4.169.1

Fixes #12630

.github/workflows/test.yml

@@ -22,6 +22,7 @@ jobs:
         npm ci
       env:
         CI: true
+        NODE_ENV: test
     - run: npm run lint-no-fix
   apidoc:
     runs-on: ubuntu-latest
@@ -42,6 +43,7 @@ jobs:
         npm ci
       env:
         CI: true
+        NODE_ENV: test
     - run: npm run apidoc
   sanity:
     runs-on: ubuntu-latest
@@ -62,6 +64,7 @@ jobs:
         npm ci
       env:
         CI: true
+        NODE_ENV: test
     - run: npm run test:sanity
   
   common:
@@ -83,6 +86,7 @@ jobs:
         npm ci
       env:
         CI: true
+        NODE_ENV: test
     - run: npm run test:common
   content:
     runs-on: ubuntu-latest
@@ -103,6 +107,7 @@ jobs:
         npm ci
       env:
         CI: true
+        NODE_ENV: test
     - run: npm run test:content
   
   api-unit:
@@ -110,6 +115,7 @@ jobs:
     strategy:
       matrix:
         node-version: [12.x]
+        mongodb-version: [4.2]
     steps:
     - uses: actions/checkout@v1
       with:
@@ -118,13 +124,18 @@ jobs:
       uses: actions/setup-node@v1
       with:
         node-version: ${{ matrix.node-version }}
-    - run: sudo docker run --name mongo -d -p 27017:27017 mongo:4.2
+    - name: Start MongoDB ${{ matrix.mongodb-version }} Replica Set
+      uses: supercharge/mongodb-github-action@1.3.0
+      with:
+        mongodb-version: ${{ matrix.mongodb-version }}
+        mongodb-replica-set: rs
     - run: cp config.json.example config.json
     - name: npm install
       run: |
         npm ci
       env:
         CI: true
+        NODE_ENV: test
     - run: npm run test:api:unit
       env:
         REQUIRES_SERVER=true: true
@@ -133,6 +144,7 @@ jobs:
     strategy:
       matrix:
         node-version: [12.x]
+        mongodb-version: [4.2]
     steps:
     - uses: actions/checkout@v1
       with:
@@ -141,13 +153,18 @@ jobs:
       uses: actions/setup-node@v1
       with:
         node-version: ${{ matrix.node-version }}
-    - run: sudo docker run --name mongo -d -p 27017:27017 mongo:4.2
+    - name: Start MongoDB ${{ matrix.mongodb-version }} Replica Set
+      uses: supercharge/mongodb-github-action@1.3.0
+      with:
+        mongodb-version: ${{ matrix.mongodb-version }}
+        mongodb-replica-set: rs
     - run: cp config.json.example config.json
     - name: npm install
       run: |
         npm ci
       env:
         CI: true
+        NODE_ENV: test
     - run: npm run test:api-v3:integration
       env:
         REQUIRES_SERVER=true: true
@@ -156,6 +173,7 @@ jobs:
     strategy:
       matrix:
         node-version: [12.x]
+        mongodb-version: [4.2]
     steps:
     - uses: actions/checkout@v1
       with:
@@ -164,13 +182,18 @@ jobs:
       uses: actions/setup-node@v1
       with:
         node-version: ${{ matrix.node-version }}
-    - run: sudo docker run --name mongo -d -p 27017:27017 mongo:4.2
+    - name: Start MongoDB ${{ matrix.mongodb-version }} Replica Set
+      uses: supercharge/mongodb-github-action@1.3.0
+      with:
+        mongodb-version: ${{ matrix.mongodb-version }}
+        mongodb-replica-set: rs
     - run: cp config.json.example config.json
     - name: npm install
       run: |
         npm ci
       env:
         CI: true
+        NODE_ENV: test
     - run: npm run test:api-v4:integration
       env:
         REQUIRES_SERVER=true: true
@@ -194,5 +217,6 @@ jobs:
         npm ci
       env:
         CI: true
+        NODE_ENV: test
     - run: npm run test:unit
       working-directory: ./website/client

.gitignore

@@ -38,7 +38,12 @@ yarn.lock
 .elasticbeanstalk/*
 !.elasticbeanstalk/*.cfg.yml
 !.elasticbeanstalk/*.global.yml
+
 /.vscode
 
 # webstorm fake webpack for path intellisense
 webpack.webstorm.config
+
+# mongodb replica set for local dev
+mongodb-*.tgz
+/mongodb-data

config.json.example

@@ -32,7 +32,8 @@
   "LOGGLY_SUBDOMAIN": "example-subdomain",
   "LOGGLY_TOKEN": "example-token",
   "MAINTENANCE_MODE": "false",
-  "NODE_DB_URI": "mongodb://localhost:27017/habitrpg",
+  "NODE_DB_URI": "mongodb://localhost:27017/habitica-dev?replicaSet=rs",
+  "TEST_DB_URI": "mongodb://localhost:27017/habitica-test?replicaSet=rs",
   "MONGODB_POOL_SIZE": "10",
   "NODE_ENV": "development",
   "PATH": "bin:node_modules/.bin:/usr/local/bin:/usr/bin:/bin",
@@ -70,7 +71,6 @@
   "SLACK_URL": "https://hooks.slack.com/services/some-url",
   "STRIPE_API_KEY": "aaaabbbbccccddddeeeeffff00001111",
   "STRIPE_PUB_KEY": "22223333444455556666777788889999",
-  "TEST_DB_URI": "mongodb://localhost:27017/habitrpg_test",
   "TRANSIFEX_SLACK_CHANNEL": "transifex",
   "WEB_CONCURRENCY": 1,
   "SKIP_SSL_CHECK_KEY": "key",
@@ -80,5 +80,9 @@
   "APPLE_AUTH_CLIENT_ID": "",
   "APPLE_AUTH_KEY_ID": "",
   "BLOCKED_IPS": "",
-  "LOG_AMPLITUDE_EVENTS": "false"
+  "LOG_AMPLITUDE_EVENTS": "false",
+  "RATE_LIMITER_ENABLED": "false",
+  "REDIS_HOST": "aaabbbcccdddeeefff",
+  "REDIS_PORT": "1234",
+  "REDIS_PASSWORD": "12345678"
 }

gulp/gulp-build.js

@@ -1,5 +1,12 @@
+/* eslint-disable no-console */
+
 import gulp from 'gulp';
+import path from 'path';
 import babel from 'gulp-babel';
+import os from 'os';
+import fs from 'fs';
+import spawn from 'cross-spawn'; // eslint-disable-line import/no-extraneous-dependencies
+import clean from 'rimraf';
 
 gulp.task('build:babel:server', () => gulp.src('website/server/**/*.js')
   .pipe(babel())
@@ -24,10 +31,67 @@ gulp.task('build:prod', gulp.series(
   done => done(),
 ));
 
+// Due to this issue https://github.com/vkarpov15/run-rs/issues/45
+// When used on windows `run-rs` must first be run without the `--keep` option
+// in order to be setup correctly, afterwards it can be used.
+
+const MONGO_PATH = path.join(__dirname, '/../mongodb-data/');
+
+gulp.task('build:prepare-mongo', async () => {
+  if (fs.existsSync(MONGO_PATH)) {
+    // console.log('MongoDB data folder exists, skipping setup.');
+    return;
+  }
+
+  if (os.platform() !== 'win32') {
+    // console.log('Not on Windows, skipping MongoDB setup.');
+    return;
+  }
+
+  console.log('MongoDB data folder is missing, setting up.'); // eslint-disable-line no-console
+
+  // use run-rs without --keep, kill it as soon as the replica set starts
+  const runRsProcess = spawn('run-rs', ['-v', '4.2.8', '-l', 'ubuntu1804', '--dbpath', 'mongodb-data', '--number', '1', '--quiet']);
+
+  for await (const chunk of runRsProcess.stdout) {
+    const stringChunk = chunk.toString();
+    console.log(stringChunk); // eslint-disable-line no-console
+    // kills the process after the replica set is setup
+    if (stringChunk.includes('Started replica set')) {
+      console.log('MongoDB setup correctly.'); // eslint-disable-line no-console
+      runRsProcess.kill();
+    }
+  }
+
+  let error = '';
+  for await (const chunk of runRsProcess.stderr) {
+    const stringChunk = chunk.toString();
+    error += stringChunk;
+  }
+
+  const exitCode = await new Promise(resolve => {
+    runRsProcess.on('close', resolve);
+  });
+
+  if (exitCode || error.length > 0) {
+    // remove any leftover files
+    clean.sync(MONGO_PATH);
+
+    throw new Error(`Error running run-rs: ${error}`);
+  }
+});
+
+gulp.task('build:dev', gulp.series(
+  'build:prepare-mongo',
+  done => done(),
+));
+
 const buildArgs = [];
 
 if (process.env.NODE_ENV === 'production') { // eslint-disable-line no-process-env
   buildArgs.push('build:prod');
+} else if (process.env.NODE_ENV !== 'test') { // eslint-disable-line no-process-env
+  buildArgs.push('build:dev');
 }
 
 gulp.task('build', gulp.series(buildArgs, done => {

gulp/gulp-console.js

@@ -3,6 +3,10 @@ import nconf from 'nconf';
 import repl from 'repl';
 import gulp from 'gulp';
 import logger from '../website/server/libs/logger';
+import {
+  getDevelopmentConnectionUrl,
+  getDefaultConnectionOptions,
+} from '../website/server/libs/mongodb';
 
 // Add additional properties to the repl's context
 const improveRepl = context => {
@@ -26,13 +30,14 @@ const improveRepl = context => {
   context.Group = require('../website/server/models/group').model; // eslint-disable-line global-require
   context.User = require('../website/server/models/user').model; // eslint-disable-line global-require
 
-  const isProd = nconf.get('NODE_ENV') === 'production';
-  const mongooseOptions = !isProd ? {} : {
-    keepAlive: 1,
-    connectTimeoutMS: 30000,
-  };
+  const IS_PROD = nconf.get('NODE_ENV') === 'production';
+  const NODE_DB_URI = nconf.get('NODE_DB_URI');
+
+  const mongooseOptions = getDefaultConnectionOptions();
+  const connectionUrl = IS_PROD ? NODE_DB_URI : getDevelopmentConnectionUrl(NODE_DB_URI);
+
   mongoose.connect(
-    nconf.get('NODE_DB_URI'),
+    connectionUrl,
     mongooseOptions,
     err => {
       if (err) throw err;

gulp/gulp-tests.js

@@ -3,9 +3,11 @@ import { exec } from 'child_process';
 import gulp from 'gulp';
 import os from 'os';
 import nconf from 'nconf';
+import { pipe } from './taskHelper';
 import {
-  pipe,
-} from './taskHelper';
+  getDevelopmentConnectionUrl,
+  getDefaultConnectionOptions,
+} from '../website/server/libs/mongodb';
 
 // TODO rewrite
 
@@ -17,15 +19,16 @@ const TEST_DB_URI = nconf.get('TEST_DB_URI');
 const SANITY_TEST_COMMAND = 'npm run test:sanity';
 const COMMON_TEST_COMMAND = 'npm run test:common';
 const CONTENT_TEST_COMMAND = 'npm run test:content';
-const CONTENT_OPTIONS = { maxBuffer: 1024 * 500 };
+const LIMIT_MAX_BUFFER_OPTIONS = { maxBuffer: 1024 * 500 };
 
-/* Helper methods for reporting test summary */
+/* Helper method for reporting test summary */
 const testResults = [];
 const testCount = (stdout, regexp) => {
   const match = stdout.match(regexp);
   return parseInt(match && (match[1] || 0), 10);
 };
 
+/* Helper methods to correctly run child test processes */
 const testBin = (string, additionalEnvVariables = '') => {
   if (os.platform() === 'win32') {
     if (additionalEnvVariables !== '') {
@@ -37,6 +40,15 @@ const testBin = (string, additionalEnvVariables = '') => {
   return `NODE_ENV=test ${additionalEnvVariables} ${string}`;
 };
 
+function runInChildProcess (command, options = {}, envVariables = '') {
+  return done => pipe(exec(testBin(command, envVariables), options, done));
+}
+
+function integrationTestCommand (testDir, coverageDir) {
+  return `istanbul cover --dir coverage/${coverageDir} --report lcovonly node_modules/mocha/bin/_mocha -- ${testDir} --recursive --require ./test/helpers/start-server`;
+}
+
+/* Test task definitions */
 gulp.task('test:nodemon', gulp.series(done => {
   process.env.PORT = TEST_SERVER_PORT; // eslint-disable-line no-process-env
   process.env.NODE_DB_URI = TEST_DB_URI; // eslint-disable-line no-process-env
@@ -44,7 +56,10 @@ gulp.task('test:nodemon', gulp.series(done => {
 }, 'nodemon'));
 
 gulp.task('test:prepare:mongo', cb => {
-  mongoose.connect(TEST_DB_URI, err => {
+  const mongooseOptions = getDefaultConnectionOptions();
+  const connectionUrl = getDevelopmentConnectionUrl(TEST_DB_URI);
+
+  mongoose.connect(connectionUrl, mongooseOptions, err => {
     if (err) return cb(`Unable to connect to mongo database. Are you sure it's running? \n\n${err}`);
     return mongoose.connection.dropDatabase(err2 => {
       if (err2) return cb(err2);
@@ -75,31 +90,9 @@ gulp.task('test:prepare', gulp.series(
   done => done(),
 ));
 
-gulp.task('test:sanity', cb => {
-  const runner = exec(
-    testBin(SANITY_TEST_COMMAND),
-    err => {
-      if (err) {
-        process.exit(1);
-      }
-      cb();
-    },
-  );
-  pipe(runner);
-});
+gulp.task('test:sanity', runInChildProcess(SANITY_TEST_COMMAND));
 
-gulp.task('test:common', gulp.series('test:prepare:build', cb => {
-  const runner = exec(
-    testBin(COMMON_TEST_COMMAND),
-    err => {
-      if (err) {
-        process.exit(1);
-      }
-      cb();
-    },
-  );
-  pipe(runner);
-}));
+gulp.task('test:common', gulp.series('test:prepare:build', runInChildProcess(COMMON_TEST_COMMAND)));
 
 gulp.task('test:common:clean', cb => {
   pipe(exec(testBin(COMMON_TEST_COMMAND), () => cb()));
@@ -123,22 +116,11 @@ gulp.task('test:common:safe', gulp.series('test:prepare:build', cb => {
   pipe(runner);
 }));
 
-gulp.task('test:content', gulp.series('test:prepare:build', cb => {
-  const runner = exec(
-    testBin(CONTENT_TEST_COMMAND),
-    CONTENT_OPTIONS,
-    err => {
-      if (err) {
-        process.exit(1);
-      }
-      cb();
-    },
-  );
-  pipe(runner);
-}));
+gulp.task('test:content', gulp.series('test:prepare:build',
+  runInChildProcess(CONTENT_TEST_COMMAND, LIMIT_MAX_BUFFER_OPTIONS)));
 
 gulp.task('test:content:clean', cb => {
-  pipe(exec(testBin(CONTENT_TEST_COMMAND), CONTENT_OPTIONS, () => cb()));
+  pipe(exec(testBin(CONTENT_TEST_COMMAND), LIMIT_MAX_BUFFER_OPTIONS, () => cb()));
 });
 
 gulp.task('test:content:watch', gulp.series('test:content:clean', () => gulp.watch(['common/script/content/**', 'test/**'], gulp.series('test:content:clean', done => done()))));
@@ -146,7 +128,7 @@ gulp.task('test:content:watch', gulp.series('test:content:clean', () => gulp.wat
 gulp.task('test:content:safe', gulp.series('test:prepare:build', cb => {
   const runner = exec(
     testBin(CONTENT_TEST_COMMAND),
-    CONTENT_OPTIONS,
+    LIMIT_MAX_BUFFER_OPTIONS,
     (err, stdout) => { // eslint-disable-line handle-callback-err
       testResults.push({
         suite: 'Content Specs\t',
@@ -160,93 +142,38 @@ gulp.task('test:content:safe', gulp.series('test:prepare:build', cb => {
   pipe(runner);
 }));
 
-gulp.task('test:api:unit:run', done => {
-  const runner = exec(
-    testBin('istanbul cover --dir coverage/api-unit node_modules/mocha/bin/_mocha -- test/api/unit --recursive --require ./test/helpers/start-server'),
-    err => {
-      if (err) {
-        process.exit(1);
-      }
-      done();
-    },
-  );
-
-  pipe(runner);
-});
+gulp.task('test:api:unit:run',
+  runInChildProcess(integrationTestCommand('test/api/unit', 'coverage/api-unit')));
 
 gulp.task('test:api:unit:watch', () => gulp.watch(['website/server/libs/*', 'test/api/unit/**/*', 'website/server/controllers/**/*'], gulp.series('test:api:unit:run', done => done())));
 
-gulp.task('test:api-v3:integration', done => {
-  const runner = exec(
-    testBin('istanbul cover --dir coverage/api-v3-integration --report lcovonly node_modules/mocha/bin/_mocha -- test/api/v3/integration --recursive --require ./test/helpers/start-server'),
-    { maxBuffer: 500 * 1024 },
-    err => {
-      if (err) {
-        process.exit(1);
-      }
-      done();
-    },
-  );
-
-  pipe(runner);
-});
+gulp.task('test:api-v3:integration', gulp.series('test:prepare:mongo',
+  runInChildProcess(
+    integrationTestCommand('test/api/v3/integration', 'coverage/api-v3-integration'),
+    LIMIT_MAX_BUFFER_OPTIONS,
+  )));
 
 gulp.task('test:api-v3:integration:watch', () => gulp.watch([
   'website/server/controllers/api-v3/**/*', 'common/script/ops/*', 'website/server/libs/*.js',
   'test/api/v3/integration/**/*',
 ], gulp.series('test:api-v3:integration', done => done())));
 
-gulp.task('test:api-v3:integration:separate-server', done => {
-  const runner = exec(
-    testBin('mocha test/api/v3/integration --recursive --require ./test/helpers/start-server', 'LOAD_SERVER=0'),
-    { maxBuffer: 500 * 1024 },
-    err => done(err),
-  );
-
-  pipe(runner);
-});
-
-gulp.task('test:api-v4:integration', done => {
-  const runner = exec(
-    testBin('istanbul cover --dir coverage/api-v4-integration --report lcovonly node_modules/mocha/bin/_mocha -- test/api/v4 --recursive --require ./test/helpers/start-server'),
-    { maxBuffer: 500 * 1024 },
-    err => {
-      if (err) {
-        process.exit(1);
-      }
-      done();
-    },
-  );
-
-  pipe(runner);
-});
-
-gulp.task('test:api-v4:integration:separate-server', done => {
-  const runner = exec(
-    testBin('mocha test/api/v4 --recursive --require ./test/helpers/start-server', 'LOAD_SERVER=0'),
-    { maxBuffer: 500 * 1024 },
-    err => done(err),
-  );
-
-  pipe(runner);
-});
-
-gulp.task('test', gulp.series(
-  'test:sanity',
-  'test:content',
-  'test:common',
-  'test:prepare:mongo',
-  'test:api:unit:run',
-  'test:api-v3:integration',
-  'test:api-v4:integration',
-  done => done(),
+gulp.task('test:api-v3:integration:separate-server', runInChildProcess(
+  'mocha test/api/v3/integration --recursive --require ./test/helpers/start-server',
+  LIMIT_MAX_BUFFER_OPTIONS,
+  'LOAD_SERVER=0',
 ));
 
-gulp.task('test:api-v3', gulp.series(
-  'test:prepare:mongo',
-  'test:api:unit:run',
-  'test:api-v3:integration',
-  done => done(),
+gulp.task('test:api-v4:integration', gulp.series('test:prepare:mongo',
+  runInChildProcess(
+    integrationTestCommand('test/api/v4', 'api-v4-integration'),
+    LIMIT_MAX_BUFFER_OPTIONS,
+  )));
+
+gulp.task('test:api-v4:integration:separate-server', runInChildProcess(
+  'mocha test/api/v4 --recursive --require ./test/helpers/start-server',
+  LIMIT_MAX_BUFFER_OPTIONS,
+  'LOAD_SERVER=0',
 ));
 
 gulp.task('test:api:unit', gulp.series(
@@ -254,3 +181,19 @@ gulp.task('test:api:unit', gulp.series(
   'test:api:unit:run',
   done => done(),
 ));
+
+gulp.task('test', gulp.series(
+  'test:sanity',
+  'test:content',
+  'test:common',
+  'test:api:unit:run',
+  'test:api-v3:integration',
+  'test:api-v4:integration',
+  done => done(),
+));
+
+gulp.task('test:api-v3', gulp.series(
+  'test:api:unit',
+  'test:api-v3:integration',
+  done => done(),
+));

migrations/archive/2020/20200721_summer_splash_orcas.js

@@ -0,0 +1,59 @@
+/* eslint-disable no-console */
+const MIGRATION_NAME = '20200721_summer_splash_orcas';
+
+import { model as User } from '../../../website/server/models/user';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count++;
+
+  let set;
+
+  if (user && user.items && user.items.pets && typeof user.items.pets['Orca-Base'] !== 'undefined') {
+    set = { migration: MIGRATION_NAME };
+  } else if (user && user.items && user.items.mounts && typeof user.items.mounts['Orca-Base'] !== 'undefined') {
+    set = { migration: MIGRATION_NAME, 'items.pets.Orca-Base': 5 };
+  } else {
+    set = { migration: MIGRATION_NAME, 'items.mounts.Orca-Base': true };
+  }
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+
+  return await User.update({ _id: user._id }, { $set: set }).exec();
+}
+
+export default async function processUsers () {
+  let query = {
+    migration: {$ne: MIGRATION_NAME},
+    'auth.timestamps.loggedin': {$gt: new Date('2020-06-21')},
+  };
+
+  const fields = {
+    _id: 1,
+    items: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1],
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};

migrations/archive/2020/20200731_naming_day.js

@@ -0,0 +1,87 @@
+/* eslint-disable no-console */
+const MIGRATION_NAME = '20200731_naming_day';
+import { v4 as uuid } from 'uuid';
+
+import { model as User } from '../../../website/server/models/user';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count++;
+
+  let set;
+  let push;
+  const inc = {
+    'items.food.Cake_Base': 1,
+    'items.food.Cake_CottonCandyBlue': 1,
+    'items.food.Cake_CottonCandyPink': 1,
+    'items.food.Cake_Desert': 1,
+    'items.food.Cake_Golden': 1,
+    'items.food.Cake_Red': 1,
+    'items.food.Cake_Shade': 1,
+    'items.food.Cake_Skeleton': 1,
+    'items.food.Cake_White': 1,
+    'items.food.Cake_Zombie': 1,
+    'achievements.habiticaDays': 1,
+  };
+
+  if (user && user.items && user.items.gear && user.items.gear.owned && typeof user.items.gear.owned.back_special_namingDay2020 !== 'undefined') {
+    set = { migration: MIGRATION_NAME };
+  } else if (user && user.items && user.items.gear && user.items.gear.owned && typeof user.items.gear.owned.body_special_namingDay2018 !== 'undefined') {
+    set = { migration: MIGRATION_NAME, 'items.gear.owned.back_special_namingDay2020': false };
+    push = { pinnedItems: { type: 'marketGear', path: 'gear.flat.back_special_namingDay2020', _id: uuid() }};
+  } else if (user && user.items && user.items.gear && user.items.gear.owned && typeof user.items.gear.owned.head_special_namingDay2017 !== 'undefined') {
+    set = { migration: MIGRATION_NAME, 'items.gear.owned.body_special_namingDay2018': false };
+    push = { pinnedItems: { type: 'marketGear', path: 'gear.flat.body_special_namingDay2018', _id: uuid() }};
+  } else if (user && user.items && user.items.pets && typeof user.items.pets['Gryphon-RoyalPurple'] !== 'undefined') {
+    set = { migration: MIGRATION_NAME, 'items.gear.owned.head_special_namingDay2017': false };
+    push = { pinnedItems: { type: 'marketGear', path: 'gear.flat.head_special_namingDay2017', _id: uuid() }};
+  } else if (user && user.items && user.items.mounts && typeof user.items.mounts['Gryphon-RoyalPurple'] !== 'undefined') {
+    set = { migration: MIGRATION_NAME, 'items.pets.Gryphon-RoyalPurple': 5 };
+  } else {
+    set = { migration: MIGRATION_NAME, 'items.mounts.Gryphon-RoyalPurple': true };
+  }
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+
+  if (push) {
+    return await User.update({ _id: user._id }, { $set: set, $inc: inc, $push: push }).exec();
+  } else {
+    return await User.update({ _id: user._id }, { $set: set, $inc: inc }).exec();
+  }
+}
+
+export default async function processUsers () {
+  let query = {
+    migration: { $ne: MIGRATION_NAME },
+    'auth.timestamps.loggedin': { $gt: new Date('2020-07-01') },
+  };
+
+  const fields = {
+    _id: 1,
+    items: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1]._id,
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};

migrations/archive/2020/20200818_pet_color_achievements.js

@@ -1,5 +1,5 @@
 /* eslint-disable no-console */
-const MIGRATION_NAME = '20200218_pet_color_achievements';
+const MIGRATION_NAME = '20200818_pet_color_achievements';
 import { model as User } from '../../../website/server/models/user';
 
 const progressCount = 1000;
@@ -14,31 +14,31 @@ async function updateUser (user) {
 
   if (user && user.items && user.items.pets) {
     const pets = user.items.pets;
-    if (pets['Wolf-CottonCandyPink'] > 0
-      && pets['TigerCub-CottonCandyPink'] > 0
-      && pets['PandaCub-CottonCandyPink'] > 0
-      && pets['LionCub-CottonCandyPink'] > 0
-      && pets['Fox-CottonCandyPink'] > 0
-      && pets['FlyingPig-CottonCandyPink'] > 0
-      && pets['Dragon-CottonCandyPink'] > 0
-      && pets['Cactus-CottonCandyPink'] > 0
-      && pets['BearCub-CottonCandyPink'] > 0) {
-        set['achievements.tickledPink'] = true;
+    if (pets['Wolf-Golden'] > 0
+      && pets['TigerCub-Golden'] > 0
+      && pets['PandaCub-Golden'] > 0
+      && pets['LionCub-Golden'] > 0
+      && pets['Fox-Golden'] > 0
+      && pets['FlyingPig-Golden'] > 0
+      && pets['Dragon-Golden'] > 0
+      && pets['Cactus-Golden'] > 0
+      && pets['BearCub-Golden'] > 0) {
+        set['achievements.goodAsGold'] = true;
       }
   }
 
   if (user && user.items && user.items.mounts) {
     const mounts = user.items.mounts;
-    if (mounts['Wolf-CottonCandyPink']
-      && mounts['TigerCub-CottonCandyPink']
-      && mounts['PandaCub-CottonCandyPink']
-      && mounts['LionCub-CottonCandyPink']
-      && mounts['Fox-CottonCandyPink']
-      && mounts['FlyingPig-CottonCandyPink']
-      && mounts['Dragon-CottonCandyPink']
-      && mounts['Cactus-CottonCandyPink']
-      && mounts['BearCub-CottonCandyPink'] ) {
-        set['achievements.rosyOutlook'] = true;
+    if (mounts['Wolf-Golden']
+      && mounts['TigerCub-Golden']
+      && mounts['PandaCub-Golden']
+      && mounts['LionCub-Golden']
+      && mounts['Fox-Golden']
+      && mounts['FlyingPig-Golden']
+      && mounts['Dragon-Golden']
+      && mounts['Cactus-Golden']
+      && mounts['BearCub-Golden'] ) {
+        set['achievements.allThatGlitters'] = true;
       }
   }
 
@@ -50,7 +50,7 @@ async function updateUser (user) {
 module.exports = async function processUsers () {
   let query = {
     migration: { $ne: MIGRATION_NAME },
-    'auth.timestamps.loggedin': { $gt: new Date('2020-02-01') },
+    'auth.timestamps.loggedin': { $gt: new Date('2020-08-01') },
   };
 
   const fields = {

migrations/archive/2020/20201020_pet_color_achievements.js

@@ -0,0 +1,82 @@
+/* eslint-disable no-console */
+const MIGRATION_NAME = '20201020_pet_color_achievements';
+import { model as User } from '../../../website/server/models/user';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count++;
+
+  const set = {
+    migration: MIGRATION_NAME,
+  };
+
+  if (user && user.items && user.items.pets) {
+    const pets = user.items.pets;
+    if (pets['Wolf-Golden'] > 0
+      && pets['TigerCub-Skeleton'] > 0
+      && pets['PandaCub-Skeleton'] > 0
+      && pets['LionCub-Skeleton'] > 0
+      && pets['Fox-Skeleton'] > 0
+      && pets['FlyingPig-Skeleton'] > 0
+      && pets['Dragon-Skeleton'] > 0
+      && pets['Cactus-Skeleton'] > 0
+      && pets['BearCub-Skeleton'] > 0) {
+        set['achievements.boneCollector'] = true;
+      }
+  }
+
+  if (user && user.items && user.items.mounts) {
+    const mounts = user.items.mounts;
+    if (mounts['Wolf-Skeleton']
+      && mounts['TigerCub-Skeleton']
+      && mounts['PandaCub-Skeleton']
+      && mounts['LionCub-Skeleton']
+      && mounts['Fox-Skeleton']
+      && mounts['FlyingPig-Skeleton']
+      && mounts['Dragon-Skeleton']
+      && mounts['Cactus-Skeleton']
+      && mounts['BearCub-Skeleton'] ) {
+        set['achievements.skeletonCrew'] = true;
+      }
+  }
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+
+  return await User.update({ _id: user._id }, { $set: set }).exec();
+}
+
+module.exports = async function processUsers () {
+  let query = {
+    migration: { $ne: MIGRATION_NAME },
+    'auth.timestamps.loggedin': { $gt: new Date('2020-10-01') },
+  };
+
+  const fields = {
+    _id: 1,
+    items: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1]._id,
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};

migrations/archive/2020/20201029_habitoween_ladder.js

@@ -0,0 +1,84 @@
+/*
+ * Award Habitoween ladder items to participants in this month's Habitoween festivities
+ */
+/* eslint-disable no-console */
+
+const MIGRATION_NAME = '20201029_habitoween_ladder'; // Update when running in future years
+
+import { model as User } from '../../../website/server/models/user';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count++;
+
+  const set = {};
+  const inc = {
+    'items.food.Candy_Skeleton': 1,
+    'items.food.Candy_Base': 1,
+    'items.food.Candy_CottonCandyBlue': 1,
+    'items.food.Candy_CottonCandyPink': 1,
+    'items.food.Candy_Shade': 1,
+    'items.food.Candy_White': 1,
+    'items.food.Candy_Golden': 1,
+    'items.food.Candy_Zombie': 1,
+    'items.food.Candy_Desert': 1,
+    'items.food.Candy_Red': 1,
+  };
+
+  set.migration = MIGRATION_NAME;
+
+  if (user && user.items && user.items.mounts && user.items.mounts['JackOLantern-Glow']) {
+    set['items.pets.JackOLantern-RoyalPurple'] = 5;
+  } else if (user && user.items && user.items.pets && user.items.pets['JackOLantern-Glow']) {
+    set['items.mounts.JackOLantern-Glow'] = true;
+  } else if (user && user.items && user.items.mounts && user.items.mounts['JackOLantern-Ghost']) {
+    set['items.pets.JackOLantern-Glow'] = 5;
+  } else if (user && user.items && user.items.pets && user.items.pets['JackOLantern-Ghost']) {
+    set['items.mounts.JackOLantern-Ghost'] = true;
+  } else if (user && user.items && user.items.mounts && user.items.mounts['JackOLantern-Base']) {
+    set['items.pets.JackOLantern-Ghost'] = 5;
+  } else if (user && user.items && user.items.pets && user.items.pets['JackOLantern-Base']) {
+    set['items.mounts.JackOLantern-Base'] = true;
+  } else {
+    set['items.pets.JackOLantern-Base'] = 5;
+  }
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+  return await User.update({_id: user._id}, {$inc: inc, $set: set}).exec();
+}
+
+module.exports = async function processUsers () {
+  let query = {
+    migration: {$ne: MIGRATION_NAME},
+    'auth.timestamps.loggedin': {$gt: new Date('2020-10-01')},
+  };
+
+  const fields = {
+    _id: 1,
+    items: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1],
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};

migrations/archive/2020/20201102_fix_habitoween.js

@@ -0,0 +1,58 @@
+/*
+ * Fix JackOLantern-Base for users that signed up recently
+ */
+/* eslint-disable no-console */
+
+const MIGRATION_NAME = '20201102_fix_habitoween'; // Update when running in future years
+
+import { model as User } from '../../../website/server/models/user';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count++;
+
+  const set = {};
+
+  set.migration = MIGRATION_NAME;
+  set['items.pets.JackOLantern-Base'] = 5;
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+  return await User.update({_id: user._id}, {$inc: inc, $set: set}).exec();
+}
+
+module.exports = async function processUsers () {
+  let query = {
+    migration: {$ne: MIGRATION_NAME},
+    'auth.timestamps.created': {$gt: new Date('2020-10-26')},
+    'items.pets.JackOLantern-Base': true,
+  };
+
+  const fields = {
+    _id: 1,
+    items: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1],
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};

migrations/archive/2020/20201103_drop_cap_ab_tweaks.js

@@ -0,0 +1,62 @@
+/*
+ * All web users should be enrolled in the Drop Cap AB Test
+ */
+/* eslint-disable no-console */
+
+const MIGRATION_NAME = '20201103_drop_cap_ab_tweaks';
+
+import { model as User } from '../../../website/server/models/user';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count++;
+
+  const set = {};
+
+  set.migration = MIGRATION_NAME;
+
+  const testGroup = Math.random();
+  // Enroll 100% of users, splitting them 50/50
+  const value = testGroup <= 0.50 ? 'drop-cap-notif-enabled' : 'drop-cap-notif-disabled';
+  set['_ABtests.dropCapNotif'] = value;
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+  return await User.update({_id: user._id}, {$set: set}).exec();
+}
+
+module.exports = async function processUsers () {
+  let query = {
+    migration: {$ne: MIGRATION_NAME},
+    'auth.timestamps.loggedin': {$gt: new Date('2020-10-10')},
+    '_ABtests.dropCapNotif': 'drop-cap-notif-not-enrolled',
+  };
+
+  const fields = {
+    _id: 1,
+    _ABtests: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1],
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};

migrations/users/tag-challenge-field-string2bool.js

@@ -0,0 +1,73 @@
+import { model as User } from '../../website/server/models/user';
+
+const MIGRATION_NAME = 'tag-challenge-field-string2bool';
+
+const progressCount = 1000;
+let count = 0;
+
+export default async function processUsers () {
+  const query = {
+    migration: { $ne: MIGRATION_NAME },
+    tags: {
+      $elemMatch: {
+        challenge: {
+          $exists: true,
+          $type: 'string',
+        },
+      },
+    },
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    // eslint-disable-next-line no-await-in-loop
+    const users = await User.find(query)
+      .sort({ _id: 1 })
+      .limit(250)
+      .select({ _id: 1, tags: 1 })
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1],
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+}
+
+async function updateUser (user) {
+  count += 1;
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+  let requiresUpdate = false;
+
+  if (user && user.tags) {
+    user.tags.forEach(tag => {
+      if (tag && typeof tag.challenge === 'string') {
+        requiresUpdate = true;
+        if (tag.challenge === 'true') {
+          tag.challenge = true;
+        } else if (tag.challenge === 'false') {
+          tag.challenge = false;
+        } else {
+          tag.challenge = null;
+        }
+      }
+    });
+  }
+
+  if (requiresUpdate) {
+    const set = {
+      migration: MIGRATION_NAME,
+      tags: user.tags,
+    };
+    return User.update({ _id: user._id }, { $set: set }).exec();
+  }
+
+  return null;
+}

package.json

@@ -1,18 +1,18 @@
 {
   "name": "habitica",
   "description": "A habit tracker app which treats your goals like a Role Playing Game.",
-  "version": "4.148.2",
+  "version": "4.169.1",
   "main": "./website/server/index.js",
   "dependencies": {
-    "@babel/core": "^7.10.3",
-    "@babel/preset-env": "^7.10.3",
-    "@babel/register": "^7.10.3",
-    "@google-cloud/trace-agent": "^5.1.0",
+    "@babel/core": "^7.12.3",
+    "@babel/preset-env": "^7.12.1",
+    "@babel/register": "^7.12.1",
+    "@google-cloud/trace-agent": "^5.1.1",
     "@slack/client": "^4.12.0",
     "accepts": "^1.3.5",
     "amazon-payments": "^0.2.8",
     "amplitude": "^3.5.0",
-    "apidoc": "^0.23.0",
+    "apidoc": "^0.25.0",
     "apn": "^2.2.0",
     "apple-auth": "^1.0.6",
     "bcrypt": "^5.0.0",
@@ -20,7 +20,7 @@
     "compression": "^1.7.4",
     "cookie-session": "^1.4.0",
     "coupon-code": "^0.4.5",
-    "csv-stringify": "^5.5.0",
+    "csv-stringify": "^5.5.1",
     "cwait": "^1.1.1",
     "domain-middleware": "~0.1.0",
     "eslint": "^6.8.0",
@@ -30,49 +30,51 @@
     "express-basic-auth": "^1.1.5",
     "express-validator": "^5.2.0",
     "glob": "^7.1.6",
-    "got": "^11.3.0",
+    "got": "^11.8.0",
     "gulp": "^4.0.0",
     "gulp-babel": "^8.0.0",
     "gulp-imagemin": "^7.1.0",
     "gulp-nodemon": "^2.5.0",
     "gulp.spritesmith": "^6.9.0",
-    "habitica-markdown": "^2.0.2",
+    "habitica-markdown": "^3.0.0",
     "helmet": "^3.23.3",
-    "image-size": "^0.8.3",
+    "image-size": "^0.9.3",
     "in-app-purchase": "^1.11.3",
     "js2xmlparser": "^4.0.1",
     "jsonwebtoken": "^8.5.1",
-    "jwks-rsa": "^1.8.1",
-    "lodash": "^4.17.15",
+    "jwks-rsa": "^1.11.0",
+    "lodash": "^4.17.20",
     "merge-stream": "^2.0.0",
     "method-override": "^3.0.0",
-    "moment": "^2.27.0",
+    "moment": "^2.29.1",
     "moment-recur": "^1.0.7",
-    "mongoose": "^5.9.20",
+    "mongoose": "^5.10.11",
     "morgan": "^1.10.0",
     "nconf": "^0.10.0",
-    "node-gcm": "^1.0.2",
+    "node-gcm": "^1.0.3",
     "on-headers": "^1.0.2",
     "passport": "^0.4.1",
     "passport-facebook": "^3.0.0",
     "passport-google-oauth2": "^0.2.0",
     "passport-google-oauth20": "1.0.0",
-    "paypal-ipn": "3.0.0",
     "paypal-rest-sdk": "^1.8.1",
+    "pp-ipn": "^1.1.0",
     "ps-tree": "^1.0.0",
-    "regenerator-runtime": "^0.13.5",
+    "rate-limiter-flexible": "^2.1.13",
+    "redis": "^3.0.2",
+    "regenerator-runtime": "^0.13.7",
     "remove-markdown": "^0.3.0",
     "rimraf": "^3.0.2",
     "short-uuid": "^3.0.0",
     "stripe": "^7.15.0",
-    "superagent": "^5.3.1",
-    "universal-analytics": "^0.4.17",
+    "superagent": "^6.1.0",
+    "universal-analytics": "^0.4.23",
     "useragent": "^2.1.9",
-    "uuid": "^8.2.0",
-    "validator": "^13.1.1",
+    "uuid": "^8.3.1",
+    "validator": "^13.1.17",
     "vinyl-buffer": "^1.0.1",
     "winston": "^3.3.3",
-    "winston-loggly-bulk": "^3.1.0",
+    "winston-loggly-bulk": "^3.1.1",
     "xml2js": "^0.4.23"
   },
   "private": true,
@@ -102,20 +104,24 @@
     "client:unit": "cd website/client && npm run test:unit",
     "start": "gulp nodemon",
     "debug": "gulp nodemon --inspect",
+    "mongo:dev": "run-rs -v 4.2.8 -l ubuntu1804 --keep --dbpath mongodb-data --number 1 --quiet",
     "postinstall": "gulp build && cd website/client && npm install",
     "apidoc": "gulp apidoc"
   },
   "devDependencies": {
-    "axios": "^0.19.2",
+    "axios": "^0.21.0",
     "chai": "^4.1.2",
     "chai-as-promised": "^7.1.1",
+    "chai-moment": "^0.1.0",
     "chalk": "^4.1.0",
+    "cross-spawn": "^7.0.3",
     "expect.js": "^0.3.1",
     "istanbul": "^1.1.0-alpha.1",
     "mocha": "^5.1.1",
-    "monk": "^7.3.0",
+    "monk": "^7.3.2",
     "require-again": "^2.0.0",
-    "sinon": "^9.0.2",
+    "run-rs": "^0.6.2",
+    "sinon": "^9.2.1",
     "sinon-chai": "^3.5.0",
     "sinon-stub-promise": "^4.0.0"
   },

scripts/gdpr-delete-users.js

@@ -31,19 +31,22 @@ async function deleteAmplitudeData (userId, email) {
       console.log(`${userId} (${email}) Amplitude response: ${response.status} ${response.statusText}`);
     }
   }
+  await new Promise(resolve => setTimeout(resolve, 1000));
 }
 
 async function deleteHabiticaData (user, email) {
   const truncatedEmail = email.slice(0, email.indexOf('@'));
   const set = {
+    'auth.blocked': false,
     'auth.local.hashed_password': '$2a$10$QDnNh1j1yMPnTXDEOV38xOePEWFd4X8DSYwAM8XTmqmacG5X0DKjW',
     'auth.local.passwordHashMethod': 'bcrypt',
   };
-  if (!user.auth.local.email) set['auth.local.email'] = `${truncatedEmail}@example.com`;
+  if (!user.auth.local.email) set['auth.local.email'] = `${truncatedEmail}-gdpr@example.com`;
   await User.update(
     { _id: user._id },
     { $set: set },
   );
+  await new Promise(resolve => setTimeout(resolve, 1000));
   const response = await axios.delete(
     `${BASE_URL}/api/v3/user`,
     {

test/api/unit/libs/cron.test.js

@@ -42,13 +42,13 @@ describe('cron', () => {
   });
 
   it('updates user.preferences.timezoneOffsetAtLastCron', () => {
-    const timezoneOffsetFromUserPrefs = 1;
+    const timezoneUtcOffsetFromUserPrefs = -1;
 
     cron({
-      user, tasksByType, daysMissed, analytics, timezoneOffsetFromUserPrefs,
+      user, tasksByType, daysMissed, analytics, timezoneUtcOffsetFromUserPrefs,
     });
 
-    expect(user.preferences.timezoneOffsetAtLastCron).to.equal(timezoneOffsetFromUserPrefs);
+    expect(user.preferences.timezoneOffsetAtLastCron).to.equal(1);
   });
 
   it('resets user.items.lastDrop.count', () => {
@@ -240,7 +240,7 @@ describe('cron', () => {
       user1.purchased.plan.consecutive.gemCapExtra = 0;
 
       it('does not increment consecutive benefits after the first month', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(1, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(1, 'months')
           .add(2, 'days')
           .toDate());
         // Add 1 month to simulate what happens a month after the subscription was created.
@@ -256,7 +256,7 @@ describe('cron', () => {
       });
 
       it('does not increment consecutive benefits after the second month', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(2, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(2, 'months')
           .add(2, 'days')
           .toDate());
         // Add 1 month to simulate what happens a month after the subscription was created.
@@ -272,7 +272,7 @@ describe('cron', () => {
       });
 
       it('increments consecutive benefits after the third month', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(3, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(3, 'months')
           .add(2, 'days')
           .toDate());
         // Add 1 month to simulate what happens a month after the subscription was created.
@@ -288,7 +288,7 @@ describe('cron', () => {
       });
 
       it('does not increment consecutive benefits after the fourth month', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(4, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(4, 'months')
           .add(2, 'days')
           .toDate());
         // Add 1 month to simulate what happens a month after the subscription was created.
@@ -304,7 +304,7 @@ describe('cron', () => {
       });
 
       it('increments consecutive benefits correctly if user has been absent with continuous subscription', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(10, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(10, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -339,7 +339,7 @@ describe('cron', () => {
       user3.purchased.plan.consecutive.gemCapExtra = 5;
 
       it('does not increment consecutive benefits in the first month of the first paid period that they already have benefits for', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(1, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(1, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -352,7 +352,7 @@ describe('cron', () => {
       });
 
       it('does not increment consecutive benefits in the middle of the period that they already have benefits for', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(2, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(2, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -365,7 +365,7 @@ describe('cron', () => {
       });
 
       it('does not increment consecutive benefits in the final month of the period that they already have benefits for', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(3, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(3, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -378,7 +378,7 @@ describe('cron', () => {
       });
 
       it('increments consecutive benefits the month after the second paid period has started', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(4, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(4, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -391,7 +391,7 @@ describe('cron', () => {
       });
 
       it('does not increment consecutive benefits in the second month of the second period that they already have benefits for', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(5, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(5, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -404,7 +404,7 @@ describe('cron', () => {
       });
 
       it('does not increment consecutive benefits in the final month of the second period that they already have benefits for', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(6, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(6, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -417,7 +417,7 @@ describe('cron', () => {
       });
 
       it('increments consecutive benefits the month after the third paid period has started', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(7, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(7, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -430,7 +430,7 @@ describe('cron', () => {
       });
 
       it('increments consecutive benefits correctly if user has been absent with continuous subscription', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(10, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(10, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -465,7 +465,7 @@ describe('cron', () => {
       user6.purchased.plan.consecutive.gemCapExtra = 10;
 
       it('does not increment consecutive benefits in the first month of the first paid period that they already have benefits for', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(1, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(1, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -478,7 +478,7 @@ describe('cron', () => {
       });
 
       it('does not increment consecutive benefits in the final month of the period that they already have benefits for', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(6, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(6, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -491,7 +491,7 @@ describe('cron', () => {
       });
 
       it('increments consecutive benefits the month after the second paid period has started', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(7, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(7, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -504,7 +504,7 @@ describe('cron', () => {
       });
 
       it('increments consecutive benefits the month after the third paid period has started', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(13, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(13, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -517,7 +517,7 @@ describe('cron', () => {
       });
 
       it('increments consecutive benefits correctly if user has been absent with continuous subscription', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(19, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(19, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -552,7 +552,7 @@ describe('cron', () => {
       user12.purchased.plan.consecutive.gemCapExtra = 20;
 
       it('does not increment consecutive benefits in the first month of the first paid period that they already have benefits for', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(1, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(1, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -565,7 +565,7 @@ describe('cron', () => {
       });
 
       it('does not increment consecutive benefits in the final month of the period that they already have benefits for', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(12, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(12, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -578,7 +578,7 @@ describe('cron', () => {
       });
 
       it('increments consecutive benefits the month after the second paid period has started', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(13, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(13, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -591,7 +591,7 @@ describe('cron', () => {
       });
 
       it('increments consecutive benefits the month after the third paid period has started', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(25, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(25, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -604,7 +604,7 @@ describe('cron', () => {
       });
 
       it('increments consecutive benefits correctly if user has been absent with continuous subscription', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(37, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(37, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -641,7 +641,7 @@ describe('cron', () => {
       user3g.purchased.plan.consecutive.gemCapExtra = 5;
 
       it('does not increment consecutive benefits in the first month of the gift subscription', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(1, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(1, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -654,7 +654,7 @@ describe('cron', () => {
       });
 
       it('does not increment consecutive benefits in the second month of the gift subscription', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(2, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(2, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -667,7 +667,7 @@ describe('cron', () => {
       });
 
       it('does not increment consecutive benefits in the third month of the gift subscription', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(3, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(3, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -680,7 +680,7 @@ describe('cron', () => {
       });
 
       it('does not increment consecutive benefits in the month after the gift subscription has ended', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(4, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(4, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -717,7 +717,7 @@ describe('cron', () => {
       user6x.purchased.plan.consecutive.gemCapExtra = 15;
 
       it('increments consecutive benefits in the first month since the fix for #4819 goes live', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(1, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(1, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -730,7 +730,7 @@ describe('cron', () => {
       });
 
       it('does not increment consecutive benefits in the second month after the fix goes live', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(2, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(2, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -743,7 +743,7 @@ describe('cron', () => {
       });
 
       it('does not increment consecutive benefits in the third month after the fix goes live', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(3, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(3, 'months')
           .add(2, 'days')
           .toDate());
         cron({
@@ -756,7 +756,7 @@ describe('cron', () => {
       });
 
       it('increments consecutive benefits in the seventh month after the fix goes live', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(7, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(7, 'months')
           .add(2, 'days')
           .toDate());
         cron({

test/api/unit/libs/highlightMentions.test.js

@@ -171,28 +171,32 @@ describe('highlightMentions', () => {
   it('github issue 12118, method crashes when square brackets are used', async () => {
     const text = '[test]';
 
-    let err;
+    const result = await highlightMentions(text);
 
-    try {
-      await highlightMentions(text);
-    } catch (e) {
-      err = e;
-    }
-
-    expect(err).to.be.undefined;
+    expect(result[0]).to.equal(text);
   });
 
   it('github issue 12138, method crashes when regex chars are used in code block', async () => {
     const text = '`[test]`';
 
-    let err;
+    const result = await highlightMentions(text);
 
-    try {
-      await highlightMentions(text);
-    } catch (e) {
-      err = e;
-    }
+    expect(result[0]).to.equal(text);
+  });
 
-    expect(err).to.be.undefined;
+  it('github issue 12586, method crashes when empty link is used', async () => {
+    const text = '[]()';
+
+    const result = await highlightMentions(text);
+
+    expect(result[0]).to.equal(text);
+  });
+
+  it('github issue 12586, method crashes when link without title is used', async () => {
+    const text = '[](www.google.com)';
+
+    const result = await highlightMentions(text);
+
+    expect(result[0]).to.equal(text);
   });
 });

test/api/unit/libs/mongodb.js

@@ -0,0 +1,50 @@
+import os from 'os';
+import nconf from 'nconf';
+import requireAgain from 'require-again';
+
+const pathToMongoLib = '../../../../website/server/libs/mongodb';
+
+describe('mongodb', () => {
+  afterEach(() => {
+    sandbox.restore();
+  });
+
+  describe('getDevelopmentConnectionUrl', () => {
+    it('returns the original connection url if not on windows', () => {
+      sandbox.stub(os, 'platform').returns('linux');
+      const mongoLibOverride = requireAgain(pathToMongoLib);
+
+      const originalString = 'mongodb://localhost:3030';
+      const string = mongoLibOverride.getDevelopmentConnectionUrl(originalString);
+      expect(string).to.equal(originalString);
+    });
+
+    it('replaces localhost with hostname on windows', () => {
+      sandbox.stub(os, 'platform').returns('win32');
+      sandbox.stub(os, 'hostname').returns('hostname');
+      const mongoLibOverride = requireAgain(pathToMongoLib);
+
+      const originalString = 'mongodb://localhost:3030';
+      const string = mongoLibOverride.getDevelopmentConnectionUrl(originalString);
+      expect(string).to.equal('mongodb://hostname:3030');
+    });
+  });
+
+  describe('getDefaultConnectionOptions', () => {
+    it('returns development config when IS_PROD is false', () => {
+      sandbox.stub(nconf, 'get').withArgs('IS_PROD').returns(false);
+      const mongoLibOverride = requireAgain(pathToMongoLib);
+
+      const options = mongoLibOverride.getDefaultConnectionOptions();
+      expect(options).to.have.all.keys(['useNewUrlParser', 'useUnifiedTopology']);
+    });
+
+    it('returns production config when IS_PROD is true', () => {
+      sandbox.stub(nconf, 'get').withArgs('IS_PROD').returns(true);
+      const mongoLibOverride = requireAgain(pathToMongoLib);
+
+      const options = mongoLibOverride.getDefaultConnectionOptions();
+      expect(options).to.have.all.keys(['useNewUrlParser', 'useUnifiedTopology', 'keepAlive', 'keepAliveInitialDelay']);
+    });
+  });
+});

test/api/unit/libs/payments/amazon/checkout.test.js

@@ -2,13 +2,14 @@ import { model as User } from '../../../../../../website/server/models/user';
 import amzLib from '../../../../../../website/server/libs/payments/amazon';
 import payments from '../../../../../../website/server/libs/payments/payments';
 import common from '../../../../../../website/common';
+import apiError from '../../../../../../website/server/libs/apiError';
 
 const { i18n } = common;
 
 describe('Amazon Payments - Checkout', () => {
   const subKey = 'basic_3mo';
   let user; let orderReferenceId; let
-    headers;
+    headers; const gemsBlockKey = '21gems'; const gemsBlock = common.content.gems[gemsBlockKey];
   let setOrderReferenceDetailsSpy;
   let confirmOrderReferenceSpy;
   let authorizeSpy;
@@ -16,7 +17,7 @@ describe('Amazon Payments - Checkout', () => {
 
   let paymentBuyGemsStub;
   let paymentCreateSubscritionStub;
-  let amount = 5;
+  let amount = gemsBlock.price / 100;
 
   function expectOrderReferenceSpy () {
     expect(setOrderReferenceDetailsSpy).to.be.calledOnce;
@@ -107,13 +108,20 @@ describe('Amazon Payments - Checkout', () => {
       paymentMethod,
       headers,
     };
-    if (gift) expectedArgs.gift = gift;
+    if (gift) {
+      expectedArgs.gift = gift;
+      expectedArgs.gemsBlock = undefined;
+    } else {
+      expectedArgs.gemsBlock = gemsBlock;
+    }
     expect(paymentBuyGemsStub).to.be.calledWith(expectedArgs);
   }
 
   it('should purchase gems', async () => {
     sinon.stub(user, 'canGetGems').resolves(true);
-    await amzLib.checkout({ user, orderReferenceId, headers });
+    await amzLib.checkout({
+      user, orderReferenceId, headers, gemsBlock: gemsBlockKey,
+    });
 
     expectBuyGemsStub(amzLib.constants.PAYMENT_METHOD);
     expectAmazonStubs();
@@ -144,7 +152,9 @@ describe('Amazon Payments - Checkout', () => {
 
   it('should error if user cannot get gems gems', async () => {
     sinon.stub(user, 'canGetGems').resolves(false);
-    await expect(amzLib.checkout({ user, orderReferenceId, headers }))
+    await expect(amzLib.checkout({
+      user, orderReferenceId, headers, gemsBlock: gemsBlockKey,
+    }))
       .to.eventually.be.rejected.and.to.eql({
         httpCode: 401,
         message: i18n.t('groupPolicyCannotGetGems'),
@@ -153,6 +163,17 @@ describe('Amazon Payments - Checkout', () => {
     user.canGetGems.restore();
   });
 
+  it('should error if gems block is not valid', async () => {
+    await expect(amzLib.checkout({
+      user, orderReferenceId, headers, gemsBlock: 'invalid',
+    }))
+      .to.eventually.be.rejected.and.to.eql({
+        httpCode: 400,
+        message: apiError('invalidGemsBlock'),
+        name: 'BadRequest',
+      });
+  });
+
   it('should gift gems', async () => {
     const receivingUser = new User();
     await receivingUser.save();
@@ -195,6 +216,7 @@ describe('Amazon Payments - Checkout', () => {
       paymentMethod: amzLib.constants.PAYMENT_METHOD_GIFT,
       headers,
       gift,
+      gemsBlock: undefined,
     });
     expectAmazonStubs();
   });

test/api/unit/libs/payments/amazon/upgrade-groupplan.test.js

@@ -31,11 +31,14 @@ describe('#upgradeGroupPlan', () => {
     group = generateGroup({
       name: 'test group',
       type: 'guild',
-      privacy: 'public',
+      privacy: 'private',
       leader: user._id,
     });
     await group.save();
 
+    user.guilds.push(group._id);
+    await user.save();
+
     spy = sinon.stub(amzLib, 'authorizeOnBillingAgreement');
     spy.resolves([]);
 

test/api/unit/libs/payments/apple.test.js

@@ -5,7 +5,6 @@ import applePayments from '../../../../../website/server/libs/payments/apple';
 import iap from '../../../../../website/server/libs/inAppPurchases';
 import { model as User } from '../../../../../website/server/models/user';
 import common from '../../../../../website/common';
-import { mockFindById, restoreFindById } from '../../../../helpers/mongoose.helper';
 
 const { i18n } = common;
 
@@ -84,7 +83,7 @@ describe('Apple Payments', () => {
       user.canGetGems.restore();
     });
 
-    it('errors if amount does not exist', async () => {
+    it('errors if gemsBlock does not exist', async () => {
       sinon.stub(user, 'canGetGems').resolves(true);
       iapGetPurchaseDataStub.restore();
       iapGetPurchaseDataStub = sinon.stub(iap, 'getPurchaseData')
@@ -106,23 +105,23 @@ describe('Apple Payments', () => {
     const gemsCanPurchase = [
       {
         productId: 'com.habitrpg.ios.Habitica.4gems',
-        amount: 1,
+        gemsBlock: '4gems',
       },
       {
         productId: 'com.habitrpg.ios.Habitica.20gems',
-        amount: 5.25,
+        gemsBlock: '21gems',
       },
       {
         productId: 'com.habitrpg.ios.Habitica.21gems',
-        amount: 5.25,
+        gemsBlock: '21gems',
       },
       {
         productId: 'com.habitrpg.ios.Habitica.42gems',
-        amount: 10.5,
+        gemsBlock: '42gems',
       },
       {
         productId: 'com.habitrpg.ios.Habitica.84gems',
-        amount: 21,
+        gemsBlock: '84gems',
       },
     ];
 
@@ -149,8 +148,9 @@ describe('Apple Payments', () => {
         expect(paymentBuyGemsStub).to.be.calledWith({
           user,
           paymentMethod: applePayments.constants.PAYMENT_METHOD_APPLE,
-          amount: gemTest.amount,
+          gemsBlock: common.content.gems[gemTest.gemsBlock],
           headers,
+          gift: undefined,
         });
         expect(user.canGetGems).to.be.calledOnce;
         user.canGetGems.restore();
@@ -161,8 +161,6 @@ describe('Apple Payments', () => {
       const receivingUser = new User();
       await receivingUser.save();
 
-      mockFindById(receivingUser);
-
       iapGetPurchaseDataStub.restore();
       iapGetPurchaseDataStub = sinon.stub(iap, 'getPurchaseData')
         .returns([{
@@ -184,12 +182,17 @@ describe('Apple Payments', () => {
 
       expect(paymentBuyGemsStub).to.be.calledOnce;
       expect(paymentBuyGemsStub).to.be.calledWith({
-        user: receivingUser,
+        user,
         paymentMethod: applePayments.constants.PAYMENT_METHOD_APPLE,
-        amount: gemsCanPurchase[0].amount,
         headers,
+        gift: {
+          type: 'gems',
+          gems: { amount: 4 },
+          member: sinon.match({ _id: receivingUser._id }),
+          uuid: receivingUser._id,
+        },
+        gemsBlock: common.content.gems['4gems'],
       });
-      restoreFindById();
     });
   });
 

test/api/unit/libs/payments/gems.test.js

@@ -0,0 +1,14 @@
+import common from '../../../../../website/common';
+import { getGemsBlock } from '../../../../../website/server/libs/payments/gems';
+
+describe('payments/gems', () => {
+  describe('#getGemsBlock', () => {
+    it('throws an error if the gem block key is invalid', () => {
+      expect(() => getGemsBlock('invalid')).to.throw;
+    });
+
+    it('returns the gem block for the given key', () => {
+      expect(getGemsBlock('21gems')).to.equal(common.content.gems['21gems']);
+    });
+  });
+});

test/api/unit/libs/payments/google.test.js

@@ -5,7 +5,6 @@ import googlePayments from '../../../../../website/server/libs/payments/google';
 import iap from '../../../../../website/server/libs/inAppPurchases';
 import { model as User } from '../../../../../website/server/models/user';
 import common from '../../../../../website/common';
-import { mockFindById, restoreFindById } from '../../../../helpers/mongoose.helper';
 
 const { i18n } = common;
 
@@ -14,7 +13,7 @@ describe('Google Payments', () => {
 
   describe('verifyGemPurchase', () => {
     let sku; let user; let token; let receipt; let signature; let
-      headers;
+      headers; const gemsBlock = common.content.gems['21gems'];
     let iapSetupStub; let iapValidateStub; let iapIsValidatedStub; let
       paymentBuyGemsStub;
 
@@ -103,8 +102,9 @@ describe('Google Payments', () => {
       expect(paymentBuyGemsStub).to.be.calledWith({
         user,
         paymentMethod: googlePayments.constants.PAYMENT_METHOD_GOOGLE,
-        amount: 5.25,
+        gemsBlock,
         headers,
+        gift: undefined,
       });
       expect(user.canGetGems).to.be.calledOnce;
       user.canGetGems.restore();
@@ -114,8 +114,6 @@ describe('Google Payments', () => {
       const receivingUser = new User();
       await receivingUser.save();
 
-      mockFindById(receivingUser);
-
       const gift = { uuid: receivingUser._id };
       await googlePayments.verifyGemPurchase({
         user, gift, receipt, signature, headers,
@@ -132,12 +130,17 @@ describe('Google Payments', () => {
 
       expect(paymentBuyGemsStub).to.be.calledOnce;
       expect(paymentBuyGemsStub).to.be.calledWith({
-        user: receivingUser,
+        user,
         paymentMethod: googlePayments.constants.PAYMENT_METHOD_GOOGLE,
-        amount: 5.25,
+        gemsBlock,
         headers,
+        gift: {
+          type: 'gems',
+          gems: { amount: 21 },
+          member: sinon.match({ _id: receivingUser._id }),
+          uuid: receivingUser._id,
+        },
       });
-      restoreFindById();
     });
   });
 

test/api/unit/libs/payments/group-plans/group-payments-cancel.test.js

@@ -21,11 +21,14 @@ describe('Canceling a subscription for group', () => {
     group = generateGroup({
       name: 'test group',
       type: 'guild',
-      privacy: 'public',
+      privacy: 'private',
       leader: user._id,
     });
     await group.save();
 
+    user.guilds.push(group._id);
+    await user.save();
+
     data = {
       user,
       sub: {
@@ -141,6 +144,8 @@ describe('Canceling a subscription for group', () => {
 
   it('prevents non group leader from managing subscription', async () => {
     const groupMember = new User();
+    groupMember.guilds.push(group._id);
+    await groupMember.save();
     data.user = groupMember;
     data.groupId = group._id;
 
@@ -162,7 +167,9 @@ describe('Canceling a subscription for group', () => {
 
     let updatedGroup = await Group.findById(group._id).exec();
     const newLeader = new User();
+    newLeader.profile.name = 'newLeader';
     updatedGroup.leader = newLeader._id;
+    await newLeader.save();
     await updatedGroup.save();
 
     await api.cancelSubscription(data);
@@ -185,8 +192,6 @@ describe('Canceling a subscription for group', () => {
         'user-agent': '',
       },
     };
-    user.guilds.push(group._id);
-    await user.save();
     expect(group.purchased.plan.planId).to.not.exist;
     data.groupId = group._id;
     await api.createSubscription(data);
@@ -211,10 +216,15 @@ describe('Canceling a subscription for group', () => {
     await api.createSubscription(data);
     await api.cancelSubscription(data);
 
-    expect(sender.sendTxn).to.be.have.callCount(4);
-    expect(sender.sendTxn.thirdCall.args[0]._id).to.equal(recipient._id);
-    expect(sender.sendTxn.thirdCall.args[1]).to.equal('group-member-cancel');
-    expect(sender.sendTxn.thirdCall.args[2]).to.eql([
+    expect(sender.sendTxn).to.be.have.callCount(6);
+    const recipientCall = sender.sendTxn.getCalls().find(call => {
+      const isRecipient = call.args[0]._id === recipient._id;
+      const isGroupMemberCancel = call.args[1] === 'group-member-cancel';
+      return isRecipient && isGroupMemberCancel;
+    });
+    expect(recipientCall.args[0]._id).to.equal(recipient._id);
+    expect(recipientCall.args[1]).to.equal('group-member-cancel');
+    expect(recipientCall.args[2]).to.eql([
       { name: 'LEADER', content: user.profile.name },
       { name: 'GROUP_NAME', content: group.name },
     ]);
@@ -246,8 +256,6 @@ describe('Canceling a subscription for group', () => {
     recipient.guilds.push(group._id);
     await recipient.save();
 
-    user.guilds.push(group._id);
-    await user.save();
     data.groupId = group._id;
 
     await api.createSubscription(data);
@@ -259,11 +267,13 @@ describe('Canceling a subscription for group', () => {
     const group2 = generateGroup({
       name: 'test group2',
       type: 'guild',
-      privacy: 'public',
+      privacy: 'private',
       leader: user._id,
     });
     data.groupId = group2._id;
     await group2.save();
+    user.guilds.push(group2._id);
+    await user.save();
     recipient.guilds.push(group2._id);
     await recipient.save();
 
@@ -285,8 +295,6 @@ describe('Canceling a subscription for group', () => {
   });
 
   it('does cancel a leader subscription with two cancelled group plans', async () => {
-    user.guilds.push(group._id);
-    await user.save();
     data.groupId = group._id;
 
     await api.createSubscription(data);
@@ -298,7 +306,7 @@ describe('Canceling a subscription for group', () => {
     const group2 = generateGroup({
       name: 'test group2',
       type: 'guild',
-      privacy: 'public',
+      privacy: 'private',
       leader: user._id,
     });
     user.guilds.push(group2._id);

test/api/unit/libs/payments/group-plans/group-payments-create.test.js

@@ -12,6 +12,7 @@ import { model as Group } from '../../../../../../website/server/models/group';
 import {
   generateGroup,
 } from '../../../../../helpers/api-unit.helper';
+import i18n from '../../../../../../website/common/script/i18n';
 
 describe('Purchasing a group plan for group', () => {
   const EMAIL_TEMPLATE_SUBSCRIPTION_TYPE_GOOGLE = 'Google_subscription';
@@ -33,11 +34,14 @@ describe('Purchasing a group plan for group', () => {
     group = generateGroup({
       name: groupName,
       type: 'guild',
-      privacy: 'public',
+      privacy: 'private',
       leader: user._id,
     });
     await group.save();
 
+    user.guilds.push(group._id);
+    await user.save();
+
     data = {
       user,
       sub: {
@@ -112,6 +116,30 @@ describe('Purchasing a group plan for group', () => {
     expect(updatedGroup.purchased.plan.dateCreated).to.exist;
   });
 
+  it('does not create a group plan for a public guild', async () => {
+    const publicGroup = generateGroup({
+      name: groupName,
+      type: 'guild',
+      privacy: 'public',
+      leader: user._id,
+    });
+    await publicGroup.save();
+
+    expect(publicGroup.purchased.plan.planId).to.not.exist;
+    data.groupId = publicGroup._id;
+
+    await expect(api.createSubscription(data))
+      .to.eventually.be.rejected.and.to.eql({
+        httpCode: 401,
+        name: 'NotAuthorized',
+        message: i18n.t('onlyPrivateGuildsCanUpgrade'),
+      });
+
+    const updatedGroup = await Group.findById(publicGroup._id).exec();
+
+    expect(updatedGroup.purchased.plan.planId).to.not.exist;
+  });
+
   it('sends an email', async () => {
     expect(group.purchased.plan.planId).to.not.exist;
     data.groupId = group._id;
@@ -148,8 +176,6 @@ describe('Purchasing a group plan for group', () => {
   });
 
   it('grants all members of a group a subscription', async () => {
-    user.guilds.push(group._id);
-    await user.save();
     expect(group.purchased.plan.planId).to.not.exist;
     data.groupId = group._id;
 
@@ -179,17 +205,28 @@ describe('Purchasing a group plan for group', () => {
 
     await api.createSubscription(data);
 
-    expect(sender.sendTxn).to.be.calledTwice;
-    expect(sender.sendTxn.firstCall.args[0]._id).to.equal(recipient._id);
-    expect(sender.sendTxn.firstCall.args[1]).to.equal('group-member-join');
-    expect(sender.sendTxn.firstCall.args[2]).to.eql([
+    expect(sender.sendTxn).to.be.calledThrice;
+    const recipientCall = sender.sendTxn.getCalls().find(call => {
+      const isRecipient = call.args[0]._id === recipient._id;
+      const isJoin = call.args[1] === 'group-member-join';
+      return isRecipient && isJoin;
+    });
+    expect(recipientCall.args[0]._id).to.equal(recipient._id);
+    expect(recipientCall.args[1]).to.equal('group-member-join');
+    expect(recipientCall.args[2]).to.eql([
       { name: 'LEADER', content: user.profile.name },
       { name: 'GROUP_NAME', content: group.name },
       { name: 'PREVIOUS_SUBSCRIPTION_TYPE', content: EMAIL_TEMPLATE_SUBSCRIPTION_TYPE_NONE },
     ]);
+
     // confirm that the other email sent is appropriate:
-    expect(sender.sendTxn.secondCall.args[0]._id).to.equal(group.leader);
-    expect(sender.sendTxn.secondCall.args[1]).to.equal('group-subscription-begins');
+    const leaderCall = sender.sendTxn.getCalls().find(call => {
+      const isLeader = call.args[0]._id === group.leader;
+      const isSubscriptionBegin = call.args[1] === 'group-subscription-begins';
+      return isLeader && isSubscriptionBegin;
+    });
+    expect(leaderCall.args[0]._id).to.equal(group.leader);
+    expect(leaderCall.args[1]).to.equal('group-subscription-begins');
   });
 
   it('sends one email to subscribed member of group, stating subscription is cancelled (Stripe)', async () => {
@@ -205,17 +242,28 @@ describe('Purchasing a group plan for group', () => {
 
     await api.createSubscription(data);
 
-    expect(sender.sendTxn).to.be.calledTwice;
-    expect(sender.sendTxn.firstCall.args[0]._id).to.equal(recipient._id);
-    expect(sender.sendTxn.firstCall.args[1]).to.equal('group-member-join');
-    expect(sender.sendTxn.firstCall.args[2]).to.eql([
+    expect(sender.sendTxn).to.be.calledThrice;
+    const recipientCall = sender.sendTxn.getCalls().find(call => {
+      const isRecipient = call.args[0]._id === recipient._id;
+      const isJoin = call.args[1] === 'group-member-join';
+      return isRecipient && isJoin;
+    });
+    expect(recipientCall.args[0]._id).to.equal(recipient._id);
+    expect(recipientCall.args[1]).to.equal('group-member-join');
+    expect(recipientCall.args[2]).to.eql([
       { name: 'LEADER', content: user.profile.name },
       { name: 'GROUP_NAME', content: group.name },
       { name: 'PREVIOUS_SUBSCRIPTION_TYPE', content: EMAIL_TEMPLATE_SUBSCRIPTION_TYPE_NORMAL },
     ]);
+
     // confirm that the other email sent is not a cancel-subscription email:
-    expect(sender.sendTxn.secondCall.args[0]._id).to.equal(group.leader);
-    expect(sender.sendTxn.secondCall.args[1]).to.equal('group-subscription-begins');
+    const leaderCall = sender.sendTxn.getCalls().find(call => {
+      const isLeader = call.args[0]._id === group.leader;
+      const isSubscriptionBegin = call.args[1] === 'group-subscription-begins';
+      return isLeader && isSubscriptionBegin;
+    });
+    expect(leaderCall.args[0]._id).to.equal(group.leader);
+    expect(leaderCall.args[1]).to.equal('group-subscription-begins');
   });
 
   it('sends one email to subscribed member of group, stating subscription is cancelled (Amazon)', async () => {
@@ -238,17 +286,28 @@ describe('Purchasing a group plan for group', () => {
 
     await api.createSubscription(data);
 
-    expect(sender.sendTxn).to.be.calledTwice;
-    expect(sender.sendTxn.firstCall.args[0]._id).to.equal(recipient._id);
-    expect(sender.sendTxn.firstCall.args[1]).to.equal('group-member-join');
-    expect(sender.sendTxn.firstCall.args[2]).to.eql([
+    expect(sender.sendTxn).to.be.calledThrice;
+    const recipientCall = sender.sendTxn.getCalls().find(call => {
+      const isRecipient = call.args[0]._id === recipient._id;
+      const isJoin = call.args[1] === 'group-member-join';
+      return isRecipient && isJoin;
+    });
+    expect(recipientCall.args[0]._id).to.equal(recipient._id);
+    expect(recipientCall.args[1]).to.equal('group-member-join');
+    expect(recipientCall.args[2]).to.eql([
       { name: 'LEADER', content: user.profile.name },
       { name: 'GROUP_NAME', content: group.name },
       { name: 'PREVIOUS_SUBSCRIPTION_TYPE', content: EMAIL_TEMPLATE_SUBSCRIPTION_TYPE_NORMAL },
     ]);
+
     // confirm that the other email sent is not a cancel-subscription email:
-    expect(sender.sendTxn.secondCall.args[0]._id).to.equal(group.leader);
-    expect(sender.sendTxn.secondCall.args[1]).to.equal('group-subscription-begins');
+    const leaderCall = sender.sendTxn.getCalls().find(call => {
+      const isLeader = call.args[0]._id === group.leader;
+      const isSubscriptionBegin = call.args[1] === 'group-subscription-begins';
+      return isLeader && isSubscriptionBegin;
+    });
+    expect(leaderCall.args[0]._id).to.equal(group.leader);
+    expect(leaderCall.args[1]).to.equal('group-subscription-begins');
 
     amzLib.getBillingAgreementDetails.restore();
   });
@@ -275,17 +334,28 @@ describe('Purchasing a group plan for group', () => {
 
     await api.createSubscription(data);
 
-    expect(sender.sendTxn).to.be.calledTwice;
-    expect(sender.sendTxn.firstCall.args[0]._id).to.equal(recipient._id);
-    expect(sender.sendTxn.firstCall.args[1]).to.equal('group-member-join');
-    expect(sender.sendTxn.firstCall.args[2]).to.eql([
+    expect(sender.sendTxn).to.be.calledThrice;
+    const recipientCall = sender.sendTxn.getCalls().find(call => {
+      const isRecipient = call.args[0]._id === recipient._id;
+      const isJoin = call.args[1] === 'group-member-join';
+      return isRecipient && isJoin;
+    });
+    expect(recipientCall.args[0]._id).to.equal(recipient._id);
+    expect(recipientCall.args[1]).to.equal('group-member-join');
+    expect(recipientCall.args[2]).to.eql([
       { name: 'LEADER', content: user.profile.name },
       { name: 'GROUP_NAME', content: group.name },
       { name: 'PREVIOUS_SUBSCRIPTION_TYPE', content: EMAIL_TEMPLATE_SUBSCRIPTION_TYPE_NORMAL },
     ]);
+
     // confirm that the other email sent is not a cancel-subscription email:
-    expect(sender.sendTxn.secondCall.args[0]._id).to.equal(group.leader);
-    expect(sender.sendTxn.secondCall.args[1]).to.equal('group-subscription-begins');
+    const leaderCall = sender.sendTxn.getCalls().find(call => {
+      const isLeader = call.args[0]._id === group.leader;
+      const isSubscriptionBegin = call.args[1] === 'group-subscription-begins';
+      return isLeader && isSubscriptionBegin;
+    });
+    expect(leaderCall.args[0]._id).to.equal(group.leader);
+    expect(leaderCall.args[1]).to.equal('group-subscription-begins');
 
     paypalPayments.paypalBillingAgreementGet.restore();
     paypalPayments.paypalBillingAgreementCancel.restore();
@@ -302,8 +372,6 @@ describe('Purchasing a group plan for group', () => {
     recipient.guilds.push(group._id);
     await recipient.save();
 
-    user.guilds.push(group._id);
-    await user.save();
     data.groupId = group._id;
 
     await api.createSubscription(data);
@@ -356,8 +424,6 @@ describe('Purchasing a group plan for group', () => {
     recipient.guilds.push(group._id);
     await recipient.save();
 
-    user.guilds.push(group._id);
-    await user.save();
     data.groupId = group._id;
 
     await api.createSubscription(data);
@@ -419,8 +485,6 @@ describe('Purchasing a group plan for group', () => {
 
     data.gift = undefined;
 
-    user.guilds.push(group._id);
-    await user.save();
     data.groupId = group._id;
 
     await api.createSubscription(data);
@@ -455,8 +519,6 @@ describe('Purchasing a group plan for group', () => {
 
     data.gift = undefined;
 
-    user.guilds.push(group._id);
-    await user.save();
     data.groupId = group._id;
 
     await api.createSubscription(data);
@@ -483,8 +545,6 @@ describe('Purchasing a group plan for group', () => {
     recipient.guilds.push(group._id);
     await recipient.save();
 
-    user.guilds.push(group._id);
-    await user.save();
     data.groupId = group._id;
 
     await api.createSubscription(data);
@@ -511,8 +571,6 @@ describe('Purchasing a group plan for group', () => {
 
     await recipient.save();
 
-    user.guilds.push(group._id);
-    await user.save();
     data.groupId = group._id;
 
     await api.createSubscription(data);
@@ -541,8 +599,6 @@ describe('Purchasing a group plan for group', () => {
 
     await recipient.save();
 
-    user.guilds.push(group._id);
-    await user.save();
     data.groupId = group._id;
 
     await api.createSubscription(data);
@@ -566,8 +622,6 @@ describe('Purchasing a group plan for group', () => {
     recipient.guilds.push(group._id);
     await recipient.save();
 
-    user.guilds.push(group._id);
-    await user.save();
     data.groupId = group._id;
 
     await recipient.cancelSubscription();
@@ -589,8 +643,6 @@ describe('Purchasing a group plan for group', () => {
     recipient.guilds.push(group._id);
     await recipient.save();
 
-    user.guilds.push(group._id);
-    await user.save();
     data.groupId = group._id;
 
     await recipient.cancelSubscription();
@@ -611,8 +663,6 @@ describe('Purchasing a group plan for group', () => {
     recipient.guilds.push(group._id);
     await recipient.save();
 
-    user.guilds.push(group._id);
-    await user.save();
     data.groupId = group._id;
 
     await api.createSubscription(data);
@@ -632,8 +682,6 @@ describe('Purchasing a group plan for group', () => {
     recipient.guilds.push(group._id);
     await recipient.save();
 
-    user.guilds.push(group._id);
-    await user.save();
     data.groupId = group._id;
 
     await api.createSubscription(data);
@@ -653,8 +701,6 @@ describe('Purchasing a group plan for group', () => {
     recipient.guilds.push(group._id);
     await recipient.save();
 
-    user.guilds.push(group._id);
-    await user.save();
     data.groupId = group._id;
 
     await api.createSubscription(data);
@@ -688,8 +734,6 @@ describe('Purchasing a group plan for group', () => {
     recipient.guilds.push(group._id);
     await recipient.save();
 
-    user.guilds.push(group._id);
-    await user.save();
     data.groupId = group._id;
 
     await api.createSubscription(data);
@@ -713,8 +757,6 @@ describe('Purchasing a group plan for group', () => {
     recipient.guilds.push(group._id);
     await recipient.save();
 
-    user.guilds.push(group._id);
-    await user.save();
     data.groupId = group._id;
 
     await api.createSubscription(data);
@@ -726,13 +768,15 @@ describe('Purchasing a group plan for group', () => {
     const group2 = generateGroup({
       name: 'test group2',
       type: 'guild',
-      privacy: 'public',
+      privacy: 'private',
       leader: user._id,
     });
     data.groupId = group2._id;
     await group2.save();
     recipient.guilds.push(group2._id);
     await recipient.save();
+    user.guilds.push(group2._id);
+    await user.save();
 
     await api.createSubscription(data);
 
@@ -757,8 +801,6 @@ describe('Purchasing a group plan for group', () => {
     recipient.guilds.push(group._id);
     await recipient.save();
 
-    user.guilds.push(group._id);
-    await user.save();
     data.groupId = group._id;
 
     await api.createSubscription(data);
@@ -770,17 +812,22 @@ describe('Purchasing a group plan for group', () => {
     const group2 = generateGroup({
       name: 'test group2',
       type: 'guild',
-      privacy: 'public',
+      privacy: 'private',
       leader: user._id,
     });
     data.groupId = group2._id;
     await group2.save();
     recipient.guilds.push(group2._id);
     await recipient.save();
+    user.guilds.push(group2._id);
+    await user.save();
 
     await api.createSubscription(data);
 
     const updatedGroup = await Group.findById(group._id).exec();
+    updatedGroup.memberCount = 2;
+    await updatedGroup.save();
+
     await updatedGroup.leave(recipient);
 
     updatedUser = await User.findById(recipient._id).exec();
@@ -806,8 +853,6 @@ describe('Purchasing a group plan for group', () => {
     recipient.guilds.push(group._id);
     await recipient.save();
 
-    user.guilds.push(group._id);
-    await user.save();
     data.groupId = group._id;
 
     await api.createSubscription(data);
@@ -835,8 +880,6 @@ describe('Purchasing a group plan for group', () => {
     recipient.guilds.push(group._id);
     await recipient.save();
 
-    user.guilds.push(group._id);
-    await user.save();
     data.groupId = group._id;
 
     await api.createSubscription(data);
@@ -864,8 +907,6 @@ describe('Purchasing a group plan for group', () => {
     recipient.guilds.push(group._id);
     await recipient.save();
 
-    user.guilds.push(group._id);
-    await user.save();
     data.groupId = group._id;
 
     await api.createSubscription(data);
@@ -894,8 +935,6 @@ describe('Purchasing a group plan for group', () => {
     recipient.guilds.push(group._id);
     await recipient.save();
 
-    user.guilds.push(group._id);
-    await user.save();
     data.groupId = group._id;
 
     await api.createSubscription(data);

test/api/unit/libs/payments/payments.test.js

@@ -1,6 +1,7 @@
 import moment from 'moment';
 
 import * as sender from '../../../../../website/server/libs/email';
+import common from '../../../../../website/common';
 import api from '../../../../../website/server/libs/payments/payments';
 import * as analytics from '../../../../../website/server/libs/analyticsService';
 import * as notifications from '../../../../../website/server/libs/pushNotifications';
@@ -9,6 +10,7 @@ import { translate as t } from '../../../../helpers/api-integration/v3';
 import {
   generateGroup,
 } from '../../../../helpers/api-unit.helper';
+import * as worldState from '../../../../../website/server/libs/worldState';
 
 describe('payments/index', () => {
   let user; let group; let data; let
@@ -246,6 +248,7 @@ describe('payments/index', () => {
           quantity: 1,
           gift: true,
           purchaseValue: 15,
+          firstPurchase: true,
           headers: {
             'x-client': 'habitica-web',
             'user-agent': '',
@@ -343,6 +346,7 @@ describe('payments/index', () => {
           quantity: 1,
           gift: false,
           purchaseValue: 15,
+          firstPurchase: true,
           headers: {
             'x-client': 'habitica-web',
             'user-agent': '',
@@ -419,10 +423,22 @@ describe('payments/index', () => {
     });
 
     context('Mystery Items', () => {
-      it('awards mystery items when within the timeframe for a mystery item', async () => {
-        const mayMysteryItemTimeframe = 1464725113000; // May 31st 2016
-        const fakeClock = sinon.useFakeTimers(mayMysteryItemTimeframe);
+      let clock;
+      const mayMysteryItem = 'armor_mystery_201605';
 
+      beforeEach(() => {
+        const mayMysteryItemTimeframe = new Date(2016, 4, 31); // May 31st 2016
+        clock = sinon.useFakeTimers({
+          now: mayMysteryItemTimeframe,
+          toFake: ['Date'],
+        });
+      });
+
+      afterEach(() => {
+        if (clock) clock.restore();
+      });
+
+      it('awards mystery items when within the timeframe for a mystery item', async () => {
         data = { paymentMethod: 'PaymentMethod', user, sub: { key: 'basic_3mo' } };
 
         const oldNotificationsCount = user.notifications.length;
@@ -435,14 +451,9 @@ describe('payments/index', () => {
         expect(user.purchased.plan.mysteryItems).to.include('head_mystery_201605');
         expect(user.notifications.length).to.equal(oldNotificationsCount + 1);
         expect(user.notifications[0].type).to.equal('NEW_MYSTERY_ITEMS');
-
-        fakeClock.restore();
       });
 
       it('does not award mystery item when user already owns the item', async () => {
-        const mayMysteryItemTimeframe = 1464725113000; // May 31st 2016
-        const fakeClock = sinon.useFakeTimers(mayMysteryItemTimeframe);
-        const mayMysteryItem = 'armor_mystery_201605';
         user.items.gear.owned[mayMysteryItem] = true;
 
         data = { paymentMethod: 'PaymentMethod', user, sub: { key: 'basic_3mo' } };
@@ -451,14 +462,9 @@ describe('payments/index', () => {
 
         expect(user.purchased.plan.mysteryItems).to.have.a.lengthOf(1);
         expect(user.purchased.plan.mysteryItems).to.include('head_mystery_201605');
-
-        fakeClock.restore();
       });
 
       it('does not award mystery item when user already has the item in the mystery box', async () => {
-        const mayMysteryItemTimeframe = 1464725113000; // May 31st 2016
-        const fakeClock = sinon.useFakeTimers(mayMysteryItemTimeframe);
-        const mayMysteryItem = 'armor_mystery_201605';
         user.purchased.plan.mysteryItems = [mayMysteryItem];
 
         sandbox.spy(user.purchased.plan.mysteryItems, 'push');
@@ -468,8 +474,6 @@ describe('payments/index', () => {
 
         expect(user.purchased.plan.mysteryItems.push).to.be.calledOnce;
         expect(user.purchased.plan.mysteryItems.push).to.be.calledWith('head_mystery_201605');
-
-        fakeClock.restore();
       });
     });
   });
@@ -555,6 +559,7 @@ describe('payments/index', () => {
     beforeEach(() => {
       data = {
         user,
+        gemsBlock: common.content.gems['21gems'],
         paymentMethod: 'payment',
         headers: {
           'x-client': 'habitica-web',
@@ -564,22 +569,6 @@ describe('payments/index', () => {
     });
 
     context('Self Purchase', () => {
-      it('amount property defaults to 5', async () => {
-        expect(user.balance).to.eql(0);
-
-        await api.buyGems(data);
-
-        expect(user.balance).to.eql(5);
-      });
-
-      it('can set amount that is purchased', async () => {
-        data.amount = 13;
-
-        await api.buyGems(data);
-
-        expect(user.balance).to.eql(13);
-      });
-
       it('sends a donation email', async () => {
         await api.buyGems(data);
 
@@ -588,6 +577,51 @@ describe('payments/index', () => {
       });
     });
 
+    context('No Active Promotion', () => {
+      beforeEach(() => {
+        sinon.stub(worldState, 'getCurrentEvent').returns(null);
+      });
+
+      afterEach(() => {
+        worldState.getCurrentEvent.restore();
+      });
+
+      it('does not apply a discount', async () => {
+        const balanceBefore = user.balance;
+
+        await api.buyGems(data);
+
+        const balanceAfter = user.balance;
+        const balanceDiff = balanceAfter - balanceBefore;
+
+        expect(balanceDiff * 4).to.eql(21);
+      });
+    });
+
+    context('Active Promotion', () => {
+      beforeEach(() => {
+        sinon.stub(worldState, 'getCurrentEvent').returns({
+          ...common.content.events.fall2020,
+          event: 'fall2020',
+        });
+      });
+
+      afterEach(() => {
+        worldState.getCurrentEvent.restore();
+      });
+
+      it('applies a discount', async () => {
+        const balanceBefore = user.balance;
+
+        await api.buyGems(data);
+
+        const balanceAfter = user.balance;
+        const balanceDiff = balanceAfter - balanceBefore;
+
+        expect(balanceDiff * 4).to.eql(30);
+      });
+    });
+
     context('Gift', () => {
       let recipient;
 

test/api/unit/libs/payments/paypal/checkout-success.test.js

@@ -2,11 +2,13 @@
 import paypalPayments from '../../../../../../website/server/libs/payments/paypal';
 import payments from '../../../../../../website/server/libs/payments/payments';
 import { model as User } from '../../../../../../website/server/models/user';
+import common from '../../../../../../website/common';
 
-describe('checkout success', () => {
+describe('paypal - checkout success', () => {
   const subKey = 'basic_3mo';
   let user; let gift; let customerId; let
     paymentId;
+  const gemsBlockKey = '21gems'; const gemsBlock = common.content.gems[gemsBlockKey];
   let paypalPaymentExecuteStub; let paymentBuyGemsStub; let
     paymentsCreateSubscritionStub;
 
@@ -28,7 +30,7 @@ describe('checkout success', () => {
 
   it('purchases gems', async () => {
     await paypalPayments.checkoutSuccess({
-      user, gift, paymentId, customerId,
+      user, gift, paymentId, customerId, gemsBlock: gemsBlockKey,
     });
 
     expect(paypalPaymentExecuteStub).to.be.calledOnce;
@@ -38,6 +40,7 @@ describe('checkout success', () => {
       user,
       customerId,
       paymentMethod: 'Paypal',
+      gemsBlock,
     });
   });
 

test/api/unit/libs/payments/paypal/checkout.test.js

@@ -4,12 +4,14 @@ import nconf from 'nconf';
 import paypalPayments from '../../../../../../website/server/libs/payments/paypal';
 import { model as User } from '../../../../../../website/server/models/user';
 import common from '../../../../../../website/common';
+import apiError from '../../../../../../website/server/libs/apiError';
 
 const BASE_URL = nconf.get('BASE_URL');
 const { i18n } = common;
 
-describe('checkout', () => {
+describe('paypal - checkout', () => {
   const subKey = 'basic_3mo';
+  const gemsBlockKey = '21gems';
   let paypalPaymentCreateStub;
   let approvalHerf;
 
@@ -53,10 +55,10 @@ describe('checkout', () => {
   });
 
   it('creates a link for gem purchases', async () => {
-    const link = await paypalPayments.checkout({ user: new User() });
+    const link = await paypalPayments.checkout({ user: new User(), gemsBlock: gemsBlockKey });
 
     expect(paypalPaymentCreateStub).to.be.calledOnce;
-    expect(paypalPaymentCreateStub).to.be.calledWith(getPaypalCreateOptions('Habitica Gems', 5.00));
+    expect(paypalPaymentCreateStub).to.be.calledWith(getPaypalCreateOptions('Habitica Gems', 4.99));
     expect(link).to.eql(approvalHerf);
   });
 
@@ -83,11 +85,23 @@ describe('checkout', () => {
     const user = new User();
     sinon.stub(user, 'canGetGems').resolves(false);
 
-    await expect(paypalPayments.checkout({ user })).to.eventually.be.rejected.and.to.eql({
-      httpCode: 401,
-      message: i18n.t('groupPolicyCannotGetGems'),
-      name: 'NotAuthorized',
-    });
+    await expect(paypalPayments.checkout({ user, gemsBlock: gemsBlockKey }))
+      .to.eventually.be.rejected.and.to.eql({
+        httpCode: 401,
+        message: i18n.t('groupPolicyCannotGetGems'),
+        name: 'NotAuthorized',
+      });
+  });
+
+  it('should error if the gems block is not valid', async () => {
+    const user = new User();
+
+    await expect(paypalPayments.checkout({ user, gemsBlock: 'invalid' }))
+      .to.eventually.be.rejected.and.to.eql({
+        httpCode: 400,
+        message: apiError('invalidGemsBlock'),
+        name: 'BadRequest',
+      });
   });
 
   it('creates a link for gifting gems', async () => {

test/api/unit/libs/payments/paypal/ipn.test.js

@@ -6,7 +6,7 @@ import {
 } from '../../../../../helpers/api-unit.helper';
 import { model as User } from '../../../../../../website/server/models/user';
 
-describe('ipn', () => {
+describe('paypal - ipn', () => {
   const subKey = 'basic_3mo';
   let user; let group; let txn_type; let userPaymentId; let
     groupPaymentId;

test/api/unit/libs/payments/paypal/subscribe-cancel.test.js

@@ -10,7 +10,7 @@ import { createNonLeaderGroupMember } from '../paymentHelpers';
 
 const { i18n } = common;
 
-describe('subscribeCancel', () => {
+describe('paypal - subscribeCancel', () => {
   const subKey = 'basic_3mo';
   let user; let group; let groupId; let customerId; let groupCustomerId; let
     nextBillingDate;

test/api/unit/libs/payments/paypal/subscribe-success.test.js

@@ -7,7 +7,7 @@ import {
 import { model as User } from '../../../../../../website/server/models/user';
 import common from '../../../../../../website/common';
 
-describe('subscribeSuccess', () => {
+describe('paypal - subscribeSuccess', () => {
   const subKey = 'basic_3mo';
   let user; let group; let block; let groupId; let token; let headers; let
     customerId;

test/api/unit/libs/payments/paypal/subscribe.test.js

@@ -8,7 +8,7 @@ import common from '../../../../../../website/common';
 
 const { i18n } = common;
 
-describe('subscribe', () => {
+describe('paypal - subscribe', () => {
   const subKey = 'basic_3mo';
   let coupon; let sub; let
     approvalHerf;

test/api/unit/libs/payments/stripe/calculateSubscriptionTerminationDate.test.js

@@ -4,7 +4,7 @@ import api from '../../../../../../website/server/libs/payments/payments';
 
 const groupPlanId = api.constants.GROUP_PLAN_CUSTOMER_ID;
 
-describe('#calculateSubscriptionTerminationDate', () => {
+describe('stripe - #calculateSubscriptionTerminationDate', () => {
   let plan;
   let nextBill;
 

test/api/unit/libs/payments/stripe/cancel-subscription.test.js

@@ -10,7 +10,7 @@ import common from '../../../../../../website/common';
 
 const { i18n } = common;
 
-describe('cancel subscription', () => {
+describe('stripe - cancel subscription', () => {
   const subKey = 'basic_3mo';
   const stripe = stripeModule('test');
   let user; let groupId; let

test/api/unit/libs/payments/stripe/checkout-subscription.test.js

@@ -12,7 +12,7 @@ import common from '../../../../../../website/common';
 
 const { i18n } = common;
 
-describe('checkout with subscription', () => {
+describe('stripe - checkout with subscription', () => {
   const subKey = 'basic_3mo';
   const stripe = stripeModule('test');
   let user; let group; let data; let gift; let sub;

test/api/unit/libs/payments/stripe/checkout.test.js

@@ -4,16 +4,17 @@ import { model as User } from '../../../../../../website/server/models/user';
 import stripePayments from '../../../../../../website/server/libs/payments/stripe';
 import payments from '../../../../../../website/server/libs/payments/payments';
 import common from '../../../../../../website/common';
+import apiError from '../../../../../../website/server/libs/apiError';
 
 const { i18n } = common;
 
-describe('checkout', () => {
+describe('stripe - checkout', () => {
   const subKey = 'basic_3mo';
   const stripe = stripeModule('test');
   let stripeChargeStub; let paymentBuyGemsStub; let
     paymentCreateSubscritionStub;
   let user; let gift; let groupId; let email; let headers; let coupon; let customerIdResponse; let
-    token;
+    token; const gemsBlockKey = '21gems'; const gemsBlock = common.content.gems[gemsBlockKey];
 
   beforeEach(() => {
     user = new User();
@@ -89,6 +90,7 @@ describe('checkout', () => {
     await expect(stripePayments.checkout({
       token,
       user,
+      gemsBlock: gemsBlockKey,
       gift,
       groupId,
       email,
@@ -101,6 +103,25 @@ describe('checkout', () => {
     });
   });
 
+  it('should error if the gems block is invalid', async () => {
+    gift = undefined;
+
+    await expect(stripePayments.checkout({
+      token,
+      user,
+      gemsBlock: 'invalid',
+      gift,
+      groupId,
+      email,
+      headers,
+      coupon,
+    }, stripe)).to.eventually.be.rejected.and.to.eql({
+      httpCode: 400,
+      message: apiError('invalidGemsBlock'),
+      name: 'BadRequest',
+    });
+  });
+
   it('should purchase gems', async () => {
     gift = undefined;
     sinon.stub(user, 'canGetGems').resolves(true);
@@ -108,6 +129,7 @@ describe('checkout', () => {
     await stripePayments.checkout({
       token,
       user,
+      gemsBlock: gemsBlockKey,
       gift,
       groupId,
       email,
@@ -117,7 +139,7 @@ describe('checkout', () => {
 
     expect(stripeChargeStub).to.be.calledOnce;
     expect(stripeChargeStub).to.be.calledWith({
-      amount: 500,
+      amount: 499,
       currency: 'usd',
       card: token,
     });
@@ -128,6 +150,7 @@ describe('checkout', () => {
       customerId: customerIdResponse,
       paymentMethod: 'Stripe',
       gift,
+      gemsBlock,
     });
     expect(user.canGetGems).to.be.calledOnce;
     user.canGetGems.restore();
@@ -167,6 +190,7 @@ describe('checkout', () => {
       customerId: customerIdResponse,
       paymentMethod: 'Gift',
       gift,
+      gemsBlock: undefined,
     });
   });
 
@@ -205,6 +229,7 @@ describe('checkout', () => {
       customerId: customerIdResponse,
       paymentMethod: 'Gift',
       gift,
+      gemsBlock: undefined,
     });
   });
 });

test/api/unit/libs/payments/stripe/edit-subscription.test.js

@@ -9,7 +9,7 @@ import common from '../../../../../../website/common';
 
 const { i18n } = common;
 
-describe('edit subscription', () => {
+describe('stripe - edit subscription', () => {
   const subKey = 'basic_3mo';
   const stripe = stripeModule('test');
   let user; let groupId; let group; let

test/api/unit/libs/payments/stripe/upgrade-group-plan.test.js

@@ -33,11 +33,14 @@ describe('Stripe - Upgrade Group Plan', () => {
     group = generateGroup({
       name: 'test group',
       type: 'guild',
-      privacy: 'public',
+      privacy: 'private',
       leader: user._id,
     });
     await group.save();
 
+    user.guilds.push(group._id);
+    await user.save();
+
     spy = sinon.stub(stripe.subscriptions, 'update');
     spy.resolves([]);
     data.groupId = group._id;

test/api/unit/libs/preening.test.js

@@ -9,7 +9,7 @@ describe('preenHistory', () => {
   beforeEach(() => {
     // Replace system clocks so we can get predictable results
     clock = sinon.useFakeTimers({
-      now: Number(moment('2013-10-20').zone(0).startOf('day').toDate()),
+      now: Number(moment('2013-10-20').utcOffset(0).startOf('day').toDate()),
       toFake: ['Date'],
     });
   });

test/api/unit/libs/xmlMarshaller.test.js

@@ -0,0 +1,44 @@
+import * as xmlMarshaller from '../../../../website/server/libs/xmlMarshaller';
+
+describe('xml marshaller marshalls user data', () => {
+  const minimumUser = {
+    pinnedItems: [],
+    unpinnedItems: [],
+    inbox: {},
+  };
+
+  function userDataWith (fields) {
+    return { ...minimumUser, ...fields };
+  }
+
+  it('maps the newMessages field to have id as a value in a list.', () => {
+    const userData = userDataWith({
+      newMessages: {
+        '283171a5-422c-4991-bc78-95b1b5b51629': {
+          name: 'The Language Hackers',
+          value: true,
+        },
+        '283171a6-422c-4991-bc78-95b1b5b51629': {
+          name: 'The Bug Hackers',
+          value: false,
+        },
+      },
+    });
+
+    const xml = xmlMarshaller.marshallUserData(userData);
+
+    expect(xml).to.equal(`<user>
+    <inbox/>
+    <newMessages>
+        <id>283171a5-422c-4991-bc78-95b1b5b51629</id>
+        <name>The Language Hackers</name>
+        <value>true</value>
+    </newMessages>
+    <newMessages>
+        <id>283171a6-422c-4991-bc78-95b1b5b51629</id>
+        <name>The Bug Hackers</name>
+        <value>false</value>
+    </newMessages>
+</user>`);
+  });
+});

test/api/unit/middlewares/cors.test.js

@@ -21,7 +21,8 @@ describe('cors middleware', () => {
     expect(res.set).to.have.been.calledWith({
       'Access-Control-Allow-Origin': '*',
       'Access-Control-Allow-Methods': 'OPTIONS,GET,POST,PUT,HEAD,DELETE',
-      'Access-Control-Allow-Headers': 'Content-Type,Accept,Content-Encoding,X-Requested-With,x-api-user,x-api-key,x-client',
+      'Access-Control-Allow-Headers': 'Authorization,Content-Type,Accept,Content-Encoding,X-Requested-With,x-api-user,x-api-key,x-client',
+      'Access-Control-Expose-Headers': 'X-RateLimit-Limit,X-RateLimit-Remaining,X-RateLimit-Reset,Retry-After',
     });
     expect(res.sendStatus).to.not.have.been.called;
     expect(next).to.have.been.calledOnce;
@@ -33,7 +34,8 @@ describe('cors middleware', () => {
     expect(res.set).to.have.been.calledWith({
       'Access-Control-Allow-Origin': '*',
       'Access-Control-Allow-Methods': 'OPTIONS,GET,POST,PUT,HEAD,DELETE',
-      'Access-Control-Allow-Headers': 'Content-Type,Accept,Content-Encoding,X-Requested-With,x-api-user,x-api-key,x-client',
+      'Access-Control-Allow-Headers': 'Authorization,Content-Type,Accept,Content-Encoding,X-Requested-With,x-api-user,x-api-key,x-client',
+      'Access-Control-Expose-Headers': 'X-RateLimit-Limit,X-RateLimit-Remaining,X-RateLimit-Reset,Retry-After',
     });
     expect(res.sendStatus).to.have.been.calledWith(200);
     expect(next).to.not.have.been.called;

test/api/unit/middlewares/cronMiddleware.js

@@ -293,4 +293,90 @@ describe('cron middleware', () => {
       });
     });
   });
+
+  context('Drop Cap A/B Test', async () => {
+    it('enrolls web users', async () => {
+      user.lastCron = moment(new Date()).subtract({ days: 2 });
+      await user.save();
+      req.headers['x-client'] = 'habitica-web';
+
+      await new Promise((resolve, reject) => {
+        cronMiddleware(req, res, async err => {
+          if (err) return reject(err);
+          user = await User.findById(user._id).exec();
+          expect(user._ABtests.dropCapNotif).to.be.a.string;
+
+          return resolve();
+        });
+      });
+    });
+
+    it('enables the new notification for 50% of users', async () => {
+      sandbox.stub(Math, 'random').returns(0.5);
+      user.lastCron = moment(new Date()).subtract({ days: 2 });
+      await user.save();
+      req.headers['x-client'] = 'habitica-web';
+
+      await new Promise((resolve, reject) => {
+        cronMiddleware(req, res, async err => {
+          if (err) return reject(err);
+          user = await User.findById(user._id).exec();
+          expect(user._ABtests.dropCapNotif).to.be.equal('drop-cap-notif-enabled');
+
+          return resolve();
+        });
+      });
+    });
+
+    it('disables the new notification for 50% of users', async () => {
+      sandbox.stub(Math, 'random').returns(0.51);
+      user.lastCron = moment(new Date()).subtract({ days: 2 });
+      await user.save();
+      req.headers['x-client'] = 'habitica-web';
+
+      await new Promise((resolve, reject) => {
+        cronMiddleware(req, res, async err => {
+          if (err) return reject(err);
+          user = await User.findById(user._id).exec();
+          expect(user._ABtests.dropCapNotif).to.be.equal('drop-cap-notif-disabled');
+
+          return resolve();
+        });
+      });
+    });
+
+    it('does not affect subscribers', async () => {
+      sandbox.stub(Math, 'random').returns(0.2);
+      user.lastCron = moment(new Date()).subtract({ days: 2 });
+      await user.save();
+      req.headers['x-client'] = 'habitica-web';
+      sandbox.stub(User.prototype, 'isSubscribed').returns(true);
+
+      await new Promise((resolve, reject) => {
+        cronMiddleware(req, res, async err => {
+          if (err) return reject(err);
+          user = await User.findById(user._id).exec();
+          expect(user._ABtests.dropCapNotif).to.not.exist;
+
+          return resolve();
+        });
+      });
+    });
+
+    it('does not affect mobile users', async () => {
+      user.lastCron = moment(new Date()).subtract({ days: 2 });
+      await user.save();
+      req.headers['x-client'] = 'habitica-ios';
+
+      await new Promise((resolve, reject) => {
+        cronMiddleware(req, res, async err => {
+          if (err) return reject(err);
+          user = await User.findById(user._id).exec();
+          expect(user._ABtests.dropCapNotif).to.not.exist;
+
+          return resolve();
+        });
+      });
+    });
+  });
 });

test/api/unit/middlewares/ensureAccessRight.test.js

@@ -5,7 +5,7 @@ import {
   generateNext,
 } from '../../../helpers/api-unit.helper';
 import i18n from '../../../../website/common/script/i18n';
-import { ensureAdmin, ensureSudo } from '../../../../website/server/middlewares/ensureAccessRight';
+import { ensureAdmin, ensureSudo, ensureNewsPoster } from '../../../../website/server/middlewares/ensureAccessRight';
 import { NotAuthorized } from '../../../../website/server/libs/errors';
 import apiError from '../../../../website/server/libs/apiError';
 
@@ -40,6 +40,27 @@ describe('ensure access middlewares', () => {
     });
   });
 
+  context('ensure newsPoster', () => {
+    it('returns not authorized when user is not a newsPoster', () => {
+      res.locals = { user: { contributor: { newsPoster: false } } };
+
+      ensureNewsPoster(req, res, next);
+
+      const calledWith = next.getCall(0).args;
+      expect(calledWith[0].message).to.equal(apiError('noNewsPosterAccess'));
+      expect(calledWith[0] instanceof NotAuthorized).to.equal(true);
+    });
+
+    it('passes when user is a newsPoster', () => {
+      res.locals = { user: { contributor: { newsPoster: true } } };
+
+      ensureNewsPoster(req, res, next);
+
+      expect(next).to.be.calledOnce;
+      expect(next.args[0]).to.be.empty;
+    });
+  });
+
   context('ensure sudo', () => {
     it('returns not authorized when user is not a sudo user', () => {
       res.locals = { user: { contributor: { sudo: false } } };

test/api/unit/middlewares/ipBlocker.test.js

@@ -57,7 +57,7 @@ describe('ipBlocker middleware', () => {
   });
 
   it('does not throw when the ip does not match', () => {
-    req.headers['x-forwarded-for'] = '192.168.1.1';
+    req.ip = '192.168.1.1';
     sandbox.stub(nconf, 'get').withArgs('BLOCKED_IPS').returns('192.168.1.2');
     const attachIpBlocker = requireAgain(pathToIpBlocker).default;
     attachIpBlocker(req, res, next);
@@ -65,30 +65,12 @@ describe('ipBlocker middleware', () => {
     checkErrorNotThrown(next);
   });
 
-  it('throws when a matching ip exist in x-forwarded-for', () => {
-    req.headers['x-forwarded-for'] = '192.168.1.1';
+  it('throws when the ip is blocked', () => {
+    req.ip = '192.168.1.1';
     sandbox.stub(nconf, 'get').withArgs('BLOCKED_IPS').returns('192.168.1.1');
     const attachIpBlocker = requireAgain(pathToIpBlocker).default;
     attachIpBlocker(req, res, next);
 
     checkErrorThrown(next);
   });
-
-  it('trims ips in x-forwarded-for', () => {
-    req.headers['x-forwarded-for'] = '192.168.1.1';
-    sandbox.stub(nconf, 'get').withArgs('BLOCKED_IPS').returns(',  192.168.1.1 ,   192.168.1.4, ');
-    const attachIpBlocker = requireAgain(pathToIpBlocker).default;
-    attachIpBlocker(req, res, next);
-
-    checkErrorThrown(next);
-  });
-
-  it('works when multiple ips are passed in x-forwarded-for', () => {
-    req.headers['x-forwarded-for'] = '192.168.1.4';
-    sandbox.stub(nconf, 'get').withArgs('BLOCKED_IPS').returns('192.168.1.1, 192.168.1.4, 192.168.1.3');
-    const attachIpBlocker = requireAgain(pathToIpBlocker).default;
-    attachIpBlocker(req, res, next);
-
-    checkErrorThrown(next);
-  });
 });

test/api/unit/middlewares/rateLimiter.test.js

@@ -0,0 +1,141 @@
+import nconf from 'nconf';
+import { RateLimiterMemory } from 'rate-limiter-flexible';
+import requireAgain from 'require-again';
+import {
+  generateRes,
+  generateReq,
+  generateNext,
+} from '../../../helpers/api-unit.helper';
+import { TooManyRequests } from '../../../../website/server/libs/errors';
+import apiError from '../../../../website/server/libs/apiError';
+import logger from '../../../../website/server/libs/logger';
+
+describe('rateLimiter middleware', () => {
+  const pathToRateLimiter = '../../../../website/server/middlewares/rateLimiter';
+
+  let res; let req; let next; let nconfGetStub;
+
+  beforeEach(() => {
+    nconfGetStub = sandbox.stub(nconf, 'get');
+
+    nconfGetStub.withArgs('NODE_ENV').returns('test');
+    nconfGetStub.withArgs('IS_TEST').returns(true);
+
+    res = generateRes();
+    req = generateReq();
+    next = generateNext();
+  });
+
+  afterEach(() => {
+    sandbox.restore();
+  });
+
+  it('is disabled when the env var is not defined', () => {
+    nconfGetStub.withArgs('RATE_LIMITER_ENABLED').returns(undefined);
+    const attachRateLimiter = requireAgain(pathToRateLimiter).default;
+    attachRateLimiter(req, res, next);
+
+    expect(next).to.have.been.calledOnce;
+    const calledWith = next.getCall(0).args;
+    expect(typeof calledWith[0] === 'undefined').to.equal(true);
+    expect(res.set).to.not.have.been.called;
+  });
+
+  it('is disabled when the env var is an not "true"', () => {
+    nconfGetStub.withArgs('RATE_LIMITER_ENABLED').returns('false');
+    const attachRateLimiter = requireAgain(pathToRateLimiter).default;
+    attachRateLimiter(req, res, next);
+
+    expect(next).to.have.been.calledOnce;
+    const calledWith = next.getCall(0).args;
+    expect(typeof calledWith[0] === 'undefined').to.equal(true);
+    expect(res.set).to.not.have.been.called;
+  });
+
+  it('does not throw when there are available points', async () => {
+    nconfGetStub.withArgs('RATE_LIMITER_ENABLED').returns('true');
+    const attachRateLimiter = requireAgain(pathToRateLimiter).default;
+    await attachRateLimiter(req, res, next);
+
+    expect(next).to.have.been.calledOnce;
+    const calledWith = next.getCall(0).args;
+    expect(typeof calledWith[0] === 'undefined').to.equal(true);
+
+    expect(res.set).to.have.been.calledOnce;
+    expect(res.set).to.have.been.calledWithMatch({
+      'X-RateLimit-Limit': 30,
+      'X-RateLimit-Remaining': 29,
+      'X-RateLimit-Reset': sinon.match(Date),
+    });
+  });
+
+  it('does not throw when an unknown error is thrown by the rate limiter', async () => {
+    nconfGetStub.withArgs('RATE_LIMITER_ENABLED').returns('true');
+    sandbox.stub(logger, 'error');
+    sandbox.stub(RateLimiterMemory.prototype, 'consume')
+      .returns(Promise.reject(new Error('Unknown error.')));
+
+    const attachRateLimiter = requireAgain(pathToRateLimiter).default;
+    await attachRateLimiter(req, res, next);
+
+    expect(next).to.have.been.calledOnce;
+    const calledWith = next.getCall(0).args;
+    expect(typeof calledWith[0] === 'undefined').to.equal(true);
+    expect(res.set).to.not.have.been.called;
+
+    expect(logger.error).to.be.calledOnce;
+    expect(logger.error).to.have.been.calledWithMatch(Error, 'Rate Limiter Error');
+  });
+
+  it('throws when there are no available points remaining', async () => {
+    nconfGetStub.withArgs('RATE_LIMITER_ENABLED').returns('true');
+    const attachRateLimiter = requireAgain(pathToRateLimiter).default;
+
+    // call for 31 times
+    for (let i = 0; i < 31; i += 1) {
+      await attachRateLimiter(req, res, next); // eslint-disable-line no-await-in-loop
+    }
+
+    expect(next).to.have.been.callCount(31);
+    const calledWith = next.getCall(30).args;
+    expect(calledWith[0].message).to.equal(apiError('clientRateLimited'));
+    expect(calledWith[0] instanceof TooManyRequests).to.equal(true);
+
+    expect(res.set).to.have.been.callCount(31);
+    expect(res.set).to.have.been.calledWithMatch({
+      'Retry-After': sinon.match(Number),
+      'X-RateLimit-Limit': 30,
+      'X-RateLimit-Remaining': 0,
+      'X-RateLimit-Reset': sinon.match(Date),
+    });
+  });
+
+  it('uses the user id if supplied or the ip address', async () => {
+    nconfGetStub.withArgs('RATE_LIMITER_ENABLED').returns('true');
+    const attachRateLimiter = requireAgain(pathToRateLimiter).default;
+
+    req.ip = 1;
+    await attachRateLimiter(req, res, next);
+
+    req.headers['x-api-user'] = 'user-1';
+    await attachRateLimiter(req, res, next);
+    await attachRateLimiter(req, res, next);
+
+    // user id an ip are counted as separate sources
+    expect(res.set).to.have.been.calledWithMatch({
+      'X-RateLimit-Limit': 30,
+      'X-RateLimit-Remaining': 28, // 2 calls with user id
+      'X-RateLimit-Reset': sinon.match(Date),
+    });
+
+    req.headers['x-api-user'] = undefined;
+    await attachRateLimiter(req, res, next);
+    await attachRateLimiter(req, res, next);
+
+    expect(res.set).to.have.been.calledWithMatch({
+      'X-RateLimit-Limit': 30,
+      'X-RateLimit-Remaining': 27, // 3 calls with only ip
+      'X-RateLimit-Reset': sinon.match(Date),
+    });
+  });
+});

test/api/unit/middlewares/redirects.js

@@ -22,7 +22,7 @@ describe('redirects middleware', () => {
       const nconfStub = sandbox.stub(nconf, 'get');
       nconfStub.withArgs('BASE_URL').returns('https://habitica.com');
       nconfStub.withArgs('IS_PROD').returns(true);
-      req.header = sandbox.stub().withArgs('x-forwarded-proto').returns('http');
+      req.protocol = 'http';
       req.originalUrl = '/static/front';
 
       const attachRedirects = requireAgain(pathToRedirectsMiddleware);
@@ -37,7 +37,7 @@ describe('redirects middleware', () => {
       const nconfStub = sandbox.stub(nconf, 'get');
       nconfStub.withArgs('BASE_URL').returns('https://habitica.com');
       nconfStub.withArgs('IS_PROD').returns(true);
-      req.header = sandbox.stub().withArgs('x-forwarded-proto').returns('https');
+      req.protocol = 'https';
       req.originalUrl = '/static/front';
 
       const attachRedirects = requireAgain(pathToRedirectsMiddleware);
@@ -51,7 +51,7 @@ describe('redirects middleware', () => {
       const nconfStub = sandbox.stub(nconf, 'get');
       nconfStub.withArgs('BASE_URL').returns('https://habitica.com');
       nconfStub.withArgs('IS_PROD').returns(false);
-      req.header = sandbox.stub().withArgs('x-forwarded-proto').returns('http');
+      req.protocol = 'http';
       req.originalUrl = '/static/front';
 
       const attachRedirects = requireAgain(pathToRedirectsMiddleware);
@@ -65,7 +65,7 @@ describe('redirects middleware', () => {
       const nconfStub = sandbox.stub(nconf, 'get');
       nconfStub.withArgs('BASE_URL').returns('http://habitica.com');
       nconfStub.withArgs('IS_PROD').returns(true);
-      req.header = sandbox.stub().withArgs('x-forwarded-proto').returns('http');
+      req.protocol = 'http';
       req.originalUrl = '/static/front';
 
       const attachRedirects = requireAgain(pathToRedirectsMiddleware);
@@ -81,7 +81,7 @@ describe('redirects middleware', () => {
       nconfStub.withArgs('IS_PROD').returns(true);
       nconfStub.withArgs('SKIP_SSL_CHECK_KEY').returns('test-key');
 
-      req.header = sandbox.stub().withArgs('x-forwarded-proto').returns('http');
+      req.protocol = 'http';
       req.originalUrl = '/static/front';
       req.query.skipSSLCheck = 'test-key';
 
@@ -97,7 +97,7 @@ describe('redirects middleware', () => {
       nconfStub.withArgs('IS_PROD').returns(true);
       nconfStub.withArgs('SKIP_SSL_CHECK_KEY').returns('test-key');
 
-      req.header = sandbox.stub().withArgs('x-forwarded-proto').returns('http');
+      req.protocol = 'http';
       req.originalUrl = '/static/front?skipSSLCheck=INVALID';
       req.query.skipSSLCheck = 'INVALID';
 
@@ -114,7 +114,7 @@ describe('redirects middleware', () => {
       nconfStub.withArgs('IS_PROD').returns(true);
       nconfStub.withArgs('SKIP_SSL_CHECK_KEY').returns(null);
 
-      req.header = sandbox.stub().withArgs('x-forwarded-proto').returns('http');
+      req.protocol = 'http';
       req.originalUrl = '/static/front';
       req.query.skipSSLCheck = 'INVALID';
 

test/api/unit/models/challenge.test.js

@@ -35,6 +35,33 @@ describe('Challenge Model', () => {
       notes: 'test notes',
     },
   };
+  const tasks2ToTest = {
+    habit: {
+      text: 'test habit 2',
+      type: 'habit',
+      up: false,
+      down: true,
+      notes: 'test notes',
+    },
+    todo: {
+      text: 'test todo 2',
+      type: 'todo',
+      notes: 'test notes',
+    },
+    daily: {
+      text: 'test daily 2',
+      type: 'daily',
+      frequency: 'daily',
+      everyX: 5,
+      startDate: new Date(),
+      notes: 'test notes',
+    },
+    reward: {
+      text: 'test reward 2',
+      type: 'reward',
+      notes: 'test notes',
+    },
+  };
 
   beforeEach(async () => {
     guild = new Group({
@@ -146,6 +173,60 @@ describe('Challenge Model', () => {
         expect(syncedTask.attribute).to.eql('str');
       });
 
+      it('should add challenge tag back to user upon syncing challenge tasks to a user with challenge tag removed', async () => {
+        await challenge.addTasks([task]);
+
+        const newMember = new User({
+          guilds: [guild._id],
+        });
+        await newMember.save();
+        await challenge.syncTasksToUser(newMember);
+
+        let updatedNewMember = await User.findById(newMember._id).exec();
+        const updatedNewMemberId = updatedNewMember._id;
+
+        updatedNewMember.tags = [];
+        await updatedNewMember.save();
+
+        const taskValue2 = tasks2ToTest[taskType];
+        const task2 = new Tasks[`${taskType}`](Tasks.Task.sanitize(taskValue2));
+        task2.challenge.id = challenge._id;
+        await challenge.addTasks([task2]);
+        await challenge.syncTasksToUser(updatedNewMember);
+
+        updatedNewMember = await User.findById(updatedNewMemberId).exec();
+
+        expect(updatedNewMember.tags.length).to.equal(1);
+        expect(updatedNewMember.tags[0].id).to.equal(challenge._id);
+        expect(updatedNewMember.tags[0].name).to.equal(challenge.shortName);
+      });
+
+      it('should not add a duplicate challenge tag to user upon syncing challenge tasks to a user with existing challenge tag', async () => {
+        await challenge.addTasks([task]);
+
+        const newMember = new User({
+          guilds: [guild._id],
+        });
+        await newMember.save();
+        await challenge.syncTasksToUser(newMember);
+
+        let updatedNewMember = await User.findById(newMember._id).exec();
+        const updatedNewMemberId = updatedNewMember._id;
+
+        const taskValue2 = tasks2ToTest[taskType];
+        const task2 = new Tasks[`${taskType}`](Tasks.Task.sanitize(taskValue2));
+        task2.challenge.id = challenge._id;
+        await challenge.addTasks([task2]);
+        await challenge.syncTasksToUser(updatedNewMember);
+
+        updatedNewMember = await User.findById(updatedNewMemberId);
+
+        expect(updatedNewMember.tags.length).to.equal(8);
+        expect(updatedNewMember.tags[7].id).to.equal(challenge._id);
+        expect(updatedNewMember.tags[7].name).to.equal(challenge.shortName);
+        expect(updatedNewMember.tags.filter(tag => tag.id === challenge._id).length).to.equal(1);
+      });
+
       it('syncs challenge tasks to a user with the existing task', async () => {
         await challenge.addTasks([task]);
 

test/api/unit/models/group_tasks.test.js

@@ -235,15 +235,16 @@ describe('Group Task Methods', () => {
         });
       });
 
-      it('removes an assigned task and unlinks assignees', async () => {
+      it('removes assigned tasks when master task is deleted', async () => {
         await guild.syncTask(task, leader);
         await guild.removeTask(task);
 
         const updatedLeader = await User.findOne({ _id: leader._id });
-        const updatedLeadersTasks = await Tasks.Task.find({ _id: { $in: updatedLeader.tasksOrder[`${taskType}s`] } });
+        const updatedLeadersTasks = await Tasks.Task.find({ userId: leader._id, type: taskType });
         const syncedTask = find(updatedLeadersTasks, findLinkedTask);
 
-        expect(syncedTask.group.broken).to.equal('TASK_DELETED');
+        expect(updatedLeader.tasksOrder[`${taskType}s`]).to.not.include(task._id);
+        expect(syncedTask).to.not.exist;
       });
 
       it('unlinks and deletes group tasks for a user when remove-all is specified', async () => {

test/api/unit/models/newsPost.js

@@ -0,0 +1,138 @@
+import { v4 } from 'uuid';
+import { model as NewsPost, refreshNewsPost } from '../../../../website/server/models/newsPost';
+import { sleep } from '../../../helpers/api-unit.helper';
+
+describe('NewsPost Model', () => {
+  const publishDate = Number(new Date());
+
+  // NOTE publishDate is manually increased by +500 for each test
+  // to make sure it's always in the future from the previous one
+  // bevause NewsPost.lastNewsPost() is not reset between tests.
+  // And without a more recent publishDate it wouldn't update
+
+  it('#lastNewsPost', () => {
+    const lastPost = { _id: v4(), publishDate, published: true };
+    NewsPost.updateLastNewsPost(lastPost);
+    expect(NewsPost.lastNewsPost()).to.equal(lastPost);
+  });
+
+  it('#getLastPostFromDatabase', async () => {
+    const expectedId = v4();
+
+    await NewsPost.create([
+      // more recent but not published
+      {
+        _id: v4(),
+        publishDate: new Date(publishDate + 50),
+        author: v4(),
+        published: false,
+        title: 'Title',
+        credits: 'credits',
+        text: 'text',
+      },
+      // expected
+      {
+        _id: expectedId,
+        publishDate,
+        author: v4(),
+        published: true,
+        title: 'Title',
+        credits: 'credits',
+        text: 'text',
+      },
+      // published but less recent
+      {
+        _id: v4(),
+        publishDate: new Date(Number(publishDate) - 50),
+        author: v4(),
+        published: true,
+        title: 'Title',
+        credits: 'credits',
+        text: 'text',
+      },
+    ]);
+
+    const fetched = await NewsPost.getLastPostFromDatabase();
+    expect(fetched._id).to.equal(expectedId);
+  });
+
+  context('#updateLastNewsPost', () => {
+    it('updates the post if new one is more recent and published', () => {
+      const previousPost = {
+        _id: v4(),
+        publishDate: new Date(publishDate + 100),
+        published: true,
+      };
+      NewsPost.updateLastNewsPost(previousPost);
+      const newPost = {
+        _id: v4(),
+        publishDate: new Date(publishDate + 150),
+        published: true,
+      };
+      NewsPost.updateLastNewsPost(newPost);
+      expect(NewsPost.lastNewsPost()._id).to.equal(newPost._id);
+    });
+
+    it('does not update the post if new one is from the past', () => {
+      const previousPost = new NewsPost({
+        _id: v4(), publishDate: new Date(publishDate + 200), published: true,
+      });
+      NewsPost.updateLastNewsPost(previousPost);
+      const newPost = new NewsPost({
+        _id: v4(), publishDate: new Date(publishDate + 175), published: true,
+      });
+      NewsPost.updateLastNewsPost(newPost);
+      expect(NewsPost.lastNewsPost()._id).to.equal(previousPost._id);
+    });
+
+    it('does not update the post if new one is not published', () => {
+      const previousPost = new NewsPost({
+        _id: v4(), publishDate: new Date(publishDate + 250), published: true,
+      });
+      NewsPost.updateLastNewsPost(previousPost);
+      const newPost = new NewsPost({
+        _id: v4(), publishDate: new Date(publishDate + 300), published: false,
+      });
+      NewsPost.updateLastNewsPost(newPost);
+      expect(NewsPost.lastNewsPost()._id).to.equal(previousPost._id);
+    });
+  });
+
+  context('refreshes NewsPost', () => {
+    let intervalId;
+
+    beforeEach(async () => {
+      // Delete all existing posts from the database
+      await NewsPost.remove();
+    });
+
+    afterEach(() => {
+      if (intervalId) clearInterval(intervalId);
+    });
+
+    it('refreshes the last post at a specific interval', async () => {
+      await sleep(0.1); // wait 100ms to make sure all previous posts are in the past
+      const previousPost = {
+        _id: v4(), publishDate: new Date(), published: true,
+      };
+      NewsPost.updateLastNewsPost(previousPost);
+      intervalId = refreshNewsPost(50); // refreshes every 50ms
+
+      await sleep(0.1); // wait 100ms to make sure the new post has a more recent publishDate
+      const newPost = await NewsPost.create({
+        _id: v4(),
+        publishDate: new Date(),
+        author: v4(),
+        published: true,
+        title: 'Title',
+        credits: 'credits',
+        text: 'text',
+      });
+
+      expect(NewsPost.lastNewsPost()._id).to.equal(previousPost._id);
+      await sleep(0.15); // wait 150ms
+
+      expect(NewsPost.lastNewsPost()._id).to.equal(newPost._id);
+    });
+  });
+});

test/api/unit/models/task.test.js

@@ -3,7 +3,6 @@ import { model as Challenge } from '../../../../website/server/models/challenge'
 import { model as Group } from '../../../../website/server/models/group';
 import { model as User } from '../../../../website/server/models/user';
 import * as Tasks from '../../../../website/server/models/task';
-import { InternalServerError } from '../../../../website/server/libs/errors';
 import { generateHistory } from '../../../helpers/api-unit.helper';
 
 describe('Task Model', () => {
@@ -99,7 +98,8 @@ describe('Task Model', () => {
           throw new Error('No exception when Id is None');
         } catch (err) {
           expect(err).to.exist;
-          expect(err).to.eql(new InternalServerError('Task identifier is a required argument'));
+          expect(err).to.be.an.instanceOf(Error);
+          expect(err.message).to.eql('Task identifier is a required argument');
         }
       });
 
@@ -109,7 +109,8 @@ describe('Task Model', () => {
           throw new Error('No exception when user_id is undefined');
         } catch (err) {
           expect(err).to.exist;
-          expect(err).to.eql(new InternalServerError('User identifier is a required argument'));
+          expect(err).to.be.an.instanceOf(Error);
+          expect(err.message).to.eql('User identifier is a required argument');
         }
       });
 
@@ -153,6 +154,132 @@ describe('Task Model', () => {
       });
     });
 
+    describe('findMultipleByIdOrAlias', () => {
+      let taskWithAlias;
+      let secondTask;
+      let user;
+
+      beforeEach(async () => {
+        user = new User();
+        await user.save();
+
+        taskWithAlias = new Tasks.todo({ // eslint-disable-line new-cap
+          text: 'some text',
+          alias: 'short-name',
+          userId: user.id,
+        });
+        await taskWithAlias.save();
+
+        secondTask = new Tasks.habit({ // eslint-disable-line new-cap
+          text: 'second task',
+          alias: 'second-short-name',
+          userId: user.id,
+        });
+        await secondTask.save();
+
+        sandbox.spy(Tasks.Task, 'find');
+      });
+
+      it('throws an error if task identifiers is not passed in', async () => {
+        try {
+          await Tasks.Task.findMultipleByIdOrAlias(null, user._id);
+          throw new Error('No exception when Id is None');
+        } catch (err) {
+          expect(err).to.exist;
+          expect(err).to.be.an.instanceOf(Error);
+          expect(err.message).to.eql('Task identifiers is a required array argument');
+        }
+      });
+
+      it('throws an error if task identifiers is not an array', async () => {
+        try {
+          await Tasks.Task.findMultipleByIdOrAlias('string', user._id);
+          throw new Error('No exception when Id is None');
+        } catch (err) {
+          expect(err).to.exist;
+          expect(err).to.be.an.instanceOf(Error);
+          expect(err.message).to.eql('Task identifiers is a required array argument');
+        }
+      });
+
+      it('throws an error if user identifier is not passed in', async () => {
+        try {
+          await Tasks.Task.findMultipleByIdOrAlias([taskWithAlias._id]);
+          throw new Error('No exception when user_id is undefined');
+        } catch (err) {
+          expect(err).to.exist;
+          expect(err).to.be.an.instanceOf(Error);
+          expect(err.message).to.eql('User identifier is a required argument');
+        }
+      });
+
+      it('returns task by id', async () => {
+        const foundTasks = await Tasks.Task.findMultipleByIdOrAlias([taskWithAlias._id], user._id);
+
+        expect(foundTasks[0].text).to.eql(taskWithAlias.text);
+      });
+
+      it('returns task by alias', async () => {
+        const foundTasks = await Tasks.Task.findMultipleByIdOrAlias(
+          [taskWithAlias.alias], user._id,
+        );
+
+        expect(foundTasks[0].text).to.eql(taskWithAlias.text);
+      });
+
+      it('returns multiple tasks', async () => {
+        const foundTasks = await Tasks.Task.findMultipleByIdOrAlias(
+          [taskWithAlias.alias, secondTask._id], user._id,
+        );
+
+        expect(foundTasks.length).to.eql(2);
+        expect(foundTasks[0]._id).to.eql(taskWithAlias._id);
+        expect(foundTasks[1]._id).to.eql(secondTask._id);
+      });
+
+      it('returns a task only once if searched by both id and alias', async () => {
+        const foundTasks = await Tasks.Task.findMultipleByIdOrAlias(
+          [taskWithAlias.alias, taskWithAlias._id], user._id,
+        );
+
+        expect(foundTasks.length).to.eql(1);
+        expect(foundTasks[0].text).to.eql(taskWithAlias.text);
+      });
+
+      it('scopes alias lookup to user', async () => {
+        await Tasks.Task.findMultipleByIdOrAlias([taskWithAlias.alias], user._id);
+
+        expect(Tasks.Task.find).to.be.calledOnce;
+        expect(Tasks.Task.find).to.be.calledWithMatch({
+          $or: [
+            { _id: { $in: [] } },
+            { alias: { $in: [taskWithAlias.alias] } },
+          ],
+          userId: user._id,
+        });
+      });
+
+      it('returns empty array if tasks cannot be found', async () => {
+        const foundTasks = await Tasks.Task.findMultipleByIdOrAlias(['not-found'], user._id);
+
+        expect(foundTasks).to.eql([]);
+      });
+
+      it('accepts additional query parameters', async () => {
+        await Tasks.Task.findMultipleByIdOrAlias([taskWithAlias.alias], user._id, { foo: 'bar' });
+
+        expect(Tasks.Task.find).to.be.calledOnce;
+        expect(Tasks.Task.find).to.be.calledWithMatch({
+          $or: [
+            { _id: { $in: [] } },
+            { alias: { $in: [taskWithAlias.alias] } },
+          ],
+          userId: user._id,
+          foo: 'bar',
+        });
+      });
+    });
+
     describe('sanitizeUserChallengeTask ', () => {
     });
 

test/api/unit/models/user.test.js

@@ -1,87 +1,90 @@
 import moment from 'moment';
 import { model as User } from '../../../../website/server/models/user';
+import { model as NewsPost } from '../../../../website/server/models/newsPost';
 import { model as Group } from '../../../../website/server/models/group';
 import common from '../../../../website/common';
 
 describe('User Model', () => {
-  it('keeps user._tmp when calling .toJSON', () => {
-    const user = new User({
-      auth: {
-        local: {
-          username: 'username',
-          lowerCaseUsername: 'username',
-          email: 'email@email.email',
-          salt: 'salt',
-          hashed_password: 'hashed_password', // eslint-disable-line camelcase
+  describe('.toJSON()', () => {
+    it('keeps user._tmp when calling .toJSON', () => {
+      const user = new User({
+        auth: {
+          local: {
+            username: 'username',
+            lowerCaseUsername: 'username',
+            email: 'email@email.email',
+            salt: 'salt',
+            hashed_password: 'hashed_password', // eslint-disable-line camelcase
+          },
         },
-      },
+      });
+
+      user._tmp = { ok: true };
+      user._nonTmp = { ok: true };
+
+      expect(user._tmp).to.eql({ ok: true });
+      expect(user._nonTmp).to.eql({ ok: true });
+
+      const toObject = user.toObject();
+      const toJSON = user.toJSON();
+
+      expect(toObject).to.not.have.keys('_tmp');
+      expect(toObject).to.not.have.keys('_nonTmp');
+
+      expect(toJSON).to.have.any.key('_tmp');
+      expect(toJSON._tmp).to.eql({ ok: true });
+      expect(toJSON).to.not.have.keys('_nonTmp');
     });
 
-    user._tmp = { ok: true };
-    user._nonTmp = { ok: true };
+    it('can add computed stats to a JSONified user object', () => {
+      const user = new User();
+      const userToJSON = user.toJSON();
 
-    expect(user._tmp).to.eql({ ok: true });
-    expect(user._nonTmp).to.eql({ ok: true });
+      expect(userToJSON.stats.maxMP).to.not.exist;
+      expect(userToJSON.stats.maxHealth).to.not.exist;
+      expect(userToJSON.stats.toNextLevel).to.not.exist;
 
-    const toObject = user.toObject();
-    const toJSON = user.toJSON();
+      User.addComputedStatsToJSONObj(userToJSON.stats, userToJSON);
 
-    expect(toObject).to.not.have.keys('_tmp');
-    expect(toObject).to.not.have.keys('_nonTmp');
+      expect(userToJSON.stats.maxMP).to.exist;
+      expect(userToJSON.stats.maxHealth).to.equal(common.maxHealth);
+      expect(userToJSON.stats.toNextLevel).to.equal(common.tnl(user.stats.lvl));
+    });
 
-    expect(toJSON).to.have.any.key('_tmp');
-    expect(toJSON._tmp).to.eql({ ok: true });
-    expect(toJSON).to.not.have.keys('_nonTmp');
-  });
+    it('can transform user object without mongoose helpers', async () => {
+      const user = new User();
+      await user.save();
+      const userToJSON = await User.findById(user._id).lean().exec();
 
-  it('can add computed stats to a JSONified user object', () => {
-    const user = new User();
-    const userToJSON = user.toJSON();
+      expect(userToJSON.stats.maxMP).to.not.exist;
+      expect(userToJSON.stats.maxHealth).to.not.exist;
+      expect(userToJSON.stats.toNextLevel).to.not.exist;
+      expect(userToJSON.id).to.not.exist;
 
-    expect(userToJSON.stats.maxMP).to.not.exist;
-    expect(userToJSON.stats.maxHealth).to.not.exist;
-    expect(userToJSON.stats.toNextLevel).to.not.exist;
+      User.transformJSONUser(userToJSON);
 
-    User.addComputedStatsToJSONObj(userToJSON.stats, userToJSON);
+      expect(userToJSON.id).to.equal(userToJSON._id);
+      expect(userToJSON.stats.maxMP).to.not.exist;
+      expect(userToJSON.stats.maxHealth).to.not.exist;
+      expect(userToJSON.stats.toNextLevel).to.not.exist;
+    });
 
-    expect(userToJSON.stats.maxMP).to.exist;
-    expect(userToJSON.stats.maxHealth).to.equal(common.maxHealth);
-    expect(userToJSON.stats.toNextLevel).to.equal(common.tnl(user.stats.lvl));
-  });
+    it('can transform user object without mongoose helpers (including computed stats)', async () => {
+      const user = new User();
+      await user.save();
+      const userToJSON = await User.findById(user._id).lean().exec();
 
-  it('can transform user object without mongoose helpers', async () => {
-    const user = new User();
-    await user.save();
-    const userToJSON = await User.findById(user._id).lean().exec();
+      expect(userToJSON.stats.maxMP).to.not.exist;
+      expect(userToJSON.stats.maxHealth).to.not.exist;
+      expect(userToJSON.stats.toNextLevel).to.not.exist;
 
-    expect(userToJSON.stats.maxMP).to.not.exist;
-    expect(userToJSON.stats.maxHealth).to.not.exist;
-    expect(userToJSON.stats.toNextLevel).to.not.exist;
-    expect(userToJSON.id).to.not.exist;
+      User.transformJSONUser(userToJSON, true);
 
-    User.transformJSONUser(userToJSON);
-
-    expect(userToJSON.id).to.equal(userToJSON._id);
-    expect(userToJSON.stats.maxMP).to.not.exist;
-    expect(userToJSON.stats.maxHealth).to.not.exist;
-    expect(userToJSON.stats.toNextLevel).to.not.exist;
-  });
-
-  it('can transform user object without mongoose helpers (including computed stats)', async () => {
-    const user = new User();
-    await user.save();
-    const userToJSON = await User.findById(user._id).lean().exec();
-
-    expect(userToJSON.stats.maxMP).to.not.exist;
-    expect(userToJSON.stats.maxHealth).to.not.exist;
-    expect(userToJSON.stats.toNextLevel).to.not.exist;
-
-    User.transformJSONUser(userToJSON, true);
-
-    expect(userToJSON.id).to.equal(userToJSON._id);
-    expect(userToJSON.stats.maxMP).to.exist;
-    expect(userToJSON.stats.maxHealth).to.equal(common.maxHealth);
-    expect(userToJSON.stats.toNextLevel).to.equal(common.tnl(user.stats.lvl));
+      expect(userToJSON.id).to.equal(userToJSON._id);
+      expect(userToJSON.stats.maxMP).to.exist;
+      expect(userToJSON.stats.maxHealth).to.equal(common.maxHealth);
+      expect(userToJSON.stats.toNextLevel).to.equal(common.tnl(user.stats.lvl));
+    });
   });
 
   context('achievements', () => {
@@ -589,6 +592,50 @@ describe('User Model', () => {
   });
 
   context('pre-save hook', () => {
+    it('enrolls users that signup through web in the Drop Cap AB test', async () => {
+      let user = new User();
+      user.registeredThrough = 'habitica-web';
+      user = await user.save();
+      expect(user._ABtests.dropCapNotif).to.exist;
+    });
+
+    it('does not enroll users that signup through modal in the Drop Cap AB test', async () => {
+      let user = new User();
+      user.registeredThrough = 'habitica-ios';
+      user = await user.save();
+      expect(user._ABtests.dropCapNotif).to.not.exist;
+    });
+
+    it('marks the last news post as read for new users', async () => {
+      const lastNewsPost = { _id: '1' };
+      sandbox.stub(NewsPost, 'lastNewsPost').returns(lastNewsPost);
+
+      let user = new User();
+      expect(user.isNew).to.equal(true);
+      user = await user.save();
+
+      expect(user.checkNewStuff()).to.equal(false);
+      expect(user.toJSON().flags.newStuff).to.equal(false);
+      expect(user.flags.lastNewStuffRead).to.equal(lastNewsPost._id);
+    });
+
+    it('does not mark the last news post as read for existing users', async () => {
+      const lastNewsPost = { _id: '1' };
+      const lastNewsPostStub = sandbox.stub(NewsPost, 'lastNewsPost');
+      lastNewsPostStub.returns(lastNewsPost);
+
+      let user = new User();
+      user = await user.save();
+
+      expect(user.isNew).to.equal(false);
+      user.profile.name = 'new name';
+
+      lastNewsPostStub.returns({ _id: '2' });
+      user = await user.save();
+
+      expect(user.flags.lastNewStuffRead).to.equal(lastNewsPost._id); // not _id: 2
+    });
+
     it('does not try to award achievements when achievements or items not selected in query', async () => {
       let user = new User();
       user = await user.save(); // necessary for user.isSelected to work correctly
@@ -761,7 +808,7 @@ describe('User Model', () => {
     });
   });
 
-  context('days missed', () => {
+  describe('daysUserHasMissed', () => {
     // http://forbrains.co.uk/international_tools/earth_timezones
     let user;
 
@@ -769,24 +816,51 @@ describe('User Model', () => {
       user = new User();
     });
 
-    it('should not cron early when going back a timezone', () => {
-      const yesterday = moment('2017-12-05T00:00:00.000-06:00'); // 11 pm on 4 Texas
-      const timezoneOffset = moment().zone('-06:00').zone();
-      user.lastCron = yesterday;
-      user.preferences.timezoneOffset = timezoneOffset;
+    it('correctly calculates days missed since lastCron', () => {
+      const now = moment();
+      user.lastCron = moment(now).subtract(5, 'days');
 
-      const today = moment('2017-12-06T00:00:00.000-06:00'); // 11 pm on 4 Texas
-      const req = {};
-      req.header = () => timezoneOffset + 60;
+      const { daysMissed } = user.daysUserHasMissed(now);
 
-      const { daysMissed } = user.daysUserHasMissed(today, req);
+      expect(daysMissed).to.eql(5);
+    });
 
+    it('uses timezone from preferences to calculate days missed', () => {
+      const now = moment('2017-07-08 01:00:00Z');
+      user.lastCron = moment('2017-07-04 13:00:00Z');
+      user.preferences.timezoneOffset = 120;
+
+      const { daysMissed } = user.daysUserHasMissed(now);
+
+      expect(daysMissed).to.eql(3);
+    });
+
+    it('uses timezone at last cron to calculate days missed', () => {
+      const now = moment('2017-09-08 13:00:00Z');
+      user.lastCron = moment('2017-09-06 01:00:00+02:00');
+      user.preferences.timezoneOffset = 0;
+      user.preferences.timezoneOffsetAtLastCron = -120;
+
+      const { daysMissed } = user.daysUserHasMissed(now);
+
+      expect(daysMissed).to.eql(2);
+    });
+
+    it('respects new timezone that drags time into same day', () => {
+      user.lastCron = moment('2017-12-05T00:00:00.000-06:00');
+      user.preferences.timezoneOffset = 360;
+      const today = moment('2017-12-06T00:00:00.000-06:00');
+      const requestWithMinus7Timezone = { header: () => 420 };
+
+      const { daysMissed } = user.daysUserHasMissed(today, requestWithMinus7Timezone);
+
+      expect(user.preferences.timezoneOffset).to.eql(420);
       expect(daysMissed).to.eql(0);
     });
 
     it('should not cron early when going back a timezone with a custom day start', () => {
       const yesterday = moment('2017-12-05T02:00:00.000-08:00');
-      const timezoneOffset = moment().zone('-08:00').zone();
+      const timezoneOffset = 480;
       user.lastCron = yesterday;
       user.preferences.timezoneOffset = timezoneOffset;
       user.preferences.dayStart = 2;
@@ -800,4 +874,46 @@ describe('User Model', () => {
       expect(daysMissed).to.eql(0);
     });
   });
+
+  it('isNewsPoster', async () => {
+    const user = new User();
+    await user.save();
+
+    expect(user.isNewsPoster()).to.equal(false);
+
+    user.contributor.newsPoster = true;
+    expect(user.isNewsPoster()).to.equal(true);
+  });
+
+  describe('checkNewStuff', () => {
+    let user;
+
+    beforeEach(() => {
+      user = new User();
+    });
+
+    afterEach(() => {
+      sandbox.restore();
+    });
+
+    it('no last news post', () => {
+      sandbox.stub(NewsPost, 'lastNewsPost').returns(null);
+      expect(user.checkNewStuff()).to.equal(false);
+      expect(user.toJSON().flags.newStuff).to.equal(false);
+    });
+
+    it('last news post read', () => {
+      sandbox.stub(NewsPost, 'lastNewsPost').returns({ _id: '123' });
+      user.flags.lastNewStuffRead = '123';
+      expect(user.checkNewStuff()).to.equal(false);
+      expect(user.toJSON().flags.newStuff).to.equal(false);
+    });
+
+    it('last news post not read', () => {
+      sandbox.stub(NewsPost, 'lastNewsPost').returns({ _id: '123' });
+      user.flags.lastNewStuffRead = '124';
+      expect(user.checkNewStuff()).to.equal(true);
+      expect(user.toJSON().flags.newStuff).to.equal(true);
+    });
+  });
 });

test/api/v3/integration/challenges/GET-challenges_challengeId_members.test.js

@@ -117,7 +117,7 @@ describe('GET /challenges/:challengeId/members', () => {
     expect(res[0].profile).to.have.all.keys(['name']);
   });
 
-  it('returns only first 30 members if req.query.includeAllMembers is not true', async () => {
+  it('returns only first 30 members if req.query.includeAllMembers is not true and req.query.limit is undefined', async () => {
     const group = await generateGroup(user, { type: 'party', name: generateUUID() });
     const challenge = await generateChallenge(user, group);
     await user.post(`/challenges/${challenge._id}/join`);
@@ -136,7 +136,7 @@ describe('GET /challenges/:challengeId/members', () => {
     });
   });
 
-  it('returns only first 30 members if req.query.includeAllMembers is not defined', async () => {
+  it('returns only first 30 members if req.query.includeAllMembers is not defined and req.query.limit is undefined', async () => {
     const group = await generateGroup(user, { type: 'party', name: generateUUID() });
     const challenge = await generateChallenge(user, group);
     await user.post(`/challenges/${challenge._id}/join`);
@@ -155,6 +155,68 @@ describe('GET /challenges/:challengeId/members', () => {
     });
   });
 
+  it('returns an error if req.query.limit is over 60', async () => {
+    const group = await generateGroup(user, { type: 'party', privacy: 'private' });
+    const challenge = await generateChallenge(user, group);
+    const anotherUser = await generateUser();
+
+    await expect(anotherUser.get(`/challenges/${challenge._id}/members?limit=61`)).to.eventually.be.rejected.and.eql({
+      code: 400,
+      error: 'BadRequest',
+      message: t('invalidReqParams'),
+    });
+  });
+
+  it('returns an error if req.query.limit is under 1', async () => {
+    const group = await generateGroup(user, { type: 'party', privacy: 'private' });
+    const challenge = await generateChallenge(user, group);
+    const anotherUser = await generateUser();
+
+    await expect(anotherUser.get(`/challenges/${challenge._id}/members?limit=-13`)).to.eventually.be.rejected.and.eql({
+      code: 400,
+      error: 'BadRequest',
+      message: t('invalidReqParams'),
+    });
+  });
+
+  it('returns an error if req.query.limit is not an integer', async () => {
+    const group = await generateGroup(user, { type: 'party', privacy: 'private' });
+    const challenge = await generateChallenge(user, group);
+    const anotherUser = await generateUser();
+
+    await expect(anotherUser.get(`/challenges/${challenge._id}/members?limit=true`)).to.eventually.be.rejected.and.eql({
+      code: 400,
+      error: 'BadRequest',
+      message: t('invalidReqParams'),
+    });
+  });
+
+  it('returns up to 60 members when req.query.limit is specified', async () => {
+    const group = await generateGroup(user, { type: 'party', name: generateUUID() });
+    const challenge = await generateChallenge(user, group);
+    await user.post(`/challenges/${challenge._id}/join`);
+
+    const usersToGenerate = [];
+    for (let i = 0; i < 62; i += 1) {
+      usersToGenerate.push(generateUser({ challenges: [challenge._id] }));
+    }
+    await Promise.all(usersToGenerate);
+
+    let res = await user.get(`/challenges/${challenge._id}/members?limit=57`);
+    expect(res.length).to.equal(57);
+    res.forEach(member => {
+      expect(member).to.have.all.keys(['_id', 'auth', 'flags', 'id', 'profile']);
+      expect(member.profile).to.have.all.keys(['name']);
+    });
+
+    res = await user.get(`/challenges/${challenge._id}/members?limit=60&lastId=${res[res.length - 1]._id}`);
+    expect(res.length).to.equal(6);
+    res.forEach(member => {
+      expect(member).to.have.all.keys(['_id', 'auth', 'flags', 'id', 'profile']);
+      expect(member.profile).to.have.all.keys(['name']);
+    });
+  }).timeout(30000);
+
   it('returns all members if req.query.includeAllMembers is true', async () => {
     const group = await generateGroup(user, { type: 'party', name: generateUUID() });
     const challenge = await generateChallenge(user, group);

test/api/v3/integration/challenges/GET-challenges_user.test.js

@@ -6,8 +6,8 @@ import {
 
 describe('GET challenges/user', () => {
   context('no official challenges', () => {
-    let user; let member; let nonMember; let challenge; let challenge2; let
-      publicGuild;
+    let user; let member; let nonMember; let challenge; let challenge2;
+    let publicGuild; let userData; let groupData;
 
     before(async () => {
       const { group, groupLeader, members } = await createAndPopulateGroup({
@@ -19,225 +19,197 @@ describe('GET challenges/user', () => {
         members: 1,
       });
 
-      user = groupLeader;
       publicGuild = group;
+      groupData = {
+        _id: publicGuild._id,
+        categories: [],
+        id: publicGuild._id,
+        type: publicGuild.type,
+        privacy: publicGuild.privacy,
+        name: publicGuild.name,
+        summary: publicGuild.name,
+        leader: publicGuild.leader._id,
+      };
+
+      user = groupLeader;
+      userData = {
+        _id: publicGuild.leader._id,
+        id: publicGuild.leader._id,
+        profile: { name: user.profile.name },
+        auth: {
+          local: {
+            username: user.auth.local.username,
+          },
+        },
+        flags: {
+          verifiedUsername: true,
+        },
+      };
+
       member = members[0]; // eslint-disable-line prefer-destructuring
       nonMember = await generateUser();
 
       challenge = await generateChallenge(user, group);
-      await user.post(`/challenges/${challenge._id}/join`);
       challenge2 = await generateChallenge(user, group);
-      await user.post(`/challenges/${challenge2._id}/join`);
-    });
 
-    it('should return challenges user has joined', async () => {
       await nonMember.post(`/challenges/${challenge._id}/join`);
+    });
+    context('all challenges', () => {
+      it('should return challenges user has joined', async () => {
+        const challenges = await nonMember.get('/challenges/user');
 
-      const challenges = await nonMember.get('/challenges/user');
+        const foundChallenge = _.find(challenges, { _id: challenge._id });
+        expect(foundChallenge).to.exist;
+        expect(foundChallenge.leader).to.eql(userData);
+        expect(foundChallenge.group).to.eql(groupData);
+      });
 
-      const foundChallenge = _.find(challenges, { _id: challenge._id });
-      expect(foundChallenge).to.exist;
-      expect(foundChallenge.leader).to.eql({
-        _id: publicGuild.leader._id,
-        id: publicGuild.leader._id,
-        profile: { name: user.profile.name },
-        auth: {
-          local: {
-            username: user.auth.local.username,
+      it('should not return challenges a non-member has not joined', async () => {
+        const challenges = await nonMember.get('/challenges/user');
+
+        const foundChallenge2 = _.find(challenges, { _id: challenge2._id });
+        expect(foundChallenge2).to.not.exist;
+      });
+
+      it('should return challenges user has created', async () => {
+        const challenges = await user.get('/challenges/user');
+
+        const foundChallenge1 = _.find(challenges, { _id: challenge._id });
+        expect(foundChallenge1).to.exist;
+        expect(foundChallenge1.leader).to.eql(userData);
+        expect(foundChallenge1.group).to.eql(groupData);
+        const foundChallenge2 = _.find(challenges, { _id: challenge2._id });
+        expect(foundChallenge2).to.exist;
+        expect(foundChallenge2.leader).to.eql(userData);
+        expect(foundChallenge2.group).to.eql(groupData);
+      });
+
+      it('should return challenges in user\'s group', async () => {
+        const challenges = await member.get('/challenges/user');
+
+        const foundChallenge1 = _.find(challenges, { _id: challenge._id });
+        expect(foundChallenge1).to.exist;
+        expect(foundChallenge1.leader).to.eql(userData);
+        expect(foundChallenge1.group).to.eql(groupData);
+        const foundChallenge2 = _.find(challenges, { _id: challenge2._id });
+        expect(foundChallenge2).to.exist;
+        expect(foundChallenge2.leader).to.eql(userData);
+        expect(foundChallenge2.group).to.eql(groupData);
+      });
+
+      it('should return newest challenges first', async () => {
+        let challenges = await user.get('/challenges/user');
+
+        let foundChallengeIndex = _.findIndex(challenges, { _id: challenge2._id });
+        expect(foundChallengeIndex).to.eql(0);
+
+        const newChallenge = await generateChallenge(user, publicGuild);
+        await user.post(`/challenges/${newChallenge._id}/join`);
+
+        challenges = await user.get('/challenges/user');
+
+        foundChallengeIndex = _.findIndex(challenges, { _id: newChallenge._id });
+        expect(foundChallengeIndex).to.eql(0);
+      });
+
+      it('should not return challenges user doesn\'t have access to', async () => {
+        const { group, groupLeader } = await createAndPopulateGroup({
+          groupDetails: {
+            name: 'TestPrivateGuild',
+            summary: 'summary for TestPrivateGuild',
+            type: 'guild',
+            privacy: 'private',
           },
-        },
-        flags: {
-          verifiedUsername: true,
-        },
-      });
-      expect(foundChallenge.group).to.eql({
-        _id: publicGuild._id,
-        categories: [],
-        id: publicGuild._id,
-        type: publicGuild.type,
-        privacy: publicGuild.privacy,
-        name: publicGuild.name,
-        summary: publicGuild.name,
-        leader: publicGuild.leader._id,
-      });
-    });
+        });
 
-    it('should return challenges user has created', async () => {
-      const challenges = await user.get('/challenges/user');
+        const privateChallenge = await generateChallenge(groupLeader, group);
+        await groupLeader.post(`/challenges/${privateChallenge._id}/join`);
 
-      const foundChallenge1 = _.find(challenges, { _id: challenge._id });
-      expect(foundChallenge1).to.exist;
-      expect(foundChallenge1.leader).to.eql({
-        _id: publicGuild.leader._id,
-        id: publicGuild.leader._id,
-        profile: { name: user.profile.name },
-        auth: {
-          local: {
-            username: user.auth.local.username,
+        const challenges = await nonMember.get('/challenges/user');
+
+        const foundChallenge = _.find(challenges, { _id: privateChallenge._id });
+        expect(foundChallenge).to.not.exist;
+      });
+
+      it('should not return challenges user doesn\'t have access to, even with query parameters', async () => {
+        const { group, groupLeader } = await createAndPopulateGroup({
+          groupDetails: {
+            name: 'TestPrivateGuild',
+            summary: 'summary for TestPrivateGuild',
+            type: 'guild',
+            privacy: 'private',
           },
-        },
-        flags: {
-          verifiedUsername: true,
-        },
-      });
-      expect(foundChallenge1.group).to.eql({
-        _id: publicGuild._id,
-        categories: [],
-        id: publicGuild._id,
-        type: publicGuild.type,
-        privacy: publicGuild.privacy,
-        name: publicGuild.name,
-        summary: publicGuild.name,
-        leader: publicGuild.leader._id,
-      });
-      const foundChallenge2 = _.find(challenges, { _id: challenge2._id });
-      expect(foundChallenge2).to.exist;
-      expect(foundChallenge2.leader).to.eql({
-        _id: publicGuild.leader._id,
-        id: publicGuild.leader._id,
-        profile: { name: user.profile.name },
-        auth: {
-          local: {
-            username: user.auth.local.username,
-          },
-        },
-        flags: {
-          verifiedUsername: true,
-        },
-      });
-      expect(foundChallenge2.group).to.eql({
-        _id: publicGuild._id,
-        categories: [],
-        id: publicGuild._id,
-        type: publicGuild.type,
-        privacy: publicGuild.privacy,
-        name: publicGuild.name,
-        summary: publicGuild.name,
-        leader: publicGuild.leader._id,
+        });
+
+        const privateChallenge = await generateChallenge(groupLeader, group, {
+          categories: [{
+            name: 'academics',
+            slug: 'academics',
+          }],
+        });
+        await groupLeader.post(`/challenges/${privateChallenge._id}/join`);
+
+        const challenges = await nonMember.get('/challenges/user?categories=academics&owned=not_owned');
+
+        const foundChallenge = _.find(challenges, { _id: privateChallenge._id });
+        expect(foundChallenge).to.not.exist;
       });
     });
 
-    it('should return challenges in user\'s group', async () => {
-      const challenges = await member.get('/challenges/user');
+    context('my challenges', () => {
+      it('should return challenges user has joined', async () => {
+        const challenges = await nonMember.get(`/challenges/user?member=${true}`);
 
-      const foundChallenge1 = _.find(challenges, { _id: challenge._id });
-      expect(foundChallenge1).to.exist;
-      expect(foundChallenge1.leader).to.eql({
-        _id: publicGuild.leader._id,
-        id: publicGuild.leader._id,
-        profile: { name: user.profile.name },
-        auth: {
-          local: {
-            username: user.auth.local.username,
-          },
-        },
-        flags: {
-          verifiedUsername: true,
-        },
-      });
-      expect(foundChallenge1.group).to.eql({
-        _id: publicGuild._id,
-        categories: [],
-        id: publicGuild._id,
-        type: publicGuild.type,
-        privacy: publicGuild.privacy,
-        name: publicGuild.name,
-        summary: publicGuild.name,
-        leader: publicGuild.leader._id,
-      });
-      const foundChallenge2 = _.find(challenges, { _id: challenge2._id });
-      expect(foundChallenge2).to.exist;
-      expect(foundChallenge2.leader).to.eql({
-        _id: publicGuild.leader._id,
-        id: publicGuild.leader._id,
-        profile: { name: user.profile.name },
-        auth: {
-          local: {
-            username: user.auth.local.username,
-          },
-        },
-        flags: {
-          verifiedUsername: true,
-        },
-      });
-      expect(foundChallenge2.group).to.eql({
-        _id: publicGuild._id,
-        categories: [],
-        id: publicGuild._id,
-        type: publicGuild.type,
-        privacy: publicGuild.privacy,
-        name: publicGuild.name,
-        summary: publicGuild.name,
-        leader: publicGuild.leader._id,
-      });
-    });
-
-    it('should not return challenges in user groups if we send member true param', async () => {
-      const challenges = await member.get(`/challenges/user?member=${true}`);
-
-      const foundChallenge1 = _.find(challenges, { _id: challenge._id });
-      expect(foundChallenge1).to.not.exist;
-
-      const foundChallenge2 = _.find(challenges, { _id: challenge2._id });
-      expect(foundChallenge2).to.not.exist;
-    });
-
-    it('should return newest challenges first', async () => {
-      let challenges = await user.get('/challenges/user');
-
-      let foundChallengeIndex = _.findIndex(challenges, { _id: challenge2._id });
-      expect(foundChallengeIndex).to.eql(0);
-
-      const newChallenge = await generateChallenge(user, publicGuild);
-      await user.post(`/challenges/${newChallenge._id}/join`);
-
-      challenges = await user.get('/challenges/user');
-
-      foundChallengeIndex = _.findIndex(challenges, { _id: newChallenge._id });
-      expect(foundChallengeIndex).to.eql(0);
-    });
-
-    it('should not return challenges user doesn\'t have access to', async () => {
-      const { group, groupLeader } = await createAndPopulateGroup({
-        groupDetails: {
-          name: 'TestPrivateGuild',
-          summary: 'summary for TestPrivateGuild',
-          type: 'guild',
-          privacy: 'private',
-        },
+        const foundChallenge = _.find(challenges, { _id: challenge._id });
+        expect(foundChallenge).to.exist;
+        expect(foundChallenge.leader).to.eql(userData);
+        expect(foundChallenge.group).to.eql(groupData);
       });
 
-      const privateChallenge = await generateChallenge(groupLeader, group);
-      await groupLeader.post(`/challenges/${privateChallenge._id}/join`);
+      it('should return challenges user has created', async () => {
+        const challenges = await user.get(`/challenges/user?member=${true}`);
 
-      const challenges = await nonMember.get('/challenges/user');
-
-      const foundChallenge = _.find(challenges, { _id: privateChallenge._id });
-      expect(foundChallenge).to.not.exist;
-    });
-
-    it('should not return challenges user doesn\'t have access to, even with query parameters', async () => {
-      const { group, groupLeader } = await createAndPopulateGroup({
-        groupDetails: {
-          name: 'TestPrivateGuild',
-          summary: 'summary for TestPrivateGuild',
-          type: 'guild',
-          privacy: 'private',
-        },
+        const foundChallenge1 = _.find(challenges, { _id: challenge._id });
+        expect(foundChallenge1).to.exist;
+        expect(foundChallenge1.leader).to.eql(userData);
+        expect(foundChallenge1.group).to.eql(groupData);
+        const foundChallenge2 = _.find(challenges, { _id: challenge2._id });
+        expect(foundChallenge2).to.exist;
+        expect(foundChallenge2.leader).to.eql(userData);
+        expect(foundChallenge2.group).to.eql(groupData);
       });
 
-      const privateChallenge = await generateChallenge(groupLeader, group, {
-        categories: [{
-          name: 'academics',
-          slug: 'academics',
-        }],
+      it('should return challenges user has created if filter by owned', async () => {
+        const challenges = await user.get(`/challenges/user?member=${true}&owned=owned`);
+
+        const foundChallenge1 = _.find(challenges, { _id: challenge._id });
+        expect(foundChallenge1).to.exist;
+        expect(foundChallenge1.leader).to.eql(userData);
+        expect(foundChallenge1.group).to.eql(groupData);
+        const foundChallenge2 = _.find(challenges, { _id: challenge2._id });
+        expect(foundChallenge2).to.exist;
+        expect(foundChallenge2.leader).to.eql(userData);
+        expect(foundChallenge2.group).to.eql(groupData);
       });
-      await groupLeader.post(`/challenges/${privateChallenge._id}/join`);
 
-      const challenges = await nonMember.get('/challenges/user?categories=academics&owned=not_owned');
+      it('should not return challenges user has created if filter by not owned', async () => {
+        const challenges = await user.get(`/challenges/user?owned=not_owned&member=${true}`);
 
-      const foundChallenge = _.find(challenges, { _id: privateChallenge._id });
-      expect(foundChallenge).to.not.exist;
+        const foundChallenge1 = _.find(challenges, { _id: challenge._id });
+        expect(foundChallenge1).to.not.exist;
+        const foundChallenge2 = _.find(challenges, { _id: challenge2._id });
+        expect(foundChallenge2).to.not.exist;
+      });
+
+      it('should not return challenges in user groups', async () => {
+        const challenges = await member.get(`/challenges/user?member=${true}`);
+
+        const foundChallenge1 = _.find(challenges, { _id: challenge._id });
+        expect(foundChallenge1).to.not.exist;
+
+        const foundChallenge2 = _.find(challenges, { _id: challenge2._id });
+        expect(foundChallenge2).to.not.exist;
+      });
     });
   });
 

test/api/v3/integration/challenges/POST-challenges_challengeId_winner_winnerId.test.js

@@ -159,7 +159,7 @@ describe('POST /challenges/:challengeId/winner/:winnerId', () => {
 
       expect(testTask.challenge.broken).to.eql('CHALLENGE_CLOSED');
       expect(testTask.challenge.winner).to.eql(winningUser.profile.name);
-      expect(challengeTag.challenge).to.eql('false');
+      expect(challengeTag.challenge).to.eql(false);
     });
   });
 });

test/api/v3/integration/chat/POST-chat.test.js

@@ -14,7 +14,6 @@ import {
   TAVERN_ID,
 } from '../../../../../website/server/models/group';
 import { CHAT_FLAG_FROM_SHADOW_MUTE, MAX_MESSAGE_LENGTH } from '../../../../../website/common/script/constants';
-import guildsAllowingBannedWords from '../../../../../website/server/libs/guildsAllowingBannedWords';
 import * as email from '../../../../../website/server/libs/email';
 
 const BASE_URL = nconf.get('BASE_URL');
@@ -329,7 +328,8 @@ describe('POST /chat', () => {
         members: 1,
       });
 
-      guildsAllowingBannedWords[group._id] = true;
+      // Update the bannedWordsAllowed property for the group
+      group.update({ bannedWordsAllowed: true });
 
       const message = await members[0].post(`/groups/${group._id}/chat`, { message: testBannedWordMessage });
 
@@ -503,8 +503,8 @@ describe('POST /chat', () => {
     const memberUsername = 'memberUsername';
     await member.update({ 'auth.local.username': memberUsername });
 
-    const messageWithMentions = `hi @${memberUsername} 123456789 
-    123456789 123456789 123456789 123456789 123456789 123456789 89 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 12345678 END.`;
+    const messageWithMentions = `hi @${memberUsername} 123456789
+     123456789 123456789 123456789 123456789 123456789 123456789 89 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 12345678 END.`;
     expect(messageWithMentions.length).to.equal(MAX_MESSAGE_LENGTH);
     const newMessage = await user.post(`/groups/${groupWithChat._id}/chat`, { message: messageWithMentions });
     const groupMessages = await user.get(`/groups/${groupWithChat._id}/chat`);

test/api/v3/integration/groups/GET-groups.test.js

@@ -12,7 +12,7 @@ import apiError from '../../../../../website/server/libs/apiError';
 describe('GET /groups', () => {
   let user;
   let userInGuild;
-  const NUMBER_OF_PUBLIC_GUILDS = 3; // 2 + the tavern
+  const NUMBER_OF_PUBLIC_GUILDS = 2;
   const NUMBER_OF_PUBLIC_GUILDS_USER_IS_LEADER = 2;
   const NUMBER_OF_PUBLIC_GUILDS_USER_IS_MEMBER = 1;
   const NUMBER_OF_USERS_PRIVATE_GUILDS = 1;
@@ -236,11 +236,22 @@ describe('GET /groups', () => {
       await expect(user.get('/groups?type=publicGuilds&paginate=true&page=1'))
         .to.eventually.have.a.lengthOf(GUILD_PER_PAGE);
       const page2 = await expect(user.get('/groups?type=publicGuilds&paginate=true&page=2'))
-        .to.eventually.have.a.lengthOf(1 + 4); // 1 created now, 4 by other tests
-      expect(page2[4].name).to.equal('guild with less members');
+        // 1 created now, 4 by other tests, -1 for no more tavern.
+        .to.eventually.have.a.lengthOf(1 + 4 - 1);
+      expect(page2[3].name).to.equal('guild with less members');
     }).timeout(10000);
   });
 
+  it('makes sure that the tavern doesn\'t show up when guilds is passed as a query', async () => {
+    const guilds = await user.get('/groups?type=guilds');
+    expect(guilds.find(g => g.id === TAVERN_ID)).to.be.undefined;
+  });
+
+  it('makes sure that the tavern doesn\'t show up when publicGuilds is passed as a query', async () => {
+    const guilds = await user.get('/groups?type=publicGuilds');
+    expect(guilds.find(g => g.id === TAVERN_ID)).to.be.undefined;
+  });
+
   it('returns all the user\'s guilds when guilds passed in as query', async () => {
     await expect(user.get('/groups?type=guilds'))
       .to.eventually.have.a
@@ -254,7 +265,7 @@ describe('GET /groups', () => {
 
   it('returns a list of groups user has access to', async () => {
     await expect(user.get('/groups?type=privateGuilds,publicGuilds,party,tavern'))
-      .to.eventually.have.lengthOf(NUMBER_OF_GROUPS_USER_CAN_VIEW);
+      .to.eventually.have.lengthOf(NUMBER_OF_GROUPS_USER_CAN_VIEW - 1); // -1 for no Tavern.
   });
 
   it('returns a list of groups user has access to', async () => {

test/api/v3/integration/groups/GET-groups_groupId_invites.test.js

@@ -70,7 +70,7 @@ describe('GET /groups/:groupId/invites', () => {
     expect(res[0].profile).to.have.all.keys(['name']);
   });
 
-  it('returns only first 30 invites', async () => {
+  it('returns only first 30 invites by default (req.query.limit not specified)', async () => {
     const leader = await generateUser({ balance: 4 });
     const group = await generateGroup(leader, { type: 'guild', privacy: 'public', name: generateUUID() });
 
@@ -89,6 +89,65 @@ describe('GET /groups/:groupId/invites', () => {
     });
   }).timeout(10000);
 
+  it('returns an error if req.query.limit is over 60', async () => {
+    const leader = await generateUser({ balance: 4 });
+    const group = await generateGroup(leader, { type: 'guild', privacy: 'public', name: generateUUID() });
+
+    await expect(leader.get(`/groups/${group._id}/invites?limit=61`)).to.eventually.be.rejected.and.eql({
+      code: 400,
+      error: 'BadRequest',
+      message: t('invalidReqParams'),
+    });
+  });
+
+  it('returns an error if req.query.limit is under 1', async () => {
+    const leader = await generateUser({ balance: 4 });
+    const group = await generateGroup(leader, { type: 'guild', privacy: 'public', name: generateUUID() });
+
+    await expect(leader.get(`/groups/${group._id}/invites?limit=-1`)).to.eventually.be.rejected.and.eql({
+      code: 400,
+      error: 'BadRequest',
+      message: t('invalidReqParams'),
+    });
+  });
+
+  it('returns an error if req.query.limit is not an integer', async () => {
+    const leader = await generateUser({ balance: 4 });
+    const group = await generateGroup(leader, { type: 'guild', privacy: 'public', name: generateUUID() });
+
+    await expect(leader.get(`/groups/${group._id}/invites?limit=1.3`)).to.eventually.be.rejected.and.eql({
+      code: 400,
+      error: 'BadRequest',
+      message: t('invalidReqParams'),
+    });
+  });
+
+  it('returns up to 60 invites when req.query.limit is specified', async () => {
+    const leader = await generateUser({ balance: 4 });
+    const group = await generateGroup(leader, { type: 'guild', privacy: 'public', name: generateUUID() });
+
+    const invitesToGenerate = [];
+    for (let i = 0; i < 31; i += 1) {
+      invitesToGenerate.push(generateUser());
+    }
+    const generatedInvites = await Promise.all(invitesToGenerate);
+    await leader.post(`/groups/${group._id}/invite`, { uuids: generatedInvites.map(invite => invite._id) });
+
+    let res = await leader.get(`/groups/${group._id}/invites?limit=14`);
+    expect(res.length).to.equal(14);
+    res.forEach(member => {
+      expect(member).to.have.all.keys(['_id', 'auth', 'flags', 'id', 'profile']);
+      expect(member.profile).to.have.all.keys(['name']);
+    });
+
+    res = await leader.get(`/groups/${group._id}/invites?limit=31`);
+    expect(res.length).to.equal(31);
+    res.forEach(member => {
+      expect(member).to.have.all.keys(['_id', 'auth', 'flags', 'id', 'profile']);
+      expect(member.profile).to.have.all.keys(['name']);
+    });
+  }).timeout(30000);
+
   it('supports using req.query.lastId to get more invites', async function test () {
     this.timeout(30000); // @TODO: times out after 8 seconds
     const leader = await generateUser({ balance: 4 });

test/api/v3/integration/groups/GET-groups_groupId_members.test.js

@@ -116,7 +116,7 @@ describe('GET /groups/:groupId/members', () => {
     expect(memberRes.inbox.messages).to.not.exist;
   });
 
-  it('returns only first 30 members', async () => {
+  it('returns only first 30 members by default (req.query.limit not specified)', async () => {
     const group = await generateGroup(user, { type: 'party', name: generateUUID() });
 
     const usersToGenerate = [];
@@ -133,6 +133,60 @@ describe('GET /groups/:groupId/members', () => {
     });
   });
 
+  it('returns an error if req.query.limit is over 60', async () => {
+    await generateGroup(user, { type: 'party', name: generateUUID() });
+
+    await expect(user.get('/groups/party/members?limit=61')).to.eventually.be.rejected.and.eql({
+      code: 400,
+      error: 'BadRequest',
+      message: t('invalidReqParams'),
+    });
+  });
+
+  it('returns an error if req.query.limit is under 1', async () => {
+    await generateGroup(user, { type: 'party', name: generateUUID() });
+
+    await expect(user.get('/groups/party/members?limit=0')).to.eventually.be.rejected.and.eql({
+      code: 400,
+      error: 'BadRequest',
+      message: t('invalidReqParams'),
+    });
+  });
+
+  it('returns an error if req.query.limit is not an integer', async () => {
+    await generateGroup(user, { type: 'party', name: generateUUID() });
+
+    await expect(user.get('/groups/party/members?limit=1.1')).to.eventually.be.rejected.and.eql({
+      code: 400,
+      error: 'BadRequest',
+      message: t('invalidReqParams'),
+    });
+  });
+
+  it('returns up to 60 members when req.query.limit is specified', async () => {
+    const group = await generateGroup(user, { type: 'party', name: generateUUID() });
+
+    const usersToGenerate = [];
+    for (let i = 0; i < 62; i += 1) {
+      usersToGenerate.push(generateUser({ party: { _id: group._id } }));
+    }
+    await Promise.all(usersToGenerate);
+
+    let res = await user.get('/groups/party/members?limit=60');
+    expect(res.length).to.equal(60);
+    res.forEach(member => {
+      expect(member).to.have.all.keys(['_id', 'auth', 'flags', 'id', 'profile']);
+      expect(member.profile).to.have.all.keys(['name']);
+    });
+
+    res = await user.get(`/groups/party/members?limit=60&lastId=${res[res.length - 1]._id}`);
+    expect(res.length).to.equal(3);
+    res.forEach(member => {
+      expect(member).to.have.all.keys(['_id', 'auth', 'flags', 'id', 'profile']);
+      expect(member.profile).to.have.all.keys(['name']);
+    });
+  }).timeout(30000);
+
   it('returns only first 30 members even when ?includeAllMembers=true', async () => {
     const group = await generateGroup(user, { type: 'party', name: generateUUID() });
 

test/api/v3/integration/groups/POST-group_remove_manager.test.js

@@ -75,12 +75,7 @@ describe('POST /group/:groupId/remove-manager', () => {
     await nonLeader.post(`/tasks/${task._id}/assign/${nonManager._id}`);
     const memberTasks = await nonManager.get('/tasks/user');
     const syncedTask = find(memberTasks, findAssignedTask);
-    await expect(nonManager.post(`/tasks/${syncedTask._id}/score/up`))
-      .to.eventually.be.rejected.and.to.eql({
-        code: 401,
-        error: 'NotAuthorized',
-        message: t('taskApprovalHasBeenRequested'),
-      });
+    await nonManager.post(`/tasks/${syncedTask._id}/score/up`);
 
     const updatedGroup = await leader.post(`/groups/${groupToUpdate._id}/remove-manager`, {
       managerId: nonLeader._id,

test/api/v3/integration/groups/POST-groups_groupId_join.test.js

@@ -203,6 +203,16 @@ describe('POST /group/:groupId/join', () => {
         await expect(invitedUser.get('/user')).to.eventually.have.nested.property('party._id', party._id);
       });
 
+      it('Issue #12291: accepting a redundant party invite will let the user stay in the party', async () => {
+        await invitedUser.update({
+          'party._id': party._id,
+        });
+        await expect(invitedUser.get('/user')).to.eventually.have.nested.property('party._id', party._id);
+        await invitedUser.post(`/groups/${party._id}/join`);
+
+        await expect(invitedUser.get('/user')).to.eventually.have.nested.property('party._id', party._id);
+      });
+
       it('notifies inviting user that their invitation was accepted', async () => {
         await invitedUser.post(`/groups/${party._id}/join`);
 

test/api/v3/integration/groups/POST-groups_groupId_leave.test.js

@@ -274,6 +274,7 @@ describe('POST /groups/:groupId/leave', () => {
 
   each(typesOfGroups, (groupDetails, groupType) => {
     context(`Leaving a group plan when the group is a ${groupType}`, () => {
+      if (groupDetails.privacy === 'public') return; // public guilds cannot be group plans
       let groupWithPlan;
       let leader;
       let member;
@@ -341,6 +342,7 @@ describe('POST /groups/:groupId/leave', () => {
 
   each(typesOfGroups, (groupDetails, groupType) => {
     context(`Leaving a group with extraMonths left plan when the group is a ${groupType}`, () => {
+      if (groupDetails.privacy === 'public') return; // public guilds cannot be group plans
       const extraMonths = 12;
       let groupWithPlan;
       let member;

test/api/v3/integration/groups/POST-groups_id_removeMember.test.js

@@ -251,6 +251,29 @@ describe('POST /groups/:groupId/removeMember/:memberId', () => {
       expect(party.quest.members[partyMember._id]).to.not.exist;
     });
 
+    it('prevents user from being removed if they are the quest owner', async () => {
+      const petQuest = 'whale';
+      await partyMember.update({
+        [`items.quests.${petQuest}`]: 1,
+      });
+
+      await partyMember.post(`/groups/${party._id}/quests/invite/${petQuest}`);
+      await partyLeader.post(`/groups/${party._id}/quests/accept`);
+
+      await party.sync();
+
+      expect(party.quest.members[partyLeader._id]).to.be.true;
+      expect(party.quest.members[partyMember._id]).to.be.true;
+
+      await party.sync();
+
+      expect(leader.post(`/groups/${party._id}/removeMember/${partyMember._id}`))
+        .to.eventually.be.rejected.and.eql({
+          code: 401,
+          text: t('cannotRemoveQuestOwner'),
+        });
+    });
+
     it('sends email to user with rescinded invite', async () => {
       await partyLeader.post(`/groups/${party._id}/removeMember/${partyInvitedUser._id}`);
 

test/api/v3/integration/groups/PUT-groups.test.js

@@ -79,4 +79,56 @@ describe('PUT /group', () => {
     expect(updatedGroup.leader.profile.name).to.eql(nonLeader.profile.name);
     expect(updatedGroup.name).to.equal(groupUpdatedName);
   });
+
+  it('allows for an admin to update the bannedWordsAllow property for an existing guild', async () => {
+    const { group, groupLeader } = await createAndPopulateGroup({
+      groupDetails: {
+        name: 'public guild',
+        type: 'guild',
+        privacy: 'public',
+      },
+    });
+
+    const updateGroupDetails = {
+      id: group._id,
+      name: 'public guild',
+      type: 'guild',
+      privacy: 'public',
+      bannedWordsAllowed: true,
+    };
+
+    // Make guild leader into admin
+    await groupLeader.post('/debug/make-admin');
+    await groupLeader.sync();
+
+    // Update the bannedWordsAllowed property for the group
+    const response = await groupLeader.put(`/groups/${group._id}`, updateGroupDetails);
+
+    expect(groupLeader.contributor.admin).to.eql(true);
+    expect(response.bannedWordsAllowed).to.eql(true);
+  });
+
+  it('does not allow for a non-admin to update the bannedWordsAllow property for an existing guild', async () => {
+    const { group, groupLeader } = await createAndPopulateGroup({
+      groupDetails: {
+        name: 'public guild',
+        type: 'guild',
+        privacy: 'public',
+      },
+    });
+
+    const updateGroupDetails = {
+      id: group._id,
+      name: 'public guild',
+      type: 'guild',
+      privacy: 'public',
+      bannedWordsAllowed: true,
+    };
+
+    // Update the bannedWordsAllowed property for the group
+    const response = await groupLeader.put(`/groups/${group._id}`, updateGroupDetails);
+
+    expect(groupLeader.contributor.admin).to.eql(undefined);
+    expect(response.bannedWordsAllowed).to.eql(undefined);
+  });
 });

test/api/v3/integration/news/GET-news.test.js

@@ -4,7 +4,6 @@ import {
 
 describe('GET /news', () => {
   let api;
-
   beforeEach(async () => {
     api = requester();
   });

test/api/v3/integration/news/POST-news_tell_me_later.test.js

@@ -1,24 +1,27 @@
 import {
   generateUser,
 } from '../../../../helpers/api-integration/v3';
+import { model as NewsPost } from '../../../../../website/server/models/newsPost';
 
 describe('POST /news/tell-me-later', () => {
   let user;
 
   beforeEach(async () => {
-    user = await generateUser({
-      'flags.newStuff': true,
+    NewsPost.updateLastNewsPost({
+      _id: '1234', publishDate: new Date(), title: 'Title', published: true,
     });
+    user = await generateUser();
   });
 
   it('marks new stuff as read and adds notification', async () => {
-    expect(user.flags.newStuff).to.equal(true);
     const initialNotifications = user.notifications.length;
 
     await user.post('/news/tell-me-later');
     await user.sync();
 
-    expect(user.flags.newStuff).to.equal(false);
+    expect(user.flags.lastNewStuffRead).to.equal('1234');
+    // fetching the user because newStuff is a computed property
+    expect((await user.get('/user')).flags.newStuff).to.equal(false);
     expect(user.notifications.length).to.equal(initialNotifications + 1);
 
     const notification = user.notifications[user.notifications.length - 1];

test/api/v3/integration/payments/stripe/POST-payments_stripe_checkout.test.js

@@ -14,7 +14,10 @@ describe('payments - stripe - #checkout', () => {
   });
 
   it('verifies credentials', async () => {
-    await expect(user.post(endpoint, { id: 123 })).to.eventually.be.rejected.and.include({
+    await expect(user.post(
+      `${endpoint}?gemsBlock=4gems`,
+      { id: 123 },
+    )).to.eventually.be.rejected.and.include({
       code: 401,
       error: 'Error',
       // message: 'Invalid API Key provided: aaaabbbb********************1111',
@@ -32,7 +35,7 @@ describe('payments - stripe - #checkout', () => {
       stripePayments.checkout.restore();
     });
 
-    it('cancels a user subscription', async () => {
+    it('creates a user subscription', async () => {
       user = await generateUser({
         'profile.name': 'sender',
         'purchased.plan.customerId': 'customer-id',
@@ -48,7 +51,7 @@ describe('payments - stripe - #checkout', () => {
       expect(stripeCheckoutSubscriptionStub.args[0][0].groupId).to.eql(undefined);
     });
 
-    it('cancels a group subscription', async () => {
+    it('creates a group subscription', async () => {
       user = await generateUser({
         'profile.name': 'sender',
         'purchased.plan.customerId': 'customer-id',

test/api/v3/integration/quests/POST-groups_groupId_quests_invite.test.js

@@ -83,22 +83,6 @@ describe('POST /groups/:groupId/quests/invite/:questKey', () => {
       });
     });
 
-    it('does not issue invites if the user is of insufficient Level', async () => {
-      const LEVELED_QUEST = 'atom1';
-      const LEVELED_QUEST_REQ = questScrolls[LEVELED_QUEST].lvl;
-      const leaderUpdate = {};
-      leaderUpdate[`items.quests.${LEVELED_QUEST}`] = 1;
-      leaderUpdate['stats.lvl'] = LEVELED_QUEST_REQ - 1;
-
-      await leader.update(leaderUpdate);
-
-      await expect(leader.post(`/groups/${questingGroup._id}/quests/invite/${LEVELED_QUEST}`)).to.eventually.be.rejected.and.eql({
-        code: 401,
-        error: 'NotAuthorized',
-        message: t('questLevelTooHigh', { level: LEVELED_QUEST_REQ }),
-      });
-    });
-
     it('does not issue invites if a quest is already underway', async () => {
       const QUEST_IN_PROGRESS = 'atom1';
       const leaderUpdate = {};
@@ -212,6 +196,18 @@ describe('POST /groups/:groupId/quests/invite/:questKey', () => {
       expect(returnedGroup.chat[0]._meta).to.be.undefined;
     });
 
+    it('successfully issues a quest invitation when quest level is higher than user level', async () => {
+      const LEVELED_QUEST = 'atom1';
+      const LEVELED_QUEST_REQ = questScrolls[LEVELED_QUEST].lvl;
+      const leaderUpdate = {};
+      leaderUpdate[`items.quests.${LEVELED_QUEST}`] = 1;
+      leaderUpdate['stats.lvl'] = LEVELED_QUEST_REQ - 1;
+
+      await leader.update(leaderUpdate);
+
+      await leader.post(`/groups/${questingGroup._id}/quests/invite/${LEVELED_QUEST}`);
+    });
+
     context('sending quest activity webhooks', () => {
       before(async () => {
         await server.start();

test/api/v3/integration/tasks/GET-tasks_user.test.js

@@ -153,12 +153,12 @@ describe('GET /tasks/user', () => {
   });
 
   xit('returns dailies with isDue for the date specified and will add CDS offset if time is not supplied and assumes timezones', async () => {
-    const timezone = 420;
+    const timezoneOffset = 420;
     await user.update({
       'preferences.dayStart': 0,
-      'preferences.timezoneOffset': timezone,
+      'preferences.timezoneOffset': timezoneOffset,
     });
-    const startDate = moment().zone(timezone).subtract('4', 'days').startOf('day')
+    const startDate = moment().utcOffset(-timezoneOffset).subtract('4', 'days').startOf('day')
       .toISOString();
     await user.post('/tasks/user', [
       {
@@ -180,12 +180,12 @@ describe('GET /tasks/user', () => {
   });
 
   xit('returns dailies with isDue for the date specified and will add CDS offset if time is not supplied and assumes timezones', async () => {
-    const timezone = 240;
+    const timezoneOffset = 240;
     await user.update({
       'preferences.dayStart': 0,
-      'preferences.timezoneOffset': timezone,
+      'preferences.timezoneOffset': timezoneOffset,
     });
-    const startDate = moment().zone(timezone).subtract('4', 'days').startOf('day')
+    const startDate = moment().utcOffset(-timezoneOffset).subtract('4', 'days').startOf('day')
       .toISOString();
     await user.post('/tasks/user', [
       {
@@ -207,12 +207,12 @@ describe('GET /tasks/user', () => {
   });
 
   xit('returns dailies with isDue for the date specified and will add CDS offset if time is not supplied and assumes timezones', async () => {
-    const timezone = 540;
+    const timezoneOffset = 540;
     await user.update({
       'preferences.dayStart': 0,
-      'preferences.timezoneOffset': timezone,
+      'preferences.timezoneOffset': timezoneOffset,
     });
-    const startDate = moment().zone(timezone).subtract('4', 'days').startOf('day')
+    const startDate = moment().utcOffset(-timezoneOffset).subtract('4', 'days').startOf('day')
       .toISOString();
     await user.post('/tasks/user', [
       {

test/api/v3/integration/tasks/POST-tasks_id_score_direction.test.js

@@ -1,4 +1,5 @@
 import { v4 as generateUUID } from 'uuid';
+import apiError from '../../../../../website/server/libs/apiError';
 import {
   generateUser,
   sleep,
@@ -44,7 +45,7 @@ describe('POST /tasks/:id/score/:direction', () => {
       await expect(user.post(`/tasks/${generateUUID()}/score/tt`)).to.eventually.be.rejected.and.eql({
         code: 400,
         error: 'BadRequest',
-        message: t('invalidReqParams'),
+        message: apiError('directionUpDown'),
       });
     });
 
@@ -261,6 +262,7 @@ describe('POST /tasks/:id/score/:direction', () => {
       const task = await user.get(`/tasks/${daily._id}`);
 
       expect(task.completed).to.equal(true);
+      expect(task.value).to.be.greaterThan(daily.value);
     });
 
     it('uncompletes daily when direction is down', async () => {

test/api/v3/integration/tasks/POST-tasks_move_taskId_to_position.test.js

@@ -91,7 +91,9 @@ describe('POST /tasks/:taskId/move/to/:position', () => {
 
     const taskToMove = tasks[1];
     expect(taskToMove.text).to.equal('habit 2');
-    const newOrder = await user.post(`/tasks/${tasks[1]._id}/move/to/-1`);
+    await user.post(`/tasks/${tasks[1]._id}/move/to/-1`);
+    await user.sync();
+    const newOrder = user.tasksOrder.habits;
     expect(newOrder[4]).to.equal(taskToMove._id);
     expect(newOrder.length).to.equal(5);
   });

test/api/v3/integration/tasks/PUT-tasks_id.test.js

@@ -499,6 +499,45 @@ describe('PUT /tasks/:id', () => {
     });
   });
 
+  context('monthly dailys', () => {
+    let monthly;
+
+    beforeEach(async () => {
+      const date1 = moment.utc('2020-07-01').toDate();
+      monthly = await user.post('/tasks/user', {
+        text: 'test monthly',
+        type: 'daily',
+        frequency: 'monthly',
+        startDate: date1,
+        daysOfMonth: [date1.getDate()],
+      });
+    });
+
+    it('updates days of month when start date updated', async () => {
+      const date2 = moment.utc('2020-07-01').toDate();
+      const savedMonthly = await user.put(`/tasks/${monthly._id}`, {
+        startDate: date2,
+      });
+
+      expect(savedMonthly.daysOfMonth).to.deep.equal([moment(date2).date()]);
+    });
+
+    it('updates next due when start date updated', async () => {
+      const date2 = moment.utc('2022-07-01').toDate();
+      const savedMonthly = await user.put(`/tasks/${monthly._id}`, {
+        startDate: date2,
+      });
+
+      expect(savedMonthly.nextDue.length).to.eql(6);
+      expect(moment(savedMonthly.nextDue[0]).toDate()).to.eql(moment.utc('2022-08-01').toDate());
+      expect(moment(savedMonthly.nextDue[1]).toDate()).to.eql(moment.utc('2022-09-01').toDate());
+      expect(moment(savedMonthly.nextDue[2]).toDate()).to.eql(moment.utc('2022-10-01').toDate());
+      expect(moment(savedMonthly.nextDue[3]).toDate()).to.eql(moment.utc('2022-11-01').toDate());
+      expect(moment(savedMonthly.nextDue[4]).toDate()).to.eql(moment.utc('2022-12-01').toDate());
+      expect(moment(savedMonthly.nextDue[5]).toDate()).to.eql(moment.utc('2023-01-01').toDate());
+    });
+  });
+
   context('rewards', () => {
     let reward;
 

test/api/v3/integration/tasks/groups/DELETE-group_tasks_id.test.js

@@ -73,12 +73,7 @@ describe('Groups DELETE /tasks/:id', () => {
     });
     const memberTasks = await member.get('/tasks/user');
     const syncedTask = find(memberTasks, findAssignedTask);
-    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
-      .to.eventually.be.rejected.and.to.eql({
-        code: 401,
-        error: 'NotAuthorized',
-        message: t('taskApprovalHasBeenRequested'),
-      });
+    await member.post(`/tasks/${syncedTask._id}/score/up`);
 
     await user.sync();
     await member2.sync();
@@ -96,16 +91,16 @@ describe('Groups DELETE /tasks/:id', () => {
     expect(member2.notifications.length).to.equal(1);
   });
 
-  it('unlinks assigned user', async () => {
+  it('deletes task from assigned user', async () => {
     await user.del(`/tasks/${task._id}`);
 
     const memberTasks = await member.get('/tasks/user');
     const syncedTask = find(memberTasks, findAssignedTask);
 
-    expect(syncedTask.group.broken).to.equal('TASK_DELETED');
+    expect(syncedTask).to.not.exist;
   });
 
-  it('unlinks all assigned users', async () => {
+  it('deletes task from all assigned users', async () => {
     await user.del(`/tasks/${task._id}`);
 
     const memberTasks = await member.get('/tasks/user');
@@ -114,8 +109,8 @@ describe('Groups DELETE /tasks/:id', () => {
     const member2Tasks = await member2.get('/tasks/user');
     const member2SyncedTask = find(member2Tasks, findAssignedTask);
 
-    expect(syncedTask.group.broken).to.equal('TASK_DELETED');
-    expect(member2SyncedTask.group.broken).to.equal('TASK_DELETED');
+    expect(syncedTask).to.not.exist;
+    expect(member2SyncedTask).to.not.exist;
   });
 
   it('prevents a user from deleting a task they are assigned to', async () => {
@@ -130,22 +125,6 @@ describe('Groups DELETE /tasks/:id', () => {
       });
   });
 
-  it('allows a user to delete a broken task', async () => {
-    const memberTasks = await member.get('/tasks/user');
-    const syncedTask = find(memberTasks, findAssignedTask);
-
-    await user.del(`/tasks/${task._id}`);
-
-    await member.del(`/tasks/${syncedTask._id}`);
-
-    await expect(member.get(`/tasks/${syncedTask._id}`))
-      .to.eventually.be.rejected.and.eql({
-        code: 404,
-        error: 'NotFound',
-        message: 'Task not found.',
-      });
-  });
-
   it('allows a user to delete a task after leaving a group', async () => {
     const memberTasks = await member.get('/tasks/user');
     const syncedTask = find(memberTasks, findAssignedTask);

test/api/v3/integration/tasks/groups/POST-group_tasks_id_approve_userId.test.js

@@ -58,22 +58,14 @@ describe('POST /tasks/:id/approve/:userId', () => {
     let memberTasks = await member.get('/tasks/user');
     let syncedTask = find(memberTasks, findAssignedTask);
 
-    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
-      .to.eventually.be.rejected.and.to.eql({
-        code: 401,
-        error: 'NotAuthorized',
-        message: t('taskApprovalHasBeenRequested'),
-      });
-
+    await member.post(`/tasks/${syncedTask._id}/score/up`);
     await user.post(`/tasks/${task._id}/approve/${member._id}`);
 
     await member.sync();
 
-    expect(member.notifications.length).to.equal(3);
+    expect(member.notifications.length).to.equal(2);
     expect(member.notifications[1].type).to.equal('GROUP_TASK_APPROVED');
     expect(member.notifications[1].data.message).to.equal(t('yourTaskHasBeenApproved', { taskText: task.text }));
-    expect(member.notifications[2].type).to.equal('SCORED_TASK');
-    expect(member.notifications[2].data.message).to.equal(t('yourTaskHasBeenApproved', { taskText: task.text }));
 
     memberTasks = await member.get('/tasks/user');
     syncedTask = find(memberTasks, findAssignedTask);
@@ -93,21 +85,13 @@ describe('POST /tasks/:id/approve/:userId', () => {
     let memberTasks = await member.get('/tasks/user');
     let syncedTask = find(memberTasks, findAssignedTask);
 
-    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
-      .to.eventually.be.rejected.and.to.eql({
-        code: 401,
-        error: 'NotAuthorized',
-        message: t('taskApprovalHasBeenRequested'),
-      });
-
+    await member.post(`/tasks/${syncedTask._id}/score/up`);
     await member2.post(`/tasks/${task._id}/approve/${member._id}`);
     await member.sync();
 
-    expect(member.notifications.length).to.equal(3);
+    expect(member.notifications.length).to.equal(2);
     expect(member.notifications[1].type).to.equal('GROUP_TASK_APPROVED');
     expect(member.notifications[1].data.message).to.equal(t('yourTaskHasBeenApproved', { taskText: task.text }));
-    expect(member.notifications[2].type).to.equal('SCORED_TASK');
-    expect(member.notifications[2].data.message).to.equal(t('yourTaskHasBeenApproved', { taskText: task.text }));
 
     memberTasks = await member.get('/tasks/user');
     syncedTask = find(memberTasks, findAssignedTask);
@@ -125,12 +109,7 @@ describe('POST /tasks/:id/approve/:userId', () => {
     await member2.post(`/tasks/${task._id}/assign/${member._id}`);
     const memberTasks = await member.get('/tasks/user');
     const syncedTask = find(memberTasks, findAssignedTask);
-    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
-      .to.eventually.be.rejected.and.to.eql({
-        code: 401,
-        error: 'NotAuthorized',
-        message: t('taskApprovalHasBeenRequested'),
-      });
+    await member.post(`/tasks/${syncedTask._id}/score/up`);
 
     await user.sync();
     await member2.sync();
@@ -157,14 +136,9 @@ describe('POST /tasks/:id/approve/:userId', () => {
 
     const memberTasks = await member.get('/tasks/user');
     const syncedTask = find(memberTasks, findAssignedTask);
-    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
-      .to.eventually.be.rejected.and.to.eql({
-        code: 401,
-        error: 'NotAuthorized',
-        message: t('taskApprovalHasBeenRequested'),
-      });
-
+    await member.post(`/tasks/${syncedTask._id}/score/up`);
     await member2.post(`/tasks/${task._id}/approve/${member._id}`);
+
     await expect(user.post(`/tasks/${task._id}/approve/${member._id}`))
       .to.eventually.be.rejected.and.to.eql({
         code: 401,
@@ -197,13 +171,7 @@ describe('POST /tasks/:id/approve/:userId', () => {
 
     const memberTasks = await member.get('/tasks/user');
     const syncedTask = find(memberTasks, findAssignedTask);
-    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
-      .to.eventually.be.rejected.and.to.eql({
-        code: 401,
-        error: 'NotAuthorized',
-        message: t('taskApprovalHasBeenRequested'),
-      });
-
+    await member.post(`/tasks/${syncedTask._id}/score/up`);
     await user.post(`/tasks/${sharedCompletionTask._id}/approve/${member._id}`);
 
     const groupTasks = await user.get(`/tasks/group/${guild._id}?type=completedTodos`);
@@ -226,13 +194,7 @@ describe('POST /tasks/:id/approve/:userId', () => {
 
     const memberTasks = await member.get('/tasks/user');
     const syncedTask = find(memberTasks, findAssignedTask);
-    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
-      .to.eventually.be.rejected.and.to.eql({
-        code: 401,
-        error: 'NotAuthorized',
-        message: t('taskApprovalHasBeenRequested'),
-      });
-
+    await member.post(`/tasks/${syncedTask._id}/score/up`);
     await user.post(`/tasks/${sharedCompletionTask._id}/approve/${member._id}`);
 
     const member2Tasks = await member2.get('/tasks/user');
@@ -258,13 +220,7 @@ describe('POST /tasks/:id/approve/:userId', () => {
 
     const memberTasks = await member.get('/tasks/user');
     const syncedTask = find(memberTasks, findAssignedTask);
-    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
-      .to.eventually.be.rejected.and.to.eql({
-        code: 401,
-        error: 'NotAuthorized',
-        message: t('taskApprovalHasBeenRequested'),
-      });
-
+    await member.post(`/tasks/${syncedTask._id}/score/up`);
     await user.post(`/tasks/${sharedCompletionTask._id}/approve/${member._id}`);
 
     const groupTasks = await user.get(`/tasks/group/${guild._id}`);
@@ -287,21 +243,10 @@ describe('POST /tasks/:id/approve/:userId', () => {
 
     const memberTasks = await member.get('/tasks/user');
     const syncedTask = find(memberTasks, findAssignedTask);
-    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
-      .to.eventually.be.rejected.and.to.eql({
-        code: 401,
-        error: 'NotAuthorized',
-        message: t('taskApprovalHasBeenRequested'),
-      });
-
+    await member.post(`/tasks/${syncedTask._id}/score/up`);
     const member2Tasks = await member2.get('/tasks/user');
     const member2SyncedTask = find(member2Tasks, findAssignedTask);
-    await expect(member2.post(`/tasks/${member2SyncedTask._id}/score/up`))
-      .to.eventually.be.rejected.and.to.eql({
-        code: 401,
-        error: 'NotAuthorized',
-        message: t('taskApprovalHasBeenRequested'),
-      });
+    await member2.post(`/tasks/${member2SyncedTask._id}/score/up`);
 
     await user.post(`/tasks/${sharedCompletionTask._id}/approve/${member._id}`);
     await user.post(`/tasks/${sharedCompletionTask._id}/approve/${member2._id}`);

test/api/v3/integration/tasks/groups/POST-group_tasks_id_needs-work_userId.test.js

@@ -61,13 +61,7 @@ describe('POST /tasks/:id/needs-work/:userId', () => {
     let syncedTask = find(memberTasks, findAssignedTask);
 
     // score task to require approval
-    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
-      .to.eventually.be.rejected.and.to.eql({
-        code: 401,
-        error: 'NotAuthorized',
-        message: t('taskApprovalHasBeenRequested'),
-      });
-
+    await member.post(`/tasks/${syncedTask._id}/score/up`);
     await user.post(`/tasks/${task._id}/needs-work/${member._id}`);
 
     [memberTasks] = await Promise.all([member.get('/tasks/user'), member.sync()]);
@@ -114,12 +108,7 @@ describe('POST /tasks/:id/needs-work/:userId', () => {
     let syncedTask = find(memberTasks, findAssignedTask);
 
     // score task to require approval
-    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
-      .to.eventually.be.rejected.and.to.eql({
-        code: 401,
-        error: 'NotAuthorized',
-        message: t('taskApprovalHasBeenRequested'),
-      });
+    await member.post(`/tasks/${syncedTask._id}/score/up`);
 
     const initialNotifications = member.notifications.length;
 
@@ -172,13 +161,7 @@ describe('POST /tasks/:id/needs-work/:userId', () => {
     const memberTasks = await member.get('/tasks/user');
     const syncedTask = find(memberTasks, findAssignedTask);
 
-    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
-      .to.eventually.be.rejected.and.to.eql({
-        code: 401,
-        error: 'NotAuthorized',
-        message: t('taskApprovalHasBeenRequested'),
-      });
-
+    await member.post(`/tasks/${syncedTask._id}/score/up`);
     await member2.post(`/tasks/${task._id}/approve/${member._id}`);
     await expect(user.post(`/tasks/${task._id}/needs-work/${member._id}`))
       .to.eventually.be.rejected.and.to.eql({

test/api/v3/integration/tasks/groups/POST-group_tasks_id_score_direction.test.js

@@ -44,12 +44,11 @@ describe('POST /tasks/:id/score/:direction', () => {
     const syncedTask = find(memberTasks, findAssignedTask);
     const direction = 'up';
 
-    await expect(member.post(`/tasks/${syncedTask._id}/score/${direction}`))
-      .to.eventually.be.rejected.and.to.eql({
-        code: 401,
-        error: 'NotAuthorized',
-        message: t('taskApprovalHasBeenRequested'),
-      });
+    const response = await member.post(`/tasks/${syncedTask._id}/score/${direction}`);
+
+    expect(response.data.requiresApproval).to.equal(true);
+    expect(response.message).to.equal(t('taskApprovalHasBeenRequested'));
+
     const updatedTask = await member.get(`/tasks/${syncedTask._id}`);
 
     await user.sync();
@@ -76,12 +75,7 @@ describe('POST /tasks/:id/score/:direction', () => {
     const syncedTask = find(memberTasks, findAssignedTask);
     const direction = 'up';
 
-    await expect(member.post(`/tasks/${syncedTask._id}/score/${direction}`))
-      .to.eventually.be.rejected.and.to.eql({
-        code: 401,
-        error: 'NotAuthorized',
-        message: t('taskApprovalHasBeenRequested'),
-      });
+    await member.post(`/tasks/${syncedTask._id}/score/${direction}`);
     const updatedTask = await member.get(`/tasks/${syncedTask._id}`);
     await user.sync();
     await member2.sync();
@@ -111,31 +105,18 @@ describe('POST /tasks/:id/score/:direction', () => {
     const memberTasks = await member.get('/tasks/user');
     const syncedTask = find(memberTasks, findAssignedTask);
 
-    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
-      .to.eventually.be.rejected.and.to.eql({
-        code: 401,
-        error: 'NotAuthorized',
-        message: t('taskApprovalHasBeenRequested'),
-      });
+    await member.post(`/tasks/${syncedTask._id}/score/up`);
 
-    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
-      .to.eventually.be.rejected.and.eql({
-        code: 401,
-        error: 'NotAuthorized',
-        message: t('taskRequiresApproval'),
-      });
+    const response = await member.post(`/tasks/${syncedTask._id}/score/up`);
+    expect(response.data.requiresApproval).to.equal(true);
+    expect(response.message).to.equal(t('taskRequiresApproval'));
   });
 
   it('allows a user to score an approved task', async () => {
     const memberTasks = await member.get('/tasks/user');
     const syncedTask = find(memberTasks, findAssignedTask);
 
-    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
-      .to.eventually.be.rejected.and.to.eql({
-        code: 401,
-        error: 'NotAuthorized',
-        message: t('taskApprovalHasBeenRequested'),
-      });
+    await member.post(`/tasks/${syncedTask._id}/score/up`);
 
     await user.post(`/tasks/${task._id}/approve/${member._id}`);
 

test/api/v3/integration/tasks/groups/PUT-group_task_id.test.js

@@ -71,12 +71,10 @@ describe('PUT /tasks/:id', () => {
     const syncedTask = find(memberTasks, memberTask => memberTask.group.taskId === habit._id);
 
     // score up to trigger approval
-    await expect(member2.post(`/tasks/${syncedTask._id}/score/up`))
-      .to.eventually.be.rejected.and.to.eql({
-        code: 401,
-        error: 'NotAuthorized',
-        message: t('taskApprovalHasBeenRequested'),
-      });
+    const response = await member2.post(`/tasks/${syncedTask._id}/score/up`);
+
+    expect(response.data.requiresApproval).to.equal(true);
+    expect(response.message).to.equal(t('taskApprovalHasBeenRequested'));
   });
 
   it('member updates a group task value - not allowed', async () => {

test/api/v3/integration/user/POST-user_class_cast_spellId.test.js

@@ -161,6 +161,23 @@ describe('POST /user/class/cast/:spellId', () => {
       });
   });
 
+  it('Issue #12361: returns an error if stealth has already been cast', async () => {
+    await user.update({
+      'stats.class': 'rogue',
+      'stats.lvl': 15,
+      'stats.mp': 400,
+      'stats.buffs.stealth': 1,
+    });
+    await user.sync();
+    await expect(user.post('/user/class/cast/stealth'))
+      .to.eventually.be.rejected.and.eql({
+        code: 400,
+        error: 'BadRequest',
+        message: t('spellAlreadyCast'),
+      });
+    expect(user.stats.mp).to.equal(400);
+  });
+
   it('returns an error if targeted party member doesn\'t exist', async () => {
     const { groupLeader } = await createAndPopulateGroup({
       groupDetails: { type: 'party', privacy: 'private' },

test/api/v3/integration/user/POST-user_feed_pet_food.test.js

@@ -41,6 +41,29 @@ describe('POST /user/feed/:pet/:food', () => {
     expect(user.items.pets['Wolf-Base']).to.equal(7);
   });
 
+  it('bulk feeding pet with non-preferred food', async () => {
+    await user.update({
+      'items.pets.Wolf-Base': 5,
+      'items.food.Milk': 3,
+    });
+
+    const food = content.food.Milk;
+    const pet = content.petInfo['Wolf-Base'];
+
+    const res = await user.post('/user/feed/Wolf-Base/Milk?amount=2');
+    await user.sync();
+    expect(res).to.eql({
+      data: user.items.pets['Wolf-Base'],
+      message: t('messageDontEnjoyFood', {
+        egg: pet.text(),
+        foodText: food.textThe(),
+      }),
+    });
+
+    expect(user.items.food.Milk).to.eql(1);
+    expect(user.items.pets['Wolf-Base']).to.equal(9);
+  });
+
   context('sending user activity webhooks', () => {
     before(async () => {
       await server.start();
@@ -77,5 +100,33 @@ describe('POST /user/feed/:pet/:food', () => {
       expect(body.pet).to.eql('Wolf-Base');
       expect(body.message).to.eql(res.message);
     });
+
+    it('sends user activity webhook (mount raised after full bulk feeding)', async () => {
+      const uuid = generateUUID();
+
+      await user.post('/user/webhook', {
+        url: `http://localhost:${server.port}/webhooks/${uuid}`,
+        type: 'userActivity',
+        enabled: true,
+        options: {
+          mountRaised: true,
+        },
+      });
+
+      await user.update({
+        'items.pets.Wolf-Base': 47,
+        'items.food.Milk': 3,
+      });
+      const res = await user.post('/user/feed/Wolf-Base/Milk?amount=2');
+
+      await sleep();
+
+      const body = server.getWebhookData(uuid);
+
+      expect(user.achievements.allYourBase).to.not.equal(true);
+      expect(body.type).to.eql('mountRaised');
+      expect(body.pet).to.eql('Wolf-Base');
+      expect(body.message).to.eql(res.message);
+    });
   });
 });

test/api/v3/integration/user/PUT-user.test.js

@@ -3,6 +3,7 @@ import {
   generateUser,
   translate as t,
 } from '../../../../helpers/api-integration/v3';
+import { model as NewsPost } from '../../../../../website/server/models/newsPost';
 
 describe('PUT /user', () => {
   let user;
@@ -92,6 +93,32 @@ describe('PUT /user', () => {
         error: 'BadRequest',
         message: t('displaynameIssueSlur'),
       });
+
+      await expect(user.put('/user', {
+        'profile.name': 'namecontainsnewline\n',
+      })).to.eventually.be.rejected.and.eql({
+        code: 400,
+        error: 'BadRequest',
+        message: t('displaynameIssueNewline'),
+      });
+    });
+
+    it('can set flags.newStuff to false', async () => {
+      NewsPost.updateLastNewsPost({
+        _id: '1234', publishDate: new Date(), title: 'Title', published: true,
+      });
+
+      await user.update({
+        'flags.lastNewStuffRead': '123',
+      });
+
+      await user.put('/user', {
+        'flags.newStuff': false,
+      });
+
+      await user.sync();
+
+      expect(user.flags.lastNewStuffRead).to.eql('1234');
     });
   });
 

test/api/v3/integration/webhook/PUT-user_update_webhook.test.js

@@ -127,19 +127,26 @@ describe('PUT /user/webhook/:id', () => {
   it('can update taskActivity options', async () => {
     const type = 'taskActivity';
     const options = {
+      checklistScored: true,
       updated: false,
-      deleted: true,
+      scored: false,
     };
-
-    const webhook = await user.put(`/user/webhook/${webhookToUpdate.id}`, { type, options });
-
-    expect(webhook.options).to.eql({
-      checklistScored: false, // starting value
+    const expected = {
+      checklistScored: true,
       created: true, // starting value
       updated: false,
-      deleted: true,
-      scored: true, // default value
-    });
+      deleted: false, // starting value
+      scored: false,
+    };
+
+    const returnedWebhook = await user.put(`/user/webhook/${webhookToUpdate.id}`, { type, options });
+
+    await user.sync();
+
+    const savedWebhook = user.webhooks.find(hook => webhookToUpdate.id === hook.id);
+
+    expect(returnedWebhook.options).to.eql(expected);
+    expect(savedWebhook.options).to.eql(expected);
   });
 
   it('errors if taskActivity option is not a boolean', async () => {

test/api/v3/integration/world-state/GET-world-state.test.js

@@ -4,6 +4,8 @@ import {
   requester,
   resetHabiticaDB,
 } from '../../../../helpers/api-integration/v3';
+import * as worldState from '../../../../../website/server/libs/worldState';
+import common from '../../../../../website/common';
 
 describe('GET /world-state', () => {
   before(async () => {
@@ -39,4 +41,41 @@ describe('GET /world-state', () => {
     expect(res).to.have.nested.property('npcImageSuffix');
     expect(res.npcImageSuffix).to.be.a('string');
   });
+
+  context('no current event', () => {
+    beforeEach(async () => {
+      sinon.stub(worldState, 'getCurrentEvent').returns(null);
+    });
+
+    afterEach(() => {
+      worldState.getCurrentEvent.restore();
+    });
+
+    it('returns null for the current event when there is none active', async () => {
+      const res = await requester().get('/world-state');
+
+      expect(res.currentEvent).to.be.null;
+    });
+  });
+
+  context('no current event', () => {
+    const evt = {
+      ...common.content.events.fall2020,
+      event: 'fall2020',
+    };
+
+    beforeEach(async () => {
+      sinon.stub(worldState, 'getCurrentEvent').returns(evt);
+    });
+
+    afterEach(() => {
+      worldState.getCurrentEvent.restore();
+    });
+
+    it('returns the current event when there is an active one', async () => {
+      const res = await requester().get('/world-state');
+
+      expect(res.currentEvent).to.eql(evt);
+    });
+  });
 });

test/api/v4/news/DELETE-news.test.js

@@ -0,0 +1,49 @@
+import { v4 } from 'uuid';
+import {
+  generateUser,
+  translate as t,
+} from '../../../helpers/api-integration/v4';
+
+describe('DELETE /news/:newsID', () => {
+  let user;
+  const newsPost = {
+    title: 'New Post',
+    publishDate: new Date(),
+    published: true,
+    credits: 'credits',
+    text: 'news body',
+  };
+  beforeEach(async () => {
+    user = await generateUser({
+      'contributor.newsPoster': true,
+    });
+  });
+
+  it('disallows access to non-newsPosters', async () => {
+    const nonAdminUser = await generateUser({ 'contributor.newsPoster': false });
+    await expect(nonAdminUser.del(`/news/${v4()}`)).to.eventually.be.rejected.and.eql({
+      code: 401,
+      error: 'NotAuthorized',
+      message: 'You don\'t have news poster access.',
+    });
+  });
+
+  it('returns an error if the post does not exist', async () => {
+    await expect(user.del(`/news/${v4()}`)).to.eventually.be.rejected.and.eql({
+      code: 404,
+      error: 'NotFound',
+      message: t('newsPostNotFound'),
+    });
+  });
+
+  it('deletes news posts', async () => {
+    const existingPost = await user.post('/news', newsPost);
+    await user.del(`/news/${existingPost._id}`);
+
+    const returnedPosts = await user.get('/news');
+    const deletedPost = returnedPosts.find(returnedPost => returnedPost._id === existingPost._id);
+
+    expect(returnedPosts).is.an('array');
+    expect(deletedPost).to.not.exist;
+  });
+});

test/api/v4/news/GET-news.test.js

@@ -0,0 +1,50 @@
+import {
+  requester, generateUser,
+} from '../../../helpers/api-integration/v4';
+
+describe('GET /news', () => {
+  let api;
+  const newsPost = {
+    title: 'New Post',
+    publishDate: new Date(),
+    published: true,
+    credits: 'credits',
+    text: 'news body',
+  };
+
+  before(async () => {
+    api = requester();
+    const user = await generateUser({
+      'contributor.newsPoster': true,
+    });
+
+    await Promise.all([
+      user.post('/news', newsPost),
+      user.post('/news', newsPost),
+      user.post('/news', newsPost),
+      user.post('/news', newsPost),
+      user.post('/news', newsPost),
+      user.post('/news', newsPost),
+      user.post('/news', newsPost),
+      user.post('/news', newsPost),
+      user.post('/news', newsPost),
+      user.post('/news', newsPost),
+      user.post('/news', newsPost),
+      user.post('/news', newsPost),
+    ]);
+  });
+
+  it('returns the latest news in json format, does not require authentication, 10 per page', async () => {
+    const res = await api.get('/news');
+    expect(res.length).to.be.equal(10);
+    expect(res[0].title).to.be.not.empty;
+    expect(res[0].text).to.be.not.empty;
+  });
+
+  it('supports pagination', async () => {
+    const res = await api.get('/news?page=1');
+    expect(res.length).to.be.equal(2);
+    expect(res[0].title).to.be.not.empty;
+    expect(res[0].text).to.be.not.empty;
+  });
+});

test/api/v4/news/GET-news_id.test.js

@@ -0,0 +1,36 @@
+import { v4 } from 'uuid';
+import {
+  generateUser,
+  translate as t,
+} from '../../../helpers/api-integration/v4';
+
+describe('GET /news/:newsID', () => {
+  let user;
+  const newsPost = {
+    title: 'New Post',
+    publishDate: new Date(),
+    published: true,
+    credits: 'credits',
+    text: 'news body',
+  };
+  beforeEach(async () => {
+    user = await generateUser({
+      'contributor.newsPoster': true,
+    });
+  });
+
+  it('returns an error if the post does not exist', async () => {
+    await expect(user.get(`/news/${v4()}`)).to.eventually.be.rejected.and.eql({
+      code: 404,
+      error: 'NotFound',
+      message: t('newsPostNotFound'),
+    });
+  });
+
+  it('fetches an existing post', async () => {
+    const existingPost = await user.post('/news', newsPost);
+    const fetchedPost = await user.get(`/news/${existingPost._id}`);
+
+    expect(fetchedPost._id).to.equal(existingPost._id);
+  });
+});

test/api/v4/news/POST-news.test.js

@@ -0,0 +1,134 @@
+import moment from 'moment';
+import {
+  generateUser,
+  sleep,
+} from '../../../helpers/api-integration/v4';
+import { model as NewsPost } from '../../../../website/server/models/newsPost';
+
+describe('POST /news', () => {
+  let user;
+  const newsPost = {
+    title: 'New Post',
+    publishDate: new Date(),
+    published: true,
+    credits: 'credits',
+    text: 'news body',
+  };
+  beforeEach(async () => {
+    user = await generateUser({
+      'contributor.newsPoster': true,
+    });
+  });
+
+  it('disallows access to non-admins', async () => {
+    const nonAdminUser = await generateUser({ 'contributor.newsPoster': false });
+    await expect(nonAdminUser.post('/news')).to.eventually.be.rejected.and.eql({
+      code: 401,
+      error: 'NotAuthorized',
+      message: 'You don\'t have news poster access.',
+    });
+  });
+
+  it('creates news posts', async () => {
+    const response = await user.post('/news', newsPost);
+
+    expect(response.title).to.equal(newsPost.title);
+    expect(response.credits).to.equal(newsPost.credits);
+    expect(response.text).to.equal(newsPost.text);
+    expect(response._id).to.exist;
+
+    const res = await user.get('/news');
+    expect(res[0]._id).to.equal(response._id);
+    expect(res[0].title).to.equal(newsPost.title);
+    expect(res[0].text).to.equal(newsPost.text);
+  });
+
+  context('calls updateLastNewsPost', () => {
+    beforeEach(async () => {
+      await NewsPost.remove({ });
+    });
+
+    afterEach(async () => {
+      newsPost.publishDate = new Date();
+      newsPost.published = true;
+    });
+
+    it('new post is published and the most recent one', async () => {
+      newsPost.publishDate = new Date();
+      const newPost = await user.post('/news', newsPost);
+      await sleep(0.05);
+      expect(NewsPost.lastNewsPost()._id).to.equal(newPost._id);
+    });
+
+    it('new post is not published', async () => {
+      newsPost.published = false;
+      const newPost = await user.post('/news', newsPost);
+      await sleep(0.05);
+      expect(NewsPost.lastNewsPost()._id).to.not.equal(newPost._id);
+    });
+
+    it('new post is published but in the future', async () => {
+      newsPost.publishDate = moment().add({ days: 1 }).toDate();
+      const newPost = await user.post('/news', newsPost);
+      await sleep(0.05);
+      expect(NewsPost.lastNewsPost()._id).to.not.equal(newPost._id);
+    });
+
+    it('new post is published but not the most recent one', async () => {
+      const oldPost = await user.post('/news', newsPost);
+      newsPost.publishDate = moment().subtract({ days: 1 }).toDate();
+      await user.post('/news', newsPost);
+      await sleep(0.05);
+      expect(NewsPost.lastNewsPost()._id).to.equal(oldPost._id);
+    });
+  });
+
+  it('sets default fields', async () => {
+    const response = await user.post('/news', {
+      title: 'A post',
+      credits: 'Credits',
+      text: 'Text',
+    });
+
+    expect(response.published).to.equal(false);
+    expect(response.publishDate).to.exist;
+    expect(response.author).to.equal(user._id);
+    expect(response.createdAt).to.exist;
+    expect(response.updatedAt).to.exist;
+  });
+
+  context('required fields', () => {
+    it('title', async () => {
+      await expect(user.post('/news', {
+        text: 'Text',
+        credits: 'Credits',
+      })).to.eventually.be.rejected.and.eql({
+        code: 400,
+        error: 'BadRequest',
+        message: 'NewsPost validation failed',
+      });
+    });
+
+    it('credits', async () => {
+      await expect(user.post('/news', {
+        text: 'Text',
+        title: 'Title',
+      })).to.eventually.be.rejected.and.eql({
+        code: 400,
+        error: 'BadRequest',
+        message: 'NewsPost validation failed',
+      });
+    });
+
+    it('text', async () => {
+      await expect(user.post('/news', {
+        credits: 'credits',
+        title: 'Title',
+      })).to.eventually.be.rejected.and.eql({
+        code: 400,
+        error: 'BadRequest',
+        message: 'NewsPost validation failed',
+      });
+    });
+  });
+});

test/api/v4/news/POST-news_read.test.js

@@ -0,0 +1,22 @@
+import {
+  generateUser,
+} from '../../../helpers/api-integration/v4';
+import { model as NewsPost } from '../../../../website/server/models/newsPost';
+
+describe('POST /news/read', () => {
+  let user;
+
+  beforeEach(async () => {
+    user = await generateUser();
+  });
+
+  it('marks new stuff as read', async () => {
+    NewsPost.updateLastNewsPost({ _id: '1234', publishDate: new Date(), published: true });
+    await user.post('/news/read');
+    await user.sync();
+
+    expect(user.flags.lastNewStuffRead).to.equal('1234');
+    // fetching the user because newStuff is a computed property
+    expect((await user.get('/user')).flags.newStuff).to.equal(false);
+  });
+});

test/api/v4/news/PUT-news_newsId.test.js

@@ -0,0 +1,103 @@
+import { v4 } from 'uuid';
+import {
+  generateUser,
+  translate as t,
+  sleep,
+} from '../../../helpers/api-integration/v4';
+import { model as NewsPost } from '../../../../website/server/models/newsPost';
+
+describe('PUT /news/:newsID', () => {
+  let user;
+  const newsPost = {
+    title: 'New Post',
+    publishDate: new Date(),
+    published: true,
+    credits: 'credits',
+    text: 'news body',
+  };
+  beforeEach(async () => {
+    user = await generateUser({
+      'contributor.newsPoster': true,
+    });
+  });
+
+  it('disallows access to non-admins', async () => {
+    const nonAdminUser = await generateUser({ 'contributor.newsPoster': false });
+    await expect(nonAdminUser.put('/news/1234')).to.eventually.be.rejected.and.eql({
+      code: 401,
+      error: 'NotAuthorized',
+      message: 'You don\'t have news poster access.',
+    });
+  });
+
+  it('returns an error if the post does not exist', async () => {
+    await expect(user.put(`/news/${v4()}`)).to.eventually.be.rejected.and.eql({
+      code: 404,
+      error: 'NotFound',
+      message: t('newsPostNotFound'),
+    });
+  });
+
+  it('updates existing news posts', async () => {
+    const existingPost = await user.post('/news', newsPost);
+    const updatedPost = await user.put(`/news/${existingPost._id}`, {
+      title: 'Changed Title',
+    });
+
+    expect(updatedPost.title).to.equal('Changed Title');
+    expect(updatedPost.credits).to.equal(existingPost.credits);
+    expect(updatedPost.text).to.equal(existingPost.text);
+    expect(updatedPost.published).to.equal(existingPost.published);
+    expect(updatedPost._id).to.equal(existingPost._id);
+  });
+
+  context('calls updateLastNewsPost', () => {
+    beforeEach(async () => {
+      await NewsPost.remove({ });
+    });
+
+    it('updates post data', async () => {
+      const existingPost = await user.post('/news', { ...newsPost, publishDate: new Date() });
+      const updatedPost = await user.put(`/news/${existingPost._id}`, {
+        title: 'Changed Title',
+      });
+      await sleep(0.05);
+
+      expect(NewsPost.lastNewsPost().title).to.equal(updatedPost.title);
+    });
+
+    it('updated post is not published', async () => {
+      const oldPost = await user.post('/news', { ...newsPost, publishDate: new Date() });
+      const newUnpublished = await user.post('/news', { ...newsPost, published: false });
+      await user.put(`/news/${newUnpublished._id}`, {
+        title: 'Changed Title',
+      });
+      await sleep(0.05);
+
+      expect(NewsPost.lastNewsPost()._id).to.equal(oldPost._id);
+    });
+
+    it('updated post is published', async () => {
+      await user.post('/news', { ...newsPost, publishDate: new Date() });
+      const newUnpublished = await user.post('/news', { ...newsPost, published: false, publishDate: new Date() });
+      await user.put(`/news/${newUnpublished._id}`, {
+        publishDate: new Date(),
+        published: true,
+      });
+      await sleep(0.05);
+
+      expect(NewsPost.lastNewsPost()._id).to.equal(newUnpublished._id);
+    });
+
+    it('updated post publishDate is in future', async () => {
+      const oldPost = await user.post('/news', { ...newsPost, publishDate: new Date() });
+      const newUnpublished = await user.post('/news', newsPost);
+      await user.put(`/news/${newUnpublished._id}`, {
+        publishDate: Date.now() + 50000,
+      });
+      await sleep(0.05);
+
+      expect(NewsPost.lastNewsPost()._id).to.equal(oldPost._id);
+    });
+  });
+});

test/api/v4/tasks/POST-tasks-bulk-score.test.js

@@ -0,0 +1,583 @@
+import { v4 as generateUUID } from 'uuid';
+import {
+  generateUser,
+  sleep,
+  translate as t,
+  server,
+} from '../../../helpers/api-integration/v4';
+
+describe('POST /tasks/bulk-score', () => {
+  let user;
+
+  beforeEach(async () => {
+    user = await generateUser({
+      'stats.gp': 100,
+    });
+  });
+
+  context('all', () => {
+    it('can use id to identify the task', async () => {
+      const todo = await user.post('/tasks/user', {
+        text: 'test todo',
+        type: 'todo',
+        alias: 'alias',
+      });
+
+      const res = await user.post('/tasks/bulk-score', [{ id: todo.id, direction: 'up' }]);
+
+      expect(res).to.be.ok;
+      expect(res.tasks.length).to.equal(1);
+      expect(res.tasks[0].id).to.equal(todo._id);
+      expect(res.tasks[0].delta).to.be.greaterThan(0);
+    });
+
+    it('can use a alias in place of the id', async () => {
+      const todo = await user.post('/tasks/user', {
+        text: 'test todo',
+        type: 'todo',
+        alias: 'alias',
+      });
+
+      const res = await user.post('/tasks/bulk-score', [{ id: todo.alias, direction: 'up' }]);
+
+      expect(res).to.be.ok;
+      expect(res.tasks.length).to.equal(1);
+      expect(res.tasks[0].id).to.equal(todo._id);
+      expect(res.tasks[0].delta).to.be.greaterThan(0);
+    });
+
+    it('sends task scored webhooks', async () => {
+      const uuid = generateUUID();
+      await server.start();
+
+      await user.post('/user/webhook', {
+        url: `http://localhost:${server.port}/webhooks/${uuid}`,
+        type: 'taskActivity',
+        enabled: true,
+        options: {
+          created: false,
+          scored: true,
+        },
+      });
+
+      const task = await user.post('/tasks/user', {
+        text: 'test habit',
+        type: 'habit',
+      });
+
+      await user.post('/tasks/bulk-score', [{ id: task.id, direction: 'up' }]);
+
+      await sleep();
+
+      await server.close();
+
+      const body = server.getWebhookData(uuid);
+
+      expect(body.user).to.have.all.keys('_id', '_tmp', 'stats');
+      expect(body.user.stats).to.have.all.keys('hp', 'mp', 'exp', 'gp', 'lvl', 'class', 'points', 'str', 'con', 'int', 'per', 'buffs', 'training', 'maxHealth', 'maxMP', 'toNextLevel');
+      expect(body.task.id).to.eql(task.id);
+      expect(body.direction).to.eql('up');
+      expect(body.delta).to.be.greaterThan(0);
+    });
+
+    context('sending user activity webhooks', () => {
+      before(async () => {
+        await server.start();
+      });
+
+      after(async () => {
+        await server.close();
+      });
+
+      it('sends user activity webhook when the user levels up', async () => {
+        const uuid = generateUUID();
+
+        await user.post('/user/webhook', {
+          url: `http://localhost:${server.port}/webhooks/${uuid}`,
+          type: 'userActivity',
+          enabled: true,
+          options: {
+            leveledUp: true,
+          },
+        });
+
+        const initialLvl = user.stats.lvl;
+
+        await user.update({
+          'stats.exp': 3000,
+        });
+        const task = await user.post('/tasks/user', {
+          text: 'test habit',
+          type: 'habit',
+        });
+
+        await user.post('/tasks/bulk-score', [{ id: task.id, direction: 'up' }]);
+        await user.sync();
+        await sleep();
+
+        const body = server.getWebhookData(uuid);
+
+        expect(body.type).to.eql('leveledUp');
+        expect(body.initialLvl).to.eql(initialLvl);
+        expect(body.finalLvl).to.eql(user.stats.lvl);
+      });
+    });
+
+    it('fails the entire op if one task scoring fails', async () => {
+      const todo = await user.post('/tasks/user', {
+        text: 'test todo',
+        type: 'todo',
+      });
+      const habit = await user.post('/tasks/user', {
+        text: 'test habit',
+        type: 'habit',
+      });
+
+      await expect(user.post('/tasks/bulk-score', [
+        { id: todo.id, direction: 'down' },
+        { id: habit.id, direction: 'down' },
+      ])).to.eventually.be.rejected.and.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('sessionOutdated'),
+      });
+
+      const updatedHabit = await user.get(`/tasks/${habit._id}`);
+      expect(updatedHabit.history.length).to.equal(0);
+      expect(updatedHabit.value).to.equal(0);
+
+      const updatedTodo = await user.get(`/tasks/${todo._id}`);
+      expect(updatedTodo.value).to.equal(0);
+    });
+
+    it('sends _tmp for each task', async () => {
+      const habit1 = await user.post('/tasks/user', {
+        text: 'test habit 1',
+        type: 'habit',
+      });
+      const habit2 = await user.post('/tasks/user', {
+        text: 'test habit 2',
+        type: 'habit',
+      });
+
+      await user.update({
+        'party.quest.key': 'gryphon',
+      });
+
+      const res = await user.post('/tasks/bulk-score', [
+        { id: habit1._id, direction: 'up' },
+        { id: habit2._id, direction: 'up' },
+      ]);
+
+      await user.sync();
+
+      expect(res.tasks[0]._tmp.quest.progressDelta).to.be.greaterThan(0);
+      expect(res.tasks[1]._tmp.quest.progressDelta).to.be.greaterThan(0);
+      expect(user.party.quest.progress.up).to
+        .eql(res.tasks[0]._tmp.quest.progressDelta + res.tasks[1]._tmp.quest.progressDelta);
+    });
+  });
+
+  context('todos', () => {
+    let todo;
+
+    beforeEach(async () => {
+      todo = await user.post('/tasks/user', {
+        text: 'test todo',
+        type: 'todo',
+      });
+    });
+
+    it('completes todo when direction is up', async () => {
+      await user.post('/tasks/bulk-score', [{ id: todo.id, direction: 'up' }]);
+      const task = await user.get(`/tasks/${todo._id}`);
+
+      expect(task.completed).to.equal(true);
+      expect(task.dateCompleted).to.be.a('string'); // date gets converted to a string as json doesn't have a Date type
+    });
+
+    it('moves completed todos out of user.tasksOrder.todos', async () => {
+      const getUser = await user.get('/user');
+      expect(getUser.tasksOrder.todos.indexOf(todo._id)).to.not.equal(-1);
+
+      await user.post('/tasks/bulk-score', [{ id: todo.id, direction: 'up' }]);
+      const updatedTask = await user.get(`/tasks/${todo._id}`);
+      expect(updatedTask.completed).to.equal(true);
+
+      const updatedUser = await user.get('/user');
+      expect(updatedUser.tasksOrder.todos.indexOf(todo._id)).to.equal(-1);
+    });
+
+    it('moves un-completed todos back into user.tasksOrder.todos', async () => {
+      const getUser = await user.get('/user');
+      expect(getUser.tasksOrder.todos.indexOf(todo._id)).to.not.equal(-1);
+
+      await user.post('/tasks/bulk-score', [{ id: todo.id, direction: 'up' }]);
+      await user.post('/tasks/bulk-score', [{ id: todo.id, direction: 'down' }]);
+
+      const updatedTask = await user.get(`/tasks/${todo._id}`);
+      expect(updatedTask.completed).to.equal(false);
+
+      const updatedUser = await user.get('/user');
+      const l = updatedUser.tasksOrder.todos.length;
+      expect(updatedUser.tasksOrder.todos.indexOf(todo._id)).not.to.equal(-1);
+      // Check that it was pushed at the bottom
+      expect(updatedUser.tasksOrder.todos.indexOf(todo._id)).to.equal(l - 1);
+    });
+
+    it('uncompletes todo when direction is down', async () => {
+      await user.post('/tasks/bulk-score', [{ id: todo.id, direction: 'up' }, { id: todo.id, direction: 'down' }]);
+      const updatedTask = await user.get(`/tasks/${todo._id}`);
+
+      expect(updatedTask.completed).to.equal(false);
+      expect(updatedTask.dateCompleted).to.be.a('undefined');
+    });
+
+    it('doesn\'t let a todo be uncompleted twice', async () => {
+      await expect(user.post('/tasks/bulk-score', [{ id: todo.id, direction: 'down' }])).to.eventually.be.rejected.and.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('sessionOutdated'),
+      });
+    });
+
+    context('user stats when direction is up', () => {
+      let updatedUser; let res;
+
+      beforeEach(async () => {
+        res = await user.post('/tasks/bulk-score', [{ id: todo.id, direction: 'up' }]);
+        updatedUser = await user.get('/user');
+      });
+
+      it('increases user\'s mp', () => {
+        expect(updatedUser.stats.mp).to.be.greaterThan(user.stats.mp);
+        expect(res.mp).to.equal(updatedUser.stats.mp);
+      });
+
+      it('increases user\'s exp', () => {
+        expect(updatedUser.stats.exp).to.be.greaterThan(user.stats.exp);
+        expect(res.exp).to.equal(updatedUser.stats.exp);
+      });
+
+      it('increases user\'s gold', () => {
+        expect(updatedUser.stats.gp).to.be.greaterThan(user.stats.gp);
+        expect(res.gp).to.equal(updatedUser.stats.gp);
+      });
+    });
+
+    context('user stats when direction is down', () => {
+      let updatedUser; let initialUser; let res;
+
+      beforeEach(async () => {
+        await user.post('/tasks/bulk-score', [{ id: todo.id, direction: 'up' }]);
+        initialUser = await user.get('/user');
+        res = await user.post('/tasks/bulk-score', [{ id: todo.id, direction: 'down' }]);
+        updatedUser = await user.get('/user');
+      });
+
+      it('decreases user\'s mp', () => {
+        expect(updatedUser.stats.mp).to.be.lessThan(initialUser.stats.mp);
+      });
+
+      it('decreases user\'s exp', () => {
+        expect(updatedUser.stats.exp).to.be.lessThan(initialUser.stats.exp);
+        expect(res.exp).to.equal(updatedUser.stats.exp);
+      });
+
+      it('decreases user\'s gold', () => {
+        expect(updatedUser.stats.gp).to.be.lessThan(initialUser.stats.gp);
+        expect(res.gp).to.equal(updatedUser.stats.gp);
+      });
+    });
+  });
+
+  context('dailys', () => {
+    let daily;
+
+    beforeEach(async () => {
+      daily = await user.post('/tasks/user', {
+        text: 'test daily',
+        type: 'daily',
+      });
+    });
+
+    it('completes daily when direction is up', async () => {
+      await user.post('/tasks/bulk-score', [{ id: daily.id, direction: 'up' }]);
+      const task = await user.get(`/tasks/${daily._id}`);
+
+      expect(task.completed).to.equal(true);
+    });
+
+    it('uncompletes daily when direction is down', async () => {
+      await user.post('/tasks/bulk-score', [{ id: daily.id, direction: 'up' }, { id: daily.id, direction: 'down' }]);
+      const task = await user.get(`/tasks/${daily._id}`);
+
+      expect(task.completed).to.equal(false);
+    });
+
+    it('computes isDue', async () => {
+      await user.post('/tasks/bulk-score', [{ id: daily.id, direction: 'up' }]);
+      const task = await user.get(`/tasks/${daily._id}`);
+
+      expect(task.isDue).to.equal(true);
+    });
+
+    it('computes nextDue', async () => {
+      await user.post('/tasks/bulk-score', [{ id: daily.id, direction: 'up' }]);
+      const task = await user.get(`/tasks/${daily._id}`);
+
+      expect(task.nextDue.length).to.eql(6);
+    });
+
+    context('user stats when direction is up', () => {
+      let updatedUser; let res;
+
+      beforeEach(async () => {
+        res = await user.post('/tasks/bulk-score', [{ id: daily.id, direction: 'up' }]);
+        updatedUser = await user.get('/user');
+      });
+
+      it('increases user\'s mp', () => {
+        expect(updatedUser.stats.mp).to.be.greaterThan(user.stats.mp);
+        expect(res.mp).to.equal(updatedUser.stats.mp);
+      });
+
+      it('increases user\'s exp', () => {
+        expect(updatedUser.stats.exp).to.be.greaterThan(user.stats.exp);
+        expect(res.exp).to.equal(updatedUser.stats.exp);
+      });
+
+      it('increases user\'s gold', () => {
+        expect(updatedUser.stats.gp).to.be.greaterThan(user.stats.gp);
+        expect(res.gp).to.equal(updatedUser.stats.gp);
+      });
+    });
+
+    context('user stats when direction is down', () => {
+      let updatedUser; let initialUser; let res;
+
+      beforeEach(async () => {
+        await user.post('/tasks/bulk-score', [{ id: daily.id, direction: 'up' }]);
+        initialUser = await user.get('/user');
+        res = await user.post('/tasks/bulk-score', [{ id: daily.id, direction: 'down' }]);
+        updatedUser = await user.get('/user');
+      });
+
+      it('decreases user\'s mp', () => {
+        expect(updatedUser.stats.mp).to.be.lessThan(initialUser.stats.mp);
+        expect(res.mp).to.equal(updatedUser.stats.mp);
+      });
+
+      it('decreases user\'s exp', () => {
+        expect(updatedUser.stats.exp).to.be.lessThan(initialUser.stats.exp);
+        expect(res.exp).to.equal(updatedUser.stats.exp);
+      });
+
+      it('decreases user\'s gold', () => {
+        expect(updatedUser.stats.gp).to.be.lessThan(initialUser.stats.gp);
+        expect(res.gp).to.equal(updatedUser.stats.gp);
+      });
+    });
+  });
+
+  context('habits', () => {
+    let habit; let minusHabit; let plusHabit; let
+      neitherHabit; // eslint-disable-line no-unused-vars
+
+    beforeEach(async () => {
+      habit = await user.post('/tasks/user', {
+        text: 'test habit',
+        type: 'habit',
+      });
+
+      minusHabit = await user.post('/tasks/user', {
+        text: 'test min habit',
+        type: 'habit',
+        up: false,
+      });
+
+      plusHabit = await user.post('/tasks/user', {
+        text: 'test plus habit',
+        type: 'habit',
+        down: false,
+      });
+
+      neitherHabit = await user.post('/tasks/user', {
+        text: 'test neither habit',
+        type: 'habit',
+        up: false,
+        down: false,
+      });
+    });
+
+    it('increases user\'s mp when direction is up', async () => {
+      const res = await user.post('/tasks/bulk-score', [{ id: habit.id, direction: 'up' }, {
+        id: plusHabit.id,
+        direction: 'up',
+      }]);
+      const updatedUser = await user.get('/user');
+
+      expect(updatedUser.stats.mp).to.be.greaterThan(user.stats.mp);
+      expect(res.mp).to.equal(updatedUser.stats.mp);
+    });
+
+    it('decreases user\'s mp when direction is down', async () => {
+      const res = await user.post('/tasks/bulk-score', [{
+        id: habit.id,
+        direction: 'down',
+      }, {
+        id: minusHabit.id,
+        direction: 'down',
+      }]);
+      const updatedUser = await user.get('/user');
+
+      expect(updatedUser.stats.mp).to.be.lessThan(user.stats.mp);
+      expect(res.mp).to.equal(updatedUser.stats.mp);
+    });
+
+    it('increases user\'s exp when direction is up', async () => {
+      const res = await user.post('/tasks/bulk-score', [{
+        id: habit.id,
+        direction: 'up',
+      }, {
+        id: plusHabit.id,
+        direction: 'up',
+      }]);
+      const updatedUser = await user.get('/user');
+
+      expect(updatedUser.stats.exp).to.be.greaterThan(user.stats.exp);
+      expect(res.exp).to.equal(updatedUser.stats.exp);
+    });
+
+    it('increases user\'s gold when direction is up', async () => {
+      const res = await user.post('/tasks/bulk-score', [{
+        id: habit.id,
+        direction: 'up',
+      }, {
+        id: plusHabit.id,
+        direction: 'up',
+      }]);
+      const updatedUser = await user.get('/user');
+
+      expect(updatedUser.stats.gp).to.be.greaterThan(user.stats.gp);
+      expect(res.gp).to.equal(updatedUser.stats.gp);
+    });
+
+    it('records only one history entry per day', async () => {
+      const initialHistoryLength = habit.history.length;
+      await user.post('/tasks/bulk-score', [{
+        id: habit.id,
+        direction: 'up',
+      }, {
+        id: habit.id,
+        direction: 'up',
+      }, {
+        id: habit.id,
+        direction: 'down',
+      }, {
+        id: habit.id,
+        direction: 'up',
+      }]);
+
+      const updatedTask = await user.get(`/tasks/${habit._id}`);
+
+      expect(updatedTask.history.length).to.eql(initialHistoryLength + 1);
+
+      const lastHistoryEntry = updatedTask.history[updatedTask.history.length - 1];
+      expect(lastHistoryEntry.scoredUp).to.equal(3);
+      expect(lastHistoryEntry.scoredDown).to.equal(1);
+    });
+  });
+
+  context('mixed', () => {
+    let habit; let daily; let todo;
+
+    beforeEach(async () => {
+      habit = await user.post('/tasks/user', {
+        text: 'test habit',
+        type: 'habit',
+      });
+      daily = await user.post('/tasks/user', {
+        text: 'test habit',
+        type: 'habit',
+      });
+      todo = await user.post('/tasks/user', {
+        text: 'test habit',
+        type: 'habit',
+      });
+    });
+
+    it('scores habits, dailies, todos', async () => {
+      const res = await user.post('/tasks/bulk-score', [
+        { id: habit.id, direction: 'down' },
+        { id: daily.id, direction: 'up' },
+        { id: todo.id, direction: 'up' },
+      ]);
+
+      expect(res.tasks[0].id).to.eql(habit.id);
+      expect(res.tasks[0].delta).to.be.below(0);
+      expect(res.tasks[0]._tmp).to.exist;
+
+      expect(res.tasks[1].id).to.eql(daily.id);
+      expect(res.tasks[1].delta).to.be.greaterThan(0);
+      expect(res.tasks[1]._tmp).to.exist;
+
+      expect(res.tasks[2].id).to.eql(todo.id);
+      expect(res.tasks[2].delta).to.be.greaterThan(0);
+      expect(res.tasks[2]._tmp).to.exist;
+
+      const updatedHabit = await user.get(`/tasks/${habit._id}`);
+      const updatedDaily = await user.get(`/tasks/${daily._id}`);
+      const updatedTodo = await user.get(`/tasks/${todo._id}`);
+
+      expect(habit.value).to.be.greaterThan(updatedHabit.value);
+      expect(updatedHabit.counterDown).to.equal(1);
+      expect(updatedDaily.value).to.be.greaterThan(daily.value);
+      expect(updatedTodo.value).to.be.greaterThan(todo.value);
+    });
+  });
+
+  context('reward', () => {
+    it('correctly handles rewards', async () => {
+      const reward = await user.post('/tasks/user', {
+        text: 'test reward',
+        type: 'reward',
+        value: 5,
+      });
+
+      const res = await user.post('/tasks/bulk-score', [{ id: reward.id, direction: 'up' }]);
+      const updatedUser = await user.get('/user');
+
+      // purchases reward
+      expect(user.stats.gp).to.equal(updatedUser.stats.gp + 5);
+      expect(res.gp).to.equal(updatedUser.stats.gp);
+
+      // does not change user\'s mp
+      expect(user.stats.mp).to.equal(updatedUser.stats.mp);
+      expect(res.mp).to.equal(updatedUser.stats.mp);
+
+      // does not change user\'s exp
+      expect(user.stats.exp).to.equal(updatedUser.stats.exp);
+      expect(res.exp).to.equal(updatedUser.stats.exp);
+    });
+
+    it('fails if the user does not have enough gold', async () => {
+      const reward = await user.post('/tasks/user', {
+        text: 'test reward',
+        type: 'reward',
+        value: 500,
+      });
+
+      await expect(user.post('/tasks/bulk-score', [{ id: reward.id, direction: 'up' }])).to.eventually.be.rejected.and.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('messageNotEnoughGold'),
+      });
+
+      const updatedUser = await user.get('/user');
+
+      // does not purchase reward
+      expect(user.stats.gp).to.equal(updatedUser.stats.gp);
+    });
+  });
+});

test/api/v4/user/POST-user_unequip.test.js

@@ -0,0 +1,52 @@
+import {
+  generateUser,
+} from '../../../helpers/api-integration/v4';
+import { UNEQUIP_EQUIPPED } from '../../../../website/common/script/ops/unequip';
+
+describe('POST /user/unequip', () => {
+  let user;
+
+  beforeEach(async () => {
+    user = await generateUser({
+      preferences: {
+        background: 'violet',
+      },
+      items: {
+        currentMount: 'BearCub-Base',
+        currentPet: 'BearCub-Base',
+        gear: {
+          owned: {
+            weapon_warrior_0: true,
+            weapon_warrior_1: true,
+            weapon_warrior_2: true,
+            weapon_wizard_1: true,
+            weapon_wizard_2: true,
+            shield_base_0: true,
+            shield_warrior_1: true,
+          },
+          equipped: {
+            weapon: 'weapon_warrior_2',
+            shield: 'shield_warrior_1',
+          },
+          costume: {
+            weapon: 'weapon_warrior_2',
+            shield: 'shield_warrior_1',
+          },
+        },
+      },
+      stats: { gp: 200 },
+    });
+  });
+
+  // More tests in common code unit tests
+
+  context('Gear', () => {
+    it('should unequip all battle gear items', async () => {
+      await user.post(`/user/unequip/${UNEQUIP_EQUIPPED}`);
+      await user.sync();
+
+      expect(user.items.gear.equipped.weapon).to.eq('weapon_base_0');
+      expect(user.items.gear.equipped.shield).to.eq('shield_base_0');
+    });
+  });
+});

test/api/v4/user/auth/POST-user_verify_display_name.test.js

@@ -53,5 +53,11 @@ describe('POST /user/auth/verify-display-name', async () => {
         displayName: 'this is a very long display name over 30 characters',
       })).to.eventually.eql({ isUsable: false, issues: [t('displaynameIssueLength')] });
     });
+
+    it('errors if display name contains a newline', async () => {
+      await expect(user.post(ENDPOINT, {
+        displayName: 'namecontainsnewline\n',
+      })).to.eventually.eql({ isUsable: false, issues: [t('displaynameIssueNewline')] });
+    });
   });
 });

test/common/fns/getUtcOffset.test.js

@@ -0,0 +1,25 @@
+import getUtcOffset from '../../../website/common/script/fns/getUtcOffset';
+
+describe('getUtcOffset', () => {
+  let user;
+
+  beforeEach(() => {
+    user = { preferences: {} };
+  });
+
+  it('returns 0 when user.timezoneOffset is not set', () => {
+    expect(getUtcOffset(user)).to.equal(0);
+  });
+
+  it('returns 0 when user.timezoneOffset is zero', () => {
+    user.preferences.timezoneOffset = 0;
+
+    expect(getUtcOffset(user)).to.equal(0);
+  });
+
+  it('returns the opposite of user.timezoneOffset', () => {
+    user.preferences.timezoneOffset = -10;
+
+    expect(getUtcOffset(user)).to.eql(10);
+  });
+});

test/common/fns/randomDrop.test.js

@@ -1,4 +1,5 @@
 import randomDrop from '../../../website/common/script/fns/randomDrop';
+import i18n from '../../../website/common/script/i18n';
 import {
   generateUser,
   generateTodo,
@@ -144,5 +145,148 @@ describe('common.fns.randomDrop', () => {
         expect(acceptableDrops).to.contain(user._tmp.drop.key); // always Desert
       });
     });
+
+    context('drop cap notification', () => {
+      let analytics;
+      const req = {};
+      let isSubscribedStub;
+
+      beforeEach(() => {
+        user.addNotification = () => {};
+        sandbox.stub(user, 'addNotification');
+        user.isSubscribed = () => {};
+        isSubscribedStub = sandbox.stub(user, 'isSubscribed');
+        isSubscribedStub.returns(false);
+        analytics = { track () {} };
+        sandbox.stub(analytics, 'track');
+      });
+
+      it('sends a notification if A/B test is enabled when drop cap is reached', () => {
+        user._ABtests.dropCapNotif = 'drop-cap-notif-enabled';
+        predictableRandom.returns(0.1);
+
+        // Max Drop Count is 5
+        expect(user.items.lastDrop.count).to.equal(0);
+        randomDrop(user, { task, predictableRandom }, req, analytics);
+        randomDrop(user, { task, predictableRandom }, req, analytics);
+        randomDrop(user, { task, predictableRandom }, req, analytics);
+        randomDrop(user, { task, predictableRandom }, req, analytics);
+        randomDrop(user, { task, predictableRandom }, req, analytics);
+        expect(user.items.lastDrop.count).to.equal(5);
+        expect(user.addNotification).to.be.calledOnce;
+        expect(user.addNotification).to.be.calledWith('DROP_CAP_REACHED', {
+          message: i18n.t('dropCapReached'),
+          items: 5,
+        });
+      });
+
+      it('does not send a notification if user is enrolled in disabled A/B test group', () => {
+        user._ABtests.dropCapNotif = 'drop-cap-notif-disabled';
+        predictableRandom.returns(0.1);
+
+        // Max Drop Count is 5
+        expect(user.items.lastDrop.count).to.equal(0);
+        randomDrop(user, { task, predictableRandom }, req, analytics);
+        randomDrop(user, { task, predictableRandom }, req, analytics);
+        randomDrop(user, { task, predictableRandom }, req, analytics);
+        randomDrop(user, { task, predictableRandom }, req, analytics);
+        randomDrop(user, { task, predictableRandom }, req, analytics);
+        expect(user.items.lastDrop.count).to.equal(5);
+        expect(user.addNotification).to.not.be.called;
+      });
+
+      it('does not send a notification if user is enrolled in disabled A/B test group', () => {
+        user._ABtests.dropCapNotif = 'drop-cap-notif-not-enrolled';
+        predictableRandom.returns(0.1);
+
+        // Max Drop Count is 5
+        expect(user.items.lastDrop.count).to.equal(0);
+        randomDrop(user, { task, predictableRandom }, req, analytics);
+        randomDrop(user, { task, predictableRandom }, req, analytics);
+        randomDrop(user, { task, predictableRandom }, req, analytics);
+        randomDrop(user, { task, predictableRandom }, req, analytics);
+        randomDrop(user, { task, predictableRandom }, req, analytics);
+        expect(user.items.lastDrop.count).to.equal(5);
+        expect(user.addNotification).to.not.be.called;
+      });
+
+      it('does not send a notification if drop cap is not reached', () => {
+        user._ABtests.dropCapNotif = 'drop-cap-notif-enabled';
+        predictableRandom.returns(0.1);
+
+        // Max Drop Count is 5
+        expect(user.items.lastDrop.count).to.equal(0);
+        randomDrop(user, { task, predictableRandom }, req, analytics);
+        randomDrop(user, { task, predictableRandom }, req, analytics);
+        randomDrop(user, { task, predictableRandom }, req, analytics);
+        randomDrop(user, { task, predictableRandom }, req, analytics);
+        expect(user.items.lastDrop.count).to.equal(4);
+        expect(user.addNotification).to.not.be.called;
+      });
+
+      it('does not send a notification if user is subscribed', () => {
+        user._ABtests.dropCapNotif = 'drop-cap-notif-enabled';
+        predictableRandom.returns(0.1);
+        isSubscribedStub.returns(true);
+
+        // Max Drop Count is 5
+        expect(user.items.lastDrop.count).to.equal(0);
+        randomDrop(user, { task, predictableRandom }, req, analytics);
+        randomDrop(user, { task, predictableRandom }, req, analytics);
+        randomDrop(user, { task, predictableRandom }, req, analytics);
+        randomDrop(user, { task, predictableRandom }, req, analytics);
+        randomDrop(user, { task, predictableRandom }, req, analytics);
+        expect(user.items.lastDrop.count).to.equal(5);
+        expect(user.addNotification).to.not.be.called;
+      });
+
+      it('tracks drop cap reached event for enrolled users (notification enabled)', () => {
+        user._ABtests.dropCapNotif = 'drop-cap-notif-enabled';
+        predictableRandom.returns(0.1);
+        isSubscribedStub.returns(true);
+
+        // Max Drop Count is 5
+        expect(user.items.lastDrop.count).to.equal(0);
+        randomDrop(user, { task, predictableRandom }, req, analytics);
+        randomDrop(user, { task, predictableRandom }, req, analytics);
+        randomDrop(user, { task, predictableRandom }, req, analytics);
+        randomDrop(user, { task, predictableRandom }, req, analytics);
+        randomDrop(user, { task, predictableRandom }, req, analytics);
+        expect(user.items.lastDrop.count).to.equal(5);
+        expect(analytics.track).to.be.calledWith('drop cap reached');
+      });
+
+      it('tracks drop cap reached event for enrolled users (notification disabled)', () => {
+        user._ABtests.dropCapNotif = 'drop-cap-notif-disabled';
+        predictableRandom.returns(0.1);
+        isSubscribedStub.returns(true);
+
+        // Max Drop Count is 5
+        expect(user.items.lastDrop.count).to.equal(0);
+        randomDrop(user, { task, predictableRandom }, req, analytics);
+        randomDrop(user, { task, predictableRandom }, req, analytics);
+        randomDrop(user, { task, predictableRandom }, req, analytics);
+        randomDrop(user, { task, predictableRandom }, req, analytics);
+        randomDrop(user, { task, predictableRandom }, req, analytics);
+        expect(user.items.lastDrop.count).to.equal(5);
+        expect(analytics.track).to.be.calledWith('drop cap reached');
+      });
+
+      it('does not track drop cap reached event for users not enrolled in A/B test', () => {
+        user._ABtests.dropCapNotif = 'drop-cap-notif-not-enrolled';
+        predictableRandom.returns(0.1);
+        isSubscribedStub.returns(true);
+
+        // Max Drop Count is 5
+        expect(user.items.lastDrop.count).to.equal(0);
+        randomDrop(user, { task, predictableRandom }, req, analytics);
+        randomDrop(user, { task, predictableRandom }, req, analytics);
+        randomDrop(user, { task, predictableRandom }, req, analytics);
+        randomDrop(user, { task, predictableRandom }, req, analytics);
+        randomDrop(user, { task, predictableRandom }, req, analytics);
+        expect(user.items.lastDrop.count).to.equal(5);
+        expect(analytics.track).to.not.be.calledWith('drop cap reached');
+      });
+    });
   });
 });

test/common/libs/cron.test.js

@@ -0,0 +1,184 @@
+import moment from 'moment';
+
+import { startOfDay, daysSince } from '../../../website/common/script/cron';
+
+function localMoment (timeString, utcOffset) {
+  return moment(timeString).utcOffset(utcOffset, true);
+}
+
+describe('cron utility functions', () => {
+  describe('startOfDay', () => {
+    it('is zero when no daystart configured', () => {
+      const options = { now: moment('2020-02-02 09:30:00Z'), timezoneOffset: 0 };
+
+      const result = startOfDay(options);
+
+      expect(result).to.be.sameMoment('2020-02-02 00:00:00Z');
+    });
+
+    it('is zero when negative daystart configured', () => {
+      const options = {
+        now: moment('2020-02-02 09:30:00Z'),
+        timezoneOffset: 0,
+        daystart: -5,
+      };
+
+      const result = startOfDay(options);
+
+      expect(result).to.be.sameMoment('2020-02-02 00:00:00Z');
+    });
+
+    it('is zero when daystart over 24 is configured', () => {
+      const options = {
+        now: moment('2020-02-02 09:30:00Z'),
+        timezoneOffset: 0,
+        daystart: 25,
+      };
+
+      const result = startOfDay(options);
+
+      expect(result).to.be.sameMoment('2020-02-02 00:00:00Z');
+    });
+
+    it('is equal to daystart o\'clock when daystart configured', () => {
+      const options = {
+        now: moment('2020-02-02 09:30:00Z'),
+        timezoneOffset: 0,
+        dayStart: 5,
+      };
+
+      const result = startOfDay(options);
+
+      expect(result).to.be.sameMoment('2020-02-02 05:00:00Z');
+    });
+
+    it('is previous day daystart o\'clock when daystart is after current time', () => {
+      const options = {
+        now: moment('2020-02-02 04:30:00Z'),
+        timezoneOffset: 0,
+        dayStart: 5,
+      };
+
+      const result = startOfDay(options);
+
+      expect(result).to.be.sameMoment('2020-02-01 05:00:00Z');
+    });
+
+    it('is daystart o\'clock when daystart is after current time due to timezone', () => {
+      const options = {
+        now: moment('2020-02-02 04:30:00Z'),
+        timezoneOffset: -120,
+        dayStart: 5,
+      };
+
+      const result = startOfDay(options);
+
+      expect(result).to.be.sameMoment('2020-02-02 05:00:00+02:00');
+    });
+
+    it('returns in default timezone if no timezone defined', () => {
+      const utcOffset = moment().utcOffset();
+      const now = localMoment('2020-02-02 04:30:00', utcOffset).utc();
+
+      const result = startOfDay({ now });
+
+      expect(result).to.be.sameMoment(localMoment('2020-02-02', utcOffset));
+    });
+
+    it('returns in default timezone if timezone lower than -12:00', () => {
+      const utcOffset = moment().utcOffset();
+      const options = {
+        now: localMoment('2020-02-02 17:30:00', utcOffset).utc(),
+        timezoneOffset: 721,
+      };
+
+      const result = startOfDay(options);
+
+      expect(result).to.be.sameMoment(localMoment('2020-02-02', utcOffset));
+    });
+
+    it('returns in default timezone if timezone higher than +14:00', () => {
+      const utcOffset = moment().utcOffset();
+      const options = {
+        now: localMoment('2020-02-02 07:32:25.376', utcOffset).utc(),
+        timezoneOffset: -841,
+      };
+
+      const result = startOfDay(options);
+
+      expect(result).to.be.sameMoment(localMoment('2020-02-02', utcOffset));
+    });
+
+    it('returns in overridden timezone if override present', () => {
+      const options = {
+        now: moment('2020-02-02 13:30:27Z'),
+        timezoneOffset: 0,
+        timezoneUtcOffsetOverride: -240,
+      };
+
+      const result = startOfDay(options);
+
+      expect(result).to.be.sameMoment('2020-02-02 00:00:00-04:00');
+    });
+
+    it('returns start of yesterday if timezone difference carries it over datelines', () => {
+      const offset = 300;
+      const options = {
+        now: moment('2020-02-02 04:30:00Z'),
+        timezoneOffset: offset,
+      };
+
+      const result = startOfDay(options);
+
+      expect(result).to.be.sameMoment(localMoment('2020-02-01', -offset));
+    });
+  });
+
+  describe('daysSince', () => {
+    it('correctly calculates days between two dates', () => {
+      const now = moment();
+      const dayBeforeYesterday = moment(now).subtract({ days: 2 });
+
+      expect(daysSince(dayBeforeYesterday, { now })).to.equal(2);
+    });
+
+    it('is one lower if current time is before dayStart', () => {
+      const oneWeekAgoAtOnePm = moment().hour(13).subtract({ days: 7 });
+      const thisMorningThreeAm = moment().hour(3);
+      const options = {
+        now: thisMorningThreeAm,
+        dayStart: 6,
+      };
+
+      const result = daysSince(oneWeekAgoAtOnePm, options);
+
+      expect(result).to.equal(6);
+    });
+
+    it('is one higher if reference time is before dayStart and current time after dayStart', () => {
+      const oneWeekAgoAtEightAm = moment().hour(8).subtract({ days: 7 });
+      const todayAtFivePm = moment().hour(17);
+      const options = {
+        now: todayAtFivePm,
+        dayStart: 11,
+      };
+
+      const result = daysSince(oneWeekAgoAtEightAm, options);
+
+      expect(result).to.equal(8);
+    });
+
+    // Variations in timezone configuration options are already covered by startOfDay tests.
+    it('uses now in user timezone as configured in options', () => {
+      const timezoneOffset = 120;
+      const options = {
+        now: moment('1989-11-09 02:53:00+01:00'),
+        timezoneOffset,
+      };
+
+      const result = daysSince(localMoment('1989-11-08', -timezoneOffset), options);
+
+      expect(result).to.equal(0);
+    });
+  });
+});

test/common/libs/taskDefaults.test.js

@@ -1,6 +1,7 @@
 import moment from 'moment';
 
 import taskDefaults from '../../../website/common/script/libs/taskDefaults';
+import getUtcOffset from '../../../website/common/script/fns/getUtcOffset';
 import { generateUser } from '../../helpers/common.helper';
 
 describe('taskDefaults', () => {
@@ -72,7 +73,7 @@ describe('taskDefaults', () => {
 
     expect(task.startDate).to.eql(
       moment()
-        .zone(user.preferences.timezoneOffset, 'hour')
+        .utcOffset(getUtcOffset(user))
         .startOf('day')
         .subtract(1, 'day')
         .toDate(),

test/common/ops/feed.js

@@ -113,6 +113,30 @@ describe('shared.ops.feed', () => {
         done();
       }
     });
+
+    it('does not allow bulk-feeding query amount above food owned', done => {
+      user.items.pets['Wolf-Base'] = 5;
+      user.items.food.Meat = 6;
+      try {
+        feed(user, { params: { pet: 'Wolf-Base', food: 'Meat' }, query: { amount: 8 } });
+      } catch (err) {
+        expect(err).to.be.an.instanceof(NotAuthorized);
+        expect(err.message).to.equal(i18n.t('notEnoughFood'));
+        done();
+      }
+    });
+
+    it('does not allow bulk-over-feeding pet', done => {
+      user.items.pets['Wolf-Base'] = 45;
+      user.items.food.Meat = 3;
+      try {
+        feed(user, { params: { pet: 'Wolf-Base', food: 'Meat' }, query: { amount: 2 } });
+      } catch (err) {
+        expect(err).to.be.an.instanceof(NotAuthorized);
+        expect(err.message).to.equal(i18n.t('tooMuchFood'));
+        done();
+      }
+    });
   });
 
   context('successful feeding', () => {
@@ -188,6 +212,61 @@ describe('shared.ops.feed', () => {
       expect(user.items.pets['Wolf-Base']).to.equal(7);
     });
 
+    it('evolves the pet into a mount when feeding user.items.pets[pet] >= 50 preferred food (bulk)', () => {
+      user.items.pets['Wolf-Base'] = 5;
+      user.items.food.Meat = 10;
+      user.items.currentPet = 'Wolf-Base';
+
+      const pet = content.petInfo['Wolf-Base'];
+
+      const [data, message] = feed(user, { params: { pet: 'Wolf-Base', food: 'Meat' }, query: { amount: 9 } });
+      expect(data).to.eql(user.items.pets['Wolf-Base']);
+      expect(message).to.eql(i18n.t('messageEvolve', {
+        egg: pet.text(),
+      }));
+
+      expect(user.items.food.Meat).to.equal(1);
+      expect(user.items.pets['Wolf-Base']).to.equal(-1);
+      expect(user.items.mounts['Wolf-Base']).to.equal(true);
+      expect(user.items.currentPet).to.equal('');
+    });
+
+    it('evolves the pet into a mount when feeding user.items.pets[pet] >= 50 wrong food (bulk)', () => {
+      user.items.pets['Wolf-Base'] = 5;
+      user.items.food.Milk = 25;
+      user.items.currentPet = 'Wolf-Base';
+
+      const pet = content.petInfo['Wolf-Base'];
+
+      const [data, message] = feed(user, { params: { pet: 'Wolf-Base', food: 'Milk' }, query: { amount: 23 } });
+      expect(data).to.eql(user.items.pets['Wolf-Base']);
+      expect(message).to.eql(i18n.t('messageEvolve', {
+        egg: pet.text(),
+      }));
+      expect(user.items.food.Milk).to.equal(2);
+      expect(user.items.pets['Wolf-Base']).to.equal(-1);
+      expect(user.items.mounts['Wolf-Base']).to.equal(true);
+      expect(user.items.currentPet).to.equal('');
+    });
+
+    it('does not like the food (bulk low food) ', () => {
+      user.items.pets['Wolf-Base'] = 5;
+      user.items.food.Milk = 5;
+
+      const food = content.food.Milk;
+      const pet = content.petInfo['Wolf-Base'];
+
+      const [data, message] = feed(user, { params: { pet: 'Wolf-Base', food: 'Milk' }, query: { amount: 5 } });
+      expect(data).to.eql(user.items.pets['Wolf-Base']);
+      expect(message).to.eql(i18n.t('messageDontEnjoyFood', {
+        egg: pet.text(),
+        foodText: food.textThe(),
+      }));
+
+      expect(user.items.food.Milk).to.equal(0);
+      expect(user.items.pets['Wolf-Base']).to.equal(15);
+    });
+
     it('awards All Your Base achievement', () => {
       user.items.pets['Wolf-Spooky'] = 5;
       user.items.food.Milk = 2;

test/common/ops/spells.js

@@ -4,6 +4,7 @@ import {
 import spells from '../../../website/common/script/content/spells';
 import {
   NotAuthorized,
+  BadRequest,
 } from '../../../website/common/script/libs/errors';
 import i18n from '../../../website/common/script/i18n';
 
@@ -25,7 +26,7 @@ describe('shared.ops.spells', () => {
     const spell = spells.healer.heal;
 
     try {
-      spell.cast(user);
+      spell.cast(user, null, { language: 'en' });
     } catch (err) {
       expect(err).to.be.an.instanceof(NotAuthorized);
       expect(err.message).to.equal(i18n.t('messageHealthAlreadyMax'));
@@ -35,4 +36,22 @@ describe('shared.ops.spells', () => {
       done();
     }
   });
+
+  it('Issue #12361: returns an error if chilling frost has already been cast', done => {
+    user.stats.class = 'wizard';
+    user.stats.lvl = 15;
+    user.stats.mp = 400;
+    user.stats.buffs.streaks = true;
+
+    const spell = spells.wizard.frost;
+    try {
+      spell.cast(user, null, { language: 'en' });
+    } catch (err) {
+      expect(err).to.be.an.instanceof(BadRequest);
+      expect(err.message).to.equal(i18n.t('spellAlreadyCast'));
+      expect(user.stats.mp).to.eql(400);
+
+      done();
+    }
+  });
 });

test/common/ops/unequip.js

@@ -0,0 +1,100 @@
+/* eslint-disable camelcase */
+
+import {
+  generateUser,
+} from '../../helpers/common.helper';
+import {
+  UNEQUIP_ALL,
+  UNEQUIP_BACKGROUND,
+  UNEQUIP_COSTUME,
+  UNEQUIP_EQUIPPED,
+  UNEQUIP_PET_MOUNT,
+  unEquipByType,
+} from '../../../website/common/script/ops/unequip';
+
+describe('shared.ops.unequip', () => {
+  let user;
+
+  beforeEach(() => {
+    user = generateUser({
+      preferences: {
+        background: 'violet',
+      },
+      items: {
+        currentMount: 'BearCub-Base',
+        currentPet: 'BearCub-Base',
+        gear: {
+          owned: {
+            weapon_warrior_0: true,
+            weapon_warrior_1: true,
+            weapon_warrior_2: true,
+            weapon_wizard_1: true,
+            weapon_wizard_2: true,
+            shield_base_0: true,
+            shield_warrior_1: true,
+          },
+          equipped: {
+            weapon: 'weapon_warrior_2',
+            shield: 'shield_warrior_1',
+          },
+          costume: {
+            weapon: 'weapon_warrior_2',
+            shield: 'shield_warrior_1',
+          },
+        },
+      },
+      stats: { gp: 200 },
+    });
+  });
+
+  context('Gear', () => {
+    it('should unequip all battle gear items', () => {
+      unEquipByType(user, { params: { type: UNEQUIP_EQUIPPED } });
+
+      expect(user.items.gear.equipped.weapon).to.eq('weapon_base_0');
+      expect(user.items.gear.equipped.shield).to.eq('shield_base_0');
+    });
+  });
+
+  context('Costume', () => {
+    it('should unequip all costume items', () => {
+      unEquipByType(user, { params: { type: UNEQUIP_COSTUME } });
+
+      expect(user.items.gear.costume.weapon).to.eq('weapon_base_0');
+      expect(user.items.gear.costume.shield).to.eq('shield_base_0');
+    });
+  });
+
+  context('Pet and Mount', () => {
+    it('should unequip Pet and Mount', () => {
+      unEquipByType(user, { params: { type: UNEQUIP_PET_MOUNT } });
+
+      expect(user.items.currentMount).to.eq('');
+      expect(user.items.currentPet).to.eq('');
+    });
+  });
+
+  context('Background', () => {
+    it('should unequip Background', () => {
+      unEquipByType(user, { params: { type: UNEQUIP_BACKGROUND } });
+
+      expect(user.preferences.background).to.eq('');
+    });
+  });
+
+  context('All Items', () => {
+    it('should unequip all Items', () => {
+      unEquipByType(user, { params: { type: UNEQUIP_ALL } });
+
+      expect(user.items.gear.equipped.weapon).to.eq('weapon_base_0');
+      expect(user.items.gear.equipped.shield).to.eq('shield_base_0');
+
+      expect(user.items.gear.costume.weapon).to.eq('weapon_base_0');
+      expect(user.items.gear.costume.shield).to.eq('shield_base_0');
+
+      expect(user.items.currentMount).to.eq('');
+      expect(user.items.currentPet).to.eq('');
+      expect(user.preferences.background).to.eq('');
+    });
+  });
+});

test/common/shouldDo.test.js

@@ -5,6 +5,8 @@ import 'moment-recur';
 describe('shouldDo', () => {
   let day; let
     dailyTask;
+  // Options is a mapping of user.preferences, therefor `timezoneOffset` still holds old zone
+  // values instead of utcOffset values.
   let options = {};
   let nextDue = [];
 
@@ -80,17 +82,17 @@ describe('shouldDo', () => {
 
       it('returns true if the user\'s current time is after start date and Custom Day Start', () => {
         options.dayStart = 4;
-        day = moment().zone(options.timezoneOffset).startOf('day').add(6, 'hours')
+        day = moment().utcOffset(-options.timezoneOffset).startOf('day').add(6, 'hours')
           .toDate();
-        dailyTask.startDate = moment().zone(options.timezoneOffset).startOf('day').toDate();
+        dailyTask.startDate = moment().utcOffset(-options.timezoneOffset).startOf('day').toDate();
         expect(shouldDo(day, dailyTask, options)).to.equal(true);
       });
 
       it('returns false if the user\'s current time is before Custom Day Start', () => {
         options.dayStart = 8;
-        day = moment().zone(options.timezoneOffset).startOf('day').add(2, 'hours')
+        day = moment().utcOffset(-options.timezoneOffset).startOf('day').add(2, 'hours')
           .toDate();
-        dailyTask.startDate = moment().zone(options.timezoneOffset).startOf('day').toDate();
+        dailyTask.startDate = moment().utcOffset(-options.timezoneOffset).startOf('day').toDate();
         expect(shouldDo(day, dailyTask, options)).to.equal(false);
       });
     });
@@ -112,14 +114,14 @@ describe('shouldDo', () => {
 
       it('returns true if the user\'s current time is after Custom Day Start', () => {
         options.dayStart = 4;
-        day = moment().zone(options.timezoneOffset).startOf('day').add(6, 'hours')
+        day = moment().utcOffset(-options.timezoneOffset).startOf('day').add(6, 'hours')
           .toDate();
         expect(shouldDo(day, dailyTask, options)).to.equal(true);
       });
 
       it('returns false if the user\'s current time is before Custom Day Start', () => {
         options.dayStart = 8;
-        day = moment().zone(options.timezoneOffset).startOf('day').add(2, 'hours')
+        day = moment().utcOffset(-options.timezoneOffset).startOf('day').add(2, 'hours')
           .toDate();
         expect(shouldDo(day, dailyTask, options)).to.equal(false);
       });