Merge branch 'develop' of https://github.com/HabitRPG/habitica into autocomplete-username

# Conflicts:
#	package.json
#	website/client/components/chat/autoComplete.vue
#	website/client/components/chat/chatCard.vue
#	website/client/components/groups/chat.vue
#	website/server/controllers/api-v3/chat.js
#	website/server/controllers/api-v3/members.js
#	website/server/controllers/api-v4/members.js

test/api/unit/libs/analyticsService.test.js

@@ -335,14 +335,13 @@ describe('analyticsService', () => {
     let data, itemSpy;
 
     beforeEach(() => {
+      Visitor.prototype.event.yields();
+
       itemSpy = sandbox.stub().returnsThis();
 
-      Visitor.prototype.event.returns({
-        send: sandbox.stub(),
-      });
       Visitor.prototype.transaction.returns({
         item: itemSpy,
-        send: sandbox.stub().returnsThis(),
+        send: sandbox.stub().yields(),
       });
 
       data = {

test/api/unit/libs/cron.test.js

@@ -1232,7 +1232,7 @@ describe('cron', () => {
       cron({user, tasksByType, daysMissed, analytics});
 
       expect(user.history.exp).to.have.lengthOf(1);
-      expect(user.history.exp[0].value).to.equal(150);
+      expect(user.history.exp[0].value).to.equal(25);
     });
 
     it('increments perfect day achievement if all (at least 1) due dailies were completed', () => {

test/api/unit/libs/email.test.js

@@ -1,9 +1,7 @@
 /* eslint-disable global-require */
 import got from 'got';
 import nconf from 'nconf';
-import nodemailer from 'nodemailer';
 import requireAgain from 'require-again';
-import logger from '../../../../website/server/libs/logger';
 import { TAVERN_ID } from '../../../../website/server/models/group';
 import { defer } from '../../../helpers/api-unit.helper';
 
@@ -35,42 +33,6 @@ function getUser () {
 describe('emails', () => {
   let pathToEmailLib = '../../../../website/server/libs/email';
 
-  describe('sendEmail', () => {
-    let sendMailSpy;
-
-    beforeEach(() => {
-      sendMailSpy = sandbox.stub().returns(defer().promise);
-      sandbox.stub(nodemailer, 'createTransport').returns({
-        sendMail: sendMailSpy,
-      });
-    });
-
-    afterEach(() => {
-      sandbox.restore();
-    });
-
-    it('can send an email using the default transport', () => {
-      let attachEmail = requireAgain(pathToEmailLib);
-      attachEmail.send();
-      expect(sendMailSpy).to.be.calledOnce;
-    });
-
-    it('logs errors', (done) => {
-      sandbox.stub(logger, 'error');
-
-      let attachEmail = requireAgain(pathToEmailLib);
-      attachEmail.send();
-      expect(sendMailSpy).to.be.calledOnce;
-      defer().reject();
-
-      // wait for unhandledRejection event to fire
-      setTimeout(() => {
-        expect(logger.error).to.be.calledOnce;
-        done();
-      }, 20);
-    });
-  });
-
   describe('getUserInfo', () => {
     it('returns an empty object if no field request', () => {
       let attachEmail = requireAgain(pathToEmailLib);
@@ -84,7 +46,7 @@ describe('emails', () => {
       let user = getUser();
       let data = getUserInfo(user, ['name', 'email', '_id', 'canSend']);
 
-      expect(data).to.have.property('name', user.profile.name);
+      expect(data).to.have.property('name', user.auth.local.username);
       expect(data).to.have.property('email', user.auth.local.email);
       expect(data).to.have.property('_id', user._id);
       expect(data).to.have.property('canSend', true);
@@ -95,11 +57,11 @@ describe('emails', () => {
       let getUserInfo = attachEmail.getUserInfo;
       let user = getUser();
       delete user.profile.name;
-      delete user.auth.local;
+      delete user.auth.local.email;
 
       let data = getUserInfo(user, ['name', 'email', '_id', 'canSend']);
 
-      expect(data).to.have.property('name', user.profile.name);
+      expect(data).to.have.property('name', user.auth.local.username);
       expect(data).to.have.property('email', user.auth.facebook.emails[0].value);
       expect(data).to.have.property('_id', user._id);
       expect(data).to.have.property('canSend', true);
@@ -114,7 +76,7 @@ describe('emails', () => {
 
       let data = getUserInfo(user, ['name', 'email', '_id', 'canSend']);
 
-      expect(data).to.have.property('name', user.profile.name);
+      expect(data).to.have.property('name', user.auth.local.username);
       expect(data).not.to.have.property('email');
       expect(data).to.have.property('_id', user._id);
       expect(data).to.have.property('canSend', true);

test/api/unit/libs/items/utils.test.js

@@ -0,0 +1,113 @@
+/* eslint-disable camelcase */
+import {
+  validateItemPath,
+  getDefaultOwnedGear,
+  castItemVal,
+} from '../../../../../website/server/libs/items/utils';
+
+describe('Items Utils', () => {
+  describe('getDefaultOwnedGear', () => {
+    it('clones the result object', () => {
+      const res1 = getDefaultOwnedGear();
+      res1.extraProperty = true;
+
+      const res2 = getDefaultOwnedGear();
+      expect(res2).not.to.have.property('extraProperty');
+    });
+  });
+
+  describe('validateItemPath', () => {
+    it('returns false if not an item path', () => {
+      expect(validateItemPath('notitems.gear.owned.item')).to.equal(false);
+    });
+
+    it('returns true if a valid schema path', () => {
+      expect(validateItemPath('items.gear.equipped.weapon')).to.equal(true);
+      expect(validateItemPath('items.currentPet')).to.equal(true);
+      expect(validateItemPath('items.special.snowball')).to.equal(true);
+    });
+
+    it('works with owned gear paths', () => {
+      expect(validateItemPath('items.gear.owned.head_armoire_crownOfHearts')).to.equal(true);
+      expect(validateItemPath('items.gear.owned.head_invalid')).to.equal(false);
+    });
+
+    it('works with pets paths', () => {
+      expect(validateItemPath('items.pets.Wolf-CottonCandyPink')).to.equal(true);
+      expect(validateItemPath('items.pets.Wolf-Invalid')).to.equal(false);
+    });
+
+    it('works with eggs paths', () => {
+      expect(validateItemPath('items.eggs.LionCub')).to.equal(true);
+      expect(validateItemPath('items.eggs.Armadillo')).to.equal(true);
+      expect(validateItemPath('items.eggs.NotAnArmadillo')).to.equal(false);
+    });
+
+    it('works with hatching potions paths', () => {
+      expect(validateItemPath('items.hatchingPotions.Base')).to.equal(true);
+      expect(validateItemPath('items.hatchingPotions.StarryNight')).to.equal(true);
+      expect(validateItemPath('items.hatchingPotions.Invalid')).to.equal(false);
+    });
+
+    it('works with food paths', () => {
+      expect(validateItemPath('items.food.Cake_Base')).to.equal(true);
+      expect(validateItemPath('items.food.Cake_Invalid')).to.equal(false);
+    });
+
+    it('works with mounts paths', () => {
+      expect(validateItemPath('items.mounts.Cactus-Base')).to.equal(true);
+      expect(validateItemPath('items.mounts.Aether-Invisible')).to.equal(true);
+      expect(validateItemPath('items.mounts.Aether-Invalid')).to.equal(false);
+    });
+
+    it('works with quests paths', () => {
+      expect(validateItemPath('items.quests.atom3')).to.equal(true);
+      expect(validateItemPath('items.quests.invalid')).to.equal(false);
+    });
+  });
+
+  describe('castItemVal', () => {
+    it('returns the item val untouched if not an item path', () => {
+      expect(castItemVal('notitems.gear.owned.item', 'a string')).to.equal('a string');
+    });
+
+    it('returns the item val untouched if an unsupported path', () => {
+      expect(castItemVal('items.gear.equipped.weapon', 'a string')).to.equal('a string');
+      expect(castItemVal('items.currentPet', 'a string')).to.equal('a string');
+      expect(castItemVal('items.special.snowball', 'a string')).to.equal('a string');
+    });
+
+    it('converts values for pets paths to numbers', () => {
+      expect(castItemVal('items.pets.Wolf-CottonCandyPink', '5')).to.equal(5);
+      expect(castItemVal('items.pets.Wolf-Invalid', '5')).to.equal(5);
+    });
+
+    it('converts values for eggs paths to numbers', () => {
+      expect(castItemVal('items.eggs.LionCub', '5')).to.equal(5);
+      expect(castItemVal('items.eggs.Armadillo', '5')).to.equal(5);
+      expect(castItemVal('items.eggs.NotAnArmadillo', '5')).to.equal(5);
+    });
+
+    it('converts values for hatching potions paths to numbers', () => {
+      expect(castItemVal('items.hatchingPotions.Base', '5')).to.equal(5);
+      expect(castItemVal('items.hatchingPotions.StarryNight', '5')).to.equal(5);
+      expect(castItemVal('items.hatchingPotions.Invalid', '5')).to.equal(5);
+    });
+
+    it('converts values for food paths to numbers', () => {
+      expect(castItemVal('items.food.Cake_Base', '5')).to.equal(5);
+      expect(castItemVal('items.food.Cake_Invalid', '5')).to.equal(5);
+    });
+
+    it('converts values for mounts paths to numbers', () => {
+      expect(castItemVal('items.mounts.Cactus-Base', '5')).to.equal(5);
+      expect(castItemVal('items.mounts.Aether-Invisible', '5')).to.equal(5);
+      expect(castItemVal('items.mounts.Aether-Invalid', '5')).to.equal(5);
+    });
+
+    it('converts values for quests paths to numbers', () => {
+      expect(castItemVal('items.quests.atom3', '5')).to.equal(5);
+      expect(castItemVal('items.quests.invalid', '5')).to.equal(5);
+    });
+  });
+});

test/api/unit/libs/payments/payments.test.js

@@ -16,6 +16,7 @@ describe('payments/index', () => {
   beforeEach(async () => {
     user = new User();
     user.profile.name = 'sender';
+    user.auth.local.username = 'sender';
     await user.save();
 
     group = generateGroup({

test/api/unit/libs/slack.js

@@ -32,6 +32,7 @@ describe('slack', () => {
         },
         message: {
           id: 'chat-id',
+          username: 'author',
           user: 'Author',
           uuid: 'author-id',
           text: 'some text',
@@ -50,11 +51,11 @@ describe('slack', () => {
 
       expect(IncomingWebhook.prototype.send).to.be.calledOnce;
       expect(IncomingWebhook.prototype.send).to.be.calledWith({
-        text: 'flagger (flagger-id; language: flagger-lang) flagged a message',
+        text: 'flagger (flagger-id; language: flagger-lang) flagged a group message',
         attachments: [{
           fallback: 'Flag Message',
           color: 'danger',
-          author_name: `Author - author@example.com - author-id\n${timestamp}`,
+          author_name: `@author Author (author@example.com; author-id)\n${timestamp}`,
           title: 'Flag in Some group - (private guild)',
           title_link: undefined,
           text: 'some text',

test/api/unit/middlewares/auth.test.js

@@ -16,7 +16,7 @@ describe('auth middleware', () => {
   describe('auth with headers', () => {
     it('allows to specify a list of user field that we do not want to load', (done) => {
       const authWithHeaders = authWithHeadersFactory({
-        userFieldsToExclude: ['items', 'flags', 'auth.timestamps'],
+        userFieldsToExclude: ['items'],
       });
 
       req.headers['x-api-user'] = user._id;
@@ -27,11 +27,34 @@ describe('auth middleware', () => {
 
         const userToJSON = res.locals.user.toJSON();
         expect(userToJSON.items).to.not.exist;
-        expect(userToJSON.flags).to.not.exist;
-        expect(userToJSON.auth.timestamps).to.not.exist;
+        expect(userToJSON.auth).to.exist;
+
+        done();
+      });
+    });
+
+    it('makes sure some fields are always included', (done) => {
+      const authWithHeaders = authWithHeadersFactory({
+        userFieldsToExclude: [
+          'items', 'auth.timestamps',
+          'preferences', 'notifications', '_id', 'flags', 'auth', // these are always loaded
+        ],
+      });
+
+      req.headers['x-api-user'] = user._id;
+      req.headers['x-api-key'] = user.apiToken;
+
+      authWithHeaders(req, res, (err) => {
+        if (err) return done(err);
+
+        const userToJSON = res.locals.user.toJSON();
+        expect(userToJSON.items).to.not.exist;
+        expect(userToJSON.auth.timestamps).to.exist;
         expect(userToJSON.auth).to.exist;
         expect(userToJSON.notifications).to.exist;
         expect(userToJSON.preferences).to.exist;
+        expect(userToJSON._id).to.exist;
+        expect(userToJSON.flags).to.exist;
 
         done();
       });

test/api/unit/models/group.test.js

@@ -1,7 +1,7 @@
 import moment from 'moment';
 import { v4 as generateUUID } from 'uuid';
 import validator from 'validator';
-import { sleep } from '../../../helpers/api-unit.helper';
+import { sleep, translationCheck } from '../../../helpers/api-unit.helper';
 import {
   SPAM_MESSAGE_LIMIT,
   SPAM_MIN_EXEMPT_CONTRIB_LEVEL,
@@ -271,7 +271,16 @@ describe('Group Model', () => {
           party = await Group.findOne({_id: party._id});
 
           expect(Group.prototype.sendChat).to.be.calledOnce;
-          expect(Group.prototype.sendChat).to.be.calledWith('`Participating Member attacks Wailing Whale for 5.0 damage.` `Wailing Whale attacks party for 7.5 damage.`');
+          expect(Group.prototype.sendChat).to.be.calledWith({
+            message: '`Participating Member attacks Wailing Whale for 5.0 damage. Wailing Whale attacks party for 7.5 damage.`',
+            info: {
+              bossDamage: '7.5',
+              quest: 'whale',
+              type: 'boss_damage',
+              user: 'Participating Member',
+              userDamage: '5.0',
+            },
+          });
         });
 
         it('applies damage only to participating members of party', async () => {
@@ -344,7 +353,10 @@ describe('Group Model', () => {
           party = await Group.findOne({_id: party._id});
 
           expect(Group.prototype.sendChat).to.be.calledTwice;
-          expect(Group.prototype.sendChat).to.be.calledWith('`You defeated Wailing Whale! Questing party members receive the rewards of victory.`');
+          expect(Group.prototype.sendChat).to.be.calledWith({
+            message: '`You defeated Wailing Whale! Questing party members receive the rewards of victory.`',
+            info: { quest: 'whale', type: 'boss_defeated' },
+          });
         });
 
         it('calls finishQuest when boss has <= 0 hp', async () => {
@@ -387,7 +399,10 @@ describe('Group Model', () => {
 
             party = await Group.findOne({_id: party._id});
 
-            expect(Group.prototype.sendChat).to.be.calledWith(quest.boss.rage.effect('en'));
+            expect(Group.prototype.sendChat).to.be.calledWith({
+              message: quest.boss.rage.effect('en'),
+              info: { quest: 'trex_undead', type: 'boss_rage' },
+            });
             expect(party.quest.progress.hp).to.eql(383.5);
             expect(party.quest.progress.rage).to.eql(0);
           });
@@ -437,7 +452,10 @@ describe('Group Model', () => {
 
             party = await Group.findOne({_id: party._id});
 
-            expect(Group.prototype.sendChat).to.be.calledWith(quest.boss.rage.effect('en'));
+            expect(Group.prototype.sendChat).to.be.calledWith({
+              message: quest.boss.rage.effect('en'),
+              info: { quest: 'lostMasterclasser4', type: 'boss_rage' },
+            });
             expect(party.quest.progress.rage).to.eql(0);
 
             let drainedUser = await User.findById(participatingMember._id);
@@ -488,7 +506,15 @@ describe('Group Model', () => {
           party = await Group.findOne({_id: party._id});
 
           expect(Group.prototype.sendChat).to.be.calledOnce;
-          expect(Group.prototype.sendChat).to.be.calledWith('`Participating Member found 5 Bars of Soap.`');
+          expect(Group.prototype.sendChat).to.be.calledWith({
+            message: '`Participating Member found 5 Bars of Soap.`',
+            info: {
+              items: { soapBars: 5 },
+              quest: 'atom1',
+              type: 'user_found_items',
+              user: 'Participating Member',
+            },
+          });
         });
 
         it('sends a chat message if no progress is made', async () => {
@@ -499,7 +525,15 @@ describe('Group Model', () => {
           party = await Group.findOne({_id: party._id});
 
           expect(Group.prototype.sendChat).to.be.calledOnce;
-          expect(Group.prototype.sendChat).to.be.calledWith('`Participating Member found 0 Bars of Soap.`');
+          expect(Group.prototype.sendChat).to.be.calledWith({
+            message: '`Participating Member found 0 Bars of Soap.`',
+            info: {
+              items: { soapBars: 0 },
+              quest: 'atom1',
+              type: 'user_found_items',
+              user: 'Participating Member',
+            },
+          });
         });
 
         it('sends a chat message if no progress is made on quest with multiple items', async () => {
@@ -516,9 +550,15 @@ describe('Group Model', () => {
           party = await Group.findOne({_id: party._id});
 
           expect(Group.prototype.sendChat).to.be.calledOnce;
-          expect(Group.prototype.sendChat).to.be.calledWithMatch(/`Participating Member found/);
-          expect(Group.prototype.sendChat).to.be.calledWithMatch(/0 Blue Fins/);
-          expect(Group.prototype.sendChat).to.be.calledWithMatch(/0 Fire Coral/);
+          expect(Group.prototype.sendChat).to.be.calledWith({
+            message: '`Participating Member found 0 Fire Coral, 0 Blue Fins.`',
+            info: {
+              items: { blueFins: 0, fireCoral: 0 },
+              quest: 'dilatoryDistress1',
+              type: 'user_found_items',
+              user: 'Participating Member',
+            },
+          });
         });
 
         it('handles collection quests with multiple items', async () => {
@@ -535,8 +575,14 @@ describe('Group Model', () => {
           party = await Group.findOne({_id: party._id});
 
           expect(Group.prototype.sendChat).to.be.calledOnce;
-          expect(Group.prototype.sendChat).to.be.calledWithMatch(/`Participating Member found/);
-          expect(Group.prototype.sendChat).to.be.calledWithMatch(/\d* (Tracks|Broken Twigs)/);
+          expect(Group.prototype.sendChat).to.be.calledWithMatch({
+            message: sinon.match(/`Participating Member found/).and(sinon.match(/\d* (Tracks|Broken Twigs)/)),
+            info: {
+              quest: 'evilsanta2',
+              type: 'user_found_items',
+              user: 'Participating Member',
+            },
+          });
         });
 
         it('sends message about victory', async () => {
@@ -547,7 +593,10 @@ describe('Group Model', () => {
           party = await Group.findOne({_id: party._id});
 
           expect(Group.prototype.sendChat).to.be.calledTwice;
-          expect(Group.prototype.sendChat).to.be.calledWith('`All items found! Party has received their rewards.`');
+          expect(Group.prototype.sendChat).to.be.calledWith({
+            message: '`All items found! Party has received their rewards.`',
+            info: { type: 'all_items_found' },
+          });
         });
 
         it('calls finishQuest when all items are found', async () => {
@@ -718,6 +767,258 @@ describe('Group Model', () => {
         expect(res.t).to.not.be.called;
       });
     });
+
+    describe('translateSystemMessages', () => {
+      it('translate quest_start', async () => {
+        questLeader.preferences.language = 'en';
+        party.chat = [{
+          info: {
+            type: 'quest_start',
+            quest: 'basilist',
+          },
+        }];
+        let toJSON = await Group.toJSONCleanChat(party, questLeader);
+        translationCheck(toJSON.chat[0].text);
+      });
+
+      it('translate boss_damage', async () => {
+        questLeader.preferences.language = 'en';
+        party.chat = [{
+          info: {
+            type: 'boss_damage',
+            user: questLeader.profile.name,
+            quest: 'basilist',
+            userDamage: 15.3,
+            bossDamage: 3.7,
+          },
+        }];
+        let toJSON = await Group.toJSONCleanChat(party, questLeader);
+        translationCheck(toJSON.chat[0].text);
+      });
+
+      it('translate boss_dont_attack', async () => {
+        questLeader.preferences.language = 'en';
+        party.chat = [{
+          info: {
+            type: 'boss_dont_attack',
+            user: questLeader.profile.name,
+            quest: 'basilist',
+            userDamage: 15.3,
+          },
+        }];
+        let toJSON = await Group.toJSONCleanChat(party, questLeader);
+        translationCheck(toJSON.chat[0].text);
+      });
+
+      it('translate boss_rage', async () => {
+        questLeader.preferences.language = 'en';
+        party.chat = [{
+          info: {
+            type: 'boss_rage',
+            quest: 'lostMasterclasser3',
+          },
+        }];
+        let toJSON = await Group.toJSONCleanChat(party, questLeader);
+        translationCheck(toJSON.chat[0].text);
+      });
+
+      it('translate boss_defeated', async () => {
+        questLeader.preferences.language = 'en';
+        party.chat = [{
+          info: {
+            type: 'boss_defeated',
+            quest: 'lostMasterclasser3',
+          },
+        }];
+        let toJSON = await Group.toJSONCleanChat(party, questLeader);
+        translationCheck(toJSON.chat[0].text);
+      });
+
+      it('translate user_found_items', async () => {
+        questLeader.preferences.language = 'en';
+        party.chat = [{
+          info: {
+            type: 'user_found_items',
+            user: questLeader.profile.name,
+            quest: 'lostMasterclasser1',
+            items: {
+              ancientTome: 3,
+              forbiddenTome: 2,
+              hiddenTome: 1,
+            },
+          },
+        }];
+        let toJSON = await Group.toJSONCleanChat(party, questLeader);
+        translationCheck(toJSON.chat[0].text);
+      });
+
+      it('translate all_items_found', async () => {
+        questLeader.preferences.language = 'en';
+        party.chat = [{
+          info: {
+            type: 'all_items_found',
+          },
+        }];
+        let toJSON = await Group.toJSONCleanChat(party, questLeader);
+        translationCheck(toJSON.chat[0].text);
+      });
+
+      it('translate spell_cast_party', async () => {
+        questLeader.preferences.language = 'en';
+        party.chat = [{
+          info: {
+            type: 'spell_cast_party',
+            user: questLeader.profile.name,
+            class: 'wizard',
+            spell: 'earth',
+          },
+        }];
+        let toJSON = await Group.toJSONCleanChat(party, questLeader);
+        translationCheck(toJSON.chat[0].text);
+      });
+
+      it('translate spell_cast_user', async () => {
+        questLeader.preferences.language = 'en';
+        party.chat = [{
+          info: {
+            type: 'spell_cast_user',
+            user: questLeader.profile.name,
+            class: 'special',
+            spell: 'snowball',
+            target: participatingMember.profile.name,
+          },
+        }];
+        let toJSON = await Group.toJSONCleanChat(party, questLeader);
+        translationCheck(toJSON.chat[0].text);
+      });
+
+      it('translate quest_cancel', async () => {
+        questLeader.preferences.language = 'en';
+        party.chat = [{
+          info: {
+            type: 'quest_cancel',
+            user: questLeader.profile.name,
+            quest: 'basilist',
+          },
+        }];
+        let toJSON = await Group.toJSONCleanChat(party, questLeader);
+        translationCheck(toJSON.chat[0].text);
+      });
+
+      it('translate quest_abort', async () => {
+        questLeader.preferences.language = 'en';
+        party.chat = [{
+          info: {
+            type: 'quest_abort',
+            user: questLeader.profile.name,
+            quest: 'basilist',
+          },
+        }];
+        let toJSON = await Group.toJSONCleanChat(party, questLeader);
+        translationCheck(toJSON.chat[0].text);
+      });
+
+      it('translate tavern_quest_completed', async () => {
+        questLeader.preferences.language = 'en';
+        party.chat = [{
+          info: {
+            type: 'tavern_quest_completed',
+            quest: 'stressbeast',
+          },
+        }];
+        let toJSON = await Group.toJSONCleanChat(party, questLeader);
+        translationCheck(toJSON.chat[0].text);
+      });
+
+      it('translate tavern_boss_rage_tired', async () => {
+        questLeader.preferences.language = 'en';
+        party.chat = [{
+          info: {
+            type: 'tavern_boss_rage_tired',
+            quest: 'stressbeast',
+          },
+        }];
+        let toJSON = await Group.toJSONCleanChat(party, questLeader);
+        translationCheck(toJSON.chat[0].text);
+      });
+
+      it('translate tavern_boss_rage', async () => {
+        questLeader.preferences.language = 'en';
+        party.chat = [{
+          info: {
+            type: 'tavern_boss_rage',
+            quest: 'dysheartener',
+            scene: 'market',
+          },
+        }];
+        let toJSON = await Group.toJSONCleanChat(party, questLeader);
+        translationCheck(toJSON.chat[0].text);
+      });
+
+      it('translate tavern_boss_desperation', async () => {
+        questLeader.preferences.language = 'en';
+        party.chat = [{
+          info: {
+            type: 'tavern_boss_desperation',
+            quest: 'stressbeast',
+          },
+        }];
+        let toJSON = await Group.toJSONCleanChat(party, questLeader);
+        translationCheck(toJSON.chat[0].text);
+      });
+
+      it('translate claim_task', async () => {
+        questLeader.preferences.language = 'en';
+        party.chat = [{
+          info: {
+            type: 'claim_task',
+            user: questLeader.profile.name,
+            task: 'Feed the pet',
+          },
+        }];
+        let toJSON = await Group.toJSONCleanChat(party, questLeader);
+        translationCheck(toJSON.chat[0].text);
+      });
+    });
+
+    describe('toJSONCleanChat', () => {
+      it('shows messages with 1 flag to non-admins', async () => {
+        party.chat = [{
+          flagCount: 1,
+          info: {
+            type: 'quest_start',
+            quest: 'basilist',
+          },
+        }];
+        let toJSON = await Group.toJSONCleanChat(party, questLeader);
+        expect(toJSON.chat.length).to.equal(1);
+      });
+
+      it('shows messages with >= 2 flag to admins', async () => {
+        party.chat = [{
+          flagCount: 3,
+          info: {
+            type: 'quest_start',
+            quest: 'basilist',
+          },
+        }];
+        const admin = new User({'contributor.admin': true});
+        let toJSON = await Group.toJSONCleanChat(party, admin);
+        expect(toJSON.chat.length).to.equal(1);
+      });
+
+      it('doesn\'t show flagged messages to non-admins', async () => {
+        party.chat = [{
+          flagCount: 3,
+          info: {
+            type: 'quest_start',
+            quest: 'basilist',
+          },
+        }];
+        let toJSON = await Group.toJSONCleanChat(party, questLeader);
+        expect(toJSON.chat.length).to.equal(0);
+      });
+    });
   });
 
   context('Instance Methods', () => {
@@ -1007,20 +1308,22 @@ describe('Group Model', () => {
       });
 
       it('formats message', () => {
-        const chatMessage = party.sendChat('a new message', {
-          _id: 'user-id',
-          profile: { name: 'user name' },
-          contributor: {
-            toObject () {
-              return 'contributor object';
+        const chatMessage = party.sendChat({
+          message: 'a new message', user: {
+            _id: 'user-id',
+            profile: { name: 'user name' },
+            contributor: {
+              toObject () {
+                return 'contributor object';
+              },
             },
-          },
-          backer: {
-            toObject () {
-              return 'backer object';
+            backer: {
+              toObject () {
+                return 'backer object';
+              },
             },
-          },
-        });
+          }}
+        );
 
         const chat = chatMessage;
 
@@ -1037,7 +1340,7 @@ describe('Group Model', () => {
       });
 
       it('formats message as system if no user is passed in', () => {
-        const chat = party.sendChat('a system message');
+        const chat = party.sendChat({message: 'a system message'});
 
         expect(chat.text).to.eql('a system message');
         expect(validator.isUUID(chat.id)).to.eql(true);
@@ -1052,7 +1355,7 @@ describe('Group Model', () => {
       });
 
       it('updates users about new messages in party', () => {
-        party.sendChat('message');
+        party.sendChat({message: 'message'});
 
         expect(User.update).to.be.calledOnce;
         expect(User.update).to.be.calledWithMatch({
@@ -1066,7 +1369,7 @@ describe('Group Model', () => {
           type: 'guild',
         });
 
-        group.sendChat('message');
+        group.sendChat({message: 'message'});
 
         expect(User.update).to.be.calledOnce;
         expect(User.update).to.be.calledWithMatch({
@@ -1076,7 +1379,7 @@ describe('Group Model', () => {
       });
 
       it('does not send update to user that sent the message', () => {
-        party.sendChat('message', {_id: 'user-id', profile: { name: 'user' }});
+        party.sendChat({message: 'message', user: {_id: 'user-id', profile: { name: 'user' }}});
 
         expect(User.update).to.be.calledOnce;
         expect(User.update).to.be.calledWithMatch({
@@ -1088,7 +1391,7 @@ describe('Group Model', () => {
       it('skips sending new message notification for guilds with > 5000 members', () => {
         party.memberCount = 5001;
 
-        party.sendChat('message');
+        party.sendChat({message: 'message'});
 
         expect(User.update).to.not.be.called;
       });
@@ -1096,7 +1399,7 @@ describe('Group Model', () => {
       it('skips sending messages to the tavern', () => {
         party._id = TAVERN_ID;
 
-        party.sendChat('message');
+        party.sendChat({message: 'message'});
 
         expect(User.update).to.not.be.called;
       });
@@ -1431,7 +1734,7 @@ describe('Group Model', () => {
       let quest;
 
       beforeEach(() => {
-        quest = questScrolls.whale;
+        quest = questScrolls.armadillo;
         party.quest.key = quest.key;
         party.quest.active = false;
         party.quest.leader = questLeader._id;
@@ -1579,6 +1882,36 @@ describe('Group Model', () => {
         expect(updatedSleepingParticipatingMember.achievements.lostMasterclasser).to.not.eql(true);
       });
 
+      it('gives out other pet-related quest achievements', async () => {
+        quest = questScrolls.rock;
+        party.quest.key = quest.key;
+
+        questLeader.achievements.quests = {
+          mayhemMistiflying1: 1,
+          yarn: 1,
+          mayhemMistiflying2: 1,
+          egg: 1,
+          mayhemMistiflying3: 1,
+          slime: 2,
+        };
+        await questLeader.save();
+        await party.finishQuest(quest);
+
+        let [
+          updatedLeader,
+          updatedParticipatingMember,
+          updatedSleepingParticipatingMember,
+        ] = await Promise.all([
+          User.findById(questLeader._id).exec(),
+          User.findById(participatingMember._id).exec(),
+          User.findById(sleepingParticipatingMember._id).exec(),
+        ]);
+
+        expect(updatedLeader.achievements.mindOverMatter).to.eql(true);
+        expect(updatedParticipatingMember.achievements.mindOverMatter).to.not.eql(true);
+        expect(updatedSleepingParticipatingMember.achievements.mindOverMatter).to.not.eql(true);
+      });
+
       it('gives xp and gold', async () => {
         await party.finishQuest(quest);
 
@@ -1715,13 +2048,13 @@ describe('Group Model', () => {
           questLeader = await User.findById(questLeader._id);
           participatingMember = await User.findById(participatingMember._id);
 
-          expect(questLeader.party.quest.completed).to.eql('whale');
+          expect(questLeader.party.quest.completed).to.eql('armadillo');
           expect(questLeader.party.quest.progress.up).to.eql(10);
           expect(questLeader.party.quest.progress.down).to.eql(8);
           expect(questLeader.party.quest.progress.collectedItems).to.eql(5);
           expect(questLeader.party.quest.RSVPNeeded).to.eql(false);
 
-          expect(participatingMember.party.quest.completed).to.eql('whale');
+          expect(participatingMember.party.quest.completed).to.eql('armadillo');
           expect(participatingMember.party.quest.progress.up).to.eql(10);
           expect(participatingMember.party.quest.progress.down).to.eql(8);
           expect(participatingMember.party.quest.progress.collectedItems).to.eql(5);
@@ -1928,7 +2261,7 @@ describe('Group Model', () => {
 
         await guild.save();
 
-        const groupMessage = guild.sendChat('Test message.');
+        const groupMessage = guild.sendChat({message: 'Test message.'});
         await groupMessage.save();
 
         await sleep();

test/api/v3/integration/challenges/GET-challenges_user.test.js

@@ -171,7 +171,7 @@ describe('GET challenges/user', () => {
       });
     });
 
-    it('should return not return challenges in user groups if we send member true param', async () => {
+    it('should not return challenges in user groups if we send member true param', async () => {
       let challenges = await member.get(`/challenges/user?member=${true}`);
 
       let foundChallenge1 = _.find(challenges, { _id: challenge._id });
@@ -214,6 +214,28 @@ describe('GET challenges/user', () => {
       let foundChallenge = _.find(challenges, { _id: privateChallenge._id });
       expect(foundChallenge).to.not.exist;
     });
+
+    it('should not return challenges user doesn\'t have access to, even with query parameters', async () => {
+      let { group, groupLeader } = await createAndPopulateGroup({
+        groupDetails: {
+          name: 'TestPrivateGuild',
+          summary: 'summary for TestPrivateGuild',
+          type: 'guild',
+          privacy: 'private',
+        },
+      });
+
+      let privateChallenge = await generateChallenge(groupLeader, group, {categories: [{
+        name: 'academics',
+        slug: 'academics',
+      }]});
+      await groupLeader.post(`/challenges/${privateChallenge._id}/join`);
+
+      let challenges = await nonMember.get('/challenges/user?categories=academics&owned=not_owned');
+
+      let foundChallenge = _.find(challenges, { _id: privateChallenge._id });
+      expect(foundChallenge).to.not.exist;
+    });
   });
 
   context('official challenge is present', () => {

test/api/v3/integration/challenges/PUT-challenges_challengeId.test.js

@@ -56,11 +56,11 @@ describe('PUT /challenges/:challengeId', () => {
       tasksOrder: 'new order',
       official: true,
       shortName: 'new short name',
+      leader: member._id,
 
       // applied
       name: 'New Challenge Name',
       description: 'New challenge description.',
-      leader: member._id,
     });
 
     expect(res.prize).to.equal(0);
@@ -76,12 +76,12 @@ describe('PUT /challenges/:challengeId', () => {
     expect(res.shortName).not.to.equal('new short name');
 
     expect(res.leader).to.eql({
-      _id: member._id,
-      id: member._id,
-      profile: {name: member.profile.name},
+      _id: user._id,
+      id: user._id,
+      profile: {name: user.profile.name},
       auth: {
         local: {
-          username: member.auth.local.username,
+          username: user.auth.local.username,
         },
       },
       flags: {

test/api/v3/integration/chat/POST-chat.flag.test.js

@@ -63,11 +63,11 @@ describe('POST /chat/:chatId/flag', () => {
 
     /* eslint-disable camelcase */
     expect(IncomingWebhook.prototype.send).to.be.calledWith({
-      text: `${user.profile.name} (${user.id}; language: en) flagged a message`,
+      text: `${user.profile.name} (${user.id}; language: en) flagged a group message`,
       attachments: [{
         fallback: 'Flag Message',
         color: 'danger',
-        author_name: `${anotherUser.profile.name} - ${anotherUser.auth.local.email} - ${anotherUser._id}\n${timestamp}`,
+        author_name: `@${anotherUser.auth.local.username} ${anotherUser.profile.name} (${anotherUser.auth.local.email}; ${anotherUser._id})\n${timestamp}`,
         title: 'Flag in Test Guild',
         title_link: `${BASE_URL}/groups/guild/${group._id}`,
         text: TEST_MESSAGE,
@@ -98,11 +98,11 @@ describe('POST /chat/:chatId/flag', () => {
 
     /* eslint-disable camelcase */
     expect(IncomingWebhook.prototype.send).to.be.calledWith({
-      text: `${newUser.profile.name} (${newUser.id}; language: en) flagged a message`,
+      text: `${newUser.profile.name} (${newUser.id}; language: en) flagged a group message`,
       attachments: [{
         fallback: 'Flag Message',
         color: 'danger',
-        author_name: `${newUser.profile.name} - ${newUser.auth.local.email} - ${newUser._id}\n${timestamp}`,
+        author_name: `@${newUser.auth.local.username} ${newUser.profile.name} (${newUser.auth.local.email}; ${newUser._id})\n${timestamp}`,
         title: 'Flag in Test Guild',
         title_link: `${BASE_URL}/groups/guild/${group._id}`,
         text: TEST_MESSAGE,

test/api/v3/integration/chat/POST-chat.test.js

@@ -12,6 +12,7 @@ import {
   SPAM_MIN_EXEMPT_CONTRIB_LEVEL,
   TAVERN_ID,
 } from '../../../../../website/server/models/group';
+import { CHAT_FLAG_FROM_SHADOW_MUTE } from '../../../../../website/common/script/constants';
 import { v4 as generateUUID } from 'uuid';
 import { getMatchesByWordArray } from '../../../../../website/server/libs/stringUtils';
 import bannedWords from '../../../../../website/server/libs/bannedWords';
@@ -81,6 +82,10 @@ describe('POST /chat', () => {
   });
 
   describe('mute user', () => {
+    afterEach(() => {
+      member.update({'flags.chatRevoked': false});
+    });
+
     it('returns an error when chat privileges are revoked when sending a message to a public guild', async () => {
       const userWithChatRevoked = await member.update({'flags.chatRevoked': true});
       await expect(userWithChatRevoked.post(`/groups/${groupWithChat._id}/chat`, { message: testMessage})).to.eventually.be.rejected.and.eql({
@@ -89,6 +94,129 @@ describe('POST /chat', () => {
         message: t('chatPrivilegesRevoked'),
       });
     });
+
+    it('does not error when chat privileges are revoked when sending a message to a private guild', async () => {
+      const { group, members } = await createAndPopulateGroup({
+        groupDetails: {
+          name: 'Private Guild',
+          type: 'guild',
+          privacy: 'private',
+        },
+        members: 1,
+      });
+
+      const privateGuildMemberWithChatsRevoked = members[0];
+      await privateGuildMemberWithChatsRevoked.update({'flags.chatRevoked': true});
+
+      const message = await privateGuildMemberWithChatsRevoked.post(`/groups/${group._id}/chat`, { message: testMessage});
+
+      expect(message.message.id).to.exist;
+    });
+
+    it('does not error when chat privileges are revoked when sending a message to a party', async () => {
+      const { group, members } = await createAndPopulateGroup({
+        groupDetails: {
+          name: 'Party',
+          type: 'party',
+          privacy: 'private',
+        },
+        members: 1,
+      });
+
+      const privatePartyMemberWithChatsRevoked = members[0];
+      await privatePartyMemberWithChatsRevoked.update({'flags.chatRevoked': true});
+
+      const message = await privatePartyMemberWithChatsRevoked.post(`/groups/${group._id}/chat`, { message: testMessage});
+
+      expect(message.message.id).to.exist;
+    });
+  });
+
+  describe('shadow-mute user', () => {
+    beforeEach(() => {
+      sandbox.spy(email, 'sendTxn');
+      sandbox.stub(IncomingWebhook.prototype, 'send');
+    });
+
+    afterEach(() => {
+      sandbox.restore();
+      member.update({'flags.chatShadowMuted': false});
+    });
+
+    it('creates a chat with flagCount already set and notifies mods when sending a message to a public guild', async () => {
+      const userWithChatShadowMuted = await member.update({'flags.chatShadowMuted': true});
+      const message = await userWithChatShadowMuted.post(`/groups/${groupWithChat._id}/chat`, { message: testMessage});
+      expect(message.message.id).to.exist;
+      expect(message.message.flagCount).to.eql(CHAT_FLAG_FROM_SHADOW_MUTE);
+
+      // Email sent to mods
+      await sleep(0.5);
+      expect(email.sendTxn).to.be.calledOnce;
+      expect(email.sendTxn.args[0][1]).to.eql('shadow-muted-post-report-to-mods');
+
+      // Slack message to mods
+      expect(IncomingWebhook.prototype.send).to.be.calledOnce;
+      /* eslint-disable camelcase */
+      expect(IncomingWebhook.prototype.send).to.be.calledWith({
+        text: `@${member.auth.local.username} / ${member.profile.name} posted while shadow-muted`,
+        attachments: [{
+          fallback: 'Shadow-Muted Message',
+          color: 'danger',
+          author_name: `@${member.auth.local.username} ${member.profile.name} (${member.auth.local.email}; ${member._id})`,
+          title: 'Shadow-Muted Post in Test Guild',
+          title_link: `${BASE_URL}/groups/guild/${groupWithChat.id}`,
+          text: testMessage,
+          mrkdwn_in: [
+            'text',
+          ],
+        }],
+      });
+      /* eslint-enable camelcase */
+    });
+
+    it('creates a chat with zero flagCount when sending a message to a private guild', async () => {
+      const { group, members } = await createAndPopulateGroup({
+        groupDetails: {
+          name: 'Private Guild',
+          type: 'guild',
+          privacy: 'private',
+        },
+        members: 1,
+      });
+
+      const userWithChatShadowMuted = members[0];
+      await userWithChatShadowMuted.update({'flags.chatShadowMuted': true});
+
+      const message = await userWithChatShadowMuted.post(`/groups/${group._id}/chat`, { message: testMessage});
+
+      expect(message.message.id).to.exist;
+      expect(message.message.flagCount).to.eql(0);
+    });
+
+    it('creates a chat with zero flagCount when sending a message to a party', async () => {
+      const { group, members } = await createAndPopulateGroup({
+        groupDetails: {
+          name: 'Party',
+          type: 'party',
+          privacy: 'private',
+        },
+        members: 1,
+      });
+
+      const userWithChatShadowMuted = members[0];
+      await userWithChatShadowMuted.update({'flags.chatShadowMuted': true});
+
+      const message = await userWithChatShadowMuted.post(`/groups/${group._id}/chat`, { message: testMessage});
+
+      expect(message.message.id).to.exist;
+      expect(message.message.flagCount).to.eql(0);
+    });
+
+    it('creates a chat with zero flagCount when non-shadow-muted user sends a message to a public guild', async () => {
+      const message = await member.post(`/groups/${groupWithChat._id}/chat`, { message: testMessage});
+      expect(message.message.id).to.exist;
+      expect(message.message.flagCount).to.eql(0);
+    });
   });
 
   context('banned word', () => {
@@ -235,6 +363,7 @@ describe('POST /chat', () => {
 
     afterEach(() => {
       sandbox.restore();
+      user.update({'flags.chatRevoked': false});
     });
 
     it('errors and revokes privileges when chat message contains a banned slur', async () => {
@@ -257,7 +386,7 @@ describe('POST /chat', () => {
         attachments: [{
           fallback: 'Slur Message',
           color: 'danger',
-          author_name: `${user.profile.name} - ${user.auth.local.email} - ${user._id}`,
+          author_name: `@${user.auth.local.username} ${user.profile.name} (${user.auth.local.email}; ${user._id})`,
           title: 'Slur in Test Guild',
           title_link: `${BASE_URL}/groups/guild/${groupWithChat.id}`,
           text: testSlurMessage,
@@ -274,11 +403,6 @@ describe('POST /chat', () => {
         error: 'NotAuthorized',
         message: t('chatPrivilegesRevoked'),
       });
-
-      // @TODO: The next test should not depend on this. We should reset the user test in a beforeEach
-      // Restore chat privileges to continue testing
-      user.flags.chatRevoked = false;
-      await user.update({'flags.chatRevoked': false});
     });
 
     it('does not allow slurs in private groups', async () => {
@@ -310,7 +434,7 @@ describe('POST /chat', () => {
         attachments: [{
           fallback: 'Slur Message',
           color: 'danger',
-          author_name: `${members[0].profile.name} - ${members[0].auth.local.email} - ${members[0]._id}`,
+          author_name: `@${members[0].auth.local.username} ${members[0].profile.name} (${members[0].auth.local.email}; ${members[0]._id})`,
           title: 'Slur in Party - (private party)',
           title_link: undefined,
           text: testSlurMessage,
@@ -327,10 +451,6 @@ describe('POST /chat', () => {
         error: 'NotAuthorized',
         message: t('chatPrivilegesRevoked'),
       });
-
-      // Restore chat privileges to continue testing
-      members[0].flags.chatRevoked = false;
-      await members[0].update({'flags.chatRevoked': false});
     });
 
     it('errors when slur is typed in mixed case', async () => {
@@ -345,42 +465,6 @@ describe('POST /chat', () => {
     });
   });
 
-  it('does not error when sending a message to a private guild with a user with revoked chat', async () => {
-    let { group, members } = await createAndPopulateGroup({
-      groupDetails: {
-        name: 'Private Guild',
-        type: 'guild',
-        privacy: 'private',
-      },
-      members: 1,
-    });
-
-    let privateGuildMemberWithChatsRevoked = members[0];
-    await privateGuildMemberWithChatsRevoked.update({'flags.chatRevoked': true});
-
-    let message = await privateGuildMemberWithChatsRevoked.post(`/groups/${group._id}/chat`, { message: testMessage});
-
-    expect(message.message.id).to.exist;
-  });
-
-  it('does not error when sending a message to a party with a user with revoked chat', async () => {
-    let { group, members } = await createAndPopulateGroup({
-      groupDetails: {
-        name: 'Party',
-        type: 'party',
-        privacy: 'private',
-      },
-      members: 1,
-    });
-
-    let privatePartyMemberWithChatsRevoked = members[0];
-    await privatePartyMemberWithChatsRevoked.update({'flags.chatRevoked': true});
-
-    let message = await privatePartyMemberWithChatsRevoked.post(`/groups/${group._id}/chat`, { message: testMessage});
-
-    expect(message.message.id).to.exist;
-  });
-
   it('creates a chat', async () => {
     const newMessage = await user.post(`/groups/${groupWithChat._id}/chat`, { message: testMessage});
     const groupMessages = await user.get(`/groups/${groupWithChat._id}/chat`);
@@ -486,35 +570,55 @@ describe('POST /chat', () => {
     });
   });
 
-  it('notifies other users of new messages for a guild', async () => {
-    let message = await user.post(`/groups/${groupWithChat._id}/chat`, { message: testMessage});
-    let memberWithNotification = await member.get('/user');
-
-    expect(message.message.id).to.exist;
-    expect(memberWithNotification.newMessages[`${groupWithChat._id}`]).to.exist;
-    expect(memberWithNotification.notifications.find(n => {
-      return n.type === 'NEW_CHAT_MESSAGE' && n.data.group.id === groupWithChat._id;
-    })).to.exist;
-  });
-
-  it('notifies other users of new messages for a party', async () => {
-    let { group, groupLeader, members } = await createAndPopulateGroup({
-      groupDetails: {
-        name: 'Test Party',
-        type: 'party',
-        privacy: 'private',
-      },
-      members: 1,
+  context('chat notifications', () => {
+    beforeEach(() => {
+      member.update({newMessages: {}, notifications: []});
     });
 
-    let message = await groupLeader.post(`/groups/${group._id}/chat`, { message: testMessage});
-    let memberWithNotification = await members[0].get('/user');
+    it('notifies other users of new messages for a guild', async () => {
+      let message = await user.post(`/groups/${groupWithChat._id}/chat`, { message: testMessage });
+      let memberWithNotification = await member.get('/user');
 
-    expect(message.message.id).to.exist;
-    expect(memberWithNotification.newMessages[`${group._id}`]).to.exist;
-    expect(memberWithNotification.notifications.find(n => {
-      return n.type === 'NEW_CHAT_MESSAGE' && n.data.group.id === group._id;
-    })).to.exist;
+      expect(message.message.id).to.exist;
+      expect(memberWithNotification.newMessages[`${groupWithChat._id}`]).to.exist;
+      expect(memberWithNotification.notifications.find(n => {
+        return n.type === 'NEW_CHAT_MESSAGE' && n.data.group.id === groupWithChat._id;
+      })).to.exist;
+    });
+
+    it('notifies other users of new messages for a party', async () => {
+      let { group, groupLeader, members } = await createAndPopulateGroup({
+        groupDetails: {
+          name: 'Test Party',
+          type: 'party',
+          privacy: 'private',
+        },
+        members: 1,
+      });
+
+      let message = await groupLeader.post(`/groups/${group._id}/chat`, { message: testMessage });
+      let memberWithNotification = await members[0].get('/user');
+
+      expect(message.message.id).to.exist;
+      expect(memberWithNotification.newMessages[`${group._id}`]).to.exist;
+      expect(memberWithNotification.notifications.find(n => {
+        return n.type === 'NEW_CHAT_MESSAGE' && n.data.group.id === group._id;
+      })).to.exist;
+    });
+
+    it('does not notify other users of a new message that is already hidden from shadow-muting', async () => {
+      await user.update({'flags.chatShadowMuted': true});
+      let message = await user.post(`/groups/${groupWithChat._id}/chat`, { message: testMessage });
+      let memberWithNotification = await member.get('/user');
+
+      await user.update({'flags.chatShadowMuted': false});
+
+      expect(message.message.id).to.exist;
+      expect(memberWithNotification.newMessages[`${groupWithChat._id}`]).to.not.exist;
+      expect(memberWithNotification.notifications.find(n => {
+        return n.type === 'NEW_CHAT_MESSAGE' && n.data.group.id === groupWithChat._id;
+      })).to.not.exist;
+    });
   });
 
   context('Spam prevention', () => {
@@ -533,7 +637,7 @@ describe('POST /chat', () => {
     });
 
     it('contributor should not receive spam alert', async () => {
-      let userSocialite = await member.update({'contributor.level': SPAM_MIN_EXEMPT_CONTRIB_LEVEL, 'flags.chatRevoked': false});
+      let userSocialite = await member.update({'contributor.level': SPAM_MIN_EXEMPT_CONTRIB_LEVEL});
 
       // Post 1 more message than the spam limit to ensure they do not reach the limit
       for (let i = 0; i < SPAM_MESSAGE_LIMIT + 1; i++) {

test/api/v3/integration/groups/POST-groups.test.js

@@ -149,7 +149,7 @@ describe('POST /group', () => {
         ).to.eventually.be.rejected.and.eql({
           code: 401,
           error: 'NotAuthorized',
-          message: t('cannotCreatePublicGuildWhenMuted'),
+          message: t('chatPrivilegesRevoked'),
         });
       });
     });

test/api/v3/integration/groups/POST-groups_groupId_leave.js

@@ -276,44 +276,70 @@ describe('POST /groups/:groupId/leave', () => {
     });
   });
 
-  context('Leaving a group plan', () => {
-    it('cancels the free subscription', async () => {
-      // Create group
-      let { group, groupLeader, members } = await createAndPopulateGroup({
-        groupDetails: {
-          name: 'Test Private Guild',
-          type: 'guild',
-        },
-        members: 1,
+  each(typesOfGroups, (groupDetails, groupType) => {
+    context(`Leaving a group plan when the group is a ${groupType}`, () => {
+      let groupWithPlan;
+      let leader;
+      let member;
+
+      beforeEach(async () => {
+        let { group, groupLeader, members } = await createAndPopulateGroup({
+          groupDetails,
+          members: 1,
+        });
+        leader = groupLeader;
+        member = members[0];
+        groupWithPlan = group;
+        let userWithFreePlan = await User.findById(leader._id).exec();
+
+        // Create subscription
+        let paymentData = {
+          user: userWithFreePlan,
+          groupId: groupWithPlan._id,
+          sub: {
+            key: 'basic_3mo',
+          },
+          customerId: 'customer-id',
+          paymentMethod: 'Payment Method',
+          headers: {
+            'x-client': 'habitica-web',
+            'user-agent': '',
+          },
+        };
+        await payments.createSubscription(paymentData);
+        await member.sync();
       });
 
-      let leader = groupLeader;
-      let member = members[0];
-      let userWithFreePlan = await User.findById(leader._id).exec();
+      it('cancels the free subscription', async () => {
+        expect(member.purchased.plan.planId).to.equal('group_plan_auto');
+        expect(member.purchased.plan.dateTerminated).to.not.exist;
 
-      // Create subscription
-      let paymentData = {
-        user: userWithFreePlan,
-        groupId: group._id,
-        sub: {
-          key: 'basic_3mo',
-        },
-        customerId: 'customer-id',
-        paymentMethod: 'Payment Method',
-        headers: {
-          'x-client': 'habitica-web',
-          'user-agent': '',
-        },
-      };
-      await payments.createSubscription(paymentData);
-      await member.sync();
-      expect(member.purchased.plan.planId).to.equal('group_plan_auto');
-      expect(member.purchased.plan.dateTerminated).to.not.exist;
+        // Leave
+        await member.post(`/groups/${groupWithPlan._id}/leave`);
+        await member.sync();
+        expect(member.purchased.plan.dateTerminated).to.exist;
+      });
 
-      // Leave
-      await member.post(`/groups/${group._id}/leave`);
-      await member.sync();
-      expect(member.purchased.plan.dateTerminated).to.exist;
+      it('preserves the free subscription when leaving a any other group without a plan', async () => {
+        // Joining a guild without a group plan
+        let { group: groupWithNoPlan } = await createAndPopulateGroup({
+          groupDetails: {
+            name: 'Group Without Plan',
+            type: 'guild',
+            privacy: 'public',
+          },
+        });
+
+        await member.post(`/groups/${groupWithNoPlan._id}/join`);
+        await member.sync();
+        expect(member.purchased.plan.planId).to.equal('group_plan_auto');
+        expect(member.purchased.plan.dateTerminated).to.not.exist;
+
+        // Leaving the guild without a group plan
+        await member.post(`/groups/${groupWithNoPlan._id}/leave`);
+        await member.sync();
+        expect(member.purchased.plan.dateTerminated).to.not.exist;
+      });
     });
   });
 });

test/api/v3/integration/groups/POST-groups_invite.test.js

@@ -100,7 +100,7 @@ describe('Post /groups/:groupId/invite', () => {
         .to.eventually.be.rejected.and.eql({
           code: 401,
           error: 'NotAuthorized',
-          message: t('cannotInviteWhenMuted'),
+          message: t('chatPrivilegesRevoked'),
         });
     });
 
@@ -262,7 +262,7 @@ describe('Post /groups/:groupId/invite', () => {
         .to.eventually.be.rejected.and.eql({
           code: 401,
           error: 'NotAuthorized',
-          message: t('cannotInviteWhenMuted'),
+          message: t('chatPrivilegesRevoked'),
         });
     });
 
@@ -436,7 +436,7 @@ describe('Post /groups/:groupId/invite', () => {
         .to.eventually.be.rejected.and.eql({
           code: 401,
           error: 'NotAuthorized',
-          message: t('cannotInviteWhenMuted'),
+          message: t('chatPrivilegesRevoked'),
         });
     });
 
@@ -526,7 +526,7 @@ describe('Post /groups/:groupId/invite', () => {
         .to.eventually.be.rejected.and.eql({
           code: 401,
           error: 'NotAuthorized',
-          message: t('cannotInviteWhenMuted'),
+          message: t('chatPrivilegesRevoked'),
         });
     });
 

test/api/v3/integration/hall/GET-hall_heroes_heroId.test.js

@@ -25,9 +25,9 @@ describe('GET /heroes/:heroId', () => {
 
   it('validates req.params.heroId', async () => {
     await expect(user.get('/hall/heroes/invalidUUID')).to.eventually.be.rejected.and.eql({
-      code: 400,
-      error: 'BadRequest',
-      message: t('invalidReqParams'),
+      code: 404,
+      error: 'NotFound',
+      message: t('userWithIDNotFound', {userId: 'invalidUUID'}),
     });
   });
 
@@ -40,7 +40,7 @@ describe('GET /heroes/:heroId', () => {
     });
   });
 
-  it('returns only necessary hero data', async () => {
+  it('returns only necessary hero data given user id', async () => {
     let hero = await generateUser({
       contributor: {tier: 23},
     });
@@ -53,4 +53,24 @@ describe('GET /heroes/:heroId', () => {
     expect(heroRes.auth.local).not.to.have.keys(['salt', 'hashed_password']);
     expect(heroRes.profile).to.have.all.keys(['name']);
   });
+
+  it('returns only necessary hero data given username', async () => {
+    let hero = await generateUser({
+      contributor: {tier: 23},
+    });
+    let heroRes = await user.get(`/hall/heroes/${hero.auth.local.username}`);
+
+    expect(heroRes).to.have.all.keys([ // works as: object has all and only these keys
+      '_id', 'id', 'balance', 'profile', 'purchased',
+      'contributor', 'auth', 'items',
+    ]);
+    expect(heroRes.auth.local).not.to.have.keys(['salt', 'hashed_password']);
+    expect(heroRes.profile).to.have.all.keys(['name']);
+  });
+
+  it('returns correct hero using search with difference case', async () => {
+    await generateUser({}, { username: 'TestUpperCaseName123' });
+    let heroRes = await user.get('/hall/heroes/TestuPPerCasEName123');
+    expect(heroRes.auth.local.username).to.equal('TestUpperCaseName123');
+  });
 });

test/api/v3/integration/hall/PUT-hall_heores_heroId.test.js

@@ -105,16 +105,22 @@ describe('PUT /heroes/:heroId', () => {
 
   it('updates chatRevoked flag', async () => {
     let hero = await generateUser();
-
     await user.put(`/hall/heroes/${hero._id}`, {
       flags: {chatRevoked: true},
     });
-
     await hero.sync();
-
     expect(hero.flags.chatRevoked).to.eql(true);
   });
 
+  it('updates chatShadowMuted flag', async () => {
+    let hero = await generateUser();
+    await user.put(`/hall/heroes/${hero._id}`, {
+      flags: {chatShadowMuted: true},
+    });
+    await hero.sync();
+    expect(hero.flags.chatShadowMuted).to.eql(true);
+  });
+
   it('updates contributor level', async () => {
     let hero = await generateUser({
       contributor: {level: 5},

test/api/v3/integration/inbox/GET-inbox_messages.test.js

@@ -6,7 +6,7 @@ describe('GET /inbox/messages', () => {
   let user;
   let otherUser;
 
-  before(async () => {
+  beforeEach(async () => {
     [user, otherUser] = await Promise.all([generateUser(), generateUser()]);
 
     await otherUser.post('/members/send-private-message', {
@@ -27,8 +27,6 @@ describe('GET /inbox/messages', () => {
       toUserId: user.id,
       message: 'fourth',
     });
-
-    await user.sync();
   });
 
   it('returns the user inbox messages as an array of ordered messages (from most to least recent)', async () => {
@@ -45,4 +43,27 @@ describe('GET /inbox/messages', () => {
     expect(messages[2].text).to.equal('second');
     expect(messages[3].text).to.equal('first');
   });
+
+  it('returns four messages when using page-query ', async () => {
+    const promises = [];
+
+    for (let i = 0; i < 10; i++) {
+      promises.push(user.post('/members/send-private-message', {
+        toUserId: user.id,
+        message: 'fourth',
+      }));
+    }
+
+    await Promise.all(promises);
+
+    const messages = await user.get('/inbox/messages?page=1');
+
+    expect(messages.length).to.equal(4);
+  });
+
+  it('returns only the messages of one conversation', async () => {
+    const messages = await user.get(`/inbox/messages?conversation=${otherUser.id}`);
+
+    expect(messages.length).to.equal(3);
+  });
 });

test/api/v3/integration/payments/stripe/POST-payments_stripe_checkout.test.js

@@ -13,10 +13,10 @@ describe('payments - stripe - #checkout', () => {
   });
 
   it('verifies credentials', async () => {
-    await expect(user.post(endpoint, {id: 123})).to.eventually.be.rejected.and.eql({
+    await expect(user.post(endpoint, {id: 123})).to.eventually.be.rejected.and.include({
       code: 401,
       error: 'Error',
-      message: 'Invalid API Key provided: ****************************1111',
+      message: 'Invalid API Key provided: aaaabbbb********************1111',
     });
   });
 

test/api/v3/integration/quests/POST-groups_groupid_quests_abort.test.js

@@ -127,7 +127,13 @@ describe('POST /groups/:groupId/quests/abort', () => {
       members: {},
     });
     expect(Group.prototype.sendChat).to.be.calledOnce;
-    expect(Group.prototype.sendChat).to.be.calledWithMatch(/aborted the party quest Wail of the Whale.`/);
+    expect(Group.prototype.sendChat).to.be.calledWithMatch({
+      message: sinon.match(/aborted the party quest Wail of the Whale.`/),
+      info: {
+        quest: 'whale',
+        type: 'quest_abort',
+      },
+    });
 
     stub.restore();
   });

test/api/v3/integration/quests/POST-groups_groupid_quests_cancel.test.js

@@ -4,6 +4,7 @@ import {
   generateUser,
 } from '../../../../helpers/api-integration/v3';
 import { v4 as generateUUID } from 'uuid';
+import { model as Group } from '../../../../../website/server/models/group';
 
 describe('POST /groups/:groupId/quests/cancel', () => {
   let questingGroup;
@@ -99,6 +100,10 @@ describe('POST /groups/:groupId/quests/cancel', () => {
   it('cancels a quest', async () => {
     await leader.post(`/groups/${questingGroup._id}/quests/invite/${PET_QUEST}`);
     await partyMembers[0].post(`/groups/${questingGroup._id}/quests/accept`);
+    // partyMembers[1] hasn't accepted the invitation, because if he accepts, invitation phase ends.
+    // The cancel command can be done only in the invitation phase.
+
+    let stub = sandbox.spy(Group.prototype, 'sendChat');
 
     let res = await leader.post(`/groups/${questingGroup._id}/quests/cancel`);
 
@@ -135,5 +140,16 @@ describe('POST /groups/:groupId/quests/cancel', () => {
       },
       members: {},
     });
+    expect(Group.prototype.sendChat).to.be.calledOnce;
+    expect(Group.prototype.sendChat).to.be.calledWithMatch({
+      message: sinon.match(/cancelled the party quest Wail of the Whale.`/),
+      info: {
+        quest: 'whale',
+        type: 'quest_cancel',
+        user: sinon.match.any,
+      },
+    });
+
+    stub.restore();
   });
 });

test/api/v3/integration/tasks/challenges/POST-tasks_challenge_id.test.js

@@ -54,6 +54,21 @@ describe('POST /tasks/challenge/:challengeId', () => {
     expect(tasksOrder.habits).to.include(task.id);
   });
 
+  it('allows non-leader admin to add tasks to a challenge when not a member', async () => {
+    const admin = await generateUser({'contributor.admin': true});
+    let task = await admin.post(`/tasks/challenge/${challenge._id}`, {
+      text: 'test habit from admin',
+      type: 'habit',
+      up: false,
+      down: true,
+      notes: 1976,
+    });
+
+    let {tasksOrder} =  await user.get(`/challenges/${challenge._id}`);
+
+    expect(tasksOrder.habits).to.include(task.id);
+  });
+
   it('returns error when user tries to create task with a alias', async () => {
     await expect(user.post(`/tasks/challenge/${challenge._id}`, {
       text: 'test habit',

test/api/v3/integration/tasks/groups/DELETE-group_tasks_id.test.js

@@ -63,6 +63,38 @@ describe('Groups DELETE /tasks/:id', () => {
       });
   });
 
+  it('removes deleted taskʾs approval pending notifications from managers', async () => {
+    await user.post(`/groups/${guild._id}/add-manager`, {
+      managerId: member2._id,
+    });
+    await user.put(`/tasks/${task._id}/`, {
+      requiresApproval: true,
+    });
+    let memberTasks = await member.get('/tasks/user');
+    let syncedTask = find(memberTasks, findAssignedTask);
+    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
+      .to.eventually.be.rejected.and.to.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('taskApprovalHasBeenRequested'),
+      });
+
+    await user.sync();
+    await member2.sync();
+    expect(user.notifications.length).to.equal(2);
+    expect(user.notifications[1].type).to.equal('GROUP_TASK_APPROVAL');
+    expect(member2.notifications.length).to.equal(2);
+    expect(member2.notifications[1].type).to.equal('GROUP_TASK_APPROVAL');
+
+    await member2.del(`/tasks/${task._id}`);
+
+    await user.sync();
+    await member2.sync();
+
+    expect(user.notifications.length).to.equal(1);
+    expect(member2.notifications.length).to.equal(1);
+  });
+
   it('unlinks assigned user', async () => {
     await user.del(`/tasks/${task._id}`);
 

test/api/v3/integration/tasks/groups/POST-group_tasks_id_approve_userId.test.js

@@ -53,18 +53,29 @@ describe('POST /tasks/:id/approve/:userId', () => {
 
   it('approves an assigned user', async () => {
     await user.post(`/tasks/${task._id}/assign/${member._id}`);
-    await user.post(`/tasks/${task._id}/approve/${member._id}`);
 
     let memberTasks = await member.get('/tasks/user');
     let syncedTask = find(memberTasks, findAssignedTask);
 
+    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
+      .to.eventually.be.rejected.and.to.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('taskApprovalHasBeenRequested'),
+      });
+
+    await user.post(`/tasks/${task._id}/approve/${member._id}`);
+
     await member.sync();
 
-    expect(member.notifications.length).to.equal(2);
-    expect(member.notifications[0].type).to.equal('GROUP_TASK_APPROVED');
-    expect(member.notifications[0].data.message).to.equal(t('yourTaskHasBeenApproved', {taskText: task.text}));
-    expect(member.notifications[1].type).to.equal('SCORED_TASK');
+    expect(member.notifications.length).to.equal(3);
+    expect(member.notifications[1].type).to.equal('GROUP_TASK_APPROVED');
     expect(member.notifications[1].data.message).to.equal(t('yourTaskHasBeenApproved', {taskText: task.text}));
+    expect(member.notifications[2].type).to.equal('SCORED_TASK');
+    expect(member.notifications[2].data.message).to.equal(t('yourTaskHasBeenApproved', {taskText: task.text}));
+
+    memberTasks = await member.get('/tasks/user');
+    syncedTask = find(memberTasks, findAssignedTask);
 
     expect(syncedTask.group.approval.approved).to.be.true;
     expect(syncedTask.group.approval.approvingUser).to.equal(user._id);
@@ -77,18 +88,28 @@ describe('POST /tasks/:id/approve/:userId', () => {
     });
 
     await member2.post(`/tasks/${task._id}/assign/${member._id}`);
-    await member2.post(`/tasks/${task._id}/approve/${member._id}`);
 
     let memberTasks = await member.get('/tasks/user');
     let syncedTask = find(memberTasks, findAssignedTask);
 
+    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
+      .to.eventually.be.rejected.and.to.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('taskApprovalHasBeenRequested'),
+      });
+
+    await member2.post(`/tasks/${task._id}/approve/${member._id}`);
     await member.sync();
 
-    expect(member.notifications.length).to.equal(2);
-    expect(member.notifications[0].type).to.equal('GROUP_TASK_APPROVED');
-    expect(member.notifications[0].data.message).to.equal(t('yourTaskHasBeenApproved', {taskText: task.text}));
-    expect(member.notifications[1].type).to.equal('SCORED_TASK');
+    expect(member.notifications.length).to.equal(3);
+    expect(member.notifications[1].type).to.equal('GROUP_TASK_APPROVED');
     expect(member.notifications[1].data.message).to.equal(t('yourTaskHasBeenApproved', {taskText: task.text}));
+    expect(member.notifications[2].type).to.equal('SCORED_TASK');
+    expect(member.notifications[2].data.message).to.equal(t('yourTaskHasBeenApproved', {taskText: task.text}));
+
+    memberTasks = await member.get('/tasks/user');
+    syncedTask = find(memberTasks, findAssignedTask);
 
     expect(syncedTask.group.approval.approved).to.be.true;
     expect(syncedTask.group.approval.approvingUser).to.equal(member2._id);
@@ -132,6 +153,16 @@ describe('POST /tasks/:id/approve/:userId', () => {
     });
 
     await member2.post(`/tasks/${task._id}/assign/${member._id}`);
+
+    let memberTasks = await member.get('/tasks/user');
+    let syncedTask = find(memberTasks, findAssignedTask);
+    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
+      .to.eventually.be.rejected.and.to.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('taskApprovalHasBeenRequested'),
+      });
+
     await member2.post(`/tasks/${task._id}/approve/${member._id}`);
     await expect(user.post(`/tasks/${task._id}/approve/${member._id}`))
       .to.eventually.be.rejected.and.to.eql({
@@ -141,6 +172,17 @@ describe('POST /tasks/:id/approve/:userId', () => {
       });
   });
 
+  it('prevents approving a task if it is not waiting for approval', async () => {
+    await user.post(`/tasks/${task._id}/assign/${member._id}`);
+
+    await expect(user.post(`/tasks/${task._id}/approve/${member._id}`))
+      .to.eventually.be.rejected.and.to.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('taskApprovalWasNotRequested'),
+      });
+  });
+
   it('completes master task when single-completion task is approved', async () => {
     let sharedCompletionTask = await user.post(`/tasks/group/${guild._id}`, {
       text: 'shared completion todo',
@@ -151,6 +193,16 @@ describe('POST /tasks/:id/approve/:userId', () => {
 
     await user.post(`/tasks/${sharedCompletionTask._id}/assign/${member._id}`);
     await user.post(`/tasks/${sharedCompletionTask._id}/assign/${member2._id}`);
+
+    let memberTasks = await member.get('/tasks/user');
+    let syncedTask = find(memberTasks, findAssignedTask);
+    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
+      .to.eventually.be.rejected.and.to.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('taskApprovalHasBeenRequested'),
+      });
+
     await user.post(`/tasks/${sharedCompletionTask._id}/approve/${member._id}`);
 
     let groupTasks = await user.get(`/tasks/group/${guild._id}?type=completedTodos`);
@@ -172,6 +224,16 @@ describe('POST /tasks/:id/approve/:userId', () => {
 
     await user.post(`/tasks/${sharedCompletionTask._id}/assign/${member._id}`);
     await user.post(`/tasks/${sharedCompletionTask._id}/assign/${member2._id}`);
+
+    let memberTasks = await member.get('/tasks/user');
+    let syncedTask = find(memberTasks, findAssignedTask);
+    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
+      .to.eventually.be.rejected.and.to.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('taskApprovalHasBeenRequested'),
+      });
+
     await user.post(`/tasks/${sharedCompletionTask._id}/approve/${member._id}`);
 
     let member2Tasks = await member2.get('/tasks/user');
@@ -193,6 +255,16 @@ describe('POST /tasks/:id/approve/:userId', () => {
 
     await user.post(`/tasks/${sharedCompletionTask._id}/assign/${member._id}`);
     await user.post(`/tasks/${sharedCompletionTask._id}/assign/${member2._id}`);
+
+    let memberTasks = await member.get('/tasks/user');
+    let syncedTask = find(memberTasks, findAssignedTask);
+    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
+      .to.eventually.be.rejected.and.to.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('taskApprovalHasBeenRequested'),
+      });
+
     await user.post(`/tasks/${sharedCompletionTask._id}/approve/${member._id}`);
 
     let groupTasks = await user.get(`/tasks/group/${guild._id}`);
@@ -214,6 +286,25 @@ describe('POST /tasks/:id/approve/:userId', () => {
 
     await user.post(`/tasks/${sharedCompletionTask._id}/assign/${member._id}`);
     await user.post(`/tasks/${sharedCompletionTask._id}/assign/${member2._id}`);
+
+    let memberTasks = await member.get('/tasks/user');
+    let syncedTask = find(memberTasks, findAssignedTask);
+    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
+      .to.eventually.be.rejected.and.to.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('taskApprovalHasBeenRequested'),
+      });
+
+    let member2Tasks = await member2.get('/tasks/user');
+    let member2SyncedTask = find(member2Tasks, findAssignedTask);
+    await expect(member2.post(`/tasks/${member2SyncedTask._id}/score/up`))
+      .to.eventually.be.rejected.and.to.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('taskApprovalHasBeenRequested'),
+      });
+
     await user.post(`/tasks/${sharedCompletionTask._id}/approve/${member._id}`);
     await user.post(`/tasks/${sharedCompletionTask._id}/approve/${member2._id}`);
 

test/api/v3/integration/tasks/groups/POST-group_tasks_id_needs-work_userId.test.js

@@ -51,7 +51,7 @@ describe('POST /tasks/:id/needs-work/:userId', () => {
       });
   });
 
-  it('marks as task as needing more work', async () => {
+  it('marks a task as needing more work', async () => {
     const initialNotifications = member.notifications.length;
 
     await user.post(`/tasks/${task._id}/assign/${member._id}`);
@@ -77,7 +77,7 @@ describe('POST /tasks/:id/needs-work/:userId', () => {
     expect(syncedTask.group.approval.requestedDate).to.equal(undefined);
 
     // Check that the notification is correct
-    expect(member.notifications.length).to.equal(initialNotifications + 1);
+    expect(member.notifications.length).to.equal(initialNotifications + 2);
     const notification = member.notifications[member.notifications.length - 1];
     expect(notification.type).to.equal('GROUP_TASK_NEEDS_WORK');
 
@@ -131,7 +131,7 @@ describe('POST /tasks/:id/needs-work/:userId', () => {
     expect(syncedTask.group.approval.requested).to.equal(false);
     expect(syncedTask.group.approval.requestedDate).to.equal(undefined);
 
-    expect(member.notifications.length).to.equal(initialNotifications + 1);
+    expect(member.notifications.length).to.equal(initialNotifications + 2);
     const notification = member.notifications[member.notifications.length - 1];
     expect(notification.type).to.equal('GROUP_TASK_NEEDS_WORK');
 
@@ -167,6 +167,17 @@ describe('POST /tasks/:id/needs-work/:userId', () => {
     });
 
     await member2.post(`/tasks/${task._id}/assign/${member._id}`);
+
+    let memberTasks = await member.get('/tasks/user');
+    let syncedTask = find(memberTasks, findAssignedTask);
+
+    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
+      .to.eventually.be.rejected.and.to.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('taskApprovalHasBeenRequested'),
+      });
+
     await member2.post(`/tasks/${task._id}/approve/${member._id}`);
     await expect(user.post(`/tasks/${task._id}/needs-work/${member._id}`))
       .to.eventually.be.rejected.and.to.eql({

test/api/v3/integration/tasks/groups/POST-group_tasks_id_score_direction.test.js

@@ -129,6 +129,13 @@ describe('POST /tasks/:id/score/:direction', () => {
     let memberTasks = await member.get('/tasks/user');
     let syncedTask = find(memberTasks, findAssignedTask);
 
+    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
+      .to.eventually.be.rejected.and.to.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('taskApprovalHasBeenRequested'),
+      });
+
     await user.post(`/tasks/${task._id}/approve/${member._id}`);
 
     await member.post(`/tasks/${syncedTask._id}/score/up`);

test/api/v3/integration/tasks/groups/POST-tasks_group_id_assign_user_id.test.js

@@ -93,15 +93,6 @@ describe('POST /tasks/:taskId/assign/:memberId', () => {
     expect(syncedTask).to.exist;
   });
 
-  it('sends a message to the group when a user claims a task', async () => {
-    await member.post(`/tasks/${task._id}/assign/${member._id}`);
-
-    let updateGroup = await user.get(`/groups/${guild._id}`);
-
-    expect(updateGroup.chat[0].text).to.equal(t('userIsClamingTask', {username: member.profile.name, task: task.text}));
-    expect(updateGroup.chat[0].uuid).to.equal('system');
-  });
-
   it('assigns a task to a user', async () => {
     await user.post(`/tasks/${task._id}/assign/${member._id}`);
 
@@ -113,6 +104,17 @@ describe('POST /tasks/:taskId/assign/:memberId', () => {
     expect(syncedTask).to.exist;
   });
 
+  it('sends a notification to assigned user', async () => {
+    await user.post(`/tasks/${task._id}/assign/${member._id}`);
+    await member.sync();
+
+    let groupTask = await user.get(`/tasks/group/${guild._id}`);
+
+    expect(member.notifications.length).to.equal(1);
+    expect(member.notifications[0].type).to.equal('GROUP_TASK_ASSIGNED');
+    expect(member.notifications[0].taskId).to.equal(groupTask._id);
+  });
+
   it('assigns a task to multiple users', async () => {
     await user.post(`/tasks/${task._id}/assign/${member._id}`);
     await user.post(`/tasks/${task._id}/assign/${member2._id}`);

test/api/v3/integration/tasks/groups/POST-tasks_task_id_unassign.test.js

@@ -86,6 +86,13 @@ describe('POST /tasks/:taskId/unassign/:memberId', () => {
     expect(syncedTask).to.not.exist;
   });
 
+  it('removes task assignment notification from unassigned user', async () => {
+    await user.post(`/tasks/${task._id}/unassign/${member._id}`);
+
+    await member.sync();
+    expect(member.notifications.length).to.equal(0);
+  });
+
   it('unassigns a user and only that user from a task', async () => {
     await user.post(`/tasks/${task._id}/assign/${member2._id}`);
 

test/api/v3/integration/user/POST-user_open_mystery_item.test.js

@@ -9,6 +9,7 @@ describe('POST /user/open-mystery-item', () => {
   let mysteryItemKey = 'eyewear_special_summerRogue';
   let mysteryItemIndex = content.gear.flat[mysteryItemKey].index;
   let mysteryItemType = content.gear.flat[mysteryItemKey].type;
+  let mysteryItemText = content.gear.flat[mysteryItemKey].text();
 
   beforeEach(async () => {
     user = await generateUser({
@@ -32,5 +33,6 @@ describe('POST /user/open-mystery-item', () => {
     expect(response.data.key).to.eql(mysteryItemKey);
     expect(response.data.index).to.eql(mysteryItemIndex);
     expect(response.data.type).to.eql(mysteryItemType);
+    expect(response.data.text).to.eql(mysteryItemText);
   });
 });

test/api/v3/integration/user/POST-user_purchase_hourglass.test.js

@@ -14,7 +14,7 @@ describe('POST /user/purchase-hourglass/:type/:key', () => {
 
   // More tests in common code unit tests
 
-  it('buys a hourglass pet', async () => {
+  it('buys an hourglass pet', async () => {
     let response = await user.post('/user/purchase-hourglass/pets/MantisShrimp-Base');
     await user.sync();
 
@@ -22,4 +22,22 @@ describe('POST /user/purchase-hourglass/:type/:key', () => {
     expect(user.purchased.plan.consecutive.trinkets).to.eql(1);
     expect(user.items.pets['MantisShrimp-Base']).to.eql(5);
   });
+
+  it('buys an hourglass quest', async () => {
+    let response = await user.post('/user/purchase-hourglass/quests/robot');
+    await user.sync();
+
+    expect(response.message).to.eql(t('hourglassPurchase'));
+    expect(user.purchased.plan.consecutive.trinkets).to.eql(1);
+    expect(user.items.quests.robot).to.eql(1);
+  });
+
+  it('buys multiple hourglass quests', async () => {
+    let response = await user.post('/user/purchase-hourglass/quests/robot', {quantity: 2});
+    await user.sync();
+
+    expect(response.message).to.eql(t('hourglassPurchase'));
+    expect(user.purchased.plan.consecutive.trinkets).to.eql(0);
+    expect(user.items.quests.robot).to.eql(2);
+  });
 });

test/api/v3/integration/user/auth/POST-login-local.test.js

@@ -110,4 +110,22 @@ describe('POST /user/auth/local/login', () => {
     let isValidPassword = await bcryptCompare(textPassword, user.auth.local.hashed_password);
     expect(isValidPassword).to.equal(true);
   });
+
+  it('user uses social authentication and has no password', async () => {
+    await user.unset({
+      'auth.local.hashed_password': 1,
+    });
+
+    await user.sync();
+    expect(user.auth.local.hashed_password).to.be.undefined;
+
+    await expect(api.post(endpoint, {
+      username: user.auth.local.username,
+      password: 'any-password',
+    })).to.eventually.be.rejected.and.eql({
+      code: 401,
+      error: 'NotAuthorized',
+      message: t('invalidLoginCredentialsLong'),
+    });
+  });
 });

test/api/v4/inbox/DELETE-inbox_messages_messageId.test.js

@@ -44,7 +44,7 @@ describe('DELETE /inbox/messages/:messageId', () => {
   });
 
   it('deletes one message', async () => {
-    const messages = await user.get('/inbox/messages');
+    const messages = await user.get('/inbox/paged-messages');
 
     expect(messages.length).to.equal(3);
 
@@ -53,10 +53,10 @@ describe('DELETE /inbox/messages/:messageId', () => {
     expect(messages[2].text).to.equal('first');
 
     await user.del(`/inbox/messages/${messages[1]._id}`);
-    const updatedMessages = await user.get('/inbox/messages');
+    const updatedMessages = await user.get('/inbox/paged-messages');
     expect(updatedMessages.length).to.equal(2);
 
     expect(updatedMessages[0].text).to.equal('third');
     expect(updatedMessages[1].text).to.equal('first');
   });
-});
+});

test/api/v4/inbox/GET-inbox-conversations.test.js

@@ -0,0 +1,92 @@
+import {
+  generateUser,
+} from '../../../helpers/api-integration/v4';
+
+describe('GET /inbox/conversations', () => {
+  let user;
+  let otherUser;
+  let thirdUser;
+
+  beforeEach(async () => {
+    [user, otherUser, thirdUser] = await Promise.all([generateUser(), generateUser(), generateUser()]);
+
+    await otherUser.post('/members/send-private-message', {
+      toUserId: user.id,
+      message: 'first',
+    });
+    await user.post('/members/send-private-message', {
+      toUserId: otherUser.id,
+      message: 'second',
+    });
+    await user.post('/members/send-private-message', {
+      toUserId: thirdUser.id,
+      message: 'third',
+    });
+    await otherUser.post('/members/send-private-message', {
+      toUserId: user.id,
+      message: 'fourth',
+    });
+
+    // message to yourself
+    await user.post('/members/send-private-message', {
+      toUserId: user.id,
+      message: 'fifth',
+    });
+  });
+
+  it('returns the conversations', async () => {
+    const result = await user.get('/inbox/conversations');
+
+    expect(result.length).to.be.equal(3);
+    expect(result[0].user).to.be.equal(user.profile.name);
+    expect(result[0].username).to.be.equal(user.auth.local.username);
+    expect(result[0].text).to.be.not.empty;
+  });
+
+  it('returns the user inbox messages as an array of ordered messages (from most to least recent)', async () => {
+    const messages = await user.get('/inbox/paged-messages');
+
+    expect(messages.length).to.equal(5);
+
+    // message to yourself
+    expect(messages[0].text).to.equal('fifth');
+    expect(messages[0].sent).to.equal(false);
+    expect(messages[0].uuid).to.equal(user._id);
+
+    expect(messages[1].text).to.equal('fourth');
+    expect(messages[2].text).to.equal('third');
+    expect(messages[3].text).to.equal('second');
+    expect(messages[4].text).to.equal('first');
+  });
+
+  it('returns four messages when using page-query ', async () => {
+    const promises = [];
+
+    for (let i = 0; i < 10; i++) {
+      promises.push(user.post('/members/send-private-message', {
+        toUserId: user.id,
+        message: 'fourth',
+      }));
+    }
+
+    await Promise.all(promises);
+
+    const messages = await user.get('/inbox/paged-messages?page=1');
+
+    expect(messages.length).to.equal(5);
+  });
+
+  it('returns only the messages of one conversation', async () => {
+    const messages = await user.get(`/inbox/paged-messages?conversation=${otherUser.id}`);
+
+    expect(messages.length).to.equal(3);
+  });
+
+  it('returns the correct message format', async () => {
+    const messages = await otherUser.get(`/inbox/paged-messages?conversation=${user.id}`);
+
+    expect(messages[0].toUUID).to.equal(user.id); // from user
+    expect(messages[1].toUUID).to.not.exist; // only filled if its from the chat partner
+    expect(messages[2].toUUID).to.equal(user.id); // from user
+  });
+});

test/api/v4/members/POST-flag_private_message.test.js

@@ -0,0 +1,74 @@
+import {
+  generateUser,
+  translate as t,
+} from '../../../helpers/api-integration/v4';
+
+describe('POST /members/flag-private-message/:messageId', () => {
+  let userToSendMessage;
+  let messageToSend = 'Test Private Message';
+
+  beforeEach(async () => {
+    userToSendMessage = await generateUser();
+  });
+
+  it('Allows players to flag their own private message', async () => {
+    let receiver = await generateUser();
+
+    await userToSendMessage.post('/members/send-private-message', {
+      message: messageToSend,
+      toUserId: receiver._id,
+    });
+
+    let senderMessages = await userToSendMessage.get('/inbox/paged-messages');
+
+    let sendersMessageInSendersInbox = _.find(senderMessages, (message) => {
+      return message.toUUID === receiver._id && message.text === messageToSend;
+    });
+
+    expect(sendersMessageInSendersInbox).to.exist;
+    await expect(userToSendMessage.post(`/members/flag-private-message/${sendersMessageInSendersInbox.id}`)).to.eventually.be.ok;
+  });
+
+  it('Flags a private message', async () => {
+    let receiver = await generateUser();
+
+    await userToSendMessage.post('/members/send-private-message', {
+      message: messageToSend,
+      toUserId: receiver._id,
+    });
+
+    let receiversMessages = await receiver.get('/inbox/paged-messages');
+
+    let sendersMessageInReceiversInbox = _.find(receiversMessages, (message) => {
+      return message.uuid === userToSendMessage._id && message.text === messageToSend;
+    });
+
+    expect(sendersMessageInReceiversInbox).to.exist;
+    await expect(receiver.post(`/members/flag-private-message/${sendersMessageInReceiversInbox.id}`)).to.eventually.be.ok;
+  });
+
+  it('Returns an error when user tries to flag a private message that is already flagged', async () => {
+    let receiver = await generateUser();
+
+    await userToSendMessage.post('/members/send-private-message', {
+      message: messageToSend,
+      toUserId: receiver._id,
+    });
+
+    let receiversMessages = await receiver.get('/inbox/paged-messages');
+
+    let sendersMessageInReceiversInbox = _.find(receiversMessages, (message) => {
+      return message.uuid === userToSendMessage._id && message.text === messageToSend;
+    });
+
+    expect(sendersMessageInReceiversInbox).to.exist;
+    await expect(receiver.post(`/members/flag-private-message/${sendersMessageInReceiversInbox.id}`)).to.eventually.be.ok;
+
+    await expect(receiver.post(`/members/flag-private-message/${sendersMessageInReceiversInbox.id}`))
+      .to.eventually.be.rejected.and.eql({
+        code: 400,
+        error: 'BadRequest',
+        message: t('messageGroupChatFlagAlreadyReported'),
+      });
+  });
+});