4.140.2

Merge branch 'develop' into release
4.140.1
2026-05-10 02:28:44 -05:00 · 2020-04-09 06:28:11 -05:00 · 2020-04-09 06:28:06 -05:00 · 2020-04-08 23:31:26 +02:00 · 2020-04-08 23:31:17 +02:00 · 2020-04-08 18:44:30 +02:00
1308 changed files with 78157 additions and 52574 deletions
@@ -37,3 +37,7 @@ yarn.lock
 .elasticbeanstalk/*
 !.elasticbeanstalk/*.cfg.yml
 !.elasticbeanstalk/*.global.yml
+/.vscode
+
+# webstorm fake webpack for path intellisense
+webpack.webstorm.config
@@ -1,4 +1,6 @@
 node_modules/**
+content_cache
+content_cache/**
 website/client/**
 test/**
 .git/**
@@ -7,3 +9,4 @@ test/**
 *.swp
 *.swx
 website/raw_sprites/**
+content_cache/**
@@ -1,6 +1,7 @@
 FROM node:12

 ENV ADMIN_EMAIL admin@habitica.com
+ENV EMAILS_COMMUNITY_MANAGER_EMAIL admin@habitica.com
 ENV AMAZON_PAYMENTS_CLIENT_ID amzn1.application-oa2-client.68ed9e6904ef438fbc1bf86bf494056e
 ENV AMAZON_PAYMENTS_SELLER_ID AMQ3SB4SG5E91
 ENV AMPLITUDE_KEY e8d4c24b3d6ef3ee73eeba715023dd43
@@ -3,9 +3,12 @@ FROM node:12
 # Install global packages
 RUN npm install -g gulp-cli mocha

-# Copy Habitica code into container and install dependencies
+# Copy package.json and package-lock.json into image, then install
+# dependencies.
 WORKDIR /usr/src/habitica
-COPY . /usr/src/habitica
-
+COPY ["package.json", "package-lock.json", "./"]
 RUN npm install
+
+# Copy the remaining source files in.
+COPY . /usr/src/habitica
 RUN npm run postinstall
@@ -1,8 +1,6 @@
 Habitica ![Build Status](https://github.com/HabitRPG/habitica/workflows/Test/badge.svg) [![Code Climate](https://codeclimate.com/github/HabitRPG/habitrpg.svg)](https://codeclimate.com/github/HabitRPG/habitrpg) [![Bountysource](https://api.bountysource.com/badge/tracker?tracker_id=68393)](https://www.bountysource.com/trackers/68393-habitrpg?utm_source=68393&utm_medium=shield&utm_campaign=TRACKER_BADGE) [![Open Source Helpers](https://www.codetriage.com/habitrpg/habitica/badges/users.svg)](https://www.codetriage.com/habitrpg/habitica)
 ===============

-[![Greenkeeper badge](https://badges.greenkeeper.io/HabitRPG/habitica.svg)](https://greenkeeper.io/)
-
 [Habitica](https://habitica.com) is an open source habit building program which treats your life like a Role Playing Game. Level up as you succeed, lose HP as you fail, earn money to buy weapons and armor.

 **We need more programmers!** Your assistance will be greatly appreciated. The wiki pages below and the additional pages they link to will tell you how to get started on contributing code and where you can go to seek further help or ask questions:
@@ -32,7 +32,7 @@
  "LOGGLY_SUBDOMAIN": "example-subdomain",
  "LOGGLY_TOKEN": "example-token",
  "MAINTENANCE_MODE": "false",
-  "NODE_DB_URI": "mongodb://localhost/habitrpg",
+  "NODE_DB_URI": "mongodb://localhost:27017/habitrpg",
  "MONGODB_POOL_SIZE": "10",
  "NODE_ENV": "development",
  "PATH": "bin:node_modules/.bin:/usr/local/bin:/usr/bin:/bin",
@@ -70,9 +70,14 @@
  "SLACK_URL": "https://hooks.slack.com/services/some-url",
  "STRIPE_API_KEY": "aaaabbbbccccddddeeeeffff00001111",
  "STRIPE_PUB_KEY": "22223333444455556666777788889999",
-  "TEST_DB_URI": "mongodb://localhost/habitrpg_test",
+  "TEST_DB_URI": "mongodb://localhost:27017/habitrpg_test",
  "TRANSIFEX_SLACK_CHANNEL": "transifex",
  "WEB_CONCURRENCY": 1,
  "SKIP_SSL_CHECK_KEY": "key",
-  "ENABLE_STACKDRIVER_TRACING": "false"
+  "ENABLE_STACKDRIVER_TRACING": "false",
+  "APPLE_AUTH_PRIVATE_KEY": "",
+  "APPLE_TEAM_ID": "",
+  "APPLE_AUTH_CLIENT_ID": "",
+  "APPLE_AUTH_KEY_ID": "",
+  "BLOCKED_IPS": ""
 }
@@ -15,8 +15,9 @@ services:
    ports:
      - "8080:8080"
    volumes:
-      - .:/code
-      - /code/node_modules
+      - .:/usr/src/habitica
+      - /usr/src/habitica/node_modules
+      - /usr/src/habitica/website/client/node_modules
  server:
    build:
      context: .
@@ -32,8 +33,8 @@ services:
    ports:
      - "3000:3000"
    volumes:
-      - .:/code
-      - /code/node_modules
+      - .:/usr/src/habitica
+      - /usr/src/habitica/node_modules
  mongo:
    image: mongo:3.6
    networks:
@@ -1,19 +1,20 @@
 import gulp from 'gulp';
 import babel from 'gulp-babel';

-gulp.task('build:src', () => gulp.src('website/server/**/*.js')
+gulp.task('build:babel:server', () => gulp.src('website/server/**/*.js')
  .pipe(babel())
  .pipe(gulp.dest('website/transpiled-babel/')));

-gulp.task('build:common', () => gulp.src('website/common/script/**/*.js')
+gulp.task('build:babel:common', () => gulp.src('website/common/script/**/*.js')
  .pipe(babel())
  .pipe(gulp.dest('website/common/transpiled-babel/')));

-gulp.task('build:server', gulp.series('build:src', 'build:common', done => done()));
+gulp.task('build:babel', gulp.parallel('build:babel:server', 'build:babel:common', done => done()));

 gulp.task('build:prod', gulp.series(
-  'build:server',
+  'build:babel',
  'apidoc',
+  'content:cache',
  done => done(),
 ));

@@ -0,0 +1,34 @@
+import gulp from 'gulp';
+import fs from 'fs';
+
+// TODO parallelize, use gulp file helpers
+gulp.task('content:cache', done => {
+  // Requiring at runtime because these files access `common`
+  // code which in production works only if transpiled so after
+  // gulp build:babel:common has run
+  const { CONTENT_CACHE_PATH, getLocalizedContent } = require('../website/server/libs/content'); // eslint-disable-line global-require
+  const { langCodes } = require('../website/server/libs/i18n'); // eslint-disable-line global-require
+
+  try {
+    // create the cache folder (if it doesn't exist)
+    try {
+      fs.mkdirSync(CONTENT_CACHE_PATH);
+    } catch (err) {
+      if (err.code !== 'EEXIST') throw err;
+    }
+
+    // clone the content for each language and save
+    // localize it
+    // save the result
+    langCodes.forEach(langCode => {
+      fs.writeFileSync(
+        `${CONTENT_CACHE_PATH}${langCode}.json`,
+        getLocalizedContent(langCode),
+        'utf8',
+      );
+    });
+    done();
+  } catch (err) {
+    done(err);
+  }
+});
@@ -13,8 +13,16 @@ const gulp = require('gulp');

 if (process.env.NODE_ENV === 'production') { // eslint-disable-line no-process-env
  require('./gulp/gulp-apidoc'); // eslint-disable-line global-require
+  require('./gulp/gulp-content'); // eslint-disable-line global-require
  require('./gulp/gulp-build'); // eslint-disable-line global-require
 } else {
-  require('glob').sync('./gulp/gulp-*').forEach(require); // eslint-disable-line global-require
+  require('./gulp/gulp-apidoc'); // eslint-disable-line global-require
+  require('./gulp/gulp-content'); // eslint-disable-line global-require
+  require('./gulp/gulp-build'); // eslint-disable-line global-require
+  require('./gulp/gulp-console'); // eslint-disable-line global-require
+  require('./gulp/gulp-sprites'); // eslint-disable-line global-require
+  require('./gulp/gulp-start'); // eslint-disable-line global-require
+  require('./gulp/gulp-tests'); // eslint-disable-line global-require
+  require('./gulp/gulp-transifex-test'); // eslint-disable-line global-require
  require('gulp').task('default', gulp.series('test')); // eslint-disable-line global-require
 }
@@ -0,0 +1,109 @@
+/*
+ * Award Onboarding Achievements for existing users
+ */
+/* eslint-disable no-console */
+
+import { model as User } from '../../website/server/models/user';
+
+const MIGRATION_NAME = '20191218_onboarding_achievements';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count += 1;
+
+  const set = {};
+
+  set.migration = MIGRATION_NAME;
+
+  const hasPet = Object.keys(user.items.pets).find(petKey => {
+    const pet = user.items.pets[petKey];
+
+    if (pet >= 5) return true;
+    return false;
+  });
+
+  if (hasPet) {
+    set['achievements.hatchedPet'] = true;
+  }
+
+  const hasFedPet = Object.keys(user.items.pets).find(petKey => {
+    const pet = user.items.pets[petKey];
+
+    if (pet > 5) return true;
+    return false;
+  });
+
+  if (hasFedPet) {
+    set['achievements.fedPet'] = true;
+  }
+
+  const hasGear = Object.keys(user.items.gear.owned).find(gearKey => {
+    const gear = user.items.gear.owned[gearKey];
+
+    if (gear === true && gearKey.indexOf('_special_') === -1) return true;
+    return false;
+  });
+
+  if (hasGear) {
+    set['achievements.purchasedEquipment'] = true;
+  }
+
+  if (user.tasksOrder) {
+    const hasTask = Object.keys(user.tasksOrder).find(tasksOrderType => {
+      const order = user.tasksOrder[tasksOrderType];
+
+      if (order && order.length > 0) return true;
+      return false;
+    });
+
+    if (hasTask) {
+      set['achievements.createdTask'] = true;
+    }
+
+    const hasExperience = user.stats && user.stats.exp && user.stats.exp > 0;
+    if (hasTask && hasExperience) {
+      set['achievements.completedTask'] = true;
+    }
+  }
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+  return User.update({ _id: user._id }, { $set: set }).exec();
+}
+
+module.exports = async function processUsers () { // eslint-disable-line import/no-commonjs
+  const query = {
+    migration: { $ne: MIGRATION_NAME },
+  };
+
+  const fields = {
+    _id: 1,
+    stats: 1,
+    items: 1,
+    achievements: 1,
+    tasksOrder: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(100)
+      .sort({ _id: 1 })
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1],
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};
@@ -0,0 +1,82 @@
+/* eslint-disable no-console */
+const MIGRATION_NAME = '20191210_pet_color_achievements';
+import { model as User } from '../../../website/server/models/user';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count++;
+
+  let set = {
+    migration: MIGRATION_NAME,
+  };
+
+  if (user && user.items && user.items.pets) {
+    const pets = user.items.pets;
+    if (pets['Wolf-White'] > 0
+      && pets['TigerCub-White'] > 0
+      && pets['PandaCub-White'] > 0
+      && pets['LionCub-White'] > 0
+      && pets['Fox-White'] > 0
+      && pets['FlyingPig-White'] > 0
+      && pets['Dragon-White'] > 0
+      && pets['Cactus-White'] > 0
+      && pets['BearCub-White'] > 0) {
+        set['achievements.primedForPainting'] = true;
+      }
+  }
+
+  if (user && user.items && user.items.mounts) {
+    const mounts = user.items.mounts;
+    if (mounts['Wolf-White']
+      && mounts['TigerCub-White']
+      && mounts['PandaCub-White']
+      && mounts['LionCub-White']
+      && mounts['Fox-White']
+      && mounts['FlyingPig-White']
+      && mounts['Dragon-White']
+      && mounts['Cactus-White']
+      && mounts['BearCub-White'] ) {
+        set['achievements.pearlyPro'] = true;
+      }
+  }
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+
+  return await User.update({ _id: user._id }, { $set: set }).exec();
+}
+
+module.exports = async function processUsers () {
+  let query = {
+    migration: { $ne: MIGRATION_NAME },
+    'auth.timestamps.loggedin': { $gt: new Date('2019-12-01') },
+  };
+
+  const fields = {
+    _id: 1,
+    items: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1]._id,
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};
@@ -0,0 +1,118 @@
+/* eslint-disable no-console */
+const MIGRATION_NAME = '20191231_nye';
+import { model as User } from '../../../website/server/models/user';
+import { v4 as uuid } from 'uuid';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count++;
+
+  const set = {'flags.newStuff': true};
+  let push;
+
+  set.migration = MIGRATION_NAME;
+
+  if (typeof user.items.gear.owned.head_special_nye2018 !== 'undefined') {
+    set['items.gear.owned.head_special_nye2019'] = false;
+    push = [
+      {
+        type: 'marketGear',
+        path: 'gear.flat.head_special_nye2019',
+        _id: uuid(),
+      },
+    ];
+  } else if (typeof user.items.gear.owned.head_special_nye2017 !== 'undefined') {
+    set['items.gear.owned.head_special_nye2018'] = false;
+    push = [
+      {
+        type: 'marketGear',
+        path: 'gear.flat.head_special_nye2018',
+        _id: uuid(),
+      },
+    ];
+  } else if (typeof user.items.gear.owned.head_special_nye2016 !== 'undefined') {
+    set['items.gear.owned.head_special_nye2017'] = false;
+    push = [
+      {
+        type: 'marketGear',
+        path: 'gear.flat.head_special_nye2017',
+        _id: uuid(),
+      },
+    ];
+  } else if (typeof user.items.gear.owned.head_special_nye2015 !== 'undefined') {
+    set['items.gear.owned.head_special_nye2016'] = false;
+    push = [
+      {
+        type: 'marketGear',
+        path: 'gear.flat.head_special_nye2016',
+        _id: uuid(),
+      },
+    ];
+  } else if (typeof user.items.gear.owned.head_special_nye2014 !== 'undefined') {
+    set['items.gear.owned.head_special_nye2015'] = false;
+    push = [
+      {
+        type: 'marketGear',
+        path: 'gear.flat.head_special_nye2015',
+        _id: uuid(),
+      },
+    ];
+  } else if (typeof user.items.gear.owned.head_special_nye !== 'undefined') {
+    set['items.gear.owned.head_special_nye2014'] = false;
+    push = [
+      {
+        type: 'marketGear',
+        path: 'gear.flat.head_special_nye2014',
+        _id: uuid(),
+      },
+    ];
+  } else {
+    set['items.gear.owned.head_special_nye'] = false;
+    push = [
+      {
+        type: 'marketGear',
+        path: 'gear.flat.head_special_nye',
+        _id: uuid(),
+      },
+    ];
+  }
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+
+  return await User.update({_id: user._id}, {$set: set, $push: {pinnedItems: {$each: push}}}).exec();
+}
+
+export default async function processUsers () {
+  let query = {
+    migration: {$ne: MIGRATION_NAME},
+  };
+
+  const fields = {
+    _id: 1,
+    items: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1],
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};
@@ -0,0 +1,91 @@
+/* eslint-disable no-console */
+const MIGRATION_NAME = '20200131_habit_birthday';
+import { v4 as uuid } from 'uuid';
+
+import { model as User } from '../../../website/server/models/user';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count++;
+
+  const inc = {
+    'items.food.Cake_Skeleton': 1,
+    'items.food.Cake_Base': 1,
+    'items.food.Cake_CottonCandyBlue': 1,
+    'items.food.Cake_CottonCandyPink': 1,
+    'items.food.Cake_Shade': 1,
+    'items.food.Cake_White': 1,
+    'items.food.Cake_Golden': 1,
+    'items.food.Cake_Zombie': 1,
+    'items.food.Cake_Desert': 1,
+    'items.food.Cake_Red': 1,
+    'achievements.habitBirthdays': 1,
+  };
+  const set = {};
+  let push;
+
+  set.migration = MIGRATION_NAME;
+
+  if (typeof user.items.gear.owned.armor_special_birthday2019 !== 'undefined') {
+    set['items.gear.owned.armor_special_birthday2020'] = false;
+    push = {pinnedItems: {type: 'marketGear', path: 'gear.flat.armor_special_birthday2020', _id: uuid()}};
+  } else if (typeof user.items.gear.owned.armor_special_birthday2018 !== 'undefined') {
+    set['items.gear.owned.armor_special_birthday2019'] = false;
+    push = {pinnedItems: {type: 'marketGear', path: 'gear.flat.armor_special_birthday2019', _id: uuid()}};
+  } else if (typeof user.items.gear.owned.armor_special_birthday2017 !== 'undefined') {
+    set['items.gear.owned.armor_special_birthday2018'] = false;
+    push = {pinnedItems: {type: 'marketGear', path: 'gear.flat.armor_special_birthday2018', _id: uuid()}};
+  } else if (typeof user.items.gear.owned.armor_special_birthday2016 !== 'undefined') {
+    set['items.gear.owned.armor_special_birthday2017'] = false;
+    push = {pinnedItems: {type: 'marketGear', path: 'gear.flat.armor_special_birthday2017', _id: uuid()}};
+  } else if (typeof user.items.gear.owned.armor_special_birthday2015 !== 'undefined') {
+    set['items.gear.owned.armor_special_birthday2016'] = false;
+    push = {pinnedItems: {type: 'marketGear', path: 'gear.flat.armor_special_birthday2016', _id: uuid()}};
+  } else if (typeof user.items.gear.owned.armor_special_birthday !== 'undefined') {
+    set['items.gear.owned.armor_special_birthday2015'] = false;
+    push = {pinnedItems: {type: 'marketGear', path: 'gear.flat.armor_special_birthday2015', _id: uuid()}};
+  } else {
+    set['items.gear.owned.armor_special_birthday'] = false;
+    push = {pinnedItems: {type: 'marketGear', path: 'gear.flat.armor_special_birthday', _id: uuid()}};
+  }
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+
+  return await User.update({_id: user._id}, {$inc: inc, $set: set, $push: push}).exec();
+}
+
+module.exports = async function processUsers () {
+  let query = {
+    migration: {$ne: MIGRATION_NAME},
+    'auth.timestamps.loggedin': {$gt: new Date('2019-01-15')},
+  };
+
+  const fields = {
+    _id: 1,
+    items: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1],
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};
@@ -0,0 +1,82 @@
+/* eslint-disable no-console */
+const MIGRATION_NAME = '20200218_pet_color_achievements';
+import { model as User } from '../../../website/server/models/user';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count++;
+
+  const set = {
+    migration: MIGRATION_NAME,
+  };
+
+  if (user && user.items && user.items.pets) {
+    const pets = user.items.pets;
+    if (pets['Wolf-CottonCandyPink'] > 0
+      && pets['TigerCub-CottonCandyPink'] > 0
+      && pets['PandaCub-CottonCandyPink'] > 0
+      && pets['LionCub-CottonCandyPink'] > 0
+      && pets['Fox-CottonCandyPink'] > 0
+      && pets['FlyingPig-CottonCandyPink'] > 0
+      && pets['Dragon-CottonCandyPink'] > 0
+      && pets['Cactus-CottonCandyPink'] > 0
+      && pets['BearCub-CottonCandyPink'] > 0) {
+        set['achievements.tickledPink'] = true;
+      }
+  }
+
+  if (user && user.items && user.items.mounts) {
+    const mounts = user.items.mounts;
+    if (mounts['Wolf-CottonCandyPink']
+      && mounts['TigerCub-CottonCandyPink']
+      && mounts['PandaCub-CottonCandyPink']
+      && mounts['LionCub-CottonCandyPink']
+      && mounts['Fox-CottonCandyPink']
+      && mounts['FlyingPig-CottonCandyPink']
+      && mounts['Dragon-CottonCandyPink']
+      && mounts['Cactus-CottonCandyPink']
+      && mounts['BearCub-CottonCandyPink'] ) {
+        set['achievements.rosyOutlook'] = true;
+      }
+  }
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+
+  return await User.update({ _id: user._id }, { $set: set }).exec();
+}
+
+module.exports = async function processUsers () {
+  let query = {
+    migration: { $ne: MIGRATION_NAME },
+    'auth.timestamps.loggedin': { $gt: new Date('2020-02-01') },
+  };
+
+  const fields = {
+    _id: 1,
+    items: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1]._id,
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};
@@ -0,0 +1,69 @@
+/* eslint-disable no-console */
+const MIGRATION_NAME = '20200402_webhooks_add_protocol';
+import { model as User } from '../../../website/server/models/user';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count++;
+
+  const set = {
+    migration: MIGRATION_NAME,
+  };
+
+  if (user && user.webhooks && user.webhooks.length > 0) {
+    user.webhooks.forEach(webhook => {
+      // Make sure the protocol is set and valid
+      if (webhook.url.startsWith('ftp')) {
+        webhook.url = webhook.url.replace('ftp', 'https');
+      }
+
+      if (!webhook.url.startsWith('http://') && !webhook.url.startsWith('https://')) {
+        // the default in got 9 was https
+        // see https://github.com/sindresorhus/got/commit/92bc8082137d7d085750359bbd76c801e213d7d2#diff-0730bb7c2e8f9ea2438b52e419dd86c9L111
+        webhook.url = `https://${webhook.url}`;
+      }
+    });
+
+    set.webhooks = user.webhooks;
+  }
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+
+  return await User.update({ _id: user._id }, { $set: set }).exec();
+}
+
+module.exports = async function processUsers () {
+  let query = {
+    migration: { $ne: MIGRATION_NAME },
+    webhooks: { $exists: true, $not: { $size: 0 } },
+  };
+
+  const fields = {
+    _id: 1,
+    webhooks: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1]._id,
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};
@@ -0,0 +1,63 @@
+/* eslint-disable no-console */
+const MIGRATION_NAME = '20200402_webhooks_reenable';
+import { model as User } from '../../../website/server/models/user';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count++;
+
+  const set = {
+    migration: MIGRATION_NAME,
+  };
+
+  if (user && user.webhooks && user.webhooks.length > 0) {
+    user.webhooks.forEach(webhook => {
+      // Re-enable webhooks disabled because of too many failures
+      if (webhook.enabled === false && webhook.lastFailureAt === null) {
+        webhook.enabled = true;
+      }
+    });
+
+    set.webhooks = user.webhooks;
+  }
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+
+  return await User.update({ _id: user._id }, { $set: set }).exec();
+}
+
+module.exports = async function processUsers () {
+  let query = {
+    migration: { $ne: MIGRATION_NAME },
+    webhooks: { $exists: true, $not: { $size: 0 } },
+  };
+
+  const fields = {
+    _id: 1,
+    webhooks: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1]._id,
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};
@@ -10,7 +10,7 @@ async function syncChallengeToMembers (challenges) {

    const promises = [];
    users.forEach(user => {
-      promises.push(challenge.syncToUser(user));
+      promises.push(challenge.syncTasksToUser(user));
      promises.push(challenge.save());
      promises.push(user.save());
    });
@@ -18,7 +18,7 @@ function setUpServer () {
 setUpServer();

 // Replace this with your migration
-const processUsers = () => {}; // require('').default;
+const processUsers = require().default;

 processUsers()
  .then(() => {
@@ -27,7 +27,7 @@ function uploadFile (buffer, fileName) {
      if (error) {
        reject(error);
      } else {
-        // console.info(`${fileName} uploaded to ${BUCKET_NAME} succesfully.`);
+        // console.info(`${fileName} uploaded to ${BUCKET_NAME} successfully.`);
        resolve(fileName);
      }
    });
@@ -0,0 +1,54 @@
+// @migrationName = 'RewardsMigrationFlipNegativeCostsValues';
+// @authorName = 'hamboomger';
+// @authorUuid = '80b61b73-2278-4947-b713-a10112cfe7f5';
+
+/*
+ * For each reward with negative cost, make it positive
+ * by assigning it an absolute value of itself
+ */
+
+import { Task } from '../../website/server/models/task';
+
+async function flipNegativeCostsValues () {
+  const query = {
+    type: 'reward',
+    value: { $lt: 0 },
+  };
+
+  const fields = {
+    _id: 1,
+    value: 1,
+  };
+
+  // eslint-disable-next-line no-constant-condition
+  while (true) {
+    // eslint-disable-next-line no-await-in-loop
+    const rewards = await Task
+      .find(query)
+      .limit(250)
+      .sort({ _id: 1 })
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (rewards.length === 0) {
+      break;
+    }
+
+    const promises = rewards.map(reward => {
+      const positiveValue = Math.abs(reward.value);
+      return Task.update({ _id: reward._id }, { $set: { value: positiveValue } }).exec();
+    });
+
+    // eslint-disable-next-line no-await-in-loop
+    await Promise.all(promises);
+
+    query._id = {
+      $gt: rewards[rewards.length - 1]._id,
+    };
+  }
+
+  console.log('All rewards with negative values were updated, migration finished');
+}
+
+export default flipNegativeCostsValues;
@@ -8,13 +8,16 @@ const BASE_URL = nconf.get('BASE_URL');
 const EMAIL_SLUG = 'mandrill-email-slug'; // Set email template to send
 const MIGRATION_NAME = 'bulk-email';

-const progressCount = 1000;
+const progressCount = 250;
 let count = 0;

 async function updateUser (user) {
  count += 1;

-  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+  if (count % progressCount === 0) {
+    console.warn(`${count} ${user._id}`);
+    await new Promise(resolve => setTimeout(resolve, 5000));
+  }

  await sendTxn(
    user,
@@ -0,0 +1,64 @@
+/* eslint-disable no-console */
+import each from 'lodash/each';
+import keys from 'lodash/keys';
+import content from '../../website/common/script/content/index';
+
+import { model as User } from '../../website/server/models/user';
+
+const MIGRATION_NAME = 'full-gear';
+
+const progressCount = 1000;
+let count = 0;
+
+/*
+ * Award users every extant pet and mount
+ */
+
+async function updateUser (user) {
+  count += 1;
+
+  const set = {};
+
+  set.migration = MIGRATION_NAME;
+
+  each(keys(content.gear.flat), gearItem => {
+    set[`items.gear.owned.${gearItem}`] = true;
+  });
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+
+  return User.update({ _id: user._id }, { $set: set }).exec();
+}
+
+export default async function processUsers () {
+  const query = {
+    migration: { $ne: MIGRATION_NAME },
+    'auth.local.lowerCaseUsername': 'olson1',
+  };
+
+  const fields = {
+    _id: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({ _id: 1 })
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1],
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+}
@@ -33,6 +33,9 @@ async function updateUser (user) {
  each(keys(content.specialPets), pet => {
    set[`items.pets.${pet}`] = 5;
  });
+  each(keys(content.wackyPets), pet => {
+    set[`items.pets.${pet}`] = 5;
+  });
  each(keys(content.mounts), mount => {
    set[`items.mounts.${mount}`] = true;
  });
@@ -54,7 +57,7 @@ async function updateUser (user) {
 export default async function processUsers () {
  const query = {
    migration: { $ne: MIGRATION_NAME },
-    'auth.local.username': 'olson22',
+    'auth.local.username': 'SabreTest',
  };

  const fields = {
@@ -3,7 +3,7 @@ import { v4 as uuid } from 'uuid';

 import { model as User } from '../../website/server/models/user';

-const MIGRATION_NAME = '20190314_pi_day';
+const MIGRATION_NAME = '20200314_pi_day';

 const progressCount = 1000;
 let count = 0;
@@ -24,27 +24,37 @@ async function updateUser (user) {
    'items.food.Pie_Red': 1,
  };
  const set = {};
+  let push;

  set.migration = MIGRATION_NAME;

-  set['items.gear.owned.head_special_piDay'] = false;
-  set['items.gear.owned.shield_special_piDay'] = false;
-  const push = [
-    { type: 'marketGear', path: 'gear.flat.head_special_piDay', _id: uuid() },
-    { type: 'marketGear', path: 'gear.flat.shield_special_piDay', _id: uuid() },
-  ];
+  if (typeof user.items.gear.owned.head_special_piDay !== 'undefined') {
+    push = false;
+  } else {
+    set['items.gear.owned.head_special_piDay'] = false;
+    set['items.gear.owned.shield_special_piDay'] = false;
+    push = [
+      { type: 'marketGear', path: 'gear.flat.head_special_piDay', _id: uuid() },
+      { type: 'marketGear', path: 'gear.flat.shield_special_piDay', _id: uuid() },
+    ];
+  }

  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);

+  if (push) {
+    return User
+      .update({ _id: user._id }, { $inc: inc, $set: set, $push: { pinnedItems: { $each: push } } })
+      .exec();
+  }
  return User
-    .update({ _id: user._id }, { $inc: inc, $set: set, $push: { pinnedItems: { $each: push } } })
+    .update({ _id: user._id }, { $inc: inc, $set: set })
    .exec();
 }

 export default async function processUsers () {
  const query = {
    migration: { $ne: MIGRATION_NAME },
-    'auth.timestamps.loggedin': { $gt: new Date('2019-02-15') },
+    'auth.timestamps.loggedin': { $gt: new Date('2020-02-15') },
  };

  const fields = {
@@ -1,76 +1,79 @@
 {
  "name": "habitica",
  "description": "A habit tracker app which treats your goals like a Role Playing Game.",
-  "version": "4.124.1",
+  "version": "4.140.2",
  "main": "./website/server/index.js",
  "dependencies": {
-    "@babel/core": "^7.7.4",
-    "@babel/preset-env": "^7.7.4",
-    "@babel/register": "^7.7.4",
-    "@google-cloud/trace-agent": "^4.2.3",
-    "@slack/client": "^3.8.1",
+    "@babel/core": "^7.9.0",
+    "@babel/preset-env": "^7.9.0",
+    "@babel/register": "^7.9.0",
+    "@google-cloud/trace-agent": "^4.2.5",
+    "@slack/client": "^4.12.0",
    "accepts": "^1.3.5",
-    "amazon-payments": "^0.2.7",
+    "amazon-payments": "^0.2.8",
    "amplitude": "^3.5.0",
    "apidoc": "^0.17.5",
    "apn": "^2.2.0",
-    "aws-sdk": "^2.578.0",
-    "bcrypt": "^3.0.7",
+    "apple-auth": "^1.0.5",
+    "aws-sdk": "^2.653.0",
+    "bcrypt": "^3.0.8",
    "body-parser": "^1.18.3",
    "compression": "^1.7.4",
-    "cookie-session": "^1.3.3",
+    "cookie-session": "^1.4.0",
    "coupon-code": "^0.4.5",
-    "csv-stringify": "^5.1.0",
+    "csv-stringify": "^5.3.6",
    "cwait": "^1.1.1",
    "domain-middleware": "~0.1.0",
-    "eslint": "^6.7.1",
+    "eslint": "^6.8.0",
    "eslint-config-habitrpg": "^6.2.0",
    "eslint-plugin-mocha": "^5.0.0",
    "express": "^4.16.3",
    "express-basic-auth": "^1.1.5",
    "express-validator": "^5.2.0",
    "glob": "^7.1.6",
-    "got": "^9.0.0",
+    "got": "^10.7.0",
    "gulp": "^4.0.0",
    "gulp-babel": "^8.0.0",
    "gulp-imagemin": "^6.2.0",
-    "gulp-nodemon": "^2.4.1",
+    "gulp-nodemon": "^2.5.0",
    "gulp.spritesmith": "^6.9.0",
-    "habitica-markdown": "^1.3.0",
-    "helmet": "^3.21.2",
+    "habitica-markdown": "^1.3.2",
+    "helmet": "^3.22.0",
    "image-size": "^0.8.3",
    "in-app-purchase": "^1.11.3",
-    "js2xmlparser": "^4.0.0",
+    "js2xmlparser": "^4.0.1",
+    "jsonwebtoken": "^8.5.1",
+    "jwks-rsa": "^1.7.0",
    "lodash": "^4.17.15",
    "merge-stream": "^2.0.0",
    "method-override": "^3.0.0",
    "moment": "^2.24.0",
    "moment-recur": "^1.0.7",
-    "mongoose": "^5.7.12",
-    "morgan": "^1.7.0",
+    "mongoose": "^5.9.7",
+    "morgan": "^1.10.0",
    "nconf": "^0.10.0",
    "node-gcm": "^1.0.2",
-    "pageres": "^5.1.0",
-    "passport": "^0.4.0",
+    "passport": "^0.4.1",
    "passport-facebook": "^3.0.0",
    "passport-google-oauth2": "^0.2.0",
    "passport-google-oauth20": "1.0.0",
    "paypal-ipn": "3.0.0",
    "paypal-rest-sdk": "^1.8.1",
    "ps-tree": "^1.0.0",
-    "regenerator-runtime": "^0.13.3",
-    "rimraf": "^3.0.0",
+    "regenerator-runtime": "^0.13.5",
+    "remove-markdown": "^0.3.0",
+    "rimraf": "^3.0.2",
    "short-uuid": "^3.0.0",
-    "stripe": "^7.13.1",
-    "superagent": "^5.1.1",
+    "stripe": "^7.15.0",
+    "superagent": "^5.2.2",
    "universal-analytics": "^0.4.17",
    "useragent": "^2.1.9",
-    "uuid": "^3.3.3",
+    "uuid": "^3.4.0",
    "validator": "^11.0.0",
    "vinyl-buffer": "^1.0.1",
-    "winston": "^2.4.3",
-    "winston-loggly-bulk": "^2.0.2",
-    "xml2js": "^0.4.4"
+    "winston": "^3.2.1",
+    "winston-loggly-bulk": "^3.1.0",
+    "xml2js": "^0.4.23"
  },
  "private": true,
  "engines": {
@@ -102,17 +105,17 @@
    "apidoc": "gulp apidoc"
  },
  "devDependencies": {
-    "axios": "^0.19.0",
+    "axios": "^0.19.2",
    "chai": "^4.1.2",
    "chai-as-promised": "^7.1.1",
-    "chalk": "^2.4.1",
+    "chalk": "^3.0.0",
    "expect.js": "^0.3.1",
    "istanbul": "^1.1.0-alpha.1",
    "mocha": "^5.1.1",
-    "monk": "^7.1.1",
+    "monk": "^7.1.2",
    "require-again": "^2.0.0",
    "sinon": "^7.2.4",
-    "sinon-chai": "^3.0.0",
+    "sinon-chai": "^3.5.0",
    "sinon-stub-promise": "^4.0.0"
  },
  "optionalDependencies": {}
@@ -34,11 +34,12 @@ async function deleteAmplitudeData (userId, email) {
 }

 async function deleteHabiticaData (user, email) {
+  const truncatedEmail = email.slice(0, email.indexOf('@'));
  await User.update(
    { _id: user._id },
    {
      $set: {
-        'auth.local.email': email,
+        'auth.local.email': user.auth.local.email ? email : `${truncatedEmail}@example.com`,
        'auth.local.hashed_password': '$2a$10$QDnNh1j1yMPnTXDEOV38xOePEWFd4X8DSYwAM8XTmqmacG5X0DKjW',
        'auth.local.passwordHashMethod': 'bcrypt',
      },
@@ -155,7 +155,7 @@ describe('analyticsService', () => {
            });
        });

-        it('sets Unkown if headers are not passed in', () => {
+        it('sets Unknown if headers are not passed in', () => {
          delete data.headers;

          return analyticsService.track(eventType, data)
@@ -476,7 +476,7 @@ describe('analyticsService', () => {
            });
        });

-        it('sets Unkown if headers are not passed in', () => {
+        it('sets Unknown if headers are not passed in', () => {
          delete data.headers;

          return analyticsService.trackPurchase(data)
@@ -0,0 +1,17 @@
+import * as contentLib from '../../../../website/server/libs/content';
+import content from '../../../../website/common/script/content';
+
+describe('contentLib', () => {
+  describe('CONTENT_CACHE_PATH', () => {
+    it('exports CONTENT_CACHE_PATH', () => {
+      expect(contentLib.CONTENT_CACHE_PATH).to.be.a.string;
+    });
+  });
+
+  describe('getLocalizedContent', () => {
+    it('clones, not modify, the original content data', () => {
+      contentLib.getLocalizedContent();
+      expect(typeof content.backgrounds.backgrounds062014.beach.text).to.equal('function');
+    });
+  });
+});
@@ -95,8 +95,8 @@ describe('cron', () => {
        user, tasksByType, daysMissed, analytics,
      });
      expect(user.purchased.plan.mysteryItems.length).to.eql(2);
-      expect(user.notifications.length).to.eql(3);
-      expect(user.notifications[0].type).to.eql('NEW_MYSTERY_ITEMS');
+      const filteredNotifications = user.notifications.filter(n => n.type === 'NEW_MYSTERY_ITEMS');
+      expect(filteredNotifications.length).to.equal(1);
    });

    it('awards multiple mystery item sets if user skipped months between logins', () => {
@@ -106,8 +106,8 @@ describe('cron', () => {
        user, tasksByType, daysMissed, analytics,
      });
      expect(user.purchased.plan.mysteryItems.length).to.eql(4);
-      expect(user.notifications.length).to.eql(3);
-      expect(user.notifications[0].type).to.eql('NEW_MYSTERY_ITEMS');
+      const filteredNotifications = user.notifications.filter(n => n.type === 'NEW_MYSTERY_ITEMS');
+      expect(filteredNotifications.length).to.equal(1);
    });

    it('resets plan.gemsBought on a new month', () => {
@@ -18,6 +18,16 @@ function getUser () {
          value: 'email@facebook',
        }],
      },
+      google: {
+        emails: [{
+          value: 'email@google',
+        }],
+      },
+      apple: {
+        emails: [{
+          value: 'email@apple',
+        }],
+      },
    },
    profile: {
      name: 'profile name',
@@ -58,6 +68,8 @@ describe('emails', () => {
      const user = getUser();
      delete user.profile.name;
      delete user.auth.local.email;
+      delete user.auth.google.emails;
+      delete user.auth.apple.emails;

      const data = getUserInfo(user, ['name', 'email', '_id', 'canSend']);

@@ -67,12 +79,48 @@ describe('emails', () => {
      expect(data).to.have.property('canSend', true);
    });

+    it('returns correct user data [google users]', () => {
+      const attachEmail = requireAgain(pathToEmailLib);
+      const { getUserInfo } = attachEmail;
+      const user = getUser();
+      delete user.profile.name;
+      delete user.auth.local.email;
+      delete user.auth.facebook.emails;
+      delete user.auth.apple.emails;
+
+      const data = getUserInfo(user, ['name', 'email', '_id', 'canSend']);
+
+      expect(data).to.have.property('name', user.auth.local.username);
+      expect(data).to.have.property('email', user.auth.google.emails[0].value);
+      expect(data).to.have.property('_id', user._id);
+      expect(data).to.have.property('canSend', true);
+    });
+
+    it('returns correct user data [apple users]', () => {
+      const attachEmail = requireAgain(pathToEmailLib);
+      const { getUserInfo } = attachEmail;
+      const user = getUser();
+      delete user.profile.name;
+      delete user.auth.local.email;
+      delete user.auth.google.emails;
+      delete user.auth.facebook.emails;
+
+      const data = getUserInfo(user, ['name', 'email', '_id', 'canSend']);
+
+      expect(data).to.have.property('name', user.auth.local.username);
+      expect(data).to.have.property('email', user.auth.apple.emails[0].value);
+      expect(data).to.have.property('_id', user._id);
+      expect(data).to.have.property('canSend', true);
+    });
+
    it('has fallbacks for missing data', () => {
      const attachEmail = requireAgain(pathToEmailLib);
      const { getUserInfo } = attachEmail;
      const user = getUser();
      delete user.auth.local.email;
      delete user.auth.facebook;
+      delete user.auth.google;
+      delete user.auth.apple;

      const data = getUserInfo(user, ['name', 'email', '_id', 'canSend']);

@@ -121,8 +169,7 @@ describe('emails', () => {

      sendTxnEmail(mailingInfo, emailType);
      expect(got.post).to.be.calledWith('undefined/job', sinon.match({
-        json: true,
-        body: {
+        json: {
          data: {
            emailType: sinon.match.same(emailType),
            to: sinon.match(value => Array.isArray(value) && value[0].name === mailingInfo.name, 'matches mailing info array'),
@@ -154,8 +201,7 @@ describe('emails', () => {

      sendTxnEmail(mailingInfo, emailType);
      expect(got.post).to.be.calledWith('undefined/job', sinon.match({
-        json: true,
-        body: {
+        json: {
          data: {
            emailType: sinon.match.same(emailType),
            to: sinon.match(val => val[0]._id === mailingInfo._id),
@@ -177,8 +223,7 @@ describe('emails', () => {

      sendTxnEmail(mailingInfo, emailType, variables);
      expect(got.post).to.be.calledWith('undefined/job', sinon.match({
-        json: true,
-        body: {
+        json: {
          data: {
            variables: sinon.match(value => value[0].name === 'BASE_URL', 'matches variables'),
            personalVariables: sinon.match(value => value[0].rcpt === mailingInfo.email
@@ -3,6 +3,7 @@ import {
  CustomError,
  NotAuthorized,
  BadRequest,
+  Forbidden,
  InternalServerError,
  NotFound,
  NotificationNotFound,
@@ -113,6 +114,32 @@ describe('Custom Errors', () => {
    });
  });

+  describe('Forbidden', () => {
+    it('is an instance of CustomError', () => {
+      const forbiddenError = new Forbidden();
+
+      expect(forbiddenError).to.be.an.instanceOf(CustomError);
+    });
+
+    it('it returns an http code of 401', () => {
+      const forbiddenError = new Forbidden();
+
+      expect(forbiddenError.httpCode).to.eql(403);
+    });
+
+    it('returns a default message', () => {
+      const forbiddenError = new Forbidden();
+
+      expect(forbiddenError.message).to.eql('Access forbidden.');
+    });
+
+    it('allows a custom message', () => {
+      const forbiddenError = new Forbidden('Custom Error Message');
+
+      expect(forbiddenError.message).to.eql('Custom Error Message');
+    });
+  });
+
  describe('InternalServerError', () => {
    it('is an instance of CustomError', () => {
      const internalServerError = new InternalServerError();
@@ -0,0 +1,111 @@
+import {
+  getLanguageFromBrowser,
+  getLanguageFromUser,
+} from '../../../../website/server/libs/language';
+import {
+  generateReq,
+} from '../../../helpers/api-unit.helper';
+
+describe('language lib', () => {
+  let req;
+
+  beforeEach(() => {
+    req = generateReq();
+  });
+
+  describe('getLanguageFromUser', () => {
+    it('uses the user preferred language if avalaible', () => {
+      const user = {
+        preferences: {
+          language: 'it',
+        },
+      };
+
+      expect(getLanguageFromUser(user, req)).to.equal('it');
+    });
+
+    it('falls back to english if the user preferred language is not avalaible', () => {
+      const user = {
+        preferences: {
+          language: 'bla',
+        },
+      };
+
+      expect(getLanguageFromUser(user, req)).to.equal('en');
+    });
+  });
+
+  describe('getLanguageFromBrowser', () => {
+    it('uses browser specificed language', () => {
+      req.headers['accept-language'] = 'pt';
+
+      expect(getLanguageFromBrowser(req)).to.equal('pt');
+    });
+
+    it('uses first language in series if browser specifies multiple', () => {
+      req.headers['accept-language'] = 'he, pt, it';
+
+      expect(getLanguageFromBrowser(req)).to.equal('he');
+    });
+
+    it('skips invalid lanaguages and uses first language in series if browser specifies multiple', () => {
+      req.headers['accept-language'] = 'blah, he, pt, it';
+
+      expect(getLanguageFromBrowser(req)).to.equal('he');
+    });
+
+    it('uses normal version of language if specialized locale is passed in', () => {
+      req.headers['accept-language'] = 'fr-CA';
+
+      expect(getLanguageFromBrowser(req)).to.equal('fr');
+    });
+
+    it('uses normal version of language if specialized locale is passed in', () => {
+      req.headers['accept-language'] = 'fr-CA';
+
+      expect(getLanguageFromBrowser(req)).to.equal('fr');
+    });
+
+    it('uses es if es is passed in', () => {
+      req.headers['accept-language'] = 'es';
+
+      expect(getLanguageFromBrowser(req)).to.equal('es');
+    });
+
+    it('uses es_419 if applicable es-languages are passed in', () => {
+      req.headers['accept-language'] = 'es-mx';
+
+      expect(getLanguageFromBrowser(req)).to.equal('es_419');
+    });
+
+    it('uses es_419 if multiple es languages are passed in', () => {
+      req.headers['accept-language'] = 'es-GT, es-MX, es-CR';
+
+      expect(getLanguageFromBrowser(req)).to.equal('es_419');
+    });
+
+    it('zh', () => {
+      req.headers['accept-language'] = 'zh-TW';
+
+      expect(getLanguageFromBrowser(req)).to.equal('zh_TW');
+    });
+
+    it('uses english if browser specified language is not compatible', () => {
+      req.headers['accept-language'] = 'blah';
+
+      expect(getLanguageFromBrowser(req)).to.equal('en');
+    });
+
+    it('uses english if browser does not specify', () => {
+      req.headers['accept-language'] = '';
+
+      expect(getLanguageFromBrowser(req)).to.equal('en');
+    });
+
+    it('uses english if browser does not supply an accept-language header', () => {
+      delete req.headers['accept-language'];
+
+      expect(getLanguageFromBrowser(req)).to.equal('en');
+    });
+  });
+});
@@ -1,14 +1,27 @@
-import winston from 'winston';
-import logger from '../../../../website/server/libs/logger';
+import logger, { _loggerConfig } from '../../../../website/server/libs/logger';
 import {
  NotFound,
 } from '../../../../website/server/libs/errors';

 describe('logger', () => {
-  let logSpy;
+  let infoSpy;
+  let warnSpy;
+  let errorSpy;
+
+  const originalLoggingEnabled = _loggerConfig.loggingEnabled;
+
+  before(() => { // enable logging in tests
+    _loggerConfig.loggingEnabled = true;
+  });
+
+  after(() => { // reset value of _loggerConfig.loggingEnabled
+    _loggerConfig.loggingEnabled = originalLoggingEnabled;
+  });

  beforeEach(() => {
-    logSpy = sandbox.stub(winston.Logger.prototype, 'log');
+    infoSpy = sandbox.stub(_loggerConfig.logger, 'info');
+    warnSpy = sandbox.stub(_loggerConfig.logger, 'warn');
+    errorSpy = sandbox.stub(_loggerConfig.logger, 'error');
  });

  afterEach(() => {
@@ -17,18 +30,52 @@ describe('logger', () => {

  describe('info', () => {
    it('calls winston\'s info log', () => {
-      logger.info(1, 2, 3);
-      expect(logSpy).to.be.calledOnce;
-      expect(logSpy).to.be.calledWith('info', 1, 2, 3);
+      logger.info('1', 2);
+      expect(infoSpy).to.be.calledOnce;
+      expect(infoSpy).to.be.calledWith('1', { extraData: 2 });
+    });
+
+    it('allows up to two arguments', () => {
+      expect(() => logger.info('1', 2, 3)).to.throw;
+      expect(infoSpy).to.not.be.called;
+    });
+
+    it('has default message', () => {
+      logger.info(1);
+      expect(infoSpy).to.be.calledOnce;
+      expect(infoSpy).to.be.calledWith('No message provided for log.', { extraData: 1 });
+    });
+
+    it('wraps non objects', () => {
+      logger.info('message', [1, 2]);
+      expect(infoSpy).to.be.calledOnce;
+      expect(infoSpy).to.be.calledWithMatch('message', { extraData: [1, 2] });
+    });
+
+    it('does not wrap objects', () => {
+      logger.info('message', { a: 1, b: 2 });
+      expect(infoSpy).to.be.calledOnce;
+      expect(infoSpy).to.be.calledWithMatch('message', { a: 1, b: 2 });
+    });
+
+    it('throws if two arguments and no message', () => {
+      expect(() => logger.info({ a: 1 }, { b: 2 })).to.throw;
+      expect(infoSpy).to.not.be.called;
    });
  });

  describe('error', () => {
-    context('non-error object', () => {
-      it('passes through arguments if the first arg is not an error object', () => {
-        logger.error(1, 2, 3, 4);
-        expect(logSpy).to.be.calledOnce;
-        expect(logSpy).to.be.calledWith('error', 1, 2, 3, 4);
+    it('allows up to two arguments', () => {
+      expect(() => logger.error('1', 2, 3)).to.throw;
+      expect(errorSpy).to.not.be.called;
+    });
+
+    it('handled non-error object', () => {
+      logger.error(1, 2);
+      expect(errorSpy).to.be.calledOnce;
+      expect(errorSpy).to.be.calledWithMatch('logger.error expects an Error instance', {
+        invalidErr: 1,
+        extraData: 2,
      });
    });

@@ -37,15 +84,12 @@ describe('logger', () => {
        const errInstance = new Error('An error.');
        logger.error(errInstance, {
          data: 1,
-        }, 2, 3);
+        });

-        expect(logSpy).to.be.calledOnce;
-        expect(logSpy).to.be.calledWith(
-          'error',
+        expect(errorSpy).to.be.calledOnce;
+        expect(errorSpy).to.be.calledWith(
          errInstance.stack,
          { data: 1, fullError: errInstance },
-          2,
-          3,
        );
      });

@@ -56,60 +100,60 @@ describe('logger', () => {
        logger.error(errInstance, {
          data: 1,
          fullError: anotherError,
-        }, 2, 3);
+        });

-        expect(logSpy).to.be.calledOnce;
-        expect(logSpy).to.be.calledWith(
-          'error',
+        expect(errorSpy).to.be.calledOnce;
+        expect(errorSpy).to.be.calledWith(
          errInstance.stack,
          { data: 1, fullError: anotherError },
-          2,
-          3,
        );
      });

      it('logs the error when errorData is null', () => {
        const errInstance = new Error('An error.');

-        logger.error(errInstance, null, 2, 3);
+        logger.error(errInstance, null);

-        expect(logSpy).to.be.calledOnce;
-        expect(logSpy).to.be.calledWith(
-          'error',
+        expect(errorSpy).to.be.calledOnce;
+        expect(errorSpy).to.be.calledWithMatch(
          errInstance.stack,
-          null,
-          2,
-          3,
+          { },
        );
      });

      it('logs the error when errorData is not an object', () => {
        const errInstance = new Error('An error.');

-        logger.error(errInstance, true, 2, 3);
+        logger.error(errInstance, true);

-        expect(logSpy).to.be.calledOnce;
-        expect(logSpy).to.be.calledWith(
-          'error',
+        expect(errorSpy).to.be.calledOnce;
+        expect(errorSpy).to.be.calledWithMatch(
          errInstance.stack,
-          true,
-          2,
-          3,
+          { extraData: true },
+        );
+      });
+
+      it('logs the error when errorData is a string', () => {
+        const errInstance = new Error('An error.');
+
+        logger.error(errInstance, 'a string');
+
+        expect(errorSpy).to.be.calledOnce;
+        expect(errorSpy).to.be.calledWithMatch(
+          errInstance.stack,
+          { extraMessage: 'a string' },
        );
      });

      it('logs the error when errorData does not include isHandledError property', () => {
        const errInstance = new Error('An error.');

-        logger.error(errInstance, { httpCode: 400 }, 2, 3);
+        logger.error(errInstance, { httpCode: 400 });

-        expect(logSpy).to.be.calledOnce;
-        expect(logSpy).to.be.calledWith(
-          'error',
+        expect(errorSpy).to.be.calledOnce;
+        expect(errorSpy).to.be.calledWith(
          errInstance.stack,
          { httpCode: 400, fullError: errInstance },
-          2,
-          3,
        );
      });

@@ -119,15 +163,12 @@ describe('logger', () => {
        logger.error(errInstance, {
          isHandledError: true,
          httpCode: 502,
-        }, 2, 3);
+        });

-        expect(logSpy).to.be.calledOnce;
-        expect(logSpy).to.be.calledWith(
-          'error',
+        expect(errorSpy).to.be.calledOnce;
+        expect(errorSpy).to.be.calledWith(
          errInstance.stack,
          { httpCode: 502, isHandledError: true, fullError: errInstance },
-          2,
-          3,
        );
      });

@@ -137,15 +178,12 @@ describe('logger', () => {
        logger.error(errInstance, {
          isHandledError: true,
          httpCode: 403,
-        }, 2, 3);
+        });

-        expect(logSpy).to.be.calledOnce;
-        expect(logSpy).to.be.calledWith(
-          'warn',
+        expect(warnSpy).to.be.calledOnce;
+        expect(warnSpy).to.be.calledWith(
          errInstance.stack,
          { httpCode: 403, isHandledError: true, fullError: errInstance },
-          2,
-          3,
        );
      });

@@ -154,19 +192,16 @@ describe('logger', () => {

        errInstance.customField = 'Some interesting data';

-        logger.error(errInstance, {}, 2, 3);
+        logger.error(errInstance, {});

-        expect(logSpy).to.be.calledOnce;
-        expect(logSpy).to.be.calledWith(
-          'error',
+        expect(errorSpy).to.be.calledOnce;
+        expect(errorSpy).to.be.calledWith(
          errInstance.stack,
          {
            fullError: {
              customField: 'Some interesting data',
            },
          },
-          2,
-          3,
        );
      });
    });
@@ -278,19 +278,6 @@ describe('Google Payments', () => {
        });
    });

-    it('should throw an error if subscription is still valid', async () => {
-      iap.getPurchaseData.restore();
-      iapGetPurchaseDataStub = sinon.stub(iap, 'getPurchaseData')
-        .returns([{ expirationDate: expirationDate.add({ day: 1 }).toDate() }]);
-
-      await expect(googlePayments.cancelSubscribe(user, headers))
-        .to.eventually.be.rejected.and.to.eql({
-          httpCode: 401,
-          name: 'NotAuthorized',
-          message: googlePayments.constants.RESPONSE_STILL_VALID,
-        });
-    });
-
    it('should throw an error if receipt is invalid', async () => {
      iap.isValidated.restore();
      iapIsValidatedStub = sinon.stub(iap, 'isValidated')
@@ -292,7 +292,7 @@ describe('Purchasing a group plan for group', () => {
  });

  it('sends appropriate emails when subscribed member of group must manually cancel recurring Android subscription', async () => {
-    const TECH_ASSISTANCE_EMAIL = nconf.get('TECH_ASSISTANCE_EMAIL');
+    const TECH_ASSISTANCE_EMAIL = nconf.get('EMAILS_TECH_ASSISTANCE_EMAIL');
    plan.customerId = 'random';
    plan.paymentMethod = api.constants.GOOGLE_PAYMENT_METHOD;

@@ -309,23 +309,44 @@ describe('Purchasing a group plan for group', () => {
    await api.createSubscription(data);

    expect(sender.sendTxn).to.have.callCount(4);
-    expect(sender.sendTxn.args[0][0]._id).to.equal(TECH_ASSISTANCE_EMAIL);
-    expect(sender.sendTxn.args[0][1]).to.equal('admin-user-subscription-details');
-    expect(sender.sendTxn.args[1][0]._id).to.equal(recipient._id);
-    expect(sender.sendTxn.args[1][1]).to.equal('group-member-join');
-    expect(sender.sendTxn.args[1][2]).to.eql([
+    const adminUserSubscriptionDetails = sender.sendTxn.args.find(sendTxnArgs => {
+      const emailType = sendTxnArgs[1];
+      return emailType === 'admin-user-subscription-details';
+    });
+    expect(adminUserSubscriptionDetails).to.exist;
+    expect(adminUserSubscriptionDetails[0].email).to.equal(TECH_ASSISTANCE_EMAIL);
+
+    const groupMemberJoinOne = sender.sendTxn.args.find(sendTxnArgs => {
+      const emailType = sendTxnArgs[1];
+      const emailRecipient = sendTxnArgs[0];
+      return emailType === 'group-member-join' && emailRecipient._id === recipient._id;
+    });
+    expect(groupMemberJoinOne).to.exist;
+    expect(groupMemberJoinOne[0]._id).to.equal(recipient._id);
+    expect(groupMemberJoinOne[2]).to.eql([
      { name: 'LEADER', content: groupLeaderName },
      { name: 'GROUP_NAME', content: groupName },
      { name: 'PREVIOUS_SUBSCRIPTION_TYPE', content: EMAIL_TEMPLATE_SUBSCRIPTION_TYPE_GOOGLE },
    ]);
-    expect(sender.sendTxn.args[2][0]._id).to.equal(group.leader);
-    expect(sender.sendTxn.args[2][1]).to.equal('group-member-join');
-    expect(sender.sendTxn.args[3][0]._id).to.equal(group.leader);
-    expect(sender.sendTxn.args[3][1]).to.equal('group-subscription-begins');
+
+    const groupMemberJoinTwo = sender.sendTxn.args.find(sendTxnArgs => {
+      const emailType = sendTxnArgs[1];
+      const emailRecipient = sendTxnArgs[0];
+      return emailType === 'group-member-join' && emailRecipient._id === group.leader;
+    });
+    expect(groupMemberJoinTwo).to.exist;
+    expect(groupMemberJoinTwo[0]._id).to.equal(group.leader);
+
+    const groupSubscriptionBegins = sender.sendTxn.args.find(sendTxnArgs => {
+      const emailType = sendTxnArgs[1];
+      return emailType === 'group-subscription-begins';
+    });
+    expect(groupSubscriptionBegins).to.exist;
+    expect(groupSubscriptionBegins[0]._id).to.equal(group.leader);
  });

  it('sends appropriate emails when subscribed member of group must manually cancel recurring iOS subscription', async () => {
-    const TECH_ASSISTANCE_EMAIL = nconf.get('TECH_ASSISTANCE_EMAIL');
+    const TECH_ASSISTANCE_EMAIL = nconf.get('EMAILS_TECH_ASSISTANCE_EMAIL');
    plan.customerId = 'random';
    plan.paymentMethod = api.constants.IOS_PAYMENT_METHOD;

@@ -342,19 +363,41 @@ describe('Purchasing a group plan for group', () => {
    await api.createSubscription(data);

    expect(sender.sendTxn).to.have.callCount(4);
-    expect(sender.sendTxn.args[0][0]._id).to.equal(TECH_ASSISTANCE_EMAIL);
-    expect(sender.sendTxn.args[0][1]).to.equal('admin-user-subscription-details');
-    expect(sender.sendTxn.args[1][0]._id).to.equal(recipient._id);
-    expect(sender.sendTxn.args[1][1]).to.equal('group-member-join');
-    expect(sender.sendTxn.args[1][2]).to.eql([
+
+    const adminUserSubscriptionDetails = sender.sendTxn.args.find(sendTxnArgs => {
+      const emailType = sendTxnArgs[1];
+      return emailType === 'admin-user-subscription-details';
+    });
+    expect(adminUserSubscriptionDetails).to.exist;
+    expect(adminUserSubscriptionDetails[0].email).to.equal(TECH_ASSISTANCE_EMAIL);
+
+    const groupMemberJoinOne = sender.sendTxn.args.find(sendTxnArgs => {
+      const emailType = sendTxnArgs[1];
+      const emailRecipient = sendTxnArgs[0];
+      return emailType === 'group-member-join' && emailRecipient._id === recipient._id;
+    });
+    expect(groupMemberJoinOne).to.exist;
+    expect(groupMemberJoinOne[0]._id).to.equal(recipient._id);
+    expect(groupMemberJoinOne[2]).to.eql([
      { name: 'LEADER', content: groupLeaderName },
      { name: 'GROUP_NAME', content: groupName },
      { name: 'PREVIOUS_SUBSCRIPTION_TYPE', content: EMAIL_TEMPLATE_SUBSCRIPTION_TYPE_IOS },
    ]);
-    expect(sender.sendTxn.args[2][0]._id).to.equal(group.leader);
-    expect(sender.sendTxn.args[2][1]).to.equal('group-member-join');
-    expect(sender.sendTxn.args[3][0]._id).to.equal(group.leader);
-    expect(sender.sendTxn.args[3][1]).to.equal('group-subscription-begins');
+
+    const groupMemberJoinTwo = sender.sendTxn.args.find(sendTxnArgs => {
+      const emailType = sendTxnArgs[1];
+      const emailRecipient = sendTxnArgs[0];
+      return emailType === 'group-member-join' && emailRecipient._id === group.leader;
+    });
+    expect(groupMemberJoinTwo).to.exist;
+    expect(groupMemberJoinTwo[0]._id).to.equal(group.leader);
+
+    const groupSubscriptionBegins = sender.sendTxn.args.find(sendTxnArgs => {
+      const emailType = sendTxnArgs[1];
+      return emailType === 'group-subscription-begins';
+    });
+    expect(groupSubscriptionBegins).to.exist;
+    expect(groupSubscriptionBegins[0]._id).to.equal(group.leader);
  });

  it('adds months to members with existing gift subscription', async () => {
@@ -626,7 +626,7 @@ describe('payments/index', () => {
          .calledWith(recipient, { receiverMsg: msg, senderMsg: msg, save: false });
      });

-      it('sends a message from purchaser to recipient wtih custom message', async () => {
+      it('sends a message from purchaser to recipient with custom message', async () => {
        data.gift.message = 'giftmessage';

        await api.buyGems(data);
@@ -5,6 +5,7 @@ import {
  moveTask,
 } from '../../../../website/server/libs/taskManager';
 import i18n from '../../../../website/common/script/i18n';
+import shared from '../../../../website/common/script';
 import {
  generateUser,
  generateGroup,
@@ -58,6 +59,51 @@ describe('taskManager', () => {
    expect(newTask.createdAt).to.exist;
  });

+  describe('onboarding', () => {
+    beforeEach(() => {
+      user.addAchievement = sinon.spy();
+      sinon.stub(shared.onboarding, 'checkOnboardingStatus');
+    });
+
+    afterEach(() => {
+      shared.onboarding.checkOnboardingStatus.restore();
+    });
+
+    it('adds the onboarding achievement to the user and checks the onboarding status', async () => {
+      req.body = testHabit;
+      res.t = i18n.t;
+      user.flags.welcomed = true;
+
+      await createTasks(req, res, { user });
+
+      expect(user.addAchievement).to.be.calledOnce;
+      expect(user.addAchievement).to.be.calledWith('createdTask');
+
+      expect(shared.onboarding.checkOnboardingStatus).to.be.calledOnce;
+      expect(shared.onboarding.checkOnboardingStatus).to.be.calledWith(user);
+    });
+
+    it('does not add the onboarding achievement to the user if flags.welcomed is false', async () => {
+      req.body = testHabit;
+      res.t = i18n.t;
+      user.flags.welcomed = false;
+
+      await createTasks(req, res, { user });
+
+      expect(user.addAchievement).to.not.be.called;
+    });
+
+    it('does not add the onboarding achievement to the user if it\'s already been awarded', async () => {
+      req.body = testHabit;
+      res.t = i18n.t;
+      user.achievements.createdTask = true;
+
+      await createTasks(req, res, { user });
+
+      expect(user.addAchievement).to.not.be.called;
+    });
+  });
+
  it('gets user tasks', async () => {
    req.body = testHabit;
    res.t = i18n.t;
@@ -1,4 +1,5 @@
 import got from 'got';
+import moment from 'moment';
 import {
  WebhookSender,
  taskScoredWebhook,
@@ -13,6 +14,7 @@ import {
 import {
  generateUser,
  defer,
+  sleep,
 } from '../../../helpers/api-unit.helper';


@@ -43,6 +45,7 @@ describe('webhooks', () => {
      options: {
        questStarted: true,
        questFinised: true,
+        questInvited: true,
      },
    }, {
      id: 'userActivity',
@@ -98,8 +101,7 @@ describe('webhooks', () => {
      expect(WebhookSender.defaultTransformData).to.be.calledOnce;
      expect(got.post).to.be.calledOnce;
      expect(got.post).to.be.calledWithMatch('http://custom-url.com', {
-        json: true,
-        body,
+        json: body,
      });
    });

@@ -119,7 +121,7 @@ describe('webhooks', () => {
      expect(sendWebhook.attachDefaultData).to.be.calledOnce;
      expect(got.post).to.be.calledOnce;
      expect(got.post).to.be.calledWithMatch('http://custom-url.com', {
-        json: true,
+        json: body,
      });

      expect(body).to.eql({
@@ -150,8 +152,7 @@ describe('webhooks', () => {
      expect(WebhookSender.defaultTransformData).to.not.be.called;
      expect(got.post).to.be.calledOnce;
      expect(got.post).to.be.calledWithMatch('http://custom-url.com', {
-        json: true,
-        body: {
+        json: {
          foo: 'bar',
          baz: 'biz',
        },
@@ -268,8 +269,7 @@ describe('webhooks', () => {

      expect(got.post).to.be.calledOnce;
      expect(got.post).to.be.calledWithMatch('http://custom-url.com', {
-        body,
-        json: true,
+        json: body,
      });
    });

@@ -289,8 +289,7 @@ describe('webhooks', () => {

      expect(got.post).to.be.calledOnce;
      expect(got.post).to.be.calledWithMatch('http://custom-url.com', {
-        body,
-        json: true,
+        json: body,
      });
    });

@@ -313,12 +312,101 @@ describe('webhooks', () => {

      expect(got.post).to.be.calledTwice;
      expect(got.post).to.be.calledWithMatch('http://custom-url.com', {
-        body,
-        json: true,
+        json: body,
      });
      expect(got.post).to.be.calledWithMatch('http://other-url.com', {
-        body,
-        json: true,
+        json: body,
+      });
+    });
+
+    describe('failures', () => {
+      let sendWebhook;
+
+      beforeEach(async () => {
+        sandbox.restore();
+        sandbox.stub(got, 'post').returns(Promise.reject());
+
+        sendWebhook = new WebhookSender({ type: 'taskActivity' });
+        user.webhooks = [{
+          url: 'http://custom-url.com', enabled: true, type: 'taskActivity',
+        }];
+        await user.save();
+
+        expect(user.webhooks[0].failures).to.equal(0);
+        expect(user.webhooks[0].lastFailureAt).to.equal(undefined);
+      });
+
+      it('does not increase failures counter if request is successfull', async () => {
+        sandbox.restore();
+        sandbox.stub(got, 'post').returns(Promise.resolve());
+
+        const body = {};
+        sendWebhook.send(user, body);
+
+        expect(got.post).to.be.calledOnce;
+        expect(got.post).to.be.calledWithMatch('http://custom-url.com', {
+          json: body,
+        });
+
+        await sleep(0.1);
+        user = await User.findById(user._id).exec();
+
+        expect(user.webhooks[0].failures).to.equal(0);
+        expect(user.webhooks[0].lastFailureAt).to.equal(undefined);
+      });
+
+      it('records failures', async () => {
+        const body = {};
+        sendWebhook.send(user, body);
+
+        expect(got.post).to.be.calledOnce;
+        expect(got.post).to.be.calledWithMatch('http://custom-url.com', {
+          json: body,
+        });
+
+        await sleep(0.1);
+        user = await User.findById(user._id).exec();
+
+        expect(user.webhooks[0].failures).to.equal(1);
+        expect((Date.now() - user.webhooks[0].lastFailureAt.getTime()) < 10000).to.be.true;
+      });
+
+      it('disables a webhook after 10 failures', async () => {
+        const times = 10;
+        for (let i = 0; i < times; i += 1) {
+          sendWebhook.send(user, {});
+          await sleep(0.1); // eslint-disable-line no-await-in-loop
+          user = await User.findById(user._id).exec(); // eslint-disable-line no-await-in-loop
+        }
+
+        expect(got.post).to.be.callCount(10);
+        expect(got.post).to.be.calledWithMatch('http://custom-url.com');
+
+        await sleep(0.1);
+        user = await User.findById(user._id).exec();
+
+        expect(user.webhooks[0].enabled).to.equal(false);
+        expect(user.webhooks[0].failures).to.equal(0);
+      });
+
+      it('resets failures after a month ', async () => {
+        const oneMonthAgo = moment().subtract(1, 'months').subtract(1, 'days').toDate();
+        user.webhooks[0].lastFailureAt = oneMonthAgo;
+        user.webhooks[0].failures = 9;
+
+        await user.save();
+
+        sendWebhook.send(user, []);
+
+        expect(got.post).to.be.calledOnce;
+        expect(got.post).to.be.calledWithMatch('http://custom-url.com');
+
+        await sleep(0.1);
+        user = await User.findById(user._id).exec();
+
+        expect(user.webhooks[0].failures).to.equal(1);
+        // Check that the stored date is whitin 10s from now
+        expect((Date.now() - user.webhooks[0].lastFailureAt.getTime()) < 10000).to.be.true;
      });
    });
  });
@@ -363,8 +451,7 @@ describe('webhooks', () => {

      expect(got.post).to.be.calledOnce;
      expect(got.post).to.be.calledWithMatch(webhooks[0].url, {
-        json: true,
-        body: {
+        json: {
          type: 'scored',
          webhookType: 'taskActivity',
          user: {
@@ -401,8 +488,7 @@ describe('webhooks', () => {

      expect(got.post).to.be.calledOnce;
      expect(got.post).to.be.calledWithMatch('http://global-activity.com', {
-        json: true,
-        body: {
+        json: {
          type: 'scored',
          webhookType: 'taskActivity',
          user: {
@@ -455,8 +541,7 @@ describe('webhooks', () => {

        expect(got.post).to.be.calledOnce;
        expect(got.post).to.be.calledWithMatch(webhooks[0].url, {
-          json: true,
-          body: {
+          json: {
            type,
            webhookType: 'taskActivity',
            user: {
@@ -496,8 +581,7 @@ describe('webhooks', () => {

        expect(got.post).to.be.calledOnce;
        expect(got.post).to.be.calledWithMatch(webhooks[0].url, {
-          json: true,
-          body: {
+          json: {
            webhookType: 'taskActivity',
            user: {
              _id: user._id,
@@ -537,8 +621,7 @@ describe('webhooks', () => {

        expect(got.post).to.be.calledOnce;
        expect(got.post).to.be.calledWithMatch(webhooks[2].url, {
-          json: true,
-          body: {
+          json: {
            type,
            webhookType: 'userActivity',
            user: {
@@ -576,7 +659,7 @@ describe('webhooks', () => {
      };
    });

-    ['questStarted', 'questFinised'].forEach(type => {
+    ['questStarted', 'questFinised', 'questInvited'].forEach(type => {
      it(`sends ${type} webhooks`, () => {
        data.type = type;

@@ -584,8 +667,7 @@ describe('webhooks', () => {

        expect(got.post).to.be.calledOnce;
        expect(got.post).to.be.calledWithMatch(webhooks[1].url, {
-          json: true,
-          body: {
+          json: {
            type,
            webhookType: 'questActivity',
            user: {
@@ -631,8 +713,7 @@ describe('webhooks', () => {

      expect(got.post).to.be.calledOnce;
      expect(got.post).to.be.calledWithMatch(webhooks[webhooks.length - 1].url, {
-        json: true,
-        body: {
+        json: {
          webhookType: 'groupChatReceived',
          user: {
            _id: user._id,
@@ -19,7 +19,7 @@ describe('analytics middleware', () => {
    next = generateNext();
  });

-  it('attaches analytics object res.locals', () => {
+  it('attaches analytics object to res', () => {
    const attachAnalytics = requireAgain(pathToAnalyticsMiddleware).default;

    attachAnalytics(req, res, next);
@@ -21,28 +21,11 @@ describe('cron middleware', () => {
    req;
  let user;

-  beforeEach(done => {
+  beforeEach(async () => {
    res = generateRes();
    req = generateReq();
-    user = new User({
-      auth: {
-        local: {
-          username: 'username',
-          lowerCaseUsername: 'username',
-          email: 'email@email.email',
-          salt: 'salt',
-          hashed_password: 'hashed_password', // eslint-disable-line camelcase
-        },
-      },
-    });
-
-    user.save()
-      .then(savedUser => {
-        res.locals.user = savedUser;
-        res.analytics = analyticsService;
-        done();
-      })
-      .catch(done);
+    user = await res.locals.user.save();
+    res.analytics = analyticsService;
  });

  afterEach(() => {
@@ -0,0 +1,94 @@
+import nconf from 'nconf';
+import requireAgain from 'require-again';
+import {
+  generateRes,
+  generateReq,
+  generateNext,
+} from '../../../helpers/api-unit.helper';
+import { Forbidden } from '../../../../website/server/libs/errors';
+import apiError from '../../../../website/server/libs/apiError';
+
+function checkErrorThrown (next) {
+  expect(next).to.have.been.calledOnce;
+  const calledWith = next.getCall(0).args;
+  expect(calledWith[0].message).to.equal(apiError('ipAddressBlocked'));
+  expect(calledWith[0] instanceof Forbidden).to.equal(true);
+}
+
+function checkErrorNotThrown (next) {
+  expect(next).to.have.been.calledOnce;
+  const calledWith = next.getCall(0).args;
+  expect(typeof calledWith[0] === 'undefined').to.equal(true);
+}
+
+describe('ipBlocker middleware', () => {
+  const pathToIpBlocker = '../../../../website/server/middlewares/ipBlocker';
+
+  let res; let req; let next;
+
+  beforeEach(() => {
+    res = generateRes();
+    req = generateReq();
+    next = generateNext();
+  });
+
+  it('is disabled when the env var is not defined', () => {
+    sandbox.stub(nconf, 'get').withArgs('BLOCKED_IPS').returns(undefined);
+    const attachIpBlocker = requireAgain(pathToIpBlocker).default;
+    attachIpBlocker(req, res, next);
+
+    checkErrorNotThrown(next);
+  });
+
+  it('is disabled when the env var is an empty string', () => {
+    sandbox.stub(nconf, 'get').withArgs('BLOCKED_IPS').returns('');
+    const attachIpBlocker = requireAgain(pathToIpBlocker).default;
+    attachIpBlocker(req, res, next);
+
+    checkErrorNotThrown(next);
+  });
+
+  it('is disabled when the env var contains comma separated empty strings', () => {
+    sandbox.stub(nconf, 'get').withArgs('BLOCKED_IPS').returns(' , , ');
+    const attachIpBlocker = requireAgain(pathToIpBlocker).default;
+    attachIpBlocker(req, res, next);
+
+    checkErrorNotThrown(next);
+  });
+
+  it('does not throw when the ip does not match', () => {
+    req.headers['x-forwarded-for'] = '192.168.1.1';
+    sandbox.stub(nconf, 'get').withArgs('BLOCKED_IPS').returns('192.168.1.2');
+    const attachIpBlocker = requireAgain(pathToIpBlocker).default;
+    attachIpBlocker(req, res, next);
+
+    checkErrorNotThrown(next);
+  });
+
+  it('throws when a matching ip exist in x-forwarded-for', () => {
+    req.headers['x-forwarded-for'] = '192.168.1.1';
+    sandbox.stub(nconf, 'get').withArgs('BLOCKED_IPS').returns('192.168.1.1');
+    const attachIpBlocker = requireAgain(pathToIpBlocker).default;
+    attachIpBlocker(req, res, next);
+
+    checkErrorThrown(next);
+  });
+
+  it('trims ips in x-forwarded-for', () => {
+    req.headers['x-forwarded-for'] = '192.168.1.1';
+    sandbox.stub(nconf, 'get').withArgs('BLOCKED_IPS').returns(',  192.168.1.1 ,   192.168.1.4, ');
+    const attachIpBlocker = requireAgain(pathToIpBlocker).default;
+    attachIpBlocker(req, res, next);
+
+    checkErrorThrown(next);
+  });
+
+  it('works when multiple ips are passed in x-forwarded-for', () => {
+    req.headers['x-forwarded-for'] = '192.168.1.4';
+    sandbox.stub(nconf, 'get').withArgs('BLOCKED_IPS').returns('192.168.1.1, 192.168.1.4, 192.168.1.3');
+    const attachIpBlocker = requireAgain(pathToIpBlocker).default;
+    attachIpBlocker(req, res, next);
+
+    checkErrorThrown(next);
+  });
+});
@@ -12,6 +12,9 @@ import { model as User } from '../../../../website/server/models/user';

 const { i18n } = common;

+// TODO some of the checks here can be simplified to simply check
+// that the right parameters are passed to the functions in libs/language
+
 describe('language middleware', () => {
  describe('res.t', () => {
    let res; let req; let
@@ -19,6 +22,8 @@ describe('language middleware', () => {

    beforeEach(() => {
      res = generateRes();
+      // remove the defaul user
+      res.locals.user = undefined;
      req = generateReq();
      next = generateNext();

@@ -57,6 +62,8 @@ describe('language middleware', () => {

    beforeEach(() => {
      res = generateRes();
+      // remove the defaul user
+      res.locals.user = undefined;
      req = generateReq();
      next = generateNext();
      attachTranslateFunction(req, res, next);
@@ -88,7 +95,7 @@ describe('language middleware', () => {
          lang: 'es',
        };

-        req.locals = {
+        res.locals = {
          user: {
            preferences: {
              language: 'it',
@@ -108,7 +115,7 @@ describe('language middleware', () => {

    context('authorized request', () => {
      it('uses the user preferred language if avalaible', () => {
-        req.locals = {
+        res.locals = {
          user: {
            preferences: {
              language: 'it',
@@ -122,7 +129,7 @@ describe('language middleware', () => {
      });

      it('falls back to english if the user preferred language is not avalaible', done => {
-        req.locals = {
+        res.locals = {
          user: {
            preferences: {
              language: 'bla',
@@ -138,7 +145,7 @@ describe('language middleware', () => {
      });

      it('uses the user preferred language even if a session is included in request', () => {
-        req.locals = {
+        res.locals = {
          user: {
            preferences: {
              language: 'it',
@@ -34,7 +34,7 @@ describe('response middleware', () => {
    expect(res.json).to.be.calledWith({
      success: true,
      data: { field: 1 },
-      notifications: [],
+      notifications: res.locals.user.notifications,
      userV: res.locals.user._v,
      appVersion: packageInfo.version,
    });
@@ -52,7 +52,7 @@ describe('response middleware', () => {
      success: true,
      data: { field: 1 },
      message: 'hello',
-      notifications: [],
+      notifications: res.locals.user.notifications,
      userV: res.locals.user._v,
      appVersion: packageInfo.version,
    });
@@ -69,7 +69,7 @@ describe('response middleware', () => {
    expect(res.json).to.be.calledWith({
      success: false,
      data: { field: 1 },
-      notifications: [],
+      notifications: res.locals.user.notifications,
      userV: res.locals.user._v,
      appVersion: packageInfo.version,
    });
@@ -84,42 +84,9 @@ describe('response middleware', () => {
    expect(res.json).to.be.calledWith({
      success: true,
      data: { field: 1 },
-      notifications: [],
+      notifications: res.locals.user.notifications,
      userV: 0,
      appVersion: packageInfo.version,
    });
  });
-
-  it('returns notifications if a user is authenticated', () => {
-    const { user } = res.locals;
-
-    user.notifications = [
-      null, // invalid, not an object
-      { seen: true }, // invalid, no type or id
-      { id: 123 }, // invalid, no type
-      // invalid, no id, not included here because the id would be added automatically
-      // {type: 'ABC'},
-      { type: 'ABC', id: '123' }, // valid
-    ];
-
-    responseMiddleware(req, res, next);
-    res.respond(200, { field: 1 });
-
-    expect(res.json).to.be.calledOnce;
-
-    expect(res.json).to.be.calledWith({
-      success: true,
-      data: { field: 1 },
-      notifications: [
-        {
-          type: 'ABC',
-          id: '123',
-          data: {},
-          seen: false,
-        },
-      ],
-      userV: res.locals.user._v,
-      appVersion: packageInfo.version,
-    });
-  });
 });
@@ -90,7 +90,37 @@ describe('Challenge Model', () => {
        expect(syncedTask.tags[0]).to.eql(challenge._id);
      });

-      it('syncs a challenge to a user', async () => {
+      it('adds a challenge to a user', async () => {
+        const newMember = new User({
+          guilds: [guild._id],
+        });
+        await newMember.save();
+
+        const addedSuccessfully = await challenge.addToUser(newMember);
+
+        const updatedNewMember = await User.findById(newMember._id);
+
+        expect(addedSuccessfully).to.eql(true);
+        expect(updatedNewMember.challenges).to.contain(challenge._id);
+      });
+
+      it('does not add a challenge to a user that already in the challenge', async () => {
+        const newMember = new User({
+          guilds: [guild._id],
+          challenges: [challenge._id],
+        });
+        await newMember.save();
+
+        const addedSuccessfully = await challenge.addToUser(newMember);
+
+        const updatedNewMember = await User.findById(newMember._id);
+
+        expect(addedSuccessfully).to.eql(false);
+        expect(updatedNewMember.challenges).to.contain(challenge._id);
+        expect(updatedNewMember.challenges.length).to.eql(1);
+      });
+
+      it('syncs challenge tasks to a user', async () => {
        await challenge.addTasks([task]);

        const newMember = new User({
@@ -98,7 +128,7 @@ describe('Challenge Model', () => {
        });
        await newMember.save();

-        await challenge.syncToUser(newMember);
+        await challenge.syncTasksToUser(newMember);

        const updatedNewMember = await User.findById(newMember._id);
        const updatedNewMemberTasks = await Tasks.Task.find({ _id: { $in: updatedNewMember.tasksOrder[`${taskType}s`] } });
@@ -110,14 +140,13 @@ describe('Challenge Model', () => {
          ),
        );

-        expect(updatedNewMember.challenges).to.contain(challenge._id);
        expect(updatedNewMember.tags[7].id).to.equal(challenge._id);
        expect(updatedNewMember.tags[7].name).to.equal(challenge.shortName);
        expect(syncedTask).to.exist;
        expect(syncedTask.attribute).to.eql('str');
      });

-      it('syncs a challenge to a user with the existing task', async () => {
+      it('syncs challenge tasks to a user with the existing task', async () => {
        await challenge.addTasks([task]);

        let updatedLeader = await User.findOne({ _id: leader._id });
@@ -134,7 +163,7 @@ describe('Challenge Model', () => {
        task.text = newTitle;
        task.attribute = 'int';
        await task.save();
-        await challenge.syncToUser(leader);
+        await challenge.syncTasksToUser(leader);

        updatedLeader = await User.findOne({ _id: leader._id });
        updatedLeadersTasks = await Tasks.Task.find({ _id: { $in: updatedLeader.tasksOrder[`${taskType}s`] } });
@@ -1164,6 +1164,23 @@ describe('Group Model', () => {
        });
      });

+      it('unlink group tag', async () => {
+        participatingMember.tags.push({
+          name: party.name,
+          id: party._id,
+          group: party._id,
+        });
+
+        await participatingMember.save();
+        await party.leave(participatingMember);
+
+        participatingMember = await User.findOne({ _id: participatingMember._id });
+        const groupTag = participatingMember.tags.find(tag => tag.id === party._id);
+
+        expect(groupTag).to.not.be.undefined;
+        expect(groupTag.group).to.be.undefined;
+      });
+
      it('deletes a private party when the last member leaves', async () => {
        await party.leave(participatingMember);
        await party.leave(sleepingParticipatingMember);
@@ -1317,7 +1334,7 @@ describe('Group Model', () => {

      it('formats message', () => {
        const chatMessage = party.sendChat({
-          message: 'a new message',
+          message: 'a _new_ message with *markdown*',
          user: {
            _id: 'user-id',
            profile: { name: 'user name' },
@@ -1336,7 +1353,8 @@ describe('Group Model', () => {

        const chat = chatMessage;

-        expect(chat.text).to.eql('a new message');
+        expect(chat.text).to.eql('a _new_ message with *markdown*');
+        expect(chat.unformattedText).to.eql('a new message with markdown');
        expect(validator.isUUID(chat.id)).to.eql(true);
        expect(chat.timestamp).to.be.a('date');
        expect(chat.likes).to.eql({});
@@ -1878,6 +1896,8 @@ describe('Group Model', () => {
        await questLeader.save();
        await party.finishQuest(quest);

+        await sleep(0.5);
+
        const [
          updatedLeader,
          updatedParticipatingMember,
@@ -0,0 +1,18 @@
+import { sanitizeText } from '../../../../website/server/models/message';
+import { MAX_MESSAGE_LENGTH } from '../../../../website/common/script/constants';
+
+describe('Message Model', () => {
+  context('sanitizeText', () => {
+    it('trims messages to the max length', () => {
+      const veryLongMessage = `
+      123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789.
+      THIS PART WON'T BE IN THE MESSAGE (over 3000)
+      `;
+      expect(veryLongMessage.length > MAX_MESSAGE_LENGTH).to.equal(true);
+
+      const sanitizedText = sanitizeText(veryLongMessage);
+      expect(sanitizedText).to.not.contain('MESSAGE');
+      expect(sanitizedText.length).to.equal(MAX_MESSAGE_LENGTH);
+    });
+  });
+});
@@ -0,0 +1,33 @@
+import { model as PushDevice } from '../../../../website/server/models/pushDevice';
+
+describe('PushDevice Model', () => {
+  context('cleanupCorruptData', () => {
+    it('converts an array of push devices to a safe version', () => {
+      const pushDevices = [
+        null, // invalid, not an object
+        { regId: '123' }, // invalid, no type
+        { type: 'android' }, // invalid, no regId
+        new PushDevice({ type: 'android', regId: '1234' }), // valid
+      ];
+
+      const safePushDevices = PushDevice.cleanupCorruptData(pushDevices);
+      expect(safePushDevices.length).to.equal(1);
+      expect(safePushDevices[0].type).to.equal('android');
+      expect(safePushDevices[0].regId).to.equal('1234');
+    });
+
+    it('removes duplicates', () => {
+      const pushDevices = [
+        new PushDevice({ type: 'android', regId: '1234' }),
+        new PushDevice({ type: 'android', regId: '1234' }),
+        new PushDevice({ type: 'iphone', regId: '1234' }), // not duplicate
+        new PushDevice({ type: 'android', regId: '12345' }), // not duplicate
+      ];
+
+      const safePushDevices = PushDevice.cleanupCorruptData(pushDevices);
+      expect(safePushDevices.length).to.equal(3);
+      expect(safePushDevices[0].type).to.equal('android');
+      expect(safePushDevices[0].regId).to.equal('1234');
+    });
+  });
+});
@@ -0,0 +1,19 @@
+import { model as Tag } from '../../../../website/server/models/tag';
+
+describe('Tag Model', () => {
+  context('cleanupCorruptData', () => {
+    it('converts an array of tags to a safe version', () => {
+      const tags = [
+        null, // invalid, not an object
+        { name: '123' }, // invalid, no id
+        { id: '123' }, // invalid, no name
+        new Tag({ name: 'ABC', id: 123 }), // valid
+      ];
+
+      const safetags = Tag.cleanupCorruptData(tags);
+      expect(safetags.length).to.equal(1);
+      expect(safetags[0].name).to.equal('ABC');
+      expect(safetags[0].id).to.equal('123');
+    });
+  });
+});
@@ -84,6 +84,243 @@ describe('User Model', () => {
    expect(userToJSON.stats.toNextLevel).to.equal(common.tnl(user.stats.lvl));
  });

+  context('achievements', () => {
+    it('can add an achievement', () => {
+      const user = new User();
+      const originalUserToJSON = user.toJSON({ minimize: false });
+      expect(originalUserToJSON.achievements.createdTask).to.not.eql(true);
+      const notificationsN = originalUserToJSON.notifications.length;
+
+      user.addAchievement('createdTask');
+
+      const userToJSON = user.toJSON();
+      expect(user.notifications.length).to.equal(notificationsN + 1);
+      expect(userToJSON.notifications[0]).to.have.all.keys(['data', 'id', 'type', 'seen']);
+      expect(userToJSON.notifications[0].type).to.equal('ACHIEVEMENT');
+      expect(userToJSON.notifications[0].data).to.eql({
+        achievement: 'createdTask',
+      });
+      expect(userToJSON.notifications[0].seen).to.eql(false);
+
+      expect(userToJSON.achievements.createdTask).to.eql(true);
+    });
+
+    it('throws an error if the achievement is not valid', () => {
+      const user = new User();
+      expect(() => user.addAchievement('notAnAchievement')).to.throw;
+    });
+
+    context('static push method', () => {
+      it('throws an error if the achievement is not valid', async () => {
+        const user = new User();
+        await user.save();
+
+        await expect(User.addAchievementUpdate({ _id: user._id }, 'notAnAchievement'))
+          .to.eventually.be.rejected;
+
+        expect(() => user.addAchievement('notAnAchievement')).to.throw;
+      });
+
+      it('adds an achievement for a single member via static method', async () => {
+        let user = new User();
+        await user.save();
+
+        const originalUserToJSON = user.toJSON({ minimize: false });
+        expect(originalUserToJSON.achievements.createdTask).to.not.eql(true);
+        const notificationsN = originalUserToJSON.notifications.length;
+
+        await User.addAchievementUpdate({ _id: user._id }, 'createdTask');
+
+        user = await User.findOne({ _id: user._id }).exec();
+
+        const userToJSON = user.toJSON();
+        expect(user.notifications.length).to.equal(notificationsN + 1);
+        expect(userToJSON.notifications[0]).to.have.all.keys(['data', 'id', 'type', 'seen']);
+        expect(userToJSON.notifications[0].type).to.equal('ACHIEVEMENT');
+        expect(userToJSON.notifications[0].data).to.eql({
+          achievement: 'createdTask',
+        });
+        expect(userToJSON.notifications[0].seen).to.eql(false);
+
+        expect(userToJSON.achievements.createdTask).to.eql(true);
+      });
+
+      it('adds an achievement for all given users via static method', async () => {
+        let user = new User();
+        const otherUser = new User();
+        await Promise.all([user.save(), otherUser.save()]);
+
+        await User.addAchievementUpdate({ _id: { $in: [user._id, otherUser._id] } }, 'createdTask');
+
+        user = await User.findOne({ _id: user._id }).exec();
+
+        let userToJSON = user.toJSON();
+        expect(user.notifications.length).to.equal(1);
+        expect(userToJSON.notifications[0]).to.have.all.keys(['data', 'id', 'type', 'seen']);
+        expect(userToJSON.notifications[0].type).to.equal('ACHIEVEMENT');
+        expect(userToJSON.notifications[0].data).to.eql({
+          achievement: 'createdTask',
+        });
+        expect(userToJSON.notifications[0].seen).to.eql(false);
+
+        expect(userToJSON.achievements.createdTask).to.eql(true);
+
+        user = await User.findOne({ _id: otherUser._id }).exec();
+
+        userToJSON = user.toJSON();
+        expect(user.notifications.length).to.equal(1);
+        expect(userToJSON.notifications[0]).to.have.all.keys(['data', 'id', 'type', 'seen']);
+        expect(userToJSON.notifications[0].type).to.equal('ACHIEVEMENT');
+        expect(userToJSON.notifications[0].data).to.eql({
+          achievement: 'createdTask',
+        });
+        expect(userToJSON.notifications[0].seen).to.eql(false);
+
+        expect(userToJSON.achievements.createdTask).to.eql(true);
+      });
+    });
+  });
+
+  context('post init', () => {
+    it('removes invalid tags when loading the user', async () => {
+      let user = new User();
+      await user.save();
+      await user.update({
+        $set: {
+          tags: [
+            null, // invalid, not an object
+            // { name: '123' }, // invalid, no id - generated automatically
+            { id: '123' }, // invalid, no name
+            { name: 'ABC', id: '1234' }, // valid
+          ],
+        },
+      }).exec();
+
+      user = await User.findById(user._id).exec();
+
+      const userToJSON = user.toJSON();
+      expect(userToJSON.tags.length).to.equal(1);
+
+      expect(userToJSON.tags[0]).to.have.all.keys(['id', 'name']);
+      expect(userToJSON.tags[0].id).to.equal('1234');
+      expect(userToJSON.tags[0].name).to.equal('ABC');
+    });
+
+    it('removes invalid push devices when loading the user', async () => {
+      let user = new User();
+      await user.save();
+      await user.update({
+        $set: {
+          pushDevices: [
+            null, // invalid, not an object
+            { regId: '123' }, // invalid, no type
+            { type: 'android' }, // invalid, no regId
+            { type: 'android', regId: '1234' }, // valid
+          ],
+        },
+      }).exec();
+
+      user = await User.findById(user._id).exec();
+
+      const userToJSON = user.toJSON();
+      expect(userToJSON.pushDevices.length).to.equal(1);
+
+      expect(userToJSON.pushDevices[0]).to.have.all.keys(['regId', 'type', 'createdAt', 'updatedAt']);
+      expect(userToJSON.pushDevices[0].type).to.equal('android');
+      expect(userToJSON.pushDevices[0].regId).to.equal('1234');
+    });
+
+    it('removes duplicate push devices when loading the user', async () => {
+      let user = new User();
+      await user.save();
+      await user.update({
+        $set: {
+          pushDevices: [
+            { type: 'android', regId: '1234' },
+            { type: 'android', regId: '1234' },
+          ],
+        },
+      }).exec();
+
+      user = await User.findById(user._id).exec();
+
+      const userToJSON = user.toJSON();
+      expect(userToJSON.pushDevices.length).to.equal(1);
+
+      expect(userToJSON.pushDevices[0]).to.have.all.keys(['regId', 'type', 'createdAt', 'updatedAt']);
+      expect(userToJSON.pushDevices[0].type).to.equal('android');
+      expect(userToJSON.pushDevices[0].regId).to.equal('1234');
+    });
+
+    it('removes invalid notifications when loading the user', async () => {
+      let user = new User();
+      await user.save();
+      await user.update({
+        $set: {
+          notifications: [
+            null, // invalid, not an object
+            { seen: true }, // invalid, no type or id
+            { id: 123 }, // invalid, no type
+            // invalid, no id, not included here because the id would be added automatically
+            // {type: 'ABC'},
+            { type: 'ABC', id: '123' }, // valid
+          ],
+        },
+      }).exec();
+
+      user = await User.findById(user._id).exec();
+
+      const userToJSON = user.toJSON();
+      expect(userToJSON.notifications.length).to.equal(1);
+
+      expect(userToJSON.notifications[0]).to.have.all.keys(['data', 'id', 'type', 'seen']);
+      expect(userToJSON.notifications[0].type).to.equal('ABC');
+      expect(userToJSON.notifications[0].id).to.equal('123');
+    });
+
+    it('removes multiple NEW_CHAT_MESSAGE for the same group', async () => {
+      let user = new User();
+      await user.save();
+      await user.update({
+        $set: {
+          notifications: [
+            {
+              type: 'NEW_CHAT_MESSAGE',
+              id: 123,
+              data: { group: { id: 12345 } },
+            },
+            {
+              type: 'NEW_CHAT_MESSAGE',
+              id: 1234,
+              data: { group: { id: 12345 } },
+            },
+            {
+              type: 'NEW_CHAT_MESSAGE',
+              id: 123,
+              data: { group: { id: 123456 } },
+            }, // not duplicate, different group
+            {
+              type: 'NEW_CHAT_MESSAGE_DIFF',
+              id: 123,
+              data: { group: { id: 12345 } },
+            }, // not duplicate, different type
+          ],
+        },
+      }).exec();
+
+      user = await User.findById(user._id).exec();
+
+      const userToJSON = user.toJSON();
+      expect(userToJSON.notifications.length).to.equal(3);
+
+      expect(userToJSON.notifications[0]).to.have.all.keys(['data', 'id', 'type', 'seen']);
+      expect(userToJSON.notifications[0].type).to.equal('NEW_CHAT_MESSAGE');
+      expect(userToJSON.notifications[0].id).to.equal('123');
+      expect(userToJSON.notifications[0].data).to.deep.equal({ group: { id: 12345 } });
+      expect(userToJSON.notifications[0].seen).to.equal(false);
+    });
+  });
+
  context('notifications', () => {
    it('can add notifications without data', () => {
      const user = new User();
@@ -98,26 +335,6 @@ describe('User Model', () => {
      expect(userToJSON.notifications[0].seen).to.eql(false);
    });

-    it('removes invalid notifications when calling toJSON', () => {
-      const user = new User();
-
-      user.notifications = [
-        null, // invalid, not an object
-        { seen: true }, // invalid, no type or id
-        { id: 123 }, // invalid, no type
-        // invalid, no id, not included here because the id would be added automatically
-        // {type: 'ABC'},
-        { type: 'ABC', id: '123' }, // valid
-      ];
-
-      const userToJSON = user.toJSON();
-      expect(userToJSON.notifications.length).to.equal(1);
-
-      expect(userToJSON.notifications[0]).to.have.all.keys(['data', 'id', 'type', 'seen']);
-      expect(userToJSON.notifications[0].type).to.equal('ABC');
-      expect(userToJSON.notifications[0].id).to.equal('123');
-    });
-
    it('can add notifications with data and already marked as seen', () => {
      const user = new User();

@@ -1,7 +1,7 @@
 import { model as UserNotification } from '../../../../website/server/models/userNotification';

 describe('UserNotification Model', () => {
-  context('convertNotificationsToSafeJson', () => {
+  context('cleanupCorruptData', () => {
    it('converts an array of notifications to a safe version', () => {
      const notifications = [
        null, // invalid, not an object
@@ -11,11 +11,44 @@ describe('UserNotification Model', () => {
        new UserNotification({ type: 'ABC', id: 123 }), // valid
      ];

-      const notificationsToJSON = UserNotification.convertNotificationsToSafeJson(notifications);
-      expect(notificationsToJSON.length).to.equal(1);
-      expect(notificationsToJSON[0]).to.have.all.keys(['data', 'id', 'type', 'seen']);
-      expect(notificationsToJSON[0].type).to.equal('ABC');
-      expect(notificationsToJSON[0].id).to.equal('123');
+      const safeNotifications = UserNotification.cleanupCorruptData(notifications);
+      expect(safeNotifications.length).to.equal(1);
+      expect(safeNotifications[0].data).to.deep.equal({});
+      expect(safeNotifications[0].seen).to.equal(false);
+      expect(safeNotifications[0].type).to.equal('ABC');
+      expect(safeNotifications[0].id).to.equal('123');
+    });
+
+    it('removes multiple NEW_CHAT_MESSAGE for the same group', () => {
+      const notifications = [
+        new UserNotification({
+          type: 'NEW_CHAT_MESSAGE',
+          id: 123,
+          data: { group: { id: 12345 } },
+        }),
+        new UserNotification({
+          type: 'NEW_CHAT_MESSAGE',
+          id: 1234,
+          data: { group: { id: 12345 } },
+        }),
+        new UserNotification({
+          type: 'NEW_CHAT_MESSAGE',
+          id: 123,
+          data: { group: { id: 123456 } },
+        }), // not duplicate, different group
+        new UserNotification({
+          type: 'NEW_CHAT_MESSAGE_DIFF',
+          id: 123,
+          data: { group: { id: 12345 } },
+        }), // not duplicate, different type
+      ];
+
+      const safeNotifications = UserNotification.cleanupCorruptData(notifications);
+      expect(safeNotifications.length).to.equal(3);
+      expect(safeNotifications[0].data).to.deep.equal({ group: { id: 12345 } });
+      expect(safeNotifications[0].seen).to.equal(false);
+      expect(safeNotifications[0].type).to.equal('NEW_CHAT_MESSAGE');
+      expect(safeNotifications[0].id).to.equal('123');
    });
  });
 });
@@ -183,6 +183,7 @@ describe('Webhook Model', () => {
            options: {
              questStarted: true,
              questFinished: true,
+              questInvited: true,
            },
          };
        });
@@ -197,6 +198,7 @@ describe('Webhook Model', () => {
          expect(wh.options).to.eql({
            questStarted: false,
            questFinished: false,
+            questInvited: false,
          });
        });

@@ -210,6 +212,7 @@ describe('Webhook Model', () => {
          expect(wh.options).to.eql({
            questStarted: false,
            questFinished: true,
+            questInvited: true,
          });
        });

@@ -224,6 +227,7 @@ describe('Webhook Model', () => {
          expect(wh.options).to.eql({
            questStarted: true,
            questFinished: true,
+            questInvited: true,
          });
        });

@@ -187,8 +187,7 @@ describe('GET challenges/groups/:groupId', () => {
  });

  context('official challenge is present', () => {
-    let publicGuild; let user; let officialChallenge; let challenge; let
-      challenge2;
+    let publicGuild; let user; let officialChallenge; let unofficialChallenges;

    before(async () => {
      const { group, groupLeader } = await createAndPopulateGroup({
@@ -214,10 +213,14 @@ describe('GET challenges/groups/:groupId', () => {
      });
      await user.post(`/challenges/${officialChallenge._id}/join`);

-      challenge = await generateChallenge(user, group);
-      await user.post(`/challenges/${challenge._id}/join`);
-      challenge2 = await generateChallenge(user, group);
-      await user.post(`/challenges/${challenge2._id}/join`);
+      // We add 10 extra challenges to test whether the official challenge
+      // (the oldest) makes it to the front page.
+      unofficialChallenges = [];
+      for (let i = 0; i < 10; i += 1) {
+        const challenge = await generateChallenge(user, group); // eslint-disable-line
+        await user.post(`/challenges/${challenge._id}/join`); // eslint-disable-line
+        unofficialChallenges.push(challenge);
+      }
    });

    it('should return official challenges first', async () => {
@@ -230,18 +233,17 @@ describe('GET challenges/groups/:groupId', () => {
    it('should return newest challenges first, after official ones', async () => {
      let challenges = await user.get(`/challenges/groups/${publicGuild._id}`);

-      let foundChallengeIndex = _.findIndex(challenges, { _id: challenge._id });
-      expect(foundChallengeIndex).to.eql(2);
-
-      foundChallengeIndex = _.findIndex(challenges, { _id: challenge2._id });
-      expect(foundChallengeIndex).to.eql(1);
+      unofficialChallenges.forEach((chal, index) => {
+        const foundChallengeIndex = _.findIndex(challenges, { _id: chal._id });
+        expect(foundChallengeIndex).to.eql(10 - index);
+      });

      const newChallenge = await generateChallenge(user, publicGuild);
      await user.post(`/challenges/${newChallenge._id}/join`);

      challenges = await user.get(`/challenges/groups/${publicGuild._id}`);

-      foundChallengeIndex = _.findIndex(challenges, { _id: newChallenge._id });
+      const foundChallengeIndex = _.findIndex(challenges, { _id: newChallenge._id });
      expect(foundChallengeIndex).to.eql(1);
    });
  });
@@ -242,7 +242,7 @@ describe('GET challenges/user', () => {
  });

  context('official challenge is present', () => {
-    let user; let officialChallenge; let challenge; let challenge2; let
+    let user; let officialChallenge; let unofficialChallenges; let
      publicGuild;

    before(async () => {
@@ -270,10 +270,14 @@ describe('GET challenges/user', () => {
      });
      await user.post(`/challenges/${officialChallenge._id}/join`);

-      challenge = await generateChallenge(user, group);
-      await user.post(`/challenges/${challenge._id}/join`);
-      challenge2 = await generateChallenge(user, group);
-      await user.post(`/challenges/${challenge2._id}/join`);
+      // We add 10 extra challenges to test whether the official challenge
+      // (the oldest) makes it to the front page.
+      unofficialChallenges = [];
+      for (let i = 0; i < 10; i += 1) {
+        const challenge = await generateChallenge(user, group); // eslint-disable-line
+        await user.post(`/challenges/${challenge._id}/join`); // eslint-disable-line
+        unofficialChallenges.push(challenge);
+      }
    });

    it('should return official challenges first', async () => {
@@ -284,20 +288,23 @@ describe('GET challenges/user', () => {
    });

    it('should return newest challenges first, after official ones', async () => {
-      let challenges = await user.get('/challenges/user');
+      let challenges = await user.get('/challenges/user?page=0');

-      let foundChallengeIndex = _.findIndex(challenges, { _id: challenge._id });
-      expect(foundChallengeIndex).to.eql(2);
-
-      foundChallengeIndex = _.findIndex(challenges, { _id: challenge2._id });
-      expect(foundChallengeIndex).to.eql(1);
+      unofficialChallenges.forEach((chal, index) => {
+        const foundChallengeIndex = _.findIndex(challenges, { _id: chal._id });
+        if (index === 0) {
+          expect(foundChallengeIndex).to.eql(-1);
+        } else {
+          expect(foundChallengeIndex).to.eql(10 - index);
+        }
+      });

      const newChallenge = await generateChallenge(user, publicGuild);
      await user.post(`/challenges/${newChallenge._id}/join`);

      challenges = await user.get('/challenges/user');

-      foundChallengeIndex = _.findIndex(challenges, { _id: newChallenge._id });
+      const foundChallengeIndex = _.findIndex(challenges, { _id: newChallenge._id });
      expect(foundChallengeIndex).to.eql(1);
    });
  });
@@ -251,7 +251,7 @@ describe('POST /challenges', () => {
      expect(groupLeader.balance).to.eql(oldUserBalance);
    });

-    it('sets all properites of the challenge as passed', async () => {
+    it('sets all properties of the challenge as passed', async () => {
      const name = 'Test Challenge';
      const shortName = 'TC Label';
      const description = 'Test Description';
@@ -13,7 +13,7 @@ import {
  SPAM_MIN_EXEMPT_CONTRIB_LEVEL,
  TAVERN_ID,
 } from '../../../../../website/server/models/group';
-import { CHAT_FLAG_FROM_SHADOW_MUTE } from '../../../../../website/common/script/constants';
+import { CHAT_FLAG_FROM_SHADOW_MUTE, MAX_MESSAGE_LENGTH } from '../../../../../website/common/script/constants';
 import { getMatchesByWordArray } from '../../../../../website/server/libs/stringUtils';
 import bannedWords from '../../../../../website/server/libs/bannedWords';
 import guildsAllowingBannedWords from '../../../../../website/server/libs/guildsAllowingBannedWords';
@@ -494,6 +494,7 @@ describe('POST /chat', () => {
    123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789.
    THIS PART WON'T BE IN THE MESSAGE (over 3000)
    `;
+    expect(veryLongMessage.length > MAX_MESSAGE_LENGTH).to.equal(true);

    const newMessage = await user.post(`/groups/${groupWithChat._id}/chat`, { message: veryLongMessage });
    const groupMessages = await user.get(`/groups/${groupWithChat._id}/chat`);
@@ -501,9 +502,27 @@ describe('POST /chat', () => {
    expect(newMessage.message.id).to.exist;
    expect(groupMessages[0].id).to.exist;

-    expect(newMessage.message.text.length).to.eql(3000);
+    expect(newMessage.message.text.length).to.eql(MAX_MESSAGE_LENGTH);
    expect(newMessage.message.text).to.not.contain('MESSAGE');
-    expect(groupMessages[0].text.length).to.eql(3000);
+    expect(groupMessages[0].text.length).to.eql(MAX_MESSAGE_LENGTH);
+  });
+
+  it('chat message with mentions - mention link should not count towards 3000 chars limit', async () => {
+    const memberUsername = 'memberUsername';
+    await member.update({ 'auth.local.username': memberUsername });
+
+    const messageWithMentions = `hi @${memberUsername} 123456789 
+    123456789 123456789 123456789 123456789 123456789 123456789 89 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 12345678 END.`;
+    expect(messageWithMentions.length).to.equal(MAX_MESSAGE_LENGTH);
+    const newMessage = await user.post(`/groups/${groupWithChat._id}/chat`, { message: messageWithMentions });
+    const groupMessages = await user.get(`/groups/${groupWithChat._id}/chat`);
+
+    const mentionLink = `[@${memberUsername}](/profile/${member._id})`;
+    expect(newMessage.message.text).to.include(mentionLink);
+    expect(newMessage.message.text).to.include(' END.');
+    expect(newMessage.message.text.length)
+      .to.eql(messageWithMentions.length - (`@${memberUsername}`).length + mentionLink.length);
+    expect(groupMessages[0].text.length).to.eql(newMessage.message.text.length);
  });

  it('creates a chat with user styles', async () => {
@@ -11,7 +11,9 @@ import apiError from '../../../../../website/server/libs/apiError';

 describe('GET /groups', () => {
  let user;
+  let userInGuild;
  const NUMBER_OF_PUBLIC_GUILDS = 3; // 2 + the tavern
+  const NUMBER_OF_PUBLIC_GUILDS_USER_IS_LEADER = 2;
  const NUMBER_OF_PUBLIC_GUILDS_USER_IS_MEMBER = 1;
  const NUMBER_OF_USERS_PRIVATE_GUILDS = 1;
  const NUMBER_OF_GROUPS_USER_CAN_VIEW = 5;
@@ -33,14 +35,20 @@ describe('GET /groups', () => {
      name: 'public guild - is member',
      type: 'guild',
      privacy: 'public',
+      summary: 'ohayou kombonwa',
+      description: 'oyasumi',
    });
    await leader.post(`/groups/${publicGuildUserIsMemberOf._id}/invite`, { uuids: [user._id] });
    await user.post(`/groups/${publicGuildUserIsMemberOf._id}/join`);

+    userInGuild = await generateUser({ guilds: [publicGuildUserIsMemberOf._id] });
+
    publicGuildNotMember = await generateGroup(leader, {
      name: 'public guild - is not member',
      type: 'guild',
      privacy: 'public',
+      summary: 'Natsume Soseki',
+      description: 'Kinnosuke no Hondana',
      categories,
    });

@@ -150,6 +158,35 @@ describe('GET /groups', () => {

      expect(guilds.length).to.equal(0);
    });
+
+    it('filters public guilds by leader role', async () => {
+      const guilds = await user.get('/groups?type=publicGuilds&leader=true');
+      expect(guilds.length).to.equal(NUMBER_OF_PUBLIC_GUILDS_USER_IS_LEADER);
+    });
+
+    it('filters public guilds by member role', async () => {
+      const guilds = await userInGuild.get('/groups?type=publicGuilds&member=true');
+      expect(guilds.length).to.equal(1);
+      expect(guilds[0].name).to.have.string('is member');
+    });
+
+    it('filters public guilds by single-word search term', async () => {
+      const guilds = await user.get('/groups?type=publicGuilds&search=kom');
+      expect(guilds.length).to.equal(1);
+      expect(guilds[0].summary).to.have.string('ohayou kombonwa');
+    });
+
+    it('filters public guilds by single-word search term left and right-padded by spaces', async () => {
+      const guilds = await user.get('/groups?type=publicGuilds&search=++++ohayou+kombonwa+++++');
+      expect(guilds.length).to.equal(1);
+      expect(guilds[0].summary).to.have.string('ohayou kombonwa');
+    });
+
+    it('filters public guilds by two-words search term separated by multiple spaces', async () => {
+      const guilds = await user.get('/groups?type=publicGuilds&search=kinnosuke+++++hon');
+      expect(guilds.length).to.equal(1);
+      expect(guilds[0].description).to.have.string('Kinnosuke');
+    });
  });

  describe('public guilds pagination', () => {
@@ -177,7 +177,7 @@ describe('GET /groups/:id', () => {
        });
    });

-    it('removes non-existant guild from user\'s guild list', async () => {
+    it('removes non-existent guild from user\'s guild list', async () => {
      const guildId = generateUUID();

      await user.update({
@@ -197,7 +197,7 @@ describe('GET /groups/:id', () => {
      expect(user.guilds).to.not.include(guildId);
    });

-    it('removes non-existant party from user\'s party object', async () => {
+    it('removes non-existent party from user\'s party object', async () => {
      const partyId = generateUUID();

      await user.update({
@@ -210,7 +210,7 @@ describe('POST /groups/:groupId/leave', () => {
        expect(userWithoutInvitation.invitations.guilds).to.not.be.empty;
      });

-      it('deletes non existant guild from user when user tries to leave', async () => {
+      it('deletes non existent guild from user when user tries to leave', async () => {
        const nonExistentGuildId = generateUUID();
        const userWithNonExistentGuild = await generateUser({ guilds: [nonExistentGuildId] });
        expect(userWithNonExistentGuild.guilds).to.contain(nonExistentGuildId);
@@ -258,7 +258,7 @@ describe('POST /groups/:groupId/leave', () => {
      });
    });

-    it('deletes non existant party from user when user tries to leave', async () => {
+    it('deletes non existent party from user when user tries to leave', async () => {
      const nonExistentPartyId = generateUUID();
      const userWithNonExistentParty = await generateUser({ 'party._id': nonExistentPartyId });
      expect(userWithNonExistentParty.party._id).to.eql(nonExistentPartyId);
@@ -6,7 +6,8 @@ import {

 describe('POST /members/send-private-message', () => {
  let userToSendMessage;
-  const messageToSend = 'Test Private Message';
+  const messageToSend = 'Test *Private* Message';
+  const unformattedMessage = 'Test Private Message';

  beforeEach(async () => {
    userToSendMessage = await generateUser();
@@ -65,7 +66,7 @@ describe('POST /members/send-private-message', () => {
    })).to.eventually.be.rejected.and.eql({
      code: 401,
      error: 'NotAuthorized',
-      message: t('notAuthorizedToSendMessageToThisUser'),
+      message: t('blockedToSendToThisUser'),
    });
  });

@@ -110,7 +111,9 @@ describe('POST /members/send-private-message', () => {

    const sendersMessageInReceiversInbox = _.find(
      updatedReceiver.inbox.messages,
-      message => message.uuid === userToSendMessage._id && message.text === messageToSend,
+      message => message.uuid === userToSendMessage._id
+        && message.text === messageToSend
+        && message.unformattedText === unformattedMessage,
    );

    const sendersMessageInSendersInbox = _.find(
@@ -89,7 +89,7 @@ describe('POST /members/transfer-gems', () => {
    })).to.eventually.be.rejected.and.eql({
      code: 401,
      error: 'NotAuthorized',
-      message: t('notAuthorizedToSendMessageToThisUser'),
+      message: t('blockedToSendToThisUser'),
    });
  });

@@ -29,7 +29,7 @@ describe('payments - amazon - #checkout', () => {
      amzLib.checkout.restore();
    });

-    it('makes a purcahse with amazon checkout', async () => {
+    it('makes a purchase with amazon checkout', async () => {
      user = await generateUser({
        'profile.name': 'sender',
        'purchased.plan.customerId': 'customer-id',
@@ -17,7 +17,7 @@ describe('payments - stripe - #checkout', () => {
    await expect(user.post(endpoint, { id: 123 })).to.eventually.be.rejected.and.include({
      code: 401,
      error: 'Error',
-      message: 'Invalid API Key provided: aaaabbbb********************1111',
+      // message: 'Invalid API Key provided: aaaabbbb********************1111',
    });
  });

@@ -100,7 +100,7 @@ describe('POST /groups/:groupId/quests/accept', () => {
        .to.eventually.be.rejected.and.eql({
          code: 401,
          error: 'NotAuthorized',
-          message: t('questAlreadyUnderway'),
+          message: t('questAlreadyStartedFriendly'),
        });
    });
  });
@@ -73,7 +73,7 @@ describe('POST /groups/:groupId/quests/force-start', () => {
        .to.eventually.be.rejected.and.eql({
          code: 401,
          error: 'NotAuthorized',
-          message: t('questAlreadyUnderway'),
+          message: t('questAlreadyStarted'),
        });
    });

@@ -2,6 +2,7 @@ import { v4 as generateUUID } from 'uuid';
 import {
  createAndPopulateGroup,
  translate as t,
+  server,
  sleep,
 } from '../../../../helpers/api-integration/v3';
 import { quests as questScrolls } from '../../../../../website/common/script/content/quests';
@@ -210,5 +211,39 @@ describe('POST /groups/:groupId/quests/invite/:questKey', () => {
      const returnedGroup = await groupLeader.get(`/groups/${group._id}`);
      expect(returnedGroup.chat[0]._meta).to.be.undefined;
    });
+
+    context('sending quest activity webhooks', () => {
+      before(async () => {
+        await server.start();
+      });
+
+      after(async () => {
+        await server.close();
+      });
+
+      it('sends quest invited webhook', async () => {
+        const uuid = generateUUID();
+
+        await member.post('/user/webhook', {
+          url: `http://localhost:${server.port}/webhooks/${uuid}`,
+          type: 'questActivity',
+          enabled: true,
+          options: {
+            questInvited: true,
+          },
+        });
+
+        await leader.post(`/groups/${questingGroup._id}/quests/invite/${PET_QUEST}`);
+
+        await sleep();
+
+        const body = server.getWebhookData(uuid);
+
+        expect(body.type).to.eql('questInvited');
+        expect(body.group.id).to.eql(questingGroup.id);
+        expect(body.group.name).to.eql(questingGroup.name);
+        expect(body.quest.key).to.eql(PET_QUEST);
+      });
+    });
  });
 });
@@ -121,7 +121,7 @@ describe('POST /groups/:groupId/quests/reject', () => {
        .to.eventually.be.rejected.and.eql({
          code: 401,
          error: 'NotAuthorized',
-          message: t('questAlreadyUnderway'),
+          message: t('questAlreadyStartedFriendly'),
        });
    });
  });
@@ -120,7 +120,7 @@ describe('DELETE /tasks/:id', () => {
  });

  context('task cannot be deleted', () => {
-    it('cannot delete a non-existant task', async () => {
+    it('cannot delete a non-existent task', async () => {
      await expect(user.del('/tasks/550e8400-e29b-41d4-a716-446655440000')).to.eventually.be.rejected.and.eql({
        code: 404,
        error: 'NotFound',
@@ -39,7 +39,7 @@ describe('GET /tasks/:id', () => {
  });

  context('task cannot be accessed', () => {
-    it('cannot get a non-existant task', async () => {
+    it('cannot get a non-existent task', async () => {
      const dummyId = generateUUID();

      await expect(user.get(`/tasks/${dummyId}`)).to.eventually.be.rejected.and.eql({
@@ -55,6 +55,18 @@ describe('POST /tasks/user', () => {
      });
    });

+    it('returns an error if reward value is a negative number', async () => {
+      await expect(user.post('/tasks/user', {
+        type: 'reward',
+        text: 'reward with negative value',
+        value: -10,
+      })).to.eventually.be.rejected.and.eql({
+        code: 400,
+        error: 'BadRequest',
+        message: 'reward validation failed',
+      });
+    });
+
    it('does not update user.tasksOrder.{taskType} when the task is not saved because invalid', async () => {
      const originalHabitsOrder = (await user.get('/user')).tasksOrder.habits;
      await expect(user.post('/tasks/user', {
@@ -530,5 +530,15 @@ describe('PUT /tasks/:id', () => {

      expect(savedReward.value).to.eql(100);
    });
+
+    it('returns an error if reward value is a negative number', async () => {
+      await expect(user.put(`/tasks/${reward._id}`, {
+        value: -10,
+      })).to.eventually.be.rejected.and.eql({
+        code: 400,
+        error: 'BadRequest',
+        message: 'reward validation failed',
+      });
+    });
  });
 });
@@ -27,7 +27,7 @@ describe('DELETE /tasks/:id', () => {
    });
  });

-  it('cannot delete a non-existant task', async () => {
+  it('cannot delete a non-existent task', async () => {
    await expect(user.del(`/tasks/${generateUUID()}`)).to.eventually.be.rejected.and.eql({
      code: 404,
      error: 'NotFound',
@@ -346,4 +346,23 @@ describe('DELETE /user', () => {
      await expect(checkExistence('users', user._id)).to.eventually.eql(false);
    });
  });
+
+  context('user with Apple auth', async () => {
+    beforeEach(async () => {
+      user = await generateUser({
+        auth: {
+          apple: {
+            id: 'apple-id',
+          },
+        },
+      });
+    });
+
+    it('deletes a Apple user', async () => {
+      await user.del('/user', {
+        password: DELETE_CONFIRMATION,
+      });
+      await expect(checkExistence('users', user._id)).to.eventually.eql(false);
+    });
+  });
 });
@@ -15,7 +15,7 @@ describe('GET /user/toggle-pinned-item', () => {
      .to.eventually.be.rejected.and.eql({
        code: 400,
        error: 'BadRequest',
-        message: t('cannotUnpinArmoirPotion'),
+        message: t('cannotUnpinItem'),
      });
  });

@@ -125,7 +125,7 @@ describe('PUT /user', () => {
  context('Sub-Level Protected Operations', () => {
    const protectedOperations = {
      'class stat': { 'stats.class': 'wizard' },
-      'flags unless whitelisted': { 'flags.dropsEnabled': true },
+      'flags unless whitelisted': { 'flags.chatRevoked': true },
      webhooks: { 'preferences.webhooks': [1, 2, 3] },
      sleep: { 'preferences.sleep': true },
      'disable classes': { 'preferences.disableClasses': true },
@@ -95,4 +95,42 @@ describe('DELETE social registration', () => {
      expect(user.auth.goodl).to.be.undefined;
    });
  });
+
+  context('Apple', () => {
+    it('fails if user does not have an alternative registration method', async () => {
+      await user.update({
+        'auth.apple.id': 'some-apple-id',
+        'auth.local': { ok: true },
+      });
+      await expect(user.del('/user/auth/social/apple')).to.eventually.be.rejected.and.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('cantDetachSocial'),
+      });
+    });
+
+    it('succeeds if user has a local registration', async () => {
+      await user.update({
+        'auth.apple.id': 'some-apple-id',
+      });
+
+      const response = await user.del('/user/auth/social/apple');
+      expect(response).to.eql({});
+      await user.sync();
+      expect(user.auth.apple).to.be.undefined;
+    });
+
+    it('succeeds if user has a facebook registration', async () => {
+      await user.update({
+        'auth.apple.id': 'some-apple-id',
+        'auth.facebook.id': 'some-facebook-id',
+        'auth.local': { ok: true },
+      });
+
+      const response = await user.del('/user/auth/social/apple');
+      expect(response).to.eql({});
+      await user.sync();
+      expect(user.auth.goodl).to.be.undefined;
+    });
+  });
 });
@@ -0,0 +1,50 @@
+import {
+  generateUser,
+  requester,
+  getProperty,
+} from '../../../../../helpers/api-integration/v3';
+import * as appleAuth from '../../../../../../website/server/libs/auth/apple';
+
+describe('GET /user/auth/apple', () => {
+  let api;
+  let user;
+  const appleEndpoint = '/user/auth/apple';
+
+  before(async () => {
+    const expectedResult = { id: 'appleId', name: 'an apple user' };
+    sandbox.stub(appleAuth, 'appleProfile').returns(Promise.resolve(expectedResult));
+  });
+
+  beforeEach(async () => {
+    api = requester();
+    user = await generateUser();
+  });
+
+  it('registers a new user', async () => {
+    const response = await api.get(appleEndpoint);
+
+    expect(response.apiToken).to.exist;
+    expect(response.id).to.exist;
+    expect(response.newUser).to.be.true;
+    await expect(getProperty('users', response.id, 'auth.apple.id')).to.eventually.equal('appleId');
+    await expect(getProperty('users', response.id, 'profile.name')).to.eventually.equal('an apple user');
+  });
+
+  it('logs an existing user in', async () => {
+    const registerResponse = await api.get(appleEndpoint);
+
+    const response = await api.get(appleEndpoint);
+
+    expect(response.apiToken).to.eql(registerResponse.apiToken);
+    expect(response.id).to.eql(registerResponse.id);
+    expect(response.newUser).to.be.false;
+  });
+
+  it('add social auth to an existing user', async () => {
+    const response = await user.get(appleEndpoint);
+
+    expect(response.apiToken).to.exist;
+    expect(response.id).to.exist;
+    expect(response.newUser).to.be.false;
+  });
+});
@@ -189,6 +189,28 @@ describe('POST /user/auth/reset-password-set-new-one', () => {
    });
  });

+  it('renders the error page if the password is too short', async () => {
+    const user = await generateUser();
+
+    const code = encrypt(JSON.stringify({
+      userId: user._id,
+      expiresAt: moment().add({ days: 1 }),
+    }));
+    await user.update({
+      'auth.local.passwordResetCode': code,
+    });
+
+    await expect(api.post(`${endpoint}`, {
+      newPassword: 'short',
+      confirmPassword: 'short',
+      code,
+    })).to.eventually.be.rejected.and.eql({
+      code: 400,
+      error: 'BadRequest',
+      message: t('invalidReqParams'),
+    });
+  });
+
  it('renders the success page and save the user', async () => {
    const user = await generateUser();

@@ -326,6 +326,24 @@ describe('POST /user/auth/local/register', () => {
      });
    });

+    it('requires minimum length for the password', async () => {
+      const username = generateRandomUserName();
+      const email = `${username}@example.com`;
+      const password = '1234567';
+      const confirmPassword = '1234567';
+
+      await expect(api.post('/user/auth/local/register', {
+        username,
+        email,
+        password,
+        confirmPassword,
+      })).to.eventually.be.rejected.and.eql({
+        code: 400,
+        error: 'BadRequest',
+        message: t('invalidReqParams'),
+      });
+    });
+
    it('requires a username', async () => {
      const email = `${generateRandomUserName()}@example.com`;
      const password = 'password';
@@ -474,6 +492,74 @@ describe('POST /user/auth/local/register', () => {
    });
  });

+  context('attach to google user', () => {
+    let user;
+    const email = 'some@email-google.net';
+    const username = 'some-username-google';
+    const password = 'some-password';
+    beforeEach(async () => {
+      user = await generateUser();
+    });
+    it('checks onlySocialAttachLocal', async () => {
+      await expect(user.post('/user/auth/local/register', {
+        email,
+        username,
+        password,
+        confirmPassword: password,
+      })).to.eventually.be.rejected.and.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('onlySocialAttachLocal'),
+      });
+    });
+    it('succeeds', async () => {
+      await user.update({ 'auth.google.id': 'some-google-id', 'auth.local': { ok: true } });
+      await user.post('/user/auth/local/register', {
+        username,
+        email,
+        password,
+        confirmPassword: password,
+      });
+      await user.sync();
+      expect(user.auth.local.username).to.eql(username);
+      expect(user.auth.local.email).to.eql(email);
+    });
+  });
+
+  context('attach to apple user', () => {
+    let user;
+    const email = 'some@email-apple.net';
+    const username = 'some-username-apple';
+    const password = 'some-password';
+    beforeEach(async () => {
+      user = await generateUser();
+    });
+    it('checks onlySocialAttachLocal', async () => {
+      await expect(user.post('/user/auth/local/register', {
+        email,
+        username,
+        password,
+        confirmPassword: password,
+      })).to.eventually.be.rejected.and.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('onlySocialAttachLocal'),
+      });
+    });
+    it('succeeds', async () => {
+      await user.update({ 'auth.apple.id': 'some-apple-id', 'auth.local': { ok: true } });
+      await user.post('/user/auth/local/register', {
+        username,
+        email,
+        password,
+        confirmPassword: password,
+      });
+      await user.sync();
+      expect(user.auth.local.username).to.eql(username);
+      expect(user.auth.local.email).to.eql(email);
+    });
+  });
+
  context('login is already taken', () => {
    let username; let email; let
      api;
@@ -51,6 +51,7 @@ describe('POST /user/auth/social', () => {

      await expect(getProperty('users', response.id, 'profile.name')).to.eventually.equal('a facebook user');
      await expect(getProperty('users', response.id, 'auth.local.lowerCaseUsername')).to.exist;
+      await expect(getProperty('users', response.id, 'auth.facebook.id')).to.eventually.equal(facebookId);
    });

    it('logs an existing user in', async () => {
@@ -106,6 +107,7 @@ describe('POST /user/auth/social', () => {
      expect(response.apiToken).to.exist;
      expect(response.id).to.exist;
      expect(response.newUser).to.be.true;
+      await expect(getProperty('users', response.id, 'auth.google.id')).to.eventually.equal(googleId);
      await expect(getProperty('users', response.id, 'profile.name')).to.eventually.equal('a google user');
    });

@@ -16,7 +16,7 @@ describe('PUT /user/auth/update-email', () => {
  const newEmail = 'SOmE-nEw-emAIl_2@example.net';
  const oldPassword = 'password'; // from habitrpg/test/helpers/api-integration/v3/object-generators.js

-  context('Local Authenticaion User', async () => {
+  context('Local Authentication User', async () => {
    let user;

    beforeEach(async () => {
@@ -82,6 +82,20 @@ describe('PUT /user/auth/update-password', async () => {
    });
  });

+  it('returns an error when newPassword is too short', async () => {
+    const body = {
+      password,
+      newPassword: '1234567',
+      confirmPassword: '1234567',
+    };
+
+    await expect(user.put(ENDPOINT, body)).to.eventually.be.rejected.and.eql({
+      code: 400,
+      error: 'BadRequest',
+      message: t('invalidReqParams'),
+    });
+  });
+
  it('returns an error when confirmPassword is missing', async () => {
    const body = {
      password,
@@ -81,6 +81,16 @@ describe('POST /user/webhook', () => {
    expect(webhook.type).to.eql('taskActivity');
  });

+  it('ignores protected fields', async () => {
+    body.failures = 3;
+    body.lastFailureAt = new Date();
+
+    const webhook = await user.post('/user/webhook', body);
+
+    expect(webhook.failures).to.eql(0);
+    expect(webhook.lastFailureAt).to.eql(undefined);
+  });
+
  it('successfully adds the webhook', async () => {
    expect(user.webhooks).to.eql([]);

@@ -226,6 +236,69 @@ describe('POST /user/webhook', () => {
    });
  });

+  it('defaults questActivity options', async () => {
+    body.type = 'questActivity';
+
+    const webhook = await user.post('/user/webhook', body);
+
+    expect(webhook.options).to.eql({
+      questStarted: false,
+      questFinished: false,
+      questInvited: false,
+    });
+  });
+
+  it('can set questActivity options', async () => {
+    body.type = 'questActivity';
+    body.options = {
+      questStarted: true,
+      questFinished: true,
+      questInvited: true,
+    };
+
+    const webhook = await user.post('/user/webhook', body);
+
+    expect(webhook.options).to.eql({
+      questStarted: true,
+      questFinished: true,
+      questInvited: true,
+    });
+  });
+
+  it('discards extra properties in questActivity options', async () => {
+    body.type = 'questActivity';
+    body.options = {
+      questStarted: false,
+      questFinished: true,
+      questInvited: true,
+      foo: 'bar',
+    };
+
+    const webhook = await user.post('/user/webhook', body);
+
+    expect(webhook.options.foo).to.not.exist;
+    expect(webhook.options).to.eql({
+      questStarted: false,
+      questFinished: true,
+      questInvited: true,
+    });
+  });
+
+  ['questStarted', 'questFinished', 'questInvited'].forEach(option => {
+    it(`requires questActivity option ${option} to be a boolean`, async () => {
+      body.type = 'questActivity';
+      body.options = {
+        [option]: 'not a boolean',
+      };
+
+      await expect(user.post('/user/webhook', body)).to.eventually.be.rejected.and.eql({
+        code: 400,
+        error: 'BadRequest',
+        message: t('webhookBooleanOption', { option }),
+      });
+    });
+  });
+
  it('discards extra properties in globalActivity options', async () => {
    body.type = 'globalActivity';
    body.options = {
@@ -63,6 +63,21 @@ describe('PUT /user/webhook/:id', () => {
    expect(webhook.options).to.eql(options);
  });

+  it('ignores protected fields', async () => {
+    const failures = 3;
+    const lastFailureAt = new Date();
+
+    await user.put(`/user/webhook/${webhookToUpdate.id}`, {
+      failures, lastFailureAt,
+    });
+
+    await user.sync();
+    const webhook = user.webhooks.find(hook => webhookToUpdate.id === hook.id);
+
+    expect(webhook.failures).to.eql(0);
+    expect(webhook.lastFailureAt).to.eql(undefined);
+  });
+
  it('updates a webhook with empty label', async () => {
    const url = 'http://a-new-url.com';
    const type = 'groupChatReceived';
@@ -109,7 +109,7 @@ describe('PUT /user', () => {
  context('Sub-Level Protected Operations', () => {
    const protectedOperations = {
      'class stat': { 'stats.class': 'wizard' },
-      'flags unless whitelisted': { 'flags.dropsEnabled': true },
+      'flags unless whitelisted': { 'flags.chatRevoked': true },
      webhooks: { 'preferences.webhooks': [1, 2, 3] },
      sleep: { 'preferences.sleep': true },
      'disable classes': { 'preferences.disableClasses': true },
@@ -457,6 +457,74 @@ describe('POST /user/auth/local/register', () => {
    });
  });

+  context('attach to google user', () => {
+    let user;
+    const email = 'some-google@email.net';
+    const username = 'some-username-google';
+    const password = 'some-password';
+    beforeEach(async () => {
+      user = await generateUser();
+    });
+    it('checks onlySocialAttachLocal', async () => {
+      await expect(user.post('/user/auth/local/register', {
+        email,
+        username,
+        password,
+        confirmPassword: password,
+      })).to.eventually.be.rejected.and.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('onlySocialAttachLocal'),
+      });
+    });
+    it('succeeds', async () => {
+      await user.update({ 'auth.google.id': 'some-google-id', 'auth.local': { ok: true } });
+      await user.post('/user/auth/local/register', {
+        username,
+        email,
+        password,
+        confirmPassword: password,
+      });
+      await user.sync();
+      expect(user.auth.local.username).to.eql(username);
+      expect(user.auth.local.email).to.eql(email);
+    });
+  });
+
+  context('attach to apple user', () => {
+    let user;
+    const email = 'some-apple@email.net';
+    const username = 'some-username-apple';
+    const password = 'some-password';
+    beforeEach(async () => {
+      user = await generateUser();
+    });
+    it('checks onlySocialAttachLocal', async () => {
+      await expect(user.post('/user/auth/local/register', {
+        email,
+        username,
+        password,
+        confirmPassword: password,
+      })).to.eventually.be.rejected.and.eql({
+        code: 401,
+        error: 'NotAuthorized',
+        message: t('onlySocialAttachLocal'),
+      });
+    });
+    it('succeeds', async () => {
+      await user.update({ 'auth.apple.id': 'some-apple-id', 'auth.local': { ok: true } });
+      await user.post('/user/auth/local/register', {
+        username,
+        email,
+        password,
+        confirmPassword: password,
+      });
+      await user.sync();
+      expect(user.auth.local.username).to.eql(username);
+      expect(user.auth.local.email).to.eql(email);
+    });
+  });
+
  context('login is already taken', () => {
    let username; let email; let
      api;
@@ -15,6 +15,7 @@ describe('common.fns.randomDrop', () => {
  beforeEach(() => {
    user = generateUser();
    user._tmp = user._tmp ? user._tmp : {};
+    user.items.eggs.Wolf = 0;
    task = generateTodo({ userId: user._id });
    predictableRandom = sandbox.stub().returns(0.5);
  });
@@ -34,10 +35,17 @@ describe('common.fns.randomDrop', () => {

  context('drops enabled', () => {
    beforeEach(() => {
-      user.flags.dropsEnabled = true;
      task.priority = 100000;
    });

+    it('awards an egg and a hatching potion if user has never received any', () => {
+      delete user.items.eggs.Wolf;
+      randomDrop(user, { task, predictableRandom });
+
+      expect(user._tmp.firstDrops.egg).to.be.a.string;
+      expect(user._tmp.firstDrops.hatchingPotion).to.be.a.string;
+    });
+
    it('does nothing if user.items.lastDrop.count is exceeded', () => {
      user.items.lastDrop.count = 100;
      randomDrop(user, { task, predictableRandom });
@@ -46,7 +54,6 @@ describe('common.fns.randomDrop', () => {

    it('drops something when the task is a todo', () => {
      expect(user._tmp).to.eql({});
-      user.flags.dropsEnabled = true;
      predictableRandom.returns(0.1);

      randomDrop(user, { task, predictableRandom });
@@ -56,7 +63,6 @@ describe('common.fns.randomDrop', () => {
    it('drops something when the task is a habit', () => {
      task = generateHabit({ userId: user._id });
      expect(user._tmp).to.eql({});
-      user.flags.dropsEnabled = true;
      predictableRandom.returns(0.1);

      randomDrop(user, { task, predictableRandom });
@@ -66,7 +72,6 @@ describe('common.fns.randomDrop', () => {
    it('drops something when the task is a daily', () => {
      task = generateDaily({ userId: user._id });
      expect(user._tmp).to.eql({});
-      user.flags.dropsEnabled = true;
      predictableRandom.returns(0.1);

      randomDrop(user, { task, predictableRandom });
@@ -76,7 +81,6 @@ describe('common.fns.randomDrop', () => {
    it('drops something when the task is a reward', () => {
      task = generateReward({ userId: user._id });
      expect(user._tmp).to.eql({});
-      user.flags.dropsEnabled = true;
      predictableRandom.returns(0.1);

      randomDrop(user, { task, predictableRandom });
@@ -110,13 +110,6 @@ describe('common.fns.updateStats', () => {
      expect(user.stats.points).to.eql(10);
    });

-    it('add user notification when drops are enabled', () => {
-      user.stats.lvl = 3;
-      updateStats(user, { });
-      expect(user.addNotification).to.be.calledOnce;
-      expect(user.addNotification).to.be.calledWith('DROPS_ENABLED');
-    });
-
    it('add user notification when the user levels up', () => {
      const initialLvl = user.stats.lvl;
      updateStats(user, {
@@ -131,7 +124,7 @@ describe('common.fns.updateStats', () => {
    it('add user notification when rebirth is enabled', () => {
      user.stats.lvl = 51;
      updateStats(user, { });
-      expect(user.addNotification).to.be.calledTwice; // once is for drops enabled
+      expect(user.addNotification).to.be.calledOnce;
      expect(user.addNotification).to.be.calledWith('REBIRTH_ENABLED');
    });

@@ -239,6 +239,47 @@ describe('achievements', () => {
    });
  });

+  describe('unearned onboarding achievements', () => {
+    const user = generateUser();
+    const onboardingAchievs = shared
+      .achievements.getAchievementsForProfile(user).onboarding.achievements;
+
+    it('created task achievement exists with no count', () => {
+      const { createdTask } = onboardingAchievs;
+
+      expect(createdTask).to.exist;
+      expect(createdTask.optionalCount).to.be.undefined;
+    });
+
+    it('completed task achievement exists with no count', () => {
+      const { completedTask } = onboardingAchievs;
+
+      expect(completedTask).to.exist;
+      expect(completedTask.optionalCount).to.be.undefined;
+    });
+
+    it('hatched pet achievement exists with no count', () => {
+      const { hatchedPet } = onboardingAchievs;
+
+      expect(hatchedPet).to.exist;
+      expect(hatchedPet.optionalCount).to.be.undefined;
+    });
+
+    it('fed pet achievement exists with no count', () => {
+      const { fedPet } = onboardingAchievs;
+
+      expect(fedPet).to.exist;
+      expect(fedPet.optionalCount).to.be.undefined;
+    });
+
+    it('purchased equipment achievement exists with no count', () => {
+      const { purchasedEquipment } = onboardingAchievs;
+
+      expect(purchasedEquipment).to.exist;
+      expect(purchasedEquipment.optionalCount).to.be.undefined;
+    });
+  });
+
  describe('earned seasonal achievements', () => {
    const user = generateUser();
    const quests = ['dilatory', 'stressbeast', 'burnout', 'bewilder'];
@@ -0,0 +1,49 @@
+
+import {
+  generateUser,
+} from '../../helpers/common.helper';
+
+import getDebuffPotionItems from '../../../website/common/script/libs/getDebuffPotionItems';
+import { TRANSFORMATION_DEBUFFS_LIST } from '../../../website/common/script/constants';
+
+describe('getDebuffPotionItems', () => {
+  let user;
+
+  beforeEach(() => {
+    user = generateUser();
+  });
+
+  for (const key of Object.keys(TRANSFORMATION_DEBUFFS_LIST)) {
+    const debuff = TRANSFORMATION_DEBUFFS_LIST[key];
+    // Here we iterate the whole object to dynamically create test suites as
+    // described in mocha's docs
+    // https://mochajs.org/#dynamically-generating-tests
+    // That's why we have eslint-disable here
+    // eslint-disable-next-line no-loop-func
+    it(`Should return the ${debuff} on ${key} buff`, () => {
+      user.stats.buffs[key] = true;
+
+      const result = getDebuffPotionItems(user);
+
+      expect(result).to.be.an('array').that.deep
+        .includes({ path: `spells.special.${debuff}`, type: 'debuffPotion' });
+    });
+  }
+
+  it('Should return all debuff potions for all buffs', () => {
+    user.stats.buffs.seafoam = true;
+    user.stats.buffs.spookySparkles = true;
+    user.stats.buffs.snowball = true;
+    user.stats.buffs.shinySeed = true;
+
+
+    const result = getDebuffPotionItems(user);
+
+    expect(result).to.be.an('array').that.deep.include.members([
+      { path: 'spells.special.sand', type: 'debuffPotion' },
+      { path: 'spells.special.petalFreePotion', type: 'debuffPotion' },
+      { path: 'spells.special.salt', type: 'debuffPotion' },
+      { path: 'spells.special.opaquePotion', type: 'debuffPotion' },
+    ]);
+  });
+});
@@ -0,0 +1,100 @@
+import moment from 'moment';
+import {
+  hasActiveOnboarding,
+  hasCompletedOnboarding,
+  onOnboardingComplete,
+  checkOnboardingStatus,
+} from '../../../website/common/script/libs/onboarding';
+import { generateUser } from '../../helpers/common.helper';
+
+describe('onboarding', () => {
+  let user;
+
+  beforeEach(() => {
+    user = generateUser();
+    user.addNotification = sinon.spy();
+    // Make sure the onboarding is active
+    user.auth.timestamps.created = moment('2019-12-20').toDate();
+  });
+
+  describe('hasActiveOnboarding', () => {
+    // The value of BEGIN DATE is available in common/script/libs/onboarding
+
+    it('returns true if the account is created after BEGIN_DATE', () => {
+      expect(hasActiveOnboarding(user)).to.eql(true);
+    });
+
+    it('returns false if the account is created before BEGIN_DATE', () => {
+      user.auth.timestamps.created = moment('2019-12-01').toDate();
+      expect(hasActiveOnboarding(user)).to.eql(false);
+    });
+  });
+
+  describe('hasCompletedOnboarding', () => {
+    it('returns false if no achievement has been awarded', () => {
+      const result = hasCompletedOnboarding(user);
+      expect(result).to.eql(false);
+    });
+
+    it('returns false if not all achievements have been awarded', () => {
+      user.achievements.completedTask = true;
+      const result = hasCompletedOnboarding(user);
+      expect(result).to.eql(false);
+    });
+
+    it('returns true if all achievements have been awarded', () => {
+      user.achievements.createdTask = true;
+      user.achievements.completedTask = true;
+      user.achievements.hatchedPet = true;
+      user.achievements.fedPet = true;
+      user.achievements.purchasedEquipment = true;
+
+      const result = hasCompletedOnboarding(user);
+      expect(result).to.eql(true);
+    });
+  });
+
+  describe('onOnboardingComplete', () => {
+    it('awards prizes', () => {
+      const { gp } = user.stats;
+      onOnboardingComplete(user);
+      expect(user.stats.gp).to.eql(gp + 100);
+    });
+  });
+
+  describe('checkOnboardingStatus', () => {
+    it('does nothing if onboarding is not active', () => {
+      const { gp } = user.stats;
+      user.auth.timestamps.created = moment('2019-12-01').toDate();
+
+      checkOnboardingStatus(user);
+      expect(user.addNotification).to.not.be.called;
+
+      expect(user.stats.gp).to.eql(gp);
+    });
+
+    it('does nothing if onboarding is not complete', () => {
+      const { gp } = user.stats;
+
+      checkOnboardingStatus(user);
+      expect(user.addNotification).to.not.be.called;
+
+      expect(user.stats.gp).to.eql(gp);
+    });
+
+    it('awards prize and add notification when onboarding is complete', () => {
+      user.achievements.createdTask = true;
+      user.achievements.completedTask = true;
+      user.achievements.hatchedPet = true;
+      user.achievements.fedPet = true;
+      user.achievements.purchasedEquipment = true;
+      const { gp } = user.stats;
+
+      checkOnboardingStatus(user);
+      expect(user.addNotification).to.be.calledOnce;
+      expect(user.addNotification).to.be.calledWith('ONBOARDING_COMPLETE');
+
+      expect(user.stats.gp).to.eql(gp + 100);
+    });
+  });
+});
@@ -0,0 +1,53 @@
+
+import {
+  generateUser,
+} from '../../helpers/common.helper';
+
+import setDebuffPotionItems from '../../../website/common/script/libs/setDebuffPotionItems';
+
+describe('setDebuffPotionItems', () => {
+  let user;
+
+  beforeEach(() => {
+    user = generateUser();
+  });
+
+  it('Should push the debuff item to pinned items of user', () => {
+    user.stats.buffs.spookySparkles = true;
+    const previousPinnedItemsLength = user.pinnedItems.length;
+
+    const result = setDebuffPotionItems(user);
+
+    expect(result.pinnedItems.length).to.be.greaterThan(previousPinnedItemsLength);
+  });
+
+  it('Shouldn\'t create duplicate of already added debuff potion', () => {
+    user.stats.buffs.spookySparkles = true;
+
+    const firstSetResult = [...setDebuffPotionItems(user).pinnedItems];
+    const secondSetResult = [...setDebuffPotionItems(user).pinnedItems];
+
+
+    expect(firstSetResult).to.be.deep.equal(secondSetResult);
+  });
+
+  it('Should remove all debuff items from pinnedItems of the user if user have no buffs', () => {
+    user.stats.buffs.seafoam = true;
+    user.stats.buffs.spookySparkles = true;
+    user.stats.buffs.snowball = true;
+    user.stats.buffs.shinySeed = true;
+
+    const firstSetResult = [...setDebuffPotionItems(user).pinnedItems];
+
+    expect(firstSetResult).to.have.lengthOf(4);
+
+    user.stats.buffs.seafoam = false;
+    user.stats.buffs.spookySparkles = false;
+    user.stats.buffs.snowball = false;
+    user.stats.buffs.shinySeed = false;
+
+    const secondSetResult = [...setDebuffPotionItems(user).pinnedItems];
+
+    expect(secondSetResult).to.have.lengthOf(0);
+  });
+});
@@ -41,7 +41,10 @@ describe('shared.ops.buyMarketGear', () => {
      },
    });

+    user.addAchievement = sinon.spy();
+
    sinon.stub(shared, 'randomVal');
+    sinon.stub(shared.onboarding, 'checkOnboardingStatus');
    sinon.stub(shared.fns, 'predictableRandom');
    sinon.stub(analytics, 'track');
  });
@@ -49,6 +52,7 @@ describe('shared.ops.buyMarketGear', () => {
  afterEach(() => {
    shared.randomVal.restore();
    shared.fns.predictableRandom.restore();
+    shared.onboarding.checkOnboardingStatus.restore();
    analytics.track.restore();
  });

@@ -86,6 +90,27 @@ describe('shared.ops.buyMarketGear', () => {
      expect(analytics.track).to.be.calledOnce;
    });

+    it('adds the onboarding achievement to the user and checks the onboarding status', () => {
+      user.stats.gp = 31;
+
+      buyGear(user, { params: { key: 'armor_warrior_1' } }, analytics);
+
+      expect(user.addAchievement).to.be.calledOnce;
+      expect(user.addAchievement).to.be.calledWith('purchasedEquipment');
+
+      expect(shared.onboarding.checkOnboardingStatus).to.be.calledOnce;
+      expect(shared.onboarding.checkOnboardingStatus).to.be.calledWith(user);
+    });
+
+    it('does not add the onboarding achievement to the user if it\'s already been awarded', () => {
+      user.stats.gp = 31;
+      user.achievements.purchasedEquipment = true;
+
+      buyGear(user, { params: { key: 'armor_warrior_1' } }, analytics);
+
+      expect(user.addAchievement).to.not.be.called;
+    });
+
    it('deducts gold from user', () => {
      user.stats.gp = 31;

@@ -10,12 +10,19 @@ import {
  generateUser,
 } from '../../helpers/common.helper';
 import errorMessage from '../../../website/common/script/libs/errorMessage';
+import shared from '../../../website/common/script';

 describe('shared.ops.feed', () => {
  let user;

  beforeEach(() => {
    user = generateUser();
+    user.addAchievement = sinon.spy();
+    sinon.stub(shared.onboarding, 'checkOnboardingStatus');
+  });
+
+  afterEach(() => {
+    shared.onboarding.checkOnboardingStatus.restore();
  });

  context('failure conditions', () => {
@@ -223,5 +230,28 @@ describe('shared.ops.feed', () => {
      expect(user.items.mounts['Wolf-Base']).to.equal(true);
      expect(user.items.currentPet).to.equal('');
    });
+
+    it('adds the onboarding achievement to the user and checks the onboarding status', () => {
+      user.items.pets['Wolf-Base'] = 5;
+      user.items.food.Meat = 2;
+
+      feed(user, { params: { pet: 'Wolf-Base', food: 'Meat' } });
+
+      expect(user.addAchievement).to.be.calledOnce;
+      expect(user.addAchievement).to.be.calledWith('fedPet');
+
+      expect(shared.onboarding.checkOnboardingStatus).to.be.calledOnce;
+      expect(shared.onboarding.checkOnboardingStatus).to.be.calledWith(user);
+    });
+
+    it('does not add the onboarding achievement to the user if it\'s already been awarded', () => {
+      user.items.pets['Wolf-Base'] = 5;
+      user.items.food.Meat = 2;
+      user.achievements.fedPet = true;
+
+      feed(user, { params: { pet: 'Wolf-Base', food: 'Meat' } });
+
+      expect(user.addAchievement).to.not.be.called;
+    });
  });
 });
@@ -9,12 +9,19 @@ import {
  generateUser,
 } from '../../helpers/common.helper';
 import errorMessage from '../../../website/common/script/libs/errorMessage';
+import shared from '../../../website/common/script';

 describe('shared.ops.hatch', () => {
  let user;

  beforeEach(() => {
    user = generateUser();
+    user.addAchievement = sinon.spy();
+    sinon.stub(shared.onboarding, 'checkOnboardingStatus');
+  });
+
+  afterEach(() => {
+    shared.onboarding.checkOnboardingStatus.restore();
  });

  context('Pet Hatching', () => {
@@ -195,6 +202,30 @@ describe('shared.ops.hatch', () => {
        hatch(user, { params: { egg: 'Wolf', hatchingPotion: 'Spooky' } });
        expect(user.achievements.dustDevil).to.eql(true);
      });
+
+      it('adds the onboarding achievement to the user and checks the onboarding status', () => {
+        user.items.eggs = { Wolf: 1 };
+        user.items.hatchingPotions = { Base: 1 };
+        user.items.pets = {};
+        hatch(user, { params: { egg: 'Wolf', hatchingPotion: 'Base' } });
+
+        expect(user.addAchievement).to.be.calledOnce;
+        expect(user.addAchievement).to.be.calledWith('hatchedPet');
+
+        expect(shared.onboarding.checkOnboardingStatus).to.be.calledOnce;
+        expect(shared.onboarding.checkOnboardingStatus).to.be.calledWith(user);
+      });
+
+      it('does not add the onboarding achievement to the user if it\'s already been awarded', () => {
+        user.items.eggs = { Wolf: 1 };
+        user.items.hatchingPotions = { Base: 1 };
+        user.items.pets = {};
+        user.achievements.hatchedPet = true;
+
+        hatch(user, { params: { egg: 'Wolf', hatchingPotion: 'Base' } });
+
+        expect(user.addAchievement).to.not.be.called;
+      });
    });
  });
 });
@@ -173,7 +173,6 @@ describe('shared.ops.rebirth', () => {

  it('resets a user\'s flags', () => {
    user.flags.itemsEnabled = true;
-    user.flags.dropsEnabled = true;
    user.flags.classSelected = true;
    user.flags.rebirthEnabled = true;
    user.flags.levelDrops = { test: 'test' };
@@ -181,7 +180,6 @@ describe('shared.ops.rebirth', () => {
    rebirth(user);

    expect(user.flags.itemsEnabled).to.be.false;
-    expect(user.flags.dropsEnabled).to.be.false;
    expect(user.flags.classSelected).to.be.false;
    expect(user.flags.rebirthEnabled).to.be.false;
    expect(user.flags.levelDrops).to.be.empty;
@@ -12,6 +12,7 @@ import {
  NotAuthorized,
 } from '../../../website/common/script/libs/errors';
 import crit from '../../../website/common/script/fns/crit';
+import shared from '../../../website/common/script';

 const EPSILON = 0.0001; // negligible distance between datapoints

@@ -340,5 +341,49 @@ describe('shared.ops.scoreTask', () => {
        expectClosePoints(ref.beforeUser, ref.afterUser, freshTodo, todo);
      });
    });
+
+    context('onboarding', () => {
+      beforeEach(() => {
+        ref.afterUser.addAchievement = sinon.spy();
+        sinon.stub(shared.onboarding, 'checkOnboardingStatus');
+      });
+
+      afterEach(() => {
+        shared.onboarding.checkOnboardingStatus.restore();
+      });
+
+      it('adds the achievement to the user and checks the onboarding status', () => {
+        scoreTask({ user: ref.afterUser, task: todo, direction: 'up' });
+        expect(ref.afterUser.addAchievement).to.be.calledOnce;
+        expect(ref.afterUser.addAchievement).to.be.calledWith('completedTask');
+
+        expect(shared.onboarding.checkOnboardingStatus).to.be.calledOnce;
+        expect(shared.onboarding.checkOnboardingStatus).to.be.calledWith(ref.afterUser);
+      });
+
+      it('does not add the onboarding achievement to the user if it\'s already been awarded', () => {
+        ref.afterUser.achievements.completedTask = true;
+        scoreTask({ user: ref.afterUser, task: todo, direction: 'up' });
+
+        expect(ref.afterUser.addAchievement).to.not.be.called;
+      });
+
+      it('does not add the onboarding achievement to the user if it\'s scored down', () => {
+        scoreTask({ user: ref.afterUser, task: todo, direction: 'down' });
+
+        expect(ref.afterUser.addAchievement).to.not.be.called;
+      });
+
+      it('does not add the onboarding achievement to the user if cron is running', () => {
+        scoreTask({
+          user: ref.afterUser,
+          task: todo,
+          direction: 'up',
+          cron: true,
+        });
+
+        expect(ref.afterUser.addAchievement).to.not.be.called;
+      });
+    });
  });
 });
@@ -54,7 +54,7 @@ describe('shared.ops.unlock', () => {
    }
  });

-  // disabled untill fully implemente
+  // disabled until fully implemente
  xit('returns an error when user already owns items in a full set', done => {
    try {
      unlock(user, { query: { path: unlockPath } });
@@ -7,6 +7,7 @@ module.exports = {
  extends: [
    'habitrpg/lib/vue',
  ],
+  ignorePatterns: ['dist/', 'node_modules/'],
  rules: {
    'no-console': process.env.NODE_ENV === 'production' ? 'error' : 'off',
    'no-debugger': process.env.NODE_ENV === 'production' ? 'error' : 'off',
--- a/Show More
+++ b/Show More