Merge branch 'develop' into Yutsuten/party-chat-translations

test/api/unit/libs/analyticsService.test.js

@@ -335,14 +335,13 @@ describe('analyticsService', () => {
     let data, itemSpy;
 
     beforeEach(() => {
+      Visitor.prototype.event.yields();
+
       itemSpy = sandbox.stub().returnsThis();
 
-      Visitor.prototype.event.returns({
-        send: sandbox.stub(),
-      });
       Visitor.prototype.transaction.returns({
         item: itemSpy,
-        send: sandbox.stub().returnsThis(),
+        send: sandbox.stub().yields(),
       });
 
       data = {

test/api/unit/libs/baseModel.test.js

@@ -5,10 +5,17 @@ describe('Base model plugin', () => {
   let schema;
 
   beforeEach(() => {
-    schema = new mongoose.Schema();
+    schema = new mongoose.Schema({}, {
+      typeKey: '$type',
+    });
     sandbox.stub(schema, 'add');
   });
 
+  it('throws if "typeKey" is not set to $type', () => {
+    const schemaWithoutTypeKey = new mongoose.Schema();
+    expect(() => schemaWithoutTypeKey.plugin(baseModel)).to.throw;
+  });
+
   it('adds a _id field to the schema', () => {
     schema.plugin(baseModel);
 

test/api/unit/libs/errors.test.js

@@ -5,7 +5,9 @@ import {
   BadRequest,
   InternalServerError,
   NotFound,
+  NotificationNotFound,
 } from '../../../../website/server/libs/errors';
+import i18n from '../../../../website/common/script/i18n';
 
 describe('Custom Errors', () => {
   describe('CustomError', () => {
@@ -66,6 +68,23 @@ describe('Custom Errors', () => {
 
       expect(notAuthorizedError.message).to.eql('Custom Error Message');
     });
+
+    describe('NotificationNotFound', () => {
+      it('is an instance of NotFound', () => {
+        const notificationNotFoundErr = new NotificationNotFound();
+        expect(notificationNotFoundErr).to.be.an.instanceOf(NotFound);
+      });
+
+      it('it returns an http code of 404', () => {
+        const notificationNotFoundErr = new NotificationNotFound();
+        expect(notificationNotFoundErr.httpCode).to.eql(404);
+      });
+
+      it('returns a standard message', () => {
+        const notificationNotFoundErr = new NotificationNotFound();
+        expect(notificationNotFoundErr.message).to.eql(i18n.t('messageNotificationNotFound'));
+      });
+    });
   });
 
   describe('BadRequest', () => {

test/api/unit/libs/items/utils.test.js

@@ -0,0 +1,113 @@
+/* eslint-disable camelcase */
+import {
+  validateItemPath,
+  getDefaultOwnedGear,
+  castItemVal,
+} from '../../../../../website/server/libs/items/utils';
+
+describe('Items Utils', () => {
+  describe('getDefaultOwnedGear', () => {
+    it('clones the result object', () => {
+      const res1 = getDefaultOwnedGear();
+      res1.extraProperty = true;
+
+      const res2 = getDefaultOwnedGear();
+      expect(res2).not.to.have.property('extraProperty');
+    });
+  });
+
+  describe('validateItemPath', () => {
+    it('returns false if not an item path', () => {
+      expect(validateItemPath('notitems.gear.owned.item')).to.equal(false);
+    });
+
+    it('returns true if a valid schema path', () => {
+      expect(validateItemPath('items.gear.equipped.weapon')).to.equal(true);
+      expect(validateItemPath('items.currentPet')).to.equal(true);
+      expect(validateItemPath('items.special.snowball')).to.equal(true);
+    });
+
+    it('works with owned gear paths', () => {
+      expect(validateItemPath('items.gear.owned.head_armoire_crownOfHearts')).to.equal(true);
+      expect(validateItemPath('items.gear.owned.head_invalid')).to.equal(false);
+    });
+
+    it('works with pets paths', () => {
+      expect(validateItemPath('items.pets.Wolf-CottonCandyPink')).to.equal(true);
+      expect(validateItemPath('items.pets.Wolf-Invalid')).to.equal(false);
+    });
+
+    it('works with eggs paths', () => {
+      expect(validateItemPath('items.eggs.LionCub')).to.equal(true);
+      expect(validateItemPath('items.eggs.Armadillo')).to.equal(true);
+      expect(validateItemPath('items.eggs.NotAnArmadillo')).to.equal(false);
+    });
+
+    it('works with hatching potions paths', () => {
+      expect(validateItemPath('items.hatchingPotions.Base')).to.equal(true);
+      expect(validateItemPath('items.hatchingPotions.StarryNight')).to.equal(true);
+      expect(validateItemPath('items.hatchingPotions.Invalid')).to.equal(false);
+    });
+
+    it('works with food paths', () => {
+      expect(validateItemPath('items.food.Cake_Base')).to.equal(true);
+      expect(validateItemPath('items.food.Cake_Invalid')).to.equal(false);
+    });
+
+    it('works with mounts paths', () => {
+      expect(validateItemPath('items.mounts.Cactus-Base')).to.equal(true);
+      expect(validateItemPath('items.mounts.Aether-Invisible')).to.equal(true);
+      expect(validateItemPath('items.mounts.Aether-Invalid')).to.equal(false);
+    });
+
+    it('works with quests paths', () => {
+      expect(validateItemPath('items.quests.atom3')).to.equal(true);
+      expect(validateItemPath('items.quests.invalid')).to.equal(false);
+    });
+  });
+
+  describe('castItemVal', () => {
+    it('returns the item val untouched if not an item path', () => {
+      expect(castItemVal('notitems.gear.owned.item', 'a string')).to.equal('a string');
+    });
+
+    it('returns the item val untouched if an unsupported path', () => {
+      expect(castItemVal('items.gear.equipped.weapon', 'a string')).to.equal('a string');
+      expect(castItemVal('items.currentPet', 'a string')).to.equal('a string');
+      expect(castItemVal('items.special.snowball', 'a string')).to.equal('a string');
+    });
+
+    it('converts values for pets paths to numbers', () => {
+      expect(castItemVal('items.pets.Wolf-CottonCandyPink', '5')).to.equal(5);
+      expect(castItemVal('items.pets.Wolf-Invalid', '5')).to.equal(5);
+    });
+
+    it('converts values for eggs paths to numbers', () => {
+      expect(castItemVal('items.eggs.LionCub', '5')).to.equal(5);
+      expect(castItemVal('items.eggs.Armadillo', '5')).to.equal(5);
+      expect(castItemVal('items.eggs.NotAnArmadillo', '5')).to.equal(5);
+    });
+
+    it('converts values for hatching potions paths to numbers', () => {
+      expect(castItemVal('items.hatchingPotions.Base', '5')).to.equal(5);
+      expect(castItemVal('items.hatchingPotions.StarryNight', '5')).to.equal(5);
+      expect(castItemVal('items.hatchingPotions.Invalid', '5')).to.equal(5);
+    });
+
+    it('converts values for food paths to numbers', () => {
+      expect(castItemVal('items.food.Cake_Base', '5')).to.equal(5);
+      expect(castItemVal('items.food.Cake_Invalid', '5')).to.equal(5);
+    });
+
+    it('converts values for mounts paths to numbers', () => {
+      expect(castItemVal('items.mounts.Cactus-Base', '5')).to.equal(5);
+      expect(castItemVal('items.mounts.Aether-Invisible', '5')).to.equal(5);
+      expect(castItemVal('items.mounts.Aether-Invalid', '5')).to.equal(5);
+    });
+
+    it('converts values for quests paths to numbers', () => {
+      expect(castItemVal('items.quests.atom3', '5')).to.equal(5);
+      expect(castItemVal('items.quests.invalid', '5')).to.equal(5);
+    });
+  });
+});

test/api/unit/libs/password.test.js

@@ -245,7 +245,9 @@ describe('Password Utilities', () => {
 
     it('returns false if the user has no local auth', async () => {
       let user = await generateUser({
-        auth: 'not an object with valid fields',
+        auth: {
+          facebook: {},
+        },
       });
       let res = await validatePasswordResetCodeAndFindUser(encrypt(JSON.stringify({
         userId: user._id,

test/api/unit/libs/payments/amazon/cancel.test.js

@@ -48,7 +48,6 @@ describe('Amazon Payments - Cancel Subscription', () => {
 
   function expectBillingAggreementDetailSpy () {
     getBillingAgreementDetailsSpy = sinon.stub(amzLib, 'getBillingAgreementDetails')
-      .returnsPromise()
       .resolves({
         BillingAgreementDetails: {
           BillingAgreementStatus: {State: 'Open'},
@@ -80,14 +79,14 @@ describe('Amazon Payments - Cancel Subscription', () => {
     headers = {};
 
     getBillingAgreementDetailsSpy = sinon.stub(amzLib, 'getBillingAgreementDetails');
-    getBillingAgreementDetailsSpy.returnsPromise().resolves({
+    getBillingAgreementDetailsSpy.resolves({
       BillingAgreementDetails: {
         BillingAgreementStatus: {State: 'Closed'},
       },
     });
 
     paymentCancelSubscriptionSpy = sinon.stub(payments, 'cancelSubscription');
-    paymentCancelSubscriptionSpy.returnsPromise().resolves({});
+    paymentCancelSubscriptionSpy.resolves({});
   });
 
   afterEach(function () {
@@ -118,7 +117,7 @@ describe('Amazon Payments - Cancel Subscription', () => {
   it('should close a user subscription if amazon not closed', async () => {
     amzLib.getBillingAgreementDetails.restore();
     expectBillingAggreementDetailSpy();
-    let closeBillingAgreementSpy = sinon.stub(amzLib, 'closeBillingAgreement').returnsPromise().resolves({});
+    let closeBillingAgreementSpy = sinon.stub(amzLib, 'closeBillingAgreement').resolves({});
     billingAgreementId = user.purchased.plan.customerId;
 
     await amzLib.cancelSubscription({user, headers});
@@ -164,7 +163,7 @@ describe('Amazon Payments - Cancel Subscription', () => {
   it('should close a group subscription if amazon not closed', async () => {
     amzLib.getBillingAgreementDetails.restore();
     expectBillingAggreementDetailSpy();
-    let closeBillingAgreementSpy = sinon.stub(amzLib, 'closeBillingAgreement').returnsPromise().resolves({});
+    let closeBillingAgreementSpy = sinon.stub(amzLib, 'closeBillingAgreement').resolves({});
     billingAgreementId = group.purchased.plan.customerId;
 
     await amzLib.cancelSubscription({user, groupId: group._id, headers});

test/api/unit/libs/payments/amazon/checkout.test.js

@@ -68,22 +68,22 @@ describe('Amazon Payments - Checkout', () => {
     orderReferenceId = 'orderReferenceId';
 
     setOrderReferenceDetailsSpy = sinon.stub(amzLib, 'setOrderReferenceDetails');
-    setOrderReferenceDetailsSpy.returnsPromise().resolves({});
+    setOrderReferenceDetailsSpy.resolves({});
 
     confirmOrderReferenceSpy = sinon.stub(amzLib, 'confirmOrderReference');
-    confirmOrderReferenceSpy.returnsPromise().resolves({});
+    confirmOrderReferenceSpy.resolves({});
 
     authorizeSpy = sinon.stub(amzLib, 'authorize');
-    authorizeSpy.returnsPromise().resolves({});
+    authorizeSpy.resolves({});
 
     closeOrderReferenceSpy = sinon.stub(amzLib, 'closeOrderReference');
-    closeOrderReferenceSpy.returnsPromise().resolves({});
+    closeOrderReferenceSpy.resolves({});
 
     paymentBuyGemsStub = sinon.stub(payments, 'buyGems');
-    paymentBuyGemsStub.returnsPromise().resolves({});
+    paymentBuyGemsStub.resolves({});
 
     paymentCreateSubscritionStub = sinon.stub(payments, 'createSubscription');
-    paymentCreateSubscritionStub.returnsPromise().resolves({});
+    paymentCreateSubscritionStub.resolves({});
 
     sinon.stub(common, 'uuid').returns('uuid-generated');
   });
@@ -111,7 +111,7 @@ describe('Amazon Payments - Checkout', () => {
   }
 
   it('should purchase gems', async () => {
-    sinon.stub(user, 'canGetGems').returnsPromise().resolves(true);
+    sinon.stub(user, 'canGetGems').resolves(true);
     await amzLib.checkout({user, orderReferenceId, headers});
 
     expectBuyGemsStub(amzLib.constants.PAYMENT_METHOD);
@@ -140,7 +140,7 @@ describe('Amazon Payments - Checkout', () => {
   });
 
   it('should error if user cannot get gems gems', async () => {
-    sinon.stub(user, 'canGetGems').returnsPromise().resolves(false);
+    sinon.stub(user, 'canGetGems').resolves(false);
     await expect(amzLib.checkout({user, orderReferenceId, headers})).to.eventually.be.rejected.and.to.eql({
       httpCode: 401,
       message: i18n.t('groupPolicyCannotGetGems'),

test/api/unit/libs/payments/amazon/subscribe.test.js

@@ -46,16 +46,16 @@ describe('Amazon Payments - Subscribe', () => {
     headers = {};
 
     amazonSetBillingAgreementDetailsSpy = sinon.stub(amzLib, 'setBillingAgreementDetails');
-    amazonSetBillingAgreementDetailsSpy.returnsPromise().resolves({});
+    amazonSetBillingAgreementDetailsSpy.resolves({});
 
     amazonConfirmBillingAgreementSpy = sinon.stub(amzLib, 'confirmBillingAgreement');
-    amazonConfirmBillingAgreementSpy.returnsPromise().resolves({});
+    amazonConfirmBillingAgreementSpy.resolves({});
 
     amazonAuthorizeOnBillingAgreementSpy = sinon.stub(amzLib, 'authorizeOnBillingAgreement');
-    amazonAuthorizeOnBillingAgreementSpy.returnsPromise().resolves({});
+    amazonAuthorizeOnBillingAgreementSpy.resolves({});
 
     createSubSpy = sinon.stub(payments, 'createSubscription');
-    createSubSpy.returnsPromise().resolves({});
+    createSubSpy.resolves({});
 
     sinon.stub(common, 'uuid').returns('uuid-generated');
   });

test/api/unit/libs/payments/amazon/upgrade-groupplan.test.js

@@ -37,7 +37,7 @@ describe('#upgradeGroupPlan', () => {
     await group.save();
 
     spy = sinon.stub(amzLib, 'authorizeOnBillingAgreement');
-    spy.returnsPromise().resolves([]);
+    spy.resolves([]);
 
     uuidString = 'uuid-v4';
     sinon.stub(uuid, 'v4').returns(uuidString);

test/api/unit/libs/payments/apple.test.js

@@ -6,6 +6,7 @@ import iap from '../../../../../website/server/libs/inAppPurchases';
 import {model as User} from '../../../../../website/server/models/user';
 import common from '../../../../../website/common';
 import moment from 'moment';
+import {mockFindById, restoreFindById} from '../../../../helpers/mongoose.helper';
 
 const i18n = common.i18n;
 
@@ -24,16 +25,16 @@ describe('Apple Payments', ()  => {
       headers = {};
 
       iapSetupStub = sinon.stub(iapModule, 'setup')
-        .returnsPromise().resolves();
+        .resolves();
       iapValidateStub = sinon.stub(iapModule, 'validate')
-        .returnsPromise().resolves({});
+        .resolves({});
       iapIsValidatedStub = sinon.stub(iapModule, 'isValidated')
         .returns(true);
       iapGetPurchaseDataStub = sinon.stub(iapModule, 'getPurchaseData')
         .returns([{productId: 'com.habitrpg.ios.Habitica.21gems',
                    transactionId: token,
         }]);
-      paymentBuyGemsStub = sinon.stub(payments, 'buyGems').returnsPromise().resolves({});
+      paymentBuyGemsStub = sinon.stub(payments, 'buyGems').resolves({});
     });
 
     afterEach(() => {
@@ -49,7 +50,7 @@ describe('Apple Payments', ()  => {
       iapIsValidatedStub = sinon.stub(iapModule, 'isValidated')
         .returns(false);
 
-      await expect(applePayments.verifyGemPurchase(user, receipt, headers))
+      await expect(applePayments.verifyGemPurchase({user, receipt, headers}))
         .to.eventually.be.rejected.and.to.eql({
           httpCode: 401,
           name: 'NotAuthorized',
@@ -61,7 +62,7 @@ describe('Apple Payments', ()  => {
       iapGetPurchaseDataStub.restore();
       iapGetPurchaseDataStub = sinon.stub(iapModule, 'getPurchaseData').returns([]);
 
-      await expect(applePayments.verifyGemPurchase(user, receipt, headers))
+      await expect(applePayments.verifyGemPurchase({user, receipt, headers}))
         .to.eventually.be.rejected.and.to.eql({
           httpCode: 401,
           name: 'NotAuthorized',
@@ -70,8 +71,8 @@ describe('Apple Payments', ()  => {
     });
 
     it('errors if the user cannot purchase gems', async () => {
-      sinon.stub(user, 'canGetGems').returnsPromise().resolves(false);
-      await expect(applePayments.verifyGemPurchase(user, receipt, headers))
+      sinon.stub(user, 'canGetGems').resolves(false);
+      await expect(applePayments.verifyGemPurchase({user, receipt, headers}))
         .to.eventually.be.rejected.and.to.eql({
           httpCode: 401,
           name: 'NotAuthorized',
@@ -82,14 +83,14 @@ describe('Apple Payments', ()  => {
     });
 
     it('errors if amount does not exist', async () => {
-      sinon.stub(user, 'canGetGems').returnsPromise().resolves(true);
+      sinon.stub(user, 'canGetGems').resolves(true);
       iapGetPurchaseDataStub.restore();
       iapGetPurchaseDataStub = sinon.stub(iapModule, 'getPurchaseData')
         .returns([{productId: 'badProduct',
                    transactionId: token,
         }]);
 
-      await expect(applePayments.verifyGemPurchase(user, receipt, headers))
+      await expect(applePayments.verifyGemPurchase({user, receipt, headers}))
         .to.eventually.be.rejected.and.to.eql({
           httpCode: 401,
           name: 'NotAuthorized',
@@ -130,8 +131,8 @@ describe('Apple Payments', ()  => {
                      transactionId: token,
           }]);
 
-        sinon.stub(user, 'canGetGems').returnsPromise().resolves(true);
-        await applePayments.verifyGemPurchase(user, receipt, headers);
+        sinon.stub(user, 'canGetGems').resolves(true);
+        await applePayments.verifyGemPurchase({user, receipt, headers});
 
         expect(iapSetupStub).to.be.calledOnce;
         expect(iapValidateStub).to.be.calledOnce;
@@ -151,6 +152,38 @@ describe('Apple Payments', ()  => {
         user.canGetGems.restore();
       });
     });
+
+    it('gifts gems', async () => {
+      const receivingUser = new User();
+      await receivingUser.save();
+
+      mockFindById(receivingUser);
+
+      iapGetPurchaseDataStub.restore();
+      iapGetPurchaseDataStub = sinon.stub(iapModule, 'getPurchaseData')
+        .returns([{productId: gemsCanPurchase[0].productId,
+                   transactionId: token,
+        }]);
+
+      const gift = {uuid: receivingUser._id};
+      await applePayments.verifyGemPurchase({user, gift, receipt, headers});
+
+      expect(iapSetupStub).to.be.calledOnce;
+      expect(iapValidateStub).to.be.calledOnce;
+      expect(iapValidateStub).to.be.calledWith(iap.APPLE, receipt);
+      expect(iapIsValidatedStub).to.be.calledOnce;
+      expect(iapIsValidatedStub).to.be.calledWith({});
+      expect(iapGetPurchaseDataStub).to.be.calledOnce;
+
+      expect(paymentBuyGemsStub).to.be.calledOnce;
+      expect(paymentBuyGemsStub).to.be.calledWith({
+        user: receivingUser,
+        paymentMethod: applePayments.constants.PAYMENT_METHOD_APPLE,
+        amount: gemsCanPurchase[0].amount,
+        headers,
+      });
+      restoreFindById();
+    });
   });
 
   describe('subscribe', () => {
@@ -167,9 +200,9 @@ describe('Apple Payments', ()  => {
       nextPaymentProcessing = moment.utc().add({days: 2});
 
       iapSetupStub = sinon.stub(iapModule, 'setup')
-        .returnsPromise().resolves();
+        .resolves();
       iapValidateStub = sinon.stub(iapModule, 'validate')
-        .returnsPromise().resolves({});
+        .resolves({});
       iapIsValidatedStub = sinon.stub(iapModule, 'isValidated')
         .returns(true);
       iapGetPurchaseDataStub = sinon.stub(iapModule, 'getPurchaseData')
@@ -186,7 +219,7 @@ describe('Apple Payments', ()  => {
           productId: sku,
           transactionId: token,
         }]);
-      paymentsCreateSubscritionStub = sinon.stub(payments, 'createSubscription').returnsPromise().resolves({});
+      paymentsCreateSubscritionStub = sinon.stub(payments, 'createSubscription').resolves({});
     });
 
     afterEach(() => {
@@ -297,9 +330,9 @@ describe('Apple Payments', ()  => {
       expirationDate = moment.utc();
 
       iapSetupStub = sinon.stub(iapModule, 'setup')
-        .returnsPromise().resolves();
+        .resolves();
       iapValidateStub = sinon.stub(iapModule, 'validate')
-        .returnsPromise().resolves({
+        .resolves({
           expirationDate,
         });
       iapGetPurchaseDataStub = sinon.stub(iapModule, 'getPurchaseData')
@@ -314,7 +347,7 @@ describe('Apple Payments', ()  => {
       user.purchased.plan.planId = subKey;
       user.purchased.plan.additionalData = receipt;
 
-      paymentCancelSubscriptionSpy = sinon.stub(payments, 'cancelSubscription').returnsPromise().resolves({});
+      paymentCancelSubscriptionSpy = sinon.stub(payments, 'cancelSubscription').resolves({});
     });
 
     afterEach(function () {

test/api/unit/libs/payments/google.test.js

@@ -6,6 +6,7 @@ import iap from '../../../../../website/server/libs/inAppPurchases';
 import {model as User} from '../../../../../website/server/models/user';
 import common from '../../../../../website/common';
 import moment from 'moment';
+import {mockFindById, restoreFindById} from '../../../../helpers/mongoose.helper';
 
 const i18n = common.i18n;
 
@@ -24,12 +25,12 @@ describe('Google Payments', ()  => {
       headers = {};
 
       iapSetupStub = sinon.stub(iapModule, 'setup')
-        .returnsPromise().resolves();
+        .resolves();
       iapValidateStub = sinon.stub(iapModule, 'validate')
-        .returnsPromise().resolves({});
+        .resolves({});
       iapIsValidatedStub = sinon.stub(iapModule, 'isValidated')
         .returns(true);
-      paymentBuyGemsStub = sinon.stub(payments, 'buyGems').returnsPromise().resolves({});
+      paymentBuyGemsStub = sinon.stub(payments, 'buyGems').resolves({});
     });
 
     afterEach(() => {
@@ -44,7 +45,7 @@ describe('Google Payments', ()  => {
       iapIsValidatedStub = sinon.stub(iapModule, 'isValidated')
         .returns(false);
 
-      await expect(googlePayments.verifyGemPurchase(user, receipt, signature, headers))
+      await expect(googlePayments.verifyGemPurchase({user, receipt, signature, headers}))
         .to.eventually.be.rejected.and.to.eql({
           httpCode: 401,
           name: 'NotAuthorized',
@@ -55,7 +56,7 @@ describe('Google Payments', ()  => {
     it('should throw an error if productId is invalid', async () => {
       receipt = `{"token": "${token}", "productId": "invalid"}`;
 
-      await expect(googlePayments.verifyGemPurchase(user, receipt, signature, headers))
+      await expect(googlePayments.verifyGemPurchase({user, receipt, signature, headers}))
         .to.eventually.be.rejected.and.to.eql({
           httpCode: 401,
           name: 'NotAuthorized',
@@ -64,9 +65,9 @@ describe('Google Payments', ()  => {
     });
 
     it('should throw an error if user cannot purchase gems', async () => {
-      sinon.stub(user, 'canGetGems').returnsPromise().resolves(false);
+      sinon.stub(user, 'canGetGems').resolves(false);
 
-      await expect(googlePayments.verifyGemPurchase(user, receipt, signature, headers))
+      await expect(googlePayments.verifyGemPurchase({user, receipt, signature, headers}))
         .to.eventually.be.rejected.and.to.eql({
           httpCode: 401,
           name: 'NotAuthorized',
@@ -77,8 +78,8 @@ describe('Google Payments', ()  => {
     });
 
     it('purchases gems', async () => {
-      sinon.stub(user, 'canGetGems').returnsPromise().resolves(true);
-      await googlePayments.verifyGemPurchase(user, receipt, signature, headers);
+      sinon.stub(user, 'canGetGems').resolves(true);
+      await googlePayments.verifyGemPurchase({user, receipt, signature, headers});
 
       expect(iapSetupStub).to.be.calledOnce;
       expect(iapValidateStub).to.be.calledOnce;
@@ -99,6 +100,34 @@ describe('Google Payments', ()  => {
       expect(user.canGetGems).to.be.calledOnce;
       user.canGetGems.restore();
     });
+
+    it('gifts gems', async () => {
+      const receivingUser = new User();
+      await receivingUser.save();
+
+      mockFindById(receivingUser);
+
+      const gift = {uuid: receivingUser._id};
+      await googlePayments.verifyGemPurchase({user, gift, receipt, signature, headers});
+
+      expect(iapSetupStub).to.be.calledOnce;
+      expect(iapValidateStub).to.be.calledOnce;
+      expect(iapValidateStub).to.be.calledWith(iap.GOOGLE, {
+        data: receipt,
+        signature,
+      });
+      expect(iapIsValidatedStub).to.be.calledOnce;
+      expect(iapIsValidatedStub).to.be.calledWith({});
+
+      expect(paymentBuyGemsStub).to.be.calledOnce;
+      expect(paymentBuyGemsStub).to.be.calledWith({
+        user: receivingUser,
+        paymentMethod: googlePayments.constants.PAYMENT_METHOD_GOOGLE,
+        amount: 5.25,
+        headers,
+      });
+      restoreFindById();
+    });
   });
 
   describe('subscribe', () => {
@@ -116,12 +145,12 @@ describe('Google Payments', ()  => {
       nextPaymentProcessing = moment.utc().add({days: 2});
 
       iapSetupStub = sinon.stub(iapModule, 'setup')
-        .returnsPromise().resolves();
+        .resolves();
       iapValidateStub = sinon.stub(iapModule, 'validate')
-        .returnsPromise().resolves({});
+        .resolves({});
       iapIsValidatedStub = sinon.stub(iapModule, 'isValidated')
         .returns(true);
-      paymentsCreateSubscritionStub = sinon.stub(payments, 'createSubscription').returnsPromise().resolves({});
+      paymentsCreateSubscritionStub = sinon.stub(payments, 'createSubscription').resolves({});
     });
 
     afterEach(() => {
@@ -193,9 +222,9 @@ describe('Google Payments', ()  => {
       expirationDate = moment.utc();
 
       iapSetupStub = sinon.stub(iapModule, 'setup')
-        .returnsPromise().resolves();
+        .resolves();
       iapValidateStub = sinon.stub(iapModule, 'validate')
-        .returnsPromise().resolves({
+        .resolves({
           expirationDate,
         });
       iapGetPurchaseDataStub = sinon.stub(iapModule, 'getPurchaseData')
@@ -210,7 +239,7 @@ describe('Google Payments', ()  => {
       user.purchased.plan.planId = subKey;
       user.purchased.plan.additionalData = {data: receipt, signature};
 
-      paymentCancelSubscriptionSpy = sinon.stub(payments, 'cancelSubscription').returnsPromise().resolves({});
+      paymentCancelSubscriptionSpy = sinon.stub(payments, 'cancelSubscription').resolves({});
     });
 
     afterEach(function () {

test/api/unit/libs/payments/group-plans/group-payments-create.test.js

@@ -69,11 +69,11 @@ describe('Purchasing a group plan for group', () => {
     };
 
     let subscriptionId = 'subId';
-    sinon.stub(stripe.customers, 'del').returnsPromise().resolves({});
+    sinon.stub(stripe.customers, 'del').resolves({});
 
     let currentPeriodEndTimeStamp = moment().add(3, 'months').unix();
     sinon.stub(stripe.customers, 'retrieve')
-      .returnsPromise().resolves({
+      .resolves({
         subscriptions: {
           data: [{id: subscriptionId, current_period_end: currentPeriodEndTimeStamp}], // eslint-disable-line camelcase
         },
@@ -216,7 +216,6 @@ describe('Purchasing a group plan for group', () => {
 
   it('sends one email to subscribed member of group, stating subscription is cancelled (Amazon)', async () => {
     sinon.stub(amzLib, 'getBillingAgreementDetails')
-      .returnsPromise()
       .resolves({
         BillingAgreementDetails: {
           BillingAgreementStatus: {State: 'Closed'},
@@ -251,9 +250,9 @@ describe('Purchasing a group plan for group', () => {
   });
 
   it('sends one email to subscribed member of group, stating subscription is cancelled (PayPal)', async () => {
-    sinon.stub(paypalPayments, 'paypalBillingAgreementCancel').returnsPromise().resolves({});
+    sinon.stub(paypalPayments, 'paypalBillingAgreementCancel').resolves({});
     sinon.stub(paypalPayments, 'paypalBillingAgreementGet')
-      .returnsPromise().resolves({
+      .resolves({
         agreement_details: { // eslint-disable-line camelcase
           next_billing_date: moment().add(3, 'months').toDate(), // eslint-disable-line camelcase
           cycles_completed: 1, // eslint-disable-line camelcase
@@ -449,7 +448,6 @@ describe('Purchasing a group plan for group', () => {
 
   it('adds months to members with existing recurring subscription (Amazon)', async () => {
     sinon.stub(amzLib, 'getBillingAgreementDetails')
-      .returnsPromise()
       .resolves({
         BillingAgreementDetails: {
           BillingAgreementStatus: {State: 'Closed'},
@@ -478,9 +476,9 @@ describe('Purchasing a group plan for group', () => {
   });
 
   it('adds months to members with existing recurring subscription (Paypal)', async () => {
-    sinon.stub(paypalPayments, 'paypalBillingAgreementCancel').returnsPromise().resolves({});
+    sinon.stub(paypalPayments, 'paypalBillingAgreementCancel').resolves({});
     sinon.stub(paypalPayments, 'paypalBillingAgreementGet')
-      .returnsPromise().resolves({
+      .resolves({
         agreement_details: { // eslint-disable-line camelcase
           next_billing_date: moment().add(3, 'months').toDate(), // eslint-disable-line camelcase
           cycles_completed: 1, // eslint-disable-line camelcase

test/api/unit/libs/payments/payments.test.js

@@ -446,6 +446,19 @@ describe('payments/index', () => {
         fakeClock.restore();
       });
 
+      it('does not add a notification for mystery items if none was awarded', async () => {
+        const noMysteryItemTimeframe = 1462183920000; // May 2nd 2016
+        let fakeClock = sinon.useFakeTimers(noMysteryItemTimeframe);
+        data = { paymentMethod: 'PaymentMethod', user, sub: { key: 'basic_3mo' } };
+
+        await api.createSubscription(data);
+
+        expect(user.purchased.plan.mysteryItems).to.have.a.lengthOf(0);
+        expect(user.notifications.find(n => n.type === 'NEW_MYSTERY_ITEMS')).to.be.undefined;
+
+        fakeClock.restore();
+      });
+
       it('does not award mystery item when user already owns the item', async () => {
         let mayMysteryItemTimeframe = 1464725113000; // May 31st 2016
         let fakeClock = sinon.useFakeTimers(mayMysteryItemTimeframe);

test/api/unit/libs/payments/paypal/checkout-success.test.js

@@ -13,9 +13,9 @@ describe('checkout success', () => {
     customerId = 'customerId-test';
     paymentId = 'paymentId-test';
 
-    paypalPaymentExecuteStub = sinon.stub(paypalPayments, 'paypalPaymentExecute').returnsPromise().resolves({});
-    paymentBuyGemsStub = sinon.stub(payments, 'buyGems').returnsPromise().resolves({});
-    paymentsCreateSubscritionStub = sinon.stub(payments, 'createSubscription').returnsPromise().resolves({});
+    paypalPaymentExecuteStub = sinon.stub(paypalPayments, 'paypalPaymentExecute').resolves({});
+    paymentBuyGemsStub = sinon.stub(payments, 'buyGems').resolves({});
+    paymentsCreateSubscritionStub = sinon.stub(payments, 'createSubscription').resolves({});
   });
 
   afterEach(() => {

test/api/unit/libs/payments/paypal/checkout.test.js

@@ -15,6 +15,7 @@ describe('checkout', () => {
 
   function getPaypalCreateOptions (description, amount) {
     return {
+      experience_profile_id: 'xp_profile_id',
       intent: 'sale',
       payer: { payment_method: 'Paypal' },
       redirect_urls: {
@@ -42,7 +43,7 @@ describe('checkout', () => {
   beforeEach(() => {
     approvalHerf = 'approval_href';
     paypalPaymentCreateStub = sinon.stub(paypalPayments, 'paypalPaymentCreate')
-      .returnsPromise().resolves({
+      .resolves({
         links: [{ rel: 'approval_url', href: approvalHerf }],
       });
   });
@@ -80,7 +81,7 @@ describe('checkout', () => {
 
   it('should error if the user cannot get gems', async () => {
     let user = new User();
-    sinon.stub(user, 'canGetGems').returnsPromise().resolves(false);
+    sinon.stub(user, 'canGetGems').resolves(false);
 
     await expect(paypalPayments.checkout({user})).to.eventually.be.rejected.and.to.eql({
       httpCode: 401,

test/api/unit/libs/payments/paypal/ipn.test.js

@@ -34,8 +34,8 @@ describe('ipn', () => {
     group.purchased.plan.lastBillingDate = new Date();
     await group.save();
 
-    ipnVerifyAsyncStub = sinon.stub(paypalPayments, 'ipnVerifyAsync').returnsPromise().resolves({});
-    paymentCancelSubscriptionSpy = sinon.stub(payments, 'cancelSubscription').returnsPromise().resolves({});
+    ipnVerifyAsyncStub = sinon.stub(paypalPayments, 'ipnVerifyAsync').resolves({});
+    paymentCancelSubscriptionSpy = sinon.stub(payments, 'cancelSubscription').resolves({});
   });
 
   afterEach(function () {

test/api/unit/libs/payments/paypal/subscribe-cancel.test.js

@@ -38,15 +38,15 @@ describe('subscribeCancel', () => {
 
     nextBillingDate = new Date();
 
-    paypalBillingAgreementCancelStub = sinon.stub(paypalPayments, 'paypalBillingAgreementCancel').returnsPromise().resolves({});
+    paypalBillingAgreementCancelStub = sinon.stub(paypalPayments, 'paypalBillingAgreementCancel').resolves({});
     paypalBillingAgreementGetStub = sinon.stub(paypalPayments, 'paypalBillingAgreementGet')
-      .returnsPromise().resolves({
+      .resolves({
         agreement_details: {
           next_billing_date: nextBillingDate,
           cycles_completed: 1,
         },
       });
-    paymentCancelSubscriptionSpy = sinon.stub(payments, 'cancelSubscription').returnsPromise().resolves({});
+    paymentCancelSubscriptionSpy = sinon.stub(payments, 'cancelSubscription').resolves({});
   });
 
   afterEach(function () {

test/api/unit/libs/payments/paypal/subscribe-success.test.js

@@ -28,10 +28,10 @@ describe('subscribeSuccess', () => {
     customerId = 'test-customerId';
 
     paypalBillingAgreementExecuteStub = sinon.stub(paypalPayments, 'paypalBillingAgreementExecute')
-      .returnsPromise({}).resolves({
+      .resolves({
         id: customerId,
       });
-    paymentsCreateSubscritionStub = sinon.stub(payments, 'createSubscription').returnsPromise().resolves({});
+    paymentsCreateSubscritionStub = sinon.stub(payments, 'createSubscription').resolves({});
   });
 
   afterEach(() => {

test/api/unit/libs/payments/paypal/subscribe.test.js

@@ -18,7 +18,7 @@ describe('subscribe', () => {
     sub = Object.assign({}, common.content.subscriptionBlocks[subKey]);
 
     paypalBillingAgreementCreateStub = sinon.stub(paypalPayments, 'paypalBillingAgreementCreate')
-      .returnsPromise().resolves({
+      .resolves({
         links: [{ rel: 'approval_url', href: approvalHerf }],
       });
   });

test/api/unit/libs/payments/stripe/cancel-subscription.test.js

@@ -82,12 +82,12 @@ describe('cancel subscription', () => {
 
     beforeEach(() => {
       subscriptionId = 'subId';
-      stripeDeleteCustomerStub = sinon.stub(stripe.customers, 'del').returnsPromise().resolves({});
-      paymentsCancelSubStub = sinon.stub(payments, 'cancelSubscription').returnsPromise().resolves({});
+      stripeDeleteCustomerStub = sinon.stub(stripe.customers, 'del').resolves({});
+      paymentsCancelSubStub = sinon.stub(payments, 'cancelSubscription').resolves({});
 
       currentPeriodEndTimeStamp = (new Date()).getTime();
       stripeRetrieveStub = sinon.stub(stripe.customers, 'retrieve')
-        .returnsPromise().resolves({
+        .resolves({
           subscriptions: {
             data: [{id: subscriptionId, current_period_end: currentPeriodEndTimeStamp}], // eslint-disable-line camelcase
           },

test/api/unit/libs/payments/stripe/checkout-subscription.test.js

@@ -54,7 +54,7 @@ describe('checkout with subscription', () => {
     token = 'test-token';
 
     spy = sinon.stub(stripe.subscriptions, 'update');
-    spy.returnsPromise().resolves;
+    spy.resolves;
 
     stripeCreateCustomerSpy = sinon.stub(stripe.customers, 'create');
     let stripCustomerResponse = {
@@ -63,10 +63,10 @@ describe('checkout with subscription', () => {
         data: [{id: subscriptionId}],
       },
     };
-    stripeCreateCustomerSpy.returnsPromise().resolves(stripCustomerResponse);
+    stripeCreateCustomerSpy.resolves(stripCustomerResponse);
 
     stripePaymentsCreateSubSpy = sinon.stub(payments, 'createSubscription');
-    stripePaymentsCreateSubSpy.returnsPromise().resolves({});
+    stripePaymentsCreateSubSpy.resolves({});
 
     data.groupId = group._id;
     data.sub.quantity = 3;

test/api/unit/libs/payments/stripe/checkout.test.js

@@ -26,9 +26,9 @@ describe('checkout', () => {
     let stripCustomerResponse = {
       id: customerIdResponse,
     };
-    stripeChargeStub = sinon.stub(stripe.charges, 'create').returnsPromise().resolves(stripCustomerResponse);
-    paymentBuyGemsStub = sinon.stub(payments, 'buyGems').returnsPromise().resolves({});
-    paymentCreateSubscritionStub = sinon.stub(payments, 'createSubscription').returnsPromise().resolves({});
+    stripeChargeStub = sinon.stub(stripe.charges, 'create').resolves(stripCustomerResponse);
+    paymentBuyGemsStub = sinon.stub(payments, 'buyGems').resolves({});
+    paymentCreateSubscritionStub = sinon.stub(payments, 'createSubscription').resolves({});
   });
 
   afterEach(() => {
@@ -82,7 +82,7 @@ describe('checkout', () => {
 
   it('should error if user cannot get gems', async () => {
     gift = undefined;
-    sinon.stub(user, 'canGetGems').returnsPromise().resolves(false);
+    sinon.stub(user, 'canGetGems').resolves(false);
 
     await expect(stripePayments.checkout({
       token,
@@ -101,7 +101,7 @@ describe('checkout', () => {
 
   it('should purchase gems', async () => {
     gift = undefined;
-    sinon.stub(user, 'canGetGems').returnsPromise().resolves(true);
+    sinon.stub(user, 'canGetGems').resolves(true);
 
     await stripePayments.checkout({
       token,

test/api/unit/libs/payments/stripe/edit-subscription.test.js

@@ -98,11 +98,11 @@ describe('edit subscription', () => {
     beforeEach(() => {
       subscriptionId = 'subId';
       stripeListSubscriptionStub = sinon.stub(stripe.customers, 'listSubscriptions')
-        .returnsPromise().resolves({
+        .resolves({
           data: [{id: subscriptionId}],
         });
 
-      stripeUpdateSubscriptionStub = sinon.stub(stripe.customers, 'updateSubscription').returnsPromise().resolves({});
+      stripeUpdateSubscriptionStub = sinon.stub(stripe.customers, 'updateSubscription').resolves({});
     });
 
     afterEach(() => {

test/api/unit/libs/payments/stripe/handle-webhook.test.js

@@ -22,7 +22,7 @@ describe('Stripe - Webhooks', () => {
     const eventRetrieved = {type: eventType};
 
     beforeEach(() => {
-      sinon.stub(stripe.events, 'retrieve').returnsPromise().resolves(eventRetrieved);
+      sinon.stub(stripe.events, 'retrieve').resolves(eventRetrieved);
       sinon.stub(logger, 'error');
     });
 
@@ -52,8 +52,8 @@ describe('Stripe - Webhooks', () => {
     const eventType = 'customer.subscription.deleted';
 
     beforeEach(() => {
-      sinon.stub(stripe.customers, 'del').returnsPromise().resolves({});
-      sinon.stub(payments, 'cancelSubscription').returnsPromise().resolves({});
+      sinon.stub(stripe.customers, 'del').resolves({});
+      sinon.stub(payments, 'cancelSubscription').resolves({});
     });
 
     afterEach(() => {
@@ -62,7 +62,7 @@ describe('Stripe - Webhooks', () => {
     });
 
     it('does not do anything if event.request is null (subscription cancelled manually)', async () => {
-      sinon.stub(stripe.events, 'retrieve').returnsPromise().resolves({
+      sinon.stub(stripe.events, 'retrieve').resolves({
         id: 123,
         type: eventType,
         request: 123,
@@ -79,7 +79,7 @@ describe('Stripe - Webhooks', () => {
     describe('user subscription', () => {
       it('throws an error if the user is not found', async () => {
         const customerId = 456;
-        sinon.stub(stripe.events, 'retrieve').returnsPromise().resolves({
+        sinon.stub(stripe.events, 'retrieve').resolves({
           id: 123,
           type: eventType,
           data: {
@@ -113,7 +113,7 @@ describe('Stripe - Webhooks', () => {
         subscriber.purchased.plan.paymentMethod = 'Stripe';
         await subscriber.save();
 
-        sinon.stub(stripe.events, 'retrieve').returnsPromise().resolves({
+        sinon.stub(stripe.events, 'retrieve').resolves({
           id: 123,
           type: eventType,
           data: {
@@ -146,7 +146,7 @@ describe('Stripe - Webhooks', () => {
     describe('group plan subscription', () => {
       it('throws an error if the group is not found', async () => {
         const customerId = 456;
-        sinon.stub(stripe.events, 'retrieve').returnsPromise().resolves({
+        sinon.stub(stripe.events, 'retrieve').resolves({
           id: 123,
           type: eventType,
           data: {
@@ -185,7 +185,7 @@ describe('Stripe - Webhooks', () => {
         subscriber.purchased.plan.paymentMethod = 'Stripe';
         await subscriber.save();
 
-        sinon.stub(stripe.events, 'retrieve').returnsPromise().resolves({
+        sinon.stub(stripe.events, 'retrieve').resolves({
           id: 123,
           type: eventType,
           data: {
@@ -227,7 +227,7 @@ describe('Stripe - Webhooks', () => {
         subscriber.purchased.plan.paymentMethod = 'Stripe';
         await subscriber.save();
 
-        sinon.stub(stripe.events, 'retrieve').returnsPromise().resolves({
+        sinon.stub(stripe.events, 'retrieve').resolves({
           id: 123,
           type: eventType,
           data: {

test/api/unit/libs/payments/stripe/upgrade-group-plan.test.js

@@ -38,7 +38,7 @@ describe('Stripe - Upgrade Group Plan', () => {
     await group.save();
 
     spy = sinon.stub(stripe.subscriptions, 'update');
-    spy.returnsPromise().resolves([]);
+    spy.resolves([]);
     data.groupId = group._id;
     data.sub.quantity = 3;
     stripePayments.setStripeApi(stripe);

test/api/unit/libs/slack.js

@@ -32,6 +32,7 @@ describe('slack', () => {
         },
         message: {
           id: 'chat-id',
+          username: 'author',
           user: 'Author',
           uuid: 'author-id',
           text: 'some text',
@@ -50,11 +51,11 @@ describe('slack', () => {
 
       expect(IncomingWebhook.prototype.send).to.be.calledOnce;
       expect(IncomingWebhook.prototype.send).to.be.calledWith({
-        text: 'flagger (flagger-id; language: flagger-lang) flagged a message',
+        text: 'flagger (flagger-id; language: flagger-lang) flagged a group message',
         attachments: [{
           fallback: 'Flag Message',
           color: 'danger',
-          author_name: `Author - author@example.com - author-id\n${timestamp}`,
+          author_name: `@author Author (author@example.com; author-id)\n${timestamp}`,
           title: 'Flag in Some group - (private guild)',
           title_link: undefined,
           text: 'some text',
@@ -110,7 +111,7 @@ describe('slack', () => {
     });
 
     it('noops if no flagging url is provided', () => {
-      sandbox.stub(nconf, 'get').withArgs('SLACK:FLAGGING_URL').returns('');
+      sandbox.stub(nconf, 'get').withArgs('SLACK_FLAGGING_URL').returns('');
       sandbox.stub(logger, 'error');
       let reRequiredSlack = requireAgain('../../../../website/server/libs/slack');
 

test/api/unit/middlewares/redirects.js

@@ -73,6 +73,56 @@ describe('redirects middleware', () => {
 
       expect(res.redirect).to.have.not.been.called;
     });
+
+    it('does not redirect if passed skip ssl request param is passed with corrrect key', () => {
+      let nconfStub = sandbox.stub(nconf, 'get');
+      nconfStub.withArgs('BASE_URL').returns('https://habitica.com');
+      nconfStub.withArgs('IS_PROD').returns(true);
+      nconfStub.withArgs('SKIP_SSL_CHECK_KEY').returns('test-key');
+
+      req.header = sandbox.stub().withArgs('x-forwarded-proto').returns('http');
+      req.originalUrl = '/static/front';
+      req.query.skipSSLCheck = 'test-key';
+
+      const attachRedirects = requireAgain(pathToRedirectsMiddleware);
+      attachRedirects.forceSSL(req, res, next);
+
+      expect(res.redirect).to.have.not.been.called;
+    });
+
+    it('does redirect if skip ssl request param is passed with incorrrect key', () => {
+      let nconfStub = sandbox.stub(nconf, 'get');
+      nconfStub.withArgs('BASE_URL').returns('https://habitica.com');
+      nconfStub.withArgs('IS_PROD').returns(true);
+      nconfStub.withArgs('SKIP_SSL_CHECK_KEY').returns('test-key');
+
+      req.header = sandbox.stub().withArgs('x-forwarded-proto').returns('http');
+      req.originalUrl = '/static/front?skipSSLCheck=INVALID';
+      req.query.skipSSLCheck = 'INVALID';
+
+      const attachRedirects = requireAgain(pathToRedirectsMiddleware);
+      attachRedirects.forceSSL(req, res, next);
+
+      expect(res.redirect).to.be.calledOnce;
+      expect(res.redirect).to.be.calledWith('https://habitica.com/static/front?skipSSLCheck=INVALID');
+    });
+
+    it('does redirect if skip ssl check key is not set', () => {
+      let nconfStub = sandbox.stub(nconf, 'get');
+      nconfStub.withArgs('BASE_URL').returns('https://habitica.com');
+      nconfStub.withArgs('IS_PROD').returns(true);
+      nconfStub.withArgs('SKIP_SSL_CHECK_KEY').returns(null);
+
+      req.header = sandbox.stub().withArgs('x-forwarded-proto').returns('http');
+      req.originalUrl = '/static/front';
+      req.query.skipSSLCheck = 'INVALID';
+
+      const attachRedirects = requireAgain(pathToRedirectsMiddleware);
+      attachRedirects.forceSSL(req, res, next);
+
+      expect(res.redirect).to.be.calledOnce;
+      expect(res.redirect).to.be.calledWith('https://habitica.com/static/front');
+    });
   });
 
   context('forceHabitica', () => {

test/api/unit/models/group.test.js

@@ -32,8 +32,19 @@ describe('Group Model', () => {
       privacy: 'private',
     });
 
+    let _progress = {
+      up: 10,
+      down: 8,
+      collectedItems: 5,
+    };
+
     questLeader = new User({
-      party: { _id: party._id },
+      party: {
+        _id: party._id,
+        quest: {
+          progress: _progress,
+        },
+      },
       profile: { name: 'Quest Leader' },
       items: {
         quests: {
@@ -45,20 +56,40 @@ describe('Group Model', () => {
     party.leader = questLeader._id;
 
     participatingMember = new User({
-      party: { _id: party._id },
+      party: {
+        _id: party._id,
+        quest: {
+          progress: _progress,
+        },
+      },
       profile: { name: 'Participating Member' },
     });
     sleepingParticipatingMember = new User({
-      party: { _id: party._id },
+      party: {
+        _id: party._id,
+        quest: {
+          progress: _progress,
+        },
+      },
       profile: { name: 'Sleeping Participating Member' },
       preferences: { sleep: true },
     });
     nonParticipatingMember = new User({
-      party: { _id: party._id },
+      party: {
+        _id: party._id,
+        quest: {
+          progress: _progress,
+        },
+      },
       profile: { name: 'Non-Participating Member' },
     });
     undecidedMember = new User({
-      party: { _id: party._id },
+      party: {
+        _id: party._id,
+        quest: {
+          progress: _progress,
+        },
+      },
       profile: { name: 'Undecided Member' },
     });
 
@@ -511,7 +542,7 @@ describe('Group Model', () => {
           party.quest.active = false;
 
           await party.startQuest(questLeader);
-          Group.prototype.sendChat.reset();
+          Group.prototype.sendChat.resetHistory();
           await party.save();
 
           await Group.processQuestProgress(participatingMember, progress);
@@ -536,7 +567,7 @@ describe('Group Model', () => {
           party.quest.active = false;
 
           await party.startQuest(questLeader);
-          Group.prototype.sendChat.reset();
+          Group.prototype.sendChat.resetHistory();
           await party.save();
 
           await Group.processQuestProgress(participatingMember, progress);
@@ -618,7 +649,7 @@ describe('Group Model', () => {
       });
 
       it('throws an error if no uuids or emails are passed in', async () => {
-        await expect(Group.validateInvitations(null, null, res)).to.eventually.be.rejected.and.eql({
+        await expect(Group.validateInvitations({}, res)).to.eventually.be.rejected.and.eql({
           httpCode: 400,
           message: 'Bad request.',
           name: 'BadRequest',
@@ -628,7 +659,7 @@ describe('Group Model', () => {
       });
 
       it('throws an error if only uuids are passed in, but they are not an array', async () => {
-        await expect(Group.validateInvitations({ uuid: 'user-id'}, null, res)).to.eventually.be.rejected.and.eql({
+        await expect(Group.validateInvitations({ uuids: 'user-id'}, res)).to.eventually.be.rejected.and.eql({
           httpCode: 400,
           message: 'Bad request.',
           name: 'BadRequest',
@@ -638,7 +669,7 @@ describe('Group Model', () => {
       });
 
       it('throws an error if only emails are passed in, but they are not an array', async () => {
-        await expect(Group.validateInvitations(null, { emails: 'user@example.com'}, res)).to.eventually.be.rejected.and.eql({
+        await expect(Group.validateInvitations({emails: 'user@example.com'}, res)).to.eventually.be.rejected.and.eql({
           httpCode: 400,
           message: 'Bad request.',
           name: 'BadRequest',
@@ -648,27 +679,27 @@ describe('Group Model', () => {
       });
 
       it('throws an error if emails are not passed in, and uuid array is empty', async () => {
-        await expect(Group.validateInvitations([], null, res)).to.eventually.be.rejected.and.eql({
+        await expect(Group.validateInvitations({uuids: []},  res)).to.eventually.be.rejected.and.eql({
           httpCode: 400,
           message: 'Bad request.',
           name: 'BadRequest',
         });
         expect(res.t).to.be.calledOnce;
-        expect(res.t).to.be.calledWith('inviteMissingUuid');
+        expect(res.t).to.be.calledWith('inviteMustNotBeEmpty');
       });
 
       it('throws an error if uuids are not passed in, and email array is empty', async () => {
-        await expect(Group.validateInvitations(null, [], res)).to.eventually.be.rejected.and.eql({
+        await expect(Group.validateInvitations({emails: []},  res)).to.eventually.be.rejected.and.eql({
           httpCode: 400,
           message: 'Bad request.',
           name: 'BadRequest',
         });
         expect(res.t).to.be.calledOnce;
-        expect(res.t).to.be.calledWith('inviteMissingEmail');
+        expect(res.t).to.be.calledWith('inviteMustNotBeEmpty');
       });
 
       it('throws an error if uuids and emails are passed in as empty arrays', async () => {
-        await expect(Group.validateInvitations([], [], res)).to.eventually.be.rejected.and.eql({
+        await expect(Group.validateInvitations({emails: [], uuids: []}, res)).to.eventually.be.rejected.and.eql({
           httpCode: 400,
           message: 'Bad request.',
           name: 'BadRequest',
@@ -688,7 +719,7 @@ describe('Group Model', () => {
 
         uuids.push('one-more-uuid'); // to put it over the limit
 
-        await expect(Group.validateInvitations(uuids, emails, res)).to.eventually.be.rejected.and.eql({
+        await expect(Group.validateInvitations({uuids, emails}, res)).to.eventually.be.rejected.and.eql({
           httpCode: 400,
           message: 'Bad request.',
           name: 'BadRequest',
@@ -706,33 +737,33 @@ describe('Group Model', () => {
           emails.push(`user-${i}@example.com`);
         }
 
-        await Group.validateInvitations(uuids, emails, res);
+        await Group.validateInvitations({uuids, emails}, res);
         expect(res.t).to.not.be.called;
       });
 
 
       it('does not throw an error if only user ids are passed in', async () => {
-        await Group.validateInvitations(['user-id', 'user-id2'], null, res);
+        await Group.validateInvitations({uuids: ['user-id', 'user-id2']}, res);
         expect(res.t).to.not.be.called;
       });
 
       it('does not throw an error if only emails are passed in', async () => {
-        await Group.validateInvitations(null, ['user1@example.com', 'user2@example.com'], res);
+        await Group.validateInvitations({emails: ['user1@example.com', 'user2@example.com']}, res);
         expect(res.t).to.not.be.called;
       });
 
       it('does not throw an error if both uuids and emails are passed in', async () => {
-        await Group.validateInvitations(['user-id', 'user-id2'], ['user1@example.com', 'user2@example.com'], res);
+        await Group.validateInvitations({uuids: ['user-id', 'user-id2'], emails: ['user1@example.com', 'user2@example.com']}, res);
         expect(res.t).to.not.be.called;
       });
 
       it('does not throw an error if uuids are passed in and emails are an empty array', async () => {
-        await Group.validateInvitations(['user-id', 'user-id2'], [], res);
+        await Group.validateInvitations({uuids: ['user-id', 'user-id2'], emails: []}, res);
         expect(res.t).to.not.be.called;
       });
 
       it('does not throw an error if emails are passed in and uuids are an empty array', async () => {
-        await Group.validateInvitations([], ['user1@example.com', 'user2@example.com'], res);
+        await Group.validateInvitations({uuids: [], emails: ['user1@example.com', 'user2@example.com']}, res);
         expect(res.t).to.not.be.called;
       });
     });
@@ -1414,16 +1445,17 @@ describe('Group Model', () => {
           expect(party.quest.members).to.eql(expectedQuestMembers);
         });
 
-        it('applies updates to user object directly if user is participating', async () => {
+        it('applies updates to user object directly if user is participating (without resetting progress, except progress.down)', async () => {
           await party.startQuest(participatingMember);
 
           expect(participatingMember.party.quest.key).to.eql('whale');
+          expect(participatingMember.party.quest.progress.up).to.eql(10);
           expect(participatingMember.party.quest.progress.down).to.eql(0);
-          expect(participatingMember.party.quest.progress.collectedItems).to.eql(0);
+          expect(participatingMember.party.quest.progress.collectedItems).to.eql(5);
           expect(participatingMember.party.quest.completed).to.eql(null);
         });
 
-        it('applies updates to other participating members', async () => {
+        it('applies updates to other participating members (without resetting progress, except progress.down)', async () => {
           await party.startQuest(nonParticipatingMember);
 
           questLeader = await User.findById(questLeader._id);
@@ -1431,18 +1463,21 @@ describe('Group Model', () => {
           sleepingParticipatingMember = await User.findById(sleepingParticipatingMember._id);
 
           expect(participatingMember.party.quest.key).to.eql('whale');
+          expect(participatingMember.party.quest.progress.up).to.eql(10);
           expect(participatingMember.party.quest.progress.down).to.eql(0);
-          expect(participatingMember.party.quest.progress.collectedItems).to.eql(0);
+          expect(participatingMember.party.quest.progress.collectedItems).to.eql(5);
           expect(participatingMember.party.quest.completed).to.eql(null);
 
           expect(sleepingParticipatingMember.party.quest.key).to.eql('whale');
+          expect(sleepingParticipatingMember.party.quest.progress.up).to.eql(10);
           expect(sleepingParticipatingMember.party.quest.progress.down).to.eql(0);
-          expect(sleepingParticipatingMember.party.quest.progress.collectedItems).to.eql(0);
+          expect(sleepingParticipatingMember.party.quest.progress.collectedItems).to.eql(5);
           expect(sleepingParticipatingMember.party.quest.completed).to.eql(null);
 
           expect(questLeader.party.quest.key).to.eql('whale');
+          expect(questLeader.party.quest.progress.up).to.eql(10);
           expect(questLeader.party.quest.progress.down).to.eql(0);
-          expect(questLeader.party.quest.progress.collectedItems).to.eql(0);
+          expect(questLeader.party.quest.progress.collectedItems).to.eql(5);
           expect(questLeader.party.quest.completed).to.eql(null);
         });
 
@@ -1453,6 +1488,9 @@ describe('Group Model', () => {
           undecidedMember = await User.findById(undecidedMember._id);
 
           expect(nonParticipatingMember.party.quest.key).to.not.eql('whale');
+          expect(nonParticipatingMember.party.quest.progress.up).to.eql(10);
+          expect(nonParticipatingMember.party.quest.progress.down).to.eql(8);
+          expect(nonParticipatingMember.party.quest.progress.collectedItems).to.eql(5);
           expect(undecidedMember.party.quest.key).to.not.eql('whale');
         });
 
@@ -1620,8 +1658,9 @@ describe('Group Model', () => {
           let userQuest = participatingMember.party.quest;
 
           expect(userQuest.key).to.eql('whale');
+          expect(userQuest.progress.up).to.eql(10);
           expect(userQuest.progress.down).to.eql(0);
-          expect(userQuest.progress.collectedItems).to.eql(0);
+          expect(userQuest.progress.collectedItems).to.eql(5);
           expect(userQuest.completed).to.eql(null);
         });
 
@@ -1921,16 +1960,23 @@ describe('Group Model', () => {
           });
         });
 
-        it('sets user quest object to a clean state', async () => {
+        it('updates participating members quest object to a clean state (except for progress)', async () => {
           await party.finishQuest(quest);
 
-          let updatedLeader = await User.findById(questLeader._id);
+          questLeader = await User.findById(questLeader._id);
+          participatingMember = await User.findById(participatingMember._id);
 
-          expect(updatedLeader.party.quest.completed).to.eql('whale');
-          expect(updatedLeader.party.quest.progress.up).to.eql(0);
-          expect(updatedLeader.party.quest.progress.down).to.eql(0);
-          expect(updatedLeader.party.quest.progress.collectedItems).to.eql(0);
-          expect(updatedLeader.party.quest.RSVPNeeded).to.eql(false);
+          expect(questLeader.party.quest.completed).to.eql('whale');
+          expect(questLeader.party.quest.progress.up).to.eql(10);
+          expect(questLeader.party.quest.progress.down).to.eql(8);
+          expect(questLeader.party.quest.progress.collectedItems).to.eql(5);
+          expect(questLeader.party.quest.RSVPNeeded).to.eql(false);
+
+          expect(participatingMember.party.quest.completed).to.eql('whale');
+          expect(participatingMember.party.quest.progress.up).to.eql(10);
+          expect(participatingMember.party.quest.progress.down).to.eql(8);
+          expect(participatingMember.party.quest.progress.collectedItems).to.eql(5);
+          expect(participatingMember.party.quest.RSVPNeeded).to.eql(false);
         });
       });
 
@@ -2094,6 +2140,62 @@ describe('Group Model', () => {
         expect(options.chat).to.eql(chat);
       });
 
+      it('sends webhooks for users with webhooks triggered by system messages', async () => {
+        let guild = new Group({
+          name: 'some guild',
+          type: 'guild',
+        });
+
+        let memberWithWebhook = new User({
+          guilds: [guild._id],
+          webhooks: [{
+            type: 'groupChatReceived',
+            url: 'http://someurl.com',
+            options: {
+              groupId: guild._id,
+            },
+          }],
+        });
+        let memberWithoutWebhook = new User({
+          guilds: [guild._id],
+        });
+        let nonMemberWithWebhooks = new User({
+          webhooks: [{
+            type: 'groupChatReceived',
+            url: 'http://a-different-url.com',
+            options: {
+              groupId: generateUUID(),
+            },
+          }],
+        });
+
+        await Promise.all([
+          memberWithWebhook.save(),
+          memberWithoutWebhook.save(),
+          nonMemberWithWebhooks.save(),
+        ]);
+
+        guild.leader = memberWithWebhook._id;
+
+        await guild.save();
+
+        const groupMessage = guild.sendChat({message: 'Test message.'});
+        await groupMessage.save();
+
+        await sleep();
+
+        expect(groupChatReceivedWebhook.send).to.be.calledOnce;
+
+        let args = groupChatReceivedWebhook.send.args[0];
+        let webhooks = args[0].webhooks;
+        let options = args[1];
+
+        expect(webhooks).to.have.a.lengthOf(1);
+        expect(webhooks[0].id).to.eql(memberWithWebhook.webhooks[0].id);
+        expect(options.group).to.eql(guild);
+        expect(options.chat).to.eql(groupMessage);
+      });
+
       it('sends webhooks for each user with webhooks in group', async () => {
         let guild = new Group({
           name: 'some guild',
@@ -2183,28 +2285,54 @@ describe('Group Model', () => {
 
     context('hasNotCancelled', () => {
       it('returns false if group does not have customer id', () => {
-        expect(party.hasNotCancelled()).to.be.undefined;
+        expect(party.hasNotCancelled()).to.be.false;
       });
 
-      it('returns true if party does not have plan.dateTerminated', () => {
+      it('returns true if group does not have plan.dateTerminated', () => {
         party.purchased.plan.customerId = 'test-id';
 
         expect(party.hasNotCancelled()).to.be.true;
       });
 
-      it('returns false if party if plan.dateTerminated is after today', () => {
+      it('returns false if group if plan.dateTerminated is after today', () => {
         party.purchased.plan.customerId = 'test-id';
         party.purchased.plan.dateTerminated = moment().add(1, 'days').toDate();
 
         expect(party.hasNotCancelled()).to.be.false;
       });
 
-      it('returns false if party if plan.dateTerminated is before today', () => {
+      it('returns false if group if plan.dateTerminated is before today', () => {
         party.purchased.plan.customerId = 'test-id';
         party.purchased.plan.dateTerminated = moment().subtract(1, 'days').toDate();
 
         expect(party.hasNotCancelled()).to.be.false;
       });
     });
+
+    context('hasCancelled', () => {
+      it('returns false if group does not have customer id', () => {
+        expect(party.hasCancelled()).to.be.false;
+      });
+
+      it('returns false if group does not have plan.dateTerminated', () => {
+        party.purchased.plan.customerId = 'test-id';
+
+        expect(party.hasCancelled()).to.be.false;
+      });
+
+      it('returns true if group if plan.dateTerminated is after today', () => {
+        party.purchased.plan.customerId = 'test-id';
+        party.purchased.plan.dateTerminated = moment().add(1, 'days').toDate();
+
+        expect(party.hasCancelled()).to.be.true;
+      });
+
+      it('returns false if group if plan.dateTerminated is before today', () => {
+        party.purchased.plan.customerId = 'test-id';
+        party.purchased.plan.dateTerminated = moment().subtract(1, 'days').toDate();
+
+        expect(party.hasCancelled()).to.be.false;
+      });
+    });
   });
 });

test/api/unit/models/user.test.js

@@ -315,9 +315,8 @@ describe('User Model', () => {
       user = new User();
     });
 
-
     it('returns false if user does not have customer id', () => {
-      expect(user.hasNotCancelled()).to.be.undefined;
+      expect(user.hasNotCancelled()).to.be.false;
     });
 
     it('returns true if user does not have plan.dateTerminated', () => {
@@ -341,6 +340,38 @@ describe('User Model', () => {
     });
   });
 
+
+  context('hasCancelled', () => {
+    let user;
+    beforeEach(() => {
+      user = new User();
+    });
+
+    it('returns false if user does not have customer id', () => {
+      expect(user.hasCancelled()).to.be.false;
+    });
+
+    it('returns false if user does not have plan.dateTerminated', () => {
+      user.purchased.plan.customerId = 'test-id';
+
+      expect(user.hasCancelled()).to.be.false;
+    });
+
+    it('returns true if user if plan.dateTerminated is after today', () => {
+      user.purchased.plan.customerId = 'test-id';
+      user.purchased.plan.dateTerminated = moment().add(1, 'days').toDate();
+
+      expect(user.hasCancelled()).to.be.true;
+    });
+
+    it('returns false if user if plan.dateTerminated is before today', () => {
+      user.purchased.plan.customerId = 'test-id';
+      user.purchased.plan.dateTerminated = moment().subtract(1, 'days').toDate();
+
+      expect(user.hasCancelled()).to.be.false;
+    });
+  });
+
   context('pre-save hook', () => {
     it('does not try to award achievements when achievements or items not selected in query', async () => {
       let user = new User();

test/api/v3/integration/challenges/GET-challenges_challengeId.test.js

@@ -47,6 +47,14 @@ describe('GET /challenges/:challengeId', () => {
         _id: groupLeader._id,
         id: groupLeader._id,
         profile: {name: groupLeader.profile.name},
+        auth: {
+          local: {
+            username: groupLeader.auth.local.username,
+          },
+        },
+        flags: {
+          verifiedUsername: true,
+        },
       });
       expect(chal.group).to.eql({
         _id: group._id,
@@ -105,6 +113,14 @@ describe('GET /challenges/:challengeId', () => {
         _id: challengeLeader._id,
         id: challengeLeader._id,
         profile: {name: challengeLeader.profile.name},
+        auth: {
+          local: {
+            username: challengeLeader.auth.local.username,
+          },
+        },
+        flags: {
+          verifiedUsername: true,
+        },
       });
       expect(chal.group).to.eql({
         _id: group._id,
@@ -131,6 +147,14 @@ describe('GET /challenges/:challengeId', () => {
         _id: challengeLeader._id,
         id: challengeLeader._id,
         profile: {name: challengeLeader.profile.name},
+        auth: {
+          local: {
+            username: challengeLeader.auth.local.username,
+          },
+        },
+        flags: {
+          verifiedUsername: true,
+        },
       });
     });
   });
@@ -179,6 +203,14 @@ describe('GET /challenges/:challengeId', () => {
         _id: challengeLeader._id,
         id: challengeLeader._id,
         profile: {name: challengeLeader.profile.name},
+        auth: {
+          local: {
+            username: challengeLeader.auth.local.username,
+          },
+        },
+        flags: {
+          verifiedUsername: true,
+        },
       });
       expect(chal.group).to.eql({
         _id: group._id,
@@ -205,6 +237,14 @@ describe('GET /challenges/:challengeId', () => {
         _id: challengeLeader._id,
         id: challengeLeader._id,
         profile: {name: challengeLeader.profile.name},
+        auth: {
+          local: {
+            username: challengeLeader.auth.local.username,
+          },
+        },
+        flags: {
+          verifiedUsername: true,
+        },
       });
     });
   });

test/api/v3/integration/challenges/GET-challenges_challengeId_export_csv.test.js

@@ -65,11 +65,11 @@ describe('GET /challenges/:challengeId/export/csv', () => {
     const sortedMembers = _.sortBy([members[0], members[1], members[2], groupLeader], '_id');
     const splitRes = res.split('\n');
 
-    expect(splitRes[0]).to.equal('UUID,name,Task,Value,Notes,Streak,Task,Value,Notes,Streak');
-    expect(splitRes[1]).to.equal(`${sortedMembers[0]._id},${sortedMembers[0].profile.name},habit:Task 1,0,,0,todo:Task 2,0,,0`);
-    expect(splitRes[2]).to.equal(`${sortedMembers[1]._id},${sortedMembers[1].profile.name},habit:Task 1,0,,0,todo:Task 2,0,,0`);
-    expect(splitRes[3]).to.equal(`${sortedMembers[2]._id},${sortedMembers[2].profile.name},habit:Task 1,0,,0,todo:Task 2,0,,0`);
-    expect(splitRes[4]).to.equal(`${sortedMembers[3]._id},${sortedMembers[3].profile.name},habit:Task 1,0,,0,todo:Task 2,0,,0`);
+    expect(splitRes[0]).to.equal('UUID,Display Name,Username,Task,Value,Notes,Streak,Task,Value,Notes,Streak');
+    expect(splitRes[1]).to.equal(`${sortedMembers[0]._id},${sortedMembers[0].profile.name},${sortedMembers[0].auth.local.username},habit:Task 1,0,,0,todo:Task 2,0,,0`);
+    expect(splitRes[2]).to.equal(`${sortedMembers[1]._id},${sortedMembers[1].profile.name},${sortedMembers[1].auth.local.username},habit:Task 1,0,,0,todo:Task 2,0,,0`);
+    expect(splitRes[3]).to.equal(`${sortedMembers[2]._id},${sortedMembers[2].profile.name},${sortedMembers[2].auth.local.username},habit:Task 1,0,,0,todo:Task 2,0,,0`);
+    expect(splitRes[4]).to.equal(`${sortedMembers[3]._id},${sortedMembers[3].profile.name},${sortedMembers[3].auth.local.username},habit:Task 1,0,,0,todo:Task 2,0,,0`);
     expect(splitRes[5]).to.equal('');
   });
 
@@ -78,10 +78,10 @@ describe('GET /challenges/:challengeId/export/csv', () => {
     const res = await members[1].get(`/challenges/${challenge._id}/export/csv`);
     const sortedMembers = _.sortBy([members[1], members[2], groupLeader], '_id');
     const splitRes = res.split('\n');
-    expect(splitRes[0]).to.equal('UUID,name,Task,Value,Notes,Streak,Task,Value,Notes,Streak');
-    expect(splitRes[1]).to.equal(`${sortedMembers[0]._id},${sortedMembers[0].profile.name},habit:Task 1,0,,0,todo:Task 2,0,,0`);
-    expect(splitRes[2]).to.equal(`${sortedMembers[1]._id},${sortedMembers[1].profile.name},habit:Task 1,0,,0,todo:Task 2,0,,0`);
-    expect(splitRes[3]).to.equal(`${sortedMembers[2]._id},${sortedMembers[2].profile.name},habit:Task 1,0,,0,todo:Task 2,0,,0`);
+    expect(splitRes[0]).to.equal('UUID,Display Name,Username,Task,Value,Notes,Streak,Task,Value,Notes,Streak');
+    expect(splitRes[1]).to.equal(`${sortedMembers[0]._id},${sortedMembers[0].profile.name},${sortedMembers[0].auth.local.username},habit:Task 1,0,,0,todo:Task 2,0,,0`);
+    expect(splitRes[2]).to.equal(`${sortedMembers[1]._id},${sortedMembers[1].profile.name},${sortedMembers[1].auth.local.username},habit:Task 1,0,,0,todo:Task 2,0,,0`);
+    expect(splitRes[3]).to.equal(`${sortedMembers[2]._id},${sortedMembers[2].profile.name},${sortedMembers[2].auth.local.username},habit:Task 1,0,,0,todo:Task 2,0,,0`);
     expect(splitRes[4]).to.equal('');
   });
 });

test/api/v3/integration/challenges/GET-challenges_challengeId_members.test.js

@@ -60,6 +60,14 @@ describe('GET /challenges/:challengeId/members', () => {
       _id: groupLeader._id,
       id: groupLeader._id,
       profile: {name: groupLeader.profile.name},
+      auth: {
+        local: {
+          username: groupLeader.auth.local.username,
+        },
+      },
+      flags: {
+        verifiedUsername: true,
+      },
     });
   });
 
@@ -73,8 +81,16 @@ describe('GET /challenges/:challengeId/members', () => {
       _id: leader._id,
       id: leader._id,
       profile: {name: leader.profile.name},
+      auth: {
+        local: {
+          username: leader.auth.local.username,
+        },
+      },
+      flags: {
+        verifiedUsername: true,
+      },
     });
-    expect(res[0]).to.have.all.keys(['_id', 'id', 'profile']);
+    expect(res[0]).to.have.all.keys(['_id', 'auth', 'flags', 'id', 'profile']);
     expect(res[0].profile).to.have.all.keys(['name']);
   });
 
@@ -88,8 +104,16 @@ describe('GET /challenges/:challengeId/members', () => {
       _id: anotherUser._id,
       id: anotherUser._id,
       profile: {name: anotherUser.profile.name},
+      auth: {
+        local: {
+          username: anotherUser.auth.local.username,
+        },
+      },
+      flags: {
+        verifiedUsername: true,
+      },
     });
-    expect(res[0]).to.have.all.keys(['_id', 'id', 'profile']);
+    expect(res[0]).to.have.all.keys(['_id', 'auth', 'flags', 'id', 'profile']);
     expect(res[0].profile).to.have.all.keys(['name']);
   });
 
@@ -107,7 +131,7 @@ describe('GET /challenges/:challengeId/members', () => {
     let res = await user.get(`/challenges/${challenge._id}/members?includeAllMembers=not-true`);
     expect(res.length).to.equal(30);
     res.forEach(member => {
-      expect(member).to.have.all.keys(['_id', 'id', 'profile']);
+      expect(member).to.have.all.keys(['_id', 'auth', 'flags', 'id', 'profile']);
       expect(member.profile).to.have.all.keys(['name']);
     });
   });
@@ -126,7 +150,7 @@ describe('GET /challenges/:challengeId/members', () => {
     let res = await user.get(`/challenges/${challenge._id}/members`);
     expect(res.length).to.equal(30);
     res.forEach(member => {
-      expect(member).to.have.all.keys(['_id', 'id', 'profile']);
+      expect(member).to.have.all.keys(['_id', 'auth', 'flags', 'id', 'profile']);
       expect(member.profile).to.have.all.keys(['name']);
     });
   });
@@ -145,7 +169,7 @@ describe('GET /challenges/:challengeId/members', () => {
     let res = await user.get(`/challenges/${challenge._id}/members?includeAllMembers=true`);
     expect(res.length).to.equal(32);
     res.forEach(member => {
-      expect(member).to.have.all.keys(['_id', 'id', 'profile']);
+      expect(member).to.have.all.keys(['_id', 'auth', 'flags', 'id', 'profile']);
       expect(member.profile).to.have.all.keys(['name']);
     });
   });

test/api/v3/integration/challenges/GET-challenges_challengeId_members_memberId.test.js

@@ -81,7 +81,7 @@ describe('GET /challenges/:challengeId/members/:memberId', () => {
     await groupLeader.post(`/tasks/challenge/${challenge._id}`, [{type: 'habit', text: taskText}]);
 
     let memberProgress = await user.get(`/challenges/${challenge._id}/members/${groupLeader._id}`);
-    expect(memberProgress).to.have.all.keys(['_id', 'id', 'profile', 'tasks']);
+    expect(memberProgress).to.have.all.keys(['_id', 'auth', 'flags', 'id', 'profile', 'tasks']);
     expect(memberProgress.profile).to.have.all.keys(['name']);
     expect(memberProgress.tasks.length).to.equal(1);
   });

test/api/v3/integration/challenges/GET-challenges_group_groupid.test.js

@@ -39,6 +39,14 @@ describe('GET challenges/groups/:groupId', () => {
         _id: publicGuild.leader._id,
         id: publicGuild.leader._id,
         profile: {name: user.profile.name},
+        auth: {
+          local: {
+            username: user.auth.local.username,
+          },
+        },
+        flags: {
+          verifiedUsername: true,
+        },
       });
       let foundChallenge2 = _.find(challenges, { _id: challenge2._id });
       expect(foundChallenge2).to.exist;
@@ -46,6 +54,14 @@ describe('GET challenges/groups/:groupId', () => {
         _id: publicGuild.leader._id,
         id: publicGuild.leader._id,
         profile: {name: user.profile.name},
+        auth: {
+          local: {
+            username: user.auth.local.username,
+          },
+        },
+        flags: {
+          verifiedUsername: true,
+        },
       });
     });
 
@@ -58,6 +74,14 @@ describe('GET challenges/groups/:groupId', () => {
         _id: publicGuild.leader._id,
         id: publicGuild.leader._id,
         profile: {name: user.profile.name},
+        auth: {
+          local: {
+            username: user.auth.local.username,
+          },
+        },
+        flags: {
+          verifiedUsername: true,
+        },
       });
       let foundChallenge2 = _.find(challenges, { _id: challenge2._id });
       expect(foundChallenge2).to.exist;
@@ -65,6 +89,14 @@ describe('GET challenges/groups/:groupId', () => {
         _id: publicGuild.leader._id,
         id: publicGuild.leader._id,
         profile: {name: user.profile.name},
+        auth: {
+          local: {
+            username: user.auth.local.username,
+          },
+        },
+        flags: {
+          verifiedUsername: true,
+        },
       });
     });
 
@@ -125,6 +157,14 @@ describe('GET challenges/groups/:groupId', () => {
         _id: privateGuild.leader._id,
         id: privateGuild.leader._id,
         profile: {name: user.profile.name},
+        auth: {
+          local: {
+            username: user.auth.local.username,
+          },
+        },
+        flags: {
+          verifiedUsername: true,
+        },
       });
       let foundChallenge2 = _.find(challenges, { _id: challenge2._id });
       expect(foundChallenge2).to.exist;
@@ -132,6 +172,14 @@ describe('GET challenges/groups/:groupId', () => {
         _id: privateGuild.leader._id,
         id: privateGuild.leader._id,
         profile: {name: user.profile.name},
+        auth: {
+          local: {
+            username: user.auth.local.username,
+          },
+        },
+        flags: {
+          verifiedUsername: true,
+        },
       });
     });
   });
@@ -235,6 +283,14 @@ describe('GET challenges/groups/:groupId', () => {
         _id: party.leader._id,
         id: party.leader._id,
         profile: {name: user.profile.name},
+        auth: {
+          local: {
+            username: user.auth.local.username,
+          },
+        },
+        flags: {
+          verifiedUsername: true,
+        },
       });
       let foundChallenge2 = _.find(challenges, { _id: challenge2._id });
       expect(foundChallenge2).to.exist;
@@ -242,6 +298,14 @@ describe('GET challenges/groups/:groupId', () => {
         _id: party.leader._id,
         id: party.leader._id,
         profile: {name: user.profile.name},
+        auth: {
+          local: {
+            username: user.auth.local.username,
+          },
+        },
+        flags: {
+          verifiedUsername: true,
+        },
       });
     });
 
@@ -254,6 +318,14 @@ describe('GET challenges/groups/:groupId', () => {
         _id: party.leader._id,
         id: party.leader._id,
         profile: {name: user.profile.name},
+        auth: {
+          local: {
+            username: user.auth.local.username,
+          },
+        },
+        flags: {
+          verifiedUsername: true,
+        },
       });
       let foundChallenge2 = _.find(challenges, { _id: challenge2._id });
       expect(foundChallenge2).to.exist;
@@ -261,6 +333,14 @@ describe('GET challenges/groups/:groupId', () => {
         _id: party.leader._id,
         id: party.leader._id,
         profile: {name: user.profile.name},
+        auth: {
+          local: {
+            username: user.auth.local.username,
+          },
+        },
+        flags: {
+          verifiedUsername: true,
+        },
       });
     });
   });
@@ -288,6 +368,14 @@ describe('GET challenges/groups/:groupId', () => {
         _id: user._id,
         id: user._id,
         profile: {name: user.profile.name},
+        auth: {
+          local: {
+            username: user.auth.local.username,
+          },
+        },
+        flags: {
+          verifiedUsername: true,
+        },
       });
       let foundChallenge2 = _.find(challenges, { _id: challenge2._id });
       expect(foundChallenge2).to.exist;
@@ -295,6 +383,14 @@ describe('GET challenges/groups/:groupId', () => {
         _id: user._id,
         id: user._id,
         profile: {name: user.profile.name},
+        auth: {
+          local: {
+            username: user.auth.local.username,
+          },
+        },
+        flags: {
+          verifiedUsername: true,
+        },
       });
     });
 
@@ -307,6 +403,14 @@ describe('GET challenges/groups/:groupId', () => {
         _id: user._id,
         id: user._id,
         profile: {name: user.profile.name},
+        auth: {
+          local: {
+            username: user.auth.local.username,
+          },
+        },
+        flags: {
+          verifiedUsername: true,
+        },
       });
       let foundChallenge2 = _.find(challenges, { _id: challenge2._id });
       expect(foundChallenge2).to.exist;
@@ -314,6 +418,14 @@ describe('GET challenges/groups/:groupId', () => {
         _id: user._id,
         id: user._id,
         profile: {name: user.profile.name},
+        auth: {
+          local: {
+            username: user.auth.local.username,
+          },
+        },
+        flags: {
+          verifiedUsername: true,
+        },
       });
     });
   });

test/api/v3/integration/challenges/GET-challenges_user.test.js

@@ -40,6 +40,14 @@ describe('GET challenges/user', () => {
         _id: publicGuild.leader._id,
         id: publicGuild.leader._id,
         profile: {name: user.profile.name},
+        auth: {
+          local: {
+            username: user.auth.local.username,
+          },
+        },
+        flags: {
+          verifiedUsername: true,
+        },
       });
       expect(foundChallenge.group).to.eql({
         _id: publicGuild._id,
@@ -62,6 +70,14 @@ describe('GET challenges/user', () => {
         _id: publicGuild.leader._id,
         id: publicGuild.leader._id,
         profile: {name: user.profile.name},
+        auth: {
+          local: {
+            username: user.auth.local.username,
+          },
+        },
+        flags: {
+          verifiedUsername: true,
+        },
       });
       expect(foundChallenge1.group).to.eql({
         _id: publicGuild._id,
@@ -79,6 +95,14 @@ describe('GET challenges/user', () => {
         _id: publicGuild.leader._id,
         id: publicGuild.leader._id,
         profile: {name: user.profile.name},
+        auth: {
+          local: {
+            username: user.auth.local.username,
+          },
+        },
+        flags: {
+          verifiedUsername: true,
+        },
       });
       expect(foundChallenge2.group).to.eql({
         _id: publicGuild._id,
@@ -101,6 +125,14 @@ describe('GET challenges/user', () => {
         _id: publicGuild.leader._id,
         id: publicGuild.leader._id,
         profile: {name: user.profile.name},
+        auth: {
+          local: {
+            username: user.auth.local.username,
+          },
+        },
+        flags: {
+          verifiedUsername: true,
+        },
       });
       expect(foundChallenge1.group).to.eql({
         _id: publicGuild._id,
@@ -118,6 +150,14 @@ describe('GET challenges/user', () => {
         _id: publicGuild.leader._id,
         id: publicGuild.leader._id,
         profile: {name: user.profile.name},
+        auth: {
+          local: {
+            username: user.auth.local.username,
+          },
+        },
+        flags: {
+          verifiedUsername: true,
+        },
       });
       expect(foundChallenge2.group).to.eql({
         _id: publicGuild._id,

test/api/v3/integration/challenges/POST-challenges_challengeId_join.test.js

@@ -79,6 +79,14 @@ describe('POST /challenges/:challengeId/join', () => {
         _id: groupLeader._id,
         id: groupLeader._id,
         profile: {name: groupLeader.profile.name},
+        auth: {
+          local: {
+            username: groupLeader.auth.local.username,
+          },
+        },
+        flags: {
+          verifiedUsername: true,
+        },
       });
       expect(res.name).to.equal(challenge.name);
     });

test/api/v3/integration/challenges/PUT-challenges_challengeId.test.js

@@ -56,11 +56,11 @@ describe('PUT /challenges/:challengeId', () => {
       tasksOrder: 'new order',
       official: true,
       shortName: 'new short name',
+      leader: member._id,
 
       // applied
       name: 'New Challenge Name',
       description: 'New challenge description.',
-      leader: member._id,
     });
 
     expect(res.prize).to.equal(0);
@@ -76,9 +76,17 @@ describe('PUT /challenges/:challengeId', () => {
     expect(res.shortName).not.to.equal('new short name');
 
     expect(res.leader).to.eql({
-      _id: member._id,
-      id: member._id,
-      profile: {name: member.profile.name},
+      _id: user._id,
+      id: user._id,
+      profile: {name: user.profile.name},
+      auth: {
+        local: {
+          username: user.auth.local.username,
+        },
+      },
+      flags: {
+        verifiedUsername: true,
+      },
     });
     expect(res.name).to.equal('New Challenge Name');
     expect(res.description).to.equal('New challenge description.');

test/api/v3/integration/chat/POST-chat.flag.test.js

@@ -63,11 +63,11 @@ describe('POST /chat/:chatId/flag', () => {
 
     /* eslint-disable camelcase */
     expect(IncomingWebhook.prototype.send).to.be.calledWith({
-      text: `${user.profile.name} (${user.id}; language: en) flagged a message`,
+      text: `${user.profile.name} (${user.id}; language: en) flagged a group message`,
       attachments: [{
         fallback: 'Flag Message',
         color: 'danger',
-        author_name: `${anotherUser.profile.name} - ${anotherUser.auth.local.email} - ${anotherUser._id}\n${timestamp}`,
+        author_name: `@${anotherUser.auth.local.username} ${anotherUser.profile.name} (${anotherUser.auth.local.email}; ${anotherUser._id})\n${timestamp}`,
         title: 'Flag in Test Guild',
         title_link: `${BASE_URL}/groups/guild/${group._id}`,
         text: TEST_MESSAGE,
@@ -98,11 +98,11 @@ describe('POST /chat/:chatId/flag', () => {
 
     /* eslint-disable camelcase */
     expect(IncomingWebhook.prototype.send).to.be.calledWith({
-      text: `${newUser.profile.name} (${newUser.id}; language: en) flagged a message`,
+      text: `${newUser.profile.name} (${newUser.id}; language: en) flagged a group message`,
       attachments: [{
         fallback: 'Flag Message',
         color: 'danger',
-        author_name: `${newUser.profile.name} - ${newUser.auth.local.email} - ${newUser._id}\n${timestamp}`,
+        author_name: `@${newUser.auth.local.username} ${newUser.profile.name} (${newUser.auth.local.email}; ${newUser._id})\n${timestamp}`,
         title: 'Flag in Test Guild',
         title_link: `${BASE_URL}/groups/guild/${group._id}`,
         text: TEST_MESSAGE,

test/api/v3/integration/chat/POST-chat.test.js

@@ -257,7 +257,7 @@ describe('POST /chat', () => {
         attachments: [{
           fallback: 'Slur Message',
           color: 'danger',
-          author_name: `${user.profile.name} - ${user.auth.local.email} - ${user._id}`,
+          author_name: `@${user.auth.local.username} ${user.profile.name} (${user.auth.local.email}; ${user._id})`,
           title: 'Slur in Test Guild',
           title_link: `${BASE_URL}/groups/guild/${groupWithChat.id}`,
           text: testSlurMessage,
@@ -310,7 +310,7 @@ describe('POST /chat', () => {
         attachments: [{
           fallback: 'Slur Message',
           color: 'danger',
-          author_name: `${members[0].profile.name} - ${members[0].auth.local.email} - ${members[0]._id}`,
+          author_name: `@${members[0].auth.local.username} ${members[0].profile.name} (${members[0].auth.local.email}; ${members[0]._id})`,
           title: 'Slur in Party - (private party)',
           title_link: undefined,
           text: testSlurMessage,

test/api/v3/integration/chat/POST-groups_id_chat_id_clear_flags.test.js

@@ -106,7 +106,7 @@ describe('POST /groups/:id/chat/:id/clearflags', () => {
         .to.eventually.be.rejected.and.eql({
           code: 400,
           error: 'BadRequest',
-          message: t('messageCannotFlagSystemMessages', {communityManagerEmail: config.EMAILS.COMMUNITY_MANAGER_EMAIL}),
+          message: t('messageCannotFlagSystemMessages', {communityManagerEmail: config.EMAILS_COMMUNITY_MANAGER_EMAIL}),
         });
       // let messages = await members[0].get(`/groups/${group._id}/chat`);
       // expect(messages[0].id).to.eql(skillMsg.id);

test/api/v3/integration/groups/GET-groups.test.js

@@ -203,7 +203,7 @@ describe('GET /groups', () => {
       let page2 = await expect(user.get('/groups?type=publicGuilds&paginate=true&page=2'))
         .to.eventually.have.a.lengthOf(1 + 4); // 1 created now, 4 by other tests
       expect(page2[4].name).to.equal('guild with less members');
-    });
+    }).timeout(10000);
   });
 
   it('returns all the user\'s guilds when guilds passed in as query', async () => {

test/api/v3/integration/groups/GET-groups_groupId_invites.test.js

@@ -50,6 +50,14 @@ describe('GET /groups/:groupId/invites', () => {
       _id: invited._id,
       id: invited._id,
       profile: {name: invited.profile.name},
+      auth: {
+        local: {
+          username: invited.auth.local.username,
+        },
+      },
+      flags: {
+        verifiedUsername: true,
+      },
     });
   });
 
@@ -58,7 +66,7 @@ describe('GET /groups/:groupId/invites', () => {
     let invited = await generateUser();
     await user.post(`/groups/${group._id}/invite`, {uuids: [invited._id]});
     let res = await user.get('/groups/party/invites');
-    expect(res[0]).to.have.all.keys(['_id', 'id', 'profile']);
+    expect(res[0]).to.have.all.keys(['_id', 'auth', 'flags', 'id', 'profile']);
     expect(res[0].profile).to.have.all.keys(['name']);
   });
 
@@ -76,10 +84,10 @@ describe('GET /groups/:groupId/invites', () => {
     let res = await leader.get(`/groups/${group._id}/invites`);
     expect(res.length).to.equal(30);
     res.forEach(member => {
-      expect(member).to.have.all.keys(['_id', 'id', 'profile']);
+      expect(member).to.have.all.keys(['_id', 'auth', 'flags', 'id', 'profile']);
       expect(member.profile).to.have.all.keys(['name']);
     });
-  });
+  }).timeout(10000);
 
   it('supports using req.query.lastId to get more invites', async function () {
     this.timeout(30000); // @TODO: times out after 8 seconds

test/api/v3/integration/groups/GET-groups_groupId_members.test.js

@@ -56,13 +56,21 @@ describe('GET /groups/:groupId/members', () => {
       _id: user._id,
       id: user._id,
       profile: {name: user.profile.name},
+      auth: {
+        local: {
+          username: user.auth.local.username,
+        },
+      },
+      flags: {
+        verifiedUsername: true,
+      },
     });
   });
 
   it('populates only some fields', async () => {
     await generateGroup(user, {type: 'party', name: generateUUID()});
     let res = await user.get('/groups/party/members');
-    expect(res[0]).to.have.all.keys(['_id', 'id', 'profile']);
+    expect(res[0]).to.have.all.keys(['_id', 'auth', 'flags', 'id', 'profile']);
     expect(res[0].profile).to.have.all.keys(['name']);
   });
 
@@ -74,7 +82,7 @@ describe('GET /groups/:groupId/members', () => {
       '_id', 'id', 'preferences', 'profile', 'stats', 'achievements', 'party',
       'backer', 'contributor', 'auth', 'items', 'inbox', 'loginIncentives', 'flags',
     ]);
-    expect(Object.keys(memberRes.auth)).to.eql(['timestamps']);
+    expect(Object.keys(memberRes.auth)).to.eql(['local', 'timestamps']);
     expect(Object.keys(memberRes.preferences).sort()).to.eql([
       'size', 'hair', 'skin', 'shirt',
       'chair', 'costume', 'sleep', 'background', 'tasks', 'disableClasses',
@@ -95,7 +103,7 @@ describe('GET /groups/:groupId/members', () => {
       '_id', 'id', 'preferences', 'profile', 'stats', 'achievements', 'party',
       'backer', 'contributor', 'auth', 'items', 'inbox', 'loginIncentives', 'flags',
     ]);
-    expect(Object.keys(memberRes.auth)).to.eql(['timestamps']);
+    expect(Object.keys(memberRes.auth)).to.eql(['local', 'timestamps']);
     expect(Object.keys(memberRes.preferences).sort()).to.eql([
       'size', 'hair', 'skin', 'shirt',
       'chair', 'costume', 'sleep', 'background', 'tasks', 'disableClasses',
@@ -120,7 +128,7 @@ describe('GET /groups/:groupId/members', () => {
     let res = await user.get('/groups/party/members');
     expect(res.length).to.equal(30);
     res.forEach(member => {
-      expect(member).to.have.all.keys(['_id', 'id', 'profile']);
+      expect(member).to.have.all.keys(['_id', 'auth', 'flags', 'id', 'profile']);
       expect(member.profile).to.have.all.keys(['name']);
     });
   });
@@ -137,7 +145,7 @@ describe('GET /groups/:groupId/members', () => {
     let res = await user.get('/groups/party/members?includeAllMembers=true');
     expect(res.length).to.equal(30);
     res.forEach(member => {
-      expect(member).to.have.all.keys(['_id', 'id', 'profile']);
+      expect(member).to.have.all.keys(['_id', 'auth', 'flags', 'id', 'profile']);
       expect(member.profile).to.have.all.keys(['name']);
     });
   });

test/api/v3/integration/groups/POST-groups_invite.test.js

@@ -23,6 +23,73 @@ describe('Post /groups/:groupId/invite', () => {
     });
   });
 
+  describe('username invites', () => {
+    it('returns an error when invited user is not found', async () => {
+      const fakeID = 'fakeuserid';
+
+      await expect(inviter.post(`/groups/${group._id}/invite`, {
+        usernames: [fakeID],
+      }))
+        .to.eventually.be.rejected.and.eql({
+          code: 404,
+          error: 'NotFound',
+          message: t('userWithUsernameNotFound', {username: fakeID}),
+        });
+    });
+
+    it('returns an error when inviting yourself to a group', async () => {
+      await expect(inviter.post(`/groups/${group._id}/invite`, {
+        usernames: [inviter.auth.local.lowerCaseUsername],
+      }))
+        .to.eventually.be.rejected.and.eql({
+          code: 400,
+          error: 'BadRequest',
+          message: t('cannotInviteSelfToGroup'),
+        });
+    });
+
+    it('invites a user to a group by username', async () => {
+      const userToInvite = await generateUser();
+
+      await expect(inviter.post(`/groups/${group._id}/invite`, {
+        usernames: [userToInvite.auth.local.lowerCaseUsername],
+      })).to.eventually.deep.equal([{
+        id: group._id,
+        name: groupName,
+        inviter: inviter._id,
+        publicGuild: false,
+      }]);
+
+      await expect(userToInvite.get('/user'))
+        .to.eventually.have.nested.property('invitations.guilds[0].id', group._id);
+    });
+
+    it('invites multiple users to a group by uuid', async () => {
+      const userToInvite = await generateUser();
+      const userToInvite2 = await generateUser();
+
+      await expect(inviter.post(`/groups/${group._id}/invite`, {
+        usernames: [userToInvite.auth.local.lowerCaseUsername, userToInvite2.auth.local.lowerCaseUsername],
+      })).to.eventually.deep.equal([
+        {
+          id: group._id,
+          name: groupName,
+          inviter: inviter._id,
+          publicGuild: false,
+        },
+        {
+          id: group._id,
+          name: groupName,
+          inviter: inviter._id,
+          publicGuild: false,
+        },
+      ]);
+
+      await expect(userToInvite.get('/user')).to.eventually.have.nested.property('invitations.guilds[0].id', group._id);
+      await expect(userToInvite2.get('/user')).to.eventually.have.nested.property('invitations.guilds[0].id', group._id);
+    });
+  });
+
   describe('user id invites', () => {
     it('returns an error when inviter has no chat privileges', async () => {
       let inviterMuted = await inviter.update({'flags.chatRevoked': true});
@@ -93,7 +160,7 @@ describe('Post /groups/:groupId/invite', () => {
         .to.eventually.be.rejected.and.eql({
           code: 400,
           error: 'BadRequest',
-          message: t('inviteMissingUuid'),
+          message: t('inviteMustNotBeEmpty'),
         });
     });
 
@@ -228,7 +295,7 @@ describe('Post /groups/:groupId/invite', () => {
         .to.eventually.be.rejected.and.eql({
           code: 400,
           error: 'BadRequest',
-          message: t('inviteMissingEmail'),
+          message: t('inviteMustNotBeEmpty'),
         });
     });
 
@@ -266,7 +333,7 @@ describe('Post /groups/:groupId/invite', () => {
         .to.eventually.be.rejected.and.eql({
           code: 401,
           error: 'NotAuthorized',
-          message: t('inviteLimitReached', {techAssistanceEmail: nconf.get('EMAILS:TECH_ASSISTANCE_EMAIL')}),
+          message: t('inviteLimitReached', {techAssistanceEmail: nconf.get('EMAILS_TECH_ASSISTANCE_EMAIL')}),
         });
     });
 
@@ -417,7 +484,7 @@ describe('Post /groups/:groupId/invite', () => {
       expect(await inviter.post(`/groups/${group._id}/invite`, {
         uuids: generatedInvites.map(invite => invite._id),
       })).to.be.an('array');
-    });
+    }).timeout(10000);
 
     // @TODO: Add this after we are able to mock the group plan route
     xit('returns an error when a non-leader invites to a group plan', async () => {
@@ -564,7 +631,7 @@ describe('Post /groups/:groupId/invite', () => {
       expect(await inviter.post(`/groups/${party._id}/invite`, {
         uuids: generatedInvites.map(invite => invite._id),
       })).to.be.an('array');
-    });
+    }).timeout(10000);
 
     it('does not allow 30+ members in a party', async () => {
       let invitesToGenerate = [];
@@ -582,6 +649,6 @@ describe('Post /groups/:groupId/invite', () => {
           error: 'BadRequest',
           message: t('partyExceedsMembersLimit', {maxMembersParty: PARTY_LIMIT_MEMBERS}),
         });
-    });
+    }).timeout(10000);
   });
 });

test/api/v3/integration/hall/GET-hall_heroes_heroId.test.js

@@ -25,9 +25,9 @@ describe('GET /heroes/:heroId', () => {
 
   it('validates req.params.heroId', async () => {
     await expect(user.get('/hall/heroes/invalidUUID')).to.eventually.be.rejected.and.eql({
-      code: 400,
-      error: 'BadRequest',
-      message: t('invalidReqParams'),
+      code: 404,
+      error: 'NotFound',
+      message: t('userWithIDNotFound', {userId: 'invalidUUID'}),
     });
   });
 
@@ -40,7 +40,7 @@ describe('GET /heroes/:heroId', () => {
     });
   });
 
-  it('returns only necessary hero data', async () => {
+  it('returns only necessary hero data given user id', async () => {
     let hero = await generateUser({
       contributor: {tier: 23},
     });
@@ -53,4 +53,24 @@ describe('GET /heroes/:heroId', () => {
     expect(heroRes.auth.local).not.to.have.keys(['salt', 'hashed_password']);
     expect(heroRes.profile).to.have.all.keys(['name']);
   });
+
+  it('returns only necessary hero data given username', async () => {
+    let hero = await generateUser({
+      contributor: {tier: 23},
+    });
+    let heroRes = await user.get(`/hall/heroes/${hero.auth.local.username}`);
+
+    expect(heroRes).to.have.all.keys([ // works as: object has all and only these keys
+      '_id', 'id', 'balance', 'profile', 'purchased',
+      'contributor', 'auth', 'items',
+    ]);
+    expect(heroRes.auth.local).not.to.have.keys(['salt', 'hashed_password']);
+    expect(heroRes.profile).to.have.all.keys(['name']);
+  });
+
+  it('returns correct hero using search with difference case', async () => {
+    await generateUser({}, { username: 'TestUpperCaseName123' });
+    let heroRes = await user.get('/hall/heroes/TestuPPerCasEName123');
+    expect(heroRes.auth.local.username).to.equal('TestUpperCaseName123');
+  });
 });

test/api/v3/integration/hall/GET-hall_patrons.test.js

@@ -56,5 +56,5 @@ describe('GET /hall/patrons', () => {
     expect(morePatrons.length).to.equal(2);
     expect(morePatrons[0].backer.tier).to.equal(2);
     expect(morePatrons[1].backer.tier).to.equal(1);
-  });
+  }).timeout(10000);
 });

test/api/v3/integration/inbox/GET-inbox_messages.test.js

@@ -27,8 +27,6 @@ describe('GET /inbox/messages', () => {
       toUserId: user.id,
       message: 'fourth',
     });
-
-    await user.sync();
   });
 
   it('returns the user inbox messages as an array of ordered messages (from most to least recent)', async () => {
@@ -45,4 +43,27 @@ describe('GET /inbox/messages', () => {
     expect(messages[2].text).to.equal('second');
     expect(messages[3].text).to.equal('first');
   });
+
+  it('returns four messages when using page-query ', async () => {
+    const promises = [];
+
+    for (let i = 0; i < 10; i++) {
+      promises.push(user.post('/members/send-private-message', {
+        toUserId: user.id,
+        message: 'fourth',
+      }));
+    }
+
+    await Promise.all(promises);
+
+    const messages = await user.get('/inbox/messages?page=1');
+
+    expect(messages.length).to.equal(4);
+  });
+
+  it('returns only the messages of one conversation', async () => {
+    const messages = await user.get(`/inbox/messages?conversation=${otherUser.id}`);
+
+    expect(messages.length).to.equal(3);
+  });
 });

test/api/v3/integration/members/GET-members_id.test.js

@@ -34,7 +34,7 @@ describe('GET /members/:memberId', () => {
       '_id', 'id', 'preferences', 'profile', 'stats', 'achievements', 'party',
       'backer', 'contributor', 'auth', 'items', 'inbox', 'loginIncentives', 'flags',
     ]);
-    expect(Object.keys(memberRes.auth)).to.eql(['timestamps']);
+    expect(Object.keys(memberRes.auth)).to.eql(['local', 'timestamps']);
     expect(Object.keys(memberRes.preferences).sort()).to.eql([
       'size', 'hair', 'skin', 'shirt',
       'chair', 'costume', 'sleep', 'background', 'tasks', 'disableClasses',

test/api/v3/integration/notifications/POST-notifications_notificationId_read.test.js

@@ -16,7 +16,7 @@ describe('POST /notifications/:notificationId/read', () => {
 
     await expect(user.post(`/notifications/${dummyId}/read`)).to.eventually.be.rejected.and.eql({
       code: 404,
-      error: 'NotFound',
+      error: 'NotificationNotFound',
       message: t('messageNotificationNotFound'),
     });
   });

test/api/v3/integration/notifications/POST-notifications_notificationId_see.test.js

@@ -16,7 +16,7 @@ describe('POST /notifications/:notificationId/see', () => {
 
     await expect(user.post(`/notifications/${dummyId}/see`)).to.eventually.be.rejected.and.eql({
       code: 404,
-      error: 'NotFound',
+      error: 'NotificationNotFound',
       message: t('messageNotificationNotFound'),
     });
   });

test/api/v3/integration/notifications/POST-notifications_read.test.js

@@ -18,7 +18,7 @@ describe('POST /notifications/read', () => {
       notificationIds: [dummyId],
     })).to.eventually.be.rejected.and.eql({
       code: 404,
-      error: 'NotFound',
+      error: 'NotificationNotFound',
       message: t('messageNotificationNotFound'),
     });
   });

test/api/v3/integration/notifications/POST_notifications_see.test.js

@@ -18,7 +18,7 @@ describe('POST /notifications/see', () => {
       notificationIds: [dummyId],
     })).to.eventually.be.rejected.and.eql({
       code: 404,
-      error: 'NotFound',
+      error: 'NotificationNotFound',
       message: t('messageNotificationNotFound'),
     });
   });

test/api/v3/integration/payments/amazon/GET-payments_amazon_subscribe_cancel.test.js

@@ -23,7 +23,7 @@ describe('payments : amazon #subscribeCancel', () => {
 
   describe('success', () => {
     beforeEach(() => {
-      amazonSubscribeCancelStub = sinon.stub(amzLib, 'cancelSubscription').returnsPromise().resolves({});
+      amazonSubscribeCancelStub = sinon.stub(amzLib, 'cancelSubscription').resolves({});
     });
 
     afterEach(() => {

test/api/v3/integration/payments/amazon/POST-payments_amazon_checkout.test.js

@@ -21,7 +21,7 @@ describe('payments - amazon - #checkout', () => {
 
   describe('success', () => {
     beforeEach(async () => {
-      amazonCheckoutStub = sinon.stub(amzLib, 'checkout').returnsPromise().resolves({});
+      amazonCheckoutStub = sinon.stub(amzLib, 'checkout').resolves({});
     });
 
     afterEach(() => {

test/api/v3/integration/payments/amazon/POST-payments_amazon_subscribe.test.js

@@ -27,7 +27,7 @@ describe('payments - amazon - #subscribe', () => {
     let coupon;
 
     beforeEach(() => {
-      subscribeWithAmazonStub = sinon.stub(amzLib, 'subscribe').returnsPromise().resolves({});
+      subscribeWithAmazonStub = sinon.stub(amzLib, 'subscribe').resolves({});
     });
 
     afterEach(() => {

test/api/v3/integration/payments/apple/GET-payments_apple_cancelSubscribe.js

@@ -13,7 +13,7 @@ describe('payments : apple #cancelSubscribe', () => {
     let cancelStub;
 
     beforeEach(async () => {
-      cancelStub = sinon.stub(applePayments, 'cancelSubscribe').returnsPromise().resolves({});
+      cancelStub = sinon.stub(applePayments, 'cancelSubscribe').resolves({});
     });
 
     afterEach(() => {

test/api/v3/integration/payments/apple/POST-payments_apple_norenewsubscribe.test.js

@@ -0,0 +1,67 @@
+import {generateUser, translate as t} from '../../../../../helpers/api-integration/v3';
+import applePayments from '../../../../../../website/server/libs/payments/apple';
+
+describe('payments : apple #norenewsubscribe', () => {
+  let endpoint = '/iap/ios/norenew-subscribe';
+  let sku = 'com.habitrpg.ios.habitica.subscription.3month';
+  let user;
+
+  beforeEach(async () => {
+    user = await generateUser();
+  });
+
+  it('verifies sub key', async () => {
+    await expect(user.post(endpoint)).to.eventually.be.rejected.and.eql({
+      code: 400,
+      error: 'BadRequest',
+      message: t('missingSubscriptionCode'),
+    });
+  });
+
+  it('verifies receipt existence', async () => {
+    await expect(user.post(endpoint, {
+      sku,
+    })).to.eventually.be.rejected.and.eql({
+      code: 400,
+      error: 'BadRequest',
+      message: t('missingReceipt'),
+    });
+  });
+
+  describe('success', () => {
+    let subscribeStub;
+
+    beforeEach(async () => {
+      subscribeStub = sinon.stub(applePayments, 'noRenewSubscribe').resolves({});
+    });
+
+    afterEach(() => {
+      applePayments.noRenewSubscribe.restore();
+    });
+
+    it('makes a purchase', async () => {
+      user = await generateUser({
+        'profile.name': 'sender',
+        'purchased.plan.customerId': 'customer-id',
+        'purchased.plan.planId': 'basic_3mo',
+        'purchased.plan.lastBillingDate': new Date(),
+        balance: 2,
+      });
+
+      await user.post(endpoint, {
+        sku,
+        transaction: {receipt: 'receipt'},
+        gift: {
+          uuid: '1',
+        },
+      });
+
+      expect(subscribeStub).to.be.calledOnce;
+      expect(subscribeStub.args[0][0].user._id).to.eql(user._id);
+      expect(subscribeStub.args[0][0].sku).to.eql(sku);
+      expect(subscribeStub.args[0][0].receipt).to.eql('receipt');
+      expect(subscribeStub.args[0][0].headers['x-api-key']).to.eql(user.apiToken);
+      expect(subscribeStub.args[0][0].headers['x-api-user']).to.eql(user._id);
+    });
+  });
+});

test/api/v3/integration/payments/apple/POST-payments_apple_subscribe.test.js

@@ -21,7 +21,7 @@ describe('payments : apple #subscribe', () => {
     let subscribeStub;
 
     beforeEach(async () => {
-      subscribeStub = sinon.stub(applePayments, 'subscribe').returnsPromise().resolves({});
+      subscribeStub = sinon.stub(applePayments, 'subscribe').resolves({});
     });
 
     afterEach(() => {

test/api/v3/integration/payments/apple/POST-payments_apple_verifyiap.js

@@ -1,4 +1,4 @@
-import {generateUser} from '../../../../../helpers/api-integration/v3';
+import {generateUser, translate as t} from '../../../../../helpers/api-integration/v3';
 import applePayments from '../../../../../../website/server/libs/payments/apple';
 
 describe('payments : apple #verify', () => {
@@ -9,11 +9,19 @@ describe('payments : apple #verify', () => {
     user = await generateUser();
   });
 
+  it('verifies receipt existence', async () => {
+    await expect(user.post(endpoint)).to.eventually.be.rejected.and.eql({
+      code: 400,
+      error: 'BadRequest',
+      message: t('missingReceipt'),
+    });
+  });
+
   describe('success', () => {
     let verifyStub;
 
     beforeEach(async () => {
-      verifyStub = sinon.stub(applePayments, 'verifyGemPurchase').returnsPromise().resolves({});
+      verifyStub = sinon.stub(applePayments, 'verifyGemPurchase').resolves({});
     });
 
     afterEach(() => {
@@ -31,10 +39,31 @@ describe('payments : apple #verify', () => {
         }});
 
       expect(verifyStub).to.be.calledOnce;
-      expect(verifyStub.args[0][0]._id).to.eql(user._id);
-      expect(verifyStub.args[0][1]).to.eql('receipt');
-      expect(verifyStub.args[0][2]['x-api-key']).to.eql(user.apiToken);
-      expect(verifyStub.args[0][2]['x-api-user']).to.eql(user._id);
+      expect(verifyStub.args[0][0].user._id).to.eql(user._id);
+      expect(verifyStub.args[0][0].receipt).to.eql('receipt');
+      expect(verifyStub.args[0][0].headers['x-api-key']).to.eql(user.apiToken);
+      expect(verifyStub.args[0][0].headers['x-api-user']).to.eql(user._id);
+    });
+
+    it('gifts a purchase', async () => {
+      user = await generateUser({
+        balance: 2,
+      });
+
+      await user.post(endpoint, {
+        transaction: {
+          receipt: 'receipt',
+        },
+        gift: {
+          uuid: '1',
+        }});
+
+      expect(verifyStub).to.be.calledOnce;
+      expect(verifyStub.args[0][0].user._id).to.eql(user._id);
+      expect(verifyStub.args[0][0].receipt).to.eql('receipt');
+      expect(verifyStub.args[0][0].gift.uuid).to.eql('1');
+      expect(verifyStub.args[0][0].headers['x-api-key']).to.eql(user.apiToken);
+      expect(verifyStub.args[0][0].headers['x-api-user']).to.eql(user._id);
     });
   });
 });

test/api/v3/integration/payments/google/GET-payments_google_cancelSubscribe.js

@@ -13,7 +13,7 @@ describe('payments : google #cancelSubscribe', () => {
     let cancelStub;
 
     beforeEach(async () => {
-      cancelStub = sinon.stub(googlePayments, 'cancelSubscribe').returnsPromise().resolves({});
+      cancelStub = sinon.stub(googlePayments, 'cancelSubscribe').resolves({});
     });
 
     afterEach(() => {

test/api/v3/integration/payments/google/POST-payments_google_norenewsubscribe.test.js

@@ -0,0 +1,97 @@
+import {generateUser, translate as t} from '../../../../../helpers/api-integration/v3';
+import googlePayments from '../../../../../../website/server/libs/payments/google';
+
+describe('payments : google #norenewsubscribe', () => {
+  let endpoint = '/iap/android/norenew-subscribe';
+  let sku = 'com.habitrpg.android.habitica.subscription.3month';
+  let user;
+
+  beforeEach(async () => {
+    user = await generateUser();
+  });
+
+  it('verifies sub key', async () => {
+    await expect(user.post(endpoint)).to.eventually.be.rejected.and.eql({
+      code: 400,
+      error: 'BadRequest',
+      message: t('missingSubscriptionCode'),
+    });
+  });
+
+  it('verifies receipt existence', async () => {
+    await expect(user.post(endpoint, {
+      sku,
+    })).to.eventually.be.rejected.and.eql({
+      code: 400,
+      error: 'BadRequest',
+      message: t('missingReceipt'),
+    });
+  });
+
+  describe('success', () => {
+    let subscribeStub;
+
+    beforeEach(async () => {
+      subscribeStub = sinon.stub(googlePayments, 'noRenewSubscribe').resolves({});
+    });
+
+    afterEach(() => {
+      googlePayments.noRenewSubscribe.restore();
+    });
+
+    it('makes a purchase', async () => {
+      user = await generateUser({
+        'profile.name': 'sender',
+        'purchased.plan.customerId': 'customer-id',
+        'purchased.plan.planId': 'basic_3mo',
+        'purchased.plan.lastBillingDate': new Date(),
+        balance: 2,
+      });
+
+      await user.post(endpoint, {
+        sku,
+        transaction: {
+          receipt: 'receipt',
+          signature: 'signature',
+        },
+      });
+
+      expect(subscribeStub).to.be.calledOnce;
+      expect(subscribeStub.args[0][0].user._id).to.eql(user._id);
+      expect(subscribeStub.args[0][0].sku).to.eql(sku);
+      expect(subscribeStub.args[0][0].receipt).to.eql('receipt');
+      expect(subscribeStub.args[0][0].signature).to.eql('signature');
+      expect(subscribeStub.args[0][0].headers['x-api-key']).to.eql(user.apiToken);
+      expect(subscribeStub.args[0][0].headers['x-api-user']).to.eql(user._id);
+    });
+
+    it('gifts a purchase', async () => {
+      user = await generateUser({
+        'profile.name': 'sender',
+        'purchased.plan.customerId': 'customer-id',
+        'purchased.plan.planId': 'basic_3mo',
+        'purchased.plan.lastBillingDate': new Date(),
+        balance: 2,
+      });
+
+      await user.post(endpoint, {
+        sku,
+        transaction: {
+          receipt: 'receipt',
+          signature: 'signature',
+        },
+        gift: {
+          uuid: '1',
+        },
+      });
+
+      expect(subscribeStub).to.be.calledOnce;
+      expect(subscribeStub.args[0][0].user._id).to.eql(user._id);
+      expect(subscribeStub.args[0][0].sku).to.eql(sku);
+      expect(subscribeStub.args[0][0].receipt).to.eql('receipt');
+      expect(subscribeStub.args[0][0].signature).to.eql('signature');
+      expect(subscribeStub.args[0][0].headers['x-api-key']).to.eql(user.apiToken);
+      expect(subscribeStub.args[0][0].headers['x-api-user']).to.eql(user._id);
+    });
+  });
+});

test/api/v3/integration/payments/google/POST-payments_google_subscribe.test.js

@@ -21,7 +21,7 @@ describe('payments : google #subscribe', () => {
     let subscribeStub;
 
     beforeEach(async () => {
-      subscribeStub = sinon.stub(googlePayments, 'subscribe').returnsPromise().resolves({});
+      subscribeStub = sinon.stub(googlePayments, 'subscribe').resolves({});
     });
 
     afterEach(() => {

test/api/v3/integration/payments/google/POST-payments_google_verifyiap.js

@@ -1,4 +1,4 @@
-import {generateUser} from '../../../../../helpers/api-integration/v3';
+import {generateUser, translate as t} from '../../../../../helpers/api-integration/v3';
 import googlePayments from '../../../../../../website/server/libs/payments/google';
 
 describe('payments : google #verify', () => {
@@ -9,11 +9,19 @@ describe('payments : google #verify', () => {
     user = await generateUser();
   });
 
+  it('verifies receipt existence', async () => {
+    await expect(user.post(endpoint)).to.eventually.be.rejected.and.eql({
+      code: 400,
+      error: 'BadRequest',
+      message: t('missingReceipt'),
+    });
+  });
+
   describe('success', () => {
     let verifyStub;
 
     beforeEach(async () => {
-      verifyStub = sinon.stub(googlePayments, 'verifyGemPurchase').returnsPromise().resolves({});
+      verifyStub = sinon.stub(googlePayments, 'verifyGemPurchase').resolves({});
     });
 
     afterEach(() => {
@@ -30,11 +38,30 @@ describe('payments : google #verify', () => {
       });
 
       expect(verifyStub).to.be.calledOnce;
-      expect(verifyStub.args[0][0]._id).to.eql(user._id);
-      expect(verifyStub.args[0][1]).to.eql('receipt');
-      expect(verifyStub.args[0][2]).to.eql('signature');
-      expect(verifyStub.args[0][3]['x-api-key']).to.eql(user.apiToken);
-      expect(verifyStub.args[0][3]['x-api-user']).to.eql(user._id);
+      expect(verifyStub.args[0][0].user._id).to.eql(user._id);
+      expect(verifyStub.args[0][0].receipt).to.eql('receipt');
+      expect(verifyStub.args[0][0].signature).to.eql('signature');
+      expect(verifyStub.args[0][0].headers['x-api-key']).to.eql(user.apiToken);
+      expect(verifyStub.args[0][0].headers['x-api-user']).to.eql(user._id);
+    });
+
+    it('gifts a purchase', async () => {
+      user = await generateUser({
+        balance: 2,
+      });
+
+      await user.post(endpoint, {
+        transaction: {receipt: 'receipt', signature: 'signature'},
+        gift: {uuid: '1'},
+      });
+
+      expect(verifyStub).to.be.calledOnce;
+      expect(verifyStub.args[0][0].user._id).to.eql(user._id);
+      expect(verifyStub.args[0][0].receipt).to.eql('receipt');
+      expect(verifyStub.args[0][0].signature).to.eql('signature');
+      expect(verifyStub.args[0][0].gift.uuid).to.eql('1');
+      expect(verifyStub.args[0][0].headers['x-api-key']).to.eql(user.apiToken);
+      expect(verifyStub.args[0][0].headers['x-api-user']).to.eql(user._id);
     });
   });
 });

test/api/v3/integration/payments/paypal/GET-payments_paypal_checkout.test.js

@@ -15,7 +15,7 @@ describe('payments : paypal #checkout', () => {
     let checkoutStub;
 
     beforeEach(async () => {
-      checkoutStub = sinon.stub(paypalPayments, 'checkout').returnsPromise().resolves('/');
+      checkoutStub = sinon.stub(paypalPayments, 'checkout').resolves('/');
     });
 
     afterEach(() => {

test/api/v3/integration/payments/paypal/GET-payments_paypal_checkout_success.test.js

@@ -34,7 +34,7 @@ describe('payments : paypal #checkoutSuccess', () => {
     let checkoutSuccessStub;
 
     beforeEach(async () => {
-      checkoutSuccessStub = sinon.stub(paypalPayments, 'checkoutSuccess').returnsPromise().resolves({});
+      checkoutSuccessStub = sinon.stub(paypalPayments, 'checkoutSuccess').resolves({});
     });
 
     afterEach(() => {

test/api/v3/integration/payments/paypal/GET-payments_paypal_subscribe.test.js

@@ -25,7 +25,7 @@ describe('payments : paypal #subscribe', () => {
     let subscribeStub;
 
     beforeEach(async () => {
-      subscribeStub = sinon.stub(paypalPayments, 'subscribe').returnsPromise().resolves('/');
+      subscribeStub = sinon.stub(paypalPayments, 'subscribe').resolves('/');
     });
 
     afterEach(() => {

test/api/v3/integration/payments/paypal/GET-payments_paypal_subscribe_cancel.test.js

@@ -25,7 +25,7 @@ describe('payments : paypal #subscribeCancel', () => {
     let subscribeCancelStub;
 
     beforeEach(async () => {
-      subscribeCancelStub = sinon.stub(paypalPayments, 'subscribeCancel').returnsPromise().resolves('/');
+      subscribeCancelStub = sinon.stub(paypalPayments, 'subscribeCancel').resolves('/');
     });
 
     afterEach(() => {

test/api/v3/integration/payments/paypal/GET-payments_paypal_subscribe_success.test.js

@@ -24,7 +24,7 @@ describe('payments : paypal #subscribeSuccess', () => {
     let subscribeSuccessStub;
 
     beforeEach(async () => {
-      subscribeSuccessStub = sinon.stub(paypalPayments, 'subscribeSuccess').returnsPromise().resolves({});
+      subscribeSuccessStub = sinon.stub(paypalPayments, 'subscribeSuccess').resolves({});
     });
 
     afterEach(() => {

test/api/v3/integration/payments/paypal/POST-payments_paypal_ipn.test.js

@@ -20,7 +20,7 @@ describe('payments - paypal - #ipn', () => {
     let ipnStub;
 
     beforeEach(async () => {
-      ipnStub = sinon.stub(paypalPayments, 'ipn').returnsPromise().resolves({});
+      ipnStub = sinon.stub(paypalPayments, 'ipn').resolves({});
     });
 
     afterEach(() => {

test/api/v3/integration/payments/stripe/GET-payments_stripe_subscribe_cancel.test.js

@@ -23,7 +23,7 @@ describe('payments - stripe - #subscribeCancel', () => {
 
   describe('success', () => {
     beforeEach(async () => {
-      stripeCancelSubscriptionStub = sinon.stub(stripePayments, 'cancelSubscription').returnsPromise().resolves({});
+      stripeCancelSubscriptionStub = sinon.stub(stripePayments, 'cancelSubscription').resolves({});
     });
 
     afterEach(() => {

test/api/v3/integration/payments/stripe/POST-payments_stripe_checkout.test.js

@@ -24,7 +24,7 @@ describe('payments - stripe - #checkout', () => {
     let stripeCheckoutSubscriptionStub;
 
     beforeEach(async () => {
-      stripeCheckoutSubscriptionStub = sinon.stub(stripePayments, 'checkout').returnsPromise().resolves({});
+      stripeCheckoutSubscriptionStub = sinon.stub(stripePayments, 'checkout').resolves({});
     });
 
     afterEach(() => {

test/api/v3/integration/payments/stripe/POST-payments_stripe_subscribe_edit.test.js

@@ -25,7 +25,7 @@ describe('payments - stripe - #subscribeEdit', () => {
     let stripeEditSubscriptionStub;
 
     beforeEach(async () => {
-      stripeEditSubscriptionStub = sinon.stub(stripePayments, 'editSubscription').returnsPromise().resolves({});
+      stripeEditSubscriptionStub = sinon.stub(stripePayments, 'editSubscription').resolves({});
     });
 
     afterEach(() => {

test/api/v3/integration/quests/POST-groups_groupid_quests_cancel.test.js

@@ -4,6 +4,7 @@ import {
   generateUser,
 } from '../../../../helpers/api-integration/v3';
 import { v4 as generateUUID } from 'uuid';
+import { model as Group } from '../../../../../website/server/models/group';
 
 describe('POST /groups/:groupId/quests/cancel', () => {
   let questingGroup;
@@ -99,6 +100,10 @@ describe('POST /groups/:groupId/quests/cancel', () => {
   it('cancels a quest', async () => {
     await leader.post(`/groups/${questingGroup._id}/quests/invite/${PET_QUEST}`);
     await partyMembers[0].post(`/groups/${questingGroup._id}/quests/accept`);
+    // partyMembers[1] hasn't accepted the invitation, because if he accepts, invitation phase ends.
+    // The cancel command can be done only in the invitation phase.
+
+    let stub = sandbox.spy(Group.prototype, 'sendChat');
 
     let res = await leader.post(`/groups/${questingGroup._id}/quests/cancel`);
 
@@ -135,5 +140,9 @@ describe('POST /groups/:groupId/quests/cancel', () => {
       },
       members: {},
     });
+    expect(Group.prototype.sendChat).to.be.calledOnce;
+    expect(Group.prototype.sendChat).to.be.calledWithMatch(/cancelled the party quest Wail of the Whale.`/);
+
+    stub.restore();
   });
 });

test/api/v3/integration/tasks/groups/DELETE-group_tasks_id.test.js

@@ -63,6 +63,38 @@ describe('Groups DELETE /tasks/:id', () => {
       });
   });
 
+  it('removes deleted taskʾs approval pending notifications from managers', async () => {
+    await user.post(`/groups/${guild._id}/add-manager`, {
+      managerId: member2._id,
+    });
+    await user.put(`/tasks/${task._id}/`, {
+      requiresApproval: true,
+    });
+    let memberTasks = await member.get('/tasks/user');
+    let syncedTask = find(memberTasks, findAssignedTask);
+    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
+      .to.eventually.be.rejected.and.to.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('taskApprovalHasBeenRequested'),
+      });
+
+    await user.sync();
+    await member2.sync();
+    expect(user.notifications.length).to.equal(2);
+    expect(user.notifications[1].type).to.equal('GROUP_TASK_APPROVAL');
+    expect(member2.notifications.length).to.equal(2);
+    expect(member2.notifications[1].type).to.equal('GROUP_TASK_APPROVAL');
+
+    await member2.del(`/tasks/${task._id}`);
+
+    await user.sync();
+    await member2.sync();
+
+    expect(user.notifications.length).to.equal(1);
+    expect(member2.notifications.length).to.equal(1);
+  });
+
   it('unlinks assigned user', async () => {
     await user.del(`/tasks/${task._id}`);
 

test/api/v3/integration/tasks/groups/POST-group_tasks_id_approve_userId.test.js

@@ -53,18 +53,29 @@ describe('POST /tasks/:id/approve/:userId', () => {
 
   it('approves an assigned user', async () => {
     await user.post(`/tasks/${task._id}/assign/${member._id}`);
-    await user.post(`/tasks/${task._id}/approve/${member._id}`);
 
     let memberTasks = await member.get('/tasks/user');
     let syncedTask = find(memberTasks, findAssignedTask);
 
+    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
+      .to.eventually.be.rejected.and.to.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('taskApprovalHasBeenRequested'),
+      });
+
+    await user.post(`/tasks/${task._id}/approve/${member._id}`);
+
     await member.sync();
 
-    expect(member.notifications.length).to.equal(2);
-    expect(member.notifications[0].type).to.equal('GROUP_TASK_APPROVED');
-    expect(member.notifications[0].data.message).to.equal(t('yourTaskHasBeenApproved', {taskText: task.text}));
-    expect(member.notifications[1].type).to.equal('SCORED_TASK');
+    expect(member.notifications.length).to.equal(3);
+    expect(member.notifications[1].type).to.equal('GROUP_TASK_APPROVED');
     expect(member.notifications[1].data.message).to.equal(t('yourTaskHasBeenApproved', {taskText: task.text}));
+    expect(member.notifications[2].type).to.equal('SCORED_TASK');
+    expect(member.notifications[2].data.message).to.equal(t('yourTaskHasBeenApproved', {taskText: task.text}));
+
+    memberTasks = await member.get('/tasks/user');
+    syncedTask = find(memberTasks, findAssignedTask);
 
     expect(syncedTask.group.approval.approved).to.be.true;
     expect(syncedTask.group.approval.approvingUser).to.equal(user._id);
@@ -77,18 +88,28 @@ describe('POST /tasks/:id/approve/:userId', () => {
     });
 
     await member2.post(`/tasks/${task._id}/assign/${member._id}`);
-    await member2.post(`/tasks/${task._id}/approve/${member._id}`);
 
     let memberTasks = await member.get('/tasks/user');
     let syncedTask = find(memberTasks, findAssignedTask);
 
+    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
+      .to.eventually.be.rejected.and.to.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('taskApprovalHasBeenRequested'),
+      });
+
+    await member2.post(`/tasks/${task._id}/approve/${member._id}`);
     await member.sync();
 
-    expect(member.notifications.length).to.equal(2);
-    expect(member.notifications[0].type).to.equal('GROUP_TASK_APPROVED');
-    expect(member.notifications[0].data.message).to.equal(t('yourTaskHasBeenApproved', {taskText: task.text}));
-    expect(member.notifications[1].type).to.equal('SCORED_TASK');
+    expect(member.notifications.length).to.equal(3);
+    expect(member.notifications[1].type).to.equal('GROUP_TASK_APPROVED');
     expect(member.notifications[1].data.message).to.equal(t('yourTaskHasBeenApproved', {taskText: task.text}));
+    expect(member.notifications[2].type).to.equal('SCORED_TASK');
+    expect(member.notifications[2].data.message).to.equal(t('yourTaskHasBeenApproved', {taskText: task.text}));
+
+    memberTasks = await member.get('/tasks/user');
+    syncedTask = find(memberTasks, findAssignedTask);
 
     expect(syncedTask.group.approval.approved).to.be.true;
     expect(syncedTask.group.approval.approvingUser).to.equal(member2._id);
@@ -132,6 +153,16 @@ describe('POST /tasks/:id/approve/:userId', () => {
     });
 
     await member2.post(`/tasks/${task._id}/assign/${member._id}`);
+
+    let memberTasks = await member.get('/tasks/user');
+    let syncedTask = find(memberTasks, findAssignedTask);
+    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
+      .to.eventually.be.rejected.and.to.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('taskApprovalHasBeenRequested'),
+      });
+
     await member2.post(`/tasks/${task._id}/approve/${member._id}`);
     await expect(user.post(`/tasks/${task._id}/approve/${member._id}`))
       .to.eventually.be.rejected.and.to.eql({
@@ -141,6 +172,17 @@ describe('POST /tasks/:id/approve/:userId', () => {
       });
   });
 
+  it('prevents approving a task if it is not waiting for approval', async () => {
+    await user.post(`/tasks/${task._id}/assign/${member._id}`);
+
+    await expect(user.post(`/tasks/${task._id}/approve/${member._id}`))
+      .to.eventually.be.rejected.and.to.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('taskApprovalWasNotRequested'),
+      });
+  });
+
   it('completes master task when single-completion task is approved', async () => {
     let sharedCompletionTask = await user.post(`/tasks/group/${guild._id}`, {
       text: 'shared completion todo',
@@ -151,6 +193,16 @@ describe('POST /tasks/:id/approve/:userId', () => {
 
     await user.post(`/tasks/${sharedCompletionTask._id}/assign/${member._id}`);
     await user.post(`/tasks/${sharedCompletionTask._id}/assign/${member2._id}`);
+
+    let memberTasks = await member.get('/tasks/user');
+    let syncedTask = find(memberTasks, findAssignedTask);
+    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
+      .to.eventually.be.rejected.and.to.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('taskApprovalHasBeenRequested'),
+      });
+
     await user.post(`/tasks/${sharedCompletionTask._id}/approve/${member._id}`);
 
     let groupTasks = await user.get(`/tasks/group/${guild._id}?type=completedTodos`);
@@ -172,6 +224,16 @@ describe('POST /tasks/:id/approve/:userId', () => {
 
     await user.post(`/tasks/${sharedCompletionTask._id}/assign/${member._id}`);
     await user.post(`/tasks/${sharedCompletionTask._id}/assign/${member2._id}`);
+
+    let memberTasks = await member.get('/tasks/user');
+    let syncedTask = find(memberTasks, findAssignedTask);
+    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
+      .to.eventually.be.rejected.and.to.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('taskApprovalHasBeenRequested'),
+      });
+
     await user.post(`/tasks/${sharedCompletionTask._id}/approve/${member._id}`);
 
     let member2Tasks = await member2.get('/tasks/user');
@@ -193,6 +255,16 @@ describe('POST /tasks/:id/approve/:userId', () => {
 
     await user.post(`/tasks/${sharedCompletionTask._id}/assign/${member._id}`);
     await user.post(`/tasks/${sharedCompletionTask._id}/assign/${member2._id}`);
+
+    let memberTasks = await member.get('/tasks/user');
+    let syncedTask = find(memberTasks, findAssignedTask);
+    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
+      .to.eventually.be.rejected.and.to.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('taskApprovalHasBeenRequested'),
+      });
+
     await user.post(`/tasks/${sharedCompletionTask._id}/approve/${member._id}`);
 
     let groupTasks = await user.get(`/tasks/group/${guild._id}`);
@@ -214,6 +286,25 @@ describe('POST /tasks/:id/approve/:userId', () => {
 
     await user.post(`/tasks/${sharedCompletionTask._id}/assign/${member._id}`);
     await user.post(`/tasks/${sharedCompletionTask._id}/assign/${member2._id}`);
+
+    let memberTasks = await member.get('/tasks/user');
+    let syncedTask = find(memberTasks, findAssignedTask);
+    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
+      .to.eventually.be.rejected.and.to.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('taskApprovalHasBeenRequested'),
+      });
+
+    let member2Tasks = await member2.get('/tasks/user');
+    let member2SyncedTask = find(member2Tasks, findAssignedTask);
+    await expect(member2.post(`/tasks/${member2SyncedTask._id}/score/up`))
+      .to.eventually.be.rejected.and.to.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('taskApprovalHasBeenRequested'),
+      });
+
     await user.post(`/tasks/${sharedCompletionTask._id}/approve/${member._id}`);
     await user.post(`/tasks/${sharedCompletionTask._id}/approve/${member2._id}`);
 

test/api/v3/integration/tasks/groups/POST-group_tasks_id_needs-work_userId.test.js

@@ -51,7 +51,7 @@ describe('POST /tasks/:id/needs-work/:userId', () => {
       });
   });
 
-  it('marks as task as needing more work', async () => {
+  it('marks a task as needing more work', async () => {
     const initialNotifications = member.notifications.length;
 
     await user.post(`/tasks/${task._id}/assign/${member._id}`);
@@ -77,7 +77,7 @@ describe('POST /tasks/:id/needs-work/:userId', () => {
     expect(syncedTask.group.approval.requestedDate).to.equal(undefined);
 
     // Check that the notification is correct
-    expect(member.notifications.length).to.equal(initialNotifications + 1);
+    expect(member.notifications.length).to.equal(initialNotifications + 2);
     const notification = member.notifications[member.notifications.length - 1];
     expect(notification.type).to.equal('GROUP_TASK_NEEDS_WORK');
 
@@ -131,7 +131,7 @@ describe('POST /tasks/:id/needs-work/:userId', () => {
     expect(syncedTask.group.approval.requested).to.equal(false);
     expect(syncedTask.group.approval.requestedDate).to.equal(undefined);
 
-    expect(member.notifications.length).to.equal(initialNotifications + 1);
+    expect(member.notifications.length).to.equal(initialNotifications + 2);
     const notification = member.notifications[member.notifications.length - 1];
     expect(notification.type).to.equal('GROUP_TASK_NEEDS_WORK');
 
@@ -167,6 +167,17 @@ describe('POST /tasks/:id/needs-work/:userId', () => {
     });
 
     await member2.post(`/tasks/${task._id}/assign/${member._id}`);
+
+    let memberTasks = await member.get('/tasks/user');
+    let syncedTask = find(memberTasks, findAssignedTask);
+
+    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
+      .to.eventually.be.rejected.and.to.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('taskApprovalHasBeenRequested'),
+      });
+
     await member2.post(`/tasks/${task._id}/approve/${member._id}`);
     await expect(user.post(`/tasks/${task._id}/needs-work/${member._id}`))
       .to.eventually.be.rejected.and.to.eql({

test/api/v3/integration/tasks/groups/POST-group_tasks_id_score_direction.test.js

@@ -129,6 +129,13 @@ describe('POST /tasks/:id/score/:direction', () => {
     let memberTasks = await member.get('/tasks/user');
     let syncedTask = find(memberTasks, findAssignedTask);
 
+    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
+      .to.eventually.be.rejected.and.to.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('taskApprovalHasBeenRequested'),
+      });
+
     await user.post(`/tasks/${task._id}/approve/${member._id}`);
 
     await member.post(`/tasks/${syncedTask._id}/score/up`);

test/api/v3/integration/tasks/groups/POST-tasks_group_id_assign_user_id.test.js

@@ -113,6 +113,17 @@ describe('POST /tasks/:taskId/assign/:memberId', () => {
     expect(syncedTask).to.exist;
   });
 
+  it('sends a notification to assigned user', async () => {
+    await user.post(`/tasks/${task._id}/assign/${member._id}`);
+    await member.sync();
+
+    let groupTask = await user.get(`/tasks/group/${guild._id}`);
+
+    expect(member.notifications.length).to.equal(1);
+    expect(member.notifications[0].type).to.equal('GROUP_TASK_ASSIGNED');
+    expect(member.notifications[0].taskId).to.equal(groupTask._id);
+  });
+
   it('assigns a task to multiple users', async () => {
     await user.post(`/tasks/${task._id}/assign/${member._id}`);
     await user.post(`/tasks/${task._id}/assign/${member2._id}`);

test/api/v3/integration/tasks/groups/POST-tasks_task_id_unassign.test.js

@@ -86,6 +86,13 @@ describe('POST /tasks/:taskId/unassign/:memberId', () => {
     expect(syncedTask).to.not.exist;
   });
 
+  it('removes task assignment notification from unassigned user', async () => {
+    await user.post(`/tasks/${task._id}/unassign/${member._id}`);
+
+    await member.sync();
+    expect(member.notifications.length).to.equal(0);
+  });
+
   it('unassigns a user and only that user from a task', async () => {
     await user.post(`/tasks/${task._id}/assign/${member2._id}`);
 

test/api/v3/integration/user/DELETE-user_messages.test.js

@@ -20,8 +20,8 @@ describe('DELETE user message', () => {
 
     messagesId = Object.keys(userRes.inbox.messages);
     expect(messagesId.length).to.eql(2);
-    expect(userRes.inbox.messages[messagesId[0]].text).to.eql('first');
-    expect(userRes.inbox.messages[messagesId[1]].text).to.eql('second');
+    expect(userRes.inbox.messages[messagesId[0]].text).to.eql('second');
+    expect(userRes.inbox.messages[messagesId[1]].text).to.eql('first');
   });
 
   it('one message', async () => {
@@ -31,7 +31,7 @@ describe('DELETE user message', () => {
 
     let userRes = await user.get('/user');
     expect(Object.keys(userRes.inbox.messages).length).to.eql(1);
-    expect(userRes.inbox.messages[messagesId[0]].text).to.eql('second');
+    expect(userRes.inbox.messages[messagesId[0]].text).to.eql('first');
   });
 
   it('clear all', async () => {

test/api/v3/integration/user/GET-user_anonymized.test.js

@@ -18,7 +18,12 @@ describe('GET /user/anonymized', () => {
       'profile.name': 'profile',
       'purchased.plan': 'purchased plan',
       contributor: 'contributor',
-      invitations: 'invitations',
+      invitations: {
+        guilds: ['guild1', 'guild2'],
+        party: {
+          _id: 'partyid',
+        },
+      },
       'items.special.nyeReceived': 'some',
       'items.special.valentineReceived': 'some',
       webhooks: [{url: 'https://somurl.com'}],

test/api/v3/integration/user/POST-user_push_device.test.js

@@ -39,14 +39,16 @@ describe('POST /user/push-devices', () => {
       });
   });
 
-  it('returns an error if user already has the push device', async () => {
+  it('fails silently if user already has the push device', async () => {
     await user.post('/user/push-devices', {type, regId});
-    await expect(user.post('/user/push-devices', {type, regId}))
-      .to.eventually.be.rejected.and.eql({
-        code: 401,
-        error: 'NotAuthorized',
-        message: t('pushDeviceAlreadyAdded'),
-      });
+    const response = await user.post('/user/push-devices', {type, regId});
+    await user.sync();
+
+    expect(response.message).to.equal(t('pushDeviceAdded'));
+    expect(response.data[0].type).to.equal(type);
+    expect(response.data[0].regId).to.equal(regId);
+    expect(user.pushDevices[0].type).to.equal(type);
+    expect(user.pushDevices[0].regId).to.equal(regId);
   });
 
   it('adds a push device to the user', async () => {

test/api/v3/integration/user/PUT-user.test.js

@@ -54,7 +54,7 @@ describe('PUT /user', () => {
     });
 
 
-    it('profile.name cannot be an empty string or null', async () => {
+    it('validates profile.name', async () => {
       await expect(user.put('/user', {
         'profile.name': ' ', // string should be trimmed
       })).to.eventually.be.rejected.and.eql({
@@ -76,7 +76,23 @@ describe('PUT /user', () => {
       })).to.eventually.be.rejected.and.eql({
         code: 400,
         error: 'BadRequest',
-        message: 'User validation failed',
+        message: t('invalidReqParams'),
+      });
+
+      await expect(user.put('/user', {
+        'profile.name': 'this is a very long display name that will not be allowed due to length',
+      })).to.eventually.be.rejected.and.eql({
+        code: 400,
+        error: 'BadRequest',
+        message: t('displaynameIssueLength'),
+      });
+
+      await expect(user.put('/user', {
+        'profile.name': 'TESTPLACEHOLDERSLURWORDHERE',
+      })).to.eventually.be.rejected.and.eql({
+        code: 400,
+        error: 'BadRequest',
+        message: t('displaynameIssueSlur'),
       });
     });
   });

test/api/v3/integration/user/auth/POST-auth_reset-password-set-new-one.js

@@ -94,9 +94,6 @@ describe('POST /user/auth/reset-password-set-new-one', () => {
       userId: user._id,
       expiresAt: moment().add({days: 1}),
     }));
-    await user.update({
-      auth: 'not an object with valid fields',
-    });
 
     await expect(api.post(`${endpoint}`, {
       code,

test/api/v3/integration/user/auth/POST-login-local.test.js

@@ -45,7 +45,7 @@ describe('POST /user/auth/local/login', () => {
     })).to.eventually.be.rejected.and.eql({
       code: 401,
       error: 'NotAuthorized',
-      message: t('accountSuspended', { communityManagerEmail: nconf.get('EMAILS:COMMUNITY_MANAGER_EMAIL'), userId: user._id }),
+      message: t('accountSuspended', { communityManagerEmail: nconf.get('EMAILS_COMMUNITY_MANAGER_EMAIL'), userId: user._id }),
     });
   });
 
@@ -110,4 +110,22 @@ describe('POST /user/auth/local/login', () => {
     let isValidPassword = await bcryptCompare(textPassword, user.auth.local.hashed_password);
     expect(isValidPassword).to.equal(true);
   });
+
+  it('user uses social authentication and has no password', async () => {
+    await user.unset({
+      'auth.local.hashed_password': 1,
+    });
+
+    await user.sync();
+    expect(user.auth.local.hashed_password).to.be.undefined;
+
+    await expect(api.post(endpoint, {
+      username: user.auth.local.username,
+      password: 'any-password',
+    })).to.eventually.be.rejected.and.eql({
+      code: 401,
+      error: 'NotAuthorized',
+      message: t('invalidLoginCredentialsLong'),
+    });
+  });
 });

test/api/v3/integration/user/auth/POST-register_local.test.js

@@ -41,6 +41,23 @@ describe('POST /user/auth/local/register', () => {
       expect(user.newUser).to.eql(true);
     });
 
+    it('registers a new user and sets verifiedUsername to true', async () => {
+      let username = generateRandomUserName();
+      let email = `${username}@example.com`;
+      let password = 'password';
+
+      let user = await api.post('/user/auth/local/register', {
+        username,
+        email,
+        password,
+        confirmPassword: password,
+      });
+
+      expect(user._id).to.exist;
+      expect(user.apiToken).to.exist;
+      expect(user.flags.verifiedUsername).to.eql(true);
+    });
+
     xit('remove spaces from username', async () => {
       // TODO can probably delete this test now
       let username = ' usernamewithspaces ';
@@ -259,7 +276,7 @@ describe('POST /user/auth/local/register', () => {
       });
     });
 
-    it('enrolls new users in an A/B test', async () => {
+    xit('enrolls new users in an A/B test', async () => {
       let username = generateRandomUserName();
       let email = `${username}@example.com`;
       let password = 'password';

test/api/v3/integration/user/auth/POST-user_auth_pusher.test.js

@@ -1,102 +0,0 @@
-/* eslint-disable camelcase */
-
-import {
-  generateUser,
-  requester,
-  translate as t,
-} from '../../../../../helpers/api-integration/v3';
-import { v4 as generateUUID } from 'uuid';
-
-describe('POST /user/auth/pusher', () => {
-  let user;
-  let endpoint = '/user/auth/pusher';
-
-  beforeEach(async () => {
-    user = await generateUser();
-  });
-
-  it('requires authentication', async () => {
-    let api = requester();
-
-    await expect(api.post(endpoint)).to.eventually.be.rejected.and.eql({
-      code: 401,
-      error: 'NotAuthorized',
-      message: t('missingAuthHeaders'),
-    });
-  });
-
-  it('returns an error if req.body.socket_id is missing', async () => {
-    await expect(user.post(endpoint, {
-      channel_name: '123',
-    })).to.eventually.be.rejected.and.eql({
-      code: 400,
-      error: 'BadRequest',
-      message: t('invalidReqParams'),
-    });
-  });
-
-  it('returns an error if req.body.channel_name is missing', async () => {
-    await expect(user.post(endpoint, {
-      socket_id: '123',
-    })).to.eventually.be.rejected.and.eql({
-      code: 400,
-      error: 'BadRequest',
-      message: t('invalidReqParams'),
-    });
-  });
-
-  it('returns an error if req.body.channel_name is badly formatted', async () => {
-    await expect(user.post(endpoint, {
-      channel_name: '123',
-      socket_id: '123',
-    })).to.eventually.be.rejected.and.eql({
-      code: 400,
-      error: 'BadRequest',
-      message: 'Invalid Pusher channel type.',
-    });
-  });
-
-  it('returns an error if an invalid channel type is passed', async () => {
-    await expect(user.post(endpoint, {
-      channel_name: 'invalid-group-123',
-      socket_id: '123',
-    })).to.eventually.be.rejected.and.eql({
-      code: 400,
-      error: 'BadRequest',
-      message: 'Invalid Pusher channel type.',
-    });
-  });
-
-  it('returns an error if an invalid resource type is passed', async () => {
-    await expect(user.post(endpoint, {
-      channel_name: 'presence-user-123',
-      socket_id: '123',
-    })).to.eventually.be.rejected.and.eql({
-      code: 400,
-      error: 'BadRequest',
-      message: 'Invalid Pusher resource type.',
-    });
-  });
-
-  it('returns an error if an invalid resource id is passed', async () => {
-    await expect(user.post(endpoint, {
-      channel_name: 'presence-group-123',
-      socket_id: '123',
-    })).to.eventually.be.rejected.and.eql({
-      code: 400,
-      error: 'BadRequest',
-      message: 'Invalid Pusher resource id, must be a UUID.',
-    });
-  });
-
-  it('returns an error if the passed resource id doesn\'t match the user\'s party', async () => {
-    await expect(user.post(endpoint, {
-      channel_name: `presence-group-${generateUUID()}`,
-      socket_id: '123',
-    })).to.eventually.be.rejected.and.eql({
-      code: 404,
-      error: 'NotFound',
-      message: 'Resource id must be the user\'s party.',
-    });
-  });
-});

test/api/v3/integration/user/auth/POST-user_auth_social.test.js

@@ -39,7 +39,7 @@ describe('POST /user/auth/social', () => {
     });
 
     it('registers a new user', async () => {
-      let response = await api.post(endpoint, {
+      const response = await api.post(endpoint, {
         authResponse: {access_token: randomAccessToken}, // eslint-disable-line camelcase
         network,
       });
@@ -47,7 +47,10 @@ describe('POST /user/auth/social', () => {
       expect(response.apiToken).to.exist;
       expect(response.id).to.exist;
       expect(response.newUser).to.be.true;
+      expect(response.username).to.exist;
+
       await expect(getProperty('users', response.id, 'profile.name')).to.eventually.equal('a facebook user');
+      await expect(getProperty('users', response.id, 'auth.local.lowerCaseUsername')).to.exist;
     });
 
     it('logs an existing user in', async () => {
@@ -77,7 +80,7 @@ describe('POST /user/auth/social', () => {
       expect(response.newUser).to.be.false;
     });
 
-    it('enrolls a new user in an A/B test', async () => {
+    xit('enrolls a new user in an A/B test', async () => {
       await api.post(endpoint, {
         authResponse: {access_token: randomAccessToken}, // eslint-disable-line camelcase
         network,
@@ -133,7 +136,7 @@ describe('POST /user/auth/social', () => {
       expect(response.newUser).to.be.false;
     });
 
-    it('enrolls a new user in an A/B test', async () => {
+    xit('enrolls a new user in an A/B test', async () => {
       await api.post(endpoint, {
         authResponse: {access_token: randomAccessToken}, // eslint-disable-line camelcase
         network,

test/api/v3/integration/user/auth/PUT-user_update_email.test.js

@@ -71,7 +71,7 @@ describe('PUT /user/auth/update-email', () => {
       })).to.eventually.be.rejected.and.eql({
         code: 401,
         error: 'NotAuthorized',
-        message: t('cannotFulfillReq', { techAssistanceEmail: nconf.get('EMAILS:TECH_ASSISTANCE_EMAIL') }),
+        message: t('cannotFulfillReq', { techAssistanceEmail: nconf.get('EMAILS_TECH_ASSISTANCE_EMAIL') }),
       });
     });
 

test/api/v3/integration/user/auth/PUT-user_update_username.test.js

@@ -12,14 +12,14 @@ const ENDPOINT = '/user/auth/update-username';
 
 describe('PUT /user/auth/update-username', async () => {
   let user;
-  let newUsername = 'new-username';
-  let password = 'password'; // from habitrpg/test/helpers/api-integration/v3/object-generators.js
+  let password = 'password'; // from habitrpg/test/helpers/api-integration/v4/object-generators.js
 
   beforeEach(async () => {
     user = await generateUser();
   });
 
-  it('successfully changes username', async () => {
+  it('successfully changes username with password', async () => {
+    let newUsername = 'new-username';
     let response = await user.put(ENDPOINT, {
       username: newUsername,
       password,
@@ -29,6 +29,38 @@ describe('PUT /user/auth/update-username', async () => {
     expect(user.auth.local.username).to.eql(newUsername);
   });
 
+  it('successfully changes username without password', async () => {
+    let newUsername = 'new-username-nopw';
+    let response = await user.put(ENDPOINT, {
+      username: newUsername,
+    });
+    expect(response).to.eql({ username: newUsername });
+    await user.sync();
+    expect(user.auth.local.username).to.eql(newUsername);
+  });
+
+  it('successfully changes username containing number and underscore', async () => {
+    let newUsername = 'new_username9';
+    let response = await user.put(ENDPOINT, {
+      username: newUsername,
+    });
+    expect(response).to.eql({ username: newUsername });
+    await user.sync();
+    expect(user.auth.local.username).to.eql(newUsername);
+  });
+
+  it('sets verifiedUsername when changing username', async () => {
+    user.flags.verifiedUsername = false;
+    await user.sync();
+    let newUsername = 'new-username-verify';
+    let response = await user.put(ENDPOINT, {
+      username: newUsername,
+    });
+    expect(response).to.eql({ username: newUsername });
+    await user.sync();
+    expect(user.flags.verifiedUsername).to.eql(true);
+  });
+
   it('converts user with SHA1 encrypted password to bcrypt encryption', async () => {
     let myNewUsername = 'my-new-username';
     let textPassword = 'mySecretPassword';
@@ -80,6 +112,7 @@ describe('PUT /user/auth/update-username', async () => {
     });
 
     it('errors if password is wrong', async () => {
+      let newUsername = 'new-username';
       await expect(user.put(ENDPOINT, {
         username: newUsername,
         password: 'wrong-password',
@@ -90,19 +123,6 @@ describe('PUT /user/auth/update-username', async () => {
       });
     });
 
-    it('prevents social-only user from changing username', async () => {
-      let socialUser = await generateUser({ 'auth.local': { ok: true } });
-
-      await expect(socialUser.put(ENDPOINT, {
-        username: newUsername,
-        password,
-      })).to.eventually.be.rejected.and.eql({
-        code: 400,
-        error: 'BadRequest',
-        message: t('userHasNoLocalRegistration'),
-      });
-    });
-
     it('errors if new username is not provided', async () => {
       await expect(user.put(ENDPOINT, {
         password,
@@ -112,5 +132,93 @@ describe('PUT /user/auth/update-username', async () => {
         message: t('invalidReqParams'),
       });
     });
+
+    it('errors if new username is a slur', async () => {
+      await expect(user.put(ENDPOINT, {
+        username: 'TESTPLACEHOLDERSLURWORDHERE',
+      })).to.eventually.be.rejected.and.eql({
+        code: 400,
+        error: 'BadRequest',
+        message: [t('usernameIssueLength'), t('usernameIssueSlur')].join(' '),
+      });
+    });
+
+    it('errors if new username contains a slur', async () => {
+      await expect(user.put(ENDPOINT, {
+        username: 'TESTPLACEHOLDERSLURWORDHERE_otherword',
+      })).to.eventually.be.rejected.and.eql({
+        code: 400,
+        error: 'BadRequest',
+        message: [t('usernameIssueLength'), t('usernameIssueSlur')].join(' '),
+      });
+      await expect(user.put(ENDPOINT, {
+        username: 'something_TESTPLACEHOLDERSLURWORDHERE',
+      })).to.eventually.be.rejected.and.eql({
+        code: 400,
+        error: 'BadRequest',
+        message: [t('usernameIssueLength'), t('usernameIssueSlur')].join(' '),
+      });
+      await expect(user.put(ENDPOINT, {
+        username: 'somethingTESTPLACEHOLDERSLURWORDHEREotherword',
+      })).to.eventually.be.rejected.and.eql({
+        code: 400,
+        error: 'BadRequest',
+        message: [t('usernameIssueLength'), t('usernameIssueSlur')].join(' '),
+      });
+    });
+
+    it('errors if new username is not allowed', async () => {
+      await expect(user.put(ENDPOINT, {
+        username: 'support',
+      })).to.eventually.be.rejected.and.eql({
+        code: 400,
+        error: 'BadRequest',
+        message: t('usernameIssueForbidden'),
+      });
+    });
+
+    it('errors if new username is not allowed regardless of casing', async () => {
+      await expect(user.put(ENDPOINT, {
+        username: 'SUppORT',
+      })).to.eventually.be.rejected.and.eql({
+        code: 400,
+        error: 'BadRequest',
+        message: t('usernameIssueForbidden'),
+      });
+    });
+
+    it('errors if username has incorrect length', async () => {
+      await expect(user.put(ENDPOINT, {
+        username: 'thisisaverylongusernameover20characters',
+      })).to.eventually.be.rejected.and.eql({
+        code: 400,
+        error: 'BadRequest',
+        message: t('usernameIssueLength'),
+      });
+    });
+
+    it('errors if new username contains invalid characters', async () => {
+      await expect(user.put(ENDPOINT, {
+        username: 'Eichhörnchen',
+      })).to.eventually.be.rejected.and.eql({
+        code: 400,
+        error: 'BadRequest',
+        message: t('usernameIssueInvalidCharacters'),
+      });
+      await expect(user.put(ENDPOINT, {
+        username: 'test.name',
+      })).to.eventually.be.rejected.and.eql({
+        code: 400,
+        error: 'BadRequest',
+        message: t('usernameIssueInvalidCharacters'),
+      });
+      await expect(user.put(ENDPOINT, {
+        username: '🤬',
+      })).to.eventually.be.rejected.and.eql({
+        code: 400,
+        error: 'BadRequest',
+        message: t('usernameIssueInvalidCharacters'),
+      });
+    });
   });
 });

test/api/v3/integration/user/buy/POST-user_buy_gear.test.js

@@ -53,4 +53,15 @@ describe('POST /user/buy-gear/:key', () => {
         message: 'You need to purchase a lower level gear before this one.',
       });
   });
+
+  it('returns an error if tries to buy gear from a different class', async () => {
+    let key = 'armor_rogue_1';
+
+    return expect(user.post(`/user/buy-gear/${key}`))
+      .to.eventually.be.rejected.and.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: 'You can\'t buy this item.',
+      });
+  });
 });

test/api/v4/inbox/GET-inbox-conversations.test.js

@@ -0,0 +1,44 @@
+import {
+  generateUser,
+} from '../../../helpers/api-integration/v4';
+
+describe('GET /inbox/conversations', () => {
+  let user;
+  let otherUser;
+  let thirdUser;
+
+  before(async () => {
+    [user, otherUser, thirdUser] = await Promise.all([generateUser(), generateUser(), generateUser()]);
+
+    await otherUser.post('/members/send-private-message', {
+      toUserId: user.id,
+      message: 'first',
+    });
+    await user.post('/members/send-private-message', {
+      toUserId: otherUser.id,
+      message: 'second',
+    });
+    await user.post('/members/send-private-message', {
+      toUserId: thirdUser.id,
+      message: 'third',
+    });
+    await otherUser.post('/members/send-private-message', {
+      toUserId: user.id,
+      message: 'fourth',
+    });
+
+    // message to yourself
+    await user.post('/members/send-private-message', {
+      toUserId: user.id,
+      message: 'fifth',
+    });
+  });
+
+  it('returns the conversations', async () => {
+    const result = await user.get('/inbox/conversations');
+
+    expect(result.length).to.be.equal(3);
+    expect(result[0].user).to.be.equal(user.profile.name);
+    expect(result[0].username).to.be.equal(user.auth.local.username);
+  });
+});

test/api/v4/members/POST-flag_private_message.test.js

@@ -0,0 +1,74 @@
+import {
+  generateUser,
+  translate as t,
+} from '../../../helpers/api-integration/v4';
+
+describe('POST /members/flag-private-message/:messageId', () => {
+  let userToSendMessage;
+  let messageToSend = 'Test Private Message';
+
+  beforeEach(async () => {
+    userToSendMessage = await generateUser();
+  });
+
+  it('Allows players to flag their own private message', async () => {
+    let receiver = await generateUser();
+
+    await userToSendMessage.post('/members/send-private-message', {
+      message: messageToSend,
+      toUserId: receiver._id,
+    });
+
+    let senderMessages = await userToSendMessage.get('/inbox/messages');
+
+    let sendersMessageInSendersInbox = _.find(senderMessages, (message) => {
+      return message.uuid === receiver._id && message.text === messageToSend;
+    });
+
+    expect(sendersMessageInSendersInbox).to.exist;
+    await expect(userToSendMessage.post(`/members/flag-private-message/${sendersMessageInSendersInbox.id}`)).to.eventually.be.ok;
+  });
+
+  it('Flags a private message', async () => {
+    let receiver = await generateUser();
+
+    await userToSendMessage.post('/members/send-private-message', {
+      message: messageToSend,
+      toUserId: receiver._id,
+    });
+
+    let receiversMessages = await receiver.get('/inbox/messages');
+
+    let sendersMessageInReceiversInbox = _.find(receiversMessages, (message) => {
+      return message.uuid === userToSendMessage._id && message.text === messageToSend;
+    });
+
+    expect(sendersMessageInReceiversInbox).to.exist;
+    await expect(receiver.post(`/members/flag-private-message/${sendersMessageInReceiversInbox.id}`)).to.eventually.be.ok;
+  });
+
+  it('Returns an error when user tries to flag a private message that is already flagged', async () => {
+    let receiver = await generateUser();
+
+    await userToSendMessage.post('/members/send-private-message', {
+      message: messageToSend,
+      toUserId: receiver._id,
+    });
+
+    let receiversMessages = await receiver.get('/inbox/messages');
+
+    let sendersMessageInReceiversInbox = _.find(receiversMessages, (message) => {
+      return message.uuid === userToSendMessage._id && message.text === messageToSend;
+    });
+
+    expect(sendersMessageInReceiversInbox).to.exist;
+    await expect(receiver.post(`/members/flag-private-message/${sendersMessageInReceiversInbox.id}`)).to.eventually.be.ok;
+
+    await expect(receiver.post(`/members/flag-private-message/${sendersMessageInReceiversInbox.id}`))
+      .to.eventually.be.rejected.and.eql({
+        code: 400,
+        error: 'BadRequest',
+        message: t('messageGroupChatFlagAlreadyReported'),
+      });
+  });
+});

test/api/v4/user/GET-user.test.js

@@ -53,6 +53,6 @@ describe('GET /user', () => {
     let returnedUser = await user.get('/user');
 
     expect(returnedUser._id).to.equal(user._id);
-    expect(returnedUser.inbox.messages).to.be.empty;
+    expect(returnedUser.inbox.messages).to.be.undefined;
   });
 });

test/api/v4/user/PUT-user.test.js

@@ -76,7 +76,7 @@ describe('PUT /user', () => {
       })).to.eventually.be.rejected.and.eql({
         code: 400,
         error: 'BadRequest',
-        message: 'User validation failed',
+        message: t('invalidReqParams'),
       });
     });
   });

test/api/v4/user/auth/POST-register_local.test.js

@@ -473,7 +473,7 @@ describe('POST /user/auth/local/register', () => {
     });
 
     it('rejects if username is already taken', async () => {
-      let uniqueEmail = `${generateRandomUserName()}@exampe.com`;
+      let uniqueEmail = `${generateRandomUserName()}@example.com`;
       let password = 'password';
 
       await expect(api.post('/user/auth/local/register', {

test/api/v4/user/auth/POST-user_verify_display_name.test.js

@@ -0,0 +1,57 @@
+import {
+  generateUser,
+  translate as t,
+} from '../../../../helpers/api-integration/v4';
+
+const ENDPOINT = '/user/auth/verify-display-name';
+
+describe('POST /user/auth/verify-display-name', async () => {
+  let user;
+
+  beforeEach(async () => {
+    user = await generateUser();
+  });
+
+  it('successfully verifies display name including funky characters', async () => {
+    let newDisplayName = 'Sabé 🤬';
+    let response = await user.post(ENDPOINT, {
+      displayName: newDisplayName,
+    });
+    expect(response).to.eql({ isUsable: true });
+  });
+
+  context('errors', async () => {
+    it('errors if display name is not provided', async () => {
+      await expect(user.post(ENDPOINT, {
+      })).to.eventually.be.rejected.and.eql({
+        code: 400,
+        error: 'BadRequest',
+        message: t('invalidReqParams'),
+      });
+    });
+
+    it('errors if display name is a slur', async () => {
+      await expect(user.post(ENDPOINT, {
+        displayName: 'TESTPLACEHOLDERSLURWORDHERE',
+      })).to.eventually.eql({ isUsable: false, issues: [t('displaynameIssueSlur')] });
+    });
+
+    it('errors if display name contains a slur', async () => {
+      await expect(user.post(ENDPOINT, {
+        displayName: 'TESTPLACEHOLDERSLURWORDHERE_otherword',
+      })).to.eventually.eql({ isUsable: false, issues: [t('displaynameIssueLength'), t('displaynameIssueSlur')] });
+      await expect(user.post(ENDPOINT, {
+        displayName: 'something_TESTPLACEHOLDERSLURWORDHERE',
+      })).to.eventually.eql({ isUsable: false, issues: [t('displaynameIssueLength'), t('displaynameIssueSlur')] });
+      await expect(user.post(ENDPOINT, {
+        displayName: 'somethingTESTPLACEHOLDERSLURWORDHEREotherword',
+      })).to.eventually.eql({ isUsable: false, issues: [t('displaynameIssueLength'), t('displaynameIssueSlur')] });
+    });
+
+    it('errors if display name has incorrect length', async () => {
+      await expect(user.post(ENDPOINT, {
+        displayName: 'this is a very long display name over 30 characters',
+      })).to.eventually.eql({ isUsable: false, issues: [t('displaynameIssueLength')] });
+    });
+  });
+});

test/api/v4/user/auth/POST-user_verify_username.test.js

@@ -0,0 +1,89 @@
+import {
+  generateUser,
+  translate as t,
+} from '../../../../helpers/api-integration/v4';
+
+const ENDPOINT = '/user/auth/verify-username';
+
+describe('POST /user/auth/verify-username', async () => {
+  let user;
+
+  beforeEach(async () => {
+    user = await generateUser();
+  });
+
+  it('successfully verifies username', async () => {
+    let newUsername = 'new-username';
+    let response = await user.post(ENDPOINT, {
+      username: newUsername,
+    });
+    expect(response).to.eql({ isUsable: true });
+  });
+
+  it('successfully verifies username with allowed characters', async () => {
+    let newUsername = 'new-username_123';
+    let response = await user.post(ENDPOINT, {
+      username: newUsername,
+    });
+    expect(response).to.eql({ isUsable: true });
+  });
+
+  context('errors', async () => {
+    it('errors if username is not provided', async () => {
+      await expect(user.post(ENDPOINT, {
+      })).to.eventually.be.rejected.and.eql({
+        code: 400,
+        error: 'BadRequest',
+        message: t('invalidReqParams'),
+      });
+    });
+
+    it('errors if username is a slur', async () => {
+      await expect(user.post(ENDPOINT, {
+        username: 'TESTPLACEHOLDERSLURWORDHERE',
+      })).to.eventually.eql({ isUsable: false, issues: [t('usernameIssueLength'), t('usernameIssueSlur')] });
+    });
+
+    it('errors if username contains a slur', async () => {
+      await expect(user.post(ENDPOINT, {
+        username: 'TESTPLACEHOLDERSLURWORDHERE_otherword',
+      })).to.eventually.eql({ isUsable: false, issues: [t('usernameIssueLength'), t('usernameIssueSlur')] });
+      await expect(user.post(ENDPOINT, {
+        username: 'something_TESTPLACEHOLDERSLURWORDHERE',
+      })).to.eventually.eql({ isUsable: false, issues: [t('usernameIssueLength'), t('usernameIssueSlur')] });
+      await expect(user.post(ENDPOINT, {
+        username: 'somethingTESTPLACEHOLDERSLURWORDHEREotherword',
+      })).to.eventually.eql({ isUsable: false, issues: [t('usernameIssueLength'), t('usernameIssueSlur')] });
+    });
+
+    it('errors if username is not allowed', async () => {
+      await expect(user.post(ENDPOINT, {
+        username: 'support',
+      })).to.eventually.eql({ isUsable: false, issues: [t('usernameIssueForbidden')] });
+    });
+
+    it('errors if username is not allowed regardless of casing', async () => {
+      await expect(user.post(ENDPOINT, {
+        username: 'SUppORT',
+      })).to.eventually.eql({ isUsable: false, issues: [t('usernameIssueForbidden')] });
+    });
+
+    it('errors if username has incorrect length', async () => {
+      await expect(user.post(ENDPOINT, {
+        username: 'thisisaverylongusernameover20characters',
+      })).to.eventually.eql({ isUsable: false, issues: [t('usernameIssueLength')] });
+    });
+
+    it('errors if username contains invalid characters', async () => {
+      await expect(user.post(ENDPOINT, {
+        username: 'Eichhörnchen',
+      })).to.eventually.eql({ isUsable: false, issues: [t('usernameIssueInvalidCharacters')] });
+      await expect(user.post(ENDPOINT, {
+        username: 'test.name',
+      })).to.eventually.eql({ isUsable: false, issues: [t('usernameIssueInvalidCharacters')] });
+      await expect(user.post(ENDPOINT, {
+        username: '🤬',
+      })).to.eventually.eql({ isUsable: false, issues: [t('usernameIssueInvalidCharacters')] });
+    });
+  });
+});