{"action":"created","issue":{"url":"https://api.github.com/repos/HabitRPG/habitrpg/issues/6408","labels_url":"https://api.github.com/repos/HabitRPG/habitrpg/issues/6408/labels{/name}","comments_url":"https://api.github.com/repos/HabitRPG/habitrpg/issues/6408/comments","events_url":"https://api.github.com/repos/HabitRPG/habitrpg/issues/6408/events","html_url":"https://github.com/HabitRPG/habitrpg/issues/6408","id":124035772,"number":6408,"title":"Challenge API allows to create challenges that cannot be deleted, and seem to cause UX malfunction","user":{"login":"HabitualPhoenix","id":16456710,"avatar_url":"https://avatars.githubusercontent.com/u/16456710?v=3","gravatar_id":"","url":"https://api.github.com/users/HabitualPhoenix","html_url":"https://github.com/HabitualPhoenix","followers_url":"https://api.github.com/users/HabitualPhoenix/followers","following_url":"https://api.github.com/users/HabitualPhoenix/following{/other_user}","gists_url":"https://api.github.com/users/HabitualPhoenix/gists{/gist_id}","starred_url":"https://api.github.com/users/HabitualPhoenix/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/HabitualPhoenix/subscriptions","organizations_url":"https://api.github.com/users/HabitualPhoenix/orgs","repos_url":"https://api.github.com/users/HabitualPhoenix/repos","events_url":"https://api.github.com/users/HabitualPhoenix/events{/privacy}","received_events_url":"https://api.github.com/users/HabitualPhoenix/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":8,"created_at":"2015-12-28T08:42:55Z","updated_at":"2015-12-28T10:21:36Z","closed_at":null,"body":"It seems that the API allows to create guild challenges that 1) it will not be possible to delete, either through the API, or the UI; 2) will make the guild page not loadable for any of the guild's members; and 3) will make the challenges page filters malfunction for the challenge owner.\r\n\r\nI think the problem is related to accepting values for the `id` fields in the `\"todos\"`, which might then lead to wrong object linking, but I might be wrong.\r\n\r\nThis is how this happened in my case, leaving me with a challenge I could see in the list of challenges I own in the UI (and, showing up as a part of the `challenge` resource collection, with an `_id` = 568065dc932b260d01abeca0), but with no UI option to delete it (and returning *\"Challenge 568065dc932b260d01abeca0 not found\"*  in response to any request for the `challenge/568065dc932b260d01abeca0` resource):\r\n\r\n0\\. I had a challenge I owned, with multiple todos, and a party as its group. When the party was dissolved, I wanted to move the challenge to our guild instead. At that point, the UI did not allow me either to clone or to re-assign the challenge (the latter limitation being more understandable than the former). \r\n\r\n1\\. Not wanting to re-create the todos by hand, and hoping to preserve the relationship between the challenge and its former participants, I tried to use the API to update the group associated with the challenge by POSTing a `challenge` resource with a modified `\"group\"`. The request returned 200, but the `\"group\"` field changed from the guild group ID I provided, to something that didn't seem to exist (it no longer was the original party's group ID, I believe, but I might be wrong).\r\n\r\n2\\. Failing to re-attach the old challenge to a new group (something, frankly, I didn't think would likely work anyway), I tried to \"clone\" the challenge manually, by using the API, and POSTing the JSON resource derived from the old challenge, while setting the `\"_id\"` to *null*, and the `\"group\"` to the guild's ID. Unfortunately, I forgot to change the `\"id\"` fields for the todos -- they were left referring to the existing todos, parts of the old challenge.\r\n\r\nThis is what my request looked like:\r\n```\r\nPOST https://habitica.com/api/v2/challenges\r\n{\r\n  \"_id\": null,\r\n  \"name\": \"Don't Procrastinate!\",\r\n  \"description\": \"Finish . . . dailies before 5 pm.\",\r\n  \"leader\": \"8f660cd4-057b-45d9-ac72-c3fbd874e72f\",\r\n  \"group\": \"42dbb940-46ab-45d5-a130-fdb0d4972cd3\",\r\n  \"shortName\": \"by 5pm\",\r\n  \"__v\": 0,\r\n  \"prize\": 1,\r\n  \"memberCount\": 0,\r\n  \"members\": [],\r\n  \"timestamp\": \"2015-12-25T22:36:35.263Z\",\r\n  \"rewards\": [],\r\n  \"todos\": [\r\n    {\r\n      \"text\": \"Finish . . . by 5pm (3)\",\r\n      \"date\": \"2015-12-30T05:00:00.000Z\",\r\n      \"challenge\": {},\r\n      \"attribute\": \"str\",\r\n      \"priority\": 1,\r\n      \"value\": 0,\r\n      \"tags\": {},\r\n      \"notes\": \"\",\r\n      \"dateCreated\": \"2015-12-27T20:58:21.291Z\",\r\n      \"id\": \"8995dbe5-9969-46cc-8ca7-c5cac3077a4c\",\r\n      \"checklist\": [],\r\n      \"collapseChecklist\": false,\r\n      \"completed\": false,\r\n      \"type\": \"todo\"\r\n    },\r\n    {\r\n      \"text\": \"Finish . . .  by 5pm (2)\",\r\n      . . .\r\n      \"id\": \"8aae2be5-129f-4ab7-b25b-db769274dbf9\",\r\n      . . .\r\n    },\r\n      . . .\r\n  ],\r\n  \"dailys\": [],\r\n  \"habits\": [],\r\n  \"official\": false\r\n}\r\n```\r\n3\\. The request succeeded with the code 200. However, from that point on, the guild page was no longer accessible to any of the guild members (it would load only partially, with no data or action buttons), and the filters on my challenges page stopped working (all challenges were always shown, not filter option made any difference).\r\n\r\n4\\. I was able to resolve the UI problems by a) quitting the guild, which solved the challenge filtering problem for me; and b) by having the guild owner to create a new guild challenge, which solved the guild page loading problem for the members. As steps (a) and (b) were carried out in that order, I am unsure whether (a) was necessary for the guild page to start working, but it was definitely not sufficient for it by itself. \r\n\r\nI must also mention that, at some point between 3 and 4, I deleted the old challenge -- unfortunately, I do not remember where exactly in the sequence of the events that happened.\r\n\r\n5\\. I now own two challenges I cannot delete: one with the reported ID of 568065dc932b260d01abeca0, a direct result of the actions above, and another, with the reported ID of 56807cdcfc92ca4d03771c56 (possibly accidentally created while trying to get the transcript of my actions from Postman, and hitting Send an extra time -- not certain, though). Both can be seen in the UI with the Owned filter. Neither can be deleted in the UI, or through the API, as both are *\"not found\"*. \r\n\r\n(On the positive side, there is no adverse UX effects any more.)\r\n\r\nAs can be seen in the JSON above, my User ID is 8f660cd4-057b-45d9-ac72-c3fbd874e72f, and the formerly-affected guild group ID is 42dbb940-46ab-45d5-a130-fdb0d4972cd3.\r\n"},"comment":{"url":"https://api.github.com/repos/HabitRPG/habitrpg/issues/comments/167538763","html_url":"https://github.com/HabitRPG/habitrpg/issues/6408#issuecomment-167538763","issue_url":"https://api.github.com/repos/HabitRPG/habitrpg/issues/6408","id":167538763,"user":{"login":"Alys","id":1495809,"avatar_url":"https://avatars.githubusercontent.com/u/1495809?v=3","gravatar_id":"","url":"https://api.github.com/users/Alys","html_url":"https://github.com/Alys","followers_url":"https://api.github.com/users/Alys/followers","following_url":"https://api.github.com/users/Alys/following{/other_user}","gists_url":"https://api.github.com/users/Alys/gists{/gist_id}","starred_url":"https://api.github.com/users/Alys/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Alys/subscriptions","organizations_url":"https://api.github.com/users/Alys/orgs","repos_url":"https://api.github.com/users/Alys/repos","events_url":"https://api.github.com/users/Alys/events{/privacy}","received_events_url":"https://api.github.com/users/Alys/received_events","type":"User","site_admin":false},"created_at":"2015-12-28T10:21:36Z","updated_at":"2015-12-28T10:21:36Z","body":"In the user document, tasks from the bad challenges have this in their data:\r\n\r\n````\r\n        {\r\n            \"text\": \"REDACTED\",\r\n            \"challenge\": {\r\n                \"id\": null\r\n            },\r\n````\r\n\r\nAs @HabitualPhoenix reported by email, some of his tasks that were NOT from those challenges have this data:\r\n\r\n````\r\n        { \r\n            \"text\": \"REDACTED\",\r\n            \"challenge\": {\r\n                \"broken\": \"TASK_DELETED\"\r\n            },\r\n````\r\n\r\nI'm hoping that's a once-off glitch related to the challenge weirdness, rather than a problem that might reoccur. Regardless, once API v3 is in place, this sort of thing shouldn't happen any more."}}