4.237.1

This reverts commit 2748455f16.

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "habitica-images"]
+	path = habitica-images
+	url = https://github.com/HabitRPG/habitica-images

.slugignore

@@ -0,0 +1,7 @@
+# Files not included in deployments to Heroku, to save on file size.
+
+/habitica-images
+/test
+/migrations
+/scripts
+/database_reports

Dockerfile

@@ -21,6 +21,7 @@ RUN npm install -g gulp-cli mocha
 RUN mkdir -p /usr/src/habitrpg
 WORKDIR /usr/src/habitrpg
 RUN git clone --branch release --depth 1 https://github.com/HabitRPG/habitica.git /usr/src/habitrpg
+RUN git config --global url."https://".insteadOf git://
 RUN npm set unsafe-perm true
 RUN npm install
 

config.json.example

@@ -1,4 +1,5 @@
 {
+  "ACCOUNT_MIN_CHAT_AGE": "0",
   "ADMIN_EMAIL": "you@example.com",
   "AMAZON_PAYMENTS_CLIENT_ID": "CLIENT_ID",
   "AMAZON_PAYMENTS_MODE": "sandbox",

database_reports/count_users_who_own_specified_gear.js

@@ -119,7 +119,7 @@ function path(obj, path, def) {
  * @param {String} path dot separated
  * @param {*} def default value ( if result undefined )
  * @returns {*}
- * http://stackoverflow.com/a/16190716
+ * https://stackoverflow.com/a/16190716
  * Usage: console.log(path(someObject, pathname));
  */
     for(var i = 0,path = path.split('.'),len = path.length; i < len; i++){

gulp/gulp-sprites.js

@@ -1,16 +1,8 @@
 import gulp from 'gulp';
-import imagemin from 'gulp-imagemin';
 import spritesmith from 'gulp.spritesmith';
 import clean from 'rimraf';
-import sizeOf from 'image-size';
 import mergeStream from 'merge-stream';
-import { basename } from 'path';
 import { sync } from 'glob';
-import { each } from 'lodash';
-import vinylBuffer from 'vinyl-buffer';
-
-// https://github.com/Ensighten/grunt-spritesmith/issues/67#issuecomment-34786248
-const MAX_SPRITESHEET_SIZE = 1024 * 1024 * 3;
 
 const IMG_DIST_PATH = 'website/client/src/assets/images/sprites/';
 const CSS_DIST_PATH = 'website/client/src/assets/css/sprites/';
@@ -20,49 +12,6 @@ function checkForSpecialTreatment (name) {
   return name.match(regex) || name === 'head_0';
 }
 
-function calculateImgDimensions (img, addPadding) {
-  let dims = sizeOf(img);
-
-  const requiresSpecialTreatment = checkForSpecialTreatment(img);
-  if (requiresSpecialTreatment) {
-    const newWidth = dims.width < 90 ? 90 : dims.width;
-    const newHeight = dims.height < 90 ? 90 : dims.height;
-    dims = {
-      width: newWidth,
-      height: newHeight,
-    };
-  }
-
-  let padding = 0;
-
-  if (addPadding) {
-    padding = dims.width * 8 + dims.height * 8;
-  }
-
-  if (!dims.width || !dims.height) console.error('MISSING DIMENSIONS:', dims); // eslint-disable-line no-console
-
-  const totalPixelSize = dims.width * dims.height + padding;
-
-  return totalPixelSize;
-}
-
-function calculateSpritesheetsSrcIndicies (src) {
-  let totalPixels = 0;
-  const slices = [0];
-
-  each(src, (img, index) => {
-    const imageSize = calculateImgDimensions(img, true);
-    totalPixels += imageSize;
-
-    if (totalPixels > MAX_SPRITESHEET_SIZE) {
-      slices.push(index - 1);
-      totalPixels = imageSize;
-    }
-  });
-
-  return slices;
-}
-
 function cssVarMap (sprite) {
   // For hair, skins, beards, etc. we want to output a '.customize-options.WHATEVER' class,
   // which works as a 60x60 image pointing at the proper part of the 90x90 sprite.
@@ -71,94 +20,56 @@ function cssVarMap (sprite) {
   if (requiresSpecialTreatment) {
     sprite.custom = {
       px: {
-        offsetX: `-${sprite.x + 25}px`,
-        offsetY: `-${sprite.y + 15}px`,
+        offsetX: '-25px',
+        offsetY: '-15px',
         width: '60px',
         height: '60px',
       },
     };
   }
-  if (sprite.name.indexOf('shirt') !== -1) sprite.custom.px.offsetY = `-${sprite.y + 35}px`; // even more for shirts
+
+  // even more for shirts
+  if (sprite.name.indexOf('shirt') !== -1) {
+    sprite.custom.px.offsetX = '-29px';
+    sprite.custom.px.offsetY = '-42px';
+  }
+
   if (sprite.name.indexOf('hair_base') !== -1) {
     const styleArray = sprite.name.split('_').slice(2, 3);
-    if (Number(styleArray[0]) > 14) sprite.custom.px.offsetY = `-${sprite.y}px`; // don't crop updos
+    if (Number(styleArray[0]) > 14) {
+      sprite.custom.px.offsetY = '0'; // don't crop updos
+    }
   }
 }
 
 function createSpritesStream (name, src) {
-  const spritesheetSliceIndicies = calculateSpritesheetsSrcIndicies(src);
   const stream = mergeStream();
 
-  each(spritesheetSliceIndicies, (start, index) => {
-    const slicedSrc = src.slice(start, spritesheetSliceIndicies[index + 1]);
+  const spriteData = gulp.src(src)
+    .pipe(spritesmith({
+      imgName: `spritesmith-${name}.png`,
+      cssName: `spritesmith-${name}.css`,
+      algorithm: 'binary-tree',
+      padding: 1,
+      cssTemplate: 'website/raw_sprites/css/css.template.handlebars',
+      cssVarMap,
+    }));
 
-    const spriteData = gulp.src(slicedSrc)
-      .pipe(spritesmith({
-        imgName: `spritesmith-${name}-${index}.png`,
-        cssName: `spritesmith-${name}-${index}.css`,
-        algorithm: 'binary-tree',
-        padding: 1,
-        cssTemplate: 'website/raw_sprites/css/css.template.handlebars',
-        cssVarMap,
-      }));
+  const cssStream = spriteData.css
+    .pipe(gulp.dest(CSS_DIST_PATH));
 
-    const imgStream = spriteData.img
-      .pipe(vinylBuffer())
-      .pipe(imagemin())
-      .pipe(gulp.dest(IMG_DIST_PATH));
-
-    const cssStream = spriteData.css
-      .pipe(gulp.dest(CSS_DIST_PATH));
-
-    stream.add(imgStream);
-    stream.add(cssStream);
-  });
+  stream.add(cssStream);
 
   return stream;
 }
 
 gulp.task('sprites:main', () => {
-  const mainSrc = sync('website/raw_sprites/spritesmith/**/*.png');
+  const mainSrc = sync('habitica-images/**/*.png');
   return createSpritesStream('main', mainSrc);
 });
 
-gulp.task('sprites:largeSprites', () => {
-  const largeSrc = sync('website/raw_sprites/spritesmith_large/**/*.png');
-  return createSpritesStream('largeSprites', largeSrc);
-});
-
 gulp.task('sprites:clean', done => {
   clean(`${IMG_DIST_PATH}spritesmith*,${CSS_DIST_PATH}spritesmith*}`, done);
 });
 
-gulp.task('sprites:checkCompiledDimensions', gulp.series('sprites:main', 'sprites:largeSprites', done => {
-  console.log('Verifiying that images do not exceed max dimensions'); // eslint-disable-line no-console
-
-  let numberOfSheetsThatAreTooBig = 0;
-
-  const distSpritesheets = sync(`${IMG_DIST_PATH}*.png`);
-
-  each(distSpritesheets, img => {
-    const spriteSize = calculateImgDimensions(img);
-
-    if (spriteSize > MAX_SPRITESHEET_SIZE) {
-      numberOfSheetsThatAreTooBig += 1;
-      const name = basename(img, '.png');
-      console.error(`WARNING: ${name} might be too big - ${spriteSize} > ${MAX_SPRITESHEET_SIZE}`); // eslint-disable-line no-console
-    }
-  });
-
-  if (numberOfSheetsThatAreTooBig > 0) {
-    // https://github.com/HabitRPG/habitica/pull/6683#issuecomment-185462180
-    console.error( // eslint-disable-line no-console
-      `${numberOfSheetsThatAreTooBig} sheets might too big for mobile Safari to be able to handle
-      them, but there is a margin of error in these calculations so it is probably okay. Mention
-      this to an admin so they can test a staging site on mobile Safari after your PR is merged.`,
-    );
-  } else {
-    console.log('All images are within the correct dimensions'); // eslint-disable-line no-console
-  }
-  done();
-}));
-
-gulp.task('sprites:compile', gulp.series('sprites:clean', 'sprites:checkCompiledDimensions', done => done()));
+gulp.task('sprites:compile', gulp.series('sprites:clean', 'sprites:main', done => done()));

migrations/archive/2013/20131028_task_subdocs_tags_invites.js

@@ -2,7 +2,7 @@
 
 // TODO it might be better we just find() and save() all user objects using mongoose, and rely on our defined pre('save')
 // and default values to "migrate" users. This way we can make sure those parts are working properly too
-// @see http://stackoverflow.com/questions/14867697/mongoose-full-collection-scan
+// @see https://stackoverflow.com/questions/14867697/mongoose-full-collection-scan
 // Also, what do we think of a Mongoose Migration module? something like https://github.com/madhums/mongoose-migrate
 
 // IMPORTANT NOTE: this migration was written when we were using version 3 of lodash.

migrations/archive/2017/20170111_announce_collection_quest_change_in_parties.js

@@ -19,7 +19,7 @@ const Timer = require('./utils/timer');
 const connectToDb = require('./utils/connect').connectToDb;
 const closeDb = require('./utils/connect').closeDb;
 
-const message = '`This party\'s collection quest has been made easier! For details, refer to http://habitica.fandom.com/wiki/User_blog:LadyAlys/Collection_Quests_are_Now_Easier`';
+const message = '`This party\'s collection quest has been made easier! For details, refer to https://habitica.fandom.com/wiki/User_blog:LadyAlys/Collection_Quests_are_Now_Easier`';
 
 const timer = new Timer();
 

migrations/archive/2021/20211124_harvest_feast.js

@@ -0,0 +1,126 @@
+/* eslint-disable no-console */
+const MIGRATION_NAME = '20211124_harvest_feast';
+import { v4 as uuid } from 'uuid';
+import { model as User } from '../../../website/server/models/user';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count++;
+
+  const set = {};
+  let inc;
+  let push;
+
+  set.migration = MIGRATION_NAME;
+
+  if (typeof user.items.gear.owned.head_special_turkeyHelmGilded !== 'undefined') {
+    inc = {
+      'items.food.Pie_Base': 1,
+      'items.food.Pie_CottonCandyBlue': 1,
+      'items.food.Pie_CottonCandyPink': 1,
+      'items.food.Pie_Desert': 1,
+      'items.food.Pie_Golden': 1,
+      'items.food.Pie_Red': 1,
+      'items.food.Pie_Shade': 1,
+      'items.food.Pie_Skeleton': 1,
+      'items.food.Pie_Zombie': 1,
+      'items.food.Pie_White': 1,
+    }
+  } else if (typeof user.items.gear.owned.armor_special_turkeyArmorBase !== 'undefined') {
+    set['items.gear.owned.head_special_turkeyHelmGilded'] = false;
+    set['items.gear.owned.armor_special_turkeyArmorGilded'] = false;
+    set['items.gear.owned.back_special_turkeyTailGilded'] = false;
+    push = [
+      {
+        type: 'marketGear',
+        path: 'gear.flat.head_special_turkeyHelmGilded',
+        _id: uuid(),
+      },
+      {
+        type: 'marketGear',
+        path: 'gear.flat.armor_special_turkeyArmorGilded',
+        _id: uuid(),
+      },
+      {
+        type: 'marketGear',
+        path: 'gear.flat.back_special_turkeyTailGilded',
+        _id: uuid(),
+      },
+    ];
+  } else if (user.items && user.items.mounts && user.items.mounts['Turkey-Gilded']) {
+    set['items.gear.owned.head_special_turkeyHelmBase'] = false;
+    set['items.gear.owned.armor_special_turkeyArmorBase'] = false;
+    set['items.gear.owned.back_special_turkeyTailBase'] = false;
+    push = [
+      {
+        type: 'marketGear',
+        path: 'gear.flat.head_special_turkeyHelmBase',
+        _id: uuid(),
+      },
+      {
+        type: 'marketGear',
+        path: 'gear.flat.armor_special_turkeyArmorBase',
+        _id: uuid(),
+      },
+      {
+        type: 'marketGear',
+        path: 'gear.flat.back_special_turkeyTailBase',
+        _id: uuid(),
+      },
+    ];
+  } else if (user.items && user.items.pets && user.items.pets['Turkey-Gilded']) {
+    set['items.mounts.Turkey-Gilded'] = true;
+  } else if (user.items && user.items.mounts && user.items.mounts['Turkey-Base']) {
+    set['items.pets.Turkey-Gilded'] = 5;
+  } else if (user.items && user.items.pets && user.items.pets['Turkey-Base']) {
+    set['items.mounts.Turkey-Base'] = true;
+  } else {
+    set['items.pets.Turkey-Base'] = 5;
+  }
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+
+  if (inc) {
+    return await User.update({_id: user._id}, {$inc: inc, $set: set}).exec();
+  } else if (push) {
+    return await User.update({_id: user._id}, {$set: set, $push: {pinnedItems: {$each: push}}}).exec();
+  } else {
+    return await User.update({_id: user._id}, {$set: set}).exec();
+  }
+}
+
+export default async function processUsers () {
+  let query = {
+    migration: {$ne: MIGRATION_NAME},
+    'auth.timestamps.loggedin': {$gt: new Date('2021-11-01')},
+  };
+
+  const fields = {
+    _id: 1,
+    items: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1],
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};

migrations/archive/2021/20211230_nye.js

@@ -0,0 +1,135 @@
+/* eslint-disable no-console */
+const MIGRATION_NAME = '20211230_nye';
+import { model as User } from '../../../website/server/models/user';
+import { v4 as uuid } from 'uuid';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count++;
+
+  const set = { migration: MIGRATION_NAME };
+  let push;
+
+  if (typeof user.items.gear.owned.head_special_nye2020 !== 'undefined') {
+    set['items.gear.owned.head_special_nye2021'] = false;
+    push = [
+      {
+        type: 'marketGear',
+        path: 'gear.flat.head_special_nye2021',
+        _id: uuid(),
+      },
+    ];
+  } else if (typeof user.items.gear.owned.head_special_nye2019 !== 'undefined') {
+    set['items.gear.owned.head_special_nye2020'] = false;
+    push = [
+      {
+        type: 'marketGear',
+        path: 'gear.flat.head_special_nye2020',
+        _id: uuid(),
+      },
+    ];
+  } else if (typeof user.items.gear.owned.head_special_nye2018 !== 'undefined') {
+    set['items.gear.owned.head_special_nye2019'] = false;
+    push = [
+      {
+        type: 'marketGear',
+        path: 'gear.flat.head_special_nye2019',
+        _id: uuid(),
+      },
+    ];
+  } else if (typeof user.items.gear.owned.head_special_nye2017 !== 'undefined') {
+    set['items.gear.owned.head_special_nye2018'] = false;
+    push = [
+      {
+        type: 'marketGear',
+        path: 'gear.flat.head_special_nye2018',
+        _id: uuid(),
+      },
+    ];
+  } else if (typeof user.items.gear.owned.head_special_nye2016 !== 'undefined') {
+    set['items.gear.owned.head_special_nye2017'] = false;
+    push = [
+      {
+        type: 'marketGear',
+        path: 'gear.flat.head_special_nye2017',
+        _id: uuid(),
+      },
+    ];
+  } else if (typeof user.items.gear.owned.head_special_nye2015 !== 'undefined') {
+    set['items.gear.owned.head_special_nye2016'] = false;
+    push = [
+      {
+        type: 'marketGear',
+        path: 'gear.flat.head_special_nye2016',
+        _id: uuid(),
+      },
+    ];
+  } else if (typeof user.items.gear.owned.head_special_nye2014 !== 'undefined') {
+    set['items.gear.owned.head_special_nye2015'] = false;
+    push = [
+      {
+        type: 'marketGear',
+        path: 'gear.flat.head_special_nye2015',
+        _id: uuid(),
+      },
+    ];
+  } else if (typeof user.items.gear.owned.head_special_nye !== 'undefined') {
+    set['items.gear.owned.head_special_nye2014'] = false;
+    push = [
+      {
+        type: 'marketGear',
+        path: 'gear.flat.head_special_nye2014',
+        _id: uuid(),
+      },
+    ];
+  } else {
+    set['items.gear.owned.head_special_nye'] = false;
+    push = [
+      {
+        type: 'marketGear',
+        path: 'gear.flat.head_special_nye',
+        _id: uuid(),
+      },
+    ];
+  }
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+
+  return await User.update({_id: user._id}, {$set: set, $push: {pinnedItems: {$each: push}}}).exec();
+}
+
+export default async function processUsers () {
+  let query = {
+    'auth.timestamps.loggedin': {$gt: new Date('2021-12-01')},
+    migration: {$ne: MIGRATION_NAME},
+  };
+
+  const fields = {
+    _id: 1,
+    items: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1],
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};

migrations/archive/2022/20220131_habit_birthday.js

@@ -0,0 +1,97 @@
+/* eslint-disable no-console */
+const MIGRATION_NAME = '20220131_habit_birthday';
+import { v4 as uuid } from 'uuid';
+
+import { model as User } from '../../../website/server/models/user';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count++;
+
+  const inc = {
+    'items.food.Cake_Skeleton': 1,
+    'items.food.Cake_Base': 1,
+    'items.food.Cake_CottonCandyBlue': 1,
+    'items.food.Cake_CottonCandyPink': 1,
+    'items.food.Cake_Shade': 1,
+    'items.food.Cake_White': 1,
+    'items.food.Cake_Golden': 1,
+    'items.food.Cake_Zombie': 1,
+    'items.food.Cake_Desert': 1,
+    'items.food.Cake_Red': 1,
+    'achievements.habitBirthdays': 1,
+  };
+  const set = {};
+  let push;
+
+  set.migration = MIGRATION_NAME;
+
+  if (typeof user.items.gear.owned.armor_special_birthday2021 !== 'undefined') {
+    set['items.gear.owned.armor_special_birthday2022'] = false;
+    push = {pinnedItems: {type: 'marketGear', path: 'gear.flat.armor_special_birthday2022', _id: uuid()}};
+  } else if (typeof user.items.gear.owned.armor_special_birthday2020 !== 'undefined') {
+    set['items.gear.owned.armor_special_birthday2021'] = false;
+    push = {pinnedItems: {type: 'marketGear', path: 'gear.flat.armor_special_birthday2021', _id: uuid()}};
+  } else if (typeof user.items.gear.owned.armor_special_birthday2019 !== 'undefined') {
+    set['items.gear.owned.armor_special_birthday2020'] = false;
+    push = {pinnedItems: {type: 'marketGear', path: 'gear.flat.armor_special_birthday2020', _id: uuid()}};
+  } else if (typeof user.items.gear.owned.armor_special_birthday2018 !== 'undefined') {
+    set['items.gear.owned.armor_special_birthday2019'] = false;
+    push = {pinnedItems: {type: 'marketGear', path: 'gear.flat.armor_special_birthday2019', _id: uuid()}};
+  } else if (typeof user.items.gear.owned.armor_special_birthday2017 !== 'undefined') {
+    set['items.gear.owned.armor_special_birthday2018'] = false;
+    push = {pinnedItems: {type: 'marketGear', path: 'gear.flat.armor_special_birthday2018', _id: uuid()}};
+  } else if (typeof user.items.gear.owned.armor_special_birthday2016 !== 'undefined') {
+    set['items.gear.owned.armor_special_birthday2017'] = false;
+    push = {pinnedItems: {type: 'marketGear', path: 'gear.flat.armor_special_birthday2017', _id: uuid()}};
+  } else if (typeof user.items.gear.owned.armor_special_birthday2015 !== 'undefined') {
+    set['items.gear.owned.armor_special_birthday2016'] = false;
+    push = {pinnedItems: {type: 'marketGear', path: 'gear.flat.armor_special_birthday2016', _id: uuid()}};
+  } else if (typeof user.items.gear.owned.armor_special_birthday !== 'undefined') {
+    set['items.gear.owned.armor_special_birthday2015'] = false;
+    push = {pinnedItems: {type: 'marketGear', path: 'gear.flat.armor_special_birthday2015', _id: uuid()}};
+  } else {
+    set['items.gear.owned.armor_special_birthday'] = false;
+    push = {pinnedItems: {type: 'marketGear', path: 'gear.flat.armor_special_birthday', _id: uuid()}};
+  }
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+
+  return await User.update({_id: user._id}, {$inc: inc, $set: set, $push: push}).exec();
+}
+
+export default async function processUsers () {
+  let query = {
+    migration: {$ne: MIGRATION_NAME},
+    'auth.timestamps.loggedin': {$gt: new Date('2022-01-01')},
+  };
+
+  const fields = {
+    _id: 1,
+    items: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1],
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};

migrations/archive/2022/20220201_pet_group_achievements.js

@@ -0,0 +1,178 @@
+/* eslint-disable no-console */
+const MIGRATION_NAME = '20220201_pet_group_achievements';
+import { model as User } from '../../../website/server/models/user';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count++;
+
+  const set = {
+    migration: MIGRATION_NAME,
+  };
+
+  if (user && user.items && user.items.pets) {
+    const pets = user.items.pets;
+    if (pets['FlyingPig-Base']
+      && pets['FlyingPig-CottonCandyBlue']
+      && pets['FlyingPig-CottonCandyPink']
+      && pets['FlyingPig-Desert']
+      && pets['FlyingPig-Golden']
+      && pets['FlyingPig-Red']
+      && pets['FlyingPig-Shade']
+      && pets['FlyingPig-Skeleton']
+      && pets['FlyingPig-White']
+      && pets['FlyingPig-Zombie']
+      && pets['Snake-Base']
+      && pets['Snake-CottonCandyBlue']
+      && pets['Snake-CottonCandyPink']
+      && pets['Snake-Desert']
+      && pets['Snake-Golden']
+      && pets['Snake-Red']
+      && pets['Snake-Shade']
+      && pets['Snake-Skeleton']
+      && pets['Snake-White']
+      && pets['Snake-Zombie']
+      && pets['Sheep-Base']
+      && pets['Sheep-CottonCandyBlue']
+      && pets['Sheep-CottonCandyPink']
+      && pets['Sheep-Desert']
+      && pets['Sheep-Golden']
+      && pets['Sheep-Red']
+      && pets['Sheep-Shade']
+      && pets['Sheep-Skeleton']
+      && pets['Sheep-White']
+      && pets['Sheep-Zombie']
+      && pets['Rooster-Base']
+      && pets['Rooster-CottonCandyBlue']
+      && pets['Rooster-CottonCandyPink']
+      && pets['Rooster-Desert']
+      && pets['Rooster-Golden']
+      && pets['Rooster-Red']
+      && pets['Rooster-Shade']
+      && pets['Rooster-Skeleton']
+      && pets['Rooster-White']
+      && pets['Rooster-Zombie']
+      && pets['Rat-Base']
+      && pets['Rat-CottonCandyBlue']
+      && pets['Rat-CottonCandyPink']
+      && pets['Rat-Desert']
+      && pets['Rat-Golden']
+      && pets['Rat-Red']
+      && pets['Rat-Shade']
+      && pets['Rat-Skeleton']
+      && pets['Rat-White']
+      && pets['Rat-Zombie']
+      && pets['Bunny-Base']
+      && pets['Bunny-CottonCandyBlue']
+      && pets['Bunny-CottonCandyPink']
+      && pets['Bunny-Desert']
+      && pets['Bunny-Golden']
+      && pets['Bunny-Red']
+      && pets['Bunny-Shade']
+      && pets['Bunny-Skeleton']
+      && pets['Bunny-White']
+      && pets['Bunny-Zombie']
+      && pets['Horse-Base']
+      && pets['Horse-CottonCandyBlue']
+      && pets['Horse-CottonCandyPink']
+      && pets['Horse-Desert']
+      && pets['Horse-Golden']
+      && pets['Horse-Red']
+      && pets['Horse-Shade']
+      && pets['Horse-Skeleton']
+      && pets['Horse-White']
+      && pets['Horse-Zombie']
+      && pets['Cow-Base']
+      && pets['Cow-CottonCandyBlue']
+      && pets['Cow-CottonCandyPink']
+      && pets['Cow-Desert']
+      && pets['Cow-Golden']
+      && pets['Cow-Red']
+      && pets['Cow-Shade']
+      && pets['Cow-Skeleton']
+      && pets['Cow-White']
+      && pets['Cow-Zombie']
+      && pets['Monkey-Base']
+      && pets['Monkey-CottonCandyBlue']
+      && pets['Monkey-CottonCandyPink']
+      && pets['Monkey-Desert']
+      && pets['Monkey-Golden']
+      && pets['Monkey-Red']
+      && pets['Monkey-Shade']
+      && pets['Monkey-Skeleton']
+      && pets['Monkey-White']
+      && pets['Monkey-Zombie']
+      && pets['Wolf-Base']
+      && pets['Wolf-CottonCandyBlue']
+      && pets['Wolf-CottonCandyPink']
+      && pets['Wolf-Desert']
+      && pets['Wolf-Golden']
+      && pets['Wolf-Red']
+      && pets['Wolf-Shade']
+      && pets['Wolf-Skeleton']
+      && pets['Wolf-White']
+      && pets['Wolf-Zombie']
+      && pets['Tiger-Base']
+      && pets['Tiger-CottonCandyBlue']
+      && pets['Tiger-CottonCandyPink']
+      && pets['Tiger-Desert']
+      && pets['Tiger-Golden']
+      && pets['Tiger-Red']
+      && pets['Tiger-Shade']
+      && pets['Tiger-Skeleton']
+      && pets['Tiger-White']
+      && pets['Tiger-Zombie']
+      && pets['Dragon-Base']
+      && pets['Dragon-CottonCandyBlue']
+      && pets['Dragon-CottonCandyPink']
+      && pets['Dragon-Desert']
+      && pets['Dragon-Golden']
+      && pets['Dragon-Red']
+      && pets['Dragon-Shade']
+      && pets['Dragon-Skeleton']
+      && pets['Dragon-White']
+      && pets['Dragon-Zombie']) {
+        set['achievements.zodiacZookeeper'] = true;
+      }
+  }
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+
+  return await User.update({ _id: user._id }, { $set: set }).exec();
+}
+
+export default async function processUsers () {
+  let query = {
+    // migration: { $ne: MIGRATION_NAME },
+    'auth.timestamps.loggedin': { $gt: new Date('2021-08-01') },
+  };
+
+  const fields = {
+    _id: 1,
+    items: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1]._id,
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};

migrations/archive/2022/20220309_pet_group_achievements.js

@@ -0,0 +1,138 @@
+/* eslint-disable no-console */
+const MIGRATION_NAME = '20220309_pet_group_achievements';
+import { model as User } from '../../../website/server/models/user';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count++;
+
+  const set = {
+    migration: MIGRATION_NAME,
+  };
+
+  if (user && user.items && user.items.pets) {
+    const pets = user.items.pets;
+    if (pets['FlyingPig-Base']
+      && pets['FlyingPig-CottonCandyBlue']
+      && pets['FlyingPig-CottonCandyPink']
+      && pets['FlyingPig-Desert']
+      && pets['FlyingPig-Golden']
+      && pets['FlyingPig-Red']
+      && pets['FlyingPig-Shade']
+      && pets['FlyingPig-Skeleton']
+      && pets['FlyingPig-White']
+      && pets['FlyingPig-Zombie']
+      && pets['Owl-Base']
+      && pets['Owl-CottonCandyBlue']
+      && pets['Owl-CottonCandyPink']
+      && pets['Owl-Desert']
+      && pets['Owl-Golden']
+      && pets['Owl-Red']
+      && pets['Owl-Shade']
+      && pets['Owl-Skeleton']
+      && pets['Owl-White']
+      && pets['Owl-Zombie']
+      && pets['Parrot-Base']
+      && pets['Parrot-CottonCandyBlue']
+      && pets['Parrot-CottonCandyPink']
+      && pets['Parrot-Desert']
+      && pets['Parrot-Golden']
+      && pets['Parrot-Red']
+      && pets['Parrot-Shade']
+      && pets['Parrot-Skeleton']
+      && pets['Parrot-White']
+      && pets['Parrot-Zombie']
+      && pets['Rooster-Base']
+      && pets['Rooster-CottonCandyBlue']
+      && pets['Rooster-CottonCandyPink']
+      && pets['Rooster-Desert']
+      && pets['Rooster-Golden']
+      && pets['Rooster-Red']
+      && pets['Rooster-Shade']
+      && pets['Rooster-Skeleton']
+      && pets['Rooster-White']
+      && pets['Rooster-Zombie']
+      && pets['Pterodactyl-Base']
+      && pets['Pterodactyl-CottonCandyBlue']
+      && pets['Pterodactyl-CottonCandyPink']
+      && pets['Pterodactyl-Desert']
+      && pets['Pterodactyl-Golden']
+      && pets['Pterodactyl-Red']
+      && pets['Pterodactyl-Shade']
+      && pets['Pterodactyl-Skeleton']
+      && pets['Pterodactyl-White']
+      && pets['Pterodactyl-Zombie']
+      && pets['Gryphon-Base']
+      && pets['Gryphon-CottonCandyBlue']
+      && pets['Gryphon-CottonCandyPink']
+      && pets['Gryphon-Desert']
+      && pets['Gryphon-Golden']
+      && pets['Gryphon-Red']
+      && pets['Gryphon-Shade']
+      && pets['Gryphon-Skeleton']
+      && pets['Gryphon-White']
+      && pets['Gryphon-Zombie']
+      && pets['Falcon-Base']
+      && pets['Falcon-CottonCandyBlue']
+      && pets['Falcon-CottonCandyPink']
+      && pets['Falcon-Desert']
+      && pets['Falcon-Golden']
+      && pets['Falcon-Red']
+      && pets['Falcon-Shade']
+      && pets['Falcon-Skeleton']
+      && pets['Falcon-White']
+      && pets['Falcon-Zombie']
+      && pets['Peacock-Base']
+      && pets['Peacock-CottonCandyBlue']
+      && pets['Peacock-CottonCandyPink']
+      && pets['Peacock-Desert']
+      && pets['Peacock-Golden']
+      && pets['Peacock-Red']
+      && pets['Peacock-Shade']
+      && pets['Peacock-Skeleton']
+      && pets['Peacock-White']
+      && pets['Peacock-Zombie']) {
+        set['achievements.birdsOfAFeather'] = true;
+      }
+  }
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+
+  return await User.update({ _id: user._id }, { $set: set }).exec();
+}
+
+export default async function processUsers () {
+  let query = {
+    // migration: { $ne: MIGRATION_NAME },
+    'auth.timestamps.loggedin': { $gt: new Date('2021-08-01') },
+  };
+
+  const fields = {
+    _id: 1,
+    items: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1]._id,
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};

migrations/archive/2022/20220524_pet_group_achievements.js

@@ -0,0 +1,128 @@
+/* eslint-disable no-console */
+const MIGRATION_NAME = '20220524_pet_group_achievements';
+import { model as User } from '../../../website/server/models/user';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count++;
+
+  const set = {
+    migration: MIGRATION_NAME,
+  };
+
+  if (user && user.items && user.items.pets) {
+    const pets = user.items.pets;
+    if (pets['Alligator-Base']
+      && pets['Alligator-CottonCandyBlue']
+      && pets['Alligator-CottonCandyPink']
+      && pets['Alligator-Desert']
+      && pets['Alligator-Golden']
+      && pets['Alligator-Red']
+      && pets['Alligator-Shade']
+      && pets['Alligator-Skeleton']
+      && pets['Alligator-White']
+      && pets['Alligator-Zombie']
+      && pets['Snake-Base']
+      && pets['Snake-CottonCandyBlue']
+      && pets['Snake-CottonCandyPink']
+      && pets['Snake-Desert']
+      && pets['Snake-Golden']
+      && pets['Snake-Red']
+      && pets['Snake-Shade']
+      && pets['Snake-Skeleton']
+      && pets['Snake-White']
+      && pets['Snake-Zombie']
+      && pets['Triceratops-Base']
+      && pets['Triceratops-CottonCandyBlue']
+      && pets['Triceratops-CottonCandyPink']
+      && pets['Triceratops-Desert']
+      && pets['Triceratops-Golden']
+      && pets['Triceratops-Red']
+      && pets['Triceratops-Shade']
+      && pets['Triceratops-Skeleton']
+      && pets['Triceratops-White']
+      && pets['Triceratops-Zombie']
+      && pets['TRex-Base']
+      && pets['TRex-CottonCandyBlue']
+      && pets['TRex-CottonCandyPink']
+      && pets['TRex-Desert']
+      && pets['TRex-Golden']
+      && pets['TRex-Red']
+      && pets['TRex-Shade']
+      && pets['TRex-Skeleton']
+      && pets['TRex-White']
+      && pets['TRex-Zombie']
+      && pets['Pterodactyl-Base']
+      && pets['Pterodactyl-CottonCandyBlue']
+      && pets['Pterodactyl-CottonCandyPink']
+      && pets['Pterodactyl-Desert']
+      && pets['Pterodactyl-Golden']
+      && pets['Pterodactyl-Red']
+      && pets['Pterodactyl-Shade']
+      && pets['Pterodactyl-Skeleton']
+      && pets['Pterodactyl-White']
+      && pets['Pterodactyl-Zombie']
+      && pets['Turtle-Base']
+      && pets['Turtle-CottonCandyBlue']
+      && pets['Turtle-CottonCandyPink']
+      && pets['Turtle-Desert']
+      && pets['Turtle-Golden']
+      && pets['Turtle-Red']
+      && pets['Turtle-Shade']
+      && pets['Turtle-Skeleton']
+      && pets['Turtle-White']
+      && pets['Turtle-Zombie']
+      && pets['Velociraptor-Base']
+      && pets['Velociraptor-CottonCandyBlue']
+      && pets['Velociraptor-CottonCandyPink']
+      && pets['Velociraptor-Desert']
+      && pets['Velociraptor-Golden']
+      && pets['Velociraptor-Red']
+      && pets['Velociraptor-Shade']
+      && pets['Velociraptor-Skeleton']
+      && pets['Velociraptor-White']
+      && pets['Velociraptor-Zombie']) {
+        set['achievements.reptacularRumble'] = true;
+      }
+  }
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+
+  return await User.update({ _id: user._id }, { $set: set }).exec();
+}
+
+export default async function processUsers () {
+  let query = {
+    // migration: { $ne: MIGRATION_NAME },
+    'auth.timestamps.loggedin': { $gt: new Date('2022-01-01') },
+  };
+
+  const fields = {
+    _id: 1,
+    items: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1]._id,
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};

migrations/archive/s3-upload.js

@@ -16,7 +16,7 @@ AWS.config.update({
 const BUCKET_NAME = config.S3.bucket;
 const s3 = new AWS.S3();
 
-// Adapted from http://stackoverflow.com/a/22210077/2601552
+// Adapted from https://stackoverflow.com/a/22210077/2601552
 function uploadFile (buffer, fileName) {
   return new Promise((resolve, reject) => {
     s3.putObject({

migrations/command-line/cancelSubscription.js

@@ -2,7 +2,7 @@
 
 // For some reason people often to contact me to cancel their sub,
 // rather than do it online. Even when I point them to
-// the FAQ (http://goo.gl/1uoPGQ) they insist...
+// the FAQ (https://habitica.fandom.com/wiki/FAQ) they insist...
 
 db.users.update(
   { _id: '' },

migrations/users/pi-day.js

@@ -3,13 +3,13 @@ import { v4 as uuid } from 'uuid';
 
 import { model as User } from '../../website/server/models/user';
 
-const MIGRATION_NAME = '20210314_pi_day';
+const MIGRATION_NAME = '20220314_pi_day';
 
 const progressCount = 1000;
 let count = 0;
 
 async function updateUser (user) {
-  count *= 1;
+  count += 1;
 
   const inc = {
     'items.food.Pie_Skeleton': 1,
@@ -54,7 +54,7 @@ async function updateUser (user) {
 export default async function processUsers () {
   const query = {
     migration: { $ne: MIGRATION_NAME },
-    'auth.timestamps.loggedin': { $gt: new Date('2021-02-15') },
+    'auth.timestamps.loggedin': { $gt: new Date('2022-02-15') },
   };
 
   const fields = {

package.json

@@ -1,25 +1,25 @@
 {
   "name": "habitica",
   "description": "A habit tracker app which treats your goals like a Role Playing Game.",
-  "version": "4.211.0",
+  "version": "4.237.1",
   "main": "./website/server/index.js",
   "dependencies": {
-    "@babel/core": "^7.15.8",
-    "@babel/preset-env": "^7.15.8",
-    "@babel/register": "^7.15.3",
-    "@google-cloud/trace-agent": "^5.1.5",
-    "@parse/node-apn": "^4.1.1",
-    "@slack/webhook": "^6.0.0",
-    "accepts": "^1.3.5",
+    "@babel/core": "^7.18.6",
+    "@babel/preset-env": "^7.18.6",
+    "@babel/register": "^7.18.6",
+    "@google-cloud/trace-agent": "^5.1.6",
+    "@parse/node-apn": "^5.1.3",
+    "@slack/webhook": "^6.1.0",
+    "accepts": "^1.3.8",
     "amazon-payments": "^0.2.9",
-    "amplitude": "^5.1.7",
-    "apidoc": "^0.50.0",
+    "amplitude": "^6.0.0",
+    "apidoc": "^0.52.0",
     "apple-auth": "^1.0.7",
     "bcrypt": "^5.0.1",
-    "body-parser": "^1.18.3",
+    "body-parser": "^1.20.0",
     "bootstrap": "^4.6.0",
     "compression": "^1.7.4",
-    "cookie-session": "^1.4.0",
+    "cookie-session": "^2.0.0",
     "coupon-code": "^0.4.5",
     "csv-stringify": "^5.6.5",
     "cwait": "^1.1.1",
@@ -27,31 +27,31 @@
     "eslint": "^6.8.0",
     "eslint-config-habitrpg": "^6.2.0",
     "eslint-plugin-mocha": "^5.0.0",
-    "express": "^4.16.3",
-    "express-basic-auth": "^1.1.5",
+    "express": "^4.18.1",
+    "express-basic-auth": "^1.2.1",
     "express-validator": "^5.2.0",
-    "glob": "^7.2.0",
-    "got": "^11.8.2",
+    "glob": "^8.0.3",
+    "got": "^11.8.3",
     "gulp": "^4.0.0",
     "gulp-babel": "^8.0.0",
     "gulp-imagemin": "^7.1.0",
     "gulp-nodemon": "^2.5.0",
-    "gulp.spritesmith": "^6.12.1",
+    "gulp.spritesmith": "^6.13.0",
     "habitica-markdown": "^3.0.0",
     "helmet": "^4.6.0",
-    "image-size": "^1.0.0",
+    "image-size": "^1.0.2",
     "in-app-purchase": "^1.11.3",
-    "js2xmlparser": "^4.0.1",
+    "js2xmlparser": "^4.0.2",
     "jsonwebtoken": "^8.5.1",
-    "jwks-rsa": "^2.0.5",
+    "jwks-rsa": "^2.1.4",
     "lodash": "^4.17.21",
     "merge-stream": "^2.0.0",
     "method-override": "^3.0.0",
-    "moment": "^2.29.1",
+    "moment": "^2.29.4",
     "moment-recur": "^1.0.7",
     "mongoose": "^5.13.7",
     "morgan": "^1.10.0",
-    "nconf": "^0.11.3",
+    "nconf": "^0.12.0",
     "node-gcm": "^1.0.5",
     "on-headers": "^1.0.2",
     "passport": "^0.5.0",
@@ -61,20 +61,20 @@
     "paypal-rest-sdk": "^1.8.1",
     "pp-ipn": "^1.1.0",
     "ps-tree": "^1.0.0",
-    "rate-limiter-flexible": "^2.3.1",
+    "rate-limiter-flexible": "^2.3.7",
     "redis": "^3.1.2",
     "regenerator-runtime": "^0.13.9",
-    "remove-markdown": "^0.3.0",
+    "remove-markdown": "^0.5.0",
     "rimraf": "^3.0.2",
     "short-uuid": "^4.2.0",
-    "stripe": "^8.183.0",
-    "superagent": "^6.1.0",
-    "universal-analytics": "^0.4.23",
+    "stripe": "^8.222.0",
+    "superagent": "^7.1.6",
+    "universal-analytics": "^0.5.3",
     "useragent": "^2.1.9",
     "uuid": "^8.3.2",
-    "validator": "^13.6.0",
+    "validator": "^13.7.0",
     "vinyl-buffer": "^1.0.1",
-    "winston": "^3.3.3",
+    "winston": "^3.8.1",
     "winston-loggly-bulk": "^3.2.1",
     "xml2js": "^0.4.23"
   },
@@ -106,12 +106,12 @@
     "start": "gulp nodemon",
     "debug": "gulp nodemon --inspect",
     "mongo:dev": "run-rs -v 4.2.8 -l ubuntu1804 --keep --dbpath mongodb-data --number 1 --quiet",
-    "postinstall": "gulp build && cd website/client && npm install",
+    "postinstall": "git config --global url.\"https://\".insteadOf git:// && gulp build && cd website/client && npm install",
     "apidoc": "gulp apidoc"
   },
   "devDependencies": {
-    "axios": "^0.23.0",
-    "chai": "^4.3.4",
+    "axios": "^0.27.2",
+    "chai": "^4.3.6",
     "chai-as-promised": "^7.1.1",
     "chai-moment": "^0.1.0",
     "chalk": "^4.1.2",
@@ -121,8 +121,8 @@
     "mocha": "^5.1.1",
     "monk": "^7.3.4",
     "require-again": "^2.0.0",
-    "run-rs": "^0.7.5",
-    "sinon": "^11.1.2",
+    "run-rs": "^0.7.6",
+    "sinon": "^13.0.2",
     "sinon-chai": "^3.7.0",
     "sinon-stub-promise": "^4.0.0"
   },

scripts/gdpr-delete-users.js

@@ -40,7 +40,7 @@ async function deleteHabiticaData (user, email) {
     'auth.local.passwordHashMethod': 'bcrypt',
   };
   if (!user.auth.local.email) set['auth.local.email'] = `${user._id}@example.com`;
-  await User.update(
+  await User.updateOne(
     { _id: user._id },
     { $set: set },
   );

test/api/unit/libs/bug-report.test.js

@@ -0,0 +1,57 @@
+/* eslint-disable global-require */
+import nconf from 'nconf';
+import { generateUser } from '../../../helpers/api-unit.helper';
+import * as emailLib from '../../../../website/server/libs/email';
+import { bugReportLogic } from '../../../../website/server/libs/bug-report';
+
+describe('bug-report', () => {
+  beforeEach(() => {
+    sandbox.stub(emailLib, 'sendTxn').returns(Promise.resolve());
+
+    const nconfGetStub = sandbox.stub(nconf, 'get');
+    nconfGetStub.withArgs('ADMIN_EMAIL').returns('true');
+  });
+
+  afterEach(() => {
+    sandbox.restore();
+  });
+
+  it('sends a mail using sendTxn', async () => {
+    const userId = '2b58daeb-bc50-4a83-b5d3-4ac52c7c0608';
+    const userMail = 'me@me.com';
+    const userMessage = 'The power is over 9000, please fix it';
+    const userAgent = 'The UserAgent with a bunch of weird browser engine levels';
+
+    const user = generateUser({
+      _id: userId,
+    });
+
+    const result = await bugReportLogic(
+      user, userMail, userMessage, userAgent,
+    );
+
+    expect(emailLib.sendTxn).to.be.called;
+    expect(result).to.deep.equal({
+      sendMailResult: undefined,
+      emailData: {
+        BROWSER_UA: userAgent,
+        REPORT_MSG: userMessage,
+        USER_CLASS: 'warrior',
+        USER_CONSECUTIVE_MONTHS: 0,
+        USER_COSTUME: 'false',
+        USER_CUSTOMER_ID: undefined,
+        USER_CUSTOM_DAY: 0,
+        USER_DAILIES_PAUSED: 'false',
+        USER_EMAIL: userMail,
+        USER_HOURGLASSES: 0,
+        USER_ID: userId,
+        USER_LEVEL: 1,
+        USER_OFFSET_MONTHS: 0,
+        USER_PAYMENT_PLATFORM: undefined,
+        USER_SUBSCRIPTION: undefined,
+        USER_TIMEZONE_OFFSET: 0,
+        USER_USERNAME: undefined,
+      },
+    });
+  });
+});

test/api/unit/libs/email.test.js

@@ -148,9 +148,18 @@ describe('emails', () => {
     });
   });
 
-  describe('sendTxnEmail', () => {
+  describe('sendTxn', () => {
+    let sendTxn = null;
+
     beforeEach(() => {
       sandbox.stub(got, 'post').returns(defer().promise);
+
+      const nconfGetStub = sandbox.stub(nconf, 'get');
+      nconfGetStub.withArgs('IS_PROD').returns(true);
+      nconfGetStub.withArgs('BASE_URL').returns('BASE_URL');
+
+      const attachEmail = requireAgain(pathToEmailLib);
+      sendTxn = attachEmail.sendTxn;
     });
 
     afterEach(() => {
@@ -158,16 +167,14 @@ describe('emails', () => {
     });
 
     it('can send a txn email to one recipient', () => {
-      sandbox.stub(nconf, 'get').withArgs('IS_PROD').returns(true);
-      const attachEmail = requireAgain(pathToEmailLib);
-      const sendTxnEmail = attachEmail.sendTxn;
       const emailType = 'an email type';
       const mailingInfo = {
         name: 'my name',
         email: 'my@email',
       };
 
-      sendTxnEmail(mailingInfo, emailType);
+      sendTxn(mailingInfo, emailType);
+      expect(got.post).to.be.called;
       expect(got.post).to.be.calledWith('undefined/job', sinon.match({
         json: {
           data: {
@@ -179,27 +186,77 @@ describe('emails', () => {
     });
 
     it('does not send email if address is missing', () => {
-      sandbox.stub(nconf, 'get').withArgs('IS_PROD').returns(true);
-      const attachEmail = requireAgain(pathToEmailLib);
-      const sendTxnEmail = attachEmail.sendTxn;
       const emailType = 'an email type';
       const mailingInfo = {
         name: 'my name',
         // email: 'my@email',
       };
 
-      sendTxnEmail(mailingInfo, emailType);
+      sendTxn(mailingInfo, emailType);
       expect(got.post).not.to.be.called;
     });
 
+    it('throws error when mail target is only a string', () => {
+      const emailType = 'an email type';
+      const mailingInfo = 'my email';
+
+      expect(sendTxn(mailingInfo, emailType)).to.throw;
+    });
+
+    it('throws error when mail target has no _id or email', () => {
+      const emailType = 'an email type';
+      const mailingInfo = {
+
+      };
+
+      expect(sendTxn(mailingInfo, emailType)).to.throw;
+    });
+
+    it('throws error when variables not an array', () => {
+      const emailType = 'an email type';
+      const mailingInfo = {
+        name: 'my name',
+        email: 'my@email',
+      };
+      const variables = {};
+
+      expect(sendTxn(mailingInfo, emailType, variables)).to.throw;
+    });
+    it('throws error when variables array not contain name/content', () => {
+      const emailType = 'an email type';
+      const mailingInfo = {
+        name: 'my name',
+        email: 'my@email',
+      };
+      const variables = [
+        {
+
+        },
+      ];
+
+      expect(sendTxn(mailingInfo, emailType, variables)).to.throw;
+    });
+    it('throws no error when variables array contain name but no content', () => {
+      const emailType = 'an email type';
+      const mailingInfo = {
+        name: 'my name',
+        email: 'my@email',
+      };
+      const variables = [
+        {
+          name: 'MY_VAR',
+        },
+      ];
+
+      expect(sendTxn(mailingInfo, emailType, variables)).to.not.throw;
+    });
+
     it('uses getUserInfo in case of user data', () => {
-      sandbox.stub(nconf, 'get').withArgs('IS_PROD').returns(true);
-      const attachEmail = requireAgain(pathToEmailLib);
-      const sendTxnEmail = attachEmail.sendTxn;
       const emailType = 'an email type';
       const mailingInfo = getUser();
 
-      sendTxnEmail(mailingInfo, emailType);
+      sendTxn(mailingInfo, emailType);
+      expect(got.post).to.be.called;
       expect(got.post).to.be.calledWith('undefined/job', sinon.match({
         json: {
           data: {
@@ -211,17 +268,15 @@ describe('emails', () => {
     });
 
     it('sends email with some default variables', () => {
-      sandbox.stub(nconf, 'get').withArgs('IS_PROD').returns(true);
-      const attachEmail = requireAgain(pathToEmailLib);
-      const sendTxnEmail = attachEmail.sendTxn;
       const emailType = 'an email type';
       const mailingInfo = {
         name: 'my name',
         email: 'my@email',
       };
-      const variables = [1, 2, 3];
+      const variables = [];
 
-      sendTxnEmail(mailingInfo, emailType, variables);
+      sendTxn(mailingInfo, emailType, variables);
+      expect(got.post).to.be.called;
       expect(got.post).to.be.calledWith('undefined/job', sinon.match({
         json: {
           data: {

test/api/unit/libs/items/utils.test.js

@@ -99,23 +99,26 @@ describe('Items Utils', () => {
       expect(castItemVal('items.food.Cake_Invalid', '5')).to.equal(5);
     });
 
-    it('converts values for mounts paths to numbers', () => {
-      expect(castItemVal('items.mounts.Cactus-Base', 'true')).to.equal(true);
-      expect(castItemVal('items.mounts.Aether-Invisible', 'false')).to.equal(false);
-      expect(castItemVal('items.mounts.Aether-Invalid', 'true')).to.equal(true);
-      expect(castItemVal('items.mounts.Aether-Invalid', 'truish')).to.equal(true);
-      expect(castItemVal('items.mounts.Aether-Invalid', 0)).to.equal(false);
-    });
-
     it('converts values for quests paths to numbers', () => {
       expect(castItemVal('items.quests.atom3', '5')).to.equal(5);
       expect(castItemVal('items.quests.invalid', '5')).to.equal(5);
     });
 
-    it('converts values for owned gear', () => {
+    it('converts values for mounts paths to true/null', () => {
+      // mounts are never false but can be null (function contains more details)
+      expect(castItemVal('items.mounts.Cactus-Base', 'true')).to.equal(true);
+      expect(castItemVal('items.mounts.Aether-Invisible', 'null')).to.equal(null);
+      expect(castItemVal('items.mounts.Aether-Invisible', 'false')).to.equal(null);
+      expect(castItemVal('items.mounts.Aether-Invalid', 'true')).to.equal(true);
+      expect(castItemVal('items.mounts.Aether-Invalid', 'truthy')).to.equal(true);
+      expect(castItemVal('items.mounts.Aether-Invalid', 0)).to.equal(null);
+    });
+
+    it('converts values for owned gear to true/false', () => {
       expect(castItemVal('items.gear.owned.shield_warrior_0', 'true')).to.equal(true);
       expect(castItemVal('items.gear.owned.invalid', 'false')).to.equal(false);
-      expect(castItemVal('items.gear.owned.invalid', 'thruthy')).to.equal(true);
+      expect(castItemVal('items.gear.owned.invalid', 'null')).to.equal(false);
+      expect(castItemVal('items.gear.owned.invalid', 'truthy')).to.equal(true);
       expect(castItemVal('items.gear.owned.invalid', 0)).to.equal(false);
     });
   });

test/api/unit/libs/payments/google.test.js

@@ -256,7 +256,7 @@ describe('Google Payments', () => {
           expirationDate,
         });
       iapGetPurchaseDataStub = sinon.stub(iap, 'getPurchaseData')
-        .returns([{ expirationDate: expirationDate.toDate() }]);
+        .returns([{ expirationDate: expirationDate.toDate(), autoRenewing: false }]);
       iapIsValidatedStub = sinon.stub(iap, 'isValidated')
         .returns(true);
 
@@ -325,5 +325,79 @@ describe('Google Payments', () => {
         headers,
       });
     });
+
+    it('should cancel a user subscription with multiple inactive subscriptions', async () => {
+      const laterDate = moment.utc().add(7, 'days');
+      iap.getPurchaseData.restore();
+      iapGetPurchaseDataStub = sinon.stub(iap, 'getPurchaseData')
+        .returns([{ expirationDate, autoRenewing: false },
+          { expirationDate: laterDate, autoRenewing: false },
+        ]);
+      await googlePayments.cancelSubscribe(user, headers);
+
+      expect(iapSetupStub).to.be.calledOnce;
+      expect(iapValidateStub).to.be.calledOnce;
+      expect(iapValidateStub).to.be.calledWith(iap.GOOGLE, {
+        data: receipt,
+        signature,
+      });
+      expect(iapIsValidatedStub).to.be.calledOnce;
+      expect(iapIsValidatedStub).to.be.calledWith({
+        expirationDate,
+      });
+      expect(iapGetPurchaseDataStub).to.be.calledOnce;
+
+      expect(paymentCancelSubscriptionSpy).to.be.calledOnce;
+      expect(paymentCancelSubscriptionSpy).to.be.calledWith({
+        user,
+        paymentMethod: googlePayments.constants.PAYMENT_METHOD_GOOGLE,
+        nextBill: laterDate.toDate(),
+        headers,
+      });
+    });
+
+    it('should not cancel a user subscription with autorenew', async () => {
+      iap.getPurchaseData.restore();
+      iapGetPurchaseDataStub = sinon.stub(iap, 'getPurchaseData')
+        .returns([{ autoRenewing: true }]);
+      await googlePayments.cancelSubscribe(user, headers);
+
+      expect(iapSetupStub).to.be.calledOnce;
+      expect(iapValidateStub).to.be.calledOnce;
+      expect(iapValidateStub).to.be.calledWith(iap.GOOGLE, {
+        data: receipt,
+        signature,
+      });
+      expect(iapIsValidatedStub).to.be.calledOnce;
+      expect(iapIsValidatedStub).to.be.calledWith({
+        expirationDate,
+      });
+      expect(iapGetPurchaseDataStub).to.be.calledOnce;
+
+      expect(paymentCancelSubscriptionSpy).to.not.be.called;
+    });
+
+    it('should not cancel a user subscription with multiple subscriptions with one autorenew', async () => {
+      iap.getPurchaseData.restore();
+      iapGetPurchaseDataStub = sinon.stub(iap, 'getPurchaseData')
+        .returns([{ expirationDate, autoRenewing: false },
+          { autoRenewing: true },
+          { expirationDate, autoRenewing: false }]);
+      await googlePayments.cancelSubscribe(user, headers);
+
+      expect(iapSetupStub).to.be.calledOnce;
+      expect(iapValidateStub).to.be.calledOnce;
+      expect(iapValidateStub).to.be.calledWith(iap.GOOGLE, {
+        data: receipt,
+        signature,
+      });
+      expect(iapIsValidatedStub).to.be.calledOnce;
+      expect(iapIsValidatedStub).to.be.calledWith({
+        expirationDate,
+      });
+      expect(iapGetPurchaseDataStub).to.be.calledOnce;
+
+      expect(paymentCancelSubscriptionSpy).to.not.be.called;
+    });
   });
 });

test/api/unit/libs/payments/payments.test.js

@@ -247,11 +247,11 @@ describe('payments/index', () => {
 
       context('No Active Promotion', () => {
         beforeEach(() => {
-          sinon.stub(worldState, 'getCurrentEvent').returns(null);
+          sinon.stub(worldState, 'getCurrentEventList').returns([]);
         });
 
         afterEach(() => {
-          worldState.getCurrentEvent.restore();
+          worldState.getCurrentEventList.restore();
         });
 
         it('sends a private message about the gift', async () => {
@@ -268,14 +268,14 @@ describe('payments/index', () => {
 
       context('Active Promotion', () => {
         beforeEach(() => {
-          sinon.stub(worldState, 'getCurrentEvent').returns({
+          sinon.stub(worldState, 'getCurrentEventList').returns([{
             ...common.content.events.winter2021Promo,
             event: 'winter2021',
-          });
+          }]);
         });
 
         afterEach(() => {
-          worldState.getCurrentEvent.restore();
+          worldState.getCurrentEventList.restore();
         });
 
         it('creates a gift subscription for purchaser and recipient if none exist', async () => {

test/api/unit/libs/xmlMarshaller.test.js

@@ -42,3 +42,109 @@ describe('xml marshaller marshalls user data', () => {
 </user>`);
   });
 });
+
+describe('xml marshaller marshalls user data (with purchases)', () => {
+  const minimumUser = {
+    pinnedItems: [],
+    unpinnedItems: [],
+    inbox: {},
+  };
+
+  function userDataWith (fields) {
+    return { ...minimumUser, ...fields };
+  }
+
+  it('maps the purchases field with data that begins with a number', () => {
+    const userData = userDataWith({
+      purchased: {
+        ads: false,
+        txnCount: 0,
+        skin: {
+          eb052b: true,
+          '0ff591': true,
+          '2b43f6': true,
+          d7a9f7: true,
+          '800ed0': true,
+          rainbow: true,
+        },
+      },
+    });
+
+    const xml = xmlMarshaller.marshallUserData(userData);
+
+    expect(xml).to.equal(`<user>
+    <inbox/>
+    <purchased>
+        <ads>false</ads>
+        <txnCount>0</txnCount>
+        <skin>eb052b</skin>
+        <skin>0ff591</skin>
+        <skin>2b43f6</skin>
+        <skin>d7a9f7</skin>
+        <skin>800ed0</skin>
+        <skin>rainbow</skin>
+    </purchased>
+</user>`);
+  });
+});
+
+describe('xml marshaller marshalls user data (with purchases nested)', () => {
+  const minimumUser = {
+    pinnedItems: [],
+    unpinnedItems: [],
+    inbox: {},
+  };
+
+  function userDataWith (fields) {
+    return { ...minimumUser, ...fields };
+  }
+
+  it('maps the purchases field with data that begins with a number and nested objects', () => {
+    const userData = userDataWith({
+      purchased: {
+        ads: false,
+        txnCount: 0,
+        skin: {
+          eb052b: true,
+          '0ff591': true,
+          '2b43f6': true,
+          d7a9f7: true,
+          '800ed0': true,
+          rainbow: true,
+        },
+        plan: {
+          consecutive: {
+            count: 0,
+            offset: 0,
+            gemCapExtra: 0,
+            trinkets: 0,
+          },
+        },
+      },
+    });
+
+    const xml = xmlMarshaller.marshallUserData(userData);
+
+    expect(xml).to.equal(`<user>
+    <inbox/>
+    <purchased>
+        <ads>false</ads>
+        <txnCount>0</txnCount>
+        <skin>eb052b</skin>
+        <skin>0ff591</skin>
+        <skin>2b43f6</skin>
+        <skin>d7a9f7</skin>
+        <skin>800ed0</skin>
+        <skin>rainbow</skin>
+        <plan>
+            <item>
+                <count>0</count>
+                <offset>0</offset>
+                <gemCapExtra>0</gemCapExtra>
+                <trinkets>0</trinkets>
+            </item>
+        </plan>
+    </purchased>
+</user>`);
+  });
+});

test/api/unit/middlewares/cronMiddleware.js

@@ -128,6 +128,22 @@ describe('cron middleware', () => {
     });
   });
 
+  it('runs cron if previous cron was incomplete', async () => {
+    user.lastCron = moment(new Date()).subtract({ days: 1 });
+    user.auth.timestamps.loggedin = moment(new Date()).subtract({ days: 4 });
+    const now = new Date();
+    await user.save();
+
+    await new Promise((resolve, reject) => {
+      cronMiddleware(req, res, err => {
+        if (err) return reject(err);
+        expect(moment(now).isSame(user.lastCron, 'day'));
+        expect(moment(now).isSame(user.auth.timestamps.loggedin, 'day'));
+        return resolve();
+      });
+    });
+  });
+
   it('updates user.auth.timestamps.loggedin and lastCron', async () => {
     user.lastCron = moment(new Date()).subtract({ days: 2 });
     const now = new Date();
@@ -293,4 +309,33 @@ describe('cron middleware', () => {
       });
     });
   });
+
+  it('cron should not run more than once', async () => {
+    user.lastCron = moment(new Date()).subtract({ days: 2 });
+    await user.save();
+
+    sandbox.spy(cronLib, 'cron');
+
+    await Promise.all([new Promise((resolve, reject) => {
+      cronMiddleware(req, res, err => {
+        if (err) return reject(err);
+        return resolve();
+      });
+    }), new Promise((resolve, reject) => {
+      cronMiddleware(req, res, err => {
+        if (err) return reject(err);
+        return resolve();
+      });
+    }), new Promise((resolve, reject) => {
+      setTimeout(() => {
+        cronMiddleware(req, res, err => {
+          if (err) return reject(err);
+          return resolve();
+        });
+      }, 400);
+    }),
+    ]);
+
+    expect(cronLib.cron).to.be.calledOnce;
+  });
 });

test/api/unit/middlewares/ensureAccessRight.test.js

@@ -4,8 +4,7 @@ import {
   generateReq,
   generateNext,
 } from '../../../helpers/api-unit.helper';
-import i18n from '../../../../website/common/script/i18n';
-import { ensureAdmin, ensureSudo, ensureNewsPoster } from '../../../../website/server/middlewares/ensureAccessRight';
+import { ensurePermission } from '../../../../website/server/middlewares/ensureAccessRight';
 import { NotAuthorized } from '../../../../website/server/libs/errors';
 import apiError from '../../../../website/server/libs/apiError';
 
@@ -20,20 +19,20 @@ describe('ensure access middlewares', () => {
   });
 
   context('ensure admin', () => {
-    it('returns not authorized when user is not an admin', () => {
-      res.locals = { user: { contributor: { admin: false } } };
+    it('returns not authorized when user is not in userSupport', () => {
+      res.locals = { user: { permissions: { userSupport: false } } };
 
-      ensureAdmin(req, res, next);
+      ensurePermission('userSupport')(req, res, next);
 
       const calledWith = next.getCall(0).args;
-      expect(calledWith[0].message).to.equal(i18n.t('noAdminAccess'));
+      expect(calledWith[0].message).to.equal(apiError('noPrivAccess'));
       expect(calledWith[0] instanceof NotAuthorized).to.equal(true);
     });
 
-    it('passes when user is an admin', () => {
-      res.locals = { user: { contributor: { admin: true } } };
+    it('passes when user is an userSuppor', () => {
+      res.locals = { user: { permissions: { userSupport: true } } };
 
-      ensureAdmin(req, res, next);
+      ensurePermission('userSupport')(req, res, next);
 
       expect(next).to.be.calledOnce;
       expect(next.args[0]).to.be.empty;
@@ -42,40 +41,40 @@ describe('ensure access middlewares', () => {
 
   context('ensure newsPoster', () => {
     it('returns not authorized when user is not a newsPoster', () => {
-      res.locals = { user: { contributor: { newsPoster: false } } };
+      res.locals = { user: { permissions: { news: false } } };
 
-      ensureNewsPoster(req, res, next);
+      ensurePermission('news')(req, res, next);
 
       const calledWith = next.getCall(0).args;
-      expect(calledWith[0].message).to.equal(apiError('noNewsPosterAccess'));
+      expect(calledWith[0].message).to.equal(apiError('noPrivAccess'));
       expect(calledWith[0] instanceof NotAuthorized).to.equal(true);
     });
 
     it('passes when user is a newsPoster', () => {
-      res.locals = { user: { contributor: { newsPoster: true } } };
+      res.locals = { user: { permissions: { news: true } } };
 
-      ensureNewsPoster(req, res, next);
+      ensurePermission('news')(req, res, next);
 
       expect(next).to.be.calledOnce;
       expect(next.args[0]).to.be.empty;
     });
   });
 
-  context('ensure sudo', () => {
-    it('returns not authorized when user is not a sudo user', () => {
-      res.locals = { user: { contributor: { sudo: false } } };
+  context('ensure coupons', () => {
+    it('returns not authorized when user does not have access to coupon calls', () => {
+      res.locals = { user: { permissions: { coupons: false } } };
 
-      ensureSudo(req, res, next);
+      ensurePermission('coupons')(req, res, next);
 
       const calledWith = next.getCall(0).args;
-      expect(calledWith[0].message).to.equal(apiError('noSudoAccess'));
+      expect(calledWith[0].message).to.equal(apiError('noPrivAccess'));
       expect(calledWith[0] instanceof NotAuthorized).to.equal(true);
     });
 
-    it('passes when user is a sudo user', () => {
-      res.locals = { user: { contributor: { sudo: true } } };
+    it('passes when user has access to coupon calls', () => {
+      res.locals = { user: { permissions: { coupons: true } } };
 
-      ensureSudo(req, res, next);
+      ensurePermission('coupons')(req, res, next);
 
       expect(next).to.be.calledOnce;
       expect(next.args[0]).to.be.empty;

test/api/unit/models/group.test.js

@@ -1029,7 +1029,7 @@ describe('Group Model', () => {
         expect(toJSON.chat.length).to.equal(1);
       });
 
-      it('shows messages with >= 2 flag to admins', async () => {
+      it('shows messages with >= 2 flag to moderators', async () => {
         party.chat = [{
           flagCount: 3,
           info: {
@@ -1037,12 +1037,12 @@ describe('Group Model', () => {
             quest: 'basilist',
           },
         }];
-        const admin = new User({ 'contributor.admin': true });
+        const admin = new User({ 'permissions.moderator': true });
         const toJSON = await Group.toJSONCleanChat(party, admin);
         expect(toJSON.chat.length).to.equal(1);
       });
 
-      it('doesn\'t show flagged messages to non-admins', async () => {
+      it('doesn\'t show flagged messages to non-moderators', async () => {
         party.chat = [{
           flagCount: 3,
           info: {

test/api/unit/models/user.test.js

@@ -634,7 +634,7 @@ describe('User Model', () => {
       user = await user.save();
       // verify that it's been awarded
       expect(user.achievements.beastMaster).to.equal(true);
-      expect(user.notifications.find(notification => notification.type === 'ACHIEVEMENT_BEAST_MASTER')).to.exist;
+      expect(user.notifications.find(notification => notification.type === 'ACHIEVEMENT_STABLE')).to.exist;
 
       // reset the user
       user.achievements.beastMasterCount = 0;
@@ -683,9 +683,9 @@ describe('User Model', () => {
 
       user = await user.save();
       // verify that it's been awarded
-      expect(user.notifications.find(notification => notification.type === 'ACHIEVEMENT_BEAST_MASTER')).to.exist;
-      expect(user.notifications.find(notification => notification.type === 'ACHIEVEMENT_MOUNT_MASTER')).to.exist;
-      expect(user.notifications.find(notification => notification.type === 'ACHIEVEMENT_TRIAD_BINGO')).to.exist;
+      expect(user.notifications.find(
+        notification => notification.type === 'ACHIEVEMENT_STABLE',
+      )).to.exist;
     });
 
     context('manage unallocated stats points notifications', () => {
@@ -811,6 +811,16 @@ describe('User Model', () => {
       expect(daysMissed).to.eql(5);
     });
 
+    it('correctly handles a cron that did not complete', () => {
+      const now = moment();
+      user.lastCron = moment(now).subtract(2, 'days');
+      user.auth.timestamps.loggedIn = moment(now).subtract(5, 'days');
+
+      const { daysMissed } = user.daysUserHasMissed(now);
+
+      expect(daysMissed).to.eql(5);
+    });
+
     it('uses timezone from preferences to calculate days missed', () => {
       const now = moment('2017-07-08 01:00:00Z');
       user.lastCron = moment('2017-07-04 13:00:00Z');
@@ -867,7 +877,7 @@ describe('User Model', () => {
 
     expect(user.isNewsPoster()).to.equal(false);
 
-    user.contributor.newsPoster = true;
+    user.permissions = { news: true };
     expect(user.isNewsPoster()).to.equal(true);
   });
 

test/api/v3/integration/challenges/GET-challenges_group_groupid.test.js

@@ -202,7 +202,7 @@ describe('GET challenges/groups/:groupId', () => {
       publicGuild = group;
 
       await user.update({
-        'contributor.admin': true,
+        'permissions.challengeAdmin': true,
       });
 
       officialChallenge = await generateChallenge(user, group, {

test/api/v3/integration/challenges/GET-challenges_user.test.js

@@ -231,7 +231,7 @@ describe('GET challenges/user', () => {
       publicGuild = group;
 
       await user.update({
-        'contributor.admin': true,
+        'permissions.challengeAdmin': true,
       });
 
       officialChallenge = await generateChallenge(user, group, {

test/api/v3/integration/challenges/POST-challenges.test.js

@@ -203,8 +203,8 @@ describe('POST /challenges', () => {
 
     it('sets challenge as official if created by admin and official flag is set', async () => {
       await groupLeader.update({
-        contributor: {
-          admin: true,
+        permissions: {
+          challengeAdmin: true,
         },
       });
 

test/api/v3/integration/challenges/PUT-challenges_challengeId.test.js

@@ -74,7 +74,6 @@ describe('PUT /challenges/:challengeId', () => {
     expect(res.memberCount).to.equal(2);
     expect(res.tasksOrder).not.to.equal('new order');
     expect(res.official).to.equal(false);
-    expect(res.shortName).not.to.equal('new short name');
 
     expect(res.leader).to.eql({
       _id: user._id,

test/api/v3/integration/chat/DELETE-chat_id.test.js

@@ -15,6 +15,10 @@ describe('DELETE /groups/:groupId/chat/:chatId', () => {
         type: 'guild',
         privacy: 'public',
       },
+      leaderDetails: {
+        'auth.timestamps.created': new Date('2022-01-01'),
+        balance: 10,
+      },
     });
 
     groupWithChat = group;
@@ -22,7 +26,7 @@ describe('DELETE /groups/:groupId/chat/:chatId', () => {
     message = await user.post(`/groups/${groupWithChat._id}/chat`, { message: 'Some message' });
     message = message.message;
     userThatDidNotCreateChat = await generateUser();
-    admin = await generateUser({ 'contributor.admin': true });
+    admin = await generateUser({ 'permissions.moderator': true });
   });
 
   context('Chat errors', () => {

test/api/v3/integration/chat/POST-chat.flag.test.js

@@ -17,7 +17,7 @@ describe('POST /chat/:chatId/flag', () => {
 
   beforeEach(async () => {
     user = await generateUser({ balance: 1, 'auth.timestamps.created': moment().subtract(USER_AGE_FOR_FLAGGING + 1, 'days').toDate() });
-    admin = await generateUser({ balance: 1, 'contributor.admin': true });
+    admin = await generateUser({ balance: 1, 'permissions.moderator': true });
     anotherUser = await generateUser({ 'auth.timestamps.created': moment().subtract(USER_AGE_FOR_FLAGGING + 1, 'days').toDate() });
     newUser = await generateUser({ 'auth.timestamps.created': moment().subtract(1, 'days').toDate() });
     sandbox.stub(IncomingWebhook.prototype, 'send').returns(Promise.resolve());
@@ -117,7 +117,9 @@ describe('POST /chat/:chatId/flag', () => {
   });
 
   it('Flags a chat when the author\'s account was deleted', async () => {
-    const deletedUser = await generateUser();
+    const deletedUser = await generateUser({
+      'auth.timestamps.created': new Date('2022-01-01'),
+    });
     const { message } = await deletedUser.post(`/groups/${group._id}/chat`, { message: TEST_MESSAGE });
     await deletedUser.del('/user', {
       password: 'password',

test/api/v3/integration/chat/POST-chat.like.test.js

@@ -18,11 +18,16 @@ describe('POST /chat/:chatId/like', () => {
         privacy: 'public',
       },
       members: 1,
+      leaderDetails: {
+        'auth.timestamps.created': new Date('2022-01-01'),
+        balance: 10,
+      },
     });
 
     user = groupLeader;
     groupWithChat = group;
     anotherUser = members[0]; // eslint-disable-line prefer-destructuring
+    await anotherUser.update({ 'auth.timestamps.created': new Date('2022-01-01') });
   });
 
   it('Returns an error when chat message is not found', async () => {

test/api/v3/integration/chat/POST-chat.test.js

@@ -38,10 +38,15 @@ describe('POST /chat', () => {
       members: 2,
     });
     user = groupLeader;
-    await user.update({ 'contributor.level': SPAM_MIN_EXEMPT_CONTRIB_LEVEL }); // prevent tests accidentally throwing messageGroupChatSpam
+    await user.update({
+      'contributor.level': SPAM_MIN_EXEMPT_CONTRIB_LEVEL,
+      'auth.timestamps.created': new Date('2022-01-01'),
+    }); // prevent tests accidentally throwing messageGroupChatSpam
     groupWithChat = group;
     member = members[0]; // eslint-disable-line prefer-destructuring
     additionalMember = members[1]; // eslint-disable-line prefer-destructuring
+    await member.update({ 'auth.timestamps.created': new Date('2022-01-01') });
+    await additionalMember.update({ 'auth.timestamps.created': new Date('2022-01-01') });
   });
 
   it('Returns an error when no message is provided', async () => {
@@ -104,7 +109,10 @@ describe('POST /chat', () => {
       });
 
       const privateGuildMemberWithChatsRevoked = members[0];
-      await privateGuildMemberWithChatsRevoked.update({ 'flags.chatRevoked': true });
+      await privateGuildMemberWithChatsRevoked.update({
+        'flags.chatRevoked': true,
+        'auth.timestamps.created': new Date('2022-01-01'),
+      });
 
       const message = await privateGuildMemberWithChatsRevoked.post(`/groups/${group._id}/chat`, { message: testMessage });
 
@@ -122,7 +130,10 @@ describe('POST /chat', () => {
       });
 
       const privatePartyMemberWithChatsRevoked = members[0];
-      await privatePartyMemberWithChatsRevoked.update({ 'flags.chatRevoked': true });
+      await privatePartyMemberWithChatsRevoked.update({
+        'flags.chatRevoked': true,
+        'auth.timestamps.created': new Date('2022-01-01'),
+      });
 
       const message = await privatePartyMemberWithChatsRevoked.post(`/groups/${group._id}/chat`, { message: testMessage });
 
@@ -183,7 +194,10 @@ describe('POST /chat', () => {
       });
 
       const userWithChatShadowMuted = members[0];
-      await userWithChatShadowMuted.update({ 'flags.chatShadowMuted': true });
+      await userWithChatShadowMuted.update({
+        'flags.chatShadowMuted': true,
+        'auth.timestamps.created': new Date('2022-01-01'),
+      });
 
       const message = await userWithChatShadowMuted.post(`/groups/${group._id}/chat`, { message: testMessage });
 
@@ -202,7 +216,10 @@ describe('POST /chat', () => {
       });
 
       const userWithChatShadowMuted = members[0];
-      await userWithChatShadowMuted.update({ 'flags.chatShadowMuted': true });
+      await userWithChatShadowMuted.update({
+        'flags.chatShadowMuted': true,
+        'auth.timestamps.created': new Date('2022-01-01'),
+      });
 
       const message = await userWithChatShadowMuted.post(`/groups/${group._id}/chat`, { message: testMessage });
 
@@ -312,6 +329,7 @@ describe('POST /chat', () => {
         },
         members: 1,
       });
+      await members[0].update({ 'auth.timestamps.created': new Date('2022-01-01') });
 
       const message = await members[0].post(`/groups/${group._id}/chat`, { message: testBannedWordMessage });
 
@@ -330,6 +348,7 @@ describe('POST /chat', () => {
 
       // Update the bannedWordsAllowed property for the group
       group.update({ bannedWordsAllowed: true });
+      await members[0].update({ 'auth.timestamps.created': new Date('2022-01-01') });
 
       const message = await members[0].post(`/groups/${group._id}/chat`, { message: testBannedWordMessage });
 
@@ -345,6 +364,7 @@ describe('POST /chat', () => {
         },
         members: 1,
       });
+      await members[0].update({ 'auth.timestamps.created': new Date('2022-01-01') });
 
       const message = await members[0].post(`/groups/${group._id}/chat`, { message: testBannedWordMessage });
 
@@ -402,7 +422,7 @@ describe('POST /chat', () => {
       });
     });
 
-    it('does not allow slurs in private groups', async () => {
+    it('allows slurs in private groups', async () => {
       const { group, members } = await createAndPopulateGroup({
         groupDetails: {
           name: 'Party',
@@ -411,43 +431,11 @@ describe('POST /chat', () => {
         },
         members: 1,
       });
+      await members[0].update({ 'auth.timestamps.created': new Date('2022-01-01') });
 
-      await expect(members[0].post(`/groups/${group._id}/chat`, { message: testSlurMessage })).to.eventually.be.rejected.and.eql({
-        code: 400,
-        error: 'BadRequest',
-        message: t('bannedSlurUsed'),
-      });
+      const message = await members[0].post(`/groups/${group._id}/chat`, { message: testSlurMessage });
 
-      // Email sent to mods
-      await sleep(0.5);
-      expect(email.sendTxn).to.be.calledThrice;
-      expect(email.sendTxn.args[2][1]).to.eql('slur-report-to-mods');
-
-      // Slack message to mods
-      expect(IncomingWebhook.prototype.send).to.be.calledOnce;
-      /* eslint-disable camelcase */
-      expect(IncomingWebhook.prototype.send).to.be.calledWith({
-        text: `${members[0].profile.name} (${members[0].id}) tried to post a slur`,
-        attachments: [{
-          fallback: 'Slur Message',
-          color: 'danger',
-          author_name: `@${members[0].auth.local.username} ${members[0].profile.name} (${members[0].auth.local.email}; ${members[0]._id})`,
-          title: 'Slur in Party - (private party)',
-          title_link: undefined,
-          text: testSlurMessage,
-          mrkdwn_in: [
-            'text',
-          ],
-        }],
-      });
-      /* eslint-enable camelcase */
-
-      // Chat privileges are revoked
-      await expect(members[0].post(`/groups/${groupWithChat._id}/chat`, { message: testMessage })).to.eventually.be.rejected.and.eql({
-        code: 401,
-        error: 'NotAuthorized',
-        message: t('chatPrivilegesRevoked'),
-      });
+      expect(message.message.id).to.exist;
     });
 
     it('errors when slur is typed in mixed case', async () => {
@@ -463,6 +451,16 @@ describe('POST /chat', () => {
     });
   });
 
+  it('errors when user account is too young', async () => {
+    const brandNewUser = await generateUser();
+    await expect(brandNewUser.post('/groups/habitrpg/chat', { message: 'hi im new' }))
+      .to.eventually.be.rejected.and.eql({
+        code: 400,
+        error: 'BadRequest',
+        message: t('chatTemporarilyUnavailable'),
+      });
+  });
+
   it('creates a chat', async () => {
     const newMessage = await user.post(`/groups/${groupWithChat._id}/chat`, { message: testMessage });
     const groupMessages = await user.get(`/groups/${groupWithChat._id}/chat`);
@@ -525,6 +523,7 @@ describe('POST /chat', () => {
       'items.currentMount': mount,
       'items.currentPet': pet,
       'preferences.style': style,
+      'auth.timestamps.created': new Date('2022-01-01'),
     });
     await userWithStyle.sync();
 
@@ -550,6 +549,7 @@ describe('POST /chat', () => {
     };
     const backer = await generateUser({
       backer: backerInfo,
+      'auth.timestamps.created': new Date('2022-01-01'),
     });
 
     const message = await backer.post(`/groups/${groupWithChat._id}/chat`, { message: testMessage });
@@ -620,6 +620,9 @@ describe('POST /chat', () => {
           privacy: 'private',
         },
         members: 1,
+        leaderDetails: {
+          'auth.timestamps.created': new Date('2022-01-01'),
+        },
       });
 
       const message = await groupLeader.post(`/groups/${group._id}/chat`, { message: testMessage });

test/api/v3/integration/chat/POST-chat_seen.test.js

@@ -15,6 +15,10 @@ describe('POST /groups/:id/chat/seen', () => {
           privacy: 'public',
         },
         members: 1,
+        leaderDetails: {
+          'auth.timestamps.created': new Date('2022-01-01'),
+          balance: 10,
+        },
       });
 
       guild = group;
@@ -51,6 +55,9 @@ describe('POST /groups/:id/chat/seen', () => {
           privacy: 'private',
         },
         members: 1,
+        leaderDetails: {
+          'auth.timestamps.created': new Date('2022-01-01'),
+        },
       });
 
       party = group;

test/api/v3/integration/chat/POST-groups_id_chat_id_clear_flags.test.js

@@ -18,12 +18,16 @@ describe('POST /groups/:id/chat/:id/clearflags', () => {
         type: 'guild',
         privacy: 'public',
       },
+      leaderDetails: {
+        'auth.timestamps.created': new Date('2022-01-01'),
+        balance: 10,
+      },
     });
 
     groupWithChat = group;
     author = groupLeader;
     nonAdmin = await generateUser({ 'auth.timestamps.created': moment().subtract(USER_AGE_FOR_FLAGGING + 1, 'days').toDate() });
-    admin = await generateUser({ 'contributor.admin': true });
+    admin = await generateUser({ 'permissions.moderator': true });
 
     message = await author.post(`/groups/${groupWithChat._id}/chat`, { message: 'Some message' });
     message = message.message;
@@ -65,6 +69,7 @@ describe('POST /groups/:id/chat/:id/clearflags', () => {
         members: 1,
       });
 
+      await members[0].update({ 'auth.timestamps.created': new Date('2022-01-01') });
       let privateMessage = await members[0].post(`/groups/${group._id}/chat`, { message: 'Some message' });
       privateMessage = privateMessage.message;
 

test/api/v3/integration/coupons/GET-coupons.test.js

@@ -14,18 +14,18 @@ describe('GET /coupons/', () => {
     user = await generateUser();
   });
 
-  it('returns an error if user has no sudo permission', async () => {
+  it('returns an error if user has no coupons permission', async () => {
     await user.get('/user'); // needed so the request after this will authenticate with the correct cookie session
     await expect(user.get('/coupons')).to.eventually.be.rejected.and.eql({
       code: 401,
       error: 'NotAuthorized',
-      message: apiError('noSudoAccess'),
+      message: apiError('noPrivAccess'),
     });
   });
 
   it('should return the coupons in CSV format ordered by creation date', async () => {
     await user.update({
-      'contributor.sudo': true,
+      'permissions.coupons': true,
     });
 
     const coupons = await user.post('/coupons/generate/wondercon?count=11');

test/api/v3/integration/coupons/POST-coupons_enter_code.test.js

@@ -15,7 +15,7 @@ describe('POST /coupons/enter/:code', () => {
   beforeEach(async () => {
     user = await generateUser();
     sudoUser = await generateUser({
-      'contributor.sudo': true,
+      'permissions.coupons': true,
     });
   });
 

test/api/v3/integration/coupons/POST-coupons_generate_event.test.js

@@ -14,19 +14,19 @@ describe('POST /coupons/generate/:event', () => {
 
   beforeEach(async () => {
     user = await generateUser({
-      'contributor.sudo': true,
+      'permissions.coupons': true,
     });
   });
 
-  it('returns an error if user has no sudo permission', async () => {
+  it('returns an error if user has no coupons permission', async () => {
     await user.update({
-      'contributor.sudo': false,
+      'permissions.coupons': false,
     });
 
     await expect(user.post('/coupons/generate/aaa')).to.eventually.be.rejected.and.eql({
       code: 401,
       error: 'NotAuthorized',
-      message: apiError('noSudoAccess'),
+      message: apiError('noPrivAccess'),
     });
   });
 
@@ -48,7 +48,7 @@ describe('POST /coupons/generate/:event', () => {
 
   it('should generate coupons', async () => {
     await user.update({
-      'contributor.sudo': true,
+      'permissions.coupons': true,
     });
 
     const coupons = await user.post('/coupons/generate/wondercon?count=2');

test/api/v3/integration/coupons/POST-coupons_validate_code.test.js

@@ -21,7 +21,7 @@ describe('POST /coupons/validate/:code', () => {
 
   it('returns true if coupon code is valid', async () => {
     const sudoUser = await generateUser({
-      'contributor.sudo': true,
+      'permissions.coupons': true,
     });
 
     const [coupon] = await sudoUser.post('/coupons/generate/wondercon?count=1');

test/api/v3/integration/debug/POST-debug_make-admin.test.js

@@ -3,7 +3,7 @@ import {
   generateUser,
 } from '../../../../helpers/api-integration/v3';
 
-describe('POST /debug/make-admin (pended for v3 prod testing)', () => {
+describe('POST /debug/make-admin', () => {
   let user;
 
   before(async () => {
@@ -14,12 +14,12 @@ describe('POST /debug/make-admin (pended for v3 prod testing)', () => {
     nconf.set('IS_PROD', false);
   });
 
-  it('makes user an admine', async () => {
+  it('makes user an admin', async () => {
     await user.post('/debug/make-admin');
 
     await user.sync();
 
-    expect(user.contributor.admin).to.eql(true);
+    expect(user.permissions.fullAccess).to.eql(true);
   });
 
   it('returns error when not in production mode', async () => {

test/api/v3/integration/groups/GET-groups.test.js

@@ -219,11 +219,19 @@ describe('GET /groups', () => {
 
     it('returns 30 guilds per page ordered by number of members', async () => {
       await user.update({ balance: 9000 });
-      const groups = await Promise.all(_.times(60, i => generateGroup(user, {
-        name: `public guild ${i} - is member`,
-        type: 'guild',
-        privacy: 'public',
-      })));
+      const delay = () => new Promise(resolve => setTimeout(resolve, 40));
+      const promises = [];
+
+      for (let i = 0; i < 60; i += 1) {
+        promises.push(generateGroup(user, {
+          name: `public guild ${i} - is member`,
+          type: 'guild',
+          privacy: 'public',
+        }));
+        await delay(); // eslint-disable-line no-await-in-loop
+      }
+
+      const groups = await Promise.all(promises);
 
       // update group number 32 and not the first to make sure sorting works
       await groups[32].update({ name: 'guild with most members', memberCount: 199 });

test/api/v3/integration/groups/GET-groups_id.test.js

@@ -315,7 +315,7 @@ describe('GET /groups/:id', () => {
 
       beforeEach(async () => {
         admin = await generateUser({
-          'contributor.admin': true,
+          'permissions.moderator': true,
         });
       });
 

test/api/v3/integration/groups/POST-group_remove_manager.test.js

@@ -7,7 +7,7 @@ import {
 describe('POST /group/:groupId/remove-manager', () => {
   let leader; let nonLeader; let
     groupToUpdate;
-  const groupName = 'Test Public Guild';
+  const groupName = 'Test Private Guild';
   const groupType = 'guild';
   let nonManager;
 
@@ -20,9 +20,10 @@ describe('POST /group/:groupId/remove-manager', () => {
       groupDetails: {
         name: groupName,
         type: groupType,
-        privacy: 'public',
+        privacy: 'private',
       },
       members: 2,
+      upgradeToGroupPlan: true,
     });
 
     groupToUpdate = group;
@@ -83,7 +84,7 @@ describe('POST /group/:groupId/remove-manager', () => {
 
     await nonLeader.sync();
 
-    expect(nonLeader.notifications.length).to.equal(0);
+    expect(nonLeader.notifications.length).to.equal(1); // user gets mystery items
     expect(updatedGroup.managers[nonLeader._id]).to.not.exist;
   });
 });

test/api/v3/integration/groups/POST-groups.test.js

@@ -2,6 +2,7 @@ import {
   generateUser,
   translate as t,
 } from '../../../../helpers/api-integration/v3';
+import { model as Group } from '../../../../../website/server/models/group';
 
 describe('POST /group', () => {
   let user;
@@ -203,6 +204,23 @@ describe('POST /group', () => {
 
         expect(updatedUser.balance).to.eql(user.balance - 1);
       });
+
+      it('does not deduct the gems from user when guild creation fails', async () => {
+        const stub = sinon.stub(Group.prototype, 'save').rejects();
+        const promise = user.post('/groups', {
+          name: groupName,
+          type: groupType,
+          privacy: groupPrivacy,
+        });
+
+        await expect(promise).to.eventually.be.rejected;
+
+        const updatedUser = await user.get('/user');
+
+        expect(updatedUser.balance).to.eql(user.balance);
+
+        stub.restore();
+      });
     });
   });
 

test/api/v3/integration/groups/POST-groups_groupId_leave.test.js

@@ -37,6 +37,7 @@ describe('POST /groups/:groupId/leave', () => {
         leader = groupLeader;
         member = members[0]; // eslint-disable-line prefer-destructuring
         memberCount = group.memberCount;
+        await members[0].update({ 'auth.timestamps.created': new Date('2022-01-01') });
       });
 
       it('prevents non members from leaving', async () => {
@@ -152,6 +153,10 @@ describe('POST /groups/:groupId/leave', () => {
             type: 'guild',
           },
           invites: 1,
+          leaderDetails: {
+            'auth.timestamps.created': new Date('2022-01-01'),
+            balance: 10,
+          },
         });
 
         privateGuild = group;

test/api/v3/integration/groups/POST-groups_id_removeMember.test.js

@@ -32,7 +32,7 @@ describe('POST /groups/:groupId/removeMember/:memberId', () => {
     invitedUser = invitees[0]; // eslint-disable-line prefer-destructuring
     member = members[0]; // eslint-disable-line prefer-destructuring
     member2 = members[1]; // eslint-disable-line prefer-destructuring
-    adminUser = await generateUser({ 'contributor.admin': true });
+    adminUser = await generateUser({ 'permissions.moderator': true });
   });
 
   context('All Groups', () => {
@@ -153,6 +153,7 @@ describe('POST /groups/:groupId/removeMember/:memberId', () => {
         },
         invites: 1,
         members: 2,
+        leaderDetails: { 'auth.timestamps.created': new Date('2022-01-01') },
       });
 
       party = group;

test/api/v3/integration/groups/PUT-groups.test.js

@@ -20,7 +20,7 @@ describe('PUT /group', () => {
       },
       members: 1,
     });
-    adminUser = await generateUser({ 'contributor.admin': true });
+    adminUser = await generateUser({ 'permissions.moderator': true });
     groupToUpdate = group;
     leader = groupLeader;
     nonLeader = members[0]; // eslint-disable-line prefer-destructuring
@@ -104,11 +104,11 @@ describe('PUT /group', () => {
     // Update the bannedWordsAllowed property for the group
     const response = await groupLeader.put(`/groups/${group._id}`, updateGroupDetails);
 
-    expect(groupLeader.contributor.admin).to.eql(true);
+    expect(groupLeader.permissions.fullAccess).to.eql(true);
     expect(response.bannedWordsAllowed).to.eql(true);
   });
 
-  it('does not allow for a non-admin to update the bannedWordsAllow property for an existing guild', async () => {
+  it('does not allow for a non-moderator to update the bannedWordsAllow property for an existing guild', async () => {
     const { group, groupLeader } = await createAndPopulateGroup({
       groupDetails: {
         name: 'public guild',
@@ -128,7 +128,6 @@ describe('PUT /group', () => {
     // Update the bannedWordsAllowed property for the group
     const response = await groupLeader.put(`/groups/${group._id}`, updateGroupDetails);
 
-    expect(groupLeader.contributor.admin).to.eql(undefined);
     expect(response.bannedWordsAllowed).to.eql(undefined);
   });
 });

test/api/v3/integration/hall/GET-hall_heroes_heroId.test.js

@@ -7,9 +7,14 @@ import {
 describe('GET /heroes/:heroId', () => {
   let user;
 
+  const heroFields = [
+    '_id', 'id', 'auth', 'balance', 'contributor', 'flags', 'items',
+    'lastCron', 'party', 'preferences', 'profile', 'purchased', 'secret',
+  ];
+
   before(async () => {
     user = await generateUser({
-      contributor: { admin: true },
+      permissions: { userSupport: true },
     });
   });
 
@@ -19,7 +24,7 @@ describe('GET /heroes/:heroId', () => {
     await expect(nonAdmin.get(`/hall/heroes/${user._id}`)).to.eventually.be.rejected.and.eql({
       code: 401,
       error: 'NotAuthorized',
-      message: t('noAdminAccess'),
+      message: t('noPrivAccess'),
     });
   });
 
@@ -49,10 +54,7 @@ describe('GET /heroes/:heroId', () => {
     });
     const heroRes = await user.get(`/hall/heroes/${hero._id}`);
 
-    expect(heroRes).to.have.all.keys([ // works as: object has all and only these keys
-      '_id', 'id', 'balance', 'profile', 'purchased',
-      'contributor', 'auth', 'items', 'secret',
-    ]);
+    expect(heroRes).to.have.all.keys(heroFields); // works as: object has all and only these keys
     expect(heroRes.auth.local).not.to.have.keys(['salt', 'hashed_password']);
     expect(heroRes.profile).to.have.all.keys(['name']);
     expect(heroRes.secret.text).to.be.eq('Super Hero');
@@ -64,10 +66,7 @@ describe('GET /heroes/:heroId', () => {
     });
     const heroRes = await user.get(`/hall/heroes/${hero.auth.local.username}`);
 
-    expect(heroRes).to.have.all.keys([ // works as: object has all and only these keys
-      '_id', 'id', 'balance', 'profile', 'purchased',
-      'contributor', 'auth', 'items', 'secret',
-    ]);
+    expect(heroRes).to.have.all.keys(heroFields);
     expect(heroRes.auth.local).not.to.have.keys(['salt', 'hashed_password']);
     expect(heroRes.profile).to.have.all.keys(['name']);
   });

test/api/v3/integration/hall/GET-hall_heroes_party_groupId.test.js

@@ -0,0 +1,61 @@
+import { v4 as generateUUID } from 'uuid';
+import {
+  generateUser,
+  generateGroup,
+  translate as t,
+} from '../../../../helpers/api-integration/v3';
+import apiError from '../../../../../website/server/libs/apiError';
+
+describe('GET /heroes/party/:groupId', () => {
+  let user; // admin user
+
+  before(async () => {
+    user = await generateUser({
+      'permissions.userSupport': true,
+    });
+  });
+
+  it('requires the caller to be an admin', async () => {
+    const nonAdmin = await generateUser();
+    const party = await generateGroup(nonAdmin, { type: 'party', privacy: 'private' });
+    await expect(nonAdmin.get(`/hall/heroes/party/${party._id}`)).to.eventually.be.rejected.and.eql({
+      code: 401,
+      error: 'NotAuthorized',
+      message: apiError('noPrivAccess'),
+    });
+  });
+
+  it('validates req.params.groupId', async () => {
+    await expect(user.get('/hall/heroes/party/invalidUUID')).to.eventually.be.rejected.and.eql({
+      code: 400,
+      error: 'BadRequest',
+      message: t('invalidReqParams'),
+    });
+  });
+
+  it('handles non-existing party', async () => {
+    const dummyId = generateUUID();
+    await expect(user.get(`/hall/heroes/party/${dummyId}`)).to.eventually.be.rejected.and.eql({
+      code: 404,
+      error: 'NotFound',
+      message: apiError('groupWithIDNotFound', { groupId: dummyId }),
+    });
+  });
+
+  it('returns only necessary party data given group id', async () => {
+    const nonAdmin = await generateUser();
+    const party = await generateGroup(nonAdmin, { type: 'party', privacy: 'private' });
+
+    const partyRes = await user.get(`/hall/heroes/party/${party._id}`);
+
+    expect(partyRes).to.have.all.keys([ // works as: object has all and only these keys
+      '_id', 'id', 'balance', 'challengeCount', 'leader', 'leaderOnly', 'memberCount',
+      'purchased', 'quest', 'summary',
+    ]);
+    expect(partyRes.summary).to.eq(' ');
+    // NB: 'summary' is NOT a field that the API route retrieves!
+    // It must not be retrieved for privacy reasons.
+    // However the group model automatically adds a summary for reasons given here:
+    // https://github.com/HabitRPG/habitica/blob/8da36bf27c62ba0397a6af260c20d35a17f3d911/website/server/models/group.js#L161-L170
+  });
+});

test/api/v3/integration/hall/PUT-hall_heores_heroId.test.js

@@ -1,4 +1,5 @@
 import { v4 as generateUUID } from 'uuid';
+import { model as User } from '../../../../../website/server/models/user';
 import {
   generateUser,
   translate as t,
@@ -8,15 +9,12 @@ describe('PUT /heroes/:heroId', () => {
   let user;
 
   const heroFields = [
-    '_id', 'balance', 'profile', 'purchased',
-    'contributor', 'auth', 'items', 'flags',
-    'secret',
+    '_id', 'auth', 'balance', 'contributor', 'flags', 'items', 'lastCron',
+    'party', 'preferences', 'profile', 'purchased', 'secret', 'permissions',
   ];
 
   before(async () => {
-    user = await generateUser({
-      contributor: { admin: true },
-    });
+    user = await generateUser({ 'permissions.userSupport': true });
   });
 
   it('requires the caller to be an admin', async () => {
@@ -25,7 +23,7 @@ describe('PUT /heroes/:heroId', () => {
     await expect(nonAdmin.put(`/hall/heroes/${user._id}`)).to.eventually.be.rejected.and.eql({
       code: 401,
       error: 'NotAuthorized',
-      message: t('noAdminAccess'),
+      message: t('noPrivAccess'),
     });
   });
 
@@ -57,8 +55,7 @@ describe('PUT /heroes/:heroId', () => {
     });
 
     // test response
-    // works as: object has all and only these keys
-    expect(heroRes).to.have.all.keys(heroFields);
+    expect(heroRes).to.have.all.keys(heroFields); // works as: object has all and only these keys
     expect(heroRes.auth.local).not.to.have.keys(['salt', 'hashed_password']);
     expect(heroRes.profile).to.have.all.keys(['name']);
 
@@ -134,7 +131,6 @@ describe('PUT /heroes/:heroId', () => {
     });
 
     // test response
-    // works as: object has all and only these keys
     expect(heroRes).to.have.all.keys(heroFields);
     expect(heroRes.auth.local).not.to.have.keys(['salt', 'hashed_password']);
     expect(heroRes.profile).to.have.all.keys(['name']);
@@ -159,7 +155,6 @@ describe('PUT /heroes/:heroId', () => {
     });
 
     // test response
-    // works as: object has all and only these keys
     expect(heroRes).to.have.all.keys(heroFields);
     expect(heroRes.auth.local).not.to.have.keys(['salt', 'hashed_password']);
     expect(heroRes.profile).to.have.all.keys(['name']);
@@ -215,7 +210,6 @@ describe('PUT /heroes/:heroId', () => {
     });
 
     // test response
-    // works as: object has all and only these keys
     expect(heroRes).to.have.all.keys(heroFields);
     expect(heroRes.auth.local).not.to.have.keys(['salt', 'hashed_password']);
     expect(heroRes.profile).to.have.all.keys(['name']);
@@ -226,4 +220,35 @@ describe('PUT /heroes/:heroId', () => {
     await hero.sync();
     expect(hero.items.special.snowball).to.equal(5);
   });
+
+  it('does not accidentally update API Token', async () => {
+    // This test has been included because hall.js will contain code to produce
+    // a truncated version of the API Token, and we want to be sure that
+    // the real Token is not modified by bugs in that code.
+    const hero = await generateUser();
+    const originalToken = hero.apiToken;
+
+    // make any change to the user except the Token
+    await user.put(`/hall/heroes/${hero._id}`, {
+      contributor: { text: 'Astronaut' },
+    });
+
+    const updatedHero = await User.findById(hero._id).exec();
+    expect(updatedHero.apiToken).to.equal(originalToken);
+    expect(updatedHero.apiTokenObscured).to.not.exist;
+  });
+
+  it('does update API Token when admin changes it', async () => {
+    const hero = await generateUser();
+    const originalToken = hero.apiToken;
+
+    // change the user's API Token
+    await user.put(`/hall/heroes/${hero._id}`, {
+      changeApiToken: true,
+    });
+
+    const updatedHero = await User.findById(hero._id).exec();
+    expect(updatedHero.apiToken).to.not.equal(originalToken);
+    expect(updatedHero.apiTokenObscured).to.not.exist;
+  });
 });

test/api/v3/integration/members/POST-send_private_message.test.js

@@ -176,7 +176,7 @@ describe('POST /members/send-private-message', () => {
 
   it('allows admin to send when sender has blocked the admin', async () => {
     userToSendMessage = await generateUser({
-      'contributor.admin': 1,
+      'permissions.moderator': true,
     });
     const receiver = await generateUser({ 'inbox.blocks': [userToSendMessage._id] });
 
@@ -204,7 +204,7 @@ describe('POST /members/send-private-message', () => {
 
   it('allows admin to send when to user has opted out of messaging', async () => {
     userToSendMessage = await generateUser({
-      'contributor.admin': 1,
+      'permissions.moderator': true,
     });
     const receiver = await generateUser({ 'inbox.optOut': true });
 

test/api/v3/integration/notifications/prevent-multiple-notification.js

@@ -25,6 +25,7 @@ describe('Prevent multiple notifications', () => {
 
     for (let i = 0; i < 4; i += 1) {
       for (let memberIndex = 0; memberIndex < partyMembers.length; memberIndex += 1) {
+        await partyMembers[memberIndex].update({ 'auth.timestamps.created': new Date('2022-01-01') }); // eslint-disable-line no-await-in-loop
         multipleChatMessages.push(
           partyMembers[memberIndex].post(`/groups/${party._id}/chat`, { message: `Message ${i}_${memberIndex}` }),
         );

test/api/v3/integration/qrcodes/GET-qrcodes_user.test.js

@@ -1,33 +0,0 @@
-import superagent from 'superagent';
-import nconf from 'nconf';
-import {
-  generateUser,
-  translate as t,
-} from '../../../../helpers/api-integration/v3';
-
-const API_TEST_SERVER_PORT = nconf.get('PORT');
-xdescribe('GET /qr-code/user/:memberId', () => {
-  let user;
-
-  before(async () => {
-    user = await generateUser();
-  });
-
-  it('validates req.params.memberId', async () => {
-    await expect(user.get('/qr-code/user/invalidUUID')).to.eventually.be.rejected.and.eql({
-      code: 400,
-      error: 'BadRequest',
-      message: t('invalidReqParams'),
-    });
-  });
-
-  it('redirects to profile page', async () => {
-    const url = `http://localhost:${API_TEST_SERVER_PORT}/qr-code/user/${user._id}`;
-    const response = await superagent.get(url).end((err, res) => {
-      expect(err).to.be(undefined);
-      return res;
-    });
-    expect(response.status).to.eql(200);
-    expect(response.request.url).to.eql(`http://localhost:${API_TEST_SERVER_PORT}/static/front/#?memberId=${user._id}`);
-  });
-});

test/api/v3/integration/shops/GET-shops_backgrounds.test.js

@@ -14,7 +14,7 @@ describe('GET /shops/backgrounds', () => {
     const shop = await user.get('/shops/backgrounds');
     expect(shop.identifier).to.equal('backgroundShop');
     expect(shop.text).to.eql(t('backgroundShop'));
-    expect(shop.notes).to.eql(t('backgroundShopText'));
+    expect(shop.notes).to.eql(t('backgroundShop'));
     expect(shop.imageName).to.equal('background_shop');
     expect(shop.sets).to.be.an('array');
 

test/api/v3/integration/tasks/DELETE-tasks_id.test.js

@@ -31,7 +31,7 @@ describe('DELETE /tasks/:id', () => {
       await expect(user.get(`/tasks/${task._id}`)).to.eventually.be.rejected.and.eql({
         code: 404,
         error: 'NotFound',
-        message: t('taskNotFound'),
+        message: t('messageTaskNotFound'),
       });
     });
 
@@ -41,7 +41,7 @@ describe('DELETE /tasks/:id', () => {
       await expect(user.get(`/tasks/${task._id}`)).to.eventually.be.rejected.and.eql({
         code: 404,
         error: 'NotFound',
-        message: t('taskNotFound'),
+        message: t('messageTaskNotFound'),
       });
     });
   });
@@ -123,7 +123,7 @@ describe('DELETE /tasks/:id', () => {
       await expect(user.del('/tasks/550e8400-e29b-41d4-a716-446655440000')).to.eventually.be.rejected.and.eql({
         code: 404,
         error: 'NotFound',
-        message: t('taskNotFound'),
+        message: t('messageTaskNotFound'),
       });
     });
 
@@ -137,7 +137,7 @@ describe('DELETE /tasks/:id', () => {
       await expect(user.del(`/tasks/${anotherUsersTask._id}`)).to.eventually.be.rejected.and.eql({
         code: 404,
         error: 'NotFound',
-        message: t('taskNotFound'),
+        message: t('messageTaskNotFound'),
       });
     });
 

test/api/v3/integration/tasks/GET-tasks_challenge_challengeId.test.js

@@ -47,7 +47,7 @@ describe('GET /tasks/:taskId', () => {
     await expect(user.get(`/tasks/${generateUUID()}`)).to.eventually.be.rejected.and.eql({
       code: 404,
       error: 'NotFound',
-      message: t('taskNotFound'),
+      message: t('messageTaskNotFound'),
     });
   });
 
@@ -68,7 +68,7 @@ describe('GET /tasks/:taskId', () => {
         await expect(anotherUser.get(`/tasks/${task._id}`)).to.eventually.be.rejected.and.eql({
           code: 404,
           error: 'NotFound',
-          message: t('taskNotFound'),
+          message: t('messageTaskNotFound'),
         });
       });
     });

test/api/v3/integration/tasks/GET-tasks_id.test.js

@@ -21,7 +21,7 @@ describe('GET /tasks/:id', () => {
         await expect(user.get(`/tasks/${dummyId}`)).to.eventually.be.rejected.and.eql({
           code: 404,
           error: 'NotFound',
-          message: t('taskNotFound'),
+          message: t('messageTaskNotFound'),
         });
       });
     });
@@ -63,7 +63,7 @@ describe('GET /tasks/:id', () => {
         await expect(anotherUser.get(`/tasks/${task._id}`)).to.eventually.be.rejected.and.eql({
           code: 404,
           error: 'NotFound',
-          message: t('taskNotFound'),
+          message: t('messageTaskNotFound'),
         });
       });
     });
@@ -105,7 +105,7 @@ describe('GET /tasks/:id', () => {
 
       it('can get challenge task if admin', async () => {
         const admin = await generateUser({
-          'contributor.admin': true,
+          'permissions.challengeAdmin': true,
         });
 
         const getTask = await admin.get(`/tasks/${task._id}`);
@@ -118,7 +118,7 @@ describe('GET /tasks/:id', () => {
         await expect(user.get(`/tasks/${task._id}`)).to.eventually.be.rejected.and.eql({
           code: 404,
           error: 'NotFound',
-          message: t('taskNotFound'),
+          message: t('messageTaskNotFound'),
         });
       });
     });
@@ -134,6 +134,7 @@ describe('GET /tasks/:id', () => {
           type: 'guild',
         },
         members: 1,
+        upgradeToGroupPlan: true,
       });
 
       group = groupData.group;
@@ -163,7 +164,7 @@ describe('GET /tasks/:id', () => {
         await expect(user.get(`/tasks/${task._id}`)).to.eventually.be.rejected.and.eql({
           code: 404,
           error: 'NotFound',
-          message: t('taskNotFound'),
+          message: t('messageTaskNotFound'),
         });
       });
     });

test/api/v3/integration/tasks/POST-tasks_clearCompletedTodos.test.js

@@ -7,7 +7,11 @@ import {
 describe('POST /tasks/clearCompletedTodos', () => {
   it('deletes all completed todos except the ones from a challenge and group', async () => {
     const user = await generateUser({ balance: 1 });
-    const guild = await generateGroup(user);
+    const guild = await generateGroup(
+      user,
+      {},
+      { 'purchased.plan.customerId': 'group-unlimited' },
+    );
     const challenge = await generateChallenge(user, guild);
     await user.post(`/challenges/${challenge._id}/join`);
 

test/api/v3/integration/tasks/POST-tasks_move_taskId_to_position.test.js

@@ -23,7 +23,7 @@ describe('POST /tasks/:taskId/move/to/:position', () => {
     await expect(user.post(`/tasks/${generateUUID()}/move/to/1`)).to.eventually.be.rejected.and.eql({
       code: 404,
       error: 'NotFound',
-      message: t('taskNotFound'),
+      message: t('messageTaskNotFound'),
     });
   });
 

test/api/v3/integration/tasks/POST-tasks_unlink-all_challengeId.test.js

@@ -80,7 +80,7 @@ describe('POST /tasks/unlink-all/:challengeId', () => {
     await expect(user.get(`/tasks/${daily._id}`)).to.eventually.be.rejected.and.eql({
       code: 404,
       error: 'NotFound',
-      message: t('taskNotFound'),
+      message: t('messageTaskNotFound'),
     });
   });
 

test/api/v3/integration/tasks/POST-tasks_unlink-one_taskId.test.js

@@ -65,7 +65,7 @@ describe('POST /tasks/unlink-one/:taskId', () => {
       .to.eventually.be.rejected.and.eql({
         code: 404,
         error: 'NotFound',
-        message: t('taskNotFound'),
+        message: t('messageTaskNotFound'),
       });
   });
 

test/api/v3/integration/tasks/challenges/DELETE-tasks_challenge_challengeId_checklist_itemId.test.js

@@ -22,7 +22,7 @@ describe('DELETE /tasks/:taskId/checklist/:itemId', () => {
     await expect(user.del(`/tasks/${generateUUID()}/checklist/${generateUUID()}`)).to.eventually.be.rejected.and.eql({
       code: 404,
       error: 'NotFound',
-      message: t('taskNotFound'),
+      message: t('messageTaskNotFound'),
     });
   });
 

test/api/v3/integration/tasks/challenges/DELETE-tasks_id_challenge_challengeId.test.js

@@ -31,7 +31,7 @@ describe('DELETE /tasks/:id', () => {
     await expect(user.del(`/tasks/${generateUUID()}`)).to.eventually.be.rejected.and.eql({
       code: 404,
       error: 'NotFound',
-      message: t('taskNotFound'),
+      message: t('messageTaskNotFound'),
     });
   });
 
@@ -51,7 +51,7 @@ describe('DELETE /tasks/:id', () => {
     await expect(user.get(`/tasks/${task._id}`)).to.eventually.be.rejected.and.eql({
       code: 404,
       error: 'NotFound',
-      message: t('taskNotFound'),
+      message: t('messageTaskNotFound'),
     });
   });
 
@@ -93,7 +93,7 @@ describe('DELETE /tasks/:id', () => {
       await expect(anotherUser.get(`/tasks/${task._id}`)).to.eventually.be.rejected.and.eql({
         code: 404,
         error: 'NotFound',
-        message: t('taskNotFound'),
+        message: t('messageTaskNotFound'),
       });
     });
 
@@ -111,7 +111,7 @@ describe('DELETE /tasks/:id', () => {
       await expect(anotherUser.get(`/tasks/${anotherUsersNewChallengeTaskID}`)).to.eventually.be.rejected.and.eql({
         code: 404,
         error: 'NotFound',
-        message: t('taskNotFound'),
+        message: t('messageTaskNotFound'),
       });
     });
   });

test/api/v3/integration/tasks/challenges/POST-tasks_challenge_challengeId_taskId_checklist.test.js

@@ -24,7 +24,7 @@ describe('POST /tasks/:taskId/checklist/', () => {
     })).to.eventually.be.rejected.and.eql({
       code: 404,
       error: 'NotFound',
-      message: t('taskNotFound'),
+      message: t('messageTaskNotFound'),
     });
   });
 

test/api/v3/integration/tasks/challenges/POST-tasks_challenge_id.test.js

@@ -60,7 +60,7 @@ describe('POST /tasks/challenge/:challengeId', () => {
   });
 
   it('allows non-leader admin to add tasks to a challenge when not a member', async () => {
-    const admin = await generateUser({ 'contributor.admin': true });
+    const admin = await generateUser({ 'permissions.challengeAdmin': true });
     const task = await admin.post(`/tasks/challenge/${challenge._id}`, {
       text: 'test habit from admin',
       type: 'habit',

test/api/v3/integration/tasks/challenges/PUT-tasks_challenge_challengeId.test.js

@@ -37,7 +37,7 @@ describe('PUT /tasks/:id', () => {
       })).to.eventually.be.rejected.and.eql({
         code: 404,
         error: 'NotFound',
-        message: t('taskNotFound'),
+        message: t('messageTaskNotFound'),
       });
     });
 

test/api/v3/integration/tasks/challenges/PUT-tasks_challenge_challengeId_tasksId_checklist_itemId.test.js

@@ -137,7 +137,7 @@ describe('PUT /tasks/:taskId/checklist/:itemId', () => {
     await expect(user.put(`/tasks/${generateUUID()}/checklist/${generateUUID()}`)).to.eventually.be.rejected.and.eql({
       code: 404,
       error: 'NotFound',
-      message: t('taskNotFound'),
+      message: t('messageTaskNotFound'),
     });
   });
 

test/api/v3/integration/tasks/checklists/DELETE-tasks_taskId_checklist_itemId.test.js

@@ -70,7 +70,7 @@ describe('DELETE /tasks/:taskId/checklist/:itemId', () => {
     await expect(user.del(`/tasks/${generateUUID()}/checklist/${generateUUID()}`)).to.eventually.be.rejected.and.eql({
       code: 404,
       error: 'NotFound',
-      message: t('taskNotFound'),
+      message: t('messageTaskNotFound'),
     });
   });
 

test/api/v3/integration/tasks/checklists/POST-tasks_taskId_checklist.test.js

@@ -88,7 +88,7 @@ describe('POST /tasks/:taskId/checklist/', () => {
     })).to.eventually.be.rejected.and.eql({
       code: 404,
       error: 'NotFound',
-      message: t('taskNotFound'),
+      message: t('messageTaskNotFound'),
     });
   });
 });

test/api/v3/integration/tasks/checklists/POST-tasks_taskId_checklist_itemId_score.test.js

@@ -80,7 +80,7 @@ describe('POST /tasks/:taskId/checklist/:itemId/score', () => {
     await expect(user.post(`/tasks/${generateUUID()}/checklist/${generateUUID()}/score`)).to.eventually.be.rejected.and.eql({
       code: 404,
       error: 'NotFound',
-      message: t('taskNotFound'),
+      message: t('messageTaskNotFound'),
     });
   });
 

test/api/v3/integration/tasks/checklists/PUT-tasks_taskId_checklist_itemId.test.js

@@ -88,7 +88,7 @@ describe('PUT /tasks/:taskId/checklist/:itemId', () => {
     await expect(user.put(`/tasks/${generateUUID()}/checklist/${generateUUID()}`)).to.eventually.be.rejected.and.eql({
       code: 404,
       error: 'NotFound',
-      message: t('taskNotFound'),
+      message: t('messageTaskNotFound'),
     });
   });
 

test/api/v3/integration/tasks/groups/DELETE-group_tasks_id.test.js

@@ -19,6 +19,7 @@ describe('Groups DELETE /tasks/:id', () => {
         type: 'guild',
       },
       members: 2,
+      upgradeToGroupPlan: true,
     });
 
     guild = group;
@@ -45,7 +46,7 @@ describe('Groups DELETE /tasks/:id', () => {
       .to.eventually.be.rejected.and.eql({
         code: 404,
         error: 'NotFound',
-        message: t('taskNotFound'),
+        message: t('messageTaskNotFound'),
       });
   });
 
@@ -60,7 +61,7 @@ describe('Groups DELETE /tasks/:id', () => {
       .to.eventually.be.rejected.and.eql({
         code: 404,
         error: 'NotFound',
-        message: t('taskNotFound'),
+        message: t('messageTaskNotFound'),
       });
   });
 
@@ -77,18 +78,18 @@ describe('Groups DELETE /tasks/:id', () => {
 
     await user.sync();
     await member2.sync();
-    expect(user.notifications.length).to.equal(2);
-    expect(user.notifications[1].type).to.equal('GROUP_TASK_APPROVAL');
-    expect(member2.notifications.length).to.equal(2);
-    expect(member2.notifications[1].type).to.equal('GROUP_TASK_APPROVAL');
+    expect(user.notifications.length).to.equal(3); // mystery items
+    expect(user.notifications[2].type).to.equal('GROUP_TASK_APPROVAL');
+    expect(member2.notifications.length).to.equal(3);
+    expect(member2.notifications[2].type).to.equal('GROUP_TASK_APPROVAL');
 
     await member2.del(`/tasks/${task._id}`);
 
     await user.sync();
     await member2.sync();
 
-    expect(user.notifications.length).to.equal(1);
-    expect(member2.notifications.length).to.equal(1);
+    expect(user.notifications.length).to.equal(2);
+    expect(member2.notifications.length).to.equal(2);
   });
 
   it('deletes task from assigned user', async () => {

test/api/v3/integration/tasks/groups/GET-approvals_group_id.test.js

@@ -18,6 +18,7 @@ describe('GET /approvals/group/:groupId', () => {
         type: 'guild',
       },
       members: 2,
+      upgradeToGroupPlan: true,
     });
 
     guild = group;

test/api/v3/integration/tasks/groups/GET-tasks_group_id.test.js

@@ -36,7 +36,7 @@ describe('GET /tasks/group/:groupId', () => {
 
   before(async () => {
     user = await generateUser();
-    group = await generateGroup(user);
+    group = await generateGroup(user, {}, { 'purchased.plan.customerId': 'group-unlimited' });
   });
 
   it('returns error when group is not found', async () => {

test/api/v3/integration/tasks/groups/POST-group_tasks_id_approve_userId.test.js

@@ -19,6 +19,7 @@ describe('POST /tasks/:id/approve/:userId', () => {
         type: 'guild',
       },
       members: 2,
+      upgradeToGroupPlan: true,
     });
 
     guild = group;
@@ -38,7 +39,7 @@ describe('POST /tasks/:id/approve/:userId', () => {
       .to.eventually.be.rejected.and.to.eql({
         code: 404,
         error: 'NotFound',
-        message: t('taskNotFound'),
+        message: t('messageTaskNotFound'),
       });
   });
 
@@ -63,9 +64,9 @@ describe('POST /tasks/:id/approve/:userId', () => {
 
     await member.sync();
 
-    expect(member.notifications.length).to.equal(2);
-    expect(member.notifications[1].type).to.equal('GROUP_TASK_APPROVED');
-    expect(member.notifications[1].data.message).to.equal(t('yourTaskHasBeenApproved', { taskText: task.text }));
+    expect(member.notifications.length).to.equal(3);
+    expect(member.notifications[2].type).to.equal('GROUP_TASK_APPROVED');
+    expect(member.notifications[2].data.message).to.equal(t('yourTaskHasBeenApproved', { taskText: task.text }));
 
     memberTasks = await member.get('/tasks/user');
     syncedTask = find(memberTasks, findAssignedTask);
@@ -89,9 +90,9 @@ describe('POST /tasks/:id/approve/:userId', () => {
     await member2.post(`/tasks/${task._id}/approve/${member._id}`);
     await member.sync();
 
-    expect(member.notifications.length).to.equal(2);
-    expect(member.notifications[1].type).to.equal('GROUP_TASK_APPROVED');
-    expect(member.notifications[1].data.message).to.equal(t('yourTaskHasBeenApproved', { taskText: task.text }));
+    expect(member.notifications.length).to.equal(3);
+    expect(member.notifications[2].type).to.equal('GROUP_TASK_APPROVED');
+    expect(member.notifications[2].data.message).to.equal(t('yourTaskHasBeenApproved', { taskText: task.text }));
 
     memberTasks = await member.get('/tasks/user');
     syncedTask = find(memberTasks, findAssignedTask);
@@ -113,18 +114,18 @@ describe('POST /tasks/:id/approve/:userId', () => {
 
     await user.sync();
     await member2.sync();
-    expect(user.notifications.length).to.equal(2);
-    expect(user.notifications[1].type).to.equal('GROUP_TASK_APPROVAL');
-    expect(member2.notifications.length).to.equal(1);
-    expect(member2.notifications[0].type).to.equal('GROUP_TASK_APPROVAL');
+    expect(user.notifications.length).to.equal(3);
+    expect(user.notifications[2].type).to.equal('GROUP_TASK_APPROVAL');
+    expect(member2.notifications.length).to.equal(2);
+    expect(member2.notifications[1].type).to.equal('GROUP_TASK_APPROVAL');
 
     await member2.post(`/tasks/${task._id}/approve/${member._id}`);
 
     await user.sync();
     await member2.sync();
 
-    expect(user.notifications.length).to.equal(1);
-    expect(member2.notifications.length).to.equal(0);
+    expect(user.notifications.length).to.equal(2);
+    expect(member2.notifications.length).to.equal(1);
   });
 
   it('prevents double approval on a task', async () => {

test/api/v3/integration/tasks/groups/POST-group_tasks_id_needs-work_userId.test.js

@@ -19,6 +19,7 @@ describe('POST /tasks/:id/needs-work/:userId', () => {
         type: 'guild',
       },
       members: 2,
+      upgradeToGroupPlan: true,
     });
 
     guild = group;
@@ -38,7 +39,7 @@ describe('POST /tasks/:id/needs-work/:userId', () => {
       .to.eventually.be.rejected.and.to.eql({
         code: 404,
         error: 'NotFound',
-        message: t('taskNotFound'),
+        message: t('messageTaskNotFound'),
       });
   });
 
@@ -72,7 +73,7 @@ describe('POST /tasks/:id/needs-work/:userId', () => {
     expect(syncedTask.group.approval.requestedDate).to.equal(undefined);
 
     // Check that the notification is correct
-    expect(member.notifications.length).to.equal(initialNotifications + 2);
+    expect(member.notifications.length).to.equal(initialNotifications + 3);
     const notification = member.notifications[member.notifications.length - 1];
     expect(notification.type).to.equal('GROUP_TASK_NEEDS_WORK');
 
@@ -121,7 +122,7 @@ describe('POST /tasks/:id/needs-work/:userId', () => {
     expect(syncedTask.group.approval.requested).to.equal(false);
     expect(syncedTask.group.approval.requestedDate).to.equal(undefined);
 
-    expect(member.notifications.length).to.equal(initialNotifications + 2);
+    expect(member.notifications.length).to.equal(initialNotifications + 3);
     const notification = member.notifications[member.notifications.length - 1];
     expect(notification.type).to.equal('GROUP_TASK_NEEDS_WORK');
 

test/api/v3/integration/tasks/groups/POST-group_tasks_id_score_direction.test.js

@@ -19,6 +19,7 @@ describe('POST /tasks/:id/score/:direction', () => {
         type: 'guild',
       },
       members: 2,
+      upgradeToGroupPlan: true,
     });
 
     guild = group;
@@ -53,15 +54,15 @@ describe('POST /tasks/:id/score/:direction', () => {
 
     await user.sync();
 
-    expect(user.notifications.length).to.equal(2);
-    expect(user.notifications[1].type).to.equal('GROUP_TASK_APPROVAL');
-    expect(user.notifications[1].data.message).to.equal(t('userHasRequestedTaskApproval', {
+    expect(user.notifications.length).to.equal(3);
+    expect(user.notifications[2].type).to.equal('GROUP_TASK_APPROVAL');
+    expect(user.notifications[2].data.message).to.equal(t('userHasRequestedTaskApproval', {
       user: member.auth.local.username,
       taskName: updatedTask.text,
       taskId: updatedTask._id,
       direction,
     }, 'cs')); // This test only works if we have the notification translated
-    expect(user.notifications[1].data.groupId).to.equal(guild._id);
+    expect(user.notifications[2].data.groupId).to.equal(guild._id);
 
     expect(updatedTask.group.approval.requested).to.equal(true);
     expect(updatedTask.group.approval.requestedDate).to.be.a('string'); // date gets converted to a string as json doesn't have a Date type
@@ -80,25 +81,25 @@ describe('POST /tasks/:id/score/:direction', () => {
     await user.sync();
     await member2.sync();
 
-    expect(user.notifications.length).to.equal(2);
-    expect(user.notifications[1].type).to.equal('GROUP_TASK_APPROVAL');
-    expect(user.notifications[1].data.message).to.equal(t('userHasRequestedTaskApproval', {
+    expect(user.notifications.length).to.equal(3);
+    expect(user.notifications[2].type).to.equal('GROUP_TASK_APPROVAL');
+    expect(user.notifications[2].data.message).to.equal(t('userHasRequestedTaskApproval', {
       user: member.auth.local.username,
       taskName: updatedTask.text,
       taskId: updatedTask._id,
       direction,
     }));
-    expect(user.notifications[1].data.groupId).to.equal(guild._id);
+    expect(user.notifications[2].data.groupId).to.equal(guild._id);
 
-    expect(member2.notifications.length).to.equal(1);
-    expect(member2.notifications[0].type).to.equal('GROUP_TASK_APPROVAL');
-    expect(member2.notifications[0].data.message).to.equal(t('userHasRequestedTaskApproval', {
+    expect(member2.notifications.length).to.equal(2);
+    expect(member2.notifications[1].type).to.equal('GROUP_TASK_APPROVAL');
+    expect(member2.notifications[1].data.message).to.equal(t('userHasRequestedTaskApproval', {
       user: member.auth.local.username,
       taskName: updatedTask.text,
       taskId: updatedTask._id,
       direction,
     }));
-    expect(member2.notifications[0].data.groupId).to.equal(guild._id);
+    expect(member2.notifications[1].data.groupId).to.equal(guild._id);
   });
 
   it('errors when approval has already been requested', async () => {

test/api/v3/integration/tasks/groups/POST-tasks_group_id.test.js

@@ -26,6 +26,7 @@ describe('POST /tasks/group/:groupid', () => {
         privacy: 'private',
       },
       members: 1,
+      upgradeToGroupPlan: true,
     });
 
     guild = group;

test/api/v3/integration/tasks/groups/POST-tasks_group_id_assign_user_id.test.js

@@ -21,6 +21,7 @@ describe('POST /tasks/:taskId/assign/:memberId', () => {
         type: 'guild',
       },
       members: 2,
+      upgradeToGroupPlan: true,
     });
 
     guild = group;
@@ -42,7 +43,7 @@ describe('POST /tasks/:taskId/assign/:memberId', () => {
       .to.eventually.be.rejected.and.eql({
         code: 404,
         error: 'NotFound',
-        message: t('taskNotFound'),
+        message: t('messageTaskNotFound'),
       });
   });
 
@@ -103,14 +104,14 @@ describe('POST /tasks/:taskId/assign/:memberId', () => {
     await member2.sync();
     const groupTask = await user.get(`/tasks/group/${guild._id}`);
 
-    expect(user.notifications.length).to.equal(2); // includes Guild Joined achievement
-    expect(user.notifications[1].type).to.equal('GROUP_TASK_CLAIMED');
-    expect(user.notifications[1].data.taskId).to.equal(groupTask[0]._id);
-    expect(user.notifications[1].data.groupId).to.equal(guild._id);
-    expect(member2.notifications.length).to.equal(1);
-    expect(member2.notifications[0].type).to.equal('GROUP_TASK_CLAIMED');
-    expect(member2.notifications[0].data.taskId).to.equal(groupTask[0]._id);
-    expect(member2.notifications[0].data.groupId).to.equal(guild._id);
+    expect(user.notifications.length).to.equal(3); // includes Guild Joined achievement
+    expect(user.notifications[2].type).to.equal('GROUP_TASK_CLAIMED');
+    expect(user.notifications[2].data.taskId).to.equal(groupTask[0]._id);
+    expect(user.notifications[2].data.groupId).to.equal(guild._id);
+    expect(member2.notifications.length).to.equal(2);
+    expect(member2.notifications[1].type).to.equal('GROUP_TASK_CLAIMED');
+    expect(member2.notifications[1].data.taskId).to.equal(groupTask[0]._id);
+    expect(member2.notifications[1].data.groupId).to.equal(guild._id);
   });
 
   it('assigns a task to a user', async () => {
@@ -130,9 +131,9 @@ describe('POST /tasks/:taskId/assign/:memberId', () => {
 
     const groupTask = await user.get(`/tasks/group/${guild._id}`);
 
-    expect(member.notifications.length).to.equal(1);
-    expect(member.notifications[0].type).to.equal('GROUP_TASK_ASSIGNED');
-    expect(member.notifications[0].taskId).to.equal(groupTask._id);
+    expect(member.notifications.length).to.equal(2);
+    expect(member.notifications[1].type).to.equal('GROUP_TASK_ASSIGNED');
+    expect(member.notifications[1].taskId).to.equal(groupTask._id);
   });
 
   it('assigns a task to multiple users', async () => {

test/api/v3/integration/tasks/groups/POST-tasks_move_taskId_to_position.test.js

@@ -9,7 +9,7 @@ describe('POST group-tasks/:taskId/move/to/:position', () => {
 
   beforeEach(async () => {
     user = await generateUser({ balance: 1 });
-    guild = await generateGroup(user, { type: 'guild' });
+    guild = await generateGroup(user, { type: 'guild' }, { 'purchased.plan.customerId': 'group-unlimited' });
   });
 
   it('can move task to new position', async () => {

test/api/v3/integration/tasks/groups/POST-tasks_task_id_unassign.test.js

@@ -21,6 +21,7 @@ describe('POST /tasks/:taskId/unassign/:memberId', () => {
         type: 'guild',
       },
       members: 2,
+      upgradeToGroupPlan: true,
     });
 
     guild = group;
@@ -44,7 +45,7 @@ describe('POST /tasks/:taskId/unassign/:memberId', () => {
       .to.eventually.be.rejected.and.eql({
         code: 404,
         error: 'NotFound',
-        message: t('taskNotFound'),
+        message: t('messageTaskNotFound'),
       });
   });
 
@@ -91,7 +92,7 @@ describe('POST /tasks/:taskId/unassign/:memberId', () => {
     await user.post(`/tasks/${task._id}/unassign/${member._id}`);
 
     await member.sync();
-    expect(member.notifications.length).to.equal(0);
+    expect(member.notifications.length).to.equal(1); // mystery items
   });
 
   it('unassigns a user and only that user from a task', async () => {

test/api/v3/integration/tasks/groups/PUT-group_task_id.test.js

@@ -22,6 +22,7 @@ describe('PUT /tasks/:id', () => {
         type: 'guild',
       },
       members: 2,
+      upgradeToGroupPlan: true,
     });
 
     guild = group;

test/api/v3/integration/tasks/groups/checklists/DELETE-group_tasks_taskId_checklist_item.test.js

@@ -15,6 +15,7 @@ describe('DELETE group /tasks/:taskId/checklist/:itemId', () => {
         type: 'guild',
       },
       members: 2,
+      upgradeToGroupPlan: true,
     });
 
     guild = group;
@@ -65,7 +66,7 @@ describe('DELETE group /tasks/:taskId/checklist/:itemId', () => {
     await expect(user.del(`/tasks/${generateUUID()}/checklist/${generateUUID()}`)).to.eventually.be.rejected.and.eql({
       code: 404,
       error: 'NotFound',
-      message: t('taskNotFound'),
+      message: t('messageTaskNotFound'),
     });
   });
 

test/api/v3/integration/tasks/groups/checklists/POST-group_tasks_taskId_checklist.test.js

@@ -15,6 +15,7 @@ describe('POST group /tasks/:taskId/checklist/', () => {
         type: 'guild',
       },
       members: 2,
+      upgradeToGroupPlan: true,
     });
 
     guild = group;
@@ -80,7 +81,7 @@ describe('POST group /tasks/:taskId/checklist/', () => {
     })).to.eventually.be.rejected.and.eql({
       code: 404,
       error: 'NotFound',
-      message: t('taskNotFound'),
+      message: t('messageTaskNotFound'),
     });
   });
 });

test/api/v3/integration/tasks/groups/checklists/PUT-group_tasks_taskId_checklist_itemId.test.js

@@ -15,6 +15,7 @@ describe('PUT group /tasks/:taskId/checklist/:itemId', () => {
         type: 'guild',
       },
       members: 2,
+      upgradeToGroupPlan: true,
     });
 
     guild = group;
@@ -74,7 +75,7 @@ describe('PUT group /tasks/:taskId/checklist/:itemId', () => {
     await expect(user.put(`/tasks/${generateUUID()}/checklist/${generateUUID()}`)).to.eventually.be.rejected.and.eql({
       code: 404,
       error: 'NotFound',
-      message: t('taskNotFound'),
+      message: t('messageTaskNotFound'),
     });
   });
 

test/api/v3/integration/user/POST-user_class_cast_spellId.test.js

@@ -116,7 +116,7 @@ describe('POST /user/class/cast/:spellId', () => {
       .to.eventually.be.rejected.and.eql({
         code: 404,
         error: 'NotFound',
-        message: t('taskNotFound'),
+        message: t('messageTaskNotFound'),
       });
   });
 
@@ -139,7 +139,7 @@ describe('POST /user/class/cast/:spellId', () => {
   });
 
   it('returns an error if a group task was targeted', async () => {
-    const { group, groupLeader } = await createAndPopulateGroup();
+    const { group, groupLeader } = await createAndPopulateGroup({ upgradeToGroupPlan: true });
 
     const groupTask = await groupLeader.post(`/tasks/group/${group._id}`, {
       text: 'todo group',
@@ -266,7 +266,7 @@ describe('POST /user/class/cast/:spellId', () => {
   });
 
   it('searing brightness does not affect challenge or group tasks', async () => {
-    const guild = await generateGroup(user);
+    const guild = await generateGroup(user, {}, { 'purchased.plan.customerId': 'group-unlimited' });
     const challenge = await generateChallenge(user, guild);
     await user.post(`/challenges/${challenge._id}/join`);
     await user.post(`/tasks/challenge/${challenge._id}`, {

test/api/v3/integration/user/POST-user_reset.test.js

@@ -27,7 +27,7 @@ describe('POST /user/reset', () => {
     await expect(user.get(`/tasks/${task._id}`)).to.eventually.be.rejected.and.eql({
       code: 404,
       error: 'NotFound',
-      message: t('taskNotFound'),
+      message: t('messageTaskNotFound'),
     });
 
     expect(user.tasksOrder.habits).to.be.empty;
@@ -45,7 +45,7 @@ describe('POST /user/reset', () => {
     await expect(user.get(`/tasks/${task._id}`)).to.eventually.be.rejected.and.eql({
       code: 404,
       error: 'NotFound',
-      message: t('taskNotFound'),
+      message: t('messageTaskNotFound'),
     });
 
     expect(user.tasksOrder.dailys).to.be.empty;
@@ -63,7 +63,7 @@ describe('POST /user/reset', () => {
     await expect(user.get(`/tasks/${task._id}`)).to.eventually.be.rejected.and.eql({
       code: 404,
       error: 'NotFound',
-      message: t('taskNotFound'),
+      message: t('messageTaskNotFound'),
     });
 
     expect(user.tasksOrder.todos).to.be.empty;
@@ -81,14 +81,14 @@ describe('POST /user/reset', () => {
     await expect(user.get(`/tasks/${task._id}`)).to.eventually.be.rejected.and.eql({
       code: 404,
       error: 'NotFound',
-      message: t('taskNotFound'),
+      message: t('messageTaskNotFound'),
     });
 
     expect(user.tasksOrder.rewards).to.be.empty;
   });
 
   it('does not delete challenge or group tasks', async () => {
-    const guild = await generateGroup(user);
+    const guild = await generateGroup(user, {}, { 'purchased.plan.customerId': 'group-unlimited' });
     const challenge = await generateChallenge(user, guild);
     await user.post(`/challenges/${challenge._id}/join`);
     await user.post(`/tasks/challenge/${challenge._id}`, {
@@ -120,7 +120,7 @@ describe('POST /user/reset', () => {
 
   it('does not delete secret', async () => {
     const admin = await generateUser({
-      contributor: { admin: true },
+      permissions: { userSupport: true },
     });
 
     const hero = await generateUser({

test/api/v3/integration/user/PUT-user.test.js

@@ -135,6 +135,7 @@ describe('PUT /user', () => {
       'gem balance': { balance: 100 },
       auth: { 'auth.blocked': true, 'auth.timestamps.created': new Date() },
       contributor: { 'contributor.level': 9, 'contributor.admin': true, 'contributor.text': 'some text' },
+      permissions: { 'permissions.fullAccess': true, 'permissions.news': true, 'permissions.moderator': 'some text' },
       backer: { 'backer.tier': 10, 'backer.npc': 'Bilbo' },
       subscriptions: { 'purchased.plan.extraMonths': 500, 'purchased.plan.consecutive.trinkets': 1000 },
       'customization gem purchases': { 'purchased.background.tavern': true, 'purchased.skin.bear': true },

test/api/v3/integration/user/auth/GET-user_auth_apple.test.js

@@ -1,3 +1,4 @@
+import { v4 as generateUUID } from 'uuid';
 import {
   generateUser,
   requester,
@@ -9,15 +10,18 @@ describe('GET /user/auth/apple', () => {
   let api;
   let user;
   const appleEndpoint = '/user/auth/apple';
-
-  before(async () => {
-    const expectedResult = { id: 'appleId', name: 'an apple user' };
-    sandbox.stub(appleAuth, 'appleProfile').returns(Promise.resolve(expectedResult));
-  });
+  let randomAppleId = '123456';
 
   beforeEach(async () => {
     api = requester();
     user = await generateUser();
+    randomAppleId = generateUUID();
+    const expectedResult = { id: randomAppleId, name: 'an apple user' };
+    sandbox.stub(appleAuth, 'appleProfile').returns(Promise.resolve(expectedResult));
+  });
+
+  afterEach(async () => {
+    appleAuth.appleProfile.restore();
   });
 
   it('registers a new user', async () => {
@@ -26,7 +30,7 @@ describe('GET /user/auth/apple', () => {
     expect(response.apiToken).to.exist;
     expect(response.id).to.exist;
     expect(response.newUser).to.be.true;
-    await expect(getProperty('users', response.id, 'auth.apple.id')).to.eventually.equal('appleId');
+    await expect(getProperty('users', response.id, 'auth.apple.id')).to.eventually.equal(randomAppleId);
     await expect(getProperty('users', response.id, 'profile.name')).to.eventually.equal('an apple user');
   });
 

test/api/v3/integration/user/auth/POST-user_auth_social.test.js

@@ -1,4 +1,5 @@
 import passport from 'passport';
+import { v4 as generateUUID } from 'uuid';
 import {
   generateUser,
   requester,
@@ -10,14 +11,15 @@ describe('POST /user/auth/social', () => {
   let api;
   let user;
   const endpoint = '/user/auth/social';
-  const randomAccessToken = '123456';
-  const facebookId = 'facebookId';
-  const googleId = 'googleId';
+  let randomAccessToken = '123456';
+  let randomFacebookId = 'facebookId';
+  let randomGoogleId = 'googleId';
   let network = 'NoNetwork';
 
   beforeEach(async () => {
     api = requester();
     user = await generateUser();
+    randomAccessToken = generateUUID();
   });
 
   it('fails if network is not supported', async () => {
@@ -32,12 +34,23 @@ describe('POST /user/auth/social', () => {
   });
 
   describe('facebook', () => {
-    before(async () => {
-      const expectedResult = { id: facebookId, displayName: 'a facebook user' };
+    beforeEach(async () => {
+      randomFacebookId = generateUUID();
+      const expectedResult = {
+        id: randomFacebookId,
+        displayName: 'a facebook user',
+        emails: [
+          { value: `${user.auth.local.username}+facebook@example.com` },
+        ],
+      };
       sandbox.stub(passport._strategies.facebook, 'userProfile').yields(null, expectedResult);
       network = 'facebook';
     });
 
+    afterEach(async () => {
+      passport._strategies.facebook.userProfile.restore();
+    });
+
     it('registers a new user', async () => {
       const response = await api.post(endpoint, {
         authResponse: { access_token: randomAccessToken }, // eslint-disable-line camelcase
@@ -51,7 +64,8 @@ describe('POST /user/auth/social', () => {
 
       await expect(getProperty('users', response.id, 'profile.name')).to.eventually.equal('a facebook user');
       await expect(getProperty('users', response.id, 'auth.local.lowerCaseUsername')).to.exist;
-      await expect(getProperty('users', response.id, 'auth.facebook.id')).to.eventually.equal(facebookId);
+      await expect(getProperty('users', response.id, 'auth.local.email')).to.eventually.equal(`${user.auth.local.username}+facebook@example.com`);
+      await expect(getProperty('users', response.id, 'auth.facebook.id')).to.eventually.equal(randomFacebookId);
     });
 
     it('logs an existing user in', async () => {
@@ -68,6 +82,57 @@ describe('POST /user/auth/social', () => {
       expect(response.apiToken).to.eql(registerResponse.apiToken);
       expect(response.id).to.eql(registerResponse.id);
       expect(response.newUser).to.be.false;
+      expect(registerResponse.newUser).to.be.true;
+    });
+
+    it('logs an existing user in if they have local auth with matching email', async () => {
+      passport._strategies.facebook.userProfile.restore();
+      const expectedResult = {
+        id: randomFacebookId,
+        displayName: 'a facebook user',
+        emails: [
+          { value: user.auth.local.email },
+        ],
+      };
+      sandbox.stub(passport._strategies.facebook, 'userProfile').yields(null, expectedResult);
+
+      const response = await api.post(endpoint, {
+        authResponse: { access_token: randomAccessToken }, // eslint-disable-line camelcase
+        network,
+      });
+
+      expect(response.apiToken).to.eql(user.apiToken);
+      expect(response.id).to.eql(user._id);
+      expect(response.newUser).to.be.false;
+    });
+
+    it('logs an existing user into their social account if they have local auth with matching email', async () => {
+      const registerResponse = await api.post(endpoint, {
+        authResponse: { access_token: randomAccessToken }, // eslint-disable-line camelcase
+        network,
+      });
+      expect(registerResponse.newUser).to.be.true;
+      // This is important for existing accounts before the new social handling
+      passport._strategies.facebook.userProfile.restore();
+      const expectedResult = {
+        id: randomFacebookId,
+        displayName: 'a facebook user',
+        emails: [
+          { value: user.auth.local.email },
+        ],
+      };
+      sandbox.stub(passport._strategies.facebook, 'userProfile').yields(null, expectedResult);
+
+      const response = await api.post(endpoint, {
+        authResponse: { access_token: randomAccessToken }, // eslint-disable-line camelcase
+        network,
+      });
+
+      expect(response.apiToken).to.eql(registerResponse.apiToken);
+      expect(response.id).to.eql(registerResponse.id);
+      expect(response.apiToken).not.to.eql(user.apiToken);
+      expect(response.id).not.to.eql(user._id);
+      expect(response.newUser).to.be.false;
     });
 
     it('add social auth to an existing user', async () => {
@@ -76,11 +141,28 @@ describe('POST /user/auth/social', () => {
         network,
       });
 
-      expect(response.apiToken).to.exist;
-      expect(response.id).to.exist;
+      expect(response.apiToken).to.eql(user.apiToken);
+      expect(response.id).to.eql(user._id);
       expect(response.newUser).to.be.false;
     });
 
+    it('does not log into other account if social auth already exists', async () => {
+      const registerResponse = await api.post(endpoint, {
+        authResponse: { access_token: randomAccessToken }, // eslint-disable-line camelcase
+        network,
+      });
+      expect(registerResponse.newUser).to.be.true;
+
+      await expect(user.post(endpoint, {
+        authResponse: { access_token: randomAccessToken }, // eslint-disable-line camelcase
+        network,
+      })).to.eventually.be.rejected.and.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('socialAlreadyExists'),
+      });
+    });
+
     xit('enrolls a new user in an A/B test', async () => {
       await api.post(endpoint, {
         authResponse: { access_token: randomAccessToken }, // eslint-disable-line camelcase
@@ -92,12 +174,23 @@ describe('POST /user/auth/social', () => {
   });
 
   describe('google', () => {
-    before(async () => {
-      const expectedResult = { id: googleId, displayName: 'a google user' };
+    beforeEach(async () => {
+      randomGoogleId = generateUUID();
+      const expectedResult = {
+        id: randomGoogleId,
+        displayName: 'a google user',
+        emails: [
+          { value: `${user.auth.local.username}+google@example.com` },
+        ],
+      };
       sandbox.stub(passport._strategies.google, 'userProfile').yields(null, expectedResult);
       network = 'google';
     });
 
+    afterEach(async () => {
+      passport._strategies.google.userProfile.restore();
+    });
+
     it('registers a new user', async () => {
       const response = await api.post(endpoint, {
         authResponse: { access_token: randomAccessToken }, // eslint-disable-line camelcase
@@ -107,7 +200,8 @@ describe('POST /user/auth/social', () => {
       expect(response.apiToken).to.exist;
       expect(response.id).to.exist;
       expect(response.newUser).to.be.true;
-      await expect(getProperty('users', response.id, 'auth.google.id')).to.eventually.equal(googleId);
+      await expect(getProperty('users', response.id, 'auth.google.id')).to.eventually.equal(randomGoogleId);
+      await expect(getProperty('users', response.id, 'auth.local.email')).to.eventually.equal(`${user.auth.local.username}+google@example.com`);
       await expect(getProperty('users', response.id, 'profile.name')).to.eventually.equal('a google user');
     });
 
@@ -125,6 +219,57 @@ describe('POST /user/auth/social', () => {
       expect(response.apiToken).to.eql(registerResponse.apiToken);
       expect(response.id).to.eql(registerResponse.id);
       expect(response.newUser).to.be.false;
+      expect(registerResponse.newUser).to.be.true;
+    });
+
+    it('logs an existing user in if they have local auth with matching email', async () => {
+      passport._strategies.google.userProfile.restore();
+      const expectedResult = {
+        id: randomGoogleId,
+        displayName: 'a google user',
+        emails: [
+          { value: user.auth.local.email },
+        ],
+      };
+      sandbox.stub(passport._strategies.google, 'userProfile').yields(null, expectedResult);
+
+      const response = await api.post(endpoint, {
+        authResponse: { access_token: randomAccessToken }, // eslint-disable-line camelcase
+        network,
+      });
+
+      expect(response.apiToken).to.eql(user.apiToken);
+      expect(response.id).to.eql(user._id);
+      expect(response.newUser).to.be.false;
+    });
+
+    it('logs an existing user into their social account if they have local auth with matching email', async () => {
+      const registerResponse = await api.post(endpoint, {
+        authResponse: { access_token: randomAccessToken }, // eslint-disable-line camelcase
+        network,
+      });
+      expect(registerResponse.newUser).to.be.true;
+      // This is important for existing accounts before the new social handling
+      passport._strategies.google.userProfile.restore();
+      const expectedResult = {
+        id: randomGoogleId,
+        displayName: 'a google user',
+        emails: [
+          { value: user.auth.local.email },
+        ],
+      };
+      sandbox.stub(passport._strategies.google, 'userProfile').yields(null, expectedResult);
+
+      const response = await api.post(endpoint, {
+        authResponse: { access_token: randomAccessToken }, // eslint-disable-line camelcase
+        network,
+      });
+
+      expect(response.apiToken).to.eql(registerResponse.apiToken);
+      expect(response.id).to.eql(registerResponse.id);
+      expect(response.apiToken).not.to.eql(user.apiToken);
+      expect(response.id).not.to.eql(user._id);
+      expect(response.newUser).to.be.false;
     });
 
     it('add social auth to an existing user', async () => {
@@ -133,11 +278,28 @@ describe('POST /user/auth/social', () => {
         network,
       });
 
-      expect(response.apiToken).to.exist;
-      expect(response.id).to.exist;
+      expect(response.apiToken).to.eql(user.apiToken);
+      expect(response.id).to.eql(user._id);
       expect(response.newUser).to.be.false;
     });
 
+    it('does not log into other account if social auth already exists', async () => {
+      const registerResponse = await api.post(endpoint, {
+        authResponse: { access_token: randomAccessToken }, // eslint-disable-line camelcase
+        network,
+      });
+      expect(registerResponse.newUser).to.be.true;
+
+      await expect(user.post(endpoint, {
+        authResponse: { access_token: randomAccessToken }, // eslint-disable-line camelcase
+        network,
+      })).to.eventually.be.rejected.and.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('socialAlreadyExists'),
+      });
+    });
+
     xit('enrolls a new user in an A/B test', async () => {
       await api.post(endpoint, {
         authResponse: { access_token: randomAccessToken }, // eslint-disable-line camelcase

test/api/v3/integration/user/buy/POST-user_buy_quest.test.js

@@ -39,25 +39,38 @@ describe('POST /user/buy-quest/:key', () => {
     }));
   });
 
-  it('returns an error if quest prerequisites are not met', async () => {
-    const key = 'dilatoryDistress2';
+  it('returns an error if not all quest prerequisites are met', async () => {
+    const prerequisites = ['dilatoryDistress1', 'dilatoryDistress2'];
+    const key = 'dilatoryDistress3';
+
+    const achievementName1 = `achievements.quests.${prerequisites[0]}`;
+
+    await user.update({
+      [achievementName1]: true,
+      'stats.gp': 9999,
+    });
 
     await expect(user.post(`/user/buy-quest/${key}`))
       .to.eventually.be.rejected.and.eql({
         code: 401,
         error: 'NotAuthorized',
-        message: t('mustComplete', { quest: 'dilatoryDistress1' }),
+        message: t('mustComplete', { quest: prerequisites[1] }),
       });
   });
 
   it('allows purchase of a quest if prerequisites are met', async () => {
-    const prerequisite = 'dilatoryDistress1';
-    const key = 'dilatoryDistress2';
+    const prerequisites = ['dilatoryDistress1', 'dilatoryDistress2'];
+    const key = 'dilatoryDistress3';
     const item = content.quests[key];
 
-    const achievementName = `achievements.quests.${prerequisite}`;
+    const achievementName1 = `achievements.quests.${prerequisites[0]}`;
+    const achievementName2 = `achievements.quests.${prerequisites[1]}`;
 
-    await user.update({ [achievementName]: true, 'stats.gp': 9999 });
+    await user.update({
+      [achievementName1]: true,
+      [achievementName2]: true,
+      'stats.gp': 9999,
+    });
     const res = await user.post(`/user/buy-quest/${key}`);
     await user.sync();
 

test/api/v4/POST-bug-report.test.js

@@ -0,0 +1,49 @@
+import {
+  generateUser,
+} from '../../helpers/api-integration/v4';
+
+describe('POST /bug-report', () => {
+  let user;
+
+  beforeEach(async () => {
+    user = await generateUser();
+  });
+
+  it('returns an error when message is not added', async () => {
+    await expect(user.post('/bug-report', {
+      message: '',
+    }))
+      .to.eventually.be.rejected.and.to.eql({
+        code: 400,
+        error: 'BadRequest',
+        // seems it is not possible to get the real error message
+        message: 'Invalid request parameters.',
+      });
+  });
+
+  it('returns an error when email is not added', async () => {
+    await expect(user.post('/bug-report', {
+      message: 'message',
+      email: '',
+    }))
+      .to.eventually.be.rejected.and.to.eql({
+        code: 400,
+        error: 'BadRequest',
+        // seems it is not possible to get the real error message
+        message: 'Invalid request parameters.',
+      });
+  });
+
+  it('returns an error when email is not valid', async () => {
+    await expect(user.post('/bug-report', {
+      message: 'message',
+      email: 'notamail',
+    }))
+      .to.eventually.be.rejected.and.to.eql({
+        code: 400,
+        error: 'BadRequest',
+        // seems it is not possible to get the real error message
+        message: 'Invalid request parameters.',
+      });
+  });
+});

test/api/v4/coupon/POST-coupons_enter_code.test.js

@@ -15,7 +15,7 @@ describe('POST /coupons/enter/:code', () => {
   beforeEach(async () => {
     user = await generateUser();
     sudoUser = await generateUser({
-      'contributor.sudo': true,
+      'permissions.coupons': true,
     });
   });