Merge branch 'api_tests' into develop

test/api-legacy/anonymized.coffee

@@ -1,62 +0,0 @@
-'use strict'
-
-app = require("../../website/src/server")
-
-describe "GET /api/v2/user/anonymized", ->
-
-  anon = null
-
-  before (done) ->
-    # TODO: Seed user with messages, rewards, dailys, checklists, webhooks, etc
-    registerNewUser ->
-      request.get(baseURL + "/user/anonymized")
-        .end (err, res) ->
-          anon = res.body
-          done()
-    , true
-
-  it 'retains user id', (done) ->
-    expect(anon._id).to.equal user._id
-    done()
-
-  it 'removes credentials and financial information', (done) ->
-    expect(anon.apiToken).to.not.exist
-    expect(anon.auth.local).to.not.exist
-    expect(anon.auth.facebook).to.not.exist
-    expect(anon.purchased.plan).to.not.exist
-    done()
-
-  it 'removes profile information', (done) ->
-    expect(anon.profile).to.not.exist
-    expect(anon.contributor).to.not.exist
-    expect(anon.achievements.challenges).to.not.exist
-    done()
-
-  it 'removes social information', (done) ->
-    expect(anon.newMessages).to.not.exist
-    expect(anon.invitations).to.not.exist
-    expect(anon.items.special.nyeReceived).to.not.exist
-    expect(anon.items.special.valentineReceived).to.not.exist
-    _(anon.inbox.messages).each (msg) ->
-      expect(msg).to.equal 'inbox message text'
-    done()
-
-  it 'removes webhooks', (done) ->
-    expect(anon.webhooks).to.not.exist
-    done()
-
-  it 'anonymizes task info', (done) ->
-    _(['habits', 'todos', 'dailys', 'rewards']).each (tasks) ->
-      _(anon[tasks]).each (task) ->
-        expect(task.text).to.equal 'task text'
-        expect(task.notes).to.equal 'task notes'
-        checklist_count = 0
-        _(task.checklist).each (box) ->
-          box.text = 'item' + checklist_count++
-    done()
-
-  it 'anonymizes tags', (done) ->
-    _(anon.tags).each (tag) ->
-      expect(tag.name).to.equal 'tag'
-      expect(tag.challenge).to.equal 'challenge'
-    done()

test/api-legacy/get_user.coffee

@@ -1,25 +0,0 @@
-'use strict'
-
-require('../../website/src/server')
-
-describe 'User', ->
-
-  before (done) ->
-    registerNewUser done, true
-
-  describe 'GET /user', ->
-    it 'removes password from user object', (done) ->
-      request.get(baseURL + '/user')
-        .end (err, res) ->
-          expectCode res, 200
-          localAuth = res.body.auth.local
-          expect(localAuth.hashed_password).to.not.exist
-          expect(localAuth.salt).to.not.exist
-          done()
-
-    it 'removes apiToken from user object', (done) ->
-      request.get(baseURL + '/user')
-        .end (err, res) ->
-          expectCode res, 200
-          expect(res.body.apiToken).to.not.exist
-          done()

test/api-legacy/party.coffee

@@ -6,124 +6,6 @@ Group = require("../../website/src/models/group").model
 app = require("../../website/src/server")
 
 describe "Party", ->
-  context "creating a party", ->
-    it "creates a party", (done) ->
-      async.waterfall [
-        (cb) ->
-          registerNewUser(cb, true)
-
-        (user, cb) ->
-          request.post(baseURL + "/groups").send(
-            name: "TestGroup"
-            type: "party"
-          ).end (err, res) ->
-            expectCode res, 200
-            group = res.body
-            expect(group.members.length).to.equal 1
-            expect(group.leader).to.equal user._id
-            cb()
-      ], done
-
-    it "prevents user from creating a second party", (done) ->
-      request.post(baseURL + "/groups").send(
-        name: "TestGroup"
-        type: "party"
-      ).end (err, res) ->
-        expectCode res, 400
-        expect(res.body.err).to.equal "Already in a party, try refreshing."
-        done()
-
-  context "Searching for a party", ->
-    group = undefined
-    beforeEach (done) ->
-      async.waterfall [
-        (cb) ->
-          registerNewUser(cb, true)
-
-        (user, cb) ->
-          request.post(baseURL + "/groups").send(
-            name: "TestGroup"
-            type: "party"
-          ).end (err, res) ->
-            expectCode res, 200
-            group = res.body
-            expect(group.members.length).to.equal 1
-            expect(group.leader).to.equal user._id
-            cb()
-      ], done
-
-    it "can be found by querying for group type party", (done) ->
-      request.get(baseURL + "/groups/").send(
-        type: "party"
-      ).end (err, res) ->
-        expectCode res, 200
-        party = _.find res.body, (g) -> return g._id == group._id
-        expect(party._id).to.equal group._id
-        expect(party.leader).to.equal user._id
-        expect(party.name).to.equal group.name
-        expect(party.quest).to.deep.equal { progress: {} }
-        expect(party.memberCount).to.equal group.memberCount
-        done()
-
-  context "joining a party", ->
-    group = undefined
-    beforeEach (done) ->
-      async.waterfall [
-        (cb) ->
-          registerNewUser(cb, true)
-
-        (user, cb) ->
-          request.post(baseURL + "/groups").send(
-            name: "TestGroup"
-            type: "party"
-          ).end (err, res) ->
-            expectCode res, 200
-            group = res.body
-            expect(group.members.length).to.equal 1
-            expect(group.leader).to.equal user._id
-            cb()
-      ], done
-
-    it "prevents user from joining a party when they haven't been invited", (done) ->
-      registerNewUser (err, user) ->
-        request.post(baseURL + "/groups/" + group._id + "/join").send()
-        .set("X-API-User", user._id)
-        .set("X-API-Key", user.apiToken)
-        .end (err, res) ->
-          expectCode res, 401
-          expect(res.body.err).to.equal "Can't join a group you're not invited to."
-          done()
-      , false
-
-    it "allows users to join a party when they have been invited", (done) ->
-      tmpUser = undefined
-      async.waterfall [
-        (cb) ->
-          registerNewUser(cb, false)
-
-        (user, cb) ->
-          tmpUser = user
-          inviteURL = baseURL + "/groups/" + group._id + "/invite"
-          request.post(inviteURL).send(
-            uuids: [tmpUser._id]
-          )
-          .end ->
-            cb()
-
-        (cb) ->
-          request.post(baseURL + "/groups/" + group._id + "/join")
-          .set("X-API-User", tmpUser._id)
-          .set("X-API-Key", tmpUser.apiToken)
-          .end (err, res) ->
-            expectCode res, 200
-            cb()
-
-        (cb) ->
-          Group.findById group._id, (err, grp) ->
-            expect(grp.members).to.include(tmpUser._id)
-            cb()
-      ], done
-
   context "Quests", ->
     party = undefined
     group = undefined

test/api-legacy/pushNotifications.coffee

@@ -11,21 +11,6 @@ describe "Push-Notifications", ->
   before (done) ->
     registerNewUser(done, true)
 
-  describe "POST /user/pushDevice", ->
-    it "Registers a DeviceID", (done) ->
-      request.post(baseURL + "/user/pushDevice").send(
-        { regId: "123123", type: "android"}
-      ).end (err, res) ->
-        expectCode res, 200
-
-        User.findOne
-          _id: global.user._id
-        , (err, _user) ->
-          expect(_user.pushDevices.length).to.equal 1
-          expect(_user.pushDevices[0].regId).to.equal "123123"
-
-          done()
-
   describe "Events that send push notifications", ->
     pushSpy = { sendNotify: sinon.spy() }
 

test/api-legacy/todos.coffee

@@ -80,106 +80,3 @@ describe "Todos", ->
           # Expect todos to be 2 less than the total count
           expect(_.size(res.body.todos)).to.equal numTasks - 2
           done()
-
-  describe "Creating, Updating, Deleting Todos", ->
-    todo = undefined
-    updateTodo = undefined
-    describe "Creating todos", ->
-      it "Creates a todo", (done) ->
-        request.post(baseURL + "/user/tasks").send(
-            type: "todo"
-            text: "Sample Todo"
-        ).end (err, res) ->
-          expectCode res, 200
-          todo = res.body
-          expect(todo.text).to.equal "Sample Todo"
-          expect(todo.id).to.be.ok
-          expect(todo.value).to.equal 0
-          done()
-
-      it "Does not create a todo with an id that already exists", (done) ->
-        original_todo = {
-          type: "todo"
-          text: "original todo"
-          id: "custom-id"
-        }
-        duplicate_id_todo = {
-          type: "todo"
-          text: "not original todo"
-          id: "custom-id"
-        }
-        request.post(baseURL + "/user/tasks").send(
-          original_todo
-        ).end (err, res) ->
-          request.post(baseURL + "/user/tasks").send(
-            duplicate_id_todo
-          ).end (err, res) ->
-            expectCode res, 409
-            expect(res.body.err).to.eql('A task with that ID already exists.')
-            done()
-
-    describe "Updating todos", ->
-      it "Does not update id of todo", (done) ->
-        request.put(baseURL + "/user/tasks/" + todo.id).send(
-          id: "a-new-id"
-        ).end (err, res) ->
-          expectCode res, 200
-          updateTodo = res.body
-          expect(updateTodo.id).to.equal todo.id
-          done()
-
-      it "Does not update type of todo", (done) ->
-        request.put(baseURL + "/user/tasks/" + todo.id).send(
-          type: "habit"
-        ).end (err, res) ->
-          expectCode res, 200
-          updateTodo = res.body
-          expect(updateTodo.type).to.equal todo.type
-          done()
-
-      it "Does update text, attribute, priority, value, notes", (done) ->
-        request.put(baseURL + "/user/tasks/" + todo.id).send(
-          text: "Changed Title"
-          attribute: "int"
-          priority: 1.5
-          value: 5
-          notes: "Some notes"
-        ).end (err, res) ->
-          expectCode res, 200
-          todo = res.body
-          expect(todo.text).to.equal "Changed Title"
-          expect(todo.attribute).to.equal "int"
-          expect(todo.priority).to.equal 1.5
-          expect(todo.value).to.equal 5
-          expect(todo.notes).to.equal "Some notes"
-          done()
-
-    describe "Deleting todos", ->
-      it "Does delete todo", (done) ->
-        request.del(baseURL + "/user/tasks/" + todo.id).send(
-        ).end (err, res) ->
-          expectCode res, 200
-          body = res.body
-          expect(body).to.be.empty
-          done()
-
-      it "Does not delete already deleted todo", (done) ->
-        request.del(baseURL + "/user/tasks/" + todo.id).send(
-        ).end (err, res) ->
-          expectCode res, 404
-          body = res.body
-          expect(body.err).to.equal "Task not found."
-          done()
-
-      it "Does not update text, attribute, priority, value, notes if task is already deleted", (done) ->
-        request.put(baseURL + "/user/tasks/" + todo.id).send(
-          text: "New Title"
-          attribute: "str"
-          priority: 1
-          value: 4
-          notes: "Other notes"
-        ).end (err, res) ->
-          expectCode res, 404
-          body = res.body
-          expect(body.err).to.equal "Task not found."
-          done()

test/api-legacy/users.coffee

@@ -12,25 +12,6 @@ describe "Users", ->
         done()
       , true
 
-    it 'Should delete a user', (done) ->
-      async.waterfall [
-        (cb) ->
-          registerManyUsers 1, cb
-
-        (_userToDelete, cb) ->
-          userToDelete = _userToDelete[0]
-          request.del(baseURL + "/user")
-          .set("X-API-User", userToDelete._id)
-          .set("X-API-Key", userToDelete.apiToken)
-          .end (err, res) ->
-            expectCode res, 200
-            request.get(baseURL + "/user/" + userToDelete._id)
-            .end (err, res) ->
-              expectCode res, 404
-              cb()
-
-      ], done
-
     context "handle group changes when user cancels", ->
       it "Should choose a new group leader when deleting a user", (done) ->
         userToDelete = undefined

test/api/groups/POST-groups_id_join.test.js

@@ -3,6 +3,7 @@ import {
   generateUser,
   requester,
 } from '../../helpers/api.helper';
+import { each, find } from 'lodash';
 
 describe('POST /groups/:id/join', () => {
 
@@ -10,6 +11,108 @@ describe('POST /groups/:id/join', () => {
     it('returns an error');
   });
 
+  each({
+    'public guild': {type: 'guild', privacy: 'public'},
+    'private guild': {type: 'guild', privacy: 'private'},
+    'party': {type: 'party', privacy: 'private'},
+  }, (data, groupType) => {
+    context(`user has invitation to a ${groupType}`, () => {
+      let api, group, invitee;
+
+      beforeEach(() => {
+        return createAndPopulateGroup({
+          groupDetails: {
+            type: data.type,
+            privacy: data.privacy,
+          },
+          invites: 1,
+        }).then((res) => {
+          group = res.group;
+          invitee = res.invitees[0];
+          api = requester(invitee);
+        });
+      });
+
+      it(`allows user to join a ${groupType}`, () => {
+        return api.post(`/groups/${group._id}/join`).then((res) => {
+          return api.get(`/groups/${group._id}`);
+        }).then((_group) => {
+          let members = _group.members;
+          let userInGroup = find(members, (user) => {
+            return user._id === invitee._id;
+          });
+
+          expect(userInGroup).to.exist;
+        });
+      });
+    });
+  });
+
+  each({
+    'private guild': {type: 'guild', privacy: 'private'},
+    'party': {type: 'party', privacy: 'private'},
+  }, (data, groupType) => {
+    context(`user does not have an invitation to a ${groupType}`, () => {
+      let api, group, user;
+
+      beforeEach(() => {
+        return createAndPopulateGroup({
+          groupDetails: {
+            type: data.type,
+            privacy: data.privacy,
+          },
+        }).then((res) => {
+          group = res.group;
+          return generateUser();
+        }).then((generatedUser) => {
+          user = generatedUser;
+          api = requester(user);
+        });
+      });
+
+      it(`does not allow user to join a ${groupType}`, () => {
+        return expect(api.post(`/groups/${group._id}/join`).then((res) => {
+          return api.get(`/groups/${group._id}`);
+        })).to.eventually.be.rejected.and.eql({
+          code: 401,
+          text: 'Can\'t join a group you\'re not invited to.',
+        });
+      });
+    });
+  });
+
+  context('user does not have an invitation to a public group', () => {
+    let api, group, user;
+
+    beforeEach(() => {
+      return createAndPopulateGroup({
+        groupDetails: {
+          type: 'guild',
+          privacy: 'public',
+        },
+      }).then((res) => {
+        group = res.group;
+        return generateUser();
+      }).then((generatedUser) => {
+        user = generatedUser;
+        api = requester(user);
+      });
+    });
+
+    it('allows user to join a public guild', () => {
+      return api.post(`/groups/${group._id}/join`).then((res) => {
+        return api.get(`/groups/${group._id}`);
+      }).then((_group) => {
+        let members = _group.members;
+        let userInGroup = find(members, (member) => {
+          return user._id === user._id;
+        });
+
+        expect(userInGroup).to.exist;
+      });
+    });
+  });
+
   context('public guild has no leader', () => {
     let user, group;
 

test/api/user/GET-user.test.js

@@ -6,19 +6,28 @@ import {
 describe('GET /user', () => {
   let user;
 
-  beforeEach(() => {
+  before(() => {
     return generateUser().then((usr) => {
-      user = usr;
+      let api = requester(usr);
+      return api.get('/user');
+    }).then((fetchedUser) => {
+      user = fetchedUser;
     });
   });
 
   it('gets the user object', () => {
-    let api = requester(user);
-    return api.get('/user').then((fetchedUser) => {
-      expect(fetchedUser._id).to.eql(user._id);
-      expect(fetchedUser.auth.local.username).to.eql(user.auth.local.username);
-      expect(fetchedUser.todos).to.eql(user.todos);
-      expect(fetchedUser.items).to.eql(user.items);
-    });
+    expect(user._id).to.eql(user._id);
+    expect(user.auth.local.username).to.eql(user.auth.local.username);
+    expect(user.todos).to.eql(user.todos);
+    expect(user.items).to.eql(user.items);
+  });
+
+  it('does not include password information', () => {
+    expect(user.auth.local.hashed_password).to.not.exist
+    expect(user.auth.local.salt).to.not.exist
+  });
+
+  it('does not include api token', () => {
+    expect(user.apiToken).to.not.exist
   });
 });

test/api/user/anonymized/GET-user_anonymized.test.js

@@ -0,0 +1,102 @@
+import {
+  generateUser,
+  requester,
+} from '../../../helpers/api.helper';
+import { each } from 'lodash';
+
+describe('GET /user/anonymized', () => {
+  let api, user;
+
+  before(() => {
+    return generateUser({
+      'inbox.messages' : {
+        'the-message-id' : {
+          sort : 214,
+          user : 'Some user',
+          backer : {},
+          contributor : {
+            text : 'Blacksmith',
+            level : 2,
+            contributions : 'Made some contributions',
+            admin : false
+          },
+          uuid : 'some-users-uuid',
+          flagCount : 0,
+          flags : {},
+          likes : {},
+          timestamp : 1444154258699.0000000000000000,
+          text : 'Lorem ipsum',
+          id : 'the-messages-id',
+          sent : true
+        }
+      }
+    }).then((usr) => {
+      api = requester(usr);
+      return api.post('/user/tasks', {
+        text: 'some private text',
+        notes: 'some private notes',
+        checklist: [
+          {text: 'a private checklist'},
+          {text: 'another private checklist'},
+        ],
+        type: 'daily',
+      });
+    }).then((result) => {
+      return api.get('/user/anonymized');
+    }).then((anonymizedUser) => {
+      user = anonymizedUser;
+    });
+  });
+
+  it('retains user id', () => {
+    expect(user._id).to.exist;
+  });
+
+  it('removes credentials and financial information', () => {
+    expect(user.apiToken).to.not.exist;
+    expect(user.auth.local).to.not.exist;
+    expect(user.auth.facebook).to.not.exist;
+    expect(user.purchased.plan).to.not.exist;
+  });
+
+  it('removes profile information', () => {
+    expect(user.profile).to.not.exist;
+    expect(user.contributor).to.not.exist;
+    expect(user.achievements.challenges).to.not.exist;
+  });
+
+  it('removes social information', () => {
+    expect(user.newMessages).to.not.exist;
+    expect(user.invitations).to.not.exist;
+    expect(user.items.special.nyeReceived).to.not.exist;
+    expect(user.items.special.valentineReceived).to.not.exist;
+
+    each(user.inbox.messages, (msg) => {
+      expect(msg.text).to.eql('inbox message text');
+    });
+  });
+
+  it('anonymizes task info', () => {
+    each(['habits', 'todos', 'dailys', 'rewards'], (tasks) => {
+      each(user[tasks], (task) => {
+        expect(task.text).to.eql('task text');
+        expect(task.notes).to.eql('task notes');
+
+        each(task.checklist, (box) => {
+          expect(box.text).to.match(/item\d*/);
+        });
+      });
+    });
+  });
+
+  it('anonymizes tags', () => {
+    each(user.tags, (tag) => {
+      expect(tag.name).to.eql('tag');
+      expect(tag.challenge).to.eql('challenge');
+    });
+  });
+
+  it('removes webhooks', () => {
+    expect(user.webhooks).to.not.exist;
+  });
+});

test/api/user/pushDevice/POST-pushDevice.test.js

@@ -0,0 +1,26 @@
+import {
+  generateUser,
+  requester,
+} from '../../../helpers/api.helper';
+
+describe('POST /user/pushDevice', () => {
+  let api;
+
+  beforeEach(() => {
+    return generateUser().then((user) => {
+      api = requester(user);
+    });
+  });
+
+  it('registers a device id', () => {
+    return api.post('/user/pushDevice', {
+      regId: '123123',
+      type: 'android',
+    }).then((devices) => {
+      let device = devices[0];
+      expect(device._id).to.exist;
+      expect(device.regId).to.eql('123123');
+      expect(device.type).to.eql('android');
+    });
+  });
+});

test/api/user/tasks/DELETE-tasks_id.test.js

@@ -0,0 +1,44 @@
+import {
+  generateUser,
+  requester,
+} from '../../../helpers/api.helper';
+
+describe('DELETE /user/tasks/:id', () => {
+  let api, user, task;
+
+  beforeEach(() => {
+    return generateUser().then((_user) => {
+      user = _user;
+      task = user.todos[0];
+      api = requester(user);
+    });
+  });
+
+  it('deletes a task', () => {
+    return expect(api.del(`/user/tasks/${task.id}`)
+      .then((res) => {
+        return api.get(`/user/tasks/${task.id}`);
+      })).to.eventually.be.rejected.and.eql({
+        code: 404,
+        text: 'No task found.',
+    });
+  });
+
+  it('returns an error if the task does not exist', () => {
+    return expect(api.del('/user/tasks/task-that-does-not-exist'))
+      .to.eventually.be.rejected.and.eql({
+        code: 404,
+        text: 'Task not found.',
+    });
+  });
+
+  it('does not delete another user\'s task', () => {
+    return expect(generateUser().then((otherUser) => {
+      let otherUsersTask = otherUser.todos[0];
+      return api.del(`/user/tasks/${otherUsersTask.id}`);
+    })).to.eventually.be.rejected.and.eql({
+      code: 404,
+      text: 'Task not found.',
+    });
+  });
+});

test/api/user/tasks/GET-tasks.test.js

@@ -0,0 +1,27 @@
+import {
+  generateUser,
+  requester,
+} from '../../../helpers/api.helper';
+
+describe('GET /user/tasks/', () => {
+  let api, user;
+
+  beforeEach(() => {
+    return generateUser().then((_user) => {
+      user = _user;
+      api = requester(user);
+    });
+  });
+
+  it('gets all tasks', () => {
+    return api.get(`/user/tasks/`).then((tasks) => {
+      expect(tasks).to.be.an('array');
+      expect(tasks.length).to.be.greaterThan(4);
+
+      let task = tasks[0];
+      expect(task.id).to.exist;
+      expect(task.type).to.exist;
+      expect(task.text).to.exist;
+    });
+  });
+});

test/api/user/tasks/GET-tasks_id.test.js

@@ -0,0 +1,44 @@
+import {
+  generateUser,
+  requester,
+} from '../../../helpers/api.helper';
+
+describe('GET /user/tasks/:id', () => {
+  let api, user, task;
+
+  beforeEach(() => {
+    return generateUser().then((_user) => {
+      user = _user;
+      task = user.todos[0];
+      api = requester(user);
+    });
+  });
+
+  it('gets a task', () => {
+    return api.get(`/user/tasks/${task.id}`).then((foundTask) => {
+      expect(foundTask.id).to.eql(task.id);
+      expect(foundTask.text).to.eql(task.text);
+      expect(foundTask.notes).to.eql(task.notes);
+      expect(foundTask.value).to.eql(task.value);
+      expect(foundTask.type).to.eql(task.type);
+    });
+  });
+
+  it('returns an error if the task does not exist', () => {
+    return expect(api.get('/user/tasks/task-that-does-not-exist'))
+      .to.eventually.be.rejected.and.eql({
+        code: 404,
+        text: 'No task found.',
+    });
+  });
+
+  it('does not get another user\'s task', () => {
+    return expect(generateUser().then((otherUser) => {
+      let otherUsersTask = otherUser.todos[0];
+      return api.get(`/user/tasks/${otherUsersTask.id}`);
+    })).to.eventually.be.rejected.and.eql({
+      code: 404,
+      text: 'No task found.',
+    });
+  });
+});

test/api/user/tasks/POST-tasks.test.js

@@ -0,0 +1,70 @@
+import {
+  generateUser,
+  requester,
+} from '../../../helpers/api.helper';
+
+describe('POST /user/tasks', () => {
+
+  let api, user;
+
+  beforeEach(() => {
+    return generateUser().then((_user) => {
+      user = _user;
+      api = requester(user);
+    });
+  });
+
+  it('creates a task', () => {
+    return api.post('/user/tasks').then((task) => {
+      expect(task.id).to.exist;
+    });
+  });
+
+  it('creates a habit by default', () => {
+    return expect(api.post('/user/tasks'))
+      .to.eventually.have.property('type', 'habit');
+  });
+
+  it('creates a task with specified values', () => {
+    return api.post('/user/tasks', {
+      type: 'daily',
+      text: 'My task',
+      notes: 'My notes',
+      frequency: 'daily',
+    }).then((task) => {
+      expect(task.type).to.eql('daily');
+      expect(task.text).to.eql('My task');
+      expect(task.notes).to.eql('My notes');
+      expect(task.frequency).to.eql('daily');
+    });
+  });
+
+  it('does not create a task with an id that already exists', () => {
+    let todo = user.todos[0];
+
+    return expect(api.post('/user/tasks', {
+      id: todo.id,
+    })).to.eventually.be.rejected.and.eql({
+      code: 409,
+      text: 'A task with that ID already exists.',
+    });
+  });
+
+  xit('TODO: no error is thrown - throws a 500 validation error if invalid type is posted', () => {
+    return expect(api.post('/user/tasks', {
+      type: 'not-valid',
+    })).to.eventually.be.rejected.and.eql({
+      code: 500,
+      text: 'Cannot call method \'indexOf\' of undefined',
+    });
+  });
+
+  xit('TODO: no error is thrown - throws a 500 validation error if invalid data is posted', () => {
+    return expect(api.post('/user/tasks', {
+      frequency: 'not-valid',
+    })).to.eventually.be.rejected.and.eql({
+      code: 500,
+      text: 'Task validation failed',
+    });
+  });
+});

test/api/user/tasks/PUT-tasks_id.test.js

@@ -0,0 +1,70 @@
+import {
+  generateUser,
+  requester,
+} from '../../../helpers/api.helper';
+
+describe('PUT /user/tasks/:id', () => {
+  let api, user, task;
+
+  beforeEach(() => {
+    return generateUser().then((_user) => {
+      user = _user;
+      api = requester(user);
+      task = user.todos[0];
+    });
+  });
+
+  it('does not update the id of the task', () => {
+    return api.put(`/user/tasks/${task.id}`, {
+      id: 'some-thing',
+    }).then((updatedTask) => {
+      expect(updatedTask.id).to.eql(task.id);
+      expect(updatedTask.id).to.not.eql('some-thing');
+    });
+  });
+
+  it('does not update the type of the task', () => {
+    return api.put(`/user/tasks/${task.id}`, {
+      type: 'habit',
+    }).then((updatedTask) => {
+      expect(updatedTask.type).to.eql(task.type);
+      expect(updatedTask.type).to.not.eql('habit');
+    });
+  });
+
+  it('updates text, attribute, priority, value and notes', () => {
+    return api.put(`/user/tasks/${task.id}`, {
+      text: 'new text',
+      notes: 'new notes',
+      value: 10000,
+      priority: .5,
+      attribute: 'str',
+    }).then((updatedTask) => {
+      expect(updatedTask.text).to.eql('new text');
+      expect(updatedTask.notes).to.eql('new notes');
+      expect(updatedTask.value).to.eql(10000);
+      expect(updatedTask.priority).to.eql(.5);
+      expect(updatedTask.attribute).to.eql('str');
+    });
+  });
+
+  it('returns an error if the task does not exist', () => {
+    return expect(api.put('/user/tasks/task-id-that-does-not-exist'))
+      .to.eventually.be.rejected.and.eql({
+        code: 404,
+        text: 'Task not found.',
+      });
+  });
+
+  it('does not update another user\'s task', () => {
+    return expect(generateUser().then((otherUser) => {
+      let otherUsersTask = otherUser.todos[0];
+      return api.put(`/user/tasks/${otherUsersTask._id}`, {
+        name: 'some name',
+      });
+    })).to.eventually.be.rejected.and.eql({
+      code: 404,
+      text: 'Task not found.',
+    });
+  });
+});