } from '../../../../../../website/server/models/user';
+import stripePayments from '../../../../../../website/server/libs/payments/stripe';
+import payments from '../../../../../../website/server/libs/payments/payments';
+import common from '../../../../../../website/common';
+
+const i18n = common.i18n;
+
+describe('checkout', () => {
+  const subKey = 'basic_3mo';
+  const stripe = stripeModule('test');
+  let stripeChargeStub, paymentBuyGemsStub, paymentCreateSubscritionStub;
+  let user, gift, groupId, email, headers, coupon, customerIdResponse, token;
+
+  beforeEach(() => {
+    user = new User();
+    user.profile.name = 'sender';
+    user.purchased.plan.customerId = 'customer-id';
+    user.purchased.plan.planId = subKey;
+    user.purchased.plan.lastBillingDate = new Date();
+
+    token = 'test-token';
+
+    customerIdResponse = 'example-customerIdResponse';
+    let stripCustomerResponse = {
+      id: customerIdResponse,
+    };
+    stripeChargeStub = sinon.stub(stripe.charges, 'create').returnsPromise().resolves(stripCustomerResponse);
+    paymentBuyGemsStub = sinon.stub(payments, 'buyGems').returnsPromise().resolves({});
+    paymentCreateSubscritionStub = sinon.stub(payments, 'createSubscription').returnsPromise().resolves({});
+  });
+
+  afterEach(() => {
+    stripe.charges.create.restore();
+    payments.buyGems.restore();
+    payments.createSubscription.restore();
+  });
+
+  it('should error if there is no token', async () => {
+    await expect(stripePayments.checkout({
+      user,
+      gift,
+      groupId,
+      email,
+      headers,
+      coupon,
+    }, stripe))
+      .to.eventually.be.rejected.and.to.eql({
+        httpCode: 400,
+        message: 'Missing req.body.id',
+        name: 'BadRequest',
+      });
+  });
+
+  it('should error if gem amount is too low', async () => {
+    let receivingUser = new User();
+    receivingUser.save();
+    gift = {
+      type: 'gems',
+      gems: {
+        amount: 0,
+        uuid: receivingUser._id,
+      },
+    };
+
+    await expect(stripePayments.checkout({
+      token,
+      user,
+      gift,
+      groupId,
+      email,
+      headers,
+      coupon,
+    }, stripe))
+      .to.eventually.be.rejected.and.to.eql({
+        httpCode: 400,
+        message: 'Amount must be at least 1.',
+        name: 'BadRequest',
+      });
+  });
+
+  it('should error if user cannot get gems', async () => {
+    gift = undefined;
+    sinon.stub(user, 'canGetGems').returnsPromise().resolves(false);
+
+    await expect(stripePayments.checkout({
+      token,
+      user,
+      gift,
+      groupId,
+      email,
+      headers,
+      coupon,
+    }, stripe)).to.eventually.be.rejected.and.to.eql({
+      httpCode: 401,
+      message: i18n.t('groupPolicyCannotGetGems'),
+      name: 'NotAuthorized',
+    });
+  });
+
+  it('should purchase gems', async () => {
+    gift = undefined;
+    sinon.stub(user, 'canGetGems').returnsPromise().resolves(true);
+
+    await stripePayments.checkout({
+      token,
+      user,
+      gift,
+      groupId,
+      email,
+      headers,
+      coupon,
+    }, stripe);
+
+    expect(stripeChargeStub).to.be.calledOnce;
+    expect(stripeChargeStub).to.be.calledWith({
+      amount: 500,
+      currency: 'usd',
+      card: token,
+    });
+
+    expect(paymentBuyGemsStub).to.be.calledOnce;
+    expect(paymentBuyGemsStub).to.be.calledWith({
+      user,
+      customerId: customerIdResponse,
+      paymentMethod: 'Stripe',
+      gift,
+    });
+    expect(user.canGetGems).to.be.calledOnce;
+    user.canGetGems.restore();
+  });
+
+  it('should gift gems', async () => {
+    let receivingUser = new User();
+    await receivingUser.save();
+    gift = {
+      type: 'gems',
+      uuid: receivingUser._id,
+      gems: {
+        amount: 16,
+      },
+    };
+
+    await stripePayments.checkout({
+      token,
+      user,
+      gift,
+      groupId,
+      email,
+      headers,
+      coupon,
+    }, stripe);
+
+    expect(stripeChargeStub).to.be.calledOnce;
+    expect(stripeChargeStub).to.be.calledWith({
+      amount: '400',
+      currency: 'usd',
+      card: token,
+    });
+
+    expect(paymentBuyGemsStub).to.be.calledOnce;
+    expect(paymentBuyGemsStub).to.be.calledWith({
+      user,
+      customerId: customerIdResponse,
+      paymentMethod: 'Gift',
+      gift,
+    });
+  });
+
+  it('should gift a subscription', async () => {
+    let receivingUser = new User();
+    receivingUser.save();
+    gift = {
+      type: 'subscription',
+      subscription: {
+        key: subKey,
+        uuid: receivingUser._id,
+      },
+    };
+
+    await stripePayments.checkout({
+      token,
+      user,
+      gift,
+      groupId,
+      email,
+      headers,
+      coupon,
+    }, stripe);
+
+    gift.member = receivingUser;
+    expect(stripeChargeStub).to.be.calledOnce;
+    expect(stripeChargeStub).to.be.calledWith({
+      amount: '1500',
+      currency: 'usd',
+      card: token,
+    });
+
+    expect(paymentCreateSubscritionStub).to.be.calledOnce;
+    expect(paymentCreateSubscritionStub).to.be.calledWith({
+      user,
+      customerId: customerIdResponse,
+      paymentMethod: 'Gift',
+      gift,
+    });
+  });
+});

test/api/unit/libs/payments/stripe/edit-subscription.test.js

@@ -0,0 +1,147 @@
+import stripeModule from 'stripe';
+
+import {
+  generateGroup,
+} from '../../../../../helpers/api-unit.helper.js';
+import { model as User } from '../../../../../../website/server/models/user';
+import stripePayments from '../../../../../../website/server/libs/payments/stripe';
+import common from '../../../../../../website/common';
+
+const i18n = common.i18n;
+
+describe('edit subscription', () => {
+  const subKey = 'basic_3mo';
+  const stripe = stripeModule('test');
+  let user, groupId, group, token;
+
+  beforeEach(async () => {
+    user = new User();
+    user.profile.name = 'sender';
+    user.purchased.plan.customerId = 'customer-id';
+    user.purchased.plan.planId = subKey;
+    user.purchased.plan.lastBillingDate = new Date();
+
+    group = generateGroup({
+      name: 'test group',
+      type: 'guild',
+      privacy: 'public',
+      leader: user._id,
+    });
+    group.purchased.plan.customerId = 'customer-id';
+    group.purchased.plan.planId = subKey;
+    await group.save();
+
+    groupId = group._id;
+
+    token = 'test-token';
+  });
+
+  it('throws an error if there is no customer id', async () => {
+    user.purchased.plan.customerId = undefined;
+
+    await expect(stripePayments.editSubscription({
+      user,
+      groupId: undefined,
+    }))
+      .to.eventually.be.rejected.and.to.eql({
+        httpCode: 401,
+        name: 'NotAuthorized',
+        message: i18n.t('missingSubscription'),
+      });
+  });
+
+  it('throws an error if a token is not provided', async () => {
+    await expect(stripePayments.editSubscription({
+      user,
+      groupId: undefined,
+    }))
+      .to.eventually.be.rejected.and.to.eql({
+        httpCode: 400,
+        name: 'BadRequest',
+        message: 'Missing req.body.id',
+      });
+  });
+
+  it('throws an error if the group is not found', async () => {
+    await expect(stripePayments.editSubscription({
+      token,
+      user,
+      groupId: 'fake-group',
+    }))
+      .to.eventually.be.rejected.and.to.eql({
+        httpCode: 404,
+        name: 'NotFound',
+        message: i18n.t('groupNotFound'),
+      });
+  });
+
+  it('throws an error if user is not the group leader', async () => {
+    let nonLeader = new User();
+    nonLeader.guilds.push(groupId);
+    await nonLeader.save();
+
+    await expect(stripePayments.editSubscription({
+      token,
+      user: nonLeader,
+      groupId,
+    }))
+      .to.eventually.be.rejected.and.to.eql({
+        httpCode: 401,
+        name: 'NotAuthorized',
+        message: i18n.t('onlyGroupLeaderCanManageSubscription'),
+      });
+  });
+
+  describe('success', () => {
+    let stripeListSubscriptionStub, stripeUpdateSubscriptionStub, subscriptionId;
+
+    beforeEach(() => {
+      subscriptionId = 'subId';
+      stripeListSubscriptionStub = sinon.stub(stripe.customers, 'listSubscriptions')
+        .returnsPromise().resolves({
+          data: [{id: subscriptionId}],
+        });
+
+      stripeUpdateSubscriptionStub = sinon.stub(stripe.customers, 'updateSubscription').returnsPromise().resolves({});
+    });
+
+    afterEach(() => {
+      stripe.customers.listSubscriptions.restore();
+      stripe.customers.updateSubscription.restore();
+    });
+
+    it('edits a user subscription', async () => {
+      await stripePayments.editSubscription({
+        token,
+        user,
+        groupId: undefined,
+      }, stripe);
+
+      expect(stripeListSubscriptionStub).to.be.calledOnce;
+      expect(stripeListSubscriptionStub).to.be.calledWith(user.purchased.plan.customerId);
+      expect(stripeUpdateSubscriptionStub).to.be.calledOnce;
+      expect(stripeUpdateSubscriptionStub).to.be.calledWith(
+        user.purchased.plan.customerId,
+        subscriptionId,
+        { card: token }
+      );
+    });
+
+    it('edits a group subscription', async () => {
+      await stripePayments.editSubscription({
+        token,
+        user,
+        groupId,
+      }, stripe);
+
+      expect(stripeListSubscriptionStub).to.be.calledOnce;
+      expect(stripeListSubscriptionStub).to.be.calledWith(group.purchased.plan.customerId);
+      expect(stripeUpdateSubscriptionStub).to.be.calledOnce;
+      expect(stripeUpdateSubscriptionStub).to.be.calledWith(
+        group.purchased.plan.customerId,
+        subscriptionId,
+        { card: token }
+      );
+    });
+  });
+});

test/api/unit/libs/payments/stripe/handle-webhook.test.js

@@ -0,0 +1,260 @@
+import stripeModule from 'stripe';
+
+import {
+  generateGroup,
+} from '../../../../../helpers/api-unit.helper.js';
+import { model as User } from '../../../../../../website/server/models/user';
+import stripePayments from '../../../../../../website/server/libs/payments/stripe';
+import payments from '../../../../../../website/server/libs/payments/payments';
+import common from '../../../../../../website/common';
+import logger from '../../../../../../website/server/libs/logger';
+import { v4 as uuid } from 'uuid';
+import moment from 'moment';
+
+const i18n = common.i18n;
+
+describe('Stripe - Webhooks', () => {
+  const stripe = stripeModule('test');
+
+  describe('all events', () => {
+    const eventType = 'account.updated';
+    const event = {id: 123};
+    const eventRetrieved = {type: eventType};
+
+    beforeEach(() => {
+      sinon.stub(stripe.events, 'retrieve').returnsPromise().resolves(eventRetrieved);
+      sinon.stub(logger, 'error');
+    });
+
+    afterEach(() => {
+      stripe.events.retrieve.restore();
+      logger.error.restore();
+    });
+
+    it('logs an error if an unsupported webhook event is passed', async () => {
+      const error = new Error(`Missing handler for Stripe webhook ${eventType}`);
+      await stripePayments.handleWebhooks({requestBody: event}, stripe);
+      expect(logger.error).to.have.been.calledOnce;
+
+      const calledWith = logger.error.getCall(0).args;
+      expect(calledWith[0].message).to.equal(error.message);
+      expect(calledWith[1].event).to.equal(eventRetrieved);
+    });
+
+    it('retrieves and validates the event from Stripe', async () => {
+      await stripePayments.handleWebhooks({requestBody: event}, stripe);
+      expect(stripe.events.retrieve).to.have.been.calledOnce;
+      expect(stripe.events.retrieve).to.have.been.calledWith(event.id);
+    });
+  });
+
+  describe('customer.subscription.deleted', () => {
+    const eventType = 'customer.subscription.deleted';
+
+    beforeEach(() => {
+      sinon.stub(stripe.customers, 'del').returnsPromise().resolves({});
+      sinon.stub(payments, 'cancelSubscription').returnsPromise().resolves({});
+    });
+
+    afterEach(() => {
+      stripe.customers.del.restore();
+      payments.cancelSubscription.restore();
+    });
+
+    it('does not do anything if event.request is null (subscription cancelled manually)', async () => {
+      sinon.stub(stripe.events, 'retrieve').returnsPromise().resolves({
+        id: 123,
+        type: eventType,
+        request: 123,
+      });
+
+      await stripePayments.handleWebhooks({requestBody: {}}, stripe);
+
+      expect(stripe.events.retrieve).to.have.been.calledOnce;
+      expect(stripe.customers.del).to.not.have.been.called;
+      expect(payments.cancelSubscription).to.not.have.been.called;
+      stripe.events.retrieve.restore();
+    });
+
+    describe('user subscription', () => {
+      it('throws an error if the user is not found', async () => {
+        const customerId = 456;
+        sinon.stub(stripe.events, 'retrieve').returnsPromise().resolves({
+          id: 123,
+          type: eventType,
+          data: {
+            object: {
+              plan: {
+                id: 'basic_earned',
+              },
+              customer: customerId,
+            },
+          },
+          request: null,
+        });
+
+        await expect(stripePayments.handleWebhooks({requestBody: {}}, stripe)).to.eventually.be.rejectedWith({
+          message: i18n.t('userNotFound'),
+          httpCode: 404,
+          name: 'NotFound',
+        });
+
+        expect(stripe.customers.del).to.not.have.been.called;
+        expect(payments.cancelSubscription).to.not.have.been.called;
+
+        stripe.events.retrieve.restore();
+      });
+
+      it('deletes the customer on Stripe and calls payments.cancelSubscription', async () => {
+        const customerId = '456';
+
+        let subscriber = new User();
+        subscriber.purchased.plan.customerId = customerId;
+        subscriber.purchased.plan.paymentMethod = 'Stripe';
+        await subscriber.save();
+
+        sinon.stub(stripe.events, 'retrieve').returnsPromise().resolves({
+          id: 123,
+          type: eventType,
+          data: {
+            object: {
+              plan: {
+                id: 'basic_earned',
+              },
+              customer: customerId,
+            },
+          },
+          request: null,
+        });
+
+        await stripePayments.handleWebhooks({requestBody: {}}, stripe);
+
+        expect(stripe.customers.del).to.have.been.calledOnce;
+        expect(stripe.customers.del).to.have.been.calledWith(customerId);
+        expect(payments.cancelSubscription).to.have.been.calledOnce;
+
+        let cancelSubscriptionOpts = payments.cancelSubscription.lastCall.args[0];
+        expect(cancelSubscriptionOpts.user._id).to.equal(subscriber._id);
+        expect(cancelSubscriptionOpts.paymentMethod).to.equal('Stripe');
+        expect(Math.round(moment(cancelSubscriptionOpts.nextBill).diff(new Date(), 'days', true))).to.equal(3);
+        expect(cancelSubscriptionOpts.groupId).to.be.undefined;
+
+        stripe.events.retrieve.restore();
+      });
+    });
+
+    describe('group plan subscription', () => {
+      it('throws an error if the group is not found', async () => {
+        const customerId = 456;
+        sinon.stub(stripe.events, 'retrieve').returnsPromise().resolves({
+          id: 123,
+          type: eventType,
+          data: {
+            object: {
+              plan: {
+                id: 'group_monthly',
+              },
+              customer: customerId,
+            },
+          },
+          request: null,
+        });
+
+        await expect(stripePayments.handleWebhooks({requestBody: {}}, stripe)).to.eventually.be.rejectedWith({
+          message: i18n.t('groupNotFound'),
+          httpCode: 404,
+          name: 'NotFound',
+        });
+
+        expect(stripe.customers.del).to.not.have.been.called;
+        expect(payments.cancelSubscription).to.not.have.been.called;
+
+        stripe.events.retrieve.restore();
+      });
+
+      it('throws an error if the group leader is not found', async () => {
+        const customerId = 456;
+
+        let subscriber = generateGroup({
+          name: 'test group',
+          type: 'guild',
+          privacy: 'public',
+          leader: uuid(),
+        });
+        subscriber.purchased.plan.customerId = customerId;
+        subscriber.purchased.plan.paymentMethod = 'Stripe';
+        await subscriber.save();
+
+        sinon.stub(stripe.events, 'retrieve').returnsPromise().resolves({
+          id: 123,
+          type: eventType,
+          data: {
+            object: {
+              plan: {
+                id: 'group_monthly',
+              },
+              customer: customerId,
+            },
+          },
+          request: null,
+        });
+
+        await expect(stripePayments.handleWebhooks({requestBody: {}}, stripe)).to.eventually.be.rejectedWith({
+          message: i18n.t('userNotFound'),
+          httpCode: 404,
+          name: 'NotFound',
+        });
+
+        expect(stripe.customers.del).to.not.have.been.called;
+        expect(payments.cancelSubscription).to.not.have.been.called;
+
+        stripe.events.retrieve.restore();
+      });
+
+      it('deletes the customer on Stripe and calls payments.cancelSubscription', async () => {
+        const customerId = '456';
+
+        let leader = new User();
+        await leader.save();
+
+        let subscriber = generateGroup({
+          name: 'test group',
+          type: 'guild',
+          privacy: 'public',
+          leader: leader._id,
+        });
+        subscriber.purchased.plan.customerId = customerId;
+        subscriber.purchased.plan.paymentMethod = 'Stripe';
+        await subscriber.save();
+
+        sinon.stub(stripe.events, 'retrieve').returnsPromise().resolves({
+          id: 123,
+          type: eventType,
+          data: {
+            object: {
+              plan: {
+                id: 'group_monthly',
+              },
+              customer: customerId,
+            },
+          },
+          request: null,
+        });
+
+        await stripePayments.handleWebhooks({requestBody: {}}, stripe);
+
+        expect(stripe.customers.del).to.have.been.calledOnce;
+        expect(stripe.customers.del).to.have.been.calledWith(customerId);
+        expect(payments.cancelSubscription).to.have.been.calledOnce;
+
+        let cancelSubscriptionOpts = payments.cancelSubscription.lastCall.args[0];
+        expect(cancelSubscriptionOpts.user._id).to.equal(leader._id);
+        expect(cancelSubscriptionOpts.paymentMethod).to.equal('Stripe');
+        expect(Math.round(moment(cancelSubscriptionOpts.nextBill).diff(new Date(), 'days', true))).to.equal(3);
+        expect(cancelSubscriptionOpts.groupId).to.equal(subscriber._id);
+
+        stripe.events.retrieve.restore();
+      });
+    });
+  });
+});

test/api/unit/libs/payments/stripe/upgrade-group-plan.test.js

@@ -0,0 +1,66 @@
+import stripeModule from 'stripe';
+
+import {
+  generateGroup,
+} from '../../../../../helpers/api-unit.helper.js';
+import { model as User } from '../../../../../../website/server/models/user';
+import { model as Group } from '../../../../../../website/server/models/group';
+import stripePayments from '../../../../../../website/server/libs/payments/stripe';
+import payments from '../../../../../../website/server/libs/payments/payments';
+
+describe('Stripe - Upgrade Group Plan', () => {
+  const stripe = stripeModule('test');
+  let spy, data, user, group;
+
+  beforeEach(async function () {
+    user = new User();
+    user.profile.name = 'sender';
+
+    data = {
+      user,
+      sub: {
+        key: 'basic_3mo', // @TODO: Validate that this is group
+      },
+      customerId: 'customer-id',
+      paymentMethod: 'Payment Method',
+      headers: {
+        'x-client': 'habitica-web',
+        'user-agent': '',
+      },
+    };
+
+    group = generateGroup({
+      name: 'test group',
+      type: 'guild',
+      privacy: 'public',
+      leader: user._id,
+    });
+    await group.save();
+
+    spy = sinon.stub(stripe.subscriptions, 'update');
+    spy.returnsPromise().resolves([]);
+    data.groupId = group._id;
+    data.sub.quantity = 3;
+    stripePayments.setStripeApi(stripe);
+  });
+
+  afterEach(function () {
+    stripe.subscriptions.update.restore();
+  });
+
+  it('updates a group plan quantity', async () => {
+    data.paymentMethod = 'Stripe';
+    await payments.createSubscription(data);
+
+    let updatedGroup = await Group.findById(group._id).exec();
+    expect(updatedGroup.purchased.plan.quantity).to.eql(3);
+
+    updatedGroup.memberCount += 1;
+    await updatedGroup.save();
+
+    await stripePayments.chargeForAdditionalGroupMember(updatedGroup);
+
+    expect(spy.calledOnce).to.be.true;
+    expect(updatedGroup.purchased.plan.quantity).to.eql(4);
+  });
+});