4.241.0

Removed testing banner
Fixed a JS console error when assigning a user to a previously open task
Fixed a potential abuse where user might be able to score someone else's 
task via API call
Fixed an issue where finding tasks by alias could return tasks belonging 
to other users
Fixed an issue that was appending the user's party ID to their list of 
Guilds
Fixed an issue where group tasks were not receiving the default tag 
needed for filtering them on user's personal list

.eslintignore

@@ -8,10 +8,10 @@ website/client/
 website/common/transpiled-babel/
 dist/
 dist-client/
-apidoc_build/
+apidoc/html/
 content_cache/
 i18n_cache/
 node_modules/
 
 # Old migrations, disabled
-migrations/archive/*
+migrations/archive/*

.github/CONTRIBUTING.md

@@ -4,7 +4,7 @@
 
 # Pull Request
 
-[Please see these instructions for adding a pull request](http://habitica.fandom.com/wiki/Using_Your_Local_Install_to_Modify_Habitica%27s_Website_and_API)
+[Please see these instructions for adding a pull request](https://habitica.fandom.com/wiki/Using_Your_Local_Install_to_Modify_Habitica's_Website_and_API)
 
 # Requesting a feature
 
@@ -12,4 +12,4 @@ Habitica uses [this Google form](https://docs.google.com/forms/d/e/1FAIpQLScPhrw
 
 # Contributing Code
 
-See [Contributing to Habitica](http://habitica.fandom.com/wiki/Contributing_to_Habitica#Coders_.28Web_.26_Mobile.29)
+See [Contributing to Habitica](https://habitica.fandom.com/wiki/Contributing_to_Habitica#Coders_.28Web_.26_Mobile.29)

.github/ISSUE_TEMPLATE.md

@@ -1,20 +1,19 @@
-[//]: # (Before logging this issue, please post to the Report a Bug guild from the Habitica website's Help menu. Most bugs can be handled quickly there. If a GitHub issue is needed, you will be advised of that by a moderator or staff member -- a player with a dark blue or purple name. It is recommended that you don't create a new issue unless advised to.)
+[//]: # (Before logging this issue, please contact site administrators from "Report a Bug" in the Habitica website's Help menu. If a GitHub issue is needed, staff will let you know and will most likely log one on your behalf. It is recommended that you don't create a new issue unless advised to.)
 
-[//]: # (Bugs in the mobile apps can also be reported there.)
+[//]: # (Bugs in the mobile apps can be reported via Menu > About > Support.)
 
-[//]: # (If you have a feature request, use "Help > Request a Feature", not GitHub or the Report a Bug guild.)
+[//]: # (If you have a feature request, use "Help > Request a Feature", not GitHub.)
 
 [//]: # (For more guidelines see https://github.com/HabitRPG/habitica/issues/2760)
 
-[//]: # (Fill out relevant information - UUID is found from the Habitia website at User Icon > Settings > API)
+[//]: # (Fill out relevant information - UUID is found from the Habitica website at User Icon > Settings > API)
 ### General Info
-  * UUID: 
-  * Browser: 
-  * OS: 
+  * UUID:
+  * Browser:
+  * OS:
 
 ### Description
 [//]: # (Describe bug in detail here. Include screenshots if helpful.)
 
 #### Console Errors
 [//]: # (Include any JavaScript console errors here.)
-

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,4 +1,4 @@
-[//]: # (Note: See http://habitica.fandom.com/wiki/Using_Your_Local_Install_to_Modify_Habitica%27s_Website_and_API for more info)
+[//]: # (Note: See https://habitica.fandom.com/wiki/Using_Your_Local_Install_to_Modify_Habitica%27s_Website_and_API for more info)
 
 [//]: # (Put Issue # here, if applicable. This will automatically close the issue if your PR is merged in)
 Fixes put_#_and_issue_number_here
@@ -11,4 +11,4 @@ Fixes put_#_and_issue_number_here
 [//]: # (Put User ID in here - found on the Habitica website at User Icon > Settings > API)
 
 ----
-UUID: 
+UUID:

.github/dependabot.yml

@@ -0,0 +1,186 @@
+version: 2
+updates:
+- package-ecosystem: npm
+  directory: "/"
+  schedule:
+    interval: weekly
+    time: "06:00"
+    timezone: Europe/Rome
+  open-pull-requests-limit: 99
+  ignore:
+  - dependency-name: express-validator
+    versions:
+    - 6.10.0
+    - 6.10.1
+    - 6.9.2
+  - dependency-name: "@babel/core"
+    versions:
+    - 7.12.13
+    - 7.12.16
+    - 7.12.17
+    - 7.13.1
+    - 7.13.10
+    - 7.13.13
+    - 7.13.14
+    - 7.13.15
+    - 7.13.8
+  - dependency-name: redis
+    versions:
+    - 3.1.0
+  - dependency-name: stripe
+    versions:
+    - 8.134.0
+    - 8.135.0
+    - 8.137.0
+    - 8.138.0
+    - 8.140.0
+    - 8.142.0
+  - dependency-name: "@babel/register"
+    versions:
+    - 7.12.13
+    - 7.13.14
+    - 7.13.8
+  - dependency-name: mongoose
+    versions:
+    - 5.11.14
+    - 5.11.15
+    - 5.11.16
+    - 5.11.17
+    - 5.11.18
+    - 5.11.19
+    - 5.12.0
+    - 5.12.1
+    - 5.12.2
+    - 5.12.3
+  - dependency-name: jwks-rsa
+    versions:
+    - 1.12.3
+    - 2.0.1
+    - 2.0.2
+  - dependency-name: "@babel/preset-env"
+    versions:
+    - 7.12.13
+    - 7.12.16
+    - 7.12.17
+    - 7.13.10
+    - 7.13.12
+    - 7.13.8
+    - 7.13.9
+  - dependency-name: image-size
+    versions:
+    - 0.9.4
+    - 0.9.5
+    - 0.9.7
+  - dependency-name: winston-loggly-bulk
+    versions:
+    - 3.2.0
+  - dependency-name: chai
+    versions:
+    - 4.3.0
+    - 4.3.3
+  - dependency-name: mocha
+    versions:
+    - 8.2.1
+    - 8.3.0
+    - 8.3.1
+  - dependency-name: "@google-cloud/trace-agent"
+    versions:
+    - 5.1.2
+  - dependency-name: monk
+    versions:
+    - 7.3.3
+- package-ecosystem: npm
+  directory: "/website/client"
+  schedule:
+    interval: weekly
+    time: "06:00"
+    timezone: Europe/Rome
+  open-pull-requests-limit: 99
+  ignore:
+  - dependency-name: eslint-plugin-vue
+    versions:
+    - 7.5.0
+    - 7.6.0
+    - 7.7.0
+    - 7.8.0
+    - 7.9.0
+  - dependency-name: "@storybook/addon-knobs"
+    versions:
+    - 6.1.17
+    - 6.1.18
+    - 6.1.20
+    - 6.1.21
+    - 6.2.2
+    - 6.2.3
+    - 6.2.7
+  - dependency-name: "@storybook/addon-links"
+    versions:
+    - 6.1.17
+    - 6.1.18
+    - 6.1.20
+    - 6.1.21
+    - 6.2.2
+    - 6.2.3
+    - 6.2.7
+  - dependency-name: "@storybook/vue"
+    versions:
+    - 6.1.17
+    - 6.1.18
+    - 6.1.20
+    - 6.1.21
+    - 6.2.2
+    - 6.2.3
+    - 6.2.7
+  - dependency-name: "@storybook/addon-actions"
+    versions:
+    - 6.1.17
+    - 6.1.18
+    - 6.1.20
+    - 6.1.21
+    - 6.2.2
+    - 6.2.3
+    - 6.2.7
+  - dependency-name: core-js
+    versions:
+    - 3.10.0
+    - 3.10.1
+    - 3.9.0
+    - 3.9.1
+  - dependency-name: bootstrap
+    versions:
+    - 4.6.0
+  - dependency-name: y18n
+    versions:
+    - 4.0.1
+  - dependency-name: hellojs
+    versions:
+    - 1.18.8
+    - 1.19.2
+  - dependency-name: chai
+    versions:
+    - 4.3.0
+    - 4.3.3
+  - dependency-name: amplitude-js
+    versions:
+    - 7.4.2
+    - 7.4.3
+    - 7.4.4
+  - dependency-name: pug
+    versions:
+    - 3.0.2
+  - dependency-name: sass
+    versions:
+    - 1.32.6
+    - 1.32.7
+    - 1.32.8
+  - dependency-name: "@vue/test-utils"
+    versions:
+    - 1.1.2
+    - 1.1.3
+  - dependency-name: intro.js
+    versions:
+    - 3.2.1
+    - 3.3.1
+  - dependency-name: sass-loader
+    versions:
+    - 10.1.1

.github/workflows/test.yml

@@ -219,4 +219,25 @@ jobs:
         CI: true
         NODE_ENV: test
     - run: npm run test:unit
-      working-directory: ./website/client
+      working-directory: ./website/client
+
+  production-build:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node-version: [14.x]
+    steps:
+    - uses: actions/checkout@v1
+      with:
+        fetch-depth: 1
+    - name: Use Node.js ${{ matrix.node-version }}
+      uses: actions/setup-node@v1
+      with:
+        node-version: ${{ matrix.node-version }}
+    - run: cp config.json.example config.json
+    - name: npm install
+      run: |
+        npm install
+      env:
+        CI: true
+        NODE_ENV: production

.gitignore

@@ -5,7 +5,7 @@ website/common/transpiled-babel/
 node_modules
 content_cache
 i18n_cache
-apidoc_build
+apidoc/html
 *.swp
 .idea*
 config.json

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "habitica-images"]
+	path = habitica-images
+	url = https://github.com/HabitRPG/habitica-images

.slugignore

@@ -0,0 +1,7 @@
+# Files not included in deployments to Heroku, to save on file size.
+
+/habitica-images
+/test
+/migrations
+/scripts
+/database_reports

Dockerfile

@@ -21,6 +21,7 @@ RUN npm install -g gulp-cli mocha
 RUN mkdir -p /usr/src/habitrpg
 WORKDIR /usr/src/habitrpg
 RUN git clone --branch release --depth 1 https://github.com/HabitRPG/habitica.git /usr/src/habitrpg
+RUN git config --global url."https://".insteadOf git://
 RUN npm set unsafe-perm true
 RUN npm install
 

README.md

@@ -4,11 +4,11 @@ Habitica ![Build Status](https://github.com/HabitRPG/habitica/workflows/Test/bad
 [Habitica](https://habitica.com) is an open source habit building program which treats your life like a Role Playing Game. Level up as you succeed, lose HP as you fail, earn money to buy weapons and armor.
 
 **We need more programmers!** Your assistance will be greatly appreciated. The wiki pages below and the additional pages they link to will tell you how to get started on contributing code and where you can go to seek further help or ask questions:
-* [Guidance for Blacksmiths](http://habitica.fandom.com/wiki/Guidance_for_Blacksmiths) - an introduction to the technologies used and how the software is organized.
-* [Setting up Habitica Locally](http://habitica.fandom.com/wiki/Setting_up_Habitica_Locally) - how to set up a local install of Habitica for development and testing on various platforms.
+* [Guidance for Blacksmiths](https://habitica.fandom.com/wiki/Guidance_for_Blacksmiths) - an introduction to the technologies used and how the software is organized.
+* [Setting up Habitica Locally](https://habitica.fandom.com/wiki/Setting_up_Habitica_Locally) - how to set up a local install of Habitica for development and testing on various platforms.
 
 Habitica's code is licensed as described at https://github.com/HabitRPG/habitica/blob/develop/LICENSE
 
-**Found a bug?** Please report it in the [Report a Bug guild](https://habitica.com/groups/guild/a29da26b-37de-4a71-b0c6-48e72a900dac) rather than creating an issue (an admin will advise you if a new issue is necessary; usually it is not).
+**Found a bug?** Please report it to [admin email](mailto:admin@habitica.com) rather than creating an issue (an admin will advise you if a new issue is necessary; usually it is not).
 
 **Have any questions about Habitica or its community?** See the links in the [habitica.com](https://habitica.com) website's Help menu or drop in to [Guilds > Tavern Chat](https://habitica.com/groups/tavern) to ask questions or chat socially!

apidoc/apidoc.json

@@ -2,6 +2,7 @@
   "name": "Habitica V3 API Documentation",
   "title": "Habitica",
   "url": "https://habitica.com",
+  "sampleUrl": null,
   "header": {
     "title": "Introduction",
     "filename": "apidoc/header.md"

apidoc/header.md

@@ -2,4 +2,4 @@
 
 This webpage includes the documentation for version 3 of the [Habitica](https://habitica.com) API.
 
-If you're developing a 3rd party tool that uses the Habitica API you should read the [Guidance for Comrades](https://habitica.fandom.com/wiki/Guidance_for_Comrades) and in particular the section called [Rules for Third-Party Tools](https://habitica.fandom.com/wiki/Guidance_for_Comrades#Rules_for_Third-Party_Tools) which includes suggestions on how to best use the API and the rules to follow when interacting with it. 
+If you're developing a 3rd party tool that uses the Habitica API you should read the [Guidance for Comrades](https://habitica.fandom.com/wiki/Guidance_for_Comrades) and in particular the section called [Rules for Third-Party Tools](https://habitica.fandom.com/wiki/Guidance_for_Comrades#Rules_for_Third-Party_Tools) which includes suggestions on how to best use the API and the rules to follow when interacting with it.

config.json.example

@@ -1,4 +1,5 @@
 {
+  "ACCOUNT_MIN_CHAT_AGE": "0",
   "ADMIN_EMAIL": "you@example.com",
   "AMAZON_PAYMENTS_CLIENT_ID": "CLIENT_ID",
   "AMAZON_PAYMENTS_MODE": "sandbox",

database_reports/count_users_who_own_specified_gear.js

@@ -119,7 +119,7 @@ function path(obj, path, def) {
  * @param {String} path dot separated
  * @param {*} def default value ( if result undefined )
  * @returns {*}
- * http://stackoverflow.com/a/16190716
+ * https://stackoverflow.com/a/16190716
  * Usage: console.log(path(someObject, pathname));
  */
     for(var i = 0,path = path.split('.'),len = path.length; i < len; i++){

gulp/gulp-apidoc.js

@@ -2,8 +2,9 @@ import gulp from 'gulp';
 import clean from 'rimraf';
 import apidoc from 'apidoc';
 
-const APIDOC_DEST_PATH = './apidoc_build';
+const APIDOC_DEST_PATH = './apidoc/html';
 const APIDOC_SRC_PATH = './website/server';
+const APIDOC_CONFIG_PATH = './apidoc/apidoc.json';
 gulp.task('apidoc:clean', done => {
   clean(APIDOC_DEST_PATH, done);
 });
@@ -12,6 +13,7 @@ gulp.task('apidoc', gulp.series('apidoc:clean', done => {
   const result = apidoc.createDoc({
     src: APIDOC_SRC_PATH,
     dest: APIDOC_DEST_PATH,
+    config: APIDOC_CONFIG_PATH,
   });
 
   if (result === false) {

gulp/gulp-sprites.js

@@ -1,16 +1,8 @@
 import gulp from 'gulp';
-import imagemin from 'gulp-imagemin';
 import spritesmith from 'gulp.spritesmith';
 import clean from 'rimraf';
-import sizeOf from 'image-size';
 import mergeStream from 'merge-stream';
-import { basename } from 'path';
 import { sync } from 'glob';
-import { each } from 'lodash';
-import vinylBuffer from 'vinyl-buffer';
-
-// https://github.com/Ensighten/grunt-spritesmith/issues/67#issuecomment-34786248
-const MAX_SPRITESHEET_SIZE = 1024 * 1024 * 3;
 
 const IMG_DIST_PATH = 'website/client/src/assets/images/sprites/';
 const CSS_DIST_PATH = 'website/client/src/assets/css/sprites/';
@@ -20,49 +12,6 @@ function checkForSpecialTreatment (name) {
   return name.match(regex) || name === 'head_0';
 }
 
-function calculateImgDimensions (img, addPadding) {
-  let dims = sizeOf(img);
-
-  const requiresSpecialTreatment = checkForSpecialTreatment(img);
-  if (requiresSpecialTreatment) {
-    const newWidth = dims.width < 90 ? 90 : dims.width;
-    const newHeight = dims.height < 90 ? 90 : dims.height;
-    dims = {
-      width: newWidth,
-      height: newHeight,
-    };
-  }
-
-  let padding = 0;
-
-  if (addPadding) {
-    padding = dims.width * 8 + dims.height * 8;
-  }
-
-  if (!dims.width || !dims.height) console.error('MISSING DIMENSIONS:', dims); // eslint-disable-line no-console
-
-  const totalPixelSize = dims.width * dims.height + padding;
-
-  return totalPixelSize;
-}
-
-function calculateSpritesheetsSrcIndicies (src) {
-  let totalPixels = 0;
-  const slices = [0];
-
-  each(src, (img, index) => {
-    const imageSize = calculateImgDimensions(img, true);
-    totalPixels += imageSize;
-
-    if (totalPixels > MAX_SPRITESHEET_SIZE) {
-      slices.push(index - 1);
-      totalPixels = imageSize;
-    }
-  });
-
-  return slices;
-}
-
 function cssVarMap (sprite) {
   // For hair, skins, beards, etc. we want to output a '.customize-options.WHATEVER' class,
   // which works as a 60x60 image pointing at the proper part of the 90x90 sprite.
@@ -71,94 +20,56 @@ function cssVarMap (sprite) {
   if (requiresSpecialTreatment) {
     sprite.custom = {
       px: {
-        offsetX: `-${sprite.x + 25}px`,
-        offsetY: `-${sprite.y + 15}px`,
+        offsetX: '-25px',
+        offsetY: '-15px',
         width: '60px',
         height: '60px',
       },
     };
   }
-  if (sprite.name.indexOf('shirt') !== -1) sprite.custom.px.offsetY = `-${sprite.y + 35}px`; // even more for shirts
+
+  // even more for shirts
+  if (sprite.name.indexOf('shirt') !== -1) {
+    sprite.custom.px.offsetX = '-29px';
+    sprite.custom.px.offsetY = '-42px';
+  }
+
   if (sprite.name.indexOf('hair_base') !== -1) {
     const styleArray = sprite.name.split('_').slice(2, 3);
-    if (Number(styleArray[0]) > 14) sprite.custom.px.offsetY = `-${sprite.y}px`; // don't crop updos
+    if (Number(styleArray[0]) > 14) {
+      sprite.custom.px.offsetY = '0'; // don't crop updos
+    }
   }
 }
 
 function createSpritesStream (name, src) {
-  const spritesheetSliceIndicies = calculateSpritesheetsSrcIndicies(src);
   const stream = mergeStream();
 
-  each(spritesheetSliceIndicies, (start, index) => {
-    const slicedSrc = src.slice(start, spritesheetSliceIndicies[index + 1]);
+  const spriteData = gulp.src(src)
+    .pipe(spritesmith({
+      imgName: `spritesmith-${name}.png`,
+      cssName: `spritesmith-${name}.css`,
+      algorithm: 'binary-tree',
+      padding: 1,
+      cssTemplate: 'website/raw_sprites/css/css.template.handlebars',
+      cssVarMap,
+    }));
 
-    const spriteData = gulp.src(slicedSrc)
-      .pipe(spritesmith({
-        imgName: `spritesmith-${name}-${index}.png`,
-        cssName: `spritesmith-${name}-${index}.css`,
-        algorithm: 'binary-tree',
-        padding: 1,
-        cssTemplate: 'website/raw_sprites/css/css.template.handlebars',
-        cssVarMap,
-      }));
+  const cssStream = spriteData.css
+    .pipe(gulp.dest(CSS_DIST_PATH));
 
-    const imgStream = spriteData.img
-      .pipe(vinylBuffer())
-      .pipe(imagemin())
-      .pipe(gulp.dest(IMG_DIST_PATH));
-
-    const cssStream = spriteData.css
-      .pipe(gulp.dest(CSS_DIST_PATH));
-
-    stream.add(imgStream);
-    stream.add(cssStream);
-  });
+  stream.add(cssStream);
 
   return stream;
 }
 
 gulp.task('sprites:main', () => {
-  const mainSrc = sync('website/raw_sprites/spritesmith/**/*.png');
+  const mainSrc = sync('habitica-images/**/*.png');
   return createSpritesStream('main', mainSrc);
 });
 
-gulp.task('sprites:largeSprites', () => {
-  const largeSrc = sync('website/raw_sprites/spritesmith_large/**/*.png');
-  return createSpritesStream('largeSprites', largeSrc);
-});
-
 gulp.task('sprites:clean', done => {
   clean(`${IMG_DIST_PATH}spritesmith*,${CSS_DIST_PATH}spritesmith*}`, done);
 });
 
-gulp.task('sprites:checkCompiledDimensions', gulp.series('sprites:main', 'sprites:largeSprites', done => {
-  console.log('Verifiying that images do not exceed max dimensions'); // eslint-disable-line no-console
-
-  let numberOfSheetsThatAreTooBig = 0;
-
-  const distSpritesheets = sync(`${IMG_DIST_PATH}*.png`);
-
-  each(distSpritesheets, img => {
-    const spriteSize = calculateImgDimensions(img);
-
-    if (spriteSize > MAX_SPRITESHEET_SIZE) {
-      numberOfSheetsThatAreTooBig += 1;
-      const name = basename(img, '.png');
-      console.error(`WARNING: ${name} might be too big - ${spriteSize} > ${MAX_SPRITESHEET_SIZE}`); // eslint-disable-line no-console
-    }
-  });
-
-  if (numberOfSheetsThatAreTooBig > 0) {
-    // https://github.com/HabitRPG/habitica/pull/6683#issuecomment-185462180
-    console.error( // eslint-disable-line no-console
-      `${numberOfSheetsThatAreTooBig} sheets might too big for mobile Safari to be able to handle
-      them, but there is a margin of error in these calculations so it is probably okay. Mention
-      this to an admin so they can test a staging site on mobile Safari after your PR is merged.`,
-    );
-  } else {
-    console.log('All images are within the correct dimensions'); // eslint-disable-line no-console
-  }
-  done();
-}));
-
-gulp.task('sprites:compile', gulp.series('sprites:clean', 'sprites:checkCompiledDimensions', done => done()));
+gulp.task('sprites:compile', gulp.series('sprites:clean', 'sprites:main', done => done()));

migrations/archive/2013/20131028_task_subdocs_tags_invites.js

@@ -2,7 +2,7 @@
 
 // TODO it might be better we just find() and save() all user objects using mongoose, and rely on our defined pre('save')
 // and default values to "migrate" users. This way we can make sure those parts are working properly too
-// @see http://stackoverflow.com/questions/14867697/mongoose-full-collection-scan
+// @see https://stackoverflow.com/questions/14867697/mongoose-full-collection-scan
 // Also, what do we think of a Mongoose Migration module? something like https://github.com/madhums/mongoose-migrate
 
 // IMPORTANT NOTE: this migration was written when we were using version 3 of lodash.

migrations/archive/2017/20170111_announce_collection_quest_change_in_parties.js

@@ -19,7 +19,7 @@ const Timer = require('./utils/timer');
 const connectToDb = require('./utils/connect').connectToDb;
 const closeDb = require('./utils/connect').closeDb;
 
-const message = '`This party\'s collection quest has been made easier! For details, refer to http://habitica.fandom.com/wiki/User_blog:LadyAlys/Collection_Quests_are_Now_Easier`';
+const message = '`This party\'s collection quest has been made easier! For details, refer to https://habitica.fandom.com/wiki/User_blog:LadyAlys/Collection_Quests_are_Now_Easier`';
 
 const timer = new Timer();
 

migrations/archive/2021/20210525_pet_color_achievements.js

@@ -0,0 +1,82 @@
+/* eslint-disable no-console */
+const MIGRATION_NAME = '20210525_pet_color_achievements';
+import { model as User } from '../../../website/server/models/user';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count++;
+
+  const set = {
+    migration: MIGRATION_NAME,
+  };
+
+  if (user && user.items && user.items.pets) {
+    const pets = user.items.pets;
+    if (pets['Wolf-CottonCandyBlue'] > 0
+      && pets['TigerCub-CottonCandyBlue'] > 0
+      && pets['PandaCub-CottonCandyBlue'] > 0
+      && pets['LionCub-CottonCandyBlue'] > 0
+      && pets['Fox-CottonCandyBlue'] > 0
+      && pets['FlyingPig-CottonCandyBlue'] > 0
+      && pets['Dragon-CottonCandyBlue'] > 0
+      && pets['Cactus-CottonCandyBlue'] > 0
+      && pets['BearCub-CottonCandyBlue'] > 0) {
+        set['achievements.violetsAreBlue'] = true;
+      }
+  }
+
+  if (user && user.items && user.items.mounts) {
+    const mounts = user.items.mounts;
+    if (mounts['Wolf-CottonCandyBlue']
+      && mounts['TigerCub-CottonCandyBlue']
+      && mounts['PandaCub-CottonCandyBlue']
+      && mounts['LionCub-CottonCandyBlue']
+      && mounts['Fox-CottonCandyBlue']
+      && mounts['FlyingPig-CottonCandyBlue']
+      && mounts['Dragon-CottonCandyBlue']
+      && mounts['Cactus-CottonCandyBlue']
+      && mounts['BearCub-CottonCandyBlue'] ) {
+        set['achievements.wildBlueYonder'] = true;
+      }
+  }
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+
+  return await User.update({ _id: user._id }, { $set: set }).exec();
+}
+
+module.exports = async function processUsers () {
+  let query = {
+    migration: { $ne: MIGRATION_NAME },
+    'auth.timestamps.loggedin': { $gt: new Date('2021-05-01') },
+  };
+
+  const fields = {
+    _id: 1,
+    items: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1]._id,
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};

migrations/archive/2021/20210824_pet_group_achievements.js

@@ -0,0 +1,138 @@
+/* eslint-disable no-console */
+const MIGRATION_NAME = '20210824_pet_group_achievements';
+import { model as User } from '../../../website/server/models/user';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count++;
+
+  const set = {
+    migration: MIGRATION_NAME,
+  };
+
+  if (user && user.items && user.items.pets) {
+    const pets = user.items.pets;
+    if (pets['FlyingPig-Base']
+      && pets['FlyingPig-CottonCandyBlue']
+      && pets['FlyingPig-CottonCandyPink']
+      && pets['FlyingPig-Desert']
+      && pets['FlyingPig-Golden']
+      && pets['FlyingPig-Red']
+      && pets['FlyingPig-Shade']
+      && pets['FlyingPig-Skeleton']
+      && pets['FlyingPig-White']
+      && pets['FlyingPig-Zombie']
+      && pets['Ferret-Base']
+      && pets['Ferret-CottonCandyBlue']
+      && pets['Ferret-CottonCandyPink']
+      && pets['Ferret-Desert']
+      && pets['Ferret-Golden']
+      && pets['Ferret-Red']
+      && pets['Ferret-Shade']
+      && pets['Ferret-Skeleton']
+      && pets['Ferret-White']
+      && pets['Ferret-Zombie']
+      && pets['GuineaPig-Base']
+      && pets['GuineaPig-CottonCandyBlue']
+      && pets['GuineaPig-CottonCandyPink']
+      && pets['GuineaPig-Desert']
+      && pets['GuineaPig-Golden']
+      && pets['GuineaPig-Red']
+      && pets['GuineaPig-Shade']
+      && pets['GuineaPig-Skeleton']
+      && pets['GuineaPig-White']
+      && pets['GuineaPig-Zombie']
+      && pets['Rooster-Base']
+      && pets['Rooster-CottonCandyBlue']
+      && pets['Rooster-CottonCandyPink']
+      && pets['Rooster-Desert']
+      && pets['Rooster-Golden']
+      && pets['Rooster-Red']
+      && pets['Rooster-Shade']
+      && pets['Rooster-Skeleton']
+      && pets['Rooster-White']
+      && pets['Rooster-Zombie']
+      && pets['Rat-Base']
+      && pets['Rat-CottonCandyBlue']
+      && pets['Rat-CottonCandyPink']
+      && pets['Rat-Desert']
+      && pets['Rat-Golden']
+      && pets['Rat-Red']
+      && pets['Rat-Shade']
+      && pets['Rat-Skeleton']
+      && pets['Rat-White']
+      && pets['Rat-Zombie']
+      && pets['Bunny-Base']
+      && pets['Bunny-CottonCandyBlue']
+      && pets['Bunny-CottonCandyPink']
+      && pets['Bunny-Desert']
+      && pets['Bunny-Golden']
+      && pets['Bunny-Red']
+      && pets['Bunny-Shade']
+      && pets['Bunny-Skeleton']
+      && pets['Bunny-White']
+      && pets['Bunny-Zombie']
+      && pets['Horse-Base']
+      && pets['Horse-CottonCandyBlue']
+      && pets['Horse-CottonCandyPink']
+      && pets['Horse-Desert']
+      && pets['Horse-Golden']
+      && pets['Horse-Red']
+      && pets['Horse-Shade']
+      && pets['Horse-Skeleton']
+      && pets['Horse-White']
+      && pets['Horse-Zombie']
+      && pets['Cow-Base']
+      && pets['Cow-CottonCandyBlue']
+      && pets['Cow-CottonCandyPink']
+      && pets['Cow-Desert']
+      && pets['Cow-Golden']
+      && pets['Cow-Red']
+      && pets['Cow-Shade']
+      && pets['Cow-Skeleton']
+      && pets['Cow-White']
+      && pets['Cow-Zombie']) {
+        set['achievements.domesticated'] = true;
+      }
+  }
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+
+  return await User.update({ _id: user._id }, { $set: set }).exec();
+}
+
+export default async function processUsers () {
+  let query = {
+    // migration: { $ne: MIGRATION_NAME },
+    'auth.timestamps.loggedin': { $gt: new Date('2021-08-01') },
+  };
+
+  const fields = {
+    _id: 1,
+    items: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1]._id,
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};

migrations/archive/2021/20211021_pet_color_achievements.js

@@ -0,0 +1,82 @@
+/* eslint-disable no-console */
+const MIGRATION_NAME = '20211021_pet_color_achievements';
+import { model as User } from '../../../website/server/models/user';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count++;
+
+  const set = {
+    migration: MIGRATION_NAME,
+  };
+
+  if (user && user.items && user.items.pets) {
+    const pets = user.items.pets;
+    if (pets['Wolf-Shade'] > 0
+      && pets['TigerCub-Shade'] > 0
+      && pets['PandaCub-Shade'] > 0
+      && pets['LionCub-Shade'] > 0
+      && pets['Fox-Shade'] > 0
+      && pets['FlyingPig-Shade'] > 0
+      && pets['Dragon-Shade'] > 0
+      && pets['Cactus-Shade'] > 0
+      && pets['BearCub-Shade'] > 0) {
+        set['achievements.shadyCustomer'] = true;
+      }
+  }
+
+  if (user && user.items && user.items.mounts) {
+    const mounts = user.items.mounts;
+    if (mounts['Wolf-Shade']
+      && mounts['TigerCub-Shade']
+      && mounts['PandaCub-Shade']
+      && mounts['LionCub-Shade']
+      && mounts['Fox-Shade']
+      && mounts['FlyingPig-Shade']
+      && mounts['Dragon-Shade']
+      && mounts['Cactus-Shade']
+      && mounts['BearCub-Shade'] ) {
+        set['achievements.shadeOfItAll'] = true;
+      }
+  }
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+
+  return await User.update({ _id: user._id }, { $set: set }).exec();
+}
+
+export default async function processUsers () {
+  let query = {
+    migration: { $ne: MIGRATION_NAME },
+    'auth.timestamps.loggedin': { $gt: new Date('2021-10-01') },
+  };
+
+  const fields = {
+    _id: 1,
+    items: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1]._id,
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};

migrations/archive/2021/20211028_habitoween_ladder.js

@@ -0,0 +1,86 @@
+/*
+ * Award Habitoween ladder items to participants in this month's Habitoween festivities
+ */
+/* eslint-disable no-console */
+
+const MIGRATION_NAME = '20211028_habitoween_ladder'; // Update when running in future years
+
+import { model as User } from '../../../website/server/models/user';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count++;
+
+  const set = {};
+  const inc = {
+    'items.food.Candy_Skeleton': 1,
+    'items.food.Candy_Base': 1,
+    'items.food.Candy_CottonCandyBlue': 1,
+    'items.food.Candy_CottonCandyPink': 1,
+    'items.food.Candy_Shade': 1,
+    'items.food.Candy_White': 1,
+    'items.food.Candy_Golden': 1,
+    'items.food.Candy_Zombie': 1,
+    'items.food.Candy_Desert': 1,
+    'items.food.Candy_Red': 1,
+  };
+
+  set.migration = MIGRATION_NAME;
+
+  if (user && user.items && user.items.pets && user.items.pets['JackOLantern-RoyalPurple']) {
+    set['items.mounts.JackOLantern-RoyalPurple'] = true;
+  } else if (user && user.items && user.items.mounts && user.items.mounts['JackOLantern-Glow']) {
+    set['items.pets.JackOLantern-RoyalPurple'] = 5;
+  } else if (user && user.items && user.items.pets && user.items.pets['JackOLantern-Glow']) {
+    set['items.mounts.JackOLantern-Glow'] = true;
+  } else if (user && user.items && user.items.mounts && user.items.mounts['JackOLantern-Ghost']) {
+    set['items.pets.JackOLantern-Glow'] = 5;
+  } else if (user && user.items && user.items.pets && user.items.pets['JackOLantern-Ghost']) {
+    set['items.mounts.JackOLantern-Ghost'] = true;
+  } else if (user && user.items && user.items.mounts && user.items.mounts['JackOLantern-Base']) {
+    set['items.pets.JackOLantern-Ghost'] = 5;
+  } else if (user && user.items && user.items.pets && user.items.pets['JackOLantern-Base']) {
+    set['items.mounts.JackOLantern-Base'] = true;
+  } else {
+    set['items.pets.JackOLantern-Base'] = 5;
+  }
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+  return await User.update({_id: user._id}, {$inc: inc, $set: set}).exec();
+}
+
+export default async function processUsers () {
+  let query = {
+    migration: {$ne: MIGRATION_NAME},
+    'auth.timestamps.loggedin': {$gt: new Date('2021-10-01')},
+  };
+
+  const fields = {
+    _id: 1,
+    items: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1],
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};

migrations/archive/2021/20211124_harvest_feast.js

@@ -0,0 +1,126 @@
+/* eslint-disable no-console */
+const MIGRATION_NAME = '20211124_harvest_feast';
+import { v4 as uuid } from 'uuid';
+import { model as User } from '../../../website/server/models/user';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count++;
+
+  const set = {};
+  let inc;
+  let push;
+
+  set.migration = MIGRATION_NAME;
+
+  if (typeof user.items.gear.owned.head_special_turkeyHelmGilded !== 'undefined') {
+    inc = {
+      'items.food.Pie_Base': 1,
+      'items.food.Pie_CottonCandyBlue': 1,
+      'items.food.Pie_CottonCandyPink': 1,
+      'items.food.Pie_Desert': 1,
+      'items.food.Pie_Golden': 1,
+      'items.food.Pie_Red': 1,
+      'items.food.Pie_Shade': 1,
+      'items.food.Pie_Skeleton': 1,
+      'items.food.Pie_Zombie': 1,
+      'items.food.Pie_White': 1,
+    }
+  } else if (typeof user.items.gear.owned.armor_special_turkeyArmorBase !== 'undefined') {
+    set['items.gear.owned.head_special_turkeyHelmGilded'] = false;
+    set['items.gear.owned.armor_special_turkeyArmorGilded'] = false;
+    set['items.gear.owned.back_special_turkeyTailGilded'] = false;
+    push = [
+      {
+        type: 'marketGear',
+        path: 'gear.flat.head_special_turkeyHelmGilded',
+        _id: uuid(),
+      },
+      {
+        type: 'marketGear',
+        path: 'gear.flat.armor_special_turkeyArmorGilded',
+        _id: uuid(),
+      },
+      {
+        type: 'marketGear',
+        path: 'gear.flat.back_special_turkeyTailGilded',
+        _id: uuid(),
+      },
+    ];
+  } else if (user.items && user.items.mounts && user.items.mounts['Turkey-Gilded']) {
+    set['items.gear.owned.head_special_turkeyHelmBase'] = false;
+    set['items.gear.owned.armor_special_turkeyArmorBase'] = false;
+    set['items.gear.owned.back_special_turkeyTailBase'] = false;
+    push = [
+      {
+        type: 'marketGear',
+        path: 'gear.flat.head_special_turkeyHelmBase',
+        _id: uuid(),
+      },
+      {
+        type: 'marketGear',
+        path: 'gear.flat.armor_special_turkeyArmorBase',
+        _id: uuid(),
+      },
+      {
+        type: 'marketGear',
+        path: 'gear.flat.back_special_turkeyTailBase',
+        _id: uuid(),
+      },
+    ];
+  } else if (user.items && user.items.pets && user.items.pets['Turkey-Gilded']) {
+    set['items.mounts.Turkey-Gilded'] = true;
+  } else if (user.items && user.items.mounts && user.items.mounts['Turkey-Base']) {
+    set['items.pets.Turkey-Gilded'] = 5;
+  } else if (user.items && user.items.pets && user.items.pets['Turkey-Base']) {
+    set['items.mounts.Turkey-Base'] = true;
+  } else {
+    set['items.pets.Turkey-Base'] = 5;
+  }
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+
+  if (inc) {
+    return await User.update({_id: user._id}, {$inc: inc, $set: set}).exec();
+  } else if (push) {
+    return await User.update({_id: user._id}, {$set: set, $push: {pinnedItems: {$each: push}}}).exec();
+  } else {
+    return await User.update({_id: user._id}, {$set: set}).exec();
+  }
+}
+
+export default async function processUsers () {
+  let query = {
+    migration: {$ne: MIGRATION_NAME},
+    'auth.timestamps.loggedin': {$gt: new Date('2021-11-01')},
+  };
+
+  const fields = {
+    _id: 1,
+    items: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1],
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};

migrations/archive/2021/20211230_nye.js

@@ -0,0 +1,135 @@
+/* eslint-disable no-console */
+const MIGRATION_NAME = '20211230_nye';
+import { model as User } from '../../../website/server/models/user';
+import { v4 as uuid } from 'uuid';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count++;
+
+  const set = { migration: MIGRATION_NAME };
+  let push;
+
+  if (typeof user.items.gear.owned.head_special_nye2020 !== 'undefined') {
+    set['items.gear.owned.head_special_nye2021'] = false;
+    push = [
+      {
+        type: 'marketGear',
+        path: 'gear.flat.head_special_nye2021',
+        _id: uuid(),
+      },
+    ];
+  } else if (typeof user.items.gear.owned.head_special_nye2019 !== 'undefined') {
+    set['items.gear.owned.head_special_nye2020'] = false;
+    push = [
+      {
+        type: 'marketGear',
+        path: 'gear.flat.head_special_nye2020',
+        _id: uuid(),
+      },
+    ];
+  } else if (typeof user.items.gear.owned.head_special_nye2018 !== 'undefined') {
+    set['items.gear.owned.head_special_nye2019'] = false;
+    push = [
+      {
+        type: 'marketGear',
+        path: 'gear.flat.head_special_nye2019',
+        _id: uuid(),
+      },
+    ];
+  } else if (typeof user.items.gear.owned.head_special_nye2017 !== 'undefined') {
+    set['items.gear.owned.head_special_nye2018'] = false;
+    push = [
+      {
+        type: 'marketGear',
+        path: 'gear.flat.head_special_nye2018',
+        _id: uuid(),
+      },
+    ];
+  } else if (typeof user.items.gear.owned.head_special_nye2016 !== 'undefined') {
+    set['items.gear.owned.head_special_nye2017'] = false;
+    push = [
+      {
+        type: 'marketGear',
+        path: 'gear.flat.head_special_nye2017',
+        _id: uuid(),
+      },
+    ];
+  } else if (typeof user.items.gear.owned.head_special_nye2015 !== 'undefined') {
+    set['items.gear.owned.head_special_nye2016'] = false;
+    push = [
+      {
+        type: 'marketGear',
+        path: 'gear.flat.head_special_nye2016',
+        _id: uuid(),
+      },
+    ];
+  } else if (typeof user.items.gear.owned.head_special_nye2014 !== 'undefined') {
+    set['items.gear.owned.head_special_nye2015'] = false;
+    push = [
+      {
+        type: 'marketGear',
+        path: 'gear.flat.head_special_nye2015',
+        _id: uuid(),
+      },
+    ];
+  } else if (typeof user.items.gear.owned.head_special_nye !== 'undefined') {
+    set['items.gear.owned.head_special_nye2014'] = false;
+    push = [
+      {
+        type: 'marketGear',
+        path: 'gear.flat.head_special_nye2014',
+        _id: uuid(),
+      },
+    ];
+  } else {
+    set['items.gear.owned.head_special_nye'] = false;
+    push = [
+      {
+        type: 'marketGear',
+        path: 'gear.flat.head_special_nye',
+        _id: uuid(),
+      },
+    ];
+  }
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+
+  return await User.update({_id: user._id}, {$set: set, $push: {pinnedItems: {$each: push}}}).exec();
+}
+
+export default async function processUsers () {
+  let query = {
+    'auth.timestamps.loggedin': {$gt: new Date('2021-12-01')},
+    migration: {$ne: MIGRATION_NAME},
+  };
+
+  const fields = {
+    _id: 1,
+    items: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1],
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};

migrations/archive/2022/20220131_habit_birthday.js

@@ -0,0 +1,97 @@
+/* eslint-disable no-console */
+const MIGRATION_NAME = '20220131_habit_birthday';
+import { v4 as uuid } from 'uuid';
+
+import { model as User } from '../../../website/server/models/user';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count++;
+
+  const inc = {
+    'items.food.Cake_Skeleton': 1,
+    'items.food.Cake_Base': 1,
+    'items.food.Cake_CottonCandyBlue': 1,
+    'items.food.Cake_CottonCandyPink': 1,
+    'items.food.Cake_Shade': 1,
+    'items.food.Cake_White': 1,
+    'items.food.Cake_Golden': 1,
+    'items.food.Cake_Zombie': 1,
+    'items.food.Cake_Desert': 1,
+    'items.food.Cake_Red': 1,
+    'achievements.habitBirthdays': 1,
+  };
+  const set = {};
+  let push;
+
+  set.migration = MIGRATION_NAME;
+
+  if (typeof user.items.gear.owned.armor_special_birthday2021 !== 'undefined') {
+    set['items.gear.owned.armor_special_birthday2022'] = false;
+    push = {pinnedItems: {type: 'marketGear', path: 'gear.flat.armor_special_birthday2022', _id: uuid()}};
+  } else if (typeof user.items.gear.owned.armor_special_birthday2020 !== 'undefined') {
+    set['items.gear.owned.armor_special_birthday2021'] = false;
+    push = {pinnedItems: {type: 'marketGear', path: 'gear.flat.armor_special_birthday2021', _id: uuid()}};
+  } else if (typeof user.items.gear.owned.armor_special_birthday2019 !== 'undefined') {
+    set['items.gear.owned.armor_special_birthday2020'] = false;
+    push = {pinnedItems: {type: 'marketGear', path: 'gear.flat.armor_special_birthday2020', _id: uuid()}};
+  } else if (typeof user.items.gear.owned.armor_special_birthday2018 !== 'undefined') {
+    set['items.gear.owned.armor_special_birthday2019'] = false;
+    push = {pinnedItems: {type: 'marketGear', path: 'gear.flat.armor_special_birthday2019', _id: uuid()}};
+  } else if (typeof user.items.gear.owned.armor_special_birthday2017 !== 'undefined') {
+    set['items.gear.owned.armor_special_birthday2018'] = false;
+    push = {pinnedItems: {type: 'marketGear', path: 'gear.flat.armor_special_birthday2018', _id: uuid()}};
+  } else if (typeof user.items.gear.owned.armor_special_birthday2016 !== 'undefined') {
+    set['items.gear.owned.armor_special_birthday2017'] = false;
+    push = {pinnedItems: {type: 'marketGear', path: 'gear.flat.armor_special_birthday2017', _id: uuid()}};
+  } else if (typeof user.items.gear.owned.armor_special_birthday2015 !== 'undefined') {
+    set['items.gear.owned.armor_special_birthday2016'] = false;
+    push = {pinnedItems: {type: 'marketGear', path: 'gear.flat.armor_special_birthday2016', _id: uuid()}};
+  } else if (typeof user.items.gear.owned.armor_special_birthday !== 'undefined') {
+    set['items.gear.owned.armor_special_birthday2015'] = false;
+    push = {pinnedItems: {type: 'marketGear', path: 'gear.flat.armor_special_birthday2015', _id: uuid()}};
+  } else {
+    set['items.gear.owned.armor_special_birthday'] = false;
+    push = {pinnedItems: {type: 'marketGear', path: 'gear.flat.armor_special_birthday', _id: uuid()}};
+  }
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+
+  return await User.update({_id: user._id}, {$inc: inc, $set: set, $push: push}).exec();
+}
+
+export default async function processUsers () {
+  let query = {
+    migration: {$ne: MIGRATION_NAME},
+    'auth.timestamps.loggedin': {$gt: new Date('2022-01-01')},
+  };
+
+  const fields = {
+    _id: 1,
+    items: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1],
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};

migrations/archive/2022/20220201_pet_group_achievements.js

@@ -0,0 +1,178 @@
+/* eslint-disable no-console */
+const MIGRATION_NAME = '20220201_pet_group_achievements';
+import { model as User } from '../../../website/server/models/user';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count++;
+
+  const set = {
+    migration: MIGRATION_NAME,
+  };
+
+  if (user && user.items && user.items.pets) {
+    const pets = user.items.pets;
+    if (pets['FlyingPig-Base']
+      && pets['FlyingPig-CottonCandyBlue']
+      && pets['FlyingPig-CottonCandyPink']
+      && pets['FlyingPig-Desert']
+      && pets['FlyingPig-Golden']
+      && pets['FlyingPig-Red']
+      && pets['FlyingPig-Shade']
+      && pets['FlyingPig-Skeleton']
+      && pets['FlyingPig-White']
+      && pets['FlyingPig-Zombie']
+      && pets['Snake-Base']
+      && pets['Snake-CottonCandyBlue']
+      && pets['Snake-CottonCandyPink']
+      && pets['Snake-Desert']
+      && pets['Snake-Golden']
+      && pets['Snake-Red']
+      && pets['Snake-Shade']
+      && pets['Snake-Skeleton']
+      && pets['Snake-White']
+      && pets['Snake-Zombie']
+      && pets['Sheep-Base']
+      && pets['Sheep-CottonCandyBlue']
+      && pets['Sheep-CottonCandyPink']
+      && pets['Sheep-Desert']
+      && pets['Sheep-Golden']
+      && pets['Sheep-Red']
+      && pets['Sheep-Shade']
+      && pets['Sheep-Skeleton']
+      && pets['Sheep-White']
+      && pets['Sheep-Zombie']
+      && pets['Rooster-Base']
+      && pets['Rooster-CottonCandyBlue']
+      && pets['Rooster-CottonCandyPink']
+      && pets['Rooster-Desert']
+      && pets['Rooster-Golden']
+      && pets['Rooster-Red']
+      && pets['Rooster-Shade']
+      && pets['Rooster-Skeleton']
+      && pets['Rooster-White']
+      && pets['Rooster-Zombie']
+      && pets['Rat-Base']
+      && pets['Rat-CottonCandyBlue']
+      && pets['Rat-CottonCandyPink']
+      && pets['Rat-Desert']
+      && pets['Rat-Golden']
+      && pets['Rat-Red']
+      && pets['Rat-Shade']
+      && pets['Rat-Skeleton']
+      && pets['Rat-White']
+      && pets['Rat-Zombie']
+      && pets['Bunny-Base']
+      && pets['Bunny-CottonCandyBlue']
+      && pets['Bunny-CottonCandyPink']
+      && pets['Bunny-Desert']
+      && pets['Bunny-Golden']
+      && pets['Bunny-Red']
+      && pets['Bunny-Shade']
+      && pets['Bunny-Skeleton']
+      && pets['Bunny-White']
+      && pets['Bunny-Zombie']
+      && pets['Horse-Base']
+      && pets['Horse-CottonCandyBlue']
+      && pets['Horse-CottonCandyPink']
+      && pets['Horse-Desert']
+      && pets['Horse-Golden']
+      && pets['Horse-Red']
+      && pets['Horse-Shade']
+      && pets['Horse-Skeleton']
+      && pets['Horse-White']
+      && pets['Horse-Zombie']
+      && pets['Cow-Base']
+      && pets['Cow-CottonCandyBlue']
+      && pets['Cow-CottonCandyPink']
+      && pets['Cow-Desert']
+      && pets['Cow-Golden']
+      && pets['Cow-Red']
+      && pets['Cow-Shade']
+      && pets['Cow-Skeleton']
+      && pets['Cow-White']
+      && pets['Cow-Zombie']
+      && pets['Monkey-Base']
+      && pets['Monkey-CottonCandyBlue']
+      && pets['Monkey-CottonCandyPink']
+      && pets['Monkey-Desert']
+      && pets['Monkey-Golden']
+      && pets['Monkey-Red']
+      && pets['Monkey-Shade']
+      && pets['Monkey-Skeleton']
+      && pets['Monkey-White']
+      && pets['Monkey-Zombie']
+      && pets['Wolf-Base']
+      && pets['Wolf-CottonCandyBlue']
+      && pets['Wolf-CottonCandyPink']
+      && pets['Wolf-Desert']
+      && pets['Wolf-Golden']
+      && pets['Wolf-Red']
+      && pets['Wolf-Shade']
+      && pets['Wolf-Skeleton']
+      && pets['Wolf-White']
+      && pets['Wolf-Zombie']
+      && pets['Tiger-Base']
+      && pets['Tiger-CottonCandyBlue']
+      && pets['Tiger-CottonCandyPink']
+      && pets['Tiger-Desert']
+      && pets['Tiger-Golden']
+      && pets['Tiger-Red']
+      && pets['Tiger-Shade']
+      && pets['Tiger-Skeleton']
+      && pets['Tiger-White']
+      && pets['Tiger-Zombie']
+      && pets['Dragon-Base']
+      && pets['Dragon-CottonCandyBlue']
+      && pets['Dragon-CottonCandyPink']
+      && pets['Dragon-Desert']
+      && pets['Dragon-Golden']
+      && pets['Dragon-Red']
+      && pets['Dragon-Shade']
+      && pets['Dragon-Skeleton']
+      && pets['Dragon-White']
+      && pets['Dragon-Zombie']) {
+        set['achievements.zodiacZookeeper'] = true;
+      }
+  }
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+
+  return await User.update({ _id: user._id }, { $set: set }).exec();
+}
+
+export default async function processUsers () {
+  let query = {
+    // migration: { $ne: MIGRATION_NAME },
+    'auth.timestamps.loggedin': { $gt: new Date('2021-08-01') },
+  };
+
+  const fields = {
+    _id: 1,
+    items: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1]._id,
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};

migrations/archive/2022/20220309_pet_group_achievements.js

@@ -0,0 +1,138 @@
+/* eslint-disable no-console */
+const MIGRATION_NAME = '20220309_pet_group_achievements';
+import { model as User } from '../../../website/server/models/user';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count++;
+
+  const set = {
+    migration: MIGRATION_NAME,
+  };
+
+  if (user && user.items && user.items.pets) {
+    const pets = user.items.pets;
+    if (pets['FlyingPig-Base']
+      && pets['FlyingPig-CottonCandyBlue']
+      && pets['FlyingPig-CottonCandyPink']
+      && pets['FlyingPig-Desert']
+      && pets['FlyingPig-Golden']
+      && pets['FlyingPig-Red']
+      && pets['FlyingPig-Shade']
+      && pets['FlyingPig-Skeleton']
+      && pets['FlyingPig-White']
+      && pets['FlyingPig-Zombie']
+      && pets['Owl-Base']
+      && pets['Owl-CottonCandyBlue']
+      && pets['Owl-CottonCandyPink']
+      && pets['Owl-Desert']
+      && pets['Owl-Golden']
+      && pets['Owl-Red']
+      && pets['Owl-Shade']
+      && pets['Owl-Skeleton']
+      && pets['Owl-White']
+      && pets['Owl-Zombie']
+      && pets['Parrot-Base']
+      && pets['Parrot-CottonCandyBlue']
+      && pets['Parrot-CottonCandyPink']
+      && pets['Parrot-Desert']
+      && pets['Parrot-Golden']
+      && pets['Parrot-Red']
+      && pets['Parrot-Shade']
+      && pets['Parrot-Skeleton']
+      && pets['Parrot-White']
+      && pets['Parrot-Zombie']
+      && pets['Rooster-Base']
+      && pets['Rooster-CottonCandyBlue']
+      && pets['Rooster-CottonCandyPink']
+      && pets['Rooster-Desert']
+      && pets['Rooster-Golden']
+      && pets['Rooster-Red']
+      && pets['Rooster-Shade']
+      && pets['Rooster-Skeleton']
+      && pets['Rooster-White']
+      && pets['Rooster-Zombie']
+      && pets['Pterodactyl-Base']
+      && pets['Pterodactyl-CottonCandyBlue']
+      && pets['Pterodactyl-CottonCandyPink']
+      && pets['Pterodactyl-Desert']
+      && pets['Pterodactyl-Golden']
+      && pets['Pterodactyl-Red']
+      && pets['Pterodactyl-Shade']
+      && pets['Pterodactyl-Skeleton']
+      && pets['Pterodactyl-White']
+      && pets['Pterodactyl-Zombie']
+      && pets['Gryphon-Base']
+      && pets['Gryphon-CottonCandyBlue']
+      && pets['Gryphon-CottonCandyPink']
+      && pets['Gryphon-Desert']
+      && pets['Gryphon-Golden']
+      && pets['Gryphon-Red']
+      && pets['Gryphon-Shade']
+      && pets['Gryphon-Skeleton']
+      && pets['Gryphon-White']
+      && pets['Gryphon-Zombie']
+      && pets['Falcon-Base']
+      && pets['Falcon-CottonCandyBlue']
+      && pets['Falcon-CottonCandyPink']
+      && pets['Falcon-Desert']
+      && pets['Falcon-Golden']
+      && pets['Falcon-Red']
+      && pets['Falcon-Shade']
+      && pets['Falcon-Skeleton']
+      && pets['Falcon-White']
+      && pets['Falcon-Zombie']
+      && pets['Peacock-Base']
+      && pets['Peacock-CottonCandyBlue']
+      && pets['Peacock-CottonCandyPink']
+      && pets['Peacock-Desert']
+      && pets['Peacock-Golden']
+      && pets['Peacock-Red']
+      && pets['Peacock-Shade']
+      && pets['Peacock-Skeleton']
+      && pets['Peacock-White']
+      && pets['Peacock-Zombie']) {
+        set['achievements.birdsOfAFeather'] = true;
+      }
+  }
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+
+  return await User.update({ _id: user._id }, { $set: set }).exec();
+}
+
+export default async function processUsers () {
+  let query = {
+    // migration: { $ne: MIGRATION_NAME },
+    'auth.timestamps.loggedin': { $gt: new Date('2021-08-01') },
+  };
+
+  const fields = {
+    _id: 1,
+    items: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1]._id,
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};

migrations/archive/2022/20220524_pet_group_achievements.js

@@ -0,0 +1,128 @@
+/* eslint-disable no-console */
+const MIGRATION_NAME = '20220524_pet_group_achievements';
+import { model as User } from '../../../website/server/models/user';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count++;
+
+  const set = {
+    migration: MIGRATION_NAME,
+  };
+
+  if (user && user.items && user.items.pets) {
+    const pets = user.items.pets;
+    if (pets['Alligator-Base']
+      && pets['Alligator-CottonCandyBlue']
+      && pets['Alligator-CottonCandyPink']
+      && pets['Alligator-Desert']
+      && pets['Alligator-Golden']
+      && pets['Alligator-Red']
+      && pets['Alligator-Shade']
+      && pets['Alligator-Skeleton']
+      && pets['Alligator-White']
+      && pets['Alligator-Zombie']
+      && pets['Snake-Base']
+      && pets['Snake-CottonCandyBlue']
+      && pets['Snake-CottonCandyPink']
+      && pets['Snake-Desert']
+      && pets['Snake-Golden']
+      && pets['Snake-Red']
+      && pets['Snake-Shade']
+      && pets['Snake-Skeleton']
+      && pets['Snake-White']
+      && pets['Snake-Zombie']
+      && pets['Triceratops-Base']
+      && pets['Triceratops-CottonCandyBlue']
+      && pets['Triceratops-CottonCandyPink']
+      && pets['Triceratops-Desert']
+      && pets['Triceratops-Golden']
+      && pets['Triceratops-Red']
+      && pets['Triceratops-Shade']
+      && pets['Triceratops-Skeleton']
+      && pets['Triceratops-White']
+      && pets['Triceratops-Zombie']
+      && pets['TRex-Base']
+      && pets['TRex-CottonCandyBlue']
+      && pets['TRex-CottonCandyPink']
+      && pets['TRex-Desert']
+      && pets['TRex-Golden']
+      && pets['TRex-Red']
+      && pets['TRex-Shade']
+      && pets['TRex-Skeleton']
+      && pets['TRex-White']
+      && pets['TRex-Zombie']
+      && pets['Pterodactyl-Base']
+      && pets['Pterodactyl-CottonCandyBlue']
+      && pets['Pterodactyl-CottonCandyPink']
+      && pets['Pterodactyl-Desert']
+      && pets['Pterodactyl-Golden']
+      && pets['Pterodactyl-Red']
+      && pets['Pterodactyl-Shade']
+      && pets['Pterodactyl-Skeleton']
+      && pets['Pterodactyl-White']
+      && pets['Pterodactyl-Zombie']
+      && pets['Turtle-Base']
+      && pets['Turtle-CottonCandyBlue']
+      && pets['Turtle-CottonCandyPink']
+      && pets['Turtle-Desert']
+      && pets['Turtle-Golden']
+      && pets['Turtle-Red']
+      && pets['Turtle-Shade']
+      && pets['Turtle-Skeleton']
+      && pets['Turtle-White']
+      && pets['Turtle-Zombie']
+      && pets['Velociraptor-Base']
+      && pets['Velociraptor-CottonCandyBlue']
+      && pets['Velociraptor-CottonCandyPink']
+      && pets['Velociraptor-Desert']
+      && pets['Velociraptor-Golden']
+      && pets['Velociraptor-Red']
+      && pets['Velociraptor-Shade']
+      && pets['Velociraptor-Skeleton']
+      && pets['Velociraptor-White']
+      && pets['Velociraptor-Zombie']) {
+        set['achievements.reptacularRumble'] = true;
+      }
+  }
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+
+  return await User.update({ _id: user._id }, { $set: set }).exec();
+}
+
+export default async function processUsers () {
+  let query = {
+    // migration: { $ne: MIGRATION_NAME },
+    'auth.timestamps.loggedin': { $gt: new Date('2022-01-01') },
+  };
+
+  const fields = {
+    _id: 1,
+    items: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1]._id,
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};

migrations/archive/s3-upload.js

@@ -16,7 +16,7 @@ AWS.config.update({
 const BUCKET_NAME = config.S3.bucket;
 const s3 = new AWS.S3();
 
-// Adapted from http://stackoverflow.com/a/22210077/2601552
+// Adapted from https://stackoverflow.com/a/22210077/2601552
 function uploadFile (buffer, fileName) {
   return new Promise((resolve, reject) => {
     s3.putObject({

migrations/command-line/cancelSubscription.js

@@ -2,7 +2,7 @@
 
 // For some reason people often to contact me to cancel their sub,
 // rather than do it online. Even when I point them to
-// the FAQ (http://goo.gl/1uoPGQ) they insist...
+// the FAQ (https://habitica.fandom.com/wiki/FAQ) they insist...
 
 db.users.update(
   { _id: '' },

migrations/tasks/team-tasks-v2.js

@@ -0,0 +1,68 @@
+import filter from 'lodash/filter';
+import find from 'lodash/find';
+import isArray from 'lodash/isArray';
+import { model as Group } from '../../website/server/models/group';
+import { model as User } from '../../website/server/models/user';
+import * as Tasks from '../../website/server/models/task';
+
+async function updateTeamTasks (team) {
+  const toSave = [];
+  const teamTasks = await Tasks.Task.find({
+    'group.id': team._id,
+  }).exec();
+
+  const teamBoardTasks = filter(teamTasks, task => !task.userId);
+  const teamUserTasks = filter(teamTasks, task => task.userId);
+
+  for (const boardTask of teamBoardTasks) {
+    if (isArray(boardTask.group.assignedUsers)) {
+      boardTask.group.approval = undefined;
+      boardTask.group.assignedDate = undefined;
+      boardTask.group.assigningUsername = undefined;
+      boardTask.group.sharedCompletion = undefined;
+
+      for (const assignedUserId of boardTask.group.assignedUsers) {
+        const assignedUser = await User.findById(assignedUserId, 'auth'); // eslint-disable-line no-await-in-loop
+        const userTask = find(teamUserTasks, task => task.userId === assignedUserId
+           && task.group.taskId === boardTask._id);
+        if (!boardTask.group.assignedUsersDetail) boardTask.group.assignedUsersDetail = {};
+        if (userTask) {
+          boardTask.group.assignedUsersDetail[assignedUserId] = {
+            assignedDate: userTask.group.assignedDate,
+            assignedUsername: assignedUser.auth.local.username,
+            assigningUsername: userTask.group.assigningUsername,
+            completed: userTask.completed || false,
+            completedDate: userTask.dateCompleted,
+          };
+          toSave.push(Tasks.Task.findByIdAndDelete(userTask._id));
+        } else {
+          boardTask.group.assignedUsersDetail[assignedUserId] = {
+            assignedDate: new Date(),
+            assignedUsername: assignedUser.auth.local.username,
+            assigningUsername: null,
+            completed: false,
+            completedDate: null,
+          };
+        }
+      }
+      boardTask.markModified('group');
+      toSave.push(boardTask.save());
+    }
+  }
+
+  return Promise.all(toSave);
+}
+
+export default async function processTeams () {
+  const activeTeams = await Group.find({
+    'purchased.plan.customerId': { $exists: true },
+    $or: [
+      { 'purchased.plan.dateTerminated': { $exists: false } },
+      { 'purchased.plan.dateTerminated': null },
+      { 'purchased.plan.dateTerminated': { $gt: new Date() } },
+    ],
+  }).exec();
+
+  const taskPromises = activeTeams.map(updateTeamTasks);
+  return Promise.all(taskPromises);
+}

migrations/users/pi-day.js

@@ -3,13 +3,13 @@ import { v4 as uuid } from 'uuid';
 
 import { model as User } from '../../website/server/models/user';
 
-const MIGRATION_NAME = '20200314_pi_day';
+const MIGRATION_NAME = '20220314_pi_day';
 
 const progressCount = 1000;
 let count = 0;
 
 async function updateUser (user) {
-  count *= 1;
+  count += 1;
 
   const inc = {
     'items.food.Pie_Skeleton': 1,
@@ -54,7 +54,7 @@ async function updateUser (user) {
 export default async function processUsers () {
   const query = {
     migration: { $ne: MIGRATION_NAME },
-    'auth.timestamps.loggedin': { $gt: new Date('2020-02-15') },
+    'auth.timestamps.loggedin': { $gt: new Date('2022-02-15') },
   };
 
   const fields = {

package.json

@@ -1,80 +1,81 @@
 {
   "name": "habitica",
   "description": "A habit tracker app which treats your goals like a Role Playing Game.",
-  "version": "4.183.1",
+  "version": "4.241.0",
   "main": "./website/server/index.js",
   "dependencies": {
-    "@babel/core": "^7.12.10",
-    "@babel/preset-env": "^7.12.11",
-    "@babel/register": "^7.12.10",
-    "@google-cloud/trace-agent": "^5.1.1",
-    "@parse/node-apn": "^4.0.0",
-    "@slack/webhook": "^5.0.4",
-    "accepts": "^1.3.5",
-    "amazon-payments": "^0.2.8",
-    "amplitude": "^5.1.4",
-    "apidoc": "^0.26.0",
+    "@babel/core": "^7.18.10",
+    "@babel/preset-env": "^7.18.10",
+    "@babel/register": "^7.18.9",
+    "@google-cloud/trace-agent": "^5.1.6",
+    "@parse/node-apn": "^5.1.3",
+    "@slack/webhook": "^6.1.0",
+    "accepts": "^1.3.8",
+    "amazon-payments": "^0.2.9",
+    "amplitude": "^6.0.0",
+    "apidoc": "^0.52.0",
     "apple-auth": "^1.0.7",
-    "bcrypt": "^5.0.0",
-    "body-parser": "^1.18.3",
+    "bcrypt": "^5.0.1",
+    "body-parser": "^1.20.0",
+    "bootstrap": "^4.6.0",
     "compression": "^1.7.4",
-    "cookie-session": "^1.4.0",
+    "cookie-session": "^2.0.0",
     "coupon-code": "^0.4.5",
-    "csv-stringify": "^5.6.1",
+    "csv-stringify": "^5.6.5",
     "cwait": "^1.1.1",
     "domain-middleware": "~0.1.0",
     "eslint": "^6.8.0",
     "eslint-config-habitrpg": "^6.2.0",
     "eslint-plugin-mocha": "^5.0.0",
-    "express": "^4.16.3",
-    "express-basic-auth": "^1.1.5",
+    "express": "^4.18.1",
+    "express-basic-auth": "^1.2.1",
     "express-validator": "^5.2.0",
-    "glob": "^7.1.6",
-    "got": "^11.8.1",
+    "glob": "^8.0.3",
+    "got": "^11.8.3",
     "gulp": "^4.0.0",
     "gulp-babel": "^8.0.0",
     "gulp-imagemin": "^7.1.0",
     "gulp-nodemon": "^2.5.0",
-    "gulp.spritesmith": "^6.9.0",
+    "gulp.spritesmith": "^6.13.0",
     "habitica-markdown": "^3.0.0",
-    "helmet": "^4.4.1",
-    "image-size": "^0.9.3",
+    "helmet": "^4.6.0",
+    "image-size": "^1.0.2",
     "in-app-purchase": "^1.11.3",
-    "js2xmlparser": "^4.0.1",
+    "js2xmlparser": "^4.0.2",
     "jsonwebtoken": "^8.5.1",
-    "jwks-rsa": "^1.12.2",
-    "lodash": "^4.17.20",
+    "jwks-rsa": "^2.1.4",
+    "lodash": "^4.17.21",
     "merge-stream": "^2.0.0",
     "method-override": "^3.0.0",
-    "moment": "^2.29.1",
+    "moment": "^2.29.4",
     "moment-recur": "^1.0.7",
-    "mongoose": "^5.11.13",
+    "mongoose": "^5.13.7",
     "morgan": "^1.10.0",
-    "nconf": "^0.11.1",
-    "node-gcm": "^1.0.3",
+    "nconf": "^0.12.0",
+    "node-gcm": "^1.0.5",
     "on-headers": "^1.0.2",
-    "passport": "^0.4.1",
+    "passport": "^0.5.0",
     "passport-facebook": "^3.0.0",
     "passport-google-oauth2": "^0.2.0",
-    "passport-google-oauth20": "1.0.0",
+    "passport-google-oauth20": "2.0.0",
     "paypal-rest-sdk": "^1.8.1",
     "pp-ipn": "^1.1.0",
     "ps-tree": "^1.0.0",
-    "rate-limiter-flexible": "^2.2.1",
-    "redis": "^3.0.2",
-    "regenerator-runtime": "^0.13.7",
-    "remove-markdown": "^0.3.0",
+    "rate-limiter-flexible": "^2.3.7",
+    "redis": "^3.1.2",
+    "regenerator-runtime": "^0.13.9",
+    "remove-markdown": "^0.5.0",
     "rimraf": "^3.0.2",
-    "short-uuid": "^4.1.0",
-    "stripe": "^8.132.0",
-    "superagent": "^6.1.0",
-    "universal-analytics": "^0.4.23",
+    "short-uuid": "^4.2.0",
+    "stripe": "^8.222.0",
+    "superagent": "^7.1.6",
+    "universal-analytics": "^0.5.3",
     "useragent": "^2.1.9",
     "uuid": "^8.3.2",
-    "validator": "^13.5.2",
+    "validator": "^13.7.0",
     "vinyl-buffer": "^1.0.1",
-    "winston": "^3.3.3",
-    "winston-loggly-bulk": "^3.1.1",
+    "winston": "^3.8.1",
+    "winston-loggly-bulk": "^3.2.1",
     "xml2js": "^0.4.23"
   },
   "private": true,
@@ -105,24 +106,24 @@
     "start": "gulp nodemon",
     "debug": "gulp nodemon --inspect",
     "mongo:dev": "run-rs -v 4.2.8 -l ubuntu1804 --keep --dbpath mongodb-data --number 1 --quiet",
-    "postinstall": "gulp build && cd website/client && npm install",
+    "postinstall": "git config --global url.\"https://\".insteadOf git:// && gulp build && cd website/client && npm install",
     "apidoc": "gulp apidoc"
   },
   "devDependencies": {
-    "axios": "^0.21.1",
-    "chai": "^4.1.2",
+    "axios": "^0.27.2",
+    "chai": "^4.3.6",
     "chai-as-promised": "^7.1.1",
     "chai-moment": "^0.1.0",
-    "chalk": "^4.1.0",
+    "chalk": "^4.1.2",
     "cross-spawn": "^7.0.3",
     "expect.js": "^0.3.1",
     "istanbul": "^1.1.0-alpha.1",
     "mocha": "^5.1.1",
-    "monk": "^7.3.2",
+    "monk": "^7.3.4",
     "require-again": "^2.0.0",
-    "run-rs": "^0.7.4",
-    "sinon": "^9.2.4",
-    "sinon-chai": "^3.5.0",
+    "run-rs": "^0.7.7",
+    "sinon": "^13.0.2",
+    "sinon-chai": "^3.7.0",
     "sinon-stub-promise": "^4.0.0"
   },
   "optionalDependencies": {}

scripts/gdpr-delete-users.js

@@ -31,7 +31,6 @@ async function deleteAmplitudeData (userId, email) {
       console.log(`${userId} (${email}) Amplitude response: ${response.status} ${response.statusText}`);
     }
   }
-  await new Promise(resolve => setTimeout(resolve, 1000));
 }
 
 async function deleteHabiticaData (user, email) {
@@ -41,7 +40,7 @@ async function deleteHabiticaData (user, email) {
     'auth.local.passwordHashMethod': 'bcrypt',
   };
   if (!user.auth.local.email) set['auth.local.email'] = `${user._id}@example.com`;
-  await User.update(
+  await User.updateOne(
     { _id: user._id },
     { $set: set },
   );
@@ -83,6 +82,7 @@ async function processEmailAddress (email) {
       $or: [
         { 'auth.facebook.emails.value': email },
         { 'auth.google.emails.value': email },
+        { 'auth.apple.emails.value': email },
       ],
     },
     { _id: 1, apiToken: 1, auth: 1 },
@@ -96,6 +96,7 @@ async function processEmailAddress (email) {
     return console.log(`No users found with email address ${email}`);
   }
 
+  await new Promise(resolve => setTimeout(resolve, 1000));
   return Promise.all(users.map(user => (async () => {
     await deleteAmplitudeData(user._id, email); // eslint-disable-line no-await-in-loop
     await deleteHabiticaData(user, email); // eslint-disable-line no-await-in-loop

scripts/team-cron.js

@@ -0,0 +1,105 @@
+import forEach from 'lodash/forEach';
+import { model as Group } from '../website/server/models/group';
+import { model as User } from '../website/server/models/user';
+import * as Tasks from '../website/server/models/task';
+import { daysSince, shouldDo } from '../website/common/script/cron';
+
+const TASK_VALUE_CHANGE_FACTOR = 0.9747;
+const MIN_TASK_VALUE = -47.27;
+
+async function updateTeamTasks (team) {
+  const toSave = [];
+  let teamLeader = await User.findOne({ _id: team.leader }, 'preferences').exec();
+
+  if (!teamLeader) { // why would this happen?
+    teamLeader = {
+      preferences: { }, // when options are sanitized this becomes CDS 0 at UTC
+    };
+  }
+
+  if (
+    !team.cron || !team.cron.lastProcessed
+    || daysSince(team.cron.lastProcessed, teamLeader.preferences) > 0
+  ) {
+    const tasks = await Tasks.Task.find({
+      'group.id': team._id,
+      userId: { $exists: false },
+      $or: [
+        { type: 'todo', completed: false },
+        { type: { $in: ['habit', 'daily'] } },
+      ],
+    }).exec();
+
+    const tasksByType = {
+      habits: [], dailys: [], todos: [], rewards: [],
+    };
+    forEach(tasks, task => tasksByType[`${task.type}s`].push(task));
+
+    forEach(tasksByType.habits, habit => {
+      if (!(habit.up && habit.down) && habit.value !== 0) {
+        habit.value *= 0.5;
+        if (Math.abs(habit.value) < 0.1) habit.value = 0;
+        toSave.push(habit.save());
+      }
+    });
+    forEach(tasksByType.todos, todo => {
+      if (!todo.completed) {
+        const delta = TASK_VALUE_CHANGE_FACTOR ** todo.value;
+        todo.value -= delta;
+        if (todo.value < MIN_TASK_VALUE) todo.value = MIN_TASK_VALUE;
+        toSave.push(todo.save());
+      }
+    });
+    forEach(tasksByType.dailys, daily => {
+      let processChecklist = false;
+      let assignments = 0;
+      let completions = 0;
+      for (const assignedUser in daily.group.assignedUsersDetail) {
+        if (Object.prototype.hasOwnProperty.call(daily.group.assignedUsersDetail, assignedUser)) {
+          assignments += 1;
+          if (daily.group.assignedUsersDetail[assignedUser].completed) {
+            completions += 1;
+            daily.group.assignedUsersDetail[assignedUser].completed = false;
+          }
+        }
+      }
+      if (completions > 0) daily.markModified('group.assignedUsersDetail');
+      if (daily.completed) {
+        processChecklist = true;
+        daily.completed = false;
+      } else if (shouldDo(team.cron.lastProcessed, daily, teamLeader.preferences)) {
+        processChecklist = true;
+        const delta = TASK_VALUE_CHANGE_FACTOR ** daily.value;
+        if (assignments > 0) {
+          daily.value -= ((completions / assignments) * delta);
+        }
+        if (daily.value < MIN_TASK_VALUE) daily.value = MIN_TASK_VALUE;
+      }
+      daily.isDue = shouldDo(new Date(), daily, teamLeader.preferences);
+      if (processChecklist && daily.checklist.length > 0) {
+        daily.checklist.forEach(i => { i.completed = false; });
+      }
+      toSave.push(daily.save());
+    });
+
+    if (!team.cron) team.cron = {};
+    team.cron.lastProcessed = new Date();
+    toSave.push(team.save());
+  }
+
+  return Promise.all(toSave);
+}
+
+export default async function processTeamsCron () {
+  const activeTeams = await Group.find({
+    'purchased.plan.customerId': { $exists: true },
+    $or: [
+      { 'purchased.plan.dateTerminated': { $exists: false } },
+      { 'purchased.plan.dateTerminated': null },
+      { 'purchased.plan.dateTerminated': { $gt: new Date() } },
+    ],
+  }).exec();
+
+  const cronPromises = activeTeams.map(updateTeamTasks);
+  return Promise.all(cronPromises);
+}

test/README.md

@@ -1 +1 @@
-For information about writing and running tests, see [Using Your Local Install to Modify Habitica's Website and API](http://habitica.fandom.com/wiki/Using_Your_Local_Install_to_Modify_Habitica%27s_Website_and_API).
+For information about writing and running tests, see [Using Your Local Install to Modify Habitica's Website and API](https://habitica.fandom.com/wiki/Using_Your_Local_Install_to_Modify_Habitica's_Website_and_API).

test/api/unit/libs/bug-report.test.js

@@ -0,0 +1,57 @@
+/* eslint-disable global-require */
+import nconf from 'nconf';
+import { generateUser } from '../../../helpers/api-unit.helper';
+import * as emailLib from '../../../../website/server/libs/email';
+import { bugReportLogic } from '../../../../website/server/libs/bug-report';
+
+describe('bug-report', () => {
+  beforeEach(() => {
+    sandbox.stub(emailLib, 'sendTxn').returns(Promise.resolve());
+
+    const nconfGetStub = sandbox.stub(nconf, 'get');
+    nconfGetStub.withArgs('ADMIN_EMAIL').returns('true');
+  });
+
+  afterEach(() => {
+    sandbox.restore();
+  });
+
+  it('sends a mail using sendTxn', async () => {
+    const userId = '2b58daeb-bc50-4a83-b5d3-4ac52c7c0608';
+    const userMail = 'me@me.com';
+    const userMessage = 'The power is over 9000, please fix it';
+    const userAgent = 'The UserAgent with a bunch of weird browser engine levels';
+
+    const user = generateUser({
+      _id: userId,
+    });
+
+    const result = await bugReportLogic(
+      user, userMail, userMessage, userAgent,
+    );
+
+    expect(emailLib.sendTxn).to.be.called;
+    expect(result).to.deep.equal({
+      sendMailResult: undefined,
+      emailData: {
+        BROWSER_UA: userAgent,
+        REPORT_MSG: userMessage,
+        USER_CLASS: 'warrior',
+        USER_CONSECUTIVE_MONTHS: 0,
+        USER_COSTUME: 'false',
+        USER_CUSTOMER_ID: undefined,
+        USER_CUSTOM_DAY: 0,
+        USER_DAILIES_PAUSED: 'false',
+        USER_EMAIL: userMail,
+        USER_HOURGLASSES: 0,
+        USER_ID: userId,
+        USER_LEVEL: 1,
+        USER_OFFSET_MONTHS: 0,
+        USER_PAYMENT_PLATFORM: undefined,
+        USER_SUBSCRIPTION: undefined,
+        USER_TIMEZONE_OFFSET: 0,
+        USER_USERNAME: undefined,
+      },
+    });
+  });
+});

test/api/unit/libs/email.test.js

@@ -148,9 +148,18 @@ describe('emails', () => {
     });
   });
 
-  describe('sendTxnEmail', () => {
+  describe('sendTxn', () => {
+    let sendTxn = null;
+
     beforeEach(() => {
       sandbox.stub(got, 'post').returns(defer().promise);
+
+      const nconfGetStub = sandbox.stub(nconf, 'get');
+      nconfGetStub.withArgs('IS_PROD').returns(true);
+      nconfGetStub.withArgs('BASE_URL').returns('BASE_URL');
+
+      const attachEmail = requireAgain(pathToEmailLib);
+      sendTxn = attachEmail.sendTxn;
     });
 
     afterEach(() => {
@@ -158,16 +167,14 @@ describe('emails', () => {
     });
 
     it('can send a txn email to one recipient', () => {
-      sandbox.stub(nconf, 'get').withArgs('IS_PROD').returns(true);
-      const attachEmail = requireAgain(pathToEmailLib);
-      const sendTxnEmail = attachEmail.sendTxn;
       const emailType = 'an email type';
       const mailingInfo = {
         name: 'my name',
         email: 'my@email',
       };
 
-      sendTxnEmail(mailingInfo, emailType);
+      sendTxn(mailingInfo, emailType);
+      expect(got.post).to.be.called;
       expect(got.post).to.be.calledWith('undefined/job', sinon.match({
         json: {
           data: {
@@ -179,27 +186,77 @@ describe('emails', () => {
     });
 
     it('does not send email if address is missing', () => {
-      sandbox.stub(nconf, 'get').withArgs('IS_PROD').returns(true);
-      const attachEmail = requireAgain(pathToEmailLib);
-      const sendTxnEmail = attachEmail.sendTxn;
       const emailType = 'an email type';
       const mailingInfo = {
         name: 'my name',
         // email: 'my@email',
       };
 
-      sendTxnEmail(mailingInfo, emailType);
+      sendTxn(mailingInfo, emailType);
       expect(got.post).not.to.be.called;
     });
 
+    it('throws error when mail target is only a string', () => {
+      const emailType = 'an email type';
+      const mailingInfo = 'my email';
+
+      expect(sendTxn(mailingInfo, emailType)).to.throw;
+    });
+
+    it('throws error when mail target has no _id or email', () => {
+      const emailType = 'an email type';
+      const mailingInfo = {
+
+      };
+
+      expect(sendTxn(mailingInfo, emailType)).to.throw;
+    });
+
+    it('throws error when variables not an array', () => {
+      const emailType = 'an email type';
+      const mailingInfo = {
+        name: 'my name',
+        email: 'my@email',
+      };
+      const variables = {};
+
+      expect(sendTxn(mailingInfo, emailType, variables)).to.throw;
+    });
+    it('throws error when variables array not contain name/content', () => {
+      const emailType = 'an email type';
+      const mailingInfo = {
+        name: 'my name',
+        email: 'my@email',
+      };
+      const variables = [
+        {
+
+        },
+      ];
+
+      expect(sendTxn(mailingInfo, emailType, variables)).to.throw;
+    });
+    it('throws no error when variables array contain name but no content', () => {
+      const emailType = 'an email type';
+      const mailingInfo = {
+        name: 'my name',
+        email: 'my@email',
+      };
+      const variables = [
+        {
+          name: 'MY_VAR',
+        },
+      ];
+
+      expect(sendTxn(mailingInfo, emailType, variables)).to.not.throw;
+    });
+
     it('uses getUserInfo in case of user data', () => {
-      sandbox.stub(nconf, 'get').withArgs('IS_PROD').returns(true);
-      const attachEmail = requireAgain(pathToEmailLib);
-      const sendTxnEmail = attachEmail.sendTxn;
       const emailType = 'an email type';
       const mailingInfo = getUser();
 
-      sendTxnEmail(mailingInfo, emailType);
+      sendTxn(mailingInfo, emailType);
+      expect(got.post).to.be.called;
       expect(got.post).to.be.calledWith('undefined/job', sinon.match({
         json: {
           data: {
@@ -211,17 +268,15 @@ describe('emails', () => {
     });
 
     it('sends email with some default variables', () => {
-      sandbox.stub(nconf, 'get').withArgs('IS_PROD').returns(true);
-      const attachEmail = requireAgain(pathToEmailLib);
-      const sendTxnEmail = attachEmail.sendTxn;
       const emailType = 'an email type';
       const mailingInfo = {
         name: 'my name',
         email: 'my@email',
       };
-      const variables = [1, 2, 3];
+      const variables = [];
 
-      sendTxnEmail(mailingInfo, emailType, variables);
+      sendTxn(mailingInfo, emailType, variables);
+      expect(got.post).to.be.called;
       expect(got.post).to.be.calledWith('undefined/job', sinon.match({
         json: {
           data: {

test/api/unit/libs/highlightMentions.test.js

@@ -11,14 +11,14 @@ describe('highlightMentions', () => {
       lean () {
         return this;
       },
-      exec () {
-        return Promise.resolve([
+      async exec () {
+        return [
           { auth: { local: { username: 'user' } }, _id: '111' },
           { auth: { local: { username: 'user2' } }, _id: '222' },
           { auth: { local: { username: 'user3' } }, _id: '333' },
           { auth: { local: { username: 'user-dash' } }, _id: '444' },
           { auth: { local: { username: 'user_underscore' } }, _id: '555' },
-        ]);
+        ];
       },
     };
 
@@ -168,35 +168,50 @@ describe('highlightMentions', () => {
     });
   });
 
-  it('github issue 12118, method crashes when square brackets are used', async () => {
-    const text = '[test]';
+  describe('issues', () => {
+    it('github issue 12118, method crashes when square brackets are used', async () => {
+      const text = '[test]';
 
-    const result = await highlightMentions(text);
+      const result = await highlightMentions(text);
 
-    expect(result[0]).to.equal(text);
+      expect(result[0]).to.equal(text);
+    });
+
+    it('github issue 12138, method crashes when regex chars are used in code block', async () => {
+      const text = '`[test]`';
+
+      const result = await highlightMentions(text);
+
+      expect(result[0]).to.equal(text);
+    });
+
+    it('github issue 12586, method crashes when empty link is used', async () => {
+      const text = '[]()';
+
+      const result = await highlightMentions(text);
+
+      expect(result[0]).to.equal(text);
+    });
+
+    it('github issue 12586, method crashes when link without title is used', async () => {
+      const text = '[](www.google.com)';
+
+      const result = await highlightMentions(text);
+
+      expect(result[0]).to.equal(text);
+    });
   });
 
-  it('github issue 12138, method crashes when regex chars are used in code block', async () => {
-    const text = '`[test]`';
+  describe('base url', () => {
+    it('should prefix habitica.com if it is production', async () => {
+      const OLD_NODE_ENV = process.env.NODE_ENV;
+      process.env.NODE_ENV = 'production';
+      const text = '@user';
 
-    const result = await highlightMentions(text);
+      const result = await highlightMentions(text);
 
-    expect(result[0]).to.equal(text);
-  });
-
-  it('github issue 12586, method crashes when empty link is used', async () => {
-    const text = '[]()';
-
-    const result = await highlightMentions(text);
-
-    expect(result[0]).to.equal(text);
-  });
-
-  it('github issue 12586, method crashes when link without title is used', async () => {
-    const text = '[](www.google.com)';
-
-    const result = await highlightMentions(text);
-
-    expect(result[0]).to.equal(text);
+      expect(result[0]).to.equal('[@user](https://habitica.com/profile/111)');
+      process.env.NODE_ENV = OLD_NODE_ENV;
+    });
   });
 });

test/api/unit/libs/items/utils.test.js

@@ -99,23 +99,26 @@ describe('Items Utils', () => {
       expect(castItemVal('items.food.Cake_Invalid', '5')).to.equal(5);
     });
 
-    it('converts values for mounts paths to numbers', () => {
-      expect(castItemVal('items.mounts.Cactus-Base', 'true')).to.equal(true);
-      expect(castItemVal('items.mounts.Aether-Invisible', 'false')).to.equal(false);
-      expect(castItemVal('items.mounts.Aether-Invalid', 'true')).to.equal(true);
-      expect(castItemVal('items.mounts.Aether-Invalid', 'truish')).to.equal(true);
-      expect(castItemVal('items.mounts.Aether-Invalid', 0)).to.equal(false);
-    });
-
     it('converts values for quests paths to numbers', () => {
       expect(castItemVal('items.quests.atom3', '5')).to.equal(5);
       expect(castItemVal('items.quests.invalid', '5')).to.equal(5);
     });
 
-    it('converts values for owned gear', () => {
+    it('converts values for mounts paths to true/null', () => {
+      // mounts are never false but can be null (function contains more details)
+      expect(castItemVal('items.mounts.Cactus-Base', 'true')).to.equal(true);
+      expect(castItemVal('items.mounts.Aether-Invisible', 'null')).to.equal(null);
+      expect(castItemVal('items.mounts.Aether-Invisible', 'false')).to.equal(null);
+      expect(castItemVal('items.mounts.Aether-Invalid', 'true')).to.equal(true);
+      expect(castItemVal('items.mounts.Aether-Invalid', 'truthy')).to.equal(true);
+      expect(castItemVal('items.mounts.Aether-Invalid', 0)).to.equal(null);
+    });
+
+    it('converts values for owned gear to true/false', () => {
       expect(castItemVal('items.gear.owned.shield_warrior_0', 'true')).to.equal(true);
       expect(castItemVal('items.gear.owned.invalid', 'false')).to.equal(false);
-      expect(castItemVal('items.gear.owned.invalid', 'thruthy')).to.equal(true);
+      expect(castItemVal('items.gear.owned.invalid', 'null')).to.equal(false);
+      expect(castItemVal('items.gear.owned.invalid', 'truthy')).to.equal(true);
       expect(castItemVal('items.gear.owned.invalid', 0)).to.equal(false);
     });
   });

test/api/unit/libs/payments/google.test.js

@@ -256,7 +256,7 @@ describe('Google Payments', () => {
           expirationDate,
         });
       iapGetPurchaseDataStub = sinon.stub(iap, 'getPurchaseData')
-        .returns([{ expirationDate: expirationDate.toDate() }]);
+        .returns([{ expirationDate: expirationDate.toDate(), autoRenewing: false }]);
       iapIsValidatedStub = sinon.stub(iap, 'isValidated')
         .returns(true);
 
@@ -325,5 +325,79 @@ describe('Google Payments', () => {
         headers,
       });
     });
+
+    it('should cancel a user subscription with multiple inactive subscriptions', async () => {
+      const laterDate = moment.utc().add(7, 'days');
+      iap.getPurchaseData.restore();
+      iapGetPurchaseDataStub = sinon.stub(iap, 'getPurchaseData')
+        .returns([{ expirationDate, autoRenewing: false },
+          { expirationDate: laterDate, autoRenewing: false },
+        ]);
+      await googlePayments.cancelSubscribe(user, headers);
+
+      expect(iapSetupStub).to.be.calledOnce;
+      expect(iapValidateStub).to.be.calledOnce;
+      expect(iapValidateStub).to.be.calledWith(iap.GOOGLE, {
+        data: receipt,
+        signature,
+      });
+      expect(iapIsValidatedStub).to.be.calledOnce;
+      expect(iapIsValidatedStub).to.be.calledWith({
+        expirationDate,
+      });
+      expect(iapGetPurchaseDataStub).to.be.calledOnce;
+
+      expect(paymentCancelSubscriptionSpy).to.be.calledOnce;
+      expect(paymentCancelSubscriptionSpy).to.be.calledWith({
+        user,
+        paymentMethod: googlePayments.constants.PAYMENT_METHOD_GOOGLE,
+        nextBill: laterDate.toDate(),
+        headers,
+      });
+    });
+
+    it('should not cancel a user subscription with autorenew', async () => {
+      iap.getPurchaseData.restore();
+      iapGetPurchaseDataStub = sinon.stub(iap, 'getPurchaseData')
+        .returns([{ autoRenewing: true }]);
+      await googlePayments.cancelSubscribe(user, headers);
+
+      expect(iapSetupStub).to.be.calledOnce;
+      expect(iapValidateStub).to.be.calledOnce;
+      expect(iapValidateStub).to.be.calledWith(iap.GOOGLE, {
+        data: receipt,
+        signature,
+      });
+      expect(iapIsValidatedStub).to.be.calledOnce;
+      expect(iapIsValidatedStub).to.be.calledWith({
+        expirationDate,
+      });
+      expect(iapGetPurchaseDataStub).to.be.calledOnce;
+
+      expect(paymentCancelSubscriptionSpy).to.not.be.called;
+    });
+
+    it('should not cancel a user subscription with multiple subscriptions with one autorenew', async () => {
+      iap.getPurchaseData.restore();
+      iapGetPurchaseDataStub = sinon.stub(iap, 'getPurchaseData')
+        .returns([{ expirationDate, autoRenewing: false },
+          { autoRenewing: true },
+          { expirationDate, autoRenewing: false }]);
+      await googlePayments.cancelSubscribe(user, headers);
+
+      expect(iapSetupStub).to.be.calledOnce;
+      expect(iapValidateStub).to.be.calledOnce;
+      expect(iapValidateStub).to.be.calledWith(iap.GOOGLE, {
+        data: receipt,
+        signature,
+      });
+      expect(iapIsValidatedStub).to.be.calledOnce;
+      expect(iapIsValidatedStub).to.be.calledWith({
+        expirationDate,
+      });
+      expect(iapGetPurchaseDataStub).to.be.calledOnce;
+
+      expect(paymentCancelSubscriptionSpy).to.not.be.called;
+    });
   });
 });

test/api/unit/libs/payments/payments.test.js

@@ -247,11 +247,11 @@ describe('payments/index', () => {
 
       context('No Active Promotion', () => {
         beforeEach(() => {
-          sinon.stub(worldState, 'getCurrentEvent').returns(null);
+          sinon.stub(worldState, 'getCurrentEventList').returns([]);
         });
 
         afterEach(() => {
-          worldState.getCurrentEvent.restore();
+          worldState.getCurrentEventList.restore();
         });
 
         it('sends a private message about the gift', async () => {
@@ -268,14 +268,14 @@ describe('payments/index', () => {
 
       context('Active Promotion', () => {
         beforeEach(() => {
-          sinon.stub(worldState, 'getCurrentEvent').returns({
+          sinon.stub(worldState, 'getCurrentEventList').returns([{
             ...common.content.events.winter2021Promo,
             event: 'winter2021',
-          });
+          }]);
         });
 
         afterEach(() => {
-          worldState.getCurrentEvent.restore();
+          worldState.getCurrentEventList.restore();
         });
 
         it('creates a gift subscription for purchaser and recipient if none exist', async () => {

test/api/unit/libs/taskManager.js

@@ -1,9 +1,11 @@
 import {
   createTasks,
   getTasks,
+} from '../../../../website/server/libs/tasks';
+import {
   syncableAttrs,
   moveTask,
-} from '../../../../website/server/libs/taskManager';
+} from '../../../../website/server/libs/tasks/utils';
 import i18n from '../../../../website/common/script/i18n';
 import shared from '../../../../website/common/script';
 import {

test/api/unit/libs/webhooks.test.js

@@ -656,9 +656,11 @@ describe('webhooks', () => {
           id: 'group-id',
           name: 'some group',
           otherData: 'foo',
+          quest: {},
         },
         quest: {
           key: 'some-key',
+          questOwner: 'user-id',
         },
       };
     });

test/api/unit/libs/xmlMarshaller.test.js

@@ -42,3 +42,109 @@ describe('xml marshaller marshalls user data', () => {
 </user>`);
   });
 });
+
+describe('xml marshaller marshalls user data (with purchases)', () => {
+  const minimumUser = {
+    pinnedItems: [],
+    unpinnedItems: [],
+    inbox: {},
+  };
+
+  function userDataWith (fields) {
+    return { ...minimumUser, ...fields };
+  }
+
+  it('maps the purchases field with data that begins with a number', () => {
+    const userData = userDataWith({
+      purchased: {
+        ads: false,
+        txnCount: 0,
+        skin: {
+          eb052b: true,
+          '0ff591': true,
+          '2b43f6': true,
+          d7a9f7: true,
+          '800ed0': true,
+          rainbow: true,
+        },
+      },
+    });
+
+    const xml = xmlMarshaller.marshallUserData(userData);
+
+    expect(xml).to.equal(`<user>
+    <inbox/>
+    <purchased>
+        <ads>false</ads>
+        <txnCount>0</txnCount>
+        <skin>eb052b</skin>
+        <skin>0ff591</skin>
+        <skin>2b43f6</skin>
+        <skin>d7a9f7</skin>
+        <skin>800ed0</skin>
+        <skin>rainbow</skin>
+    </purchased>
+</user>`);
+  });
+});
+
+describe('xml marshaller marshalls user data (with purchases nested)', () => {
+  const minimumUser = {
+    pinnedItems: [],
+    unpinnedItems: [],
+    inbox: {},
+  };
+
+  function userDataWith (fields) {
+    return { ...minimumUser, ...fields };
+  }
+
+  it('maps the purchases field with data that begins with a number and nested objects', () => {
+    const userData = userDataWith({
+      purchased: {
+        ads: false,
+        txnCount: 0,
+        skin: {
+          eb052b: true,
+          '0ff591': true,
+          '2b43f6': true,
+          d7a9f7: true,
+          '800ed0': true,
+          rainbow: true,
+        },
+        plan: {
+          consecutive: {
+            count: 0,
+            offset: 0,
+            gemCapExtra: 0,
+            trinkets: 0,
+          },
+        },
+      },
+    });
+
+    const xml = xmlMarshaller.marshallUserData(userData);
+
+    expect(xml).to.equal(`<user>
+    <inbox/>
+    <purchased>
+        <ads>false</ads>
+        <txnCount>0</txnCount>
+        <skin>eb052b</skin>
+        <skin>0ff591</skin>
+        <skin>2b43f6</skin>
+        <skin>d7a9f7</skin>
+        <skin>800ed0</skin>
+        <skin>rainbow</skin>
+        <plan>
+            <item>
+                <count>0</count>
+                <offset>0</offset>
+                <gemCapExtra>0</gemCapExtra>
+                <trinkets>0</trinkets>
+            </item>
+        </plan>
+    </purchased>
+</user>`);
+  });
+});

test/api/unit/middlewares/cronMiddleware.js

@@ -128,6 +128,22 @@ describe('cron middleware', () => {
     });
   });
 
+  it('runs cron if previous cron was incomplete', async () => {
+    user.lastCron = moment(new Date()).subtract({ days: 1 });
+    user.auth.timestamps.loggedin = moment(new Date()).subtract({ days: 4 });
+    const now = new Date();
+    await user.save();
+
+    await new Promise((resolve, reject) => {
+      cronMiddleware(req, res, err => {
+        if (err) return reject(err);
+        expect(moment(now).isSame(user.lastCron, 'day'));
+        expect(moment(now).isSame(user.auth.timestamps.loggedin, 'day'));
+        return resolve();
+      });
+    });
+  });
+
   it('updates user.auth.timestamps.loggedin and lastCron', async () => {
     user.lastCron = moment(new Date()).subtract({ days: 2 });
     const now = new Date();
@@ -294,89 +310,32 @@ describe('cron middleware', () => {
     });
   });
 
-  context('Drop Cap A/B Test', async () => {
-    it('enrolls web users', async () => {
-      user.lastCron = moment(new Date()).subtract({ days: 2 });
-      await user.save();
-      req.headers['x-client'] = 'habitica-web';
+  it('cron should not run more than once', async () => {
+    user.lastCron = moment(new Date()).subtract({ days: 2 });
+    await user.save();
 
-      await new Promise((resolve, reject) => {
-        cronMiddleware(req, res, async err => {
+    sandbox.spy(cronLib, 'cron');
+
+    await Promise.all([new Promise((resolve, reject) => {
+      cronMiddleware(req, res, err => {
+        if (err) return reject(err);
+        return resolve();
+      });
+    }), new Promise((resolve, reject) => {
+      cronMiddleware(req, res, err => {
+        if (err) return reject(err);
+        return resolve();
+      });
+    }), new Promise((resolve, reject) => {
+      setTimeout(() => {
+        cronMiddleware(req, res, err => {
           if (err) return reject(err);
-          user = await User.findById(user._id).exec();
-          expect(user._ABtests.dropCapNotif).to.be.a.string;
-
           return resolve();
         });
-      });
-    });
+      }, 400);
+    }),
+    ]);
 
-    it('enables the new notification for 50% of users', async () => {
-      sandbox.stub(Math, 'random').returns(0.5);
-      user.lastCron = moment(new Date()).subtract({ days: 2 });
-      await user.save();
-      req.headers['x-client'] = 'habitica-web';
-
-      await new Promise((resolve, reject) => {
-        cronMiddleware(req, res, async err => {
-          if (err) return reject(err);
-          user = await User.findById(user._id).exec();
-          expect(user._ABtests.dropCapNotif).to.be.equal('drop-cap-notif-enabled');
-
-          return resolve();
-        });
-      });
-    });
-
-    it('disables the new notification for 50% of users', async () => {
-      sandbox.stub(Math, 'random').returns(0.51);
-      user.lastCron = moment(new Date()).subtract({ days: 2 });
-      await user.save();
-      req.headers['x-client'] = 'habitica-web';
-
-      await new Promise((resolve, reject) => {
-        cronMiddleware(req, res, async err => {
-          if (err) return reject(err);
-          user = await User.findById(user._id).exec();
-          expect(user._ABtests.dropCapNotif).to.be.equal('drop-cap-notif-disabled');
-
-          return resolve();
-        });
-      });
-    });
-
-    it('does not affect subscribers', async () => {
-      sandbox.stub(Math, 'random').returns(0.2);
-      user.lastCron = moment(new Date()).subtract({ days: 2 });
-      await user.save();
-      req.headers['x-client'] = 'habitica-web';
-      sandbox.stub(User.prototype, 'isSubscribed').returns(true);
-
-      await new Promise((resolve, reject) => {
-        cronMiddleware(req, res, async err => {
-          if (err) return reject(err);
-          user = await User.findById(user._id).exec();
-          expect(user._ABtests.dropCapNotif).to.not.exist;
-
-          return resolve();
-        });
-      });
-    });
-
-    it('does not affect mobile users', async () => {
-      user.lastCron = moment(new Date()).subtract({ days: 2 });
-      await user.save();
-      req.headers['x-client'] = 'habitica-ios';
-
-      await new Promise((resolve, reject) => {
-        cronMiddleware(req, res, async err => {
-          if (err) return reject(err);
-          user = await User.findById(user._id).exec();
-          expect(user._ABtests.dropCapNotif).to.not.exist;
-
-          return resolve();
-        });
-      });
-    });
+    expect(cronLib.cron).to.be.calledOnce;
   });
 });

test/api/unit/middlewares/ensureAccessRight.test.js

@@ -4,8 +4,7 @@ import {
   generateReq,
   generateNext,
 } from '../../../helpers/api-unit.helper';
-import i18n from '../../../../website/common/script/i18n';
-import { ensureAdmin, ensureSudo, ensureNewsPoster } from '../../../../website/server/middlewares/ensureAccessRight';
+import { ensurePermission } from '../../../../website/server/middlewares/ensureAccessRight';
 import { NotAuthorized } from '../../../../website/server/libs/errors';
 import apiError from '../../../../website/server/libs/apiError';
 
@@ -20,20 +19,20 @@ describe('ensure access middlewares', () => {
   });
 
   context('ensure admin', () => {
-    it('returns not authorized when user is not an admin', () => {
-      res.locals = { user: { contributor: { admin: false } } };
+    it('returns not authorized when user is not in userSupport', () => {
+      res.locals = { user: { permissions: { userSupport: false } } };
 
-      ensureAdmin(req, res, next);
+      ensurePermission('userSupport')(req, res, next);
 
       const calledWith = next.getCall(0).args;
-      expect(calledWith[0].message).to.equal(i18n.t('noAdminAccess'));
+      expect(calledWith[0].message).to.equal(apiError('noPrivAccess'));
       expect(calledWith[0] instanceof NotAuthorized).to.equal(true);
     });
 
-    it('passes when user is an admin', () => {
-      res.locals = { user: { contributor: { admin: true } } };
+    it('passes when user is an userSuppor', () => {
+      res.locals = { user: { permissions: { userSupport: true } } };
 
-      ensureAdmin(req, res, next);
+      ensurePermission('userSupport')(req, res, next);
 
       expect(next).to.be.calledOnce;
       expect(next.args[0]).to.be.empty;
@@ -42,40 +41,40 @@ describe('ensure access middlewares', () => {
 
   context('ensure newsPoster', () => {
     it('returns not authorized when user is not a newsPoster', () => {
-      res.locals = { user: { contributor: { newsPoster: false } } };
+      res.locals = { user: { permissions: { news: false } } };
 
-      ensureNewsPoster(req, res, next);
+      ensurePermission('news')(req, res, next);
 
       const calledWith = next.getCall(0).args;
-      expect(calledWith[0].message).to.equal(apiError('noNewsPosterAccess'));
+      expect(calledWith[0].message).to.equal(apiError('noPrivAccess'));
       expect(calledWith[0] instanceof NotAuthorized).to.equal(true);
     });
 
     it('passes when user is a newsPoster', () => {
-      res.locals = { user: { contributor: { newsPoster: true } } };
+      res.locals = { user: { permissions: { news: true } } };
 
-      ensureNewsPoster(req, res, next);
+      ensurePermission('news')(req, res, next);
 
       expect(next).to.be.calledOnce;
       expect(next.args[0]).to.be.empty;
     });
   });
 
-  context('ensure sudo', () => {
-    it('returns not authorized when user is not a sudo user', () => {
-      res.locals = { user: { contributor: { sudo: false } } };
+  context('ensure coupons', () => {
+    it('returns not authorized when user does not have access to coupon calls', () => {
+      res.locals = { user: { permissions: { coupons: false } } };
 
-      ensureSudo(req, res, next);
+      ensurePermission('coupons')(req, res, next);
 
       const calledWith = next.getCall(0).args;
-      expect(calledWith[0].message).to.equal(apiError('noSudoAccess'));
+      expect(calledWith[0].message).to.equal(apiError('noPrivAccess'));
       expect(calledWith[0] instanceof NotAuthorized).to.equal(true);
     });
 
-    it('passes when user is a sudo user', () => {
-      res.locals = { user: { contributor: { sudo: true } } };
+    it('passes when user has access to coupon calls', () => {
+      res.locals = { user: { permissions: { coupons: true } } };
 
-      ensureSudo(req, res, next);
+      ensurePermission('coupons')(req, res, next);
 
       expect(next).to.be.calledOnce;
       expect(next.args[0]).to.be.empty;

test/api/unit/models/group.test.js

@@ -488,20 +488,6 @@ describe('Group Model', () => {
           expect(party.quest.progress.collect.soapBars).to.eq(5);
         });
 
-        it('does not drop an item if not need when on a collection quest', async () => {
-          party.quest.key = 'dilatoryDistress1';
-          party.quest.active = false;
-          await party.startQuest(questLeader);
-          party.quest.progress.collect.fireCoral = 20;
-          await party.save();
-
-          await Group.processQuestProgress(participatingMember, progress);
-
-          party = await Group.findOne({ _id: party._id });
-
-          expect(party.quest.progress.collect.fireCoral).to.eq(20);
-        });
-
         it('sends a chat message about progress', async () => {
           await Group.processQuestProgress(participatingMember, progress);
 
@@ -538,8 +524,8 @@ describe('Group Model', () => {
           });
         });
 
-        describe('collection quests with multiple items', () => {
-          it('sends a chat message if no progress is made on quest with multiple items', async () => {
+        describe('collection quests with multiple item types', () => {
+          it('sends a chat message if no progress is made', async () => {
             progress.collectedItems = 0;
             party.quest.key = 'dilatoryDistress1';
             party.quest.active = false;
@@ -609,6 +595,28 @@ describe('Group Model', () => {
           });
         });
 
+        it('does not drop items when an item type becomes full', async () => {
+          progress.collectedItems = 20;
+          party.quest.key = 'dilatoryDistress1';
+          party.quest.active = false;
+
+          await party.startQuest(questLeader);
+          party.quest.progress.collect.fireCoral = 19;
+          await party.save();
+
+          await Group.processQuestProgress(participatingMember, progress);
+
+          party = await Group.findOne({ _id: party._id });
+
+          // There is a very small chance (~1 in 500K) that blueFins will
+          // be 19 or 20 due to randomness and not any bug. In these cases, this
+          // test doesn't actually verify anything, but it's rare enough that it
+          // shouldn't be a problem, and to make it deterministic would require
+          // stubbing out methods in implementation-specific ways.
+          expect(party.quest.progress.collect.fireCoral).to.be.within(19, 20);
+          expect(party.quest.progress.collect.blueFins).to.be.within(19, 20);
+        });
+
         it('sends message about victory', async () => {
           progress.collectedItems = 500;
 
@@ -1021,7 +1029,7 @@ describe('Group Model', () => {
         expect(toJSON.chat.length).to.equal(1);
       });
 
-      it('shows messages with >= 2 flag to admins', async () => {
+      it('shows messages with >= 2 flag to moderators', async () => {
         party.chat = [{
           flagCount: 3,
           info: {
@@ -1029,12 +1037,12 @@ describe('Group Model', () => {
             quest: 'basilist',
           },
         }];
-        const admin = new User({ 'contributor.admin': true });
+        const admin = new User({ 'permissions.moderator': true });
         const toJSON = await Group.toJSONCleanChat(party, admin);
         expect(toJSON.chat.length).to.equal(1);
       });
 
-      it('doesn\'t show flagged messages to non-admins', async () => {
+      it('doesn\'t show flagged messages to non-moderators', async () => {
         party.chat = [{
           flagCount: 3,
           info: {

test/api/unit/models/group_tasks.test.js

@@ -1,12 +1,10 @@
-import { each, find, findIndex } from 'lodash';
-import { model as Challenge } from '../../../../website/server/models/challenge';
+import { each, findIndex } from 'lodash';
 import { model as Group } from '../../../../website/server/models/group';
 import { model as User } from '../../../../website/server/models/user';
 import * as Tasks from '../../../../website/server/models/task';
 
 describe('Group Task Methods', () => {
-  let guild; let leader; let challenge; let
-    task;
+  let guild; let leader; let task;
   const tasksToTest = {
     habit: {
       text: 'test habit',
@@ -31,10 +29,6 @@ describe('Group Task Methods', () => {
     },
   };
 
-  function findLinkedTask (updatedLeadersTask) {
-    return updatedLeadersTask.group.taskId === task._id;
-  }
-
   beforeEach(async () => {
     guild = new Group({
       name: 'test party',
@@ -47,19 +41,9 @@ describe('Group Task Methods', () => {
 
     guild.leader = leader._id;
 
-    challenge = new Challenge({
-      name: 'Test Challenge',
-      shortName: 'Test',
-      leader: leader._id,
-      group: guild._id,
-    });
-
-    leader.challenges = [challenge._id];
-
     await Promise.all([
       guild.save(),
       leader.save(),
-      challenge.save(),
     ]);
   });
 
@@ -78,7 +62,15 @@ describe('Group Task Methods', () => {
       });
 
       it('syncs an assigned task to a user', async () => {
-        await guild.syncTask(task, leader);
+        await guild.syncTask(task, [leader], leader);
+
+        const updatedTask = await Tasks.Task.findOne({ _id: task._id });
+        expect(updatedTask.group.assignedUsers).to.contain(leader._id);
+        expect(updatedTask.group.assignedUsersDetail[leader._id]).to.exist;
+      });
+
+      it('creates tags for a user when task is synced', async () => {
+        await guild.syncTask(task, [leader], leader);
 
         const updatedLeader = await User.findOne({ _id: leader._id });
         const tagIndex = findIndex(updatedLeader.tags, { id: guild._id });
@@ -88,197 +80,6 @@ describe('Group Task Methods', () => {
         expect(newTag.name).to.equal(guild.name);
         expect(newTag.group).to.equal(guild._id);
       });
-
-      it('create tags for a user when task is synced', async () => {
-        await guild.syncTask(task, leader);
-
-        const updatedLeader = await User.findOne({ _id: leader._id });
-        const updatedLeadersTasks = await Tasks.Task.find({ _id: { $in: updatedLeader.tasksOrder[`${taskType}s`] } });
-        const syncedTask = find(updatedLeadersTasks, findLinkedTask);
-
-        expect(task.group.assignedUsers).to.contain(leader._id);
-        expect(syncedTask).to.exist;
-      });
-
-      it('syncs updated info for assigned task to a user', async () => {
-        await guild.syncTask(task, leader);
-        const updatedTaskName = 'Update Task name';
-        task.text = updatedTaskName;
-        await guild.syncTask(task, leader);
-
-        const updatedLeader = await User.findOne({ _id: leader._id });
-        const updatedLeadersTasks = await Tasks.Task.find({ _id: { $in: updatedLeader.tasksOrder[`${taskType}s`] } });
-        const syncedTask = find(updatedLeadersTasks, findLinkedTask);
-
-        expect(task.group.assignedUsers).to.contain(leader._id);
-        expect(syncedTask).to.exist;
-        expect(syncedTask.text).to.equal(task.text);
-      });
-
-      it('syncs checklist items to an assigned user', async () => {
-        await guild.syncTask(task, leader);
-
-        const updatedLeader = await User.findOne({ _id: leader._id });
-        const updatedLeadersTasks = await Tasks.Task.find({ _id: { $in: updatedLeader.tasksOrder[`${taskType}s`] } });
-        const syncedTask = find(updatedLeadersTasks, findLinkedTask);
-
-        if (task.type !== 'daily' && task.type !== 'todo') return;
-
-        expect(syncedTask.checklist.length).to.equal(task.checklist.length);
-        expect(syncedTask.checklist[0].text).to.equal(task.checklist[0].text);
-      });
-
-      describe('syncs updated info', async () => {
-        let newMember;
-
-        beforeEach(async () => {
-          newMember = new User({
-            guilds: [guild._id],
-          });
-          await newMember.save();
-
-          await guild.syncTask(task, leader);
-          await guild.syncTask(task, newMember);
-        });
-
-        it('syncs updated info for assigned task to all users', async () => {
-          const updatedTaskName = 'Update Task name';
-          task.text = updatedTaskName;
-          task.group.approval.required = true;
-
-          await guild.updateTask(task);
-
-          const updatedLeader = await User.findOne({ _id: leader._id });
-          const updatedLeadersTasks = await Tasks.Task.find({ _id: { $in: updatedLeader.tasksOrder[`${taskType}s`] } });
-          const syncedTask = find(updatedLeadersTasks, findLinkedTask);
-
-          const updatedMember = await User.findOne({ _id: newMember._id });
-          const updatedMemberTasks = await Tasks.Task.find({ _id: { $in: updatedMember.tasksOrder[`${taskType}s`] } });
-          const syncedMemberTask = find(updatedMemberTasks, findLinkedTask);
-
-          expect(task.group.assignedUsers).to.contain(leader._id);
-          expect(syncedTask).to.exist;
-          expect(syncedTask.text).to.equal(task.text);
-          expect(syncedTask.group.approval.required).to.equal(true);
-
-          expect(task.group.assignedUsers).to.contain(newMember._id);
-          expect(syncedMemberTask).to.exist;
-          expect(syncedMemberTask.text).to.equal(task.text);
-          expect(syncedMemberTask.group.approval.required).to.equal(true);
-        });
-
-        it('syncs a new checklist item to all assigned users', async () => {
-          if (task.type !== 'daily' && task.type !== 'todo') return;
-
-          const newCheckListItem = {
-            text: 'Checklist Item 1',
-            completed: false,
-          };
-
-          task.checklist.push(newCheckListItem);
-
-          await guild.updateTask(task, { newCheckListItem });
-
-          const updatedLeader = await User.findOne({ _id: leader._id });
-          const updatedLeadersTasks = await Tasks.Task.find({ _id: { $in: updatedLeader.tasksOrder[`${taskType}s`] } });
-          const syncedTask = find(updatedLeadersTasks, findLinkedTask);
-
-          const updatedMember = await User.findOne({ _id: newMember._id });
-          const updatedMemberTasks = await Tasks.Task.find({ _id: { $in: updatedMember.tasksOrder[`${taskType}s`] } });
-          const syncedMemberTask = find(updatedMemberTasks, findLinkedTask);
-
-          expect(syncedTask.checklist.length).to.equal(task.checklist.length);
-          expect(syncedTask.checklist[1].text).to.equal(task.checklist[1].text);
-          expect(syncedMemberTask.checklist.length).to.equal(task.checklist.length);
-          expect(syncedMemberTask.checklist[1].text).to.equal(task.checklist[1].text);
-        });
-
-        it('syncs updated info for checklist in assigned task to all users when flag is passed', async () => {
-          if (task.type !== 'daily' && task.type !== 'todo') return;
-
-          const updateCheckListText = 'Updated checklist item';
-          if (task.checklist) {
-            task.checklist[0].text = updateCheckListText;
-          }
-
-          await guild.updateTask(task, { updateCheckListItems: [task.checklist[0]] });
-
-          const updatedLeader = await User.findOne({ _id: leader._id });
-          const updatedLeadersTasks = await Tasks.Task.find({ _id: { $in: updatedLeader.tasksOrder[`${taskType}s`] } });
-          const syncedTask = find(updatedLeadersTasks, findLinkedTask);
-
-          const updatedMember = await User.findOne({ _id: newMember._id });
-          const updatedMemberTasks = await Tasks.Task.find({ _id: { $in: updatedMember.tasksOrder[`${taskType}s`] } });
-          const syncedMemberTask = find(updatedMemberTasks, findLinkedTask);
-
-          expect(syncedTask.checklist.length).to.equal(task.checklist.length);
-          expect(syncedTask.checklist[0].text).to.equal(updateCheckListText);
-          expect(syncedMemberTask.checklist.length).to.equal(task.checklist.length);
-          expect(syncedMemberTask.checklist[0].text).to.equal(updateCheckListText);
-        });
-
-        it('removes a checklist item in assigned task to all users when flag is passed with checklist id', async () => {
-          if (task.type !== 'daily' && task.type !== 'todo') return;
-
-          await guild.updateTask(task, { removedCheckListItemId: task.checklist[0].id });
-
-          const updatedLeader = await User.findOne({ _id: leader._id });
-          const updatedLeadersTasks = await Tasks.Task.find({ _id: { $in: updatedLeader.tasksOrder[`${taskType}s`] } });
-          const syncedTask = find(updatedLeadersTasks, findLinkedTask);
-
-          const updatedMember = await User.findOne({ _id: newMember._id });
-          const updatedMemberTasks = await Tasks.Task.find({ _id: { $in: updatedMember.tasksOrder[`${taskType}s`] } });
-          const syncedMemberTask = find(updatedMemberTasks, findLinkedTask);
-
-          expect(syncedTask.checklist.length).to.equal(0);
-          expect(syncedMemberTask.checklist.length).to.equal(0);
-        });
-      });
-
-      it('removes assigned tasks when master task is deleted', async () => {
-        await guild.syncTask(task, leader);
-        await guild.removeTask(task);
-
-        const updatedLeader = await User.findOne({ _id: leader._id });
-        const updatedLeadersTasks = await Tasks.Task.find({ userId: leader._id, type: taskType });
-        const syncedTask = find(updatedLeadersTasks, findLinkedTask);
-
-        expect(updatedLeader.tasksOrder[`${taskType}s`]).to.not.include(task._id);
-        expect(syncedTask).to.not.exist;
-      });
-
-      it('unlinks and deletes group tasks for a user when remove-all is specified', async () => {
-        await guild.syncTask(task, leader);
-        await guild.unlinkTask(task, leader, 'remove-all');
-
-        const updatedLeader = await User.findOne({ _id: leader._id });
-        const updatedLeadersTasks = await Tasks.Task.find({ _id: { $in: updatedLeader.tasksOrder[`${taskType}s`] } });
-        const syncedTask = find(updatedLeadersTasks, findLinkedTask);
-
-        expect(task.group.assignedUsers).to.not.contain(leader._id);
-        expect(syncedTask).to.not.exist;
-      });
-
-      it('unlinks and keeps group tasks for a user when keep-all is specified', async () => {
-        await guild.syncTask(task, leader);
-
-        let updatedLeader = await User.findOne({ _id: leader._id });
-        let updatedLeadersTasks = await Tasks.Task.find({ _id: { $in: updatedLeader.tasksOrder[`${taskType}s`] } });
-        const syncedTask = find(updatedLeadersTasks, findLinkedTask);
-
-        await guild.unlinkTask(task, leader, 'keep-all');
-
-        updatedLeader = await User.findOne({ _id: leader._id });
-        updatedLeadersTasks = await Tasks.Task.find({ _id: { $in: updatedLeader.tasksOrder[`${taskType}s`] } });
-        const updatedSyncedTask = find(
-          updatedLeadersTasks,
-          updatedLeadersTask => updatedLeadersTask._id === syncedTask._id,
-        );
-
-        expect(task.group.assignedUsers).to.not.contain(leader._id);
-        expect(updatedSyncedTask).to.exist;
-        expect(updatedSyncedTask.group._id).to.be.undefined;
-      });
     });
   });
 });

test/api/unit/models/task.test.js

@@ -246,13 +246,23 @@ describe('Task Model', () => {
         expect(foundTasks[0].text).to.eql(taskWithAlias.text);
       });
 
-      it('scopes alias lookup to user', async () => {
+      it('scopes alias lookup to user when querying aliases only', async () => {
         await Tasks.Task.findMultipleByIdOrAlias([taskWithAlias.alias], user._id);
 
+        expect(Tasks.Task.find).to.be.calledOnce;
+        expect(Tasks.Task.find).to.be.calledWithMatch({
+          alias: { $in: [taskWithAlias.alias] },
+          userId: user._id,
+        });
+      });
+
+      it('scopes alias lookup to user when querying aliases and IDs', async () => {
+        await Tasks.Task.findMultipleByIdOrAlias([taskWithAlias.alias, secondTask._id], user._id);
+
         expect(Tasks.Task.find).to.be.calledOnce;
         expect(Tasks.Task.find).to.be.calledWithMatch({
           $or: [
-            { _id: { $in: [] } },
+            { _id: { $in: [secondTask._id] } },
             { alias: { $in: [taskWithAlias.alias] } },
           ],
           userId: user._id,
@@ -270,10 +280,7 @@ describe('Task Model', () => {
 
         expect(Tasks.Task.find).to.be.calledOnce;
         expect(Tasks.Task.find).to.be.calledWithMatch({
-          $or: [
-            { _id: { $in: [] } },
-            { alias: { $in: [taskWithAlias.alias] } },
-          ],
+          alias: { $in: [taskWithAlias.alias] },
           userId: user._id,
           foo: 'bar',
         });

test/api/unit/models/user.test.js

@@ -592,20 +592,6 @@ describe('User Model', () => {
   });
 
   context('pre-save hook', () => {
-    it('enrolls users that signup through web in the Drop Cap AB test', async () => {
-      let user = new User();
-      user.registeredThrough = 'habitica-web';
-      user = await user.save();
-      expect(user._ABtests.dropCapNotif).to.exist;
-    });
-
-    it('does not enroll users that signup through modal in the Drop Cap AB test', async () => {
-      let user = new User();
-      user.registeredThrough = 'habitica-ios';
-      user = await user.save();
-      expect(user._ABtests.dropCapNotif).to.not.exist;
-    });
-
     it('marks the last news post as read for new users', async () => {
       const lastNewsPost = { _id: '1' };
       sandbox.stub(NewsPost, 'lastNewsPost').returns(lastNewsPost);
@@ -648,7 +634,7 @@ describe('User Model', () => {
       user = await user.save();
       // verify that it's been awarded
       expect(user.achievements.beastMaster).to.equal(true);
-      expect(user.notifications.find(notification => notification.type === 'ACHIEVEMENT_BEAST_MASTER')).to.exist;
+      expect(user.notifications.find(notification => notification.type === 'ACHIEVEMENT_STABLE')).to.exist;
 
       // reset the user
       user.achievements.beastMasterCount = 0;
@@ -697,9 +683,9 @@ describe('User Model', () => {
 
       user = await user.save();
       // verify that it's been awarded
-      expect(user.notifications.find(notification => notification.type === 'ACHIEVEMENT_BEAST_MASTER')).to.exist;
-      expect(user.notifications.find(notification => notification.type === 'ACHIEVEMENT_MOUNT_MASTER')).to.exist;
-      expect(user.notifications.find(notification => notification.type === 'ACHIEVEMENT_TRIAD_BINGO')).to.exist;
+      expect(user.notifications.find(
+        notification => notification.type === 'ACHIEVEMENT_STABLE',
+      )).to.exist;
     });
 
     context('manage unallocated stats points notifications', () => {
@@ -825,6 +811,16 @@ describe('User Model', () => {
       expect(daysMissed).to.eql(5);
     });
 
+    it('correctly handles a cron that did not complete', () => {
+      const now = moment();
+      user.lastCron = moment(now).subtract(2, 'days');
+      user.auth.timestamps.loggedIn = moment(now).subtract(5, 'days');
+
+      const { daysMissed } = user.daysUserHasMissed(now);
+
+      expect(daysMissed).to.eql(5);
+    });
+
     it('uses timezone from preferences to calculate days missed', () => {
       const now = moment('2017-07-08 01:00:00Z');
       user.lastCron = moment('2017-07-04 13:00:00Z');
@@ -881,7 +877,7 @@ describe('User Model', () => {
 
     expect(user.isNewsPoster()).to.equal(false);
 
-    user.contributor.newsPoster = true;
+    user.permissions = { news: true };
     expect(user.isNewsPoster()).to.equal(true);
   });
 

test/api/v3/integration/challenges/GET-challenges_group_groupid.test.js

@@ -202,7 +202,7 @@ describe('GET challenges/groups/:groupId', () => {
       publicGuild = group;
 
       await user.update({
-        'contributor.admin': true,
+        'permissions.challengeAdmin': true,
       });
 
       officialChallenge = await generateChallenge(user, group, {

test/api/v3/integration/challenges/GET-challenges_user.test.js

@@ -231,7 +231,7 @@ describe('GET challenges/user', () => {
       publicGuild = group;
 
       await user.update({
-        'contributor.admin': true,
+        'permissions.challengeAdmin': true,
       });
 
       officialChallenge = await generateChallenge(user, group, {

test/api/v3/integration/challenges/POST-challenges.test.js

@@ -4,6 +4,7 @@ import {
   createAndPopulateGroup,
   translate as t,
 } from '../../../../helpers/api-integration/v3';
+import { MAX_SUMMARY_SIZE_FOR_CHALLENGES } from '../../../../../website/common/script/constants';
 
 describe('POST /challenges', () => {
   it('returns error when group is empty', async () => {
@@ -60,6 +61,22 @@ describe('POST /challenges', () => {
     });
   });
 
+  it('return error when creating a challenge with summary with greater than MAX_SUMMARY_SIZE_FOR_CHALLENGES characters', async () => {
+    const user = await generateUser();
+    const summary = 'A'.repeat(MAX_SUMMARY_SIZE_FOR_CHALLENGES + 1);
+    const group = createAndPopulateGroup({
+      members: 1,
+    });
+    await expect(user.post('/challenges', {
+      group: group._id,
+      summary,
+    })).to.eventually.be.rejected.and.eql({
+      code: 400,
+      error: 'BadRequest',
+      message: t('invalidReqParams'),
+    });
+  });
+
   context('Creating a challenge for a valid group', () => {
     let groupLeader;
     let group;
@@ -203,8 +220,8 @@ describe('POST /challenges', () => {
 
     it('sets challenge as official if created by admin and official flag is set', async () => {
       await groupLeader.update({
-        contributor: {
-          admin: true,
+        permissions: {
+          challengeAdmin: true,
         },
       });
 

test/api/v3/integration/challenges/PUT-challenges_challengeId.test.js

@@ -4,6 +4,7 @@ import {
   createAndPopulateGroup,
   translate as t,
 } from '../../../../helpers/api-integration/v3';
+import { MAX_SUMMARY_SIZE_FOR_CHALLENGES } from '../../../../../website/common/script/constants';
 
 describe('PUT /challenges/:challengeId', () => {
   let privateGuild; let user; let nonMember; let challenge; let
@@ -74,7 +75,6 @@ describe('PUT /challenges/:challengeId', () => {
     expect(res.memberCount).to.equal(2);
     expect(res.tasksOrder).not.to.equal('new order');
     expect(res.official).to.equal(false);
-    expect(res.shortName).not.to.equal('new short name');
 
     expect(res.leader).to.eql({
       _id: user._id,
@@ -92,4 +92,15 @@ describe('PUT /challenges/:challengeId', () => {
     expect(res.name).to.equal('New Challenge Name');
     expect(res.description).to.equal('New challenge description.');
   });
+
+  it('return error when challenge summary is greater than MAX_SUMMARY_SIZE_FOR_CHALLENGES characters', async () => {
+    const summary = 'A'.repeat(MAX_SUMMARY_SIZE_FOR_CHALLENGES + 1);
+    await expect(user.put(`/challenges/${challenge._id}`, {
+      summary,
+    })).to.eventually.be.rejected.and.eql({
+      code: 400,
+      error: 'BadRequest',
+      message: t('invalidReqParams'),
+    });
+  });
 });

test/api/v3/integration/chat/DELETE-chat_id.test.js

@@ -15,6 +15,10 @@ describe('DELETE /groups/:groupId/chat/:chatId', () => {
         type: 'guild',
         privacy: 'public',
       },
+      leaderDetails: {
+        'auth.timestamps.created': new Date('2022-01-01'),
+        balance: 10,
+      },
     });
 
     groupWithChat = group;
@@ -22,7 +26,7 @@ describe('DELETE /groups/:groupId/chat/:chatId', () => {
     message = await user.post(`/groups/${groupWithChat._id}/chat`, { message: 'Some message' });
     message = message.message;
     userThatDidNotCreateChat = await generateUser();
-    admin = await generateUser({ 'contributor.admin': true });
+    admin = await generateUser({ 'permissions.moderator': true });
   });
 
   context('Chat errors', () => {

test/api/v3/integration/chat/POST-chat.flag.test.js

@@ -17,7 +17,7 @@ describe('POST /chat/:chatId/flag', () => {
 
   beforeEach(async () => {
     user = await generateUser({ balance: 1, 'auth.timestamps.created': moment().subtract(USER_AGE_FOR_FLAGGING + 1, 'days').toDate() });
-    admin = await generateUser({ balance: 1, 'contributor.admin': true });
+    admin = await generateUser({ balance: 1, 'permissions.moderator': true });
     anotherUser = await generateUser({ 'auth.timestamps.created': moment().subtract(USER_AGE_FOR_FLAGGING + 1, 'days').toDate() });
     newUser = await generateUser({ 'auth.timestamps.created': moment().subtract(1, 'days').toDate() });
     sandbox.stub(IncomingWebhook.prototype, 'send').returns(Promise.resolve());
@@ -117,7 +117,9 @@ describe('POST /chat/:chatId/flag', () => {
   });
 
   it('Flags a chat when the author\'s account was deleted', async () => {
-    const deletedUser = await generateUser();
+    const deletedUser = await generateUser({
+      'auth.timestamps.created': new Date('2022-01-01'),
+    });
     const { message } = await deletedUser.post(`/groups/${group._id}/chat`, { message: TEST_MESSAGE });
     await deletedUser.del('/user', {
       password: 'password',

test/api/v3/integration/chat/POST-chat.like.test.js

@@ -18,11 +18,16 @@ describe('POST /chat/:chatId/like', () => {
         privacy: 'public',
       },
       members: 1,
+      leaderDetails: {
+        'auth.timestamps.created': new Date('2022-01-01'),
+        balance: 10,
+      },
     });
 
     user = groupLeader;
     groupWithChat = group;
     anotherUser = members[0]; // eslint-disable-line prefer-destructuring
+    await anotherUser.update({ 'auth.timestamps.created': new Date('2022-01-01') });
   });
 
   it('Returns an error when chat message is not found', async () => {

test/api/v3/integration/chat/POST-chat.test.js

@@ -38,10 +38,15 @@ describe('POST /chat', () => {
       members: 2,
     });
     user = groupLeader;
-    await user.update({ 'contributor.level': SPAM_MIN_EXEMPT_CONTRIB_LEVEL }); // prevent tests accidentally throwing messageGroupChatSpam
+    await user.update({
+      'contributor.level': SPAM_MIN_EXEMPT_CONTRIB_LEVEL,
+      'auth.timestamps.created': new Date('2022-01-01'),
+    }); // prevent tests accidentally throwing messageGroupChatSpam
     groupWithChat = group;
     member = members[0]; // eslint-disable-line prefer-destructuring
     additionalMember = members[1]; // eslint-disable-line prefer-destructuring
+    await member.update({ 'auth.timestamps.created': new Date('2022-01-01') });
+    await additionalMember.update({ 'auth.timestamps.created': new Date('2022-01-01') });
   });
 
   it('Returns an error when no message is provided', async () => {
@@ -104,7 +109,10 @@ describe('POST /chat', () => {
       });
 
       const privateGuildMemberWithChatsRevoked = members[0];
-      await privateGuildMemberWithChatsRevoked.update({ 'flags.chatRevoked': true });
+      await privateGuildMemberWithChatsRevoked.update({
+        'flags.chatRevoked': true,
+        'auth.timestamps.created': new Date('2022-01-01'),
+      });
 
       const message = await privateGuildMemberWithChatsRevoked.post(`/groups/${group._id}/chat`, { message: testMessage });
 
@@ -122,7 +130,10 @@ describe('POST /chat', () => {
       });
 
       const privatePartyMemberWithChatsRevoked = members[0];
-      await privatePartyMemberWithChatsRevoked.update({ 'flags.chatRevoked': true });
+      await privatePartyMemberWithChatsRevoked.update({
+        'flags.chatRevoked': true,
+        'auth.timestamps.created': new Date('2022-01-01'),
+      });
 
       const message = await privatePartyMemberWithChatsRevoked.post(`/groups/${group._id}/chat`, { message: testMessage });
 
@@ -183,7 +194,10 @@ describe('POST /chat', () => {
       });
 
       const userWithChatShadowMuted = members[0];
-      await userWithChatShadowMuted.update({ 'flags.chatShadowMuted': true });
+      await userWithChatShadowMuted.update({
+        'flags.chatShadowMuted': true,
+        'auth.timestamps.created': new Date('2022-01-01'),
+      });
 
       const message = await userWithChatShadowMuted.post(`/groups/${group._id}/chat`, { message: testMessage });
 
@@ -202,7 +216,10 @@ describe('POST /chat', () => {
       });
 
       const userWithChatShadowMuted = members[0];
-      await userWithChatShadowMuted.update({ 'flags.chatShadowMuted': true });
+      await userWithChatShadowMuted.update({
+        'flags.chatShadowMuted': true,
+        'auth.timestamps.created': new Date('2022-01-01'),
+      });
 
       const message = await userWithChatShadowMuted.post(`/groups/${group._id}/chat`, { message: testMessage });
 
@@ -312,6 +329,7 @@ describe('POST /chat', () => {
         },
         members: 1,
       });
+      await members[0].update({ 'auth.timestamps.created': new Date('2022-01-01') });
 
       const message = await members[0].post(`/groups/${group._id}/chat`, { message: testBannedWordMessage });
 
@@ -330,6 +348,7 @@ describe('POST /chat', () => {
 
       // Update the bannedWordsAllowed property for the group
       group.update({ bannedWordsAllowed: true });
+      await members[0].update({ 'auth.timestamps.created': new Date('2022-01-01') });
 
       const message = await members[0].post(`/groups/${group._id}/chat`, { message: testBannedWordMessage });
 
@@ -345,6 +364,7 @@ describe('POST /chat', () => {
         },
         members: 1,
       });
+      await members[0].update({ 'auth.timestamps.created': new Date('2022-01-01') });
 
       const message = await members[0].post(`/groups/${group._id}/chat`, { message: testBannedWordMessage });
 
@@ -402,7 +422,7 @@ describe('POST /chat', () => {
       });
     });
 
-    it('does not allow slurs in private groups', async () => {
+    it('allows slurs in private groups', async () => {
       const { group, members } = await createAndPopulateGroup({
         groupDetails: {
           name: 'Party',
@@ -411,43 +431,11 @@ describe('POST /chat', () => {
         },
         members: 1,
       });
+      await members[0].update({ 'auth.timestamps.created': new Date('2022-01-01') });
 
-      await expect(members[0].post(`/groups/${group._id}/chat`, { message: testSlurMessage })).to.eventually.be.rejected.and.eql({
-        code: 400,
-        error: 'BadRequest',
-        message: t('bannedSlurUsed'),
-      });
+      const message = await members[0].post(`/groups/${group._id}/chat`, { message: testSlurMessage });
 
-      // Email sent to mods
-      await sleep(0.5);
-      expect(email.sendTxn).to.be.calledThrice;
-      expect(email.sendTxn.args[2][1]).to.eql('slur-report-to-mods');
-
-      // Slack message to mods
-      expect(IncomingWebhook.prototype.send).to.be.calledOnce;
-      /* eslint-disable camelcase */
-      expect(IncomingWebhook.prototype.send).to.be.calledWith({
-        text: `${members[0].profile.name} (${members[0].id}) tried to post a slur`,
-        attachments: [{
-          fallback: 'Slur Message',
-          color: 'danger',
-          author_name: `@${members[0].auth.local.username} ${members[0].profile.name} (${members[0].auth.local.email}; ${members[0]._id})`,
-          title: 'Slur in Party - (private party)',
-          title_link: undefined,
-          text: testSlurMessage,
-          mrkdwn_in: [
-            'text',
-          ],
-        }],
-      });
-      /* eslint-enable camelcase */
-
-      // Chat privileges are revoked
-      await expect(members[0].post(`/groups/${groupWithChat._id}/chat`, { message: testMessage })).to.eventually.be.rejected.and.eql({
-        code: 401,
-        error: 'NotAuthorized',
-        message: t('chatPrivilegesRevoked'),
-      });
+      expect(message.message.id).to.exist;
     });
 
     it('errors when slur is typed in mixed case', async () => {
@@ -463,6 +451,16 @@ describe('POST /chat', () => {
     });
   });
 
+  it('errors when user account is too young', async () => {
+    const brandNewUser = await generateUser();
+    await expect(brandNewUser.post('/groups/habitrpg/chat', { message: 'hi im new' }))
+      .to.eventually.be.rejected.and.eql({
+        code: 400,
+        error: 'BadRequest',
+        message: t('chatTemporarilyUnavailable'),
+      });
+  });
+
   it('creates a chat', async () => {
     const newMessage = await user.post(`/groups/${groupWithChat._id}/chat`, { message: testMessage });
     const groupMessages = await user.get(`/groups/${groupWithChat._id}/chat`);
@@ -525,6 +523,7 @@ describe('POST /chat', () => {
       'items.currentMount': mount,
       'items.currentPet': pet,
       'preferences.style': style,
+      'auth.timestamps.created': new Date('2022-01-01'),
     });
     await userWithStyle.sync();
 
@@ -550,6 +549,7 @@ describe('POST /chat', () => {
     };
     const backer = await generateUser({
       backer: backerInfo,
+      'auth.timestamps.created': new Date('2022-01-01'),
     });
 
     const message = await backer.post(`/groups/${groupWithChat._id}/chat`, { message: testMessage });
@@ -620,6 +620,9 @@ describe('POST /chat', () => {
           privacy: 'private',
         },
         members: 1,
+        leaderDetails: {
+          'auth.timestamps.created': new Date('2022-01-01'),
+        },
       });
 
       const message = await groupLeader.post(`/groups/${group._id}/chat`, { message: testMessage });

test/api/v3/integration/chat/POST-chat_seen.test.js

@@ -15,6 +15,10 @@ describe('POST /groups/:id/chat/seen', () => {
           privacy: 'public',
         },
         members: 1,
+        leaderDetails: {
+          'auth.timestamps.created': new Date('2022-01-01'),
+          balance: 10,
+        },
       });
 
       guild = group;
@@ -51,6 +55,9 @@ describe('POST /groups/:id/chat/seen', () => {
           privacy: 'private',
         },
         members: 1,
+        leaderDetails: {
+          'auth.timestamps.created': new Date('2022-01-01'),
+        },
       });
 
       party = group;

test/api/v3/integration/chat/POST-groups_id_chat_id_clear_flags.test.js

@@ -18,12 +18,16 @@ describe('POST /groups/:id/chat/:id/clearflags', () => {
         type: 'guild',
         privacy: 'public',
       },
+      leaderDetails: {
+        'auth.timestamps.created': new Date('2022-01-01'),
+        balance: 10,
+      },
     });
 
     groupWithChat = group;
     author = groupLeader;
     nonAdmin = await generateUser({ 'auth.timestamps.created': moment().subtract(USER_AGE_FOR_FLAGGING + 1, 'days').toDate() });
-    admin = await generateUser({ 'contributor.admin': true });
+    admin = await generateUser({ 'permissions.moderator': true });
 
     message = await author.post(`/groups/${groupWithChat._id}/chat`, { message: 'Some message' });
     message = message.message;
@@ -65,6 +69,7 @@ describe('POST /groups/:id/chat/:id/clearflags', () => {
         members: 1,
       });
 
+      await members[0].update({ 'auth.timestamps.created': new Date('2022-01-01') });
       let privateMessage = await members[0].post(`/groups/${group._id}/chat`, { message: 'Some message' });
       privateMessage = privateMessage.message;
 

test/api/v3/integration/coupons/GET-coupons.test.js

@@ -14,18 +14,18 @@ describe('GET /coupons/', () => {
     user = await generateUser();
   });
 
-  it('returns an error if user has no sudo permission', async () => {
+  it('returns an error if user has no coupons permission', async () => {
     await user.get('/user'); // needed so the request after this will authenticate with the correct cookie session
     await expect(user.get('/coupons')).to.eventually.be.rejected.and.eql({
       code: 401,
       error: 'NotAuthorized',
-      message: apiError('noSudoAccess'),
+      message: apiError('noPrivAccess'),
     });
   });
 
   it('should return the coupons in CSV format ordered by creation date', async () => {
     await user.update({
-      'contributor.sudo': true,
+      'permissions.coupons': true,
     });
 
     const coupons = await user.post('/coupons/generate/wondercon?count=11');

test/api/v3/integration/coupons/POST-coupons_enter_code.test.js

@@ -15,7 +15,7 @@ describe('POST /coupons/enter/:code', () => {
   beforeEach(async () => {
     user = await generateUser();
     sudoUser = await generateUser({
-      'contributor.sudo': true,
+      'permissions.coupons': true,
     });
   });
 

test/api/v3/integration/coupons/POST-coupons_generate_event.test.js

@@ -14,19 +14,19 @@ describe('POST /coupons/generate/:event', () => {
 
   beforeEach(async () => {
     user = await generateUser({
-      'contributor.sudo': true,
+      'permissions.coupons': true,
     });
   });
 
-  it('returns an error if user has no sudo permission', async () => {
+  it('returns an error if user has no coupons permission', async () => {
     await user.update({
-      'contributor.sudo': false,
+      'permissions.coupons': false,
     });
 
     await expect(user.post('/coupons/generate/aaa')).to.eventually.be.rejected.and.eql({
       code: 401,
       error: 'NotAuthorized',
-      message: apiError('noSudoAccess'),
+      message: apiError('noPrivAccess'),
     });
   });
 
@@ -48,7 +48,7 @@ describe('POST /coupons/generate/:event', () => {
 
   it('should generate coupons', async () => {
     await user.update({
-      'contributor.sudo': true,
+      'permissions.coupons': true,
     });
 
     const coupons = await user.post('/coupons/generate/wondercon?count=2');

test/api/v3/integration/coupons/POST-coupons_validate_code.test.js

@@ -21,7 +21,7 @@ describe('POST /coupons/validate/:code', () => {
 
   it('returns true if coupon code is valid', async () => {
     const sudoUser = await generateUser({
-      'contributor.sudo': true,
+      'permissions.coupons': true,
     });
 
     const [coupon] = await sudoUser.post('/coupons/generate/wondercon?count=1');

test/api/v3/integration/debug/POST-debug_make-admin.test.js

@@ -3,7 +3,7 @@ import {
   generateUser,
 } from '../../../../helpers/api-integration/v3';
 
-describe('POST /debug/make-admin (pended for v3 prod testing)', () => {
+describe('POST /debug/make-admin', () => {
   let user;
 
   before(async () => {
@@ -14,12 +14,12 @@ describe('POST /debug/make-admin (pended for v3 prod testing)', () => {
     nconf.set('IS_PROD', false);
   });
 
-  it('makes user an admine', async () => {
+  it('makes user an admin', async () => {
     await user.post('/debug/make-admin');
 
     await user.sync();
 
-    expect(user.contributor.admin).to.eql(true);
+    expect(user.permissions.fullAccess).to.eql(true);
   });
 
   it('returns error when not in production mode', async () => {

test/api/v3/integration/groups/GET-groups.test.js

@@ -219,11 +219,19 @@ describe('GET /groups', () => {
 
     it('returns 30 guilds per page ordered by number of members', async () => {
       await user.update({ balance: 9000 });
-      const groups = await Promise.all(_.times(60, i => generateGroup(user, {
-        name: `public guild ${i} - is member`,
-        type: 'guild',
-        privacy: 'public',
-      })));
+      const delay = () => new Promise(resolve => setTimeout(resolve, 40));
+      const promises = [];
+
+      for (let i = 0; i < 60; i += 1) {
+        promises.push(generateGroup(user, {
+          name: `public guild ${i} - is member`,
+          type: 'guild',
+          privacy: 'public',
+        }));
+        await delay(); // eslint-disable-line no-await-in-loop
+      }
+
+      const groups = await Promise.all(promises);
 
       // update group number 32 and not the first to make sure sorting works
       await groups[32].update({ name: 'guild with most members', memberCount: 199 });

test/api/v3/integration/groups/GET-groups_id.test.js

@@ -315,7 +315,7 @@ describe('GET /groups/:id', () => {
 
       beforeEach(async () => {
         admin = await generateUser({
-          'contributor.admin': true,
+          'permissions.moderator': true,
         });
       });
 

test/api/v3/integration/groups/POST-group_remove_manager.test.js

@@ -1,4 +1,3 @@
-import { find } from 'lodash';
 import {
   createAndPopulateGroup,
   translate as t,
@@ -7,22 +6,19 @@ import {
 describe('POST /group/:groupId/remove-manager', () => {
   let leader; let nonLeader; let
     groupToUpdate;
-  const groupName = 'Test Public Guild';
+  const groupName = 'Test Private Guild';
   const groupType = 'guild';
   let nonManager;
 
-  function findAssignedTask (memberTask) {
-    return memberTask.group.id === groupToUpdate._id;
-  }
-
   beforeEach(async () => {
     const { group, groupLeader, members } = await createAndPopulateGroup({
       groupDetails: {
         name: groupName,
         type: groupType,
-        privacy: 'public',
+        privacy: 'private',
       },
       members: 2,
+      upgradeToGroupPlan: true,
     });
 
     groupToUpdate = group;
@@ -62,28 +58,4 @@ describe('POST /group/:groupId/remove-manager', () => {
 
     expect(updatedGroup.managers[nonLeader._id]).to.not.exist;
   });
-
-  it('removes group approval notifications from a manager that is removed', async () => {
-    await leader.post(`/groups/${groupToUpdate._id}/add-manager`, {
-      managerId: nonLeader._id,
-    });
-    const task = await leader.post(`/tasks/group/${groupToUpdate._id}`, {
-      text: 'test todo',
-      type: 'todo',
-      requiresApproval: true,
-    });
-    await nonLeader.post(`/tasks/${task._id}/assign/${nonManager._id}`);
-    const memberTasks = await nonManager.get('/tasks/user');
-    const syncedTask = find(memberTasks, findAssignedTask);
-    await nonManager.post(`/tasks/${syncedTask._id}/score/up`);
-
-    const updatedGroup = await leader.post(`/groups/${groupToUpdate._id}/remove-manager`, {
-      managerId: nonLeader._id,
-    });
-
-    await nonLeader.sync();
-
-    expect(nonLeader.notifications.length).to.equal(0);
-    expect(updatedGroup.managers[nonLeader._id]).to.not.exist;
-  });
 });

test/api/v3/integration/groups/POST-groups.test.js

@@ -2,6 +2,8 @@ import {
   generateUser,
   translate as t,
 } from '../../../../helpers/api-integration/v3';
+import { model as Group } from '../../../../../website/server/models/group';
+import { MAX_SUMMARY_SIZE_FOR_GUILDS } from '../../../../../website/common/script/constants';
 
 describe('POST /group', () => {
   let user;
@@ -70,6 +72,20 @@ describe('POST /group', () => {
 
       expect(updatedGroup.summary).to.eql(summary);
     });
+
+    it('returns error when summary is longer than MAX_SUMMARY_SIZE_FOR_GUILDS characters', async () => {
+      const name = 'Test Group';
+      const summary = 'A'.repeat(MAX_SUMMARY_SIZE_FOR_GUILDS + 1);
+      await expect(user.post('/groups', {
+        name,
+        type: 'guild',
+        summary,
+      })).to.eventually.be.rejected.and.eql({
+        code: 400,
+        error: 'BadRequest',
+        message: t('invalidReqParams'),
+      });
+    });
   });
 
   context('Guilds', () => {
@@ -203,6 +219,23 @@ describe('POST /group', () => {
 
         expect(updatedUser.balance).to.eql(user.balance - 1);
       });
+
+      it('does not deduct the gems from user when guild creation fails', async () => {
+        const stub = sinon.stub(Group.prototype, 'save').rejects();
+        const promise = user.post('/groups', {
+          name: groupName,
+          type: groupType,
+          privacy: groupPrivacy,
+        });
+
+        await expect(promise).to.eventually.be.rejected;
+
+        const updatedUser = await user.get('/user');
+
+        expect(updatedUser.balance).to.eql(user.balance);
+
+        stub.restore();
+      });
     });
   });
 

test/api/v3/integration/groups/POST-groups_groupId_leave.test.js

@@ -37,6 +37,7 @@ describe('POST /groups/:groupId/leave', () => {
         leader = groupLeader;
         member = members[0]; // eslint-disable-line prefer-destructuring
         memberCount = group.memberCount;
+        await members[0].update({ 'auth.timestamps.created': new Date('2022-01-01') });
       });
 
       it('prevents non members from leaving', async () => {
@@ -152,6 +153,10 @@ describe('POST /groups/:groupId/leave', () => {
             type: 'guild',
           },
           invites: 1,
+          leaderDetails: {
+            'auth.timestamps.created': new Date('2022-01-01'),
+            balance: 10,
+          },
         });
 
         privateGuild = group;

test/api/v3/integration/groups/POST-groups_id_removeMember.test.js

@@ -32,7 +32,7 @@ describe('POST /groups/:groupId/removeMember/:memberId', () => {
     invitedUser = invitees[0]; // eslint-disable-line prefer-destructuring
     member = members[0]; // eslint-disable-line prefer-destructuring
     member2 = members[1]; // eslint-disable-line prefer-destructuring
-    adminUser = await generateUser({ 'contributor.admin': true });
+    adminUser = await generateUser({ 'permissions.moderator': true });
   });
 
   context('All Groups', () => {
@@ -153,6 +153,7 @@ describe('POST /groups/:groupId/removeMember/:memberId', () => {
         },
         invites: 1,
         members: 2,
+        leaderDetails: { 'auth.timestamps.created': new Date('2022-01-01') },
       });
 
       party = group;

test/api/v3/integration/groups/POST-groups_invite.test.js

@@ -7,7 +7,7 @@ import {
 } from '../../../../helpers/api-integration/v3';
 
 const INVITES_LIMIT = 100;
-const PARTY_LIMIT_MEMBERS = 30;
+const PARTY_LIMIT_MEMBERS = 29;
 const MAX_EMAIL_INVITES_BY_USER = 200;
 
 describe('Post /groups/:groupId/invite', () => {
@@ -650,7 +650,7 @@ describe('Post /groups/:groupId/invite', () => {
         .to.eventually.be.rejected.and.eql({
           code: 400,
           error: 'BadRequest',
-          message: t('partyExceedsMembersLimit', { maxMembersParty: PARTY_LIMIT_MEMBERS }),
+          message: t('partyExceedsMembersLimit', { maxMembersParty: PARTY_LIMIT_MEMBERS + 1 }),
         });
     }).timeout(10000);
   });

test/api/v3/integration/groups/PUT-groups.test.js

@@ -3,6 +3,7 @@ import {
   generateUser,
   translate as t,
 } from '../../../../helpers/api-integration/v3';
+import { MAX_SUMMARY_SIZE_FOR_GUILDS } from '../../../../../website/common/script/constants';
 
 describe('PUT /group', () => {
   let leader; let nonLeader; let groupToUpdate; let
@@ -20,7 +21,7 @@ describe('PUT /group', () => {
       },
       members: 1,
     });
-    adminUser = await generateUser({ 'contributor.admin': true });
+    adminUser = await generateUser({ 'permissions.moderator': true });
     groupToUpdate = group;
     leader = groupLeader;
     nonLeader = members[0]; // eslint-disable-line prefer-destructuring
@@ -104,11 +105,11 @@ describe('PUT /group', () => {
     // Update the bannedWordsAllowed property for the group
     const response = await groupLeader.put(`/groups/${group._id}`, updateGroupDetails);
 
-    expect(groupLeader.contributor.admin).to.eql(true);
+    expect(groupLeader.permissions.fullAccess).to.eql(true);
     expect(response.bannedWordsAllowed).to.eql(true);
   });
 
-  it('does not allow for a non-admin to update the bannedWordsAllow property for an existing guild', async () => {
+  it('does not allow for a non-moderator to update the bannedWordsAllow property for an existing guild', async () => {
     const { group, groupLeader } = await createAndPopulateGroup({
       groupDetails: {
         name: 'public guild',
@@ -128,7 +129,17 @@ describe('PUT /group', () => {
     // Update the bannedWordsAllowed property for the group
     const response = await groupLeader.put(`/groups/${group._id}`, updateGroupDetails);
 
-    expect(groupLeader.contributor.admin).to.eql(undefined);
     expect(response.bannedWordsAllowed).to.eql(undefined);
   });
+
+  it('returns error when summary is longer than MAX_SUMMARY_SIZE_FOR_GUILDS characters', async () => {
+    const summary = 'A'.repeat(MAX_SUMMARY_SIZE_FOR_GUILDS + 1);
+    await expect(leader.put(`/groups/${groupToUpdate._id}`, {
+      summary,
+    })).to.eventually.be.rejected.and.eql({
+      code: 400,
+      error: 'BadRequest',
+      message: t('invalidReqParams'),
+    });
+  });
 });

test/api/v3/integration/hall/GET-hall_heroes_heroId.test.js

@@ -7,9 +7,14 @@ import {
 describe('GET /heroes/:heroId', () => {
   let user;
 
+  const heroFields = [
+    '_id', 'id', 'auth', 'balance', 'contributor', 'flags', 'items',
+    'lastCron', 'party', 'preferences', 'profile', 'purchased', 'secret',
+  ];
+
   before(async () => {
     user = await generateUser({
-      contributor: { admin: true },
+      permissions: { userSupport: true },
     });
   });
 
@@ -19,7 +24,7 @@ describe('GET /heroes/:heroId', () => {
     await expect(nonAdmin.get(`/hall/heroes/${user._id}`)).to.eventually.be.rejected.and.eql({
       code: 401,
       error: 'NotAuthorized',
-      message: t('noAdminAccess'),
+      message: t('noPrivAccess'),
     });
   });
 
@@ -49,10 +54,7 @@ describe('GET /heroes/:heroId', () => {
     });
     const heroRes = await user.get(`/hall/heroes/${hero._id}`);
 
-    expect(heroRes).to.have.all.keys([ // works as: object has all and only these keys
-      '_id', 'id', 'balance', 'profile', 'purchased',
-      'contributor', 'auth', 'items', 'secret',
-    ]);
+    expect(heroRes).to.have.all.keys(heroFields); // works as: object has all and only these keys
     expect(heroRes.auth.local).not.to.have.keys(['salt', 'hashed_password']);
     expect(heroRes.profile).to.have.all.keys(['name']);
     expect(heroRes.secret.text).to.be.eq('Super Hero');
@@ -64,10 +66,7 @@ describe('GET /heroes/:heroId', () => {
     });
     const heroRes = await user.get(`/hall/heroes/${hero.auth.local.username}`);
 
-    expect(heroRes).to.have.all.keys([ // works as: object has all and only these keys
-      '_id', 'id', 'balance', 'profile', 'purchased',
-      'contributor', 'auth', 'items', 'secret',
-    ]);
+    expect(heroRes).to.have.all.keys(heroFields);
     expect(heroRes.auth.local).not.to.have.keys(['salt', 'hashed_password']);
     expect(heroRes.profile).to.have.all.keys(['name']);
   });

test/api/v3/integration/hall/GET-hall_heroes_party_groupId.test.js

@@ -0,0 +1,61 @@
+import { v4 as generateUUID } from 'uuid';
+import {
+  generateUser,
+  generateGroup,
+  translate as t,
+} from '../../../../helpers/api-integration/v3';
+import apiError from '../../../../../website/server/libs/apiError';
+
+describe('GET /heroes/party/:groupId', () => {
+  let user; // admin user
+
+  before(async () => {
+    user = await generateUser({
+      'permissions.userSupport': true,
+    });
+  });
+
+  it('requires the caller to be an admin', async () => {
+    const nonAdmin = await generateUser();
+    const party = await generateGroup(nonAdmin, { type: 'party', privacy: 'private' });
+    await expect(nonAdmin.get(`/hall/heroes/party/${party._id}`)).to.eventually.be.rejected.and.eql({
+      code: 401,
+      error: 'NotAuthorized',
+      message: apiError('noPrivAccess'),
+    });
+  });
+
+  it('validates req.params.groupId', async () => {
+    await expect(user.get('/hall/heroes/party/invalidUUID')).to.eventually.be.rejected.and.eql({
+      code: 400,
+      error: 'BadRequest',
+      message: t('invalidReqParams'),
+    });
+  });
+
+  it('handles non-existing party', async () => {
+    const dummyId = generateUUID();
+    await expect(user.get(`/hall/heroes/party/${dummyId}`)).to.eventually.be.rejected.and.eql({
+      code: 404,
+      error: 'NotFound',
+      message: apiError('groupWithIDNotFound', { groupId: dummyId }),
+    });
+  });
+
+  it('returns only necessary party data given group id', async () => {
+    const nonAdmin = await generateUser();
+    const party = await generateGroup(nonAdmin, { type: 'party', privacy: 'private' });
+
+    const partyRes = await user.get(`/hall/heroes/party/${party._id}`);
+
+    expect(partyRes).to.have.all.keys([ // works as: object has all and only these keys
+      '_id', 'id', 'balance', 'challengeCount', 'leader', 'leaderOnly', 'memberCount',
+      'purchased', 'quest', 'summary',
+    ]);
+    expect(partyRes.summary).to.eq(' ');
+    // NB: 'summary' is NOT a field that the API route retrieves!
+    // It must not be retrieved for privacy reasons.
+    // However the group model automatically adds a summary for reasons given here:
+    // https://github.com/HabitRPG/habitica/blob/8da36bf27c62ba0397a6af260c20d35a17f3d911/website/server/models/group.js#L161-L170
+  });
+});

test/api/v3/integration/hall/PUT-hall_heores_heroId.test.js

@@ -1,4 +1,5 @@
 import { v4 as generateUUID } from 'uuid';
+import { model as User } from '../../../../../website/server/models/user';
 import {
   generateUser,
   translate as t,
@@ -8,15 +9,12 @@ describe('PUT /heroes/:heroId', () => {
   let user;
 
   const heroFields = [
-    '_id', 'balance', 'profile', 'purchased',
-    'contributor', 'auth', 'items', 'flags',
-    'secret',
+    '_id', 'auth', 'balance', 'contributor', 'flags', 'items', 'lastCron',
+    'party', 'preferences', 'profile', 'purchased', 'secret', 'permissions',
   ];
 
   before(async () => {
-    user = await generateUser({
-      contributor: { admin: true },
-    });
+    user = await generateUser({ 'permissions.userSupport': true });
   });
 
   it('requires the caller to be an admin', async () => {
@@ -25,7 +23,7 @@ describe('PUT /heroes/:heroId', () => {
     await expect(nonAdmin.put(`/hall/heroes/${user._id}`)).to.eventually.be.rejected.and.eql({
       code: 401,
       error: 'NotAuthorized',
-      message: t('noAdminAccess'),
+      message: t('noPrivAccess'),
     });
   });
 
@@ -57,8 +55,7 @@ describe('PUT /heroes/:heroId', () => {
     });
 
     // test response
-    // works as: object has all and only these keys
-    expect(heroRes).to.have.all.keys(heroFields);
+    expect(heroRes).to.have.all.keys(heroFields); // works as: object has all and only these keys
     expect(heroRes.auth.local).not.to.have.keys(['salt', 'hashed_password']);
     expect(heroRes.profile).to.have.all.keys(['name']);
 
@@ -134,7 +131,6 @@ describe('PUT /heroes/:heroId', () => {
     });
 
     // test response
-    // works as: object has all and only these keys
     expect(heroRes).to.have.all.keys(heroFields);
     expect(heroRes.auth.local).not.to.have.keys(['salt', 'hashed_password']);
     expect(heroRes.profile).to.have.all.keys(['name']);
@@ -159,7 +155,6 @@ describe('PUT /heroes/:heroId', () => {
     });
 
     // test response
-    // works as: object has all and only these keys
     expect(heroRes).to.have.all.keys(heroFields);
     expect(heroRes.auth.local).not.to.have.keys(['salt', 'hashed_password']);
     expect(heroRes.profile).to.have.all.keys(['name']);
@@ -215,7 +210,6 @@ describe('PUT /heroes/:heroId', () => {
     });
 
     // test response
-    // works as: object has all and only these keys
     expect(heroRes).to.have.all.keys(heroFields);
     expect(heroRes.auth.local).not.to.have.keys(['salt', 'hashed_password']);
     expect(heroRes.profile).to.have.all.keys(['name']);
@@ -226,4 +220,35 @@ describe('PUT /heroes/:heroId', () => {
     await hero.sync();
     expect(hero.items.special.snowball).to.equal(5);
   });
+
+  it('does not accidentally update API Token', async () => {
+    // This test has been included because hall.js will contain code to produce
+    // a truncated version of the API Token, and we want to be sure that
+    // the real Token is not modified by bugs in that code.
+    const hero = await generateUser();
+    const originalToken = hero.apiToken;
+
+    // make any change to the user except the Token
+    await user.put(`/hall/heroes/${hero._id}`, {
+      contributor: { text: 'Astronaut' },
+    });
+
+    const updatedHero = await User.findById(hero._id).exec();
+    expect(updatedHero.apiToken).to.equal(originalToken);
+    expect(updatedHero.apiTokenObscured).to.not.exist;
+  });
+
+  it('does update API Token when admin changes it', async () => {
+    const hero = await generateUser();
+    const originalToken = hero.apiToken;
+
+    // change the user's API Token
+    await user.put(`/hall/heroes/${hero._id}`, {
+      changeApiToken: true,
+    });
+
+    const updatedHero = await User.findById(hero._id).exec();
+    expect(updatedHero.apiToken).to.not.equal(originalToken);
+    expect(updatedHero.apiTokenObscured).to.not.exist;
+  });
 });

test/api/v3/integration/members/POST-send_private_message.test.js

@@ -176,7 +176,7 @@ describe('POST /members/send-private-message', () => {
 
   it('allows admin to send when sender has blocked the admin', async () => {
     userToSendMessage = await generateUser({
-      'contributor.admin': 1,
+      'permissions.moderator': true,
     });
     const receiver = await generateUser({ 'inbox.blocks': [userToSendMessage._id] });
 
@@ -204,7 +204,7 @@ describe('POST /members/send-private-message', () => {
 
   it('allows admin to send when to user has opted out of messaging', async () => {
     userToSendMessage = await generateUser({
-      'contributor.admin': 1,
+      'permissions.moderator': true,
     });
     const receiver = await generateUser({ 'inbox.optOut': true });
 

test/api/v3/integration/notifications/prevent-multiple-notification.js

@@ -25,6 +25,7 @@ describe('Prevent multiple notifications', () => {
 
     for (let i = 0; i < 4; i += 1) {
       for (let memberIndex = 0; memberIndex < partyMembers.length; memberIndex += 1) {
+        await partyMembers[memberIndex].update({ 'auth.timestamps.created': new Date('2022-01-01') }); // eslint-disable-line no-await-in-loop
         multipleChatMessages.push(
           partyMembers[memberIndex].post(`/groups/${party._id}/chat`, { message: `Message ${i}_${memberIndex}` }),
         );

test/api/v3/integration/qrcodes/GET-qrcodes_user.test.js

@@ -1,33 +0,0 @@
-import superagent from 'superagent';
-import nconf from 'nconf';
-import {
-  generateUser,
-  translate as t,
-} from '../../../../helpers/api-integration/v3';
-
-const API_TEST_SERVER_PORT = nconf.get('PORT');
-xdescribe('GET /qr-code/user/:memberId', () => {
-  let user;
-
-  before(async () => {
-    user = await generateUser();
-  });
-
-  it('validates req.params.memberId', async () => {
-    await expect(user.get('/qr-code/user/invalidUUID')).to.eventually.be.rejected.and.eql({
-      code: 400,
-      error: 'BadRequest',
-      message: t('invalidReqParams'),
-    });
-  });
-
-  it('redirects to profile page', async () => {
-    const url = `http://localhost:${API_TEST_SERVER_PORT}/qr-code/user/${user._id}`;
-    const response = await superagent.get(url).end((err, res) => {
-      expect(err).to.be(undefined);
-      return res;
-    });
-    expect(response.status).to.eql(200);
-    expect(response.request.url).to.eql(`http://localhost:${API_TEST_SERVER_PORT}/static/front/#?memberId=${user._id}`);
-  });
-});

test/api/v3/integration/quests/POST-groups_groupId_quests_invite.test.js

@@ -240,6 +240,31 @@ describe('POST /groups/:groupId/quests/invite/:questKey', () => {
         expect(body.group.name).to.eql(questingGroup.name);
         expect(body.quest.key).to.eql(PET_QUEST);
       });
+
+      it('sends quest invited webhook to the inviter too', async () => {
+        const uuid = generateUUID();
+
+        await leader.post('/user/webhook', {
+          url: `http://localhost:${server.port}/webhooks/${uuid}`,
+          type: 'questActivity',
+          enabled: true,
+          options: {
+            questInvited: true,
+          },
+        });
+
+        await leader.post(`/groups/${questingGroup._id}/quests/invite/${PET_QUEST}`);
+
+        await sleep();
+
+        const body = server.getWebhookData(uuid);
+
+        expect(body.type).to.eql('questInvited');
+        expect(body.group.id).to.eql(questingGroup.id);
+        expect(body.group.name).to.eql(questingGroup.name);
+        expect(body.quest.key).to.eql(PET_QUEST);
+        expect(body.quest.questOwner).to.eql(questingGroup.leader._id);
+      });
     });
   });
 });

test/api/v3/integration/quests/POST-groups_groupid_quests_leave.test.js

@@ -61,15 +61,6 @@ describe('POST /groups/:groupId/quests/leave', () => {
         });
     });
 
-    it('returns an error when quest is not active', async () => {
-      await expect(partyMembers[0].post(`/groups/${questingGroup._id}/quests/leave`))
-        .to.eventually.be.rejected.and.eql({
-          code: 404,
-          error: 'NotFound',
-          message: t('noActiveQuestToLeave'),
-        });
-    });
-
     it('returns an error when quest leader attempts to leave', async () => {
       await leader.post(`/groups/${questingGroup._id}/quests/invite/${PET_QUEST}`);
       await partyMembers[0].post(`/groups/${questingGroup._id}/quests/accept`);
@@ -97,18 +88,14 @@ describe('POST /groups/:groupId/quests/leave', () => {
     });
   });
 
-  it('leaves a quest', async () => {
-    await leader.post(`/groups/${questingGroup._id}/quests/invite/${PET_QUEST}`);
-    await partyMembers[0].post(`/groups/${questingGroup._id}/quests/accept`);
-    await partyMembers[1].post(`/groups/${questingGroup._id}/quests/accept`);
-
-    const leaveResult = await partyMembers[0].post(`/groups/${questingGroup._id}/quests/leave`);
+  async function letPartyMemberLeaveAndCheckChanges (partyMember) {
+    const leaveResult = await partyMember.post(`/groups/${questingGroup._id}/quests/leave`);
     await Promise.all([
-      partyMembers[0].sync(),
+      partyMember.sync(),
       questingGroup.sync(),
     ]);
 
-    expect(partyMembers[0].party.quest).to.eql({
+    expect(partyMember.party.quest).to.eql({
       key: null,
       progress: {
         up: 0,
@@ -120,6 +107,29 @@ describe('POST /groups/:groupId/quests/leave', () => {
       RSVPNeeded: false,
     });
     expect(questingGroup.quest).to.deep.equal(leaveResult);
-    expect(questingGroup.quest.members[partyMembers[0]._id]).to.be.false;
+    expect(questingGroup.quest.members[partyMember._id]).to.be.false;
+  }
+
+  it('leaves an active quest', async () => {
+    await leader.post(`/groups/${questingGroup._id}/quests/invite/${PET_QUEST}`);
+    await partyMembers[0].post(`/groups/${questingGroup._id}/quests/accept`);
+    await partyMembers[1].post(`/groups/${questingGroup._id}/quests/accept`);
+
+    await questingGroup.sync();
+
+    expect(questingGroup.quest.active).to.eql(true);
+
+    await letPartyMemberLeaveAndCheckChanges(partyMembers[0]);
+  });
+
+  it('leaves an inactive quest ', async () => {
+    await leader.post(`/groups/${questingGroup._id}/quests/invite/${PET_QUEST}`);
+    await partyMembers[0].post(`/groups/${questingGroup._id}/quests/accept`);
+
+    await questingGroup.sync();
+
+    expect(questingGroup.quest.active).to.eql(false);
+
+    await letPartyMemberLeaveAndCheckChanges(partyMembers[0]);
   });
 });

test/api/v3/integration/shops/GET-shops_backgrounds.test.js

@@ -14,7 +14,7 @@ describe('GET /shops/backgrounds', () => {
     const shop = await user.get('/shops/backgrounds');
     expect(shop.identifier).to.equal('backgroundShop');
     expect(shop.text).to.eql(t('backgroundShop'));
-    expect(shop.notes).to.eql(t('backgroundShopText'));
+    expect(shop.notes).to.eql(t('backgroundShop'));
     expect(shop.imageName).to.equal('background_shop');
     expect(shop.sets).to.be.an('array');
 

test/api/v3/integration/tasks/DELETE-tasks_id.test.js

@@ -28,11 +28,10 @@ describe('DELETE /tasks/:id', () => {
 
     it('deletes a user\'s task', async () => {
       await user.del(`/tasks/${task._id}`);
-
       await expect(user.get(`/tasks/${task._id}`)).to.eventually.be.rejected.and.eql({
         code: 404,
         error: 'NotFound',
-        message: t('taskNotFound'),
+        message: t('messageTaskNotFound'),
       });
     });
 
@@ -42,7 +41,7 @@ describe('DELETE /tasks/:id', () => {
       await expect(user.get(`/tasks/${task._id}`)).to.eventually.be.rejected.and.eql({
         code: 404,
         error: 'NotFound',
-        message: t('taskNotFound'),
+        message: t('messageTaskNotFound'),
       });
     });
   });
@@ -124,7 +123,7 @@ describe('DELETE /tasks/:id', () => {
       await expect(user.del('/tasks/550e8400-e29b-41d4-a716-446655440000')).to.eventually.be.rejected.and.eql({
         code: 404,
         error: 'NotFound',
-        message: t('taskNotFound'),
+        message: t('messageTaskNotFound'),
       });
     });
 
@@ -138,7 +137,7 @@ describe('DELETE /tasks/:id', () => {
       await expect(user.del(`/tasks/${anotherUsersTask._id}`)).to.eventually.be.rejected.and.eql({
         code: 404,
         error: 'NotFound',
-        message: t('taskNotFound'),
+        message: t('messageTaskNotFound'),
       });
     });
 

test/api/v3/integration/tasks/GET-tasks_challenge_challengeId.test.js

@@ -47,7 +47,7 @@ describe('GET /tasks/:taskId', () => {
     await expect(user.get(`/tasks/${generateUUID()}`)).to.eventually.be.rejected.and.eql({
       code: 404,
       error: 'NotFound',
-      message: t('taskNotFound'),
+      message: t('messageTaskNotFound'),
     });
   });
 
@@ -68,7 +68,7 @@ describe('GET /tasks/:taskId', () => {
         await expect(anotherUser.get(`/tasks/${task._id}`)).to.eventually.be.rejected.and.eql({
           code: 404,
           error: 'NotFound',
-          message: t('taskNotFound'),
+          message: t('messageTaskNotFound'),
         });
       });
     });

test/api/v3/integration/tasks/GET-tasks_id.test.js

@@ -21,7 +21,7 @@ describe('GET /tasks/:id', () => {
         await expect(user.get(`/tasks/${dummyId}`)).to.eventually.be.rejected.and.eql({
           code: 404,
           error: 'NotFound',
-          message: t('taskNotFound'),
+          message: t('messageTaskNotFound'),
         });
       });
     });
@@ -63,7 +63,7 @@ describe('GET /tasks/:id', () => {
         await expect(anotherUser.get(`/tasks/${task._id}`)).to.eventually.be.rejected.and.eql({
           code: 404,
           error: 'NotFound',
-          message: t('taskNotFound'),
+          message: t('messageTaskNotFound'),
         });
       });
     });
@@ -105,7 +105,7 @@ describe('GET /tasks/:id', () => {
 
       it('can get challenge task if admin', async () => {
         const admin = await generateUser({
-          'contributor.admin': true,
+          'permissions.challengeAdmin': true,
         });
 
         const getTask = await admin.get(`/tasks/${task._id}`);
@@ -118,7 +118,7 @@ describe('GET /tasks/:id', () => {
         await expect(user.get(`/tasks/${task._id}`)).to.eventually.be.rejected.and.eql({
           code: 404,
           error: 'NotFound',
-          message: t('taskNotFound'),
+          message: t('messageTaskNotFound'),
         });
       });
     });
@@ -134,6 +134,7 @@ describe('GET /tasks/:id', () => {
           type: 'guild',
         },
         members: 1,
+        upgradeToGroupPlan: true,
       });
 
       group = groupData.group;
@@ -163,7 +164,7 @@ describe('GET /tasks/:id', () => {
         await expect(user.get(`/tasks/${task._id}`)).to.eventually.be.rejected.and.eql({
           code: 404,
           error: 'NotFound',
-          message: t('taskNotFound'),
+          message: t('messageTaskNotFound'),
         });
       });
     });

test/api/v3/integration/tasks/POST-tasks_clearCompletedTodos.test.js

@@ -7,8 +7,15 @@ import {
 describe('POST /tasks/clearCompletedTodos', () => {
   it('deletes all completed todos except the ones from a challenge and group', async () => {
     const user = await generateUser({ balance: 1 });
-    const guild = await generateGroup(user);
+    const guild = await generateGroup(
+      user,
+      {},
+      { 'purchased.plan.customerId': 'group-unlimited' },
+    );
     const challenge = await generateChallenge(user, guild);
+    await user.put('/user', {
+      'preferences.tasks.mirrorGroupTasks': [guild._id],
+    });
     await user.post(`/challenges/${challenge._id}/join`);
 
     const initialTodoCount = user.tasksOrder.todos.length;
@@ -29,7 +36,7 @@ describe('POST /tasks/clearCompletedTodos', () => {
       text: 'todo 7',
       type: 'todo',
     });
-    await user.post(`/tasks/${groupTask._id}/assign/${user._id}`);
+    await user.post(`/tasks/${groupTask._id}/assign`, [user._id]);
 
     const tasks = await user.get('/tasks/user?type=todos');
     expect(tasks.length).to.equal(initialTodoCount + 7);

test/api/v3/integration/tasks/POST-tasks_move_taskId_to_position.test.js

@@ -23,7 +23,7 @@ describe('POST /tasks/:taskId/move/to/:position', () => {
     await expect(user.post(`/tasks/${generateUUID()}/move/to/1`)).to.eventually.be.rejected.and.eql({
       code: 404,
       error: 'NotFound',
-      message: t('taskNotFound'),
+      message: t('messageTaskNotFound'),
     });
   });
 

test/api/v3/integration/tasks/POST-tasks_unlink-all_challengeId.test.js

@@ -80,7 +80,7 @@ describe('POST /tasks/unlink-all/:challengeId', () => {
     await expect(user.get(`/tasks/${daily._id}`)).to.eventually.be.rejected.and.eql({
       code: 404,
       error: 'NotFound',
-      message: t('taskNotFound'),
+      message: t('messageTaskNotFound'),
     });
   });
 
@@ -97,7 +97,7 @@ describe('POST /tasks/unlink-all/:challengeId', () => {
     await user.del(`/challenges/${challenge._id}`);
     await user.post(`/tasks/unlink-all/${challenge._id}?keep=keep-all`);
     // Get the task for the second user
-    const [, anotherUserTask] = await anotherUser.get('/tasks/user');
+    const [anotherUserTask] = await anotherUser.get('/tasks/user');
     // Expect the second user to still have the task, but unlinked
     expect(anotherUserTask.challenge).to.eql({
       taskId: daily._id,

test/api/v3/integration/tasks/POST-tasks_unlink-one_taskId.test.js

@@ -65,7 +65,7 @@ describe('POST /tasks/unlink-one/:taskId', () => {
       .to.eventually.be.rejected.and.eql({
         code: 404,
         error: 'NotFound',
-        message: t('taskNotFound'),
+        message: t('messageTaskNotFound'),
       });
   });
 
@@ -92,16 +92,16 @@ describe('POST /tasks/unlink-one/:taskId', () => {
 
   it('unlinks a task from a challenge and saves it on keep=keep', async () => {
     await user.post(`/tasks/challenge/${challenge._id}`, tasksToTest.daily);
-    let [, daily] = await user.get('/tasks/user');
+    let [daily] = await user.get('/tasks/user');
     await user.del(`/challenges/${challenge._id}`);
     await user.post(`/tasks/unlink-one/${daily._id}?keep=keep`);
-    [, daily] = await user.get('/tasks/user');
+    [daily] = await user.get('/tasks/user');
     expect(daily.challenge).to.eql({});
   });
 
   it('unlinks a task from a challenge and deletes it on keep=remove', async () => {
     await user.post(`/tasks/challenge/${challenge._id}`, tasksToTest.daily);
-    const [, daily] = await user.get('/tasks/user');
+    const [daily] = await user.get('/tasks/user');
     await user.del(`/challenges/${challenge._id}`);
     await user.post(`/tasks/unlink-one/${daily._id}?keep=remove`);
     const tasks = await user.get('/tasks/user');

test/api/v3/integration/tasks/PUT-tasks_id.test.js

@@ -535,24 +535,12 @@ describe('PUT /tasks/:id', () => {
       });
 
       expect(savedMonthly.nextDue.length).to.eql(6);
-      expect(moment(savedMonthly.nextDue[0]).toDate()).to.eql(
-        moment(date2).add(1, 'months').startOf('day').toDate(),
-      );
-      expect(moment(savedMonthly.nextDue[1]).toDate()).to.eql(
-        moment(date2).add(2, 'months').startOf('day').toDate(),
-      );
-      expect(moment(savedMonthly.nextDue[2]).toDate()).to.eql(
-        moment(date2).add(3, 'months').startOf('day').toDate(),
-      );
-      expect(moment(savedMonthly.nextDue[3]).toDate()).to.eql(
-        moment(date2).add(4, 'months').startOf('day').toDate(),
-      );
-      expect(moment(savedMonthly.nextDue[4]).toDate()).to.eql(
-        moment(date2).add(5, 'months').startOf('day').toDate(),
-      );
-      expect(moment(savedMonthly.nextDue[5]).toDate()).to.eql(
-        moment(date2).add(6, 'months').startOf('day').toDate(),
-      );
+      expect(moment(savedMonthly.nextDue[0]).isSame(moment(date2).add(1, 'months').startOf('day')));
+      expect(moment(savedMonthly.nextDue[1]).isSame(moment(date2).add(2, 'months').startOf('day')));
+      expect(moment(savedMonthly.nextDue[2]).isSame(moment(date2).add(3, 'months').startOf('day')));
+      expect(moment(savedMonthly.nextDue[3]).isSame(moment(date2).add(4, 'months').startOf('day')));
+      expect(moment(savedMonthly.nextDue[4]).isSame(moment(date2).add(5, 'months').startOf('day')));
+      expect(moment(savedMonthly.nextDue[5]).isSame(moment(date2).add(6, 'months').startOf('day')));
     });
   });
 

test/api/v3/integration/tasks/challenges/DELETE-tasks_challenge_challengeId_checklist_itemId.test.js

@@ -22,7 +22,7 @@ describe('DELETE /tasks/:taskId/checklist/:itemId', () => {
     await expect(user.del(`/tasks/${generateUUID()}/checklist/${generateUUID()}`)).to.eventually.be.rejected.and.eql({
       code: 404,
       error: 'NotFound',
-      message: t('taskNotFound'),
+      message: t('messageTaskNotFound'),
     });
   });
 

test/api/v3/integration/tasks/challenges/DELETE-tasks_id_challenge_challengeId.test.js

@@ -31,7 +31,7 @@ describe('DELETE /tasks/:id', () => {
     await expect(user.del(`/tasks/${generateUUID()}`)).to.eventually.be.rejected.and.eql({
       code: 404,
       error: 'NotFound',
-      message: t('taskNotFound'),
+      message: t('messageTaskNotFound'),
     });
   });
 
@@ -51,7 +51,7 @@ describe('DELETE /tasks/:id', () => {
     await expect(user.get(`/tasks/${task._id}`)).to.eventually.be.rejected.and.eql({
       code: 404,
       error: 'NotFound',
-      message: t('taskNotFound'),
+      message: t('messageTaskNotFound'),
     });
   });
 
@@ -93,7 +93,7 @@ describe('DELETE /tasks/:id', () => {
       await expect(anotherUser.get(`/tasks/${task._id}`)).to.eventually.be.rejected.and.eql({
         code: 404,
         error: 'NotFound',
-        message: t('taskNotFound'),
+        message: t('messageTaskNotFound'),
       });
     });
 
@@ -111,7 +111,7 @@ describe('DELETE /tasks/:id', () => {
       await expect(anotherUser.get(`/tasks/${anotherUsersNewChallengeTaskID}`)).to.eventually.be.rejected.and.eql({
         code: 404,
         error: 'NotFound',
-        message: t('taskNotFound'),
+        message: t('messageTaskNotFound'),
       });
     });
   });

test/api/v3/integration/tasks/challenges/GET_tasks_challenge.id.test.js

@@ -21,10 +21,6 @@ describe('GET /tasks/challenge/:challengeId', () => {
       up: false,
       down: true,
     },
-    todo: {
-      text: 'test todo',
-      type: 'todo',
-    },
     daily: {
       text: 'test daily',
       type: 'daily',
@@ -32,6 +28,10 @@ describe('GET /tasks/challenge/:challengeId', () => {
       everyX: 5,
       startDate: new Date(),
     },
+    todo: {
+      text: 'test todo',
+      type: 'todo',
+    },
     reward: {
       text: 'test reward',
       type: 'reward',
@@ -84,4 +84,35 @@ describe('GET /tasks/challenge/:challengeId', () => {
       });
     });
   });
+
+  it('maintains challenge task order', async () => {
+    const orderedTasks = {};
+    Object.entries(tasksToTest).forEach(async (taskType, taskValue) => {
+      const results = [];
+      for (let i = 0; i < 5; i += 1) {
+        results.push(user.post(`/tasks/challenge/${challenge._id}`, taskValue));
+      }
+      const taskList = await Promise.all(results);
+      await user.post(`/tasks/${taskList[0]._id}/move/to/3`);
+
+      const firstTask = taskList.unshift();
+      taskList.splice(3, 0, firstTask);
+
+      orderedTasks[taskType] = taskList;
+    });
+
+    const results = await user.get(`/tasks/challenge/${challenge._id}`);
+    const resultTasks = {};
+
+    results.forEach(result => {
+      if (!resultTasks[result.type]) {
+        resultTasks[result.type] = [];
+      }
+      resultTasks[result.type].push(result);
+    });
+
+    Object.entries(orderedTasks).forEach((taskType, taskList) => {
+      expect(resultTasks[taskType]).to.eql(taskList);
+    });
+  });
 });

test/api/v3/integration/tasks/challenges/POST-tasks_challenge_challengeId_taskId_checklist.test.js

@@ -24,7 +24,7 @@ describe('POST /tasks/:taskId/checklist/', () => {
     })).to.eventually.be.rejected.and.eql({
       code: 404,
       error: 'NotFound',
-      message: t('taskNotFound'),
+      message: t('messageTaskNotFound'),
     });
   });
 

test/api/v3/integration/tasks/challenges/POST-tasks_challenge_id.test.js

@@ -60,7 +60,7 @@ describe('POST /tasks/challenge/:challengeId', () => {
   });
 
   it('allows non-leader admin to add tasks to a challenge when not a member', async () => {
-    const admin = await generateUser({ 'contributor.admin': true });
+    const admin = await generateUser({ 'permissions.challengeAdmin': true });
     const task = await admin.post(`/tasks/challenge/${challenge._id}`, {
       text: 'test habit from admin',
       type: 'habit',