4.145.1

commit f461c07ca7997362512a366eebc7d3a8fba854ee
Author: Sabe Jones <sabrecat@gmail.com>
Date:   Thu Jun 11 16:37:14 2020 -0500

    fix(sprites): wolf alignment

commit 6ceb4ba6d1ea62892e9b335307043d78971328d0
Author: Sabe Jones <sabrecat@gmail.com>
Date:   Thu Jun 11 14:53:07 2020 -0500

    chore(sprites): compile

commit 8b517309f531c7f151c5c18a5ca9847ab7aa5dbb
Author: Sabe Jones <sabrecat@gmail.com>
Date:   Thu Jun 11 14:52:49 2020 -0500

    feat(content): Fluorite Magic Hatching Potion and quest

.eslintignore

@@ -10,6 +10,7 @@ dist/
 dist-client/
 apidoc_build/
 content_cache/
+i18n_cache/
 node_modules/
 
 # Old migrations, disabled

.github/CONTRIBUTING.md

@@ -8,13 +8,8 @@
 
 # Requesting a feature
 
-Habitica uses [Trello](https://trello.com/b/EpoYEYod/habitica) to track feature requests. [Read more](https://trello.com/c/odmhIqyW/440-read-first-table-of-contents).
+Habitica uses [this Google form](https://docs.google.com/forms/d/e/1FAIpQLScPhrwq_7P1C6PTrI3lbvTsvqGyTNnGzp1ugi1Ml0PFee_p5g/viewform?usp=sf_link) to track feature requests. Please post there rather than creating an issue.
 
 # Contributing Code
 
 See [Contributing to Habitica](http://habitica.fandom.com/wiki/Contributing_to_Habitica#Coders_.28Web_.26_Mobile.29)
-
-## Issue Triage [![Open Source Helpers](https://www.codetriage.com/habitrpg/habitica/badges/users.svg)](https://www.codetriage.com/habitrpg/habitica)
-
-You can triage issues which may include reproducing bug reports or asking for vital information, such as version numbers or reproduction instructions. If you would like to start triaging issues, one easy way to get started is to [subscribe to habitrpg on CodeTriage](https://www.codetriage.com/habitrpg/habitica).
-

.gitignore

@@ -4,6 +4,7 @@ website/transpiled-babel/
 website/common/transpiled-babel/
 node_modules
 content_cache
+i18n_cache
 apidoc_build
 *.swp
 .idea*
@@ -37,6 +38,7 @@ yarn.lock
 .elasticbeanstalk/*
 !.elasticbeanstalk/*.cfg.yml
 !.elasticbeanstalk/*.global.yml
+/.vscode
 
 # webstorm fake webpack for path intellisense
 webpack.webstorm.config

.nodemonignore

@@ -1,4 +1,6 @@
 node_modules/**
+content_cache
+content_cache/**
 website/client/**
 test/**
 .git/**
@@ -7,3 +9,4 @@ test/**
 *.swp
 *.swx
 website/raw_sprites/**
+content_cache/**

Dockerfile

@@ -1,6 +1,7 @@
 FROM node:12
 
 ENV ADMIN_EMAIL admin@habitica.com
+ENV EMAILS_COMMUNITY_MANAGER_EMAIL admin@habitica.com
 ENV AMAZON_PAYMENTS_CLIENT_ID amzn1.application-oa2-client.68ed9e6904ef438fbc1bf86bf494056e
 ENV AMAZON_PAYMENTS_SELLER_ID AMQ3SB4SG5E91
 ENV AMPLITUDE_KEY e8d4c24b3d6ef3ee73eeba715023dd43
@@ -11,6 +12,7 @@ ENV GOOGLE_CLIENT_ID 1035232791481-32vtplgnjnd1aufv3mcu1lthf31795fq.apps.googleu
 ENV LOGGLY_CLIENT_TOKEN ab5663bf-241f-4d14-8783-7d80db77089a
 ENV NODE_ENV production
 ENV STRIPE_PUB_KEY pk_85fQ0yMECHNfHTSsZoxZXlPSwSNfA
+ENV APPLE_AUTH_CLIENT_ID 9Q9SMRMCNN.com.habitrpg.ios.Habitica
 
 # Install global packages
 RUN npm install -g gulp-cli mocha

LICENSE

@@ -1,6 +1,6 @@
 * Code is GPL v3 licensed:
 This Source Code is subject to the terms of the GNU General Public License, v. 3.0.
-If a copy of the GPL was not distributed with this file, You can obtain one at http://www.gnu.org/licenses/gpl-3.0.txt
+If a copy of the GPL was not distributed with this file, you can obtain one at http://www.gnu.org/licenses/gpl-3.0.txt
 
 * Assets and content designed for Mozilla BrowserQuest are licensed under CC-BY-SA 3.0:
 http://creativecommons.org/licenses/by-sa/3.0/

README.md

@@ -1,8 +1,6 @@
-Habitica ![Build Status](https://github.com/HabitRPG/habitica/workflows/Test/badge.svg) [![Code Climate](https://codeclimate.com/github/HabitRPG/habitrpg.svg)](https://codeclimate.com/github/HabitRPG/habitrpg) [![Bountysource](https://api.bountysource.com/badge/tracker?tracker_id=68393)](https://www.bountysource.com/trackers/68393-habitrpg?utm_source=68393&utm_medium=shield&utm_campaign=TRACKER_BADGE) [![Open Source Helpers](https://www.codetriage.com/habitrpg/habitica/badges/users.svg)](https://www.codetriage.com/habitrpg/habitica)
+Habitica ![Build Status](https://github.com/HabitRPG/habitica/workflows/Test/badge.svg) [![Code Climate](https://codeclimate.com/github/HabitRPG/habitrpg.svg)](https://codeclimate.com/github/HabitRPG/habitrpg) [![Bountysource](https://api.bountysource.com/badge/tracker?tracker_id=68393)](https://www.bountysource.com/trackers/68393-habitrpg?utm_source=68393&utm_medium=shield&utm_campaign=TRACKER_BADGE)
 ===============
 
-[![Greenkeeper badge](https://badges.greenkeeper.io/HabitRPG/habitica.svg)](https://greenkeeper.io/)
-
 [Habitica](https://habitica.com) is an open source habit building program which treats your life like a Role Playing Game. Level up as you succeed, lose HP as you fail, earn money to buy weapons and armor.
 
 **We need more programmers!** Your assistance will be greatly appreciated. The wiki pages below and the additional pages they link to will tell you how to get started on contributing code and where you can go to seek further help or ask questions:

config.json.example

@@ -32,7 +32,7 @@
   "LOGGLY_SUBDOMAIN": "example-subdomain",
   "LOGGLY_TOKEN": "example-token",
   "MAINTENANCE_MODE": "false",
-  "NODE_DB_URI": "mongodb://localhost/habitrpg",
+  "NODE_DB_URI": "mongodb://localhost:27017/habitrpg",
   "MONGODB_POOL_SIZE": "10",
   "NODE_ENV": "development",
   "PATH": "bin:node_modules/.bin:/usr/local/bin:/usr/bin:/bin",
@@ -70,9 +70,15 @@
   "SLACK_URL": "https://hooks.slack.com/services/some-url",
   "STRIPE_API_KEY": "aaaabbbbccccddddeeeeffff00001111",
   "STRIPE_PUB_KEY": "22223333444455556666777788889999",
-  "TEST_DB_URI": "mongodb://localhost/habitrpg_test",
+  "TEST_DB_URI": "mongodb://localhost:27017/habitrpg_test",
   "TRANSIFEX_SLACK_CHANNEL": "transifex",
   "WEB_CONCURRENCY": 1,
   "SKIP_SSL_CHECK_KEY": "key",
-  "ENABLE_STACKDRIVER_TRACING": "false"
+  "ENABLE_STACKDRIVER_TRACING": "false",
+  "APPLE_AUTH_PRIVATE_KEY": "",
+  "APPLE_TEAM_ID": "",
+  "APPLE_AUTH_CLIENT_ID": "",
+  "APPLE_AUTH_KEY_ID": "",
+  "BLOCKED_IPS": "",
+  "LOG_AMPLITUDE_EVENTS": "false"
 }

gulp/gulp-build.js

@@ -1,19 +1,26 @@
 import gulp from 'gulp';
 import babel from 'gulp-babel';
 
-gulp.task('build:src', () => gulp.src('website/server/**/*.js')
+gulp.task('build:babel:server', () => gulp.src('website/server/**/*.js')
   .pipe(babel())
   .pipe(gulp.dest('website/transpiled-babel/')));
 
-gulp.task('build:common', () => gulp.src('website/common/script/**/*.js')
+gulp.task('build:babel:common', () => gulp.src('website/common/script/**/*.js')
   .pipe(babel())
   .pipe(gulp.dest('website/common/transpiled-babel/')));
 
-gulp.task('build:server', gulp.series('build:src', 'build:common', done => done()));
+gulp.task('build:babel', gulp.parallel('build:babel:server', 'build:babel:common', done => done()));
+
+gulp.task('build:cache', gulp.parallel(
+  'cache:content',
+  'cache:i18n',
+  done => done(),
+));
 
 gulp.task('build:prod', gulp.series(
-  'build:server',
+  'build:babel',
   'apidoc',
+  'build:cache',
   done => done(),
 ));
 

gulp/gulp-cache.js

@@ -0,0 +1,63 @@
+import gulp from 'gulp';
+import fs from 'fs';
+
+// TODO parallelize, use gulp file helpers
+gulp.task('cache:content', done => {
+  // Requiring at runtime because these files access `common`
+  // code which in production works only if transpiled so after
+  // gulp build:babel:common has run
+  const { CONTENT_CACHE_PATH, getLocalizedContentResponse } = require('../website/server/libs/content'); // eslint-disable-line global-require
+  const { langCodes } = require('../website/server/libs/i18n'); // eslint-disable-line global-require
+
+  try {
+    // create the cache folder (if it doesn't exist)
+    try {
+      fs.mkdirSync(CONTENT_CACHE_PATH);
+    } catch (err) {
+      if (err.code !== 'EEXIST') throw err;
+    }
+
+    // clone the content for each language and save
+    // localize it
+    // save the result
+    langCodes.forEach(langCode => {
+      fs.writeFileSync(
+        `${CONTENT_CACHE_PATH}${langCode}.json`,
+        getLocalizedContentResponse(langCode),
+        'utf8',
+      );
+    });
+    done();
+  } catch (err) {
+    done(err);
+  }
+});
+
+gulp.task('cache:i18n', done => {
+  // Requiring at runtime because these files access `common`
+  // code which in production works only if transpiled so after
+  // gulp build:babel:common has run
+  const { BROWSER_SCRIPT_CACHE_PATH, geti18nBrowserScript } = require('../website/server/libs/i18n'); // eslint-disable-line global-require
+  const { langCodes } = require('../website/server/libs/i18n'); // eslint-disable-line global-require
+
+  try {
+    // create the cache folder (if it doesn't exist)
+    try {
+      fs.mkdirSync(BROWSER_SCRIPT_CACHE_PATH);
+    } catch (err) {
+      if (err.code !== 'EEXIST') throw err;
+    }
+
+    // create and save the i18n browser script for each language
+    langCodes.forEach(languageCode => {
+      fs.writeFileSync(
+        `${BROWSER_SCRIPT_CACHE_PATH}${languageCode}.js`,
+        geti18nBrowserScript(languageCode),
+        'utf8',
+      );
+    });
+    done();
+  } catch (err) {
+    done(err);
+  }
+});

gulp/gulp-sprites.js

@@ -161,4 +161,4 @@ gulp.task('sprites:checkCompiledDimensions', gulp.series('sprites:main', 'sprite
   done();
 }));
 
-gulp.task('sprites:compile', gulp.series('sprites:clean', 'sprites:main', 'sprites:largeSprites', 'sprites:checkCompiledDimensions', done => done()));
+gulp.task('sprites:compile', gulp.series('sprites:clean', 'sprites:checkCompiledDimensions', done => done()));

gulpfile.js

@@ -13,8 +13,16 @@ const gulp = require('gulp');
 
 if (process.env.NODE_ENV === 'production') { // eslint-disable-line no-process-env
   require('./gulp/gulp-apidoc'); // eslint-disable-line global-require
+  require('./gulp/gulp-cache'); // eslint-disable-line global-require
   require('./gulp/gulp-build'); // eslint-disable-line global-require
 } else {
-  require('glob').sync('./gulp/gulp-*').forEach(require); // eslint-disable-line global-require
+  require('./gulp/gulp-apidoc'); // eslint-disable-line global-require
+  require('./gulp/gulp-cache'); // eslint-disable-line global-require
+  require('./gulp/gulp-build'); // eslint-disable-line global-require
+  require('./gulp/gulp-console'); // eslint-disable-line global-require
+  require('./gulp/gulp-sprites'); // eslint-disable-line global-require
+  require('./gulp/gulp-start'); // eslint-disable-line global-require
+  require('./gulp/gulp-tests'); // eslint-disable-line global-require
+  require('./gulp/gulp-transifex-test'); // eslint-disable-line global-require
   require('gulp').task('default', gulp.series('test')); // eslint-disable-line global-require
 }

migrations/archive/2020/20200402_webhooks_add_protocol.js

@@ -0,0 +1,69 @@
+/* eslint-disable no-console */
+const MIGRATION_NAME = '20200402_webhooks_add_protocol';
+import { model as User } from '../../../website/server/models/user';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count++;
+
+  const set = {
+    migration: MIGRATION_NAME,
+  };
+
+  if (user && user.webhooks && user.webhooks.length > 0) {
+    user.webhooks.forEach(webhook => {
+      // Make sure the protocol is set and valid
+      if (webhook.url.startsWith('ftp')) {
+        webhook.url = webhook.url.replace('ftp', 'https');
+      }
+
+      if (!webhook.url.startsWith('http://') && !webhook.url.startsWith('https://')) {
+        // the default in got 9 was https
+        // see https://github.com/sindresorhus/got/commit/92bc8082137d7d085750359bbd76c801e213d7d2#diff-0730bb7c2e8f9ea2438b52e419dd86c9L111
+        webhook.url = `https://${webhook.url}`;
+      }
+    });
+
+    set.webhooks = user.webhooks;
+  }
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+
+  return await User.update({ _id: user._id }, { $set: set }).exec();
+}
+
+module.exports = async function processUsers () {
+  let query = {
+    migration: { $ne: MIGRATION_NAME },
+    webhooks: { $exists: true, $not: { $size: 0 } },
+  };
+
+  const fields = {
+    _id: 1,
+    webhooks: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1]._id,
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};

migrations/archive/2020/20200402_webhooks_reenable.js

@@ -0,0 +1,63 @@
+/* eslint-disable no-console */
+const MIGRATION_NAME = '20200402_webhooks_reenable';
+import { model as User } from '../../../website/server/models/user';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count++;
+
+  const set = {
+    migration: MIGRATION_NAME,
+  };
+
+  if (user && user.webhooks && user.webhooks.length > 0) {
+    user.webhooks.forEach(webhook => {
+      // Re-enable webhooks disabled because of too many failures
+      if (webhook.enabled === false && webhook.lastFailureAt === null) {
+        webhook.enabled = true;
+      }
+    });
+
+    set.webhooks = user.webhooks;
+  }
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+
+  return await User.update({ _id: user._id }, { $set: set }).exec();
+}
+
+module.exports = async function processUsers () {
+  let query = {
+    migration: { $ne: MIGRATION_NAME },
+    webhooks: { $exists: true, $not: { $size: 0 } },
+  };
+
+  const fields = {
+    _id: 1,
+    webhooks: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1]._id,
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};

migrations/migration-runner.js

@@ -18,7 +18,7 @@ function setUpServer () {
 setUpServer();
 
 // Replace this with your migration
-const processUsers = () => {}; // require('').default;
+const processUsers = require().default;
 
 processUsers()
   .then(() => {

migrations/tasks/rewards-flip-negative-costs.js

@@ -0,0 +1,54 @@
+// @migrationName = 'RewardsMigrationFlipNegativeCostsValues';
+// @authorName = 'hamboomger';
+// @authorUuid = '80b61b73-2278-4947-b713-a10112cfe7f5';
+
+/*
+ * For each reward with negative cost, make it positive
+ * by assigning it an absolute value of itself
+ */
+
+import { Task } from '../../website/server/models/task';
+
+async function flipNegativeCostsValues () {
+  const query = {
+    type: 'reward',
+    value: { $lt: 0 },
+  };
+
+  const fields = {
+    _id: 1,
+    value: 1,
+  };
+
+  // eslint-disable-next-line no-constant-condition
+  while (true) {
+    // eslint-disable-next-line no-await-in-loop
+    const rewards = await Task
+      .find(query)
+      .limit(250)
+      .sort({ _id: 1 })
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (rewards.length === 0) {
+      break;
+    }
+
+    const promises = rewards.map(reward => {
+      const positiveValue = Math.abs(reward.value);
+      return Task.update({ _id: reward._id }, { $set: { value: positiveValue } }).exec();
+    });
+
+    // eslint-disable-next-line no-await-in-loop
+    await Promise.all(promises);
+
+    query._id = {
+      $gt: rewards[rewards.length - 1]._id,
+    };
+  }
+
+  console.log('All rewards with negative values were updated, migration finished');
+}
+
+export default flipNegativeCostsValues;

migrations/users/full-gear.js

@@ -0,0 +1,64 @@
+/* eslint-disable no-console */
+import each from 'lodash/each';
+import keys from 'lodash/keys';
+import content from '../../website/common/script/content/index';
+
+import { model as User } from '../../website/server/models/user';
+
+const MIGRATION_NAME = 'full-gear';
+
+const progressCount = 1000;
+let count = 0;
+
+/*
+ * Award users every extant pet and mount
+ */
+
+async function updateUser (user) {
+  count += 1;
+
+  const set = {};
+
+  set.migration = MIGRATION_NAME;
+
+  each(keys(content.gear.flat), gearItem => {
+    set[`items.gear.owned.${gearItem}`] = true;
+  });
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+
+  return User.update({ _id: user._id }, { $set: set }).exec();
+}
+
+export default async function processUsers () {
+  const query = {
+    migration: { $ne: MIGRATION_NAME },
+    'auth.local.lowerCaseUsername': 'olson1',
+  };
+
+  const fields = {
+    _id: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({ _id: 1 })
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1],
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+}

migrations/users/full-stable.js

@@ -33,6 +33,9 @@ async function updateUser (user) {
   each(keys(content.specialPets), pet => {
     set[`items.pets.${pet}`] = 5;
   });
+  each(keys(content.wackyPets), pet => {
+    set[`items.pets.${pet}`] = 5;
+  });
   each(keys(content.mounts), mount => {
     set[`items.mounts.${mount}`] = true;
   });
@@ -54,7 +57,7 @@ async function updateUser (user) {
 export default async function processUsers () {
   const query = {
     migration: { $ne: MIGRATION_NAME },
-    'auth.local.username': 'olson22',
+    'auth.local.username': 'SabreTest',
   };
 
   const fields = {

migrations/users/pi-day.js

@@ -3,7 +3,7 @@ import { v4 as uuid } from 'uuid';
 
 import { model as User } from '../../website/server/models/user';
 
-const MIGRATION_NAME = '20190314_pi_day';
+const MIGRATION_NAME = '20200314_pi_day';
 
 const progressCount = 1000;
 let count = 0;
@@ -24,27 +24,37 @@ async function updateUser (user) {
     'items.food.Pie_Red': 1,
   };
   const set = {};
+  let push;
 
   set.migration = MIGRATION_NAME;
 
-  set['items.gear.owned.head_special_piDay'] = false;
-  set['items.gear.owned.shield_special_piDay'] = false;
-  const push = [
-    { type: 'marketGear', path: 'gear.flat.head_special_piDay', _id: uuid() },
-    { type: 'marketGear', path: 'gear.flat.shield_special_piDay', _id: uuid() },
-  ];
+  if (typeof user.items.gear.owned.head_special_piDay !== 'undefined') {
+    push = false;
+  } else {
+    set['items.gear.owned.head_special_piDay'] = false;
+    set['items.gear.owned.shield_special_piDay'] = false;
+    push = [
+      { type: 'marketGear', path: 'gear.flat.head_special_piDay', _id: uuid() },
+      { type: 'marketGear', path: 'gear.flat.shield_special_piDay', _id: uuid() },
+    ];
+  }
 
   if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
 
+  if (push) {
+    return User
+      .update({ _id: user._id }, { $inc: inc, $set: set, $push: { pinnedItems: { $each: push } } })
+      .exec();
+  }
   return User
-    .update({ _id: user._id }, { $inc: inc, $set: set, $push: { pinnedItems: { $each: push } } })
+    .update({ _id: user._id }, { $inc: inc, $set: set })
     .exec();
 }
 
 export default async function processUsers () {
   const query = {
     migration: { $ne: MIGRATION_NAME },
-    'auth.timestamps.loggedin': { $gt: new Date('2019-02-15') },
+    'auth.timestamps.loggedin': { $gt: new Date('2020-02-15') },
   };
 
   const fields = {

package.json

@@ -1,26 +1,26 @@
 {
   "name": "habitica",
   "description": "A habit tracker app which treats your goals like a Role Playing Game.",
-  "version": "4.135.1",
+  "version": "4.145.1",
   "main": "./website/server/index.js",
   "dependencies": {
-    "@babel/core": "^7.8.4",
-    "@babel/preset-env": "^7.8.4",
-    "@babel/register": "^7.8.3",
-    "@google-cloud/trace-agent": "^4.2.5",
-    "@slack/client": "^3.8.1",
+    "@babel/core": "^7.10.2",
+    "@babel/preset-env": "^7.10.2",
+    "@babel/register": "^7.10.1",
+    "@google-cloud/trace-agent": "^5.0.0",
+    "@slack/client": "^4.12.0",
     "accepts": "^1.3.5",
     "amazon-payments": "^0.2.8",
     "amplitude": "^3.5.0",
     "apidoc": "^0.17.5",
     "apn": "^2.2.0",
-    "aws-sdk": "^2.624.0",
+    "apple-auth": "^1.0.6",
     "bcrypt": "^3.0.8",
     "body-parser": "^1.18.3",
     "compression": "^1.7.4",
     "cookie-session": "^1.4.0",
     "coupon-code": "^0.4.5",
-    "csv-stringify": "^5.3.6",
+    "csv-stringify": "^5.5.0",
     "cwait": "^1.1.1",
     "domain-middleware": "~0.1.0",
     "eslint": "^6.8.0",
@@ -30,35 +30,36 @@
     "express-basic-auth": "^1.1.5",
     "express-validator": "^5.2.0",
     "glob": "^7.1.6",
-    "got": "^9.0.0",
+    "got": "^10.7.0",
     "gulp": "^4.0.0",
     "gulp-babel": "^8.0.0",
     "gulp-imagemin": "^6.2.0",
-    "gulp-nodemon": "^2.4.1",
+    "gulp-nodemon": "^2.5.0",
     "gulp.spritesmith": "^6.9.0",
-    "habitica-markdown": "^1.3.2",
-    "helmet": "^3.21.2",
+    "habitica-markdown": "^2.0.0",
+    "helmet": "^3.22.0",
     "image-size": "^0.8.3",
     "in-app-purchase": "^1.11.3",
     "js2xmlparser": "^4.0.1",
+    "jsonwebtoken": "^8.5.1",
+    "jwks-rsa": "^1.8.0",
     "lodash": "^4.17.15",
     "merge-stream": "^2.0.0",
     "method-override": "^3.0.0",
-    "moment": "^2.24.0",
+    "moment": "^2.26.0",
     "moment-recur": "^1.0.7",
-    "mongoose": "^5.9.2",
-    "morgan": "^1.7.0",
+    "mongoose": "^5.9.18",
+    "morgan": "^1.10.0",
     "nconf": "^0.10.0",
     "node-gcm": "^1.0.2",
-    "pageres": "^5.1.0",
+    "on-headers": "^1.0.2",
     "passport": "^0.4.1",
     "passport-facebook": "^3.0.0",
-    "passport-google-oauth2": "^0.2.0",
     "passport-google-oauth20": "1.0.0",
     "paypal-ipn": "3.0.0",
     "paypal-rest-sdk": "^1.8.1",
     "ps-tree": "^1.0.0",
-    "regenerator-runtime": "^0.13.3",
+    "regenerator-runtime": "^0.13.5",
     "remove-markdown": "^0.3.0",
     "rimraf": "^3.0.2",
     "short-uuid": "^3.0.0",
@@ -69,8 +70,8 @@
     "uuid": "^3.4.0",
     "validator": "^11.0.0",
     "vinyl-buffer": "^1.0.1",
-    "winston": "^2.4.3",
-    "winston-loggly-bulk": "^2.0.2",
+    "winston": "^3.2.1",
+    "winston-loggly-bulk": "^3.1.0",
     "xml2js": "^0.4.23"
   },
   "private": true,
@@ -99,6 +100,7 @@
     "client:build": "cd website/client && npm run build",
     "client:unit": "cd website/client && npm run test:unit",
     "start": "gulp nodemon",
+    "debug": "gulp nodemon --inspect",
     "postinstall": "gulp build && cd website/client && npm install",
     "apidoc": "gulp apidoc"
   },
@@ -106,11 +108,11 @@
     "axios": "^0.19.2",
     "chai": "^4.1.2",
     "chai-as-promised": "^7.1.1",
-    "chalk": "^2.4.1",
+    "chalk": "^3.0.0",
     "expect.js": "^0.3.1",
     "istanbul": "^1.1.0-alpha.1",
     "mocha": "^5.1.1",
-    "monk": "^7.1.2",
+    "monk": "^7.3.0",
     "require-again": "^2.0.0",
     "sinon": "^7.2.4",
     "sinon-chai": "^3.5.0",

test/api/unit/libs/content.test.js

@@ -0,0 +1,17 @@
+import * as contentLib from '../../../../website/server/libs/content';
+import content from '../../../../website/common/script/content';
+
+describe('contentLib', () => {
+  describe('CONTENT_CACHE_PATH', () => {
+    it('exports CONTENT_CACHE_PATH', () => {
+      expect(contentLib.CONTENT_CACHE_PATH).to.be.a.string;
+    });
+  });
+
+  describe('getLocalizedContentResponse', () => {
+    it('clones, not modify, the original content data', () => {
+      contentLib.getLocalizedContentResponse();
+      expect(typeof content.backgrounds.backgrounds062014.beach.text).to.equal('function');
+    });
+  });
+});

test/api/unit/libs/cron.test.js

@@ -879,6 +879,11 @@ describe('cron', () => {
       tasksByType.todos.push(task);
     });
 
+    afterEach(() => {
+      tasksByType.todos = [];
+      user.tasksOrder.todos = [];
+    });
+
     it('should make uncompleted todos redder', () => {
       const valueBefore = tasksByType.todos[0].value;
       cron({
@@ -887,6 +892,15 @@ describe('cron', () => {
       expect(tasksByType.todos[0].value).to.be.lessThan(valueBefore);
     });
 
+    it('should not make completed todos redder', () => {
+      tasksByType.todos[0].completed = true;
+      const valueBefore = tasksByType.todos[0].value;
+      cron({
+        user, tasksByType, daysMissed, analytics,
+      });
+      expect(tasksByType.todos[0].value).to.equal(valueBefore);
+    });
+
     it('should add history of completed todos to user history', () => {
       tasksByType.todos[0].completed = true;
 
@@ -898,17 +912,13 @@ describe('cron', () => {
     });
 
     it('should remove completed todos from users taskOrder list', () => {
-      tasksByType.todos = [];
-      user.tasksOrder.todos = [];
       const todo = {
         text: 'test todo',
         type: 'todo',
         value: 0,
       };
 
-      let task = new Tasks.todo(Tasks.Task.sanitize(todo)); // eslint-disable-line new-cap
-      tasksByType.todos.push(task);
-      task = new Tasks.todo(Tasks.Task.sanitize(todo)); // eslint-disable-line new-cap
+      const task = new Tasks.todo(Tasks.Task.sanitize(todo)); // eslint-disable-line new-cap
       tasksByType.todos.push(task);
       tasksByType.todos[0].completed = true;
 
@@ -930,8 +940,6 @@ describe('cron', () => {
     });
 
     it('should preserve todos order in task list', () => {
-      tasksByType.todos = [];
-      user.tasksOrder.todos = [];
       const todo = {
         text: 'test todo',
         type: 'todo',

test/api/unit/libs/email.test.js

@@ -18,6 +18,16 @@ function getUser () {
           value: 'email@facebook',
         }],
       },
+      google: {
+        emails: [{
+          value: 'email@google',
+        }],
+      },
+      apple: {
+        emails: [{
+          value: 'email@apple',
+        }],
+      },
     },
     profile: {
       name: 'profile name',
@@ -58,6 +68,8 @@ describe('emails', () => {
       const user = getUser();
       delete user.profile.name;
       delete user.auth.local.email;
+      delete user.auth.google.emails;
+      delete user.auth.apple.emails;
 
       const data = getUserInfo(user, ['name', 'email', '_id', 'canSend']);
 
@@ -67,12 +79,48 @@ describe('emails', () => {
       expect(data).to.have.property('canSend', true);
     });
 
+    it('returns correct user data [google users]', () => {
+      const attachEmail = requireAgain(pathToEmailLib);
+      const { getUserInfo } = attachEmail;
+      const user = getUser();
+      delete user.profile.name;
+      delete user.auth.local.email;
+      delete user.auth.facebook.emails;
+      delete user.auth.apple.emails;
+
+      const data = getUserInfo(user, ['name', 'email', '_id', 'canSend']);
+
+      expect(data).to.have.property('name', user.auth.local.username);
+      expect(data).to.have.property('email', user.auth.google.emails[0].value);
+      expect(data).to.have.property('_id', user._id);
+      expect(data).to.have.property('canSend', true);
+    });
+
+    it('returns correct user data [apple users]', () => {
+      const attachEmail = requireAgain(pathToEmailLib);
+      const { getUserInfo } = attachEmail;
+      const user = getUser();
+      delete user.profile.name;
+      delete user.auth.local.email;
+      delete user.auth.google.emails;
+      delete user.auth.facebook.emails;
+
+      const data = getUserInfo(user, ['name', 'email', '_id', 'canSend']);
+
+      expect(data).to.have.property('name', user.auth.local.username);
+      expect(data).to.have.property('email', user.auth.apple.emails[0].value);
+      expect(data).to.have.property('_id', user._id);
+      expect(data).to.have.property('canSend', true);
+    });
+
     it('has fallbacks for missing data', () => {
       const attachEmail = requireAgain(pathToEmailLib);
       const { getUserInfo } = attachEmail;
       const user = getUser();
       delete user.auth.local.email;
       delete user.auth.facebook;
+      delete user.auth.google;
+      delete user.auth.apple;
 
       const data = getUserInfo(user, ['name', 'email', '_id', 'canSend']);
 
@@ -121,8 +169,7 @@ describe('emails', () => {
 
       sendTxnEmail(mailingInfo, emailType);
       expect(got.post).to.be.calledWith('undefined/job', sinon.match({
-        json: true,
-        body: {
+        json: {
           data: {
             emailType: sinon.match.same(emailType),
             to: sinon.match(value => Array.isArray(value) && value[0].name === mailingInfo.name, 'matches mailing info array'),
@@ -154,8 +201,7 @@ describe('emails', () => {
 
       sendTxnEmail(mailingInfo, emailType);
       expect(got.post).to.be.calledWith('undefined/job', sinon.match({
-        json: true,
-        body: {
+        json: {
           data: {
             emailType: sinon.match.same(emailType),
             to: sinon.match(val => val[0]._id === mailingInfo._id),
@@ -177,8 +223,7 @@ describe('emails', () => {
 
       sendTxnEmail(mailingInfo, emailType, variables);
       expect(got.post).to.be.calledWith('undefined/job', sinon.match({
-        json: true,
-        body: {
+        json: {
           data: {
             variables: sinon.match(value => value[0].name === 'BASE_URL', 'matches variables'),
             personalVariables: sinon.match(value => value[0].rcpt === mailingInfo.email

test/api/unit/libs/errors.test.js

@@ -3,6 +3,7 @@ import {
   CustomError,
   NotAuthorized,
   BadRequest,
+  Forbidden,
   InternalServerError,
   NotFound,
   NotificationNotFound,
@@ -113,6 +114,32 @@ describe('Custom Errors', () => {
     });
   });
 
+  describe('Forbidden', () => {
+    it('is an instance of CustomError', () => {
+      const forbiddenError = new Forbidden();
+
+      expect(forbiddenError).to.be.an.instanceOf(CustomError);
+    });
+
+    it('it returns an http code of 401', () => {
+      const forbiddenError = new Forbidden();
+
+      expect(forbiddenError.httpCode).to.eql(403);
+    });
+
+    it('returns a default message', () => {
+      const forbiddenError = new Forbidden();
+
+      expect(forbiddenError.message).to.eql('Access forbidden.');
+    });
+
+    it('allows a custom message', () => {
+      const forbiddenError = new Forbidden('Custom Error Message');
+
+      expect(forbiddenError.message).to.eql('Custom Error Message');
+    });
+  });
+
   describe('InternalServerError', () => {
     it('is an instance of CustomError', () => {
       const internalServerError = new InternalServerError();

test/api/unit/libs/highlightMentions.js

@@ -1,60 +0,0 @@
-import mongoose from 'mongoose';
-import {
-  highlightMentions,
-} from '../../../../website/server/libs/highlightMentions';
-
-describe('highlightMentions', () => {
-  beforeEach(() => {
-    const mockFind = {
-      select () {
-        return this;
-      },
-      lean () {
-        return this;
-      },
-      exec () {
-        return Promise.resolve([{
-          auth: { local: { username: 'user' } }, _id: '111',
-        }, { auth: { local: { username: 'user2' } }, _id: '222' }, { auth: { local: { username: 'user3' } }, _id: '333' }, { auth: { local: { username: 'user-dash' } }, _id: '444' }, { auth: { local: { username: 'user_underscore' } }, _id: '555' },
-        ]);
-      },
-    };
-
-    sinon.stub(mongoose.Model, 'find').returns(mockFind);
-  });
-
-  afterEach(() => {
-    sinon.restore();
-  });
-
-  it('doesn\'t change text without mentions', async () => {
-    const text = 'some chat text';
-    const result = await highlightMentions(text);
-    expect(result[0]).to.equal(text);
-  });
-  it('highlights existing users', async () => {
-    const text = '@user: message';
-    const result = await highlightMentions(text);
-    expect(result[0]).to.equal('[@user](/profile/111): message');
-  });
-  it('highlights special characters', async () => {
-    const text = '@user-dash: message @user_underscore';
-    const result = await highlightMentions(text);
-    expect(result[0]).to.equal('[@user-dash](/profile/444): message [@user_underscore](/profile/555)');
-  });
-  it('doesn\'t highlight nonexisting users', async () => {
-    const text = '@nouser message';
-    const result = await highlightMentions(text);
-    expect(result[0]).to.equal('@nouser message');
-  });
-  it('highlights multiple existing users', async () => {
-    const text = '@user message (@user2) @user3 @user';
-    const result = await highlightMentions(text);
-    expect(result[0]).to.equal('[@user](/profile/111) message ([@user2](/profile/222)) [@user3](/profile/333) [@user](/profile/111)');
-  });
-  it('doesn\'t highlight more than 5 users', async () => {
-    const text = '@user @user2 @user3 @user4 @user5 @user6';
-    const result = await highlightMentions(text);
-    expect(result[0]).to.equal(text);
-  });
-});

test/api/unit/libs/highlightMentions.test.js

@@ -0,0 +1,198 @@
+import mongoose from 'mongoose';
+
+import highlightMentions from '../../../../website/server/libs/highlightMentions';
+
+describe('highlightMentions', () => {
+  beforeEach(() => {
+    const mockFind = {
+      select () {
+        return this;
+      },
+      lean () {
+        return this;
+      },
+      exec () {
+        return Promise.resolve([
+          { auth: { local: { username: 'user' } }, _id: '111' },
+          { auth: { local: { username: 'user2' } }, _id: '222' },
+          { auth: { local: { username: 'user3' } }, _id: '333' },
+          { auth: { local: { username: 'user-dash' } }, _id: '444' },
+          { auth: { local: { username: 'user_underscore' } }, _id: '555' },
+        ]);
+      },
+    };
+
+    sinon.stub(mongoose.Model, 'find').returns(mockFind);
+  });
+
+  afterEach(() => {
+    sinon.restore();
+  });
+
+  it('doesn\'t change text without mentions', async () => {
+    const text = 'some chat text';
+    const result = await highlightMentions(text);
+    expect(result[0]).to.equal(text);
+  });
+
+  it('highlights existing users', async () => {
+    const text = '@user: message';
+    const result = await highlightMentions(text);
+    expect(result[0]).to.equal('[@user](/profile/111): message');
+  });
+
+  it('highlights special characters', async () => {
+    const text = '@user-dash: message @user_underscore';
+    const result = await highlightMentions(text);
+    expect(result[0]).to.equal('[@user-dash](/profile/444): message [@user_underscore](/profile/555)');
+  });
+
+  it('doesn\'t highlight nonexisting users', async () => {
+    const text = '@nouser message';
+    const result = await highlightMentions(text);
+    expect(result[0]).to.equal('@nouser message');
+  });
+
+  it('highlights multiple existing users', async () => {
+    const text = '@user message (@user2) @user3 @user';
+    const result = await highlightMentions(text);
+    expect(result[0]).to.equal('[@user](/profile/111) message ([@user2](/profile/222)) [@user3](/profile/333) [@user](/profile/111)');
+  });
+
+  it('doesn\'t highlight more than 5 users', async () => {
+    const text = '@user @user2 @user3 @user4 @user5 @user6';
+    const result = await highlightMentions(text);
+    expect(result[0]).to.equal(text);
+  });
+
+  describe('link interactions', async () => {
+    it('doesn\'t highlight users in link', async () => {
+      const text = 'http://www.medium.com/@user/blog';
+      const result = await highlightMentions(text);
+      expect(result[0]).to.equal(text);
+    });
+
+    it('doesn\'t highlight user in link between brackets', async () => {
+      const text = '(http://www.medium.com/@user/blog)';
+      const result = await highlightMentions(text);
+      expect(result[0]).to.equal(text);
+    });
+
+    it('doesn\'t highlight user in an autolink', async () => {
+      const text = '<http://www.medium.com/@user/blog>';
+      const result = await highlightMentions(text);
+      expect(result[0]).to.equal(text);
+    });
+
+    it('doesn\'t highlight users in link text', async () => {
+      const text = '[Check awesome blog written by @user](http://www.medium.com/@user/blog)';
+      const result = await highlightMentions(text);
+      expect(result[0]).to.equal(text);
+    });
+
+    it('doesn\'t highlight users in link with newlines and markup', async () => {
+      const text = '[Check `awesome` \nblog **written** by @user](http://www.medium.com/@user/blog)';
+      const result = await highlightMentions(text);
+      expect(result[0]).to.equal(text);
+    });
+
+    it('doesn\'t highlight users in link when followed by same @user mention', async () => {
+      const text = 'http://www.medium.com/@user/blog @user';
+      const result = await highlightMentions(text);
+      expect(result[0]).to.equal('http://www.medium.com/@user/blog [@user](/profile/111)');
+    });
+
+    // https://spec.commonmark.org/0.29/#example-483
+    it('doesn\'t highlight user in a link without url', async () => {
+      const text = '[@user2]()';
+      const result = await highlightMentions(text);
+      expect(result[0]).to.equal(text);
+    });
+
+    // https://github.com/HabitRPG/habitica/issues/12217
+    it('doesn\'t highlight user in link with url-escapable characters', async () => {
+      const text = '[test](https://habitica.fandom.com/ru/@wiki/Снаряжение)';
+      const result = await highlightMentions(text);
+      expect(result[0]).to.equal(text);
+    });
+
+    // https://github.com/HabitRPG/habitica/issues/12223
+    it('matches a link in between two the same links', async () => {
+      const text = '[here](http://habitica.wikia.com/wiki/The_Keep:Pirate_Cove/FAQ)\n@user\n[hier](http://habitica.wikia.com/wiki/The_Keep:Pirate_Cove/FAQ)';
+
+      const result = await highlightMentions(text);
+
+      expect(result[0]).to.equal('[here](http://habitica.wikia.com/wiki/The_Keep:Pirate_Cove/FAQ)\n[@user](/profile/111)\n[hier](http://habitica.wikia.com/wiki/The_Keep:Pirate_Cove/FAQ)');
+    });
+  });
+
+  describe('exceptions in code blocks', () => {
+    it('doesn\'t highlight user in inline code block', async () => {
+      const text = '`@user`';
+
+      const result = await highlightMentions(text);
+
+      expect(result[0]).to.equal(text);
+    });
+
+    it('doesn\'t highlight user in fenced code block', async () => {
+      const text = 'Text\n\n```\n// code referencing @user\n```\n\nText';
+
+      const result = await highlightMentions(text);
+
+      expect(result[0]).to.equal(text);
+    });
+
+    it('doesn\'t highlight user in indented code block', async () => {
+      const text = '      @user';
+
+      const result = await highlightMentions(text);
+
+      expect(result[0]).to.equal(text);
+    });
+
+    it('does highlight user that\'s after in-line code block', async () => {
+      const text = '`<code />` for @user';
+
+      const result = await highlightMentions(text);
+
+      expect(result[0]).to.equal('`<code />` for [@user](/profile/111)');
+    });
+
+    it('does highlight same content properly', async () => {
+      const text = '@user `@user`';
+
+      const result = await highlightMentions(text);
+
+      expect(result[0]).to.equal('[@user](/profile/111) `@user`');
+    });
+  });
+
+  it('github issue 12118, method crashes when square brackets are used', async () => {
+    const text = '[test]';
+
+    let err;
+
+    try {
+      await highlightMentions(text);
+    } catch (e) {
+      err = e;
+    }
+
+    expect(err).to.be.undefined;
+  });
+
+  it('github issue 12138, method crashes when regex chars are used in code block', async () => {
+    const text = '`[test]`';
+
+    let err;
+
+    try {
+      await highlightMentions(text);
+    } catch (e) {
+      err = e;
+    }
+
+    expect(err).to.be.undefined;
+  });
+});

test/api/unit/libs/language.test.js

@@ -0,0 +1,111 @@
+import {
+  getLanguageFromBrowser,
+  getLanguageFromUser,
+} from '../../../../website/server/libs/language';
+import {
+  generateReq,
+} from '../../../helpers/api-unit.helper';
+
+describe('language lib', () => {
+  let req;
+
+  beforeEach(() => {
+    req = generateReq();
+  });
+
+  describe('getLanguageFromUser', () => {
+    it('uses the user preferred language if avalaible', () => {
+      const user = {
+        preferences: {
+          language: 'it',
+        },
+      };
+
+      expect(getLanguageFromUser(user, req)).to.equal('it');
+    });
+
+    it('falls back to english if the user preferred language is not avalaible', () => {
+      const user = {
+        preferences: {
+          language: 'bla',
+        },
+      };
+
+      expect(getLanguageFromUser(user, req)).to.equal('en');
+    });
+  });
+
+  describe('getLanguageFromBrowser', () => {
+    it('uses browser specificed language', () => {
+      req.headers['accept-language'] = 'pt';
+
+      expect(getLanguageFromBrowser(req)).to.equal('pt');
+    });
+
+    it('uses first language in series if browser specifies multiple', () => {
+      req.headers['accept-language'] = 'he, pt, it';
+
+      expect(getLanguageFromBrowser(req)).to.equal('he');
+    });
+
+    it('skips invalid lanaguages and uses first language in series if browser specifies multiple', () => {
+      req.headers['accept-language'] = 'blah, he, pt, it';
+
+      expect(getLanguageFromBrowser(req)).to.equal('he');
+    });
+
+    it('uses normal version of language if specialized locale is passed in', () => {
+      req.headers['accept-language'] = 'fr-CA';
+
+      expect(getLanguageFromBrowser(req)).to.equal('fr');
+    });
+
+    it('uses normal version of language if specialized locale is passed in', () => {
+      req.headers['accept-language'] = 'fr-CA';
+
+      expect(getLanguageFromBrowser(req)).to.equal('fr');
+    });
+
+    it('uses es if es is passed in', () => {
+      req.headers['accept-language'] = 'es';
+
+      expect(getLanguageFromBrowser(req)).to.equal('es');
+    });
+
+    it('uses es_419 if applicable es-languages are passed in', () => {
+      req.headers['accept-language'] = 'es-mx';
+
+      expect(getLanguageFromBrowser(req)).to.equal('es_419');
+    });
+
+    it('uses es_419 if multiple es languages are passed in', () => {
+      req.headers['accept-language'] = 'es-GT, es-MX, es-CR';
+
+      expect(getLanguageFromBrowser(req)).to.equal('es_419');
+    });
+
+    it('zh', () => {
+      req.headers['accept-language'] = 'zh-TW';
+
+      expect(getLanguageFromBrowser(req)).to.equal('zh_TW');
+    });
+
+    it('uses english if browser specified language is not compatible', () => {
+      req.headers['accept-language'] = 'blah';
+
+      expect(getLanguageFromBrowser(req)).to.equal('en');
+    });
+
+    it('uses english if browser does not specify', () => {
+      req.headers['accept-language'] = '';
+
+      expect(getLanguageFromBrowser(req)).to.equal('en');
+    });
+
+    it('uses english if browser does not supply an accept-language header', () => {
+      delete req.headers['accept-language'];
+
+      expect(getLanguageFromBrowser(req)).to.equal('en');
+    });
+  });
+});

test/api/unit/libs/localizeContentData.js

@@ -0,0 +1,22 @@
+import faq from '../../../../website/common/script/content/faq';
+import common from '../../../../website/common';
+import { localizeContentData } from '../../../../website/server/libs/content';
+
+const { i18n } = common;
+
+describe('localizeContentData', () => {
+  it('Should take a an object with localization identifiers and '
+    + 'return an object with actual translations in English', () => {
+    const faqInEnglish = localizeContentData(faq, 'en');
+
+    expect(faqInEnglish).to.have.property('stillNeedHelp');
+    expect(faqInEnglish.stillNeedHelp.ios).to.equal(i18n.t('iosFaqStillNeedHelp', 'en'));
+  });
+  it('Should take an object with localization identifiers and '
+    + 'return an object with actual translations in German', () => {
+    const faqInEnglish = localizeContentData(faq, 'de');
+
+    expect(faqInEnglish).to.have.property('stillNeedHelp');
+    expect(faqInEnglish.stillNeedHelp.ios).to.equal(i18n.t('iosFaqStillNeedHelp', 'de'));
+  });
+});

test/api/unit/libs/logger.js

@@ -1,14 +1,27 @@
-import winston from 'winston';
-import logger from '../../../../website/server/libs/logger';
+import logger, { _loggerConfig } from '../../../../website/server/libs/logger';
 import {
   NotFound,
 } from '../../../../website/server/libs/errors';
 
 describe('logger', () => {
-  let logSpy;
+  let infoSpy;
+  let warnSpy;
+  let errorSpy;
+
+  const originalLoggingEnabled = _loggerConfig.loggingEnabled;
+
+  before(() => { // enable logging in tests
+    _loggerConfig.loggingEnabled = true;
+  });
+
+  after(() => { // reset value of _loggerConfig.loggingEnabled
+    _loggerConfig.loggingEnabled = originalLoggingEnabled;
+  });
 
   beforeEach(() => {
-    logSpy = sandbox.stub(winston.Logger.prototype, 'log');
+    infoSpy = sandbox.stub(_loggerConfig.logger, 'info');
+    warnSpy = sandbox.stub(_loggerConfig.logger, 'warn');
+    errorSpy = sandbox.stub(_loggerConfig.logger, 'error');
   });
 
   afterEach(() => {
@@ -17,18 +30,52 @@ describe('logger', () => {
 
   describe('info', () => {
     it('calls winston\'s info log', () => {
-      logger.info(1, 2, 3);
-      expect(logSpy).to.be.calledOnce;
-      expect(logSpy).to.be.calledWith('info', 1, 2, 3);
+      logger.info('1', 2);
+      expect(infoSpy).to.be.calledOnce;
+      expect(infoSpy).to.be.calledWith('1', { extraData: 2 });
+    });
+
+    it('allows up to two arguments', () => {
+      expect(() => logger.info('1', 2, 3)).to.throw;
+      expect(infoSpy).to.not.be.called;
+    });
+
+    it('has default message', () => {
+      logger.info(1);
+      expect(infoSpy).to.be.calledOnce;
+      expect(infoSpy).to.be.calledWith('No message provided for log.', { extraData: 1 });
+    });
+
+    it('wraps non objects', () => {
+      logger.info('message', [1, 2]);
+      expect(infoSpy).to.be.calledOnce;
+      expect(infoSpy).to.be.calledWithMatch('message', { extraData: [1, 2] });
+    });
+
+    it('does not wrap objects', () => {
+      logger.info('message', { a: 1, b: 2 });
+      expect(infoSpy).to.be.calledOnce;
+      expect(infoSpy).to.be.calledWithMatch('message', { a: 1, b: 2 });
+    });
+
+    it('throws if two arguments and no message', () => {
+      expect(() => logger.info({ a: 1 }, { b: 2 })).to.throw;
+      expect(infoSpy).to.not.be.called;
     });
   });
 
   describe('error', () => {
-    context('non-error object', () => {
-      it('passes through arguments if the first arg is not an error object', () => {
-        logger.error(1, 2, 3, 4);
-        expect(logSpy).to.be.calledOnce;
-        expect(logSpy).to.be.calledWith('error', 1, 2, 3, 4);
+    it('allows up to two arguments', () => {
+      expect(() => logger.error('1', 2, 3)).to.throw;
+      expect(errorSpy).to.not.be.called;
+    });
+
+    it('handled non-error object', () => {
+      logger.error(1, 2);
+      expect(errorSpy).to.be.calledOnce;
+      expect(errorSpy).to.be.calledWithMatch('logger.error expects an Error instance', {
+        invalidErr: 1,
+        extraData: 2,
       });
     });
 
@@ -37,15 +84,12 @@ describe('logger', () => {
         const errInstance = new Error('An error.');
         logger.error(errInstance, {
           data: 1,
-        }, 2, 3);
+        });
 
-        expect(logSpy).to.be.calledOnce;
-        expect(logSpy).to.be.calledWith(
-          'error',
+        expect(errorSpy).to.be.calledOnce;
+        expect(errorSpy).to.be.calledWith(
           errInstance.stack,
           { data: 1, fullError: errInstance },
-          2,
-          3,
         );
       });
 
@@ -56,60 +100,60 @@ describe('logger', () => {
         logger.error(errInstance, {
           data: 1,
           fullError: anotherError,
-        }, 2, 3);
+        });
 
-        expect(logSpy).to.be.calledOnce;
-        expect(logSpy).to.be.calledWith(
-          'error',
+        expect(errorSpy).to.be.calledOnce;
+        expect(errorSpy).to.be.calledWith(
           errInstance.stack,
           { data: 1, fullError: anotherError },
-          2,
-          3,
         );
       });
 
       it('logs the error when errorData is null', () => {
         const errInstance = new Error('An error.');
 
-        logger.error(errInstance, null, 2, 3);
+        logger.error(errInstance, null);
 
-        expect(logSpy).to.be.calledOnce;
-        expect(logSpy).to.be.calledWith(
-          'error',
+        expect(errorSpy).to.be.calledOnce;
+        expect(errorSpy).to.be.calledWithMatch(
           errInstance.stack,
-          null,
-          2,
-          3,
+          { },
         );
       });
 
       it('logs the error when errorData is not an object', () => {
         const errInstance = new Error('An error.');
 
-        logger.error(errInstance, true, 2, 3);
+        logger.error(errInstance, true);
 
-        expect(logSpy).to.be.calledOnce;
-        expect(logSpy).to.be.calledWith(
-          'error',
+        expect(errorSpy).to.be.calledOnce;
+        expect(errorSpy).to.be.calledWithMatch(
           errInstance.stack,
-          true,
-          2,
-          3,
+          { extraData: true },
+        );
+      });
+
+      it('logs the error when errorData is a string', () => {
+        const errInstance = new Error('An error.');
+
+        logger.error(errInstance, 'a string');
+
+        expect(errorSpy).to.be.calledOnce;
+        expect(errorSpy).to.be.calledWithMatch(
+          errInstance.stack,
+          { extraMessage: 'a string' },
         );
       });
 
       it('logs the error when errorData does not include isHandledError property', () => {
         const errInstance = new Error('An error.');
 
-        logger.error(errInstance, { httpCode: 400 }, 2, 3);
+        logger.error(errInstance, { httpCode: 400 });
 
-        expect(logSpy).to.be.calledOnce;
-        expect(logSpy).to.be.calledWith(
-          'error',
+        expect(errorSpy).to.be.calledOnce;
+        expect(errorSpy).to.be.calledWith(
           errInstance.stack,
           { httpCode: 400, fullError: errInstance },
-          2,
-          3,
         );
       });
 
@@ -119,15 +163,12 @@ describe('logger', () => {
         logger.error(errInstance, {
           isHandledError: true,
           httpCode: 502,
-        }, 2, 3);
+        });
 
-        expect(logSpy).to.be.calledOnce;
-        expect(logSpy).to.be.calledWith(
-          'error',
+        expect(errorSpy).to.be.calledOnce;
+        expect(errorSpy).to.be.calledWith(
           errInstance.stack,
           { httpCode: 502, isHandledError: true, fullError: errInstance },
-          2,
-          3,
         );
       });
 
@@ -137,15 +178,12 @@ describe('logger', () => {
         logger.error(errInstance, {
           isHandledError: true,
           httpCode: 403,
-        }, 2, 3);
+        });
 
-        expect(logSpy).to.be.calledOnce;
-        expect(logSpy).to.be.calledWith(
-          'warn',
+        expect(warnSpy).to.be.calledOnce;
+        expect(warnSpy).to.be.calledWith(
           errInstance.stack,
           { httpCode: 403, isHandledError: true, fullError: errInstance },
-          2,
-          3,
         );
       });
 
@@ -154,19 +192,16 @@ describe('logger', () => {
 
         errInstance.customField = 'Some interesting data';
 
-        logger.error(errInstance, {}, 2, 3);
+        logger.error(errInstance, {});
 
-        expect(logSpy).to.be.calledOnce;
-        expect(logSpy).to.be.calledWith(
-          'error',
+        expect(errorSpy).to.be.calledOnce;
+        expect(errorSpy).to.be.calledWith(
           errInstance.stack,
           {
             fullError: {
               customField: 'Some interesting data',
             },
           },
-          2,
-          3,
         );
       });
     });

test/api/unit/libs/payments/group-plans/group-payments-create.test.js

@@ -11,7 +11,6 @@ import { model as User } from '../../../../../../website/server/models/user';
 import { model as Group } from '../../../../../../website/server/models/group';
 import {
   generateGroup,
-  sleep,
 } from '../../../../../helpers/api-unit.helper';
 
 describe('Purchasing a group plan for group', () => {
@@ -293,7 +292,7 @@ describe('Purchasing a group plan for group', () => {
   });
 
   it('sends appropriate emails when subscribed member of group must manually cancel recurring Android subscription', async () => {
-    const TECH_ASSISTANCE_EMAIL = nconf.get('TECH_ASSISTANCE_EMAIL');
+    const TECH_ASSISTANCE_EMAIL = nconf.get('EMAILS_TECH_ASSISTANCE_EMAIL');
     plan.customerId = 'random';
     plan.paymentMethod = api.constants.GOOGLE_PAYMENT_METHOD;
 
@@ -308,26 +307,46 @@ describe('Purchasing a group plan for group', () => {
     data.groupId = group._id;
 
     await api.createSubscription(data);
-    await sleep(0.5);
 
     expect(sender.sendTxn).to.have.callCount(4);
-    expect(sender.sendTxn.args[0][0]._id).to.equal(TECH_ASSISTANCE_EMAIL);
-    expect(sender.sendTxn.args[0][1]).to.equal('admin-user-subscription-details');
-    expect(sender.sendTxn.args[1][0]._id).to.equal(recipient._id);
-    expect(sender.sendTxn.args[1][1]).to.equal('group-member-join');
-    expect(sender.sendTxn.args[1][2]).to.eql([
+    const adminUserSubscriptionDetails = sender.sendTxn.args.find(sendTxnArgs => {
+      const emailType = sendTxnArgs[1];
+      return emailType === 'admin-user-subscription-details';
+    });
+    expect(adminUserSubscriptionDetails).to.exist;
+    expect(adminUserSubscriptionDetails[0].email).to.equal(TECH_ASSISTANCE_EMAIL);
+
+    const groupMemberJoinOne = sender.sendTxn.args.find(sendTxnArgs => {
+      const emailType = sendTxnArgs[1];
+      const emailRecipient = sendTxnArgs[0];
+      return emailType === 'group-member-join' && emailRecipient._id === recipient._id;
+    });
+    expect(groupMemberJoinOne).to.exist;
+    expect(groupMemberJoinOne[0]._id).to.equal(recipient._id);
+    expect(groupMemberJoinOne[2]).to.eql([
       { name: 'LEADER', content: groupLeaderName },
       { name: 'GROUP_NAME', content: groupName },
       { name: 'PREVIOUS_SUBSCRIPTION_TYPE', content: EMAIL_TEMPLATE_SUBSCRIPTION_TYPE_GOOGLE },
     ]);
-    expect(sender.sendTxn.args[2][0]._id).to.equal(group.leader);
-    expect(sender.sendTxn.args[2][1]).to.equal('group-member-join');
-    expect(sender.sendTxn.args[3][0]._id).to.equal(group.leader);
-    expect(sender.sendTxn.args[3][1]).to.equal('group-subscription-begins');
+
+    const groupMemberJoinTwo = sender.sendTxn.args.find(sendTxnArgs => {
+      const emailType = sendTxnArgs[1];
+      const emailRecipient = sendTxnArgs[0];
+      return emailType === 'group-member-join' && emailRecipient._id === group.leader;
+    });
+    expect(groupMemberJoinTwo).to.exist;
+    expect(groupMemberJoinTwo[0]._id).to.equal(group.leader);
+
+    const groupSubscriptionBegins = sender.sendTxn.args.find(sendTxnArgs => {
+      const emailType = sendTxnArgs[1];
+      return emailType === 'group-subscription-begins';
+    });
+    expect(groupSubscriptionBegins).to.exist;
+    expect(groupSubscriptionBegins[0]._id).to.equal(group.leader);
   });
 
   it('sends appropriate emails when subscribed member of group must manually cancel recurring iOS subscription', async () => {
-    const TECH_ASSISTANCE_EMAIL = nconf.get('TECH_ASSISTANCE_EMAIL');
+    const TECH_ASSISTANCE_EMAIL = nconf.get('EMAILS_TECH_ASSISTANCE_EMAIL');
     plan.customerId = 'random';
     plan.paymentMethod = api.constants.IOS_PAYMENT_METHOD;
 
@@ -342,22 +361,43 @@ describe('Purchasing a group plan for group', () => {
     data.groupId = group._id;
 
     await api.createSubscription(data);
-    await sleep(0.5);
 
     expect(sender.sendTxn).to.have.callCount(4);
-    expect(sender.sendTxn.args[0][0]._id).to.equal(TECH_ASSISTANCE_EMAIL);
-    expect(sender.sendTxn.args[0][1]).to.equal('admin-user-subscription-details');
-    expect(sender.sendTxn.args[1][0]._id).to.equal(recipient._id);
-    expect(sender.sendTxn.args[1][1]).to.equal('group-member-join');
-    expect(sender.sendTxn.args[1][2]).to.eql([
+
+    const adminUserSubscriptionDetails = sender.sendTxn.args.find(sendTxnArgs => {
+      const emailType = sendTxnArgs[1];
+      return emailType === 'admin-user-subscription-details';
+    });
+    expect(adminUserSubscriptionDetails).to.exist;
+    expect(adminUserSubscriptionDetails[0].email).to.equal(TECH_ASSISTANCE_EMAIL);
+
+    const groupMemberJoinOne = sender.sendTxn.args.find(sendTxnArgs => {
+      const emailType = sendTxnArgs[1];
+      const emailRecipient = sendTxnArgs[0];
+      return emailType === 'group-member-join' && emailRecipient._id === recipient._id;
+    });
+    expect(groupMemberJoinOne).to.exist;
+    expect(groupMemberJoinOne[0]._id).to.equal(recipient._id);
+    expect(groupMemberJoinOne[2]).to.eql([
       { name: 'LEADER', content: groupLeaderName },
       { name: 'GROUP_NAME', content: groupName },
       { name: 'PREVIOUS_SUBSCRIPTION_TYPE', content: EMAIL_TEMPLATE_SUBSCRIPTION_TYPE_IOS },
     ]);
-    expect(sender.sendTxn.args[2][0]._id).to.equal(group.leader);
-    expect(sender.sendTxn.args[2][1]).to.equal('group-member-join');
-    expect(sender.sendTxn.args[3][0]._id).to.equal(group.leader);
-    expect(sender.sendTxn.args[3][1]).to.equal('group-subscription-begins');
+
+    const groupMemberJoinTwo = sender.sendTxn.args.find(sendTxnArgs => {
+      const emailType = sendTxnArgs[1];
+      const emailRecipient = sendTxnArgs[0];
+      return emailType === 'group-member-join' && emailRecipient._id === group.leader;
+    });
+    expect(groupMemberJoinTwo).to.exist;
+    expect(groupMemberJoinTwo[0]._id).to.equal(group.leader);
+
+    const groupSubscriptionBegins = sender.sendTxn.args.find(sendTxnArgs => {
+      const emailType = sendTxnArgs[1];
+      return emailType === 'group-subscription-begins';
+    });
+    expect(groupSubscriptionBegins).to.exist;
+    expect(groupSubscriptionBegins[0]._id).to.equal(group.leader);
   });
 
   it('adds months to members with existing gift subscription', async () => {

test/api/unit/libs/payments/stripe/calculateSubscriptionTerminationDate.test.js

@@ -0,0 +1,89 @@
+import moment from 'moment';
+import calculateSubscriptionTerminationDate from '../../../../../../website/server/libs/payments/calculateSubscriptionTerminationDate';
+import api from '../../../../../../website/server/libs/payments/payments';
+
+const groupPlanId = api.constants.GROUP_PLAN_CUSTOMER_ID;
+
+describe('#calculateSubscriptionTerminationDate', () => {
+  let plan;
+  let nextBill;
+
+  beforeEach(() => {
+    plan = {
+      customerId: 'customer-id',
+      extraMonths: 0,
+    };
+    nextBill = moment();
+  });
+
+  it('should extend date to the exact amount of days left before the next bill will occur', () => {
+    nextBill = moment()
+      .add(5, 'days');
+    const expectedTerminationDate = moment()
+      .add(5, 'days');
+
+    const terminationDate = calculateSubscriptionTerminationDate(nextBill, plan, groupPlanId);
+    expect(expectedTerminationDate.diff(terminationDate, 'days')).to.eql(0);
+  });
+
+  it('if nextBill is null, add 30 days to termination date', () => {
+    nextBill = null;
+    const expectedTerminationDate = moment()
+      .add(30, 'days');
+    const terminationDate = calculateSubscriptionTerminationDate(nextBill, plan, groupPlanId);
+
+    expect(expectedTerminationDate.diff(terminationDate, 'days')).to.eql(0);
+  });
+
+  it('if nextBill is null and it\'s a group plan, add 2 days instead of 30', () => {
+    nextBill = null;
+    plan.customerId = api.constants.GROUP_PLAN_CUSTOMER_ID;
+    const expectedTerminationDate = moment()
+      .add(2, 'days');
+
+    const terminationDate = calculateSubscriptionTerminationDate(nextBill, plan, groupPlanId);
+    expect(expectedTerminationDate.diff(terminationDate, 'days')).to.eql(0);
+  });
+
+  it('should add 30.5 days for each extraMonth', () => {
+    plan.extraMonths = 4;
+    const expectedTerminationDate = moment()
+      .add(30.5 * 4, 'days');
+
+    const terminationDate = calculateSubscriptionTerminationDate(nextBill, plan, groupPlanId);
+    expect(expectedTerminationDate.diff(terminationDate, 'days')).to.eql(0);
+  });
+
+  it('should round up if total days gained by extraMonth is a decimal number', () => {
+    plan.extraMonths = 5;
+    const expectedTerminationDate = moment()
+      .add(Math.ceil(30.5 * 5), 'days');
+
+    const terminationDate = calculateSubscriptionTerminationDate(nextBill, plan, groupPlanId);
+    expect(expectedTerminationDate.diff(terminationDate, 'days')).to.eql(0);
+  });
+
+  it('behaves like extraMonths is 0 if it\'s set to a negative number', () => {
+    plan.extraMonths = -5;
+    const expectedTerminationDate = moment();
+    const terminationDate = calculateSubscriptionTerminationDate(nextBill, plan, groupPlanId);
+    expect(expectedTerminationDate.diff(terminationDate, 'days')).to.eql(0);
+  });
+
+  it('returns current terminated date if it exists and is later than newly calculated date', () => {
+    const expectedTerminationDate = moment().add({ months: 5 }).toDate();
+    plan.dateTerminated = expectedTerminationDate;
+
+    const terminationDate = calculateSubscriptionTerminationDate(nextBill, plan, groupPlanId);
+
+    expect(terminationDate).to.equal(expectedTerminationDate);
+  });
+
+  it('returns the calculated termination date if the plan does not have one', () => {
+    nextBill = moment().add(5, 'days');
+    const expectedTerminationDate = moment().add(5, 'days');
+
+    const terminationDate = calculateSubscriptionTerminationDate(nextBill, plan, groupPlanId);
+    expect(expectedTerminationDate.diff(terminationDate, 'days')).to.eql(0);
+  });
+});

test/api/unit/libs/pushNotifications.js

@@ -1,13 +1,15 @@
-import requireAgain from 'require-again';
 import apn from 'apn/mock';
+import _ from 'lodash';
 import nconf from 'nconf';
 import gcmLib from 'node-gcm'; // works with FCM notifications too
 import { model as User } from '../../../../website/server/models/user';
+import {
+  sendNotification as sendPushNotification,
+  MAX_MESSAGE_LENGTH,
+} from '../../../../website/server/libs/pushNotifications';
 
 describe('pushNotifications', () => {
   let user;
-  let sendPushNotification;
-  const pathToPushNotifications = '../../../../website/server/libs/pushNotifications';
   let fcmSendSpy;
   let apnSendSpy;
 
@@ -28,8 +30,6 @@ describe('pushNotifications', () => {
       on: () => null,
       send: apnSendSpy,
     });
-
-    sendPushNotification = requireAgain(pathToPushNotifications).sendNotification;
   });
 
   afterEach(() => {
@@ -86,6 +86,67 @@ describe('pushNotifications', () => {
     expect(apnSendSpy).to.not.have.been.called;
   });
 
+  it('cuts the message to 300 chars', () => {
+    const longMessage = `12345 12345 12345 12345 12345 12345 12345
+      12345 12345 12345 12345 12345 12345 12345 12345 12345 12345
+      12345 12345 12345 12345 12345 12345 12345 12345 12345 12345
+      12345 12345 12345 12345 12345 12345 12345 12345 12345 12345
+      12345 12345 12345 12345 12345 12345 12345 12345 12345 12345
+      12345 12345 12345 12345 12345 12345 12345 12345 12345 12345
+      12345 12345 12345 12345 12345 12345 12345 12345 12345 12345
+      12345 12345 12345 12345 12345 12345 12345 12345 12345 12345
+      12345 12345 12345 12345 12345 12345 12345 12345 12345 12345
+      12345 12345 12345 12345 12345 12345 12345 12345 12345 12345
+      12345 12345 12345 12345 12345 12345 12345 12345 12345 12345`;
+
+    expect(longMessage.length > MAX_MESSAGE_LENGTH).to.equal(true);
+
+    const details = {
+      identifier,
+      title,
+      message: longMessage,
+      payload: {
+        message: longMessage,
+      },
+    };
+
+    sendPushNotification(user, details);
+
+    expect(details.message).to.equal(_.truncate(longMessage, { length: MAX_MESSAGE_LENGTH }));
+    expect(details.payload.message)
+      .to.equal(_.truncate(longMessage, { length: MAX_MESSAGE_LENGTH }));
+
+    expect(details.message.length).to.equal(MAX_MESSAGE_LENGTH);
+    expect(details.payload.message.length).to.equal(MAX_MESSAGE_LENGTH);
+  });
+
+  it('cuts the message to 300 chars (no payload)', () => {
+    const longMessage = `12345 12345 12345 12345 12345 12345 12345
+      12345 12345 12345 12345 12345 12345 12345 12345 12345 12345
+      12345 12345 12345 12345 12345 12345 12345 12345 12345 12345
+      12345 12345 12345 12345 12345 12345 12345 12345 12345 12345
+      12345 12345 12345 12345 12345 12345 12345 12345 12345 12345
+      12345 12345 12345 12345 12345 12345 12345 12345 12345 12345
+      12345 12345 12345 12345 12345 12345 12345 12345 12345 12345
+      12345 12345 12345 12345 12345 12345 12345 12345 12345 12345
+      12345 12345 12345 12345 12345 12345 12345 12345 12345 12345
+      12345 12345 12345 12345 12345 12345 12345 12345 12345 12345
+      12345 12345 12345 12345 12345 12345 12345 12345 12345 12345`;
+
+    expect(longMessage.length > MAX_MESSAGE_LENGTH).to.equal(true);
+
+    const details = {
+      identifier,
+      title,
+      message: longMessage,
+    };
+
+    sendPushNotification(user, details);
+
+    expect(details.message).to.equal(_.truncate(longMessage, { length: MAX_MESSAGE_LENGTH }));
+    expect(details.message.length).to.equal(MAX_MESSAGE_LENGTH);
+  });
+
   // TODO disabled because APN relies on a Promise
   xit('uses APN for iOS devices', () => {
     user.pushDevices.push({

test/api/unit/libs/stringUtils.test.js

@@ -0,0 +1,12 @@
+import { getMatchesByWordArray } from '../../../../website/server/libs/stringUtils';
+import bannedWords from '../../../../website/server/libs/bannedWords';
+
+describe('stringUtils', () => {
+  describe('getMatchesByWordArray', () => {
+    it('check all banned words are matched', async () => {
+      const message = bannedWords.join(',').replace(/\\/g, '');
+      const matches = getMatchesByWordArray(message, bannedWords);
+      expect(matches.length).to.equal(bannedWords.length);
+    });
+  });
+});

test/api/unit/libs/webhooks.test.js

@@ -1,4 +1,5 @@
 import got from 'got';
+import moment from 'moment';
 import {
   WebhookSender,
   taskScoredWebhook,
@@ -13,8 +14,9 @@ import {
 import {
   generateUser,
   defer,
+  sleep,
 } from '../../../helpers/api-unit.helper';
-
+import logger from '../../../../website/server/libs/logger';
 
 describe('webhooks', () => {
   let webhooks; let
@@ -99,8 +101,7 @@ describe('webhooks', () => {
       expect(WebhookSender.defaultTransformData).to.be.calledOnce;
       expect(got.post).to.be.calledOnce;
       expect(got.post).to.be.calledWithMatch('http://custom-url.com', {
-        json: true,
-        body,
+        json: body,
       });
     });
 
@@ -120,7 +121,7 @@ describe('webhooks', () => {
       expect(sendWebhook.attachDefaultData).to.be.calledOnce;
       expect(got.post).to.be.calledOnce;
       expect(got.post).to.be.calledWithMatch('http://custom-url.com', {
-        json: true,
+        json: body,
       });
 
       expect(body).to.eql({
@@ -151,8 +152,7 @@ describe('webhooks', () => {
       expect(WebhookSender.defaultTransformData).to.not.be.called;
       expect(got.post).to.be.calledOnce;
       expect(got.post).to.be.calledWithMatch('http://custom-url.com', {
-        json: true,
-        body: {
+        json: {
           foo: 'bar',
           baz: 'biz',
         },
@@ -269,8 +269,7 @@ describe('webhooks', () => {
 
       expect(got.post).to.be.calledOnce;
       expect(got.post).to.be.calledWithMatch('http://custom-url.com', {
-        body,
-        json: true,
+        json: body,
       });
     });
 
@@ -290,8 +289,7 @@ describe('webhooks', () => {
 
       expect(got.post).to.be.calledOnce;
       expect(got.post).to.be.calledWithMatch('http://custom-url.com', {
-        body,
-        json: true,
+        json: body,
       });
     });
 
@@ -314,12 +312,105 @@ describe('webhooks', () => {
 
       expect(got.post).to.be.calledTwice;
       expect(got.post).to.be.calledWithMatch('http://custom-url.com', {
-        body,
-        json: true,
+        json: body,
       });
       expect(got.post).to.be.calledWithMatch('http://other-url.com', {
-        body,
-        json: true,
+        json: body,
+      });
+    });
+
+    describe('failures', () => {
+      let sendWebhook;
+
+      beforeEach(async () => {
+        sandbox.restore();
+        sandbox.stub(got, 'post').returns(Promise.reject());
+
+        sendWebhook = new WebhookSender({ type: 'taskActivity' });
+        user.webhooks = [{
+          url: 'http://custom-url.com', enabled: true, type: 'taskActivity',
+        }];
+        await user.save();
+
+        expect(user.webhooks[0].failures).to.equal(0);
+        expect(user.webhooks[0].lastFailureAt).to.equal(undefined);
+      });
+
+      it('does not increase failures counter if request is successfull', async () => {
+        sandbox.restore();
+        sandbox.stub(got, 'post').returns(Promise.resolve());
+
+        const body = {};
+        sendWebhook.send(user, body);
+
+        expect(got.post).to.be.calledOnce;
+        expect(got.post).to.be.calledWithMatch('http://custom-url.com', {
+          json: body,
+        });
+
+        await sleep(0.1);
+        user = await User.findById(user._id).exec();
+
+        expect(user.webhooks[0].failures).to.equal(0);
+        expect(user.webhooks[0].lastFailureAt).to.equal(undefined);
+      });
+
+      it('records failures', async () => {
+        sinon.stub(logger, 'error');
+        const body = {};
+        sendWebhook.send(user, body);
+
+        expect(got.post).to.be.calledOnce;
+        expect(got.post).to.be.calledWithMatch('http://custom-url.com', {
+          json: body,
+        });
+
+        await sleep(0.1);
+        user = await User.findById(user._id).exec();
+
+        expect(user.webhooks[0].failures).to.equal(1);
+        expect((Date.now() - user.webhooks[0].lastFailureAt.getTime()) < 10000).to.be.true;
+
+        expect(logger.error).to.be.calledOnce;
+        logger.error.restore();
+      });
+
+      it('disables a webhook after 10 failures', async () => {
+        const times = 10;
+        for (let i = 0; i < times; i += 1) {
+          sendWebhook.send(user, {});
+          await sleep(0.1); // eslint-disable-line no-await-in-loop
+          user = await User.findById(user._id).exec(); // eslint-disable-line no-await-in-loop
+        }
+
+        expect(got.post).to.be.callCount(10);
+        expect(got.post).to.be.calledWithMatch('http://custom-url.com');
+
+        await sleep(0.1);
+        user = await User.findById(user._id).exec();
+
+        expect(user.webhooks[0].enabled).to.equal(false);
+        expect(user.webhooks[0].failures).to.equal(0);
+      });
+
+      it('resets failures after a month ', async () => {
+        const oneMonthAgo = moment().subtract(1, 'months').subtract(1, 'days').toDate();
+        user.webhooks[0].lastFailureAt = oneMonthAgo;
+        user.webhooks[0].failures = 9;
+
+        await user.save();
+
+        sendWebhook.send(user, []);
+
+        expect(got.post).to.be.calledOnce;
+        expect(got.post).to.be.calledWithMatch('http://custom-url.com');
+
+        await sleep(0.1);
+        user = await User.findById(user._id).exec();
+
+        expect(user.webhooks[0].failures).to.equal(1);
+        // Check that the stored date is whitin 10s from now
+        expect((Date.now() - user.webhooks[0].lastFailureAt.getTime()) < 10000).to.be.true;
       });
     });
   });
@@ -364,8 +455,7 @@ describe('webhooks', () => {
 
       expect(got.post).to.be.calledOnce;
       expect(got.post).to.be.calledWithMatch(webhooks[0].url, {
-        json: true,
-        body: {
+        json: {
           type: 'scored',
           webhookType: 'taskActivity',
           user: {
@@ -402,8 +492,7 @@ describe('webhooks', () => {
 
       expect(got.post).to.be.calledOnce;
       expect(got.post).to.be.calledWithMatch('http://global-activity.com', {
-        json: true,
-        body: {
+        json: {
           type: 'scored',
           webhookType: 'taskActivity',
           user: {
@@ -456,8 +545,7 @@ describe('webhooks', () => {
 
         expect(got.post).to.be.calledOnce;
         expect(got.post).to.be.calledWithMatch(webhooks[0].url, {
-          json: true,
-          body: {
+          json: {
             type,
             webhookType: 'taskActivity',
             user: {
@@ -497,8 +585,7 @@ describe('webhooks', () => {
 
         expect(got.post).to.be.calledOnce;
         expect(got.post).to.be.calledWithMatch(webhooks[0].url, {
-          json: true,
-          body: {
+          json: {
             webhookType: 'taskActivity',
             user: {
               _id: user._id,
@@ -538,8 +625,7 @@ describe('webhooks', () => {
 
         expect(got.post).to.be.calledOnce;
         expect(got.post).to.be.calledWithMatch(webhooks[2].url, {
-          json: true,
-          body: {
+          json: {
             type,
             webhookType: 'userActivity',
             user: {
@@ -585,8 +671,7 @@ describe('webhooks', () => {
 
         expect(got.post).to.be.calledOnce;
         expect(got.post).to.be.calledWithMatch(webhooks[1].url, {
-          json: true,
-          body: {
+          json: {
             type,
             webhookType: 'questActivity',
             user: {
@@ -632,8 +717,7 @@ describe('webhooks', () => {
 
       expect(got.post).to.be.calledOnce;
       expect(got.post).to.be.calledWithMatch(webhooks[webhooks.length - 1].url, {
-        json: true,
-        body: {
+        json: {
           webhookType: 'groupChatReceived',
           user: {
             _id: user._id,

test/api/unit/middlewares/analytics.test.js

@@ -19,7 +19,7 @@ describe('analytics middleware', () => {
     next = generateNext();
   });
 
-  it('attaches analytics object res.locals', () => {
+  it('attaches analytics object to res', () => {
     const attachAnalytics = requireAgain(pathToAnalyticsMiddleware).default;
 
     attachAnalytics(req, res, next);

test/api/unit/middlewares/cache.test.js

@@ -0,0 +1,31 @@
+import {
+  generateRes,
+  generateReq,
+  generateNext,
+} from '../../../helpers/api-unit.helper';
+import {
+  disableCache,
+} from '../../../../website/server/middlewares/cache';
+
+describe('cache middlewares', () => {
+  let res; let req; let
+    next;
+
+  beforeEach(() => {
+    req = generateReq();
+    res = generateRes();
+    next = generateNext();
+  });
+
+  describe('disableCache', () => {
+    it('sets the correct headers', () => {
+      disableCache(req, res, next);
+      expect(res.set).to.have.been.calledWith('Cache-Control', 'no-store');
+      expect(next).to.have.been.calledOnce;
+    });
+
+    xit('removes the etag header', () => {
+      // @TODO how to stub onHeaders
+    });
+  });
+});

test/api/unit/middlewares/cronMiddleware.js

@@ -21,28 +21,11 @@ describe('cron middleware', () => {
     req;
   let user;
 
-  beforeEach(done => {
+  beforeEach(async () => {
     res = generateRes();
     req = generateReq();
-    user = new User({
-      auth: {
-        local: {
-          username: 'username',
-          lowerCaseUsername: 'username',
-          email: 'email@email.email',
-          salt: 'salt',
-          hashed_password: 'hashed_password', // eslint-disable-line camelcase
-        },
-      },
-    });
-
-    user.save()
-      .then(savedUser => {
-        res.locals.user = savedUser;
-        res.analytics = analyticsService;
-        done();
-      })
-      .catch(done);
+    user = await res.locals.user.save();
+    res.analytics = analyticsService;
   });
 
   afterEach(() => {

test/api/unit/middlewares/errorHandler.test.js

@@ -170,6 +170,7 @@ describe('errorHandler', () => {
       originalUrl: req.originalUrl,
       headers: req.headers,
       body: req.body,
+      query: req.query,
       httpCode: 400,
       isHandledError: true,
     });

test/api/unit/middlewares/ipBlocker.test.js

@@ -0,0 +1,94 @@
+import nconf from 'nconf';
+import requireAgain from 'require-again';
+import {
+  generateRes,
+  generateReq,
+  generateNext,
+} from '../../../helpers/api-unit.helper';
+import { Forbidden } from '../../../../website/server/libs/errors';
+import apiError from '../../../../website/server/libs/apiError';
+
+function checkErrorThrown (next) {
+  expect(next).to.have.been.calledOnce;
+  const calledWith = next.getCall(0).args;
+  expect(calledWith[0].message).to.equal(apiError('ipAddressBlocked'));
+  expect(calledWith[0] instanceof Forbidden).to.equal(true);
+}
+
+function checkErrorNotThrown (next) {
+  expect(next).to.have.been.calledOnce;
+  const calledWith = next.getCall(0).args;
+  expect(typeof calledWith[0] === 'undefined').to.equal(true);
+}
+
+describe('ipBlocker middleware', () => {
+  const pathToIpBlocker = '../../../../website/server/middlewares/ipBlocker';
+
+  let res; let req; let next;
+
+  beforeEach(() => {
+    res = generateRes();
+    req = generateReq();
+    next = generateNext();
+  });
+
+  it('is disabled when the env var is not defined', () => {
+    sandbox.stub(nconf, 'get').withArgs('BLOCKED_IPS').returns(undefined);
+    const attachIpBlocker = requireAgain(pathToIpBlocker).default;
+    attachIpBlocker(req, res, next);
+
+    checkErrorNotThrown(next);
+  });
+
+  it('is disabled when the env var is an empty string', () => {
+    sandbox.stub(nconf, 'get').withArgs('BLOCKED_IPS').returns('');
+    const attachIpBlocker = requireAgain(pathToIpBlocker).default;
+    attachIpBlocker(req, res, next);
+
+    checkErrorNotThrown(next);
+  });
+
+  it('is disabled when the env var contains comma separated empty strings', () => {
+    sandbox.stub(nconf, 'get').withArgs('BLOCKED_IPS').returns(' , , ');
+    const attachIpBlocker = requireAgain(pathToIpBlocker).default;
+    attachIpBlocker(req, res, next);
+
+    checkErrorNotThrown(next);
+  });
+
+  it('does not throw when the ip does not match', () => {
+    req.headers['x-forwarded-for'] = '192.168.1.1';
+    sandbox.stub(nconf, 'get').withArgs('BLOCKED_IPS').returns('192.168.1.2');
+    const attachIpBlocker = requireAgain(pathToIpBlocker).default;
+    attachIpBlocker(req, res, next);
+
+    checkErrorNotThrown(next);
+  });
+
+  it('throws when a matching ip exist in x-forwarded-for', () => {
+    req.headers['x-forwarded-for'] = '192.168.1.1';
+    sandbox.stub(nconf, 'get').withArgs('BLOCKED_IPS').returns('192.168.1.1');
+    const attachIpBlocker = requireAgain(pathToIpBlocker).default;
+    attachIpBlocker(req, res, next);
+
+    checkErrorThrown(next);
+  });
+
+  it('trims ips in x-forwarded-for', () => {
+    req.headers['x-forwarded-for'] = '192.168.1.1';
+    sandbox.stub(nconf, 'get').withArgs('BLOCKED_IPS').returns(',  192.168.1.1 ,   192.168.1.4, ');
+    const attachIpBlocker = requireAgain(pathToIpBlocker).default;
+    attachIpBlocker(req, res, next);
+
+    checkErrorThrown(next);
+  });
+
+  it('works when multiple ips are passed in x-forwarded-for', () => {
+    req.headers['x-forwarded-for'] = '192.168.1.4';
+    sandbox.stub(nconf, 'get').withArgs('BLOCKED_IPS').returns('192.168.1.1, 192.168.1.4, 192.168.1.3');
+    const attachIpBlocker = requireAgain(pathToIpBlocker).default;
+    attachIpBlocker(req, res, next);
+
+    checkErrorThrown(next);
+  });
+});

test/api/unit/middlewares/language.test.js

@@ -12,6 +12,9 @@ import { model as User } from '../../../../website/server/models/user';
 
 const { i18n } = common;
 
+// TODO some of the checks here can be simplified to simply check
+// that the right parameters are passed to the functions in libs/language
+
 describe('language middleware', () => {
   describe('res.t', () => {
     let res; let req; let
@@ -19,6 +22,8 @@ describe('language middleware', () => {
 
     beforeEach(() => {
       res = generateRes();
+      // remove the defaul user
+      res.locals.user = undefined;
       req = generateReq();
       next = generateNext();
 
@@ -57,6 +62,8 @@ describe('language middleware', () => {
 
     beforeEach(() => {
       res = generateRes();
+      // remove the defaul user
+      res.locals.user = undefined;
       req = generateReq();
       next = generateNext();
       attachTranslateFunction(req, res, next);
@@ -88,7 +95,7 @@ describe('language middleware', () => {
           lang: 'es',
         };
 
-        req.locals = {
+        res.locals = {
           user: {
             preferences: {
               language: 'it',
@@ -108,7 +115,7 @@ describe('language middleware', () => {
 
     context('authorized request', () => {
       it('uses the user preferred language if avalaible', () => {
-        req.locals = {
+        res.locals = {
           user: {
             preferences: {
               language: 'it',
@@ -122,7 +129,7 @@ describe('language middleware', () => {
       });
 
       it('falls back to english if the user preferred language is not avalaible', done => {
-        req.locals = {
+        res.locals = {
           user: {
             preferences: {
               language: 'bla',
@@ -138,7 +145,7 @@ describe('language middleware', () => {
       });
 
       it('uses the user preferred language even if a session is included in request', () => {
-        req.locals = {
+        res.locals = {
           user: {
             preferences: {
               language: 'it',

test/api/unit/middlewares/response.js

@@ -34,7 +34,7 @@ describe('response middleware', () => {
     expect(res.json).to.be.calledWith({
       success: true,
       data: { field: 1 },
-      notifications: [],
+      notifications: res.locals.user.notifications,
       userV: res.locals.user._v,
       appVersion: packageInfo.version,
     });
@@ -52,7 +52,7 @@ describe('response middleware', () => {
       success: true,
       data: { field: 1 },
       message: 'hello',
-      notifications: [],
+      notifications: res.locals.user.notifications,
       userV: res.locals.user._v,
       appVersion: packageInfo.version,
     });
@@ -69,7 +69,7 @@ describe('response middleware', () => {
     expect(res.json).to.be.calledWith({
       success: false,
       data: { field: 1 },
-      notifications: [],
+      notifications: res.locals.user.notifications,
       userV: res.locals.user._v,
       appVersion: packageInfo.version,
     });
@@ -84,42 +84,9 @@ describe('response middleware', () => {
     expect(res.json).to.be.calledWith({
       success: true,
       data: { field: 1 },
-      notifications: [],
+      notifications: res.locals.user.notifications,
       userV: 0,
       appVersion: packageInfo.version,
     });
   });
-
-  it('returns notifications if a user is authenticated', () => {
-    const { user } = res.locals;
-
-    user.notifications = [
-      null, // invalid, not an object
-      { seen: true }, // invalid, no type or id
-      { id: 123 }, // invalid, no type
-      // invalid, no id, not included here because the id would be added automatically
-      // {type: 'ABC'},
-      { type: 'ABC', id: '123' }, // valid
-    ];
-
-    responseMiddleware(req, res, next);
-    res.respond(200, { field: 1 });
-
-    expect(res.json).to.be.calledOnce;
-
-    expect(res.json).to.be.calledWith({
-      success: true,
-      data: { field: 1 },
-      notifications: [
-        {
-          type: 'ABC',
-          id: '123',
-          data: {},
-          seen: false,
-        },
-      ],
-      userV: res.locals.user._v,
-      appVersion: packageInfo.version,
-    });
-  });
 });

test/api/unit/models/group.test.js

@@ -538,52 +538,74 @@ describe('Group Model', () => {
           });
         });
 
-        it('sends a chat message if no progress is made on quest with multiple items', async () => {
-          progress.collectedItems = 0;
-          party.quest.key = 'dilatoryDistress1';
-          party.quest.active = false;
+        describe('collection quests with multiple items', () => {
+          it('sends a chat message if no progress is made on quest with multiple items', async () => {
+            progress.collectedItems = 0;
+            party.quest.key = 'dilatoryDistress1';
+            party.quest.active = false;
 
-          await party.startQuest(questLeader);
-          Group.prototype.sendChat.resetHistory();
-          await party.save();
+            await party.startQuest(questLeader);
+            Group.prototype.sendChat.resetHistory();
+            await party.save();
 
-          await Group.processQuestProgress(participatingMember, progress);
+            await Group.processQuestProgress(participatingMember, progress);
 
-          party = await Group.findOne({ _id: party._id });
+            party = await Group.findOne({ _id: party._id });
 
-          expect(Group.prototype.sendChat).to.be.calledOnce;
-          expect(Group.prototype.sendChat).to.be.calledWith({
-            message: '`Participating Member found 0 Fire Coral, 0 Blue Fins.`',
-            info: {
-              items: { blueFins: 0, fireCoral: 0 },
-              quest: 'dilatoryDistress1',
-              type: 'user_found_items',
-              user: 'Participating Member',
-            },
+            expect(Group.prototype.sendChat).to.be.calledOnce;
+            expect(Group.prototype.sendChat).to.be.calledWith({
+              message: '`Participating Member found 0 Fire Coral, 0 Blue Fins.`',
+              info: {
+                items: { blueFins: 0, fireCoral: 0 },
+                quest: 'dilatoryDistress1',
+                type: 'user_found_items',
+                user: 'Participating Member',
+              },
+            });
           });
-        });
 
-        it('handles collection quests with multiple items', async () => {
-          progress.collectedItems = 10;
-          party.quest.key = 'evilsanta2';
-          party.quest.active = false;
+          it('handles correctly', async () => {
+            progress.collectedItems = 10;
+            party.quest.key = 'evilsanta2';
+            party.quest.active = false;
 
-          await party.startQuest(questLeader);
-          Group.prototype.sendChat.resetHistory();
-          await party.save();
+            await party.startQuest(questLeader);
+            Group.prototype.sendChat.resetHistory();
+            await party.save();
 
-          await Group.processQuestProgress(participatingMember, progress);
+            await Group.processQuestProgress(participatingMember, progress);
 
-          party = await Group.findOne({ _id: party._id });
+            party = await Group.findOne({ _id: party._id });
 
-          expect(Group.prototype.sendChat).to.be.calledOnce;
-          expect(Group.prototype.sendChat).to.be.calledWithMatch({
-            message: sinon.match(/`Participating Member found/).and(sinon.match(/\d* (Tracks|Broken Twigs)/)),
-            info: {
-              quest: 'evilsanta2',
-              type: 'user_found_items',
-              user: 'Participating Member',
-            },
+            expect(Group.prototype.sendChat).to.be.calledOnce;
+            expect(Group.prototype.sendChat).to.be.calledWithMatch({
+              message: sinon.match(/`Participating Member found/).and(sinon.match(/\d* (Tracks|Broken Twigs)/)),
+              info: {
+                quest: 'evilsanta2',
+                type: 'user_found_items',
+                user: 'Participating Member',
+              },
+            });
+          });
+
+          it('cannot collect excess items', async () => {
+            // Make sure the quest progress isn't erased
+            sandbox.stub(Group.prototype, 'finishQuest').returns(Promise.resolve());
+
+            progress.collectedItems = 500;
+            party.quest.key = 'evilsanta2';
+            party.quest.active = false;
+
+            await party.startQuest(questLeader);
+            await party.save();
+
+            await Group.processQuestProgress(participatingMember, progress);
+            party = await Group.findOne({ _id: party._id });
+
+            expect(party.quest.progress.collect.tracks)
+              .to.eql(questScrolls.evilsanta2.collect.tracks.count);
+            expect(party.quest.progress.collect.branches)
+              .to.eql(questScrolls.evilsanta2.collect.branches.count);
           });
         });
 
@@ -2380,29 +2402,29 @@ describe('Group Model', () => {
       });
     });
 
-    context('isSubscribed', () => {
+    context('hasActiveGroupPlan', () => {
       it('returns false if group does not have customer id', () => {
-        expect(party.isSubscribed()).to.be.undefined;
+        expect(party.hasActiveGroupPlan()).to.be.undefined;
       });
 
       it('returns true if group does not have plan.dateTerminated', () => {
         party.purchased.plan.customerId = 'test-id';
 
-        expect(party.isSubscribed()).to.be.true;
+        expect(party.hasActiveGroupPlan()).to.be.true;
       });
 
       it('returns true if group if plan.dateTerminated is after today', () => {
         party.purchased.plan.customerId = 'test-id';
         party.purchased.plan.dateTerminated = moment().add(1, 'days').toDate();
 
-        expect(party.isSubscribed()).to.be.true;
+        expect(party.hasActiveGroupPlan()).to.be.true;
       });
 
       it('returns false if group if plan.dateTerminated is before today', () => {
         party.purchased.plan.customerId = 'test-id';
         party.purchased.plan.dateTerminated = moment().subtract(1, 'days').toDate();
 
-        expect(party.isSubscribed()).to.be.false;
+        expect(party.hasActiveGroupPlan()).to.be.false;
       });
     });
 

test/api/unit/models/message.test.js

@@ -0,0 +1,18 @@
+import { sanitizeText } from '../../../../website/server/models/message';
+import { MAX_MESSAGE_LENGTH } from '../../../../website/common/script/constants';
+
+describe('Message Model', () => {
+  context('sanitizeText', () => {
+    it('trims messages to the max length', () => {
+      const veryLongMessage = `
+      123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789.
+      THIS PART WON'T BE IN THE MESSAGE (over 3000)
+      `;
+      expect(veryLongMessage.length > MAX_MESSAGE_LENGTH).to.equal(true);
+
+      const sanitizedText = sanitizeText(veryLongMessage);
+      expect(sanitizedText).to.not.contain('MESSAGE');
+      expect(sanitizedText.length).to.equal(MAX_MESSAGE_LENGTH);
+    });
+  });
+});

test/api/unit/models/pushDevice.test.js

@@ -0,0 +1,33 @@
+import { model as PushDevice } from '../../../../website/server/models/pushDevice';
+
+describe('PushDevice Model', () => {
+  context('cleanupCorruptData', () => {
+    it('converts an array of push devices to a safe version', () => {
+      const pushDevices = [
+        null, // invalid, not an object
+        { regId: '123' }, // invalid, no type
+        { type: 'android' }, // invalid, no regId
+        new PushDevice({ type: 'android', regId: '1234' }), // valid
+      ];
+
+      const safePushDevices = PushDevice.cleanupCorruptData(pushDevices);
+      expect(safePushDevices.length).to.equal(1);
+      expect(safePushDevices[0].type).to.equal('android');
+      expect(safePushDevices[0].regId).to.equal('1234');
+    });
+
+    it('removes duplicates', () => {
+      const pushDevices = [
+        new PushDevice({ type: 'android', regId: '1234' }),
+        new PushDevice({ type: 'android', regId: '1234' }),
+        new PushDevice({ type: 'iphone', regId: '1234' }), // not duplicate
+        new PushDevice({ type: 'android', regId: '12345' }), // not duplicate
+      ];
+
+      const safePushDevices = PushDevice.cleanupCorruptData(pushDevices);
+      expect(safePushDevices.length).to.equal(3);
+      expect(safePushDevices[0].type).to.equal('android');
+      expect(safePushDevices[0].regId).to.equal('1234');
+    });
+  });
+});

test/api/unit/models/tag.test.js

@@ -0,0 +1,19 @@
+import { model as Tag } from '../../../../website/server/models/tag';
+
+describe('Tag Model', () => {
+  context('cleanupCorruptData', () => {
+    it('converts an array of tags to a safe version', () => {
+      const tags = [
+        null, // invalid, not an object
+        { name: '123' }, // invalid, no id
+        { id: '123' }, // invalid, no name
+        new Tag({ name: 'ABC', id: 123 }), // valid
+      ];
+
+      const safetags = Tag.cleanupCorruptData(tags);
+      expect(safetags.length).to.equal(1);
+      expect(safetags[0].name).to.equal('ABC');
+      expect(safetags[0].id).to.equal('123');
+    });
+  });
+});

test/api/unit/models/user.test.js

@@ -181,6 +181,146 @@ describe('User Model', () => {
     });
   });
 
+  context('post init', () => {
+    it('removes invalid tags when loading the user', async () => {
+      let user = new User();
+      await user.save();
+      await user.update({
+        $set: {
+          tags: [
+            null, // invalid, not an object
+            // { name: '123' }, // invalid, no id - generated automatically
+            { id: '123' }, // invalid, no name
+            { name: 'ABC', id: '1234' }, // valid
+          ],
+        },
+      }).exec();
+
+      user = await User.findById(user._id).exec();
+
+      const userToJSON = user.toJSON();
+      expect(userToJSON.tags.length).to.equal(1);
+
+      expect(userToJSON.tags[0]).to.have.all.keys(['id', 'name']);
+      expect(userToJSON.tags[0].id).to.equal('1234');
+      expect(userToJSON.tags[0].name).to.equal('ABC');
+    });
+
+    it('removes invalid push devices when loading the user', async () => {
+      let user = new User();
+      await user.save();
+      await user.update({
+        $set: {
+          pushDevices: [
+            null, // invalid, not an object
+            { regId: '123' }, // invalid, no type
+            { type: 'android' }, // invalid, no regId
+            { type: 'android', regId: '1234' }, // valid
+          ],
+        },
+      }).exec();
+
+      user = await User.findById(user._id).exec();
+
+      const userToJSON = user.toJSON();
+      expect(userToJSON.pushDevices.length).to.equal(1);
+
+      expect(userToJSON.pushDevices[0]).to.have.all.keys(['regId', 'type', 'createdAt', 'updatedAt']);
+      expect(userToJSON.pushDevices[0].type).to.equal('android');
+      expect(userToJSON.pushDevices[0].regId).to.equal('1234');
+    });
+
+    it('removes duplicate push devices when loading the user', async () => {
+      let user = new User();
+      await user.save();
+      await user.update({
+        $set: {
+          pushDevices: [
+            { type: 'android', regId: '1234' },
+            { type: 'android', regId: '1234' },
+          ],
+        },
+      }).exec();
+
+      user = await User.findById(user._id).exec();
+
+      const userToJSON = user.toJSON();
+      expect(userToJSON.pushDevices.length).to.equal(1);
+
+      expect(userToJSON.pushDevices[0]).to.have.all.keys(['regId', 'type', 'createdAt', 'updatedAt']);
+      expect(userToJSON.pushDevices[0].type).to.equal('android');
+      expect(userToJSON.pushDevices[0].regId).to.equal('1234');
+    });
+
+    it('removes invalid notifications when loading the user', async () => {
+      let user = new User();
+      await user.save();
+      await user.update({
+        $set: {
+          notifications: [
+            null, // invalid, not an object
+            { seen: true }, // invalid, no type or id
+            { id: 123 }, // invalid, no type
+            // invalid, no id, not included here because the id would be added automatically
+            // {type: 'ABC'},
+            { type: 'ABC', id: '123' }, // valid
+          ],
+        },
+      }).exec();
+
+      user = await User.findById(user._id).exec();
+
+      const userToJSON = user.toJSON();
+      expect(userToJSON.notifications.length).to.equal(1);
+
+      expect(userToJSON.notifications[0]).to.have.all.keys(['data', 'id', 'type', 'seen']);
+      expect(userToJSON.notifications[0].type).to.equal('ABC');
+      expect(userToJSON.notifications[0].id).to.equal('123');
+    });
+
+    it('removes multiple NEW_CHAT_MESSAGE for the same group', async () => {
+      let user = new User();
+      await user.save();
+      await user.update({
+        $set: {
+          notifications: [
+            {
+              type: 'NEW_CHAT_MESSAGE',
+              id: 123,
+              data: { group: { id: 12345 } },
+            },
+            {
+              type: 'NEW_CHAT_MESSAGE',
+              id: 1234,
+              data: { group: { id: 12345 } },
+            },
+            {
+              type: 'NEW_CHAT_MESSAGE',
+              id: 123,
+              data: { group: { id: 123456 } },
+            }, // not duplicate, different group
+            {
+              type: 'NEW_CHAT_MESSAGE_DIFF',
+              id: 123,
+              data: { group: { id: 12345 } },
+            }, // not duplicate, different type
+          ],
+        },
+      }).exec();
+
+      user = await User.findById(user._id).exec();
+
+      const userToJSON = user.toJSON();
+      expect(userToJSON.notifications.length).to.equal(3);
+
+      expect(userToJSON.notifications[0]).to.have.all.keys(['data', 'id', 'type', 'seen']);
+      expect(userToJSON.notifications[0].type).to.equal('NEW_CHAT_MESSAGE');
+      expect(userToJSON.notifications[0].id).to.equal('123');
+      expect(userToJSON.notifications[0].data).to.deep.equal({ group: { id: 12345 } });
+      expect(userToJSON.notifications[0].seen).to.equal(false);
+    });
+  });
+
   context('notifications', () => {
     it('can add notifications without data', () => {
       const user = new User();
@@ -195,26 +335,6 @@ describe('User Model', () => {
       expect(userToJSON.notifications[0].seen).to.eql(false);
     });
 
-    it('removes invalid notifications when calling toJSON', () => {
-      const user = new User();
-
-      user.notifications = [
-        null, // invalid, not an object
-        { seen: true }, // invalid, no type or id
-        { id: 123 }, // invalid, no type
-        // invalid, no id, not included here because the id would be added automatically
-        // {type: 'ABC'},
-        { type: 'ABC', id: '123' }, // valid
-      ];
-
-      const userToJSON = user.toJSON();
-      expect(userToJSON.notifications.length).to.equal(1);
-
-      expect(userToJSON.notifications[0]).to.have.all.keys(['data', 'id', 'type', 'seen']);
-      expect(userToJSON.notifications[0].type).to.equal('ABC');
-      expect(userToJSON.notifications[0].id).to.equal('123');
-    });
-
     it('can add notifications with data and already marked as seen', () => {
       const user = new User();
 

test/api/unit/models/userNotification.test.js

@@ -1,7 +1,7 @@
 import { model as UserNotification } from '../../../../website/server/models/userNotification';
 
 describe('UserNotification Model', () => {
-  context('convertNotificationsToSafeJson', () => {
+  context('cleanupCorruptData', () => {
     it('converts an array of notifications to a safe version', () => {
       const notifications = [
         null, // invalid, not an object
@@ -11,11 +11,44 @@ describe('UserNotification Model', () => {
         new UserNotification({ type: 'ABC', id: 123 }), // valid
       ];
 
-      const notificationsToJSON = UserNotification.convertNotificationsToSafeJson(notifications);
-      expect(notificationsToJSON.length).to.equal(1);
-      expect(notificationsToJSON[0]).to.have.all.keys(['data', 'id', 'type', 'seen']);
-      expect(notificationsToJSON[0].type).to.equal('ABC');
-      expect(notificationsToJSON[0].id).to.equal('123');
+      const safeNotifications = UserNotification.cleanupCorruptData(notifications);
+      expect(safeNotifications.length).to.equal(1);
+      expect(safeNotifications[0].data).to.deep.equal({});
+      expect(safeNotifications[0].seen).to.equal(false);
+      expect(safeNotifications[0].type).to.equal('ABC');
+      expect(safeNotifications[0].id).to.equal('123');
+    });
+
+    it('removes multiple NEW_CHAT_MESSAGE for the same group', () => {
+      const notifications = [
+        new UserNotification({
+          type: 'NEW_CHAT_MESSAGE',
+          id: 123,
+          data: { group: { id: 12345 } },
+        }),
+        new UserNotification({
+          type: 'NEW_CHAT_MESSAGE',
+          id: 1234,
+          data: { group: { id: 12345 } },
+        }),
+        new UserNotification({
+          type: 'NEW_CHAT_MESSAGE',
+          id: 123,
+          data: { group: { id: 123456 } },
+        }), // not duplicate, different group
+        new UserNotification({
+          type: 'NEW_CHAT_MESSAGE_DIFF',
+          id: 123,
+          data: { group: { id: 12345 } },
+        }), // not duplicate, different type
+      ];
+
+      const safeNotifications = UserNotification.cleanupCorruptData(notifications);
+      expect(safeNotifications.length).to.equal(3);
+      expect(safeNotifications[0].data).to.deep.equal({ group: { id: 12345 } });
+      expect(safeNotifications[0].seen).to.equal(false);
+      expect(safeNotifications[0].type).to.equal('NEW_CHAT_MESSAGE');
+      expect(safeNotifications[0].id).to.equal('123');
     });
   });
 });

test/api/v3/integration/challenges/GET-challenges_group_groupid.test.js

@@ -187,8 +187,7 @@ describe('GET challenges/groups/:groupId', () => {
   });
 
   context('official challenge is present', () => {
-    let publicGuild; let user; let officialChallenge; let challenge; let
-      challenge2;
+    let publicGuild; let user; let officialChallenge; let unofficialChallenges;
 
     before(async () => {
       const { group, groupLeader } = await createAndPopulateGroup({
@@ -214,10 +213,14 @@ describe('GET challenges/groups/:groupId', () => {
       });
       await user.post(`/challenges/${officialChallenge._id}/join`);
 
-      challenge = await generateChallenge(user, group);
-      await user.post(`/challenges/${challenge._id}/join`);
-      challenge2 = await generateChallenge(user, group);
-      await user.post(`/challenges/${challenge2._id}/join`);
+      // We add 10 extra challenges to test whether the official challenge
+      // (the oldest) makes it to the front page.
+      unofficialChallenges = [];
+      for (let i = 0; i < 10; i += 1) {
+        const challenge = await generateChallenge(user, group); // eslint-disable-line
+        await user.post(`/challenges/${challenge._id}/join`); // eslint-disable-line
+        unofficialChallenges.push(challenge);
+      }
     });
 
     it('should return official challenges first', async () => {
@@ -230,18 +233,17 @@ describe('GET challenges/groups/:groupId', () => {
     it('should return newest challenges first, after official ones', async () => {
       let challenges = await user.get(`/challenges/groups/${publicGuild._id}`);
 
-      let foundChallengeIndex = _.findIndex(challenges, { _id: challenge._id });
-      expect(foundChallengeIndex).to.eql(2);
-
-      foundChallengeIndex = _.findIndex(challenges, { _id: challenge2._id });
-      expect(foundChallengeIndex).to.eql(1);
+      unofficialChallenges.forEach((chal, index) => {
+        const foundChallengeIndex = _.findIndex(challenges, { _id: chal._id });
+        expect(foundChallengeIndex).to.eql(10 - index);
+      });
 
       const newChallenge = await generateChallenge(user, publicGuild);
       await user.post(`/challenges/${newChallenge._id}/join`);
 
       challenges = await user.get(`/challenges/groups/${publicGuild._id}`);
 
-      foundChallengeIndex = _.findIndex(challenges, { _id: newChallenge._id });
+      const foundChallengeIndex = _.findIndex(challenges, { _id: newChallenge._id });
       expect(foundChallengeIndex).to.eql(1);
     });
   });

test/api/v3/integration/challenges/GET-challenges_user.test.js

@@ -242,7 +242,7 @@ describe('GET challenges/user', () => {
   });
 
   context('official challenge is present', () => {
-    let user; let officialChallenge; let challenge; let challenge2; let
+    let user; let officialChallenge; let unofficialChallenges; let
       publicGuild;
 
     before(async () => {
@@ -270,10 +270,14 @@ describe('GET challenges/user', () => {
       });
       await user.post(`/challenges/${officialChallenge._id}/join`);
 
-      challenge = await generateChallenge(user, group);
-      await user.post(`/challenges/${challenge._id}/join`);
-      challenge2 = await generateChallenge(user, group);
-      await user.post(`/challenges/${challenge2._id}/join`);
+      // We add 10 extra challenges to test whether the official challenge
+      // (the oldest) makes it to the front page.
+      unofficialChallenges = [];
+      for (let i = 0; i < 10; i += 1) {
+        const challenge = await generateChallenge(user, group); // eslint-disable-line
+        await user.post(`/challenges/${challenge._id}/join`); // eslint-disable-line
+        unofficialChallenges.push(challenge);
+      }
     });
 
     it('should return official challenges first', async () => {
@@ -284,20 +288,23 @@ describe('GET challenges/user', () => {
     });
 
     it('should return newest challenges first, after official ones', async () => {
-      let challenges = await user.get('/challenges/user');
+      let challenges = await user.get('/challenges/user?page=0');
 
-      let foundChallengeIndex = _.findIndex(challenges, { _id: challenge._id });
-      expect(foundChallengeIndex).to.eql(2);
-
-      foundChallengeIndex = _.findIndex(challenges, { _id: challenge2._id });
-      expect(foundChallengeIndex).to.eql(1);
+      unofficialChallenges.forEach((chal, index) => {
+        const foundChallengeIndex = _.findIndex(challenges, { _id: chal._id });
+        if (index === 0) {
+          expect(foundChallengeIndex).to.eql(-1);
+        } else {
+          expect(foundChallengeIndex).to.eql(10 - index);
+        }
+      });
 
       const newChallenge = await generateChallenge(user, publicGuild);
       await user.post(`/challenges/${newChallenge._id}/join`);
 
       challenges = await user.get('/challenges/user');
 
-      foundChallengeIndex = _.findIndex(challenges, { _id: newChallenge._id });
+      const foundChallengeIndex = _.findIndex(challenges, { _id: newChallenge._id });
       expect(foundChallengeIndex).to.eql(1);
     });
   });

test/api/v3/integration/chat/POST-chat.test.js

@@ -13,9 +13,7 @@ import {
   SPAM_MIN_EXEMPT_CONTRIB_LEVEL,
   TAVERN_ID,
 } from '../../../../../website/server/models/group';
-import { CHAT_FLAG_FROM_SHADOW_MUTE } from '../../../../../website/common/script/constants';
-import { getMatchesByWordArray } from '../../../../../website/server/libs/stringUtils';
-import bannedWords from '../../../../../website/server/libs/bannedWords';
+import { CHAT_FLAG_FROM_SHADOW_MUTE, MAX_MESSAGE_LENGTH } from '../../../../../website/common/script/constants';
 import guildsAllowingBannedWords from '../../../../../website/server/libs/guildsAllowingBannedWords';
 import * as email from '../../../../../website/server/libs/email';
 
@@ -292,12 +290,6 @@ describe('POST /chat', () => {
         .that.includes(testBannedWords.join(', '));
     });
 
-    it('check all banned words are matched', async () => {
-      const message = bannedWords.join(',').replace(/\\/g, '');
-      const matches = getMatchesByWordArray(message, bannedWords);
-      expect(matches.length).to.equal(bannedWords.length);
-    });
-
     it('does not error when bad word is suffix of a word', async () => {
       const wordAsSuffix = `prefix${testBannedWordMessage}`;
       const message = await user.post('/groups/habitrpg/chat', { message: wordAsSuffix });
@@ -494,6 +486,7 @@ describe('POST /chat', () => {
     123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789.
     THIS PART WON'T BE IN THE MESSAGE (over 3000)
     `;
+    expect(veryLongMessage.length > MAX_MESSAGE_LENGTH).to.equal(true);
 
     const newMessage = await user.post(`/groups/${groupWithChat._id}/chat`, { message: veryLongMessage });
     const groupMessages = await user.get(`/groups/${groupWithChat._id}/chat`);
@@ -501,9 +494,27 @@ describe('POST /chat', () => {
     expect(newMessage.message.id).to.exist;
     expect(groupMessages[0].id).to.exist;
 
-    expect(newMessage.message.text.length).to.eql(3000);
+    expect(newMessage.message.text.length).to.eql(MAX_MESSAGE_LENGTH);
     expect(newMessage.message.text).to.not.contain('MESSAGE');
-    expect(groupMessages[0].text.length).to.eql(3000);
+    expect(groupMessages[0].text.length).to.eql(MAX_MESSAGE_LENGTH);
+  });
+
+  it('chat message with mentions - mention link should not count towards 3000 chars limit', async () => {
+    const memberUsername = 'memberUsername';
+    await member.update({ 'auth.local.username': memberUsername });
+
+    const messageWithMentions = `hi @${memberUsername} 123456789 
+    123456789 123456789 123456789 123456789 123456789 123456789 89 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 12345678 END.`;
+    expect(messageWithMentions.length).to.equal(MAX_MESSAGE_LENGTH);
+    const newMessage = await user.post(`/groups/${groupWithChat._id}/chat`, { message: messageWithMentions });
+    const groupMessages = await user.get(`/groups/${groupWithChat._id}/chat`);
+
+    const mentionLink = `[@${memberUsername}](/profile/${member._id})`;
+    expect(newMessage.message.text).to.include(mentionLink);
+    expect(newMessage.message.text).to.include(' END.');
+    expect(newMessage.message.text.length)
+      .to.eql(messageWithMentions.length - (`@${memberUsername}`).length + mentionLink.length);
+    expect(groupMessages[0].text.length).to.eql(newMessage.message.text.length);
   });
 
   it('creates a chat with user styles', async () => {

test/api/v3/integration/groups/GET-groups.test.js

@@ -11,7 +11,9 @@ import apiError from '../../../../../website/server/libs/apiError';
 
 describe('GET /groups', () => {
   let user;
+  let userInGuild;
   const NUMBER_OF_PUBLIC_GUILDS = 3; // 2 + the tavern
+  const NUMBER_OF_PUBLIC_GUILDS_USER_IS_LEADER = 2;
   const NUMBER_OF_PUBLIC_GUILDS_USER_IS_MEMBER = 1;
   const NUMBER_OF_USERS_PRIVATE_GUILDS = 1;
   const NUMBER_OF_GROUPS_USER_CAN_VIEW = 5;
@@ -33,14 +35,20 @@ describe('GET /groups', () => {
       name: 'public guild - is member',
       type: 'guild',
       privacy: 'public',
+      summary: 'ohayou kombonwa',
+      description: 'oyasumi',
     });
     await leader.post(`/groups/${publicGuildUserIsMemberOf._id}/invite`, { uuids: [user._id] });
     await user.post(`/groups/${publicGuildUserIsMemberOf._id}/join`);
 
+    userInGuild = await generateUser({ guilds: [publicGuildUserIsMemberOf._id] });
+
     publicGuildNotMember = await generateGroup(leader, {
       name: 'public guild - is not member',
       type: 'guild',
       privacy: 'public',
+      summary: 'Natsume Soseki',
+      description: 'Kinnosuke no Hondana',
       categories,
     });
 
@@ -150,6 +158,35 @@ describe('GET /groups', () => {
 
       expect(guilds.length).to.equal(0);
     });
+
+    it('filters public guilds by leader role', async () => {
+      const guilds = await user.get('/groups?type=publicGuilds&leader=true');
+      expect(guilds.length).to.equal(NUMBER_OF_PUBLIC_GUILDS_USER_IS_LEADER);
+    });
+
+    it('filters public guilds by member role', async () => {
+      const guilds = await userInGuild.get('/groups?type=publicGuilds&member=true');
+      expect(guilds.length).to.equal(1);
+      expect(guilds[0].name).to.have.string('is member');
+    });
+
+    it('filters public guilds by single-word search term', async () => {
+      const guilds = await user.get('/groups?type=publicGuilds&search=kom');
+      expect(guilds.length).to.equal(1);
+      expect(guilds[0].summary).to.have.string('ohayou kombonwa');
+    });
+
+    it('filters public guilds by single-word search term left and right-padded by spaces', async () => {
+      const guilds = await user.get('/groups?type=publicGuilds&search=++++ohayou+kombonwa+++++');
+      expect(guilds.length).to.equal(1);
+      expect(guilds[0].summary).to.have.string('ohayou kombonwa');
+    });
+
+    it('filters public guilds by two-words search term separated by multiple spaces', async () => {
+      const guilds = await user.get('/groups?type=publicGuilds&search=kinnosuke+++++hon');
+      expect(guilds.length).to.equal(1);
+      expect(guilds[0].description).to.have.string('Kinnosuke');
+    });
   });
 
   describe('public guilds pagination', () => {

test/api/v3/integration/groups/POST-groups_groupId_leave.test.js

@@ -1,7 +1,6 @@
 import { v4 as generateUUID } from 'uuid';
-import {
-  each,
-} from 'lodash';
+import each from 'lodash/each';
+import moment from 'moment';
 import {
   generateChallenge,
   checkExistence,
@@ -12,6 +11,7 @@ import {
 } from '../../../../helpers/api-integration/v3';
 import { model as User } from '../../../../../website/server/models/user';
 import payments from '../../../../../website/server/libs/payments/payments';
+import calculateSubscriptionTerminationDate from '../../../../../website/server/libs/payments/calculateSubscriptionTerminationDate';
 
 describe('POST /groups/:groupId/leave', () => {
   const typesOfGroups = {
@@ -338,4 +338,49 @@ describe('POST /groups/:groupId/leave', () => {
       });
     });
   });
+
+  each(typesOfGroups, (groupDetails, groupType) => {
+    context(`Leaving a group with extraMonths left plan when the group is a ${groupType}`, () => {
+      const extraMonths = 12;
+      let groupWithPlan;
+      let member;
+
+      beforeEach(async () => {
+        const { group, members } = await createAndPopulateGroup({
+          groupDetails,
+          members: 1,
+          upgradeToGroupPlan: true,
+        });
+        [member] = members;
+        groupWithPlan = group;
+        await member.update({
+          'purchased.plan.extraMonths': extraMonths,
+        });
+      });
+
+      it('calculates dateTerminated and sets extraMonths to zero after user leaves the group', async () => {
+        const userBeforeLeave = await User.findById(member._id).exec();
+
+        await member.post(`/groups/${groupWithPlan._id}/leave`);
+        const userAfterLeave = await User.findById(member._id).exec();
+
+        const dateTerminatedBefore = userBeforeLeave.purchased.plan.dateTerminated;
+        const extraMonthsBefore = userBeforeLeave.purchased.plan.extraMonths;
+        const dateTerminatedAfter = userAfterLeave.purchased.plan.dateTerminated;
+        const extraMonthsAfter = userAfterLeave.purchased.plan.extraMonths;
+
+        const expectedTerminationDate = calculateSubscriptionTerminationDate(null, {
+          customerId: payments.constants.GROUP_PLAN_CUSTOMER_ID,
+          extraMonths,
+        }, payments.constants.GROUP_PLAN_CUSTOMER_ID);
+
+        expect(extraMonthsBefore).to.gte(12);
+        expect(extraMonthsAfter).to.equal(0);
+        expect(dateTerminatedBefore).to.be.null;
+        expect(dateTerminatedAfter).to.exist;
+
+        expect(moment(dateTerminatedAfter).diff(expectedTerminationDate, 'days')).to.equal(0);
+      });
+    });
+  });
 });

test/api/v3/integration/hall/GET-hall_heroes.test.js

@@ -10,6 +10,9 @@ describe('GET /hall/heroes', () => {
     const nonHero = await generateUser();
     const hero1 = await generateUser({
       contributor: { level: 1 },
+      secret: {
+        text: 'Super-Hero',
+      },
     });
     const hero2 = await generateUser({
       contributor: { level: 3 },
@@ -21,6 +24,8 @@ describe('GET /hall/heroes', () => {
     expect(heroes[1]._id).to.equal(hero1._id);
 
     expect(heroes[0]).to.have.all.keys(['_id', 'contributor', 'backer', 'profile']);
+
+    // should not contain the secret
     expect(heroes[1]).to.have.all.keys(['_id', 'contributor', 'backer', 'profile']);
 
     expect(heroes[0].profile).to.have.all.keys(['name']);
@@ -28,5 +33,6 @@ describe('GET /hall/heroes', () => {
 
     expect(heroes[0].profile.name).to.equal(hero2.profile.name);
     expect(heroes[1].profile.name).to.equal(hero1.profile.name);
+    expect(heroes[1].secret).to.equal(undefined);
   });
 });

test/api/v3/integration/hall/GET-hall_heroes_heroId.test.js

@@ -43,15 +43,19 @@ describe('GET /heroes/:heroId', () => {
   it('returns only necessary hero data given user id', async () => {
     const hero = await generateUser({
       contributor: { tier: 23 },
+      secret: {
+        text: 'Super Hero',
+      },
     });
     const heroRes = await user.get(`/hall/heroes/${hero._id}`);
 
     expect(heroRes).to.have.all.keys([ // works as: object has all and only these keys
       '_id', 'id', 'balance', 'profile', 'purchased',
-      'contributor', 'auth', 'items',
+      'contributor', 'auth', 'items', 'secret',
     ]);
     expect(heroRes.auth.local).not.to.have.keys(['salt', 'hashed_password']);
     expect(heroRes.profile).to.have.all.keys(['name']);
+    expect(heroRes.secret.text).to.be.eq('Super Hero');
   });
 
   it('returns only necessary hero data given username', async () => {
@@ -62,7 +66,7 @@ describe('GET /heroes/:heroId', () => {
 
     expect(heroRes).to.have.all.keys([ // works as: object has all and only these keys
       '_id', 'id', 'balance', 'profile', 'purchased',
-      'contributor', 'auth', 'items',
+      'contributor', 'auth', 'items', 'secret',
     ]);
     expect(heroRes.auth.local).not.to.have.keys(['salt', 'hashed_password']);
     expect(heroRes.profile).to.have.all.keys(['name']);

test/api/v3/integration/hall/PUT-hall_heores_heroId.test.js

@@ -7,6 +7,12 @@ import {
 describe('PUT /heroes/:heroId', () => {
   let user;
 
+  const heroFields = [
+    '_id', 'balance', 'profile', 'purchased',
+    'contributor', 'auth', 'items', 'flags',
+    'secret',
+  ];
+
   before(async () => {
     user = await generateUser({
       contributor: { admin: true },
@@ -51,10 +57,8 @@ describe('PUT /heroes/:heroId', () => {
     });
 
     // test response
-    expect(heroRes).to.have.all.keys([ // works as: object has all and only these keys
-      '_id', 'balance', 'profile', 'purchased',
-      'contributor', 'auth', 'items', 'flags',
-    ]);
+    // works as: object has all and only these keys
+    expect(heroRes).to.have.all.keys(heroFields);
     expect(heroRes.auth.local).not.to.have.keys(['salt', 'hashed_password']);
     expect(heroRes.profile).to.have.all.keys(['name']);
 
@@ -130,10 +134,8 @@ describe('PUT /heroes/:heroId', () => {
     });
 
     // test response
-    expect(heroRes).to.have.all.keys([ // works as: object has all and only these keys
-      '_id', 'balance', 'profile', 'purchased',
-      'contributor', 'auth', 'items', 'flags',
-    ]);
+    // works as: object has all and only these keys
+    expect(heroRes).to.have.all.keys(heroFields);
     expect(heroRes.auth.local).not.to.have.keys(['salt', 'hashed_password']);
     expect(heroRes.profile).to.have.all.keys(['name']);
 
@@ -157,10 +159,8 @@ describe('PUT /heroes/:heroId', () => {
     });
 
     // test response
-    expect(heroRes).to.have.all.keys([ // works as: object has all and only these keys
-      '_id', 'balance', 'profile', 'purchased',
-      'contributor', 'auth', 'items', 'flags',
-    ]);
+    // works as: object has all and only these keys
+    expect(heroRes).to.have.all.keys(heroFields);
     expect(heroRes.auth.local).not.to.have.keys(['salt', 'hashed_password']);
     expect(heroRes.profile).to.have.all.keys(['name']);
 
@@ -173,6 +173,40 @@ describe('PUT /heroes/:heroId', () => {
     expect(hero.contributor.text).to.equal('Astronaut');
   });
 
+  it('updates contributor secret', async () => {
+    const secretText = 'my super hero';
+
+    const hero = await generateUser({
+      contributor: { level: 5 },
+      secret: {
+        text: 'supr hro typo',
+      },
+    });
+    const heroRes = await user.put(`/hall/heroes/${hero._id}`, {
+      contributor: { text: 'Astronaut' },
+      secret: {
+        text: secretText,
+      },
+    });
+
+    // test response
+    // works as: object has all and only these keys
+    expect(heroRes).to.have.all.keys(heroFields);
+    expect(heroRes.auth.local).not.to.have.keys(['salt', 'hashed_password']);
+    expect(heroRes.profile).to.have.all.keys(['name']);
+
+    // test response values
+    expect(heroRes.contributor.level).to.equal(5); // doesn't modify previous values
+    expect(heroRes.contributor.text).to.equal('Astronaut');
+    expect(heroRes.secret.text).to.equal(secretText);
+
+    // test hero values
+    await hero.sync();
+    expect(hero.contributor.level).to.equal(5); // doesn't modify previous values
+    expect(hero.contributor.text).to.equal('Astronaut');
+    expect(hero.secret.text).to.equal(secretText);
+  });
+
   it('updates items', async () => {
     const hero = await generateUser();
     const heroRes = await user.put(`/hall/heroes/${hero._id}`, {
@@ -181,10 +215,8 @@ describe('PUT /heroes/:heroId', () => {
     });
 
     // test response
-    expect(heroRes).to.have.all.keys([ // works as: object has all and only these keys
-      '_id', 'balance', 'profile', 'purchased',
-      'contributor', 'auth', 'items', 'flags',
-    ]);
+    // works as: object has all and only these keys
+    expect(heroRes).to.have.all.keys(heroFields);
     expect(heroRes.auth.local).not.to.have.keys(['salt', 'hashed_password']);
     expect(heroRes.profile).to.have.all.keys(['name']);
 

test/api/v3/integration/members/GET-members_id.test.js

@@ -29,6 +29,9 @@ describe('GET /members/:memberId', () => {
         costume: false,
         background: 'volcano',
       },
+      secret: {
+        text: 'Clark Kent',
+      },
     });
     const memberRes = await user.get(`/members/${member._id}`);
     expect(memberRes).to.have.all.keys([ // works as: object has all and only these keys
@@ -46,6 +49,29 @@ describe('GET /members/:memberId', () => {
     expect(memberRes.stats.toNextLevel).to.equal(common.tnl(memberRes.stats.lvl));
     expect(memberRes.inbox.optOut).to.exist;
     expect(memberRes.inbox.messages).to.not.exist;
+    expect(memberRes.secret).to.not.exist;
+  });
+
+  it('does not return secret for the own account', async () => {
+    // make sure user has all the fields that can be returned by the getMember call
+    const member = await generateUser({
+      contributor: { level: 1 },
+      backer: { tier: 3 },
+      preferences: {
+        costume: false,
+        background: 'volcano',
+      },
+      secret: {
+        text: 'Clark Kent',
+      },
+    });
+    const memberRes = await member.get(`/members/${member._id}`);
+    expect(memberRes).to.have.keys([ // works as: object has all and only these keys
+      '_id', 'id', 'preferences', 'profile', 'stats', 'achievements', 'party',
+      'backer', 'contributor', 'auth', 'items', 'inbox', 'loginIncentives', 'flags',
+    ]);
+
+    expect(memberRes.secret).to.not.exist;
   });
 
   it('handles non-existing members', async () => {

test/api/v3/integration/payments/stripe/POST-payments_stripe_checkout.test.js

@@ -17,7 +17,7 @@ describe('payments - stripe - #checkout', () => {
     await expect(user.post(endpoint, { id: 123 })).to.eventually.be.rejected.and.include({
       code: 401,
       error: 'Error',
-      message: 'Invalid API Key provided: aaaabbbb********************1111',
+      // message: 'Invalid API Key provided: aaaabbbb********************1111',
     });
   });
 

test/api/v3/integration/quests/POST-groups_groupId_quests_accept.test.js

@@ -112,7 +112,7 @@ describe('POST /groups/:groupId/quests/accept', () => {
 
       await Promise.all([partyMembers[0].sync(), questingGroup.sync()]);
       expect(leader.party.quest.RSVPNeeded).to.equal(false);
-      expect(questingGroup.quest.members[partyMembers[0]._id]);
+      expect(questingGroup.quest.members[partyMembers[0]._id]).to.equal(true);
     });
 
     it('does not begin the quest if pending invitations remain', async () => {

test/api/v3/integration/tasks/POST-tasks_user.test.js

@@ -55,6 +55,18 @@ describe('POST /tasks/user', () => {
       });
     });
 
+    it('returns an error if reward value is a negative number', async () => {
+      await expect(user.post('/tasks/user', {
+        type: 'reward',
+        text: 'reward with negative value',
+        value: -10,
+      })).to.eventually.be.rejected.and.eql({
+        code: 400,
+        error: 'BadRequest',
+        message: 'reward validation failed',
+      });
+    });
+
     it('does not update user.tasksOrder.{taskType} when the task is not saved because invalid', async () => {
       const originalHabitsOrder = (await user.get('/user')).tasksOrder.habits;
       await expect(user.post('/tasks/user', {

test/api/v3/integration/tasks/PUT-tasks_id.test.js

@@ -530,5 +530,15 @@ describe('PUT /tasks/:id', () => {
 
       expect(savedReward.value).to.eql(100);
     });
+
+    it('returns an error if reward value is a negative number', async () => {
+      await expect(user.put(`/tasks/${reward._id}`, {
+        value: -10,
+      })).to.eventually.be.rejected.and.eql({
+        code: 400,
+        error: 'BadRequest',
+        message: 'reward validation failed',
+      });
+    });
   });
 });

test/api/v3/integration/user/DELETE-user.test.js

@@ -346,4 +346,23 @@ describe('DELETE /user', () => {
       await expect(checkExistence('users', user._id)).to.eventually.eql(false);
     });
   });
+
+  context('user with Apple auth', async () => {
+    beforeEach(async () => {
+      user = await generateUser({
+        auth: {
+          apple: {
+            id: 'apple-id',
+          },
+        },
+      });
+    });
+
+    it('deletes a Apple user', async () => {
+      await user.del('/user', {
+        password: DELETE_CONFIRMATION,
+      });
+      await expect(checkExistence('users', user._id)).to.eventually.eql(false);
+    });
+  });
 });

test/api/v3/integration/user/GET-user.test.js

@@ -1,3 +1,4 @@
+import range from 'lodash/range';
 import {
   generateUser,
 } from '../../../../helpers/api-integration/v3';
@@ -26,6 +27,7 @@ describe('GET /user', () => {
     expect(returnedUser.auth.local.passwordHashMethod).to.not.exist;
     expect(returnedUser.auth.local.salt).to.not.exist;
     expect(returnedUser.apiToken).to.not.exist;
+    expect(returnedUser.secret).to.not.exist;
   });
 
   it('returns only user properties requested', async () => {
@@ -38,4 +40,30 @@ describe('GET /user', () => {
     expect(returnedUser.notifications).to.exist;
     expect(returnedUser.stats).to.not.exist;
   });
+
+  it('does not return requested private properties', async () => {
+    const returnedUser = await user.get('/user?userFields=apiToken,secret.text');
+
+    expect(returnedUser.apiToken).to.not.exist;
+    expect(returnedUser.secret).to.not.exist;
+  });
+
+  it('returns the full inbox', async () => {
+    const otherUser = await generateUser();
+    const amountOfMessages = 12;
+
+    const allMessagesPromise = range(amountOfMessages)
+      .map(i => otherUser.post('/members/send-private-message', {
+        toUserId: user.id,
+        message: `Message Num: ${i}`,
+      }));
+
+    await Promise.all(allMessagesPromise);
+
+    const returnedUser = await user.get('/user');
+
+    expect(returnedUser._id).to.equal(user._id);
+    expect(returnedUser.inbox).to.exist;
+    expect(Object.keys(returnedUser.inbox.messages)).to.have.a.lengthOf(amountOfMessages);
+  });
 });

test/api/v3/integration/user/GET-user_anonymized.test.js

@@ -12,7 +12,11 @@ describe('GET /user/anonymized', () => {
   const endpoint = '/user/anonymized';
 
   before(async () => {
-    user = await generateUser();
+    user = await generateUser({
+      secret: {
+        text: 'Clark Kent',
+      },
+    });
     await user.update({
       newMessages: ['some', 'new', 'messages'],
       'profile.name': 'profile',
@@ -100,5 +104,7 @@ describe('GET /user/anonymized', () => {
         });
       }
     });
+
+    expect(returnedUser.secret).to.not.exist;
   });
 });

test/api/v3/integration/user/POST-user_reset.test.js

@@ -117,4 +117,24 @@ describe('POST /user/reset', () => {
     expect(userChallengeTask).to.exist;
     expect(syncedGroupTask).to.exist;
   });
+
+  it('does not delete secret', async () => {
+    const admin = await generateUser({
+      contributor: { admin: true },
+    });
+
+    const hero = await generateUser({
+      contributor: { level: 1 },
+      secret: {
+        text: 'Super-Hero',
+      },
+    });
+
+    await hero.post('/user/reset');
+
+    const heroRes = await admin.get(`/hall/heroes/${hero.auth.local.username}`);
+
+    expect(heroRes.secret).to.exist;
+    expect(heroRes.secret.text).to.be.eq('Super-Hero');
+  });
 });

test/api/v3/integration/user/POST-user_unlock.js

@@ -6,6 +6,7 @@ import {
 describe('POST /user/unlock', () => {
   let user;
   const unlockPath = 'shirt.convict,shirt.cross,shirt.fire,shirt.horizon,shirt.ocean,shirt.purple,shirt.rainbow,shirt.redblue,shirt.thunder,shirt.tropical,shirt.zombie';
+  const unlockGearSetPath = 'items.gear.owned.headAccessory_special_bearEars,items.gear.owned.headAccessory_special_cactusEars,items.gear.owned.headAccessory_special_foxEars,items.gear.owned.headAccessory_special_lionEars,items.gear.owned.headAccessory_special_pandaEars,items.gear.owned.headAccessory_special_pigEars,items.gear.owned.headAccessory_special_tigerEars,items.gear.owned.headAccessory_special_wolfEars';
   const unlockCost = 1.25;
   const usersStartingGems = 5;
 
@@ -34,4 +35,25 @@ describe('POST /user/unlock', () => {
     expect(response.message).to.equal(t('unlocked'));
     expect(user.balance).to.equal(usersStartingGems - unlockCost);
   });
+
+  it('does not reduce a user\'s balance twice', async () => {
+    await user.update({
+      balance: usersStartingGems,
+    });
+    const response = await user.post(`/user/unlock?path=${unlockGearSetPath}`);
+    await user.sync();
+
+    expect(response.message).to.equal(t('unlocked'));
+    expect(user.balance).to.equal(usersStartingGems - unlockCost);
+
+    expect(user.post(`/user/unlock?path=${unlockGearSetPath}`))
+      .to.eventually.be.rejected.and.to.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('alreadyUnlocked'),
+      });
+    await user.sync();
+
+    expect(user.balance).to.equal(usersStartingGems - unlockCost);
+  });
 });

test/api/v3/integration/user/PUT-user.test.js

@@ -107,6 +107,7 @@ describe('PUT /user', () => {
       'customization gem purchases': { 'purchased.background.tavern': true, 'purchased.skin.bear': true },
       notifications: [{ type: 123 }],
       webhooks: { webhooks: [{ url: 'https://foobar.com' }] },
+      secret: { secret: { text: 'Some new text' } },
     };
 
     each(protectedOperations, (data, testName) => {
@@ -125,10 +126,11 @@ describe('PUT /user', () => {
   context('Sub-Level Protected Operations', () => {
     const protectedOperations = {
       'class stat': { 'stats.class': 'wizard' },
-      'flags unless whitelisted': { 'flags.dropsEnabled': true },
+      'flags unless whitelisted': { 'flags.chatRevoked': true },
       webhooks: { 'preferences.webhooks': [1, 2, 3] },
       sleep: { 'preferences.sleep': true },
       'disable classes': { 'preferences.disableClasses': true },
+      secret: { secret: { text: 'Some new text' } },
     };
 
     each(protectedOperations, (data, testName) => {

test/api/v3/integration/user/auth/DELETE-user_auth_social_network.test.js

@@ -95,4 +95,42 @@ describe('DELETE social registration', () => {
       expect(user.auth.goodl).to.be.undefined;
     });
   });
+
+  context('Apple', () => {
+    it('fails if user does not have an alternative registration method', async () => {
+      await user.update({
+        'auth.apple.id': 'some-apple-id',
+        'auth.local': { ok: true },
+      });
+      await expect(user.del('/user/auth/social/apple')).to.eventually.be.rejected.and.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('cantDetachSocial'),
+      });
+    });
+
+    it('succeeds if user has a local registration', async () => {
+      await user.update({
+        'auth.apple.id': 'some-apple-id',
+      });
+
+      const response = await user.del('/user/auth/social/apple');
+      expect(response).to.eql({});
+      await user.sync();
+      expect(user.auth.apple).to.be.undefined;
+    });
+
+    it('succeeds if user has a facebook registration', async () => {
+      await user.update({
+        'auth.apple.id': 'some-apple-id',
+        'auth.facebook.id': 'some-facebook-id',
+        'auth.local': { ok: true },
+      });
+
+      const response = await user.del('/user/auth/social/apple');
+      expect(response).to.eql({});
+      await user.sync();
+      expect(user.auth.goodl).to.be.undefined;
+    });
+  });
 });

test/api/v3/integration/user/auth/GET-user_auth_apple.test.js

@@ -0,0 +1,50 @@
+import {
+  generateUser,
+  requester,
+  getProperty,
+} from '../../../../../helpers/api-integration/v3';
+import * as appleAuth from '../../../../../../website/server/libs/auth/apple';
+
+describe('GET /user/auth/apple', () => {
+  let api;
+  let user;
+  const appleEndpoint = '/user/auth/apple';
+
+  before(async () => {
+    const expectedResult = { id: 'appleId', name: 'an apple user' };
+    sandbox.stub(appleAuth, 'appleProfile').returns(Promise.resolve(expectedResult));
+  });
+
+  beforeEach(async () => {
+    api = requester();
+    user = await generateUser();
+  });
+
+  it('registers a new user', async () => {
+    const response = await api.get(appleEndpoint);
+
+    expect(response.apiToken).to.exist;
+    expect(response.id).to.exist;
+    expect(response.newUser).to.be.true;
+    await expect(getProperty('users', response.id, 'auth.apple.id')).to.eventually.equal('appleId');
+    await expect(getProperty('users', response.id, 'profile.name')).to.eventually.equal('an apple user');
+  });
+
+  it('logs an existing user in', async () => {
+    const registerResponse = await api.get(appleEndpoint);
+
+    const response = await api.get(appleEndpoint);
+
+    expect(response.apiToken).to.eql(registerResponse.apiToken);
+    expect(response.id).to.eql(registerResponse.id);
+    expect(response.newUser).to.be.false;
+  });
+
+  it('add social auth to an existing user', async () => {
+    const response = await user.get(appleEndpoint);
+
+    expect(response.apiToken).to.exist;
+    expect(response.id).to.exist;
+    expect(response.newUser).to.be.false;
+  });
+});

test/api/v3/integration/user/auth/POST-register_local.test.js

@@ -492,6 +492,74 @@ describe('POST /user/auth/local/register', () => {
     });
   });
 
+  context('attach to google user', () => {
+    let user;
+    const email = 'some@email-google.net';
+    const username = 'some-username-google';
+    const password = 'some-password';
+    beforeEach(async () => {
+      user = await generateUser();
+    });
+    it('checks onlySocialAttachLocal', async () => {
+      await expect(user.post('/user/auth/local/register', {
+        email,
+        username,
+        password,
+        confirmPassword: password,
+      })).to.eventually.be.rejected.and.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('onlySocialAttachLocal'),
+      });
+    });
+    it('succeeds', async () => {
+      await user.update({ 'auth.google.id': 'some-google-id', 'auth.local': { ok: true } });
+      await user.post('/user/auth/local/register', {
+        username,
+        email,
+        password,
+        confirmPassword: password,
+      });
+      await user.sync();
+      expect(user.auth.local.username).to.eql(username);
+      expect(user.auth.local.email).to.eql(email);
+    });
+  });
+
+  context('attach to apple user', () => {
+    let user;
+    const email = 'some@email-apple.net';
+    const username = 'some-username-apple';
+    const password = 'some-password';
+    beforeEach(async () => {
+      user = await generateUser();
+    });
+    it('checks onlySocialAttachLocal', async () => {
+      await expect(user.post('/user/auth/local/register', {
+        email,
+        username,
+        password,
+        confirmPassword: password,
+      })).to.eventually.be.rejected.and.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('onlySocialAttachLocal'),
+      });
+    });
+    it('succeeds', async () => {
+      await user.update({ 'auth.apple.id': 'some-apple-id', 'auth.local': { ok: true } });
+      await user.post('/user/auth/local/register', {
+        username,
+        email,
+        password,
+        confirmPassword: password,
+      });
+      await user.sync();
+      expect(user.auth.local.username).to.eql(username);
+      expect(user.auth.local.email).to.eql(email);
+    });
+  });
+
   context('login is already taken', () => {
     let username; let email; let
       api;

test/api/v3/integration/user/auth/POST-user_auth_social.test.js

@@ -51,6 +51,7 @@ describe('POST /user/auth/social', () => {
 
       await expect(getProperty('users', response.id, 'profile.name')).to.eventually.equal('a facebook user');
       await expect(getProperty('users', response.id, 'auth.local.lowerCaseUsername')).to.exist;
+      await expect(getProperty('users', response.id, 'auth.facebook.id')).to.eventually.equal(facebookId);
     });
 
     it('logs an existing user in', async () => {
@@ -106,6 +107,7 @@ describe('POST /user/auth/social', () => {
       expect(response.apiToken).to.exist;
       expect(response.id).to.exist;
       expect(response.newUser).to.be.true;
+      await expect(getProperty('users', response.id, 'auth.google.id')).to.eventually.equal(googleId);
       await expect(getProperty('users', response.id, 'profile.name')).to.eventually.equal('a google user');
     });
 

test/api/v3/integration/webhook/POST-user_add_webhook.test.js

@@ -81,6 +81,16 @@ describe('POST /user/webhook', () => {
     expect(webhook.type).to.eql('taskActivity');
   });
 
+  it('ignores protected fields', async () => {
+    body.failures = 3;
+    body.lastFailureAt = new Date();
+
+    const webhook = await user.post('/user/webhook', body);
+
+    expect(webhook.failures).to.eql(0);
+    expect(webhook.lastFailureAt).to.eql(undefined);
+  });
+
   it('successfully adds the webhook', async () => {
     expect(user.webhooks).to.eql([]);
 

test/api/v3/integration/webhook/PUT-user_update_webhook.test.js

@@ -63,6 +63,21 @@ describe('PUT /user/webhook/:id', () => {
     expect(webhook.options).to.eql(options);
   });
 
+  it('ignores protected fields', async () => {
+    const failures = 3;
+    const lastFailureAt = new Date();
+
+    await user.put(`/user/webhook/${webhookToUpdate.id}`, {
+      failures, lastFailureAt,
+    });
+
+    await user.sync();
+    const webhook = user.webhooks.find(hook => webhookToUpdate.id === hook.id);
+
+    expect(webhook.failures).to.eql(0);
+    expect(webhook.lastFailureAt).to.eql(undefined);
+  });
+
   it('updates a webhook with empty label', async () => {
     const url = 'http://a-new-url.com';
     const type = 'groupChatReceived';

test/api/v4/faq/GET-faq.test.js

@@ -0,0 +1,65 @@
+import {
+  requester,
+  translate,
+} from '../../../helpers/api-integration/v4';
+import i18n from '../../../../website/common/script/i18n';
+
+describe('GET /faq', () => {
+  describe('language parameter', () => {
+    it('returns faq (and does not require authentication)', async () => {
+      const res = await requester().get('/faq');
+
+      expect(res).to.have.property('stillNeedHelp');
+      expect(res.stillNeedHelp.ios).to.equal(translate('iosFaqStillNeedHelp'));
+      expect(res).to.have.property('questions');
+      expect(res.questions[0].question).to.equal(translate('faqQuestion0'));
+    });
+
+    it('returns faq not in English', async () => {
+      const res = await requester().get('/faq?language=de');
+      expect(res).to.have.nested.property('stillNeedHelp.ios');
+      expect(res.stillNeedHelp.ios).to.equal(i18n.t('iosFaqStillNeedHelp', 'de'));
+    });
+
+    it('falls back to English if the desired language is not found', async () => {
+      const res = await requester().get('/faq?language=wrong');
+      expect(res).to.have.nested.property('stillNeedHelp.ios');
+      expect(res.stillNeedHelp.ios).to.equal(translate('iosFaqStillNeedHelp'));
+    });
+  });
+
+  describe('platform parameter', () => {
+    it('returns faq with answers for ios platform only', async () => {
+      const res = await requester().get('/faq?platform=ios');
+
+      expect(res).to.have.property('stillNeedHelp');
+      expect(res.stillNeedHelp).to.eql({ ios: translate('iosFaqStillNeedHelp') });
+
+      expect(res).to.have.property('questions');
+      expect(res.questions[0]).to.eql({
+        question: translate('faqQuestion0'),
+        ios: translate('iosFaqAnswer0'),
+      });
+    });
+    it('returns an error when invalid platform parameter is specified', async () => {
+      const request = requester().get('/faq?platform=wrong');
+      await expect(request)
+        .to.eventually.be.rejected.and.eql({
+          code: 400,
+          error: 'BadRequest',
+          message: i18n.t('invalidReqParams'),
+        });
+    });
+    it('falls back to "web" description if there is no description for specified platform', async () => {
+      const res = await requester().get('/faq?platform=android');
+      expect(res).to.have.property('stillNeedHelp');
+      expect(res.stillNeedHelp).to.eql({ web: translate('webFaqStillNeedHelp') });
+
+      expect(res).to.have.property('questions');
+      expect(res.questions[0]).to.eql({
+        question: translate('faqQuestion0'),
+        android: translate('androidFaqAnswer0'),
+      });
+    });
+  });
+});

test/api/v4/inbox/GET-inbox-conversations.test.js

@@ -63,7 +63,7 @@ describe('GET /inbox/conversations', () => {
     expect(messages[4].text).to.equal('first');
   });
 
-  it('returns four messages when using page-query ', async () => {
+  it('returns five messages when using page-query ', async () => {
     const promises = [];
 
     for (let i = 0; i < 10; i += 1) {

test/api/v4/user/GET-user.test.js

@@ -26,6 +26,7 @@ describe('GET /user', () => {
     expect(returnedUser.auth.local.passwordHashMethod).to.not.exist;
     expect(returnedUser.auth.local.salt).to.not.exist;
     expect(returnedUser.apiToken).to.not.exist;
+    expect(returnedUser.secret).to.not.exist;
   });
 
   it('returns only user properties requested', async () => {
@@ -39,6 +40,13 @@ describe('GET /user', () => {
     expect(returnedUser.stats).to.not.exist;
   });
 
+  it('does not return requested private properties', async () => {
+    const returnedUser = await user.get('/user?userFields=apiToken,secret.text');
+
+    expect(returnedUser.apiToken).to.not.exist;
+    expect(returnedUser.secret).to.not.exist;
+  });
+
   it('does not return new inbox messages', async () => {
     const otherUser = await generateUser();
 

test/api/v4/user/POST-user_reset.test.js

@@ -117,4 +117,25 @@ describe('POST /user/reset', () => {
     expect(userChallengeTask).to.exist;
     expect(syncedGroupTask).to.exist;
   });
+
+  it('does not delete secret', async () => {
+    const admin = await generateUser({
+      contributor: { admin: true },
+    });
+
+    const hero = await generateUser({
+      contributor: { level: 1 },
+      secret: {
+        text: 'Super-Hero',
+      },
+    });
+
+
+    await hero.post('/user/reset');
+
+    const heroRes = await admin.get(`/hall/heroes/${hero.auth.local.username}`);
+
+    expect(heroRes.secret).to.exist;
+    expect(heroRes.secret.text).to.be.eq('Super-Hero');
+  });
 });

test/api/v4/user/PUT-user.test.js

@@ -91,6 +91,7 @@ describe('PUT /user', () => {
       'customization gem purchases': { 'purchased.background.tavern': true, 'purchased.skin.bear': true },
       notifications: [{ type: 123 }],
       webhooks: { webhooks: [{ url: 'https://foobar.com' }] },
+      secret: { secret: { text: 'Some new text' } },
     };
 
     each(protectedOperations, (data, testName) => {
@@ -109,10 +110,11 @@ describe('PUT /user', () => {
   context('Sub-Level Protected Operations', () => {
     const protectedOperations = {
       'class stat': { 'stats.class': 'wizard' },
-      'flags unless whitelisted': { 'flags.dropsEnabled': true },
+      'flags unless whitelisted': { 'flags.chatRevoked': true },
       webhooks: { 'preferences.webhooks': [1, 2, 3] },
       sleep: { 'preferences.sleep': true },
       'disable classes': { 'preferences.disableClasses': true },
+      secret: { secret: { text: 'Some new text' } },
     };
 
     each(protectedOperations, (data, testName) => {

test/api/v4/user/auth/POST-register_local.test.js

@@ -457,6 +457,74 @@ describe('POST /user/auth/local/register', () => {
     });
   });
 
+  context('attach to google user', () => {
+    let user;
+    const email = 'some-google@email.net';
+    const username = 'some-username-google';
+    const password = 'some-password';
+    beforeEach(async () => {
+      user = await generateUser();
+    });
+    it('checks onlySocialAttachLocal', async () => {
+      await expect(user.post('/user/auth/local/register', {
+        email,
+        username,
+        password,
+        confirmPassword: password,
+      })).to.eventually.be.rejected.and.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('onlySocialAttachLocal'),
+      });
+    });
+    it('succeeds', async () => {
+      await user.update({ 'auth.google.id': 'some-google-id', 'auth.local': { ok: true } });
+      await user.post('/user/auth/local/register', {
+        username,
+        email,
+        password,
+        confirmPassword: password,
+      });
+      await user.sync();
+      expect(user.auth.local.username).to.eql(username);
+      expect(user.auth.local.email).to.eql(email);
+    });
+  });
+
+  context('attach to apple user', () => {
+    let user;
+    const email = 'some-apple@email.net';
+    const username = 'some-username-apple';
+    const password = 'some-password';
+    beforeEach(async () => {
+      user = await generateUser();
+    });
+    it('checks onlySocialAttachLocal', async () => {
+      await expect(user.post('/user/auth/local/register', {
+        email,
+        username,
+        password,
+        confirmPassword: password,
+      })).to.eventually.be.rejected.and.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('onlySocialAttachLocal'),
+      });
+    });
+    it('succeeds', async () => {
+      await user.update({ 'auth.apple.id': 'some-apple-id', 'auth.local': { ok: true } });
+      await user.post('/user/auth/local/register', {
+        username,
+        email,
+        password,
+        confirmPassword: password,
+      });
+      await user.sync();
+      expect(user.auth.local.username).to.eql(username);
+      expect(user.auth.local.email).to.eql(email);
+    });
+  });
+
   context('login is already taken', () => {
     let username; let email; let
       api;

test/client/.babelrc

@@ -1,16 +0,0 @@
-{
-  "env": {
-    "test": {
-      plugins: [
-        ["istanbul"],
-      ],
-    },
-  },
-  "presets": [
-    ["es2015", { modules: false }],
-  ],
-  "plugins": [
-    "transform-object-rest-spread",
-  ],
-  "comments": false,
-}

test/client/unit/index.js

@@ -1,21 +0,0 @@
-/* eslint-disable */
-// TODO verify if it's needed, added because Axios require Promise in the global scope
-// and babel-runtime doesn't affect external libraries
-require('babel-polyfill');
-
-// Automatically setup SinonJS' sandbox for each test
-beforeEach(() => {
-  global.sandbox = sinon.createSandbox();
-});
-
-afterEach(() => {
-  global.sandbox.restore();
-});
-
-// require all test files
-const testsContext = require.context('./specs', true, /\.js$/);
-testsContext.keys().forEach(testsContext);
-
-// require all .vue and .js files except main.js for coverage.
-const srcContext = require.context('../../../website/client', true, /^\.\/(?=(?!main(\.js)?$))(?=(.*\.(vue|js)$))/);
-srcContext.keys().forEach(srcContext);

test/client/unit/karma.conf.js

@@ -1,40 +0,0 @@
-/* eslint-disable */
-// This is a karma config file. For more details see
-//   http://karma-runner.github.io/0.13/config/configuration-file.html
-// we are also using it with karma-webpack
-//   https://github.com/webpack/karma-webpack
-
-// Necessary for babel to respect the env version of .babelrc which is necessary
-// Because inject-loader does not work with ["es2015", { modules: false }] that we use
-// in order to let webpack2 handle the imports
-process.env.CHROME_BIN = require('puppeteer').executablePath();
-// eslint-disable-line no-process-env
-process.env.BABEL_ENV = process.env.NODE_ENV; // eslint-disable-line no-process-env
-const webpackConfig = require('../../../webpack/webpack.test.conf');
-
-module.exports = function (config) {
-  config.set({
-    // to run in additional browsers:
-    // 1. install corresponding karma launcher
-    //    http://karma-runner.github.io/0.13/config/browsers.html
-    // 2. add it to the `browsers` array below.
-    browsers: ['ChromeHeadless'],
-    frameworks: ['mocha', 'sinon-stub-promise', 'sinon-chai', 'chai-as-promised', 'chai'],
-    reporters: ['spec', 'coverage'],
-    files: ['./index.js'],
-    preprocessors: {
-      './index.js': ['webpack', 'sourcemap'],
-    },
-    webpack: webpackConfig,
-    webpackMiddleware: {
-      noInfo: true,
-    },
-    coverageReporter: {
-      dir: '../../../coverage/client-unit',
-      reporters: [
-        { type: 'lcov', subdir: '.' },
-        { type: 'text-summary' },
-      ],
-    },
-  });
-};

test/common/fns/randomDrop.test.js

@@ -15,6 +15,7 @@ describe('common.fns.randomDrop', () => {
   beforeEach(() => {
     user = generateUser();
     user._tmp = user._tmp ? user._tmp : {};
+    user.items.eggs.Wolf = 0;
     task = generateTodo({ userId: user._id });
     predictableRandom = sandbox.stub().returns(0.5);
   });
@@ -34,10 +35,17 @@ describe('common.fns.randomDrop', () => {
 
   context('drops enabled', () => {
     beforeEach(() => {
-      user.flags.dropsEnabled = true;
       task.priority = 100000;
     });
 
+    it('awards an egg and a hatching potion if user has never received any', () => {
+      delete user.items.eggs.Wolf;
+      randomDrop(user, { task, predictableRandom });
+
+      expect(user._tmp.firstDrops.egg).to.be.a.string;
+      expect(user._tmp.firstDrops.hatchingPotion).to.be.a.string;
+    });
+
     it('does nothing if user.items.lastDrop.count is exceeded', () => {
       user.items.lastDrop.count = 100;
       randomDrop(user, { task, predictableRandom });
@@ -46,7 +54,6 @@ describe('common.fns.randomDrop', () => {
 
     it('drops something when the task is a todo', () => {
       expect(user._tmp).to.eql({});
-      user.flags.dropsEnabled = true;
       predictableRandom.returns(0.1);
 
       randomDrop(user, { task, predictableRandom });
@@ -56,7 +63,6 @@ describe('common.fns.randomDrop', () => {
     it('drops something when the task is a habit', () => {
       task = generateHabit({ userId: user._id });
       expect(user._tmp).to.eql({});
-      user.flags.dropsEnabled = true;
       predictableRandom.returns(0.1);
 
       randomDrop(user, { task, predictableRandom });
@@ -66,7 +72,6 @@ describe('common.fns.randomDrop', () => {
     it('drops something when the task is a daily', () => {
       task = generateDaily({ userId: user._id });
       expect(user._tmp).to.eql({});
-      user.flags.dropsEnabled = true;
       predictableRandom.returns(0.1);
 
       randomDrop(user, { task, predictableRandom });
@@ -76,7 +81,6 @@ describe('common.fns.randomDrop', () => {
     it('drops something when the task is a reward', () => {
       task = generateReward({ userId: user._id });
       expect(user._tmp).to.eql({});
-      user.flags.dropsEnabled = true;
       predictableRandom.returns(0.1);
 
       randomDrop(user, { task, predictableRandom });

test/common/fns/updateStats.test.js

@@ -110,13 +110,6 @@ describe('common.fns.updateStats', () => {
       expect(user.stats.points).to.eql(10);
     });
 
-    it('add user notification when drops are enabled', () => {
-      user.stats.lvl = 3;
-      updateStats(user, { });
-      expect(user.addNotification).to.be.calledOnce;
-      expect(user.addNotification).to.be.calledWith('DROPS_ENABLED');
-    });
-
     it('add user notification when the user levels up', () => {
       const initialLvl = user.stats.lvl;
       updateStats(user, {
@@ -131,7 +124,7 @@ describe('common.fns.updateStats', () => {
     it('add user notification when rebirth is enabled', () => {
       user.stats.lvl = 51;
       updateStats(user, { });
-      expect(user.addNotification).to.be.calledTwice; // once is for drops enabled
+      expect(user.addNotification).to.be.calledOnce;
       expect(user.addNotification).to.be.calledWith('REBIRTH_ENABLED');
     });
 

test/common/ops/buy/buyGem.js

@@ -119,7 +119,7 @@ describe('shared.ops.buyGem', () => {
           buyGem(user, { params: { type: 'gems', key: 'gem' } });
         } catch (err) {
           expect(err).to.be.an.instanceof(NotAuthorized);
-          expect(err.message).to.equal(i18n.t('reachedGoldToGemCap', { convCap: planGemLimits.convCap }));
+          expect(err.message).to.equal(i18n.t('maxBuyGems', { convCap: planGemLimits.convCap }));
           done();
         }
       });

test/common/ops/buy/buyMysterySet.js

@@ -88,7 +88,14 @@ describe('shared.ops.buyMysterySet', () => {
         expect(user.items.gear.owned).to.have.property('armor_mystery_301404', true);
         expect(user.items.gear.owned).to.have.property('head_mystery_301404', true);
         expect(user.items.gear.owned).to.have.property('eyewear_mystery_301404', true);
-        expect(analytics.track).to.be.called;
+        expect(analytics.track).to.be.calledOnce;
+        expect(analytics.track).to.be.calledWithMatch('acquire item', {
+          uuid: user._id,
+          itemKey: '301404',
+          itemType: 'Subscriber Gear',
+          acquireMethod: 'Hourglass',
+          category: 'behavior',
+        });
       });
     });
   });

test/common/ops/feed.js

@@ -89,6 +89,18 @@ describe('shared.ops.feed', () => {
       }
     });
 
+    it('does not allow feeding of wacky pets', done => {
+      user.items.pets['Wolf-Veggie'] = 5;
+      user.items.food.Meat = 1;
+      try {
+        feed(user, { params: { pet: 'Wolf-Veggie', food: 'Meat' } });
+      } catch (err) {
+        expect(err).to.be.an.instanceof(NotAuthorized);
+        expect(err.message).to.equal(i18n.t('messageCannotFeedPet'));
+        done();
+      }
+    });
+
     it('does not allow feeding of mounts', done => {
       user.items.pets['Wolf-Base'] = -1;
       user.items.mounts['Wolf-Base'] = true;

test/common/ops/rebirth.js

@@ -173,7 +173,6 @@ describe('shared.ops.rebirth', () => {
 
   it('resets a user\'s flags', () => {
     user.flags.itemsEnabled = true;
-    user.flags.dropsEnabled = true;
     user.flags.classSelected = true;
     user.flags.rebirthEnabled = true;
     user.flags.levelDrops = { test: 'test' };
@@ -181,7 +180,6 @@ describe('shared.ops.rebirth', () => {
     rebirth(user);
 
     expect(user.flags.itemsEnabled).to.be.false;
-    expect(user.flags.dropsEnabled).to.be.false;
     expect(user.flags.classSelected).to.be.false;
     expect(user.flags.rebirthEnabled).to.be.false;
     expect(user.flags.levelDrops).to.be.empty;

test/common/ops/reset.js

@@ -52,6 +52,22 @@ describe('shared.ops.reset', () => {
     expect(user.stats.lvl).to.equal(1);
   });
 
+  it('resets user\'s stat points (str, con, int, per, points)', () => {
+    user.stats.str = 2;
+    user.stats.con = 2;
+    user.stats.int = 2;
+    user.stats.per = 2;
+    user.stats.points = 2;
+
+    reset(user);
+
+    expect(user.stats.str).to.equal(0);
+    expect(user.stats.con).to.equal(0);
+    expect(user.stats.int).to.equal(0);
+    expect(user.stats.per).to.equal(0);
+    expect(user.stats.points).to.equal(1);
+  });
+
   it('resets user\'s gold', () => {
     user.stats.gp = 20;
 

test/common/ops/unlock.js

@@ -1,20 +1,18 @@
+import get from 'lodash/get';
 import unlock from '../../../website/common/script/ops/unlock';
 import i18n from '../../../website/common/script/i18n';
-import {
-  generateUser,
-} from '../../helpers/common.helper';
-import {
-  NotAuthorized,
-  BadRequest,
-} from '../../../website/common/script/libs/errors';
+import { generateUser } from '../../helpers/common.helper';
+import { NotAuthorized, BadRequest } from '../../../website/common/script/libs/errors';
 
 describe('shared.ops.unlock', () => {
   let user;
   const unlockPath = 'shirt.convict,shirt.cross,shirt.fire,shirt.horizon,shirt.ocean,shirt.purple,shirt.rainbow,shirt.redblue,shirt.thunder,shirt.tropical,shirt.zombie';
   const unlockGearSetPath = 'items.gear.owned.headAccessory_special_bearEars,items.gear.owned.headAccessory_special_cactusEars,items.gear.owned.headAccessory_special_foxEars,items.gear.owned.headAccessory_special_lionEars,items.gear.owned.headAccessory_special_pandaEars,items.gear.owned.headAccessory_special_pigEars,items.gear.owned.headAccessory_special_tigerEars,items.gear.owned.headAccessory_special_wolfEars';
   const backgroundUnlockPath = 'background.giant_florals';
-  const unlockCost = 1.25;
-  const usersStartingGems = 5;
+  const backgroundSetUnlockPath = 'background.archery_range,background.giant_florals,background.rainbows_end';
+  const hairUnlockPath = 'hair.color.rainbow,hair.color.yellow,hair.color.green,hair.color.purple,hair.color.blue,hair.color.TRUred';
+  const facialHairUnlockPath = 'hair.mustache.1,hair.mustache.2,hair.beard.1,hair.beard.2,hair.beard.3';
+  const usersStartingGems = 50 / 4;
 
   beforeEach(() => {
     user = generateUser();
@@ -31,6 +29,15 @@ describe('shared.ops.unlock', () => {
     }
   });
 
+  it('does not unlock lost gear', done => {
+    user.items.gear.owned.headAccessory_special_bearEars = false;
+
+    unlock(user, { query: { path: 'items.gear.owned.headAccessory_special_bearEars' } });
+
+    expect(user.balance).to.equal(usersStartingGems);
+    done();
+  });
+
   it('returns an error when user balance is too low', done => {
     user.balance = 0;
 
@@ -44,28 +51,124 @@ describe('shared.ops.unlock', () => {
   });
 
   it('returns an error when user already owns a full set', done => {
+    let expectedBalance;
+
     try {
       unlock(user, { query: { path: unlockPath } });
+      expectedBalance = user.balance;
       unlock(user, { query: { path: unlockPath } });
     } catch (err) {
       expect(err).to.be.an.instanceof(NotAuthorized);
       expect(err.message).to.equal(i18n.t('alreadyUnlocked'));
+      expect(user.balance).to.equal(expectedBalance);
       done();
     }
   });
 
-  // disabled until fully implemente
-  xit('returns an error when user already owns items in a full set', done => {
+  it('returns an error when user already owns a full set of gear', done => {
+    let expectedBalance;
+
     try {
-      unlock(user, { query: { path: unlockPath } });
-      unlock(user, { query: { path: unlockPath } });
+      unlock(user, { query: { path: unlockGearSetPath } });
+      expectedBalance = user.balance;
+      unlock(user, { query: { path: unlockGearSetPath } });
     } catch (err) {
       expect(err).to.be.an.instanceof(NotAuthorized);
       expect(err.message).to.equal(i18n.t('alreadyUnlocked'));
+      expect(user.balance).to.equal(expectedBalance);
       done();
     }
   });
 
+  it('returns an error if an item does not exists', done => {
+    try {
+      unlock(user, { query: { path: 'background.invalid_background' } });
+    } catch (err) {
+      expect(err).to.be.an.instanceof(BadRequest);
+      expect(err.message).to.equal(i18n.t('invalidUnlockSet'));
+      done();
+    }
+  });
+
+  it('returns an error if there are items from multiple sets', done => {
+    try {
+      unlock(user, { query: { path: 'shirt.convict,skin.0ff591' } });
+    } catch (err) {
+      expect(err).to.be.an.instanceof(BadRequest);
+      expect(err.message).to.equal(i18n.t('invalidUnlockSet'));
+      done();
+    }
+  });
+
+  it('returns an error if gear is not from the animal set', done => {
+    try {
+      unlock(user, { query: { path: 'items.gear.owned.back_mystery_202004' } });
+    } catch (err) {
+      expect(err).to.be.an.instanceof(BadRequest);
+      expect(err.message).to.equal(i18n.t('invalidUnlockSet'));
+      done();
+    }
+  });
+
+  it('returns an error if the item is free', done => {
+    try {
+      unlock(user, { query: { path: 'shirt.black' } });
+    } catch (err) {
+      expect(err).to.be.an.instanceof(BadRequest);
+      expect(err.message).to.equal(i18n.t('invalidUnlockSet'));
+      done();
+    }
+  });
+
+  it('returns an error if an item does not belong to a set (appearances)', done => {
+    try {
+      unlock(user, { query: { path: 'shirt.pink' } });
+    } catch (err) {
+      expect(err).to.be.an.instanceof(BadRequest);
+      expect(err.message).to.equal(i18n.t('invalidUnlockSet'));
+      done();
+    }
+  });
+
+  it('returns an error when user already owns items in a full set and it would be more expensive to buy the entire set', done => {
+    try {
+      // There are 11 shirts in the set, each cost 2 gems, the full set 5 gems
+      // In order for the full purchase not to be worth, we must own 9
+      const partialUnlockPaths = unlockPath.split(',');
+      unlock(user, { query: { path: partialUnlockPaths[0] } });
+      unlock(user, { query: { path: partialUnlockPaths[1] } });
+      unlock(user, { query: { path: partialUnlockPaths[2] } });
+      unlock(user, { query: { path: partialUnlockPaths[3] } });
+      unlock(user, { query: { path: partialUnlockPaths[4] } });
+      unlock(user, { query: { path: partialUnlockPaths[5] } });
+      unlock(user, { query: { path: partialUnlockPaths[6] } });
+      unlock(user, { query: { path: partialUnlockPaths[7] } });
+      unlock(user, { query: { path: partialUnlockPaths[8] } });
+
+      unlock(user, { query: { path: unlockPath } });
+    } catch (err) {
+      expect(err).to.be.an.instanceof(NotAuthorized);
+      expect(err.message).to.equal(i18n.t('alreadyUnlockedPart'));
+      done();
+    }
+  });
+
+  it('does not return an error when user already owns items in a full set and it would not be more expensive to buy the entire set', () => {
+    // There are 11 shirts in the set, each cost 2 gems, the full set 5 gems
+    // In order for the full purchase to be worth, we can own already 8
+    const partialUnlockPaths = unlockPath.split(',');
+    unlock(user, { query: { path: partialUnlockPaths[0] } });
+    unlock(user, { query: { path: partialUnlockPaths[1] } });
+    unlock(user, { query: { path: partialUnlockPaths[2] } });
+    unlock(user, { query: { path: partialUnlockPaths[3] } });
+    unlock(user, { query: { path: partialUnlockPaths[4] } });
+    unlock(user, { query: { path: partialUnlockPaths[5] } });
+    unlock(user, { query: { path: partialUnlockPaths[6] } });
+    unlock(user, { query: { path: partialUnlockPaths[7] } });
+
+    unlock(user, { query: { path: unlockPath } });
+  });
+
   it('equips an item already owned', () => {
     expect(user.purchased.background.giant_florals).to.not.exist;
 
@@ -78,7 +181,7 @@ describe('shared.ops.unlock', () => {
     expect(user.preferences.background).to.equal('giant_florals');
   });
 
-  it('un-equips an item already equipped', () => {
+  it('un-equips a background already equipped', () => {
     expect(user.purchased.background.giant_florals).to.not.exist;
 
     unlock(user, { query: { path: backgroundUnlockPath } }); // unlock
@@ -91,31 +194,143 @@ describe('shared.ops.unlock', () => {
     expect(user.preferences.background).to.equal('');
   });
 
-  it('unlocks a full set', () => {
+  it('unlocks a full set of appearance items', () => {
+    const initialShirts = Object.keys(user.purchased.shirt).length;
     const [, message] = unlock(user, { query: { path: unlockPath } });
 
     expect(message).to.equal(i18n.t('unlocked'));
-    expect(user.purchased.shirt.convict).to.be.true;
+    const individualPaths = unlockPath.split(',');
+    individualPaths.forEach(path => {
+      expect(get(user.purchased, path)).to.be.true;
+    });
+    expect(Object.keys(user.purchased.shirt).length)
+      .to.equal(initialShirts + individualPaths.length);
+    expect(user.balance).to.equal(usersStartingGems - 1.25);
+  });
+
+  it('unlocks a full set of hair items', () => {
+    user.purchased.hair.color = {};
+
+    const initialHairColors = Object.keys(user.purchased.hair.color).length;
+    const [, message] = unlock(user, { query: { path: hairUnlockPath } });
+
+    expect(message).to.equal(i18n.t('unlocked'));
+    const individualPaths = hairUnlockPath.split(',');
+    individualPaths.forEach(path => {
+      expect(get(user.purchased, path)).to.be.true;
+    });
+    expect(Object.keys(user.purchased.hair.color).length)
+      .to.equal(initialHairColors + individualPaths.length);
+    expect(user.balance).to.equal(usersStartingGems - 1.25);
+  });
+
+  it('unlocks the facial hair set', () => {
+    user.purchased.hair.mustache = {};
+    user.purchased.hair.beard = {};
+
+    const initialMustache = Object.keys(user.purchased.hair.mustache).length;
+    const initialBeard = Object.keys(user.purchased.hair.mustache).length;
+    const [, message] = unlock(user, { query: { path: facialHairUnlockPath } });
+
+    expect(message).to.equal(i18n.t('unlocked'));
+    const individualPaths = facialHairUnlockPath.split(',');
+    individualPaths.forEach(path => {
+      expect(get(user.purchased, path)).to.be.true;
+    });
+    expect(Object.keys(user.purchased.hair.mustache).length + Object.keys(user.purchased.hair.beard).length) // eslint-disable-line max-len
+      .to.equal(initialMustache + initialBeard + individualPaths.length);
+    expect(user.balance).to.equal(usersStartingGems - 1.25);
   });
 
   it('unlocks a full set of gear', () => {
+    const initialGear = Object.keys(user.items.gear.owned).length;
     const [, message] = unlock(user, { query: { path: unlockGearSetPath } });
 
     expect(message).to.equal(i18n.t('unlocked'));
-    expect(user.items.gear.owned.headAccessory_special_wolfEars).to.be.true;
+
+    const individualPaths = unlockGearSetPath.split(',');
+    individualPaths.forEach(path => {
+      expect(get(user, path)).to.be.true;
+    });
+    expect(Object.keys(user.items.gear.owned).length)
+      .to.equal(initialGear + individualPaths.length);
+    expect(user.balance).to.equal(usersStartingGems - 1.25);
   });
 
-  it('unlocks a an item', () => {
+  it('unlocks a full set of backgrounds', () => {
+    const initialBackgrounds = Object.keys(user.purchased.background).length;
+    const [, message] = unlock(user, { query: { path: backgroundSetUnlockPath } });
+
+    expect(message).to.equal(i18n.t('unlocked'));
+    const individualPaths = backgroundSetUnlockPath.split(',');
+    individualPaths.forEach(path => {
+      expect(get(user.purchased, path)).to.be.true;
+    });
+    expect(Object.keys(user.purchased.background).length)
+      .to.equal(initialBackgrounds + individualPaths.length);
+    expect(user.balance).to.equal(usersStartingGems - 3.75);
+  });
+
+  it('unlocks an item (appearance)', () => {
+    const path = unlockPath.split(',')[0];
+    const initialShirts = Object.keys(user.purchased.shirt).length;
+    const [, message] = unlock(user, { query: { path } });
+
+    expect(message).to.equal(i18n.t('unlocked'));
+    expect(Object.keys(user.purchased.shirt).length).to.equal(initialShirts + 1);
+    expect(get(user.purchased, path)).to.be.true;
+    expect(user.balance).to.equal(usersStartingGems - 0.5);
+  });
+
+  it('unlocks an item (hair color)', () => {
+    user.purchased.hair.color = {};
+
+    const path = hairUnlockPath.split(',')[0];
+    const initialColorHair = Object.keys(user.purchased.hair.color).length;
+    const [, message] = unlock(user, { query: { path } });
+
+    expect(message).to.equal(i18n.t('unlocked'));
+    expect(Object.keys(user.purchased.hair.color).length).to.equal(initialColorHair + 1);
+    expect(get(user.purchased, path)).to.be.true;
+    expect(user.balance).to.equal(usersStartingGems - 0.5);
+  });
+
+  it('unlocks an item (facial hair)', () => {
+    user.purchased.hair.mustache = {};
+    user.purchased.hair.beard = {};
+
+    const path = facialHairUnlockPath.split(',')[0];
+    const initialMustache = Object.keys(user.purchased.hair.mustache).length;
+    const initialBeard = Object.keys(user.purchased.hair.beard).length;
+    const [, message] = unlock(user, { query: { path } });
+
+    expect(message).to.equal(i18n.t('unlocked'));
+
+    expect(Object.keys(user.purchased.hair.mustache).length).to.equal(initialMustache + 1);
+    expect(Object.keys(user.purchased.hair.beard).length).to.equal(initialBeard);
+
+    expect(get(user.purchased, path)).to.be.true;
+    expect(user.balance).to.equal(usersStartingGems - 0.5);
+  });
+
+  it('unlocks an item (gear)', () => {
+    const path = unlockGearSetPath.split(',')[0];
+    const initialGear = Object.keys(user.items.gear.owned).length;
+    const [, message] = unlock(user, { query: { path } });
+
+    expect(message).to.equal(i18n.t('unlocked'));
+    expect(Object.keys(user.items.gear.owned).length).to.equal(initialGear + 1);
+    expect(get(user, path)).to.be.true;
+    expect(user.balance).to.equal(usersStartingGems - 0.5);
+  });
+
+  it('unlocks an item (background)', () => {
+    const initialBackgrounds = Object.keys(user.purchased.background).length;
     const [, message] = unlock(user, { query: { path: backgroundUnlockPath } });
 
     expect(message).to.equal(i18n.t('unlocked'));
-    expect(user.purchased.background.giant_florals).to.be.true;
-  });
-
-  it('reduces a user\'s balance', () => {
-    const [, message] = unlock(user, { query: { path: unlockPath } });
-
-    expect(message).to.equal(i18n.t('unlocked'));
-    expect(user.balance).to.equal(usersStartingGems - unlockCost);
+    expect(Object.keys(user.purchased.background).length).to.equal(initialBackgrounds + 1);
+    expect(get(user.purchased, backgroundUnlockPath)).to.be.true;
+    expect(user.balance).to.equal(usersStartingGems - 1.75);
   });
 });

test/helpers/api-integration/v3/object-generators.js

@@ -5,6 +5,8 @@ import { v4 as generateUUID } from 'uuid';
 import { ApiUser, ApiGroup, ApiChallenge } from '../api-classes';
 import { requester } from '../requester';
 import * as Tasks from '../../../../website/server/models/task';
+import payments from '../../../../website/server/libs/payments/payments';
+import { model as User } from '../../../../website/server/models/user';
 
 // Creates a new user and returns it
 // If you need the user to have specific requirements,
@@ -83,14 +85,35 @@ export async function generateGroup (leader, details = {}, update = {}) {
   return apiGroup;
 }
 
+async function _upgradeToGroupPlan (groupLeader, group) {
+  const groupLeaderModel = await User.findById(groupLeader._id).exec();
+
+  // Create subscription
+  const paymentData = {
+    user: groupLeaderModel,
+    groupId: group._id,
+    sub: {
+      key: 'basic_3mo',
+    },
+    customerId: 'customer-id',
+    paymentMethod: 'Payment Method',
+    headers: {
+      'x-client': 'habitica-web',
+      'user-agent': '',
+    },
+  };
+  await payments.createSubscription(paymentData);
+}
+
 // This is generate group + the ability to create
 // real users to populate it. The settings object
 // takes in:
 // members: Number - the number of group members to create.
 // Defaults to 0. Does not include group leader.
-// inivtes: Number - the number of users to create and invite to the group. Defaults to 0.
+// invites: Number - the number of users to create and invite to the group. Defaults to 0.
 // groupDetails: Object - how to initialize the group
 // leaderDetails: Object - defaults for the leader, defaults with a gem balance so the user
+// addGroupPlan: boolean - will add group plan with basic subscription. Defaults to false
 // can create the group
 //
 // Returns an object with
@@ -101,6 +124,7 @@ export async function generateGroup (leader, details = {}, update = {}) {
 export async function createAndPopulateGroup (settings = {}) {
   const numberOfMembers = settings.members || 0;
   const numberOfInvites = settings.invites || 0;
+  const upgradeToGroupPlan = settings.upgradeToGroupPlan || false;
   const { groupDetails } = settings;
   const leaderDetails = settings.leaderDetails || { balance: 10 };
 
@@ -130,6 +154,10 @@ export async function createAndPopulateGroup (settings = {}) {
 
   await Promise.all(invitees.map(invitee => invitee.sync()));
 
+  if (upgradeToGroupPlan) {
+    await _upgradeToGroupPlan(groupLeader, group);
+  }
+
   return {
     groupLeader,
     group,

website/client/package.json

@@ -5,46 +5,46 @@
   "scripts": {
     "serve": "vue-cli-service serve",
     "build": "vue-cli-service build",
+    "test:unit": "vue-cli-service test:unit --require ./tests/unit/helpers.js",
     "lint": "vue-cli-service lint .",
     "lint-no-fix": "vue-cli-service lint --no-fix .",
     "postinstall": "node ./scripts/npm-postinstall.js",
     "storybook:build": "vue-cli-service storybook:build -c config/storybook -o dist/storybook",
-    "storybook:serve": "vue-cli-service storybook:serve -p 6006 -c config/storybook",
-    "test:unit": "vue-cli-service test:unit --require ./tests/unit/helpers.js"
+    "storybook:serve": "vue-cli-service storybook:serve -p 6006 -c config/storybook"
   },
   "dependencies": {
-    "@vue/cli-plugin-babel": "^4.2.2",
-    "@vue/cli-plugin-eslint": "^4.2.2",
-    "@vue/cli-plugin-router": "^4.2.2",
-    "@vue/cli-plugin-unit-mocha": "^4.2.2",
-    "@vue/cli-service": "^4.2.2",
-    "@storybook/addon-actions": "^5.3.13",
-    "@storybook/addon-knobs": "^5.3.13",
-    "@storybook/addon-links": "^5.3.13",
-    "@storybook/addon-notes": "^5.3.13",
-    "@storybook/vue": "^5.3.13",
+    "@storybook/addon-actions": "^5.3.19",
+    "@storybook/addon-knobs": "^5.3.19",
+    "@storybook/addon-links": "^5.3.19",
+    "@storybook/addon-notes": "^5.3.19",
+    "@storybook/vue": "^5.3.19",
+    "@vue/cli-plugin-babel": "^4.4.1",
+    "@vue/cli-plugin-eslint": "^4.4.1",
+    "@vue/cli-plugin-router": "^4.4.1",
+    "@vue/cli-plugin-unit-mocha": "^4.4.1",
+    "@vue/cli-service": "^4.4.1",
     "@vue/test-utils": "1.0.0-beta.29",
-    "amplitude-js": "^5.9.0",
+    "amplitude-js": "^5.11.0",
     "axios": "^0.19.2",
     "axios-progress-bar": "^1.2.0",
-    "babel-eslint": "^10.0.1",
-    "bootstrap": "^4.4.1",
-    "bootstrap-vue": "^2.5.0",
+    "babel-eslint": "^10.1.0",
+    "bootstrap": "^4.5.0",
+    "bootstrap-vue": "^2.15.0",
     "chai": "^4.1.2",
-    "core-js": "^3.6.4",
+    "core-js": "^3.6.5",
     "eslint": "^6.8.0",
     "eslint-config-habitrpg": "^6.2.0",
     "eslint-plugin-mocha": "^5.3.0",
-    "eslint-plugin-vue": "^6.2.1",
-    "habitica-markdown": "^1.3.2",
+    "eslint-plugin-vue": "^6.2.2",
+    "habitica-markdown": "^2.0.0",
     "hellojs": "^1.18.4",
-    "inspectpack": "^4.4.0",
+    "inspectpack": "^4.5.2",
     "intro.js": "^2.9.3",
-    "jquery": "^3.4.1",
+    "jquery": "^3.5.1",
     "lodash": "^4.17.15",
-    "moment": "^2.24.0",
+    "moment": "^2.26.0",
     "nconf": "^0.10.0",
-    "sass": "^1.25.0",
+    "sass": "^1.26.8",
     "sass-loader": "^8.0.2",
     "smartbanner.js": "^1.15.0",
     "svg-inline-loader": "^0.8.2",
@@ -56,11 +56,10 @@
     "vue": "^2.6.11",
     "vue-cli-plugin-storybook": "^0.6.1",
     "vue-mugen-scroll": "^0.2.6",
-    "vue-router": "^3.1.5",
+    "vue-router": "^3.3.2",
     "vue-template-compiler": "^2.6.11",
-    "vue2-perfect-scrollbar": "^1.3.0",
-    "vuedraggable": "^2.23.1",
+    "vuedraggable": "^2.23.2",
     "vuejs-datepicker": "git://github.com/habitrpg/vuejs-datepicker.git#5d237615463a84a23dd6f3f77c6ab577d68593ec",
-    "webpack": "^4.41.6"
+    "webpack": "^4.43.0"
   }
 }

website/client/public/index.html

@@ -18,6 +18,7 @@
     <meta name="smartbanner:button-url-apple" content="https://itunes.apple.com/us/app/habitica-gamified-taskmanager/id994882113">
     <meta name="smartbanner:button-url-google" content="https://play.google.com/store/apps/details?id=com.habitrpg.android.habitica">
     <meta name="smartbanner:enabled-platforms" content="android,ios">
+    <meta name="smartbanner:hide-ttl" content="2592000000">
     <link href="https://fonts.googleapis.com/css?family=Roboto+Condensed:400,400i,700,700i|Roboto:400,400i,700,700i" rel="stylesheet">
     <link rel="shortcut icon" sizes="48x48" href="/static/icons/favicon.ico">
     <link rel="shortcut icon" sizes="192x192" href="/static/icons/favicon_192x192.png">

website/client/public/static/README.md

@@ -0,0 +1,13 @@
+The files in the following subfolders:
+
+- audio
+- emails
+- icons
+- merch
+- presskit
+
+are not processed by Webpack so their filenames don't get hashed, but given that they almost never change, they're still cached for 1 week.
+
+In case one of the files needs to be updated the filename should be changed if possible.
+
+For more information see `website/server/middlewares/static.js`.

website/client/src/app.vue

@@ -20,10 +20,6 @@
           </svg>
           <!-- eslint-enable max-len -->
         </div>
-        <div class="col-12 text-center">
-          <h2>{{ $t('tipTitle', {tipNumber: currentTipNumber}) }}</h2>
-          <p>{{ currentTip }}</p>
-        </div>
       </div>
     </div>
     <div
@@ -33,7 +29,7 @@
         'resting': showRestingBanner
       }"
     >
-      <banned-account-modal />
+      <!-- <banned-account-modal /> -->
       <amazon-payments-modal v-if="!isStaticPage" />
       <payments-success-modal />
       <sub-cancel-modal-confirm v-if="isUserLoaded" />
@@ -266,7 +262,6 @@ import {
 } from '@/libs/userlocalManager';
 
 import svgClose from '@/assets/svg/close.svg';
-import bannedAccountModal from '@/components/bannedAccountModal';
 
 const COMMUNITY_MANAGER_EMAIL = process.env.EMAILS_COMMUNITY_MANAGER_EMAIL; // eslint-disable-line
 
@@ -281,7 +276,6 @@ export default {
     BuyModal,
     SelectMembersModal,
     amazonPaymentsModal,
-    bannedAccountModal,
     paymentsSuccessModal,
     subCancelModalConfirm,
     subCanceledModal,
@@ -299,12 +293,11 @@ export default {
       audioSuffix: null,
 
       loading: true,
-      currentTipNumber: 0,
       bannerHidden: false,
     };
   },
   computed: {
-    ...mapState(['isUserLoggedIn', 'browserTimezoneOffset', 'isUserLoaded']),
+    ...mapState(['isUserLoggedIn', 'browserTimezoneOffset', 'isUserLoaded', 'notificationsRemoved']),
     ...mapState({ user: 'user.data' }),
     isStaticPage () {
       return this.$route.meta.requiresLogin === false;
@@ -312,15 +305,6 @@ export default {
     castingSpell () {
       return this.$store.state.spellOptions.castingSpell;
     },
-    currentTip () {
-      const numberOfTips = 35 + 1;
-      const min = 1;
-      const randomNumber = Math.random() * (numberOfTips - min) + min;
-      const tipNumber = Math.floor(randomNumber);
-      this.currentTipNumber = tipNumber; // eslint-disable-line vue/no-side-effects-in-computed-properties, max-len
-
-      return this.$t(`tip${tipNumber}`);
-    },
     showRestingBanner () {
       return !this.bannerHidden && this.user && this.user.preferences.sleep;
     },
@@ -377,15 +361,58 @@ export default {
       showSpinner: false,
     });
 
-    // Set up Error interceptors
-    axios.interceptors.response.use(response => {
-      if (this.user && response.data && response.data.notifications) {
-        this.$set(this.user, 'notifications', response.data.notifications);
+    axios.interceptors.response.use(response => { // Set up Response interceptors
+      // Verify that the user was not updated from another browser/app/client
+      // If it was, sync
+      const { url } = response.config;
+      const { method } = response.config;
+
+      const isApiCall = url.indexOf('api/v4') !== -1;
+      const userV = response.data && response.data.userV;
+      const isCron = url.indexOf('/api/v4/cron') === 0 && method === 'post';
+
+      if (this.isUserLoaded && isApiCall && userV) {
+        const oldUserV = this.user._v;
+        this.user._v = userV;
+
+        // Do not sync again if already syncing
+        const isUserSync = url.indexOf('/api/v4/user') === 0 && method === 'get';
+        const isTasksSync = url.indexOf('/api/v4/tasks/user') === 0 && method === 'get';
+        // exclude chat seen requests because with real time chat they would be too many
+        const isChatSeen = url.indexOf('/chat/seen') !== -1 && method === 'post';
+        // exclude POST /api/v4/cron because the user is synced automatically after cron runs
+
+        // Something has changed on the user object that was not tracked here, sync the user
+        if (userV - oldUserV > 1 && !isCron && !isChatSeen && !isUserSync && !isTasksSync) {
+          Promise.all([
+            this.$store.dispatch('user:fetch', { forceLoad: true }),
+            this.$store.dispatch('tasks:fetchUserTasks', { forceLoad: true }),
+          ]);
+        }
       }
+
+      // Store the app version from the server
+      const serverAppVersion = response.data && response.data.appVersion;
+
+      if (serverAppVersion && this.$store.state.serverAppVersion !== response.data.appVersion) {
+        this.$store.state.serverAppVersion = serverAppVersion;
+      }
+
+      // Store the notifications, filtering those that have already been read
+      // See store/index.js on why this is necessary
+      if (this.user && response.data && response.data.notifications) {
+        const filteredNotifications = response.data.notifications.filter(serverNotification => {
+          if (this.notificationsRemoved.includes(serverNotification.id)) return false;
+          return true;
+        });
+        this.$set(this.user, 'notifications', filteredNotifications);
+      }
+
       return response;
-    }, error => {
+    }, error => { // Set up Error interceptors
       if (error.response.status >= 400) {
-        this.checkForBannedUser(error);
+        const isBanned = this.checkForBannedUser(error);
+        if (isBanned === true) return null; // eslint-disable-line consistent-return
 
         // Don't show errors from getting user details. These users have delete their account,
         // but their chat message still exists.
@@ -403,7 +430,8 @@ export default {
         // TODO use a specific error like NotificationNotFound instead of checking for the string
         const invalidUserMessage = [this.$t('invalidCredentials'), 'Missing authentication headers.'];
         if (invalidUserMessage.indexOf(errorMessage) !== -1) {
-          this.$store.dispatch('auth:logout');
+          this.$store.dispatch('auth:logout', { redirectToLogin: true });
+          return null;
         }
 
         // Most server errors should return is click to dismiss errors, with some exceptions
@@ -439,51 +467,6 @@ export default {
       return Promise.reject(error);
     });
 
-    axios.interceptors.response.use(response => {
-      // Verify that the user was not updated from another browser/app/client
-      // If it was, sync
-      const { url } = response.config;
-      const { method } = response.config;
-
-      const isApiCall = url.indexOf('api/v4') !== -1;
-      const userV = response.data && response.data.userV;
-      const isCron = url.indexOf('/api/v4/cron') === 0 && method === 'post';
-
-      if (this.isUserLoaded && isApiCall && userV) {
-        const oldUserV = this.user._v;
-        this.user._v = userV;
-
-        // Do not sync again if already syncing
-        const isUserSync = url.indexOf('/api/v4/user') === 0 && method === 'get';
-        const isTasksSync = url.indexOf('/api/v4/tasks/user') === 0 && method === 'get';
-        // exclude chat seen requests because with real time chat they would be too many
-        const isChatSeen = url.indexOf('/chat/seen') !== -1 && method === 'post';
-        // exclude POST /api/v4/cron because the user is synced automatically after cron runs
-
-        // Something has changed on the user object that was not tracked here, sync the user
-        if (userV - oldUserV > 1 && !isCron && !isChatSeen && !isUserSync && !isTasksSync) {
-          Promise.all([
-            this.$store.dispatch('user:fetch', { forceLoad: true }),
-            this.$store.dispatch('tasks:fetchUserTasks', { forceLoad: true }),
-          ]);
-        }
-      }
-
-      // Verify the client is updated
-      // const serverAppVersion = response.data.appVersion;
-      // let serverAppVersionState = this.$store.state.serverAppVersion;
-      // if (isApiCall && !serverAppVersionState) {
-      //   this.$store.state.serverAppVersion = serverAppVersion;
-      // } else if (isApiCall && serverAppVersionState !== serverAppVersion) {
-      //   if (document.activeElement.tagName !== 'INPUT'
-      // || confirm(this.$t('habiticaHasUpdated'))) {
-      //     location.reload(true);
-      //   }
-      // }
-
-      return response;
-    });
-
     // Setup listener for title
     this.$store.watch(state => state.title, title => {
       document.title = title;
@@ -553,7 +536,7 @@ export default {
 
       // Case where user is not logged in
       if (!parseSettings) {
-        return;
+        return false;
       }
 
       const bannedMessage = this.$t('accountSuspended', {
@@ -561,9 +544,10 @@ export default {
         userId: parseSettings.auth.apiId,
       });
 
-      if (errorMessage !== bannedMessage) return;
+      if (errorMessage !== bannedMessage) return false;
 
-      this.$root.$emit('bv::show::modal', 'banned-account');
+      this.$store.dispatch('auth:logout', { redirectToLogin: true });
+      return true;
     },
     initializeModalStack () {
       // Manage modals

website/client/src/assets/css/sprites.css

@@ -4,6 +4,12 @@
   height: 219px;
 }
 
+.Pet_HatchingPotion_Dessert {
+  background: url("~@/assets/images/animated/Pet_HatchingPotion_Dessert.gif") no-repeat;
+  width: 68px;
+  height: 68px;
+}
+
 .Pet_HatchingPotion_Veggie {
   background: url("~@/assets/images/animated/Pet_HatchingPotion_Veggie.gif") no-repeat;
   width: 68px;

website/client/src/assets/css/sprites/spritesmith-largeSprites-0.css

@@ -1,60 +1,30 @@
-.promo_achievement_CottonCandyPink {
+.promo_armoire_backgrounds_202006 {
   background-image: url('~@/assets/images/sprites/spritesmith-largeSprites-0.png');
-  background-position: -668px -444px;
-  width: 204px;
-  height: 102px;
-}
-.promo_armoire_backgrounds_202002 {
-  background-image: url('~@/assets/images/sprites/spritesmith-largeSprites-0.png');
-  background-position: 0px -277px;
+  background-position: -340px 0px;
   width: 423px;
   height: 147px;
 }
-.promo_mystery_202003 {
+.promo_mystery_202006 {
   background-image: url('~@/assets/images/sprites/spritesmith-largeSprites-0.png');
-  background-position: -668px -148px;
+  background-position: -340px -148px;
   width: 282px;
   height: 147px;
 }
 .promo_take_this {
   background-image: url('~@/assets/images/sprites/spritesmith-largeSprites-0.png');
-  background-position: -873px -444px;
+  background-position: -623px -148px;
   width: 96px;
   height: 69px;
 }
-.promo_valentines_2020 {
-  background-image: url('~@/assets/images/sprites/spritesmith-largeSprites-0.png');
-  background-position: -668px 0px;
-  width: 309px;
-  height: 147px;
-}
-.promo_valentines_potions {
-  background-image: url('~@/assets/images/sprites/spritesmith-largeSprites-0.png');
-  background-position: 0px -425px;
-  width: 420px;
-  height: 147px;
-}
-.scene_cake {
-  background-image: url('~@/assets/images/sprites/spritesmith-largeSprites-0.png');
-  background-position: -424px -277px;
-  width: 204px;
-  height: 102px;
-}
-.scene_dailies {
+.scene_achievement {
   background-image: url('~@/assets/images/sprites/spritesmith-largeSprites-0.png');
   background-position: 0px 0px;
-  width: 327px;
-  height: 276px;
-}
-.scene_gaining_achievement {
-  background-image: url('~@/assets/images/sprites/spritesmith-largeSprites-0.png');
-  background-position: -328px 0px;
   width: 339px;
   height: 210px;
 }
-.scene_shanaqui {
+.scene_hiking {
   background-image: url('~@/assets/images/sprites/spritesmith-largeSprites-0.png');
-  background-position: -668px -296px;
-  width: 282px;
-  height: 147px;
+  background-position: 0px -211px;
+  width: 258px;
+  height: 258px;
 }