Commit Graph

149 Commits

Author SHA1 Message Date
Sabe Jones
8fa91a3805 chore(node): upgrade to Node 20 2024-03-11 09:59:57 -05:00
Phillip Thelen
f8d315ff6e Upgrade to mongoose 7 (#14971)
* remove some unused dependencies

* update mongoose version

* make common tests pass

* Make unit tests pass

* make api v3 integration tests pass

* fix lint issues

* fix issue with package-lock

* fix(lint): we don't need no .js

* fix(lint): update to latest config-habitrpg

* chore(npm): update package locks

* fix(test): replace deprecated fn

* chore(package): update eslint-habitrpg again

* fix(lint): server linting

* fix(lint): client linting

* fix(client): correct mangled common imports

* chore(npm): update package-locks

* fix(lint): punctuation, module

---------

Co-authored-by: SabreCat <sabrecat@gmail.com>
Co-authored-by: SabreCat <sabe@habitica.com>
2024-01-16 15:18:47 -06:00
Sabe Jones
b7def686e9 Squashed commit of the following:
commit 83bcd07e20
Author: SabreCat <sabrecat@gmail.com>
Date:   Fri Dec 22 17:24:45 2023 -0600

    fix(profile): revert state on error

commit 6aa6278727
Author: SabreCat <sabrecat@gmail.com>
Date:   Fri Dec 22 14:37:28 2023 -0600

    fix(test): no longer care about swears in profile

commit 0882c77038
Author: SabreCat <sabe@habitica.com>
Date:   Fri Dec 22 14:15:42 2023 -0600

    fix(lint): remove unused functions

commit 9b275ef72d
Author: SabreCat <sabe@habitica.com>
Date:   Fri Dec 22 14:09:11 2023 -0600

    fix(profiles): restore reporting functionality
    Also remove unused and/or unrelated code and clean up comments

commit f4ed8c1461
Merge: da16aa9c75 f8ba191eea
Author: SabreCat <sabe@habitica.com>
Date:   Fri Dec 22 12:11:00 2023 -0600

    Merge branch 'release' into slur-swear-blocker

commit da16aa9c75
Author: CuriousMagpie <eilatan@gmail.com>
Date:   Thu Dec 21 13:20:28 2023 -0500

    feat(s/s blocker): challenge updates to slack

commit 51bed61c4c
Author: CuriousMagpie <eilatan@gmail.com>
Date:   Tue Dec 19 15:36:59 2023 -0500

    feat(s/s blocker): work on challenges

commit 139cbcb21c
Author: CuriousMagpie <eilatan@gmail.com>
Date:   Wed Dec 13 13:20:45 2023 -0500

    fix(slack): update Slack notification to include authorEmail and remove undefined

commit 805b287721
Author: SabreCat <sabe@habitica.com>
Date:   Tue Dec 12 16:35:54 2023 -0600

    fix(profiles): improve profanity check logic

commit 02ef7e8822
Author: CuriousMagpie <eilatan@gmail.com>
Date:   Tue Dec 12 17:22:29 2023 -0500

    feat(slur blocker): arghhhhhh

commit 949dee9b1e
Author: CuriousMagpie <eilatan@gmail.com>
Date:   Tue Dec 12 13:57:29 2023 -0500

    feat(slur blocker): more refactoring

commit bf953998f4
Merge: d21aa687b7 f572aa442e
Author: CuriousMagpie <eilatan@gmail.com>
Date:   Mon Dec 11 15:20:06 2023 -0500

    Merge branch 'release' into slur-swear-blocker

commit d21aa687b7
Author: CuriousMagpie <eilatan@gmail.com>
Date:   Thu Dec 7 18:00:29 2023 -0500

    feat(slur blocker): refactoring code

commit f2db90c494
Author: CuriousMagpie <eilatan@gmail.com>
Date:   Wed Dec 6 12:12:55 2023 -0500

    feat(slur/swear blocker): work on Profiles

commit 8f9822ffe8
Author: CuriousMagpie <eilatan@gmail.com>
Date:   Mon Dec 4 17:25:17 2023 -0500

    feat(profiles/challenges): work on profile block & slack report

commit bdb2e06e5e
Author: CuriousMagpie <eilatan@gmail.com>
Date:   Fri Dec 1 16:11:27 2023 -0500

    feat(slur/swear): working on it

commit 7277b5cad5
Merge: 24d14277ab 941f1f976c
Author: CuriousMagpie <eilatan@gmail.com>
Date:   Fri Dec 1 15:04:46 2023 -0500

    Merge branch 'profile-slur-swear-blocker' into slur-swear-blocker

commit 941f1f976c
Author: CuriousMagpie <eilatan@gmail.com>
Date:   Thu Nov 30 14:34:30 2023 -0500

    feat(profiles/PMs): slur/swear blocker upgrade

commit 0863017efc
Author: CuriousMagpie <eilatan@gmail.com>
Date:   Tue Nov 28 16:21:21 2023 -0500

    feat(profiles): slur/swear blocker

commit e9937d864f
Author: CuriousMagpie <eilatan@gmail.com>
Date:   Mon Nov 27 15:24:37 2023 -0500

    feat(profiles): slur/swear blocker

commit 24d14277ab
Author: CuriousMagpie <eilatan@gmail.com>
Date:   Mon Nov 27 14:12:46 2023 -0500

    feat(challenges): update behavior based on public/private groups

commit 1251f5b6a7
Author: CuriousMagpie <eilatan@gmail.com>
Date:   Tue Nov 14 16:28:29 2023 -0500

    feat(challenges): swear and slur blocker

commit a771045ca7
Author: CuriousMagpie <eilatan@gmail.com>
Date:   Tue Nov 14 15:46:16 2023 -0500

    feat(challenges): even more slur blocker

commit e5e91aa78a
Author: CuriousMagpie <eilatan@gmail.com>
Date:   Tue Nov 14 14:31:25 2023 -0500

    feat(challenges): more slur blocker

commit 50e824e4e3
Author: CuriousMagpie <eilatan@gmail.com>
Date:   Mon Nov 13 15:12:14 2023 -0500

    feat(challenges): slur blocker

commit 315ea24ef4
Author: CuriousMagpie <eilatan@gmail.com>
Date:   Fri Nov 3 12:31:12 2023 -0400

    feat(challenges): slur blocker work

commit 0f742d219f
Author: CuriousMagpie <eilatan@gmail.com>
Date:   Thu Nov 2 16:22:31 2023 -0400

    feat(challenges): add banned words & slur blocker to challenges

commit 40d6b60ee3
Author: CuriousMagpie <eilatan@gmail.com>
Date:   Mon Oct 23 13:00:46 2023 -0400

    update packages on local/origin repo
2024-01-10 15:14:11 -06:00
SabreCat
330c3e1bf6 fix(lint): remove unused fn 2023-07-27 16:34:29 -05:00
SabreCat
0ba3cd3bdf fix(tests): cleanup continues 2023-07-27 16:18:25 -05:00
SabreCat
df25e0574d fix(auth): enforce max pass length at update 2022-12-05 16:36:42 -06:00
Sabe Jones
82c5e40b92 Enforce maximum password length (#14290)
* fix(auth): enforce maximum password length

* fix(auth): line length and better error message

* fix(auth): correctly import/export constant

Co-authored-by: SabreCat <sabe@habitica.com>
2022-11-18 16:49:10 -06:00
Phillip Thelen
24841346dc Purge Facebook (#13696)
* Don't sign in user when trying to connect a social account that was already created

* Log social users into matching local auth accounts

If the social account has an email that already exists as a local user, instead of creating a new account log them into their account and add the social auth to the account

* If possible set local authentication email for social users

* Allow password reset emails to be sent to social login users

* lint fixes

* Fix issues and tests

* fix tests

* Fix lint error.

* purge Facebook.

Only keep it in some select places to allow for some compatablilty.

* Fix error

* fix error

* Let settings handle it when you don't have a password set but an email

* fix error

* Fix boolean logic

* fix json conversion

* .

* fix password reset for old social accounts

* Don't sign in user when trying to connect a social account that was already created

* Log social users into matching local auth accounts

If the social account has an email that already exists as a local user, instead of creating a new account log them into their account and add the social auth to the account

* If possible set local authentication email for social users

* Allow password reset emails to be sent to social login users

* lint fixes

* Fix issues and tests

* fix tests

* Fix lint error.

* purge Facebook.

Only keep it in some select places to allow for some compatablilty.

* Fix error

* fix error

* Let settings handle it when you don't have a password set but an email

* fix error

* Fix boolean logic

* fix json conversion

* fix password reset for old social accounts

* Revert "lint fixes"

This reverts commit c244b1651c.

# Conflicts:
#	website/client/src/components/auth/registerLoginReset.vue
#	website/client/src/components/static/contact.vue

* Revert "fix password reset for old social accounts"

This reverts commit 7e0069a80f.

* fix duplicate code

* chore(misc): remove irrelevant changes

* chore(privacy): update policy page with note about FB

Co-authored-by: SabreCat <sabe@habitica.com>
2022-09-15 18:22:52 -05:00
SabreCat
ee0f6fd78f fix(test): same thing for v3 2022-08-25 10:35:49 -05:00
SabreCat
4c85b933cb fix(tests): correct one last v3 test and wrap v4 2022-08-22 21:59:51 -05:00
SabreCat
82abdaa0c4 WIP(tests): finish cleaning up v3 integrations 2022-08-22 21:47:55 -05:00
Vi Mio
3b1407f529 feat: prevent user from purchasing a quest if prerequisites are not met (#14073)
* feat: prevent user from purchasing a quest if prerequisites are not met

* test: fail to buy quest if not all prerequisites are met

* test: modify to check all quest prerequisites
2022-07-14 15:24:52 -05:00
SabreCat
d668fd8920 fix(tests): missed alt test suite versions 2022-06-09 15:22:23 -05:00
SabreCat
85c7c7ea57 fix(tests): create test teams properly, adjust expectations 2022-06-09 15:06:51 -05:00
Phillip Thelen
38b39b600c Adminpanel and revamped permissions (#13843)
* create Admin Panel page with initial content from Hall's admin section

* reorganise Admin Panel form and add more accordians

* add lastCron to fields returned by api.getHeroes

* improve timestamps and authentication section

* add party and quest info to Admin Panel, add party to heroAdminFields

* move Admin Panel menu item to top of menu, make invisible to non-admins

* remove code used for displaying all Heroes

* add avatar appearance and drops section in Admin Panel

* allow logged-in user to be the default hero loaded

* add time zones to timestamp/authentication section

* rename Items to Update Items

This will allow a new Items section to be added.

* add read-only Items display with button to copy data to Update Items section

* remove never-used allItemsPaths code that had been copied from Hall

* update tests for the attributes added to heroAdminFields

* supply names for items and also set information for gear/equipment

* remove code that loads subsections of content

We use enough of the content that it's easier to load it all and
access it through the content object, especially when we're looping
through different item types.

* add gear names and set details to Avatar Costume/Battle Gear section

* make the wiki URLs clickable and make minor item format improvements

* add gear sets for Check-In Incentives and animal ears and tails

* add gear set for Gold-Purchasable Quest Lines

Also merges the existing Mystery of the Masterclassers quest set into it.

* fix error with Kickstarter gear set and include wiki link

* improve description of check-in incentive gear set

* fix description of Items section

* fix lint warnings

* update another test for the attributes added to heroAdminFields

* allow "@" to be included when specifying Username to load

* create GetHeroParty API v3 route to fetch a given user's party data

Only some data from the party will be loaded (e.g., not private
data such as name, description).

Includes tests for the route.

See the next commit for front-end changes that use this.

* display data from a given user's party in admin panel

Only some data from the party will be loaded (e.g., not private
data such as name, description).

Also adds support for finding and displaying errors from the
user's data.

* use new error handling method for other sections

- Time zone differences
- Cron bugs
- Privilege removal (mute/block) - not a bug but needs to be highlighted

* redirect non-admin users away from admin-only page (WIP)

This needs more work. Currently, admin users are also redirected
if they access the page by direct URL or after reload.

* clarify source of items from Check-In Incentives and Lunar Battle quests

* replace non-standard form fields with HTML forms

* add user's language, remove unused export blocks

* convert functions to filters: formatDate, formatTimeZone

* improve display of minutes portion of time zone in Admin Panel

* move basic details about user to a new component

* move Timestamp/Cron/Auth/etc details to a new component - WIP, has errors

The automatic expand and error warnings don't reset themselves when
you fetch data for a new user.

* replace non-standard form fields with HTML forms

Most of this was done in 26fdcbbee5

* move Timestamp/Cron/Auth/etc details to a new component (fixed)

* move Avatar and Drops section to a new component

* move Party and Quest section to a new component

* move Contributor Details to new component, add checkbox for admin, add preview

This adds a markdown-enabled preview of the Contributions textarea.

It also removes the code that automatically set contributor.admin
to true when the Tier was above 7.
That feature wasn't secure because the Tier can be accidentally
changed if you scroll while the cursor is over the Tier form field
(we accidentally demoted a Socialite once by doing that and if
we'd scrolled in the other direction we would have given her
admin privileges).

Instead there's now a checkbox for giving moderator-level privileges.
We'll want that anyway when we move to a system of selected
privileges for each admin instead of all admin privileges being
given to all mods/staff.

There's also a commented-out checkbox for giving Bailey CMS
privileges, for when we're ready to use that. The User model doesn't
yet have support for it.

* move Privileges and Gems section to a new component

* rename formatItems to getItemDescription; make other minor fixes

* remove an outdated test description

This "pended" explanation probably wasn't needed after "x" was
removed from "describe" in 2ab76db27c

* add newsPoster Bailey CMS permission to User model and Admin Panel

* move formatDate from mixins to filters

* make lint fixes

* remove development comments from hall.js

I'll be handling the TODO comment and I've left in my "XXX" marker
to remind me

* fix bug in Hall's castItemVal: mounts are null not false

* move Items section to a new component and delete Update Items section

The Update Items section is no longer needed because the new Items
component has in-place editing.

* remove unused imports

* add "secret" field to "Privileges, Gem Balance" section.

Also move the markdownPreview style from contributorDetails.vue to
index.vue since it's used in two components now.

* show non-Standard never-owned Pets and Mounts in Items section

* redirect non-admin users away from admin-only page

This completes the work started in commit a4f9c754ad

It now allows admins to access the page when coming from another
page on the site or from a direct link, including if the admin user
isn't logged in yet.

* display memberCount for party

* add secret.text field to Contributor Details

This is in addition to showing it in the Privileges section because
the secret text could be about either troublesome behaviour or
contributions.

* allow user to be loaded into Admin Panel via a URL

This includes:

- router config has a child route for the admin panel with a
Username/ID as a parameter
- loadHero code moved from top-level index page into a new
"user support" index page
- links in the Hall changed to point to admin panel route
- admin panel link added to admin section of user profile modal

* keep list of known titles on their own lines

* sort heroFields alphabetically

No actual changes.

* return all flags for use in Admin Panel and fix Hall tests for flags

Future Admin Panel changes will display more flags.

NB 'flags' wasn't in the tests before, even though two optional
flags were being fetched.
The tests weren't failing because the test users hadn't been given
data for those optional flags.

The primary reason for this change now is to fix the tests.

* show part of the API Token in the Admin Panel

* send full hero object into cronAndAuth.vue

This is a prelude to allowing this component to change the hero.

* split heroAdminFields string into two: one for fetching data and one for showing it

This is because apiToken must be fetched but not shown,
while apiTokenObscured is calculated (not fetched) and shown.

* let admin change a user's API Token

* restore sanity

* remove code to show obscured version of API Token

It will return with tighter permissions for viewing it.

* add Custom Day Start time (CDS) to Timestamps, Time Zone... section

* commit lint's automatic fixes - one for admin-panel changes in hall.js

The other fixes aren't related to this PR but I figured they may
as well go live.

* apply fixes from paglias's comments, excluding style/CSS changesd

The comments that this PR fixes start at
https://github.com/HabitRPG/habitica/pull/12035#pullrequestreview-500422316

Style fixes will be in a future commit.

* fix styles/CSS

* allow profile modal to close when using admin panel link

Also removes an empty components block.

* prevent Admin Panel being used without new userSupport privilege

Also adds initial support for other contributor.priv privileges
and changes Debug Menu to add userSupport privilege

* don't do this: this.hero = { ...hero };

* enhance quest error messages

* redirect to admin-panel home page when using "Save and Clear Data"

The user's ID / name is still in the form for easy refetching.

* create ensurePriv function, use in api.getHeroParty

* fix lint problems and integration tests

* add page title to top-level Admin Panel

Also add more details to a router comment (consistent with a similar
comment) in case it helps anyone.

* fix tests

* display Moderation Notes above Contributions

* lint fix

* remove placeholder code for new privileges

I had planned to have each of these implemented in stages, but
paglias wanted it all done at once. I'm afraid that's too big a
project for me to take on in a single PR so I'm cancelling
the plans for adjusting the privileges.

* Improve permission handling

* Don't report timezone error on first day

* fix lint error

* .

* Fix lint error

* fix failing tests

* Fix more tests

* .

* ..

* ...

* fix(admin): always include permissions when querying user
also remove unnecessary failing test case

* permission improvements

* show transactions in admin panel

* fix lint errors

* fix permission check

* fix(panel): missing mixin, handle empty perms object

Co-authored-by: Alys <alice.harris@oldgods.net>
Co-authored-by: SabreCat <sabe@habitica.com>
2022-05-03 14:40:56 -05:00
Phillip Thelen
664f960a8b Pull in missing changes from FB removal PR (#13931)
* fix(auth): hide post hoc Facebook reg

* Pull in missing changes

* fix(lint): whitespace

* fix(strings): missing error message

* fix(tests): update to match functionality

Co-authored-by: SabreCat <sabe@habitica.com>
2022-04-14 12:58:37 -05:00
SabreCat
de477ebb4a Revert "Revert "Revert "Prerequisites to removing Facebook authentication (#13683)"""
This reverts commit e3ffd7acbc.
2022-01-31 14:52:22 -06:00
SabreCat
e3ffd7acbc Revert "Revert "Prerequisites to removing Facebook authentication (#13683)""
This reverts commit b3c466ad5a.
2022-01-27 14:50:04 -06:00
SabreCat
b3c466ad5a Revert "Prerequisites to removing Facebook authentication (#13683)"
This reverts commit 1177ad8b8c.
2022-01-25 09:30:37 -06:00
Phillip Thelen
1177ad8b8c Prerequisites to removing Facebook authentication (#13683)
* Don't sign in user when trying to connect a social account that was already created

* Log social users into matching local auth accounts

If the social account has an email that already exists as a local user, instead of creating a new account log them into their account and add the social auth to the account

* If possible set local authentication email for social users

* Allow password reset emails to be sent to social login users

* lint fixes

* Fix issues and tests

* fix tests

* Fix lint error.
2022-01-21 15:15:58 -06:00
Natalie L
5d87c2af13 fix: I18n string update (#13588)
* i18n string updates (issue #9210)

* change offHand to offHandCapitalized

* added removeTasks to challenge.json

* added hairBangs back to character.json

* added hairBangs back to character.json

* more hairBangs nonsense

* added hairBangs to hair-settings.vue, removed same from character.json

* changed levelUp to levelup in levelUp.vue and achievements.json

* fix duplicate string values

* fixed different strings with same content in different files

* updated test/api/v3 and test/api/v4 with messageTaskNotFound

* Delete POST-tasks_taskId_checklist_itemId_score.test.js

File got copied to a new directory, doesn't need to be here.

* fix: userID token in patrons.vue and heroes.vue

* removed: unused clock of code

* Restored eggsItemType to inventory.json

Co-authored-by: Sabe Jones <sabrecat@gmail.com>
2021-11-04 16:33:08 -05:00
Carlton McFarlane
a53355872b Add checks for profanity to profile updates (#12445)
* fix(profile): detect attempt to use banned words as display name. refactor profanity detection method.

* fix(profile): detect attempt to use banned words in blurb. further refactor profanity detection. inform the user their chat privileges have been revoked.

* refactor: add function to normalize Unicode strings and remove diacritics

* fix: improve regEx to prevent false partial matches e.g. 'hello' being recognised as banned words. porting fix from #12309

* fix(profile): refactor of profanity detection for #12445

* fix(profile): add test for swear words in new profile. fix existing tests

* fix(profile): show different error message for attempted slur use in username by new users.

* fix(profile): remove incorrect slur test

* fix(profile): fix slurs not caught at start of end of strings connect by punctuation

* tests(profile): fix tests for profanity checking

* remove exclusive test

* 11865 - update text for slur warnings

* 11865 - remove unused string from locale files

* 11865 - improve naming of banned word usage locale string

* 11865 - improve logic so that differentiated warnings are shown depending on whether a slur or other profanity has been used in a display name

* 11865 - construct slur regexes outside the validation function in which they are used

* 11865 - fix tests
2021-04-30 15:47:39 -05:00
Sabe Jones
d231eb3023 fix(test): force special spell purchasable for test 2021-04-09 15:41:20 -05:00
negue
1bccbc03fa Hotfix: moving pinned items (#12935)
* increase checks for moving pinned items - fixes #10406

* allow to move official pinneditems

* using common object instead of method import
2021-01-25 17:40:18 -06:00
Phillip Thelen
d9e774dd77 Implement Bailey CMS API (#10739)
* Begin refactoring news API to return individual markdown posts

* Implement simple bailey CMS

* Prevented users with lvl less than 10 from seeing mana

* Added in class checks and notification tests

* Added getter use

* Fixed class check

* chore(i18n): update locales

* 4.60.2

* remove tests that are no longer needed because we won't be purging private messages (#10670)

Ref: this comment from paglias: https://github.com/HabitRPG/habitica/issues/7940#issuecomment-406489506

* remove .only

* allow challenge leader/owner to view/join/modify challenge in private group they've left - fixes #9753 (#10606)

* rename hasAccess to canJoin for challenges

This is so the function won't be used accidentally for other
purposes, since hasAccess could be misinterpretted.

* add isLeader function for challenges

* allow challenge leader to join/modify/end challenge when they're not in the private group it's in

* delete duplicate test

* clarify title of existing tests

* add tests and adjust existing tests to reduce privileges of test users

* fix lint errors

* remove pointless isLeader check (it's checked in canJoin)

* Correct Challenges tooltip in Guild view (#10667)

* Fix new party member cannot join pending quest (#10648)

* Saved sort selection into local storage for later use - fixes #10432 (#10655)

* Saved sort selection into local storage for later use

* Updated code to use userLocalManager module

* Fix initial position item info when selecting one item after another (fixes #10077) (#10661)

* Update lastMouseMoveEvent even when dragging an egg or potion.

* Update lastMouseMoveEvent even when dragging a food item.

* Refactor/market vue (#10601)

* extract inventoryDrawer from market

* show scrollbar only if needed

* extract featuredItemsHeader / pinUtils

* extract pageLayout

* extract layoutSection / filterDropdown - fix sortByNumber

* rollback sortByNumber order-fix

* move equipment lists out of the layout-section (for now)

* refactor sellModal

* extract checkbox

* extract equipment section

* extract category row

* revert scroll - remove sellModal item template

* fix(lint): commas and semis

* Created category item component (#10613)

* extract filter sidebar

* fix gemCount - fix raising the item count if the item wasn't previously owned

* fixes #10659

* remove unneeded method

* fix typo when importing component

* feat(content): Forest Friends Quest Bundle

* chore(sprites): compile

* chore(i18n): update locales

* 4.60.3

* fix(bcrypt): install fork compatible with Node 8

* chore(i18n): update locales

* 4.60.4

* add swear words - TRIGGER / CONTENT WARNING: assault, slurs, swearwords, etc

* add pinUtils-mixin   - fixes #10682 (#10683)

* chore(news): Bailey

* chore(i18n): update locales

* 4.60.5

* Improve rendering banner about sleeping in the inn

See #10695

* Display settings in one column

* Small Updates (#10701)

* small updates

* fix client unit test

* fix uuid validation

* Revert "Small Updates (#10701)" (#10702)

This reverts commit dd7fa73961.

* feat(event): Fall Festival 2018

* chore(sprites): compile

* chore(i18n): update locales

* 4.61.0

* Move inbox to its own model (#10428)

* shared model for chat and inbox

* disable inbox schema

* inbox: use separate model

* remove old code that used group.chat

* add back chat field (not used) and remove old tests

* remove inbox exclusions when loading user

* add GET /api/v3/inbox/messages

* add comment

* implement DELETE /inbox/messages/:messageid in v4

* implement GET /inbox/messages in v4 and update tests

* implement DELETE /api/v4/inbox/clear

* fix url

* fix doc

* update /export/inbox.html

* update other data exports

* add back messages in user schema

* add user.toJSONWithInbox

* add compativility until migration is done

* more compatibility

* fix tojson called twice

* add compatibility methods

* fix common tests

* fix v4 integration tests

* v3 get user -> with inbox

* start to fix tests

* fix v3 integration tests

* wip

* wip, client use new route

* update tests for members/send-private-message

* tests for get user in v4

* add tests for DELETE /inbox/messages/:messageId

* add tests for DELETE /inbox/clear in v4

* update docs

* fix tests

* initial migration

* fix migration

* fix migration

* migration fixes

* migrate api.enterCouponCode

* migrate api.castSpell

* migrate reset, reroll, rebirth

* add routes to v4 version

* fix tests

* fixes

* api.updateUser

* remove .only

* get user -> userLib

* refactor inbox.vue to work with new data model

* fix return message when messaging yourself

* wip fix bug with new conversation

* wip

* fix remaining ui issues

* move api.registerLocal, fixes

* keep only v3 version of GET /inbox/messages

* Fix API early Stat Point allocation (#10680)

* Refactor hasClass check to common so it can be used in shared & server-side code

* Check that user has selected class before allocating stat points

* chore(event): end Ember Hatching Potions

* chore(analytics): reenable navigation tracking

* update bcrypt

* Point achievement modal links to main site (#10709)

* Animal ears after death (#10691)

* Animal Ears purchasable with Gold if lost in Death

* remove ears from pinned items when set is bought

* standardise css and error handling for gems and coins

* revert accidental new line

* fix client tests

* Reduce margin-bottom of checklist-item from 10px to -3px. (#10684)

* chore(i18n): update locales

* 4.61.1

* Position inn banner when window is resized

* feat(content): Subscriber Items and Magic Potions

* chore(sprites): compile

* chore(i18n): update locales

* 4.62.0

* Update inn banner handling

* Fix banner offset on initial load

* Fix minor issues.

* Issue: 10660 - Fixed. Changed default to Please Enter A Value (#10718)

* Issue: 10660 - Fixed. Changed default to Please Enter A Value

* Issue: 10660 - Fixed/revision 2 Changed default to Enter A Value

* chore(news): Bailey announcements

* chore(i18n): update locales

* 4.62.1

* adjust wiki link for usernameInfo string

https://github.com/HabitRPG/habitica-private/issues/7#issuecomment-425405425

* raise coverage for tasks api calls (#10029)

* - updates a group task - approval is required
- updates a group task with checklist

* add expect to test the new checklist length

* - moves tasks to a specified position out of length

* remove unused line

* website getter tasks tests

* re-add sanitizeUserChallengeTask

* change config.json.example variable to be a string not a boolean

* fix tests - pick the text / up/down props too

* fix test - remove changes on text/up/down - revert sanitize condition - revert sanitization props

* chore(i18n): update locales

* 4.62.2

* chore(news): Bailey

* chore(i18n): update locales

* 4.62.3

* inbox: fix avatar display and order

* Username announcement (#10729)

* Change update username API call

The call no longer requires a password and also validates the username.

* Implement API call to verify username without setting it

* Improve coding style

* Apply username verification to registration

* Update error messages

* Validate display names.

* Fix API early Stat Point allocation (#10680)

* Refactor hasClass check to common so it can be used in shared & server-side code

* Check that user has selected class before allocating stat points

* chore(event): end Ember Hatching Potions

* chore(analytics): reenable navigation tracking

* update bcrypt

* Point achievement modal links to main site (#10709)

* Animal ears after death (#10691)

* Animal Ears purchasable with Gold if lost in Death

* remove ears from pinned items when set is bought

* standardise css and error handling for gems and coins

* revert accidental new line

* fix client tests

* Reduce margin-bottom of checklist-item from 10px to -3px. (#10684)

* chore(i18n): update locales

* 4.61.1

* feat(content): Subscriber Items and Magic Potions

* chore(sprites): compile

* chore(i18n): update locales

* 4.62.0

* Display notification for users to confirm their username

* fix typo

* WIP(usernames): Changes to address #10694

* WIP(usernames): Further changes for #10694

* fix(usernames): don't show spurious headings

* Change verify username notification to new version

* Improve feedback for invalid usernames

* Allow user to set their username again to confirm it

* Improve validation display for usernames

* Temporarily move display name validation outside of schema

* Improve rendering banner about sleeping in the inn

See #10695

* Display settings in one column

* Position inn banner when window is resized

* Update inn banner handling

* Fix banner offset on initial load

* Fix minor issues.

* Issue: 10660 - Fixed. Changed default to Please Enter A Value (#10718)

* Issue: 10660 - Fixed. Changed default to Please Enter A Value

* Issue: 10660 - Fixed/revision 2 Changed default to Enter A Value

* chore(news): Bailey announcements

* chore(i18n): update locales

* 4.62.1

* adjust wiki link for usernameInfo string

https://github.com/HabitRPG/habitica-private/issues/7#issuecomment-425405425

* raise coverage for tasks api calls (#10029)

* - updates a group task - approval is required
- updates a group task with checklist

* add expect to test the new checklist length

* - moves tasks to a specified position out of length

* remove unused line

* website getter tasks tests

* re-add sanitizeUserChallengeTask

* change config.json.example variable to be a string not a boolean

* fix tests - pick the text / up/down props too

* fix test - remove changes on text/up/down - revert sanitize condition - revert sanitization props

* Change update username API call

The call no longer requires a password and also validates the username.

* feat(content): Subscriber Items and Magic Potions

* Re-add register call

* Fix merge issue

* Fix issue with setting username

* Implement new alert style

* Display username confirmation status in settings

* Add disclaimer to change username field

* validate username in settings

* Allow specific fields to be focused when opening site settings

* Implement requested changes.

* Fix merge issue

* Fix failing tests

* verify username when users register with username and password

* Set ID for change username notification

* Disable submit button if username is invalid

* Improve username confirmation handling

* refactor(settings): address remaining code comments on auth form

* Revert "refactor(settings): address remaining code comments on auth form"

This reverts commit 9b6609ad64.

* Social user username (#10620)

* Refactored private functions to library

* Refactored social login code

* Added username to social registration

* Changed id library

* Added new local auth check

* Fixed export error. Fixed password check error

* fix(settings): password not available on client

* refactor(settings): more sensible placement of methods

* chore(migration): script to hand out procgen usernames

* fix(migration): don't give EVERYONE new names you doofus

* fix(migration): limit data retrieved, be extra careful about updates

* fix(migration): use missing field, not migration tag, for query

* fix(migration): unused var

* fix(usernames): only generate 20 characters

* fix(migration): set lowerCaseUsername

* fix(lint): comma

* fix(lint): comma spacing

* chore(i18n): update locales

* 4.63.0

* chore(news): Bailey

* chore(i18n): update locales

* 4.63.1

* fix(usernames): various
Reword invalid characters error
Correct typo in slur error
Remove extraneous Confirm button
Reset username field if empty on blur
Restore ability to add local auth to social login

* fix(auth): account for new username paradigm in add-local flow

* fix(auth): alert on successful addLocal

* chore(i18n): update locales

* 4.63.2

* fix(auth): Don't try to check existing username on new reg

* 4.63.3

* feat(content): Armoire and BGs 2018/10

* chore(sprites): compile

* fix(passport): use graph API v2.8

* chore(i18n): update locales

* 4.64.0

* Begin refactoring news API to return individual markdown posts

* Implement simple bailey CMS

* remove old news markdown

* Correctly display images in bailey modal

* Remove need for newStuff migration

* Add basic tests

* Fix authentication issue

* Fix tests

* Update news model

* add API route to get single post

* remove news admin frontend code

* fix lint error

* Fix merge mixups

* Fix lint errors

* fix api call

* fix lint error

* Fix issues caused by merging

* remove console log

* Improve news display

* Correctly update users notifications

* Fix date display for news posts

* Fix tests

* remove old cache file

* correctly create date

* correctly create promise

* Better check for existance.

* Improve docs

* Fix minor issues

* Add method to get latest post

* fix lint errors

* use correct call for 404

* add comment about old newStuff field

* paginate news

* Fix lint errors

* Remove unnecessary await

* Fix broken tests

* ...

* correct existence check

* fix database queries

* change approach to cached news posts

* fix tests

* Change how news posts are cached

* Fetch last news post at an interval

* Fix typos and other small things

* add new permission for modifying bailey posts

* add test for ensureNewsPoster

* return last news post with legacy api

* Fix test

* Hopefully fix test

* change fields to _id

* Fixes

* Fixes

* fix test

* Fixes

* make all tests pass

* fix lint

* id -> _id

* _id -> id

* remove identical tell me later route from api v4

* fix lint

* user model: fix issues with newStuff

* improve user#toJSONTransform

* fix typo

* improve newsPost.js

* fix(integration tests): do not return flags.newStuff if it was not selected

* fix news controller

* server side fixes, start refactoring client

* more client fixes

* automatically set author

* new stuff: show one post per user + drafts

* change default border radius for modals to 8px

* required fields and defaults

* slit news into its own component and fix static page

* noNewsPoster: move from i18n to apiError

* remove unused strings

* fix unit tests

* update apidocs

* add backward comparibility for flags.newStuff in api v3

* fix integration tests

* POST news: make integration test independent of number of posts

* api v3 news: render markdown

* static new-stuff: add padding and fix when user not logged in

* test flags.newStuff

* api v3: test setting flags.newStuff on PUT /user

* refactor news post cache and add tests

* remove new locales file

* more resilient tests

* more resilient tests

* refactor tests for NewsPost.updateLastNewsPost

* api v4: fix tests

* api v3: fix tests

* can set flags.newStuff in api v4

Co-authored-by: Keith Holliday <keithrholliday@gmail.com>
Co-authored-by: Sabe Jones <sabrecat@gmail.com>
Co-authored-by: Alys <Alys@users.noreply.github.com>
Co-authored-by: Matteo Pagliazzi <matteopagliazzi@gmail.com>
Co-authored-by: Carl Vuorinen <carl.vuorinen@gmail.com>
Co-authored-by: Rene Cordier <rene.cordier@gmail.com>
Co-authored-by: Forrest Hatfield <github@forresthatfield.com>
Co-authored-by: lucubro <88whacko@gmail.com>
Co-authored-by: negue <negue@users.noreply.github.com>
Co-authored-by: Alys <alice.harris@oldgods.net>
Co-authored-by: J.D. Sandifer <sandifer.jd@gmail.com>
Co-authored-by: Kirsty <kirsty-tortoise@users.noreply.github.com>
Co-authored-by: beatscribe <rattjp@gmail.com>
Co-authored-by: Phillip Thelen <phillip@habitica.com>
2020-10-13 10:15:52 -05:00
Matteo Pagliazzi
9a07ba7417 Better XSS Fix (#12483)
* Revert "fix(test): adjust expectations"

This reverts commit 205436d5b1.

* Revert "fix(escaping): global inoffensive apostrophe"

This reverts commit 2b8f94b244.

* change <%- to <%=

* fix interpolation only where necessary

* remove unused variable
2020-08-20 13:41:46 -05:00
Sabe Jones
205436d5b1 fix(test): adjust expectations 2020-08-15 11:56:47 -05:00
Jalansh
c0bf2cffea Casting Chilling Frost and Stealth skill again will not be processed and return an error instead. Fixes #12361. (#12404)
* Added logic for a repeating Chilling Frost skill. Added test case for redundant chilling frost skill cast. Added comments for the logic of repeating Stealth skill because of an error.

* Added logic for a repeating Stealth skill. Avoiding MP reduction still pending because of console error. Test cases pending.

* Completed the logic for a repeated Stealth skill. Added repeated frost skill cast check in common. Removed exclusive test. Test cases are pending.

* Added test case for Stealth skill recast. Fixed lint errors. Fixed a flaw in if statement which led to test case failure.

* Fixed lint errors in test case.

* Added a common JSON entry for skil recasts in three files. Other files remaining. Added Chilling Frost recast check in common code. Modified test cases.

* Added spellDisabled condition in client code.

* Reverted JSON messages for three languages. Added spellAlreadyCast attribute to JSON file in locales/en. Made changes for showing appropriate message in client code.

* Added an import for throwing BadRequest in common code. Modified test case accordingly.

* Update website/common/script/content/spells.js

Co-authored-by: Matteo Pagliazzi <matteopagliazzi@gmail.com>

* Added target and req attributes in cast() method arguments.

* Changed common code test case because of increased function parameters. Moved chilling frost test casse to common tests instead of server tests.

* Changed the test case format in common tests.

* Added a missing done statement.

* Fixed a minor error which led to failing test case. Removed the exclusive test which led to lint error.

* Fixed lint errors.

* Added a class named 'disabled' for the frontend change.

* fix(skills): style cleanup

* fix(skills): unfix

Co-authored-by: Matteo Pagliazzi <matteopagliazzi@gmail.com>
Co-authored-by: Sabe Jones <sabrecat@gmail.com>
2020-08-09 18:25:59 +02:00
Amber
ead0b6c56f PR to fix: Disallow line breaks in display names (#12380)
* Update settings.json

* Update index.js

* Update validation.js

* Update validation.js

* Update validation.js

Removes the second check

* Update tests and validation

Added tests, and updated validation
2020-07-18 22:41:19 +02:00
PitiTheGrey
e89ff95a21 Add Bulk Feed via query parameter (#12384)
* Update feed.js

New Tests for bulk feeding

* Update POST-user_feed_pet_food.test.js

Added test for bulk-feeding

* Update user.js

Added 'query paramter' for bulk feeding

* Update pets.json

Added "tooMuchFood" for bulk feeding pets

* Update feed.js

Added query parameter option for bulk feeding pets.

* Update feed.js

fixing lint
(bulk feeding)

* Update POST-user_feed_pet_food.test.js

adjustments for testing bulk feeding

* Update feed.js

Bulk feeding 
amount as integer

* Update pets.json

added invalidAmount for bulk feeding

* Update feed.js

Bulk feeding  
Error handling

* Update feed.js

Bulk - feed  
no hardcoded values

* Update pets.json

Get rid of my german accent.
2020-07-13 16:04:03 +02:00
Matteo Pagliazzi
3d5630d5a2 chore: update sub-deps and fix lint 2020-07-01 18:20:18 +02:00
negue
1c94c1a968 fix: return full inbox on user-v3-api (#12146)
* fix inbox on user-v3-api + test

* add @benkelaar suggestions
2020-05-02 21:48:16 +02:00
negue
26767f598b API: Adding secret.text to the user-schema (#12121) 2020-05-02 19:59:05 +02:00
Bart Enkelaar
dc9800d88a Don't bill (subtract gems) multiple times for multiple unlock item set calls (#12116)
* Issue 11050 - Small tuneups to unlock.js

- Use includes i.o. indexOf
- Extract small function for object setting duplication
- Use every instead of custom counter

* Issue 11050 - Properly store purchased items when purchasing them

* Issue 11050 - Couple more tuneups in unlock.js and implemented partial failure scenario

* Issue 11050 - Fix last lint issue

* Issue 11050 - Check path for gear i.o. failing to write it to purchased

* Issue 11050 - Guarantee variation coverage in tests

* Issue 11050 - Use startsWith instead of includes for background check

* Issue 11050 - Don't unlock lost items
2020-04-24 16:16:34 +02:00
Phillip Thelen
9d16ab7dba Sign in with Apple (#11793)
* add date check

* achievements modal polishing

* refresh private-messages page when you are already on it

* add countbadge knob to change the example

* fix lint

* typos

* typos

* typos

* add toggle for achievements categories

* typo

* fix test

* fix edit avatar modal cannot be closed

* WIP(settings): subscriber page improvements

* WIP(subscriptions): more design build-out

* fix(css): disabled button styles

* fix(css): better Amazon targeting

* fix hide tooltip + align header correctly

* disable perfect scroll

* load messages on refresh event

* fix header label + conversation actions not breaking layout on hover

* WIP(g1g1): notif

* WIP(g1g1): notif cont'd

* fix(test): snowball change

* fix(event): feature NYE card

* chore(sprites): compile

* fix(bgs): include TT required field

* add gifting banner to the max height calculation

* chore(event): enable winter customizations

* WIP(gifting): partial modal implementation

* feat(gifting): select giftee modal

* fix(gifting): notification order, modal dismiss

* Begin implementing sign in with apple

# Conflicts:
#	package-lock.json
#	website/common/script/constants.js
#	website/server/libs/auth/social.js
#	website/server/models/user/schema.js

* Add apple sign in button to website

* fix lint errors

* fix config json

* fix(modals): correct some repops

* fix(gifting): style updates

* fix(buy): modal style changes

* fix(modals): also clean out "prev"

* Attempt workaround for sign in with apple on android

* temporarily log everything as error

* refactor(modals): hide in dismiss event

* fix temporary test failure

* changes to sign in with apple

* fix: first batch of layout issues for private messages + auto sizing textarea

* fix(modals): new dismiss logic

* fix(modals): new dismiss no go??

* Only use email scope

* print debugging

* .

* ..

* ...

* username second line - open profile on face-avatar/conversation name - fix textarea height

* temporarily disable apple auth and just return data for debugging

* Hopefully this works

* .....

* WIP(subscription): unsubscribed state

* .

* ..

* MAYBE THIS ACTUALLY WORKS???

* Implement apple sign in

* fix some urls

* fix urls

* fix redirect and auth

* attempt to also request name

* fix lint error

* WIP(subscription): partial subscribed

* chore(sprites): compile

* Change approach so that it actually works

* fix config error

* fix lint errors

* Fix

* fix lint error

* lint error

* WIP(subscription): finish subscribed

* refresh on sync

* new "you dont have any messages" style + changed min textarea height

* new conversationItem style / layout

* reset message unread on reload

* chore(npm): update package-locks

* fix styles / textarea height

* feat(subscription): revised sub page RC

* list optOut / chatRevoked informations for each conversation + show why its disabled

* Improve apple redirect view

* Fix apple icon on group task registration page

* WIP(adventure): prereqs

* Block / Unblock - correct disabled states - $gray-200 instead of 300/400

* canReceive not checking chatRevoked

* fix: faceAvatar / userLink open the selected conversation user

* check if the target user is blocking the logged-in user

* fix(subs): style tweaks

* fix(profiles): short circuit contributor
Attempted fix for #11830

* chore(sprites): compile

* fix(content): missing potion data

* fix(content): missing string

* WIP(drops): new modal

* fix(subs): moar style tweaks

* check if blocks is undefined

* max-height instead of height

* fix "no messages" state + canReceive on a new conversation

* WIP(adventure): analytics fixes etc

* Improve apple signin handling

* fixed conversations width (280px on max 768 width page)

* feat(adventure): random egg+potion on 2nd task

* fix(lint): noworkies

* fix(modal): correctly construct classes

* fix(tests): expectations and escape

* Fix typo

* use base url from env variables

* fix lint

* call autosize after message is sent

* fix urls

* always verify token

* throw error when social auth could not retrieve id

* Store emails correctly for apple auth

* Retrieve name when authenticating through apple

* Fix lint errors

* fix all lint errors

* fix(content): missing strings

* Revert "always verify token"

This reverts commit 8ac40c76bf.

# Conflicts:
#	website/server/libs/auth/social.js

* Correctly load name

* remove extra changes

* remove extra logger call

* reset package and package-lock

* add back missing packages

* use name from apple

* add support for multiple apple public keys

* add some unit and integration tests

* add apple auth integration test

* tweak social signup buttons

* pixel pushing

Co-authored-by: Matteo Pagliazzi <matteopagliazzi@gmail.com>
Co-authored-by: Sabe Jones <sabrecat@gmail.com>
Co-authored-by: negue <eugen.bolz@gmail.com>
Co-authored-by: Phillip Thelen <phillip@habitica.com>
2020-04-08 18:44:30 +02:00
Sabe Jones
bd8e67a2ea Adventure Guide Prep (#11883)
* WIP(adventure): prereqs

* WIP(drops): new modal

* WIP(adventure): analytics fixes etc

* feat(adventure): random egg+potion on 2nd task

* fix(lint): noworkies

* fix(modal): correctly construct classes

* fix(tests): expectations and escape

* fix(first-drops): address comments

* fix(first-drops): don't give random drops until first drops

* fix(drops): remove more Level 3 references

* refactor(drops): no need for cloning

* refactor(drops): unnecessary export

* fix(first-drops): force sync

* fix(first-drops): move to server

* fix(first-drops): escape in case we get here with >0 items

* fix(lint): line length

* fix(pet-food): remove unused string
2020-03-07 13:03:13 -06:00
Yo
04a9c97393 Fix Typos (#11644)
* Fix Typos

* Fix More Typos
2019-12-23 17:52:55 +01:00
Matteo Pagliazzi
e4edab2b9d Minimum password length + Static Pages fixes (was #11474) (#11506)
* Revert "Revert "Minimum password length + Static Pages fixes (#11474)""

This reverts commit d1afbf4b92.

* add min length for reset password
2019-12-18 19:02:15 +01:00
Xaz16
60a12e8090 after merge 2019-10-28 23:15:45 +03:00
Sabe Jones
51726d8d8e fix(pets): correct achievement logic 2019-10-23 08:21:51 -05:00
Sabe Jones
2b8e25833d fix(schema): add missing notif types 2019-10-23 08:10:43 -05:00
Matteo Pagliazzi
a1e3127d36 fix mongoose issue 2019-10-13 18:31:43 +02:00
Matteo Pagliazzi
85fb5f33aa fix test lint 2019-10-08 20:45:38 +02:00
Matteo Pagliazzi
90f732f545 Revert "Revert "Fix: Antidotes to Avatar Transformation Items should be added to Rewards by API (#11353)" (#11406)"
This reverts commit 50cae0165c.
2019-10-07 16:55:55 +02:00
Matteo Pagliazzi
50cae0165c Revert "Fix: Antidotes to Avatar Transformation Items should be added to Rewards by API (#11353)" (#11406)
This reverts commit 5b57d91a9b.
2019-10-07 16:55:44 +02:00
Aleksey
5b57d91a9b Fix: Antidotes to Avatar Transformation Items should be added to Rewards by API (#11353)
* Fix: moved debuffPotions from vue component

- Move logic of choosing proper debuf potion from vue component to website commons
- introduce new function to get debuffSpellItems

* Fix: move debuffPotions to server

* Refactoring: move setting of debuff potion to func

* Fix: sanity

* Refactoring & Tests:

- Create test case for get and set DebuffPotionItems functions
- Fix setDebuffPotionItems function to not create duplicated debuff items
- Make debuff potion type of items unpinnable
- Move list of debuffs to constant to reuse it in tests and functions

* Fix: typo in test describe

* Fix: translation of unpin

* Fix: setDebuffPotionItems on cron buffs reset

* Fix: use full path for debuff potions
2019-10-06 18:41:39 +02:00
Sabe Jones
fc841d0ad4 Hourglass Quest (#11325)
* feat(content): Hourglass Quest

* fix(hourglasses): NaN from undefined

* fix(quests): sanity check for negative scrolls

* fix(hourglasses): don't show quantity selection for binary items

* fix(route): validate number, use body not params

* test(timetrav): add quest tests
2019-08-29 15:22:12 -04:00
Phillip Thelen
6784d23a7c Add translated gear name to open-mystery-item call (#11306)
* Add translated gear name to open-mystery-item call

* Fix test

* fix mystery item text language
2019-08-16 19:40:49 +02:00
Chester Sng
87d86ee632 Add test case for user that uses social authentication 2019-03-23 20:04:09 +08:00
Sabe Jones
f42e22b58f Make env vars more palatable for containerization (#10895)
* refactor(env-vars): remove object/colon syntax

* fix(tests): correct config expectations
2018-12-06 10:13:49 -06:00