prevents damage to quest participants with false or null values - partial fix for #7653 (#7665)

test/api/v3/unit/models/group.test.js

@@ -211,6 +211,38 @@ describe('Group Model', () => {
           expect(updatedUndecidedMember.stats.hp).to.eql(50);
         });
 
+        it('applies damage only to participating members of party even under buggy conditions', async () => {
+          // stops unfair damage from mbugs like https://github.com/HabitRPG/habitrpg/issues/7653
+          party.quest.members = {
+            [questLeader._id]: true,
+            [participatingMember._id]: true,
+            [nonParticipatingMember._id]: false,
+            [undecidedMember._id]: null,
+          };
+          await party.save();
+
+          await Group.processQuestProgress(participatingMember, progress);
+
+          party = await Group.findOne({_id: party._id});
+
+          let [
+            updatedLeader,
+            updatedParticipatingMember,
+            updatedNonParticipatingMember,
+            updatedUndecidedMember,
+          ] = await Promise.all([
+            User.findById(questLeader._id),
+            User.findById(participatingMember._id),
+            User.findById(nonParticipatingMember._id),
+            User.findById(undecidedMember._id),
+          ]);
+
+          expect(updatedLeader.stats.hp).to.eql(42.5);
+          expect(updatedParticipatingMember.stats.hp).to.eql(42.5);
+          expect(updatedNonParticipatingMember.stats.hp).to.eql(50);
+          expect(updatedUndecidedMember.stats.hp).to.eql(50);
+        });
+
         it('sends message about victory', async () => {
           progress.up = 999;
 

website/server/models/group.js

@@ -522,7 +522,7 @@ schema.methods._processBossQuest = async function processBossQuest (options) {
 
   // Everyone takes damage
   await User.update({
-    _id: {$in: _.keys(group.quest.members)},
+    _id: {$in: _.keys(_.pick(group.quest.members, _.identity))},
   }, {
     $inc: {'stats.hp': down},
   }, {multi: true}).exec();