4.116.4

feat(push): add notification types for mobile push
Merge branch 'origin/develop' into Weblate.
2025-10-26 10:42:52 +01:00 · 2019-10-10 13:07:11 -05:00 · 2019-10-10 13:06:59 -05:00 · 2019-10-08 22:40:26 +02:00 · 2019-10-08 22:39:59 +02:00 · 2019-10-08 15:36:55 -05:00
3697 changed files with 379388 additions and 66306 deletions
--- a/.github/CONTRIBUTING.md
+++ b/.github/CONTRIBUTING.md
@@ -4,7 +4,7 @@

 # Pull Request

-[Please see these instructions for adding a pull request](http://habitica.wikia.com/wiki/Using_Your_Local_Install_to_Modify_Habitica%27s_Website_and_API)
+[Please see these instructions for adding a pull request](http://habitica.fandom.com/wiki/Using_Your_Local_Install_to_Modify_Habitica%27s_Website_and_API)

 # Requesting a feature

@@ -12,4 +12,9 @@ Habitica uses [Trello](https://trello.com/b/EpoYEYod/habitica) to track feature

 # Contributing Code

-See [Contributing to Habitica](http://habitica.wikia.com/wiki/Contributing_to_Habitica#Coders_.28Web_.26_Mobile.29)
+See [Contributing to Habitica](http://habitica.fandom.com/wiki/Contributing_to_Habitica#Coders_.28Web_.26_Mobile.29)
+
+## Issue Triage [![Open Source Helpers](https://www.codetriage.com/habitrpg/habitica/badges/users.svg)](https://www.codetriage.com/habitrpg/habitica)
+
+You can triage issues which may include reproducing bug reports or asking for vital information, such as version numbers or reproduction instructions. If you would like to start triaging issues, one easy way to get started is to [subscribe to habitrpg on CodeTriage](https://www.codetriage.com/habitrpg/habitica).
+
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -1,4 +1,4 @@
-[//]: # (Note: See http://habitica.wikia.com/wiki/Using_Your_Local_Install_to_Modify_Habitica%27s_Website_and_API for more info)
+[//]: # (Note: See http://habitica.fandom.com/wiki/Using_Your_Local_Install_to_Modify_Habitica%27s_Website_and_API for more info)

 [//]: # (Put Issue # here, if applicable. This will automatically close the issue if your PR is merged in)
 Fixes put_#_and_issue_numer_here
--- a/.gitignore
+++ b/.gitignore
@@ -40,6 +40,7 @@ test/client/unit/coverage
 test/client/e2e/reports
 test/client-old/spec/mocks/translations.js
 yarn.lock
+.gitattributes

 # Elastic Beanstalk Files
 .elasticbeanstalk/*
--- a/.nvmrc
+++ b/.nvmrc
@@ -1 +1 @@
-10
+12
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,6 +1,6 @@
 language: node_js
 node_js:
-  - '10'
+  - '12'
 services:
  - mongodb
 cache:
@@ -14,7 +14,6 @@ before_script:
  - sleep 5
 script:
  - npm run $TEST
-  - if [ $COVERAGE ]; then ./node_modules/.bin/lcov-result-merger 'coverage/**/*.info' | ./node_modules/coveralls/bin/coveralls.js; fi
 env:
  global:
    - DISABLE_REQUEST_LOGGING=true
--- a/5
+++ b/5
@@ -1,4 +1,4 @@
-FROM node:10
+FROM node:12

 ENV ADMIN_EMAIL admin@habitica.com
 ENV AMAZON_PAYMENTS_CLIENT_ID amzn1.application-oa2-client.68ed9e6904ef438fbc1bf86bf494056e
@@ -8,6 +8,7 @@ ENV BASE_URL https://habitica.com
 ENV FACEBOOK_KEY 128307497299777
 ENV GA_ID UA-33510635-1
 ENV GOOGLE_CLIENT_ID 1035232791481-32vtplgnjnd1aufv3mcu1lthf31795fq.apps.googleusercontent.com
+ENV LOGGLY_CLIENT_TOKEN ab5663bf-241f-4d14-8783-7d80db77089a
 ENV NODE_ENV production
 ENV STRIPE_PUB_KEY pk_85fQ0yMECHNfHTSsZoxZXlPSwSNfA

@@ -17,7 +18,7 @@ RUN npm install -g gulp-cli mocha
 # Clone Habitica repo and install dependencies
 RUN mkdir -p /usr/src/habitrpg
 WORKDIR /usr/src/habitrpg
-RUN git clone --branch release https://github.com/HabitRPG/habitica.git /usr/src/habitrpg
+RUN git clone --branch release --depth 1 https://github.com/HabitRPG/habitica.git /usr/src/habitrpg
 RUN npm install
 RUN gulp build:prod --force

--- a/21
+++ b/21
@@ -1,18 +1,5 @@
-FROM node:10
-
-# Install global packages
-RUN npm install -g gulp-cli mocha
-
-# Clone Habitica repo and install dependencies
-RUN mkdir -p /usr/src/habitrpg
-WORKDIR /usr/src/habitrpg
-RUN git clone https://github.com/HabitRPG/habitica.git /usr/src/habitrpg
-RUN cp config.json.example config.json
+FROM node:12
+WORKDIR /code
+COPY package*.json /code/
 RUN npm install
-
-# Create Build dir
-RUN mkdir -p ./website/build
-
-# Start Habitica
-EXPOSE 3000
-CMD ["npm", "start"]
+RUN npm install -g gulp-cli mocha
--- a/README.md
+++ b/README.md
@@ -1,12 +1,16 @@
-Habitica [![Build Status](https://travis-ci.org/HabitRPG/habitica.svg?branch=develop)](https://travis-ci.org/HabitRPG/habitica) [![Code Climate](https://codeclimate.com/github/HabitRPG/habitrpg.svg)](https://codeclimate.com/github/HabitRPG/habitrpg) [![Coverage Status](https://coveralls.io/repos/github/HabitRPG/habitica/badge.svg?branch=develop)](https://coveralls.io/github/HabitRPG/habitica?branch=develop) [![Bountysource](https://api.bountysource.com/badge/tracker?tracker_id=68393)](https://www.bountysource.com/trackers/68393-habitrpg?utm_source=68393&utm_medium=shield&utm_campaign=TRACKER_BADGE) [![Open Source Helpers](https://www.codetriage.com/habitrpg/habitica/badges/users.svg)](https://www.codetriage.com/habitrpg/habitica)
+Habitica [![Build Status](https://travis-ci.org/HabitRPG/habitica.svg?branch=develop)](https://travis-ci.org/HabitRPG/habitica) [![Code Climate](https://codeclimate.com/github/HabitRPG/habitrpg.svg)](https://codeclimate.com/github/HabitRPG/habitrpg) [![Bountysource](https://api.bountysource.com/badge/tracker?tracker_id=68393)](https://www.bountysource.com/trackers/68393-habitrpg?utm_source=68393&utm_medium=shield&utm_campaign=TRACKER_BADGE) [![Open Source Helpers](https://www.codetriage.com/habitrpg/habitica/badges/users.svg)](https://www.codetriage.com/habitrpg/habitica)
 ===============

 [![Greenkeeper badge](https://badges.greenkeeper.io/HabitRPG/habitica.svg)](https://greenkeeper.io/)

 [Habitica](https://habitica.com) is an open source habit building program which treats your life like a Role Playing Game. Level up as you succeed, lose HP as you fail, earn money to buy weapons and armor.

-We need more programmers! Your assistance will be greatly appreciated.
+**We need more programmers!** Your assistance will be greatly appreciated. The wiki pages below and the additional pages they link to will tell you how to get started on contributing code and where you can go to seek further help or ask questions:
+* [Guidance for Blacksmiths](http://habitica.fandom.com/wiki/Guidance_for_Blacksmiths) - an introduction to the technologies used and how the software is organized.
+* [Setting up Habitica Locally](http://habitica.fandom.com/wiki/Setting_up_Habitica_Locally) - how to set up a local install of Habitica for development and testing on various platforms.

-For an introduction to the technologies used and how the software is organized, refer to [Guidance for Blacksmiths](http://habitica.wikia.com/wiki/Guidance_for_Blacksmiths).
+Habitica's code is licensed as described at https://github.com/HabitRPG/habitica/blob/develop/LICENSE

-To set up a local install of Habitica for development and testing on various platforms, see [Setting up Habitica Locally](http://habitica.wikia.com/wiki/Setting_up_Habitica_Locally).
+**Found a bug?** Please report it in the [Report a Bug guild](https://habitica.com/groups/guild/a29da26b-37de-4a71-b0c6-48e72a900dac) rather than creating an issue (an admin will advise you if a new issue is necessary; usually it is not).
+
+**Have any questions about Habitica or its community?** See the links in the [habitica.com](https://habitica.com) website's Help menu or drop in to [Guilds > Tavern Chat](https://habitica.com/groups/tavern) to ask questions or chat socially!
--- a/VAGRANT.md
+++ b/VAGRANT.md
@@ -8,4 +8,4 @@ minimal dependencies on the developer's local platform. It can be used
 on a variety of systems including Windows, Mac OS X, and Linux.

 Instructions for using the Habitica Vagrant environment are in
-[Setting up Habitica Locally](http://habitica.wikia.com/wiki/Setting_up_Habitica_Locally).
+[Setting up Habitica Locally](http://habitica.fandom.com/wiki/Setting_up_Habitica_Locally).
--- a/config.json.example
+++ b/config.json.example
@@ -61,21 +61,17 @@
  "SESSION_SECRET_IV": "12345678912345678912345678912345",
  "SESSION_SECRET_KEY": "1234567891234567891234567891234567891234567891234567891234567891",
  "SITE_HTTP_AUTH_ENABLED": "false",
-  "SITE_HTTP_AUTH_PASSWORD": "password",
-  "SITE_HTTP_AUTH_USERNAME": "admin",
+  "SITE_HTTP_AUTH_PASSWORDS": "password,wordpass,passkey",
+  "SITE_HTTP_AUTH_USERNAMES": "admin,tester,contributor",
  "SLACK_FLAGGING_FOOTER_LINK": "https://habitrpg.github.io/flag-o-rama/",
  "SLACK_FLAGGING_URL": "https://hooks.slack.com/services/id/id/id",
  "SLACK_SUBSCRIPTIONS_URL": "https://hooks.slack.com/services/id/id/id",
  "SLACK_URL": "https://hooks.slack.com/services/some-url",
-  "SMTP_HOST": "example.com",
-  "SMTP_PASS": "password",
-  "SMTP_PORT": 587,
-  "SMTP_SERVICE": "Gmail",
-  "SMTP_TLS": "true",
-  "SMTP_USER": "user@example.com",
  "STRIPE_API_KEY": "aaaabbbbccccddddeeeeffff00001111",
  "STRIPE_PUB_KEY": "22223333444455556666777788889999",
  "TEST_DB_URI": "mongodb://localhost/habitrpg_test",
  "TRANSIFEX_SLACK_CHANNEL": "transifex",
-  "WEB_CONCURRENCY": 1
+  "WEB_CONCURRENCY": 1,
+  "SKIP_SSL_CHECK_KEY": "key",
+  "ENABLE_STACKDRIVER_TRACING": "false"
 }
--- a/docker-compose.dev.yml
+++ b/docker-compose.dev.yml
@@ -1,14 +1,45 @@
 version: "3"
 services:
-
  client:
+    build:
+      context: .
+      dockerfile: ./Dockerfile-Dev
+    command: ["npm", "run", "client:dev"]
+    depends_on:
+      - server
    environment:
-      - NODE_ENV=development
+      - BASE_URL=http://server:3000
+    image: habitica
+    networks:
+      - habitica
+    ports:
+      - "8080:8080"
    volumes:
-      - '.:/usr/src/habitrpg'
-
+      - .:/code
+      - /code/node_modules
  server:
+    build:
+      context: .
+      dockerfile: ./Dockerfile-Dev
+    command: ["npm", "start"]
+    depends_on:
+      - mongo
    environment:
-      - NODE_ENV=development
+      - NODE_DB_URI=mongodb://mongo/habitrpg
+    image: habitica
+    networks:
+      - habitica
+    ports:
+      - "3000:3000"
    volumes:
-      - '.:/usr/src/habitrpg'
+      - .:/code
+      - /code/node_modules
+  mongo:
+    image: mongo:3.4
+    networks:
+      - habitica
+    ports:
+      - "27017:27017"
+networks:
+  habitica:
+    driver: bridge
--- a/gulp/gulp-sprites.js
+++ b/gulp/gulp-sprites.js
@@ -16,7 +16,7 @@ const IMG_DIST_PATH = 'website/client/assets/images/sprites/';
 const CSS_DIST_PATH = 'website/client/assets/css/sprites/';

 function checkForSpecialTreatment (name) {
-  let regex = /^hair|skin|beard|mustach|shirt|flower|^headAccessory_special_\w+Ears|^eyewear_special_\w+TopFrame/;
+  let regex = /^hair|skin|beard|mustach|shirt|flower|^headAccessory_special_\w+Ears|^eyewear_special_\w+TopFrame|^eyewear_special_\w+HalfMoon/;
  return name.match(regex) || name === 'head_0';
 }

--- a/migrations/archive/2017/20170111_announce_collection_quest_change_in_parties.js
+++ b/migrations/archive/2017/20170111_announce_collection_quest_change_in_parties.js
@@ -19,7 +19,7 @@ const Timer = require('./utils/timer');
 const connectToDb = require('./utils/connect').connectToDb;
 const closeDb = require('./utils/connect').closeDb;

-const message = '`This party\'s collection quest has been made easier! For details, refer to http://habitica.wikia.com/wiki/User_blog:LadyAlys/Collection_Quests_are_Now_Easier`';
+const message = '`This party\'s collection quest has been made easier! For details, refer to http://habitica.fandom.com/wiki/User_blog:LadyAlys/Collection_Quests_are_Now_Easier`';

 const timer = new Timer();

--- a/migrations/archive/2018/20181231_nye.js
+++ b/migrations/archive/2018/20181231_nye.js
@@ -0,0 +1,110 @@
+/* eslint-disable no-console */
+const MIGRATION_NAME = '20181231_nye';
+import { model as User } from '../../../website/server/models/user';
+import mongoose from 'mongoose';
+import { v4 as uuid } from 'uuid';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count++;
+
+  const set = {'flags.newStuff': true};
+  let push;
+
+  set.migration = MIGRATION_NAME;
+
+  if (typeof user.items.gear.owned.head_special_nye2017 !== 'undefined') {
+    set['items.gear.owned.head_special_nye2018'] = false;
+    push = [
+      {
+        type: 'marketGear',
+        path: 'gear.flat.head_special_nye2018',
+        _id: uuid(),
+      },
+    ];
+  } else if (typeof user.items.gear.owned.head_special_nye2016 !== 'undefined') {
+    set['items.gear.owned.head_special_nye2017'] = false;
+    push = [
+      {
+        type: 'marketGear',
+        path: 'gear.flat.head_special_nye2017',
+        _id: uuid(),
+      },
+    ];
+  } else if (typeof user.items.gear.owned.head_special_nye2015 !== 'undefined') {
+    set['items.gear.owned.head_special_nye2016'] = false;
+    push = [
+      {
+        type: 'marketGear',
+        path: 'gear.flat.head_special_nye2016',
+        _id: uuid(),
+      },
+    ];
+  } else if (typeof user.items.gear.owned.head_special_nye2014 !== 'undefined') {
+    set['items.gear.owned.head_special_nye2015'] = false;
+    push = [
+      {
+        type: 'marketGear',
+        path: 'gear.flat.head_special_nye2015',
+        _id: uuid(),
+      },
+    ];
+  } else if (typeof user.items.gear.owned.head_special_nye !== 'undefined') {
+    set['items.gear.owned.head_special_nye2014'] = false;
+    push = [
+      {
+        type: 'marketGear',
+        path: 'gear.flat.head_special_nye2014',
+        _id: uuid(),
+      },
+    ];
+  } else {
+    set['items.gear.owned.head_special_nye'] = false;
+    push = [
+      {
+        type: 'marketGear',
+        path: 'gear.flat.head_special_nye',
+        _id: uuid(),
+      },
+    ];
+  }
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+
+  return await User.update({_id: user._id}, {$set: set, $push: {pinnedItems: {$each: push}}}).exec();
+}
+
+module.exports = async function processUsers () {
+  let query = {
+    migration: {$ne: MIGRATION_NAME},
+  };
+
+  const fields = {
+    _id: 1,
+    items: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1],
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};
--- a/migrations/archive/2019/20190131_habit_birthday.js
+++ b/migrations/archive/2019/20190131_habit_birthday.js
@@ -0,0 +1,88 @@
+/* eslint-disable no-console */
+const MIGRATION_NAME = '20190131_habit_birthday';
+import { v4 as uuid } from 'uuid';
+
+import { model as User } from '../../../website/server/models/user';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count++;
+
+  const inc = {
+    'items.food.Cake_Skeleton': 1,
+    'items.food.Cake_Base': 1,
+    'items.food.Cake_CottonCandyBlue': 1,
+    'items.food.Cake_CottonCandyPink': 1,
+    'items.food.Cake_Shade': 1,
+    'items.food.Cake_White': 1,
+    'items.food.Cake_Golden': 1,
+    'items.food.Cake_Zombie': 1,
+    'items.food.Cake_Desert': 1,
+    'items.food.Cake_Red': 1,
+    'achievements.habitBirthdays': 1,
+  };
+  const set = {};
+  let push;
+
+  set.migration = MIGRATION_NAME;
+
+  if (typeof user.items.gear.owned.armor_special_birthday2018 !== 'undefined') {
+    set['items.gear.owned.armor_special_birthday2019'] = false;
+    push = {pinnedItems: {type: 'marketGear', path: 'gear.flat.armor_special_birthday2019', _id: uuid()}};
+  } else if (typeof user.items.gear.owned.armor_special_birthday2017 !== 'undefined') {
+    set['items.gear.owned.armor_special_birthday2018'] = false;
+    push = {pinnedItems: {type: 'marketGear', path: 'gear.flat.armor_special_birthday2018', _id: uuid()}};
+  } else if (typeof user.items.gear.owned.armor_special_birthday2016 !== 'undefined') {
+    set['items.gear.owned.armor_special_birthday2017'] = false;
+    push = {pinnedItems: {type: 'marketGear', path: 'gear.flat.armor_special_birthday2017', _id: uuid()}};
+  } else if (typeof user.items.gear.owned.armor_special_birthday2015 !== 'undefined') {
+    set['items.gear.owned.armor_special_birthday2016'] = false;
+    push = {pinnedItems: {type: 'marketGear', path: 'gear.flat.armor_special_birthday2016', _id: uuid()}};
+  } else if (typeof user.items.gear.owned.armor_special_birthday !== 'undefined') {
+    set['items.gear.owned.armor_special_birthday2015'] = false;
+    push = {pinnedItems: {type: 'marketGear', path: 'gear.flat.armor_special_birthday2015', _id: uuid()}};
+  } else {
+    set['items.gear.owned.armor_special_birthday'] = false;
+    push = {pinnedItems: {type: 'marketGear', path: 'gear.flat.armor_special_birthday', _id: uuid()}};
+  }
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+
+  return await User.update({_id: user._id}, {$inc: inc, $set: set, $push: push}).exec();
+}
+
+module.exports = async function processUsers () {
+  let query = {
+    migration: {$ne: MIGRATION_NAME},
+    'auth.timestamps.loggedin': {$gt: new Date('2019-01-15')},
+  };
+
+  const fields = {
+    _id: 1,
+    items: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1],
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};
--- a/migrations/archive/2019/20190530_halfmoon_glasses.js
+++ b/migrations/archive/2019/20190530_halfmoon_glasses.js
@@ -0,0 +1,62 @@
+/* eslint-disable no-console */
+const MIGRATION_NAME = '20190530_halfmoon_glasses';
+import { v4 as uuid } from 'uuid';
+
+import { model as User } from '../../../website/server/models/user';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count++;
+
+  const set = {
+    'items.gear.owned.eyewear_special_blackHalfMoon': true,
+    'items.gear.owned.eyewear_special_blueHalfMoon': true,
+    'items.gear.owned.eyewear_special_greenHalfMoon': true,
+    'items.gear.owned.eyewear_special_pinkHalfMoon': true,
+    'items.gear.owned.eyewear_special_redHalfMoon': true,
+    'items.gear.owned.eyewear_special_whiteHalfMoon': true,
+    'items.gear.owned.eyewear_special_yellowHalfMoon': true,
+  };
+
+  set.migration = MIGRATION_NAME;
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+
+  return await User.update({_id: user._id}, {$set: set}).exec();
+}
+
+module.exports = async function processUsers () {
+  let query = {
+    migration: {$ne: MIGRATION_NAME},
+    'auth.timestamps.loggedin': {$gt: new Date('2019-05-01')},
+  };
+
+  const fields = {
+    _id: 1,
+    items: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1],
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};
--- a/migrations/archive/2019/20190618_summer_splash_orcas.js
+++ b/migrations/archive/2019/20190618_summer_splash_orcas.js
@@ -0,0 +1,59 @@
+/* eslint-disable no-console */
+const MIGRATION_NAME = '20190618_summer_splash_orcas';
+
+import { model as User } from '../../../website/server/models/user';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count++;
+
+  let set;
+
+  if (user && user.items && user.items.pets && typeof user.items.pets['Orca-Base'] !== 'undefined') {
+    set = { migration: MIGRATION_NAME };
+  } else if (user && user.items && user.items.mounts && typeof user.items.mounts['Orca-Base'] !== 'undefined') {
+    set = { migration: MIGRATION_NAME, 'items.pets.Orca-Base': 5 };
+  } else {
+    set = { migration: MIGRATION_NAME, 'items.mounts.Orca-Base': true };
+  }
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+
+  return await User.update({ _id: user._id }, { $set: set }).exec();
+}
+
+module.exports = async function processUsers () {
+  let query = {
+    migration: {$ne: MIGRATION_NAME},
+    'auth.timestamps.loggedin': {$gt: new Date('2019-05-18')},
+  };
+
+  const fields = {
+    _id: 1,
+    items: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1],
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};
--- a/migrations/archive/2019/20190716_groups_fix.js
+++ b/migrations/archive/2019/20190716_groups_fix.js
@@ -0,0 +1,84 @@
+/* eslint-disable no-console */
+const MIGRATION_NAME = '20190716_groups_fix';
+
+import monk from 'monk';
+import nconf from 'nconf';
+const CONNECTION_STRING = nconf.get('MIGRATION_CONNECT_STRING');
+
+import { model as User } from '../../../website/server/models/user';
+
+const progressCount = 1000;
+let count = 0;
+let backupUsers;
+
+async function updateUser (user) {
+  count++;
+
+  let set = { migration: MIGRATION_NAME };
+  let addToSet;
+
+  const monkPromise = new Promise((resolve, reject) => {
+     backupUsers.findOne(
+      { _id: user._id },
+      { fields: { _id: 1, party: 1, guilds: 1 }},
+    ).then(foundUserInBackup => {
+      resolve(foundUserInBackup);
+    }).catch(e => {
+      reject(e);
+    })
+  });
+  let backupUser = await monkPromise;
+  if (!backupUser) return;
+
+  if (!user.party._id) {
+    set.party = backupUser.party;
+  }
+  addToSet = { guilds: { $each: backupUser.guilds }};
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+
+  return User.update({ _id: user._id }, { $set: set, $addToSet: addToSet }).exec();
+}
+
+module.exports = async function processUsers () {
+  const query = {
+    'auth.timestamps.loggedin': {$gt: new Date('2019-07-15')},
+  };
+
+  let backupDb = monk(CONNECTION_STRING);
+  const backupDbPromise = new Promise((resolve, reject) => {
+    backupDb.then(() => resolve()).catch((e) => reject(e));
+  });
+
+  await backupDbPromise;
+  console.log('Connected to backup db');
+  backupUsers = backupDb.get('users', { castIds: false });
+
+  const fields = {
+    _id: 1,
+    party: 1,
+    guilds: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1],
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};
--- a/migrations/archive/2019/20190717_groups_fix_2.js
+++ b/migrations/archive/2019/20190717_groups_fix_2.js
@@ -0,0 +1,88 @@
+/* eslint-disable no-console */
+const MIGRATION_NAME = '20190717_groups_fix_2';
+
+import monk from 'monk';
+import nconf from 'nconf';
+const CONNECTION_STRING = nconf.get('MIGRATION_CONNECT_STRING');
+
+import { model as User } from '../../../website/server/models/user';
+import { sendTxn as sendTxnEmail } from '../../../website/server/libs/email';
+import shared from '../../../website/common';
+
+const questScrolls = shared.content.quests;
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateGroup (group) {
+  count++;
+
+  if (group && group.quest && group.quest.key && group.quest.leader) {
+    const quest = questScrolls[group.quest.key];
+    const leader = await User.findOne({_id: group.quest.leader}).exec();
+
+    if (leader && quest) {
+      await User.update({ 
+        _id: leader._id,
+        migration: {$ne: MIGRATION_NAME},
+      }, {
+        $set: {migration: MIGRATION_NAME},
+        $inc: { 
+          balance: 1,
+          [`items.quests.${group.quest.key}`]: 1,
+        },
+      }).exec();
+
+      // unsubscribe from all is already checked by sendTxnEmail
+      if (leader.preferences && leader.preferences.emailNotifications && leader.preferences.emailNotifications.majorUpdates !== false) {
+        sendTxnEmail(leader, 'groups-outage');
+      }
+    }
+  }
+
+  if (count % progressCount === 0) console.warn(`${count} ${group._id}`);
+}
+
+module.exports = async function processUsers () {
+  const query = {
+    type: 'party'
+  };
+
+  let backupDb = monk(CONNECTION_STRING);
+  const backupDbPromise = new Promise((resolve, reject) => {
+    backupDb.then(() => resolve()).catch((e) => reject(e));
+  });
+
+  await backupDbPromise;
+  console.log('Connected to backup db');
+  const backupGroups = backupDb.get('groups', { castIds: false });
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const groupsPromise = new Promise((resolve, reject) => {
+      backupGroups
+      .find(query, {
+        limit: 250, 
+        sort: {_id: 1}
+      })
+      .then(foundGroupInBackup => {
+        resolve(foundGroupInBackup);
+      }).catch(e => {
+        reject(e);
+      });
+    });
+
+    const groups = await groupsPromise;
+
+    if (groups.length === 0) {
+      console.warn('All appropriate groups found and modified.');
+      console.warn(`\n${count} groups processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: groups[groups.length - 1]._id,
+      };
+    }
+
+    await Promise.all(groups.map(updateGroup)); // eslint-disable-line no-await-in-loop
+  }
+};
--- a/migrations/archive/2019/20190731_naming_day.js
+++ b/migrations/archive/2019/20190731_naming_day.js
@@ -0,0 +1,84 @@
+/* eslint-disable no-console */
+const MIGRATION_NAME = '20190731_naming_day';
+import { v4 as uuid } from 'uuid';
+
+import { model as User } from '../../../website/server/models/user';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count++;
+
+  let set;
+  let push;
+  const inc = {
+    'items.food.Cake_Base': 1,
+    'items.food.Cake_CottonCandyBlue': 1,
+    'items.food.Cake_CottonCandyPink': 1,
+    'items.food.Cake_Desert': 1,
+    'items.food.Cake_Golden': 1,
+    'items.food.Cake_Red': 1,
+    'items.food.Cake_Shade': 1,
+    'items.food.Cake_Skeleton': 1,
+    'items.food.Cake_White': 1,
+    'items.food.Cake_Zombie': 1,
+    'achievements.habiticaDays': 1,
+  };
+
+  if (user && user.items && user.items.gear && user.items.gear.owned && typeof user.items.gear.owned.body_special_namingDay2018 !== 'undefined') {
+    set = { migration: MIGRATION_NAME };
+  } else if (user && user.items && user.items.gear && user.items.gear.owned && typeof user.items.gear.owned.head_special_namingDay2017 !== 'undefined') {
+    set = { migration: MIGRATION_NAME, 'items.gear.owned.body_special_namingDay2018': false };
+    push = { pinnedItems: { type: 'marketGear', path: 'gear.flat.body_special_namingDay2018', _id: uuid() }};
+  } else if (user && user.items && user.items.pets && typeof user.items.pets['Gryphon-RoyalPurple'] !== 'undefined') {
+    set = { migration: MIGRATION_NAME, 'items.gear.owned.head_special_namingDay2017': false };
+    push = { pinnedItems: { type: 'marketGear', path: 'gear.flat.head_special_namingDay2017', _id: uuid() }};
+  } else if (user && user.items && user.items.mounts && typeof user.items.mounts['Gryphon-RoyalPurple'] !== 'undefined') {
+    set = { migration: MIGRATION_NAME, 'items.pets.Gryphon-RoyalPurple': 5 };
+  } else {
+    set = { migration: MIGRATION_NAME, 'items.mounts.Gryphon-RoyalPurple': true };
+  }
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+
+  if (push) {
+    return await User.update({ _id: user._id }, { $set: set, $inc: inc, $push: push }).exec();
+  } else {
+    return await User.update({ _id: user._id }, { $set: set, $inc: inc }).exec();
+  }
+}
+
+module.exports = async function processUsers () {
+  let query = {
+    migration: { $ne: MIGRATION_NAME },
+    'auth.timestamps.loggedin': { $gt: new Date('2019-07-01') },
+  };
+
+  const fields = {
+    _id: 1,
+    items: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1]._id,
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};
--- a/migrations/archive/2019/20190917_pet_color_achievements.js
+++ b/migrations/archive/2019/20190917_pet_color_achievements.js
@@ -0,0 +1,104 @@
+/* eslint-disable no-console */
+const MIGRATION_NAME = '20190917_pet_color_achievements';
+import { model as User } from '../../../website/server/models/user';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count++;
+
+  let set = {
+    migration: MIGRATION_NAME,
+  };
+
+  if (user && user.items && user.items.pets) {
+    const pets = user.items.pets;
+    if (pets['Wolf-Base'] > 0
+      && pets['TigerCub-Base'] > 0
+      && pets['PandaCub-Base'] > 0
+      && pets['LionCub-Base'] > 0
+      && pets['Fox-Base'] > 0
+      && pets['FlyingPig-Base'] > 0
+      && pets['Dragon-Base'] > 0
+      && pets['Cactus-Base'] > 0
+      && pets['BearCub-Base'] > 0) {
+        set['achievements.backToBasics'] = true;
+      }
+    if (pets['Wolf-Desert'] > 0
+      && pets['TigerCub-Desert'] > 0
+      && pets['PandaCub-Desert'] > 0
+      && pets['LionCub-Desert'] > 0
+      && pets['Fox-Desert'] > 0
+      && pets['FlyingPig-Desert'] > 0
+      && pets['Dragon-Desert'] > 0
+      && pets['Cactus-Desert'] > 0
+      && pets['BearCub-Desert'] > 0) {
+        set['achievements.dustDevil'] = true;
+      }
+  }
+
+  if (user && user.items && user.items.mounts) {
+    const mounts = user.items.mounts;
+    if (mounts['Wolf-Base']
+      && mounts['TigerCub-Base']
+      && mounts['PandaCub-Base']
+      && mounts['LionCub-Base']
+      && mounts['Fox-Base']
+      && mounts['FlyingPig-Base']
+      && mounts['Dragon-Base']
+      && mounts['Cactus-Base']
+      && mounts['BearCub-Base'] ) {
+        set['achievements.allYourBase'] = true;
+      }
+    if (mounts['Wolf-Desert']
+      && mounts['TigerCub-Desert']
+      && mounts['PandaCub-Desert']
+      && mounts['LionCub-Desert']
+      && mounts['Fox-Desert']
+      && mounts['FlyingPig-Desert']
+      && mounts['Dragon-Desert']
+      && mounts['Cactus-Desert']
+      && mounts['BearCub-Desert'] ) {
+        set['achievements.aridAuthority'] = true;
+      }
+  }
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+
+  return await User.update({ _id: user._id }, { $set: set }).exec();
+}
+
+module.exports = async function processUsers () {
+  let query = {
+    migration: { $ne: MIGRATION_NAME },
+    'auth.timestamps.loggedin': { $gt: new Date('2019-09-01') },
+  };
+
+  const fields = {
+    _id: 1,
+    items: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1]._id,
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};
--- a/migrations/archive/2019/20190927_kickstarter.js
+++ b/migrations/archive/2019/20190927_kickstarter.js
@@ -0,0 +1,67 @@
+/* eslint-disable no-console */
+const MIGRATION_NAME = '20190927_kickstarter';
+import { v4 as uuid } from 'uuid';
+
+import { model as User } from '../../../website/server/models/user';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count++;
+
+  const set = {};
+  let push = {pinnedItems: {$each: []}};
+
+  set.migration = MIGRATION_NAME;
+  set['achievements.ks2019'] = true;
+
+  // set['items.gear.owned.armor_special_ks2019'] = false;
+  // push.pinnedItems.$each.push({type: 'marketGear', path: 'gear.flat.armor_special_ks2019', _id: uuid()});
+  set['items.gear.owned.head_special_ks2019'] = false;
+  push.pinnedItems.$each.push({type: 'marketGear', path: 'gear.flat.head_special_ks2019', _id: uuid()});
+  // set['items.gear.owned.shield_special_ks2019'] = false;
+  // push.pinnedItems.$each.push({type: 'marketGear', path: 'gear.flat.shield_special_ks2019', _id: uuid()});
+  // set['items.gear.owned.weapon_special_ks2019'] = false;
+  // push.pinnedItems.$each.push({type: 'marketGear', path: 'gear.flat.weapon_special_ks2019', _id: uuid()});
+  set['items.gear.owned.eyewear_special_ks2019'] = false;
+  push.pinnedItems.$each.push({type: 'marketGear', path: 'gear.flat.eyewear_special_ks2019', _id: uuid()});
+  // set['items.pets.Gryphon-Gryphatrice'] = 5;
+  // set['items.mounts.Gryphon-Gryphatrice'] = true;
+
+  return await User.update({_id: user._id}, {$set: set, $push: push}).exec();
+}
+
+module.exports = async function processUsers () {
+  let query = {
+    migration: {$ne: MIGRATION_NAME},
+    'auth.local.lowerCaseUsername': {$in: []},
+  };
+
+  const fields = {
+    _id: 1,
+    items: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1],
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};
--- a/migrations/migration-runner.js
+++ b/migrations/migration-runner.js
@@ -17,7 +17,7 @@ function setUpServer () {
 setUpServer();

 // Replace this with your migration
-const processUsers = require('./users/mystery-items.js');
+const processUsers = require('');
 processUsers()
  .then(function success () {
    process.exit(0);
--- a/migrations/users/bulk-email.js
+++ b/migrations/users/bulk-email.js
@@ -1,5 +1,5 @@
 /* eslint-disable no-console */
-import { sendTxn } from '../../../website/server/libs/email';
+import { sendTxn } from '../../website/server/libs/email';
 import { model as User } from '../../website/server/models/user';
 import moment from 'moment';
 import nconf from 'nconf';
--- a/migrations/users/full-stable.js
+++ b/migrations/users/full-stable.js
@@ -1,67 +1,24 @@
+/* eslint-disable no-console */
+const MIGRATION_NAME = 'full-stable';
 import each from 'lodash/each';
 import keys from 'lodash/keys';
 import content from '../../website/common/script/content/index';
-const migrationName = 'full-stable.js';
-const authorName = 'Sabe'; // in case script author needs to know when their ...
-const authorUuid = '7f14ed62-5408-4e1b-be83-ada62d504931'; // ... own data is done
+
+import { model as User } from '../../website/server/models/user';
+
+const progressCount = 1000;
+let count = 0;

 /*
 * Award users every extant pet and mount
 */
-const connectionString = 'mongodb://localhost:27017/habitrpg?auto_reconnect=true'; // FOR TEST DATABASE

-let monk = require('monk');
-let dbUsers = monk(connectionString).get('users', { castIds: false });
-
-function processUsers (lastId) {
-  // specify a query to limit the affected users (empty for all users):
-  let query = {
-    'profile.name': 'SabreCat',
-  };
-
-  if (lastId) {
-    query._id = {
-      $gt: lastId,
-    };
-  }
-
-  dbUsers.find(query, {
-    sort: {_id: 1},
-    limit: 250,
-    fields: [
-    ], // specify fields we are interested in to limit retrieved data (empty if we're not reading data):
-  })
-    .then(updateUsers)
-    .catch((err) => {
-      console.log(err);
-      return exiting(1, `ERROR! ${  err}`);
-    });
-}
-
-let progressCount = 1000;
-let count = 0;
-
-function updateUsers (users) {
-  if (!users || users.length === 0) {
-    console.warn('All appropriate users found and modified.');
-    displayData();
-    return;
-  }
-
-  let userPromises = users.map(updateUser);
-  let lastUser = users[users.length - 1];
-
-  return Promise.all(userPromises)
-    .then(() => {
-      processUsers(lastUser._id);
-    });
-}
-
-function updateUser (user) {
+async function updateUser (user) {
  count++;
-  let set = {
-    migration: migrationName,
-  };
+
+  const set = {};
+
+  set.migration = MIGRATION_NAME;

  each(keys(content.pets), (pet) => {
    set[`items.pets.${pet}`] = 5;
@@ -88,30 +45,40 @@ function updateUser (user) {
    set[`items.mounts.${mount}`] = true;
  });

-  dbUsers.update({_id: user._id}, {$set: set});
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);

-  if (count % progressCount === 0) console.warn(`${count  } ${  user._id}`);
-  if (user._id === authorUuid) console.warn(`${authorName  } processed`);
+  return await User.update({_id: user._id}, {$set: set}).exec();
 }

-function displayData () {
-  console.warn(`\n${  count  } users processed\n`);
-  return exiting(0);
-}
+module.exports = async function processUsers () {
+  let query = {
+    migration: {$ne: MIGRATION_NAME},
+    'auth.local.username': 'olson22',
+  };

-function exiting (code, msg) {
-  code = code || 0; // 0 = success
-  if (code && !msg) {
-    msg = 'ERROR!';
-  }
-  if (msg) {
-    if (code) {
-      console.error(msg);
-    } else      {
-      console.log(msg);
+  const fields = {
+    _id: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1],
+      };
    }
-  }
-  process.exit(code);
-}

-module.exports = processUsers;
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};
--- a/migrations/users/mystery-items.js
+++ b/migrations/users/mystery-items.js
@@ -1,6 +1,6 @@
 /* eslint-disable no-console */
-const MIGRATION_NAME = 'mystery_items_201812';
-const MYSTERY_ITEMS = ['headAccessory_mystery_201812', 'back_mystery_201812'];
+const MIGRATION_NAME = 'mystery_items_201909';
+const MYSTERY_ITEMS = ['armor_mystery_201909', 'head_mystery_201909'];
 import { model as User } from '../../website/server/models/user';
 import { model as UserNotification } from '../../website/server/models/userNotification';

--- a/migrations/users/pi-day.js
+++ b/migrations/users/pi-day.js
@@ -0,0 +1,73 @@
+/* eslint-disable no-console */
+const MIGRATION_NAME = '20190314_pi_day';
+import { v4 as uuid } from 'uuid';
+
+import { model as User } from '../../website/server/models/user';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count++;
+
+  const inc = {
+    'items.food.Pie_Skeleton': 1,
+    'items.food.Pie_Base': 1,
+    'items.food.Pie_CottonCandyBlue': 1,
+    'items.food.Pie_CottonCandyPink': 1,
+    'items.food.Pie_Shade': 1,
+    'items.food.Pie_White': 1,
+    'items.food.Pie_Golden': 1,
+    'items.food.Pie_Zombie': 1,
+    'items.food.Pie_Desert': 1,
+    'items.food.Pie_Red': 1,
+  };
+  const set = {};
+
+  set.migration = MIGRATION_NAME;
+
+  set['items.gear.owned.head_special_piDay'] = false;
+  set['items.gear.owned.shield_special_piDay'] = false;
+  const push = [
+    {type: 'marketGear', path: 'gear.flat.head_special_piDay', _id: uuid()},
+    {type: 'marketGear', path: 'gear.flat.shield_special_piDay', _id: uuid()},
+  ];
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+
+  return await User.update({_id: user._id}, {$inc: inc, $set: set, $push: {pinnedItems: {$each: push}}}).exec();
+}
+
+module.exports = async function processUsers () {
+  let query = {
+    migration: {$ne: MIGRATION_NAME},
+    'auth.timestamps.loggedin': {$gt: new Date('2019-02-15')},
+  };
+
+  const fields = {
+    _id: 1,
+    items: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1],
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};
--- a/package-lock.json
+++ b/package-lock.json
--- a/package.json
+++ b/package.json
@@ -1,18 +1,20 @@
 {
  "name": "habitica",
  "description": "A habit tracker app which treats your goals like a Role Playing Game.",
-  "version": "4.77.4",
+  "version": "4.116.4",
  "main": "./website/server/index.js",
  "dependencies": {
+    "@google-cloud/trace-agent": "^4.0.0",
    "@slack/client": "^3.8.1",
    "accepts": "^1.3.5",
    "amazon-payments": "^0.2.7",
    "amplitude": "^3.5.0",
+    "amplitude-js": "^5.2.2",
    "apidoc": "^0.17.5",
    "apn": "^2.2.0",
-    "autoprefixer": "^8.5.0",
-    "aws-sdk": "^2.329.0",
-    "axios": "^0.18.0",
+    "autoprefixer": "^9.4.0",
+    "aws-sdk": "^2.432.0",
+    "axios": "^0.19.0",
    "axios-progress-bar": "^1.2.0",
    "babel-core": "^6.26.3",
    "babel-eslint": "^8.2.3",
@@ -26,16 +28,16 @@
    "babel-preset-es2015": "^6.6.0",
    "babel-register": "^6.6.0",
    "babel-runtime": "^6.11.6",
-    "bcrypt": "^3.0.1",
+    "bcrypt": "^3.0.6",
    "body-parser": "^1.18.3",
    "bootstrap": "^4.1.1",
-    "bootstrap-vue": "^2.0.0-rc.9",
-    "compression": "^1.7.2",
-    "cookie-session": "^1.2.0",
+    "bootstrap-vue": "^2.0.2",
+    "compression": "^1.7.4",
+    "cookie-session": "^1.3.3",
    "coupon-code": "^0.4.5",
-    "cross-env": "^5.2.0",
+    "cross-env": "^6.0.0",
    "css-loader": "^0.28.11",
-    "csv-stringify": "^4.3.1",
+    "csv-stringify": "^5.1.0",
    "cwait": "^1.1.1",
    "domain-middleware": "~0.1.0",
    "express": "^4.16.3",
@@ -46,32 +48,33 @@
    "got": "^9.0.0",
    "gulp": "^4.0.0",
    "gulp-babel": "^7.0.1",
-    "gulp-imagemin": "^5.0.3",
+    "gulp-imagemin": "^6.0.0",
    "gulp-nodemon": "^2.4.1",
    "gulp.spritesmith": "^6.9.0",
    "habitica-markdown": "^1.3.0",
-    "hellojs": "^1.15.1",
+    "hellojs": "^1.18.1",
+    "helmet": "^3.21.0",
    "html-webpack-plugin": "^3.2.0",
-    "image-size": "^0.6.2",
-    "in-app-purchase": "^1.10.2",
+    "image-size": "^0.8.0",
+    "in-app-purchase": "^1.11.3",
    "intro.js": "^2.9.3",
    "jquery": ">=3.0.0",
-    "js2xmlparser": "^3.0.0",
+    "js2xmlparser": "^4.0.0",
    "lodash": "^4.17.10",
-    "merge-stream": "^1.0.0",
+    "merge-stream": "^2.0.0",
    "method-override": "^3.0.0",
    "moment": "^2.22.1",
    "moment-recur": "^1.0.7",
-    "mongoose": "^5.3.4",
+    "mongoose": "^5.6.9",
    "morgan": "^1.7.0",
    "nconf": "^0.10.0",
    "node-gcm": "^1.0.2",
-    "node-sass": "^4.9.0",
-    "nodemailer": "^4.6.4",
-    "ora": "^3.0.0",
-    "pageres": "^4.1.1",
+    "node-sass": "^4.12.0",
+    "ora": "^3.2.0",
+    "pageres": "^5.1.0",
    "passport": "^0.4.0",
-    "passport-facebook": "^2.0.0",
+    "passport-facebook": "^3.0.0",
+    "passport-google-oauth2": "^0.2.0",
    "passport-google-oauth20": "1.0.0",
    "paypal-ipn": "3.0.0",
    "paypal-rest-sdk": "^1.8.1",
@@ -79,16 +82,17 @@
    "postcss-easy-import": "^3.0.0",
    "ps-tree": "^1.0.0",
    "pug": "^2.0.3",
+    "regenerator-runtime": "^0.13.3",
    "rimraf": "^2.4.3",
    "sass-loader": "^7.0.3",
    "shelljs": "^0.8.2",
    "short-uuid": "^3.0.0",
-    "smartbanner.js": "^1.9.1",
-    "stripe": "^5.9.0",
-    "superagent": "^4.0.0",
+    "smartbanner.js": "^1.11.0",
+    "stripe": "^7.9.0",
+    "superagent": "^5.0.2",
    "svg-inline-loader": "^0.8.0",
-    "svg-url-loader": "^2.3.2",
-    "svgo": "^1.0.5",
+    "svg-url-loader": "^3.0.0",
+    "svgo": "^1.2.0",
    "svgo-loader": "^2.1.0",
    "universal-analytics": "^0.4.17",
    "update": "^0.7.4",
@@ -96,15 +100,15 @@
    "url-loader": "^1.0.0",
    "useragent": "^2.1.9",
    "uuid": "^3.0.1",
-    "validator": "^10.5.0",
+    "validator": "^11.0.0",
    "vinyl-buffer": "^1.0.1",
-    "vue": "^2.5.16",
+    "vue": "^2.6.10",
    "vue-loader": "^14.2.2",
    "vue-mugen-scroll": "^0.2.1",
    "vue-router": "^3.0.0",
    "vue-style-loader": "^4.1.0",
-    "vue-template-compiler": "^2.5.16",
-    "vuedraggable": "^2.15.0",
+    "vue-template-compiler": "^2.6.10",
+    "vuedraggable": "^2.20.0",
    "vuejs-datepicker": "git://github.com/habitrpg/vuejs-datepicker.git#5d237615463a84a23dd6f3f77c6ab577d68593ec",
    "webpack": "^3.12.0",
    "webpack-merge": "^4.1.3",
@@ -114,7 +118,7 @@
  },
  "private": true,
  "engines": {
-    "node": "^10",
+    "node": "^12",
    "npm": "^6"
  },
  "scripts": {
@@ -144,16 +148,15 @@
    "apidoc": "gulp apidoc"
  },
  "devDependencies": {
-    "@vue/test-utils": "^1.0.0-beta.19",
+    "@vue/test-utils": "^1.0.0-beta.29",
    "babel-plugin-istanbul": "^4.1.6",
    "babel-plugin-syntax-object-rest-spread": "^6.13.0",
    "chai": "^4.1.2",
    "chai-as-promised": "^7.1.1",
    "chalk": "^2.4.1",
-    "chromedriver": "^2.40.0",
+    "chromedriver": "^77.0.0",
    "connect-history-api-fallback": "^1.1.0",
-    "coveralls": "^3.0.1",
-    "cross-spawn": "^6.0.5",
+    "cross-spawn": "^7.0.0",
    "eslint": "^4.19.1",
    "eslint-config-habitrpg": "^4.0.0",
    "eslint-friendly-formatter": "^4.0.1",
@@ -162,12 +165,12 @@
    "eslint-plugin-mocha": "^5.0.0",
    "eventsource-polyfill": "^0.9.6",
    "expect.js": "^0.3.1",
-    "http-proxy-middleware": "^0.19.0",
+    "http-proxy-middleware": "^0.20.0",
    "istanbul": "^1.1.0-alpha.1",
-    "karma": "^3.1.3",
+    "karma": "^4.0.1",
    "karma-babel-preprocessor": "^7.0.0",
    "karma-chai-plugins": "^0.9.0",
-    "karma-chrome-launcher": "^2.2.0",
+    "karma-chrome-launcher": "^3.0.0",
    "karma-coverage": "^1.1.2",
    "karma-mocha": "^1.3.0",
    "karma-mocha-reporter": "^2.2.5",
@@ -176,14 +179,13 @@
    "karma-sourcemap-loader": "^0.3.7",
    "karma-spec-reporter": "0.0.32",
    "karma-webpack": "^3.0.0",
-    "lcov-result-merger": "^3.0.0",
    "mocha": "^5.1.1",
    "monk": "^6.0.6",
-    "nightwatch": "^0.9.21",
-    "puppeteer": "^1.5.0",
+    "nightwatch": "^1.0.16",
+    "puppeteer": "^1.14.0",
    "require-again": "^2.0.0",
    "selenium-server": "^3.12.0",
-    "sinon": "^6.3.5",
+    "sinon": "^7.2.4",
    "sinon-chai": "^3.0.0",
    "sinon-stub-promise": "^4.0.0",
    "webpack-bundle-analyzer": "^2.12.0",
--- a/scripts/gdpr-delete-users.js
+++ b/scripts/gdpr-delete-users.js
@@ -53,12 +53,12 @@ async function _deleteHabiticaData (user, email) {

  if (response) {
    console.log(`${response.status} ${response.statusText}`);
-    if (response.status === 200) console.log(`${user._id} removed. Last login: ${user.auth.timestamps.loggedin}`);
+    if (response.status === 200) console.log(`${user._id} (${email}) removed. Last login: ${user.auth.timestamps.loggedin}`);
  }
 }

 async function _processEmailAddress (email) {
-  const emailRegex = new RegExp(`^${email}`, 'i');
+  const emailRegex = new RegExp(`^${email}$`, 'i');
  const users = await User.find({
    $or: [
      {'auth.local.email': emailRegex},
--- a/test/README.md
+++ b/test/README.md
@@ -1 +1 @@
-For information about writing and running tests, see [Using Your Local Install to Modify Habitica's Website and API](http://habitica.wikia.com/wiki/Using_Your_Local_Install_to_Modify_Habitica%27s_Website_and_API).
+For information about writing and running tests, see [Using Your Local Install to Modify Habitica's Website and API](http://habitica.fandom.com/wiki/Using_Your_Local_Install_to_Modify_Habitica%27s_Website_and_API).
--- a/test/api/unit/libs/analyticsService.test.js
+++ b/test/api/unit/libs/analyticsService.test.js
@@ -335,14 +335,13 @@ describe('analyticsService', () => {
    let data, itemSpy;

    beforeEach(() => {
+      Visitor.prototype.event.yields();
+
      itemSpy = sandbox.stub().returnsThis();

-      Visitor.prototype.event.returns({
-        send: sandbox.stub(),
-      });
      Visitor.prototype.transaction.returns({
        item: itemSpy,
-        send: sandbox.stub().returnsThis(),
+        send: sandbox.stub().yields(),
      });

      data = {
--- a/test/api/unit/libs/cron.test.js
+++ b/test/api/unit/libs/cron.test.js
@@ -1232,7 +1232,7 @@ describe('cron', () => {
      cron({user, tasksByType, daysMissed, analytics});

      expect(user.history.exp).to.have.lengthOf(1);
-      expect(user.history.exp[0].value).to.equal(150);
+      expect(user.history.exp[0].value).to.equal(25);
    });

    it('increments perfect day achievement if all (at least 1) due dailies were completed', () => {
--- a/test/api/unit/libs/email.test.js
+++ b/test/api/unit/libs/email.test.js
@@ -1,9 +1,7 @@
 /* eslint-disable global-require */
 import got from 'got';
 import nconf from 'nconf';
-import nodemailer from 'nodemailer';
 import requireAgain from 'require-again';
-import logger from '../../../../website/server/libs/logger';
 import { TAVERN_ID } from '../../../../website/server/models/group';
 import { defer } from '../../../helpers/api-unit.helper';

@@ -35,42 +33,6 @@ function getUser () {
 describe('emails', () => {
  let pathToEmailLib = '../../../../website/server/libs/email';

-  describe('sendEmail', () => {
-    let sendMailSpy;
-
-    beforeEach(() => {
-      sendMailSpy = sandbox.stub().returns(defer().promise);
-      sandbox.stub(nodemailer, 'createTransport').returns({
-        sendMail: sendMailSpy,
-      });
-    });
-
-    afterEach(() => {
-      sandbox.restore();
-    });
-
-    it('can send an email using the default transport', () => {
-      let attachEmail = requireAgain(pathToEmailLib);
-      attachEmail.send();
-      expect(sendMailSpy).to.be.calledOnce;
-    });
-
-    it('logs errors', (done) => {
-      sandbox.stub(logger, 'error');
-
-      let attachEmail = requireAgain(pathToEmailLib);
-      attachEmail.send();
-      expect(sendMailSpy).to.be.calledOnce;
-      defer().reject();
-
-      // wait for unhandledRejection event to fire
-      setTimeout(() => {
-        expect(logger.error).to.be.calledOnce;
-        done();
-      }, 20);
-    });
-  });
-
  describe('getUserInfo', () => {
    it('returns an empty object if no field request', () => {
      let attachEmail = requireAgain(pathToEmailLib);
@@ -84,7 +46,7 @@ describe('emails', () => {
      let user = getUser();
      let data = getUserInfo(user, ['name', 'email', '_id', 'canSend']);

-      expect(data).to.have.property('name', user.profile.name);
+      expect(data).to.have.property('name', user.auth.local.username);
      expect(data).to.have.property('email', user.auth.local.email);
      expect(data).to.have.property('_id', user._id);
      expect(data).to.have.property('canSend', true);
@@ -95,11 +57,11 @@ describe('emails', () => {
      let getUserInfo = attachEmail.getUserInfo;
      let user = getUser();
      delete user.profile.name;
-      delete user.auth.local;
+      delete user.auth.local.email;

      let data = getUserInfo(user, ['name', 'email', '_id', 'canSend']);

-      expect(data).to.have.property('name', user.profile.name);
+      expect(data).to.have.property('name', user.auth.local.username);
      expect(data).to.have.property('email', user.auth.facebook.emails[0].value);
      expect(data).to.have.property('_id', user._id);
      expect(data).to.have.property('canSend', true);
@@ -114,7 +76,7 @@ describe('emails', () => {

      let data = getUserInfo(user, ['name', 'email', '_id', 'canSend']);

-      expect(data).to.have.property('name', user.profile.name);
+      expect(data).to.have.property('name', user.auth.local.username);
      expect(data).not.to.have.property('email');
      expect(data).to.have.property('_id', user._id);
      expect(data).to.have.property('canSend', true);
--- a/test/api/unit/libs/errors.test.js
+++ b/test/api/unit/libs/errors.test.js
@@ -5,7 +5,9 @@ import {
  BadRequest,
  InternalServerError,
  NotFound,
+  NotificationNotFound,
 } from '../../../../website/server/libs/errors';
+import i18n from '../../../../website/common/script/i18n';

 describe('Custom Errors', () => {
  describe('CustomError', () => {
@@ -66,6 +68,23 @@ describe('Custom Errors', () => {

      expect(notAuthorizedError.message).to.eql('Custom Error Message');
    });
+
+    describe('NotificationNotFound', () => {
+      it('is an instance of NotFound', () => {
+        const notificationNotFoundErr = new NotificationNotFound();
+        expect(notificationNotFoundErr).to.be.an.instanceOf(NotFound);
+      });
+
+      it('it returns an http code of 404', () => {
+        const notificationNotFoundErr = new NotificationNotFound();
+        expect(notificationNotFoundErr.httpCode).to.eql(404);
+      });
+
+      it('returns a standard message', () => {
+        const notificationNotFoundErr = new NotificationNotFound();
+        expect(notificationNotFoundErr.message).to.eql(i18n.t('messageNotificationNotFound'));
+      });
+    });
  });

  describe('BadRequest', () => {
--- a/test/api/unit/libs/i18n.test.js
+++ b/test/api/unit/libs/i18n.test.js
@@ -1,27 +1,11 @@
 import {
  translations,
-  localePath,
  langCodes,
+  approvedLanguages,
 } from '../../../../website/server/libs/i18n';
-import fs from 'fs';
-import path from 'path';

 describe('i18n', () => {
-  let listOfLocales = [];
-
-  before((done) => {
-    fs.readdir(localePath, (err, files) => {
-      if (err) return done(err);
-
-      files.forEach((file) => {
-        if (fs.statSync(path.join(localePath, file)).isDirectory() === false) return;
-        listOfLocales.push(file);
-      });
-
-      listOfLocales = listOfLocales.sort();
-      done();
-    });
-  });
+  let listOfLocales = approvedLanguages.sort();

  describe('translations', () => {
    it('includes a translation object for each locale', () => {
--- a/test/api/unit/libs/items/utils.test.js
+++ b/test/api/unit/libs/items/utils.test.js
@@ -0,0 +1,122 @@
+/* eslint-disable camelcase */
+import {
+  validateItemPath,
+  getDefaultOwnedGear,
+  castItemVal,
+} from '../../../../../website/server/libs/items/utils';
+
+describe('Items Utils', () => {
+  describe('getDefaultOwnedGear', () => {
+    it('clones the result object', () => {
+      const res1 = getDefaultOwnedGear();
+      res1.extraProperty = true;
+
+      const res2 = getDefaultOwnedGear();
+      expect(res2).not.to.have.property('extraProperty');
+    });
+  });
+
+  describe('validateItemPath', () => {
+    it('returns false if not an item path', () => {
+      expect(validateItemPath('notitems.gear.owned.item')).to.equal(false);
+    });
+
+    it('returns true if a valid schema path', () => {
+      expect(validateItemPath('items.gear.equipped.weapon')).to.equal(true);
+      expect(validateItemPath('items.currentPet')).to.equal(true);
+      expect(validateItemPath('items.special.snowball')).to.equal(true);
+    });
+
+    it('works with owned gear paths', () => {
+      expect(validateItemPath('items.gear.owned.head_armoire_crownOfHearts')).to.equal(true);
+      expect(validateItemPath('items.gear.owned.head_invalid')).to.equal(false);
+    });
+
+    it('works with pets paths', () => {
+      expect(validateItemPath('items.pets.Wolf-CottonCandyPink')).to.equal(true);
+      expect(validateItemPath('items.pets.Wolf-Invalid')).to.equal(false);
+    });
+
+    it('works with eggs paths', () => {
+      expect(validateItemPath('items.eggs.LionCub')).to.equal(true);
+      expect(validateItemPath('items.eggs.Armadillo')).to.equal(true);
+      expect(validateItemPath('items.eggs.NotAnArmadillo')).to.equal(false);
+    });
+
+    it('works with hatching potions paths', () => {
+      expect(validateItemPath('items.hatchingPotions.Base')).to.equal(true);
+      expect(validateItemPath('items.hatchingPotions.StarryNight')).to.equal(true);
+      expect(validateItemPath('items.hatchingPotions.Invalid')).to.equal(false);
+    });
+
+    it('works with food paths', () => {
+      expect(validateItemPath('items.food.Cake_Base')).to.equal(true);
+      expect(validateItemPath('items.food.Cake_Invalid')).to.equal(false);
+    });
+
+    it('works with mounts paths', () => {
+      expect(validateItemPath('items.mounts.Cactus-Base')).to.equal(true);
+      expect(validateItemPath('items.mounts.Aether-Invisible')).to.equal(true);
+      expect(validateItemPath('items.mounts.Aether-Invalid')).to.equal(false);
+    });
+
+    it('works with quests paths', () => {
+      expect(validateItemPath('items.quests.atom3')).to.equal(true);
+      expect(validateItemPath('items.quests.invalid')).to.equal(false);
+    });
+  });
+
+  describe('castItemVal', () => {
+    it('returns the item val untouched if not an item path', () => {
+      expect(castItemVal('notitems.gear.owned.item', 'a string')).to.equal('a string');
+    });
+
+    it('returns the item val untouched if an unsupported path', () => {
+      expect(castItemVal('items.gear.equipped.weapon', 'a string')).to.equal('a string');
+      expect(castItemVal('items.currentPet', 'a string')).to.equal('a string');
+      expect(castItemVal('items.special.snowball', 'a string')).to.equal('a string');
+    });
+
+    it('converts values for pets paths to numbers', () => {
+      expect(castItemVal('items.pets.Wolf-CottonCandyPink', '5')).to.equal(5);
+      expect(castItemVal('items.pets.Wolf-Invalid', '5')).to.equal(5);
+    });
+
+    it('converts values for eggs paths to numbers', () => {
+      expect(castItemVal('items.eggs.LionCub', '5')).to.equal(5);
+      expect(castItemVal('items.eggs.Armadillo', '5')).to.equal(5);
+      expect(castItemVal('items.eggs.NotAnArmadillo', '5')).to.equal(5);
+    });
+
+    it('converts values for hatching potions paths to numbers', () => {
+      expect(castItemVal('items.hatchingPotions.Base', '5')).to.equal(5);
+      expect(castItemVal('items.hatchingPotions.StarryNight', '5')).to.equal(5);
+      expect(castItemVal('items.hatchingPotions.Invalid', '5')).to.equal(5);
+    });
+
+    it('converts values for food paths to numbers', () => {
+      expect(castItemVal('items.food.Cake_Base', '5')).to.equal(5);
+      expect(castItemVal('items.food.Cake_Invalid', '5')).to.equal(5);
+    });
+
+    it('converts values for mounts paths to numbers', () => {
+      expect(castItemVal('items.mounts.Cactus-Base', 'true')).to.equal(true);
+      expect(castItemVal('items.mounts.Aether-Invisible', 'false')).to.equal(false);
+      expect(castItemVal('items.mounts.Aether-Invalid', 'true')).to.equal(true);
+      expect(castItemVal('items.mounts.Aether-Invalid', 'truish')).to.equal(true);
+      expect(castItemVal('items.mounts.Aether-Invalid', 0)).to.equal(false);
+    });
+
+    it('converts values for quests paths to numbers', () => {
+      expect(castItemVal('items.quests.atom3', '5')).to.equal(5);
+      expect(castItemVal('items.quests.invalid', '5')).to.equal(5);
+    });
+
+    it('converts values for owned gear', () => {
+      expect(castItemVal('items.gear.owned.shield_warrior_0', 'true')).to.equal(true);
+      expect(castItemVal('items.gear.owned.invalid', 'false')).to.equal(false);
+      expect(castItemVal('items.gear.owned.invalid', 'thruthy')).to.equal(true);
+      expect(castItemVal('items.gear.owned.invalid', 0)).to.equal(false);
+    });
+  });
+});
--- a/test/api/unit/libs/payments/apple.test.js
+++ b/test/api/unit/libs/payments/apple.test.js
@@ -6,6 +6,7 @@ import iap from '../../../../../website/server/libs/inAppPurchases';
 import {model as User} from '../../../../../website/server/models/user';
 import common from '../../../../../website/common';
 import moment from 'moment';
+import {mockFindById, restoreFindById} from '../../../../helpers/mongoose.helper';

 const i18n = common.i18n;

@@ -49,7 +50,7 @@ describe('Apple Payments', ()  => {
      iapIsValidatedStub = sinon.stub(iapModule, 'isValidated')
        .returns(false);

-      await expect(applePayments.verifyGemPurchase(user, receipt, headers))
+      await expect(applePayments.verifyGemPurchase({user, receipt, headers}))
        .to.eventually.be.rejected.and.to.eql({
          httpCode: 401,
          name: 'NotAuthorized',
@@ -61,7 +62,7 @@ describe('Apple Payments', ()  => {
      iapGetPurchaseDataStub.restore();
      iapGetPurchaseDataStub = sinon.stub(iapModule, 'getPurchaseData').returns([]);

-      await expect(applePayments.verifyGemPurchase(user, receipt, headers))
+      await expect(applePayments.verifyGemPurchase({user, receipt, headers}))
        .to.eventually.be.rejected.and.to.eql({
          httpCode: 401,
          name: 'NotAuthorized',
@@ -71,7 +72,7 @@ describe('Apple Payments', ()  => {

    it('errors if the user cannot purchase gems', async () => {
      sinon.stub(user, 'canGetGems').resolves(false);
-      await expect(applePayments.verifyGemPurchase(user, receipt, headers))
+      await expect(applePayments.verifyGemPurchase({user, receipt, headers}))
        .to.eventually.be.rejected.and.to.eql({
          httpCode: 401,
          name: 'NotAuthorized',
@@ -89,7 +90,7 @@ describe('Apple Payments', ()  => {
                   transactionId: token,
        }]);

-      await expect(applePayments.verifyGemPurchase(user, receipt, headers))
+      await expect(applePayments.verifyGemPurchase({user, receipt, headers}))
        .to.eventually.be.rejected.and.to.eql({
          httpCode: 401,
          name: 'NotAuthorized',
@@ -131,7 +132,7 @@ describe('Apple Payments', ()  => {
          }]);

        sinon.stub(user, 'canGetGems').resolves(true);
-        await applePayments.verifyGemPurchase(user, receipt, headers);
+        await applePayments.verifyGemPurchase({user, receipt, headers});

        expect(iapSetupStub).to.be.calledOnce;
        expect(iapValidateStub).to.be.calledOnce;
@@ -151,6 +152,38 @@ describe('Apple Payments', ()  => {
        user.canGetGems.restore();
      });
    });
+
+    it('gifts gems', async () => {
+      const receivingUser = new User();
+      await receivingUser.save();
+
+      mockFindById(receivingUser);
+
+      iapGetPurchaseDataStub.restore();
+      iapGetPurchaseDataStub = sinon.stub(iapModule, 'getPurchaseData')
+        .returns([{productId: gemsCanPurchase[0].productId,
+                   transactionId: token,
+        }]);
+
+      const gift = {uuid: receivingUser._id};
+      await applePayments.verifyGemPurchase({user, gift, receipt, headers});
+
+      expect(iapSetupStub).to.be.calledOnce;
+      expect(iapValidateStub).to.be.calledOnce;
+      expect(iapValidateStub).to.be.calledWith(iap.APPLE, receipt);
+      expect(iapIsValidatedStub).to.be.calledOnce;
+      expect(iapIsValidatedStub).to.be.calledWith({});
+      expect(iapGetPurchaseDataStub).to.be.calledOnce;
+
+      expect(paymentBuyGemsStub).to.be.calledOnce;
+      expect(paymentBuyGemsStub).to.be.calledWith({
+        user: receivingUser,
+        paymentMethod: applePayments.constants.PAYMENT_METHOD_APPLE,
+        amount: gemsCanPurchase[0].amount,
+        headers,
+      });
+      restoreFindById();
+    });
  });

  describe('subscribe', () => {
--- a/test/api/unit/libs/payments/google.test.js
+++ b/test/api/unit/libs/payments/google.test.js
@@ -6,6 +6,7 @@ import iap from '../../../../../website/server/libs/inAppPurchases';
 import {model as User} from '../../../../../website/server/models/user';
 import common from '../../../../../website/common';
 import moment from 'moment';
+import {mockFindById, restoreFindById} from '../../../../helpers/mongoose.helper';

 const i18n = common.i18n;

@@ -44,7 +45,7 @@ describe('Google Payments', ()  => {
      iapIsValidatedStub = sinon.stub(iapModule, 'isValidated')
        .returns(false);

-      await expect(googlePayments.verifyGemPurchase(user, receipt, signature, headers))
+      await expect(googlePayments.verifyGemPurchase({user, receipt, signature, headers}))
        .to.eventually.be.rejected.and.to.eql({
          httpCode: 401,
          name: 'NotAuthorized',
@@ -55,7 +56,7 @@ describe('Google Payments', ()  => {
    it('should throw an error if productId is invalid', async () => {
      receipt = `{"token": "${token}", "productId": "invalid"}`;

-      await expect(googlePayments.verifyGemPurchase(user, receipt, signature, headers))
+      await expect(googlePayments.verifyGemPurchase({user, receipt, signature, headers}))
        .to.eventually.be.rejected.and.to.eql({
          httpCode: 401,
          name: 'NotAuthorized',
@@ -66,7 +67,7 @@ describe('Google Payments', ()  => {
    it('should throw an error if user cannot purchase gems', async () => {
      sinon.stub(user, 'canGetGems').resolves(false);

-      await expect(googlePayments.verifyGemPurchase(user, receipt, signature, headers))
+      await expect(googlePayments.verifyGemPurchase({user, receipt, signature, headers}))
        .to.eventually.be.rejected.and.to.eql({
          httpCode: 401,
          name: 'NotAuthorized',
@@ -78,7 +79,7 @@ describe('Google Payments', ()  => {

    it('purchases gems', async () => {
      sinon.stub(user, 'canGetGems').resolves(true);
-      await googlePayments.verifyGemPurchase(user, receipt, signature, headers);
+      await googlePayments.verifyGemPurchase({user, receipt, signature, headers});

      expect(iapSetupStub).to.be.calledOnce;
      expect(iapValidateStub).to.be.calledOnce;
@@ -99,6 +100,34 @@ describe('Google Payments', ()  => {
      expect(user.canGetGems).to.be.calledOnce;
      user.canGetGems.restore();
    });
+
+    it('gifts gems', async () => {
+      const receivingUser = new User();
+      await receivingUser.save();
+
+      mockFindById(receivingUser);
+
+      const gift = {uuid: receivingUser._id};
+      await googlePayments.verifyGemPurchase({user, gift, receipt, signature, headers});
+
+      expect(iapSetupStub).to.be.calledOnce;
+      expect(iapValidateStub).to.be.calledOnce;
+      expect(iapValidateStub).to.be.calledWith(iap.GOOGLE, {
+        data: receipt,
+        signature,
+      });
+      expect(iapIsValidatedStub).to.be.calledOnce;
+      expect(iapIsValidatedStub).to.be.calledWith({});
+
+      expect(paymentBuyGemsStub).to.be.calledOnce;
+      expect(paymentBuyGemsStub).to.be.calledWith({
+        user: receivingUser,
+        paymentMethod: googlePayments.constants.PAYMENT_METHOD_GOOGLE,
+        amount: 5.25,
+        headers,
+      });
+      restoreFindById();
+    });
  });

  describe('subscribe', () => {
--- a/test/api/unit/libs/payments/payments.test.js
+++ b/test/api/unit/libs/payments/payments.test.js
@@ -16,6 +16,7 @@ describe('payments/index', () => {
  beforeEach(async () => {
    user = new User();
    user.profile.name = 'sender';
+    user.auth.local.username = 'sender';
    await user.save();

    group = generateGroup({
@@ -209,7 +210,7 @@ describe('payments/index', () => {
        await api.createSubscription(data);
        let msg = '\`Hello recipient, sender has sent you 3 months of subscription!\`';

-        expect(user.sendMessage).to.be.calledTwice;
+        expect(user.sendMessage).to.be.calledOnce;
        expect(user.sendMessage).to.be.calledWith(recipient, { receiverMsg: msg, senderMsg: msg, save: false });
      });

@@ -247,77 +248,6 @@ describe('payments/index', () => {
          },
        });
      });
-
-      context('Winter 2018-19 Gift-1-Get-1 Promotion', async () => {
-        it('creates a gift subscription for purchaser and recipient if none exist', async () => {
-          await api.createSubscription(data);
-
-          expect(user.items.pets['Jackalope-RoyalPurple']).to.eql(5);
-          expect(user.purchased.plan.customerId).to.eql('Gift');
-          expect(user.purchased.plan.dateTerminated).to.exist;
-          expect(user.purchased.plan.dateUpdated).to.exist;
-          expect(user.purchased.plan.dateCreated).to.exist;
-
-          expect(recipient.items.pets['Jackalope-RoyalPurple']).to.eql(5);
-          expect(recipient.purchased.plan.customerId).to.eql('Gift');
-          expect(recipient.purchased.plan.dateTerminated).to.exist;
-          expect(recipient.purchased.plan.dateUpdated).to.exist;
-          expect(recipient.purchased.plan.dateCreated).to.exist;
-        });
-
-        it('adds extraMonths to existing subscription for purchaser and creates a gift subscription for recipient without sub', async () => {
-          user.purchased.plan = plan;
-
-          expect(user.purchased.plan.extraMonths).to.eql(0);
-
-          await api.createSubscription(data);
-
-          expect(user.purchased.plan.extraMonths).to.eql(3);
-
-          expect(recipient.items.pets['Jackalope-RoyalPurple']).to.eql(5);
-          expect(recipient.purchased.plan.customerId).to.eql('Gift');
-          expect(recipient.purchased.plan.dateTerminated).to.exist;
-          expect(recipient.purchased.plan.dateUpdated).to.exist;
-          expect(recipient.purchased.plan.dateCreated).to.exist;
-        });
-
-        it('adds extraMonths to existing subscription for recipient and creates a gift subscription for purchaser without sub', async () => {
-          recipient.purchased.plan = plan;
-
-          expect(recipient.purchased.plan.extraMonths).to.eql(0);
-
-          await api.createSubscription(data);
-
-          expect(recipient.purchased.plan.extraMonths).to.eql(3);
-
-          expect(user.items.pets['Jackalope-RoyalPurple']).to.eql(5);
-          expect(user.purchased.plan.customerId).to.eql('Gift');
-          expect(user.purchased.plan.dateTerminated).to.exist;
-          expect(user.purchased.plan.dateUpdated).to.exist;
-          expect(user.purchased.plan.dateCreated).to.exist;
-        });
-
-        it('adds extraMonths to existing subscriptions for purchaser and recipient', async () => {
-          user.purchased.plan = plan;
-          recipient.purchased.plan = plan;
-
-          expect(user.purchased.plan.extraMonths).to.eql(0);
-          expect(recipient.purchased.plan.extraMonths).to.eql(0);
-
-          await api.createSubscription(data);
-
-          expect(user.purchased.plan.extraMonths).to.eql(3);
-          expect(recipient.purchased.plan.extraMonths).to.eql(3);
-        });
-
-        it('sends a private message about the promotion', async () => {
-          await api.createSubscription(data);
-          let msg = '\`Hello sender, you received 3 months of subscription as part of our holiday gift-giving promotion!\`';
-
-          expect(user.sendMessage).to.be.calledTwice;
-          expect(user.sendMessage).to.be.calledWith(user, { senderMsg: msg });
-        });
-      });
    });

    context('Purchasing a subscription for self', () => {
--- a/test/api/unit/libs/payments/stripe/edit-subscription.test.js
+++ b/test/api/unit/libs/payments/stripe/edit-subscription.test.js
@@ -97,17 +97,17 @@ describe('edit subscription', () => {

    beforeEach(() => {
      subscriptionId = 'subId';
-      stripeListSubscriptionStub = sinon.stub(stripe.customers, 'listSubscriptions')
+      stripeListSubscriptionStub = sinon.stub(stripe.subscriptions, 'list')
        .resolves({
          data: [{id: subscriptionId}],
        });

-      stripeUpdateSubscriptionStub = sinon.stub(stripe.customers, 'updateSubscription').resolves({});
+      stripeUpdateSubscriptionStub = sinon.stub(stripe.subscriptions, 'update').resolves({});
    });

    afterEach(() => {
-      stripe.customers.listSubscriptions.restore();
-      stripe.customers.updateSubscription.restore();
+      stripe.subscriptions.list.restore();
+      stripe.subscriptions.update.restore();
    });

    it('edits a user subscription', async () => {
@@ -118,10 +118,9 @@ describe('edit subscription', () => {
      }, stripe);

      expect(stripeListSubscriptionStub).to.be.calledOnce;
-      expect(stripeListSubscriptionStub).to.be.calledWith(user.purchased.plan.customerId);
+      expect(stripeListSubscriptionStub).to.be.calledWith({customer: user.purchased.plan.customerId});
      expect(stripeUpdateSubscriptionStub).to.be.calledOnce;
      expect(stripeUpdateSubscriptionStub).to.be.calledWith(
-        user.purchased.plan.customerId,
        subscriptionId,
        { card: token }
      );
@@ -135,10 +134,9 @@ describe('edit subscription', () => {
      }, stripe);

      expect(stripeListSubscriptionStub).to.be.calledOnce;
-      expect(stripeListSubscriptionStub).to.be.calledWith(group.purchased.plan.customerId);
+      expect(stripeListSubscriptionStub).to.be.calledWith({customer: group.purchased.plan.customerId});
      expect(stripeUpdateSubscriptionStub).to.be.calledOnce;
      expect(stripeUpdateSubscriptionStub).to.be.calledWith(
-        group.purchased.plan.customerId,
        subscriptionId,
        { card: token }
      );
--- a/test/api/unit/libs/slack.js
+++ b/test/api/unit/libs/slack.js
@@ -32,6 +32,7 @@ describe('slack', () => {
        },
        message: {
          id: 'chat-id',
+          username: 'author',
          user: 'Author',
          uuid: 'author-id',
          text: 'some text',
@@ -50,11 +51,11 @@ describe('slack', () => {

      expect(IncomingWebhook.prototype.send).to.be.calledOnce;
      expect(IncomingWebhook.prototype.send).to.be.calledWith({
-        text: 'flagger (flagger-id; language: flagger-lang) flagged a message',
+        text: 'flagger (flagger-id; language: flagger-lang) flagged a group message',
        attachments: [{
          fallback: 'Flag Message',
          color: 'danger',
-          author_name: `Author - author@example.com - author-id\n${timestamp}`,
+          author_name: `@author Author (author@example.com; author-id)\n${timestamp}`,
          title: 'Flag in Some group - (private guild)',
          title_link: undefined,
          text: 'some text',
--- a/test/api/unit/middlewares/auth.test.js
+++ b/test/api/unit/middlewares/auth.test.js
@@ -16,7 +16,7 @@ describe('auth middleware', () => {
  describe('auth with headers', () => {
    it('allows to specify a list of user field that we do not want to load', (done) => {
      const authWithHeaders = authWithHeadersFactory({
-        userFieldsToExclude: ['items', 'flags', 'auth.timestamps'],
+        userFieldsToExclude: ['items'],
      });

      req.headers['x-api-user'] = user._id;
@@ -27,11 +27,34 @@ describe('auth middleware', () => {

        const userToJSON = res.locals.user.toJSON();
        expect(userToJSON.items).to.not.exist;
-        expect(userToJSON.flags).to.not.exist;
-        expect(userToJSON.auth.timestamps).to.not.exist;
+        expect(userToJSON.auth).to.exist;
+
+        done();
+      });
+    });
+
+    it('makes sure some fields are always included', (done) => {
+      const authWithHeaders = authWithHeadersFactory({
+        userFieldsToExclude: [
+          'items', 'auth.timestamps',
+          'preferences', 'notifications', '_id', 'flags', 'auth', // these are always loaded
+        ],
+      });
+
+      req.headers['x-api-user'] = user._id;
+      req.headers['x-api-key'] = user.apiToken;
+
+      authWithHeaders(req, res, (err) => {
+        if (err) return done(err);
+
+        const userToJSON = res.locals.user.toJSON();
+        expect(userToJSON.items).to.not.exist;
+        expect(userToJSON.auth.timestamps).to.exist;
        expect(userToJSON.auth).to.exist;
        expect(userToJSON.notifications).to.exist;
        expect(userToJSON.preferences).to.exist;
+        expect(userToJSON._id).to.exist;
+        expect(userToJSON.flags).to.exist;

        done();
      });
--- a/test/api/unit/middlewares/redirects.js
+++ b/test/api/unit/middlewares/redirects.js
@@ -73,6 +73,56 @@ describe('redirects middleware', () => {

      expect(res.redirect).to.have.not.been.called;
    });
+
+    it('does not redirect if passed skip ssl request param is passed with corrrect key', () => {
+      let nconfStub = sandbox.stub(nconf, 'get');
+      nconfStub.withArgs('BASE_URL').returns('https://habitica.com');
+      nconfStub.withArgs('IS_PROD').returns(true);
+      nconfStub.withArgs('SKIP_SSL_CHECK_KEY').returns('test-key');
+
+      req.header = sandbox.stub().withArgs('x-forwarded-proto').returns('http');
+      req.originalUrl = '/static/front';
+      req.query.skipSSLCheck = 'test-key';
+
+      const attachRedirects = requireAgain(pathToRedirectsMiddleware);
+      attachRedirects.forceSSL(req, res, next);
+
+      expect(res.redirect).to.have.not.been.called;
+    });
+
+    it('does redirect if skip ssl request param is passed with incorrrect key', () => {
+      let nconfStub = sandbox.stub(nconf, 'get');
+      nconfStub.withArgs('BASE_URL').returns('https://habitica.com');
+      nconfStub.withArgs('IS_PROD').returns(true);
+      nconfStub.withArgs('SKIP_SSL_CHECK_KEY').returns('test-key');
+
+      req.header = sandbox.stub().withArgs('x-forwarded-proto').returns('http');
+      req.originalUrl = '/static/front?skipSSLCheck=INVALID';
+      req.query.skipSSLCheck = 'INVALID';
+
+      const attachRedirects = requireAgain(pathToRedirectsMiddleware);
+      attachRedirects.forceSSL(req, res, next);
+
+      expect(res.redirect).to.be.calledOnce;
+      expect(res.redirect).to.be.calledWith('https://habitica.com/static/front?skipSSLCheck=INVALID');
+    });
+
+    it('does redirect if skip ssl check key is not set', () => {
+      let nconfStub = sandbox.stub(nconf, 'get');
+      nconfStub.withArgs('BASE_URL').returns('https://habitica.com');
+      nconfStub.withArgs('IS_PROD').returns(true);
+      nconfStub.withArgs('SKIP_SSL_CHECK_KEY').returns(null);
+
+      req.header = sandbox.stub().withArgs('x-forwarded-proto').returns('http');
+      req.originalUrl = '/static/front';
+      req.query.skipSSLCheck = 'INVALID';
+
+      const attachRedirects = requireAgain(pathToRedirectsMiddleware);
+      attachRedirects.forceSSL(req, res, next);
+
+      expect(res.redirect).to.be.calledOnce;
+      expect(res.redirect).to.be.calledWith('https://habitica.com/static/front');
+    });
  });

  context('forceHabitica', () => {
--- a/test/api/unit/models/group.test.js
+++ b/test/api/unit/models/group.test.js
@@ -1,7 +1,7 @@
 import moment from 'moment';
 import { v4 as generateUUID } from 'uuid';
 import validator from 'validator';
-import { sleep } from '../../../helpers/api-unit.helper';
+import { sleep, translationCheck } from '../../../helpers/api-unit.helper';
 import {
  SPAM_MESSAGE_LIMIT,
  SPAM_MIN_EXEMPT_CONTRIB_LEVEL,
@@ -32,8 +32,19 @@ describe('Group Model', () => {
      privacy: 'private',
    });

+    let _progress = {
+      up: 10,
+      down: 8,
+      collectedItems: 5,
+    };
+
    questLeader = new User({
-      party: { _id: party._id },
+      party: {
+        _id: party._id,
+        quest: {
+          progress: _progress,
+        },
+      },
      profile: { name: 'Quest Leader' },
      items: {
        quests: {
@@ -45,20 +56,40 @@ describe('Group Model', () => {
    party.leader = questLeader._id;

    participatingMember = new User({
-      party: { _id: party._id },
+      party: {
+        _id: party._id,
+        quest: {
+          progress: _progress,
+        },
+      },
      profile: { name: 'Participating Member' },
    });
    sleepingParticipatingMember = new User({
-      party: { _id: party._id },
+      party: {
+        _id: party._id,
+        quest: {
+          progress: _progress,
+        },
+      },
      profile: { name: 'Sleeping Participating Member' },
      preferences: { sleep: true },
    });
    nonParticipatingMember = new User({
-      party: { _id: party._id },
+      party: {
+        _id: party._id,
+        quest: {
+          progress: _progress,
+        },
+      },
      profile: { name: 'Non-Participating Member' },
    });
    undecidedMember = new User({
-      party: { _id: party._id },
+      party: {
+        _id: party._id,
+        quest: {
+          progress: _progress,
+        },
+      },
      profile: { name: 'Undecided Member' },
    });

@@ -240,7 +271,16 @@ describe('Group Model', () => {
          party = await Group.findOne({_id: party._id});

          expect(Group.prototype.sendChat).to.be.calledOnce;
-          expect(Group.prototype.sendChat).to.be.calledWith('`Participating Member attacks Wailing Whale for 5.0 damage.` `Wailing Whale attacks party for 7.5 damage.`');
+          expect(Group.prototype.sendChat).to.be.calledWith({
+            message: '`Participating Member attacks Wailing Whale for 5.0 damage. Wailing Whale attacks party for 7.5 damage.`',
+            info: {
+              bossDamage: '7.5',
+              quest: 'whale',
+              type: 'boss_damage',
+              user: 'Participating Member',
+              userDamage: '5.0',
+            },
+          });
        });

        it('applies damage only to participating members of party', async () => {
@@ -313,7 +353,10 @@ describe('Group Model', () => {
          party = await Group.findOne({_id: party._id});

          expect(Group.prototype.sendChat).to.be.calledTwice;
-          expect(Group.prototype.sendChat).to.be.calledWith('`You defeated Wailing Whale! Questing party members receive the rewards of victory.`');
+          expect(Group.prototype.sendChat).to.be.calledWith({
+            message: '`You defeated Wailing Whale! Questing party members receive the rewards of victory.`',
+            info: { quest: 'whale', type: 'boss_defeated' },
+          });
        });

        it('calls finishQuest when boss has <= 0 hp', async () => {
@@ -356,7 +399,10 @@ describe('Group Model', () => {

            party = await Group.findOne({_id: party._id});

-            expect(Group.prototype.sendChat).to.be.calledWith(quest.boss.rage.effect('en'));
+            expect(Group.prototype.sendChat).to.be.calledWith({
+              message: quest.boss.rage.effect('en'),
+              info: { quest: 'trex_undead', type: 'boss_rage' },
+            });
            expect(party.quest.progress.hp).to.eql(383.5);
            expect(party.quest.progress.rage).to.eql(0);
          });
@@ -406,7 +452,10 @@ describe('Group Model', () => {

            party = await Group.findOne({_id: party._id});

-            expect(Group.prototype.sendChat).to.be.calledWith(quest.boss.rage.effect('en'));
+            expect(Group.prototype.sendChat).to.be.calledWith({
+              message: quest.boss.rage.effect('en'),
+              info: { quest: 'lostMasterclasser4', type: 'boss_rage' },
+            });
            expect(party.quest.progress.rage).to.eql(0);

            let drainedUser = await User.findById(participatingMember._id);
@@ -457,7 +506,15 @@ describe('Group Model', () => {
          party = await Group.findOne({_id: party._id});

          expect(Group.prototype.sendChat).to.be.calledOnce;
-          expect(Group.prototype.sendChat).to.be.calledWith('`Participating Member found 5 Bars of Soap.`');
+          expect(Group.prototype.sendChat).to.be.calledWith({
+            message: '`Participating Member found 5 Bars of Soap.`',
+            info: {
+              items: { soapBars: 5 },
+              quest: 'atom1',
+              type: 'user_found_items',
+              user: 'Participating Member',
+            },
+          });
        });

        it('sends a chat message if no progress is made', async () => {
@@ -468,7 +525,15 @@ describe('Group Model', () => {
          party = await Group.findOne({_id: party._id});

          expect(Group.prototype.sendChat).to.be.calledOnce;
-          expect(Group.prototype.sendChat).to.be.calledWith('`Participating Member found 0 Bars of Soap.`');
+          expect(Group.prototype.sendChat).to.be.calledWith({
+            message: '`Participating Member found 0 Bars of Soap.`',
+            info: {
+              items: { soapBars: 0 },
+              quest: 'atom1',
+              type: 'user_found_items',
+              user: 'Participating Member',
+            },
+          });
        });

        it('sends a chat message if no progress is made on quest with multiple items', async () => {
@@ -485,9 +550,15 @@ describe('Group Model', () => {
          party = await Group.findOne({_id: party._id});

          expect(Group.prototype.sendChat).to.be.calledOnce;
-          expect(Group.prototype.sendChat).to.be.calledWithMatch(/`Participating Member found/);
-          expect(Group.prototype.sendChat).to.be.calledWithMatch(/0 Blue Fins/);
-          expect(Group.prototype.sendChat).to.be.calledWithMatch(/0 Fire Coral/);
+          expect(Group.prototype.sendChat).to.be.calledWith({
+            message: '`Participating Member found 0 Fire Coral, 0 Blue Fins.`',
+            info: {
+              items: { blueFins: 0, fireCoral: 0 },
+              quest: 'dilatoryDistress1',
+              type: 'user_found_items',
+              user: 'Participating Member',
+            },
+          });
        });

        it('handles collection quests with multiple items', async () => {
@@ -504,8 +575,14 @@ describe('Group Model', () => {
          party = await Group.findOne({_id: party._id});

          expect(Group.prototype.sendChat).to.be.calledOnce;
-          expect(Group.prototype.sendChat).to.be.calledWithMatch(/`Participating Member found/);
-          expect(Group.prototype.sendChat).to.be.calledWithMatch(/\d* (Tracks|Broken Twigs)/);
+          expect(Group.prototype.sendChat).to.be.calledWithMatch({
+            message: sinon.match(/`Participating Member found/).and(sinon.match(/\d* (Tracks|Broken Twigs)/)),
+            info: {
+              quest: 'evilsanta2',
+              type: 'user_found_items',
+              user: 'Participating Member',
+            },
+          });
        });

        it('sends message about victory', async () => {
@@ -516,7 +593,10 @@ describe('Group Model', () => {
          party = await Group.findOne({_id: party._id});

          expect(Group.prototype.sendChat).to.be.calledTwice;
-          expect(Group.prototype.sendChat).to.be.calledWith('`All items found! Party has received their rewards.`');
+          expect(Group.prototype.sendChat).to.be.calledWith({
+            message: '`All items found! Party has received their rewards.`',
+            info: { type: 'all_items_found' },
+          });
        });

        it('calls finishQuest when all items are found', async () => {
@@ -687,6 +767,258 @@ describe('Group Model', () => {
        expect(res.t).to.not.be.called;
      });
    });
+
+    describe('translateSystemMessages', () => {
+      it('translate quest_start', async () => {
+        questLeader.preferences.language = 'en';
+        party.chat = [{
+          info: {
+            type: 'quest_start',
+            quest: 'basilist',
+          },
+        }];
+        let toJSON = await Group.toJSONCleanChat(party, questLeader);
+        translationCheck(toJSON.chat[0].text);
+      });
+
+      it('translate boss_damage', async () => {
+        questLeader.preferences.language = 'en';
+        party.chat = [{
+          info: {
+            type: 'boss_damage',
+            user: questLeader.profile.name,
+            quest: 'basilist',
+            userDamage: 15.3,
+            bossDamage: 3.7,
+          },
+        }];
+        let toJSON = await Group.toJSONCleanChat(party, questLeader);
+        translationCheck(toJSON.chat[0].text);
+      });
+
+      it('translate boss_dont_attack', async () => {
+        questLeader.preferences.language = 'en';
+        party.chat = [{
+          info: {
+            type: 'boss_dont_attack',
+            user: questLeader.profile.name,
+            quest: 'basilist',
+            userDamage: 15.3,
+          },
+        }];
+        let toJSON = await Group.toJSONCleanChat(party, questLeader);
+        translationCheck(toJSON.chat[0].text);
+      });
+
+      it('translate boss_rage', async () => {
+        questLeader.preferences.language = 'en';
+        party.chat = [{
+          info: {
+            type: 'boss_rage',
+            quest: 'lostMasterclasser3',
+          },
+        }];
+        let toJSON = await Group.toJSONCleanChat(party, questLeader);
+        translationCheck(toJSON.chat[0].text);
+      });
+
+      it('translate boss_defeated', async () => {
+        questLeader.preferences.language = 'en';
+        party.chat = [{
+          info: {
+            type: 'boss_defeated',
+            quest: 'lostMasterclasser3',
+          },
+        }];
+        let toJSON = await Group.toJSONCleanChat(party, questLeader);
+        translationCheck(toJSON.chat[0].text);
+      });
+
+      it('translate user_found_items', async () => {
+        questLeader.preferences.language = 'en';
+        party.chat = [{
+          info: {
+            type: 'user_found_items',
+            user: questLeader.profile.name,
+            quest: 'lostMasterclasser1',
+            items: {
+              ancientTome: 3,
+              forbiddenTome: 2,
+              hiddenTome: 1,
+            },
+          },
+        }];
+        let toJSON = await Group.toJSONCleanChat(party, questLeader);
+        translationCheck(toJSON.chat[0].text);
+      });
+
+      it('translate all_items_found', async () => {
+        questLeader.preferences.language = 'en';
+        party.chat = [{
+          info: {
+            type: 'all_items_found',
+          },
+        }];
+        let toJSON = await Group.toJSONCleanChat(party, questLeader);
+        translationCheck(toJSON.chat[0].text);
+      });
+
+      it('translate spell_cast_party', async () => {
+        questLeader.preferences.language = 'en';
+        party.chat = [{
+          info: {
+            type: 'spell_cast_party',
+            user: questLeader.profile.name,
+            class: 'wizard',
+            spell: 'earth',
+          },
+        }];
+        let toJSON = await Group.toJSONCleanChat(party, questLeader);
+        translationCheck(toJSON.chat[0].text);
+      });
+
+      it('translate spell_cast_user', async () => {
+        questLeader.preferences.language = 'en';
+        party.chat = [{
+          info: {
+            type: 'spell_cast_user',
+            user: questLeader.profile.name,
+            class: 'special',
+            spell: 'snowball',
+            target: participatingMember.profile.name,
+          },
+        }];
+        let toJSON = await Group.toJSONCleanChat(party, questLeader);
+        translationCheck(toJSON.chat[0].text);
+      });
+
+      it('translate quest_cancel', async () => {
+        questLeader.preferences.language = 'en';
+        party.chat = [{
+          info: {
+            type: 'quest_cancel',
+            user: questLeader.profile.name,
+            quest: 'basilist',
+          },
+        }];
+        let toJSON = await Group.toJSONCleanChat(party, questLeader);
+        translationCheck(toJSON.chat[0].text);
+      });
+
+      it('translate quest_abort', async () => {
+        questLeader.preferences.language = 'en';
+        party.chat = [{
+          info: {
+            type: 'quest_abort',
+            user: questLeader.profile.name,
+            quest: 'basilist',
+          },
+        }];
+        let toJSON = await Group.toJSONCleanChat(party, questLeader);
+        translationCheck(toJSON.chat[0].text);
+      });
+
+      it('translate tavern_quest_completed', async () => {
+        questLeader.preferences.language = 'en';
+        party.chat = [{
+          info: {
+            type: 'tavern_quest_completed',
+            quest: 'stressbeast',
+          },
+        }];
+        let toJSON = await Group.toJSONCleanChat(party, questLeader);
+        translationCheck(toJSON.chat[0].text);
+      });
+
+      it('translate tavern_boss_rage_tired', async () => {
+        questLeader.preferences.language = 'en';
+        party.chat = [{
+          info: {
+            type: 'tavern_boss_rage_tired',
+            quest: 'stressbeast',
+          },
+        }];
+        let toJSON = await Group.toJSONCleanChat(party, questLeader);
+        translationCheck(toJSON.chat[0].text);
+      });
+
+      it('translate tavern_boss_rage', async () => {
+        questLeader.preferences.language = 'en';
+        party.chat = [{
+          info: {
+            type: 'tavern_boss_rage',
+            quest: 'dysheartener',
+            scene: 'market',
+          },
+        }];
+        let toJSON = await Group.toJSONCleanChat(party, questLeader);
+        translationCheck(toJSON.chat[0].text);
+      });
+
+      it('translate tavern_boss_desperation', async () => {
+        questLeader.preferences.language = 'en';
+        party.chat = [{
+          info: {
+            type: 'tavern_boss_desperation',
+            quest: 'stressbeast',
+          },
+        }];
+        let toJSON = await Group.toJSONCleanChat(party, questLeader);
+        translationCheck(toJSON.chat[0].text);
+      });
+
+      it('translate claim_task', async () => {
+        questLeader.preferences.language = 'en';
+        party.chat = [{
+          info: {
+            type: 'claim_task',
+            user: questLeader.profile.name,
+            task: 'Feed the pet',
+          },
+        }];
+        let toJSON = await Group.toJSONCleanChat(party, questLeader);
+        translationCheck(toJSON.chat[0].text);
+      });
+    });
+
+    describe('toJSONCleanChat', () => {
+      it('shows messages with 1 flag to non-admins', async () => {
+        party.chat = [{
+          flagCount: 1,
+          info: {
+            type: 'quest_start',
+            quest: 'basilist',
+          },
+        }];
+        let toJSON = await Group.toJSONCleanChat(party, questLeader);
+        expect(toJSON.chat.length).to.equal(1);
+      });
+
+      it('shows messages with >= 2 flag to admins', async () => {
+        party.chat = [{
+          flagCount: 3,
+          info: {
+            type: 'quest_start',
+            quest: 'basilist',
+          },
+        }];
+        const admin = new User({'contributor.admin': true});
+        let toJSON = await Group.toJSONCleanChat(party, admin);
+        expect(toJSON.chat.length).to.equal(1);
+      });
+
+      it('doesn\'t show flagged messages to non-admins', async () => {
+        party.chat = [{
+          flagCount: 3,
+          info: {
+            type: 'quest_start',
+            quest: 'basilist',
+          },
+        }];
+        let toJSON = await Group.toJSONCleanChat(party, questLeader);
+        expect(toJSON.chat.length).to.equal(0);
+      });
+    });
  });

  context('Instance Methods', () => {
@@ -976,20 +1308,22 @@ describe('Group Model', () => {
      });

      it('formats message', () => {
-        const chatMessage = party.sendChat('a new message', {
-          _id: 'user-id',
-          profile: { name: 'user name' },
-          contributor: {
-            toObject () {
-              return 'contributor object';
+        const chatMessage = party.sendChat({
+          message: 'a new message', user: {
+            _id: 'user-id',
+            profile: { name: 'user name' },
+            contributor: {
+              toObject () {
+                return 'contributor object';
+              },
            },
-          },
-          backer: {
-            toObject () {
-              return 'backer object';
+            backer: {
+              toObject () {
+                return 'backer object';
+              },
            },
-          },
-        });
+          }}
+        );

        const chat = chatMessage;

@@ -1006,7 +1340,7 @@ describe('Group Model', () => {
      });

      it('formats message as system if no user is passed in', () => {
-        const chat = party.sendChat('a system message');
+        const chat = party.sendChat({message: 'a system message'});

        expect(chat.text).to.eql('a system message');
        expect(validator.isUUID(chat.id)).to.eql(true);
@@ -1021,7 +1355,7 @@ describe('Group Model', () => {
      });

      it('updates users about new messages in party', () => {
-        party.sendChat('message');
+        party.sendChat({message: 'message'});

        expect(User.update).to.be.calledOnce;
        expect(User.update).to.be.calledWithMatch({
@@ -1035,7 +1369,7 @@ describe('Group Model', () => {
          type: 'guild',
        });

-        group.sendChat('message');
+        group.sendChat({message: 'message'});

        expect(User.update).to.be.calledOnce;
        expect(User.update).to.be.calledWithMatch({
@@ -1045,7 +1379,7 @@ describe('Group Model', () => {
      });

      it('does not send update to user that sent the message', () => {
-        party.sendChat('message', {_id: 'user-id', profile: { name: 'user' }});
+        party.sendChat({message: 'message', user: {_id: 'user-id', profile: { name: 'user' }}});

        expect(User.update).to.be.calledOnce;
        expect(User.update).to.be.calledWithMatch({
@@ -1057,7 +1391,7 @@ describe('Group Model', () => {
      it('skips sending new message notification for guilds with > 5000 members', () => {
        party.memberCount = 5001;

-        party.sendChat('message');
+        party.sendChat({message: 'message'});

        expect(User.update).to.not.be.called;
      });
@@ -1065,7 +1399,7 @@ describe('Group Model', () => {
      it('skips sending messages to the tavern', () => {
        party._id = TAVERN_ID;

-        party.sendChat('message');
+        party.sendChat({message: 'message'});

        expect(User.update).to.not.be.called;
      });
@@ -1163,16 +1497,17 @@ describe('Group Model', () => {
          expect(party.quest.members).to.eql(expectedQuestMembers);
        });

-        it('applies updates to user object directly if user is participating', async () => {
+        it('applies updates to user object directly if user is participating (without resetting progress, except progress.down)', async () => {
          await party.startQuest(participatingMember);

          expect(participatingMember.party.quest.key).to.eql('whale');
+          expect(participatingMember.party.quest.progress.up).to.eql(10);
          expect(participatingMember.party.quest.progress.down).to.eql(0);
-          expect(participatingMember.party.quest.progress.collectedItems).to.eql(0);
+          expect(participatingMember.party.quest.progress.collectedItems).to.eql(5);
          expect(participatingMember.party.quest.completed).to.eql(null);
        });

-        it('applies updates to other participating members', async () => {
+        it('applies updates to other participating members (without resetting progress, except progress.down)', async () => {
          await party.startQuest(nonParticipatingMember);

          questLeader = await User.findById(questLeader._id);
@@ -1180,18 +1515,21 @@ describe('Group Model', () => {
          sleepingParticipatingMember = await User.findById(sleepingParticipatingMember._id);

          expect(participatingMember.party.quest.key).to.eql('whale');
+          expect(participatingMember.party.quest.progress.up).to.eql(10);
          expect(participatingMember.party.quest.progress.down).to.eql(0);
-          expect(participatingMember.party.quest.progress.collectedItems).to.eql(0);
+          expect(participatingMember.party.quest.progress.collectedItems).to.eql(5);
          expect(participatingMember.party.quest.completed).to.eql(null);

          expect(sleepingParticipatingMember.party.quest.key).to.eql('whale');
+          expect(sleepingParticipatingMember.party.quest.progress.up).to.eql(10);
          expect(sleepingParticipatingMember.party.quest.progress.down).to.eql(0);
-          expect(sleepingParticipatingMember.party.quest.progress.collectedItems).to.eql(0);
+          expect(sleepingParticipatingMember.party.quest.progress.collectedItems).to.eql(5);
          expect(sleepingParticipatingMember.party.quest.completed).to.eql(null);

          expect(questLeader.party.quest.key).to.eql('whale');
+          expect(questLeader.party.quest.progress.up).to.eql(10);
          expect(questLeader.party.quest.progress.down).to.eql(0);
-          expect(questLeader.party.quest.progress.collectedItems).to.eql(0);
+          expect(questLeader.party.quest.progress.collectedItems).to.eql(5);
          expect(questLeader.party.quest.completed).to.eql(null);
        });

@@ -1202,6 +1540,9 @@ describe('Group Model', () => {
          undecidedMember = await User.findById(undecidedMember._id);

          expect(nonParticipatingMember.party.quest.key).to.not.eql('whale');
+          expect(nonParticipatingMember.party.quest.progress.up).to.eql(10);
+          expect(nonParticipatingMember.party.quest.progress.down).to.eql(8);
+          expect(nonParticipatingMember.party.quest.progress.collectedItems).to.eql(5);
          expect(undecidedMember.party.quest.key).to.not.eql('whale');
        });

@@ -1369,8 +1710,9 @@ describe('Group Model', () => {
          let userQuest = participatingMember.party.quest;

          expect(userQuest.key).to.eql('whale');
+          expect(userQuest.progress.up).to.eql(10);
          expect(userQuest.progress.down).to.eql(0);
-          expect(userQuest.progress.collectedItems).to.eql(0);
+          expect(userQuest.progress.collectedItems).to.eql(5);
          expect(userQuest.completed).to.eql(null);
        });

@@ -1392,7 +1734,7 @@ describe('Group Model', () => {
      let quest;

      beforeEach(() => {
-        quest = questScrolls.whale;
+        quest = questScrolls.armadillo;
        party.quest.key = quest.key;
        party.quest.active = false;
        party.quest.leader = questLeader._id;
@@ -1540,6 +1882,36 @@ describe('Group Model', () => {
        expect(updatedSleepingParticipatingMember.achievements.lostMasterclasser).to.not.eql(true);
      });

+      it('gives out other pet-related quest achievements', async () => {
+        quest = questScrolls.rock;
+        party.quest.key = quest.key;
+
+        questLeader.achievements.quests = {
+          mayhemMistiflying1: 1,
+          yarn: 1,
+          mayhemMistiflying2: 1,
+          egg: 1,
+          mayhemMistiflying3: 1,
+          slime: 2,
+        };
+        await questLeader.save();
+        await party.finishQuest(quest);
+
+        let [
+          updatedLeader,
+          updatedParticipatingMember,
+          updatedSleepingParticipatingMember,
+        ] = await Promise.all([
+          User.findById(questLeader._id).exec(),
+          User.findById(participatingMember._id).exec(),
+          User.findById(sleepingParticipatingMember._id).exec(),
+        ]);
+
+        expect(updatedLeader.achievements.mindOverMatter).to.eql(true);
+        expect(updatedParticipatingMember.achievements.mindOverMatter).to.not.eql(true);
+        expect(updatedSleepingParticipatingMember.achievements.mindOverMatter).to.not.eql(true);
+      });
+
      it('gives xp and gold', async () => {
        await party.finishQuest(quest);

@@ -1670,16 +2042,23 @@ describe('Group Model', () => {
          });
        });

-        it('sets user quest object to a clean state', async () => {
+        it('updates participating members quest object to a clean state (except for progress)', async () => {
          await party.finishQuest(quest);

-          let updatedLeader = await User.findById(questLeader._id);
+          questLeader = await User.findById(questLeader._id);
+          participatingMember = await User.findById(participatingMember._id);

-          expect(updatedLeader.party.quest.completed).to.eql('whale');
-          expect(updatedLeader.party.quest.progress.up).to.eql(0);
-          expect(updatedLeader.party.quest.progress.down).to.eql(0);
-          expect(updatedLeader.party.quest.progress.collectedItems).to.eql(0);
-          expect(updatedLeader.party.quest.RSVPNeeded).to.eql(false);
+          expect(questLeader.party.quest.completed).to.eql('armadillo');
+          expect(questLeader.party.quest.progress.up).to.eql(10);
+          expect(questLeader.party.quest.progress.down).to.eql(8);
+          expect(questLeader.party.quest.progress.collectedItems).to.eql(5);
+          expect(questLeader.party.quest.RSVPNeeded).to.eql(false);
+
+          expect(participatingMember.party.quest.completed).to.eql('armadillo');
+          expect(participatingMember.party.quest.progress.up).to.eql(10);
+          expect(participatingMember.party.quest.progress.down).to.eql(8);
+          expect(participatingMember.party.quest.progress.collectedItems).to.eql(5);
+          expect(participatingMember.party.quest.RSVPNeeded).to.eql(false);
        });
      });

@@ -1882,7 +2261,7 @@ describe('Group Model', () => {

        await guild.save();

-        const groupMessage = guild.sendChat('Test message.');
+        const groupMessage = guild.sendChat({message: 'Test message.'});
        await groupMessage.save();

        await sleep();
--- a/test/api/v3/integration/challenges/GET-challenges_challengeId_export_csv.test.js
+++ b/test/api/v3/integration/challenges/GET-challenges_challengeId_export_csv.test.js
@@ -65,11 +65,11 @@ describe('GET /challenges/:challengeId/export/csv', () => {
    const sortedMembers = _.sortBy([members[0], members[1], members[2], groupLeader], '_id');
    const splitRes = res.split('\n');

-    expect(splitRes[0]).to.equal('UUID,name,Task,Value,Notes,Streak,Task,Value,Notes,Streak');
-    expect(splitRes[1]).to.equal(`${sortedMembers[0]._id},${sortedMembers[0].profile.name},habit:Task 1,0,,0,todo:Task 2,0,,0`);
-    expect(splitRes[2]).to.equal(`${sortedMembers[1]._id},${sortedMembers[1].profile.name},habit:Task 1,0,,0,todo:Task 2,0,,0`);
-    expect(splitRes[3]).to.equal(`${sortedMembers[2]._id},${sortedMembers[2].profile.name},habit:Task 1,0,,0,todo:Task 2,0,,0`);
-    expect(splitRes[4]).to.equal(`${sortedMembers[3]._id},${sortedMembers[3].profile.name},habit:Task 1,0,,0,todo:Task 2,0,,0`);
+    expect(splitRes[0]).to.equal('UUID,Display Name,Username,Task,Value,Notes,Streak,Task,Value,Notes,Streak');
+    expect(splitRes[1]).to.equal(`${sortedMembers[0]._id},${sortedMembers[0].profile.name},${sortedMembers[0].auth.local.username},habit:Task 1,0,,0,todo:Task 2,0,,0`);
+    expect(splitRes[2]).to.equal(`${sortedMembers[1]._id},${sortedMembers[1].profile.name},${sortedMembers[1].auth.local.username},habit:Task 1,0,,0,todo:Task 2,0,,0`);
+    expect(splitRes[3]).to.equal(`${sortedMembers[2]._id},${sortedMembers[2].profile.name},${sortedMembers[2].auth.local.username},habit:Task 1,0,,0,todo:Task 2,0,,0`);
+    expect(splitRes[4]).to.equal(`${sortedMembers[3]._id},${sortedMembers[3].profile.name},${sortedMembers[3].auth.local.username},habit:Task 1,0,,0,todo:Task 2,0,,0`);
    expect(splitRes[5]).to.equal('');
  });

@@ -78,10 +78,10 @@ describe('GET /challenges/:challengeId/export/csv', () => {
    const res = await members[1].get(`/challenges/${challenge._id}/export/csv`);
    const sortedMembers = _.sortBy([members[1], members[2], groupLeader], '_id');
    const splitRes = res.split('\n');
-    expect(splitRes[0]).to.equal('UUID,name,Task,Value,Notes,Streak,Task,Value,Notes,Streak');
-    expect(splitRes[1]).to.equal(`${sortedMembers[0]._id},${sortedMembers[0].profile.name},habit:Task 1,0,,0,todo:Task 2,0,,0`);
-    expect(splitRes[2]).to.equal(`${sortedMembers[1]._id},${sortedMembers[1].profile.name},habit:Task 1,0,,0,todo:Task 2,0,,0`);
-    expect(splitRes[3]).to.equal(`${sortedMembers[2]._id},${sortedMembers[2].profile.name},habit:Task 1,0,,0,todo:Task 2,0,,0`);
+    expect(splitRes[0]).to.equal('UUID,Display Name,Username,Task,Value,Notes,Streak,Task,Value,Notes,Streak');
+    expect(splitRes[1]).to.equal(`${sortedMembers[0]._id},${sortedMembers[0].profile.name},${sortedMembers[0].auth.local.username},habit:Task 1,0,,0,todo:Task 2,0,,0`);
+    expect(splitRes[2]).to.equal(`${sortedMembers[1]._id},${sortedMembers[1].profile.name},${sortedMembers[1].auth.local.username},habit:Task 1,0,,0,todo:Task 2,0,,0`);
+    expect(splitRes[3]).to.equal(`${sortedMembers[2]._id},${sortedMembers[2].profile.name},${sortedMembers[2].auth.local.username},habit:Task 1,0,,0,todo:Task 2,0,,0`);
    expect(splitRes[4]).to.equal('');
  });
 });
--- a/test/api/v3/integration/challenges/GET-challenges_user.test.js
+++ b/test/api/v3/integration/challenges/GET-challenges_user.test.js
@@ -171,7 +171,7 @@ describe('GET challenges/user', () => {
      });
    });

-    it('should return not return challenges in user groups if we send member true param', async () => {
+    it('should not return challenges in user groups if we send member true param', async () => {
      let challenges = await member.get(`/challenges/user?member=${true}`);

      let foundChallenge1 = _.find(challenges, { _id: challenge._id });
@@ -214,6 +214,28 @@ describe('GET challenges/user', () => {
      let foundChallenge = _.find(challenges, { _id: privateChallenge._id });
      expect(foundChallenge).to.not.exist;
    });
+
+    it('should not return challenges user doesn\'t have access to, even with query parameters', async () => {
+      let { group, groupLeader } = await createAndPopulateGroup({
+        groupDetails: {
+          name: 'TestPrivateGuild',
+          summary: 'summary for TestPrivateGuild',
+          type: 'guild',
+          privacy: 'private',
+        },
+      });
+
+      let privateChallenge = await generateChallenge(groupLeader, group, {categories: [{
+        name: 'academics',
+        slug: 'academics',
+      }]});
+      await groupLeader.post(`/challenges/${privateChallenge._id}/join`);
+
+      let challenges = await nonMember.get('/challenges/user?categories=academics&owned=not_owned');
+
+      let foundChallenge = _.find(challenges, { _id: privateChallenge._id });
+      expect(foundChallenge).to.not.exist;
+    });
  });

  context('official challenge is present', () => {
--- a/test/api/v3/integration/challenges/PUT-challenges_challengeId.test.js
+++ b/test/api/v3/integration/challenges/PUT-challenges_challengeId.test.js
@@ -56,11 +56,11 @@ describe('PUT /challenges/:challengeId', () => {
      tasksOrder: 'new order',
      official: true,
      shortName: 'new short name',
+      leader: member._id,

      // applied
      name: 'New Challenge Name',
      description: 'New challenge description.',
-      leader: member._id,
    });

    expect(res.prize).to.equal(0);
@@ -76,12 +76,12 @@ describe('PUT /challenges/:challengeId', () => {
    expect(res.shortName).not.to.equal('new short name');

    expect(res.leader).to.eql({
-      _id: member._id,
-      id: member._id,
-      profile: {name: member.profile.name},
+      _id: user._id,
+      id: user._id,
+      profile: {name: user.profile.name},
      auth: {
        local: {
-          username: member.auth.local.username,
+          username: user.auth.local.username,
        },
      },
      flags: {
--- a/test/api/v3/integration/chat/POST-chat.flag.test.js
+++ b/test/api/v3/integration/chat/POST-chat.flag.test.js
@@ -63,11 +63,11 @@ describe('POST /chat/:chatId/flag', () => {

    /* eslint-disable camelcase */
    expect(IncomingWebhook.prototype.send).to.be.calledWith({
-      text: `${user.profile.name} (${user.id}; language: en) flagged a message`,
+      text: `${user.profile.name} (${user.id}; language: en) flagged a group message`,
      attachments: [{
        fallback: 'Flag Message',
        color: 'danger',
-        author_name: `${anotherUser.profile.name} - ${anotherUser.auth.local.email} - ${anotherUser._id}\n${timestamp}`,
+        author_name: `@${anotherUser.auth.local.username} ${anotherUser.profile.name} (${anotherUser.auth.local.email}; ${anotherUser._id})\n${timestamp}`,
        title: 'Flag in Test Guild',
        title_link: `${BASE_URL}/groups/guild/${group._id}`,
        text: TEST_MESSAGE,
@@ -98,11 +98,11 @@ describe('POST /chat/:chatId/flag', () => {

    /* eslint-disable camelcase */
    expect(IncomingWebhook.prototype.send).to.be.calledWith({
-      text: `${newUser.profile.name} (${newUser.id}; language: en) flagged a message`,
+      text: `${newUser.profile.name} (${newUser.id}; language: en) flagged a group message`,
      attachments: [{
        fallback: 'Flag Message',
        color: 'danger',
-        author_name: `${newUser.profile.name} - ${newUser.auth.local.email} - ${newUser._id}\n${timestamp}`,
+        author_name: `@${newUser.auth.local.username} ${newUser.profile.name} (${newUser.auth.local.email}; ${newUser._id})\n${timestamp}`,
        title: 'Flag in Test Guild',
        title_link: `${BASE_URL}/groups/guild/${group._id}`,
        text: TEST_MESSAGE,
--- a/test/api/v3/integration/chat/POST-chat.test.js
+++ b/test/api/v3/integration/chat/POST-chat.test.js
@@ -12,6 +12,7 @@ import {
  SPAM_MIN_EXEMPT_CONTRIB_LEVEL,
  TAVERN_ID,
 } from '../../../../../website/server/models/group';
+import { CHAT_FLAG_FROM_SHADOW_MUTE } from '../../../../../website/common/script/constants';
 import { v4 as generateUUID } from 'uuid';
 import { getMatchesByWordArray } from '../../../../../website/server/libs/stringUtils';
 import bannedWords from '../../../../../website/server/libs/bannedWords';
@@ -81,6 +82,10 @@ describe('POST /chat', () => {
  });

  describe('mute user', () => {
+    afterEach(() => {
+      member.update({'flags.chatRevoked': false});
+    });
+
    it('returns an error when chat privileges are revoked when sending a message to a public guild', async () => {
      const userWithChatRevoked = await member.update({'flags.chatRevoked': true});
      await expect(userWithChatRevoked.post(`/groups/${groupWithChat._id}/chat`, { message: testMessage})).to.eventually.be.rejected.and.eql({
@@ -89,6 +94,129 @@ describe('POST /chat', () => {
        message: t('chatPrivilegesRevoked'),
      });
    });
+
+    it('does not error when chat privileges are revoked when sending a message to a private guild', async () => {
+      const { group, members } = await createAndPopulateGroup({
+        groupDetails: {
+          name: 'Private Guild',
+          type: 'guild',
+          privacy: 'private',
+        },
+        members: 1,
+      });
+
+      const privateGuildMemberWithChatsRevoked = members[0];
+      await privateGuildMemberWithChatsRevoked.update({'flags.chatRevoked': true});
+
+      const message = await privateGuildMemberWithChatsRevoked.post(`/groups/${group._id}/chat`, { message: testMessage});
+
+      expect(message.message.id).to.exist;
+    });
+
+    it('does not error when chat privileges are revoked when sending a message to a party', async () => {
+      const { group, members } = await createAndPopulateGroup({
+        groupDetails: {
+          name: 'Party',
+          type: 'party',
+          privacy: 'private',
+        },
+        members: 1,
+      });
+
+      const privatePartyMemberWithChatsRevoked = members[0];
+      await privatePartyMemberWithChatsRevoked.update({'flags.chatRevoked': true});
+
+      const message = await privatePartyMemberWithChatsRevoked.post(`/groups/${group._id}/chat`, { message: testMessage});
+
+      expect(message.message.id).to.exist;
+    });
+  });
+
+  describe('shadow-mute user', () => {
+    beforeEach(() => {
+      sandbox.spy(email, 'sendTxn');
+      sandbox.stub(IncomingWebhook.prototype, 'send');
+    });
+
+    afterEach(() => {
+      sandbox.restore();
+      member.update({'flags.chatShadowMuted': false});
+    });
+
+    it('creates a chat with flagCount already set and notifies mods when sending a message to a public guild', async () => {
+      const userWithChatShadowMuted = await member.update({'flags.chatShadowMuted': true});
+      const message = await userWithChatShadowMuted.post(`/groups/${groupWithChat._id}/chat`, { message: testMessage});
+      expect(message.message.id).to.exist;
+      expect(message.message.flagCount).to.eql(CHAT_FLAG_FROM_SHADOW_MUTE);
+
+      // Email sent to mods
+      await sleep(0.5);
+      expect(email.sendTxn).to.be.calledOnce;
+      expect(email.sendTxn.args[0][1]).to.eql('shadow-muted-post-report-to-mods');
+
+      // Slack message to mods
+      expect(IncomingWebhook.prototype.send).to.be.calledOnce;
+      /* eslint-disable camelcase */
+      expect(IncomingWebhook.prototype.send).to.be.calledWith({
+        text: `@${member.auth.local.username} / ${member.profile.name} posted while shadow-muted`,
+        attachments: [{
+          fallback: 'Shadow-Muted Message',
+          color: 'danger',
+          author_name: `@${member.auth.local.username} ${member.profile.name} (${member.auth.local.email}; ${member._id})`,
+          title: 'Shadow-Muted Post in Test Guild',
+          title_link: `${BASE_URL}/groups/guild/${groupWithChat.id}`,
+          text: testMessage,
+          mrkdwn_in: [
+            'text',
+          ],
+        }],
+      });
+      /* eslint-enable camelcase */
+    });
+
+    it('creates a chat with zero flagCount when sending a message to a private guild', async () => {
+      const { group, members } = await createAndPopulateGroup({
+        groupDetails: {
+          name: 'Private Guild',
+          type: 'guild',
+          privacy: 'private',
+        },
+        members: 1,
+      });
+
+      const userWithChatShadowMuted = members[0];
+      await userWithChatShadowMuted.update({'flags.chatShadowMuted': true});
+
+      const message = await userWithChatShadowMuted.post(`/groups/${group._id}/chat`, { message: testMessage});
+
+      expect(message.message.id).to.exist;
+      expect(message.message.flagCount).to.eql(0);
+    });
+
+    it('creates a chat with zero flagCount when sending a message to a party', async () => {
+      const { group, members } = await createAndPopulateGroup({
+        groupDetails: {
+          name: 'Party',
+          type: 'party',
+          privacy: 'private',
+        },
+        members: 1,
+      });
+
+      const userWithChatShadowMuted = members[0];
+      await userWithChatShadowMuted.update({'flags.chatShadowMuted': true});
+
+      const message = await userWithChatShadowMuted.post(`/groups/${group._id}/chat`, { message: testMessage});
+
+      expect(message.message.id).to.exist;
+      expect(message.message.flagCount).to.eql(0);
+    });
+
+    it('creates a chat with zero flagCount when non-shadow-muted user sends a message to a public guild', async () => {
+      const message = await member.post(`/groups/${groupWithChat._id}/chat`, { message: testMessage});
+      expect(message.message.id).to.exist;
+      expect(message.message.flagCount).to.eql(0);
+    });
  });

  context('banned word', () => {
@@ -235,6 +363,7 @@ describe('POST /chat', () => {

    afterEach(() => {
      sandbox.restore();
+      user.update({'flags.chatRevoked': false});
    });

    it('errors and revokes privileges when chat message contains a banned slur', async () => {
@@ -257,7 +386,7 @@ describe('POST /chat', () => {
        attachments: [{
          fallback: 'Slur Message',
          color: 'danger',
-          author_name: `${user.profile.name} - ${user.auth.local.email} - ${user._id}`,
+          author_name: `@${user.auth.local.username} ${user.profile.name} (${user.auth.local.email}; ${user._id})`,
          title: 'Slur in Test Guild',
          title_link: `${BASE_URL}/groups/guild/${groupWithChat.id}`,
          text: testSlurMessage,
@@ -274,11 +403,6 @@ describe('POST /chat', () => {
        error: 'NotAuthorized',
        message: t('chatPrivilegesRevoked'),
      });
-
-      // @TODO: The next test should not depend on this. We should reset the user test in a beforeEach
-      // Restore chat privileges to continue testing
-      user.flags.chatRevoked = false;
-      await user.update({'flags.chatRevoked': false});
    });

    it('does not allow slurs in private groups', async () => {
@@ -310,7 +434,7 @@ describe('POST /chat', () => {
        attachments: [{
          fallback: 'Slur Message',
          color: 'danger',
-          author_name: `${members[0].profile.name} - ${members[0].auth.local.email} - ${members[0]._id}`,
+          author_name: `@${members[0].auth.local.username} ${members[0].profile.name} (${members[0].auth.local.email}; ${members[0]._id})`,
          title: 'Slur in Party - (private party)',
          title_link: undefined,
          text: testSlurMessage,
@@ -327,10 +451,6 @@ describe('POST /chat', () => {
        error: 'NotAuthorized',
        message: t('chatPrivilegesRevoked'),
      });
-
-      // Restore chat privileges to continue testing
-      members[0].flags.chatRevoked = false;
-      await members[0].update({'flags.chatRevoked': false});
    });

    it('errors when slur is typed in mixed case', async () => {
@@ -345,42 +465,6 @@ describe('POST /chat', () => {
    });
  });

-  it('does not error when sending a message to a private guild with a user with revoked chat', async () => {
-    let { group, members } = await createAndPopulateGroup({
-      groupDetails: {
-        name: 'Private Guild',
-        type: 'guild',
-        privacy: 'private',
-      },
-      members: 1,
-    });
-
-    let privateGuildMemberWithChatsRevoked = members[0];
-    await privateGuildMemberWithChatsRevoked.update({'flags.chatRevoked': true});
-
-    let message = await privateGuildMemberWithChatsRevoked.post(`/groups/${group._id}/chat`, { message: testMessage});
-
-    expect(message.message.id).to.exist;
-  });
-
-  it('does not error when sending a message to a party with a user with revoked chat', async () => {
-    let { group, members } = await createAndPopulateGroup({
-      groupDetails: {
-        name: 'Party',
-        type: 'party',
-        privacy: 'private',
-      },
-      members: 1,
-    });
-
-    let privatePartyMemberWithChatsRevoked = members[0];
-    await privatePartyMemberWithChatsRevoked.update({'flags.chatRevoked': true});
-
-    let message = await privatePartyMemberWithChatsRevoked.post(`/groups/${group._id}/chat`, { message: testMessage});
-
-    expect(message.message.id).to.exist;
-  });
-
  it('creates a chat', async () => {
    const newMessage = await user.post(`/groups/${groupWithChat._id}/chat`, { message: testMessage});
    const groupMessages = await user.get(`/groups/${groupWithChat._id}/chat`);
@@ -486,35 +570,55 @@ describe('POST /chat', () => {
    });
  });

-  it('notifies other users of new messages for a guild', async () => {
-    let message = await user.post(`/groups/${groupWithChat._id}/chat`, { message: testMessage});
-    let memberWithNotification = await member.get('/user');
-
-    expect(message.message.id).to.exist;
-    expect(memberWithNotification.newMessages[`${groupWithChat._id}`]).to.exist;
-    expect(memberWithNotification.notifications.find(n => {
-      return n.type === 'NEW_CHAT_MESSAGE' && n.data.group.id === groupWithChat._id;
-    })).to.exist;
-  });
-
-  it('notifies other users of new messages for a party', async () => {
-    let { group, groupLeader, members } = await createAndPopulateGroup({
-      groupDetails: {
-        name: 'Test Party',
-        type: 'party',
-        privacy: 'private',
-      },
-      members: 1,
+  context('chat notifications', () => {
+    beforeEach(() => {
+      member.update({newMessages: {}, notifications: []});
    });

-    let message = await groupLeader.post(`/groups/${group._id}/chat`, { message: testMessage});
-    let memberWithNotification = await members[0].get('/user');
+    it('notifies other users of new messages for a guild', async () => {
+      let message = await user.post(`/groups/${groupWithChat._id}/chat`, { message: testMessage });
+      let memberWithNotification = await member.get('/user');

-    expect(message.message.id).to.exist;
-    expect(memberWithNotification.newMessages[`${group._id}`]).to.exist;
-    expect(memberWithNotification.notifications.find(n => {
-      return n.type === 'NEW_CHAT_MESSAGE' && n.data.group.id === group._id;
-    })).to.exist;
+      expect(message.message.id).to.exist;
+      expect(memberWithNotification.newMessages[`${groupWithChat._id}`]).to.exist;
+      expect(memberWithNotification.notifications.find(n => {
+        return n.type === 'NEW_CHAT_MESSAGE' && n.data.group.id === groupWithChat._id;
+      })).to.exist;
+    });
+
+    it('notifies other users of new messages for a party', async () => {
+      let { group, groupLeader, members } = await createAndPopulateGroup({
+        groupDetails: {
+          name: 'Test Party',
+          type: 'party',
+          privacy: 'private',
+        },
+        members: 1,
+      });
+
+      let message = await groupLeader.post(`/groups/${group._id}/chat`, { message: testMessage });
+      let memberWithNotification = await members[0].get('/user');
+
+      expect(message.message.id).to.exist;
+      expect(memberWithNotification.newMessages[`${group._id}`]).to.exist;
+      expect(memberWithNotification.notifications.find(n => {
+        return n.type === 'NEW_CHAT_MESSAGE' && n.data.group.id === group._id;
+      })).to.exist;
+    });
+
+    it('does not notify other users of a new message that is already hidden from shadow-muting', async () => {
+      await user.update({'flags.chatShadowMuted': true});
+      let message = await user.post(`/groups/${groupWithChat._id}/chat`, { message: testMessage });
+      let memberWithNotification = await member.get('/user');
+
+      await user.update({'flags.chatShadowMuted': false});
+
+      expect(message.message.id).to.exist;
+      expect(memberWithNotification.newMessages[`${groupWithChat._id}`]).to.not.exist;
+      expect(memberWithNotification.notifications.find(n => {
+        return n.type === 'NEW_CHAT_MESSAGE' && n.data.group.id === groupWithChat._id;
+      })).to.not.exist;
+    });
  });

  context('Spam prevention', () => {
@@ -533,7 +637,7 @@ describe('POST /chat', () => {
    });

    it('contributor should not receive spam alert', async () => {
-      let userSocialite = await member.update({'contributor.level': SPAM_MIN_EXEMPT_CONTRIB_LEVEL, 'flags.chatRevoked': false});
+      let userSocialite = await member.update({'contributor.level': SPAM_MIN_EXEMPT_CONTRIB_LEVEL});

      // Post 1 more message than the spam limit to ensure they do not reach the limit
      for (let i = 0; i < SPAM_MESSAGE_LIMIT + 1; i++) {
--- a/test/api/v3/integration/groups/POST-group_remove_manager.test.js
+++ b/test/api/v3/integration/groups/POST-group_remove_manager.test.js
@@ -21,13 +21,13 @@ describe('POST /group/:groupId/remove-manager', () => {
        type: groupType,
        privacy: 'public',
      },
-      members: 1,
+      members: 2,
    });

    groupToUpdate = group;
    leader = groupLeader;
    nonLeader = members[0];
-    nonManager = members[0];
+    nonManager = members[1];
  });

  it('returns an error when a non group leader tries to add member', async () => {
@@ -71,10 +71,10 @@ describe('POST /group/:groupId/remove-manager', () => {
      type: 'todo',
      requiresApproval: true,
    });
-    await nonLeader.post(`/tasks/${task._id}/assign/${leader._id}`);
-    let memberTasks = await leader.get('/tasks/user');
+    await nonLeader.post(`/tasks/${task._id}/assign/${nonManager._id}`);
+    let memberTasks = await nonManager.get('/tasks/user');
    let syncedTask = find(memberTasks, findAssignedTask);
-    await expect(leader.post(`/tasks/${syncedTask._id}/score/up`))
+    await expect(nonManager.post(`/tasks/${syncedTask._id}/score/up`))
      .to.eventually.be.rejected.and.to.eql({
        code: 401,
        error: 'NotAuthorized',
--- a/test/api/v3/integration/groups/POST-groups.test.js
+++ b/test/api/v3/integration/groups/POST-groups.test.js
@@ -149,7 +149,7 @@ describe('POST /group', () => {
        ).to.eventually.be.rejected.and.eql({
          code: 401,
          error: 'NotAuthorized',
-          message: t('cannotCreatePublicGuildWhenMuted'),
+          message: t('chatPrivilegesRevoked'),
        });
      });
    });
--- a/test/api/v3/integration/groups/POST-groups_groupId_leave.js
+++ b/test/api/v3/integration/groups/POST-groups_groupId_leave.js
@@ -276,44 +276,70 @@ describe('POST /groups/:groupId/leave', () => {
    });
  });

-  context('Leaving a group plan', () => {
-    it('cancels the free subscription', async () => {
-      // Create group
-      let { group, groupLeader, members } = await createAndPopulateGroup({
-        groupDetails: {
-          name: 'Test Private Guild',
-          type: 'guild',
-        },
-        members: 1,
+  each(typesOfGroups, (groupDetails, groupType) => {
+    context(`Leaving a group plan when the group is a ${groupType}`, () => {
+      let groupWithPlan;
+      let leader;
+      let member;
+
+      beforeEach(async () => {
+        let { group, groupLeader, members } = await createAndPopulateGroup({
+          groupDetails,
+          members: 1,
+        });
+        leader = groupLeader;
+        member = members[0];
+        groupWithPlan = group;
+        let userWithFreePlan = await User.findById(leader._id).exec();
+
+        // Create subscription
+        let paymentData = {
+          user: userWithFreePlan,
+          groupId: groupWithPlan._id,
+          sub: {
+            key: 'basic_3mo',
+          },
+          customerId: 'customer-id',
+          paymentMethod: 'Payment Method',
+          headers: {
+            'x-client': 'habitica-web',
+            'user-agent': '',
+          },
+        };
+        await payments.createSubscription(paymentData);
+        await member.sync();
      });

-      let leader = groupLeader;
-      let member = members[0];
-      let userWithFreePlan = await User.findById(leader._id).exec();
+      it('cancels the free subscription', async () => {
+        expect(member.purchased.plan.planId).to.equal('group_plan_auto');
+        expect(member.purchased.plan.dateTerminated).to.not.exist;

-      // Create subscription
-      let paymentData = {
-        user: userWithFreePlan,
-        groupId: group._id,
-        sub: {
-          key: 'basic_3mo',
-        },
-        customerId: 'customer-id',
-        paymentMethod: 'Payment Method',
-        headers: {
-          'x-client': 'habitica-web',
-          'user-agent': '',
-        },
-      };
-      await payments.createSubscription(paymentData);
-      await member.sync();
-      expect(member.purchased.plan.planId).to.equal('group_plan_auto');
-      expect(member.purchased.plan.dateTerminated).to.not.exist;
+        // Leave
+        await member.post(`/groups/${groupWithPlan._id}/leave`);
+        await member.sync();
+        expect(member.purchased.plan.dateTerminated).to.exist;
+      });

-      // Leave
-      await member.post(`/groups/${group._id}/leave`);
-      await member.sync();
-      expect(member.purchased.plan.dateTerminated).to.exist;
+      it('preserves the free subscription when leaving a any other group without a plan', async () => {
+        // Joining a guild without a group plan
+        let { group: groupWithNoPlan } = await createAndPopulateGroup({
+          groupDetails: {
+            name: 'Group Without Plan',
+            type: 'guild',
+            privacy: 'public',
+          },
+        });
+
+        await member.post(`/groups/${groupWithNoPlan._id}/join`);
+        await member.sync();
+        expect(member.purchased.plan.planId).to.equal('group_plan_auto');
+        expect(member.purchased.plan.dateTerminated).to.not.exist;
+
+        // Leaving the guild without a group plan
+        await member.post(`/groups/${groupWithNoPlan._id}/leave`);
+        await member.sync();
+        expect(member.purchased.plan.dateTerminated).to.not.exist;
+      });
    });
  });
 });
--- a/test/api/v3/integration/groups/POST-groups_invite.test.js
+++ b/test/api/v3/integration/groups/POST-groups_invite.test.js
@@ -100,7 +100,7 @@ describe('Post /groups/:groupId/invite', () => {
        .to.eventually.be.rejected.and.eql({
          code: 401,
          error: 'NotAuthorized',
-          message: t('cannotInviteWhenMuted'),
+          message: t('chatPrivilegesRevoked'),
        });
    });

@@ -262,7 +262,7 @@ describe('Post /groups/:groupId/invite', () => {
        .to.eventually.be.rejected.and.eql({
          code: 401,
          error: 'NotAuthorized',
-          message: t('cannotInviteWhenMuted'),
+          message: t('chatPrivilegesRevoked'),
        });
    });

@@ -436,7 +436,7 @@ describe('Post /groups/:groupId/invite', () => {
        .to.eventually.be.rejected.and.eql({
          code: 401,
          error: 'NotAuthorized',
-          message: t('cannotInviteWhenMuted'),
+          message: t('chatPrivilegesRevoked'),
        });
    });

@@ -526,7 +526,7 @@ describe('Post /groups/:groupId/invite', () => {
        .to.eventually.be.rejected.and.eql({
          code: 401,
          error: 'NotAuthorized',
-          message: t('cannotInviteWhenMuted'),
+          message: t('chatPrivilegesRevoked'),
        });
    });

--- a/test/api/v3/integration/hall/GET-hall_heroes_heroId.test.js
+++ b/test/api/v3/integration/hall/GET-hall_heroes_heroId.test.js
@@ -25,9 +25,9 @@ describe('GET /heroes/:heroId', () => {

  it('validates req.params.heroId', async () => {
    await expect(user.get('/hall/heroes/invalidUUID')).to.eventually.be.rejected.and.eql({
-      code: 400,
-      error: 'BadRequest',
-      message: t('invalidReqParams'),
+      code: 404,
+      error: 'NotFound',
+      message: t('userWithIDNotFound', {userId: 'invalidUUID'}),
    });
  });

@@ -40,7 +40,7 @@ describe('GET /heroes/:heroId', () => {
    });
  });

-  it('returns only necessary hero data', async () => {
+  it('returns only necessary hero data given user id', async () => {
    let hero = await generateUser({
      contributor: {tier: 23},
    });
@@ -53,4 +53,24 @@ describe('GET /heroes/:heroId', () => {
    expect(heroRes.auth.local).not.to.have.keys(['salt', 'hashed_password']);
    expect(heroRes.profile).to.have.all.keys(['name']);
  });
+
+  it('returns only necessary hero data given username', async () => {
+    let hero = await generateUser({
+      contributor: {tier: 23},
+    });
+    let heroRes = await user.get(`/hall/heroes/${hero.auth.local.username}`);
+
+    expect(heroRes).to.have.all.keys([ // works as: object has all and only these keys
+      '_id', 'id', 'balance', 'profile', 'purchased',
+      'contributor', 'auth', 'items',
+    ]);
+    expect(heroRes.auth.local).not.to.have.keys(['salt', 'hashed_password']);
+    expect(heroRes.profile).to.have.all.keys(['name']);
+  });
+
+  it('returns correct hero using search with difference case', async () => {
+    await generateUser({}, { username: 'TestUpperCaseName123' });
+    let heroRes = await user.get('/hall/heroes/TestuPPerCasEName123');
+    expect(heroRes.auth.local.username).to.equal('TestUpperCaseName123');
+  });
 });
--- a/test/api/v3/integration/hall/PUT-hall_heores_heroId.test.js
+++ b/test/api/v3/integration/hall/PUT-hall_heores_heroId.test.js
@@ -105,16 +105,22 @@ describe('PUT /heroes/:heroId', () => {

  it('updates chatRevoked flag', async () => {
    let hero = await generateUser();
-
    await user.put(`/hall/heroes/${hero._id}`, {
      flags: {chatRevoked: true},
    });
-
    await hero.sync();
-
    expect(hero.flags.chatRevoked).to.eql(true);
  });

+  it('updates chatShadowMuted flag', async () => {
+    let hero = await generateUser();
+    await user.put(`/hall/heroes/${hero._id}`, {
+      flags: {chatShadowMuted: true},
+    });
+    await hero.sync();
+    expect(hero.flags.chatShadowMuted).to.eql(true);
+  });
+
  it('updates contributor level', async () => {
    let hero = await generateUser({
      contributor: {level: 5},
--- a/test/api/v3/integration/inbox/GET-inbox_messages.test.js
+++ b/test/api/v3/integration/inbox/GET-inbox_messages.test.js
@@ -6,7 +6,7 @@ describe('GET /inbox/messages', () => {
  let user;
  let otherUser;

-  before(async () => {
+  beforeEach(async () => {
    [user, otherUser] = await Promise.all([generateUser(), generateUser()]);

    await otherUser.post('/members/send-private-message', {
@@ -27,8 +27,6 @@ describe('GET /inbox/messages', () => {
      toUserId: user.id,
      message: 'fourth',
    });
-
-    await user.sync();
  });

  it('returns the user inbox messages as an array of ordered messages (from most to least recent)', async () => {
@@ -45,4 +43,27 @@ describe('GET /inbox/messages', () => {
    expect(messages[2].text).to.equal('second');
    expect(messages[3].text).to.equal('first');
  });
+
+  it('returns four messages when using page-query ', async () => {
+    const promises = [];
+
+    for (let i = 0; i < 10; i++) {
+      promises.push(user.post('/members/send-private-message', {
+        toUserId: user.id,
+        message: 'fourth',
+      }));
+    }
+
+    await Promise.all(promises);
+
+    const messages = await user.get('/inbox/messages?page=1');
+
+    expect(messages.length).to.equal(4);
+  });
+
+  it('returns only the messages of one conversation', async () => {
+    const messages = await user.get(`/inbox/messages?conversation=${otherUser.id}`);
+
+    expect(messages.length).to.equal(3);
+  });
 });
--- a/test/api/v3/integration/notifications/POST-notifications_notificationId_read.test.js
+++ b/test/api/v3/integration/notifications/POST-notifications_notificationId_read.test.js
@@ -16,7 +16,7 @@ describe('POST /notifications/:notificationId/read', () => {

    await expect(user.post(`/notifications/${dummyId}/read`)).to.eventually.be.rejected.and.eql({
      code: 404,
-      error: 'NotFound',
+      error: 'NotificationNotFound',
      message: t('messageNotificationNotFound'),
    });
  });
--- a/test/api/v3/integration/notifications/POST-notifications_notificationId_see.test.js
+++ b/test/api/v3/integration/notifications/POST-notifications_notificationId_see.test.js
@@ -16,7 +16,7 @@ describe('POST /notifications/:notificationId/see', () => {

    await expect(user.post(`/notifications/${dummyId}/see`)).to.eventually.be.rejected.and.eql({
      code: 404,
-      error: 'NotFound',
+      error: 'NotificationNotFound',
      message: t('messageNotificationNotFound'),
    });
  });
--- a/test/api/v3/integration/notifications/POST-notifications_read.test.js
+++ b/test/api/v3/integration/notifications/POST-notifications_read.test.js
@@ -18,7 +18,7 @@ describe('POST /notifications/read', () => {
      notificationIds: [dummyId],
    })).to.eventually.be.rejected.and.eql({
      code: 404,
-      error: 'NotFound',
+      error: 'NotificationNotFound',
      message: t('messageNotificationNotFound'),
    });
  });
--- a/test/api/v3/integration/notifications/POST_notifications_see.test.js
+++ b/test/api/v3/integration/notifications/POST_notifications_see.test.js
@@ -18,7 +18,7 @@ describe('POST /notifications/see', () => {
      notificationIds: [dummyId],
    })).to.eventually.be.rejected.and.eql({
      code: 404,
-      error: 'NotFound',
+      error: 'NotificationNotFound',
      message: t('messageNotificationNotFound'),
    });
  });
--- a/test/api/v3/integration/payments/apple/POST-payments_apple_norenewsubscribe.test.js
+++ b/test/api/v3/integration/payments/apple/POST-payments_apple_norenewsubscribe.test.js
@@ -0,0 +1,67 @@
+import {generateUser, translate as t} from '../../../../../helpers/api-integration/v3';
+import applePayments from '../../../../../../website/server/libs/payments/apple';
+
+describe('payments : apple #norenewsubscribe', () => {
+  let endpoint = '/iap/ios/norenew-subscribe';
+  let sku = 'com.habitrpg.ios.habitica.subscription.3month';
+  let user;
+
+  beforeEach(async () => {
+    user = await generateUser();
+  });
+
+  it('verifies sub key', async () => {
+    await expect(user.post(endpoint)).to.eventually.be.rejected.and.eql({
+      code: 400,
+      error: 'BadRequest',
+      message: t('missingSubscriptionCode'),
+    });
+  });
+
+  it('verifies receipt existence', async () => {
+    await expect(user.post(endpoint, {
+      sku,
+    })).to.eventually.be.rejected.and.eql({
+      code: 400,
+      error: 'BadRequest',
+      message: t('missingReceipt'),
+    });
+  });
+
+  describe('success', () => {
+    let subscribeStub;
+
+    beforeEach(async () => {
+      subscribeStub = sinon.stub(applePayments, 'noRenewSubscribe').resolves({});
+    });
+
+    afterEach(() => {
+      applePayments.noRenewSubscribe.restore();
+    });
+
+    it('makes a purchase', async () => {
+      user = await generateUser({
+        'profile.name': 'sender',
+        'purchased.plan.customerId': 'customer-id',
+        'purchased.plan.planId': 'basic_3mo',
+        'purchased.plan.lastBillingDate': new Date(),
+        balance: 2,
+      });
+
+      await user.post(endpoint, {
+        sku,
+        transaction: {receipt: 'receipt'},
+        gift: {
+          uuid: '1',
+        },
+      });
+
+      expect(subscribeStub).to.be.calledOnce;
+      expect(subscribeStub.args[0][0].user._id).to.eql(user._id);
+      expect(subscribeStub.args[0][0].sku).to.eql(sku);
+      expect(subscribeStub.args[0][0].receipt).to.eql('receipt');
+      expect(subscribeStub.args[0][0].headers['x-api-key']).to.eql(user.apiToken);
+      expect(subscribeStub.args[0][0].headers['x-api-user']).to.eql(user._id);
+    });
+  });
+});
--- a/test/api/v3/integration/payments/apple/POST-payments_google_subscribe.test.js
+++ b/test/api/v3/integration/payments/apple/POST-payments_google_subscribe.test.js
--- a/test/api/v3/integration/payments/apple/POST-payments_apple_verifyiap.js
+++ b/test/api/v3/integration/payments/apple/POST-payments_apple_verifyiap.js
@@ -1,4 +1,4 @@
-import {generateUser} from '../../../../../helpers/api-integration/v3';
+import {generateUser, translate as t} from '../../../../../helpers/api-integration/v3';
 import applePayments from '../../../../../../website/server/libs/payments/apple';

 describe('payments : apple #verify', () => {
@@ -9,6 +9,14 @@ describe('payments : apple #verify', () => {
    user = await generateUser();
  });

+  it('verifies receipt existence', async () => {
+    await expect(user.post(endpoint)).to.eventually.be.rejected.and.eql({
+      code: 400,
+      error: 'BadRequest',
+      message: t('missingReceipt'),
+    });
+  });
+
  describe('success', () => {
    let verifyStub;

@@ -31,10 +39,31 @@ describe('payments : apple #verify', () => {
        }});

      expect(verifyStub).to.be.calledOnce;
-      expect(verifyStub.args[0][0]._id).to.eql(user._id);
-      expect(verifyStub.args[0][1]).to.eql('receipt');
-      expect(verifyStub.args[0][2]['x-api-key']).to.eql(user.apiToken);
-      expect(verifyStub.args[0][2]['x-api-user']).to.eql(user._id);
+      expect(verifyStub.args[0][0].user._id).to.eql(user._id);
+      expect(verifyStub.args[0][0].receipt).to.eql('receipt');
+      expect(verifyStub.args[0][0].headers['x-api-key']).to.eql(user.apiToken);
+      expect(verifyStub.args[0][0].headers['x-api-user']).to.eql(user._id);
+    });
+
+    it('gifts a purchase', async () => {
+      user = await generateUser({
+        balance: 2,
+      });
+
+      await user.post(endpoint, {
+        transaction: {
+          receipt: 'receipt',
+        },
+        gift: {
+          uuid: '1',
+        }});
+
+      expect(verifyStub).to.be.calledOnce;
+      expect(verifyStub.args[0][0].user._id).to.eql(user._id);
+      expect(verifyStub.args[0][0].receipt).to.eql('receipt');
+      expect(verifyStub.args[0][0].gift.uuid).to.eql('1');
+      expect(verifyStub.args[0][0].headers['x-api-key']).to.eql(user.apiToken);
+      expect(verifyStub.args[0][0].headers['x-api-user']).to.eql(user._id);
    });
  });
 });
--- a/test/api/v3/integration/payments/google/POST-payments_google_norenewsubscribe.test.js
+++ b/test/api/v3/integration/payments/google/POST-payments_google_norenewsubscribe.test.js
@@ -0,0 +1,97 @@
+import {generateUser, translate as t} from '../../../../../helpers/api-integration/v3';
+import googlePayments from '../../../../../../website/server/libs/payments/google';
+
+describe('payments : google #norenewsubscribe', () => {
+  let endpoint = '/iap/android/norenew-subscribe';
+  let sku = 'com.habitrpg.android.habitica.subscription.3month';
+  let user;
+
+  beforeEach(async () => {
+    user = await generateUser();
+  });
+
+  it('verifies sub key', async () => {
+    await expect(user.post(endpoint)).to.eventually.be.rejected.and.eql({
+      code: 400,
+      error: 'BadRequest',
+      message: t('missingSubscriptionCode'),
+    });
+  });
+
+  it('verifies receipt existence', async () => {
+    await expect(user.post(endpoint, {
+      sku,
+    })).to.eventually.be.rejected.and.eql({
+      code: 400,
+      error: 'BadRequest',
+      message: t('missingReceipt'),
+    });
+  });
+
+  describe('success', () => {
+    let subscribeStub;
+
+    beforeEach(async () => {
+      subscribeStub = sinon.stub(googlePayments, 'noRenewSubscribe').resolves({});
+    });
+
+    afterEach(() => {
+      googlePayments.noRenewSubscribe.restore();
+    });
+
+    it('makes a purchase', async () => {
+      user = await generateUser({
+        'profile.name': 'sender',
+        'purchased.plan.customerId': 'customer-id',
+        'purchased.plan.planId': 'basic_3mo',
+        'purchased.plan.lastBillingDate': new Date(),
+        balance: 2,
+      });
+
+      await user.post(endpoint, {
+        sku,
+        transaction: {
+          receipt: 'receipt',
+          signature: 'signature',
+        },
+      });
+
+      expect(subscribeStub).to.be.calledOnce;
+      expect(subscribeStub.args[0][0].user._id).to.eql(user._id);
+      expect(subscribeStub.args[0][0].sku).to.eql(sku);
+      expect(subscribeStub.args[0][0].receipt).to.eql('receipt');
+      expect(subscribeStub.args[0][0].signature).to.eql('signature');
+      expect(subscribeStub.args[0][0].headers['x-api-key']).to.eql(user.apiToken);
+      expect(subscribeStub.args[0][0].headers['x-api-user']).to.eql(user._id);
+    });
+
+    it('gifts a purchase', async () => {
+      user = await generateUser({
+        'profile.name': 'sender',
+        'purchased.plan.customerId': 'customer-id',
+        'purchased.plan.planId': 'basic_3mo',
+        'purchased.plan.lastBillingDate': new Date(),
+        balance: 2,
+      });
+
+      await user.post(endpoint, {
+        sku,
+        transaction: {
+          receipt: 'receipt',
+          signature: 'signature',
+        },
+        gift: {
+          uuid: '1',
+        },
+      });
+
+      expect(subscribeStub).to.be.calledOnce;
+      expect(subscribeStub.args[0][0].user._id).to.eql(user._id);
+      expect(subscribeStub.args[0][0].sku).to.eql(sku);
+      expect(subscribeStub.args[0][0].receipt).to.eql('receipt');
+      expect(subscribeStub.args[0][0].signature).to.eql('signature');
+      expect(subscribeStub.args[0][0].headers['x-api-key']).to.eql(user.apiToken);
+      expect(subscribeStub.args[0][0].headers['x-api-user']).to.eql(user._id);
+    });
+  });
+});
--- a/test/api/v3/integration/payments/google/POST-payments_google_verifyiap.js
+++ b/test/api/v3/integration/payments/google/POST-payments_google_verifyiap.js
@@ -1,4 +1,4 @@
-import {generateUser} from '../../../../../helpers/api-integration/v3';
+import {generateUser, translate as t} from '../../../../../helpers/api-integration/v3';
 import googlePayments from '../../../../../../website/server/libs/payments/google';

 describe('payments : google #verify', () => {
@@ -9,6 +9,14 @@ describe('payments : google #verify', () => {
    user = await generateUser();
  });

+  it('verifies receipt existence', async () => {
+    await expect(user.post(endpoint)).to.eventually.be.rejected.and.eql({
+      code: 400,
+      error: 'BadRequest',
+      message: t('missingReceipt'),
+    });
+  });
+
  describe('success', () => {
    let verifyStub;

@@ -30,11 +38,30 @@ describe('payments : google #verify', () => {
      });

      expect(verifyStub).to.be.calledOnce;
-      expect(verifyStub.args[0][0]._id).to.eql(user._id);
-      expect(verifyStub.args[0][1]).to.eql('receipt');
-      expect(verifyStub.args[0][2]).to.eql('signature');
-      expect(verifyStub.args[0][3]['x-api-key']).to.eql(user.apiToken);
-      expect(verifyStub.args[0][3]['x-api-user']).to.eql(user._id);
+      expect(verifyStub.args[0][0].user._id).to.eql(user._id);
+      expect(verifyStub.args[0][0].receipt).to.eql('receipt');
+      expect(verifyStub.args[0][0].signature).to.eql('signature');
+      expect(verifyStub.args[0][0].headers['x-api-key']).to.eql(user.apiToken);
+      expect(verifyStub.args[0][0].headers['x-api-user']).to.eql(user._id);
+    });
+
+    it('gifts a purchase', async () => {
+      user = await generateUser({
+        balance: 2,
+      });
+
+      await user.post(endpoint, {
+        transaction: {receipt: 'receipt', signature: 'signature'},
+        gift: {uuid: '1'},
+      });
+
+      expect(verifyStub).to.be.calledOnce;
+      expect(verifyStub.args[0][0].user._id).to.eql(user._id);
+      expect(verifyStub.args[0][0].receipt).to.eql('receipt');
+      expect(verifyStub.args[0][0].signature).to.eql('signature');
+      expect(verifyStub.args[0][0].gift.uuid).to.eql('1');
+      expect(verifyStub.args[0][0].headers['x-api-key']).to.eql(user.apiToken);
+      expect(verifyStub.args[0][0].headers['x-api-user']).to.eql(user._id);
    });
  });
 });
--- a/test/api/v3/integration/payments/stripe/POST-payments_stripe_checkout.test.js
+++ b/test/api/v3/integration/payments/stripe/POST-payments_stripe_checkout.test.js
@@ -13,10 +13,10 @@ describe('payments - stripe - #checkout', () => {
  });

  it('verifies credentials', async () => {
-    await expect(user.post(endpoint, {id: 123})).to.eventually.be.rejected.and.eql({
+    await expect(user.post(endpoint, {id: 123})).to.eventually.be.rejected.and.include({
      code: 401,
      error: 'Error',
-      message: 'Invalid API Key provided: ****************************1111',
+      message: 'Invalid API Key provided: aaaabbbb********************1111',
    });
  });

--- a/test/api/v3/integration/quests/POST-groups_groupid_quests_abort.test.js
+++ b/test/api/v3/integration/quests/POST-groups_groupid_quests_abort.test.js
@@ -127,7 +127,13 @@ describe('POST /groups/:groupId/quests/abort', () => {
      members: {},
    });
    expect(Group.prototype.sendChat).to.be.calledOnce;
-    expect(Group.prototype.sendChat).to.be.calledWithMatch(/aborted the party quest Wail of the Whale.`/);
+    expect(Group.prototype.sendChat).to.be.calledWithMatch({
+      message: sinon.match(/aborted the party quest Wail of the Whale.`/),
+      info: {
+        quest: 'whale',
+        type: 'quest_abort',
+      },
+    });

    stub.restore();
  });
--- a/test/api/v3/integration/quests/POST-groups_groupid_quests_cancel.test.js
+++ b/test/api/v3/integration/quests/POST-groups_groupid_quests_cancel.test.js
@@ -4,6 +4,7 @@ import {
  generateUser,
 } from '../../../../helpers/api-integration/v3';
 import { v4 as generateUUID } from 'uuid';
+import { model as Group } from '../../../../../website/server/models/group';

 describe('POST /groups/:groupId/quests/cancel', () => {
  let questingGroup;
@@ -99,6 +100,10 @@ describe('POST /groups/:groupId/quests/cancel', () => {
  it('cancels a quest', async () => {
    await leader.post(`/groups/${questingGroup._id}/quests/invite/${PET_QUEST}`);
    await partyMembers[0].post(`/groups/${questingGroup._id}/quests/accept`);
+    // partyMembers[1] hasn't accepted the invitation, because if he accepts, invitation phase ends.
+    // The cancel command can be done only in the invitation phase.
+
+    let stub = sandbox.spy(Group.prototype, 'sendChat');

    let res = await leader.post(`/groups/${questingGroup._id}/quests/cancel`);

@@ -135,5 +140,16 @@ describe('POST /groups/:groupId/quests/cancel', () => {
      },
      members: {},
    });
+    expect(Group.prototype.sendChat).to.be.calledOnce;
+    expect(Group.prototype.sendChat).to.be.calledWithMatch({
+      message: sinon.match(/cancelled the party quest Wail of the Whale.`/),
+      info: {
+        quest: 'whale',
+        type: 'quest_cancel',
+        user: sinon.match.any,
+      },
+    });
+
+    stub.restore();
  });
 });
--- a/test/api/v3/integration/tasks/challenges/POST-tasks_challenge_id.test.js
+++ b/test/api/v3/integration/tasks/challenges/POST-tasks_challenge_id.test.js
@@ -54,6 +54,21 @@ describe('POST /tasks/challenge/:challengeId', () => {
    expect(tasksOrder.habits).to.include(task.id);
  });

+  it('allows non-leader admin to add tasks to a challenge when not a member', async () => {
+    const admin = await generateUser({'contributor.admin': true});
+    let task = await admin.post(`/tasks/challenge/${challenge._id}`, {
+      text: 'test habit from admin',
+      type: 'habit',
+      up: false,
+      down: true,
+      notes: 1976,
+    });
+
+    let {tasksOrder} =  await user.get(`/challenges/${challenge._id}`);
+
+    expect(tasksOrder.habits).to.include(task.id);
+  });
+
  it('returns error when user tries to create task with a alias', async () => {
    await expect(user.post(`/tasks/challenge/${challenge._id}`, {
      text: 'test habit',
--- a/test/api/v3/integration/tasks/groups/DELETE-group_tasks_id.test.js
+++ b/test/api/v3/integration/tasks/groups/DELETE-group_tasks_id.test.js
@@ -63,6 +63,38 @@ describe('Groups DELETE /tasks/:id', () => {
      });
  });

+  it('removes deleted taskʾs approval pending notifications from managers', async () => {
+    await user.post(`/groups/${guild._id}/add-manager`, {
+      managerId: member2._id,
+    });
+    await user.put(`/tasks/${task._id}/`, {
+      requiresApproval: true,
+    });
+    let memberTasks = await member.get('/tasks/user');
+    let syncedTask = find(memberTasks, findAssignedTask);
+    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
+      .to.eventually.be.rejected.and.to.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('taskApprovalHasBeenRequested'),
+      });
+
+    await user.sync();
+    await member2.sync();
+    expect(user.notifications.length).to.equal(2);
+    expect(user.notifications[1].type).to.equal('GROUP_TASK_APPROVAL');
+    expect(member2.notifications.length).to.equal(2);
+    expect(member2.notifications[1].type).to.equal('GROUP_TASK_APPROVAL');
+
+    await member2.del(`/tasks/${task._id}`);
+
+    await user.sync();
+    await member2.sync();
+
+    expect(user.notifications.length).to.equal(1);
+    expect(member2.notifications.length).to.equal(1);
+  });
+
  it('unlinks assigned user', async () => {
    await user.del(`/tasks/${task._id}`);

--- a/test/api/v3/integration/tasks/groups/GET-approvals_group_id.test.js
+++ b/test/api/v3/integration/tasks/groups/GET-approvals_group_id.test.js
@@ -1,11 +1,10 @@
 import {
  createAndPopulateGroup,
-  translate as t,
 } from '../../../../../helpers/api-integration/v3';
 import { find } from 'lodash';

 describe('GET /approvals/group/:groupId', () => {
-  let user, guild, member, task, syncedTask;
+  let user, guild, member, addlMember, task, syncedTask, addlSyncedTask;

  function findAssignedTask (memberTask) {
    return memberTask.group.id === guild._id;
@@ -17,12 +16,13 @@ describe('GET /approvals/group/:groupId', () => {
        name: 'Test Guild',
        type: 'guild',
      },
-      members: 1,
+      members: 2,
    });

    guild = group;
    user = groupLeader;
    member = members[0];
+    addlMember = members[1];

    task = await user.post(`/tasks/group/${guild._id}`, {
      text: 'test todo',
@@ -31,37 +31,46 @@ describe('GET /approvals/group/:groupId', () => {
    });

    await user.post(`/tasks/${task._id}/assign/${member._id}`);
+    await user.post(`/tasks/${task._id}/assign/${addlMember._id}`);

    let memberTasks = await member.get('/tasks/user');
    syncedTask = find(memberTasks, findAssignedTask);

+    let addlMemberTasks = await addlMember.get('/tasks/user');
+    addlSyncedTask = find(addlMemberTasks, findAssignedTask);
+
    try {
      await member.post(`/tasks/${syncedTask._id}/score/up`);
    } catch (e) {
      // eslint-disable-next-line no-empty
    }
+
+    try {
+      await addlMember.post(`/tasks/${addlSyncedTask._id}/score/up`);
+    } catch (e) {
+      // eslint-disable-next-line no-empty
+    }
  });

-  it('errors when user is not the group leader', async () => {
-    await expect(member.get(`/approvals/group/${guild._id}`))
-      .to.eventually.be.rejected.and.to.eql({
-        code: 401,
-        error: 'NotAuthorized',
-        message: t('onlyGroupLeaderCanEditTasks'),
-      });
+  it('provides only user\'s own tasks when user is not the group leader', async () => {
+    let approvals = await member.get(`/approvals/group/${guild._id}`);
+    expect(approvals[0]._id).to.equal(syncedTask._id);
+    expect(approvals[1]).to.not.exist;
  });

-  it('gets a list of task that need approval', async () => {
+  it('allows group leaders to get a list of tasks that need approval', async () => {
    let approvals = await user.get(`/approvals/group/${guild._id}`);
    expect(approvals[0]._id).to.equal(syncedTask._id);
+    expect(approvals[1]._id).to.equal(addlSyncedTask._id);
  });

-  it('allows managers to get a list of task that need approval', async () => {
+  it('allows managers to get a list of tasks that need approval', async () => {
    await user.post(`/groups/${guild._id}/add-manager`, {
      managerId: member._id,
    });

    let approvals = await member.get(`/approvals/group/${guild._id}`);
    expect(approvals[0]._id).to.equal(syncedTask._id);
+    expect(approvals[1]._id).to.equal(addlSyncedTask._id);
  });
 });
--- a/test/api/v3/integration/tasks/groups/POST-group_tasks_id_approve_userId.test.js
+++ b/test/api/v3/integration/tasks/groups/POST-group_tasks_id_approve_userId.test.js
@@ -53,18 +53,29 @@ describe('POST /tasks/:id/approve/:userId', () => {

  it('approves an assigned user', async () => {
    await user.post(`/tasks/${task._id}/assign/${member._id}`);
-    await user.post(`/tasks/${task._id}/approve/${member._id}`);

    let memberTasks = await member.get('/tasks/user');
    let syncedTask = find(memberTasks, findAssignedTask);

+    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
+      .to.eventually.be.rejected.and.to.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('taskApprovalHasBeenRequested'),
+      });
+
+    await user.post(`/tasks/${task._id}/approve/${member._id}`);
+
    await member.sync();

-    expect(member.notifications.length).to.equal(2);
-    expect(member.notifications[0].type).to.equal('GROUP_TASK_APPROVED');
-    expect(member.notifications[0].data.message).to.equal(t('yourTaskHasBeenApproved', {taskText: task.text}));
-    expect(member.notifications[1].type).to.equal('SCORED_TASK');
+    expect(member.notifications.length).to.equal(3);
+    expect(member.notifications[1].type).to.equal('GROUP_TASK_APPROVED');
    expect(member.notifications[1].data.message).to.equal(t('yourTaskHasBeenApproved', {taskText: task.text}));
+    expect(member.notifications[2].type).to.equal('SCORED_TASK');
+    expect(member.notifications[2].data.message).to.equal(t('yourTaskHasBeenApproved', {taskText: task.text}));
+
+    memberTasks = await member.get('/tasks/user');
+    syncedTask = find(memberTasks, findAssignedTask);

    expect(syncedTask.group.approval.approved).to.be.true;
    expect(syncedTask.group.approval.approvingUser).to.equal(user._id);
@@ -77,18 +88,28 @@ describe('POST /tasks/:id/approve/:userId', () => {
    });

    await member2.post(`/tasks/${task._id}/assign/${member._id}`);
-    await member2.post(`/tasks/${task._id}/approve/${member._id}`);

    let memberTasks = await member.get('/tasks/user');
    let syncedTask = find(memberTasks, findAssignedTask);

+    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
+      .to.eventually.be.rejected.and.to.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('taskApprovalHasBeenRequested'),
+      });
+
+    await member2.post(`/tasks/${task._id}/approve/${member._id}`);
    await member.sync();

-    expect(member.notifications.length).to.equal(2);
-    expect(member.notifications[0].type).to.equal('GROUP_TASK_APPROVED');
-    expect(member.notifications[0].data.message).to.equal(t('yourTaskHasBeenApproved', {taskText: task.text}));
-    expect(member.notifications[1].type).to.equal('SCORED_TASK');
+    expect(member.notifications.length).to.equal(3);
+    expect(member.notifications[1].type).to.equal('GROUP_TASK_APPROVED');
    expect(member.notifications[1].data.message).to.equal(t('yourTaskHasBeenApproved', {taskText: task.text}));
+    expect(member.notifications[2].type).to.equal('SCORED_TASK');
+    expect(member.notifications[2].data.message).to.equal(t('yourTaskHasBeenApproved', {taskText: task.text}));
+
+    memberTasks = await member.get('/tasks/user');
+    syncedTask = find(memberTasks, findAssignedTask);

    expect(syncedTask.group.approval.approved).to.be.true;
    expect(syncedTask.group.approval.approvingUser).to.equal(member2._id);
@@ -132,6 +153,16 @@ describe('POST /tasks/:id/approve/:userId', () => {
    });

    await member2.post(`/tasks/${task._id}/assign/${member._id}`);
+
+    let memberTasks = await member.get('/tasks/user');
+    let syncedTask = find(memberTasks, findAssignedTask);
+    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
+      .to.eventually.be.rejected.and.to.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('taskApprovalHasBeenRequested'),
+      });
+
    await member2.post(`/tasks/${task._id}/approve/${member._id}`);
    await expect(user.post(`/tasks/${task._id}/approve/${member._id}`))
      .to.eventually.be.rejected.and.to.eql({
@@ -141,6 +172,17 @@ describe('POST /tasks/:id/approve/:userId', () => {
      });
  });

+  it('prevents approving a task if it is not waiting for approval', async () => {
+    await user.post(`/tasks/${task._id}/assign/${member._id}`);
+
+    await expect(user.post(`/tasks/${task._id}/approve/${member._id}`))
+      .to.eventually.be.rejected.and.to.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('taskApprovalWasNotRequested'),
+      });
+  });
+
  it('completes master task when single-completion task is approved', async () => {
    let sharedCompletionTask = await user.post(`/tasks/group/${guild._id}`, {
      text: 'shared completion todo',
@@ -151,6 +193,16 @@ describe('POST /tasks/:id/approve/:userId', () => {

    await user.post(`/tasks/${sharedCompletionTask._id}/assign/${member._id}`);
    await user.post(`/tasks/${sharedCompletionTask._id}/assign/${member2._id}`);
+
+    let memberTasks = await member.get('/tasks/user');
+    let syncedTask = find(memberTasks, findAssignedTask);
+    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
+      .to.eventually.be.rejected.and.to.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('taskApprovalHasBeenRequested'),
+      });
+
    await user.post(`/tasks/${sharedCompletionTask._id}/approve/${member._id}`);

    let groupTasks = await user.get(`/tasks/group/${guild._id}?type=completedTodos`);
@@ -172,6 +224,16 @@ describe('POST /tasks/:id/approve/:userId', () => {

    await user.post(`/tasks/${sharedCompletionTask._id}/assign/${member._id}`);
    await user.post(`/tasks/${sharedCompletionTask._id}/assign/${member2._id}`);
+
+    let memberTasks = await member.get('/tasks/user');
+    let syncedTask = find(memberTasks, findAssignedTask);
+    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
+      .to.eventually.be.rejected.and.to.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('taskApprovalHasBeenRequested'),
+      });
+
    await user.post(`/tasks/${sharedCompletionTask._id}/approve/${member._id}`);

    let member2Tasks = await member2.get('/tasks/user');
@@ -193,6 +255,16 @@ describe('POST /tasks/:id/approve/:userId', () => {

    await user.post(`/tasks/${sharedCompletionTask._id}/assign/${member._id}`);
    await user.post(`/tasks/${sharedCompletionTask._id}/assign/${member2._id}`);
+
+    let memberTasks = await member.get('/tasks/user');
+    let syncedTask = find(memberTasks, findAssignedTask);
+    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
+      .to.eventually.be.rejected.and.to.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('taskApprovalHasBeenRequested'),
+      });
+
    await user.post(`/tasks/${sharedCompletionTask._id}/approve/${member._id}`);

    let groupTasks = await user.get(`/tasks/group/${guild._id}`);
@@ -214,6 +286,25 @@ describe('POST /tasks/:id/approve/:userId', () => {

    await user.post(`/tasks/${sharedCompletionTask._id}/assign/${member._id}`);
    await user.post(`/tasks/${sharedCompletionTask._id}/assign/${member2._id}`);
+
+    let memberTasks = await member.get('/tasks/user');
+    let syncedTask = find(memberTasks, findAssignedTask);
+    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
+      .to.eventually.be.rejected.and.to.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('taskApprovalHasBeenRequested'),
+      });
+
+    let member2Tasks = await member2.get('/tasks/user');
+    let member2SyncedTask = find(member2Tasks, findAssignedTask);
+    await expect(member2.post(`/tasks/${member2SyncedTask._id}/score/up`))
+      .to.eventually.be.rejected.and.to.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('taskApprovalHasBeenRequested'),
+      });
+
    await user.post(`/tasks/${sharedCompletionTask._id}/approve/${member._id}`);
    await user.post(`/tasks/${sharedCompletionTask._id}/approve/${member2._id}`);

--- a/test/api/v3/integration/tasks/groups/POST-group_tasks_id_needs-work_userId.test.js
+++ b/test/api/v3/integration/tasks/groups/POST-group_tasks_id_needs-work_userId.test.js
@@ -51,7 +51,7 @@ describe('POST /tasks/:id/needs-work/:userId', () => {
      });
  });

-  it('marks as task as needing more work', async () => {
+  it('marks a task as needing more work', async () => {
    const initialNotifications = member.notifications.length;

    await user.post(`/tasks/${task._id}/assign/${member._id}`);
@@ -77,7 +77,7 @@ describe('POST /tasks/:id/needs-work/:userId', () => {
    expect(syncedTask.group.approval.requestedDate).to.equal(undefined);

    // Check that the notification is correct
-    expect(member.notifications.length).to.equal(initialNotifications + 1);
+    expect(member.notifications.length).to.equal(initialNotifications + 2);
    const notification = member.notifications[member.notifications.length - 1];
    expect(notification.type).to.equal('GROUP_TASK_NEEDS_WORK');

@@ -131,7 +131,7 @@ describe('POST /tasks/:id/needs-work/:userId', () => {
    expect(syncedTask.group.approval.requested).to.equal(false);
    expect(syncedTask.group.approval.requestedDate).to.equal(undefined);

-    expect(member.notifications.length).to.equal(initialNotifications + 1);
+    expect(member.notifications.length).to.equal(initialNotifications + 2);
    const notification = member.notifications[member.notifications.length - 1];
    expect(notification.type).to.equal('GROUP_TASK_NEEDS_WORK');

@@ -167,6 +167,17 @@ describe('POST /tasks/:id/needs-work/:userId', () => {
    });

    await member2.post(`/tasks/${task._id}/assign/${member._id}`);
+
+    let memberTasks = await member.get('/tasks/user');
+    let syncedTask = find(memberTasks, findAssignedTask);
+
+    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
+      .to.eventually.be.rejected.and.to.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('taskApprovalHasBeenRequested'),
+      });
+
    await member2.post(`/tasks/${task._id}/approve/${member._id}`);
    await expect(user.post(`/tasks/${task._id}/needs-work/${member._id}`))
      .to.eventually.be.rejected.and.to.eql({
--- a/test/api/v3/integration/tasks/groups/POST-group_tasks_id_score_direction.test.js
+++ b/test/api/v3/integration/tasks/groups/POST-group_tasks_id_score_direction.test.js
@@ -129,6 +129,13 @@ describe('POST /tasks/:id/score/:direction', () => {
    let memberTasks = await member.get('/tasks/user');
    let syncedTask = find(memberTasks, findAssignedTask);

+    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
+      .to.eventually.be.rejected.and.to.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('taskApprovalHasBeenRequested'),
+      });
+
    await user.post(`/tasks/${task._id}/approve/${member._id}`);

    await member.post(`/tasks/${syncedTask._id}/score/up`);
--- a/test/api/v3/integration/tasks/groups/POST-tasks_group_id_assign_user_id.test.js
+++ b/test/api/v3/integration/tasks/groups/POST-tasks_group_id_assign_user_id.test.js
@@ -93,13 +93,23 @@ describe('POST /tasks/:taskId/assign/:memberId', () => {
    expect(syncedTask).to.exist;
  });

-  it('sends a message to the group when a user claims a task', async () => {
+  it('sends notifications to group leader and managers when a task is claimed', async () => {
+    await user.post(`/groups/${guild._id}/add-manager`, {
+      managerId: member2._id,
+    });
    await member.post(`/tasks/${task._id}/assign/${member._id}`);
+    await user.sync();
+    await member2.sync();
+    let groupTask = await user.get(`/tasks/group/${guild._id}`);

-    let updateGroup = await user.get(`/groups/${guild._id}`);
-
-    expect(updateGroup.chat[0].text).to.equal(t('userIsClamingTask', {username: member.profile.name, task: task.text}));
-    expect(updateGroup.chat[0].uuid).to.equal('system');
+    expect(user.notifications.length).to.equal(2); // includes Guild Joined achievement
+    expect(user.notifications[1].type).to.equal('GROUP_TASK_CLAIMED');
+    expect(user.notifications[1].data.taskId).to.equal(groupTask[0]._id);
+    expect(user.notifications[1].data.groupId).to.equal(guild._id);
+    expect(member2.notifications.length).to.equal(1);
+    expect(member2.notifications[0].type).to.equal('GROUP_TASK_CLAIMED');
+    expect(member2.notifications[0].data.taskId).to.equal(groupTask[0]._id);
+    expect(member2.notifications[0].data.groupId).to.equal(guild._id);
  });

  it('assigns a task to a user', async () => {
@@ -113,6 +123,17 @@ describe('POST /tasks/:taskId/assign/:memberId', () => {
    expect(syncedTask).to.exist;
  });

+  it('sends a notification to assigned user', async () => {
+    await user.post(`/tasks/${task._id}/assign/${member._id}`);
+    await member.sync();
+
+    let groupTask = await user.get(`/tasks/group/${guild._id}`);
+
+    expect(member.notifications.length).to.equal(1);
+    expect(member.notifications[0].type).to.equal('GROUP_TASK_ASSIGNED');
+    expect(member.notifications[0].taskId).to.equal(groupTask._id);
+  });
+
  it('assigns a task to multiple users', async () => {
    await user.post(`/tasks/${task._id}/assign/${member._id}`);
    await user.post(`/tasks/${task._id}/assign/${member2._id}`);
--- a/test/api/v3/integration/tasks/groups/POST-tasks_task_id_unassign.test.js
+++ b/test/api/v3/integration/tasks/groups/POST-tasks_task_id_unassign.test.js
@@ -86,6 +86,13 @@ describe('POST /tasks/:taskId/unassign/:memberId', () => {
    expect(syncedTask).to.not.exist;
  });

+  it('removes task assignment notification from unassigned user', async () => {
+    await user.post(`/tasks/${task._id}/unassign/${member._id}`);
+
+    await member.sync();
+    expect(member.notifications.length).to.equal(0);
+  });
+
  it('unassigns a user and only that user from a task', async () => {
    await user.post(`/tasks/${task._id}/assign/${member2._id}`);

--- a/test/api/v3/integration/tasks/groups/PUT-group_task_id.test.js
+++ b/test/api/v3/integration/tasks/groups/PUT-group_task_id.test.js
@@ -56,11 +56,11 @@ describe('PUT /tasks/:id', () => {
      requiresApproval: true,
    });

-    let memberTasks = await member.get('/tasks/user');
+    let memberTasks = await member2.get('/tasks/user');
    let syncedTask = find(memberTasks, (memberTask) => memberTask.group.taskId === task._id);

    // score up to trigger approval
-    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
+    await expect(member2.post(`/tasks/${syncedTask._id}/score/up`))
      .to.eventually.be.rejected.and.to.eql({
        code: 401,
        error: 'NotAuthorized',
--- a/test/api/v3/integration/user/POST-user_open_mystery_item.test.js
+++ b/test/api/v3/integration/user/POST-user_open_mystery_item.test.js
@@ -9,6 +9,7 @@ describe('POST /user/open-mystery-item', () => {
  let mysteryItemKey = 'eyewear_special_summerRogue';
  let mysteryItemIndex = content.gear.flat[mysteryItemKey].index;
  let mysteryItemType = content.gear.flat[mysteryItemKey].type;
+  let mysteryItemText = content.gear.flat[mysteryItemKey].text();

  beforeEach(async () => {
    user = await generateUser({
@@ -32,5 +33,6 @@ describe('POST /user/open-mystery-item', () => {
    expect(response.data.key).to.eql(mysteryItemKey);
    expect(response.data.index).to.eql(mysteryItemIndex);
    expect(response.data.type).to.eql(mysteryItemType);
+    expect(response.data.text).to.eql(mysteryItemText);
  });
 });
--- a/test/api/v3/integration/user/POST-user_purchase_hourglass.test.js
+++ b/test/api/v3/integration/user/POST-user_purchase_hourglass.test.js
@@ -14,7 +14,7 @@ describe('POST /user/purchase-hourglass/:type/:key', () => {

  // More tests in common code unit tests

-  it('buys a hourglass pet', async () => {
+  it('buys an hourglass pet', async () => {
    let response = await user.post('/user/purchase-hourglass/pets/MantisShrimp-Base');
    await user.sync();

@@ -22,4 +22,22 @@ describe('POST /user/purchase-hourglass/:type/:key', () => {
    expect(user.purchased.plan.consecutive.trinkets).to.eql(1);
    expect(user.items.pets['MantisShrimp-Base']).to.eql(5);
  });
+
+  it('buys an hourglass quest', async () => {
+    let response = await user.post('/user/purchase-hourglass/quests/robot');
+    await user.sync();
+
+    expect(response.message).to.eql(t('hourglassPurchase'));
+    expect(user.purchased.plan.consecutive.trinkets).to.eql(1);
+    expect(user.items.quests.robot).to.eql(1);
+  });
+
+  it('buys multiple hourglass quests', async () => {
+    let response = await user.post('/user/purchase-hourglass/quests/robot', {quantity: 2});
+    await user.sync();
+
+    expect(response.message).to.eql(t('hourglassPurchase'));
+    expect(user.purchased.plan.consecutive.trinkets).to.eql(0);
+    expect(user.items.quests.robot).to.eql(2);
+  });
 });
--- a/test/api/v3/integration/user/auth/POST-login-local.test.js
+++ b/test/api/v3/integration/user/auth/POST-login-local.test.js
@@ -110,4 +110,22 @@ describe('POST /user/auth/local/login', () => {
    let isValidPassword = await bcryptCompare(textPassword, user.auth.local.hashed_password);
    expect(isValidPassword).to.equal(true);
  });
+
+  it('user uses social authentication and has no password', async () => {
+    await user.unset({
+      'auth.local.hashed_password': 1,
+    });
+
+    await user.sync();
+    expect(user.auth.local.hashed_password).to.be.undefined;
+
+    await expect(api.post(endpoint, {
+      username: user.auth.local.username,
+      password: 'any-password',
+    })).to.eventually.be.rejected.and.eql({
+      code: 401,
+      error: 'NotAuthorized',
+      message: t('invalidLoginCredentialsLong'),
+    });
+  });
 });
--- a/test/api/v3/integration/webhook/GET-user-webhook.test.js
+++ b/test/api/v3/integration/webhook/GET-user-webhook.test.js
@@ -0,0 +1,33 @@
+import { generateUser } from '../../../../helpers/api-integration/v3';
+
+describe('GET /user/webhook', () => {
+  let user;
+
+  beforeEach(async () => {
+    user = await generateUser();
+
+    await user.post('/user/webhook', {
+      url: 'http://some-url.com',
+      label: 'Label',
+      enabled: true,
+      type: 'taskActivity',
+      options: { created: true, scored: true },
+    });
+    await user.post('/user/webhook', {
+      url: 'http://some-other-url.com',
+      enabled: false,
+    });
+
+    await user.sync();
+  });
+
+  it('returns users webhooks', async () => {
+    let response = await user.get('/user/webhook');
+
+    expect(response).to.eql(user.webhooks.map(w => {
+      w.createdAt = w.createdAt.toISOString();
+      w.updatedAt = w.updatedAt.toISOString();
+      return w;
+    }));
+  });
+});
--- a/test/api/v4/inbox/DELETE-inbox_messages_messageId.test.js
+++ b/test/api/v4/inbox/DELETE-inbox_messages_messageId.test.js
@@ -44,7 +44,7 @@ describe('DELETE /inbox/messages/:messageId', () => {
  });

  it('deletes one message', async () => {
-    const messages = await user.get('/inbox/messages');
+    const messages = await user.get('/inbox/paged-messages');

    expect(messages.length).to.equal(3);

@@ -53,10 +53,10 @@ describe('DELETE /inbox/messages/:messageId', () => {
    expect(messages[2].text).to.equal('first');

    await user.del(`/inbox/messages/${messages[1]._id}`);
-    const updatedMessages = await user.get('/inbox/messages');
+    const updatedMessages = await user.get('/inbox/paged-messages');
    expect(updatedMessages.length).to.equal(2);

    expect(updatedMessages[0].text).to.equal('third');
    expect(updatedMessages[1].text).to.equal('first');
  });
-});
+});
--- a/test/api/v4/inbox/GET-inbox-conversations.test.js
+++ b/test/api/v4/inbox/GET-inbox-conversations.test.js
@@ -0,0 +1,92 @@
+import {
+  generateUser,
+} from '../../../helpers/api-integration/v4';
+
+describe('GET /inbox/conversations', () => {
+  let user;
+  let otherUser;
+  let thirdUser;
+
+  beforeEach(async () => {
+    [user, otherUser, thirdUser] = await Promise.all([generateUser(), generateUser(), generateUser()]);
+
+    await otherUser.post('/members/send-private-message', {
+      toUserId: user.id,
+      message: 'first',
+    });
+    await user.post('/members/send-private-message', {
+      toUserId: otherUser.id,
+      message: 'second',
+    });
+    await user.post('/members/send-private-message', {
+      toUserId: thirdUser.id,
+      message: 'third',
+    });
+    await otherUser.post('/members/send-private-message', {
+      toUserId: user.id,
+      message: 'fourth',
+    });
+
+    // message to yourself
+    await user.post('/members/send-private-message', {
+      toUserId: user.id,
+      message: 'fifth',
+    });
+  });
+
+  it('returns the conversations', async () => {
+    const result = await user.get('/inbox/conversations');
+
+    expect(result.length).to.be.equal(3);
+    expect(result[0].user).to.be.equal(user.profile.name);
+    expect(result[0].username).to.be.equal(user.auth.local.username);
+    expect(result[0].text).to.be.not.empty;
+  });
+
+  it('returns the user inbox messages as an array of ordered messages (from most to least recent)', async () => {
+    const messages = await user.get('/inbox/paged-messages');
+
+    expect(messages.length).to.equal(5);
+
+    // message to yourself
+    expect(messages[0].text).to.equal('fifth');
+    expect(messages[0].sent).to.equal(false);
+    expect(messages[0].uuid).to.equal(user._id);
+
+    expect(messages[1].text).to.equal('fourth');
+    expect(messages[2].text).to.equal('third');
+    expect(messages[3].text).to.equal('second');
+    expect(messages[4].text).to.equal('first');
+  });
+
+  it('returns four messages when using page-query ', async () => {
+    const promises = [];
+
+    for (let i = 0; i < 10; i++) {
+      promises.push(user.post('/members/send-private-message', {
+        toUserId: user.id,
+        message: 'fourth',
+      }));
+    }
+
+    await Promise.all(promises);
+
+    const messages = await user.get('/inbox/paged-messages?page=1');
+
+    expect(messages.length).to.equal(5);
+  });
+
+  it('returns only the messages of one conversation', async () => {
+    const messages = await user.get(`/inbox/paged-messages?conversation=${otherUser.id}`);
+
+    expect(messages.length).to.equal(3);
+  });
+
+  it('returns the correct message format', async () => {
+    const messages = await otherUser.get(`/inbox/paged-messages?conversation=${user.id}`);
+
+    expect(messages[0].toUUID).to.equal(user.id); // from user
+    expect(messages[1].toUUID).to.not.exist; // only filled if its from the chat partner
+    expect(messages[2].toUUID).to.equal(user.id); // from user
+  });
+});
--- a/test/api/v4/members/POST-flag_private_message.test.js
+++ b/test/api/v4/members/POST-flag_private_message.test.js
@@ -0,0 +1,74 @@
+import {
+  generateUser,
+  translate as t,
+} from '../../../helpers/api-integration/v4';
+
+describe('POST /members/flag-private-message/:messageId', () => {
+  let userToSendMessage;
+  let messageToSend = 'Test Private Message';
+
+  beforeEach(async () => {
+    userToSendMessage = await generateUser();
+  });
+
+  it('Allows players to flag their own private message', async () => {
+    let receiver = await generateUser();
+
+    await userToSendMessage.post('/members/send-private-message', {
+      message: messageToSend,
+      toUserId: receiver._id,
+    });
+
+    let senderMessages = await userToSendMessage.get('/inbox/paged-messages');
+
+    let sendersMessageInSendersInbox = _.find(senderMessages, (message) => {
+      return message.toUUID === receiver._id && message.text === messageToSend;
+    });
+
+    expect(sendersMessageInSendersInbox).to.exist;
+    await expect(userToSendMessage.post(`/members/flag-private-message/${sendersMessageInSendersInbox.id}`)).to.eventually.be.ok;
+  });
+
+  it('Flags a private message', async () => {
+    let receiver = await generateUser();
+
+    await userToSendMessage.post('/members/send-private-message', {
+      message: messageToSend,
+      toUserId: receiver._id,
+    });
+
+    let receiversMessages = await receiver.get('/inbox/paged-messages');
+
+    let sendersMessageInReceiversInbox = _.find(receiversMessages, (message) => {
+      return message.uuid === userToSendMessage._id && message.text === messageToSend;
+    });
+
+    expect(sendersMessageInReceiversInbox).to.exist;
+    await expect(receiver.post(`/members/flag-private-message/${sendersMessageInReceiversInbox.id}`)).to.eventually.be.ok;
+  });
+
+  it('Returns an error when user tries to flag a private message that is already flagged', async () => {
+    let receiver = await generateUser();
+
+    await userToSendMessage.post('/members/send-private-message', {
+      message: messageToSend,
+      toUserId: receiver._id,
+    });
+
+    let receiversMessages = await receiver.get('/inbox/paged-messages');
+
+    let sendersMessageInReceiversInbox = _.find(receiversMessages, (message) => {
+      return message.uuid === userToSendMessage._id && message.text === messageToSend;
+    });
+
+    expect(sendersMessageInReceiversInbox).to.exist;
+    await expect(receiver.post(`/members/flag-private-message/${sendersMessageInReceiversInbox.id}`)).to.eventually.be.ok;
+
+    await expect(receiver.post(`/members/flag-private-message/${sendersMessageInReceiversInbox.id}`))
+      .to.eventually.be.rejected.and.eql({
+        code: 400,
+        error: 'BadRequest',
+        message: t('messageGroupChatFlagAlreadyReported'),
+      });
+  });
+});
--- a/test/client/.babelrc
+++ b/test/client/.babelrc
@@ -11,8 +11,6 @@
  ],
  "plugins": [
    "transform-object-rest-spread",
-    "syntax-async-functions",
-    "transform-regenerator",
  ],
  "comments": false,
 }
--- a/test/client/unit/specs/components/avatar.vue.test.js
+++ b/test/client/unit/specs/components/avatar.vue.test.js
@@ -0,0 +1,300 @@
+import Avatar from 'client/components/avatar';
+import Vue from 'vue';
+import generateStore from 'client/store';
+
+context('avatar.vue', () => {
+  let Constructr;
+  let vm;
+
+  beforeEach(() => {
+    Constructr = Vue.extend(Avatar);
+
+    vm = new Constructr({
+      propsData: {
+        member: {
+          stats: {
+            buffs: {},
+          },
+          preferences: {
+            hair: {},
+          },
+          items: {
+            gear: {
+              equipped: {},
+            },
+          },
+        },
+      },
+    }).$mount();
+
+    vm.$store = generateStore();
+  });
+
+  afterEach(() => {
+    vm.$destroy();
+  });
+
+  describe('hasClass', () => {
+    beforeEach(() => {
+      vm.member = {
+        stats: { lvl: 17 },
+        preferences: { disableClasses: true },
+        flags: { classSelected: false },
+      };
+    });
+
+    it('accurately reports class status', () => {
+      expect(vm.hasClass).to.equal(false);
+
+      vm.member.preferences.disableClasses = false;
+      vm.member.flags.classSelected = true;
+
+      expect(vm.hasClass).to.equal(true);
+    });
+  });
+
+  describe('isBuffed', () => {
+    beforeEach(() => {
+      vm.member = {
+        stats: {
+          buffs: {},
+        },
+      };
+    });
+
+    it('accurately reports if buffed', () => {
+      expect(vm.isBuffed).to.equal(undefined);
+
+      vm.member.stats.buffs = { str: 1 };
+
+      expect(vm.isBuffed).to.equal(1);
+    });
+  });
+
+  describe('paddingTop', () => {
+    beforeEach(() => {
+      vm.member = {
+        items: {},
+      };
+    });
+
+    it('defaults to 28px', () => {
+      vm.avatarOnly = true;
+      expect(vm.paddingTop).to.equal('28px');
+    });
+
+    it('is 24px if user has a pet', () => {
+      vm.member.items = {
+        currentPet: { name: 'Foo' },
+      };
+
+      expect(vm.paddingTop).to.equal('24px');
+    });
+
+    it('is 0px if user has a mount', () => {
+      vm.member.items = {
+        currentMount: { name: 'Bar' },
+      };
+
+      expect(vm.paddingTop).to.equal('0px');
+    });
+
+    it('can be overriden', () => {
+      vm.overrideTopPadding = '27px';
+      expect(vm.paddingTop).to.equal('27px');
+    });
+  });
+
+  describe('costumeClass', () => {
+    beforeEach(() => {
+      vm.member = {
+        preferences: {},
+      };
+    });
+
+    it('returns if showing equiped gear', () => {
+      expect(vm.costumeClass).to.equal('equipped');
+    });
+    it('returns if wearing a costume', () => {
+      vm.member.preferences = { costume: true };
+      expect(vm.costumeClass).to.equal('costume');
+    });
+  });
+
+  describe('visualBuffs', () => {
+    it('returns an array of buffs', () => {
+      vm.member = {
+        stats: {
+          class: 'Warrior',
+        },
+      };
+
+      expect(vm.visualBuffs).to.include({snowball: 'snowman'});
+      expect(vm.visualBuffs).to.include({spookySparkles: 'ghost'});
+      expect(vm.visualBuffs).to.include({shinySeed: 'avatar_floral_Warrior'});
+      expect(vm.visualBuffs).to.include({seafoam: 'seafoam_star'});
+    });
+  });
+
+  describe('backgroundClass', () => {
+    beforeEach(() => {
+      vm.member.preferences = { background: 'pony' };
+    });
+
+    it('shows the background', () => {
+      expect(vm.backgroundClass).to.equal('background_pony');
+    });
+
+    it('can be overridden', () => {
+      vm.overrideAvatarGear = { background: 'character' };
+
+      expect(vm.backgroundClass).to.equal('background_character');
+    });
+
+    it('returns to a blank string if not showing background', () => {
+      vm.withBackground = false;
+      vm.avatarOnly = true;
+
+      expect(vm.backgroundClass).to.equal('');
+    });
+  });
+
+  describe('specialMountClass', () => {
+    it('checks if riding a Kangaroo', () => {
+      vm.member = {
+        stats: {
+          class: 'None',
+        },
+        items: {},
+      };
+
+      expect(vm.specialMountClass).to.equal(undefined);
+
+      vm.member.items = {
+        currentMount: ['Kangaroo'],
+      };
+
+      expect(vm.specialMountClass).to.equal('offset-kangaroo');
+    });
+  });
+
+  describe('skinClass', () => {
+    it('returns current skin color', () => {
+      vm.member = {
+        stats: {},
+        preferences: {
+          skin: 'blue',
+        },
+      };
+
+      expect(vm.skinClass).to.equal('skin_blue');
+    });
+
+    it('returns if sleep or not', () => {
+      vm.member = {
+        stats: {},
+        preferences: {
+          skin: 'blue',
+          sleep: false,
+        },
+      };
+
+      expect(vm.skinClass).to.equal('skin_blue');
+
+      vm.member.preferences.sleep = true;
+
+      expect(vm.skinClass).to.equal('skin_blue_sleep');
+    });
+  });
+
+  context('methods', () => {
+    describe('getGearClass', () => {
+      beforeEach(() => {
+        vm.member = {
+          items: {
+            gear: {
+              equipped: { Hat: 'Fancy Tophat' },
+            },
+          },
+          preferences: { costume: false },
+        };
+      });
+
+      it('returns undefined if no match', () => {
+        expect(vm.getGearClass('foo')).to.equal(undefined);
+      });
+
+      it('returns the matching gear', () => {
+        expect(vm.getGearClass('Hat')).to.equal('Fancy Tophat');
+      });
+
+      it('can be overridden', () => {
+        vm.overrideAvatarGear = { Hat: 'Dapper Bowler' };
+
+        expect(vm.getGearClass('Hat')).to.equal('Dapper Bowler');
+      });
+    });
+
+    describe('hideGear', () => {
+      it('returns no weapon equipped', () => {
+        vm.member.items.gear.equipped = {};
+        expect(vm.hideGear('weapon')).to.equal(false);
+      });
+
+      beforeEach(() => {
+        vm.member = {
+          items: {
+            gear: {
+              equipped: {
+                weapon: {
+                  baseWeapon: 'Spoon',
+                  twoHanded: false,
+                },
+              },
+            },
+          },
+          preferences: { costume: false },
+        };
+      });
+    });
+
+    describe('show avatar', () => {
+      beforeEach(() => {
+        vm.member = {
+          stats: {
+            buffs: {
+              snowball: false,
+              seafoam: false,
+              spookySparkles: false,
+              shinySeed: false,
+            },
+          },
+        };
+      });
+      it('does if not showing visual buffs', () => {
+        expect(vm.showAvatar()).to.equal(true);
+
+        let buffs = vm.member.stats.buffs;
+
+        buffs.snowball = true;
+        expect(vm.showAvatar()).to.equal(false);
+
+        buffs.snowball = false;
+        buffs.spookySparkles = true;
+        expect(vm.showAvatar()).to.equal(false);
+
+        buffs.spookySparkles = false;
+        buffs.shinySeed = true;
+        expect(vm.showAvatar()).to.equal(false);
+
+        buffs.shinySeed = false;
+        buffs.seafoam = true;
+        expect(vm.showAvatar()).to.equal(false);
+
+        buffs.seafoam = false;
+        vm.showVisualBuffs = false;
+        expect(vm.showAvatar()).to.equal(true);
+      });
+    });
+  });
+});
--- a/test/client/unit/specs/components/categories/categoryTags.js
+++ b/test/client/unit/specs/components/categories/categoryTags.js
@@ -1,4 +1,5 @@
-import {shallow} from '@vue/test-utils';
+import {mount} from '@vue/test-utils';
+import Vue from 'vue';

 import CategoryTags from 'client/components/categories/categoryTags.vue';

@@ -6,7 +7,7 @@ describe('Category Tags', () => {
  let wrapper;

  beforeEach(function () {
-    wrapper = shallow(CategoryTags, {
+    wrapper = mount(CategoryTags, {
      propsData: {
        categories: [],
      },
@@ -27,8 +28,10 @@ describe('Category Tags', () => {
        },
      ],
    });
-    expect(wrapper.contains('.category-label')).to.eq(true);
-    expect(wrapper.find('.category-label').text()).to.eq('test');
+    return Vue.nextTick().then(() => {
+      expect(wrapper.contains('.category-label')).to.eq(true);
+      expect(wrapper.find('.category-label').text()).to.eq('test');
+    });
  });

  it('displays a habitica official in purple', () => {
--- a/test/client/unit/specs/components/challenges/challengeDetail.js
+++ b/test/client/unit/specs/components/challenges/challengeDetail.js
@@ -0,0 +1,61 @@
+import { shallowMount, createLocalVue } from '@vue/test-utils';
+import ChallengeDetailComponent from 'client/components/challenges/challengeDetail.vue';
+import Store from 'client/libs/store';
+
+const localVue = createLocalVue();
+localVue.use(Store);
+
+describe('Challenge Detail', () => {
+  let store;
+  let wrapper;
+
+  beforeEach(() => {
+    store = new Store({
+      state: {
+        user: {
+          data: {
+            contributor: {
+              admin: false,
+            },
+            challenges: [],
+            stats: {
+            },
+            flags: {},
+            preferences: {},
+            party: {
+              quest: {
+              },
+            },
+          },
+        },
+      },
+      actions: {
+        'members:getChallengeMembers': () => {},
+        'challenges:getChallenge': () => [
+          {_id: '1', group: { name: '', type: ''}, memberCount: 1, name: '', summary: '', description: '', leader: '', price: 1},
+        ],
+        'tasks:getChallengeTasks': () => [
+          {_id: '1', type: 'habit'},
+          {_id: '2', type: 'daily'},
+          {_id: '3', type: 'reward'},
+          {_id: '4', type: 'todo'},
+        ],
+      },
+      getters: {
+      },
+    });
+    wrapper = shallowMount(ChallengeDetailComponent, {
+      store,
+      localVue,
+      mocks: {
+        $t: (string) => string,
+      },
+    });
+  });
+
+  it('removes a destroyed task from task list', () => {
+    let taskToRemove = {_id: '1', type: 'habit'};
+    wrapper.vm.taskDestroyed(taskToRemove);
+    expect(wrapper.vm.tasksByType[taskToRemove.type].length).to.eq(0);
+  });
+});
--- a/test/client/unit/specs/components/sidebarSection.js
+++ b/test/client/unit/specs/components/sidebarSection.js
@@ -1,4 +1,4 @@
-import { shallow } from '@vue/test-utils';
+import { mount } from '@vue/test-utils';

 import SidebarSection from 'client/components/sidebarSection.vue';

@@ -6,7 +6,7 @@ describe('Sidebar Section', () => {
  let wrapper;

  beforeEach(function () {
-    wrapper = shallow(SidebarSection, {
+    wrapper = mount(SidebarSection, {
      propsData: {
        title: 'Hello World',
      },
@@ -39,7 +39,7 @@ describe('Sidebar Section', () => {
  });

  it('can hide contents by default', () => {
-    wrapper = shallow(SidebarSection, {
+    wrapper = mount(SidebarSection, {
      propsData: {
        title: 'Hello World',
        show: false,
--- a/test/client/unit/specs/components/tasks/column.js
+++ b/test/client/unit/specs/components/tasks/column.js
@@ -1,4 +1,4 @@
-import { shallow, createLocalVue } from '@vue/test-utils';
+import { mount, createLocalVue } from '@vue/test-utils';

 import TaskColumn from 'client/components/tasks/column.vue';

@@ -21,7 +21,7 @@ describe('Task Column', () => {
    };
    let stubs = ['b-modal'];  // <b-modal> is a custom component and not tested here

-    return shallow(TaskColumn, {
+    return mount(TaskColumn, {
      propsData: {
        type,
      },
--- a/test/client/unit/specs/libs/highlightUsers.js
+++ b/test/client/unit/specs/libs/highlightUsers.js
@@ -0,0 +1,39 @@
+import {highlightUsers} from '../../../../../website/client/libs/highlightUsers';
+import habiticaMarkdown from 'habitica-markdown';
+
+describe('highlightUserAndEmail', () => {
+  it('highlights displayname', () => {
+    const text = 'hello @displayedUser with text after';
+
+    const result = highlightUsers(text, 'user', 'displayedUser');
+
+    expect(result).to.contain('<span class="at-text at-highlight">@displayedUser</span>');
+  });
+
+  it('highlights username', () => {
+    const text = 'hello @user';
+
+    const result = highlightUsers(text, 'user', 'displayedUser');
+    expect(result).to.contain('<span class="at-text at-highlight">@user</span>');
+  });
+
+  it('not highlights any email', () => {
+    const text = habiticaMarkdown.render('hello@example.com');
+
+    const result = highlightUsers(text, 'example', 'displayedUser');
+    expect(result).to.not.contain('<span class="at-highlight">@example</span>');
+  });
+
+
+  it('complex highlight', () => {
+    const plainText = 'a bit more @mentions to @use my@mentions.com broken.@mail.com';
+
+    const text = habiticaMarkdown.render(plainText);
+
+    const result = highlightUsers(text, 'use', 'mentions');
+
+    expect(result).to.contain('<span class="at-text at-highlight">@mentions</span>');
+    expect(result).to.contain('<span class="at-text at-highlight">@use</span>');
+    expect(result).to.not.contain('<span class="at-text at-highlight">@mentions</span>.com');
+  });
+});
--- a/test/client/unit/specs/store/getters/tasks/getTaskClasses.js
+++ b/test/client/unit/specs/store/getters/tasks/getTaskClasses.js
@@ -109,12 +109,13 @@ describe('getTaskClasses getter', () => {
    });
  });

-  xit('returns good todo classes', () => {
+  it('returns good todo classes', () => {
    const task = {type: 'todo', value: 2};
    expect(getTaskClasses(task, 'control')).to.deep.equal({
      bg: 'task-good-control-bg',
      checkbox: 'task-good-control-checkbox',
-      inner: 'task-good-control-inner-daily-todo`',
+      inner: 'task-good-control-inner-daily-todo',
+      icon: 'task-good-control-icon',
    });
  });

@@ -131,11 +132,23 @@ describe('getTaskClasses getter', () => {
      up: {
        bg: 'task-good-control-bg',
        inner: 'task-good-control-inner-habit',
+        icon: 'task-good-control-icon',
      },
      down: {
        bg: 'task-disabled-habit-control-bg',
        inner: 'task-disabled-habit-control-inner',
+        icon: 'task-good-control-icon',
      },
    });
  });
+
+  it('returns noninteractive classes and padlock icons for group board tasks', () => {
+    const task = {type: 'todo', value: 2, group: {id: 'group-id'}};
+    expect(getTaskClasses(task, 'control')).to.deep.equal({
+      bg: 'task-good-control-bg-noninteractive',
+      checkbox: 'task-good-control-checkbox',
+      inner: 'task-good-control-inner-daily-todo',
+      icon: 'task-good-control-icon',
+    });
+  });
 });
--- a/test/client/unit/specs/store/getters/user/user.test.js
+++ b/test/client/unit/specs/store/getters/user/user.test.js
@@ -0,0 +1,76 @@
+import { data, gems, buffs, preferences, tasksOrder } from 'client/store/getters/user';
+
+context('user getters', () => {
+  describe('data', () => {
+    it('returns the user\'s data', () => {
+      expect(data({
+        state: {
+          user: {
+            data: {
+              lvl: 1,
+            },
+          },
+        },
+      }).lvl).to.equal(1);
+    });
+  });
+
+  describe('gems', () => {
+    it('returns the user\'s gems', () => {
+      expect(gems({
+        state: {
+          user: {
+            data: { balance: 4.5 },
+          },
+        },
+      })).to.equal(18);
+    });
+  });
+
+  describe('buffs', () => {
+    it('returns the user\'s buffs', () => {
+      expect(buffs({
+        state: {
+          user: {
+            data: {
+              stats: {
+                buffs: [1],
+              },
+            },
+          },
+        },
+      })(0)).to.equal(1);
+    });
+  });
+
+  describe('preferences', () => {
+    it('returns the user\'s preferences', () => {
+      expect(preferences({
+        state: {
+          user: {
+            data: {
+              preferences: 1,
+            },
+          },
+        },
+      })).to.equal(1);
+    });
+  });
+
+  describe('tasksOrder', () => {
+    it('returns the user\'s tasksOrder', () => {
+      expect(tasksOrder({
+        state: {
+          user: {
+            tasksOrder: {
+              masters: 1,
+            },
+          },
+        },
+      })('master')).to.equal(1);
+
+      expect(tasksOrder()).to.not.equal('null');
+      expect(tasksOrder()).to.not.equal('undefined');
+    });
+  });
+});
--- a/test/client/unit/specs/store/getters/user/userGems.js
+++ b/test/client/unit/specs/store/getters/user/userGems.js
@@ -1,13 +0,0 @@
-import { gems as userGems } from 'client/store/getters/user';
-
-describe('userGems getter', () => {
-  it('returns the user\'s gems', () => {
-    expect(userGems({
-      state: {
-        user: {
-          data: {balance: 4.5},
-        },
-      },
-    })).to.equal(18);
-  });
-});
--- a/test/common/libs/inAppRewards.js
+++ b/test/common/libs/inAppRewards.js
@@ -62,6 +62,18 @@ describe('inAppRewards', () => {
    expect(result[9].path).to.eql('potion');
  });

+  it('ignores null/undefined entries', () => {
+    user.pinnedItems = testPinnedItems;
+    user.pinnedItems.push(null);
+    user.pinnedItems.push(undefined);
+    user.pinnedItemsOrder = testPinnedItemsOrder;
+
+    let result = inAppRewards(user);
+
+    expect(result[2].path).to.eql('armoire');
+    expect(result[9].path).to.eql('potion');
+  });
+
  it('does not return seasonal items which have been unpinned', () => {
    if (officialPinnedItems.length === 0) {
      return; // if no seasonal items, this test is not applicable
--- a/test/common/ops/buy/buy.js
+++ b/test/common/ops/buy/buy.js
@@ -9,6 +9,7 @@ import {
 import i18n from '../../../../website/common/script/i18n';
 import content from '../../../../website/common/script/content/index';
 import errorMessage from '../../../../website/common/script/libs/errorMessage';
+import { defaultsDeep } from 'lodash';

 describe('shared.ops.buy', () => {
  let user;
@@ -16,6 +17,10 @@ describe('shared.ops.buy', () => {

  beforeEach(() => {
    user = generateUser({
+      stats: { gp: 200 },
+    });
+
+    defaultsDeep(user, {
      items: {
        gear: {
          owned: {
@@ -26,7 +31,6 @@ describe('shared.ops.buy', () => {
          },
        },
      },
-      stats: { gp: 200 },
    });

    sinon.stub(analytics, 'track');
@@ -76,6 +80,13 @@ describe('shared.ops.buy', () => {
      headAccessory_special_redHeadband: true,
      headAccessory_special_whiteHeadband: true,
      headAccessory_special_yellowHeadband: true,
+      eyewear_special_blackHalfMoon: true,
+      eyewear_special_blueHalfMoon: true,
+      eyewear_special_greenHalfMoon: true,
+      eyewear_special_pinkHalfMoon: true,
+      eyewear_special_redHalfMoon: true,
+      eyewear_special_whiteHalfMoon: true,
+      eyewear_special_yellowHalfMoon: true,
    });
  });

@@ -138,4 +149,52 @@ describe('shared.ops.buy', () => {
    buy(user, {params: {key: 'potion'}, quantity: 2});
    expect(user.stats.hp).to.eql(50);
  });
+
+  it('errors if user supplies a non-numeric quantity', (done) => {
+    try {
+      buy(user, {
+        params: {
+          key: 'dilatoryDistress1',
+        },
+        type: 'quest',
+        quantity: 'bogle',
+      });
+    } catch (err) {
+      expect(err).to.be.an.instanceof(BadRequest);
+      expect(err.message).to.equal(errorMessage('invalidQuantity'));
+      done();
+    }
+  });
+
+  it('errors if user supplies a negative quantity', (done) => {
+    try {
+      buy(user, {
+        params: {
+          key: 'dilatoryDistress1',
+        },
+        type: 'quest',
+        quantity: -3,
+      });
+    } catch (err) {
+      expect(err).to.be.an.instanceof(BadRequest);
+      expect(err.message).to.equal(errorMessage('invalidQuantity'));
+      done();
+    }
+  });
+
+  it('errors if user supplies a decimal quantity', (done) => {
+    try {
+      buy(user, {
+        params: {
+          key: 'dilatoryDistress1',
+        },
+        type: 'quest',
+        quantity: 1.83,
+      });
+    } catch (err) {
+      expect(err).to.be.an.instanceof(BadRequest);
+      expect(err.message).to.equal(errorMessage('invalidQuantity'));
+      done();
+    }
+  });
 });
--- a/test/common/ops/buy/buyArmoire.js
+++ b/test/common/ops/buy/buyArmoire.js
@@ -158,7 +158,7 @@ describe('shared.ops.buyArmoire', () => {

      expect(armoireCount).to.eql(_.size(getFullArmoire()) - 2);
      expect(user.stats.gp).to.eql(100);
-      expect(analytics.track).to.be.calledOnce;
+      expect(analytics.track).to.be.calledTwice;
    });
  });
 });
--- a/test/common/ops/buy/buyMarketGear.js
+++ b/test/common/ops/buy/buyMarketGear.js
@@ -11,6 +11,7 @@ import {
 } from '../../../../website/common/script/libs/errors';
 import i18n from '../../../../website/common/script/i18n';
 import errorMessage from '../../../../website/common/script/libs/errorMessage';
+import { defaultsDeep } from 'lodash';

 function buyGear (user, req, analytics) {
  let buyOp = new BuyMarketGearOperation(user, req, analytics);
@@ -24,6 +25,10 @@ describe('shared.ops.buyMarketGear', () => {

  beforeEach(() => {
    user = generateUser({
+      stats: { gp: 200 },
+    });
+
+    defaultsDeep(user, {
      items: {
        gear: {
          owned: {
@@ -34,7 +39,6 @@ describe('shared.ops.buyMarketGear', () => {
          },
        },
      },
-      stats: { gp: 200 },
    });

    sinon.stub(shared, 'randomVal');
@@ -71,6 +75,13 @@ describe('shared.ops.buyMarketGear', () => {
        headAccessory_special_redHeadband: true,
        headAccessory_special_whiteHeadband: true,
        headAccessory_special_yellowHeadband: true,
+        eyewear_special_blackHalfMoon: true,
+        eyewear_special_blueHalfMoon: true,
+        eyewear_special_greenHalfMoon: true,
+        eyewear_special_pinkHalfMoon: true,
+        eyewear_special_redHalfMoon: true,
+        eyewear_special_whiteHalfMoon: true,
+        eyewear_special_yellowHalfMoon: true,
      });
      expect(analytics.track).to.be.calledOnce;
    });
--- a/test/common/ops/buy/buyQuestGems.js
+++ b/test/common/ops/buy/buyQuestGems.js
@@ -49,6 +49,15 @@ describe('shared.ops.buyQuestGems', () => {

      buyQuest(user, {params: {key}});

+      expect(user.items.quests[key]).to.equal(1);
+      expect(pinnedGearUtils.removeItemByPath.notCalled).to.equal(true);
+    });
+    it('if a user\'s count of a quest scroll is negative, it will be reset to 0 before incrementing when they buy a new one.', () => {
+      let key = 'dustbunnies';
+      user.items.quests[key] = -1;
+
+      buyQuest(user, {params: {key}});
+
      expect(user.items.quests[key]).to.equal(1);
      expect(pinnedGearUtils.removeItemByPath.notCalled).to.equal(true);
    });
--- a/Show More
+++ b/Show More