4.151.1

chore(news): Last Chance Bailey
Merge branch 'develop' into release
2026-05-09 11:11:17 -05:00 · 2020-07-30 14:41:34 -05:00 · 2020-07-30 14:38:19 -05:00 · 2020-07-30 14:23:04 -05:00 · 2020-07-28 17:58:30 +02:00 · 2020-07-28 17:58:25 +02:00
983 changed files with 49710 additions and 43175 deletions
@@ -22,6 +22,7 @@ jobs:
        npm ci
      env:
        CI: true
+        NODE_ENV: test
    - run: npm run lint-no-fix
  apidoc:
    runs-on: ubuntu-latest
@@ -42,6 +43,7 @@ jobs:
        npm ci
      env:
        CI: true
+        NODE_ENV: test
    - run: npm run apidoc
  sanity:
    runs-on: ubuntu-latest
@@ -62,6 +64,7 @@ jobs:
        npm ci
      env:
        CI: true
+        NODE_ENV: test
    - run: npm run test:sanity
  
  common:
@@ -83,6 +86,7 @@ jobs:
        npm ci
      env:
        CI: true
+        NODE_ENV: test
    - run: npm run test:common
  content:
    runs-on: ubuntu-latest
@@ -103,6 +107,7 @@ jobs:
        npm ci
      env:
        CI: true
+        NODE_ENV: test
    - run: npm run test:content
  
  api-unit:
@@ -110,6 +115,7 @@ jobs:
    strategy:
      matrix:
        node-version: [12.x]
+        mongodb-version: [4.2]
    steps:
    - uses: actions/checkout@v1
      with:
@@ -118,13 +124,18 @@ jobs:
      uses: actions/setup-node@v1
      with:
        node-version: ${{ matrix.node-version }}
-    - run: sudo docker run --name mongo -d -p 27017:27017 mongo
+    - name: Start MongoDB ${{ matrix.mongodb-version }} Replica Set
+      uses: supercharge/mongodb-github-action@1.3.0
+      with:
+        mongodb-version: ${{ matrix.mongodb-version }}
+        mongodb-replica-set: rs
    - run: cp config.json.example config.json
    - name: npm install
      run: |
        npm ci
      env:
        CI: true
+        NODE_ENV: test
    - run: npm run test:api:unit
      env:
        REQUIRES_SERVER=true: true
@@ -133,6 +144,7 @@ jobs:
    strategy:
      matrix:
        node-version: [12.x]
+        mongodb-version: [4.2]
    steps:
    - uses: actions/checkout@v1
      with:
@@ -141,13 +153,18 @@ jobs:
      uses: actions/setup-node@v1
      with:
        node-version: ${{ matrix.node-version }}
-    - run: sudo docker run --name mongo -d -p 27017:27017 mongo
+    - name: Start MongoDB ${{ matrix.mongodb-version }} Replica Set
+      uses: supercharge/mongodb-github-action@1.3.0
+      with:
+        mongodb-version: ${{ matrix.mongodb-version }}
+        mongodb-replica-set: rs
    - run: cp config.json.example config.json
    - name: npm install
      run: |
        npm ci
      env:
        CI: true
+        NODE_ENV: test
    - run: npm run test:api-v3:integration
      env:
        REQUIRES_SERVER=true: true
@@ -156,6 +173,7 @@ jobs:
    strategy:
      matrix:
        node-version: [12.x]
+        mongodb-version: [4.2]
    steps:
    - uses: actions/checkout@v1
      with:
@@ -164,13 +182,18 @@ jobs:
      uses: actions/setup-node@v1
      with:
        node-version: ${{ matrix.node-version }}
-    - run: sudo docker run --name mongo -d -p 27017:27017 mongo
+    - name: Start MongoDB ${{ matrix.mongodb-version }} Replica Set
+      uses: supercharge/mongodb-github-action@1.3.0
+      with:
+        mongodb-version: ${{ matrix.mongodb-version }}
+        mongodb-replica-set: rs
    - run: cp config.json.example config.json
    - name: npm install
      run: |
        npm ci
      env:
        CI: true
+        NODE_ENV: test
    - run: npm run test:api-v4:integration
      env:
        REQUIRES_SERVER=true: true
@@ -194,5 +217,6 @@ jobs:
        npm ci
      env:
        CI: true
+        NODE_ENV: test
    - run: npm run test:unit
      working-directory: ./website/client
@@ -42,3 +42,7 @@ yarn.lock

 # webstorm fake webpack for path intellisense
 webpack.webstorm.config
+
+# mongodb replica set for local dev
+mongodb-*.tgz
+/mongodb-data
@@ -2,6 +2,10 @@
  "name": "Habitica V3 API Documentation",
  "title": "Habitica",
  "url": "https://habitica.com",
+  "header": {
+    "title": "Introduction",
+    "filename": "apidoc/header.md"
+  },
  "template": {
    "withCompare": false
  }
@@ -0,0 +1,5 @@
+# Introduction
+
+This webpage includes the documentation for version 3 of the [Habitica](https://habitica.com) API.
+
+If you're developing a 3rd party tool that uses the Habitica API you should read the [Guidance for Comrades](https://habitica.fandom.com/wiki/Guidance_for_Comrades) and in particular the section called [Rules for Third-Party Tools](https://habitica.fandom.com/wiki/Guidance_for_Comrades#Rules_for_Third-Party_Tools) which includes suggestions on how to best use the API and the rules to follow when interacting with it. 
@@ -32,7 +32,8 @@
  "LOGGLY_SUBDOMAIN": "example-subdomain",
  "LOGGLY_TOKEN": "example-token",
  "MAINTENANCE_MODE": "false",
-  "NODE_DB_URI": "mongodb://localhost:27017/habitrpg",
+  "NODE_DB_URI": "mongodb://localhost:27017/habitica-dev?replicaSet=rs",
+  "TEST_DB_URI": "mongodb://localhost:27017/habitica-test?replicaSet=rs",
  "MONGODB_POOL_SIZE": "10",
  "NODE_ENV": "development",
  "PATH": "bin:node_modules/.bin:/usr/local/bin:/usr/bin:/bin",
@@ -70,7 +71,6 @@
  "SLACK_URL": "https://hooks.slack.com/services/some-url",
  "STRIPE_API_KEY": "aaaabbbbccccddddeeeeffff00001111",
  "STRIPE_PUB_KEY": "22223333444455556666777788889999",
-  "TEST_DB_URI": "mongodb://localhost:27017/habitrpg_test",
  "TRANSIFEX_SLACK_CHANNEL": "transifex",
  "WEB_CONCURRENCY": 1,
  "SKIP_SSL_CHECK_KEY": "key",
@@ -80,5 +80,9 @@
  "APPLE_AUTH_CLIENT_ID": "",
  "APPLE_AUTH_KEY_ID": "",
  "BLOCKED_IPS": "",
-  "LOG_AMPLITUDE_EVENTS": "false"
+  "LOG_AMPLITUDE_EVENTS": "false",
+  "RATE_LIMITER_ENABLED": "false",
+  "REDIS_HOST": "aaabbbcccdddeeefff",
+  "REDIS_PORT": "1234",
+  "REDIS_PASSWORD": "12345678"
 }
@@ -1,5 +1,10 @@
 import gulp from 'gulp';
+import path from 'path';
 import babel from 'gulp-babel';
+import os from 'os';
+import fs from 'fs';
+import spawn from 'cross-spawn'; // eslint-disable-line import/no-extraneous-dependencies
+import clean from 'rimraf';

 gulp.task('build:babel:server', () => gulp.src('website/server/**/*.js')
  .pipe(babel())
@@ -24,10 +29,67 @@ gulp.task('build:prod', gulp.series(
  done => done(),
 ));

+// Due to this issue https://github.com/vkarpov15/run-rs/issues/45
+// When used on windows `run-rs` must first be run without the `--keep` option
+// in order to be setup correctly, afterwards it can be used.
+
+const MONGO_PATH = path.join(__dirname, '/../mongodb-data/');
+
+gulp.task('build:prepare-mongo', async () => {
+  if (fs.existsSync(MONGO_PATH)) {
+    // console.log('MongoDB data folder exists, skipping setup.');
+    return;
+  }
+
+  if (os.platform() !== 'win32') {
+    // console.log('Not on Windows, skipping MongoDB setup.');
+    return;
+  }
+
+  console.log('MongoDB data folder is missing, setting up.');
+
+  // use run-rs without --keep, kill it as soon as the replica set starts
+  const runRsProcess = spawn('run-rs', ['-v', '4.2.8', '-l', 'ubuntu1804', '--dbpath', 'mongodb-data', '--number', '1', '--quiet']);
+
+  for await (const chunk of runRsProcess.stdout) {
+    const stringChunk = chunk.toString();
+    console.log(stringChunk);
+    // kills the process after the replica set is setup
+    if (stringChunk.includes('Started replica set')) {
+      console.log('MongoDB setup correctly.');
+      runRsProcess.kill();
+    }
+  }
+
+  let error = '';
+  for await (const chunk of runRsProcess.stderr) {
+    const stringChunk = chunk.toString();
+    error += stringChunk;
+  }
+
+  const exitCode = await new Promise(resolve => {
+    runRsProcess.on('close', resolve);
+  });
+
+  if (exitCode || error.length > 0) {
+    // remove any leftover files
+    clean.sync(MONGO_PATH);
+
+    throw new Error(`Error running run-rs: ${error}`);
+  }
+});
+
+gulp.task('build:dev', gulp.series(
+  'build:prepare-mongo',
+  done => done(),
+));
+
 const buildArgs = [];

 if (process.env.NODE_ENV === 'production') { // eslint-disable-line no-process-env
  buildArgs.push('build:prod');
+} else if (process.env.NODE_ENV !== 'test') { // eslint-disable-line no-process-env
+  buildArgs.push('build:dev');
 }

 gulp.task('build', gulp.series(buildArgs, done => {
@@ -3,6 +3,10 @@ import nconf from 'nconf';
 import repl from 'repl';
 import gulp from 'gulp';
 import logger from '../website/server/libs/logger';
+import {
+  getDevelopmentConnectionUrl,
+  getDefaultConnectionOptions,
+} from '../website/server/libs/mongodb';

 // Add additional properties to the repl's context
 const improveRepl = context => {
@@ -26,13 +30,14 @@ const improveRepl = context => {
  context.Group = require('../website/server/models/group').model; // eslint-disable-line global-require
  context.User = require('../website/server/models/user').model; // eslint-disable-line global-require

-  const isProd = nconf.get('NODE_ENV') === 'production';
-  const mongooseOptions = !isProd ? {} : {
-    keepAlive: 1,
-    connectTimeoutMS: 30000,
-  };
+  const IS_PROD = nconf.get('NODE_ENV') === 'production';
+  const NODE_DB_URI = nconf.get('NODE_DB_URI');
+
+  const mongooseOptions = getDefaultConnectionOptions();
+  const connectionUrl = IS_PROD ? NODE_DB_URI : getDevelopmentConnectionUrl(NODE_DB_URI);
+
  mongoose.connect(
-    nconf.get('NODE_DB_URI'),
+    connectionUrl,
    mongooseOptions,
    err => {
      if (err) throw err;
@@ -6,6 +6,10 @@ import nconf from 'nconf';
 import {
  pipe,
 } from './taskHelper';
+import {
+  getDevelopmentConnectionUrl,
+  getDefaultConnectionOptions,
+} from '../website/server/libs/mongodb';

 // TODO rewrite

@@ -44,7 +48,10 @@ gulp.task('test:nodemon', gulp.series(done => {
 }, 'nodemon'));

 gulp.task('test:prepare:mongo', cb => {
-  mongoose.connect(TEST_DB_URI, err => {
+  const mongooseOptions = getDefaultConnectionOptions();
+  const connectionUrl = getDevelopmentConnectionUrl(TEST_DB_URI);
+
+  mongoose.connect(connectionUrl, mongooseOptions, err => {
    if (err) return cb(`Unable to connect to mongo database. Are you sure it's running? \n\n${err}`);
    return mongoose.connection.dropDatabase(err2 => {
      if (err2) return cb(err2);
@@ -160,7 +167,7 @@ gulp.task('test:content:safe', gulp.series('test:prepare:build', cb => {
  pipe(runner);
 }));

-gulp.task('test:api:unit', done => {
+gulp.task('test:api:unit:run', done => {
  const runner = exec(
    testBin('istanbul cover --dir coverage/api-unit node_modules/mocha/bin/_mocha -- test/api/unit --recursive --require ./test/helpers/start-server'),
    err => {
@@ -174,9 +181,9 @@ gulp.task('test:api:unit', done => {
  pipe(runner);
 });

-gulp.task('test:api:unit:watch', () => gulp.watch(['website/server/libs/*', 'test/api/unit/**/*', 'website/server/controllers/**/*'], gulp.series('test:api:unit', done => done())));
+gulp.task('test:api:unit:watch', () => gulp.watch(['website/server/libs/*', 'test/api/unit/**/*', 'website/server/controllers/**/*'], gulp.series('test:api:unit:run', done => done())));

-gulp.task('test:api-v3:integration', done => {
+gulp.task('test:api-v3:integration', gulp.series('test:prepare:mongo', done => {
  const runner = exec(
    testBin('istanbul cover --dir coverage/api-v3-integration --report lcovonly node_modules/mocha/bin/_mocha -- test/api/v3/integration --recursive --require ./test/helpers/start-server'),
    { maxBuffer: 500 * 1024 },
@@ -189,7 +196,7 @@ gulp.task('test:api-v3:integration', done => {
  );

  pipe(runner);
-});
+}));

 gulp.task('test:api-v3:integration:watch', () => gulp.watch([
  'website/server/controllers/api-v3/**/*', 'common/script/ops/*', 'website/server/libs/*.js',
@@ -206,7 +213,7 @@ gulp.task('test:api-v3:integration:separate-server', done => {
  pipe(runner);
 });

-gulp.task('test:api-v4:integration', done => {
+gulp.task('test:api-v4:integration', gulp.series('test:prepare:mongo', done => {
  const runner = exec(
    testBin('istanbul cover --dir coverage/api-v4-integration --report lcovonly node_modules/mocha/bin/_mocha -- test/api/v4 --recursive --require ./test/helpers/start-server'),
    { maxBuffer: 500 * 1024 },
@@ -219,7 +226,7 @@ gulp.task('test:api-v4:integration', done => {
  );

  pipe(runner);
-});
+}));

 gulp.task('test:api-v4:integration:separate-server', done => {
  const runner = exec(
@@ -231,11 +238,17 @@ gulp.task('test:api-v4:integration:separate-server', done => {
  pipe(runner);
 });

+gulp.task('test:api:unit', gulp.series(
+  'test:prepare:mongo',
+  'test:api:unit:run',
+  done => done(),
+));
+
 gulp.task('test', gulp.series(
  'test:sanity',
  'test:content',
  'test:common',
-  'test:api:unit',
+  'test:api:unit:run',
  'test:api-v3:integration',
  'test:api-v4:integration',
  done => done(),
@@ -12,7 +12,6 @@ const SLACK_CONFIG = {
 const LOCALES = './website/common/locales/';
 const ENGLISH_LOCALE = `${LOCALES}en/`;

-
 function getArrayOfLanguages () {
  const languages = fs.readdirSync(LOCALES);
  languages.shift(); // Remove README.md from array of languages
@@ -0,0 +1,59 @@
+/* eslint-disable no-console */
+const MIGRATION_NAME = '20200721_summer_splash_orcas';
+
+import { model as User } from '../../../website/server/models/user';
+
+const progressCount = 1000;
+let count = 0;
+
+async function updateUser (user) {
+  count++;
+
+  let set;
+
+  if (user && user.items && user.items.pets && typeof user.items.pets['Orca-Base'] !== 'undefined') {
+    set = { migration: MIGRATION_NAME };
+  } else if (user && user.items && user.items.mounts && typeof user.items.mounts['Orca-Base'] !== 'undefined') {
+    set = { migration: MIGRATION_NAME, 'items.pets.Orca-Base': 5 };
+  } else {
+    set = { migration: MIGRATION_NAME, 'items.mounts.Orca-Base': true };
+  }
+
+  if (count % progressCount === 0) console.warn(`${count} ${user._id}`);
+
+  return await User.update({ _id: user._id }, { $set: set }).exec();
+}
+
+export default async function processUsers () {
+  let query = {
+    migration: {$ne: MIGRATION_NAME},
+    'auth.timestamps.loggedin': {$gt: new Date('2020-06-21')},
+  };
+
+  const fields = {
+    _id: 1,
+    items: 1,
+  };
+
+  while (true) { // eslint-disable-line no-constant-condition
+    const users = await User // eslint-disable-line no-await-in-loop
+      .find(query)
+      .limit(250)
+      .sort({_id: 1})
+      .select(fields)
+      .lean()
+      .exec();
+
+    if (users.length === 0) {
+      console.warn('All appropriate users found and modified.');
+      console.warn(`\n${count} users processed\n`);
+      break;
+    } else {
+      query._id = {
+        $gt: users[users.length - 1],
+      };
+    }
+
+    await Promise.all(users.map(updateUser)); // eslint-disable-line no-await-in-loop
+  }
+};
@@ -32,13 +32,11 @@
 *
 */

-
 // CONFIGURATION:
 // - Change the uuid below to be the user's uuid.
 // - Change ALL instances of "todos" to "habits"/"dailys"/"rewards" as
 //   needed. Do not miss any of them!

-
 const uuid = '30fb2640-7121-4968-ace5-f385e60ea6c5';

 db.users.aggregate([
@@ -2,7 +2,6 @@
 // @authorName = 'TheHollidayInn'; // in case script author needs to know when their ...
 // @authorUuid = ''; // ... own data is done

-
 /*
 * This migration moves chat off of groups and into their own model
 */
@@ -38,7 +37,6 @@ async function moveGroupChatToModel (skip = 0) {
    return chatpromises;
  });

-
  const reducedPromises = promises.reduce((acc, curr) => {
    acc = acc.concat(curr); // eslint-disable-line no-param-reassign
    return acc;
@@ -45,7 +45,7 @@ async function fixGroupPlanMembers () {
    pause();
    groupPlanCount += 1;

-    const canonicalMemberCount = await dbUsers.count(
+    const canonicalMemberCount = await dbUsers.countDocuments(
      {
        $or:
          [
@@ -18,7 +18,7 @@ function setUpServer () {
 setUpServer();

 // Replace this with your migration
-const processUsers = require().default;
+const processUsers = require('./archive/2020/20200721_summer_splash_orcas').default;

 processUsers()
  .then(() => {
@@ -25,7 +25,6 @@ const monk = require('monk'); // eslint-disable-line import/no-extraneous-depend

 const dbUsers = monk(connectionString).get('users', { castIds: false });

-
 function processUsers (lastId) {
  // specify a query to limit the affected users (empty for all users):
  const query = {
@@ -86,7 +85,6 @@ function updateUser (user) {

  const set = { migration: migrationName, 'flags.armoireEmpty': false };

-
  if (user.flags.armoireEmpty) {
    // this user believes their armoire has no more items in it
    if (
@@ -121,5 +121,4 @@ function exiting (code, msg) {
  process.exit(code);
 }

-
 processUsers();
@@ -9,7 +9,6 @@ const authorUuid = 'ed4c688c-6652-4a92-9d03-a5a79844174a'; // ... own data is do
 */
 const connectionString = 'mongodb://localhost:27017/habitrpg?auto_reconnect=true'; // FOR TEST DATABASE

-
 const dbUsers = monk(connectionString).get('users', { castIds: false });

 function processUsers (lastId) {
@@ -1,21 +1,21 @@
 {
  "name": "habitica",
  "description": "A habit tracker app which treats your goals like a Role Playing Game.",
-  "version": "4.144.1",
+  "version": "4.151.1",
  "main": "./website/server/index.js",
  "dependencies": {
-    "@babel/core": "^7.10.2",
-    "@babel/preset-env": "^7.10.2",
-    "@babel/register": "^7.10.1",
-    "@google-cloud/trace-agent": "^5.0.0",
+    "@babel/core": "^7.10.3",
+    "@babel/preset-env": "^7.10.3",
+    "@babel/register": "^7.10.3",
+    "@google-cloud/trace-agent": "^5.1.0",
    "@slack/client": "^4.12.0",
    "accepts": "^1.3.5",
    "amazon-payments": "^0.2.8",
    "amplitude": "^3.5.0",
-    "apidoc": "^0.17.5",
+    "apidoc": "^0.24.0",
    "apn": "^2.2.0",
    "apple-auth": "^1.0.6",
-    "bcrypt": "^3.0.8",
+    "bcrypt": "^5.0.0",
    "body-parser": "^1.18.3",
    "compression": "^1.7.4",
    "cookie-session": "^1.4.0",
@@ -30,47 +30,50 @@
    "express-basic-auth": "^1.1.5",
    "express-validator": "^5.2.0",
    "glob": "^7.1.6",
-    "got": "^10.7.0",
+    "got": "^11.5.0",
    "gulp": "^4.0.0",
    "gulp-babel": "^8.0.0",
-    "gulp-imagemin": "^6.2.0",
+    "gulp-imagemin": "^7.1.0",
    "gulp-nodemon": "^2.5.0",
    "gulp.spritesmith": "^6.9.0",
-    "habitica-markdown": "^2.0.0",
-    "helmet": "^3.22.0",
+    "habitica-markdown": "^2.0.2",
+    "helmet": "^3.23.3",
    "image-size": "^0.8.3",
    "in-app-purchase": "^1.11.3",
    "js2xmlparser": "^4.0.1",
    "jsonwebtoken": "^8.5.1",
-    "jwks-rsa": "^1.8.0",
-    "lodash": "^4.17.15",
+    "jwks-rsa": "^1.8.1",
+    "lodash": "^4.17.19",
    "merge-stream": "^2.0.0",
    "method-override": "^3.0.0",
-    "moment": "^2.26.0",
+    "moment": "^2.27.0",
    "moment-recur": "^1.0.7",
-    "mongoose": "^5.9.18",
+    "mongoose": "^5.9.25",
    "morgan": "^1.10.0",
    "nconf": "^0.10.0",
-    "node-gcm": "^1.0.2",
+    "node-gcm": "^1.0.3",
    "on-headers": "^1.0.2",
    "passport": "^0.4.1",
    "passport-facebook": "^3.0.0",
+    "passport-google-oauth2": "^0.2.0",
    "passport-google-oauth20": "1.0.0",
    "paypal-ipn": "3.0.0",
    "paypal-rest-sdk": "^1.8.1",
    "ps-tree": "^1.0.0",
-    "regenerator-runtime": "^0.13.5",
+    "rate-limiter-flexible": "^2.1.7",
+    "redis": "^3.0.2",
+    "regenerator-runtime": "^0.13.7",
    "remove-markdown": "^0.3.0",
    "rimraf": "^3.0.2",
    "short-uuid": "^3.0.0",
    "stripe": "^7.15.0",
-    "superagent": "^5.2.2",
-    "universal-analytics": "^0.4.17",
+    "superagent": "^5.3.1",
+    "universal-analytics": "^0.4.23",
    "useragent": "^2.1.9",
-    "uuid": "^3.4.0",
-    "validator": "^11.0.0",
+    "uuid": "^8.2.0",
+    "validator": "^13.1.1",
    "vinyl-buffer": "^1.0.1",
-    "winston": "^3.2.1",
+    "winston": "^3.3.3",
    "winston-loggly-bulk": "^3.1.0",
    "xml2js": "^0.4.23"
  },
@@ -101,6 +104,7 @@
    "client:unit": "cd website/client && npm run test:unit",
    "start": "gulp nodemon",
    "debug": "gulp nodemon --inspect",
+    "mongo:dev": "run-rs -v 4.2.8 -l ubuntu1804 --keep --dbpath mongodb-data --number 1 --quiet",
    "postinstall": "gulp build && cd website/client && npm install",
    "apidoc": "gulp apidoc"
  },
@@ -108,13 +112,16 @@
    "axios": "^0.19.2",
    "chai": "^4.1.2",
    "chai-as-promised": "^7.1.1",
-    "chalk": "^3.0.0",
+    "chai-moment": "^0.1.0",
+    "chalk": "^4.1.0",
+    "cross-spawn": "^7.0.3",
    "expect.js": "^0.3.1",
    "istanbul": "^1.1.0-alpha.1",
    "mocha": "^5.1.1",
    "monk": "^7.3.0",
    "require-again": "^2.0.0",
-    "sinon": "^7.2.4",
+    "run-rs": "^0.6.2",
+    "sinon": "^9.0.2",
    "sinon-chai": "^3.5.0",
    "sinon-stub-promise": "^4.0.0"
  },
@@ -35,15 +35,14 @@ async function deleteAmplitudeData (userId, email) {

 async function deleteHabiticaData (user, email) {
  const truncatedEmail = email.slice(0, email.indexOf('@'));
+  const set = {
+    'auth.local.hashed_password': '$2a$10$QDnNh1j1yMPnTXDEOV38xOePEWFd4X8DSYwAM8XTmqmacG5X0DKjW',
+    'auth.local.passwordHashMethod': 'bcrypt',
+  };
+  if (!user.auth.local.email) set['auth.local.email'] = `${truncatedEmail}@example.com`;
  await User.update(
    { _id: user._id },
-    {
-      $set: {
-        'auth.local.email': user.auth.local.email ? email : `${truncatedEmail}@example.com`,
-        'auth.local.hashed_password': '$2a$10$QDnNh1j1yMPnTXDEOV38xOePEWFd4X8DSYwAM8XTmqmacG5X0DKjW',
-        'auth.local.passwordHashMethod': 'bcrypt',
-      },
-    },
+    { $set: set },
  );
  const response = await axios.delete(
    `${BASE_URL}/api/v3/user`,
@@ -78,6 +77,7 @@ async function processEmailAddress (email) {

  const socialUsers = await User.find(
    {
+      'auth.local.email': { $not: emailRegex },
      $or: [
        { 'auth.facebook.emails.value': email },
        { 'auth.google.emails.value': email },
@@ -56,7 +56,6 @@ describe('Base model plugin', () => {
    expect(sanitized).not.to.have.property('usuallySettable');
  });

-
  it('can make fields private', () => {
    schema.plugin(baseModel, {
      private: ['amPrivate'],
@@ -42,13 +42,13 @@ describe('cron', () => {
  });

  it('updates user.preferences.timezoneOffsetAtLastCron', () => {
-    const timezoneOffsetFromUserPrefs = 1;
+    const timezoneUtcOffsetFromUserPrefs = -1;

    cron({
-      user, tasksByType, daysMissed, analytics, timezoneOffsetFromUserPrefs,
+      user, tasksByType, daysMissed, analytics, timezoneUtcOffsetFromUserPrefs,
    });

-    expect(user.preferences.timezoneOffsetAtLastCron).to.equal(timezoneOffsetFromUserPrefs);
+    expect(user.preferences.timezoneOffsetAtLastCron).to.equal(1);
  });

  it('resets user.items.lastDrop.count', () => {
@@ -240,7 +240,7 @@ describe('cron', () => {
      user1.purchased.plan.consecutive.gemCapExtra = 0;

      it('does not increment consecutive benefits after the first month', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(1, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(1, 'months')
          .add(2, 'days')
          .toDate());
        // Add 1 month to simulate what happens a month after the subscription was created.
@@ -256,7 +256,7 @@ describe('cron', () => {
      });

      it('does not increment consecutive benefits after the second month', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(2, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(2, 'months')
          .add(2, 'days')
          .toDate());
        // Add 1 month to simulate what happens a month after the subscription was created.
@@ -272,7 +272,7 @@ describe('cron', () => {
      });

      it('increments consecutive benefits after the third month', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(3, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(3, 'months')
          .add(2, 'days')
          .toDate());
        // Add 1 month to simulate what happens a month after the subscription was created.
@@ -288,7 +288,7 @@ describe('cron', () => {
      });

      it('does not increment consecutive benefits after the fourth month', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(4, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(4, 'months')
          .add(2, 'days')
          .toDate());
        // Add 1 month to simulate what happens a month after the subscription was created.
@@ -304,7 +304,7 @@ describe('cron', () => {
      });

      it('increments consecutive benefits correctly if user has been absent with continuous subscription', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(10, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(10, 'months')
          .add(2, 'days')
          .toDate());
        cron({
@@ -339,7 +339,7 @@ describe('cron', () => {
      user3.purchased.plan.consecutive.gemCapExtra = 5;

      it('does not increment consecutive benefits in the first month of the first paid period that they already have benefits for', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(1, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(1, 'months')
          .add(2, 'days')
          .toDate());
        cron({
@@ -352,7 +352,7 @@ describe('cron', () => {
      });

      it('does not increment consecutive benefits in the middle of the period that they already have benefits for', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(2, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(2, 'months')
          .add(2, 'days')
          .toDate());
        cron({
@@ -365,7 +365,7 @@ describe('cron', () => {
      });

      it('does not increment consecutive benefits in the final month of the period that they already have benefits for', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(3, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(3, 'months')
          .add(2, 'days')
          .toDate());
        cron({
@@ -378,7 +378,7 @@ describe('cron', () => {
      });

      it('increments consecutive benefits the month after the second paid period has started', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(4, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(4, 'months')
          .add(2, 'days')
          .toDate());
        cron({
@@ -391,7 +391,7 @@ describe('cron', () => {
      });

      it('does not increment consecutive benefits in the second month of the second period that they already have benefits for', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(5, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(5, 'months')
          .add(2, 'days')
          .toDate());
        cron({
@@ -404,7 +404,7 @@ describe('cron', () => {
      });

      it('does not increment consecutive benefits in the final month of the second period that they already have benefits for', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(6, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(6, 'months')
          .add(2, 'days')
          .toDate());
        cron({
@@ -417,7 +417,7 @@ describe('cron', () => {
      });

      it('increments consecutive benefits the month after the third paid period has started', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(7, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(7, 'months')
          .add(2, 'days')
          .toDate());
        cron({
@@ -430,7 +430,7 @@ describe('cron', () => {
      });

      it('increments consecutive benefits correctly if user has been absent with continuous subscription', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(10, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(10, 'months')
          .add(2, 'days')
          .toDate());
        cron({
@@ -465,7 +465,7 @@ describe('cron', () => {
      user6.purchased.plan.consecutive.gemCapExtra = 10;

      it('does not increment consecutive benefits in the first month of the first paid period that they already have benefits for', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(1, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(1, 'months')
          .add(2, 'days')
          .toDate());
        cron({
@@ -478,7 +478,7 @@ describe('cron', () => {
      });

      it('does not increment consecutive benefits in the final month of the period that they already have benefits for', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(6, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(6, 'months')
          .add(2, 'days')
          .toDate());
        cron({
@@ -491,7 +491,7 @@ describe('cron', () => {
      });

      it('increments consecutive benefits the month after the second paid period has started', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(7, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(7, 'months')
          .add(2, 'days')
          .toDate());
        cron({
@@ -504,7 +504,7 @@ describe('cron', () => {
      });

      it('increments consecutive benefits the month after the third paid period has started', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(13, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(13, 'months')
          .add(2, 'days')
          .toDate());
        cron({
@@ -517,7 +517,7 @@ describe('cron', () => {
      });

      it('increments consecutive benefits correctly if user has been absent with continuous subscription', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(19, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(19, 'months')
          .add(2, 'days')
          .toDate());
        cron({
@@ -552,7 +552,7 @@ describe('cron', () => {
      user12.purchased.plan.consecutive.gemCapExtra = 20;

      it('does not increment consecutive benefits in the first month of the first paid period that they already have benefits for', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(1, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(1, 'months')
          .add(2, 'days')
          .toDate());
        cron({
@@ -565,7 +565,7 @@ describe('cron', () => {
      });

      it('does not increment consecutive benefits in the final month of the period that they already have benefits for', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(12, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(12, 'months')
          .add(2, 'days')
          .toDate());
        cron({
@@ -578,7 +578,7 @@ describe('cron', () => {
      });

      it('increments consecutive benefits the month after the second paid period has started', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(13, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(13, 'months')
          .add(2, 'days')
          .toDate());
        cron({
@@ -591,7 +591,7 @@ describe('cron', () => {
      });

      it('increments consecutive benefits the month after the third paid period has started', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(25, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(25, 'months')
          .add(2, 'days')
          .toDate());
        cron({
@@ -604,7 +604,7 @@ describe('cron', () => {
      });

      it('increments consecutive benefits correctly if user has been absent with continuous subscription', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(37, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(37, 'months')
          .add(2, 'days')
          .toDate());
        cron({
@@ -641,7 +641,7 @@ describe('cron', () => {
      user3g.purchased.plan.consecutive.gemCapExtra = 5;

      it('does not increment consecutive benefits in the first month of the gift subscription', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(1, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(1, 'months')
          .add(2, 'days')
          .toDate());
        cron({
@@ -654,7 +654,7 @@ describe('cron', () => {
      });

      it('does not increment consecutive benefits in the second month of the gift subscription', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(2, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(2, 'months')
          .add(2, 'days')
          .toDate());
        cron({
@@ -667,7 +667,7 @@ describe('cron', () => {
      });

      it('does not increment consecutive benefits in the third month of the gift subscription', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(3, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(3, 'months')
          .add(2, 'days')
          .toDate());
        cron({
@@ -680,7 +680,7 @@ describe('cron', () => {
      });

      it('does not increment consecutive benefits in the month after the gift subscription has ended', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(4, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(4, 'months')
          .add(2, 'days')
          .toDate());
        cron({
@@ -717,7 +717,7 @@ describe('cron', () => {
      user6x.purchased.plan.consecutive.gemCapExtra = 15;

      it('increments consecutive benefits in the first month since the fix for #4819 goes live', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(1, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(1, 'months')
          .add(2, 'days')
          .toDate());
        cron({
@@ -730,7 +730,7 @@ describe('cron', () => {
      });

      it('does not increment consecutive benefits in the second month after the fix goes live', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(2, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(2, 'months')
          .add(2, 'days')
          .toDate());
        cron({
@@ -743,7 +743,7 @@ describe('cron', () => {
      });

      it('does not increment consecutive benefits in the third month after the fix goes live', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(3, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(3, 'months')
          .add(2, 'days')
          .toDate());
        cron({
@@ -756,7 +756,7 @@ describe('cron', () => {
      });

      it('increments consecutive benefits in the seventh month after the fix goes live', () => {
-        clock = sinon.useFakeTimers(moment().zone(0).startOf('month').add(7, 'months')
+        clock = sinon.useFakeTimers(moment().utcOffset(0).startOf('month').add(7, 'months')
          .add(2, 'days')
          .toDate());
        cron({
@@ -0,0 +1,50 @@
+import os from 'os';
+import nconf from 'nconf';
+import requireAgain from 'require-again';
+
+const pathToMongoLib = '../../../../website/server/libs/mongodb';
+
+describe('mongodb', () => {
+  afterEach(() => {
+    sandbox.restore();
+  });
+
+  describe('getDevelopmentConnectionUrl', () => {
+    it('returns the original connection url if not on windows', () => {
+      sandbox.stub(os, 'platform').returns('linux');
+      const mongoLibOverride = requireAgain(pathToMongoLib);
+
+      const originalString = 'mongodb://localhost:3030';
+      const string = mongoLibOverride.getDevelopmentConnectionUrl(originalString);
+      expect(string).to.equal(originalString);
+    });
+
+    it('replaces localhost with hostname on windows', () => {
+      sandbox.stub(os, 'platform').returns('win32');
+      sandbox.stub(os, 'hostname').returns('hostname');
+      const mongoLibOverride = requireAgain(pathToMongoLib);
+
+      const originalString = 'mongodb://localhost:3030';
+      const string = mongoLibOverride.getDevelopmentConnectionUrl(originalString);
+      expect(string).to.equal('mongodb://hostname:3030');
+    });
+  });
+
+  describe('getDefaultConnectionOptions', () => {
+    it('returns development config when IS_PROD is false', () => {
+      sandbox.stub(nconf, 'get').withArgs('IS_PROD').returns(false);
+      const mongoLibOverride = requireAgain(pathToMongoLib);
+
+      const options = mongoLibOverride.getDefaultConnectionOptions();
+      expect(options).to.have.all.keys(['useNewUrlParser', 'useUnifiedTopology']);
+    });
+
+    it('returns production config when IS_PROD is true', () => {
+      sandbox.stub(nconf, 'get').withArgs('IS_PROD').returns(true);
+      const mongoLibOverride = requireAgain(pathToMongoLib);
+
+      const options = mongoLibOverride.getDefaultConnectionOptions();
+      expect(options).to.have.all.keys(['useNewUrlParser', 'useUnifiedTopology', 'keepAlive', 'keepAliveInitialDelay']);
+    });
+  });
+});
@@ -1,5 +1,3 @@
-import uuid from 'uuid';
-
 import {
  generateGroup,
 } from '../../../../../helpers/api-unit.helper';
@@ -7,6 +5,7 @@ import { model as User } from '../../../../../../website/server/models/user';
 import { model as Group } from '../../../../../../website/server/models/group';
 import amzLib from '../../../../../../website/server/libs/payments/amazon';
 import payments from '../../../../../../website/server/libs/payments/payments';
+import common from '../../../../../../website/common';

 describe('#upgradeGroupPlan', () => {
  let spy; let data; let user; let group; let
@@ -41,7 +40,7 @@ describe('#upgradeGroupPlan', () => {
    spy.resolves([]);

    uuidString = 'uuid-v4';
-    sinon.stub(uuid, 'v4').returns(uuidString);
+    sinon.stub(common, 'uuid').returns(uuidString);

    data.groupId = group._id;
    data.sub.quantity = 3;
@@ -49,7 +48,7 @@ describe('#upgradeGroupPlan', () => {

  afterEach(() => {
    amzLib.authorizeOnBillingAgreement.restore();
-    uuid.v4.restore();
+    common.uuid.restore();
  });

  it('charges for a new member', async () => {
@@ -9,7 +9,7 @@ describe('preenHistory', () => {
  beforeEach(() => {
    // Replace system clocks so we can get predictable results
    clock = sinon.useFakeTimers({
-      now: Number(moment('2013-10-20').zone(0).startOf('day').toDate()),
+      now: Number(moment('2013-10-20').utcOffset(0).startOf('day').toDate()),
      toFake: ['Date'],
    });
  });
@@ -1,4 +1,3 @@
-
 import path from 'path';
 import nconf from 'nconf';
 import setupNconf from '../../../../website/server/libs/setupNconf';
@@ -21,7 +21,8 @@ describe('cors middleware', () => {
    expect(res.set).to.have.been.calledWith({
      'Access-Control-Allow-Origin': '*',
      'Access-Control-Allow-Methods': 'OPTIONS,GET,POST,PUT,HEAD,DELETE',
-      'Access-Control-Allow-Headers': 'Content-Type,Accept,Content-Encoding,X-Requested-With,x-api-user,x-api-key,x-client',
+      'Access-Control-Allow-Headers': 'Authorization,Content-Type,Accept,Content-Encoding,X-Requested-With,x-api-user,x-api-key,x-client',
+      'Access-Control-Expose-Headers': 'X-RateLimit-Limit,X-RateLimit-Remaining,X-RateLimit-Reset,Retry-After',
    });
    expect(res.sendStatus).to.not.have.been.called;
    expect(next).to.have.been.calledOnce;
@@ -33,7 +34,8 @@ describe('cors middleware', () => {
    expect(res.set).to.have.been.calledWith({
      'Access-Control-Allow-Origin': '*',
      'Access-Control-Allow-Methods': 'OPTIONS,GET,POST,PUT,HEAD,DELETE',
-      'Access-Control-Allow-Headers': 'Content-Type,Accept,Content-Encoding,X-Requested-With,x-api-user,x-api-key,x-client',
+      'Access-Control-Allow-Headers': 'Authorization,Content-Type,Accept,Content-Encoding,X-Requested-With,x-api-user,x-api-key,x-client',
+      'Access-Control-Expose-Headers': 'X-RateLimit-Limit,X-RateLimit-Remaining,X-RateLimit-Reset,Retry-After',
    });
    expect(res.sendStatus).to.have.been.calledWith(200);
    expect(next).to.not.have.been.called;
@@ -57,7 +57,7 @@ describe('ipBlocker middleware', () => {
  });

  it('does not throw when the ip does not match', () => {
-    req.headers['x-forwarded-for'] = '192.168.1.1';
+    req.ip = '192.168.1.1';
    sandbox.stub(nconf, 'get').withArgs('BLOCKED_IPS').returns('192.168.1.2');
    const attachIpBlocker = requireAgain(pathToIpBlocker).default;
    attachIpBlocker(req, res, next);
@@ -65,30 +65,12 @@ describe('ipBlocker middleware', () => {
    checkErrorNotThrown(next);
  });

-  it('throws when a matching ip exist in x-forwarded-for', () => {
-    req.headers['x-forwarded-for'] = '192.168.1.1';
+  it('throws when the ip is blocked', () => {
+    req.ip = '192.168.1.1';
    sandbox.stub(nconf, 'get').withArgs('BLOCKED_IPS').returns('192.168.1.1');
    const attachIpBlocker = requireAgain(pathToIpBlocker).default;
    attachIpBlocker(req, res, next);

    checkErrorThrown(next);
  });
-
-  it('trims ips in x-forwarded-for', () => {
-    req.headers['x-forwarded-for'] = '192.168.1.1';
-    sandbox.stub(nconf, 'get').withArgs('BLOCKED_IPS').returns(',  192.168.1.1 ,   192.168.1.4, ');
-    const attachIpBlocker = requireAgain(pathToIpBlocker).default;
-    attachIpBlocker(req, res, next);
-
-    checkErrorThrown(next);
-  });
-
-  it('works when multiple ips are passed in x-forwarded-for', () => {
-    req.headers['x-forwarded-for'] = '192.168.1.4';
-    sandbox.stub(nconf, 'get').withArgs('BLOCKED_IPS').returns('192.168.1.1, 192.168.1.4, 192.168.1.3');
-    const attachIpBlocker = requireAgain(pathToIpBlocker).default;
-    attachIpBlocker(req, res, next);
-
-    checkErrorThrown(next);
-  });
 });
@@ -0,0 +1,141 @@
+import nconf from 'nconf';
+import { RateLimiterMemory } from 'rate-limiter-flexible';
+import requireAgain from 'require-again';
+import {
+  generateRes,
+  generateReq,
+  generateNext,
+} from '../../../helpers/api-unit.helper';
+import { TooManyRequests } from '../../../../website/server/libs/errors';
+import apiError from '../../../../website/server/libs/apiError';
+import logger from '../../../../website/server/libs/logger';
+
+describe('rateLimiter middleware', () => {
+  const pathToRateLimiter = '../../../../website/server/middlewares/rateLimiter';
+
+  let res; let req; let next; let nconfGetStub;
+
+  beforeEach(() => {
+    nconfGetStub = sandbox.stub(nconf, 'get');
+
+    nconfGetStub.withArgs('NODE_ENV').returns('test');
+    nconfGetStub.withArgs('IS_TEST').returns(true);
+
+    res = generateRes();
+    req = generateReq();
+    next = generateNext();
+  });
+
+  afterEach(() => {
+    sandbox.restore();
+  });
+
+  it('is disabled when the env var is not defined', () => {
+    nconfGetStub.withArgs('RATE_LIMITER_ENABLED').returns(undefined);
+    const attachRateLimiter = requireAgain(pathToRateLimiter).default;
+    attachRateLimiter(req, res, next);
+
+    expect(next).to.have.been.calledOnce;
+    const calledWith = next.getCall(0).args;
+    expect(typeof calledWith[0] === 'undefined').to.equal(true);
+    expect(res.set).to.not.have.been.called;
+  });
+
+  it('is disabled when the env var is an not "true"', () => {
+    nconfGetStub.withArgs('RATE_LIMITER_ENABLED').returns('false');
+    const attachRateLimiter = requireAgain(pathToRateLimiter).default;
+    attachRateLimiter(req, res, next);
+
+    expect(next).to.have.been.calledOnce;
+    const calledWith = next.getCall(0).args;
+    expect(typeof calledWith[0] === 'undefined').to.equal(true);
+    expect(res.set).to.not.have.been.called;
+  });
+
+  it('does not throw when there are available points', async () => {
+    nconfGetStub.withArgs('RATE_LIMITER_ENABLED').returns('true');
+    const attachRateLimiter = requireAgain(pathToRateLimiter).default;
+    await attachRateLimiter(req, res, next);
+
+    expect(next).to.have.been.calledOnce;
+    const calledWith = next.getCall(0).args;
+    expect(typeof calledWith[0] === 'undefined').to.equal(true);
+
+    expect(res.set).to.have.been.calledOnce;
+    expect(res.set).to.have.been.calledWithMatch({
+      'X-RateLimit-Limit': 30,
+      'X-RateLimit-Remaining': 29,
+      'X-RateLimit-Reset': sinon.match(Date),
+    });
+  });
+
+  it('does not throw when an unknown error is thrown by the rate limiter', async () => {
+    nconfGetStub.withArgs('RATE_LIMITER_ENABLED').returns('true');
+    sandbox.stub(logger, 'error');
+    sandbox.stub(RateLimiterMemory.prototype, 'consume')
+      .returns(Promise.reject(new Error('Unknown error.')));
+
+    const attachRateLimiter = requireAgain(pathToRateLimiter).default;
+    await attachRateLimiter(req, res, next);
+
+    expect(next).to.have.been.calledOnce;
+    const calledWith = next.getCall(0).args;
+    expect(typeof calledWith[0] === 'undefined').to.equal(true);
+    expect(res.set).to.not.have.been.called;
+
+    expect(logger.error).to.be.calledOnce;
+    expect(logger.error).to.have.been.calledWithMatch(Error, 'Rate Limiter Error');
+  });
+
+  it('throws when there are no available points remaining', async () => {
+    nconfGetStub.withArgs('RATE_LIMITER_ENABLED').returns('true');
+    const attachRateLimiter = requireAgain(pathToRateLimiter).default;
+
+    // call for 31 times
+    for (let i = 0; i < 31; i += 1) {
+      await attachRateLimiter(req, res, next); // eslint-disable-line no-await-in-loop
+    }
+
+    expect(next).to.have.been.callCount(31);
+    const calledWith = next.getCall(30).args;
+    expect(calledWith[0].message).to.equal(apiError('clientRateLimited'));
+    expect(calledWith[0] instanceof TooManyRequests).to.equal(true);
+
+    expect(res.set).to.have.been.callCount(31);
+    expect(res.set).to.have.been.calledWithMatch({
+      'Retry-After': sinon.match(Number),
+      'X-RateLimit-Limit': 30,
+      'X-RateLimit-Remaining': 0,
+      'X-RateLimit-Reset': sinon.match(Date),
+    });
+  });
+
+  it('uses the user id if supplied or the ip address', async () => {
+    nconfGetStub.withArgs('RATE_LIMITER_ENABLED').returns('true');
+    const attachRateLimiter = requireAgain(pathToRateLimiter).default;
+
+    req.ip = 1;
+    await attachRateLimiter(req, res, next);
+
+    req.headers['x-api-user'] = 'user-1';
+    await attachRateLimiter(req, res, next);
+    await attachRateLimiter(req, res, next);
+
+    // user id an ip are counted as separate sources
+    expect(res.set).to.have.been.calledWithMatch({
+      'X-RateLimit-Limit': 30,
+      'X-RateLimit-Remaining': 28, // 2 calls with user id
+      'X-RateLimit-Reset': sinon.match(Date),
+    });
+
+    req.headers['x-api-user'] = undefined;
+    await attachRateLimiter(req, res, next);
+    await attachRateLimiter(req, res, next);
+
+    expect(res.set).to.have.been.calledWithMatch({
+      'X-RateLimit-Limit': 30,
+      'X-RateLimit-Remaining': 27, // 3 calls with only ip
+      'X-RateLimit-Reset': sinon.match(Date),
+    });
+  });
+});
@@ -22,7 +22,7 @@ describe('redirects middleware', () => {
      const nconfStub = sandbox.stub(nconf, 'get');
      nconfStub.withArgs('BASE_URL').returns('https://habitica.com');
      nconfStub.withArgs('IS_PROD').returns(true);
-      req.header = sandbox.stub().withArgs('x-forwarded-proto').returns('http');
+      req.protocol = 'http';
      req.originalUrl = '/static/front';

      const attachRedirects = requireAgain(pathToRedirectsMiddleware);
@@ -37,7 +37,7 @@ describe('redirects middleware', () => {
      const nconfStub = sandbox.stub(nconf, 'get');
      nconfStub.withArgs('BASE_URL').returns('https://habitica.com');
      nconfStub.withArgs('IS_PROD').returns(true);
-      req.header = sandbox.stub().withArgs('x-forwarded-proto').returns('https');
+      req.protocol = 'https';
      req.originalUrl = '/static/front';

      const attachRedirects = requireAgain(pathToRedirectsMiddleware);
@@ -51,7 +51,7 @@ describe('redirects middleware', () => {
      const nconfStub = sandbox.stub(nconf, 'get');
      nconfStub.withArgs('BASE_URL').returns('https://habitica.com');
      nconfStub.withArgs('IS_PROD').returns(false);
-      req.header = sandbox.stub().withArgs('x-forwarded-proto').returns('http');
+      req.protocol = 'http';
      req.originalUrl = '/static/front';

      const attachRedirects = requireAgain(pathToRedirectsMiddleware);
@@ -65,7 +65,7 @@ describe('redirects middleware', () => {
      const nconfStub = sandbox.stub(nconf, 'get');
      nconfStub.withArgs('BASE_URL').returns('http://habitica.com');
      nconfStub.withArgs('IS_PROD').returns(true);
-      req.header = sandbox.stub().withArgs('x-forwarded-proto').returns('http');
+      req.protocol = 'http';
      req.originalUrl = '/static/front';

      const attachRedirects = requireAgain(pathToRedirectsMiddleware);
@@ -81,7 +81,7 @@ describe('redirects middleware', () => {
      nconfStub.withArgs('IS_PROD').returns(true);
      nconfStub.withArgs('SKIP_SSL_CHECK_KEY').returns('test-key');

-      req.header = sandbox.stub().withArgs('x-forwarded-proto').returns('http');
+      req.protocol = 'http';
      req.originalUrl = '/static/front';
      req.query.skipSSLCheck = 'test-key';

@@ -97,7 +97,7 @@ describe('redirects middleware', () => {
      nconfStub.withArgs('IS_PROD').returns(true);
      nconfStub.withArgs('SKIP_SSL_CHECK_KEY').returns('test-key');

-      req.header = sandbox.stub().withArgs('x-forwarded-proto').returns('http');
+      req.protocol = 'http';
      req.originalUrl = '/static/front?skipSSLCheck=INVALID';
      req.query.skipSSLCheck = 'INVALID';

@@ -114,7 +114,7 @@ describe('redirects middleware', () => {
      nconfStub.withArgs('IS_PROD').returns(true);
      nconfStub.withArgs('SKIP_SSL_CHECK_KEY').returns(null);

-      req.header = sandbox.stub().withArgs('x-forwarded-proto').returns('http');
+      req.protocol = 'http';
      req.originalUrl = '/static/front';
      req.query.skipSSLCheck = 'INVALID';

@@ -16,7 +16,6 @@ describe('response middleware', () => {
    next = generateNext();
  });

-
  it('attaches respond method to res', () => {
    responseMiddleware(req, res, next);

@@ -35,6 +35,33 @@ describe('Challenge Model', () => {
      notes: 'test notes',
    },
  };
+  const tasks2ToTest = {
+    habit: {
+      text: 'test habit 2',
+      type: 'habit',
+      up: false,
+      down: true,
+      notes: 'test notes',
+    },
+    todo: {
+      text: 'test todo 2',
+      type: 'todo',
+      notes: 'test notes',
+    },
+    daily: {
+      text: 'test daily 2',
+      type: 'daily',
+      frequency: 'daily',
+      everyX: 5,
+      startDate: new Date(),
+      notes: 'test notes',
+    },
+    reward: {
+      text: 'test reward 2',
+      type: 'reward',
+      notes: 'test notes',
+    },
+  };

  beforeEach(async () => {
    guild = new Group({
@@ -146,6 +173,60 @@ describe('Challenge Model', () => {
        expect(syncedTask.attribute).to.eql('str');
      });

+      it('should add challenge tag back to user upon syncing challenge tasks to a user with challenge tag removed', async () => {
+        await challenge.addTasks([task]);
+
+        const newMember = new User({
+          guilds: [guild._id],
+        });
+        await newMember.save();
+        await challenge.syncTasksToUser(newMember);
+
+        let updatedNewMember = await User.findById(newMember._id).exec();
+        const updatedNewMemberId = updatedNewMember._id;
+
+        updatedNewMember.tags = [];
+        await updatedNewMember.save();
+
+        const taskValue2 = tasks2ToTest[taskType];
+        const task2 = new Tasks[`${taskType}`](Tasks.Task.sanitize(taskValue2));
+        task2.challenge.id = challenge._id;
+        await challenge.addTasks([task2]);
+        await challenge.syncTasksToUser(updatedNewMember);
+
+        updatedNewMember = await User.findById(updatedNewMemberId).exec();
+
+        expect(updatedNewMember.tags.length).to.equal(1);
+        expect(updatedNewMember.tags[0].id).to.equal(challenge._id);
+        expect(updatedNewMember.tags[0].name).to.equal(challenge.shortName);
+      });
+
+      it('should not add a duplicate challenge tag to user upon syncing challenge tasks to a user with existing challenge tag', async () => {
+        await challenge.addTasks([task]);
+
+        const newMember = new User({
+          guilds: [guild._id],
+        });
+        await newMember.save();
+        await challenge.syncTasksToUser(newMember);
+
+        let updatedNewMember = await User.findById(newMember._id).exec();
+        const updatedNewMemberId = updatedNewMember._id;
+
+        const taskValue2 = tasks2ToTest[taskType];
+        const task2 = new Tasks[`${taskType}`](Tasks.Task.sanitize(taskValue2));
+        task2.challenge.id = challenge._id;
+        await challenge.addTasks([task2]);
+        await challenge.syncTasksToUser(updatedNewMember);
+
+        updatedNewMember = await User.findById(updatedNewMemberId);
+
+        expect(updatedNewMember.tags.length).to.equal(8);
+        expect(updatedNewMember.tags[7].id).to.equal(challenge._id);
+        expect(updatedNewMember.tags[7].name).to.equal(challenge.shortName);
+        expect(updatedNewMember.tags.filter(tag => tag.id === challenge._id).length).to.equal(1);
+      });
+
      it('syncs challenge tasks to a user with the existing task', async () => {
        await challenge.addTasks([task]);

@@ -769,7 +769,6 @@ describe('Group Model', () => {
        expect(res.t).to.not.be.called;
      });

-
      it('does not throw an error if only user ids are passed in', async () => {
        await Group.validateInvitations({ uuids: ['user-id', 'user-id2'] }, res);
        expect(res.t).to.not.be.called;
@@ -235,15 +235,16 @@ describe('Group Task Methods', () => {
        });
      });

-      it('removes an assigned task and unlinks assignees', async () => {
+      it('removes assigned tasks when master task is deleted', async () => {
        await guild.syncTask(task, leader);
        await guild.removeTask(task);

        const updatedLeader = await User.findOne({ _id: leader._id });
-        const updatedLeadersTasks = await Tasks.Task.find({ _id: { $in: updatedLeader.tasksOrder[`${taskType}s`] } });
+        const updatedLeadersTasks = await Tasks.Task.find({ userId: leader._id, type: taskType });
        const syncedTask = find(updatedLeadersTasks, findLinkedTask);

-        expect(syncedTask.group.broken).to.equal('TASK_DELETED');
+        expect(updatedLeader.tasksOrder[`${taskType}s`]).to.not.include(task._id);
+        expect(syncedTask).to.not.exist;
      });

      it('unlinks and deletes group tasks for a user when remove-all is specified', async () => {
@@ -432,7 +432,6 @@ describe('User Model', () => {
      user = new User();
    });

-
    it('returns false if user does not have customer id', () => {
      expect(user.isSubscribed()).to.be.undefined;
    });
@@ -558,7 +557,6 @@ describe('User Model', () => {
    });
  });

-
  context('hasCancelled', () => {
    let user;
    beforeEach(() => {
@@ -763,7 +761,7 @@ describe('User Model', () => {
    });
  });

-  context('days missed', () => {
+  describe('daysUserHasMissed', () => {
    // http://forbrains.co.uk/international_tools/earth_timezones
    let user;

@@ -771,24 +769,51 @@ describe('User Model', () => {
      user = new User();
    });

-    it('should not cron early when going back a timezone', () => {
-      const yesterday = moment('2017-12-05T00:00:00.000-06:00'); // 11 pm on 4 Texas
-      const timezoneOffset = moment().zone('-06:00').zone();
-      user.lastCron = yesterday;
-      user.preferences.timezoneOffset = timezoneOffset;
+    it('correctly calculates days missed since lastCron', () => {
+      const now = moment();
+      user.lastCron = moment(now).subtract(5, 'days');

-      const today = moment('2017-12-06T00:00:00.000-06:00'); // 11 pm on 4 Texas
-      const req = {};
-      req.header = () => timezoneOffset + 60;
+      const { daysMissed } = user.daysUserHasMissed(now);

-      const { daysMissed } = user.daysUserHasMissed(today, req);
+      expect(daysMissed).to.eql(5);
+    });

+    it('uses timezone from preferences to calculate days missed', () => {
+      const now = moment('2017-07-08 01:00:00Z');
+      user.lastCron = moment('2017-07-04 13:00:00Z');
+      user.preferences.timezoneOffset = 120;
+
+      const { daysMissed } = user.daysUserHasMissed(now);
+
+      expect(daysMissed).to.eql(3);
+    });
+
+    it('uses timezone at last cron to calculate days missed', () => {
+      const now = moment('2017-09-08 13:00:00Z');
+      user.lastCron = moment('2017-09-06 01:00:00+02:00');
+      user.preferences.timezoneOffset = 0;
+      user.preferences.timezoneOffsetAtLastCron = -120;
+
+      const { daysMissed } = user.daysUserHasMissed(now);
+
+      expect(daysMissed).to.eql(2);
+    });
+
+    it('respects new timezone that drags time into same day', () => {
+      user.lastCron = moment('2017-12-05T00:00:00.000-06:00');
+      user.preferences.timezoneOffset = 360;
+      const today = moment('2017-12-06T00:00:00.000-06:00');
+      const requestWithMinus7Timezone = { header: () => 420 };
+
+      const { daysMissed } = user.daysUserHasMissed(today, requestWithMinus7Timezone);
+
+      expect(user.preferences.timezoneOffset).to.eql(420);
      expect(daysMissed).to.eql(0);
    });

    it('should not cron early when going back a timezone with a custom day start', () => {
      const yesterday = moment('2017-12-05T02:00:00.000-08:00');
-      const timezoneOffset = moment().zone('-08:00').zone();
+      const timezoneOffset = 480;
      user.lastCron = yesterday;
      user.preferences.timezoneOffset = timezoneOffset;
      user.preferences.dayStart = 2;
@@ -299,7 +299,6 @@ describe('Webhook Model', () => {
        });
      });

-
      context('type is globalActivity', () => {
        let config;

@@ -117,7 +117,7 @@ describe('GET /challenges/:challengeId/members', () => {
    expect(res[0].profile).to.have.all.keys(['name']);
  });

-  it('returns only first 30 members if req.query.includeAllMembers is not true', async () => {
+  it('returns only first 30 members if req.query.includeAllMembers is not true and req.query.limit is undefined', async () => {
    const group = await generateGroup(user, { type: 'party', name: generateUUID() });
    const challenge = await generateChallenge(user, group);
    await user.post(`/challenges/${challenge._id}/join`);
@@ -136,7 +136,7 @@ describe('GET /challenges/:challengeId/members', () => {
    });
  });

-  it('returns only first 30 members if req.query.includeAllMembers is not defined', async () => {
+  it('returns only first 30 members if req.query.includeAllMembers is not defined and req.query.limit is undefined', async () => {
    const group = await generateGroup(user, { type: 'party', name: generateUUID() });
    const challenge = await generateChallenge(user, group);
    await user.post(`/challenges/${challenge._id}/join`);
@@ -155,6 +155,68 @@ describe('GET /challenges/:challengeId/members', () => {
    });
  });

+  it('returns an error if req.query.limit is over 60', async () => {
+    const group = await generateGroup(user, { type: 'party', privacy: 'private' });
+    const challenge = await generateChallenge(user, group);
+    const anotherUser = await generateUser();
+
+    await expect(anotherUser.get(`/challenges/${challenge._id}/members?limit=61`)).to.eventually.be.rejected.and.eql({
+      code: 400,
+      error: 'BadRequest',
+      message: t('invalidReqParams'),
+    });
+  });
+
+  it('returns an error if req.query.limit is under 1', async () => {
+    const group = await generateGroup(user, { type: 'party', privacy: 'private' });
+    const challenge = await generateChallenge(user, group);
+    const anotherUser = await generateUser();
+
+    await expect(anotherUser.get(`/challenges/${challenge._id}/members?limit=-13`)).to.eventually.be.rejected.and.eql({
+      code: 400,
+      error: 'BadRequest',
+      message: t('invalidReqParams'),
+    });
+  });
+
+  it('returns an error if req.query.limit is not an integer', async () => {
+    const group = await generateGroup(user, { type: 'party', privacy: 'private' });
+    const challenge = await generateChallenge(user, group);
+    const anotherUser = await generateUser();
+
+    await expect(anotherUser.get(`/challenges/${challenge._id}/members?limit=true`)).to.eventually.be.rejected.and.eql({
+      code: 400,
+      error: 'BadRequest',
+      message: t('invalidReqParams'),
+    });
+  });
+
+  it('returns up to 60 members when req.query.limit is specified', async () => {
+    const group = await generateGroup(user, { type: 'party', name: generateUUID() });
+    const challenge = await generateChallenge(user, group);
+    await user.post(`/challenges/${challenge._id}/join`);
+
+    const usersToGenerate = [];
+    for (let i = 0; i < 62; i += 1) {
+      usersToGenerate.push(generateUser({ challenges: [challenge._id] }));
+    }
+    await Promise.all(usersToGenerate);
+
+    let res = await user.get(`/challenges/${challenge._id}/members?limit=57`);
+    expect(res.length).to.equal(57);
+    res.forEach(member => {
+      expect(member).to.have.all.keys(['_id', 'auth', 'flags', 'id', 'profile']);
+      expect(member.profile).to.have.all.keys(['name']);
+    });
+
+    res = await user.get(`/challenges/${challenge._id}/members?limit=60&lastId=${res[res.length - 1]._id}`);
+    expect(res.length).to.equal(6);
+    res.forEach(member => {
+      expect(member).to.have.all.keys(['_id', 'auth', 'flags', 'id', 'profile']);
+      expect(member.profile).to.have.all.keys(['name']);
+    });
+  }).timeout(30000);
+
  it('returns all members if req.query.includeAllMembers is true', async () => {
    const group = await generateGroup(user, { type: 'party', name: generateUUID() });
    const challenge = await generateChallenge(user, group);
@@ -70,7 +70,7 @@ describe('GET /groups/:groupId/invites', () => {
    expect(res[0].profile).to.have.all.keys(['name']);
  });

-  it('returns only first 30 invites', async () => {
+  it('returns only first 30 invites by default (req.query.limit not specified)', async () => {
    const leader = await generateUser({ balance: 4 });
    const group = await generateGroup(leader, { type: 'guild', privacy: 'public', name: generateUUID() });

@@ -89,6 +89,65 @@ describe('GET /groups/:groupId/invites', () => {
    });
  }).timeout(10000);

+  it('returns an error if req.query.limit is over 60', async () => {
+    const leader = await generateUser({ balance: 4 });
+    const group = await generateGroup(leader, { type: 'guild', privacy: 'public', name: generateUUID() });
+
+    await expect(leader.get(`/groups/${group._id}/invites?limit=61`)).to.eventually.be.rejected.and.eql({
+      code: 400,
+      error: 'BadRequest',
+      message: t('invalidReqParams'),
+    });
+  });
+
+  it('returns an error if req.query.limit is under 1', async () => {
+    const leader = await generateUser({ balance: 4 });
+    const group = await generateGroup(leader, { type: 'guild', privacy: 'public', name: generateUUID() });
+
+    await expect(leader.get(`/groups/${group._id}/invites?limit=-1`)).to.eventually.be.rejected.and.eql({
+      code: 400,
+      error: 'BadRequest',
+      message: t('invalidReqParams'),
+    });
+  });
+
+  it('returns an error if req.query.limit is not an integer', async () => {
+    const leader = await generateUser({ balance: 4 });
+    const group = await generateGroup(leader, { type: 'guild', privacy: 'public', name: generateUUID() });
+
+    await expect(leader.get(`/groups/${group._id}/invites?limit=1.3`)).to.eventually.be.rejected.and.eql({
+      code: 400,
+      error: 'BadRequest',
+      message: t('invalidReqParams'),
+    });
+  });
+
+  it('returns up to 60 invites when req.query.limit is specified', async () => {
+    const leader = await generateUser({ balance: 4 });
+    const group = await generateGroup(leader, { type: 'guild', privacy: 'public', name: generateUUID() });
+
+    const invitesToGenerate = [];
+    for (let i = 0; i < 31; i += 1) {
+      invitesToGenerate.push(generateUser());
+    }
+    const generatedInvites = await Promise.all(invitesToGenerate);
+    await leader.post(`/groups/${group._id}/invite`, { uuids: generatedInvites.map(invite => invite._id) });
+
+    let res = await leader.get(`/groups/${group._id}/invites?limit=14`);
+    expect(res.length).to.equal(14);
+    res.forEach(member => {
+      expect(member).to.have.all.keys(['_id', 'auth', 'flags', 'id', 'profile']);
+      expect(member.profile).to.have.all.keys(['name']);
+    });
+
+    res = await leader.get(`/groups/${group._id}/invites?limit=31`);
+    expect(res.length).to.equal(31);
+    res.forEach(member => {
+      expect(member).to.have.all.keys(['_id', 'auth', 'flags', 'id', 'profile']);
+      expect(member.profile).to.have.all.keys(['name']);
+    });
+  }).timeout(30000);
+
  it('supports using req.query.lastId to get more invites', async function test () {
    this.timeout(30000); // @TODO: times out after 8 seconds
    const leader = await generateUser({ balance: 4 });
@@ -116,7 +116,7 @@ describe('GET /groups/:groupId/members', () => {
    expect(memberRes.inbox.messages).to.not.exist;
  });

-  it('returns only first 30 members', async () => {
+  it('returns only first 30 members by default (req.query.limit not specified)', async () => {
    const group = await generateGroup(user, { type: 'party', name: generateUUID() });

    const usersToGenerate = [];
@@ -133,6 +133,60 @@ describe('GET /groups/:groupId/members', () => {
    });
  });

+  it('returns an error if req.query.limit is over 60', async () => {
+    await generateGroup(user, { type: 'party', name: generateUUID() });
+
+    await expect(user.get('/groups/party/members?limit=61')).to.eventually.be.rejected.and.eql({
+      code: 400,
+      error: 'BadRequest',
+      message: t('invalidReqParams'),
+    });
+  });
+
+  it('returns an error if req.query.limit is under 1', async () => {
+    await generateGroup(user, { type: 'party', name: generateUUID() });
+
+    await expect(user.get('/groups/party/members?limit=0')).to.eventually.be.rejected.and.eql({
+      code: 400,
+      error: 'BadRequest',
+      message: t('invalidReqParams'),
+    });
+  });
+
+  it('returns an error if req.query.limit is not an integer', async () => {
+    await generateGroup(user, { type: 'party', name: generateUUID() });
+
+    await expect(user.get('/groups/party/members?limit=1.1')).to.eventually.be.rejected.and.eql({
+      code: 400,
+      error: 'BadRequest',
+      message: t('invalidReqParams'),
+    });
+  });
+
+  it('returns up to 60 members when req.query.limit is specified', async () => {
+    const group = await generateGroup(user, { type: 'party', name: generateUUID() });
+
+    const usersToGenerate = [];
+    for (let i = 0; i < 62; i += 1) {
+      usersToGenerate.push(generateUser({ party: { _id: group._id } }));
+    }
+    await Promise.all(usersToGenerate);
+
+    let res = await user.get('/groups/party/members?limit=60');
+    expect(res.length).to.equal(60);
+    res.forEach(member => {
+      expect(member).to.have.all.keys(['_id', 'auth', 'flags', 'id', 'profile']);
+      expect(member.profile).to.have.all.keys(['name']);
+    });
+
+    res = await user.get(`/groups/party/members?limit=60&lastId=${res[res.length - 1]._id}`);
+    expect(res.length).to.equal(3);
+    res.forEach(member => {
+      expect(member).to.have.all.keys(['_id', 'auth', 'flags', 'id', 'profile']);
+      expect(member.profile).to.have.all.keys(['name']);
+    });
+  }).timeout(30000);
+
  it('returns only first 30 members even when ?includeAllMembers=true', async () => {
    const group = await generateGroup(user, { type: 'party', name: generateUUID() });

@@ -75,12 +75,7 @@ describe('POST /group/:groupId/remove-manager', () => {
    await nonLeader.post(`/tasks/${task._id}/assign/${nonManager._id}`);
    const memberTasks = await nonManager.get('/tasks/user');
    const syncedTask = find(memberTasks, findAssignedTask);
-    await expect(nonManager.post(`/tasks/${syncedTask._id}/score/up`))
-      .to.eventually.be.rejected.and.to.eql({
-        code: 401,
-        error: 'NotAuthorized',
-        message: t('taskApprovalHasBeenRequested'),
-      });
+    await nonManager.post(`/tasks/${syncedTask._id}/score/up`);

    const updatedGroup = await leader.post(`/groups/${groupToUpdate._id}/remove-manager`, {
      managerId: nonLeader._id,
@@ -203,6 +203,16 @@ describe('POST /group/:groupId/join', () => {
        await expect(invitedUser.get('/user')).to.eventually.have.nested.property('party._id', party._id);
      });

+      it('Issue #12291: accepting a redundant party invite will let the user stay in the party', async () => {
+        await invitedUser.update({
+          'party._id': party._id,
+        });
+        await expect(invitedUser.get('/user')).to.eventually.have.nested.property('party._id', party._id);
+        await invitedUser.post(`/groups/${party._id}/join`);
+
+        await expect(invitedUser.get('/user')).to.eventually.have.nested.property('party._id', party._id);
+      });
+
      it('notifies inviting user that their invitation was accepted', async () => {
        await invitedUser.post(`/groups/${party._id}/join`);

@@ -2,6 +2,8 @@ import { v4 as generateUUID } from 'uuid';
 import {
  generateUser,
  translate as t,
+  createAndPopulateGroup,
+  generateChallenge,
 } from '../../../../helpers/api-integration/v3';

 describe('GET /tasks/:id', () => {
@@ -11,55 +13,158 @@ describe('GET /tasks/:id', () => {
    user = await generateUser();
  });

-  context('task can be accessed', async () => {
-    let task;
+  context('general', () => {
+    context('task cannot be accessed', () => {
+      it('cannot get a non-existent task', async () => {
+        const dummyId = generateUUID();

-    beforeEach(async () => {
-      task = await user.post('/tasks/user', {
-        text: 'test habit',
-        type: 'habit',
-        alias: 'alias',
+        await expect(user.get(`/tasks/${dummyId}`)).to.eventually.be.rejected.and.eql({
+          code: 404,
+          error: 'NotFound',
+          message: t('taskNotFound'),
+        });
      });
    });
-
-    it('gets specified task', async () => {
-      const getTask = await user.get(`/tasks/${task._id}`);
-
-      expect(getTask).to.eql(task);
-    });
-
-    it('can use alias to retrieve task', async () => {
-      const getTask = await user.get(`/tasks/${task.alias}`);
-
-      expect(getTask).to.eql(task);
-    });
-
-    // TODO after challenges are implemented
-    it('can get active challenge task that user does not own'); // Yes?
  });

-  context('task cannot be accessed', () => {
-    it('cannot get a non-existent task', async () => {
-      const dummyId = generateUUID();
+  context('user', () => {
+    context('task can be accessed', async () => {
+      let task;

-      await expect(user.get(`/tasks/${dummyId}`)).to.eventually.be.rejected.and.eql({
-        code: 404,
-        error: 'NotFound',
-        message: t('taskNotFound'),
+      beforeEach(async () => {
+        task = await user.post('/tasks/user', {
+          text: 'test habit',
+          type: 'habit',
+          alias: 'alias',
+        });
+      });
+
+      it('gets specified task', async () => {
+        const getTask = await user.get(`/tasks/${task._id}`);
+
+        expect(getTask).to.eql(task);
+      });
+
+      it('can use alias to retrieve task', async () => {
+        const getTask = await user.get(`/tasks/${task.alias}`);
+
+        expect(getTask).to.eql(task);
      });
    });

-    it('cannot get a task owned by someone else', async () => {
-      const anotherUser = await generateUser();
-      const task = await user.post('/tasks/user', {
+    context('task cannot be accessed', () => {
+      it('cannot get a task owned by someone else', async () => {
+        const anotherUser = await generateUser();
+        const task = await user.post('/tasks/user', {
+          text: 'test habit',
+          type: 'habit',
+        });
+
+        await expect(anotherUser.get(`/tasks/${task._id}`)).to.eventually.be.rejected.and.eql({
+          code: 404,
+          error: 'NotFound',
+          message: t('taskNotFound'),
+        });
+      });
+    });
+  });
+
+  context('challenge', () => {
+    let challenge; let task; let leader; let member;
+
+    before(async () => {
+      const populatedGroup = await createAndPopulateGroup({
+        members: 1,
+      });
+
+      const guild = populatedGroup.group;
+      leader = populatedGroup.groupLeader;
+      member = populatedGroup.members[0]; // eslint-disable-line prefer-destructuring
+
+      challenge = await generateChallenge(leader, guild);
+      await leader.post(`/challenges/${challenge._id}/join`);
+
+      task = await leader.post(`/tasks/challenge/${challenge._id}`, {
        text: 'test habit',
        type: 'habit',
      });
+    });

-      await expect(anotherUser.get(`/tasks/${task._id}`)).to.eventually.be.rejected.and.eql({
-        code: 404,
-        error: 'NotFound',
-        message: t('taskNotFound'),
+    context('task can be accessed', async () => {
+      it('can get challenge task if member of that challenge', async () => {
+        await member.post(`/challenges/${challenge._id}/join`);
+
+        const getTask = await member.get(`/tasks/${task._id}`);
+        expect(getTask).to.eql(task);
+      });
+
+      it('can get challenge task if leader of that challenge', async () => {
+        const getTask = await leader.get(`/tasks/${task._id}`);
+        expect(getTask).to.eql(task);
+      });
+
+      it('can get challenge task if admin', async () => {
+        const admin = await generateUser({
+          'contributor.admin': true,
+        });
+
+        const getTask = await admin.get(`/tasks/${task._id}`);
+        expect(getTask).to.eql(task);
+      });
+    });
+
+    context('task cannot be accessed', () => {
+      it('cannot get a task in a challenge i am not part of', async () => {
+        await expect(user.get(`/tasks/${task._id}`)).to.eventually.be.rejected.and.eql({
+          code: 404,
+          error: 'NotFound',
+          message: t('taskNotFound'),
+        });
+      });
+    });
+  });
+
+  context('group', () => {
+    let group; let task; let members; let leader;
+
+    before(async () => {
+      const groupData = await createAndPopulateGroup({
+        groupDetails: {
+          name: 'Test Guild',
+          type: 'guild',
+        },
+        members: 1,
+      });
+
+      group = groupData.group;
+      members = groupData.members;
+      leader = groupData.groupLeader;
+
+      task = await leader.post(`/tasks/group/${group._id}`, {
+        text: 'test habit',
+        type: 'habit',
+      });
+    });
+
+    context('task can be accessed', async () => {
+      it('can get group task if leader of that group', async () => {
+        const getTask = await leader.get(`/tasks/${task._id}`);
+        expect(getTask).to.eql(task);
+      });
+
+      it('can get group task if member of that group', async () => {
+        const getTask = await members[0].get(`/tasks/${task._id}`);
+        expect(getTask).to.eql(task);
+      });
+    });
+
+    context('task cannot be accessed', () => {
+      it('cannot get a task in a group i am not part of', async () => {
+        await expect(user.get(`/tasks/${task._id}`)).to.eventually.be.rejected.and.eql({
+          code: 404,
+          error: 'NotFound',
+          message: t('taskNotFound'),
+        });
      });
    });
  });
@@ -153,40 +153,12 @@ describe('GET /tasks/user', () => {
  });

  xit('returns dailies with isDue for the date specified and will add CDS offset if time is not supplied and assumes timezones', async () => {
-    const timezone = 420;
+    const timezoneOffset = 420;
    await user.update({
      'preferences.dayStart': 0,
-      'preferences.timezoneOffset': timezone,
+      'preferences.timezoneOffset': timezoneOffset,
    });
-    const startDate = moment().zone(timezone).subtract('4', 'days').startOf('day')
-      .toISOString();
-    await user.post('/tasks/user', [
-      {
-        text: 'test daily',
-        type: 'daily',
-        startDate,
-        frequency: 'daily',
-        everyX: 2,
-      },
-    ]);
-
-    const today = moment().format('YYYY-MM-DD');
-    const dailys = await user.get(`/tasks/user?type=dailys&dueDate=${today}`);
-    expect(dailys[0].isDue).to.be.true;
-
-    const yesterday = moment().subtract('1', 'days').format('YYYY-MM-DD');
-    const dailys2 = await user.get(`/tasks/user?type=dailys&dueDate=${yesterday}`);
-    expect(dailys2[0].isDue).to.be.false;
-  });
-
-
-  xit('returns dailies with isDue for the date specified and will add CDS offset if time is not supplied and assumes timezones', async () => {
-    const timezone = 240;
-    await user.update({
-      'preferences.dayStart': 0,
-      'preferences.timezoneOffset': timezone,
-    });
-    const startDate = moment().zone(timezone).subtract('4', 'days').startOf('day')
+    const startDate = moment().utcOffset(-timezoneOffset).subtract('4', 'days').startOf('day')
      .toISOString();
    await user.post('/tasks/user', [
      {
@@ -208,12 +180,39 @@ describe('GET /tasks/user', () => {
  });

  xit('returns dailies with isDue for the date specified and will add CDS offset if time is not supplied and assumes timezones', async () => {
-    const timezone = 540;
+    const timezoneOffset = 240;
    await user.update({
      'preferences.dayStart': 0,
-      'preferences.timezoneOffset': timezone,
+      'preferences.timezoneOffset': timezoneOffset,
    });
-    const startDate = moment().zone(timezone).subtract('4', 'days').startOf('day')
+    const startDate = moment().utcOffset(-timezoneOffset).subtract('4', 'days').startOf('day')
+      .toISOString();
+    await user.post('/tasks/user', [
+      {
+        text: 'test daily',
+        type: 'daily',
+        startDate,
+        frequency: 'daily',
+        everyX: 2,
+      },
+    ]);
+
+    const today = moment().format('YYYY-MM-DD');
+    const dailys = await user.get(`/tasks/user?type=dailys&dueDate=${today}`);
+    expect(dailys[0].isDue).to.be.true;
+
+    const yesterday = moment().subtract('1', 'days').format('YYYY-MM-DD');
+    const dailys2 = await user.get(`/tasks/user?type=dailys&dueDate=${yesterday}`);
+    expect(dailys2[0].isDue).to.be.false;
+  });
+
+  xit('returns dailies with isDue for the date specified and will add CDS offset if time is not supplied and assumes timezones', async () => {
+    const timezoneOffset = 540;
+    await user.update({
+      'preferences.dayStart': 0,
+      'preferences.timezoneOffset': timezoneOffset,
+    });
+    const startDate = moment().utcOffset(-timezoneOffset).subtract('4', 'days').startOf('day')
      .toISOString();
    await user.post('/tasks/user', [
      {
@@ -687,7 +687,6 @@ describe('POST /tasks/user', () => {
      });
    });

-
    it('can create checklists', async () => {
      const task = await user.post('/tasks/user', {
        text: 'test daily',
@@ -73,12 +73,7 @@ describe('Groups DELETE /tasks/:id', () => {
    });
    const memberTasks = await member.get('/tasks/user');
    const syncedTask = find(memberTasks, findAssignedTask);
-    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
-      .to.eventually.be.rejected.and.to.eql({
-        code: 401,
-        error: 'NotAuthorized',
-        message: t('taskApprovalHasBeenRequested'),
-      });
+    await member.post(`/tasks/${syncedTask._id}/score/up`);

    await user.sync();
    await member2.sync();
@@ -96,16 +91,16 @@ describe('Groups DELETE /tasks/:id', () => {
    expect(member2.notifications.length).to.equal(1);
  });

-  it('unlinks assigned user', async () => {
+  it('deletes task from assigned user', async () => {
    await user.del(`/tasks/${task._id}`);

    const memberTasks = await member.get('/tasks/user');
    const syncedTask = find(memberTasks, findAssignedTask);

-    expect(syncedTask.group.broken).to.equal('TASK_DELETED');
+    expect(syncedTask).to.not.exist;
  });

-  it('unlinks all assigned users', async () => {
+  it('deletes task from all assigned users', async () => {
    await user.del(`/tasks/${task._id}`);

    const memberTasks = await member.get('/tasks/user');
@@ -114,8 +109,8 @@ describe('Groups DELETE /tasks/:id', () => {
    const member2Tasks = await member2.get('/tasks/user');
    const member2SyncedTask = find(member2Tasks, findAssignedTask);

-    expect(syncedTask.group.broken).to.equal('TASK_DELETED');
-    expect(member2SyncedTask.group.broken).to.equal('TASK_DELETED');
+    expect(syncedTask).to.not.exist;
+    expect(member2SyncedTask).to.not.exist;
  });

  it('prevents a user from deleting a task they are assigned to', async () => {
@@ -130,22 +125,6 @@ describe('Groups DELETE /tasks/:id', () => {
      });
  });

-  it('allows a user to delete a broken task', async () => {
-    const memberTasks = await member.get('/tasks/user');
-    const syncedTask = find(memberTasks, findAssignedTask);
-
-    await user.del(`/tasks/${task._id}`);
-
-    await member.del(`/tasks/${syncedTask._id}`);
-
-    await expect(member.get(`/tasks/${syncedTask._id}`))
-      .to.eventually.be.rejected.and.eql({
-        code: 404,
-        error: 'NotFound',
-        message: 'Task not found.',
-      });
-  });
-
  it('allows a user to delete a task after leaving a group', async () => {
    const memberTasks = await member.get('/tasks/user');
    const syncedTask = find(memberTasks, findAssignedTask);
@@ -58,22 +58,14 @@ describe('POST /tasks/:id/approve/:userId', () => {
    let memberTasks = await member.get('/tasks/user');
    let syncedTask = find(memberTasks, findAssignedTask);

-    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
-      .to.eventually.be.rejected.and.to.eql({
-        code: 401,
-        error: 'NotAuthorized',
-        message: t('taskApprovalHasBeenRequested'),
-      });
-
+    await member.post(`/tasks/${syncedTask._id}/score/up`);
    await user.post(`/tasks/${task._id}/approve/${member._id}`);

    await member.sync();

-    expect(member.notifications.length).to.equal(3);
+    expect(member.notifications.length).to.equal(2);
    expect(member.notifications[1].type).to.equal('GROUP_TASK_APPROVED');
    expect(member.notifications[1].data.message).to.equal(t('yourTaskHasBeenApproved', { taskText: task.text }));
-    expect(member.notifications[2].type).to.equal('SCORED_TASK');
-    expect(member.notifications[2].data.message).to.equal(t('yourTaskHasBeenApproved', { taskText: task.text }));

    memberTasks = await member.get('/tasks/user');
    syncedTask = find(memberTasks, findAssignedTask);
@@ -93,21 +85,13 @@ describe('POST /tasks/:id/approve/:userId', () => {
    let memberTasks = await member.get('/tasks/user');
    let syncedTask = find(memberTasks, findAssignedTask);

-    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
-      .to.eventually.be.rejected.and.to.eql({
-        code: 401,
-        error: 'NotAuthorized',
-        message: t('taskApprovalHasBeenRequested'),
-      });
-
+    await member.post(`/tasks/${syncedTask._id}/score/up`);
    await member2.post(`/tasks/${task._id}/approve/${member._id}`);
    await member.sync();

-    expect(member.notifications.length).to.equal(3);
+    expect(member.notifications.length).to.equal(2);
    expect(member.notifications[1].type).to.equal('GROUP_TASK_APPROVED');
    expect(member.notifications[1].data.message).to.equal(t('yourTaskHasBeenApproved', { taskText: task.text }));
-    expect(member.notifications[2].type).to.equal('SCORED_TASK');
-    expect(member.notifications[2].data.message).to.equal(t('yourTaskHasBeenApproved', { taskText: task.text }));

    memberTasks = await member.get('/tasks/user');
    syncedTask = find(memberTasks, findAssignedTask);
@@ -125,12 +109,7 @@ describe('POST /tasks/:id/approve/:userId', () => {
    await member2.post(`/tasks/${task._id}/assign/${member._id}`);
    const memberTasks = await member.get('/tasks/user');
    const syncedTask = find(memberTasks, findAssignedTask);
-    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
-      .to.eventually.be.rejected.and.to.eql({
-        code: 401,
-        error: 'NotAuthorized',
-        message: t('taskApprovalHasBeenRequested'),
-      });
+    await member.post(`/tasks/${syncedTask._id}/score/up`);

    await user.sync();
    await member2.sync();
@@ -157,14 +136,9 @@ describe('POST /tasks/:id/approve/:userId', () => {

    const memberTasks = await member.get('/tasks/user');
    const syncedTask = find(memberTasks, findAssignedTask);
-    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
-      .to.eventually.be.rejected.and.to.eql({
-        code: 401,
-        error: 'NotAuthorized',
-        message: t('taskApprovalHasBeenRequested'),
-      });
-
+    await member.post(`/tasks/${syncedTask._id}/score/up`);
    await member2.post(`/tasks/${task._id}/approve/${member._id}`);
+
    await expect(user.post(`/tasks/${task._id}/approve/${member._id}`))
      .to.eventually.be.rejected.and.to.eql({
        code: 401,
@@ -197,13 +171,7 @@ describe('POST /tasks/:id/approve/:userId', () => {

    const memberTasks = await member.get('/tasks/user');
    const syncedTask = find(memberTasks, findAssignedTask);
-    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
-      .to.eventually.be.rejected.and.to.eql({
-        code: 401,
-        error: 'NotAuthorized',
-        message: t('taskApprovalHasBeenRequested'),
-      });
-
+    await member.post(`/tasks/${syncedTask._id}/score/up`);
    await user.post(`/tasks/${sharedCompletionTask._id}/approve/${member._id}`);

    const groupTasks = await user.get(`/tasks/group/${guild._id}?type=completedTodos`);
@@ -226,13 +194,7 @@ describe('POST /tasks/:id/approve/:userId', () => {

    const memberTasks = await member.get('/tasks/user');
    const syncedTask = find(memberTasks, findAssignedTask);
-    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
-      .to.eventually.be.rejected.and.to.eql({
-        code: 401,
-        error: 'NotAuthorized',
-        message: t('taskApprovalHasBeenRequested'),
-      });
-
+    await member.post(`/tasks/${syncedTask._id}/score/up`);
    await user.post(`/tasks/${sharedCompletionTask._id}/approve/${member._id}`);

    const member2Tasks = await member2.get('/tasks/user');
@@ -258,13 +220,7 @@ describe('POST /tasks/:id/approve/:userId', () => {

    const memberTasks = await member.get('/tasks/user');
    const syncedTask = find(memberTasks, findAssignedTask);
-    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
-      .to.eventually.be.rejected.and.to.eql({
-        code: 401,
-        error: 'NotAuthorized',
-        message: t('taskApprovalHasBeenRequested'),
-      });
-
+    await member.post(`/tasks/${syncedTask._id}/score/up`);
    await user.post(`/tasks/${sharedCompletionTask._id}/approve/${member._id}`);

    const groupTasks = await user.get(`/tasks/group/${guild._id}`);
@@ -287,21 +243,10 @@ describe('POST /tasks/:id/approve/:userId', () => {

    const memberTasks = await member.get('/tasks/user');
    const syncedTask = find(memberTasks, findAssignedTask);
-    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
-      .to.eventually.be.rejected.and.to.eql({
-        code: 401,
-        error: 'NotAuthorized',
-        message: t('taskApprovalHasBeenRequested'),
-      });
-
+    await member.post(`/tasks/${syncedTask._id}/score/up`);
    const member2Tasks = await member2.get('/tasks/user');
    const member2SyncedTask = find(member2Tasks, findAssignedTask);
-    await expect(member2.post(`/tasks/${member2SyncedTask._id}/score/up`))
-      .to.eventually.be.rejected.and.to.eql({
-        code: 401,
-        error: 'NotAuthorized',
-        message: t('taskApprovalHasBeenRequested'),
-      });
+    await member2.post(`/tasks/${member2SyncedTask._id}/score/up`);

    await user.post(`/tasks/${sharedCompletionTask._id}/approve/${member._id}`);
    await user.post(`/tasks/${sharedCompletionTask._id}/approve/${member2._id}`);
@@ -61,13 +61,7 @@ describe('POST /tasks/:id/needs-work/:userId', () => {
    let syncedTask = find(memberTasks, findAssignedTask);

    // score task to require approval
-    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
-      .to.eventually.be.rejected.and.to.eql({
-        code: 401,
-        error: 'NotAuthorized',
-        message: t('taskApprovalHasBeenRequested'),
-      });
-
+    await member.post(`/tasks/${syncedTask._id}/score/up`);
    await user.post(`/tasks/${task._id}/needs-work/${member._id}`);

    [memberTasks] = await Promise.all([member.get('/tasks/user'), member.sync()]);
@@ -114,12 +108,7 @@ describe('POST /tasks/:id/needs-work/:userId', () => {
    let syncedTask = find(memberTasks, findAssignedTask);

    // score task to require approval
-    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
-      .to.eventually.be.rejected.and.to.eql({
-        code: 401,
-        error: 'NotAuthorized',
-        message: t('taskApprovalHasBeenRequested'),
-      });
+    await member.post(`/tasks/${syncedTask._id}/score/up`);

    const initialNotifications = member.notifications.length;

@@ -172,13 +161,7 @@ describe('POST /tasks/:id/needs-work/:userId', () => {
    const memberTasks = await member.get('/tasks/user');
    const syncedTask = find(memberTasks, findAssignedTask);

-    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
-      .to.eventually.be.rejected.and.to.eql({
-        code: 401,
-        error: 'NotAuthorized',
-        message: t('taskApprovalHasBeenRequested'),
-      });
-
+    await member.post(`/tasks/${syncedTask._id}/score/up`);
    await member2.post(`/tasks/${task._id}/approve/${member._id}`);
    await expect(user.post(`/tasks/${task._id}/needs-work/${member._id}`))
      .to.eventually.be.rejected.and.to.eql({
@@ -44,12 +44,11 @@ describe('POST /tasks/:id/score/:direction', () => {
    const syncedTask = find(memberTasks, findAssignedTask);
    const direction = 'up';

-    await expect(member.post(`/tasks/${syncedTask._id}/score/${direction}`))
-      .to.eventually.be.rejected.and.to.eql({
-        code: 401,
-        error: 'NotAuthorized',
-        message: t('taskApprovalHasBeenRequested'),
-      });
+    const response = await member.post(`/tasks/${syncedTask._id}/score/${direction}`);
+
+    expect(response.data.approvalRequested).to.equal(true);
+    expect(response.message).to.equal(t('taskApprovalHasBeenRequested'));
+
    const updatedTask = await member.get(`/tasks/${syncedTask._id}`);

    await user.sync();
@@ -76,12 +75,7 @@ describe('POST /tasks/:id/score/:direction', () => {
    const syncedTask = find(memberTasks, findAssignedTask);
    const direction = 'up';

-    await expect(member.post(`/tasks/${syncedTask._id}/score/${direction}`))
-      .to.eventually.be.rejected.and.to.eql({
-        code: 401,
-        error: 'NotAuthorized',
-        message: t('taskApprovalHasBeenRequested'),
-      });
+    await member.post(`/tasks/${syncedTask._id}/score/${direction}`);
    const updatedTask = await member.get(`/tasks/${syncedTask._id}`);
    await user.sync();
    await member2.sync();
@@ -111,12 +105,7 @@ describe('POST /tasks/:id/score/:direction', () => {
    const memberTasks = await member.get('/tasks/user');
    const syncedTask = find(memberTasks, findAssignedTask);

-    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
-      .to.eventually.be.rejected.and.to.eql({
-        code: 401,
-        error: 'NotAuthorized',
-        message: t('taskApprovalHasBeenRequested'),
-      });
+    await member.post(`/tasks/${syncedTask._id}/score/up`);

    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
      .to.eventually.be.rejected.and.eql({
@@ -130,12 +119,7 @@ describe('POST /tasks/:id/score/:direction', () => {
    const memberTasks = await member.get('/tasks/user');
    const syncedTask = find(memberTasks, findAssignedTask);

-    await expect(member.post(`/tasks/${syncedTask._id}/score/up`))
-      .to.eventually.be.rejected.and.to.eql({
-        code: 401,
-        error: 'NotAuthorized',
-        message: t('taskApprovalHasBeenRequested'),
-      });
+    await member.post(`/tasks/${syncedTask._id}/score/up`);

    await user.post(`/tasks/${task._id}/approve/${member._id}`);

@@ -4,8 +4,12 @@ import {
 } from '../../../../../helpers/api-integration/v3';

 describe('PUT /tasks/:id', () => {
-  let user; let guild; let member; let member2; let
-    task;
+  let user;
+  let guild;
+  let member;
+  let member2;
+  let habit;
+  let todo;

  function findAssignedTask (memberTask) {
    return memberTask.group.id === guild._id;
@@ -25,7 +29,7 @@ describe('PUT /tasks/:id', () => {
    member = members[0]; // eslint-disable-line prefer-destructuring
    member2 = members[1]; // eslint-disable-line prefer-destructuring

-    task = await user.post(`/tasks/group/${guild._id}`, {
+    habit = await user.post(`/tasks/group/${guild._id}`, {
      text: 'test habit',
      type: 'habit',
      up: false,
@@ -33,12 +37,18 @@ describe('PUT /tasks/:id', () => {
      notes: 1976,
    });

-    await user.post(`/tasks/${task._id}/assign/${member._id}`);
-    await user.post(`/tasks/${task._id}/assign/${member2._id}`);
+    todo = await user.post(`/tasks/group/${guild._id}`, {
+      text: 'test todo',
+      type: 'todo',
+      notes: 1976,
+    });
+
+    await user.post(`/tasks/${habit._id}/assign/${member._id}`);
+    await user.post(`/tasks/${habit._id}/assign/${member2._id}`);
  });

  it('updates a group task', async () => {
-    const savedHabit = await user.put(`/tasks/${task._id}`, {
+    const savedHabit = await user.put(`/tasks/${habit._id}`, {
      notes: 'some new notes',
    });

@@ -51,27 +61,55 @@ describe('PUT /tasks/:id', () => {
      managerId: member._id,
    });

-    // change the todo
-    task = await member.put(`/tasks/${task._id}`, {
+    // change the habit
+    habit = await member.put(`/tasks/${habit._id}`, {
      text: 'new text!',
      requiresApproval: true,
    });

    const memberTasks = await member2.get('/tasks/user');
-    const syncedTask = find(memberTasks, memberTask => memberTask.group.taskId === task._id);
+    const syncedTask = find(memberTasks, memberTask => memberTask.group.taskId === habit._id);

    // score up to trigger approval
-    await expect(member2.post(`/tasks/${syncedTask._id}/score/up`))
-      .to.eventually.be.rejected.and.to.eql({
-        code: 401,
-        error: 'NotAuthorized',
-        message: t('taskApprovalHasBeenRequested'),
-      });
+    const response = await member2.post(`/tasks/${syncedTask._id}/score/up`);
+
+    expect(response.data.approvalRequested).to.equal(true);
+    expect(response.message).to.equal(t('taskApprovalHasBeenRequested'));
+  });
+
+  it('member updates a group task value - not allowed', async () => {
+    // change the todo
+    await expect(member.put(`/tasks/${habit._id}`, {
+      text: 'new text!',
+    })).to.eventually.be.rejected.and.to.eql({
+      code: 401,
+      error: 'NotAuthorized',
+      message: t('onlyGroupLeaderCanEditTasks'),
+    });
+  });
+
+  it('member updates the collapseChecklist property - change is allowed', async () => {
+    // change the todo
+    await member.put(`/tasks/${todo._id}`, {
+      collapseChecklist: true,
+    });
+  });
+
+  it('member updates the collapseChecklist and another property - change not allowed', async () => {
+    // change the todo
+    await expect(member.put(`/tasks/${todo._id}`, {
+      collapseChecklist: true,
+      title: 'test',
+    })).to.eventually.be.rejected.and.to.eql({
+      code: 401,
+      error: 'NotAuthorized',
+      message: t('onlyGroupLeaderCanEditTasks'),
+    });
  });

  it('updates a group task with checklist', async () => {
    // add a new todo
-    task = await user.post(`/tasks/group/${guild._id}`, {
+    habit = await user.post(`/tasks/group/${guild._id}`, {
      text: 'todo',
      type: 'todo',
      checklist: [
@@ -81,13 +119,13 @@ describe('PUT /tasks/:id', () => {
      ],
    });

-    await user.post(`/tasks/${task._id}/assign/${member._id}`);
+    await user.post(`/tasks/${habit._id}/assign/${member._id}`);

    // change the checklist text
-    task = await user.put(`/tasks/${task._id}`, {
+    habit = await user.put(`/tasks/${habit._id}`, {
      checklist: [
        {
-          id: task.checklist[0].id,
+          id: habit.checklist[0].id,
          text: 'checklist 1 - edit',
        },
        {
@@ -96,18 +134,17 @@ describe('PUT /tasks/:id', () => {
      ],
    });

-    expect(task.checklist.length).to.eql(2);
+    expect(habit.checklist.length).to.eql(2);
  });

  it('updates the linked tasks', async () => {
-    await user.put(`/tasks/${task._id}`, {
+    await user.put(`/tasks/${habit._id}`, {
      text: 'some new text',
      up: false,
      down: false,
      notes: 'some new notes',
    });

-
    const memberTasks = await member.get('/tasks/user');
    const syncedTask = find(memberTasks, findAssignedTask);

@@ -117,7 +154,7 @@ describe('PUT /tasks/:id', () => {
  });

  it('updates the linked tasks for all assigned users', async () => {
-    await user.put(`/tasks/${task._id}`, {
+    await user.put(`/tasks/${habit._id}`, {
      text: 'some new text',
      up: false,
      down: false,
@@ -144,14 +181,13 @@ describe('PUT /tasks/:id', () => {
      managerId: member2._id,
    });

-    await member2.put(`/tasks/${task._id}`, {
+    await member2.put(`/tasks/${habit._id}`, {
      text: 'some new text',
      up: false,
      down: false,
      notes: 'some new notes',
    });

-
    const memberTasks = await member.get('/tasks/user');
    const syncedTask = find(memberTasks, findAssignedTask);

@@ -1,4 +1,3 @@
-
 import { v4 as generateUUID } from 'uuid';
 import { find } from 'lodash';
 import {
@@ -325,7 +324,6 @@ describe('POST /user/class/cast/:spellId', () => {
    expect(result.user.stats.mp).to.equal(10);
  });

-
  // TODO find a way to have sinon working in integration tests
  // it doesn't work when tests are running separately from server
  it('passes correct target to spell when targetType === \'tasks\'');
@@ -41,6 +41,29 @@ describe('POST /user/feed/:pet/:food', () => {
    expect(user.items.pets['Wolf-Base']).to.equal(7);
  });

+  it('bulk feeding pet with non-preferred food', async () => {
+    await user.update({
+      'items.pets.Wolf-Base': 5,
+      'items.food.Milk': 3,
+    });
+
+    const food = content.food.Milk;
+    const pet = content.petInfo['Wolf-Base'];
+
+    const res = await user.post('/user/feed/Wolf-Base/Milk?amount=2');
+    await user.sync();
+    expect(res).to.eql({
+      data: user.items.pets['Wolf-Base'],
+      message: t('messageDontEnjoyFood', {
+        egg: pet.text(),
+        foodText: food.textThe(),
+      }),
+    });
+
+    expect(user.items.food.Milk).to.eql(1);
+    expect(user.items.pets['Wolf-Base']).to.equal(9);
+  });
+
  context('sending user activity webhooks', () => {
    before(async () => {
      await server.start();
@@ -77,5 +100,33 @@ describe('POST /user/feed/:pet/:food', () => {
      expect(body.pet).to.eql('Wolf-Base');
      expect(body.message).to.eql(res.message);
    });
+
+    it('sends user activity webhook (mount raised after full bulk feeding)', async () => {
+      const uuid = generateUUID();
+
+      await user.post('/user/webhook', {
+        url: `http://localhost:${server.port}/webhooks/${uuid}`,
+        type: 'userActivity',
+        enabled: true,
+        options: {
+          mountRaised: true,
+        },
+      });
+
+      await user.update({
+        'items.pets.Wolf-Base': 47,
+        'items.food.Milk': 3,
+      });
+      const res = await user.post('/user/feed/Wolf-Base/Milk?amount=2');
+
+      await sleep();
+
+      const body = server.getWebhookData(uuid);
+
+      expect(user.achievements.allYourBase).to.not.equal(true);
+      expect(body.type).to.eql('mountRaised');
+      expect(body.pet).to.eql('Wolf-Base');
+      expect(body.message).to.eql(res.message);
+    });
  });
 });
@@ -4,7 +4,6 @@ import {
  translate as t,
 } from '../../../../helpers/api-integration/v3';

-
 describe('PUT /user', () => {
  let user;

@@ -53,7 +52,6 @@ describe('PUT /user', () => {
      expect(user.tags.length).to.be.eql(userTags.length + 1);
    });

-
    it('validates profile.name', async () => {
      await expect(user.put('/user', {
        'profile.name': ' ', // string should be trimmed
@@ -94,6 +92,14 @@ describe('PUT /user', () => {
        error: 'BadRequest',
        message: t('displaynameIssueSlur'),
      });
+
+      await expect(user.put('/user', {
+        'profile.name': 'namecontainsnewline\n',
+      })).to.eventually.be.rejected.and.eql({
+        code: 400,
+        error: 'BadRequest',
+        message: t('displaynameIssueNewline'),
+      });
    });
  });

@@ -10,7 +10,6 @@ import {
  sha1Encrypt as sha1EncryptPassword,
 } from '../../../../../../website/server/libs/password';

-
 describe('POST /user/auth/local/login', () => {
  let api;
  let user;
@@ -9,7 +9,6 @@ import {
  sha1Encrypt as sha1EncryptPassword,
 } from '../../../../../../website/server/libs/password';

-
 const ENDPOINT = '/user/auth/update-email';

 describe('PUT /user/auth/update-email', () => {
@@ -127,19 +127,26 @@ describe('PUT /user/webhook/:id', () => {
  it('can update taskActivity options', async () => {
    const type = 'taskActivity';
    const options = {
+      checklistScored: true,
      updated: false,
-      deleted: true,
+      scored: false,
    };
-
-    const webhook = await user.put(`/user/webhook/${webhookToUpdate.id}`, { type, options });
-
-    expect(webhook.options).to.eql({
-      checklistScored: false, // starting value
+    const expected = {
+      checklistScored: true,
      created: true, // starting value
      updated: false,
-      deleted: true,
-      scored: true, // default value
-    });
+      deleted: false, // starting value
+      scored: false,
+    };
+
+    const returnedWebhook = await user.put(`/user/webhook/${webhookToUpdate.id}`, { type, options });
+
+    await user.sync();
+
+    const savedWebhook = user.webhooks.find(hook => webhookToUpdate.id === hook.id);
+
+    expect(returnedWebhook.options).to.eql(expected);
+    expect(savedWebhook.options).to.eql(expected);
  });

  it('errors if taskActivity option is not a boolean', async () => {
@@ -1,4 +1,3 @@
-
 import { v4 as generateUUID } from 'uuid';
 import { find } from 'lodash';
 import {
@@ -310,7 +309,6 @@ describe('POST /user/class/cast/:spellId', () => {
    expect(result.user.stats.mp).to.equal(10);
  });

-
  // TODO find a way to have sinon working in integration tests
  // it doesn't work when tests are running separately from server
  it('passes correct target to spell when targetType === \'tasks\'');
@@ -130,7 +130,6 @@ describe('POST /user/reset', () => {
      },
    });

-
    await hero.post('/user/reset');

    const heroRes = await admin.get(`/hall/heroes/${hero.auth.local.username}`);
@@ -4,7 +4,6 @@ import {
  translate as t,
 } from '../../../helpers/api-integration/v4';

-
 describe('PUT /user', () => {
  let user;

@@ -53,7 +52,6 @@ describe('PUT /user', () => {
      expect(user.tags.length).to.be.eql(userTags.length + 1);
    });

-
    it('profile.name cannot be an empty string or null', async () => {
      await expect(user.put('/user', {
        'profile.name': ' ', // string should be trimmed
@@ -53,5 +53,11 @@ describe('POST /user/auth/verify-display-name', async () => {
        displayName: 'this is a very long display name over 30 characters',
      })).to.eventually.eql({ isUsable: false, issues: [t('displaynameIssueLength')] });
    });
+
+    it('errors if display name contains a newline', async () => {
+      await expect(user.post(ENDPOINT, {
+        displayName: 'namecontainsnewline\n',
+      })).to.eventually.eql({ isUsable: false, issues: [t('displaynameIssueNewline')] });
+    });
  });
 });
@@ -0,0 +1,25 @@
+import getUtcOffset from '../../../website/common/script/fns/getUtcOffset';
+
+describe('getUtcOffset', () => {
+  let user;
+
+  beforeEach(() => {
+    user = { preferences: {} };
+  });
+
+  it('returns 0 when user.timezoneOffset is not set', () => {
+    expect(getUtcOffset(user)).to.equal(0);
+  });
+
+  it('returns 0 when user.timezoneOffset is zero', () => {
+    user.preferences.timezoneOffset = 0;
+
+    expect(getUtcOffset(user)).to.equal(0);
+  });
+
+  it('returns the opposite of user.timezoneOffset', () => {
+    user.preferences.timezoneOffset = -10;
+
+    expect(getUtcOffset(user)).to.eql(10);
+  });
+});
@@ -16,6 +16,8 @@ describe('common.fns.randomDrop', () => {
    user = generateUser();
    user._tmp = user._tmp ? user._tmp : {};
    user.items.eggs.Wolf = 0;
+    user.items.food.Meat = 0;
+    user._id = `a${user._id.slice(1)}`;
    task = generateTodo({ userId: user._id });
    predictableRandom = sandbox.stub().returns(0.5);
  });
@@ -0,0 +1,184 @@
+import moment from 'moment';
+
+import { startOfDay, daysSince } from '../../../website/common/script/cron';
+
+function localMoment (timeString, utcOffset) {
+  return moment(timeString).utcOffset(utcOffset, true);
+}
+
+describe('cron utility functions', () => {
+  describe('startOfDay', () => {
+    it('is zero when no daystart configured', () => {
+      const options = { now: moment('2020-02-02 09:30:00Z'), timezoneOffset: 0 };
+
+      const result = startOfDay(options);
+
+      expect(result).to.be.sameMoment('2020-02-02 00:00:00Z');
+    });
+
+    it('is zero when negative daystart configured', () => {
+      const options = {
+        now: moment('2020-02-02 09:30:00Z'),
+        timezoneOffset: 0,
+        daystart: -5,
+      };
+
+      const result = startOfDay(options);
+
+      expect(result).to.be.sameMoment('2020-02-02 00:00:00Z');
+    });
+
+    it('is zero when daystart over 24 is configured', () => {
+      const options = {
+        now: moment('2020-02-02 09:30:00Z'),
+        timezoneOffset: 0,
+        daystart: 25,
+      };
+
+      const result = startOfDay(options);
+
+      expect(result).to.be.sameMoment('2020-02-02 00:00:00Z');
+    });
+
+    it('is equal to daystart o\'clock when daystart configured', () => {
+      const options = {
+        now: moment('2020-02-02 09:30:00Z'),
+        timezoneOffset: 0,
+        dayStart: 5,
+      };
+
+      const result = startOfDay(options);
+
+      expect(result).to.be.sameMoment('2020-02-02 05:00:00Z');
+    });
+
+    it('is previous day daystart o\'clock when daystart is after current time', () => {
+      const options = {
+        now: moment('2020-02-02 04:30:00Z'),
+        timezoneOffset: 0,
+        dayStart: 5,
+      };
+
+      const result = startOfDay(options);
+
+      expect(result).to.be.sameMoment('2020-02-01 05:00:00Z');
+    });
+
+    it('is daystart o\'clock when daystart is after current time due to timezone', () => {
+      const options = {
+        now: moment('2020-02-02 04:30:00Z'),
+        timezoneOffset: -120,
+        dayStart: 5,
+      };
+
+      const result = startOfDay(options);
+
+      expect(result).to.be.sameMoment('2020-02-02 05:00:00+02:00');
+    });
+
+    it('returns in default timezone if no timezone defined', () => {
+      const utcOffset = moment().utcOffset();
+      const now = localMoment('2020-02-02 04:30:00', utcOffset).utc();
+
+      const result = startOfDay({ now });
+
+      expect(result).to.be.sameMoment(localMoment('2020-02-02', utcOffset));
+    });
+
+    it('returns in default timezone if timezone lower than -12:00', () => {
+      const utcOffset = moment().utcOffset();
+      const options = {
+        now: localMoment('2020-02-02 17:30:00', utcOffset).utc(),
+        timezoneOffset: 721,
+      };
+
+      const result = startOfDay(options);
+
+      expect(result).to.be.sameMoment(localMoment('2020-02-02', utcOffset));
+    });
+
+    it('returns in default timezone if timezone higher than +14:00', () => {
+      const utcOffset = moment().utcOffset();
+      const options = {
+        now: localMoment('2020-02-02 07:32:25.376', utcOffset).utc(),
+        timezoneOffset: -841,
+      };
+
+      const result = startOfDay(options);
+
+      expect(result).to.be.sameMoment(localMoment('2020-02-02', utcOffset));
+    });
+
+    it('returns in overridden timezone if override present', () => {
+      const options = {
+        now: moment('2020-02-02 13:30:27Z'),
+        timezoneOffset: 0,
+        timezoneUtcOffsetOverride: -240,
+      };
+
+      const result = startOfDay(options);
+
+      expect(result).to.be.sameMoment('2020-02-02 00:00:00-04:00');
+    });
+
+    it('returns start of yesterday if timezone difference carries it over datelines', () => {
+      const offset = 300;
+      const options = {
+        now: moment('2020-02-02 04:30:00Z'),
+        timezoneOffset: offset,
+      };
+
+      const result = startOfDay(options);
+
+      expect(result).to.be.sameMoment(localMoment('2020-02-01', -offset));
+    });
+  });
+
+  describe('daysSince', () => {
+    it('correctly calculates days between two dates', () => {
+      const now = moment();
+      const dayBeforeYesterday = moment(now).subtract({ days: 2 });
+
+      expect(daysSince(dayBeforeYesterday, { now })).to.equal(2);
+    });
+
+    it('is one lower if current time is before dayStart', () => {
+      const oneWeekAgoAtOnePm = moment().hour(13).subtract({ days: 7 });
+      const thisMorningThreeAm = moment().hour(3);
+      const options = {
+        now: thisMorningThreeAm,
+        dayStart: 6,
+      };
+
+      const result = daysSince(oneWeekAgoAtOnePm, options);
+
+      expect(result).to.equal(6);
+    });
+
+    it('is one higher if reference time is before dayStart and current time after dayStart', () => {
+      const oneWeekAgoAtEightAm = moment().hour(8).subtract({ days: 7 });
+      const todayAtFivePm = moment().hour(17);
+      const options = {
+        now: todayAtFivePm,
+        dayStart: 11,
+      };
+
+      const result = daysSince(oneWeekAgoAtEightAm, options);
+
+      expect(result).to.equal(8);
+    });
+
+    // Variations in timezone configuration options are already covered by startOfDay tests.
+    it('uses now in user timezone as configured in options', () => {
+      const timezoneOffset = 120;
+      const options = {
+        now: moment('1989-11-09 02:53:00+01:00'),
+        timezoneOffset,
+      };
+
+      const result = daysSince(localMoment('1989-11-08', -timezoneOffset), options);
+
+      expect(result).to.equal(0);
+    });
+  });
+});
@@ -1,4 +1,3 @@
-
 import {
  generateUser,
 } from '../../helpers/common.helper';
@@ -36,7 +35,6 @@ describe('getDebuffPotionItems', () => {
    user.stats.buffs.snowball = true;
    user.stats.buffs.shinySeed = true;

-
    const result = getDebuffPotionItems(user);

    expect(result).to.be.an('array').that.deep.include.members([
@@ -1,4 +1,3 @@
-
 import {
  generateUser,
 } from '../../helpers/common.helper';
@@ -27,7 +26,6 @@ describe('setDebuffPotionItems', () => {
    const firstSetResult = [...setDebuffPotionItems(user).pinnedItems];
    const secondSetResult = [...setDebuffPotionItems(user).pinnedItems];

-
    expect(firstSetResult).to.be.deep.equal(secondSetResult);
  });

@@ -90,7 +90,6 @@ describe('shops', () => {
        },
      });

-
      const shopWizardItems = shared.shops.getMarketGearCategories(userWithItems).find(x => x.identifier === 'wizard').items.filter(x => x.klass === 'wizard' && (x.owned === false || x.owned === undefined));
      expect(shopWizardItems.length).to.eql(0);
    });
@@ -122,7 +121,6 @@ describe('shops', () => {
        },
      });

-
      const shopWizardItems = shared.shops.getMarketGearCategories(userWithItems).find(x => x.identifier === 'wizard').items.filter(x => x.klass === 'wizard' && (x.owned === false || x.owned === undefined));
      expect(shopWizardItems.find(item => item.key === 'weapon_wizard_5').locked).to.eql(false);
      expect(shopWizardItems.find(item => item.key === 'weapon_wizard_6').locked).to.eql(true);
@@ -1,6 +1,7 @@
 import moment from 'moment';

 import taskDefaults from '../../../website/common/script/libs/taskDefaults';
+import getUtcOffset from '../../../website/common/script/fns/getUtcOffset';
 import { generateUser } from '../../helpers/common.helper';

 describe('taskDefaults', () => {
@@ -72,7 +73,7 @@ describe('taskDefaults', () => {

    expect(task.startDate).to.eql(
      moment()
-        .zone(user.preferences.timezoneOffset, 'hour')
+        .utcOffset(getUtcOffset(user))
        .startOf('day')
        .subtract(1, 'day')
        .toDate(),
@@ -75,7 +75,6 @@ describe('shared.ops.buyGem', () => {
      expect(user.stats.gp).to.equal(goldPoints - planGemLimits.convRate * 2);
    });

-
    context('Failure conditions', () => {
      it('returns an error when key is not provided', done => {
        try {
@@ -141,7 +141,6 @@ describe('shared.ops.buyQuest', () => {
    }
  });

-
  it('does not buy Gem-premium Quests', done => {
    user.stats.gp = 9999;
    try {
@@ -43,7 +43,6 @@ describe('shared.ops.purchase', () => {
      }
    });

-
    it('returns error when unknown type is provided', done => {
      try {
        purchase(user, { params: { type: 'randomType', key: 'gem' } });
@@ -96,7 +95,6 @@ describe('shared.ops.purchase', () => {
      }
    });

-
    it('returns error when item is not found', done => {
      const params = { key: 'notExisting', type: 'food' };

@@ -113,6 +113,30 @@ describe('shared.ops.feed', () => {
        done();
      }
    });
+
+    it('does not allow bulk-feeding query amount above food owned', done => {
+      user.items.pets['Wolf-Base'] = 5;
+      user.items.food.Meat = 6;
+      try {
+        feed(user, { params: { pet: 'Wolf-Base', food: 'Meat' }, query: { amount: 8 } });
+      } catch (err) {
+        expect(err).to.be.an.instanceof(NotAuthorized);
+        expect(err.message).to.equal(i18n.t('notEnoughFood'));
+        done();
+      }
+    });
+
+    it('does not allow bulk-over-feeding pet', done => {
+      user.items.pets['Wolf-Base'] = 45;
+      user.items.food.Meat = 3;
+      try {
+        feed(user, { params: { pet: 'Wolf-Base', food: 'Meat' }, query: { amount: 2 } });
+      } catch (err) {
+        expect(err).to.be.an.instanceof(NotAuthorized);
+        expect(err.message).to.equal(i18n.t('tooMuchFood'));
+        done();
+      }
+    });
  });

  context('successful feeding', () => {
@@ -188,6 +212,61 @@ describe('shared.ops.feed', () => {
      expect(user.items.pets['Wolf-Base']).to.equal(7);
    });

+    it('evolves the pet into a mount when feeding user.items.pets[pet] >= 50 preferred food (bulk)', () => {
+      user.items.pets['Wolf-Base'] = 5;
+      user.items.food.Meat = 10;
+      user.items.currentPet = 'Wolf-Base';
+
+      const pet = content.petInfo['Wolf-Base'];
+
+      const [data, message] = feed(user, { params: { pet: 'Wolf-Base', food: 'Meat' }, query: { amount: 9 } });
+      expect(data).to.eql(user.items.pets['Wolf-Base']);
+      expect(message).to.eql(i18n.t('messageEvolve', {
+        egg: pet.text(),
+      }));
+
+      expect(user.items.food.Meat).to.equal(1);
+      expect(user.items.pets['Wolf-Base']).to.equal(-1);
+      expect(user.items.mounts['Wolf-Base']).to.equal(true);
+      expect(user.items.currentPet).to.equal('');
+    });
+
+    it('evolves the pet into a mount when feeding user.items.pets[pet] >= 50 wrong food (bulk)', () => {
+      user.items.pets['Wolf-Base'] = 5;
+      user.items.food.Milk = 25;
+      user.items.currentPet = 'Wolf-Base';
+
+      const pet = content.petInfo['Wolf-Base'];
+
+      const [data, message] = feed(user, { params: { pet: 'Wolf-Base', food: 'Milk' }, query: { amount: 23 } });
+      expect(data).to.eql(user.items.pets['Wolf-Base']);
+      expect(message).to.eql(i18n.t('messageEvolve', {
+        egg: pet.text(),
+      }));
+      expect(user.items.food.Milk).to.equal(2);
+      expect(user.items.pets['Wolf-Base']).to.equal(-1);
+      expect(user.items.mounts['Wolf-Base']).to.equal(true);
+      expect(user.items.currentPet).to.equal('');
+    });
+
+    it('does not like the food (bulk low food) ', () => {
+      user.items.pets['Wolf-Base'] = 5;
+      user.items.food.Milk = 5;
+
+      const food = content.food.Milk;
+      const pet = content.petInfo['Wolf-Base'];
+
+      const [data, message] = feed(user, { params: { pet: 'Wolf-Base', food: 'Milk' }, query: { amount: 5 } });
+      expect(data).to.eql(user.items.pets['Wolf-Base']);
+      expect(message).to.eql(i18n.t('messageDontEnjoyFood', {
+        egg: pet.text(),
+        foodText: food.textThe(),
+      }));
+
+      expect(user.items.food.Milk).to.equal(0);
+      expect(user.items.pets['Wolf-Base']).to.equal(15);
+    });
+
    it('awards All Your Base achievement', () => {
      user.items.pets['Wolf-Spooky'] = 5;
      user.items.food.Milk = 2;
@@ -29,7 +29,6 @@ describe('shared.ops.reset', () => {
    tasksToRemove = [habit, todo, daily, reward];
  });

-
  it('resets a user', () => {
    const [, message] = reset(user);

@@ -10,6 +10,8 @@ describe('shared.ops.unlock', () => {
  const unlockGearSetPath = 'items.gear.owned.headAccessory_special_bearEars,items.gear.owned.headAccessory_special_cactusEars,items.gear.owned.headAccessory_special_foxEars,items.gear.owned.headAccessory_special_lionEars,items.gear.owned.headAccessory_special_pandaEars,items.gear.owned.headAccessory_special_pigEars,items.gear.owned.headAccessory_special_tigerEars,items.gear.owned.headAccessory_special_wolfEars';
  const backgroundUnlockPath = 'background.giant_florals';
  const backgroundSetUnlockPath = 'background.archery_range,background.giant_florals,background.rainbows_end';
+  const hairUnlockPath = 'hair.color.rainbow,hair.color.yellow,hair.color.green,hair.color.purple,hair.color.blue,hair.color.TRUred';
+  const facialHairUnlockPath = 'hair.mustache.1,hair.mustache.2,hair.beard.1,hair.beard.2,hair.beard.3';
  const usersStartingGems = 50 / 4;

  beforeEach(() => {
@@ -206,6 +208,40 @@ describe('shared.ops.unlock', () => {
    expect(user.balance).to.equal(usersStartingGems - 1.25);
  });

+  it('unlocks a full set of hair items', () => {
+    user.purchased.hair.color = {};
+
+    const initialHairColors = Object.keys(user.purchased.hair.color).length;
+    const [, message] = unlock(user, { query: { path: hairUnlockPath } });
+
+    expect(message).to.equal(i18n.t('unlocked'));
+    const individualPaths = hairUnlockPath.split(',');
+    individualPaths.forEach(path => {
+      expect(get(user.purchased, path)).to.be.true;
+    });
+    expect(Object.keys(user.purchased.hair.color).length)
+      .to.equal(initialHairColors + individualPaths.length);
+    expect(user.balance).to.equal(usersStartingGems - 1.25);
+  });
+
+  it('unlocks the facial hair set', () => {
+    user.purchased.hair.mustache = {};
+    user.purchased.hair.beard = {};
+
+    const initialMustache = Object.keys(user.purchased.hair.mustache).length;
+    const initialBeard = Object.keys(user.purchased.hair.mustache).length;
+    const [, message] = unlock(user, { query: { path: facialHairUnlockPath } });
+
+    expect(message).to.equal(i18n.t('unlocked'));
+    const individualPaths = facialHairUnlockPath.split(',');
+    individualPaths.forEach(path => {
+      expect(get(user.purchased, path)).to.be.true;
+    });
+    expect(Object.keys(user.purchased.hair.mustache).length + Object.keys(user.purchased.hair.beard).length) // eslint-disable-line max-len
+      .to.equal(initialMustache + initialBeard + individualPaths.length);
+    expect(user.balance).to.equal(usersStartingGems - 1.25);
+  });
+
  it('unlocks a full set of gear', () => {
    const initialGear = Object.keys(user.items.gear.owned).length;
    const [, message] = unlock(user, { query: { path: unlockGearSetPath } });
@@ -246,6 +282,37 @@ describe('shared.ops.unlock', () => {
    expect(user.balance).to.equal(usersStartingGems - 0.5);
  });

+  it('unlocks an item (hair color)', () => {
+    user.purchased.hair.color = {};
+
+    const path = hairUnlockPath.split(',')[0];
+    const initialColorHair = Object.keys(user.purchased.hair.color).length;
+    const [, message] = unlock(user, { query: { path } });
+
+    expect(message).to.equal(i18n.t('unlocked'));
+    expect(Object.keys(user.purchased.hair.color).length).to.equal(initialColorHair + 1);
+    expect(get(user.purchased, path)).to.be.true;
+    expect(user.balance).to.equal(usersStartingGems - 0.5);
+  });
+
+  it('unlocks an item (facial hair)', () => {
+    user.purchased.hair.mustache = {};
+    user.purchased.hair.beard = {};
+
+    const path = facialHairUnlockPath.split(',')[0];
+    const initialMustache = Object.keys(user.purchased.hair.mustache).length;
+    const initialBeard = Object.keys(user.purchased.hair.beard).length;
+    const [, message] = unlock(user, { query: { path } });
+
+    expect(message).to.equal(i18n.t('unlocked'));
+
+    expect(Object.keys(user.purchased.hair.mustache).length).to.equal(initialMustache + 1);
+    expect(Object.keys(user.purchased.hair.beard).length).to.equal(initialBeard);
+
+    expect(get(user.purchased, path)).to.be.true;
+    expect(user.balance).to.equal(usersStartingGems - 0.5);
+  });
+
  it('unlocks an item (gear)', () => {
    const path = unlockGearSetPath.split(',')[0];
    const initialGear = Object.keys(user.items.gear.owned).length;
@@ -5,6 +5,8 @@ import 'moment-recur';
 describe('shouldDo', () => {
  let day; let
    dailyTask;
+  // Options is a mapping of user.preferences, therefor `timezoneOffset` still holds old zone
+  // values instead of utcOffset values.
  let options = {};
  let nextDue = [];

@@ -80,17 +82,17 @@ describe('shouldDo', () => {

      it('returns true if the user\'s current time is after start date and Custom Day Start', () => {
        options.dayStart = 4;
-        day = moment().zone(options.timezoneOffset).startOf('day').add(6, 'hours')
+        day = moment().utcOffset(-options.timezoneOffset).startOf('day').add(6, 'hours')
          .toDate();
-        dailyTask.startDate = moment().zone(options.timezoneOffset).startOf('day').toDate();
+        dailyTask.startDate = moment().utcOffset(-options.timezoneOffset).startOf('day').toDate();
        expect(shouldDo(day, dailyTask, options)).to.equal(true);
      });

      it('returns false if the user\'s current time is before Custom Day Start', () => {
        options.dayStart = 8;
-        day = moment().zone(options.timezoneOffset).startOf('day').add(2, 'hours')
+        day = moment().utcOffset(-options.timezoneOffset).startOf('day').add(2, 'hours')
          .toDate();
-        dailyTask.startDate = moment().zone(options.timezoneOffset).startOf('day').toDate();
+        dailyTask.startDate = moment().utcOffset(-options.timezoneOffset).startOf('day').toDate();
        expect(shouldDo(day, dailyTask, options)).to.equal(false);
      });
    });
@@ -112,14 +114,14 @@ describe('shouldDo', () => {

      it('returns true if the user\'s current time is after Custom Day Start', () => {
        options.dayStart = 4;
-        day = moment().zone(options.timezoneOffset).startOf('day').add(6, 'hours')
+        day = moment().utcOffset(-options.timezoneOffset).startOf('day').add(6, 'hours')
          .toDate();
        expect(shouldDo(day, dailyTask, options)).to.equal(true);
      });

      it('returns false if the user\'s current time is before Custom Day Start', () => {
        options.dayStart = 8;
-        day = moment().zone(options.timezoneOffset).startOf('day').add(2, 'hours')
+        day = moment().utcOffset(-options.timezoneOffset).startOf('day').add(2, 'hours')
          .toDate();
        expect(shouldDo(day, dailyTask, options)).to.equal(false);
      });
@@ -377,7 +379,6 @@ describe('shouldDo', () => {
        m: false,
      };

-
      [0, 1, 2, 3, 4, 5, 6].forEach(weekday => {
        day = moment().add(1, 'weeks').day(weekday).toDate();

@@ -1,9 +1,10 @@
 import express from 'express';
-import uuid from 'uuid';
+import { v4 as uuid } from 'uuid';
 import bodyParser from 'body-parser';
+import http from 'http';

 const app = express();
-const server = require('http').createServer(app);
+const server = http.createServer(app);

 const PORT = process.env.TEST_WEBHOOK_APP_PORT || 3099; // eslint-disable-line no-process-env

@@ -30,7 +31,7 @@ app.post('/webhooks/:id', (req, res) => {
 // See http://stackoverflow.com/a/37054753/2601552
 const sockets = {};
 server.on('connection', socket => {
-  const id = uuid.v4();
+  const id = uuid();
  sockets[id] = socket;

  socket.once('close', () => {
@@ -10,7 +10,6 @@ import {

 export { translate } from './translate';

-
 export function generateUser (options = {}) {
  const user = new User(options).toObject();

@@ -8,8 +8,9 @@
 //------------------------------
 global._ = require('lodash');
 global.chai = require('chai');
-chai.use(require('sinon-chai'));
 chai.use(require('chai-as-promised'));
+chai.use(require('chai-moment'));
+chai.use(require('sinon-chai'));

 global.expect = chai.expect;
 global.sinon = require('sinon');
@@ -1,6 +1,7 @@
 import i18n from '../../website/common/script/i18n';
+import { translations } from '../../website/server/libs/i18n';

-i18n.translations = require('../../website/server/libs/i18n').translations;
+i18n.translations = translations;

 const STRING_ERROR_MSG = 'Error processing the string. Please see Help > Report a Bug.';
 const STRING_DOES_NOT_EXIST_MSG = /^String '.*' not found.$/;
@@ -1,5 +1,4 @@
-
-const glob = require('glob').sync;
+import { sync as glob } from 'glob';

 describe('Locales files', () => {
  it('do not contain duplicates of any keys', () => {
@@ -1,6 +1,5 @@
-
-const glob = require('glob').sync;
-const readFile = require('fs').readFileSync;
+import { sync as glob } from 'glob';
+import { readFileSync as readFile } from 'fs';

 const IMPORT_REGEX = /(import|require).*common\/script/;

@@ -1,6 +1,8 @@
 /* eslint-disable import/no-extraneous-dependencies */
 import { configure } from '@storybook/vue';
+import './margin.css';
 import '../../src/assets/scss/index.scss';
+import '../../src/assets/scss/spacing.scss';
 import '../../src/assets/css/sprites.css';

 import '../../src/assets/css/sprites/spritesmith-main-0.css';
@@ -31,14 +33,22 @@ import '../../src/assets/css/sprites/spritesmith-main-24.css';
 import '../../src/assets/css/sprites/spritesmith-main-25.css';
 import '../../src/assets/css/sprites/spritesmith-main-26.css';
 import Vue from 'vue';
+import BootstrapVue from 'bootstrap-vue';
 import StoreModule from '@/libs/store';

+// couldn't inject the languages easily,
+// so just a "$t()"  string to show that this will be translated
+Vue.prototype.$t = function translateString (...args) {
+  return `$t(${JSON.stringify(args)})`;
+};
+
+Vue.use(BootstrapVue);
+Vue.use(StoreModule);
+
 const req = require.context('../../src', true, /.stories.js$/);

 function loadStories () {
  req.keys().forEach(filename => req(filename));
 }

-Vue.use(StoreModule);
-
 configure(loadStories, module);
@@ -0,0 +1,13 @@
+.background {
+    background: teal;
+    display: inline-block;
+}
+
+.content {
+    color: white;
+    background: grey;
+}
+
+.inline-block {
+    display: inline-block;
+}
@@ -18,13 +18,13 @@
    "@storybook/addon-links": "^5.3.19",
    "@storybook/addon-notes": "^5.3.19",
    "@storybook/vue": "^5.3.19",
-    "@vue/cli-plugin-babel": "^4.4.1",
-    "@vue/cli-plugin-eslint": "^4.4.1",
-    "@vue/cli-plugin-router": "^4.4.1",
-    "@vue/cli-plugin-unit-mocha": "^4.4.1",
-    "@vue/cli-service": "^4.4.1",
+    "@vue/cli-plugin-babel": "^4.4.6",
+    "@vue/cli-plugin-eslint": "^4.4.6",
+    "@vue/cli-plugin-router": "^4.4.6",
+    "@vue/cli-plugin-unit-mocha": "^4.4.6",
+    "@vue/cli-service": "^4.4.6",
    "@vue/test-utils": "1.0.0-beta.29",
-    "amplitude-js": "^5.11.0",
+    "amplitude-js": "^7.1.0",
    "axios": "^0.19.2",
    "axios-progress-bar": "^1.2.0",
    "babel-eslint": "^10.1.0",
@@ -36,30 +36,30 @@
    "eslint-config-habitrpg": "^6.2.0",
    "eslint-plugin-mocha": "^5.3.0",
    "eslint-plugin-vue": "^6.2.2",
-    "habitica-markdown": "^2.0.0",
+    "habitica-markdown": "^2.0.2",
    "hellojs": "^1.18.4",
    "inspectpack": "^4.5.2",
    "intro.js": "^2.9.3",
    "jquery": "^3.5.1",
-    "lodash": "^4.17.15",
-    "moment": "^2.26.0",
+    "lodash": "^4.17.19",
+    "moment": "^2.27.0",
    "nconf": "^0.10.0",
-    "sass": "^1.26.8",
+    "sass": "^1.26.10",
    "sass-loader": "^8.0.2",
-    "smartbanner.js": "^1.15.0",
+    "smartbanner.js": "^1.16.0",
    "svg-inline-loader": "^0.8.2",
-    "svg-url-loader": "^3.0.3",
+    "svg-url-loader": "^6.0.0",
    "svgo": "^1.3.2",
    "svgo-loader": "^2.2.1",
-    "uuid": "^3.4.0",
-    "validator": "^11.1.0",
+    "uuid": "^8.2.0",
+    "validator": "^13.1.1",
    "vue": "^2.6.11",
    "vue-cli-plugin-storybook": "^0.6.1",
    "vue-mugen-scroll": "^0.2.6",
-    "vue-router": "^3.3.2",
+    "vue-router": "^3.3.4",
    "vue-template-compiler": "^2.6.11",
-    "vuedraggable": "^2.23.2",
+    "vuedraggable": "^2.24.0",
    "vuejs-datepicker": "git://github.com/habitrpg/vuejs-datepicker.git#5d237615463a84a23dd6f3f77c6ab577d68593ec",
-    "webpack": "^4.43.0"
+    "webpack": "^4.44.0"
  }
 }
@@ -297,7 +297,7 @@ export default {
    };
  },
  computed: {
-    ...mapState(['isUserLoggedIn', 'browserTimezoneOffset', 'isUserLoaded', 'notificationsRemoved']),
+    ...mapState(['isUserLoggedIn', 'browserTimezoneUtcOffset', 'isUserLoaded', 'notificationsRemoved']),
    ...mapState({ user: 'user.data' }),
    isStaticPage () {
      return this.$route.meta.requiresLogin === false;
@@ -369,7 +369,6 @@ export default {

      const isApiCall = url.indexOf('api/v4') !== -1;
      const userV = response.data && response.data.userV;
-      const isCron = url.indexOf('/api/v4/cron') === 0 && method === 'post';

      if (this.isUserLoaded && isApiCall && userV) {
        const oldUserV = this.user._v;
@@ -381,9 +380,14 @@ export default {
        // exclude chat seen requests because with real time chat they would be too many
        const isChatSeen = url.indexOf('/chat/seen') !== -1 && method === 'post';
        // exclude POST /api/v4/cron because the user is synced automatically after cron runs
+        const isCron = url.indexOf('/api/v4/cron') === 0 && method === 'post';
+        // exclude skills casting as they already return the synced user
+        const isCast = url.indexOf('/api/v4/user/class/cast') !== -1 && method === 'post';

        // Something has changed on the user object that was not tracked here, sync the user
-        if (userV - oldUserV > 1 && !isCron && !isChatSeen && !isUserSync && !isTasksSync) {
+        if (
+          userV - oldUserV > 1 && !isCron && !isChatSeen && !isUserSync && !isTasksSync && !isCast
+        ) {
          Promise.all([
            this.$store.dispatch('user:fetch', { forceLoad: true }),
            this.$store.dispatch('tasks:fetchUserTasks', { forceLoad: true }),
@@ -489,9 +493,10 @@ export default {
        this.hideLoadingScreen();

        // Adjust the timezone offset
-        if (this.user.preferences.timezoneOffset !== this.browserTimezoneOffset) {
+        const browserTimezoneOffset = -this.browserTimezoneUtcOffset;
+        if (this.user.preferences.timezoneOffset !== browserTimezoneOffset) {
          this.$store.dispatch('user:set', {
-            'preferences.timezoneOffset': this.browserTimezoneOffset,
+            'preferences.timezoneOffset': browserTimezoneOffset,
          });
        }

@@ -742,5 +747,6 @@ export default {
 <style src="@/assets/css/sprites/spritesmith-main-25.css"></style>
 <style src="@/assets/css/sprites/spritesmith-main-26.css"></style>
 <style src="@/assets/css/sprites/spritesmith-main-27.css"></style>
+<style src="@/assets/css/sprites/spritesmith-main-28.css"></style>
 <style src="@/assets/css/sprites.css"></style>
 <style src="smartbanner.js/dist/smartbanner.min.css"></style>
@@ -1,24 +1,84 @@
-.promo_armoire_backgrounds_202006 {
+.promo_aquatic_amigos_bundle {
  background-image: url('~@/assets/images/sprites/spritesmith-largeSprites-0.png');
-  background-position: -259px 0px;
+  background-position: 0px -622px;
  width: 423px;
  height: 147px;
 }
-.promo_mystery_202006 {
+.promo_armoire_backgrounds_202007 {
  background-image: url('~@/assets/images/sprites/spritesmith-largeSprites-0.png');
-  background-position: 0px -259px;
+  background-position: -812px 0px;
+  width: 423px;
+  height: 147px;
+}
+.promo_mystery_202007 {
+  background-image: url('~@/assets/images/sprites/spritesmith-largeSprites-0.png');
+  background-position: -812px -453px;
  width: 282px;
  height: 147px;
 }
+.promo_mystery_202008 {
+  background-image: url('~@/assets/images/sprites/spritesmith-largeSprites-0.png');
+  background-position: -812px -296px;
+  width: 294px;
+  height: 156px;
+}
+.promo_orcas {
+  background-image: url('~@/assets/images/sprites/spritesmith-largeSprites-0.png');
+  background-position: -812px -601px;
+  width: 219px;
+  height: 147px;
+}
+.promo_sand_sculpture_potions {
+  background-image: url('~@/assets/images/sprites/spritesmith-largeSprites-0.png');
+  background-position: -812px -148px;
+  width: 423px;
+  height: 147px;
+}
+.promo_seafoam {
+  background-image: url('~@/assets/images/sprites/spritesmith-largeSprites-0.png');
+  background-position: 0px -473px;
+  width: 425px;
+  height: 148px;
+}
+.promo_splashy_skins {
+  background-image: url('~@/assets/images/sprites/spritesmith-largeSprites-0.png');
+  background-position: -409px -286px;
+  width: 375px;
+  height: 186px;
+}
+.customize-option.promo_splashy_skins {
+  background-image: url('~@/assets/images/sprites/spritesmith-largeSprites-0.png');
+  background-position: -434px -301px;
+  width: 60px;
+  height: 60px;
+}
+.promo_summer_splash_2019 {
+  background-image: url('~@/assets/images/sprites/spritesmith-largeSprites-0.png');
+  background-position: 0px -286px;
+  width: 408px;
+  height: 186px;
+}
+.promo_summer_splash_2020 {
+  background-image: url('~@/assets/images/sprites/spritesmith-largeSprites-0.png');
+  background-position: -367px 0px;
+  width: 444px;
+  height: 198px;
+}
 .promo_take_this {
  background-image: url('~@/assets/images/sprites/spritesmith-largeSprites-0.png');
-  background-position: -259px -148px;
+  background-position: -1107px -296px;
  width: 96px;
  height: 69px;
 }
-.scene_hiking {
+.scene_cathb {
+  background-image: url('~@/assets/images/sprites/spritesmith-largeSprites-0.png');
+  background-position: 0px -770px;
+  width: 141px;
+  height: 167px;
+}
+.scene_tools {
  background-image: url('~@/assets/images/sprites/spritesmith-largeSprites-0.png');
  background-position: 0px 0px;
-  width: 258px;
-  height: 258px;
+  width: 366px;
+  height: 285px;
 }
@@ -1,396 +1,402 @@
+.npc_matt {
+  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
+  background-position: -459px -1535px;
+  width: 195px;
+  height: 138px;
+}
+.background_dysheartener {
+  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
+  background-position: 0px 0px;
+  width: 306px;
+  height: 202px;
+}
+.banner_flair_dysheartener {
+  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
+  background-position: -1844px -856px;
+  width: 69px;
+  height: 18px;
+}
+.phobia_dysheartener {
+  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
+  background-position: -1187px -880px;
+  width: 201px;
+  height: 195px;
+}
+.quest_alligator {
+  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
+  background-position: -1627px -1079px;
+  width: 201px;
+  height: 213px;
+}
+.quest_amber {
+  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
+  background-position: -307px 0px;
+  width: 219px;
+  height: 219px;
+}
+.quest_armadillo {
+  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
+  background-position: -527px 0px;
+  width: 219px;
+  height: 219px;
+}
+.quest_atom1 {
+  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
+  background-position: -1325px -1315px;
+  width: 250px;
+  height: 150px;
+}
+.quest_atom2 {
+  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
+  background-position: -251px -1535px;
+  width: 207px;
+  height: 138px;
+}
+.quest_atom3 {
+  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
+  background-position: -747px -440px;
+  width: 216px;
+  height: 180px;
+}
+.quest_axolotl {
+  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
+  background-position: 0px -435px;
+  width: 219px;
+  height: 219px;
+}
+.quest_badger {
+  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
+  background-position: -220px -435px;
+  width: 219px;
+  height: 219px;
+}
+.quest_basilist {
+  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
+  background-position: -191px -1686px;
+  width: 189px;
+  height: 141px;
+}
+.quest_beetle {
+  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
+  background-position: -1627px -1293px;
+  width: 204px;
+  height: 201px;
+}
+.quest_bronze {
+  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
+  background-position: -440px -435px;
+  width: 219px;
+  height: 219px;
+}
 .quest_bunny {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: 0px -1546px;
+  background-position: -967px -660px;
  width: 210px;
  height: 186px;
 }
 .quest_butterfly {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -1320px -660px;
+  background-position: -747px 0px;
  width: 219px;
  height: 219px;
 }
 .quest_cheetah {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -440px 0px;
+  background-position: -747px -220px;
  width: 219px;
  height: 219px;
 }
 .quest_cow {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -1760px 0px;
+  background-position: -1844px 0px;
  width: 174px;
  height: 213px;
 }
 .quest_dilatory {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -440px -232px;
+  background-position: -220px -655px;
  width: 219px;
  height: 219px;
 }
 .quest_dilatoryDistress1 {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -222px -1332px;
+  background-position: -1627px -868px;
  width: 210px;
  height: 210px;
 }
 .quest_dilatoryDistress2 {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -1760px -422px;
+  background-position: -1844px -422px;
  width: 150px;
  height: 150px;
 }
 .quest_dilatoryDistress3 {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: 0px -452px;
+  background-position: -440px -655px;
  width: 219px;
  height: 219px;
 }
 .quest_dilatory_derby {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -220px -232px;
+  background-position: 0px -655px;
  width: 219px;
  height: 219px;
 }
 .quest_dolphin {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -220px -452px;
+  background-position: -660px -655px;
  width: 219px;
  height: 219px;
 }
 .quest_dustbunnies {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -440px -452px;
+  background-position: -967px 0px;
  width: 219px;
  height: 219px;
 }
 .quest_egg {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -1760px -214px;
+  background-position: -1844px -214px;
  width: 165px;
  height: 207px;
 }
 .quest_evilsanta {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -1760px -875px;
+  background-position: -1844px -724px;
  width: 118px;
  height: 131px;
 }
 .quest_evilsanta2 {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -880px -220px;
+  background-position: -967px -220px;
  width: 219px;
  height: 219px;
 }
 .quest_falcon {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -880px -440px;
+  background-position: -967px -440px;
  width: 219px;
  height: 219px;
 }
 .quest_ferret {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: 0px -672px;
+  background-position: 0px -875px;
+  width: 219px;
+  height: 219px;
+}
+.quest_fluorite {
+  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
+  background-position: -220px -875px;
  width: 219px;
  height: 219px;
 }
 .quest_frog {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: 0px -1332px;
+  background-position: -880px -1315px;
  width: 221px;
  height: 213px;
 }
 .quest_ghost_stag {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -440px -672px;
+  background-position: -440px -875px;
  width: 219px;
  height: 219px;
 }
 .quest_goldenknight1 {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -660px -672px;
+  background-position: -660px -875px;
  width: 219px;
  height: 219px;
 }
 .quest_goldenknight2 {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -462px -1546px;
+  background-position: 0px -1535px;
  width: 250px;
  height: 150px;
 }
 .quest_goldenknight3 {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: 0px 0px;
+  background-position: 0px -203px;
  width: 219px;
  height: 231px;
 }
 .quest_gryphon {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -876px -1332px;
+  background-position: -527px -220px;
  width: 216px;
  height: 177px;
 }
 .quest_guineapig {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -1100px -440px;
+  background-position: -880px -875px;
  width: 219px;
  height: 219px;
 }
 .quest_harpy {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -1100px -660px;
+  background-position: -1187px 0px;
  width: 219px;
  height: 219px;
 }
 .quest_hedgehog {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -433px -1332px;
+  background-position: -1407px -1100px;
  width: 219px;
  height: 186px;
 }
 .quest_hippo {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -220px -892px;
+  background-position: -1187px -220px;
  width: 219px;
  height: 219px;
 }
 .quest_horse {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -440px -892px;
+  background-position: -1187px -440px;
  width: 219px;
  height: 219px;
 }
 .quest_kangaroo {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -660px -892px;
+  background-position: -1187px -660px;
  width: 219px;
  height: 219px;
 }
 .quest_kraken {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -1093px -1332px;
+  background-position: -307px -220px;
  width: 216px;
  height: 177px;
 }
 .quest_lostMasterclasser1 {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -1100px -892px;
+  background-position: 0px -1095px;
  width: 219px;
  height: 219px;
 }
 .quest_lostMasterclasser2 {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -1320px 0px;
+  background-position: -220px -1095px;
  width: 219px;
  height: 219px;
 }
 .quest_lostMasterclasser3 {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -1320px -220px;
+  background-position: -440px -1095px;
  width: 219px;
  height: 219px;
 }
 .quest_mayhemMistiflying1 {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -1760px -724px;
+  background-position: -1844px -573px;
  width: 150px;
  height: 150px;
 }
 .quest_mayhemMistiflying2 {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -220px 0px;
+  background-position: -660px -1095px;
  width: 219px;
  height: 219px;
 }
 .quest_mayhemMistiflying3 {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -1320px -880px;
+  background-position: -880px -1095px;
  width: 219px;
  height: 219px;
 }
 .quest_monkey {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: 0px -1112px;
+  background-position: -1100px -1095px;
  width: 219px;
  height: 219px;
 }
 .quest_moon1 {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -1540px -437px;
+  background-position: -1627px 0px;
  width: 216px;
  height: 216px;
 }
 .quest_moon2 {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -440px -1112px;
+  background-position: -1407px 0px;
  width: 219px;
  height: 219px;
 }
 .quest_moon3 {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -660px -1112px;
+  background-position: -1407px -220px;
  width: 219px;
  height: 219px;
 }
 .quest_moonstone1 {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -880px -1112px;
+  background-position: -1407px -440px;
  width: 219px;
  height: 219px;
 }
 .quest_moonstone2 {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -1100px -1112px;
+  background-position: -1407px -660px;
  width: 219px;
  height: 219px;
 }
 .quest_moonstone3 {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -1320px -1112px;
+  background-position: -1407px -880px;
  width: 219px;
  height: 219px;
 }
 .quest_nudibranch {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -1540px -871px;
+  background-position: -1627px -217px;
  width: 216px;
  height: 216px;
 }
 .quest_octopus {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -653px -1332px;
+  background-position: -1102px -1315px;
  width: 222px;
  height: 177px;
 }
 .quest_owl {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -1540px 0px;
+  background-position: 0px -1315px;
  width: 219px;
  height: 219px;
 }
 .quest_peacock {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -1540px -220px;
+  background-position: -1627px -434px;
  width: 216px;
  height: 216px;
 }
 .quest_penguin {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: 0px -1733px;
+  background-position: 0px -1686px;
  width: 190px;
  height: 183px;
 }
 .quest_pterodactyl {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -220px -1112px;
+  background-position: -220px -1315px;
  width: 219px;
  height: 219px;
 }
 .quest_rat {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -1320px -440px;
+  background-position: -440px -1315px;
  width: 219px;
  height: 219px;
 }
 .quest_robot {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -880px -892px;
+  background-position: -660px -1315px;
  width: 219px;
  height: 219px;
 }
 .quest_rock {
  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -1540px -654px;
+  background-position: -1627px -651px;
  width: 216px;
  height: 216px;
 }
-.quest_rooster {
-  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -1527px -1332px;
-  width: 213px;
-  height: 174px;
-}
-.quest_ruby {
-  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: 0px -892px;
-  width: 219px;
-  height: 219px;
-}
-.quest_sabretooth {
-  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -1100px -220px;
-  width: 219px;
-  height: 219px;
-}
-.quest_seaserpent {
-  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -880px -672px;
-  width: 219px;
-  height: 219px;
-}
-.quest_sheep {
-  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -220px -672px;
-  width: 219px;
-  height: 219px;
-}
-.quest_silver {
-  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -880px 0px;
-  width: 219px;
-  height: 219px;
-}
-.quest_slime {
-  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -660px -452px;
-  width: 219px;
-  height: 219px;
-}
-.quest_sloth {
-  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -660px -220px;
-  width: 219px;
-  height: 219px;
-}
-.quest_snail {
-  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -1540px -1088px;
-  width: 219px;
-  height: 213px;
-}
-.quest_snake {
-  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -1310px -1332px;
-  width: 216px;
-  height: 177px;
-}
-.quest_spider {
-  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -211px -1546px;
-  width: 250px;
-  height: 150px;
-}
-.quest_squirrel {
-  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -660px 0px;
-  width: 219px;
-  height: 219px;
-}
-.quest_stoikalmCalamity1 {
-  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -1760px -573px;
-  width: 150px;
-  height: 150px;
-}
-.quest_stoikalmCalamity2 {
-  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: 0px -232px;
-  width: 219px;
-  height: 219px;
-}
-.quest_stoikalmCalamity3 {
-  background-image: url('~@/assets/images/sprites/spritesmith-main-13.png');
-  background-position: -1100px 0px;
-  width: 219px;
-  height: 219px;
-}
--- a/Show More
+++ b/Show More