Merge branch 'release' into develop

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "habitica",
-  "version": "4.85.2",
+  "version": "4.85.3",
   "lockfileVersion": 1,
   "requires": true,
   "dependencies": {

package.json

@@ -1,7 +1,7 @@
 {
   "name": "habitica",
   "description": "A habit tracker app which treats your goals like a Role Playing Game.",
-  "version": "4.85.2",
+  "version": "4.85.3",
   "main": "./website/server/index.js",
   "dependencies": {
     "@google-cloud/trace-agent": "^3.5.2",

website/server/index.js

@@ -12,15 +12,13 @@ const setupNconf = require('./libs/setupNconf');
 setupNconf();
 const nconf = require('nconf');
 
-const IS_PROD = nconf.get('IS_PROD');
-const STACKDRIVER_TRACING_ENABLED = nconf.get('ENABLE_STACKDRIVER_TRACING') === 'true';
-if (IS_PROD && STACKDRIVER_TRACING_ENABLED) {
-  require('@google-cloud/trace-agent').start(); // eslint-disable-line global-require
-}
+// Initialize @google-cloud/trace-agent
+require('./libs/gcpTraceAgent');
 
 const cluster = require('cluster');
 const logger = require('./libs/logger');
 
+const IS_PROD = nconf.get('IS_PROD');
 const IS_DEV = nconf.get('IS_DEV');
 const CORES = Number(nconf.get('WEB_CONCURRENCY')) || 0;
 

website/server/libs/gcpTraceAgent.js

@@ -0,0 +1,12 @@
+const nconf = require('nconf');
+
+const IS_PROD = nconf.get('IS_PROD');
+const STACKDRIVER_TRACING_ENABLED = nconf.get('ENABLE_STACKDRIVER_TRACING') === 'true';
+
+let tracer = null;
+
+if (IS_PROD && STACKDRIVER_TRACING_ENABLED) {
+  tracer = require('@google-cloud/trace-agent').start(); // eslint-disable-line global-require
+}
+
+export default tracer;

website/server/libs/payments/apple.js

@@ -239,17 +239,26 @@ api.cancelSubscribe = async function cancelSubscribe (user, headers) {
 
   await iap.setup();
 
-  let appleRes = await iap.validate(iap.APPLE, plan.additionalData);
+  let dateTerminated;
 
-  let isValidated = iap.isValidated(appleRes);
-  if (!isValidated) throw new NotAuthorized(this.constants.RESPONSE_INVALID_RECEIPT);
+  try {
+    let appleRes = await iap.validate(iap.APPLE, plan.additionalData);
 
-  let purchases = iap.getPurchaseData(appleRes);
-  if (purchases.length === 0) throw new NotAuthorized(this.constants.RESPONSE_INVALID_RECEIPT);
-  let subscriptionData = purchases[0];
+    let isValidated = iap.isValidated(appleRes);
+    if (!isValidated) throw new NotAuthorized(this.constants.RESPONSE_INVALID_RECEIPT);
 
-  let dateTerminated = new Date(Number(subscriptionData.expirationDate));
-  if (dateTerminated > new Date()) throw new NotAuthorized(this.constants.RESPONSE_STILL_VALID);
+    let purchases = iap.getPurchaseData(appleRes);
+    if (purchases.length === 0) throw new NotAuthorized(this.constants.RESPONSE_INVALID_RECEIPT);
+    let subscriptionData = purchases[0];
+
+    dateTerminated = new Date(Number(subscriptionData.expirationDate));
+    if (dateTerminated > new Date()) throw new NotAuthorized(this.constants.RESPONSE_STILL_VALID);
+  } catch (err) {
+    // If we have an invalid receipt, cancel anyway
+    if (!err || !err.validatedData || err.validatedData.is_retryable === true || err.validatedData.status !== 21010) {
+      throw err;
+    }
+  }
 
   await payments.cancelSubscription({
     user,

website/server/middlewares/auth.js

@@ -6,6 +6,7 @@ import {
 } from '../models/user';
 import nconf from 'nconf';
 import url from 'url';
+import gcpStackdriverTracer from '../libs/gcpTraceAgent';
 
 const COMMUNITY_MANAGER_EMAIL = nconf.get('EMAILS_COMMUNITY_MANAGER_EMAIL');
 
@@ -34,6 +35,13 @@ function getUserFields (options, req) {
   return `notifications ${userFieldOptions.join(' ')}`;
 }
 
+// Make sure stackdriver traces are storing the user id
+function stackdriverTraceUserId (userId) {
+  if (gcpStackdriverTracer) {
+    gcpStackdriverTracer.getCurrentRootSpan().addLabel('userId', userId);
+  }
+}
+
 // Strins won't be translated here because getUserLanguage has not run yet
 
 // Authenticate a request through the x-api-user and x-api key header
@@ -64,8 +72,9 @@ export function authWithHeaders (options = {}) {
         if (user.auth.blocked) throw new NotAuthorized(res.t('accountSuspended', {communityManagerEmail: COMMUNITY_MANAGER_EMAIL, userId: user._id}));
 
         res.locals.user = user;
-
         req.session.userId = user._id;
+        stackdriverTraceUserId(user._id);
+
         return next();
       })
       .catch(next);
@@ -93,6 +102,7 @@ export function authWithSession (req, res, next) {
       if (!user) throw new NotAuthorized(res.t('invalidCredentials'));
 
       res.locals.user = user;
+      stackdriverTraceUserId(user._id);
       return next();
     })
     .catch(next);