Username announcement (#10729)

* Change update username API call

The call no longer requires a password and also validates the username.

* Implement API call to verify username without setting it

* Improve coding style

* Apply username verification to registration

* Update error messages

* Validate display names.

* Fix API early Stat Point allocation (#10680)

* Refactor hasClass check to common so it can be used in shared & server-side code

* Check that user has selected class before allocating stat points

* chore(event): end Ember Hatching Potions

* chore(analytics): reenable navigation tracking

* update bcrypt

* Point achievement modal links to main site (#10709)

* Animal ears after death (#10691)

* Animal Ears purchasable with Gold if lost in Death

* remove ears from pinned items when set is bought

* standardise css and error handling for gems and coins

* revert accidental new line

* fix client tests

* Reduce margin-bottom of checklist-item from 10px to -3px. (#10684)

* chore(i18n): update locales

* 4.61.1

* feat(content): Subscriber Items and Magic Potions

* chore(sprites): compile

* chore(i18n): update locales

* 4.62.0

* Display notification for users to confirm their username

* fix typo

* WIP(usernames): Changes to address #10694

* WIP(usernames): Further changes for #10694

* fix(usernames): don't show spurious headings

* Change verify username notification to new version

* Improve feedback for invalid usernames

* Allow user to set their username again to confirm it

* Improve validation display for usernames

* Temporarily move display name validation outside of schema

* Improve rendering banner about sleeping in the inn

See #10695

* Display settings in one column

* Position inn banner when window is resized

* Update inn banner handling

* Fix banner offset on initial load

* Fix minor issues.

* Issue: 10660 - Fixed. Changed default to Please Enter A Value (#10718)

* Issue: 10660 - Fixed. Changed default to Please Enter A Value

* Issue: 10660 - Fixed/revision 2 Changed default to Enter A Value

* chore(news): Bailey announcements

* chore(i18n): update locales

* 4.62.1

* adjust wiki link for usernameInfo string

https://github.com/HabitRPG/habitica-private/issues/7#issuecomment-425405425

* raise coverage for tasks api calls (#10029)

* - updates a group task - approval is required
- updates a group task with checklist

* add expect to test the new checklist length

* - moves tasks to a specified position out of length

* remove unused line

* website getter tasks tests

* re-add sanitizeUserChallengeTask

* change config.json.example variable to be a string not a boolean

* fix tests - pick the text / up/down props too

* fix test - remove changes on text/up/down - revert sanitize condition - revert sanitization props

* Change update username API call

The call no longer requires a password and also validates the username.

* feat(content): Subscriber Items and Magic Potions

* Re-add register call

* Fix merge issue

* Fix issue with setting username

* Implement new alert style

* Display username confirmation status in settings

* Add disclaimer to change username field

* validate username in settings

* Allow specific fields to be focused when opening site settings

* Implement requested changes.

* Fix merge issue

* Fix failing tests

* verify username when users register with username and password

* Set ID for change username notification

* Disable submit button if username is invalid

* Improve username confirmation handling

* refactor(settings): address remaining code comments on auth form

* Revert "refactor(settings): address remaining code comments on auth form"

This reverts commit 9b6609ad64.

* Social user username (#10620)

* Refactored private functions to library

* Refactored social login code

* Added username to social registration

* Changed id library

* Added new local auth check

* Fixed export error. Fixed password check error

* fix(settings): password not available on client

* refactor(settings): more sensible placement of methods

* chore(migration): script to hand out procgen usernames

* fix(migration): don't give EVERYONE new names you doofus

* fix(migration): limit data retrieved, be extra careful about updates

* fix(migration): use missing field, not migration tag, for query

* fix(migration): unused var

* fix(usernames): only generate 20 characters

* fix(migration): set lowerCaseUsername

website/server/controllers/api-v3/auth.js

@@ -1,46 +1,35 @@
 import validator from 'validator';
 import moment from 'moment';
-import passport from 'passport';
 import nconf from 'nconf';
+
 import {
   authWithHeaders,
 } from '../../middlewares/auth';
+import { model as User } from '../../models/user';
+import common from '../../../common';
 import {
   NotAuthorized,
   BadRequest,
   NotFound,
 } from '../../libs/errors';
 import * as passwordUtils from '../../libs/password';
-import { model as User } from '../../models/user';
-import { model as EmailUnsubscription } from '../../models/emailUnsubscription';
-import { sendTxn as sendTxnEmail } from '../../libs/email';
 import { send as sendEmail } from '../../libs/email';
 import pusher from '../../libs/pusher';
-import common from '../../../common';
 import { validatePasswordResetCodeAndFindUser, convertToBcrypt} from '../../libs/password';
 import { encrypt } from '../../libs/encryption';
-import * as authLib from '../../libs/auth';
+import {
+  loginRes,
+  hasBackupAuth,
+  hasLocalAuth,
+  loginSocial,
+  registerLocal,
+} from '../../libs/auth';
 
 const BASE_URL = nconf.get('BASE_URL');
 const TECH_ASSISTANCE_EMAIL = nconf.get('EMAILS:TECH_ASSISTANCE_EMAIL');
-const COMMUNITY_MANAGER_EMAIL = nconf.get('EMAILS:COMMUNITY_MANAGER_EMAIL');
 
 let api = {};
 
-function hasBackupAuth (user, networkToRemove) {
-  if (user.auth.local.username) {
-    return true;
-  }
-
-  let hasAlternateNetwork = common.constants.SUPPORTED_SOCIAL_NETWORKS.find((network) => {
-    return network.key !== networkToRemove && user.auth[network.key].id;
-  });
-
-  return hasAlternateNetwork;
-}
-
-/* NOTE this route has also an API v4 version */
-
 /**
  * @api {post} /api/v3/user/auth/local/register Register
  * @apiDescription Register a new user with email, login name, and password or attach local auth to a social user
@@ -61,15 +50,10 @@ api.registerLocal = {
   })],
   url: '/user/auth/local/register',
   async handler (req, res) {
-    await authLib.registerLocal(req, res, { isV3: true });
+    await registerLocal(req, res, { isV3: true });
   },
 };
 
-function _loginRes (user, req, res) {
-  if (user.auth.blocked) throw new NotAuthorized(res.t('accountSuspended', {communityManagerEmail: COMMUNITY_MANAGER_EMAIL, userId: user._id}));
-  return res.respond(200, {id: user._id, apiToken: user.apiToken, newUser: user.newUser || false});
-}
-
 /**
  * @api {post} /api/v3/user/auth/local/login Login
  * @apiDescription Login a user with email / username and password
@@ -141,101 +125,19 @@ api.loginLocal = {
       headers: req.headers,
     });
 
-    return _loginRes(user, ...arguments);
+    return loginRes(user, ...arguments);
   },
 };
 
-function _passportProfile (network, accessToken) {
-  return new Promise((resolve, reject) => {
-    passport._strategies[network].userProfile(accessToken, (err, profile) => {
-      if (err) {
-        reject(err);
-      } else {
-        resolve(profile);
-      }
-    });
-  });
-}
-
 // Called as a callback by Facebook (or other social providers). Internal route
 api.loginSocial = {
   method: 'POST',
   middlewares: [authWithHeaders({
     optional: true,
   })],
-  url: '/user/auth/social', // this isn't the most appropriate url but must be the same as v2
+  url: '/user/auth/social',
   async handler (req, res) {
-    let existingUser = res.locals.user;
-    let accessToken = req.body.authResponse.access_token;
-    let network = req.body.network;
-
-    let isSupportedNetwork = common.constants.SUPPORTED_SOCIAL_NETWORKS.find(supportedNetwork => {
-      return supportedNetwork.key === network;
-    });
-    if (!isSupportedNetwork) throw new BadRequest(res.t('unsupportedNetwork'));
-
-    let profile = await _passportProfile(network, accessToken);
-
-    let user = await User.findOne({
-      [`auth.${network}.id`]: profile.id,
-    }, {_id: 1, apiToken: 1, auth: 1}).exec();
-
-    // User already signed up
-    if (user) {
-      _loginRes(user, ...arguments);
-    } else { // Create new user
-      user = {
-        auth: {
-          [network]: {
-            id: profile.id,
-            emails: profile.emails,
-          },
-        },
-        profile: {
-          name: profile.displayName || profile.name || profile.username,
-        },
-        preferences: {
-          language: req.language,
-        },
-      };
-      if (existingUser) {
-        existingUser.auth[network] = user.auth[network];
-        user = existingUser;
-      } else {
-        user = new User(user);
-        user.registeredThrough = req.headers['x-client']; // Not saved, used to create the correct tasks based on the device used
-      }
-
-      let savedUser = await user.save();
-
-      if (!existingUser) {
-        user.newUser = true;
-      }
-      _loginRes(user, ...arguments);
-
-      // Clean previous email preferences
-      if (savedUser.auth[network].emails && savedUser.auth[network].emails[0] && savedUser.auth[network].emails[0].value) {
-        EmailUnsubscription
-          .remove({email: savedUser.auth[network].emails[0].value.toLowerCase()})
-          .exec()
-          .then(() => {
-            if (!existingUser) sendTxnEmail(savedUser, 'welcome');
-          }); // eslint-disable-line max-nested-callbacks
-      }
-
-      if (!existingUser) {
-        res.analytics.track('register', {
-          category: 'acquisition',
-          type: network,
-          gaLabel: network,
-          uuid: savedUser._id,
-          headers: req.headers,
-          user: savedUser,
-        });
-      }
-
-      return null;
-    }
+    return await loginSocial(req, res);
   },
 };
 
@@ -338,7 +240,7 @@ api.updateUsername = {
     let validationErrors = req.validationErrors();
     if (validationErrors) throw validationErrors;
 
-    if (!user.auth.local.username) throw new BadRequest(res.t('userHasNoLocalRegistration'));
+    if (!hasLocalAuth(user)) throw new BadRequest(res.t('userHasNoLocalRegistration'));
 
     let password = req.body.password;
     let isValidPassword = await passwordUtils.compare(user, password);