WIP(shops): safer debug mode

config.json.example

@@ -88,5 +88,6 @@
   "REDIS_PORT": "1234",
   "REDIS_PASSWORD": "12345678",
   "TRUSTED_DOMAINS": "localhost,https://habitica.com",
-  "ENABLE_TIME_TRAVEL": "false"
+  "TIME_TRAVEL_ENABLED": "false",
+  "DEBUG_ENABLED": "false"
 }

test/api/unit/middlewares/ensureDevelopmentMode.js

@@ -0,0 +1,50 @@
+/* eslint-disable global-require */
+import nconf from 'nconf';
+import {
+  generateRes,
+  generateReq,
+  generateNext,
+} from '../../../helpers/api-unit.helper';
+import ensureDevelopmentMode from '../../../../website/server/middlewares/ensureDevelopmentMode';
+import { NotFound } from '../../../../website/server/libs/errors';
+
+describe('developmentMode middleware', () => {
+  let res; let req; let
+    next;
+
+  beforeEach(() => {
+    res = generateRes();
+    req = generateReq();
+    next = generateNext();
+  });
+
+  it('returns not found when on production URL', () => {
+    sandbox.stub(nconf, 'get').withArgs('DEBUG_ENABLED').returns(true);
+    sandbox.stub(nconf, 'get').withArgs('BASE_URL').returns('https://habitica.com');
+
+    ensureDevelopmentMode(req, res, next);
+
+    const calledWith = next.getCall(0).args;
+    expect(calledWith[0] instanceof NotFound).to.equal(true);
+  });
+
+  it('returns not found when intentionally disabled', () => {
+    sandbox.stub(nconf, 'get').withArgs('DEBUG_ENABLED').returns(false);
+    sandbox.stub(nconf, 'get').withArgs('BASE_URL').returns('http://localhost:3000');
+
+    ensureDevelopmentMode(req, res, next);
+
+    const calledWith = next.getCall(0).args;
+    expect(calledWith[0] instanceof NotFound).to.equal(true);
+  });
+
+  it('passes when enabled and on non-production URL', () => {
+    sandbox.stub(nconf, 'get').withArgs('DEBUG_ENABLED').returns(true);
+    sandbox.stub(nconf, 'get').withArgs('BASE_URL').returns('http://localhost:3000');
+
+    ensureDevelopmentMode(req, res, next);
+
+    expect(next).to.be.calledOnce;
+    expect(next.args[0]).to.be.empty;
+  });
+});

test/api/unit/middlewares/ensureDevelpmentMode.js

@@ -1,38 +0,0 @@
-/* eslint-disable global-require */
-import nconf from 'nconf';
-import {
-  generateRes,
-  generateReq,
-  generateNext,
-} from '../../../helpers/api-unit.helper';
-import ensureDevelpmentMode from '../../../../website/server/middlewares/ensureDevelpmentMode';
-import { NotFound } from '../../../../website/server/libs/errors';
-
-describe('developmentMode middleware', () => {
-  let res; let req; let
-    next;
-
-  beforeEach(() => {
-    res = generateRes();
-    req = generateReq();
-    next = generateNext();
-  });
-
-  it('returns not found when in production mode', () => {
-    sandbox.stub(nconf, 'get').withArgs('IS_PROD').returns(true);
-
-    ensureDevelpmentMode(req, res, next);
-
-    const calledWith = next.getCall(0).args;
-    expect(calledWith[0] instanceof NotFound).to.equal(true);
-  });
-
-  it('passes when not in production', () => {
-    sandbox.stub(nconf, 'get').withArgs('IS_PROD').returns(false);
-
-    ensureDevelpmentMode(req, res, next);
-
-    expect(next).to.be.calledOnce;
-    expect(next.args[0]).to.be.empty;
-  });
-});

test/api/unit/middlewares/ensureTimeTravelMode.js

@@ -18,8 +18,19 @@ describe('timetravelMode middleware', () => {
     next = generateNext();
   });
 
+  it('returns not found when using production URL', () => {
+    sandbox.stub(nconf, 'get').withArgs('TIME_TRAVEL_ENABLED').returns(false);
+    sandbox.stub(nconf, 'get').withArgs('BASE_URL').returns('https://habitica.com');
+
+    ensureTimeTravelMode(req, res, next);
+
+    const calledWith = next.getCall(0).args;
+    expect(calledWith[0] instanceof NotFound).to.equal(true);
+  });
+
   it('returns not found when not in time travel mode', () => {
-    sandbox.stub(nconf, 'get').withArgs('ENABLE_TIME_TRAVEL').returns(false);
+    sandbox.stub(nconf, 'get').withArgs('TIME_TRAVEL_ENABLED').returns(false);
+    sandbox.stub(nconf, 'get').withArgs('BASE_URL').returns('http://localhost:3000');
 
     ensureTimeTravelMode(req, res, next);
 
@@ -28,7 +39,8 @@ describe('timetravelMode middleware', () => {
   });
 
   it('passes when in time travel mode', () => {
-    sandbox.stub(nconf, 'get').withArgs('ENABLE_TIME_TRAVEL').returns(true);
+    sandbox.stub(nconf, 'get').withArgs('TIME_TRAVEL_ENABLED').returns(true);
+    sandbox.stub(nconf, 'get').withArgs('BASE_URL').returns('http://localhost:3000');
 
     ensureTimeTravelMode(req, res, next);
 

test/api/v3/integration/debug/GET-debug-timeTravelTime.test.js

@@ -10,25 +10,25 @@ describe('GET /debug/time-travel-time', () => {
   });
 
   after(() => {
-    nconf.set('ENABLE_TIME_TRAVEL', false);
+    nconf.set('TIME_TRAVEL_ENABLED', false);
   });
 
   it('returns the shifted time', async () => {
-    nconf.set('ENABLE_TIME_TRAVEL', true);
+    nconf.set('TIME_TRAVEL_ENABLED', true);
     const result = await user.get('/debug/time-travel-time');
     expect(result.time).to.exist;
     await user.post('/debug/jump-time', { disable: true });
   });
 
   it('returns shifted when the user is not an admin', async () => {
-    nconf.set('ENABLE_TIME_TRAVEL', true);
+    nconf.set('TIME_TRAVEL_ENABLED', true);
     const regularUser = await generateUser();
     const result = await regularUser.get('/debug/time-travel-time');
     expect(result.time).to.exist;
   });
 
   it('returns error when not in time travel mode', async () => {
-    nconf.set('ENABLE_TIME_TRAVEL', false);
+    nconf.set('TIME_TRAVEL_ENABLED', false);
 
     await expect(user.get('/debug/time-travel-time'))
       .eventually.be.rejected.and.to.deep.equal({

test/api/v3/integration/debug/POST-debug_jumpTime.test.js

@@ -12,13 +12,13 @@ describe('POST /debug/jump-time', () => {
   });
 
   after(async () => {
-    nconf.set('ENABLE_TIME_TRAVEL', true);
+    nconf.set('TIME_TRAVEL_ENABLED', true);
     await user.post('/debug/jump-time', { disable: true });
-    nconf.set('ENABLE_TIME_TRAVEL', false);
+    nconf.set('TIME_TRAVEL_ENABLED', false);
   });
 
   it('Jumps forward', async () => {
-    nconf.set('ENABLE_TIME_TRAVEL', true);
+    nconf.set('TIME_TRAVEL_ENABLED', true);
     const resultDate = new Date((await user.post('/debug/jump-time', { reset: true })).time);
     expect(resultDate.getDate()).to.eql(today.getDate());
     expect(resultDate.getMonth()).to.eql(today.getMonth());
@@ -30,7 +30,7 @@ describe('POST /debug/jump-time', () => {
   });
 
   it('jumps back', async () => {
-    nconf.set('ENABLE_TIME_TRAVEL', true);
+    nconf.set('TIME_TRAVEL_ENABLED', true);
     const resultDate = new Date((await user.post('/debug/jump-time', { reset: true })).time);
     expect(resultDate.getDate()).to.eql(today.getDate());
     expect(resultDate.getMonth()).to.eql(today.getMonth());
@@ -42,7 +42,7 @@ describe('POST /debug/jump-time', () => {
   });
 
   it('can jump a lot', async () => {
-    nconf.set('ENABLE_TIME_TRAVEL', true);
+    nconf.set('TIME_TRAVEL_ENABLED', true);
     const resultDate = new Date((await user.post('/debug/jump-time', { reset: true })).time);
     expect(resultDate.getDate()).to.eql(today.getDate());
     expect(resultDate.getMonth()).to.eql(today.getMonth());
@@ -52,7 +52,7 @@ describe('POST /debug/jump-time', () => {
   });
 
   it('returns error when the user is not an admin', async () => {
-    nconf.set('ENABLE_TIME_TRAVEL', true);
+    nconf.set('TIME_TRAVEL_ENABLED', true);
     const regularUser = await generateUser();
     await expect(regularUser.post('/debug/jump-time', { offsetDays: 1 }))
       .eventually.be.rejected.and.to.deep.equal({
@@ -63,7 +63,7 @@ describe('POST /debug/jump-time', () => {
   });
 
   it('returns error when not in time travel mode', async () => {
-    nconf.set('ENABLE_TIME_TRAVEL', false);
+    nconf.set('TIME_TRAVEL_ENABLED', false);
 
     await expect(user.post('/debug/jump-time', { offsetDays: 1 }))
       .eventually.be.rejected.and.to.deep.equal({

website/client/src/components/appFooter.vue

@@ -291,7 +291,7 @@
       </div>
 
       <div
-        v-if="ENABLE_TIME_TRAVEL && user.permissions && user.permissions.fullAccess"
+        v-if="TIME_TRAVEL_ENABLED && user.permissions && user.permissions.fullAccess"
         :key="lastTimeJump"
       >
         <a
@@ -328,7 +328,7 @@
       </div>
 
       <div
-        v-if="ENABLE_TIME_TRAVEL && isUserLoaded"
+        v-if="DEBUG_ENABLED && isUserLoaded"
         class="debug-toggle"
       >
         <button
@@ -826,8 +826,8 @@ import buyGemsModal from './payments/buyGemsModal.vue';
 import reportBug from '@/mixins/reportBug.js';
 import { worldStateMixin } from '@/mixins/worldState';
 
-const IS_PRODUCTION = process.env.NODE_ENV === 'production'; // eslint-disable-line no-process-env
+const DEBUG_ENABLED = process.env.DEBUG_ENABLED; // eslint-disable-line no-process-env
-const ENABLE_TIME_TRAVEL = process.env.ENABLE_TIME_TRAVEL === 'true'; // eslint-disable-line no-process-env
+const TIME_TRAVEL_ENABLED = process.env.TIME_TRAVEL_ENABLED; // eslint-disable-line no-process-env
 export default {
   components: {
     buyGemsModal,
@@ -847,8 +847,8 @@ export default {
         heart,
       }),
       debugMenuShown: false,
-      IS_PRODUCTION,
+      DEBUG_ENABLED,
-      ENABLE_TIME_TRAVEL,
+      TIME_TRAVEL_ENABLED,
       lastTimeJump: null,
     };
   },

website/client/src/components/shops/buyModal.vue

@@ -825,6 +825,7 @@ export default {
         const buySuccess = await this.unlock(this.item.path);
         if (!buySuccess) return;
         this.sync();
+        this.$root.$emit('playSound', 'Reward');
         this.purchased(this.item.text);
       } else {
         const shouldConfirmPurchase = this.item.currency === 'gems' || this.item.currency === 'hourglasses';

website/client/src/components/shops/shopItem.vue

@@ -165,11 +165,12 @@
   }
 
   .price {
-    height: 1.75rem;
+    border-radius: 0px 0px 4px 4px;
-    width: 94px;
+    font-size: 0.75rem;
+    line-height: 1;
     margin-left: -1px;
     margin-right: -1px;
-    border-radius: 0px 0px 4px 4px;
+    padding: 0.375rem 0;
 
     &.gems {
       background-color: rgba($green-100, 0.15);
@@ -190,10 +191,7 @@
 
   .price-label {
     font-family: Roboto;
-    font-size: 12px;
     font-weight: bold;
-    line-height: 1.33;
-    margin-bottom: 1px;
 
     &.gems {
       color: $green-1;

website/client/src/main.js

@@ -36,7 +36,7 @@ setUpLogging();
 setupAnalytics(); // just create queues for analytics, no scripts loaded at this time
 const store = getStore();
 
-if (process.env.ENABLE_TIME_TRAVEL) {
+if (process.env.TIME_TRAVEL_ENABLED) {
   (async () => {
     const sinon = await import('sinon');
     if (axios.defaults.headers.common['x-api-user']) {

website/client/vue.config.js

@@ -28,7 +28,8 @@ const envVars = [
   'AMPLITUDE_KEY',
   'LOGGLY_CLIENT_TOKEN',
   'TRUSTED_DOMAINS',
-  'ENABLE_TIME_TRAVEL',
+  'TIME_TRAVEL_ENABLED',
+  'DEBUG_ENABLED'
   // TODO necessary? if yes how not to mess up with vue cli? 'NODE_ENV'
 ];
 

website/server/controllers/api-v3/debug.js

@@ -2,7 +2,7 @@ import _ from 'lodash';
 import sinon from 'sinon';
 import moment from 'moment';
 import { authWithHeaders } from '../../middlewares/auth';
-import ensureDevelpmentMode from '../../middlewares/ensureDevelpmentMode';
+import ensureDevelopmentMode from '../../middlewares/ensureDevelopmentMode';
 import ensureTimeTravelMode from '../../middlewares/ensureTimeTravelMode';
 import { BadRequest } from '../../libs/errors';
 import common from '../../../common';
@@ -33,7 +33,7 @@ const api = {};
 api.addTenGems = {
   method: 'POST',
   url: '/debug/add-ten-gems',
-  middlewares: [ensureDevelpmentMode, authWithHeaders()],
+  middlewares: [ensureDevelopmentMode, authWithHeaders()],
   async handler (req, res) {
     const { user } = res.locals;
 
@@ -56,7 +56,7 @@ api.addTenGems = {
 api.addHourglass = {
   method: 'POST',
   url: '/debug/add-hourglass',
-  middlewares: [ensureDevelpmentMode, authWithHeaders()],
+  middlewares: [ensureDevelopmentMode, authWithHeaders()],
   async handler (req, res) {
     const { user } = res.locals;
 
@@ -79,7 +79,7 @@ api.addHourglass = {
 api.setCron = {
   method: 'POST',
   url: '/debug/set-cron',
-  middlewares: [ensureDevelpmentMode, authWithHeaders()],
+  middlewares: [ensureDevelopmentMode, authWithHeaders()],
   async handler (req, res) {
     const { user } = res.locals;
     const cron = req.body.lastCron;
@@ -103,7 +103,7 @@ api.setCron = {
 api.makeAdmin = {
   method: 'POST',
   url: '/debug/make-admin',
-  middlewares: [ensureDevelpmentMode, authWithHeaders()],
+  middlewares: [ensureDevelopmentMode, authWithHeaders()],
   async handler (req, res) {
     const { user } = res.locals;
 
@@ -134,7 +134,7 @@ api.makeAdmin = {
 api.modifyInventory = {
   method: 'POST',
   url: '/debug/modify-inventory',
-  middlewares: [ensureDevelpmentMode, authWithHeaders()],
+  middlewares: [ensureDevelopmentMode, authWithHeaders()],
   async handler (req, res) {
     const { user } = res.locals;
     const { gear } = req.body;
@@ -176,7 +176,7 @@ api.modifyInventory = {
 api.questProgress = {
   method: 'POST',
   url: '/debug/quest-progress',
-  middlewares: [ensureDevelpmentMode, authWithHeaders()],
+  middlewares: [ensureDevelopmentMode, authWithHeaders()],
   async handler (req, res) {
     const { user } = res.locals;
     const key = _.get(user, 'party.quest.key');

website/server/libs/analyticsService.js

@@ -353,10 +353,13 @@ const mockAnalyticsService = {
 
 // Return the production or mock service based on the current environment
 function getServiceByEnvironment () {
+  if (nconf.get('IS_PROD') || (nconf.get('DEBUG_ENABLED') && !nconf.get('BASE_URL').includes('localhost'))) {
     return {
       track,
       trackPurchase,
     };
+  }
+  return mockAnalyticsService;
 }
 
 export {

website/server/middlewares/ensureDevelopmentMode.js

@@ -0,0 +1,12 @@
+import nconf from 'nconf';
+import {
+  NotFound,
+} from '../libs/errors';
+
+export default function ensureDevelopmentMode (req, res, next) {
+  if (nconf.get('DEBUG_ENABLED') && nconf.get('BASE_URL') !== 'https://habitica.com') {
+    next();
+  } else {
+    next(new NotFound());
+  }
+}

website/server/middlewares/ensureDevelpmentMode.js

@@ -1,12 +0,0 @@
-import nconf from 'nconf';
-import {
-  NotFound,
-} from '../libs/errors';
-
-export default function ensureDevelpmentMode (req, res, next) {
-  if (!nconf.get('ENABLE_TIME_TRAVEL')) {
-    next(new NotFound());
-  } else {
-    next();
-  }
-}

website/server/middlewares/ensureTimeTravelMode.js

@@ -4,7 +4,7 @@ import {
 } from '../libs/errors';
 
 export default function ensureTimeTravelMode (req, res, next) {
-  if (nconf.get('ENABLE_TIME_TRAVEL')) {
+  if (nconf.get('TIME_TRAVEL_ENABLED') && nconf.get('BASE_URL') !== 'https://habitica.com') {
     next();
   } else {
     next(new NotFound());