4.157.0

and Turquoise Bailey

.dockerignore

@@ -1,3 +1,2 @@
 node_modules
 .git
-website

.eslintignore

@@ -10,6 +10,7 @@ dist/
 dist-client/
 apidoc_build/
 content_cache/
+i18n_cache/
 node_modules/
 
 # Old migrations, disabled

.github/CONTRIBUTING.md

@@ -8,13 +8,8 @@
 
 # Requesting a feature
 
-Habitica uses [Trello](https://trello.com/b/EpoYEYod/habitica) to track feature requests. [Read more](https://trello.com/c/odmhIqyW/440-read-first-table-of-contents).
+Habitica uses [this Google form](https://docs.google.com/forms/d/e/1FAIpQLScPhrwq_7P1C6PTrI3lbvTsvqGyTNnGzp1ugi1Ml0PFee_p5g/viewform?usp=sf_link) to track feature requests. Please post there rather than creating an issue.
 
 # Contributing Code
 
 See [Contributing to Habitica](http://habitica.fandom.com/wiki/Contributing_to_Habitica#Coders_.28Web_.26_Mobile.29)
-
-## Issue Triage [![Open Source Helpers](https://www.codetriage.com/habitrpg/habitica/badges/users.svg)](https://www.codetriage.com/habitrpg/habitica)
-
-You can triage issues which may include reproducing bug reports or asking for vital information, such as version numbers or reproduction instructions. If you would like to start triaging issues, one easy way to get started is to [subscribe to habitrpg on CodeTriage](https://www.codetriage.com/habitrpg/habitica).
-

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,7 +1,7 @@
 [//]: # (Note: See http://habitica.fandom.com/wiki/Using_Your_Local_Install_to_Modify_Habitica%27s_Website_and_API for more info)
 
 [//]: # (Put Issue # here, if applicable. This will automatically close the issue if your PR is merged in)
-Fixes put_#_and_issue_numer_here
+Fixes put_#_and_issue_number_here
 
 ### Changes
 [//]: # (Describe the changes that were made in detail here. Include pictures if necessary)

.github/workflows/test.yml

@@ -22,6 +22,7 @@ jobs:
         npm ci
       env:
         CI: true
+        NODE_ENV: test
     - run: npm run lint-no-fix
   apidoc:
     runs-on: ubuntu-latest
@@ -42,6 +43,7 @@ jobs:
         npm ci
       env:
         CI: true
+        NODE_ENV: test
     - run: npm run apidoc
   sanity:
     runs-on: ubuntu-latest
@@ -62,6 +64,7 @@ jobs:
         npm ci
       env:
         CI: true
+        NODE_ENV: test
     - run: npm run test:sanity
   
   common:
@@ -83,6 +86,7 @@ jobs:
         npm ci
       env:
         CI: true
+        NODE_ENV: test
     - run: npm run test:common
   content:
     runs-on: ubuntu-latest
@@ -103,6 +107,7 @@ jobs:
         npm ci
       env:
         CI: true
+        NODE_ENV: test
     - run: npm run test:content
   
   api-unit:
@@ -110,6 +115,7 @@ jobs:
     strategy:
       matrix:
         node-version: [12.x]
+        mongodb-version: [4.2]
     steps:
     - uses: actions/checkout@v1
       with:
@@ -118,13 +124,18 @@ jobs:
       uses: actions/setup-node@v1
       with:
         node-version: ${{ matrix.node-version }}
-    - run: sudo docker run --name mongo -d -p 27017:27017 mongo
+    - name: Start MongoDB ${{ matrix.mongodb-version }} Replica Set
+      uses: supercharge/mongodb-github-action@1.3.0
+      with:
+        mongodb-version: ${{ matrix.mongodb-version }}
+        mongodb-replica-set: rs
     - run: cp config.json.example config.json
     - name: npm install
       run: |
         npm ci
       env:
         CI: true
+        NODE_ENV: test
     - run: npm run test:api:unit
       env:
         REQUIRES_SERVER=true: true
@@ -133,6 +144,7 @@ jobs:
     strategy:
       matrix:
         node-version: [12.x]
+        mongodb-version: [4.2]
     steps:
     - uses: actions/checkout@v1
       with:
@@ -141,13 +153,18 @@ jobs:
       uses: actions/setup-node@v1
       with:
         node-version: ${{ matrix.node-version }}
-    - run: sudo docker run --name mongo -d -p 27017:27017 mongo
+    - name: Start MongoDB ${{ matrix.mongodb-version }} Replica Set
+      uses: supercharge/mongodb-github-action@1.3.0
+      with:
+        mongodb-version: ${{ matrix.mongodb-version }}
+        mongodb-replica-set: rs
     - run: cp config.json.example config.json
     - name: npm install
       run: |
         npm ci
       env:
         CI: true
+        NODE_ENV: test
     - run: npm run test:api-v3:integration
       env:
         REQUIRES_SERVER=true: true
@@ -156,6 +173,7 @@ jobs:
     strategy:
       matrix:
         node-version: [12.x]
+        mongodb-version: [4.2]
     steps:
     - uses: actions/checkout@v1
       with:
@@ -164,13 +182,18 @@ jobs:
       uses: actions/setup-node@v1
       with:
         node-version: ${{ matrix.node-version }}
-    - run: sudo docker run --name mongo -d -p 27017:27017 mongo
+    - name: Start MongoDB ${{ matrix.mongodb-version }} Replica Set
+      uses: supercharge/mongodb-github-action@1.3.0
+      with:
+        mongodb-version: ${{ matrix.mongodb-version }}
+        mongodb-replica-set: rs
     - run: cp config.json.example config.json
     - name: npm install
       run: |
         npm ci
       env:
         CI: true
+        NODE_ENV: test
     - run: npm run test:api-v4:integration
       env:
         REQUIRES_SERVER=true: true
@@ -194,5 +217,6 @@ jobs:
         npm ci
       env:
         CI: true
+        NODE_ENV: test
     - run: npm run test:unit
       working-directory: ./website/client

.gitignore

@@ -4,6 +4,7 @@ website/transpiled-babel/
 website/common/transpiled-babel/
 node_modules
 content_cache
+i18n_cache
 apidoc_build
 *.swp
 .idea*
@@ -37,3 +38,12 @@ yarn.lock
 .elasticbeanstalk/*
 !.elasticbeanstalk/*.cfg.yml
 !.elasticbeanstalk/*.global.yml
+
+/.vscode
+
+# webstorm fake webpack for path intellisense
+webpack.webstorm.config
+
+# mongodb replica set for local dev
+mongodb-*.tgz
+/mongodb-data

.nodemonignore

@@ -1,4 +1,6 @@
 node_modules/**
+content_cache
+content_cache/**
 website/client/**
 test/**
 .git/**
@@ -7,3 +9,4 @@ test/**
 *.swp
 *.swx
 website/raw_sprites/**
+content_cache/**

Dockerfile

@@ -1,6 +1,7 @@
 FROM node:12
 
 ENV ADMIN_EMAIL admin@habitica.com
+ENV EMAILS_COMMUNITY_MANAGER_EMAIL admin@habitica.com
 ENV AMAZON_PAYMENTS_CLIENT_ID amzn1.application-oa2-client.68ed9e6904ef438fbc1bf86bf494056e
 ENV AMAZON_PAYMENTS_SELLER_ID AMQ3SB4SG5E91
 ENV AMPLITUDE_KEY e8d4c24b3d6ef3ee73eeba715023dd43
@@ -11,6 +12,7 @@ ENV GOOGLE_CLIENT_ID 1035232791481-32vtplgnjnd1aufv3mcu1lthf31795fq.apps.googleu
 ENV LOGGLY_CLIENT_TOKEN ab5663bf-241f-4d14-8783-7d80db77089a
 ENV NODE_ENV production
 ENV STRIPE_PUB_KEY pk_85fQ0yMECHNfHTSsZoxZXlPSwSNfA
+ENV APPLE_AUTH_CLIENT_ID 9Q9SMRMCNN.com.habitrpg.ios.Habitica
 
 # Install global packages
 RUN npm install -g gulp-cli mocha

Dockerfile-Dev

@@ -1,5 +1,14 @@
-FROM node:12
-WORKDIR /code
-COPY package*.json /code/
-RUN npm install
-RUN npm install -g gulp-cli mocha
+FROM node:12
+
+# Install global packages
+RUN npm install -g gulp-cli mocha
+
+# Copy package.json and package-lock.json into image, then install
+# dependencies.
+WORKDIR /usr/src/habitica
+COPY ["package.json", "package-lock.json", "./"]
+RUN npm install
+
+# Copy the remaining source files in.
+COPY . /usr/src/habitica
+RUN npm run postinstall

LICENSE

@@ -1,6 +1,6 @@
 * Code is GPL v3 licensed:
 This Source Code is subject to the terms of the GNU General Public License, v. 3.0.
-If a copy of the GPL was not distributed with this file, You can obtain one at http://www.gnu.org/licenses/gpl-3.0.txt
+If a copy of the GPL was not distributed with this file, you can obtain one at http://www.gnu.org/licenses/gpl-3.0.txt
 
 * Assets and content designed for Mozilla BrowserQuest are licensed under CC-BY-SA 3.0:
 http://creativecommons.org/licenses/by-sa/3.0/

README.md

@@ -1,8 +1,6 @@
-Habitica ![Build Status](https://github.com/HabitRPG/habitica/workflows/Test/badge.svg) [![Code Climate](https://codeclimate.com/github/HabitRPG/habitrpg.svg)](https://codeclimate.com/github/HabitRPG/habitrpg) [![Bountysource](https://api.bountysource.com/badge/tracker?tracker_id=68393)](https://www.bountysource.com/trackers/68393-habitrpg?utm_source=68393&utm_medium=shield&utm_campaign=TRACKER_BADGE) [![Open Source Helpers](https://www.codetriage.com/habitrpg/habitica/badges/users.svg)](https://www.codetriage.com/habitrpg/habitica)
+Habitica ![Build Status](https://github.com/HabitRPG/habitica/workflows/Test/badge.svg) [![Code Climate](https://codeclimate.com/github/HabitRPG/habitrpg.svg)](https://codeclimate.com/github/HabitRPG/habitrpg) [![Bountysource](https://api.bountysource.com/badge/tracker?tracker_id=68393)](https://www.bountysource.com/trackers/68393-habitrpg?utm_source=68393&utm_medium=shield&utm_campaign=TRACKER_BADGE)
 ===============
 
-[![Greenkeeper badge](https://badges.greenkeeper.io/HabitRPG/habitica.svg)](https://greenkeeper.io/)
-
 [Habitica](https://habitica.com) is an open source habit building program which treats your life like a Role Playing Game. Level up as you succeed, lose HP as you fail, earn money to buy weapons and armor.
 
 **We need more programmers!** Your assistance will be greatly appreciated. The wiki pages below and the additional pages they link to will tell you how to get started on contributing code and where you can go to seek further help or ask questions:

apidoc.json

@@ -2,6 +2,10 @@
   "name": "Habitica V3 API Documentation",
   "title": "Habitica",
   "url": "https://habitica.com",
+  "header": {
+    "title": "Introduction",
+    "filename": "apidoc/header.md"
+  },
   "template": {
     "withCompare": false
   }

apidoc/header.md

@@ -0,0 +1,5 @@
+# Introduction
+
+This webpage includes the documentation for version 3 of the [Habitica](https://habitica.com) API.
+
+If you're developing a 3rd party tool that uses the Habitica API you should read the [Guidance for Comrades](https://habitica.fandom.com/wiki/Guidance_for_Comrades) and in particular the section called [Rules for Third-Party Tools](https://habitica.fandom.com/wiki/Guidance_for_Comrades#Rules_for_Third-Party_Tools) which includes suggestions on how to best use the API and the rules to follow when interacting with it. 

config.json.example

@@ -32,7 +32,8 @@
   "LOGGLY_SUBDOMAIN": "example-subdomain",
   "LOGGLY_TOKEN": "example-token",
   "MAINTENANCE_MODE": "false",
-  "NODE_DB_URI": "mongodb://localhost/habitrpg",
+  "NODE_DB_URI": "mongodb://localhost:27017/habitica-dev?replicaSet=rs",
+  "TEST_DB_URI": "mongodb://localhost:27017/habitica-test?replicaSet=rs",
   "MONGODB_POOL_SIZE": "10",
   "NODE_ENV": "development",
   "PATH": "bin:node_modules/.bin:/usr/local/bin:/usr/bin:/bin",
@@ -70,9 +71,18 @@
   "SLACK_URL": "https://hooks.slack.com/services/some-url",
   "STRIPE_API_KEY": "aaaabbbbccccddddeeeeffff00001111",
   "STRIPE_PUB_KEY": "22223333444455556666777788889999",
-  "TEST_DB_URI": "mongodb://localhost/habitrpg_test",
   "TRANSIFEX_SLACK_CHANNEL": "transifex",
   "WEB_CONCURRENCY": 1,
   "SKIP_SSL_CHECK_KEY": "key",
-  "ENABLE_STACKDRIVER_TRACING": "false"
+  "ENABLE_STACKDRIVER_TRACING": "false",
+  "APPLE_AUTH_PRIVATE_KEY": "",
+  "APPLE_TEAM_ID": "",
+  "APPLE_AUTH_CLIENT_ID": "",
+  "APPLE_AUTH_KEY_ID": "",
+  "BLOCKED_IPS": "",
+  "LOG_AMPLITUDE_EVENTS": "false",
+  "RATE_LIMITER_ENABLED": "false",
+  "REDIS_HOST": "aaabbbcccdddeeefff",
+  "REDIS_PORT": "1234",
+  "REDIS_PASSWORD": "12345678"
 }

docker-compose.dev.yml

@@ -15,8 +15,9 @@ services:
     ports:
       - "8080:8080"
     volumes:
-      - .:/code
-      - /code/node_modules
+      - .:/usr/src/habitica
+      - /usr/src/habitica/node_modules
+      - /usr/src/habitica/website/client/node_modules
   server:
     build:
       context: .
@@ -32,8 +33,8 @@ services:
     ports:
       - "3000:3000"
     volumes:
-      - .:/code
-      - /code/node_modules
+      - .:/usr/src/habitica
+      - /usr/src/habitica/node_modules
   mongo:
     image: mongo:3.6
     networks:

gulp/gulp-build.js

@@ -1,19 +1,88 @@
-import gulp from 'gulp';
-import babel from 'gulp-babel';
+/* eslint-disable no-console */
 
-gulp.task('build:src', () => gulp.src('website/server/**/*.js')
+import gulp from 'gulp';
+import path from 'path';
+import babel from 'gulp-babel';
+import os from 'os';
+import fs from 'fs';
+import spawn from 'cross-spawn'; // eslint-disable-line import/no-extraneous-dependencies
+import clean from 'rimraf';
+
+gulp.task('build:babel:server', () => gulp.src('website/server/**/*.js')
   .pipe(babel())
   .pipe(gulp.dest('website/transpiled-babel/')));
 
-gulp.task('build:common', () => gulp.src('website/common/script/**/*.js')
+gulp.task('build:babel:common', () => gulp.src('website/common/script/**/*.js')
   .pipe(babel())
   .pipe(gulp.dest('website/common/transpiled-babel/')));
 
-gulp.task('build:server', gulp.series('build:src', 'build:common', done => done()));
+gulp.task('build:babel', gulp.parallel('build:babel:server', 'build:babel:common', done => done()));
+
+gulp.task('build:cache', gulp.parallel(
+  'cache:content',
+  'cache:i18n',
+  done => done(),
+));
 
 gulp.task('build:prod', gulp.series(
-  'build:server',
+  'build:babel',
   'apidoc',
+  'build:cache',
+  done => done(),
+));
+
+// Due to this issue https://github.com/vkarpov15/run-rs/issues/45
+// When used on windows `run-rs` must first be run without the `--keep` option
+// in order to be setup correctly, afterwards it can be used.
+
+const MONGO_PATH = path.join(__dirname, '/../mongodb-data/');
+
+gulp.task('build:prepare-mongo', async () => {
+  if (fs.existsSync(MONGO_PATH)) {
+    // console.log('MongoDB data folder exists, skipping setup.');
+    return;
+  }
+
+  if (os.platform() !== 'win32') {
+    // console.log('Not on Windows, skipping MongoDB setup.');
+    return;
+  }
+
+  console.log('MongoDB data folder is missing, setting up.'); // eslint-disable-line no-console
+
+  // use run-rs without --keep, kill it as soon as the replica set starts
+  const runRsProcess = spawn('run-rs', ['-v', '4.2.8', '-l', 'ubuntu1804', '--dbpath', 'mongodb-data', '--number', '1', '--quiet']);
+
+  for await (const chunk of runRsProcess.stdout) {
+    const stringChunk = chunk.toString();
+    console.log(stringChunk); // eslint-disable-line no-console
+    // kills the process after the replica set is setup
+    if (stringChunk.includes('Started replica set')) {
+      console.log('MongoDB setup correctly.'); // eslint-disable-line no-console
+      runRsProcess.kill();
+    }
+  }
+
+  let error = '';
+  for await (const chunk of runRsProcess.stderr) {
+    const stringChunk = chunk.toString();
+    error += stringChunk;
+  }
+
+  const exitCode = await new Promise(resolve => {
+    runRsProcess.on('close', resolve);
+  });
+
+  if (exitCode || error.length > 0) {
+    // remove any leftover files
+    clean.sync(MONGO_PATH);
+
+    throw new Error(`Error running run-rs: ${error}`);
+  }
+});
+
+gulp.task('build:dev', gulp.series(
+  'build:prepare-mongo',
   done => done(),
 ));
 
@@ -21,6 +90,8 @@ const buildArgs = [];
 
 if (process.env.NODE_ENV === 'production') { // eslint-disable-line no-process-env
   buildArgs.push('build:prod');
+} else if (process.env.NODE_ENV !== 'test') { // eslint-disable-line no-process-env
+  buildArgs.push('build:dev');
 }
 
 gulp.task('build', gulp.series(buildArgs, done => {

gulp/gulp-cache.js

@@ -0,0 +1,63 @@
+import gulp from 'gulp';
+import fs from 'fs';
+
+// TODO parallelize, use gulp file helpers
+gulp.task('cache:content', done => {
+  // Requiring at runtime because these files access `common`
+  // code which in production works only if transpiled so after
+  // gulp build:babel:common has run
+  const { CONTENT_CACHE_PATH, getLocalizedContentResponse } = require('../website/server/libs/content'); // eslint-disable-line global-require
+  const { langCodes } = require('../website/server/libs/i18n'); // eslint-disable-line global-require
+
+  try {
+    // create the cache folder (if it doesn't exist)
+    try {
+      fs.mkdirSync(CONTENT_CACHE_PATH);
+    } catch (err) {
+      if (err.code !== 'EEXIST') throw err;
+    }
+
+    // clone the content for each language and save
+    // localize it
+    // save the result
+    langCodes.forEach(langCode => {
+      fs.writeFileSync(
+        `${CONTENT_CACHE_PATH}${langCode}.json`,
+        getLocalizedContentResponse(langCode),
+        'utf8',
+      );
+    });
+    done();
+  } catch (err) {
+    done(err);
+  }
+});
+
+gulp.task('cache:i18n', done => {
+  // Requiring at runtime because these files access `common`
+  // code which in production works only if transpiled so after
+  // gulp build:babel:common has run
+  const { BROWSER_SCRIPT_CACHE_PATH, geti18nBrowserScript } = require('../website/server/libs/i18n'); // eslint-disable-line global-require
+  const { langCodes } = require('../website/server/libs/i18n'); // eslint-disable-line global-require
+
+  try {
+    // create the cache folder (if it doesn't exist)
+    try {
+      fs.mkdirSync(BROWSER_SCRIPT_CACHE_PATH);
+    } catch (err) {
+      if (err.code !== 'EEXIST') throw err;
+    }
+
+    // create and save the i18n browser script for each language
+    langCodes.forEach(languageCode => {
+      fs.writeFileSync(
+        `${BROWSER_SCRIPT_CACHE_PATH}${languageCode}.js`,
+        geti18nBrowserScript(languageCode),
+        'utf8',
+      );
+    });
+    done();
+  } catch (err) {
+    done(err);
+  }
+});

gulp/gulp-console.js

@@ -3,6 +3,10 @@ import nconf from 'nconf';
 import repl from 'repl';
 import gulp from 'gulp';
 import logger from '../website/server/libs/logger';
+import {
+  getDevelopmentConnectionUrl,
+  getDefaultConnectionOptions,
+} from '../website/server/libs/mongodb';
 
 // Add additional properties to the repl's context
 const improveRepl = context => {
@@ -26,13 +30,14 @@ const improveRepl = context => {
   context.Group = require('../website/server/models/group').model; // eslint-disable-line global-require
   context.User = require('../website/server/models/user').model; // eslint-disable-line global-require
 
-  const isProd = nconf.get('NODE_ENV') === 'production';
-  const mongooseOptions = !isProd ? {} : {
-    keepAlive: 1,
-    connectTimeoutMS: 30000,
-  };
+  const IS_PROD = nconf.get('NODE_ENV') === 'production';
+  const NODE_DB_URI = nconf.get('NODE_DB_URI');
+
+  const mongooseOptions = getDefaultConnectionOptions();
+  const connectionUrl = IS_PROD ? NODE_DB_URI : getDevelopmentConnectionUrl(NODE_DB_URI);
+
   mongoose.connect(
-    nconf.get('NODE_DB_URI'),
+    connectionUrl,
     mongooseOptions,
     err => {
       if (err) throw err;

gulp/gulp-sprites.js

@@ -161,4 +161,4 @@ gulp.task('sprites:checkCompiledDimensions', gulp.series('sprites:main', 'sprite
   done();
 }));
 
-gulp.task('sprites:compile', gulp.series('sprites:clean', 'sprites:main', 'sprites:largeSprites', 'sprites:checkCompiledDimensions', done => done()));
+gulp.task('sprites:compile', gulp.series('sprites:clean', 'sprites:checkCompiledDimensions', done => done()));

gulp/gulp-tests.js

@@ -6,6 +6,10 @@ import nconf from 'nconf';
 import {
   pipe,
 } from './taskHelper';
+import {
+  getDevelopmentConnectionUrl,
+  getDefaultConnectionOptions,
+} from '../website/server/libs/mongodb';
 
 // TODO rewrite
 
@@ -44,7 +48,10 @@ gulp.task('test:nodemon', gulp.series(done => {
 }, 'nodemon'));
 
 gulp.task('test:prepare:mongo', cb => {
-  mongoose.connect(TEST_DB_URI, err => {
+  const mongooseOptions = getDefaultConnectionOptions();
+  const connectionUrl = getDevelopmentConnectionUrl(TEST_DB_URI);
+
+  mongoose.connect(connectionUrl, mongooseOptions, err => {
     if (err) return cb(`Unable to connect to mongo database. Are you sure it's running? \n\n${err}`);
     return mongoose.connection.dropDatabase(err2 => {
       if (err2) return cb(err2);
@@ -160,7 +167,7 @@ gulp.task('test:content:safe', gulp.series('test:prepare:build', cb => {
   pipe(runner);
 }));
 
-gulp.task('test:api:unit', done => {
+gulp.task('test:api:unit:run', done => {
   const runner = exec(
     testBin('istanbul cover --dir coverage/api-unit node_modules/mocha/bin/_mocha -- test/api/unit --recursive --require ./test/helpers/start-server'),
     err => {
@@ -174,9 +181,9 @@ gulp.task('test:api:unit', done => {
   pipe(runner);
 });
 
-gulp.task('test:api:unit:watch', () => gulp.watch(['website/server/libs/*', 'test/api/unit/**/*', 'website/server/controllers/**/*'], gulp.series('test:api:unit', done => done())));
+gulp.task('test:api:unit:watch', () => gulp.watch(['website/server/libs/*', 'test/api/unit/**/*', 'website/server/controllers/**/*'], gulp.series('test:api:unit:run', done => done())));
 
-gulp.task('test:api-v3:integration', done => {
+gulp.task('test:api-v3:integration', gulp.series('test:prepare:mongo', done => {
   const runner = exec(
     testBin('istanbul cover --dir coverage/api-v3-integration --report lcovonly node_modules/mocha/bin/_mocha -- test/api/v3/integration --recursive --require ./test/helpers/start-server'),
     { maxBuffer: 500 * 1024 },
@@ -189,7 +196,7 @@ gulp.task('test:api-v3:integration', done => {
   );
 
   pipe(runner);
-});
+}));
 
 gulp.task('test:api-v3:integration:watch', () => gulp.watch([
   'website/server/controllers/api-v3/**/*', 'common/script/ops/*', 'website/server/libs/*.js',
@@ -206,7 +213,7 @@ gulp.task('test:api-v3:integration:separate-server', done => {
   pipe(runner);
 });
 
-gulp.task('test:api-v4:integration', done => {
+gulp.task('test:api-v4:integration', gulp.series('test:prepare:mongo', done => {
   const runner = exec(
     testBin('istanbul cover --dir coverage/api-v4-integration --report lcovonly node_modules/mocha/bin/_mocha -- test/api/v4 --recursive --require ./test/helpers/start-server'),
     { maxBuffer: 500 * 1024 },
@@ -219,7 +226,7 @@ gulp.task('test:api-v4:integration', done => {
   );
 
   pipe(runner);
-});
+}));
 
 gulp.task('test:api-v4:integration:separate-server', done => {
   const runner = exec(
@@ -231,11 +238,17 @@ gulp.task('test:api-v4:integration:separate-server', done => {
   pipe(runner);
 });
 
+gulp.task('test:api:unit', gulp.series(
+  'test:prepare:mongo',
+  'test:api:unit:run',
+  done => done(),
+));
+
 gulp.task('test', gulp.series(
   'test:sanity',
   'test:content',
   'test:common',
-  'test:api:unit',
+  'test:api:unit:run',
   'test:api-v3:integration',
   'test:api-v4:integration',
   done => done(),

gulp/gulp-transifex-test.js

@@ -12,7 +12,6 @@ const SLACK_CONFIG = {
 const LOCALES = './website/common/locales/';
 const ENGLISH_LOCALE = `${LOCALES}en/`;
 
-
 function getArrayOfLanguages () {
   const languages = fs.readdirSync(LOCALES);
   languages.shift(); // Remove README.md from array of languages

gulpfile.js

@@ -13,8 +13,16 @@ const gulp = require('gulp');
 
 if (process.env.NODE_ENV === 'production') { // eslint-disable-line no-process-env
   require('./gulp/gulp-apidoc'); // eslint-disable-line global-require
+  require('./gulp/gulp-cache'); // eslint-disable-line global-require
   require('./gulp/gulp-build'); // eslint-disable-line global-require
 } else {
-  require('glob').sync('./gulp/gulp-*').forEach(require); // eslint-disable-line global-require
+  require('./gulp/gulp-apidoc'); // eslint-disable-line global-require
+  require('./gulp/gulp-cache'); // eslint-disable-line global-require
+  require('./gulp/gulp-build'); // eslint-disable-line global-require
+  require('./gulp/gulp-console'); // eslint-disable-line global-require
+  require('./gulp/gulp-sprites'); // eslint-disable-line global-require
+  require('./gulp/gulp-start'); // eslint-disable-line global-require
+  require('./gulp/gulp-tests'); // eslint-disable-line global-require
+  require('./gulp/gulp-transifex-test'); // eslint-disable-line global-require
   require('gulp').task('default', gulp.series('test')); // eslint-disable-line global-require
 }

migrations/archive/2019/20191125_onboarding_achievements.js

@@ -0,0 +1,109 @@
+/*
+ * Award Onboarding Achievements for existing users
+ */
+/* eslint-disable no-console */
+
+import { model as User } from '../../website/server/models/user';
+
+const MIGRATION_NAME = '20191218_onboarding_achievements';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count += 1;
+
+  const set = {};
+
+  set.migration = MIGRATION_NAME;
+
+  const hasPet = Object.keys(user.items.pets).find(petKey => {
+    const pet = user.items.pets[petKey];
+
+    if (pet >= 5) return true;
+    return false;
+  });
+
+  if (hasPet) {
+    set['achievements.hatchedPet'] = true;
+  }
+
+  const hasFedPet = Object.keys(user.items.pets).find(petKey => {
+    const pet = user.items.pets[petKey];
+
+    if (pet > 5) return true;
+    return false;
+  });
+
+  if (hasFedPet) {
+    set['achievements.fedPet'] = true;
+  }
+
+  const hasGear = Object.keys(user.items.gear.owned).find(gearKey => {
+    const gear = user.items.gear.owned[gearKey];
+
+    if (gear === true && gearKey.indexOf('_special_') === -1) return true;
+    return false;
+  });
+
+  if (hasGear) {
+    set['achievements.purchasedEquipment'] = true;
+  }
+
+  if (user.tasksOrder) {
+    const hasTask = Object.keys(user.tasksOrder).find(tasksOrderType => {
+      const order = user.tasksOrder[tasksOrderType];
+
+      if (order && order.length > 0) return true;
+      return false;
+    });
+
+    if (hasTask) {
+      set['achievements.createdTask'] = true;
+    }
+
+    const hasExperience = user.stats && user.stats.exp && user.stats.exp > 0;
+    if (hasTask && hasExperience) {
+      set['achievements.completedTask'] = true;
+    }
+  }
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+  return User.update({ _id: user._id }, { $set: set }).exec();
+}
+
+module.exports = async function processUsers () { // eslint-disable-line import/no-commonjs
+  const query = {
+    migration: { $ne: MIGRATION_NAME },
+  };
+
+  const fields = {
+    _id: 1,
+    stats: 1,
+    items: 1,
+    achievements: 1,
+    tasksOrder: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(100)
+      .sort({ _id: 1 })
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1],
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};

migrations/archive/2019/20191127_harvest_feast.js

@@ -0,0 +1,126 @@
+/* eslint-disable no-console */
+const MIGRATION_NAME = '20191127_harvest_feast';
+import { v4 as uuid } from 'uuid';
+import { model as User } from '../../../website/server/models/user';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count++;
+
+  const set = {};
+  let inc;
+  let push;
+
+  set.migration = MIGRATION_NAME;
+
+  if (typeof user.items.gear.owned.head_special_turkeyHelmGilded !== 'undefined') {
+    inc = {
+      'items.food.Pie_Base': 1,
+      'items.food.Pie_CottonCandyBlue': 1,
+      'items.food.Pie_CottonCandyPink': 1,
+      'items.food.Pie_Desert': 1,
+      'items.food.Pie_Golden': 1,
+      'items.food.Pie_Red': 1,
+      'items.food.Pie_Shade': 1,
+      'items.food.Pie_Skeleton': 1,
+      'items.food.Pie_Zombie': 1,
+      'items.food.Pie_White': 1,
+    }
+  } else if (typeof user.items.gear.owned.armor_special_turkeyArmorBase !== 'undefined') {
+    set['items.gear.owned.head_special_turkeyHelmGilded'] = false;
+    set['items.gear.owned.armor_special_turkeyArmorGilded'] = false;
+    set['items.gear.owned.back_special_turkeyTailGilded'] = false;
+    push = [
+      {
+        type: 'marketGear',
+        path: 'gear.flat.head_special_turkeyHelmGilded',
+        _id: uuid(),
+      },
+      {
+        type: 'marketGear',
+        path: 'gear.flat.armor_special_turkeyArmorGilded',
+        _id: uuid(),
+      },
+      {
+        type: 'marketGear',
+        path: 'gear.flat.back_special_turkeyTailGilded',
+        _id: uuid(),
+      },
+    ];
+  } else if (user.items && user.items.mounts && user.items.mounts['Turkey-Gilded']) {
+    set['items.gear.owned.head_special_turkeyHelmBase'] = false;
+    set['items.gear.owned.armor_special_turkeyArmorBase'] = false;
+    set['items.gear.owned.back_special_turkeyTailBase'] = false;
+    push = [
+      {
+        type: 'marketGear',
+        path: 'gear.flat.head_special_turkeyHelmBase',
+        _id: uuid(),
+      },
+      {
+        type: 'marketGear',
+        path: 'gear.flat.armor_special_turkeyArmorBase',
+        _id: uuid(),
+      },
+      {
+        type: 'marketGear',
+        path: 'gear.flat.back_special_turkeyTailBase',
+        _id: uuid(),
+      },
+    ];
+  } else if (user.items && user.items.pets && user.items.pets['Turkey-Gilded']) {
+    set['items.mounts.Turkey-Gilded'] = true;
+  } else if (user.items && user.items.mounts && user.items.mounts['Turkey-Base']) {
+    set['items.pets.Turkey-Gilded'] = 5;
+  } else if (user.items && user.items.pets && user.items.pets['Turkey-Base']) {
+    set['items.mounts.Turkey-Base'] = true;
+  } else {
+    set['items.pets.Turkey-Base'] = 5;
+  }
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+
+  if (inc) {
+    return await User.update({_id: user._id}, {$inc: inc, $set: set}).exec();
+  } else if (push) {
+    return await User.update({_id: user._id}, {$set: set, $push: {pinnedItems: {$each: push}}}).exec();
+  } else {
+    return await User.update({_id: user._id}, {$set: set}).exec();
+  }
+}
+
+module.exports = async function processUsers () {
+  let query = {
+    migration: {$ne: MIGRATION_NAME},
+    'auth.timestamps.loggedin': {$gt: new Date('2019-11-01')},
+  };
+
+  const fields = {
+    _id: 1,
+    items: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1],
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};

migrations/archive/2019/20191210_pet_color_achievements.js

@@ -0,0 +1,82 @@
+/* eslint-disable no-console */
+const MIGRATION_NAME = '20191210_pet_color_achievements';
+import { model as User } from '../../../website/server/models/user';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count++;
+
+  let set = {
+    migration: MIGRATION_NAME,
+  };
+
+  if (user && user.items && user.items.pets) {
+    const pets = user.items.pets;
+    if (pets['Wolf-White'] > 0
+      && pets['TigerCub-White'] > 0
+      && pets['PandaCub-White'] > 0
+      && pets['LionCub-White'] > 0
+      && pets['Fox-White'] > 0
+      && pets['FlyingPig-White'] > 0
+      && pets['Dragon-White'] > 0
+      && pets['Cactus-White'] > 0
+      && pets['BearCub-White'] > 0) {
+        set['achievements.primedForPainting'] = true;
+      }
+  }
+
+  if (user && user.items && user.items.mounts) {
+    const mounts = user.items.mounts;
+    if (mounts['Wolf-White']
+      && mounts['TigerCub-White']
+      && mounts['PandaCub-White']
+      && mounts['LionCub-White']
+      && mounts['Fox-White']
+      && mounts['FlyingPig-White']
+      && mounts['Dragon-White']
+      && mounts['Cactus-White']
+      && mounts['BearCub-White'] ) {
+        set['achievements.pearlyPro'] = true;
+      }
+  }
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+
+  return await User.update({ _id: user._id }, { $set: set }).exec();
+}
+
+module.exports = async function processUsers () {
+  let query = {
+    migration: { $ne: MIGRATION_NAME },
+    'auth.timestamps.loggedin': { $gt: new Date('2019-12-01') },
+  };
+
+  const fields = {
+    _id: 1,
+    items: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1]._id,
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};

migrations/archive/2019/20191231_nye.js

@@ -0,0 +1,118 @@
+/* eslint-disable no-console */
+const MIGRATION_NAME = '20191231_nye';
+import { model as User } from '../../../website/server/models/user';
+import { v4 as uuid } from 'uuid';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count++;
+
+  const set = {'flags.newStuff': true};
+  let push;
+
+  set.migration = MIGRATION_NAME;
+
+  if (typeof user.items.gear.owned.head_special_nye2018 !== 'undefined') {
+    set['items.gear.owned.head_special_nye2019'] = false;
+    push = [
+      {
+        type: 'marketGear',
+        path: 'gear.flat.head_special_nye2019',
+        _id: uuid(),
+      },
+    ];
+  } else if (typeof user.items.gear.owned.head_special_nye2017 !== 'undefined') {
+    set['items.gear.owned.head_special_nye2018'] = false;
+    push = [
+      {
+        type: 'marketGear',
+        path: 'gear.flat.head_special_nye2018',
+        _id: uuid(),
+      },
+    ];
+  } else if (typeof user.items.gear.owned.head_special_nye2016 !== 'undefined') {
+    set['items.gear.owned.head_special_nye2017'] = false;
+    push = [
+      {
+        type: 'marketGear',
+        path: 'gear.flat.head_special_nye2017',
+        _id: uuid(),
+      },
+    ];
+  } else if (typeof user.items.gear.owned.head_special_nye2015 !== 'undefined') {
+    set['items.gear.owned.head_special_nye2016'] = false;
+    push = [
+      {
+        type: 'marketGear',
+        path: 'gear.flat.head_special_nye2016',
+        _id: uuid(),
+      },
+    ];
+  } else if (typeof user.items.gear.owned.head_special_nye2014 !== 'undefined') {
+    set['items.gear.owned.head_special_nye2015'] = false;
+    push = [
+      {
+        type: 'marketGear',
+        path: 'gear.flat.head_special_nye2015',
+        _id: uuid(),
+      },
+    ];
+  } else if (typeof user.items.gear.owned.head_special_nye !== 'undefined') {
+    set['items.gear.owned.head_special_nye2014'] = false;
+    push = [
+      {
+        type: 'marketGear',
+        path: 'gear.flat.head_special_nye2014',
+        _id: uuid(),
+      },
+    ];
+  } else {
+    set['items.gear.owned.head_special_nye'] = false;
+    push = [
+      {
+        type: 'marketGear',
+        path: 'gear.flat.head_special_nye',
+        _id: uuid(),
+      },
+    ];
+  }
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+
+  return await User.update({_id: user._id}, {$set: set, $push: {pinnedItems: {$each: push}}}).exec();
+}
+
+export default async function processUsers () {
+  let query = {
+    migration: {$ne: MIGRATION_NAME},
+  };
+
+  const fields = {
+    _id: 1,
+    items: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1],
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};

migrations/archive/2020/20200131_habit_birthday.js

@@ -0,0 +1,91 @@
+/* eslint-disable no-console */
+const MIGRATION_NAME = '20200131_habit_birthday';
+import { v4 as uuid } from 'uuid';
+
+import { model as User } from '../../../website/server/models/user';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count++;
+
+  const inc = {
+    'items.food.Cake_Skeleton': 1,
+    'items.food.Cake_Base': 1,
+    'items.food.Cake_CottonCandyBlue': 1,
+    'items.food.Cake_CottonCandyPink': 1,
+    'items.food.Cake_Shade': 1,
+    'items.food.Cake_White': 1,
+    'items.food.Cake_Golden': 1,
+    'items.food.Cake_Zombie': 1,
+    'items.food.Cake_Desert': 1,
+    'items.food.Cake_Red': 1,
+    'achievements.habitBirthdays': 1,
+  };
+  const set = {};
+  let push;
+
+  set.migration = MIGRATION_NAME;
+
+  if (typeof user.items.gear.owned.armor_special_birthday2019 !== 'undefined') {
+    set['items.gear.owned.armor_special_birthday2020'] = false;
+    push = {pinnedItems: {type: 'marketGear', path: 'gear.flat.armor_special_birthday2020', _id: uuid()}};
+  } else if (typeof user.items.gear.owned.armor_special_birthday2018 !== 'undefined') {
+    set['items.gear.owned.armor_special_birthday2019'] = false;
+    push = {pinnedItems: {type: 'marketGear', path: 'gear.flat.armor_special_birthday2019', _id: uuid()}};
+  } else if (typeof user.items.gear.owned.armor_special_birthday2017 !== 'undefined') {
+    set['items.gear.owned.armor_special_birthday2018'] = false;
+    push = {pinnedItems: {type: 'marketGear', path: 'gear.flat.armor_special_birthday2018', _id: uuid()}};
+  } else if (typeof user.items.gear.owned.armor_special_birthday2016 !== 'undefined') {
+    set['items.gear.owned.armor_special_birthday2017'] = false;
+    push = {pinnedItems: {type: 'marketGear', path: 'gear.flat.armor_special_birthday2017', _id: uuid()}};
+  } else if (typeof user.items.gear.owned.armor_special_birthday2015 !== 'undefined') {
+    set['items.gear.owned.armor_special_birthday2016'] = false;
+    push = {pinnedItems: {type: 'marketGear', path: 'gear.flat.armor_special_birthday2016', _id: uuid()}};
+  } else if (typeof user.items.gear.owned.armor_special_birthday !== 'undefined') {
+    set['items.gear.owned.armor_special_birthday2015'] = false;
+    push = {pinnedItems: {type: 'marketGear', path: 'gear.flat.armor_special_birthday2015', _id: uuid()}};
+  } else {
+    set['items.gear.owned.armor_special_birthday'] = false;
+    push = {pinnedItems: {type: 'marketGear', path: 'gear.flat.armor_special_birthday', _id: uuid()}};
+  }
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+
+  return await User.update({_id: user._id}, {$inc: inc, $set: set, $push: push}).exec();
+}
+
+module.exports = async function processUsers () {
+  let query = {
+    migration: {$ne: MIGRATION_NAME},
+    'auth.timestamps.loggedin': {$gt: new Date('2019-01-15')},
+  };
+
+  const fields = {
+    _id: 1,
+    items: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1],
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};

migrations/archive/2020/20200402_webhooks_add_protocol.js

@@ -0,0 +1,69 @@
+/* eslint-disable no-console */
+const MIGRATION_NAME = '20200402_webhooks_add_protocol';
+import { model as User } from '../../../website/server/models/user';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count++;
+
+  const set = {
+    migration: MIGRATION_NAME,
+  };
+
+  if (user && user.webhooks && user.webhooks.length > 0) {
+    user.webhooks.forEach(webhook => {
+      // Make sure the protocol is set and valid
+      if (webhook.url.startsWith('ftp')) {
+        webhook.url = webhook.url.replace('ftp', 'https');
+      }
+
+      if (!webhook.url.startsWith('http://') && !webhook.url.startsWith('https://')) {
+        // the default in got 9 was https
+        // see https://github.com/sindresorhus/got/commit/92bc8082137d7d085750359bbd76c801e213d7d2#diff-0730bb7c2e8f9ea2438b52e419dd86c9L111
+        webhook.url = `https://${webhook.url}`;
+      }
+    });
+
+    set.webhooks = user.webhooks;
+  }
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+
+  return await User.update({ _id: user._id }, { $set: set }).exec();
+}
+
+module.exports = async function processUsers () {
+  let query = {
+    migration: { $ne: MIGRATION_NAME },
+    webhooks: { $exists: true, $not: { $size: 0 } },
+  };
+
+  const fields = {
+    _id: 1,
+    webhooks: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1]._id,
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};

migrations/archive/2020/20200402_webhooks_reenable.js

@@ -0,0 +1,63 @@
+/* eslint-disable no-console */
+const MIGRATION_NAME = '20200402_webhooks_reenable';
+import { model as User } from '../../../website/server/models/user';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count++;
+
+  const set = {
+    migration: MIGRATION_NAME,
+  };
+
+  if (user && user.webhooks && user.webhooks.length > 0) {
+    user.webhooks.forEach(webhook => {
+      // Re-enable webhooks disabled because of too many failures
+      if (webhook.enabled === false && webhook.lastFailureAt === null) {
+        webhook.enabled = true;
+      }
+    });
+
+    set.webhooks = user.webhooks;
+  }
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+
+  return await User.update({ _id: user._id }, { $set: set }).exec();
+}
+
+module.exports = async function processUsers () {
+  let query = {
+    migration: { $ne: MIGRATION_NAME },
+    webhooks: { $exists: true, $not: { $size: 0 } },
+  };
+
+  const fields = {
+    _id: 1,
+    webhooks: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1]._id,
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};

migrations/archive/2020/20200721_summer_splash_orcas.js

@@ -0,0 +1,59 @@
+/* eslint-disable no-console */
+const MIGRATION_NAME = '20200721_summer_splash_orcas';
+
+import { model as User } from '../../../website/server/models/user';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count++;
+
+  let set;
+
+  if (user && user.items && user.items.pets && typeof user.items.pets['Orca-Base'] !== 'undefined') {
+    set = { migration: MIGRATION_NAME };
+  } else if (user && user.items && user.items.mounts && typeof user.items.mounts['Orca-Base'] !== 'undefined') {
+    set = { migration: MIGRATION_NAME, 'items.pets.Orca-Base': 5 };
+  } else {
+    set = { migration: MIGRATION_NAME, 'items.mounts.Orca-Base': true };
+  }
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+
+  return await User.update({ _id: user._id }, { $set: set }).exec();
+}
+
+export default async function processUsers () {
+  let query = {
+    migration: {$ne: MIGRATION_NAME},
+    'auth.timestamps.loggedin': {$gt: new Date('2020-06-21')},
+  };
+
+  const fields = {
+    _id: 1,
+    items: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1],
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};

migrations/archive/2020/20200731_naming_day.js

@@ -0,0 +1,87 @@
+/* eslint-disable no-console */
+const MIGRATION_NAME = '20200731_naming_day';
+import { v4 as uuid } from 'uuid';
+
+import { model as User } from '../../../website/server/models/user';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count++;
+
+  let set;
+  let push;
+  const inc = {
+    'items.food.Cake_Base': 1,
+    'items.food.Cake_CottonCandyBlue': 1,
+    'items.food.Cake_CottonCandyPink': 1,
+    'items.food.Cake_Desert': 1,
+    'items.food.Cake_Golden': 1,
+    'items.food.Cake_Red': 1,
+    'items.food.Cake_Shade': 1,
+    'items.food.Cake_Skeleton': 1,
+    'items.food.Cake_White': 1,
+    'items.food.Cake_Zombie': 1,
+    'achievements.habiticaDays': 1,
+  };
+
+  if (user && user.items && user.items.gear && user.items.gear.owned && typeof user.items.gear.owned.back_special_namingDay2020 !== 'undefined') {
+    set = { migration: MIGRATION_NAME };
+  } else if (user && user.items && user.items.gear && user.items.gear.owned && typeof user.items.gear.owned.body_special_namingDay2018 !== 'undefined') {
+    set = { migration: MIGRATION_NAME, 'items.gear.owned.back_special_namingDay2020': false };
+    push = { pinnedItems: { type: 'marketGear', path: 'gear.flat.back_special_namingDay2020', _id: uuid() }};
+  } else if (user && user.items && user.items.gear && user.items.gear.owned && typeof user.items.gear.owned.head_special_namingDay2017 !== 'undefined') {
+    set = { migration: MIGRATION_NAME, 'items.gear.owned.body_special_namingDay2018': false };
+    push = { pinnedItems: { type: 'marketGear', path: 'gear.flat.body_special_namingDay2018', _id: uuid() }};
+  } else if (user && user.items && user.items.pets && typeof user.items.pets['Gryphon-RoyalPurple'] !== 'undefined') {
+    set = { migration: MIGRATION_NAME, 'items.gear.owned.head_special_namingDay2017': false };
+    push = { pinnedItems: { type: 'marketGear', path: 'gear.flat.head_special_namingDay2017', _id: uuid() }};
+  } else if (user && user.items && user.items.mounts && typeof user.items.mounts['Gryphon-RoyalPurple'] !== 'undefined') {
+    set = { migration: MIGRATION_NAME, 'items.pets.Gryphon-RoyalPurple': 5 };
+  } else {
+    set = { migration: MIGRATION_NAME, 'items.mounts.Gryphon-RoyalPurple': true };
+  }
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+
+  if (push) {
+    return await User.update({ _id: user._id }, { $set: set, $inc: inc, $push: push }).exec();
+  } else {
+    return await User.update({ _id: user._id }, { $set: set, $inc: inc }).exec();
+  }
+}
+
+export default async function processUsers () {
+  let query = {
+    migration: { $ne: MIGRATION_NAME },
+    'auth.timestamps.loggedin': { $gt: new Date('2020-07-01') },
+  };
+
+  const fields = {
+    _id: 1,
+    items: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1]._id,
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};

migrations/archive/2020/20200818_pet_color_achievements.js

@@ -0,0 +1,82 @@
+/* eslint-disable no-console */
+const MIGRATION_NAME = '20200818_pet_color_achievements';
+import { model as User } from '../../../website/server/models/user';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count++;
+
+  const set = {
+    migration: MIGRATION_NAME,
+  };
+
+  if (user && user.items && user.items.pets) {
+    const pets = user.items.pets;
+    if (pets['Wolf-Golden'] > 0
+      && pets['TigerCub-Golden'] > 0
+      && pets['PandaCub-Golden'] > 0
+      && pets['LionCub-Golden'] > 0
+      && pets['Fox-Golden'] > 0
+      && pets['FlyingPig-Golden'] > 0
+      && pets['Dragon-Golden'] > 0
+      && pets['Cactus-Golden'] > 0
+      && pets['BearCub-Golden'] > 0) {
+        set['achievements.goodAsGold'] = true;
+      }
+  }
+
+  if (user && user.items && user.items.mounts) {
+    const mounts = user.items.mounts;
+    if (mounts['Wolf-Golden']
+      && mounts['TigerCub-Golden']
+      && mounts['PandaCub-Golden']
+      && mounts['LionCub-Golden']
+      && mounts['Fox-Golden']
+      && mounts['FlyingPig-Golden']
+      && mounts['Dragon-Golden']
+      && mounts['Cactus-Golden']
+      && mounts['BearCub-Golden'] ) {
+        set['achievements.allThatGlitters'] = true;
+      }
+  }
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+
+  return await User.update({ _id: user._id }, { $set: set }).exec();
+}
+
+module.exports = async function processUsers () {
+  let query = {
+    migration: { $ne: MIGRATION_NAME },
+    'auth.timestamps.loggedin': { $gt: new Date('2020-08-01') },
+  };
+
+  const fields = {
+    _id: 1,
+    items: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1]._id,
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};

migrations/archive/mystery-items-old.js

@@ -1,110 +0,0 @@
-import monk from 'monk';
-import nconf from 'nconf';
-
-const migrationName = 'mystery-items-201808.js'; // Update per month
-const authorName = 'Sabe'; // in case script author needs to know when their ...
-const authorUuid = '7f14ed62-5408-4e1b-be83-ada62d504931'; // ... own data is done
-
-/*
- * Award this month's mystery items to subscribers
- */
-const MYSTERY_ITEMS = ['armor_mystery_201810', 'head_mystery_201810'];
-const CONNECTION_STRING = nconf.get('MIGRATION_CONNECT_STRING');
-
-let dbUsers = monk(CONNECTION_STRING).get('users', { castIds: false });
-let UserNotification = require('../../website/server/models/userNotification').model;
-
-function processUsers (lastId) {
-  // specify a query to limit the affected users (empty for all users):
-  let query = {
-    migration: {$ne: migrationName},
-    'purchased.plan.customerId': { $ne: null },
-    $or: [
-      { 'purchased.plan.dateTerminated': { $gte: new Date() } },
-      { 'purchased.plan.dateTerminated': { $exists: false } },
-      { 'purchased.plan.dateTerminated': { $eq: null } },
-    ],
-  };
-
-  if (lastId) {
-    query._id = {
-      $gt: lastId,
-    };
-  }
-
-  dbUsers.find(query, {
-    sort: {_id: 1},
-    limit: 250,
-    fields: [
-    ], // specify fields we are interested in to limit retrieved data (empty if we're not reading data):
-  })
-    .then(updateUsers)
-    .catch((err) => {
-      console.log(err);
-      return exiting(1, `ERROR! ${  err}`);
-    });
-}
-
-let progressCount = 1000;
-let count = 0;
-
-function updateUsers (users) {
-  if (!users || users.length === 0) {
-    console.warn('All appropriate users found and modified.');
-    displayData();
-    return;
-  }
-
-  let userPromises = users.map(updateUser);
-  let lastUser = users[users.length - 1];
-
-  return Promise.all(userPromises)
-    .then(() => {
-      processUsers(lastUser._id);
-    });
-}
-
-function updateUser (user) {
-  count++;
-
-  const addToSet = {
-    'purchased.plan.mysteryItems': {
-      $each: MYSTERY_ITEMS,
-    },
-  };
-  const push = {
-    notifications: (new UserNotification({
-      type: 'NEW_MYSTERY_ITEMS',
-      data: {
-        MYSTERY_ITEMS,
-      },
-    })).toJSON(),
-  };
-
-  dbUsers.update({_id: user._id}, {$addToSet: addToSet, $push: push});
-
-  if (count % progressCount === 0) console.warn(`${count  } ${  user._id}`);
-  if (user._id === authorUuid) console.warn(`${authorName  } processed`);
-}
-
-function displayData () {
-  console.warn(`\n${  count  } users processed\n`);
-  return exiting(0);
-}
-
-function exiting (code, msg) {
-  code = code || 0; // 0 = success
-  if (code && !msg) {
-    msg = 'ERROR!';
-  }
-  if (msg) {
-    if (code) {
-      console.error(msg);
-    } else      {
-      console.log(msg);
-    }
-  }
-  process.exit(code);
-}
-
-module.exports = processUsers;

migrations/archive/s3-upload.js

@@ -27,7 +27,7 @@ function uploadFile (buffer, fileName) {
       if (error) {
         reject(error);
       } else {
-        // console.info(`${fileName} uploaded to ${BUCKET_NAME} succesfully.`);
+        // console.info(`${fileName} uploaded to ${BUCKET_NAME} successfully.`);
         resolve(fileName);
       }
     });

migrations/challenges/sync-all-challenges.js

@@ -10,7 +10,7 @@ async function syncChallengeToMembers (challenges) {
 
     const promises = [];
     users.forEach(user => {
-      promises.push(challenge.syncToUser(user));
+      promises.push(challenge.syncTasksToUser(user));
       promises.push(challenge.save());
       promises.push(user.save());
     });

migrations/command-line/duplicatedTasksFindAndRemove.js

@@ -32,13 +32,11 @@
  *
  */
 
-
 // CONFIGURATION:
 // - Change the uuid below to be the user's uuid.
 // - Change ALL instances of "todos" to "habits"/"dailys"/"rewards" as
 //   needed. Do not miss any of them!
 
-
 const uuid = '30fb2640-7121-4968-ace5-f385e60ea6c5';
 
 db.users.aggregate([

migrations/groups/migrate-chat.js

@@ -2,7 +2,6 @@
 // @authorName = 'TheHollidayInn'; // in case script author needs to know when their ...
 // @authorUuid = ''; // ... own data is done
 
-
 /*
  * This migration moves chat off of groups and into their own model
  */
@@ -38,7 +37,6 @@ async function moveGroupChatToModel (skip = 0) {
     return chatpromises;
   });
 
-
   const reducedPromises = promises.reduce((acc, curr) => {
     acc = acc.concat(curr); // eslint-disable-line no-param-reassign
     return acc;

migrations/groups/reconcile-group-plan-members.js

@@ -45,7 +45,7 @@ async function fixGroupPlanMembers () {
     pause();
     groupPlanCount += 1;
 
-    const canonicalMemberCount = await dbUsers.count(
+    const canonicalMemberCount = await dbUsers.countDocuments(
       {
         $or:
           [

migrations/migration-runner.js

@@ -18,7 +18,7 @@ function setUpServer () {
 setUpServer();
 
 // Replace this with your migration
-const processUsers = () => {}; // require('').default;
+const processUsers = require().default;
 
 processUsers()
   .then(() => {

migrations/restock_armoire_for_users_that_need_it.js

@@ -25,7 +25,6 @@ const monk = require('monk'); // eslint-disable-line import/no-extraneous-depend
 
 const dbUsers = monk(connectionString).get('users', { castIds: false });
 
-
 function processUsers (lastId) {
   // specify a query to limit the affected users (empty for all users):
   const query = {
@@ -86,7 +85,6 @@ function updateUser (user) {
 
   const set = { migration: migrationName, 'flags.armoireEmpty': false };
 
-
   if (user.flags.armoireEmpty) {
     // this user believes their armoire has no more items in it
     if (

migrations/restore-profile-data.js

@@ -121,5 +121,4 @@ function exiting (code, msg) {
   process.exit(code);
 }
 
-
 processUsers();

migrations/tasks/rewards-flip-negative-costs.js

@@ -0,0 +1,54 @@
+// @migrationName = 'RewardsMigrationFlipNegativeCostsValues';
+// @authorName = 'hamboomger';
+// @authorUuid = '80b61b73-2278-4947-b713-a10112cfe7f5';
+
+/*
+ * For each reward with negative cost, make it positive
+ * by assigning it an absolute value of itself
+ */
+
+import { Task } from '../../website/server/models/task';
+
+async function flipNegativeCostsValues () {
+  const query = {
+    type: 'reward',
+    value: { $lt: 0 },
+  };
+
+  const fields = {
+    _id: 1,
+    value: 1,
+  };
+
+  // eslint-disable-next-line no-constant-condition
+  while (true) {
+    // eslint-disable-next-line no-await-in-loop
+    const rewards = await Task
+      .find(query)
+      .limit(250)
+      .sort({ _id: 1 })
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (rewards.length === 0) {
+      break;
+    }
+
+    const promises = rewards.map(reward => {
+      const positiveValue = Math.abs(reward.value);
+      return Task.update({ _id: reward._id }, { $set: { value: positiveValue } }).exec();
+    });
+
+    // eslint-disable-next-line no-await-in-loop
+    await Promise.all(promises);
+
+    query._id = {
+      $gt: rewards[rewards.length - 1]._id,
+    };
+  }
+
+  console.log('All rewards with negative values were updated, migration finished');
+}
+
+export default flipNegativeCostsValues;

migrations/users/bulk-email.js

@@ -8,15 +8,18 @@ const BASE_URL = nconf.get('BASE_URL');
 const EMAIL_SLUG = 'mandrill-email-slug'; // Set email template to send
 const MIGRATION_NAME = 'bulk-email';
 
-const progressCount = 1000;
+const progressCount = 250;
 let count = 0;
 
 async function updateUser (user) {
   count += 1;
 
-  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+  if (count % progressCount === 0) {
+    console.warn(`${count} ${user._id}`);
+    await new Promise(resolve => setTimeout(resolve, 5000));
+  }
 
-  sendTxn(
+  await sendTxn(
     user,
     EMAIL_SLUG,
     [{ name: 'BASE_URL', content: BASE_URL }], // Add variables from template

migrations/users/full-gear.js

@@ -1,47 +1,39 @@
 /* eslint-disable no-console */
-import { model as User } from '../../website/server/models/user';
-import { model as UserNotification } from '../../website/server/models/userNotification';
+import each from 'lodash/each';
+import keys from 'lodash/keys';
+import content from '../../website/common/script/content/index';
 
-const MIGRATION_NAME = 'mystery_items_201910';
-const MYSTERY_ITEMS = ['armor_mystery_201910', 'head_mystery_201910'];
+import { model as User } from '../../website/server/models/user';
+
+const MIGRATION_NAME = 'full-gear';
 
 const progressCount = 1000;
 let count = 0;
 
+/*
+ * Award users every extant pet and mount
+ */
+
 async function updateUser (user) {
   count += 1;
 
-  const addToSet = {
-    'purchased.plan.mysteryItems': {
-      $each: MYSTERY_ITEMS,
-    },
-  };
-  const push = {
-    notifications: (new UserNotification({
-      type: 'NEW_MYSTERY_ITEMS',
-      data: {
-        MYSTERY_ITEMS,
-      },
-    })).toJSON(),
-  };
-  const set = {
-    migration: MIGRATION_NAME,
-  };
+  const set = {};
+
+  set.migration = MIGRATION_NAME;
+
+  each(keys(content.gear.flat), gearItem => {
+    set[`items.gear.owned.${gearItem}`] = true;
+  });
 
   if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
 
-  return User.update({ _id: user._id }, { $set: set, $push: push, $addToSet: addToSet }).exec();
+  return User.update({ _id: user._id }, { $set: set }).exec();
 }
 
 export default async function processUsers () {
   const query = {
     migration: { $ne: MIGRATION_NAME },
-    'purchased.plan.customerId': { $ne: null },
-    $or: [
-      { 'purchased.plan.dateTerminated': { $gte: new Date() } },
-      { 'purchased.plan.dateTerminated': { $exists: false } },
-      { 'purchased.plan.dateTerminated': { $eq: null } },
-    ],
+    'auth.local.lowerCaseUsername': 'olson1',
   };
 
   const fields = {

migrations/users/full-stable.js

@@ -33,6 +33,9 @@ async function updateUser (user) {
   each(keys(content.specialPets), pet => {
     set[`items.pets.${pet}`] = 5;
   });
+  each(keys(content.wackyPets), pet => {
+    set[`items.pets.${pet}`] = 5;
+  });
   each(keys(content.mounts), mount => {
     set[`items.mounts.${mount}`] = true;
   });
@@ -54,7 +57,7 @@ async function updateUser (user) {
 export default async function processUsers () {
   const query = {
     migration: { $ne: MIGRATION_NAME },
-    'auth.local.username': 'olson22',
+    'auth.local.username': 'SabreTest',
   };
 
   const fields = {

migrations/users/pi-day.js

@@ -3,7 +3,7 @@ import { v4 as uuid } from 'uuid';
 
 import { model as User } from '../../website/server/models/user';
 
-const MIGRATION_NAME = '20190314_pi_day';
+const MIGRATION_NAME = '20200314_pi_day';
 
 const progressCount = 1000;
 let count = 0;
@@ -24,27 +24,37 @@ async function updateUser (user) {
     'items.food.Pie_Red': 1,
   };
   const set = {};
+  let push;
 
   set.migration = MIGRATION_NAME;
 
-  set['items.gear.owned.head_special_piDay'] = false;
-  set['items.gear.owned.shield_special_piDay'] = false;
-  const push = [
-    { type: 'marketGear', path: 'gear.flat.head_special_piDay', _id: uuid() },
-    { type: 'marketGear', path: 'gear.flat.shield_special_piDay', _id: uuid() },
-  ];
+  if (typeof user.items.gear.owned.head_special_piDay !== 'undefined') {
+    push = false;
+  } else {
+    set['items.gear.owned.head_special_piDay'] = false;
+    set['items.gear.owned.shield_special_piDay'] = false;
+    push = [
+      { type: 'marketGear', path: 'gear.flat.head_special_piDay', _id: uuid() },
+      { type: 'marketGear', path: 'gear.flat.shield_special_piDay', _id: uuid() },
+    ];
+  }
 
   if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
 
+  if (push) {
+    return User
+      .update({ _id: user._id }, { $inc: inc, $set: set, $push: { pinnedItems: { $each: push } } })
+      .exec();
+  }
   return User
-    .update({ _id: user._id }, { $inc: inc, $set: set, $push: { pinnedItems: { $each: push } } })
+    .update({ _id: user._id }, { $inc: inc, $set: set })
     .exec();
 }
 
 export default async function processUsers () {
   const query = {
     migration: { $ne: MIGRATION_NAME },
-    'auth.timestamps.loggedin': { $gt: new Date('2019-02-15') },
+    'auth.timestamps.loggedin': { $gt: new Date('2020-02-15') },
   };
 
   const fields = {

migrations/users/remove-social-users-extra-data.js

@@ -9,7 +9,6 @@ const authorUuid = 'ed4c688c-6652-4a92-9d03-a5a79844174a'; // ... own data is do
  */
 const connectionString = 'mongodb://localhost:27017/habitrpg?auto_reconnect=true'; // FOR TEST DATABASE
 
-
 const dbUsers = monk(connectionString).get('users', { castIds: false });
 
 function processUsers (lastId) {

migrations/users/tag-challenge-field-string2bool.js

@@ -0,0 +1,73 @@
+import { model as User } from '../../website/server/models/user';
+
+const MIGRATION_NAME = 'tag-challenge-field-string2bool';
+
+const progressCount = 1000;
+let count = 0;
+
+export default async function processUsers () {
+  const query = {
+    migration: { $ne: MIGRATION_NAME },
+    tags: {
+      $elemMatch: {
+        challenge: {
+          $exists: true,
+          $type: 'string',
+        },
+      },
+    },
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    // eslint-disable-next-line no-await-in-loop
+    const users = await User.find(query)
+      .sort({ _id: 1 })
+      .limit(250)
+      .select({ _id: 1, tags: 1 })
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1],
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+}
+
+async function updateUser (user) {
+  count += 1;
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+  let requiresUpdate = false;
+
+  if (user && user.tags) {
+    user.tags.forEach(tag => {
+      if (tag && typeof tag.challenge === 'string') {
+        requiresUpdate = true;
+        if (tag.challenge === 'true') {
+          tag.challenge = true;
+        } else if (tag.challenge === 'false') {
+          tag.challenge = false;
+        } else {
+          tag.challenge = null;
+        }
+      }
+    });
+  }
+
+  if (requiresUpdate) {
+    const set = {
+      migration: MIGRATION_NAME,
+      tags: user.tags,
+    };
+    return User.update({ _id: user._id }, { $set: set }).exec();
+  }
+
+  return null;
+}

package.json

@@ -1,76 +1,81 @@
 {
   "name": "habitica",
   "description": "A habit tracker app which treats your goals like a Role Playing Game.",
-  "version": "4.119.1",
+  "version": "4.157.0",
   "main": "./website/server/index.js",
   "dependencies": {
-    "@babel/core": "^7.6.4",
-    "@babel/preset-env": "^7.6.3",
-    "@babel/register": "^7.6.2",
-    "@google-cloud/trace-agent": "^4.2.2",
-    "@slack/client": "^3.8.1",
+    "@babel/core": "^7.11.6",
+    "@babel/preset-env": "^7.11.5",
+    "@babel/register": "^7.11.5",
+    "@google-cloud/trace-agent": "^5.1.0",
+    "@slack/client": "^4.12.0",
     "accepts": "^1.3.5",
-    "amazon-payments": "^0.2.7",
+    "amazon-payments": "^0.2.8",
     "amplitude": "^3.5.0",
-    "apidoc": "^0.17.5",
+    "apidoc": "^0.25.0",
     "apn": "^2.2.0",
-    "aws-sdk": "^2.556.0",
-    "bcrypt": "^3.0.6",
+    "apple-auth": "^1.0.6",
+    "bcrypt": "^5.0.0",
     "body-parser": "^1.18.3",
     "compression": "^1.7.4",
-    "cookie-session": "^1.3.3",
+    "cookie-session": "^1.4.0",
     "coupon-code": "^0.4.5",
-    "csv-stringify": "^5.1.0",
+    "csv-stringify": "^5.5.1",
     "cwait": "^1.1.1",
     "domain-middleware": "~0.1.0",
-    "eslint": "^6.6.0",
+    "eslint": "^6.8.0",
     "eslint-config-habitrpg": "^6.2.0",
     "eslint-plugin-mocha": "^5.0.0",
     "express": "^4.16.3",
     "express-basic-auth": "^1.1.5",
     "express-validator": "^5.2.0",
-    "glob": "^7.1.5",
-    "got": "^9.0.0",
+    "glob": "^7.1.6",
+    "got": "^11.6.0",
     "gulp": "^4.0.0",
     "gulp-babel": "^8.0.0",
-    "gulp-imagemin": "^6.1.1",
-    "gulp-nodemon": "^2.4.1",
+    "gulp-imagemin": "^7.1.0",
+    "gulp-nodemon": "^2.5.0",
     "gulp.spritesmith": "^6.9.0",
-    "habitica-markdown": "^1.3.0",
-    "helmet": "^3.21.2",
-    "image-size": "^0.8.3",
+    "habitica-markdown": "^3.0.0",
+    "helmet": "^3.23.3",
+    "image-size": "^0.9.1",
     "in-app-purchase": "^1.11.3",
-    "js2xmlparser": "^4.0.0",
-    "lodash": "^4.17.15",
+    "js2xmlparser": "^4.0.1",
+    "jsonwebtoken": "^8.5.1",
+    "jwks-rsa": "^1.9.0",
+    "lodash": "^4.17.20",
     "merge-stream": "^2.0.0",
     "method-override": "^3.0.0",
-    "moment": "^2.24.0",
+    "moment": "^2.27.0",
     "moment-recur": "^1.0.7",
-    "mongoose": "^5.7.7",
-    "morgan": "^1.7.0",
+    "mongoose": "^5.10.3",
+    "morgan": "^1.10.0",
     "nconf": "^0.10.0",
-    "node-gcm": "^1.0.2",
-    "pageres": "^5.1.0",
-    "passport": "^0.4.0",
+    "node-gcm": "^1.0.3",
+    "on-headers": "^1.0.2",
+    "passport": "^0.4.1",
     "passport-facebook": "^3.0.0",
     "passport-google-oauth2": "^0.2.0",
     "passport-google-oauth20": "1.0.0",
-    "paypal-ipn": "3.0.0",
     "paypal-rest-sdk": "^1.8.1",
+    "pp-ipn": "^1.1.0",
     "ps-tree": "^1.0.0",
-    "regenerator-runtime": "^0.13.3",
-    "rimraf": "^3.0.0",
+    "rate-limiter-flexible": "^2.1.10",
+    "redis": "^3.0.2",
+    "regenerator-runtime": "^0.13.7",
+    "remove-markdown": "^0.3.0",
+    "rimraf": "^3.0.2",
     "short-uuid": "^3.0.0",
-    "stripe": "^7.10.0",
-    "superagent": "^5.0.2",
-    "universal-analytics": "^0.4.17",
+    "stripe": "^7.15.0",
+    "superagent": "^6.1.0",
+    "universal-analytics": "^0.4.23",
     "useragent": "^2.1.9",
-    "uuid": "^3.3.3",
-    "validator": "^11.0.0",
+    "uuid": "^8.3.0",
+    "validator": "^13.1.1",
     "vinyl-buffer": "^1.0.1",
-    "winston": "^2.4.3",
-    "winston-loggly-bulk": "^2.0.2",
-    "xml2js": "^0.4.4"
+    "winston": "^3.3.3",
+    "winston-loggly-bulk": "^3.1.1",
+    "xml2js": "^0.4.23"
   },
   "private": true,
   "engines": {
@@ -79,7 +84,7 @@
   },
   "scripts": {
     "lint": "eslint --ext .js --fix . && cd website/client && npm run lint",
-    "lint-no-fix": "eslint --ext .js . && cd website/client && npm run lint --no-fix",
+    "lint-no-fix": "eslint --ext .js . && cd website/client && npm run lint-no-fix",
     "test": "npm run lint && gulp test && gulp apidoc",
     "test:build": "gulp test:prepare:build",
     "test:api-v3": "gulp test:api-v3",
@@ -98,21 +103,26 @@
     "client:build": "cd website/client && npm run build",
     "client:unit": "cd website/client && npm run test:unit",
     "start": "gulp nodemon",
+    "debug": "gulp nodemon --inspect",
+    "mongo:dev": "run-rs -v 4.2.8 -l ubuntu1804 --keep --dbpath mongodb-data --number 1 --quiet",
     "postinstall": "gulp build && cd website/client && npm install",
     "apidoc": "gulp apidoc"
   },
   "devDependencies": {
-    "axios": "^0.19.0",
+    "axios": "^0.19.2",
     "chai": "^4.1.2",
     "chai-as-promised": "^7.1.1",
-    "chalk": "^2.4.1",
+    "chai-moment": "^0.1.0",
+    "chalk": "^4.1.0",
+    "cross-spawn": "^7.0.3",
     "expect.js": "^0.3.1",
     "istanbul": "^1.1.0-alpha.1",
     "mocha": "^5.1.1",
-    "monk": "^7.1.1",
+    "monk": "^7.3.2",
     "require-again": "^2.0.0",
-    "sinon": "^7.2.4",
-    "sinon-chai": "^3.0.0",
+    "run-rs": "^0.6.2",
+    "sinon": "^9.0.3",
+    "sinon-chai": "^3.5.0",
     "sinon-stub-promise": "^4.0.0"
   },
   "optionalDependencies": {}

scripts/gdpr-delete-users.js

@@ -24,20 +24,29 @@ async function deleteAmplitudeData (userId, email) {
     console.log(err.response.data);
   });
 
-  if (response) console.log(`${response.status} ${response.statusText}`);
+  if (response) {
+    if (response.status === 200) {
+      console.log(`${userId} (${email}) Amplitude deletion request OK.`);
+    } else {
+      console.log(`${userId} (${email}) Amplitude response: ${response.status} ${response.statusText}`);
+    }
+  }
+  await new Promise(resolve => setTimeout(resolve, 1000));
 }
 
 async function deleteHabiticaData (user, email) {
+  const truncatedEmail = email.slice(0, email.indexOf('@'));
+  const set = {
+    'auth.blocked': false,
+    'auth.local.hashed_password': '$2a$10$QDnNh1j1yMPnTXDEOV38xOePEWFd4X8DSYwAM8XTmqmacG5X0DKjW',
+    'auth.local.passwordHashMethod': 'bcrypt',
+  };
+  if (!user.auth.local.email) set['auth.local.email'] = `${truncatedEmail}-gdpr@example.com`;
   await User.update(
     { _id: user._id },
-    {
-      $set: {
-        'auth.local.email': email,
-        'auth.local.hashed_password': '$2a$10$QDnNh1j1yMPnTXDEOV38xOePEWFd4X8DSYwAM8XTmqmacG5X0DKjW',
-        'auth.local.passwordHashMethod': 'bcrypt',
-      },
-    },
+    { $set: set },
   );
+  await new Promise(resolve => setTimeout(resolve, 1000));
   const response = await axios.delete(
     `${BASE_URL}/api/v3/user`,
     {
@@ -54,39 +63,47 @@ async function deleteHabiticaData (user, email) {
   });
 
   if (response) {
-    console.log(`${response.status} ${response.statusText}`);
-    if (response.status === 200) console.log(`${user._id} (${email}) removed. Last login: ${user.auth.timestamps.loggedin}`);
+    if (response.status === 200) {
+      console.log(`${user._id} (${email}) removed from Habitica. Last login: ${user.auth.timestamps.loggedin}`);
+    } else {
+      console.log(`${user._id} (${email}) Habitica response: ${response.status} ${response.statusText}`);
+    }
   }
 }
 
 async function processEmailAddress (email) {
   const emailRegex = new RegExp(`^${email}$`, 'i');
-  const users = await User.find({
-    $or: [
-      { 'auth.local.email': emailRegex },
-      { 'auth.facebook.emails.value': emailRegex },
-      { 'auth.google.emails.value': emailRegex },
-    ],
-  },
-  {
-    _id: 1,
-    apiToken: 1,
-    auth: 1,
-  }).exec();
+  const localUsers = await User.find(
+    { 'auth.local.email': emailRegex },
+    { _id: 1, apiToken: 1, auth: 1 },
+  ).exec();
+
+  const socialUsers = await User.find(
+    {
+      'auth.local.email': { $not: emailRegex },
+      $or: [
+        { 'auth.facebook.emails.value': email },
+        { 'auth.google.emails.value': email },
+      ],
+    },
+    { _id: 1, apiToken: 1, auth: 1 },
+  ).collation(
+    { locale: 'en', strength: 1 },
+  ).exec();
+
+  const users = localUsers.concat(socialUsers);
 
   if (users.length < 1) {
-    console.log(`No users found with email address ${email}`);
-  } else {
-    Promise.all(users.map(user => (async () => {
-      await deleteAmplitudeData(user._id, email); // eslint-disable-line no-await-in-loop
-      await deleteHabiticaData(user, email); // eslint-disable-line no-await-in-loop
-    })()));
+    return console.log(`No users found with email address ${email}`);
   }
+
+  return Promise.all(users.map(user => (async () => {
+    await deleteAmplitudeData(user._id, email); // eslint-disable-line no-await-in-loop
+    await deleteHabiticaData(user, email); // eslint-disable-line no-await-in-loop
+  })()));
 }
 
-function deleteUserData (emails) {
+export default function deleteUserData (emails) {
   const emailPromises = emails.map(processEmailAddress);
   return Promise.all(emailPromises);
 }
-
-module.exports = deleteUserData;

test/api/unit/libs/analyticsService.test.js

@@ -155,7 +155,7 @@ describe('analyticsService', () => {
             });
         });
 
-        it('sets Unkown if headers are not passed in', () => {
+        it('sets Unknown if headers are not passed in', () => {
           delete data.headers;
 
           return analyticsService.track(eventType, data)
@@ -476,7 +476,7 @@ describe('analyticsService', () => {
             });
         });
 
-        it('sets Unkown if headers are not passed in', () => {
+        it('sets Unknown if headers are not passed in', () => {
           delete data.headers;
 
           return analyticsService.trackPurchase(data)

test/api/unit/libs/baseModel.test.js

@@ -56,7 +56,6 @@ describe('Base model plugin', () => {
     expect(sanitized).not.to.have.property('usuallySettable');
   });
 
-
   it('can make fields private', () => {
     schema.plugin(baseModel, {
       private: ['amPrivate'],

test/api/unit/libs/content.test.js

@@ -0,0 +1,17 @@
+import * as contentLib from '../../../../website/server/libs/content';
+import content from '../../../../website/common/script/content';
+
+describe('contentLib', () => {
+  describe('CONTENT_CACHE_PATH', () => {
+    it('exports CONTENT_CACHE_PATH', () => {
+      expect(contentLib.CONTENT_CACHE_PATH).to.be.a.string;
+    });
+  });
+
+  describe('getLocalizedContentResponse', () => {
+    it('clones, not modify, the original content data', () => {
+      contentLib.getLocalizedContentResponse();
+      expect(typeof content.backgrounds.backgrounds062014.beach.text).to.equal('function');
+    });
+  });
+});

test/api/unit/libs/cron.test.js

@@ -42,13 +42,13 @@ describe('cron', () => {
   });
 
   it('updates user.preferences.timezoneOffsetAtLastCron', () => {
-    const timezoneOffsetFromUserPrefs = 1;
+    const timezoneUtcOffsetFromUserPrefs = -1;
 
     cron({
-      user, tasksByType, daysMissed, analytics, timezoneOffsetFromUserPrefs,
+      user, tasksByType, daysMissed, analytics, timezoneUtcOffsetFromUserPrefs,
     });
 
-    expect(user.preferences.timezoneOffsetAtLastCron).to.equal(timezoneOffsetFromUserPrefs);
+    expect(user.preferences.timezoneOffsetAtLastCron).to.equal(1);
   });
 
   it('resets user.items.lastDrop.count', () => {
@@ -88,6 +88,28 @@ describe('cron', () => {
       user.purchased.plan.dateUpdated = moment().subtract(1, 'months').toDate();
     });
 
+    it('awards current mystery items to subscriber', () => {
+      user.purchased.plan.dateUpdated = new Date('2018-12-11');
+      clock = sinon.useFakeTimers(new Date('2019-01-29'));
+      cron({
+        user, tasksByType, daysMissed, analytics,
+      });
+      expect(user.purchased.plan.mysteryItems.length).to.eql(2);
+      const filteredNotifications = user.notifications.filter(n => n.type === 'NEW_MYSTERY_ITEMS');
+      expect(filteredNotifications.length).to.equal(1);
+    });
+
+    it('awards multiple mystery item sets if user skipped months between logins', () => {
+      user.purchased.plan.dateUpdated = new Date('2018-11-11');
+      clock = sinon.useFakeTimers(new Date('2019-01-29'));
+      cron({
+        user, tasksByType, daysMissed, analytics,
+      });
+      expect(user.purchased.plan.mysteryItems.length).to.eql(4);
+      const filteredNotifications = user.notifications.filter(n => n.type === 'NEW_MYSTERY_ITEMS');
+      expect(filteredNotifications.length).to.equal(1);
+    });
+
     it('resets plan.gemsBought on a new month', () => {
       user.purchased.plan.gemsBought = 10;
       cron({
@@ -218,7 +240,7 @@ describe('cron', () => {
       user1.purchased.plan.consecutive.gemCapExtra = 0;
 
       it('does not increment consecutive benefits after the first month', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(1, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(1, 'months')
           .add(2, 'days')
           .toDate());
         // Add 1 month to simulate what happens a month after the subscription was created.
@@ -234,7 +256,7 @@ describe('cron', () => {
       });
 
       it('does not increment consecutive benefits after the second month', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(2, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(2, 'months')
           .add(2, 'days')
           .toDate());
         // Add 1 month to simulate what happens a month after the subscription was created.
@@ -250,7 +272,7 @@ describe('cron', () => {
       });
 
       it('increments consecutive benefits after the third month', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(3, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(3, 'months')
           .add(2, 'days')
           .toDate());
         // Add 1 month to simulate what happens a month after the subscription was created.
@@ -266,7 +288,7 @@ describe('cron', () => {
       });
 
       it('does not increment consecutive benefits after the fourth month', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(4, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(4, 'months')
           .add(2, 'days')
           .toDate());
         // Add 1 month to simulate what happens a month after the subscription was created.
@@ -282,7 +304,7 @@ describe('cron', () => {
       });
 
       it('increments consecutive benefits correctly if user has been absent with continuous subscription', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(10, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(10, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -317,7 +339,7 @@ describe('cron', () => {
       user3.purchased.plan.consecutive.gemCapExtra = 5;
 
       it('does not increment consecutive benefits in the first month of the first paid period that they already have benefits for', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(1, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(1, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -330,7 +352,7 @@ describe('cron', () => {
       });
 
       it('does not increment consecutive benefits in the middle of the period that they already have benefits for', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(2, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(2, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -343,7 +365,7 @@ describe('cron', () => {
       });
 
       it('does not increment consecutive benefits in the final month of the period that they already have benefits for', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(3, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(3, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -356,7 +378,7 @@ describe('cron', () => {
       });
 
       it('increments consecutive benefits the month after the second paid period has started', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(4, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(4, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -369,7 +391,7 @@ describe('cron', () => {
       });
 
       it('does not increment consecutive benefits in the second month of the second period that they already have benefits for', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(5, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(5, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -382,7 +404,7 @@ describe('cron', () => {
       });
 
       it('does not increment consecutive benefits in the final month of the second period that they already have benefits for', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(6, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(6, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -395,7 +417,7 @@ describe('cron', () => {
       });
 
       it('increments consecutive benefits the month after the third paid period has started', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(7, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(7, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -408,7 +430,7 @@ describe('cron', () => {
       });
 
       it('increments consecutive benefits correctly if user has been absent with continuous subscription', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(10, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(10, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -443,7 +465,7 @@ describe('cron', () => {
       user6.purchased.plan.consecutive.gemCapExtra = 10;
 
       it('does not increment consecutive benefits in the first month of the first paid period that they already have benefits for', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(1, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(1, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -456,7 +478,7 @@ describe('cron', () => {
       });
 
       it('does not increment consecutive benefits in the final month of the period that they already have benefits for', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(6, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(6, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -469,7 +491,7 @@ describe('cron', () => {
       });
 
       it('increments consecutive benefits the month after the second paid period has started', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(7, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(7, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -482,7 +504,7 @@ describe('cron', () => {
       });
 
       it('increments consecutive benefits the month after the third paid period has started', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(13, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(13, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -495,7 +517,7 @@ describe('cron', () => {
       });
 
       it('increments consecutive benefits correctly if user has been absent with continuous subscription', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(19, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(19, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -530,7 +552,7 @@ describe('cron', () => {
       user12.purchased.plan.consecutive.gemCapExtra = 20;
 
       it('does not increment consecutive benefits in the first month of the first paid period that they already have benefits for', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(1, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(1, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -543,7 +565,7 @@ describe('cron', () => {
       });
 
       it('does not increment consecutive benefits in the final month of the period that they already have benefits for', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(12, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(12, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -556,7 +578,7 @@ describe('cron', () => {
       });
 
       it('increments consecutive benefits the month after the second paid period has started', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(13, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(13, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -569,7 +591,7 @@ describe('cron', () => {
       });
 
       it('increments consecutive benefits the month after the third paid period has started', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(25, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(25, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -582,7 +604,7 @@ describe('cron', () => {
       });
 
       it('increments consecutive benefits correctly if user has been absent with continuous subscription', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(37, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(37, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -619,7 +641,7 @@ describe('cron', () => {
       user3g.purchased.plan.consecutive.gemCapExtra = 5;
 
       it('does not increment consecutive benefits in the first month of the gift subscription', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(1, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(1, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -632,7 +654,7 @@ describe('cron', () => {
       });
 
       it('does not increment consecutive benefits in the second month of the gift subscription', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(2, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(2, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -645,7 +667,7 @@ describe('cron', () => {
       });
 
       it('does not increment consecutive benefits in the third month of the gift subscription', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(3, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(3, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -658,7 +680,7 @@ describe('cron', () => {
       });
 
       it('does not increment consecutive benefits in the month after the gift subscription has ended', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(4, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(4, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -695,7 +717,7 @@ describe('cron', () => {
       user6x.purchased.plan.consecutive.gemCapExtra = 15;
 
       it('increments consecutive benefits in the first month since the fix for #4819 goes live', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(1, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(1, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -708,7 +730,7 @@ describe('cron', () => {
       });
 
       it('does not increment consecutive benefits in the second month after the fix goes live', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(2, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(2, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -721,7 +743,7 @@ describe('cron', () => {
       });
 
       it('does not increment consecutive benefits in the third month after the fix goes live', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(3, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(3, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -734,7 +756,7 @@ describe('cron', () => {
       });
 
       it('increments consecutive benefits in the seventh month after the fix goes live', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(7, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(7, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -857,6 +879,11 @@ describe('cron', () => {
       tasksByType.todos.push(task);
     });
 
+    afterEach(() => {
+      tasksByType.todos = [];
+      user.tasksOrder.todos = [];
+    });
+
     it('should make uncompleted todos redder', () => {
       const valueBefore = tasksByType.todos[0].value;
       cron({
@@ -865,6 +892,15 @@ describe('cron', () => {
       expect(tasksByType.todos[0].value).to.be.lessThan(valueBefore);
     });
 
+    it('should not make completed todos redder', () => {
+      tasksByType.todos[0].completed = true;
+      const valueBefore = tasksByType.todos[0].value;
+      cron({
+        user, tasksByType, daysMissed, analytics,
+      });
+      expect(tasksByType.todos[0].value).to.equal(valueBefore);
+    });
+
     it('should add history of completed todos to user history', () => {
       tasksByType.todos[0].completed = true;
 
@@ -876,17 +912,13 @@ describe('cron', () => {
     });
 
     it('should remove completed todos from users taskOrder list', () => {
-      tasksByType.todos = [];
-      user.tasksOrder.todos = [];
       const todo = {
         text: 'test todo',
         type: 'todo',
         value: 0,
       };
 
-      let task = new Tasks.todo(Tasks.Task.sanitize(todo)); // eslint-disable-line new-cap
-      tasksByType.todos.push(task);
-      task = new Tasks.todo(Tasks.Task.sanitize(todo)); // eslint-disable-line new-cap
+      const task = new Tasks.todo(Tasks.Task.sanitize(todo)); // eslint-disable-line new-cap
       tasksByType.todos.push(task);
       tasksByType.todos[0].completed = true;
 
@@ -908,8 +940,6 @@ describe('cron', () => {
     });
 
     it('should preserve todos order in task list', () => {
-      tasksByType.todos = [];
-      user.tasksOrder.todos = [];
       const todo = {
         text: 'test todo',
         type: 'todo',

test/api/unit/libs/email.test.js

@@ -18,6 +18,16 @@ function getUser () {
           value: 'email@facebook',
         }],
       },
+      google: {
+        emails: [{
+          value: 'email@google',
+        }],
+      },
+      apple: {
+        emails: [{
+          value: 'email@apple',
+        }],
+      },
     },
     profile: {
       name: 'profile name',
@@ -58,6 +68,8 @@ describe('emails', () => {
       const user = getUser();
       delete user.profile.name;
       delete user.auth.local.email;
+      delete user.auth.google.emails;
+      delete user.auth.apple.emails;
 
       const data = getUserInfo(user, ['name', 'email', '_id', 'canSend']);
 
@@ -67,12 +79,48 @@ describe('emails', () => {
       expect(data).to.have.property('canSend', true);
     });
 
+    it('returns correct user data [google users]', () => {
+      const attachEmail = requireAgain(pathToEmailLib);
+      const { getUserInfo } = attachEmail;
+      const user = getUser();
+      delete user.profile.name;
+      delete user.auth.local.email;
+      delete user.auth.facebook.emails;
+      delete user.auth.apple.emails;
+
+      const data = getUserInfo(user, ['name', 'email', '_id', 'canSend']);
+
+      expect(data).to.have.property('name', user.auth.local.username);
+      expect(data).to.have.property('email', user.auth.google.emails[0].value);
+      expect(data).to.have.property('_id', user._id);
+      expect(data).to.have.property('canSend', true);
+    });
+
+    it('returns correct user data [apple users]', () => {
+      const attachEmail = requireAgain(pathToEmailLib);
+      const { getUserInfo } = attachEmail;
+      const user = getUser();
+      delete user.profile.name;
+      delete user.auth.local.email;
+      delete user.auth.google.emails;
+      delete user.auth.facebook.emails;
+
+      const data = getUserInfo(user, ['name', 'email', '_id', 'canSend']);
+
+      expect(data).to.have.property('name', user.auth.local.username);
+      expect(data).to.have.property('email', user.auth.apple.emails[0].value);
+      expect(data).to.have.property('_id', user._id);
+      expect(data).to.have.property('canSend', true);
+    });
+
     it('has fallbacks for missing data', () => {
       const attachEmail = requireAgain(pathToEmailLib);
       const { getUserInfo } = attachEmail;
       const user = getUser();
       delete user.auth.local.email;
       delete user.auth.facebook;
+      delete user.auth.google;
+      delete user.auth.apple;
 
       const data = getUserInfo(user, ['name', 'email', '_id', 'canSend']);
 
@@ -121,8 +169,7 @@ describe('emails', () => {
 
       sendTxnEmail(mailingInfo, emailType);
       expect(got.post).to.be.calledWith('undefined/job', sinon.match({
-        json: true,
-        body: {
+        json: {
           data: {
             emailType: sinon.match.same(emailType),
             to: sinon.match(value => Array.isArray(value) && value[0].name === mailingInfo.name, 'matches mailing info array'),
@@ -154,8 +201,7 @@ describe('emails', () => {
 
       sendTxnEmail(mailingInfo, emailType);
       expect(got.post).to.be.calledWith('undefined/job', sinon.match({
-        json: true,
-        body: {
+        json: {
           data: {
             emailType: sinon.match.same(emailType),
             to: sinon.match(val => val[0]._id === mailingInfo._id),
@@ -177,8 +223,7 @@ describe('emails', () => {
 
       sendTxnEmail(mailingInfo, emailType, variables);
       expect(got.post).to.be.calledWith('undefined/job', sinon.match({
-        json: true,
-        body: {
+        json: {
           data: {
             variables: sinon.match(value => value[0].name === 'BASE_URL', 'matches variables'),
             personalVariables: sinon.match(value => value[0].rcpt === mailingInfo.email

test/api/unit/libs/errors.test.js

@@ -3,6 +3,7 @@ import {
   CustomError,
   NotAuthorized,
   BadRequest,
+  Forbidden,
   InternalServerError,
   NotFound,
   NotificationNotFound,
@@ -113,6 +114,32 @@ describe('Custom Errors', () => {
     });
   });
 
+  describe('Forbidden', () => {
+    it('is an instance of CustomError', () => {
+      const forbiddenError = new Forbidden();
+
+      expect(forbiddenError).to.be.an.instanceOf(CustomError);
+    });
+
+    it('it returns an http code of 401', () => {
+      const forbiddenError = new Forbidden();
+
+      expect(forbiddenError.httpCode).to.eql(403);
+    });
+
+    it('returns a default message', () => {
+      const forbiddenError = new Forbidden();
+
+      expect(forbiddenError.message).to.eql('Access forbidden.');
+    });
+
+    it('allows a custom message', () => {
+      const forbiddenError = new Forbidden('Custom Error Message');
+
+      expect(forbiddenError.message).to.eql('Custom Error Message');
+    });
+  });
+
   describe('InternalServerError', () => {
     it('is an instance of CustomError', () => {
       const internalServerError = new InternalServerError();

test/api/unit/libs/highlightMentions.js

@@ -1,60 +0,0 @@
-import mongoose from 'mongoose';
-import {
-  highlightMentions,
-} from '../../../../website/server/libs/highlightMentions';
-
-describe('highlightMentions', () => {
-  beforeEach(() => {
-    const mockFind = {
-      select () {
-        return this;
-      },
-      lean () {
-        return this;
-      },
-      exec () {
-        return Promise.resolve([{
-          auth: { local: { username: 'user' } }, _id: '111',
-        }, { auth: { local: { username: 'user2' } }, _id: '222' }, { auth: { local: { username: 'user3' } }, _id: '333' }, { auth: { local: { username: 'user-dash' } }, _id: '444' }, { auth: { local: { username: 'user_underscore' } }, _id: '555' },
-        ]);
-      },
-    };
-
-    sinon.stub(mongoose.Model, 'find').returns(mockFind);
-  });
-
-  afterEach(() => {
-    sinon.restore();
-  });
-
-  it('doesn\'t change text without mentions', async () => {
-    const text = 'some chat text';
-    const result = await highlightMentions(text);
-    expect(result[0]).to.equal(text);
-  });
-  it('highlights existing users', async () => {
-    const text = '@user: message';
-    const result = await highlightMentions(text);
-    expect(result[0]).to.equal('[@user](/profile/111): message');
-  });
-  it('highlights special characters', async () => {
-    const text = '@user-dash: message @user_underscore';
-    const result = await highlightMentions(text);
-    expect(result[0]).to.equal('[@user-dash](/profile/444): message [@user_underscore](/profile/555)');
-  });
-  it('doesn\'t highlight nonexisting users', async () => {
-    const text = '@nouser message';
-    const result = await highlightMentions(text);
-    expect(result[0]).to.equal('@nouser message');
-  });
-  it('highlights multiple existing users', async () => {
-    const text = '@user message (@user2) @user3 @user';
-    const result = await highlightMentions(text);
-    expect(result[0]).to.equal('[@user](/profile/111) message ([@user2](/profile/222)) [@user3](/profile/333) [@user](/profile/111)');
-  });
-  it('doesn\'t highlight more than 5 users', async () => {
-    const text = '@user @user2 @user3 @user4 @user5 @user6';
-    const result = await highlightMentions(text);
-    expect(result[0]).to.equal(text);
-  });
-});

test/api/unit/libs/highlightMentions.test.js

@@ -0,0 +1,198 @@
+import mongoose from 'mongoose';
+
+import highlightMentions from '../../../../website/server/libs/highlightMentions';
+
+describe('highlightMentions', () => {
+  beforeEach(() => {
+    const mockFind = {
+      select () {
+        return this;
+      },
+      lean () {
+        return this;
+      },
+      exec () {
+        return Promise.resolve([
+          { auth: { local: { username: 'user' } }, _id: '111' },
+          { auth: { local: { username: 'user2' } }, _id: '222' },
+          { auth: { local: { username: 'user3' } }, _id: '333' },
+          { auth: { local: { username: 'user-dash' } }, _id: '444' },
+          { auth: { local: { username: 'user_underscore' } }, _id: '555' },
+        ]);
+      },
+    };
+
+    sinon.stub(mongoose.Model, 'find').returns(mockFind);
+  });
+
+  afterEach(() => {
+    sinon.restore();
+  });
+
+  it('doesn\'t change text without mentions', async () => {
+    const text = 'some chat text';
+    const result = await highlightMentions(text);
+    expect(result[0]).to.equal(text);
+  });
+
+  it('highlights existing users', async () => {
+    const text = '@user: message';
+    const result = await highlightMentions(text);
+    expect(result[0]).to.equal('[@user](/profile/111): message');
+  });
+
+  it('highlights special characters', async () => {
+    const text = '@user-dash: message @user_underscore';
+    const result = await highlightMentions(text);
+    expect(result[0]).to.equal('[@user-dash](/profile/444): message [@user_underscore](/profile/555)');
+  });
+
+  it('doesn\'t highlight nonexisting users', async () => {
+    const text = '@nouser message';
+    const result = await highlightMentions(text);
+    expect(result[0]).to.equal('@nouser message');
+  });
+
+  it('highlights multiple existing users', async () => {
+    const text = '@user message (@user2) @user3 @user';
+    const result = await highlightMentions(text);
+    expect(result[0]).to.equal('[@user](/profile/111) message ([@user2](/profile/222)) [@user3](/profile/333) [@user](/profile/111)');
+  });
+
+  it('doesn\'t highlight more than 5 users', async () => {
+    const text = '@user @user2 @user3 @user4 @user5 @user6';
+    const result = await highlightMentions(text);
+    expect(result[0]).to.equal(text);
+  });
+
+  describe('link interactions', async () => {
+    it('doesn\'t highlight users in link', async () => {
+      const text = 'http://www.medium.com/@user/blog';
+      const result = await highlightMentions(text);
+      expect(result[0]).to.equal(text);
+    });
+
+    it('doesn\'t highlight user in link between brackets', async () => {
+      const text = '(http://www.medium.com/@user/blog)';
+      const result = await highlightMentions(text);
+      expect(result[0]).to.equal(text);
+    });
+
+    it('doesn\'t highlight user in an autolink', async () => {
+      const text = '<http://www.medium.com/@user/blog>';
+      const result = await highlightMentions(text);
+      expect(result[0]).to.equal(text);
+    });
+
+    it('doesn\'t highlight users in link text', async () => {
+      const text = '[Check awesome blog written by @user](http://www.medium.com/@user/blog)';
+      const result = await highlightMentions(text);
+      expect(result[0]).to.equal(text);
+    });
+
+    it('doesn\'t highlight users in link with newlines and markup', async () => {
+      const text = '[Check `awesome` \nblog **written** by @user](http://www.medium.com/@user/blog)';
+      const result = await highlightMentions(text);
+      expect(result[0]).to.equal(text);
+    });
+
+    it('doesn\'t highlight users in link when followed by same @user mention', async () => {
+      const text = 'http://www.medium.com/@user/blog @user';
+      const result = await highlightMentions(text);
+      expect(result[0]).to.equal('http://www.medium.com/@user/blog [@user](/profile/111)');
+    });
+
+    // https://spec.commonmark.org/0.29/#example-483
+    it('doesn\'t highlight user in a link without url', async () => {
+      const text = '[@user2]()';
+      const result = await highlightMentions(text);
+      expect(result[0]).to.equal(text);
+    });
+
+    // https://github.com/HabitRPG/habitica/issues/12217
+    it('doesn\'t highlight user in link with url-escapable characters', async () => {
+      const text = '[test](https://habitica.fandom.com/ru/@wiki/Снаряжение)';
+      const result = await highlightMentions(text);
+      expect(result[0]).to.equal(text);
+    });
+
+    // https://github.com/HabitRPG/habitica/issues/12223
+    it('matches a link in between two the same links', async () => {
+      const text = '[here](http://habitica.wikia.com/wiki/The_Keep:Pirate_Cove/FAQ)\n@user\n[hier](http://habitica.wikia.com/wiki/The_Keep:Pirate_Cove/FAQ)';
+
+      const result = await highlightMentions(text);
+
+      expect(result[0]).to.equal('[here](http://habitica.wikia.com/wiki/The_Keep:Pirate_Cove/FAQ)\n[@user](/profile/111)\n[hier](http://habitica.wikia.com/wiki/The_Keep:Pirate_Cove/FAQ)');
+    });
+  });
+
+  describe('exceptions in code blocks', () => {
+    it('doesn\'t highlight user in inline code block', async () => {
+      const text = '`@user`';
+
+      const result = await highlightMentions(text);
+
+      expect(result[0]).to.equal(text);
+    });
+
+    it('doesn\'t highlight user in fenced code block', async () => {
+      const text = 'Text\n\n```\n// code referencing @user\n```\n\nText';
+
+      const result = await highlightMentions(text);
+
+      expect(result[0]).to.equal(text);
+    });
+
+    it('doesn\'t highlight user in indented code block', async () => {
+      const text = '      @user';
+
+      const result = await highlightMentions(text);
+
+      expect(result[0]).to.equal(text);
+    });
+
+    it('does highlight user that\'s after in-line code block', async () => {
+      const text = '`<code />` for @user';
+
+      const result = await highlightMentions(text);
+
+      expect(result[0]).to.equal('`<code />` for [@user](/profile/111)');
+    });
+
+    it('does highlight same content properly', async () => {
+      const text = '@user `@user`';
+
+      const result = await highlightMentions(text);
+
+      expect(result[0]).to.equal('[@user](/profile/111) `@user`');
+    });
+  });
+
+  it('github issue 12118, method crashes when square brackets are used', async () => {
+    const text = '[test]';
+
+    let err;
+
+    try {
+      await highlightMentions(text);
+    } catch (e) {
+      err = e;
+    }
+
+    expect(err).to.be.undefined;
+  });
+
+  it('github issue 12138, method crashes when regex chars are used in code block', async () => {
+    const text = '`[test]`';
+
+    let err;
+
+    try {
+      await highlightMentions(text);
+    } catch (e) {
+      err = e;
+    }
+
+    expect(err).to.be.undefined;
+  });
+});

test/api/unit/libs/language.test.js

@@ -0,0 +1,111 @@
+import {
+  getLanguageFromBrowser,
+  getLanguageFromUser,
+} from '../../../../website/server/libs/language';
+import {
+  generateReq,
+} from '../../../helpers/api-unit.helper';
+
+describe('language lib', () => {
+  let req;
+
+  beforeEach(() => {
+    req = generateReq();
+  });
+
+  describe('getLanguageFromUser', () => {
+    it('uses the user preferred language if avalaible', () => {
+      const user = {
+        preferences: {
+          language: 'it',
+        },
+      };
+
+      expect(getLanguageFromUser(user, req)).to.equal('it');
+    });
+
+    it('falls back to english if the user preferred language is not avalaible', () => {
+      const user = {
+        preferences: {
+          language: 'bla',
+        },
+      };
+
+      expect(getLanguageFromUser(user, req)).to.equal('en');
+    });
+  });
+
+  describe('getLanguageFromBrowser', () => {
+    it('uses browser specificed language', () => {
+      req.headers['accept-language'] = 'pt';
+
+      expect(getLanguageFromBrowser(req)).to.equal('pt');
+    });
+
+    it('uses first language in series if browser specifies multiple', () => {
+      req.headers['accept-language'] = 'he, pt, it';
+
+      expect(getLanguageFromBrowser(req)).to.equal('he');
+    });
+
+    it('skips invalid lanaguages and uses first language in series if browser specifies multiple', () => {
+      req.headers['accept-language'] = 'blah, he, pt, it';
+
+      expect(getLanguageFromBrowser(req)).to.equal('he');
+    });
+
+    it('uses normal version of language if specialized locale is passed in', () => {
+      req.headers['accept-language'] = 'fr-CA';
+
+      expect(getLanguageFromBrowser(req)).to.equal('fr');
+    });
+
+    it('uses normal version of language if specialized locale is passed in', () => {
+      req.headers['accept-language'] = 'fr-CA';
+
+      expect(getLanguageFromBrowser(req)).to.equal('fr');
+    });
+
+    it('uses es if es is passed in', () => {
+      req.headers['accept-language'] = 'es';
+
+      expect(getLanguageFromBrowser(req)).to.equal('es');
+    });
+
+    it('uses es_419 if applicable es-languages are passed in', () => {
+      req.headers['accept-language'] = 'es-mx';
+
+      expect(getLanguageFromBrowser(req)).to.equal('es_419');
+    });
+
+    it('uses es_419 if multiple es languages are passed in', () => {
+      req.headers['accept-language'] = 'es-GT, es-MX, es-CR';
+
+      expect(getLanguageFromBrowser(req)).to.equal('es_419');
+    });
+
+    it('zh', () => {
+      req.headers['accept-language'] = 'zh-TW';
+
+      expect(getLanguageFromBrowser(req)).to.equal('zh_TW');
+    });
+
+    it('uses english if browser specified language is not compatible', () => {
+      req.headers['accept-language'] = 'blah';
+
+      expect(getLanguageFromBrowser(req)).to.equal('en');
+    });
+
+    it('uses english if browser does not specify', () => {
+      req.headers['accept-language'] = '';
+
+      expect(getLanguageFromBrowser(req)).to.equal('en');
+    });
+
+    it('uses english if browser does not supply an accept-language header', () => {
+      delete req.headers['accept-language'];
+
+      expect(getLanguageFromBrowser(req)).to.equal('en');
+    });
+  });
+});

test/api/unit/libs/localizeContentData.js

@@ -0,0 +1,22 @@
+import faq from '../../../../website/common/script/content/faq';
+import common from '../../../../website/common';
+import { localizeContentData } from '../../../../website/server/libs/content';
+
+const { i18n } = common;
+
+describe('localizeContentData', () => {
+  it('Should take a an object with localization identifiers and '
+    + 'return an object with actual translations in English', () => {
+    const faqInEnglish = localizeContentData(faq, 'en');
+
+    expect(faqInEnglish).to.have.property('stillNeedHelp');
+    expect(faqInEnglish.stillNeedHelp.ios).to.equal(i18n.t('iosFaqStillNeedHelp', 'en'));
+  });
+  it('Should take an object with localization identifiers and '
+    + 'return an object with actual translations in German', () => {
+    const faqInEnglish = localizeContentData(faq, 'de');
+
+    expect(faqInEnglish).to.have.property('stillNeedHelp');
+    expect(faqInEnglish.stillNeedHelp.ios).to.equal(i18n.t('iosFaqStillNeedHelp', 'de'));
+  });
+});

test/api/unit/libs/logger.js

@@ -1,14 +1,27 @@
-import winston from 'winston';
-import logger from '../../../../website/server/libs/logger';
+import logger, { _loggerConfig } from '../../../../website/server/libs/logger';
 import {
   NotFound,
 } from '../../../../website/server/libs/errors';
 
 describe('logger', () => {
-  let logSpy;
+  let infoSpy;
+  let warnSpy;
+  let errorSpy;
+
+  const originalLoggingEnabled = _loggerConfig.loggingEnabled;
+
+  before(() => { // enable logging in tests
+    _loggerConfig.loggingEnabled = true;
+  });
+
+  after(() => { // reset value of _loggerConfig.loggingEnabled
+    _loggerConfig.loggingEnabled = originalLoggingEnabled;
+  });
 
   beforeEach(() => {
-    logSpy = sandbox.stub(winston.Logger.prototype, 'log');
+    infoSpy = sandbox.stub(_loggerConfig.logger, 'info');
+    warnSpy = sandbox.stub(_loggerConfig.logger, 'warn');
+    errorSpy = sandbox.stub(_loggerConfig.logger, 'error');
   });
 
   afterEach(() => {
@@ -17,18 +30,52 @@ describe('logger', () => {
 
   describe('info', () => {
     it('calls winston\'s info log', () => {
-      logger.info(1, 2, 3);
-      expect(logSpy).to.be.calledOnce;
-      expect(logSpy).to.be.calledWith('info', 1, 2, 3);
+      logger.info('1', 2);
+      expect(infoSpy).to.be.calledOnce;
+      expect(infoSpy).to.be.calledWith('1', { extraData: 2 });
+    });
+
+    it('allows up to two arguments', () => {
+      expect(() => logger.info('1', 2, 3)).to.throw;
+      expect(infoSpy).to.not.be.called;
+    });
+
+    it('has default message', () => {
+      logger.info(1);
+      expect(infoSpy).to.be.calledOnce;
+      expect(infoSpy).to.be.calledWith('No message provided for log.', { extraData: 1 });
+    });
+
+    it('wraps non objects', () => {
+      logger.info('message', [1, 2]);
+      expect(infoSpy).to.be.calledOnce;
+      expect(infoSpy).to.be.calledWithMatch('message', { extraData: [1, 2] });
+    });
+
+    it('does not wrap objects', () => {
+      logger.info('message', { a: 1, b: 2 });
+      expect(infoSpy).to.be.calledOnce;
+      expect(infoSpy).to.be.calledWithMatch('message', { a: 1, b: 2 });
+    });
+
+    it('throws if two arguments and no message', () => {
+      expect(() => logger.info({ a: 1 }, { b: 2 })).to.throw;
+      expect(infoSpy).to.not.be.called;
     });
   });
 
   describe('error', () => {
-    context('non-error object', () => {
-      it('passes through arguments if the first arg is not an error object', () => {
-        logger.error(1, 2, 3, 4);
-        expect(logSpy).to.be.calledOnce;
-        expect(logSpy).to.be.calledWith('error', 1, 2, 3, 4);
+    it('allows up to two arguments', () => {
+      expect(() => logger.error('1', 2, 3)).to.throw;
+      expect(errorSpy).to.not.be.called;
+    });
+
+    it('handled non-error object', () => {
+      logger.error(1, 2);
+      expect(errorSpy).to.be.calledOnce;
+      expect(errorSpy).to.be.calledWithMatch('logger.error expects an Error instance', {
+        invalidErr: 1,
+        extraData: 2,
       });
     });
 
@@ -37,15 +84,12 @@ describe('logger', () => {
         const errInstance = new Error('An error.');
         logger.error(errInstance, {
           data: 1,
-        }, 2, 3);
+        });
 
-        expect(logSpy).to.be.calledOnce;
-        expect(logSpy).to.be.calledWith(
-          'error',
+        expect(errorSpy).to.be.calledOnce;
+        expect(errorSpy).to.be.calledWith(
           errInstance.stack,
           { data: 1, fullError: errInstance },
-          2,
-          3,
         );
       });
 
@@ -56,60 +100,60 @@ describe('logger', () => {
         logger.error(errInstance, {
           data: 1,
           fullError: anotherError,
-        }, 2, 3);
+        });
 
-        expect(logSpy).to.be.calledOnce;
-        expect(logSpy).to.be.calledWith(
-          'error',
+        expect(errorSpy).to.be.calledOnce;
+        expect(errorSpy).to.be.calledWith(
           errInstance.stack,
           { data: 1, fullError: anotherError },
-          2,
-          3,
         );
       });
 
       it('logs the error when errorData is null', () => {
         const errInstance = new Error('An error.');
 
-        logger.error(errInstance, null, 2, 3);
+        logger.error(errInstance, null);
 
-        expect(logSpy).to.be.calledOnce;
-        expect(logSpy).to.be.calledWith(
-          'error',
+        expect(errorSpy).to.be.calledOnce;
+        expect(errorSpy).to.be.calledWithMatch(
           errInstance.stack,
-          null,
-          2,
-          3,
+          { },
         );
       });
 
       it('logs the error when errorData is not an object', () => {
         const errInstance = new Error('An error.');
 
-        logger.error(errInstance, true, 2, 3);
+        logger.error(errInstance, true);
 
-        expect(logSpy).to.be.calledOnce;
-        expect(logSpy).to.be.calledWith(
-          'error',
+        expect(errorSpy).to.be.calledOnce;
+        expect(errorSpy).to.be.calledWithMatch(
           errInstance.stack,
-          true,
-          2,
-          3,
+          { extraData: true },
+        );
+      });
+
+      it('logs the error when errorData is a string', () => {
+        const errInstance = new Error('An error.');
+
+        logger.error(errInstance, 'a string');
+
+        expect(errorSpy).to.be.calledOnce;
+        expect(errorSpy).to.be.calledWithMatch(
+          errInstance.stack,
+          { extraMessage: 'a string' },
         );
       });
 
       it('logs the error when errorData does not include isHandledError property', () => {
         const errInstance = new Error('An error.');
 
-        logger.error(errInstance, { httpCode: 400 }, 2, 3);
+        logger.error(errInstance, { httpCode: 400 });
 
-        expect(logSpy).to.be.calledOnce;
-        expect(logSpy).to.be.calledWith(
-          'error',
+        expect(errorSpy).to.be.calledOnce;
+        expect(errorSpy).to.be.calledWith(
           errInstance.stack,
           { httpCode: 400, fullError: errInstance },
-          2,
-          3,
         );
       });
 
@@ -119,15 +163,12 @@ describe('logger', () => {
         logger.error(errInstance, {
           isHandledError: true,
           httpCode: 502,
-        }, 2, 3);
+        });
 
-        expect(logSpy).to.be.calledOnce;
-        expect(logSpy).to.be.calledWith(
-          'error',
+        expect(errorSpy).to.be.calledOnce;
+        expect(errorSpy).to.be.calledWith(
           errInstance.stack,
           { httpCode: 502, isHandledError: true, fullError: errInstance },
-          2,
-          3,
         );
       });
 
@@ -137,15 +178,12 @@ describe('logger', () => {
         logger.error(errInstance, {
           isHandledError: true,
           httpCode: 403,
-        }, 2, 3);
+        });
 
-        expect(logSpy).to.be.calledOnce;
-        expect(logSpy).to.be.calledWith(
-          'warn',
+        expect(warnSpy).to.be.calledOnce;
+        expect(warnSpy).to.be.calledWith(
           errInstance.stack,
           { httpCode: 403, isHandledError: true, fullError: errInstance },
-          2,
-          3,
         );
       });
 
@@ -154,19 +192,16 @@ describe('logger', () => {
 
         errInstance.customField = 'Some interesting data';
 
-        logger.error(errInstance, {}, 2, 3);
+        logger.error(errInstance, {});
 
-        expect(logSpy).to.be.calledOnce;
-        expect(logSpy).to.be.calledWith(
-          'error',
+        expect(errorSpy).to.be.calledOnce;
+        expect(errorSpy).to.be.calledWith(
           errInstance.stack,
           {
             fullError: {
               customField: 'Some interesting data',
             },
           },
-          2,
-          3,
         );
       });
     });

test/api/unit/libs/mongodb.js

@@ -0,0 +1,50 @@
+import os from 'os';
+import nconf from 'nconf';
+import requireAgain from 'require-again';
+
+const pathToMongoLib = '../../../../website/server/libs/mongodb';
+
+describe('mongodb', () => {
+  afterEach(() => {
+    sandbox.restore();
+  });
+
+  describe('getDevelopmentConnectionUrl', () => {
+    it('returns the original connection url if not on windows', () => {
+      sandbox.stub(os, 'platform').returns('linux');
+      const mongoLibOverride = requireAgain(pathToMongoLib);
+
+      const originalString = 'mongodb://localhost:3030';
+      const string = mongoLibOverride.getDevelopmentConnectionUrl(originalString);
+      expect(string).to.equal(originalString);
+    });
+
+    it('replaces localhost with hostname on windows', () => {
+      sandbox.stub(os, 'platform').returns('win32');
+      sandbox.stub(os, 'hostname').returns('hostname');
+      const mongoLibOverride = requireAgain(pathToMongoLib);
+
+      const originalString = 'mongodb://localhost:3030';
+      const string = mongoLibOverride.getDevelopmentConnectionUrl(originalString);
+      expect(string).to.equal('mongodb://hostname:3030');
+    });
+  });
+
+  describe('getDefaultConnectionOptions', () => {
+    it('returns development config when IS_PROD is false', () => {
+      sandbox.stub(nconf, 'get').withArgs('IS_PROD').returns(false);
+      const mongoLibOverride = requireAgain(pathToMongoLib);
+
+      const options = mongoLibOverride.getDefaultConnectionOptions();
+      expect(options).to.have.all.keys(['useNewUrlParser', 'useUnifiedTopology']);
+    });
+
+    it('returns production config when IS_PROD is true', () => {
+      sandbox.stub(nconf, 'get').withArgs('IS_PROD').returns(true);
+      const mongoLibOverride = requireAgain(pathToMongoLib);
+
+      const options = mongoLibOverride.getDefaultConnectionOptions();
+      expect(options).to.have.all.keys(['useNewUrlParser', 'useUnifiedTopology', 'keepAlive', 'keepAliveInitialDelay']);
+    });
+  });
+});

test/api/unit/libs/payments/amazon/upgrade-groupplan.test.js

@@ -1,5 +1,3 @@
-import uuid from 'uuid';
-
 import {
   generateGroup,
 } from '../../../../../helpers/api-unit.helper';
@@ -7,6 +5,7 @@ import { model as User } from '../../../../../../website/server/models/user';
 import { model as Group } from '../../../../../../website/server/models/group';
 import amzLib from '../../../../../../website/server/libs/payments/amazon';
 import payments from '../../../../../../website/server/libs/payments/payments';
+import common from '../../../../../../website/common';
 
 describe('#upgradeGroupPlan', () => {
   let spy; let data; let user; let group; let
@@ -32,16 +31,19 @@ describe('#upgradeGroupPlan', () => {
     group = generateGroup({
       name: 'test group',
       type: 'guild',
-      privacy: 'public',
+      privacy: 'private',
       leader: user._id,
     });
     await group.save();
 
+    user.guilds.push(group._id);
+    await user.save();
+
     spy = sinon.stub(amzLib, 'authorizeOnBillingAgreement');
     spy.resolves([]);
 
     uuidString = 'uuid-v4';
-    sinon.stub(uuid, 'v4').returns(uuidString);
+    sinon.stub(common, 'uuid').returns(uuidString);
 
     data.groupId = group._id;
     data.sub.quantity = 3;
@@ -49,7 +51,7 @@ describe('#upgradeGroupPlan', () => {
 
   afterEach(() => {
     amzLib.authorizeOnBillingAgreement.restore();
-    uuid.v4.restore();
+    common.uuid.restore();
   });
 
   it('charges for a new member', async () => {

test/api/unit/libs/payments/google.test.js

@@ -278,19 +278,6 @@ describe('Google Payments', () => {
         });
     });
 
-    it('should throw an error if subscription is still valid', async () => {
-      iap.getPurchaseData.restore();
-      iapGetPurchaseDataStub = sinon.stub(iap, 'getPurchaseData')
-        .returns([{ expirationDate: expirationDate.add({ day: 1 }).toDate() }]);
-
-      await expect(googlePayments.cancelSubscribe(user, headers))
-        .to.eventually.be.rejected.and.to.eql({
-          httpCode: 401,
-          name: 'NotAuthorized',
-          message: googlePayments.constants.RESPONSE_STILL_VALID,
-        });
-    });
-
     it('should throw an error if receipt is invalid', async () => {
       iap.isValidated.restore();
       iapIsValidatedStub = sinon.stub(iap, 'isValidated')

test/api/unit/libs/payments/group-plans/group-payments-cancel.test.js

@@ -21,11 +21,14 @@ describe('Canceling a subscription for group', () => {
     group = generateGroup({
       name: 'test group',
       type: 'guild',
-      privacy: 'public',
+      privacy: 'private',
       leader: user._id,
     });
     await group.save();
 
+    user.guilds.push(group._id);
+    await user.save();
+
     data = {
       user,
       sub: {
@@ -141,6 +144,8 @@ describe('Canceling a subscription for group', () => {
 
   it('prevents non group leader from managing subscription', async () => {
     const groupMember = new User();
+    groupMember.guilds.push(group._id);
+    await groupMember.save();
     data.user = groupMember;
     data.groupId = group._id;
 
@@ -162,7 +167,9 @@ describe('Canceling a subscription for group', () => {
 
     let updatedGroup = await Group.findById(group._id).exec();
     const newLeader = new User();
+    newLeader.profile.name = 'newLeader';
     updatedGroup.leader = newLeader._id;
+    await newLeader.save();
     await updatedGroup.save();
 
     await api.cancelSubscription(data);
@@ -185,8 +192,6 @@ describe('Canceling a subscription for group', () => {
         'user-agent': '',
       },
     };
-    user.guilds.push(group._id);
-    await user.save();
     expect(group.purchased.plan.planId).to.not.exist;
     data.groupId = group._id;
     await api.createSubscription(data);
@@ -211,10 +216,15 @@ describe('Canceling a subscription for group', () => {
     await api.createSubscription(data);
     await api.cancelSubscription(data);
 
-    expect(sender.sendTxn).to.be.have.callCount(4);
-    expect(sender.sendTxn.thirdCall.args[0]._id).to.equal(recipient._id);
-    expect(sender.sendTxn.thirdCall.args[1]).to.equal('group-member-cancel');
-    expect(sender.sendTxn.thirdCall.args[2]).to.eql([
+    expect(sender.sendTxn).to.be.have.callCount(6);
+    const recipientCall = sender.sendTxn.getCalls().find(call => {
+      const isRecipient = call.args[0]._id === recipient._id;
+      const isGroupMemberCancel = call.args[1] === 'group-member-cancel';
+      return isRecipient && isGroupMemberCancel;
+    });
+    expect(recipientCall.args[0]._id).to.equal(recipient._id);
+    expect(recipientCall.args[1]).to.equal('group-member-cancel');
+    expect(recipientCall.args[2]).to.eql([
       { name: 'LEADER', content: user.profile.name },
       { name: 'GROUP_NAME', content: group.name },
     ]);
@@ -246,8 +256,6 @@ describe('Canceling a subscription for group', () => {
     recipient.guilds.push(group._id);
     await recipient.save();
 
-    user.guilds.push(group._id);
-    await user.save();
     data.groupId = group._id;
 
     await api.createSubscription(data);
@@ -259,11 +267,13 @@ describe('Canceling a subscription for group', () => {
     const group2 = generateGroup({
       name: 'test group2',
       type: 'guild',
-      privacy: 'public',
+      privacy: 'private',
       leader: user._id,
     });
     data.groupId = group2._id;
     await group2.save();
+    user.guilds.push(group2._id);
+    await user.save();
     recipient.guilds.push(group2._id);
     await recipient.save();
 
@@ -285,8 +295,6 @@ describe('Canceling a subscription for group', () => {
   });
 
   it('does cancel a leader subscription with two cancelled group plans', async () => {
-    user.guilds.push(group._id);
-    await user.save();
     data.groupId = group._id;
 
     await api.createSubscription(data);
@@ -298,7 +306,7 @@ describe('Canceling a subscription for group', () => {
     const group2 = generateGroup({
       name: 'test group2',
       type: 'guild',
-      privacy: 'public',
+      privacy: 'private',
       leader: user._id,
     });
     user.guilds.push(group2._id);

test/api/unit/libs/payments/group-plans/group-payments-create.test.js

@@ -12,6 +12,7 @@ import { model as Group } from '../../../../../../website/server/models/group';
 import {
   generateGroup,
 } from '../../../../../helpers/api-unit.helper';
+import i18n from '../../../../../../website/common/script/i18n';
 
 describe('Purchasing a group plan for group', () => {
   const EMAIL_TEMPLATE_SUBSCRIPTION_TYPE_GOOGLE = 'Google_subscription';
@@ -33,11 +34,14 @@ describe('Purchasing a group plan for group', () => {
     group = generateGroup({
       name: groupName,
       type: 'guild',
-      privacy: 'public',
+      privacy: 'private',
       leader: user._id,
     });
     await group.save();
 
+    user.guilds.push(group._id);
+    await user.save();
+
     data = {
       user,
       sub: {
@@ -112,6 +116,30 @@ describe('Purchasing a group plan for group', () => {
     expect(updatedGroup.purchased.plan.dateCreated).to.exist;
   });
 
+  it('does not create a group plan for a public guild', async () => {
+    const publicGroup = generateGroup({
+      name: groupName,
+      type: 'guild',
+      privacy: 'public',
+      leader: user._id,
+    });
+    await publicGroup.save();
+
+    expect(publicGroup.purchased.plan.planId).to.not.exist;
+    data.groupId = publicGroup._id;
+
+    await expect(api.createSubscription(data))
+      .to.eventually.be.rejected.and.to.eql({
+        httpCode: 401,
+        name: 'NotAuthorized',
+        message: i18n.t('onlyPrivateGuildsCanUpgrade'),
+      });
+
+    const updatedGroup = await Group.findById(publicGroup._id).exec();
+
+    expect(updatedGroup.purchased.plan.planId).to.not.exist;
+  });
+
   it('sends an email', async () => {
     expect(group.purchased.plan.planId).to.not.exist;
     data.groupId = group._id;
@@ -148,8 +176,6 @@ describe('Purchasing a group plan for group', () => {
   });
 
   it('grants all members of a group a subscription', async () => {
-    user.guilds.push(group._id);
-    await user.save();
     expect(group.purchased.plan.planId).to.not.exist;
     data.groupId = group._id;
 
@@ -179,17 +205,28 @@ describe('Purchasing a group plan for group', () => {
 
     await api.createSubscription(data);
 
-    expect(sender.sendTxn).to.be.calledTwice;
-    expect(sender.sendTxn.firstCall.args[0]._id).to.equal(recipient._id);
-    expect(sender.sendTxn.firstCall.args[1]).to.equal('group-member-join');
-    expect(sender.sendTxn.firstCall.args[2]).to.eql([
+    expect(sender.sendTxn).to.be.calledThrice;
+    const recipientCall = sender.sendTxn.getCalls().find(call => {
+      const isRecipient = call.args[0]._id === recipient._id;
+      const isJoin = call.args[1] === 'group-member-join';
+      return isRecipient && isJoin;
+    });
+    expect(recipientCall.args[0]._id).to.equal(recipient._id);
+    expect(recipientCall.args[1]).to.equal('group-member-join');
+    expect(recipientCall.args[2]).to.eql([
       { name: 'LEADER', content: user.profile.name },
       { name: 'GROUP_NAME', content: group.name },
       { name: 'PREVIOUS_SUBSCRIPTION_TYPE', content: EMAIL_TEMPLATE_SUBSCRIPTION_TYPE_NONE },
     ]);
+
     // confirm that the other email sent is appropriate:
-    expect(sender.sendTxn.secondCall.args[0]._id).to.equal(group.leader);
-    expect(sender.sendTxn.secondCall.args[1]).to.equal('group-subscription-begins');
+    const leaderCall = sender.sendTxn.getCalls().find(call => {
+      const isLeader = call.args[0]._id === group.leader;
+      const isSubscriptionBegin = call.args[1] === 'group-subscription-begins';
+      return isLeader && isSubscriptionBegin;
+    });
+    expect(leaderCall.args[0]._id).to.equal(group.leader);
+    expect(leaderCall.args[1]).to.equal('group-subscription-begins');
   });
 
   it('sends one email to subscribed member of group, stating subscription is cancelled (Stripe)', async () => {
@@ -205,17 +242,28 @@ describe('Purchasing a group plan for group', () => {
 
     await api.createSubscription(data);
 
-    expect(sender.sendTxn).to.be.calledTwice;
-    expect(sender.sendTxn.firstCall.args[0]._id).to.equal(recipient._id);
-    expect(sender.sendTxn.firstCall.args[1]).to.equal('group-member-join');
-    expect(sender.sendTxn.firstCall.args[2]).to.eql([
+    expect(sender.sendTxn).to.be.calledThrice;
+    const recipientCall = sender.sendTxn.getCalls().find(call => {
+      const isRecipient = call.args[0]._id === recipient._id;
+      const isJoin = call.args[1] === 'group-member-join';
+      return isRecipient && isJoin;
+    });
+    expect(recipientCall.args[0]._id).to.equal(recipient._id);
+    expect(recipientCall.args[1]).to.equal('group-member-join');
+    expect(recipientCall.args[2]).to.eql([
       { name: 'LEADER', content: user.profile.name },
       { name: 'GROUP_NAME', content: group.name },
       { name: 'PREVIOUS_SUBSCRIPTION_TYPE', content: EMAIL_TEMPLATE_SUBSCRIPTION_TYPE_NORMAL },
     ]);
+
     // confirm that the other email sent is not a cancel-subscription email:
-    expect(sender.sendTxn.secondCall.args[0]._id).to.equal(group.leader);
-    expect(sender.sendTxn.secondCall.args[1]).to.equal('group-subscription-begins');
+    const leaderCall = sender.sendTxn.getCalls().find(call => {
+      const isLeader = call.args[0]._id === group.leader;
+      const isSubscriptionBegin = call.args[1] === 'group-subscription-begins';
+      return isLeader && isSubscriptionBegin;
+    });
+    expect(leaderCall.args[0]._id).to.equal(group.leader);
+    expect(leaderCall.args[1]).to.equal('group-subscription-begins');
   });
 
   it('sends one email to subscribed member of group, stating subscription is cancelled (Amazon)', async () => {
@@ -238,17 +286,28 @@ describe('Purchasing a group plan for group', () => {
 
     await api.createSubscription(data);
 
-    expect(sender.sendTxn).to.be.calledTwice;
-    expect(sender.sendTxn.firstCall.args[0]._id).to.equal(recipient._id);
-    expect(sender.sendTxn.firstCall.args[1]).to.equal('group-member-join');
-    expect(sender.sendTxn.firstCall.args[2]).to.eql([
+    expect(sender.sendTxn).to.be.calledThrice;
+    const recipientCall = sender.sendTxn.getCalls().find(call => {
+      const isRecipient = call.args[0]._id === recipient._id;
+      const isJoin = call.args[1] === 'group-member-join';
+      return isRecipient && isJoin;
+    });
+    expect(recipientCall.args[0]._id).to.equal(recipient._id);
+    expect(recipientCall.args[1]).to.equal('group-member-join');
+    expect(recipientCall.args[2]).to.eql([
       { name: 'LEADER', content: user.profile.name },
       { name: 'GROUP_NAME', content: group.name },
       { name: 'PREVIOUS_SUBSCRIPTION_TYPE', content: EMAIL_TEMPLATE_SUBSCRIPTION_TYPE_NORMAL },
     ]);
+
     // confirm that the other email sent is not a cancel-subscription email:
-    expect(sender.sendTxn.secondCall.args[0]._id).to.equal(group.leader);
-    expect(sender.sendTxn.secondCall.args[1]).to.equal('group-subscription-begins');
+    const leaderCall = sender.sendTxn.getCalls().find(call => {
+      const isLeader = call.args[0]._id === group.leader;
+      const isSubscriptionBegin = call.args[1] === 'group-subscription-begins';
+      return isLeader && isSubscriptionBegin;
+    });
+    expect(leaderCall.args[0]._id).to.equal(group.leader);
+    expect(leaderCall.args[1]).to.equal('group-subscription-begins');
 
     amzLib.getBillingAgreementDetails.restore();
   });
@@ -275,24 +334,35 @@ describe('Purchasing a group plan for group', () => {
 
     await api.createSubscription(data);
 
-    expect(sender.sendTxn).to.be.calledTwice;
-    expect(sender.sendTxn.firstCall.args[0]._id).to.equal(recipient._id);
-    expect(sender.sendTxn.firstCall.args[1]).to.equal('group-member-join');
-    expect(sender.sendTxn.firstCall.args[2]).to.eql([
+    expect(sender.sendTxn).to.be.calledThrice;
+    const recipientCall = sender.sendTxn.getCalls().find(call => {
+      const isRecipient = call.args[0]._id === recipient._id;
+      const isJoin = call.args[1] === 'group-member-join';
+      return isRecipient && isJoin;
+    });
+    expect(recipientCall.args[0]._id).to.equal(recipient._id);
+    expect(recipientCall.args[1]).to.equal('group-member-join');
+    expect(recipientCall.args[2]).to.eql([
       { name: 'LEADER', content: user.profile.name },
       { name: 'GROUP_NAME', content: group.name },
       { name: 'PREVIOUS_SUBSCRIPTION_TYPE', content: EMAIL_TEMPLATE_SUBSCRIPTION_TYPE_NORMAL },
     ]);
+
     // confirm that the other email sent is not a cancel-subscription email:
-    expect(sender.sendTxn.secondCall.args[0]._id).to.equal(group.leader);
-    expect(sender.sendTxn.secondCall.args[1]).to.equal('group-subscription-begins');
+    const leaderCall = sender.sendTxn.getCalls().find(call => {
+      const isLeader = call.args[0]._id === group.leader;
+      const isSubscriptionBegin = call.args[1] === 'group-subscription-begins';
+      return isLeader && isSubscriptionBegin;
+    });
+    expect(leaderCall.args[0]._id).to.equal(group.leader);
+    expect(leaderCall.args[1]).to.equal('group-subscription-begins');
 
     paypalPayments.paypalBillingAgreementGet.restore();
     paypalPayments.paypalBillingAgreementCancel.restore();
   });
 
   it('sends appropriate emails when subscribed member of group must manually cancel recurring Android subscription', async () => {
-    const TECH_ASSISTANCE_EMAIL = nconf.get('TECH_ASSISTANCE_EMAIL');
+    const TECH_ASSISTANCE_EMAIL = nconf.get('EMAILS_TECH_ASSISTANCE_EMAIL');
     plan.customerId = 'random';
     plan.paymentMethod = api.constants.GOOGLE_PAYMENT_METHOD;
 
@@ -302,30 +372,49 @@ describe('Purchasing a group plan for group', () => {
     recipient.guilds.push(group._id);
     await recipient.save();
 
-    user.guilds.push(group._id);
-    await user.save();
     data.groupId = group._id;
 
     await api.createSubscription(data);
 
     expect(sender.sendTxn).to.have.callCount(4);
-    expect(sender.sendTxn.args[0][0]._id).to.equal(TECH_ASSISTANCE_EMAIL);
-    expect(sender.sendTxn.args[0][1]).to.equal('admin-user-subscription-details');
-    expect(sender.sendTxn.args[1][0]._id).to.equal(recipient._id);
-    expect(sender.sendTxn.args[1][1]).to.equal('group-member-join');
-    expect(sender.sendTxn.args[1][2]).to.eql([
+    const adminUserSubscriptionDetails = sender.sendTxn.args.find(sendTxnArgs => {
+      const emailType = sendTxnArgs[1];
+      return emailType === 'admin-user-subscription-details';
+    });
+    expect(adminUserSubscriptionDetails).to.exist;
+    expect(adminUserSubscriptionDetails[0].email).to.equal(TECH_ASSISTANCE_EMAIL);
+
+    const groupMemberJoinOne = sender.sendTxn.args.find(sendTxnArgs => {
+      const emailType = sendTxnArgs[1];
+      const emailRecipient = sendTxnArgs[0];
+      return emailType === 'group-member-join' && emailRecipient._id === recipient._id;
+    });
+    expect(groupMemberJoinOne).to.exist;
+    expect(groupMemberJoinOne[0]._id).to.equal(recipient._id);
+    expect(groupMemberJoinOne[2]).to.eql([
       { name: 'LEADER', content: groupLeaderName },
       { name: 'GROUP_NAME', content: groupName },
       { name: 'PREVIOUS_SUBSCRIPTION_TYPE', content: EMAIL_TEMPLATE_SUBSCRIPTION_TYPE_GOOGLE },
     ]);
-    expect(sender.sendTxn.args[2][0]._id).to.equal(group.leader);
-    expect(sender.sendTxn.args[2][1]).to.equal('group-member-join');
-    expect(sender.sendTxn.args[3][0]._id).to.equal(group.leader);
-    expect(sender.sendTxn.args[3][1]).to.equal('group-subscription-begins');
+
+    const groupMemberJoinTwo = sender.sendTxn.args.find(sendTxnArgs => {
+      const emailType = sendTxnArgs[1];
+      const emailRecipient = sendTxnArgs[0];
+      return emailType === 'group-member-join' && emailRecipient._id === group.leader;
+    });
+    expect(groupMemberJoinTwo).to.exist;
+    expect(groupMemberJoinTwo[0]._id).to.equal(group.leader);
+
+    const groupSubscriptionBegins = sender.sendTxn.args.find(sendTxnArgs => {
+      const emailType = sendTxnArgs[1];
+      return emailType === 'group-subscription-begins';
+    });
+    expect(groupSubscriptionBegins).to.exist;
+    expect(groupSubscriptionBegins[0]._id).to.equal(group.leader);
   });
 
   it('sends appropriate emails when subscribed member of group must manually cancel recurring iOS subscription', async () => {
-    const TECH_ASSISTANCE_EMAIL = nconf.get('TECH_ASSISTANCE_EMAIL');
+    const TECH_ASSISTANCE_EMAIL = nconf.get('EMAILS_TECH_ASSISTANCE_EMAIL');
     plan.customerId = 'random';
     plan.paymentMethod = api.constants.IOS_PAYMENT_METHOD;
 
@@ -335,26 +424,46 @@ describe('Purchasing a group plan for group', () => {
     recipient.guilds.push(group._id);
     await recipient.save();
 
-    user.guilds.push(group._id);
-    await user.save();
     data.groupId = group._id;
 
     await api.createSubscription(data);
 
     expect(sender.sendTxn).to.have.callCount(4);
-    expect(sender.sendTxn.args[0][0]._id).to.equal(TECH_ASSISTANCE_EMAIL);
-    expect(sender.sendTxn.args[0][1]).to.equal('admin-user-subscription-details');
-    expect(sender.sendTxn.args[1][0]._id).to.equal(recipient._id);
-    expect(sender.sendTxn.args[1][1]).to.equal('group-member-join');
-    expect(sender.sendTxn.args[1][2]).to.eql([
+
+    const adminUserSubscriptionDetails = sender.sendTxn.args.find(sendTxnArgs => {
+      const emailType = sendTxnArgs[1];
+      return emailType === 'admin-user-subscription-details';
+    });
+    expect(adminUserSubscriptionDetails).to.exist;
+    expect(adminUserSubscriptionDetails[0].email).to.equal(TECH_ASSISTANCE_EMAIL);
+
+    const groupMemberJoinOne = sender.sendTxn.args.find(sendTxnArgs => {
+      const emailType = sendTxnArgs[1];
+      const emailRecipient = sendTxnArgs[0];
+      return emailType === 'group-member-join' && emailRecipient._id === recipient._id;
+    });
+    expect(groupMemberJoinOne).to.exist;
+    expect(groupMemberJoinOne[0]._id).to.equal(recipient._id);
+    expect(groupMemberJoinOne[2]).to.eql([
       { name: 'LEADER', content: groupLeaderName },
       { name: 'GROUP_NAME', content: groupName },
       { name: 'PREVIOUS_SUBSCRIPTION_TYPE', content: EMAIL_TEMPLATE_SUBSCRIPTION_TYPE_IOS },
     ]);
-    expect(sender.sendTxn.args[2][0]._id).to.equal(group.leader);
-    expect(sender.sendTxn.args[2][1]).to.equal('group-member-join');
-    expect(sender.sendTxn.args[3][0]._id).to.equal(group.leader);
-    expect(sender.sendTxn.args[3][1]).to.equal('group-subscription-begins');
+
+    const groupMemberJoinTwo = sender.sendTxn.args.find(sendTxnArgs => {
+      const emailType = sendTxnArgs[1];
+      const emailRecipient = sendTxnArgs[0];
+      return emailType === 'group-member-join' && emailRecipient._id === group.leader;
+    });
+    expect(groupMemberJoinTwo).to.exist;
+    expect(groupMemberJoinTwo[0]._id).to.equal(group.leader);
+
+    const groupSubscriptionBegins = sender.sendTxn.args.find(sendTxnArgs => {
+      const emailType = sendTxnArgs[1];
+      return emailType === 'group-subscription-begins';
+    });
+    expect(groupSubscriptionBegins).to.exist;
+    expect(groupSubscriptionBegins[0]._id).to.equal(group.leader);
   });
 
   it('adds months to members with existing gift subscription', async () => {
@@ -376,8 +485,6 @@ describe('Purchasing a group plan for group', () => {
 
     data.gift = undefined;
 
-    user.guilds.push(group._id);
-    await user.save();
     data.groupId = group._id;
 
     await api.createSubscription(data);
@@ -412,8 +519,6 @@ describe('Purchasing a group plan for group', () => {
 
     data.gift = undefined;
 
-    user.guilds.push(group._id);
-    await user.save();
     data.groupId = group._id;
 
     await api.createSubscription(data);
@@ -440,8 +545,6 @@ describe('Purchasing a group plan for group', () => {
     recipient.guilds.push(group._id);
     await recipient.save();
 
-    user.guilds.push(group._id);
-    await user.save();
     data.groupId = group._id;
 
     await api.createSubscription(data);
@@ -468,8 +571,6 @@ describe('Purchasing a group plan for group', () => {
 
     await recipient.save();
 
-    user.guilds.push(group._id);
-    await user.save();
     data.groupId = group._id;
 
     await api.createSubscription(data);
@@ -498,8 +599,6 @@ describe('Purchasing a group plan for group', () => {
 
     await recipient.save();
 
-    user.guilds.push(group._id);
-    await user.save();
     data.groupId = group._id;
 
     await api.createSubscription(data);
@@ -523,8 +622,6 @@ describe('Purchasing a group plan for group', () => {
     recipient.guilds.push(group._id);
     await recipient.save();
 
-    user.guilds.push(group._id);
-    await user.save();
     data.groupId = group._id;
 
     await recipient.cancelSubscription();
@@ -546,8 +643,6 @@ describe('Purchasing a group plan for group', () => {
     recipient.guilds.push(group._id);
     await recipient.save();
 
-    user.guilds.push(group._id);
-    await user.save();
     data.groupId = group._id;
 
     await recipient.cancelSubscription();
@@ -568,8 +663,6 @@ describe('Purchasing a group plan for group', () => {
     recipient.guilds.push(group._id);
     await recipient.save();
 
-    user.guilds.push(group._id);
-    await user.save();
     data.groupId = group._id;
 
     await api.createSubscription(data);
@@ -589,8 +682,6 @@ describe('Purchasing a group plan for group', () => {
     recipient.guilds.push(group._id);
     await recipient.save();
 
-    user.guilds.push(group._id);
-    await user.save();
     data.groupId = group._id;
 
     await api.createSubscription(data);
@@ -610,8 +701,6 @@ describe('Purchasing a group plan for group', () => {
     recipient.guilds.push(group._id);
     await recipient.save();
 
-    user.guilds.push(group._id);
-    await user.save();
     data.groupId = group._id;
 
     await api.createSubscription(data);
@@ -645,8 +734,6 @@ describe('Purchasing a group plan for group', () => {
     recipient.guilds.push(group._id);
     await recipient.save();
 
-    user.guilds.push(group._id);
-    await user.save();
     data.groupId = group._id;
 
     await api.createSubscription(data);
@@ -670,8 +757,6 @@ describe('Purchasing a group plan for group', () => {
     recipient.guilds.push(group._id);
     await recipient.save();
 
-    user.guilds.push(group._id);
-    await user.save();
     data.groupId = group._id;
 
     await api.createSubscription(data);
@@ -683,13 +768,15 @@ describe('Purchasing a group plan for group', () => {
     const group2 = generateGroup({
       name: 'test group2',
       type: 'guild',
-      privacy: 'public',
+      privacy: 'private',
       leader: user._id,
     });
     data.groupId = group2._id;
     await group2.save();
     recipient.guilds.push(group2._id);
     await recipient.save();
+    user.guilds.push(group2._id);
+    await user.save();
 
     await api.createSubscription(data);
 
@@ -714,8 +801,6 @@ describe('Purchasing a group plan for group', () => {
     recipient.guilds.push(group._id);
     await recipient.save();
 
-    user.guilds.push(group._id);
-    await user.save();
     data.groupId = group._id;
 
     await api.createSubscription(data);
@@ -727,17 +812,22 @@ describe('Purchasing a group plan for group', () => {
     const group2 = generateGroup({
       name: 'test group2',
       type: 'guild',
-      privacy: 'public',
+      privacy: 'private',
       leader: user._id,
     });
     data.groupId = group2._id;
     await group2.save();
     recipient.guilds.push(group2._id);
     await recipient.save();
+    user.guilds.push(group2._id);
+    await user.save();
 
     await api.createSubscription(data);
 
     const updatedGroup = await Group.findById(group._id).exec();
+    updatedGroup.memberCount = 2;
+    await updatedGroup.save();
+
     await updatedGroup.leave(recipient);
 
     updatedUser = await User.findById(recipient._id).exec();
@@ -763,8 +853,6 @@ describe('Purchasing a group plan for group', () => {
     recipient.guilds.push(group._id);
     await recipient.save();
 
-    user.guilds.push(group._id);
-    await user.save();
     data.groupId = group._id;
 
     await api.createSubscription(data);
@@ -792,8 +880,6 @@ describe('Purchasing a group plan for group', () => {
     recipient.guilds.push(group._id);
     await recipient.save();
 
-    user.guilds.push(group._id);
-    await user.save();
     data.groupId = group._id;
 
     await api.createSubscription(data);
@@ -821,8 +907,6 @@ describe('Purchasing a group plan for group', () => {
     recipient.guilds.push(group._id);
     await recipient.save();
 
-    user.guilds.push(group._id);
-    await user.save();
     data.groupId = group._id;
 
     await api.createSubscription(data);
@@ -851,8 +935,6 @@ describe('Purchasing a group plan for group', () => {
     recipient.guilds.push(group._id);
     await recipient.save();
 
-    user.guilds.push(group._id);
-    await user.save();
     data.groupId = group._id;
 
     await api.createSubscription(data);

test/api/unit/libs/payments/payments.test.js

@@ -439,31 +439,6 @@ describe('payments/index', () => {
         fakeClock.restore();
       });
 
-      it('does not awards mystery items when not within the timeframe for a mystery item', async () => {
-        const noMysteryItemTimeframe = 1462183920000; // May 2nd 2016
-        const fakeClock = sinon.useFakeTimers(noMysteryItemTimeframe);
-        data = { paymentMethod: 'PaymentMethod', user, sub: { key: 'basic_3mo' } };
-
-        await api.createSubscription(data);
-
-        expect(user.purchased.plan.mysteryItems).to.have.a.lengthOf(0);
-
-        fakeClock.restore();
-      });
-
-      it('does not add a notification for mystery items if none was awarded', async () => {
-        const noMysteryItemTimeframe = 1462183920000; // May 2nd 2016
-        const fakeClock = sinon.useFakeTimers(noMysteryItemTimeframe);
-        data = { paymentMethod: 'PaymentMethod', user, sub: { key: 'basic_3mo' } };
-
-        await api.createSubscription(data);
-
-        expect(user.purchased.plan.mysteryItems).to.have.a.lengthOf(0);
-        expect(user.notifications.find(n => n.type === 'NEW_MYSTERY_ITEMS')).to.be.undefined;
-
-        fakeClock.restore();
-      });
-
       it('does not award mystery item when user already owns the item', async () => {
         const mayMysteryItemTimeframe = 1464725113000; // May 31st 2016
         const fakeClock = sinon.useFakeTimers(mayMysteryItemTimeframe);
@@ -651,7 +626,7 @@ describe('payments/index', () => {
           .calledWith(recipient, { receiverMsg: msg, senderMsg: msg, save: false });
       });
 
-      it('sends a message from purchaser to recipient wtih custom message', async () => {
+      it('sends a message from purchaser to recipient with custom message', async () => {
         data.gift.message = 'giftmessage';
 
         await api.buyGems(data);

test/api/unit/libs/payments/stripe/calculateSubscriptionTerminationDate.test.js

@@ -0,0 +1,89 @@
+import moment from 'moment';
+import calculateSubscriptionTerminationDate from '../../../../../../website/server/libs/payments/calculateSubscriptionTerminationDate';
+import api from '../../../../../../website/server/libs/payments/payments';
+
+const groupPlanId = api.constants.GROUP_PLAN_CUSTOMER_ID;
+
+describe('#calculateSubscriptionTerminationDate', () => {
+  let plan;
+  let nextBill;
+
+  beforeEach(() => {
+    plan = {
+      customerId: 'customer-id',
+      extraMonths: 0,
+    };
+    nextBill = moment();
+  });
+
+  it('should extend date to the exact amount of days left before the next bill will occur', () => {
+    nextBill = moment()
+      .add(5, 'days');
+    const expectedTerminationDate = moment()
+      .add(5, 'days');
+
+    const terminationDate = calculateSubscriptionTerminationDate(nextBill, plan, groupPlanId);
+    expect(expectedTerminationDate.diff(terminationDate, 'days')).to.eql(0);
+  });
+
+  it('if nextBill is null, add 30 days to termination date', () => {
+    nextBill = null;
+    const expectedTerminationDate = moment()
+      .add(30, 'days');
+    const terminationDate = calculateSubscriptionTerminationDate(nextBill, plan, groupPlanId);
+
+    expect(expectedTerminationDate.diff(terminationDate, 'days')).to.eql(0);
+  });
+
+  it('if nextBill is null and it\'s a group plan, add 2 days instead of 30', () => {
+    nextBill = null;
+    plan.customerId = api.constants.GROUP_PLAN_CUSTOMER_ID;
+    const expectedTerminationDate = moment()
+      .add(2, 'days');
+
+    const terminationDate = calculateSubscriptionTerminationDate(nextBill, plan, groupPlanId);
+    expect(expectedTerminationDate.diff(terminationDate, 'days')).to.eql(0);
+  });
+
+  it('should add 30.5 days for each extraMonth', () => {
+    plan.extraMonths = 4;
+    const expectedTerminationDate = moment()
+      .add(30.5 * 4, 'days');
+
+    const terminationDate = calculateSubscriptionTerminationDate(nextBill, plan, groupPlanId);
+    expect(expectedTerminationDate.diff(terminationDate, 'days')).to.eql(0);
+  });
+
+  it('should round up if total days gained by extraMonth is a decimal number', () => {
+    plan.extraMonths = 5;
+    const expectedTerminationDate = moment()
+      .add(Math.ceil(30.5 * 5), 'days');
+
+    const terminationDate = calculateSubscriptionTerminationDate(nextBill, plan, groupPlanId);
+    expect(expectedTerminationDate.diff(terminationDate, 'days')).to.eql(0);
+  });
+
+  it('behaves like extraMonths is 0 if it\'s set to a negative number', () => {
+    plan.extraMonths = -5;
+    const expectedTerminationDate = moment();
+    const terminationDate = calculateSubscriptionTerminationDate(nextBill, plan, groupPlanId);
+    expect(expectedTerminationDate.diff(terminationDate, 'days')).to.eql(0);
+  });
+
+  it('returns current terminated date if it exists and is later than newly calculated date', () => {
+    const expectedTerminationDate = moment().add({ months: 5 }).toDate();
+    plan.dateTerminated = expectedTerminationDate;
+
+    const terminationDate = calculateSubscriptionTerminationDate(nextBill, plan, groupPlanId);
+
+    expect(terminationDate).to.equal(expectedTerminationDate);
+  });
+
+  it('returns the calculated termination date if the plan does not have one', () => {
+    nextBill = moment().add(5, 'days');
+    const expectedTerminationDate = moment().add(5, 'days');
+
+    const terminationDate = calculateSubscriptionTerminationDate(nextBill, plan, groupPlanId);
+    expect(expectedTerminationDate.diff(terminationDate, 'days')).to.eql(0);
+  });
+});

test/api/unit/libs/payments/stripe/upgrade-group-plan.test.js

@@ -33,11 +33,14 @@ describe('Stripe - Upgrade Group Plan', () => {
     group = generateGroup({
       name: 'test group',
       type: 'guild',
-      privacy: 'public',
+      privacy: 'private',
       leader: user._id,
     });
     await group.save();
 
+    user.guilds.push(group._id);
+    await user.save();
+
     spy = sinon.stub(stripe.subscriptions, 'update');
     spy.resolves([]);
     data.groupId = group._id;

test/api/unit/libs/preening.test.js

@@ -9,7 +9,7 @@ describe('preenHistory', () => {
   beforeEach(() => {
     // Replace system clocks so we can get predictable results
     clock = sinon.useFakeTimers({
-      now: Number(moment('2013-10-20').zone(0).startOf('day').toDate()),
+      now: Number(moment('2013-10-20').utcOffset(0).startOf('day').toDate()),
       toFake: ['Date'],
     });
   });

test/api/unit/libs/pushNotifications.js

@@ -1,13 +1,15 @@
-import requireAgain from 'require-again';
 import apn from 'apn/mock';
+import _ from 'lodash';
 import nconf from 'nconf';
 import gcmLib from 'node-gcm'; // works with FCM notifications too
 import { model as User } from '../../../../website/server/models/user';
+import {
+  sendNotification as sendPushNotification,
+  MAX_MESSAGE_LENGTH,
+} from '../../../../website/server/libs/pushNotifications';
 
 describe('pushNotifications', () => {
   let user;
-  let sendPushNotification;
-  const pathToPushNotifications = '../../../../website/server/libs/pushNotifications';
   let fcmSendSpy;
   let apnSendSpy;
 
@@ -28,8 +30,6 @@ describe('pushNotifications', () => {
       on: () => null,
       send: apnSendSpy,
     });
-
-    sendPushNotification = requireAgain(pathToPushNotifications).sendNotification;
   });
 
   afterEach(() => {
@@ -86,6 +86,67 @@ describe('pushNotifications', () => {
     expect(apnSendSpy).to.not.have.been.called;
   });
 
+  it('cuts the message to 300 chars', () => {
+    const longMessage = `12345 12345 12345 12345 12345 12345 12345
+      12345 12345 12345 12345 12345 12345 12345 12345 12345 12345
+      12345 12345 12345 12345 12345 12345 12345 12345 12345 12345
+      12345 12345 12345 12345 12345 12345 12345 12345 12345 12345
+      12345 12345 12345 12345 12345 12345 12345 12345 12345 12345
+      12345 12345 12345 12345 12345 12345 12345 12345 12345 12345
+      12345 12345 12345 12345 12345 12345 12345 12345 12345 12345
+      12345 12345 12345 12345 12345 12345 12345 12345 12345 12345
+      12345 12345 12345 12345 12345 12345 12345 12345 12345 12345
+      12345 12345 12345 12345 12345 12345 12345 12345 12345 12345
+      12345 12345 12345 12345 12345 12345 12345 12345 12345 12345`;
+
+    expect(longMessage.length > MAX_MESSAGE_LENGTH).to.equal(true);
+
+    const details = {
+      identifier,
+      title,
+      message: longMessage,
+      payload: {
+        message: longMessage,
+      },
+    };
+
+    sendPushNotification(user, details);
+
+    expect(details.message).to.equal(_.truncate(longMessage, { length: MAX_MESSAGE_LENGTH }));
+    expect(details.payload.message)
+      .to.equal(_.truncate(longMessage, { length: MAX_MESSAGE_LENGTH }));
+
+    expect(details.message.length).to.equal(MAX_MESSAGE_LENGTH);
+    expect(details.payload.message.length).to.equal(MAX_MESSAGE_LENGTH);
+  });
+
+  it('cuts the message to 300 chars (no payload)', () => {
+    const longMessage = `12345 12345 12345 12345 12345 12345 12345
+      12345 12345 12345 12345 12345 12345 12345 12345 12345 12345
+      12345 12345 12345 12345 12345 12345 12345 12345 12345 12345
+      12345 12345 12345 12345 12345 12345 12345 12345 12345 12345
+      12345 12345 12345 12345 12345 12345 12345 12345 12345 12345
+      12345 12345 12345 12345 12345 12345 12345 12345 12345 12345
+      12345 12345 12345 12345 12345 12345 12345 12345 12345 12345
+      12345 12345 12345 12345 12345 12345 12345 12345 12345 12345
+      12345 12345 12345 12345 12345 12345 12345 12345 12345 12345
+      12345 12345 12345 12345 12345 12345 12345 12345 12345 12345
+      12345 12345 12345 12345 12345 12345 12345 12345 12345 12345`;
+
+    expect(longMessage.length > MAX_MESSAGE_LENGTH).to.equal(true);
+
+    const details = {
+      identifier,
+      title,
+      message: longMessage,
+    };
+
+    sendPushNotification(user, details);
+
+    expect(details.message).to.equal(_.truncate(longMessage, { length: MAX_MESSAGE_LENGTH }));
+    expect(details.message.length).to.equal(MAX_MESSAGE_LENGTH);
+  });
+
   // TODO disabled because APN relies on a Promise
   xit('uses APN for iOS devices', () => {
     user.pushDevices.push({

test/api/unit/libs/setupNconf.test.js

@@ -1,4 +1,3 @@
-
 import path from 'path';
 import nconf from 'nconf';
 import setupNconf from '../../../../website/server/libs/setupNconf';

test/api/unit/libs/stringUtils.test.js

@@ -0,0 +1,12 @@
+import { getMatchesByWordArray } from '../../../../website/server/libs/stringUtils';
+import bannedWords from '../../../../website/server/libs/bannedWords';
+
+describe('stringUtils', () => {
+  describe('getMatchesByWordArray', () => {
+    it('check all banned words are matched', async () => {
+      const message = bannedWords.join(',').replace(/\\/g, '');
+      const matches = getMatchesByWordArray(message, bannedWords);
+      expect(matches.length).to.equal(bannedWords.length);
+    });
+  });
+});

test/api/unit/libs/taskManager.js

@@ -5,6 +5,7 @@ import {
   moveTask,
 } from '../../../../website/server/libs/taskManager';
 import i18n from '../../../../website/common/script/i18n';
+import shared from '../../../../website/common/script';
 import {
   generateUser,
   generateGroup,
@@ -58,6 +59,51 @@ describe('taskManager', () => {
     expect(newTask.createdAt).to.exist;
   });
 
+  describe('onboarding', () => {
+    beforeEach(() => {
+      user.addAchievement = sinon.spy();
+      sinon.stub(shared.onboarding, 'checkOnboardingStatus');
+    });
+
+    afterEach(() => {
+      shared.onboarding.checkOnboardingStatus.restore();
+    });
+
+    it('adds the onboarding achievement to the user and checks the onboarding status', async () => {
+      req.body = testHabit;
+      res.t = i18n.t;
+      user.flags.welcomed = true;
+
+      await createTasks(req, res, { user });
+
+      expect(user.addAchievement).to.be.calledOnce;
+      expect(user.addAchievement).to.be.calledWith('createdTask');
+
+      expect(shared.onboarding.checkOnboardingStatus).to.be.calledOnce;
+      expect(shared.onboarding.checkOnboardingStatus).to.be.calledWith(user);
+    });
+
+    it('does not add the onboarding achievement to the user if flags.welcomed is false', async () => {
+      req.body = testHabit;
+      res.t = i18n.t;
+      user.flags.welcomed = false;
+
+      await createTasks(req, res, { user });
+
+      expect(user.addAchievement).to.not.be.called;
+    });
+
+    it('does not add the onboarding achievement to the user if it\'s already been awarded', async () => {
+      req.body = testHabit;
+      res.t = i18n.t;
+      user.achievements.createdTask = true;
+
+      await createTasks(req, res, { user });
+
+      expect(user.addAchievement).to.not.be.called;
+    });
+  });
+
   it('gets user tasks', async () => {
     req.body = testHabit;
     res.t = i18n.t;

test/api/unit/libs/webhooks.test.js

@@ -1,4 +1,5 @@
 import got from 'got';
+import moment from 'moment';
 import {
   WebhookSender,
   taskScoredWebhook,
@@ -13,8 +14,9 @@ import {
 import {
   generateUser,
   defer,
+  sleep,
 } from '../../../helpers/api-unit.helper';
-
+import logger from '../../../../website/server/libs/logger';
 
 describe('webhooks', () => {
   let webhooks; let
@@ -43,6 +45,7 @@ describe('webhooks', () => {
       options: {
         questStarted: true,
         questFinised: true,
+        questInvited: true,
       },
     }, {
       id: 'userActivity',
@@ -98,8 +101,7 @@ describe('webhooks', () => {
       expect(WebhookSender.defaultTransformData).to.be.calledOnce;
       expect(got.post).to.be.calledOnce;
       expect(got.post).to.be.calledWithMatch('http://custom-url.com', {
-        json: true,
-        body,
+        json: body,
       });
     });
 
@@ -119,7 +121,7 @@ describe('webhooks', () => {
       expect(sendWebhook.attachDefaultData).to.be.calledOnce;
       expect(got.post).to.be.calledOnce;
       expect(got.post).to.be.calledWithMatch('http://custom-url.com', {
-        json: true,
+        json: body,
       });
 
       expect(body).to.eql({
@@ -150,8 +152,7 @@ describe('webhooks', () => {
       expect(WebhookSender.defaultTransformData).to.not.be.called;
       expect(got.post).to.be.calledOnce;
       expect(got.post).to.be.calledWithMatch('http://custom-url.com', {
-        json: true,
-        body: {
+        json: {
           foo: 'bar',
           baz: 'biz',
         },
@@ -268,8 +269,7 @@ describe('webhooks', () => {
 
       expect(got.post).to.be.calledOnce;
       expect(got.post).to.be.calledWithMatch('http://custom-url.com', {
-        body,
-        json: true,
+        json: body,
       });
     });
 
@@ -289,8 +289,7 @@ describe('webhooks', () => {
 
       expect(got.post).to.be.calledOnce;
       expect(got.post).to.be.calledWithMatch('http://custom-url.com', {
-        body,
-        json: true,
+        json: body,
       });
     });
 
@@ -313,12 +312,105 @@ describe('webhooks', () => {
 
       expect(got.post).to.be.calledTwice;
       expect(got.post).to.be.calledWithMatch('http://custom-url.com', {
-        body,
-        json: true,
+        json: body,
       });
       expect(got.post).to.be.calledWithMatch('http://other-url.com', {
-        body,
-        json: true,
+        json: body,
+      });
+    });
+
+    describe('failures', () => {
+      let sendWebhook;
+
+      beforeEach(async () => {
+        sandbox.restore();
+        sandbox.stub(got, 'post').returns(Promise.reject());
+
+        sendWebhook = new WebhookSender({ type: 'taskActivity' });
+        user.webhooks = [{
+          url: 'http://custom-url.com', enabled: true, type: 'taskActivity',
+        }];
+        await user.save();
+
+        expect(user.webhooks[0].failures).to.equal(0);
+        expect(user.webhooks[0].lastFailureAt).to.equal(undefined);
+      });
+
+      it('does not increase failures counter if request is successfull', async () => {
+        sandbox.restore();
+        sandbox.stub(got, 'post').returns(Promise.resolve());
+
+        const body = {};
+        sendWebhook.send(user, body);
+
+        expect(got.post).to.be.calledOnce;
+        expect(got.post).to.be.calledWithMatch('http://custom-url.com', {
+          json: body,
+        });
+
+        await sleep(0.1);
+        user = await User.findById(user._id).exec();
+
+        expect(user.webhooks[0].failures).to.equal(0);
+        expect(user.webhooks[0].lastFailureAt).to.equal(undefined);
+      });
+
+      it('records failures', async () => {
+        sinon.stub(logger, 'error');
+        const body = {};
+        sendWebhook.send(user, body);
+
+        expect(got.post).to.be.calledOnce;
+        expect(got.post).to.be.calledWithMatch('http://custom-url.com', {
+          json: body,
+        });
+
+        await sleep(0.1);
+        user = await User.findById(user._id).exec();
+
+        expect(user.webhooks[0].failures).to.equal(1);
+        expect((Date.now() - user.webhooks[0].lastFailureAt.getTime()) < 10000).to.be.true;
+
+        expect(logger.error).to.be.calledOnce;
+        logger.error.restore();
+      });
+
+      it('disables a webhook after 10 failures', async () => {
+        const times = 10;
+        for (let i = 0; i < times; i += 1) {
+          sendWebhook.send(user, {});
+          await sleep(0.1); // eslint-disable-line no-await-in-loop
+          user = await User.findById(user._id).exec(); // eslint-disable-line no-await-in-loop
+        }
+
+        expect(got.post).to.be.callCount(10);
+        expect(got.post).to.be.calledWithMatch('http://custom-url.com');
+
+        await sleep(0.1);
+        user = await User.findById(user._id).exec();
+
+        expect(user.webhooks[0].enabled).to.equal(false);
+        expect(user.webhooks[0].failures).to.equal(0);
+      });
+
+      it('resets failures after a month ', async () => {
+        const oneMonthAgo = moment().subtract(1, 'months').subtract(1, 'days').toDate();
+        user.webhooks[0].lastFailureAt = oneMonthAgo;
+        user.webhooks[0].failures = 9;
+
+        await user.save();
+
+        sendWebhook.send(user, []);
+
+        expect(got.post).to.be.calledOnce;
+        expect(got.post).to.be.calledWithMatch('http://custom-url.com');
+
+        await sleep(0.1);
+        user = await User.findById(user._id).exec();
+
+        expect(user.webhooks[0].failures).to.equal(1);
+        // Check that the stored date is whitin 10s from now
+        expect((Date.now() - user.webhooks[0].lastFailureAt.getTime()) < 10000).to.be.true;
       });
     });
   });
@@ -363,8 +455,7 @@ describe('webhooks', () => {
 
       expect(got.post).to.be.calledOnce;
       expect(got.post).to.be.calledWithMatch(webhooks[0].url, {
-        json: true,
-        body: {
+        json: {
           type: 'scored',
           webhookType: 'taskActivity',
           user: {
@@ -401,8 +492,7 @@ describe('webhooks', () => {
 
       expect(got.post).to.be.calledOnce;
       expect(got.post).to.be.calledWithMatch('http://global-activity.com', {
-        json: true,
-        body: {
+        json: {
           type: 'scored',
           webhookType: 'taskActivity',
           user: {
@@ -455,8 +545,7 @@ describe('webhooks', () => {
 
         expect(got.post).to.be.calledOnce;
         expect(got.post).to.be.calledWithMatch(webhooks[0].url, {
-          json: true,
-          body: {
+          json: {
             type,
             webhookType: 'taskActivity',
             user: {
@@ -496,8 +585,7 @@ describe('webhooks', () => {
 
         expect(got.post).to.be.calledOnce;
         expect(got.post).to.be.calledWithMatch(webhooks[0].url, {
-          json: true,
-          body: {
+          json: {
             webhookType: 'taskActivity',
             user: {
               _id: user._id,
@@ -537,8 +625,7 @@ describe('webhooks', () => {
 
         expect(got.post).to.be.calledOnce;
         expect(got.post).to.be.calledWithMatch(webhooks[2].url, {
-          json: true,
-          body: {
+          json: {
             type,
             webhookType: 'userActivity',
             user: {
@@ -576,7 +663,7 @@ describe('webhooks', () => {
       };
     });
 
-    ['questStarted', 'questFinised'].forEach(type => {
+    ['questStarted', 'questFinised', 'questInvited'].forEach(type => {
       it(`sends ${type} webhooks`, () => {
         data.type = type;
 
@@ -584,8 +671,7 @@ describe('webhooks', () => {
 
         expect(got.post).to.be.calledOnce;
         expect(got.post).to.be.calledWithMatch(webhooks[1].url, {
-          json: true,
-          body: {
+          json: {
             type,
             webhookType: 'questActivity',
             user: {
@@ -631,8 +717,7 @@ describe('webhooks', () => {
 
       expect(got.post).to.be.calledOnce;
       expect(got.post).to.be.calledWithMatch(webhooks[webhooks.length - 1].url, {
-        json: true,
-        body: {
+        json: {
           webhookType: 'groupChatReceived',
           user: {
             _id: user._id,

test/api/unit/middlewares/analytics.test.js

@@ -19,7 +19,7 @@ describe('analytics middleware', () => {
     next = generateNext();
   });
 
-  it('attaches analytics object res.locals', () => {
+  it('attaches analytics object to res', () => {
     const attachAnalytics = requireAgain(pathToAnalyticsMiddleware).default;
 
     attachAnalytics(req, res, next);

test/api/unit/middlewares/cache.test.js

@@ -0,0 +1,31 @@
+import {
+  generateRes,
+  generateReq,
+  generateNext,
+} from '../../../helpers/api-unit.helper';
+import {
+  disableCache,
+} from '../../../../website/server/middlewares/cache';
+
+describe('cache middlewares', () => {
+  let res; let req; let
+    next;
+
+  beforeEach(() => {
+    req = generateReq();
+    res = generateRes();
+    next = generateNext();
+  });
+
+  describe('disableCache', () => {
+    it('sets the correct headers', () => {
+      disableCache(req, res, next);
+      expect(res.set).to.have.been.calledWith('Cache-Control', 'no-store');
+      expect(next).to.have.been.calledOnce;
+    });
+
+    xit('removes the etag header', () => {
+      // @TODO how to stub onHeaders
+    });
+  });
+});

test/api/unit/middlewares/cors.test.js

@@ -21,7 +21,8 @@ describe('cors middleware', () => {
     expect(res.set).to.have.been.calledWith({
       'Access-Control-Allow-Origin': '*',
       'Access-Control-Allow-Methods': 'OPTIONS,GET,POST,PUT,HEAD,DELETE',
-      'Access-Control-Allow-Headers': 'Content-Type,Accept,Content-Encoding,X-Requested-With,x-api-user,x-api-key,x-client',
+      'Access-Control-Allow-Headers': 'Authorization,Content-Type,Accept,Content-Encoding,X-Requested-With,x-api-user,x-api-key,x-client',
+      'Access-Control-Expose-Headers': 'X-RateLimit-Limit,X-RateLimit-Remaining,X-RateLimit-Reset,Retry-After',
     });
     expect(res.sendStatus).to.not.have.been.called;
     expect(next).to.have.been.calledOnce;
@@ -33,7 +34,8 @@ describe('cors middleware', () => {
     expect(res.set).to.have.been.calledWith({
       'Access-Control-Allow-Origin': '*',
       'Access-Control-Allow-Methods': 'OPTIONS,GET,POST,PUT,HEAD,DELETE',
-      'Access-Control-Allow-Headers': 'Content-Type,Accept,Content-Encoding,X-Requested-With,x-api-user,x-api-key,x-client',
+      'Access-Control-Allow-Headers': 'Authorization,Content-Type,Accept,Content-Encoding,X-Requested-With,x-api-user,x-api-key,x-client',
+      'Access-Control-Expose-Headers': 'X-RateLimit-Limit,X-RateLimit-Remaining,X-RateLimit-Reset,Retry-After',
     });
     expect(res.sendStatus).to.have.been.calledWith(200);
     expect(next).to.not.have.been.called;

test/api/unit/middlewares/cronMiddleware.js

@@ -21,28 +21,11 @@ describe('cron middleware', () => {
     req;
   let user;
 
-  beforeEach(done => {
+  beforeEach(async () => {
     res = generateRes();
     req = generateReq();
-    user = new User({
-      auth: {
-        local: {
-          username: 'username',
-          lowerCaseUsername: 'username',
-          email: 'email@email.email',
-          salt: 'salt',
-          hashed_password: 'hashed_password', // eslint-disable-line camelcase
-        },
-      },
-    });
-
-    user.save()
-      .then(savedUser => {
-        res.locals.user = savedUser;
-        res.analytics = analyticsService;
-        done();
-      })
-      .catch(done);
+    user = await res.locals.user.save();
+    res.analytics = analyticsService;
   });
 
   afterEach(() => {

test/api/unit/middlewares/errorHandler.test.js

@@ -170,6 +170,7 @@ describe('errorHandler', () => {
       originalUrl: req.originalUrl,
       headers: req.headers,
       body: req.body,
+      query: req.query,
       httpCode: 400,
       isHandledError: true,
     });

test/api/unit/middlewares/ipBlocker.test.js

@@ -0,0 +1,76 @@
+import nconf from 'nconf';
+import requireAgain from 'require-again';
+import {
+  generateRes,
+  generateReq,
+  generateNext,
+} from '../../../helpers/api-unit.helper';
+import { Forbidden } from '../../../../website/server/libs/errors';
+import apiError from '../../../../website/server/libs/apiError';
+
+function checkErrorThrown (next) {
+  expect(next).to.have.been.calledOnce;
+  const calledWith = next.getCall(0).args;
+  expect(calledWith[0].message).to.equal(apiError('ipAddressBlocked'));
+  expect(calledWith[0] instanceof Forbidden).to.equal(true);
+}
+
+function checkErrorNotThrown (next) {
+  expect(next).to.have.been.calledOnce;
+  const calledWith = next.getCall(0).args;
+  expect(typeof calledWith[0] === 'undefined').to.equal(true);
+}
+
+describe('ipBlocker middleware', () => {
+  const pathToIpBlocker = '../../../../website/server/middlewares/ipBlocker';
+
+  let res; let req; let next;
+
+  beforeEach(() => {
+    res = generateRes();
+    req = generateReq();
+    next = generateNext();
+  });
+
+  it('is disabled when the env var is not defined', () => {
+    sandbox.stub(nconf, 'get').withArgs('BLOCKED_IPS').returns(undefined);
+    const attachIpBlocker = requireAgain(pathToIpBlocker).default;
+    attachIpBlocker(req, res, next);
+
+    checkErrorNotThrown(next);
+  });
+
+  it('is disabled when the env var is an empty string', () => {
+    sandbox.stub(nconf, 'get').withArgs('BLOCKED_IPS').returns('');
+    const attachIpBlocker = requireAgain(pathToIpBlocker).default;
+    attachIpBlocker(req, res, next);
+
+    checkErrorNotThrown(next);
+  });
+
+  it('is disabled when the env var contains comma separated empty strings', () => {
+    sandbox.stub(nconf, 'get').withArgs('BLOCKED_IPS').returns(' , , ');
+    const attachIpBlocker = requireAgain(pathToIpBlocker).default;
+    attachIpBlocker(req, res, next);
+
+    checkErrorNotThrown(next);
+  });
+
+  it('does not throw when the ip does not match', () => {
+    req.ip = '192.168.1.1';
+    sandbox.stub(nconf, 'get').withArgs('BLOCKED_IPS').returns('192.168.1.2');
+    const attachIpBlocker = requireAgain(pathToIpBlocker).default;
+    attachIpBlocker(req, res, next);
+
+    checkErrorNotThrown(next);
+  });
+
+  it('throws when the ip is blocked', () => {
+    req.ip = '192.168.1.1';
+    sandbox.stub(nconf, 'get').withArgs('BLOCKED_IPS').returns('192.168.1.1');
+    const attachIpBlocker = requireAgain(pathToIpBlocker).default;
+    attachIpBlocker(req, res, next);
+
+    checkErrorThrown(next);
+  });
+});

test/api/unit/middlewares/language.test.js

@@ -12,6 +12,9 @@ import { model as User } from '../../../../website/server/models/user';
 
 const { i18n } = common;
 
+// TODO some of the checks here can be simplified to simply check
+// that the right parameters are passed to the functions in libs/language
+
 describe('language middleware', () => {
   describe('res.t', () => {
     let res; let req; let
@@ -19,6 +22,8 @@ describe('language middleware', () => {
 
     beforeEach(() => {
       res = generateRes();
+      // remove the defaul user
+      res.locals.user = undefined;
       req = generateReq();
       next = generateNext();
 
@@ -57,6 +62,8 @@ describe('language middleware', () => {
 
     beforeEach(() => {
       res = generateRes();
+      // remove the defaul user
+      res.locals.user = undefined;
       req = generateReq();
       next = generateNext();
       attachTranslateFunction(req, res, next);
@@ -88,7 +95,7 @@ describe('language middleware', () => {
           lang: 'es',
         };
 
-        req.locals = {
+        res.locals = {
           user: {
             preferences: {
               language: 'it',
@@ -108,7 +115,7 @@ describe('language middleware', () => {
 
     context('authorized request', () => {
       it('uses the user preferred language if avalaible', () => {
-        req.locals = {
+        res.locals = {
           user: {
             preferences: {
               language: 'it',
@@ -122,7 +129,7 @@ describe('language middleware', () => {
       });
 
       it('falls back to english if the user preferred language is not avalaible', done => {
-        req.locals = {
+        res.locals = {
           user: {
             preferences: {
               language: 'bla',
@@ -138,7 +145,7 @@ describe('language middleware', () => {
       });
 
       it('uses the user preferred language even if a session is included in request', () => {
-        req.locals = {
+        res.locals = {
           user: {
             preferences: {
               language: 'it',

test/api/unit/middlewares/rateLimiter.test.js

@@ -0,0 +1,141 @@
+import nconf from 'nconf';
+import { RateLimiterMemory } from 'rate-limiter-flexible';
+import requireAgain from 'require-again';
+import {
+  generateRes,
+  generateReq,
+  generateNext,
+} from '../../../helpers/api-unit.helper';
+import { TooManyRequests } from '../../../../website/server/libs/errors';
+import apiError from '../../../../website/server/libs/apiError';
+import logger from '../../../../website/server/libs/logger';
+
+describe('rateLimiter middleware', () => {
+  const pathToRateLimiter = '../../../../website/server/middlewares/rateLimiter';
+
+  let res; let req; let next; let nconfGetStub;
+
+  beforeEach(() => {
+    nconfGetStub = sandbox.stub(nconf, 'get');
+
+    nconfGetStub.withArgs('NODE_ENV').returns('test');
+    nconfGetStub.withArgs('IS_TEST').returns(true);
+
+    res = generateRes();
+    req = generateReq();
+    next = generateNext();
+  });
+
+  afterEach(() => {
+    sandbox.restore();
+  });
+
+  it('is disabled when the env var is not defined', () => {
+    nconfGetStub.withArgs('RATE_LIMITER_ENABLED').returns(undefined);
+    const attachRateLimiter = requireAgain(pathToRateLimiter).default;
+    attachRateLimiter(req, res, next);
+
+    expect(next).to.have.been.calledOnce;
+    const calledWith = next.getCall(0).args;
+    expect(typeof calledWith[0] === 'undefined').to.equal(true);
+    expect(res.set).to.not.have.been.called;
+  });
+
+  it('is disabled when the env var is an not "true"', () => {
+    nconfGetStub.withArgs('RATE_LIMITER_ENABLED').returns('false');
+    const attachRateLimiter = requireAgain(pathToRateLimiter).default;
+    attachRateLimiter(req, res, next);
+
+    expect(next).to.have.been.calledOnce;
+    const calledWith = next.getCall(0).args;
+    expect(typeof calledWith[0] === 'undefined').to.equal(true);
+    expect(res.set).to.not.have.been.called;
+  });
+
+  it('does not throw when there are available points', async () => {
+    nconfGetStub.withArgs('RATE_LIMITER_ENABLED').returns('true');
+    const attachRateLimiter = requireAgain(pathToRateLimiter).default;
+    await attachRateLimiter(req, res, next);
+
+    expect(next).to.have.been.calledOnce;
+    const calledWith = next.getCall(0).args;
+    expect(typeof calledWith[0] === 'undefined').to.equal(true);
+
+    expect(res.set).to.have.been.calledOnce;
+    expect(res.set).to.have.been.calledWithMatch({
+      'X-RateLimit-Limit': 30,
+      'X-RateLimit-Remaining': 29,
+      'X-RateLimit-Reset': sinon.match(Date),
+    });
+  });
+
+  it('does not throw when an unknown error is thrown by the rate limiter', async () => {
+    nconfGetStub.withArgs('RATE_LIMITER_ENABLED').returns('true');
+    sandbox.stub(logger, 'error');
+    sandbox.stub(RateLimiterMemory.prototype, 'consume')
+      .returns(Promise.reject(new Error('Unknown error.')));
+
+    const attachRateLimiter = requireAgain(pathToRateLimiter).default;
+    await attachRateLimiter(req, res, next);
+
+    expect(next).to.have.been.calledOnce;
+    const calledWith = next.getCall(0).args;
+    expect(typeof calledWith[0] === 'undefined').to.equal(true);
+    expect(res.set).to.not.have.been.called;
+
+    expect(logger.error).to.be.calledOnce;
+    expect(logger.error).to.have.been.calledWithMatch(Error, 'Rate Limiter Error');
+  });
+
+  it('throws when there are no available points remaining', async () => {
+    nconfGetStub.withArgs('RATE_LIMITER_ENABLED').returns('true');
+    const attachRateLimiter = requireAgain(pathToRateLimiter).default;
+
+    // call for 31 times
+    for (let i = 0; i < 31; i += 1) {
+      await attachRateLimiter(req, res, next); // eslint-disable-line no-await-in-loop
+    }
+
+    expect(next).to.have.been.callCount(31);
+    const calledWith = next.getCall(30).args;
+    expect(calledWith[0].message).to.equal(apiError('clientRateLimited'));
+    expect(calledWith[0] instanceof TooManyRequests).to.equal(true);
+
+    expect(res.set).to.have.been.callCount(31);
+    expect(res.set).to.have.been.calledWithMatch({
+      'Retry-After': sinon.match(Number),
+      'X-RateLimit-Limit': 30,
+      'X-RateLimit-Remaining': 0,
+      'X-RateLimit-Reset': sinon.match(Date),
+    });
+  });
+
+  it('uses the user id if supplied or the ip address', async () => {
+    nconfGetStub.withArgs('RATE_LIMITER_ENABLED').returns('true');
+    const attachRateLimiter = requireAgain(pathToRateLimiter).default;
+
+    req.ip = 1;
+    await attachRateLimiter(req, res, next);
+
+    req.headers['x-api-user'] = 'user-1';
+    await attachRateLimiter(req, res, next);
+    await attachRateLimiter(req, res, next);
+
+    // user id an ip are counted as separate sources
+    expect(res.set).to.have.been.calledWithMatch({
+      'X-RateLimit-Limit': 30,
+      'X-RateLimit-Remaining': 28, // 2 calls with user id
+      'X-RateLimit-Reset': sinon.match(Date),
+    });
+
+    req.headers['x-api-user'] = undefined;
+    await attachRateLimiter(req, res, next);
+    await attachRateLimiter(req, res, next);
+
+    expect(res.set).to.have.been.calledWithMatch({
+      'X-RateLimit-Limit': 30,
+      'X-RateLimit-Remaining': 27, // 3 calls with only ip
+      'X-RateLimit-Reset': sinon.match(Date),
+    });
+  });
+});

test/api/unit/middlewares/redirects.js

@@ -22,7 +22,7 @@ describe('redirects middleware', () => {
       const nconfStub = sandbox.stub(nconf, 'get');
       nconfStub.withArgs('BASE_URL').returns('https://habitica.com');
       nconfStub.withArgs('IS_PROD').returns(true);
-      req.header = sandbox.stub().withArgs('x-forwarded-proto').returns('http');
+      req.protocol = 'http';
       req.originalUrl = '/static/front';
 
       const attachRedirects = requireAgain(pathToRedirectsMiddleware);
@@ -37,7 +37,7 @@ describe('redirects middleware', () => {
       const nconfStub = sandbox.stub(nconf, 'get');
       nconfStub.withArgs('BASE_URL').returns('https://habitica.com');
       nconfStub.withArgs('IS_PROD').returns(true);
-      req.header = sandbox.stub().withArgs('x-forwarded-proto').returns('https');
+      req.protocol = 'https';
       req.originalUrl = '/static/front';
 
       const attachRedirects = requireAgain(pathToRedirectsMiddleware);
@@ -51,7 +51,7 @@ describe('redirects middleware', () => {
       const nconfStub = sandbox.stub(nconf, 'get');
       nconfStub.withArgs('BASE_URL').returns('https://habitica.com');
       nconfStub.withArgs('IS_PROD').returns(false);
-      req.header = sandbox.stub().withArgs('x-forwarded-proto').returns('http');
+      req.protocol = 'http';
       req.originalUrl = '/static/front';
 
       const attachRedirects = requireAgain(pathToRedirectsMiddleware);
@@ -65,7 +65,7 @@ describe('redirects middleware', () => {
       const nconfStub = sandbox.stub(nconf, 'get');
       nconfStub.withArgs('BASE_URL').returns('http://habitica.com');
       nconfStub.withArgs('IS_PROD').returns(true);
-      req.header = sandbox.stub().withArgs('x-forwarded-proto').returns('http');
+      req.protocol = 'http';
       req.originalUrl = '/static/front';
 
       const attachRedirects = requireAgain(pathToRedirectsMiddleware);
@@ -81,7 +81,7 @@ describe('redirects middleware', () => {
       nconfStub.withArgs('IS_PROD').returns(true);
       nconfStub.withArgs('SKIP_SSL_CHECK_KEY').returns('test-key');
 
-      req.header = sandbox.stub().withArgs('x-forwarded-proto').returns('http');
+      req.protocol = 'http';
       req.originalUrl = '/static/front';
       req.query.skipSSLCheck = 'test-key';
 
@@ -97,7 +97,7 @@ describe('redirects middleware', () => {
       nconfStub.withArgs('IS_PROD').returns(true);
       nconfStub.withArgs('SKIP_SSL_CHECK_KEY').returns('test-key');
 
-      req.header = sandbox.stub().withArgs('x-forwarded-proto').returns('http');
+      req.protocol = 'http';
       req.originalUrl = '/static/front?skipSSLCheck=INVALID';
       req.query.skipSSLCheck = 'INVALID';
 
@@ -114,7 +114,7 @@ describe('redirects middleware', () => {
       nconfStub.withArgs('IS_PROD').returns(true);
       nconfStub.withArgs('SKIP_SSL_CHECK_KEY').returns(null);
 
-      req.header = sandbox.stub().withArgs('x-forwarded-proto').returns('http');
+      req.protocol = 'http';
       req.originalUrl = '/static/front';
       req.query.skipSSLCheck = 'INVALID';
 

test/api/unit/middlewares/response.js

@@ -16,7 +16,6 @@ describe('response middleware', () => {
     next = generateNext();
   });
 
-
   it('attaches respond method to res', () => {
     responseMiddleware(req, res, next);
 
@@ -34,7 +33,7 @@ describe('response middleware', () => {
     expect(res.json).to.be.calledWith({
       success: true,
       data: { field: 1 },
-      notifications: [],
+      notifications: res.locals.user.notifications,
       userV: res.locals.user._v,
       appVersion: packageInfo.version,
     });
@@ -52,7 +51,7 @@ describe('response middleware', () => {
       success: true,
       data: { field: 1 },
       message: 'hello',
-      notifications: [],
+      notifications: res.locals.user.notifications,
       userV: res.locals.user._v,
       appVersion: packageInfo.version,
     });
@@ -69,7 +68,7 @@ describe('response middleware', () => {
     expect(res.json).to.be.calledWith({
       success: false,
       data: { field: 1 },
-      notifications: [],
+      notifications: res.locals.user.notifications,
       userV: res.locals.user._v,
       appVersion: packageInfo.version,
     });
@@ -84,42 +83,9 @@ describe('response middleware', () => {
     expect(res.json).to.be.calledWith({
       success: true,
       data: { field: 1 },
-      notifications: [],
+      notifications: res.locals.user.notifications,
       userV: 0,
       appVersion: packageInfo.version,
     });
   });
-
-  it('returns notifications if a user is authenticated', () => {
-    const { user } = res.locals;
-
-    user.notifications = [
-      null, // invalid, not an object
-      { seen: true }, // invalid, no type or id
-      { id: 123 }, // invalid, no type
-      // invalid, no id, not included here because the id would be added automatically
-      // {type: 'ABC'},
-      { type: 'ABC', id: '123' }, // valid
-    ];
-
-    responseMiddleware(req, res, next);
-    res.respond(200, { field: 1 });
-
-    expect(res.json).to.be.calledOnce;
-
-    expect(res.json).to.be.calledWith({
-      success: true,
-      data: { field: 1 },
-      notifications: [
-        {
-          type: 'ABC',
-          id: '123',
-          data: {},
-          seen: false,
-        },
-      ],
-      userV: res.locals.user._v,
-      appVersion: packageInfo.version,
-    });
-  });
 });

test/api/unit/models/challenge.test.js

@@ -35,6 +35,33 @@ describe('Challenge Model', () => {
       notes: 'test notes',
     },
   };
+  const tasks2ToTest = {
+    habit: {
+      text: 'test habit 2',
+      type: 'habit',
+      up: false,
+      down: true,
+      notes: 'test notes',
+    },
+    todo: {
+      text: 'test todo 2',
+      type: 'todo',
+      notes: 'test notes',
+    },
+    daily: {
+      text: 'test daily 2',
+      type: 'daily',
+      frequency: 'daily',
+      everyX: 5,
+      startDate: new Date(),
+      notes: 'test notes',
+    },
+    reward: {
+      text: 'test reward 2',
+      type: 'reward',
+      notes: 'test notes',
+    },
+  };
 
   beforeEach(async () => {
     guild = new Group({
@@ -90,7 +117,37 @@ describe('Challenge Model', () => {
         expect(syncedTask.tags[0]).to.eql(challenge._id);
       });
 
-      it('syncs a challenge to a user', async () => {
+      it('adds a challenge to a user', async () => {
+        const newMember = new User({
+          guilds: [guild._id],
+        });
+        await newMember.save();
+
+        const addedSuccessfully = await challenge.addToUser(newMember);
+
+        const updatedNewMember = await User.findById(newMember._id);
+
+        expect(addedSuccessfully).to.eql(true);
+        expect(updatedNewMember.challenges).to.contain(challenge._id);
+      });
+
+      it('does not add a challenge to a user that already in the challenge', async () => {
+        const newMember = new User({
+          guilds: [guild._id],
+          challenges: [challenge._id],
+        });
+        await newMember.save();
+
+        const addedSuccessfully = await challenge.addToUser(newMember);
+
+        const updatedNewMember = await User.findById(newMember._id);
+
+        expect(addedSuccessfully).to.eql(false);
+        expect(updatedNewMember.challenges).to.contain(challenge._id);
+        expect(updatedNewMember.challenges.length).to.eql(1);
+      });
+
+      it('syncs challenge tasks to a user', async () => {
         await challenge.addTasks([task]);
 
         const newMember = new User({
@@ -98,7 +155,7 @@ describe('Challenge Model', () => {
         });
         await newMember.save();
 
-        await challenge.syncToUser(newMember);
+        await challenge.syncTasksToUser(newMember);
 
         const updatedNewMember = await User.findById(newMember._id);
         const updatedNewMemberTasks = await Tasks.Task.find({ _id: { $in: updatedNewMember.tasksOrder[`${taskType}s`] } });
@@ -110,14 +167,67 @@ describe('Challenge Model', () => {
           ),
         );
 
-        expect(updatedNewMember.challenges).to.contain(challenge._id);
         expect(updatedNewMember.tags[7].id).to.equal(challenge._id);
         expect(updatedNewMember.tags[7].name).to.equal(challenge.shortName);
         expect(syncedTask).to.exist;
         expect(syncedTask.attribute).to.eql('str');
       });
 
-      it('syncs a challenge to a user with the existing task', async () => {
+      it('should add challenge tag back to user upon syncing challenge tasks to a user with challenge tag removed', async () => {
+        await challenge.addTasks([task]);
+
+        const newMember = new User({
+          guilds: [guild._id],
+        });
+        await newMember.save();
+        await challenge.syncTasksToUser(newMember);
+
+        let updatedNewMember = await User.findById(newMember._id).exec();
+        const updatedNewMemberId = updatedNewMember._id;
+
+        updatedNewMember.tags = [];
+        await updatedNewMember.save();
+
+        const taskValue2 = tasks2ToTest[taskType];
+        const task2 = new Tasks[`${taskType}`](Tasks.Task.sanitize(taskValue2));
+        task2.challenge.id = challenge._id;
+        await challenge.addTasks([task2]);
+        await challenge.syncTasksToUser(updatedNewMember);
+
+        updatedNewMember = await User.findById(updatedNewMemberId).exec();
+
+        expect(updatedNewMember.tags.length).to.equal(1);
+        expect(updatedNewMember.tags[0].id).to.equal(challenge._id);
+        expect(updatedNewMember.tags[0].name).to.equal(challenge.shortName);
+      });
+
+      it('should not add a duplicate challenge tag to user upon syncing challenge tasks to a user with existing challenge tag', async () => {
+        await challenge.addTasks([task]);
+
+        const newMember = new User({
+          guilds: [guild._id],
+        });
+        await newMember.save();
+        await challenge.syncTasksToUser(newMember);
+
+        let updatedNewMember = await User.findById(newMember._id).exec();
+        const updatedNewMemberId = updatedNewMember._id;
+
+        const taskValue2 = tasks2ToTest[taskType];
+        const task2 = new Tasks[`${taskType}`](Tasks.Task.sanitize(taskValue2));
+        task2.challenge.id = challenge._id;
+        await challenge.addTasks([task2]);
+        await challenge.syncTasksToUser(updatedNewMember);
+
+        updatedNewMember = await User.findById(updatedNewMemberId);
+
+        expect(updatedNewMember.tags.length).to.equal(8);
+        expect(updatedNewMember.tags[7].id).to.equal(challenge._id);
+        expect(updatedNewMember.tags[7].name).to.equal(challenge.shortName);
+        expect(updatedNewMember.tags.filter(tag => tag.id === challenge._id).length).to.equal(1);
+      });
+
+      it('syncs challenge tasks to a user with the existing task', async () => {
         await challenge.addTasks([task]);
 
         let updatedLeader = await User.findOne({ _id: leader._id });
@@ -134,7 +244,7 @@ describe('Challenge Model', () => {
         task.text = newTitle;
         task.attribute = 'int';
         await task.save();
-        await challenge.syncToUser(leader);
+        await challenge.syncTasksToUser(leader);
 
         updatedLeader = await User.findOne({ _id: leader._id });
         updatedLeadersTasks = await Tasks.Task.find({ _id: { $in: updatedLeader.tasksOrder[`${taskType}s`] } });

test/api/unit/models/group.test.js

@@ -538,52 +538,74 @@ describe('Group Model', () => {
           });
         });
 
-        it('sends a chat message if no progress is made on quest with multiple items', async () => {
-          progress.collectedItems = 0;
-          party.quest.key = 'dilatoryDistress1';
-          party.quest.active = false;
+        describe('collection quests with multiple items', () => {
+          it('sends a chat message if no progress is made on quest with multiple items', async () => {
+            progress.collectedItems = 0;
+            party.quest.key = 'dilatoryDistress1';
+            party.quest.active = false;
 
-          await party.startQuest(questLeader);
-          Group.prototype.sendChat.resetHistory();
-          await party.save();
+            await party.startQuest(questLeader);
+            Group.prototype.sendChat.resetHistory();
+            await party.save();
 
-          await Group.processQuestProgress(participatingMember, progress);
+            await Group.processQuestProgress(participatingMember, progress);
 
-          party = await Group.findOne({ _id: party._id });
+            party = await Group.findOne({ _id: party._id });
 
-          expect(Group.prototype.sendChat).to.be.calledOnce;
-          expect(Group.prototype.sendChat).to.be.calledWith({
-            message: '`Participating Member found 0 Fire Coral, 0 Blue Fins.`',
-            info: {
-              items: { blueFins: 0, fireCoral: 0 },
-              quest: 'dilatoryDistress1',
-              type: 'user_found_items',
-              user: 'Participating Member',
-            },
+            expect(Group.prototype.sendChat).to.be.calledOnce;
+            expect(Group.prototype.sendChat).to.be.calledWith({
+              message: '`Participating Member found 0 Fire Coral, 0 Blue Fins.`',
+              info: {
+                items: { blueFins: 0, fireCoral: 0 },
+                quest: 'dilatoryDistress1',
+                type: 'user_found_items',
+                user: 'Participating Member',
+              },
+            });
           });
-        });
 
-        it('handles collection quests with multiple items', async () => {
-          progress.collectedItems = 10;
-          party.quest.key = 'evilsanta2';
-          party.quest.active = false;
+          it('handles correctly', async () => {
+            progress.collectedItems = 10;
+            party.quest.key = 'evilsanta2';
+            party.quest.active = false;
 
-          await party.startQuest(questLeader);
-          Group.prototype.sendChat.resetHistory();
-          await party.save();
+            await party.startQuest(questLeader);
+            Group.prototype.sendChat.resetHistory();
+            await party.save();
 
-          await Group.processQuestProgress(participatingMember, progress);
+            await Group.processQuestProgress(participatingMember, progress);
 
-          party = await Group.findOne({ _id: party._id });
+            party = await Group.findOne({ _id: party._id });
 
-          expect(Group.prototype.sendChat).to.be.calledOnce;
-          expect(Group.prototype.sendChat).to.be.calledWithMatch({
-            message: sinon.match(/`Participating Member found/).and(sinon.match(/\d* (Tracks|Broken Twigs)/)),
-            info: {
-              quest: 'evilsanta2',
-              type: 'user_found_items',
-              user: 'Participating Member',
-            },
+            expect(Group.prototype.sendChat).to.be.calledOnce;
+            expect(Group.prototype.sendChat).to.be.calledWithMatch({
+              message: sinon.match(/`Participating Member found/).and(sinon.match(/\d* (Tracks|Broken Twigs)/)),
+              info: {
+                quest: 'evilsanta2',
+                type: 'user_found_items',
+                user: 'Participating Member',
+              },
+            });
+          });
+
+          it('cannot collect excess items', async () => {
+            // Make sure the quest progress isn't erased
+            sandbox.stub(Group.prototype, 'finishQuest').returns(Promise.resolve());
+
+            progress.collectedItems = 500;
+            party.quest.key = 'evilsanta2';
+            party.quest.active = false;
+
+            await party.startQuest(questLeader);
+            await party.save();
+
+            await Group.processQuestProgress(participatingMember, progress);
+            party = await Group.findOne({ _id: party._id });
+
+            expect(party.quest.progress.collect.tracks)
+              .to.eql(questScrolls.evilsanta2.collect.tracks.count);
+            expect(party.quest.progress.collect.branches)
+              .to.eql(questScrolls.evilsanta2.collect.branches.count);
           });
         });
 
@@ -747,7 +769,6 @@ describe('Group Model', () => {
         expect(res.t).to.not.be.called;
       });
 
-
       it('does not throw an error if only user ids are passed in', async () => {
         await Group.validateInvitations({ uuids: ['user-id', 'user-id2'] }, res);
         expect(res.t).to.not.be.called;
@@ -1164,6 +1185,23 @@ describe('Group Model', () => {
         });
       });
 
+      it('unlink group tag', async () => {
+        participatingMember.tags.push({
+          name: party.name,
+          id: party._id,
+          group: party._id,
+        });
+
+        await participatingMember.save();
+        await party.leave(participatingMember);
+
+        participatingMember = await User.findOne({ _id: participatingMember._id });
+        const groupTag = participatingMember.tags.find(tag => tag.id === party._id);
+
+        expect(groupTag).to.not.be.undefined;
+        expect(groupTag.group).to.be.undefined;
+      });
+
       it('deletes a private party when the last member leaves', async () => {
         await party.leave(participatingMember);
         await party.leave(sleepingParticipatingMember);
@@ -1317,7 +1355,7 @@ describe('Group Model', () => {
 
       it('formats message', () => {
         const chatMessage = party.sendChat({
-          message: 'a new message',
+          message: 'a _new_ message with *markdown*',
           user: {
             _id: 'user-id',
             profile: { name: 'user name' },
@@ -1336,7 +1374,8 @@ describe('Group Model', () => {
 
         const chat = chatMessage;
 
-        expect(chat.text).to.eql('a new message');
+        expect(chat.text).to.eql('a _new_ message with *markdown*');
+        expect(chat.unformattedText).to.eql('a new message with markdown');
         expect(validator.isUUID(chat.id)).to.eql(true);
         expect(chat.timestamp).to.be.a('date');
         expect(chat.likes).to.eql({});
@@ -1878,6 +1917,8 @@ describe('Group Model', () => {
         await questLeader.save();
         await party.finishQuest(quest);
 
+        await sleep(0.5);
+
         const [
           updatedLeader,
           updatedParticipatingMember,
@@ -2360,29 +2401,29 @@ describe('Group Model', () => {
       });
     });
 
-    context('isSubscribed', () => {
+    context('hasActiveGroupPlan', () => {
       it('returns false if group does not have customer id', () => {
-        expect(party.isSubscribed()).to.be.undefined;
+        expect(party.hasActiveGroupPlan()).to.be.undefined;
       });
 
       it('returns true if group does not have plan.dateTerminated', () => {
         party.purchased.plan.customerId = 'test-id';
 
-        expect(party.isSubscribed()).to.be.true;
+        expect(party.hasActiveGroupPlan()).to.be.true;
       });
 
       it('returns true if group if plan.dateTerminated is after today', () => {
         party.purchased.plan.customerId = 'test-id';
         party.purchased.plan.dateTerminated = moment().add(1, 'days').toDate();
 
-        expect(party.isSubscribed()).to.be.true;
+        expect(party.hasActiveGroupPlan()).to.be.true;
       });
 
       it('returns false if group if plan.dateTerminated is before today', () => {
         party.purchased.plan.customerId = 'test-id';
         party.purchased.plan.dateTerminated = moment().subtract(1, 'days').toDate();
 
-        expect(party.isSubscribed()).to.be.false;
+        expect(party.hasActiveGroupPlan()).to.be.false;
       });
     });
 

test/api/unit/models/group_tasks.test.js

@@ -235,15 +235,16 @@ describe('Group Task Methods', () => {
         });
       });
 
-      it('removes an assigned task and unlinks assignees', async () => {
+      it('removes assigned tasks when master task is deleted', async () => {
         await guild.syncTask(task, leader);
         await guild.removeTask(task);
 
         const updatedLeader = await User.findOne({ _id: leader._id });
-        const updatedLeadersTasks = await Tasks.Task.find({ _id: { $in: updatedLeader.tasksOrder[`${taskType}s`] } });
+        const updatedLeadersTasks = await Tasks.Task.find({ userId: leader._id, type: taskType });
         const syncedTask = find(updatedLeadersTasks, findLinkedTask);
 
-        expect(syncedTask.group.broken).to.equal('TASK_DELETED');
+        expect(updatedLeader.tasksOrder[`${taskType}s`]).to.not.include(task._id);
+        expect(syncedTask).to.not.exist;
       });
 
       it('unlinks and deletes group tasks for a user when remove-all is specified', async () => {

test/api/unit/models/message.test.js

@@ -0,0 +1,18 @@
+import { sanitizeText } from '../../../../website/server/models/message';
+import { MAX_MESSAGE_LENGTH } from '../../../../website/common/script/constants';
+
+describe('Message Model', () => {
+  context('sanitizeText', () => {
+    it('trims messages to the max length', () => {
+      const veryLongMessage = `
+      123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789.
+      THIS PART WON'T BE IN THE MESSAGE (over 3000)
+      `;
+      expect(veryLongMessage.length > MAX_MESSAGE_LENGTH).to.equal(true);
+
+      const sanitizedText = sanitizeText(veryLongMessage);
+      expect(sanitizedText).to.not.contain('MESSAGE');
+      expect(sanitizedText.length).to.equal(MAX_MESSAGE_LENGTH);
+    });
+  });
+});

test/api/unit/models/pushDevice.test.js

@@ -0,0 +1,33 @@
+import { model as PushDevice } from '../../../../website/server/models/pushDevice';
+
+describe('PushDevice Model', () => {
+  context('cleanupCorruptData', () => {
+    it('converts an array of push devices to a safe version', () => {
+      const pushDevices = [
+        null, // invalid, not an object
+        { regId: '123' }, // invalid, no type
+        { type: 'android' }, // invalid, no regId
+        new PushDevice({ type: 'android', regId: '1234' }), // valid
+      ];
+
+      const safePushDevices = PushDevice.cleanupCorruptData(pushDevices);
+      expect(safePushDevices.length).to.equal(1);
+      expect(safePushDevices[0].type).to.equal('android');
+      expect(safePushDevices[0].regId).to.equal('1234');
+    });
+
+    it('removes duplicates', () => {
+      const pushDevices = [
+        new PushDevice({ type: 'android', regId: '1234' }),
+        new PushDevice({ type: 'android', regId: '1234' }),
+        new PushDevice({ type: 'iphone', regId: '1234' }), // not duplicate
+        new PushDevice({ type: 'android', regId: '12345' }), // not duplicate
+      ];
+
+      const safePushDevices = PushDevice.cleanupCorruptData(pushDevices);
+      expect(safePushDevices.length).to.equal(3);
+      expect(safePushDevices[0].type).to.equal('android');
+      expect(safePushDevices[0].regId).to.equal('1234');
+    });
+  });
+});

test/api/unit/models/tag.test.js

@@ -0,0 +1,19 @@
+import { model as Tag } from '../../../../website/server/models/tag';
+
+describe('Tag Model', () => {
+  context('cleanupCorruptData', () => {
+    it('converts an array of tags to a safe version', () => {
+      const tags = [
+        null, // invalid, not an object
+        { name: '123' }, // invalid, no id
+        { id: '123' }, // invalid, no name
+        new Tag({ name: 'ABC', id: 123 }), // valid
+      ];
+
+      const safetags = Tag.cleanupCorruptData(tags);
+      expect(safetags.length).to.equal(1);
+      expect(safetags[0].name).to.equal('ABC');
+      expect(safetags[0].id).to.equal('123');
+    });
+  });
+});

test/api/unit/models/task.test.js

@@ -3,7 +3,6 @@ import { model as Challenge } from '../../../../website/server/models/challenge'
 import { model as Group } from '../../../../website/server/models/group';
 import { model as User } from '../../../../website/server/models/user';
 import * as Tasks from '../../../../website/server/models/task';
-import { InternalServerError } from '../../../../website/server/libs/errors';
 import { generateHistory } from '../../../helpers/api-unit.helper';
 
 describe('Task Model', () => {
@@ -99,7 +98,8 @@ describe('Task Model', () => {
           throw new Error('No exception when Id is None');
         } catch (err) {
           expect(err).to.exist;
-          expect(err).to.eql(new InternalServerError('Task identifier is a required argument'));
+          expect(err).to.be.an.instanceOf(Error);
+          expect(err.message).to.eql('Task identifier is a required argument');
         }
       });
 
@@ -109,7 +109,8 @@ describe('Task Model', () => {
           throw new Error('No exception when user_id is undefined');
         } catch (err) {
           expect(err).to.exist;
-          expect(err).to.eql(new InternalServerError('User identifier is a required argument'));
+          expect(err).to.be.an.instanceOf(Error);
+          expect(err.message).to.eql('User identifier is a required argument');
         }
       });
 
@@ -153,6 +154,132 @@ describe('Task Model', () => {
       });
     });
 
+    describe('findMultipleByIdOrAlias', () => {
+      let taskWithAlias;
+      let secondTask;
+      let user;
+
+      beforeEach(async () => {
+        user = new User();
+        await user.save();
+
+        taskWithAlias = new Tasks.todo({ // eslint-disable-line new-cap
+          text: 'some text',
+          alias: 'short-name',
+          userId: user.id,
+        });
+        await taskWithAlias.save();
+
+        secondTask = new Tasks.habit({ // eslint-disable-line new-cap
+          text: 'second task',
+          alias: 'second-short-name',
+          userId: user.id,
+        });
+        await secondTask.save();
+
+        sandbox.spy(Tasks.Task, 'find');
+      });
+
+      it('throws an error if task identifiers is not passed in', async () => {
+        try {
+          await Tasks.Task.findMultipleByIdOrAlias(null, user._id);
+          throw new Error('No exception when Id is None');
+        } catch (err) {
+          expect(err).to.exist;
+          expect(err).to.be.an.instanceOf(Error);
+          expect(err.message).to.eql('Task identifiers is a required array argument');
+        }
+      });
+
+      it('throws an error if task identifiers is not an array', async () => {
+        try {
+          await Tasks.Task.findMultipleByIdOrAlias('string', user._id);
+          throw new Error('No exception when Id is None');
+        } catch (err) {
+          expect(err).to.exist;
+          expect(err).to.be.an.instanceOf(Error);
+          expect(err.message).to.eql('Task identifiers is a required array argument');
+        }
+      });
+
+      it('throws an error if user identifier is not passed in', async () => {
+        try {
+          await Tasks.Task.findMultipleByIdOrAlias([taskWithAlias._id]);
+          throw new Error('No exception when user_id is undefined');
+        } catch (err) {
+          expect(err).to.exist;
+          expect(err).to.be.an.instanceOf(Error);
+          expect(err.message).to.eql('User identifier is a required argument');
+        }
+      });
+
+      it('returns task by id', async () => {
+        const foundTasks = await Tasks.Task.findMultipleByIdOrAlias([taskWithAlias._id], user._id);
+
+        expect(foundTasks[0].text).to.eql(taskWithAlias.text);
+      });
+
+      it('returns task by alias', async () => {
+        const foundTasks = await Tasks.Task.findMultipleByIdOrAlias(
+          [taskWithAlias.alias], user._id,
+        );
+
+        expect(foundTasks[0].text).to.eql(taskWithAlias.text);
+      });
+
+      it('returns multiple tasks', async () => {
+        const foundTasks = await Tasks.Task.findMultipleByIdOrAlias(
+          [taskWithAlias.alias, secondTask._id], user._id,
+        );
+
+        expect(foundTasks.length).to.eql(2);
+        expect(foundTasks[0]._id).to.eql(taskWithAlias._id);
+        expect(foundTasks[1]._id).to.eql(secondTask._id);
+      });
+
+      it('returns a task only once if searched by both id and alias', async () => {
+        const foundTasks = await Tasks.Task.findMultipleByIdOrAlias(
+          [taskWithAlias.alias, taskWithAlias._id], user._id,
+        );
+
+        expect(foundTasks.length).to.eql(1);
+        expect(foundTasks[0].text).to.eql(taskWithAlias.text);
+      });
+
+      it('scopes alias lookup to user', async () => {
+        await Tasks.Task.findMultipleByIdOrAlias([taskWithAlias.alias], user._id);
+
+        expect(Tasks.Task.find).to.be.calledOnce;
+        expect(Tasks.Task.find).to.be.calledWithMatch({
+          $or: [
+            { _id: { $in: [] } },
+            { alias: { $in: [taskWithAlias.alias] } },
+          ],
+          userId: user._id,
+        });
+      });
+
+      it('returns empty array if tasks cannot be found', async () => {
+        const foundTasks = await Tasks.Task.findMultipleByIdOrAlias(['not-found'], user._id);
+
+        expect(foundTasks).to.eql([]);
+      });
+
+      it('accepts additional query parameters', async () => {
+        await Tasks.Task.findMultipleByIdOrAlias([taskWithAlias.alias], user._id, { foo: 'bar' });
+
+        expect(Tasks.Task.find).to.be.calledOnce;
+        expect(Tasks.Task.find).to.be.calledWithMatch({
+          $or: [
+            { _id: { $in: [] } },
+            { alias: { $in: [taskWithAlias.alias] } },
+          ],
+          userId: user._id,
+          foo: 'bar',
+        });
+      });
+    });
+
     describe('sanitizeUserChallengeTask ', () => {
     });
 

test/api/unit/models/user.test.js

@@ -84,6 +84,243 @@ describe('User Model', () => {
     expect(userToJSON.stats.toNextLevel).to.equal(common.tnl(user.stats.lvl));
   });
 
+  context('achievements', () => {
+    it('can add an achievement', () => {
+      const user = new User();
+      const originalUserToJSON = user.toJSON({ minimize: false });
+      expect(originalUserToJSON.achievements.createdTask).to.not.eql(true);
+      const notificationsN = originalUserToJSON.notifications.length;
+
+      user.addAchievement('createdTask');
+
+      const userToJSON = user.toJSON();
+      expect(user.notifications.length).to.equal(notificationsN + 1);
+      expect(userToJSON.notifications[0]).to.have.all.keys(['data', 'id', 'type', 'seen']);
+      expect(userToJSON.notifications[0].type).to.equal('ACHIEVEMENT');
+      expect(userToJSON.notifications[0].data).to.eql({
+        achievement: 'createdTask',
+      });
+      expect(userToJSON.notifications[0].seen).to.eql(false);
+
+      expect(userToJSON.achievements.createdTask).to.eql(true);
+    });
+
+    it('throws an error if the achievement is not valid', () => {
+      const user = new User();
+      expect(() => user.addAchievement('notAnAchievement')).to.throw;
+    });
+
+    context('static push method', () => {
+      it('throws an error if the achievement is not valid', async () => {
+        const user = new User();
+        await user.save();
+
+        await expect(User.addAchievementUpdate({ _id: user._id }, 'notAnAchievement'))
+          .to.eventually.be.rejected;
+
+        expect(() => user.addAchievement('notAnAchievement')).to.throw;
+      });
+
+      it('adds an achievement for a single member via static method', async () => {
+        let user = new User();
+        await user.save();
+
+        const originalUserToJSON = user.toJSON({ minimize: false });
+        expect(originalUserToJSON.achievements.createdTask).to.not.eql(true);
+        const notificationsN = originalUserToJSON.notifications.length;
+
+        await User.addAchievementUpdate({ _id: user._id }, 'createdTask');
+
+        user = await User.findOne({ _id: user._id }).exec();
+
+        const userToJSON = user.toJSON();
+        expect(user.notifications.length).to.equal(notificationsN + 1);
+        expect(userToJSON.notifications[0]).to.have.all.keys(['data', 'id', 'type', 'seen']);
+        expect(userToJSON.notifications[0].type).to.equal('ACHIEVEMENT');
+        expect(userToJSON.notifications[0].data).to.eql({
+          achievement: 'createdTask',
+        });
+        expect(userToJSON.notifications[0].seen).to.eql(false);
+
+        expect(userToJSON.achievements.createdTask).to.eql(true);
+      });
+
+      it('adds an achievement for all given users via static method', async () => {
+        let user = new User();
+        const otherUser = new User();
+        await Promise.all([user.save(), otherUser.save()]);
+
+        await User.addAchievementUpdate({ _id: { $in: [user._id, otherUser._id] } }, 'createdTask');
+
+        user = await User.findOne({ _id: user._id }).exec();
+
+        let userToJSON = user.toJSON();
+        expect(user.notifications.length).to.equal(1);
+        expect(userToJSON.notifications[0]).to.have.all.keys(['data', 'id', 'type', 'seen']);
+        expect(userToJSON.notifications[0].type).to.equal('ACHIEVEMENT');
+        expect(userToJSON.notifications[0].data).to.eql({
+          achievement: 'createdTask',
+        });
+        expect(userToJSON.notifications[0].seen).to.eql(false);
+
+        expect(userToJSON.achievements.createdTask).to.eql(true);
+
+        user = await User.findOne({ _id: otherUser._id }).exec();
+
+        userToJSON = user.toJSON();
+        expect(user.notifications.length).to.equal(1);
+        expect(userToJSON.notifications[0]).to.have.all.keys(['data', 'id', 'type', 'seen']);
+        expect(userToJSON.notifications[0].type).to.equal('ACHIEVEMENT');
+        expect(userToJSON.notifications[0].data).to.eql({
+          achievement: 'createdTask',
+        });
+        expect(userToJSON.notifications[0].seen).to.eql(false);
+
+        expect(userToJSON.achievements.createdTask).to.eql(true);
+      });
+    });
+  });
+
+  context('post init', () => {
+    it('removes invalid tags when loading the user', async () => {
+      let user = new User();
+      await user.save();
+      await user.update({
+        $set: {
+          tags: [
+            null, // invalid, not an object
+            // { name: '123' }, // invalid, no id - generated automatically
+            { id: '123' }, // invalid, no name
+            { name: 'ABC', id: '1234' }, // valid
+          ],
+        },
+      }).exec();
+
+      user = await User.findById(user._id).exec();
+
+      const userToJSON = user.toJSON();
+      expect(userToJSON.tags.length).to.equal(1);
+
+      expect(userToJSON.tags[0]).to.have.all.keys(['id', 'name']);
+      expect(userToJSON.tags[0].id).to.equal('1234');
+      expect(userToJSON.tags[0].name).to.equal('ABC');
+    });
+
+    it('removes invalid push devices when loading the user', async () => {
+      let user = new User();
+      await user.save();
+      await user.update({
+        $set: {
+          pushDevices: [
+            null, // invalid, not an object
+            { regId: '123' }, // invalid, no type
+            { type: 'android' }, // invalid, no regId
+            { type: 'android', regId: '1234' }, // valid
+          ],
+        },
+      }).exec();
+
+      user = await User.findById(user._id).exec();
+
+      const userToJSON = user.toJSON();
+      expect(userToJSON.pushDevices.length).to.equal(1);
+
+      expect(userToJSON.pushDevices[0]).to.have.all.keys(['regId', 'type', 'createdAt', 'updatedAt']);
+      expect(userToJSON.pushDevices[0].type).to.equal('android');
+      expect(userToJSON.pushDevices[0].regId).to.equal('1234');
+    });
+
+    it('removes duplicate push devices when loading the user', async () => {
+      let user = new User();
+      await user.save();
+      await user.update({
+        $set: {
+          pushDevices: [
+            { type: 'android', regId: '1234' },
+            { type: 'android', regId: '1234' },
+          ],
+        },
+      }).exec();
+
+      user = await User.findById(user._id).exec();
+
+      const userToJSON = user.toJSON();
+      expect(userToJSON.pushDevices.length).to.equal(1);
+
+      expect(userToJSON.pushDevices[0]).to.have.all.keys(['regId', 'type', 'createdAt', 'updatedAt']);
+      expect(userToJSON.pushDevices[0].type).to.equal('android');
+      expect(userToJSON.pushDevices[0].regId).to.equal('1234');
+    });
+
+    it('removes invalid notifications when loading the user', async () => {
+      let user = new User();
+      await user.save();
+      await user.update({
+        $set: {
+          notifications: [
+            null, // invalid, not an object
+            { seen: true }, // invalid, no type or id
+            { id: 123 }, // invalid, no type
+            // invalid, no id, not included here because the id would be added automatically
+            // {type: 'ABC'},
+            { type: 'ABC', id: '123' }, // valid
+          ],
+        },
+      }).exec();
+
+      user = await User.findById(user._id).exec();
+
+      const userToJSON = user.toJSON();
+      expect(userToJSON.notifications.length).to.equal(1);
+
+      expect(userToJSON.notifications[0]).to.have.all.keys(['data', 'id', 'type', 'seen']);
+      expect(userToJSON.notifications[0].type).to.equal('ABC');
+      expect(userToJSON.notifications[0].id).to.equal('123');
+    });
+
+    it('removes multiple NEW_CHAT_MESSAGE for the same group', async () => {
+      let user = new User();
+      await user.save();
+      await user.update({
+        $set: {
+          notifications: [
+            {
+              type: 'NEW_CHAT_MESSAGE',
+              id: 123,
+              data: { group: { id: 12345 } },
+            },
+            {
+              type: 'NEW_CHAT_MESSAGE',
+              id: 1234,
+              data: { group: { id: 12345 } },
+            },
+            {
+              type: 'NEW_CHAT_MESSAGE',
+              id: 123,
+              data: { group: { id: 123456 } },
+            }, // not duplicate, different group
+            {
+              type: 'NEW_CHAT_MESSAGE_DIFF',
+              id: 123,
+              data: { group: { id: 12345 } },
+            }, // not duplicate, different type
+          ],
+        },
+      }).exec();
+
+      user = await User.findById(user._id).exec();
+
+      const userToJSON = user.toJSON();
+      expect(userToJSON.notifications.length).to.equal(3);
+
+      expect(userToJSON.notifications[0]).to.have.all.keys(['data', 'id', 'type', 'seen']);
+      expect(userToJSON.notifications[0].type).to.equal('NEW_CHAT_MESSAGE');
+      expect(userToJSON.notifications[0].id).to.equal('123');
+      expect(userToJSON.notifications[0].data).to.deep.equal({ group: { id: 12345 } });
+      expect(userToJSON.notifications[0].seen).to.equal(false);
+    });
+  });
+
   context('notifications', () => {
     it('can add notifications without data', () => {
       const user = new User();
@@ -98,26 +335,6 @@ describe('User Model', () => {
       expect(userToJSON.notifications[0].seen).to.eql(false);
     });
 
-    it('removes invalid notifications when calling toJSON', () => {
-      const user = new User();
-
-      user.notifications = [
-        null, // invalid, not an object
-        { seen: true }, // invalid, no type or id
-        { id: 123 }, // invalid, no type
-        // invalid, no id, not included here because the id would be added automatically
-        // {type: 'ABC'},
-        { type: 'ABC', id: '123' }, // valid
-      ];
-
-      const userToJSON = user.toJSON();
-      expect(userToJSON.notifications.length).to.equal(1);
-
-      expect(userToJSON.notifications[0]).to.have.all.keys(['data', 'id', 'type', 'seen']);
-      expect(userToJSON.notifications[0].type).to.equal('ABC');
-      expect(userToJSON.notifications[0].id).to.equal('123');
-    });
-
     it('can add notifications with data and already marked as seen', () => {
       const user = new User();
 
@@ -215,7 +432,6 @@ describe('User Model', () => {
       user = new User();
     });
 
-
     it('returns false if user does not have customer id', () => {
       expect(user.isSubscribed()).to.be.undefined;
     });
@@ -341,7 +557,6 @@ describe('User Model', () => {
     });
   });
 
-
   context('hasCancelled', () => {
     let user;
     beforeEach(() => {
@@ -546,7 +761,7 @@ describe('User Model', () => {
     });
   });
 
-  context('days missed', () => {
+  describe('daysUserHasMissed', () => {
     // http://forbrains.co.uk/international_tools/earth_timezones
     let user;
 
@@ -554,24 +769,51 @@ describe('User Model', () => {
       user = new User();
     });
 
-    it('should not cron early when going back a timezone', () => {
-      const yesterday = moment('2017-12-05T00:00:00.000-06:00'); // 11 pm on 4 Texas
-      const timezoneOffset = moment().zone('-06:00').zone();
-      user.lastCron = yesterday;
-      user.preferences.timezoneOffset = timezoneOffset;
+    it('correctly calculates days missed since lastCron', () => {
+      const now = moment();
+      user.lastCron = moment(now).subtract(5, 'days');
 
-      const today = moment('2017-12-06T00:00:00.000-06:00'); // 11 pm on 4 Texas
-      const req = {};
-      req.header = () => timezoneOffset + 60;
+      const { daysMissed } = user.daysUserHasMissed(now);
 
-      const { daysMissed } = user.daysUserHasMissed(today, req);
+      expect(daysMissed).to.eql(5);
+    });
 
+    it('uses timezone from preferences to calculate days missed', () => {
+      const now = moment('2017-07-08 01:00:00Z');
+      user.lastCron = moment('2017-07-04 13:00:00Z');
+      user.preferences.timezoneOffset = 120;
+
+      const { daysMissed } = user.daysUserHasMissed(now);
+
+      expect(daysMissed).to.eql(3);
+    });
+
+    it('uses timezone at last cron to calculate days missed', () => {
+      const now = moment('2017-09-08 13:00:00Z');
+      user.lastCron = moment('2017-09-06 01:00:00+02:00');
+      user.preferences.timezoneOffset = 0;
+      user.preferences.timezoneOffsetAtLastCron = -120;
+
+      const { daysMissed } = user.daysUserHasMissed(now);
+
+      expect(daysMissed).to.eql(2);
+    });
+
+    it('respects new timezone that drags time into same day', () => {
+      user.lastCron = moment('2017-12-05T00:00:00.000-06:00');
+      user.preferences.timezoneOffset = 360;
+      const today = moment('2017-12-06T00:00:00.000-06:00');
+      const requestWithMinus7Timezone = { header: () => 420 };
+
+      const { daysMissed } = user.daysUserHasMissed(today, requestWithMinus7Timezone);
+
+      expect(user.preferences.timezoneOffset).to.eql(420);
       expect(daysMissed).to.eql(0);
     });
 
     it('should not cron early when going back a timezone with a custom day start', () => {
       const yesterday = moment('2017-12-05T02:00:00.000-08:00');
-      const timezoneOffset = moment().zone('-08:00').zone();
+      const timezoneOffset = 480;
       user.lastCron = yesterday;
       user.preferences.timezoneOffset = timezoneOffset;
       user.preferences.dayStart = 2;

test/api/unit/models/userNotification.test.js

@@ -1,7 +1,7 @@
 import { model as UserNotification } from '../../../../website/server/models/userNotification';
 
 describe('UserNotification Model', () => {
-  context('convertNotificationsToSafeJson', () => {
+  context('cleanupCorruptData', () => {
     it('converts an array of notifications to a safe version', () => {
       const notifications = [
         null, // invalid, not an object
@@ -11,11 +11,44 @@ describe('UserNotification Model', () => {
         new UserNotification({ type: 'ABC', id: 123 }), // valid
       ];
 
-      const notificationsToJSON = UserNotification.convertNotificationsToSafeJson(notifications);
-      expect(notificationsToJSON.length).to.equal(1);
-      expect(notificationsToJSON[0]).to.have.all.keys(['data', 'id', 'type', 'seen']);
-      expect(notificationsToJSON[0].type).to.equal('ABC');
-      expect(notificationsToJSON[0].id).to.equal('123');
+      const safeNotifications = UserNotification.cleanupCorruptData(notifications);
+      expect(safeNotifications.length).to.equal(1);
+      expect(safeNotifications[0].data).to.deep.equal({});
+      expect(safeNotifications[0].seen).to.equal(false);
+      expect(safeNotifications[0].type).to.equal('ABC');
+      expect(safeNotifications[0].id).to.equal('123');
+    });
+
+    it('removes multiple NEW_CHAT_MESSAGE for the same group', () => {
+      const notifications = [
+        new UserNotification({
+          type: 'NEW_CHAT_MESSAGE',
+          id: 123,
+          data: { group: { id: 12345 } },
+        }),
+        new UserNotification({
+          type: 'NEW_CHAT_MESSAGE',
+          id: 1234,
+          data: { group: { id: 12345 } },
+        }),
+        new UserNotification({
+          type: 'NEW_CHAT_MESSAGE',
+          id: 123,
+          data: { group: { id: 123456 } },
+        }), // not duplicate, different group
+        new UserNotification({
+          type: 'NEW_CHAT_MESSAGE_DIFF',
+          id: 123,
+          data: { group: { id: 12345 } },
+        }), // not duplicate, different type
+      ];
+
+      const safeNotifications = UserNotification.cleanupCorruptData(notifications);
+      expect(safeNotifications.length).to.equal(3);
+      expect(safeNotifications[0].data).to.deep.equal({ group: { id: 12345 } });
+      expect(safeNotifications[0].seen).to.equal(false);
+      expect(safeNotifications[0].type).to.equal('NEW_CHAT_MESSAGE');
+      expect(safeNotifications[0].id).to.equal('123');
     });
   });
 });

test/api/unit/models/webhook.test.js

@@ -183,6 +183,7 @@ describe('Webhook Model', () => {
             options: {
               questStarted: true,
               questFinished: true,
+              questInvited: true,
             },
           };
         });
@@ -197,6 +198,7 @@ describe('Webhook Model', () => {
           expect(wh.options).to.eql({
             questStarted: false,
             questFinished: false,
+            questInvited: false,
           });
         });
 
@@ -210,6 +212,7 @@ describe('Webhook Model', () => {
           expect(wh.options).to.eql({
             questStarted: false,
             questFinished: true,
+            questInvited: true,
           });
         });
 
@@ -224,6 +227,7 @@ describe('Webhook Model', () => {
           expect(wh.options).to.eql({
             questStarted: true,
             questFinished: true,
+            questInvited: true,
           });
         });
 
@@ -295,7 +299,6 @@ describe('Webhook Model', () => {
         });
       });
 
-
       context('type is globalActivity', () => {
         let config;
 

test/api/v3/integration/challenges/GET-challenges_challengeId_members.test.js

@@ -117,7 +117,7 @@ describe('GET /challenges/:challengeId/members', () => {
     expect(res[0].profile).to.have.all.keys(['name']);
   });
 
-  it('returns only first 30 members if req.query.includeAllMembers is not true', async () => {
+  it('returns only first 30 members if req.query.includeAllMembers is not true and req.query.limit is undefined', async () => {
     const group = await generateGroup(user, { type: 'party', name: generateUUID() });
     const challenge = await generateChallenge(user, group);
     await user.post(`/challenges/${challenge._id}/join`);
@@ -136,7 +136,7 @@ describe('GET /challenges/:challengeId/members', () => {
     });
   });
 
-  it('returns only first 30 members if req.query.includeAllMembers is not defined', async () => {
+  it('returns only first 30 members if req.query.includeAllMembers is not defined and req.query.limit is undefined', async () => {
     const group = await generateGroup(user, { type: 'party', name: generateUUID() });
     const challenge = await generateChallenge(user, group);
     await user.post(`/challenges/${challenge._id}/join`);
@@ -155,6 +155,68 @@ describe('GET /challenges/:challengeId/members', () => {
     });
   });
 
+  it('returns an error if req.query.limit is over 60', async () => {
+    const group = await generateGroup(user, { type: 'party', privacy: 'private' });
+    const challenge = await generateChallenge(user, group);
+    const anotherUser = await generateUser();
+
+    await expect(anotherUser.get(`/challenges/${challenge._id}/members?limit=61`)).to.eventually.be.rejected.and.eql({
+      code: 400,
+      error: 'BadRequest',
+      message: t('invalidReqParams'),
+    });
+  });
+
+  it('returns an error if req.query.limit is under 1', async () => {
+    const group = await generateGroup(user, { type: 'party', privacy: 'private' });
+    const challenge = await generateChallenge(user, group);
+    const anotherUser = await generateUser();
+
+    await expect(anotherUser.get(`/challenges/${challenge._id}/members?limit=-13`)).to.eventually.be.rejected.and.eql({
+      code: 400,
+      error: 'BadRequest',
+      message: t('invalidReqParams'),
+    });
+  });
+
+  it('returns an error if req.query.limit is not an integer', async () => {
+    const group = await generateGroup(user, { type: 'party', privacy: 'private' });
+    const challenge = await generateChallenge(user, group);
+    const anotherUser = await generateUser();
+
+    await expect(anotherUser.get(`/challenges/${challenge._id}/members?limit=true`)).to.eventually.be.rejected.and.eql({
+      code: 400,
+      error: 'BadRequest',
+      message: t('invalidReqParams'),
+    });
+  });
+
+  it('returns up to 60 members when req.query.limit is specified', async () => {
+    const group = await generateGroup(user, { type: 'party', name: generateUUID() });
+    const challenge = await generateChallenge(user, group);
+    await user.post(`/challenges/${challenge._id}/join`);
+
+    const usersToGenerate = [];
+    for (let i = 0; i < 62; i += 1) {
+      usersToGenerate.push(generateUser({ challenges: [challenge._id] }));
+    }
+    await Promise.all(usersToGenerate);
+
+    let res = await user.get(`/challenges/${challenge._id}/members?limit=57`);
+    expect(res.length).to.equal(57);
+    res.forEach(member => {
+      expect(member).to.have.all.keys(['_id', 'auth', 'flags', 'id', 'profile']);
+      expect(member.profile).to.have.all.keys(['name']);
+    });
+
+    res = await user.get(`/challenges/${challenge._id}/members?limit=60&lastId=${res[res.length - 1]._id}`);
+    expect(res.length).to.equal(6);
+    res.forEach(member => {
+      expect(member).to.have.all.keys(['_id', 'auth', 'flags', 'id', 'profile']);
+      expect(member.profile).to.have.all.keys(['name']);
+    });
+  }).timeout(30000);
+
   it('returns all members if req.query.includeAllMembers is true', async () => {
     const group = await generateGroup(user, { type: 'party', name: generateUUID() });
     const challenge = await generateChallenge(user, group);
@@ -206,16 +268,16 @@ describe('GET /challenges/:challengeId/members', () => {
     for (let i = 0; i < 3; i += 1) {
       usersToGenerate.push(generateUser({
         challenges: [challenge._id],
-        'profile.name': `${i}profilename`,
+        'auth.local.username': `${i}username`,
       }));
     }
     const generatedUsers = await Promise.all(usersToGenerate);
-    const profileNames = generatedUsers.map(generatedUser => generatedUser.profile.name);
+    const usernames = generatedUsers.map(generatedUser => generatedUser.auth.local.username);
 
-    const firstProfileName = profileNames[0];
-    const nameToSearch = firstProfileName.substring(0, 4);
+    const firstUsername = usernames[0];
+    const nameToSearch = firstUsername.substring(0, 4);
 
     const response = await user.get(`/challenges/${challenge._id}/members?search=${nameToSearch}`);
-    expect(response[0].profile.name).to.eql(firstProfileName);
+    expect(response[0].auth.local.username).to.eql(firstUsername);
   });
 });

test/api/v3/integration/challenges/GET-challenges_group_groupid.test.js

@@ -187,8 +187,7 @@ describe('GET challenges/groups/:groupId', () => {
   });
 
   context('official challenge is present', () => {
-    let publicGuild; let user; let officialChallenge; let challenge; let
-      challenge2;
+    let publicGuild; let user; let officialChallenge; let unofficialChallenges;
 
     before(async () => {
       const { group, groupLeader } = await createAndPopulateGroup({
@@ -214,10 +213,14 @@ describe('GET challenges/groups/:groupId', () => {
       });
       await user.post(`/challenges/${officialChallenge._id}/join`);
 
-      challenge = await generateChallenge(user, group);
-      await user.post(`/challenges/${challenge._id}/join`);
-      challenge2 = await generateChallenge(user, group);
-      await user.post(`/challenges/${challenge2._id}/join`);
+      // We add 10 extra challenges to test whether the official challenge
+      // (the oldest) makes it to the front page.
+      unofficialChallenges = [];
+      for (let i = 0; i < 10; i += 1) {
+        const challenge = await generateChallenge(user, group); // eslint-disable-line
+        await user.post(`/challenges/${challenge._id}/join`); // eslint-disable-line
+        unofficialChallenges.push(challenge);
+      }
     });
 
     it('should return official challenges first', async () => {
@@ -230,18 +233,17 @@ describe('GET challenges/groups/:groupId', () => {
     it('should return newest challenges first, after official ones', async () => {
       let challenges = await user.get(`/challenges/groups/${publicGuild._id}`);
 
-      let foundChallengeIndex = _.findIndex(challenges, { _id: challenge._id });
-      expect(foundChallengeIndex).to.eql(2);
-
-      foundChallengeIndex = _.findIndex(challenges, { _id: challenge2._id });
-      expect(foundChallengeIndex).to.eql(1);
+      unofficialChallenges.forEach((chal, index) => {
+        const foundChallengeIndex = _.findIndex(challenges, { _id: chal._id });
+        expect(foundChallengeIndex).to.eql(10 - index);
+      });
 
       const newChallenge = await generateChallenge(user, publicGuild);
       await user.post(`/challenges/${newChallenge._id}/join`);
 
       challenges = await user.get(`/challenges/groups/${publicGuild._id}`);
 
-      foundChallengeIndex = _.findIndex(challenges, { _id: newChallenge._id });
+      const foundChallengeIndex = _.findIndex(challenges, { _id: newChallenge._id });
       expect(foundChallengeIndex).to.eql(1);
     });
   });

test/api/v3/integration/challenges/GET-challenges_user.test.js

@@ -6,8 +6,8 @@ import {
 
 describe('GET challenges/user', () => {
   context('no official challenges', () => {
-    let user; let member; let nonMember; let challenge; let challenge2; let
-      publicGuild;
+    let user; let member; let nonMember; let challenge; let challenge2;
+    let publicGuild; let userData; let groupData;
 
     before(async () => {
       const { group, groupLeader, members } = await createAndPopulateGroup({
@@ -19,230 +19,202 @@ describe('GET challenges/user', () => {
         members: 1,
       });
 
-      user = groupLeader;
       publicGuild = group;
+      groupData = {
+        _id: publicGuild._id,
+        categories: [],
+        id: publicGuild._id,
+        type: publicGuild.type,
+        privacy: publicGuild.privacy,
+        name: publicGuild.name,
+        summary: publicGuild.name,
+        leader: publicGuild.leader._id,
+      };
+
+      user = groupLeader;
+      userData = {
+        _id: publicGuild.leader._id,
+        id: publicGuild.leader._id,
+        profile: { name: user.profile.name },
+        auth: {
+          local: {
+            username: user.auth.local.username,
+          },
+        },
+        flags: {
+          verifiedUsername: true,
+        },
+      };
+
       member = members[0]; // eslint-disable-line prefer-destructuring
       nonMember = await generateUser();
 
       challenge = await generateChallenge(user, group);
-      await user.post(`/challenges/${challenge._id}/join`);
       challenge2 = await generateChallenge(user, group);
-      await user.post(`/challenges/${challenge2._id}/join`);
-    });
 
-    it('should return challenges user has joined', async () => {
       await nonMember.post(`/challenges/${challenge._id}/join`);
+    });
+    context('all challenges', () => {
+      it('should return challenges user has joined', async () => {
+        const challenges = await nonMember.get('/challenges/user');
 
-      const challenges = await nonMember.get('/challenges/user');
+        const foundChallenge = _.find(challenges, { _id: challenge._id });
+        expect(foundChallenge).to.exist;
+        expect(foundChallenge.leader).to.eql(userData);
+        expect(foundChallenge.group).to.eql(groupData);
+      });
 
-      const foundChallenge = _.find(challenges, { _id: challenge._id });
-      expect(foundChallenge).to.exist;
-      expect(foundChallenge.leader).to.eql({
-        _id: publicGuild.leader._id,
-        id: publicGuild.leader._id,
-        profile: { name: user.profile.name },
-        auth: {
-          local: {
-            username: user.auth.local.username,
+      it('should not return challenges a non-member has not joined', async () => {
+        const challenges = await nonMember.get('/challenges/user');
+
+        const foundChallenge2 = _.find(challenges, { _id: challenge2._id });
+        expect(foundChallenge2).to.not.exist;
+      });
+
+      it('should return challenges user has created', async () => {
+        const challenges = await user.get('/challenges/user');
+
+        const foundChallenge1 = _.find(challenges, { _id: challenge._id });
+        expect(foundChallenge1).to.exist;
+        expect(foundChallenge1.leader).to.eql(userData);
+        expect(foundChallenge1.group).to.eql(groupData);
+        const foundChallenge2 = _.find(challenges, { _id: challenge2._id });
+        expect(foundChallenge2).to.exist;
+        expect(foundChallenge2.leader).to.eql(userData);
+        expect(foundChallenge2.group).to.eql(groupData);
+      });
+
+      it('should return challenges in user\'s group', async () => {
+        const challenges = await member.get('/challenges/user');
+
+        const foundChallenge1 = _.find(challenges, { _id: challenge._id });
+        expect(foundChallenge1).to.exist;
+        expect(foundChallenge1.leader).to.eql(userData);
+        expect(foundChallenge1.group).to.eql(groupData);
+        const foundChallenge2 = _.find(challenges, { _id: challenge2._id });
+        expect(foundChallenge2).to.exist;
+        expect(foundChallenge2.leader).to.eql(userData);
+        expect(foundChallenge2.group).to.eql(groupData);
+      });
+
+      it('should return newest challenges first', async () => {
+        let challenges = await user.get('/challenges/user');
+
+        let foundChallengeIndex = _.findIndex(challenges, { _id: challenge2._id });
+        expect(foundChallengeIndex).to.eql(0);
+
+        const newChallenge = await generateChallenge(user, publicGuild);
+        await user.post(`/challenges/${newChallenge._id}/join`);
+
+        challenges = await user.get('/challenges/user');
+
+        foundChallengeIndex = _.findIndex(challenges, { _id: newChallenge._id });
+        expect(foundChallengeIndex).to.eql(0);
+      });
+
+      it('should not return challenges user doesn\'t have access to', async () => {
+        const { group, groupLeader } = await createAndPopulateGroup({
+          groupDetails: {
+            name: 'TestPrivateGuild',
+            summary: 'summary for TestPrivateGuild',
+            type: 'guild',
+            privacy: 'private',
           },
-        },
-        flags: {
-          verifiedUsername: true,
-        },
-      });
-      expect(foundChallenge.group).to.eql({
-        _id: publicGuild._id,
-        categories: [],
-        id: publicGuild._id,
-        type: publicGuild.type,
-        privacy: publicGuild.privacy,
-        name: publicGuild.name,
-        summary: publicGuild.name,
-        leader: publicGuild.leader._id,
-      });
-    });
+        });
 
-    it('should return challenges user has created', async () => {
-      const challenges = await user.get('/challenges/user');
+        const privateChallenge = await generateChallenge(groupLeader, group);
+        await groupLeader.post(`/challenges/${privateChallenge._id}/join`);
 
-      const foundChallenge1 = _.find(challenges, { _id: challenge._id });
-      expect(foundChallenge1).to.exist;
-      expect(foundChallenge1.leader).to.eql({
-        _id: publicGuild.leader._id,
-        id: publicGuild.leader._id,
-        profile: { name: user.profile.name },
-        auth: {
-          local: {
-            username: user.auth.local.username,
+        const challenges = await nonMember.get('/challenges/user');
+
+        const foundChallenge = _.find(challenges, { _id: privateChallenge._id });
+        expect(foundChallenge).to.not.exist;
+      });
+
+      it('should not return challenges user doesn\'t have access to, even with query parameters', async () => {
+        const { group, groupLeader } = await createAndPopulateGroup({
+          groupDetails: {
+            name: 'TestPrivateGuild',
+            summary: 'summary for TestPrivateGuild',
+            type: 'guild',
+            privacy: 'private',
           },
-        },
-        flags: {
-          verifiedUsername: true,
-        },
-      });
-      expect(foundChallenge1.group).to.eql({
-        _id: publicGuild._id,
-        categories: [],
-        id: publicGuild._id,
-        type: publicGuild.type,
-        privacy: publicGuild.privacy,
-        name: publicGuild.name,
-        summary: publicGuild.name,
-        leader: publicGuild.leader._id,
-      });
-      const foundChallenge2 = _.find(challenges, { _id: challenge2._id });
-      expect(foundChallenge2).to.exist;
-      expect(foundChallenge2.leader).to.eql({
-        _id: publicGuild.leader._id,
-        id: publicGuild.leader._id,
-        profile: { name: user.profile.name },
-        auth: {
-          local: {
-            username: user.auth.local.username,
-          },
-        },
-        flags: {
-          verifiedUsername: true,
-        },
-      });
-      expect(foundChallenge2.group).to.eql({
-        _id: publicGuild._id,
-        categories: [],
-        id: publicGuild._id,
-        type: publicGuild.type,
-        privacy: publicGuild.privacy,
-        name: publicGuild.name,
-        summary: publicGuild.name,
-        leader: publicGuild.leader._id,
+        });
+
+        const privateChallenge = await generateChallenge(groupLeader, group, {
+          categories: [{
+            name: 'academics',
+            slug: 'academics',
+          }],
+        });
+        await groupLeader.post(`/challenges/${privateChallenge._id}/join`);
+
+        const challenges = await nonMember.get('/challenges/user?categories=academics&owned=not_owned');
+
+        const foundChallenge = _.find(challenges, { _id: privateChallenge._id });
+        expect(foundChallenge).to.not.exist;
       });
     });
 
-    it('should return challenges in user\'s group', async () => {
-      const challenges = await member.get('/challenges/user');
+    context('my challenges', () => {
+      it('should return challenges user has joined', async () => {
+        const challenges = await nonMember.get(`/challenges/user?member=${true}`);
 
-      const foundChallenge1 = _.find(challenges, { _id: challenge._id });
-      expect(foundChallenge1).to.exist;
-      expect(foundChallenge1.leader).to.eql({
-        _id: publicGuild.leader._id,
-        id: publicGuild.leader._id,
-        profile: { name: user.profile.name },
-        auth: {
-          local: {
-            username: user.auth.local.username,
-          },
-        },
-        flags: {
-          verifiedUsername: true,
-        },
-      });
-      expect(foundChallenge1.group).to.eql({
-        _id: publicGuild._id,
-        categories: [],
-        id: publicGuild._id,
-        type: publicGuild.type,
-        privacy: publicGuild.privacy,
-        name: publicGuild.name,
-        summary: publicGuild.name,
-        leader: publicGuild.leader._id,
-      });
-      const foundChallenge2 = _.find(challenges, { _id: challenge2._id });
-      expect(foundChallenge2).to.exist;
-      expect(foundChallenge2.leader).to.eql({
-        _id: publicGuild.leader._id,
-        id: publicGuild.leader._id,
-        profile: { name: user.profile.name },
-        auth: {
-          local: {
-            username: user.auth.local.username,
-          },
-        },
-        flags: {
-          verifiedUsername: true,
-        },
-      });
-      expect(foundChallenge2.group).to.eql({
-        _id: publicGuild._id,
-        categories: [],
-        id: publicGuild._id,
-        type: publicGuild.type,
-        privacy: publicGuild.privacy,
-        name: publicGuild.name,
-        summary: publicGuild.name,
-        leader: publicGuild.leader._id,
-      });
-    });
-
-    it('should not return challenges in user groups if we send member true param', async () => {
-      const challenges = await member.get(`/challenges/user?member=${true}`);
-
-      const foundChallenge1 = _.find(challenges, { _id: challenge._id });
-      expect(foundChallenge1).to.not.exist;
-
-      const foundChallenge2 = _.find(challenges, { _id: challenge2._id });
-      expect(foundChallenge2).to.not.exist;
-    });
-
-    it('should return newest challenges first', async () => {
-      let challenges = await user.get('/challenges/user');
-
-      let foundChallengeIndex = _.findIndex(challenges, { _id: challenge2._id });
-      expect(foundChallengeIndex).to.eql(0);
-
-      const newChallenge = await generateChallenge(user, publicGuild);
-      await user.post(`/challenges/${newChallenge._id}/join`);
-
-      challenges = await user.get('/challenges/user');
-
-      foundChallengeIndex = _.findIndex(challenges, { _id: newChallenge._id });
-      expect(foundChallengeIndex).to.eql(0);
-    });
-
-    it('should not return challenges user doesn\'t have access to', async () => {
-      const { group, groupLeader } = await createAndPopulateGroup({
-        groupDetails: {
-          name: 'TestPrivateGuild',
-          summary: 'summary for TestPrivateGuild',
-          type: 'guild',
-          privacy: 'private',
-        },
+        const foundChallenge = _.find(challenges, { _id: challenge._id });
+        expect(foundChallenge).to.exist;
+        expect(foundChallenge.leader).to.eql(userData);
+        expect(foundChallenge.group).to.eql(groupData);
       });
 
-      const privateChallenge = await generateChallenge(groupLeader, group);
-      await groupLeader.post(`/challenges/${privateChallenge._id}/join`);
+      it('should return challenges user has created', async () => {
+        const challenges = await user.get(`/challenges/user?member=${true}`);
 
-      const challenges = await nonMember.get('/challenges/user');
-
-      const foundChallenge = _.find(challenges, { _id: privateChallenge._id });
-      expect(foundChallenge).to.not.exist;
-    });
-
-    it('should not return challenges user doesn\'t have access to, even with query parameters', async () => {
-      const { group, groupLeader } = await createAndPopulateGroup({
-        groupDetails: {
-          name: 'TestPrivateGuild',
-          summary: 'summary for TestPrivateGuild',
-          type: 'guild',
-          privacy: 'private',
-        },
+        const foundChallenge1 = _.find(challenges, { _id: challenge._id });
+        expect(foundChallenge1).to.exist;
+        expect(foundChallenge1.leader).to.eql(userData);
+        expect(foundChallenge1.group).to.eql(groupData);
+        const foundChallenge2 = _.find(challenges, { _id: challenge2._id });
+        expect(foundChallenge2).to.exist;
+        expect(foundChallenge2.leader).to.eql(userData);
+        expect(foundChallenge2.group).to.eql(groupData);
       });
 
-      const privateChallenge = await generateChallenge(groupLeader, group, {
-        categories: [{
-          name: 'academics',
-          slug: 'academics',
-        }],
+      it('should return challenges user has created if filter by owned', async () => {
+        const challenges = await user.get(`/challenges/user?member=${true}&owned=owned`);
+
+        const foundChallenge1 = _.find(challenges, { _id: challenge._id });
+        expect(foundChallenge1).to.exist;
+        expect(foundChallenge1.leader).to.eql(userData);
+        expect(foundChallenge1.group).to.eql(groupData);
+        const foundChallenge2 = _.find(challenges, { _id: challenge2._id });
+        expect(foundChallenge2).to.exist;
+        expect(foundChallenge2.leader).to.eql(userData);
+        expect(foundChallenge2.group).to.eql(groupData);
       });
-      await groupLeader.post(`/challenges/${privateChallenge._id}/join`);
 
-      const challenges = await nonMember.get('/challenges/user?categories=academics&owned=not_owned');
+      it('should not return challenges user has created if filter by not owned', async () => {
+        const challenges = await user.get(`/challenges/user?owned=not_owned&member=${true}`);
 
-      const foundChallenge = _.find(challenges, { _id: privateChallenge._id });
-      expect(foundChallenge).to.not.exist;
+        const foundChallenge1 = _.find(challenges, { _id: challenge._id });
+        expect(foundChallenge1).to.not.exist;
+        const foundChallenge2 = _.find(challenges, { _id: challenge2._id });
+        expect(foundChallenge2).to.not.exist;
+      });
+
+      it('should not return challenges in user groups', async () => {
+        const challenges = await member.get(`/challenges/user?member=${true}`);
+
+        const foundChallenge1 = _.find(challenges, { _id: challenge._id });
+        expect(foundChallenge1).to.not.exist;
+
+        const foundChallenge2 = _.find(challenges, { _id: challenge2._id });
+        expect(foundChallenge2).to.not.exist;
+      });
     });
   });
 
   context('official challenge is present', () => {
-    let user; let officialChallenge; let challenge; let challenge2; let
+    let user; let officialChallenge; let unofficialChallenges; let
       publicGuild;
 
     before(async () => {
@@ -270,10 +242,14 @@ describe('GET challenges/user', () => {
       });
       await user.post(`/challenges/${officialChallenge._id}/join`);
 
-      challenge = await generateChallenge(user, group);
-      await user.post(`/challenges/${challenge._id}/join`);
-      challenge2 = await generateChallenge(user, group);
-      await user.post(`/challenges/${challenge2._id}/join`);
+      // We add 10 extra challenges to test whether the official challenge
+      // (the oldest) makes it to the front page.
+      unofficialChallenges = [];
+      for (let i = 0; i < 10; i += 1) {
+        const challenge = await generateChallenge(user, group); // eslint-disable-line
+        await user.post(`/challenges/${challenge._id}/join`); // eslint-disable-line
+        unofficialChallenges.push(challenge);
+      }
     });
 
     it('should return official challenges first', async () => {
@@ -284,20 +260,23 @@ describe('GET challenges/user', () => {
     });
 
     it('should return newest challenges first, after official ones', async () => {
-      let challenges = await user.get('/challenges/user');
+      let challenges = await user.get('/challenges/user?page=0');
 
-      let foundChallengeIndex = _.findIndex(challenges, { _id: challenge._id });
-      expect(foundChallengeIndex).to.eql(2);
-
-      foundChallengeIndex = _.findIndex(challenges, { _id: challenge2._id });
-      expect(foundChallengeIndex).to.eql(1);
+      unofficialChallenges.forEach((chal, index) => {
+        const foundChallengeIndex = _.findIndex(challenges, { _id: chal._id });
+        if (index === 0) {
+          expect(foundChallengeIndex).to.eql(-1);
+        } else {
+          expect(foundChallengeIndex).to.eql(10 - index);
+        }
+      });
 
       const newChallenge = await generateChallenge(user, publicGuild);
       await user.post(`/challenges/${newChallenge._id}/join`);
 
       challenges = await user.get('/challenges/user');
 
-      foundChallengeIndex = _.findIndex(challenges, { _id: newChallenge._id });
+      const foundChallengeIndex = _.findIndex(challenges, { _id: newChallenge._id });
       expect(foundChallengeIndex).to.eql(1);
     });
   });

test/api/v3/integration/challenges/POST-challenges.test.js

@@ -251,7 +251,7 @@ describe('POST /challenges', () => {
       expect(groupLeader.balance).to.eql(oldUserBalance);
     });
 
-    it('sets all properites of the challenge as passed', async () => {
+    it('sets all properties of the challenge as passed', async () => {
       const name = 'Test Challenge';
       const shortName = 'TC Label';
       const description = 'Test Description';