service_test.go

// Copyright (C) 2020 Storj Labs, Inc.
// See LICENSE for copying information.

package console_test

import (
	"bytes"
	"context"
	"database/sql"
	"encoding/json"
	"fmt"
	"math/rand"
	"sort"
	"strings"
	"testing"
	"time"

	"github.com/shopspring/decimal"
	"github.com/stretchr/testify/require"
	"github.com/zeebo/errs"
	"go.uber.org/zap"
	"golang.org/x/crypto/bcrypt"

	"storj.io/common/currency"
	"storj.io/common/macaroon"
	"storj.io/common/memory"
	"storj.io/common/pb"
	"storj.io/common/storj"
	"storj.io/common/testcontext"
	"storj.io/common/testrand"
	"storj.io/common/uuid"
	"storj.io/storj/private/blockchain"
	"storj.io/storj/private/post"
	"storj.io/storj/private/testplanet"
	"storj.io/storj/satellite"
	"storj.io/storj/satellite/accounting"
	"storj.io/storj/satellite/buckets"
	"storj.io/storj/satellite/console"
	"storj.io/storj/satellite/console/consoleweb/consoleapi"
	"storj.io/storj/satellite/nodeselection"
	"storj.io/storj/satellite/payments"
	"storj.io/storj/satellite/payments/billing"
	"storj.io/storj/satellite/payments/coinpayments"
	"storj.io/storj/satellite/payments/storjscan"
	"storj.io/storj/satellite/payments/storjscan/blockchaintest"
	"storj.io/storj/satellite/payments/stripe"
)

func TestService(t *testing.T) {
	placements := make(map[int]string)
	for i := 0; i < 4; i++ {
		placements[i] = fmt.Sprintf("loc-%d", i)
	}
	testplanet.Run(t, testplanet.Config{
		SatelliteCount: 1, StorageNodeCount: 1, UplinkCount: 3,
		Reconfigure: testplanet.Reconfigure{
			Satellite: func(log *zap.Logger, index int, config *satellite.Config) {
				config.Payments.StripeCoinPayments.StripeFreeTierCouponID = stripe.MockCouponID1
				var plcStr string
				for k, v := range placements {
					plcStr += fmt.Sprintf(`%d:annotation("location", "%s"); `, k, v)
				}
				config.Placement = nodeselection.ConfigurablePlacementRule{PlacementRules: plcStr}
			},
		},
	},
		func(t *testing.T, ctx *testcontext.Context, planet *testplanet.Planet) {
			sat := planet.Satellites[0]
			service := sat.API.Console.Service

			up1Proj, err := sat.API.DB.Console().Projects().Get(ctx, planet.Uplinks[0].Projects[0].ID)
			require.NoError(t, err)
			up2Proj, err := sat.API.DB.Console().Projects().Get(ctx, planet.Uplinks[1].Projects[0].ID)
			require.NoError(t, err)

			uplink3 := planet.Uplinks[2]
			up3Proj, err := sat.API.DB.Console().Projects().Get(ctx, uplink3.Projects[0].ID)
			require.NoError(t, err)

			require.NotEqual(t, up1Proj.ID, up2Proj.ID)
			require.NotEqual(t, up1Proj.OwnerID, up2Proj.OwnerID)

			userCtx1, err := sat.UserContext(ctx, up1Proj.OwnerID)
			require.NoError(t, err)

			userCtx2, err := sat.UserContext(ctx, up2Proj.OwnerID)
			require.NoError(t, err)

			userCtx3, err := sat.UserContext(ctx, up3Proj.OwnerID)
			require.NoError(t, err)

			getOwnerAndCtx := func(ctx context.Context, proj *console.Project) (user *console.User, userCtx context.Context) {
				user, err := sat.API.DB.Console().Users().Get(ctx, proj.OwnerID)
				require.NoError(t, err)
				userCtx, err = sat.UserContext(ctx, user.ID)
				require.NoError(t, err)
				return
			}

			t.Run("GetProject", func(t *testing.T) {
				// Getting own project details should work
				project, err := service.GetProject(userCtx1, up1Proj.ID)
				require.NoError(t, err)
				require.Equal(t, up1Proj.ID, project.ID)

				// Getting someone else project details should not work
				project, err = service.GetProject(userCtx1, up2Proj.ID)
				require.Error(t, err)
				require.Nil(t, project)
			})

			t.Run("GetUsersProjects", func(t *testing.T) {
				projects, err := service.GetUsersProjects(userCtx3)
				require.NoError(t, err)
				require.Len(t, projects, 1)
				require.Equal(t, up3Proj.ID, projects[0].ID)
				require.Zero(t, projects[0].BandwidthUsed)
				require.Zero(t, projects[0].StorageUsed)

				bucket := "testbucket1"
				require.NoError(t, uplink3.CreateBucket(userCtx3, sat, bucket))

				settledAmount := int64(2000)
				now := time.Now().UTC()
				startOfMonth := time.Date(now.Year(), now.Month(), 1, 0, 0, 0, 0, time.UTC)

				err = sat.DB.Orders().UpdateBucketBandwidthSettle(ctx, up3Proj.ID, []byte(bucket), pb.PieceAction_GET, settledAmount, 0, startOfMonth)
				require.NoError(t, err)

				sat.API.Accounting.ProjectUsage.TestSetAsOfSystemInterval(0)

				data := testrand.Bytes(50 * memory.KiB)

				require.NoError(t, uplink3.Upload(ctx, sat, bucket, "1", data))

				segments, err := sat.Metabase.DB.TestingAllSegments(userCtx3)
				require.NoError(t, err)

				service.TestSetNow(func() time.Time {
					return time.Date(now.Year(), now.Month(), 4, 0, 0, 0, 0, time.UTC)
				})

				projects, err = service.GetUsersProjects(userCtx3)
				require.NoError(t, err)
				require.Equal(t, settledAmount, projects[0].BandwidthUsed)
				require.EqualValues(t, segments[0].EncryptedSize, projects[0].StorageUsed)
			})

			t.Run("GetSalt", func(t *testing.T) {
				// Getting project salt as a member should work
				salt, err := service.GetSalt(userCtx1, up1Proj.ID)
				require.NoError(t, err)
				require.NotNil(t, salt)

				// Getting project salt with publicID should work
				salt1, err := service.GetSalt(userCtx1, up1Proj.PublicID)
				require.NoError(t, err)
				require.NotNil(t, salt1)

				// project.PublicID salt should be the same as project.ID salt
				require.Equal(t, salt, salt1)

				// Getting project salt as a non-member should not work
				salt, err = service.GetSalt(userCtx1, up2Proj.ID)
				require.Error(t, err)
				require.Nil(t, salt)
			})

			t.Run("AddCreditCard fails when payments.CreditCards.Add returns error", func(t *testing.T) {
				// user should be in free tier
				user, userCtx1 := getOwnerAndCtx(ctx, up1Proj)
				require.False(t, user.PaidTier)

				// stripecoinpayments.TestPaymentMethodsAttachFailure triggers the underlying mock stripe client to return an error
				// when attaching a payment method to a customer.
				_, err = service.Payments().AddCreditCard(userCtx1, stripe.TestPaymentMethodsAttachFailure)
				require.Error(t, err)

				// user still in free tier
				user, err = service.GetUser(ctx, up1Proj.OwnerID)
				require.NoError(t, err)
				require.False(t, user.PaidTier)

				cards, err := service.Payments().ListCreditCards(userCtx1)
				require.NoError(t, err)
				require.Len(t, cards, 0)
			})

			t.Run("AddCreditCard", func(t *testing.T) {
				// user should be in free tier
				user, userCtx1 := getOwnerAndCtx(ctx, up1Proj)
				require.False(t, user.PaidTier)

				// add a credit card to put the user in the paid tier
				card, err := service.Payments().AddCreditCard(userCtx1, "test-cc-token")
				require.NoError(t, err)
				require.NotEmpty(t, card)
				// user should be in paid tier
				user, err = service.GetUser(ctx, up1Proj.OwnerID)
				require.NoError(t, err)
				require.True(t, user.PaidTier)

				cards, err := service.Payments().ListCreditCards(userCtx1)
				require.NoError(t, err)
				require.Len(t, cards, 1)
			})

			t.Run("CreateProject", func(t *testing.T) {
				// Creating a project with a previously used name should fail
				createdProject, err := service.CreateProject(userCtx1, console.UpsertProjectInfo{
					Name: up1Proj.Name,
				})
				require.Error(t, err)
				require.Nil(t, createdProject)
			})

			t.Run("CreateProject when bot account", func(t *testing.T) {
				user, err := sat.AddUser(ctx, console.CreateUser{
					FullName: "Bot User",
					Email:    "mfauser@mail.test",
				}, 1)
				require.NoError(t, err)

				botStatus := console.PendingBotVerification
				err = sat.API.DB.Console().Users().Update(ctx, user.ID, console.UpdateUserRequest{
					Status: &botStatus,
				})
				require.NoError(t, err)

				userCtx, err := sat.UserContext(ctx, user.ID)
				require.NoError(t, err)

				// Creating a project by bot account must fail.
				createdProject, err := service.CreateProject(userCtx, console.UpsertProjectInfo{
					Name: "test name",
				})
				require.Error(t, err)
				require.True(t, console.ErrBotUser.Has(err))
				require.Nil(t, createdProject)
			})

			t.Run("CreateProject with placement", func(t *testing.T) {
				uid := planet.Uplinks[2].Projects[0].Owner.ID
				err := sat.API.DB.Console().Users().Update(ctx, uid, console.UpdateUserRequest{
					DefaultPlacement: storj.EU,
				})
				require.NoError(t, err)

				user, err := service.GetUser(ctx, uid)
				require.NoError(t, err)

				userCtx, err := sat.UserContext(ctx, user.ID)
				require.NoError(t, err)

				p, err := service.CreateProject(userCtx, console.UpsertProjectInfo{
					Name:        "eu-project",
					Description: "project with eu1 default placement",
					CreatedAt:   time.Now(),
				})
				require.NoError(t, err)
				require.Equal(t, storj.EU, p.DefaultPlacement)
			})

			t.Run("UpdateProject", func(t *testing.T) {
				updatedName := "newName"
				updatedDescription := "newDescription"
				updatedStorageLimit := memory.Size(100)
				updatedBandwidthLimit := memory.Size(100)

				_, userCtx1 := getOwnerAndCtx(ctx, up1Proj)

				// Updating own project should work
				updatedProject, err := service.UpdateProject(userCtx1, up1Proj.ID, console.UpsertProjectInfo{
					Name:           updatedName,
					Description:    updatedDescription,
					StorageLimit:   updatedStorageLimit,
					BandwidthLimit: updatedBandwidthLimit,
				})
				require.NoError(t, err)
				require.NotEqual(t, up1Proj.Name, updatedProject.Name)
				require.Equal(t, updatedName, updatedProject.Name)
				require.NotEqual(t, up1Proj.Description, updatedProject.Description)
				require.Equal(t, updatedDescription, updatedProject.Description)
				require.NotEqual(t, *up1Proj.StorageLimit, *updatedProject.StorageLimit)
				require.Equal(t, updatedStorageLimit, *updatedProject.StorageLimit)
				require.NotEqual(t, *up1Proj.BandwidthLimit, *updatedProject.BandwidthLimit)
				require.Equal(t, updatedBandwidthLimit, *updatedProject.BandwidthLimit)
				require.Equal(t, updatedStorageLimit, *updatedProject.UserSpecifiedStorageLimit)
				require.Equal(t, updatedBandwidthLimit, *updatedProject.UserSpecifiedBandwidthLimit)

				// Updating someone else project details should not work
				updatedProject, err = service.UpdateProject(userCtx1, up2Proj.ID, console.UpsertProjectInfo{
					Name:           "newName",
					Description:    "TestUpdate",
					StorageLimit:   memory.Size(100),
					BandwidthLimit: memory.Size(100),
				})
				require.Error(t, err)
				require.Nil(t, updatedProject)

				// attempting to update a project with bandwidth or storage limits set to 0 should fail
				size0 := new(memory.Size)
				*size0 = 0
				size100 := new(memory.Size)
				*size100 = memory.Size(100)

				up1Proj.StorageLimit = size0
				err = sat.DB.Console().Projects().Update(ctx, up1Proj)
				require.NoError(t, err)

				updateInfo := console.UpsertProjectInfo{
					Name:           "a b c",
					Description:    "1 2 3",
					StorageLimit:   memory.Size(123),
					BandwidthLimit: memory.Size(123),
				}
				updatedProject, err = service.UpdateProject(userCtx1, up1Proj.ID, updateInfo)
				require.Error(t, err)
				require.Nil(t, updatedProject)

				up1Proj.StorageLimit = size100
				up1Proj.BandwidthLimit = size0

				err = sat.DB.Console().Projects().Update(ctx, up1Proj)
				require.NoError(t, err)

				updatedProject, err = service.UpdateProject(userCtx1, up1Proj.ID, updateInfo)
				require.Error(t, err)
				require.Nil(t, updatedProject)

				up1Proj.StorageLimit = size100
				up1Proj.BandwidthLimit = size100
				err = sat.DB.Console().Projects().Update(ctx, up1Proj)
				require.NoError(t, err)

				// should not be able to set limit to zero.
				updatedProject, err = service.UpdateProject(userCtx1, up1Proj.ID, console.UpsertProjectInfo{
					Name:           up1Proj.Name,
					StorageLimit:   memory.Size(0),
					BandwidthLimit: memory.Size(0),
				})
				require.True(t, console.ErrInvalidProjectLimit.Has(err))
				require.Nil(t, updatedProject)

				// should not be able to set limit more than tier limit.
				updatedProject, err = service.UpdateProject(userCtx1, up1Proj.ID, console.UpsertProjectInfo{
					Name:           up1Proj.Name,
					StorageLimit:   sat.Config.Console.UsageLimits.Storage.Paid + memory.MB,
					BandwidthLimit: sat.Config.Console.UsageLimits.Bandwidth.Paid + memory.MB,
				})
				require.True(t, console.ErrInvalidProjectLimit.Has(err))
				require.Nil(t, updatedProject)

				updatedProject, err = service.UpdateProject(userCtx1, up1Proj.ID, updateInfo)
				require.NoError(t, err)
				require.Equal(t, updateInfo.Name, updatedProject.Name)
				require.Equal(t, updateInfo.Description, updatedProject.Description)
				require.NotNil(t, updatedProject.StorageLimit)
				require.NotNil(t, updatedProject.BandwidthLimit)
				require.Equal(t, updateInfo.StorageLimit, *updatedProject.StorageLimit)
				require.Equal(t, updateInfo.BandwidthLimit, *updatedProject.BandwidthLimit)

				project, err := service.GetProject(userCtx1, up1Proj.ID)
				require.NoError(t, err)
				require.Equal(t, updateInfo.StorageLimit, *project.StorageLimit)
				require.Equal(t, updateInfo.BandwidthLimit, *project.BandwidthLimit)

				// attempting to update a project with a previously used name should fail
				updatedProject, err = service.UpdateProject(userCtx1, up2Proj.ID, console.UpsertProjectInfo{
					Name: up1Proj.Name,
				})
				require.Error(t, err)
				require.Nil(t, updatedProject)

				user2, userCtx2 := getOwnerAndCtx(ctx, up2Proj)
				_, err = service.AddProjectMembers(userCtx1, up1Proj.ID, []string{user2.Email})
				require.NoError(t, err)
				// Members should not be able to update project.
				_, err = service.UpdateProject(userCtx2, up1Proj.ID, console.UpsertProjectInfo{
					Name: updatedName,
				})
				require.Error(t, err)
				require.True(t, console.ErrUnauthorized.Has(err))
				// remove user2.
				err = service.DeleteProjectMembersAndInvitations(userCtx1, up1Proj.ID, []string{user2.Email})
				require.NoError(t, err)
			})

			t.Run("AddProjectMembers", func(t *testing.T) {
				up2User, _ := getOwnerAndCtx(ctx, up2Proj)

				// Adding members to own project should work
				addedUsers, err := service.AddProjectMembers(userCtx1, up1Proj.ID, []string{up2User.Email})
				require.NoError(t, err)
				require.Len(t, addedUsers, 1)
				require.Contains(t, addedUsers, up2User)

				// Adding members to someone else project should not work
				addedUsers, err = service.AddProjectMembers(userCtx1, up2Proj.ID, []string{up2User.Email})
				require.Error(t, err)
				require.Nil(t, addedUsers)
			})

			t.Run("GetProjectMembersAndInvitations", func(t *testing.T) {
				// Getting the project members of an own project that one is a part of should work
				userPage, err := service.GetProjectMembersAndInvitations(
					userCtx1,
					up1Proj.ID,
					console.ProjectMembersCursor{Page: 1, Limit: 10},
				)
				require.NoError(t, err)
				require.Len(t, userPage.ProjectMembers, 2)

				// Getting the project members of a foreign project that one is a part of should work
				userPage, err = service.GetProjectMembersAndInvitations(
					userCtx2,
					up1Proj.ID,
					console.ProjectMembersCursor{Page: 1, Limit: 10},
				)
				require.NoError(t, err)
				require.Len(t, userPage.ProjectMembers, 2)

				// Getting the project members of a foreign project that one is not a part of should not work
				userPage, err = service.GetProjectMembersAndInvitations(
					userCtx1,
					up2Proj.ID,
					console.ProjectMembersCursor{Page: 1, Limit: 10},
				)
				require.Error(t, err)
				require.Nil(t, userPage)
			})

			t.Run("DeleteProjectMembersAndInvitations", func(t *testing.T) {
				user1, user1Ctx := getOwnerAndCtx(ctx, up1Proj)
				_, user2Ctx := getOwnerAndCtx(ctx, up2Proj)

				invitedUser, err := sat.AddUser(ctx, console.CreateUser{
					FullName: "Test User",
					Email:    "test@mail.test",
				}, 1)
				require.NoError(t, err)

				for _, id := range []uuid.UUID{up1Proj.ID, up2Proj.ID} {
					_, err = sat.DB.Console().ProjectInvitations().Upsert(ctx, &console.ProjectInvitation{
						ProjectID: id,
						Email:     invitedUser.Email,
					})
					require.NoError(t, err)
				}

				// You should not be able to remove someone from a project that you aren't a member of.
				err = service.DeleteProjectMembersAndInvitations(user1Ctx, up2Proj.ID, []string{invitedUser.Email})
				require.Error(t, err)

				// Project owners should not be able to be removed.
				err = service.DeleteProjectMembersAndInvitations(user2Ctx, up1Proj.ID, []string{user1.Email})
				require.Error(t, err)

				// An invalid email should cause the operation to fail.
				err = service.DeleteProjectMembersAndInvitations(
					user2Ctx,
					up2Proj.ID,
					[]string{invitedUser.Email, "nobody@mail.test"},
				)
				require.Error(t, err)
				_, err = sat.DB.Console().ProjectInvitations().Get(ctx, up2Proj.ID, invitedUser.Email)
				require.NoError(t, err)

				// Members and invitations should be removed.
				err = service.DeleteProjectMembersAndInvitations(user2Ctx, up2Proj.ID, []string{invitedUser.Email, user1.Email})
				require.NoError(t, err)

				_, err = sat.DB.Console().ProjectInvitations().Get(ctx, up2Proj.ID, invitedUser.Email)
				require.ErrorIs(t, err, sql.ErrNoRows)

				memberships, err := sat.DB.Console().ProjectMembers().GetByMemberID(ctx, user1.ID)
				require.NoError(t, err)
				require.Len(t, memberships, 1)
				require.NotEqual(t, up2Proj.ID, memberships[0].ProjectID)
			})

			t.Run("DeleteProject", func(t *testing.T) {
				// Deleting the own project should not work before deleting the API-Key
				err := service.DeleteProject(userCtx1, up1Proj.ID)
				require.Error(t, err)

				keys, err := service.GetAPIKeys(userCtx1, up1Proj.ID, console.APIKeyCursor{Page: 1, Limit: 10})
				require.NoError(t, err)
				require.Len(t, keys.APIKeys, 1)

				err = service.DeleteAPIKeys(userCtx1, []uuid.UUID{keys.APIKeys[0].ID})
				require.NoError(t, err)

				// Deleting the own project should now work
				err = service.DeleteProject(userCtx1, up1Proj.ID)
				require.NoError(t, err)

				// Deleting someone else project should not work
				err = service.DeleteProject(userCtx1, up2Proj.ID)
				require.Error(t, err)

				err = planet.Uplinks[1].CreateBucket(ctx, sat, "testbucket")
				require.NoError(t, err)

				// deleting a project with a bucket should fail
				err = service.DeleteProject(userCtx2, up2Proj.ID)
				require.Error(t, err)
				require.Equal(t, "console service: project usage: some buckets still exist", err.Error())
			})

			t.Run("GetProjectUsageLimits", func(t *testing.T) {
				bandwidthLimit := sat.Config.Console.UsageLimits.Bandwidth.Free
				storageLimit := sat.Config.Console.UsageLimits.Storage.Free
				bucketsLimit := int64(sat.Config.Metainfo.ProjectLimits.MaxBuckets)

				limits1, err := service.GetProjectUsageLimits(userCtx2, up2Proj.ID)
				require.NoError(t, err)
				require.NotNil(t, limits1)

				// Get usage limits with publicID
				limits2, err := service.GetProjectUsageLimits(userCtx2, up2Proj.PublicID)
				require.NoError(t, err)
				require.NotNil(t, limits2)

				// limits gotten by ID and publicID should be the same
				require.Equal(t, storageLimit.Int64(), limits1.StorageLimit)
				require.Equal(t, bandwidthLimit.Int64(), limits1.BandwidthLimit)
				require.Equal(t, int64(1), limits1.BucketsUsed)
				require.Equal(t, bucketsLimit, limits1.BucketsLimit)
				require.Equal(t, storageLimit.Int64(), limits2.StorageLimit)
				require.Equal(t, bandwidthLimit.Int64(), limits2.BandwidthLimit)
				require.Equal(t, int64(1), limits2.BucketsUsed)
				require.Equal(t, bucketsLimit, limits2.BucketsLimit)

				// update project's limits
				updatedStorageLimit := memory.Size(100) + memory.TB
				updatedBandwidthLimit := memory.Size(100) + memory.TB
				up2Proj.StorageLimit = new(memory.Size)
				*up2Proj.StorageLimit = updatedStorageLimit
				up2Proj.BandwidthLimit = new(memory.Size)
				*up2Proj.BandwidthLimit = updatedBandwidthLimit
				err = sat.DB.Console().Projects().Update(ctx, up2Proj)
				require.NoError(t, err)

				updatedBucketsLimit := 20
				err = sat.DB.Console().Projects().UpdateBucketLimit(ctx, up2Proj.ID, &updatedBucketsLimit)
				require.NoError(t, err)

				limits1, err = service.GetProjectUsageLimits(userCtx2, up2Proj.ID)
				require.NoError(t, err)
				require.NotNil(t, limits1)

				// Get usage limits with publicID
				limits2, err = service.GetProjectUsageLimits(userCtx2, up2Proj.PublicID)
				require.NoError(t, err)
				require.NotNil(t, limits2)

				// limits gotten by ID and publicID should be the same
				require.Equal(t, updatedStorageLimit.Int64(), limits1.StorageLimit)
				require.Equal(t, updatedBandwidthLimit.Int64(), limits1.BandwidthLimit)
				require.Equal(t, int64(updatedBucketsLimit), limits1.BucketsLimit)
				require.Equal(t, updatedStorageLimit.Int64(), limits2.StorageLimit)
				require.Equal(t, updatedBandwidthLimit.Int64(), limits2.BandwidthLimit)
				require.Equal(t, int64(updatedBucketsLimit), limits2.BucketsLimit)

				bucket := "testbucket1"
				err = planet.Uplinks[1].CreateBucket(ctx, sat, bucket)
				require.NoError(t, err)

				now := time.Now().UTC()
				allocatedAmount := int64(1000)
				settledAmount := int64(2000)
				startOfMonth := time.Date(now.Year(), now.Month(), 1, 0, 0, 0, 0, time.UTC)
				thirdDayOfMonth := time.Date(now.Year(), now.Month(), 3, 0, 0, 0, 0, time.UTC)

				// set now as third day of the month.
				service.TestSetNow(func() time.Time {
					return thirdDayOfMonth
				})

				// add allocated and settled bandwidth for the beginning of the month.
				err = sat.DB.Orders().
					UpdateBucketBandwidthAllocation(ctx, up2Proj.ID, []byte(bucket), pb.PieceAction_GET, allocatedAmount, startOfMonth)
				require.NoError(t, err)
				err = sat.DB.Orders().
					UpdateBucketBandwidthSettle(ctx, up2Proj.ID, []byte(bucket), pb.PieceAction_GET, settledAmount, 0, startOfMonth)
				require.NoError(t, err)

				sat.API.Accounting.ProjectUsage.TestSetAsOfSystemInterval(0)

				// at this point only allocated traffic is expected.
				limits2, err = service.GetProjectUsageLimits(userCtx2, up2Proj.PublicID)
				require.NoError(t, err)
				require.NotNil(t, limits2)
				require.Equal(t, int64(2), limits2.BucketsUsed)
				require.Equal(t, allocatedAmount, limits2.BandwidthUsed)

				// set now as fourth day of the month.
				service.TestSetNow(func() time.Time {
					return time.Date(now.Year(), now.Month(), 4, 0, 0, 0, 0, time.UTC)
				})

				// at this point only settled traffic for the first day is expected.
				limits2, err = service.GetProjectUsageLimits(userCtx2, up2Proj.PublicID)
				require.NoError(t, err)
				require.NotNil(t, limits2)
				require.Equal(t, settledAmount, limits2.BandwidthUsed)

				// add settled traffic for the third day of the month.
				err = sat.DB.Orders().
					UpdateBucketBandwidthSettle(ctx, up2Proj.ID, []byte(bucket), pb.PieceAction_GET, settledAmount, 0, thirdDayOfMonth)
				require.NoError(t, err)

				// at this point only settled traffic for the first day is expected because now is still set to fourth day.
				limits2, err = service.GetProjectUsageLimits(userCtx2, up2Proj.PublicID)
				require.NoError(t, err)
				require.NotNil(t, limits2)
				require.Equal(t, settledAmount, limits2.BandwidthUsed)

				// set now as sixth day of the month.
				service.TestSetNow(func() time.Time {
					return time.Date(now.Year(), now.Month(), 6, 0, 0, 0, 0, time.UTC)
				})

				// at this point only settled traffic for the first and third days is expected.
				limits2, err = service.GetProjectUsageLimits(userCtx2, up2Proj.PublicID)
				require.NoError(t, err)
				require.NotNil(t, limits2)
				require.Equal(t, settledAmount+settledAmount, limits2.BandwidthUsed)
			})

			t.Run("GetAllBucketNames", func(t *testing.T) {
				bucket1 := buckets.Bucket{
					ID:        testrand.UUID(),
					Name:      "testBucket1",
					ProjectID: up2Proj.ID,
				}

				bucket2 := buckets.Bucket{
					ID:        testrand.UUID(),
					Name:      "testBucket2",
					ProjectID: up2Proj.ID,
				}

				_, err := sat.API.Buckets.Service.CreateBucket(userCtx2, bucket1)
				require.NoError(t, err)

				_, err = sat.API.Buckets.Service.CreateBucket(userCtx2, bucket2)
				require.NoError(t, err)

				bucketNames, err := service.GetAllBucketNames(userCtx2, up2Proj.ID)
				require.NoError(t, err)
				require.Equal(t, bucket1.Name, bucketNames[0])
				require.Equal(t, bucket2.Name, bucketNames[1])

				bucketNames, err = service.GetAllBucketNames(userCtx2, up2Proj.PublicID)
				require.NoError(t, err)
				require.Equal(t, bucket1.Name, bucketNames[0])
				require.Equal(t, bucket2.Name, bucketNames[1])

				// Getting someone else buckets should not work
				bucketsForUnauthorizedUser, err := service.GetAllBucketNames(userCtx1, up2Proj.ID)
				require.Error(t, err)
				require.Nil(t, bucketsForUnauthorizedUser)
			})

			t.Run("GetBucketTotals", func(t *testing.T) {
				list, err := sat.DB.Buckets().ListBuckets(ctx, up2Proj.ID, buckets.ListOptions{Direction: buckets.DirectionForward}, macaroon.AllowedBuckets{All: true})
				require.NoError(t, err)
				for i, item := range list.Items {
					item.Placement = storj.PlacementConstraint(i)
					if i > len(placements)-1 {
						item.Placement = storj.PlacementConstraint(len(placements) - 1)
					}
					b, err := sat.DB.Buckets().UpdateBucket(ctx, item)
					require.NoError(t, err)
					require.Equal(t, i, int(b.Placement))
				}
				bt, err := service.GetBucketTotals(userCtx2, up2Proj.ID, accounting.BucketUsageCursor{Limit: 100, Page: 1}, time.Now())
				require.NoError(t, err)
				for _, b := range bt.BucketUsages {
					require.Equal(t, placements[int(b.DefaultPlacement)], b.Location)
				}
			})

			t.Run("GetBucketPlacements", func(t *testing.T) {
				list, err := sat.DB.Buckets().ListBuckets(ctx, up2Proj.ID, buckets.ListOptions{Direction: buckets.DirectionForward}, macaroon.AllowedBuckets{All: true})
				require.NoError(t, err)
				bp, err := service.GetBucketPlacements(userCtx2, up2Proj.ID)
				require.NoError(t, err)
				for _, b := range bp {
					var found bool
					for _, item := range list.Items {
						if item.Name == b.Name {
							found = true
							require.Equal(t, item.Placement, b.Placement.DefaultPlacement)
							require.Equal(t, placements[int(item.Placement)], b.Placement.Location)
							break
						}
					}
					if found {
						continue
					}
					require.Fail(t, "bucket name not in list", b.Name)
				}
			})

			t.Run("DeleteAPIKeyByNameAndProjectID", func(t *testing.T) {
				secret, err := macaroon.NewSecret()
				require.NoError(t, err)

				key, err := macaroon.NewAPIKey(secret)
				require.NoError(t, err)

				apikey := console.APIKeyInfo{
					Name:      "test",
					ProjectID: up2Proj.ID,
					Secret:    secret,
				}

				createdKey, err := sat.DB.Console().APIKeys().Create(ctx, key.Head(), apikey)
				require.NoError(t, err)

				info, err := sat.DB.Console().APIKeys().Get(ctx, createdKey.ID)
				require.NoError(t, err)
				require.NotNil(t, info)

				// Deleting someone else api keys should not work
				err = service.DeleteAPIKeyByNameAndProjectID(userCtx1, apikey.Name, up2Proj.ID)
				require.Error(t, err)

				err = service.DeleteAPIKeyByNameAndProjectID(userCtx2, apikey.Name, up2Proj.ID)
				require.NoError(t, err)

				info, err = sat.DB.Console().APIKeys().Get(ctx, createdKey.ID)
				require.Error(t, err)
				require.Nil(t, info)

				// test deleting by project.publicID
				createdKey, err = sat.DB.Console().APIKeys().Create(ctx, key.Head(), apikey)
				require.NoError(t, err)

				info, err = sat.DB.Console().APIKeys().Get(ctx, createdKey.ID)
				require.NoError(t, err)
				require.NotNil(t, info)

				// deleting by project.publicID
				err = service.DeleteAPIKeyByNameAndProjectID(userCtx2, apikey.Name, up2Proj.PublicID)
				require.NoError(t, err)

				info, err = sat.DB.Console().APIKeys().Get(ctx, createdKey.ID)
				require.Error(t, err)
				require.Nil(t, info)
			})
			t.Run("ApplyFreeTierCoupon", func(t *testing.T) {
				// testplanet applies the free tier coupon first, so we need to change it in order
				// to verify that ApplyFreeTierCoupon really works.
				freeTier := sat.Config.Payments.StripeCoinPayments.StripeFreeTierCouponID
				coupon3, err := service.Payments().ApplyCoupon(userCtx1, stripe.MockCouponID3)
				require.NoError(t, err)
				require.NotNil(t, coupon3)
				require.NotEqual(t, freeTier, coupon3.ID)

				coupon, err := service.Payments().ApplyFreeTierCoupon(userCtx1)
				require.NoError(t, err)
				require.NotNil(t, coupon)
				require.Equal(t, freeTier, coupon.ID)

				coupon, err = sat.API.Payments.Accounts.Coupons().GetByUserID(ctx, up1Proj.OwnerID)
				require.NoError(t, err)
				require.Equal(t, freeTier, coupon.ID)
			})
			t.Run("ApplyFreeTierCoupon fails with unknown user", func(t *testing.T) {
				coupon, err := service.Payments().ApplyFreeTierCoupon(ctx)
				require.Error(t, err)
				require.Nil(t, coupon)
			})
			t.Run("ApplyCoupon", func(t *testing.T) {
				id := stripe.MockCouponID2
				coupon, err := service.Payments().ApplyCoupon(userCtx2, id)
				require.NoError(t, err)
				require.NotNil(t, coupon)
				require.Equal(t, id, coupon.ID)

				coupon, err = sat.API.Payments.Accounts.Coupons().GetByUserID(ctx, up2Proj.OwnerID)
				require.NoError(t, err)
				require.Equal(t, id, coupon.ID)
			})
			t.Run("ApplyCoupon fails with unknown user", func(t *testing.T) {
				id := stripe.MockCouponID2
				coupon, err := service.Payments().ApplyCoupon(ctx, id)
				require.Error(t, err)
				require.Nil(t, coupon)
			})
			t.Run("ApplyCoupon fails with unknown coupon ID", func(t *testing.T) {
				coupon, err := service.Payments().ApplyCoupon(userCtx2, "unknown_coupon_id")
				require.Error(t, err)
				require.Nil(t, coupon)
			})
			t.Run("UpdatePackage", func(t *testing.T) {
				packagePlan := "package-plan-1"
				purchaseTime := time.Now()

				check := func() {
					dbPackagePlan, dbPurchaseTime, err := sat.DB.StripeCoinPayments().
						Customers().
						GetPackageInfo(ctx, up1Proj.OwnerID)
					require.NoError(t, err)
					require.NotNil(t, dbPackagePlan)
					require.NotNil(t, dbPurchaseTime)
					require.Equal(t, packagePlan, *dbPackagePlan)
					require.Equal(t, dbPurchaseTime.Truncate(time.Millisecond), dbPurchaseTime.Truncate(time.Millisecond))
				}

				require.NoError(t, service.Payments().UpdatePackage(userCtx1, packagePlan, purchaseTime))
				check()

				// Check values can't be overwritten
				err = service.Payments().UpdatePackage(userCtx1, "different-package-plan", time.Now())
				require.Error(t, err)
				require.True(t, console.ErrAlreadyHasPackage.Has(err))

				check()
			})
			t.Run("ApplyCredit fails when payments.Balances.ApplyCredit returns an error", func(t *testing.T) {
				require.Error(t, service.Payments().ApplyCredit(userCtx1, 1000, stripe.MockCBTXsNewFailure))
				btxs, err := sat.API.Payments.Accounts.Balances().ListTransactions(ctx, up1Proj.OwnerID)
				require.NoError(t, err)
				require.Zero(t, len(btxs))
			})
			t.Run("ApplyCredit", func(t *testing.T) {
				amount := int64(1000)
				desc := "test"
				require.NoError(t, service.Payments().ApplyCredit(userCtx1, 1000, desc))
				btxs, err := sat.API.Payments.Accounts.Balances().ListTransactions(ctx, up1Proj.OwnerID)
				require.NoError(t, err)
				require.Len(t, btxs, 1)
				require.Equal(t, amount, btxs[0].Amount)
				require.Equal(t, desc, btxs[0].Description)

				// test same description results in no new credit
				require.NoError(t, service.Payments().ApplyCredit(userCtx1, 1000, desc))
				btxs, err = sat.API.Payments.Accounts.Balances().ListTransactions(ctx, up1Proj.OwnerID)
				require.NoError(t, err)
				require.Len(t, btxs, 1)

				// test different description results in new credit
				require.NoError(t, service.Payments().ApplyCredit(userCtx1, 1000, "new desc"))
				btxs, err = sat.API.Payments.Accounts.Balances().ListTransactions(ctx, up1Proj.OwnerID)
				require.NoError(t, err)
				require.Len(t, btxs, 2)
			})
			t.Run("ApplyCredit fails with unknown user", func(t *testing.T) {
				require.Error(t, service.Payments().ApplyCredit(ctx, 1000, "test"))
			})
			t.Run("GetEmissionImpact", func(t *testing.T) {
				pr, err := sat.AddProject(userCtx1, up1Proj.OwnerID, "emission test")
				require.NoError(t, err)
				require.NotNil(t, pr)

				// Getting project emission impact as a member should work
				impact, err := service.GetEmissionImpact(userCtx1, pr.ID)
				require.NoError(t, err)
				require.NotNil(t, impact)
				require.EqualValues(t, console.EmissionImpactResponse{}, *impact)

				// Getting project salt as a non-member should not work
				impact, err = service.GetEmissionImpact(userCtx2, pr.ID)
				require.Error(t, err)
				require.Nil(t, impact)

				err = sat.API.Accounting.ProjectUsage.AddProjectStorageUsage(userCtx1, pr.ID, (2 * memory.TB).Int64())
				require.NoError(t, err)

				now := time.Now().UTC()
				service.TestSetNow(func() time.Time {
					return now.Add(365.25 * 24 * time.Hour)
				})

				zeroValue := float64(0)

				impact, err = service.GetEmissionImpact(userCtx1, pr.ID)
				require.NoError(t, err)
				require.NotNil(t, impact)
				require.Greater(t, impact.StorjImpact, zeroValue)
				require.Greater(t, impact.HyperscalerImpact, zeroValue)
				require.Greater(t, impact.SavedTrees, int64(0))
			})
		})
}

func TestPaidTier(t *testing.T) {
	usageConfig := console.UsageLimitsConfig{
		Storage: console.StorageLimitConfig{
			Free: memory.GB,
			Paid: memory.TB,
		},
		Bandwidth: console.BandwidthLimitConfig{
			Free: 2 * memory.GB,
			Paid: 2 * memory.TB,
		},
		Segment: console.SegmentLimitConfig{
			Free: 10,
			Paid: 50,
		},
		Project: console.ProjectLimitConfig{
			Free: 1,
			Paid: 3,
		},
	}

	testplanet.Run(t, testplanet.Config{
		SatelliteCount: 1, StorageNodeCount: 0, UplinkCount: 1,
		Reconfigure: testplanet.Reconfigure{
			Satellite: func(log *zap.Logger, index int, config *satellite.Config) {
				config.Console.UsageLimits = usageConfig
			},
		},
	}, func(t *testing.T, ctx *testcontext.Context, planet *testplanet.Planet) {
		sat := planet.Satellites[0]
		service := sat.API.Console.Service

		// project should have free tier usage limits
		proj1, err := sat.API.DB.Console().Projects().Get(ctx, planet.Uplinks[0].Projects[0].ID)
		require.NoError(t, err)
		require.Equal(t, usageConfig.Storage.Free, *proj1.StorageLimit)
		require.Equal(t, usageConfig.Bandwidth.Free, *proj1.BandwidthLimit)
		require.Equal(t, usageConfig.Segment.Free, *proj1.SegmentLimit)

		// user should be in free tier
		user, err := service.GetUser(ctx, proj1.OwnerID)
		require.NoError(t, err)
		require.False(t, user.PaidTier)

		userCtx, err := sat.UserContext(ctx, user.ID)
		require.NoError(t, err)

		// add a credit card to the user
		_, err = service.Payments().AddCreditCard(userCtx, "test-cc-token")
		require.NoError(t, err)

		// expect user to be in paid tier
		user, err = service.GetUser(ctx, user.ID)
		require.NoError(t, err)
		require.True(t, user.PaidTier)
		require.Equal(t, usageConfig.Project.Paid, user.ProjectLimit)

		// update auth ctx
		userCtx, err = sat.UserContext(ctx, user.ID)
		require.NoError(t, err)

		// expect project to be migrated to paid tier usage limits
		proj1, err = service.GetProject(userCtx, proj1.ID)
		require.NoError(t, err)
		require.Equal(t, usageConfig.Storage.Paid, *proj1.StorageLimit)
		require.Equal(t, usageConfig.Bandwidth.Paid, *proj1.BandwidthLimit)
		require.Equal(t, usageConfig.Segment.Paid, *proj1.SegmentLimit)

		// expect new project to be created with paid tier usage limits
		proj2, err := service.CreateProject(userCtx, console.UpsertProjectInfo{Name: "Project 2"})
		require.NoError(t, err)
		require.Equal(t, usageConfig.Storage.Paid, *proj2.StorageLimit)
	})
}

// TestUpdateProjectExceedsLimits ensures that a project with limits manually set above the defaults can be updated.
func TestUpdateProjectExceedsLimits(t *testing.T) {
	usageConfig := console.UsageLimitsConfig{
		Storage: console.StorageLimitConfig{
			Free: memory.GB,
			Paid: memory.TB,
		},
		Bandwidth: console.BandwidthLimitConfig{
			Free: 2 * memory.GB,
			Paid: 2 * memory.TB,
		},
		Segment: console.SegmentLimitConfig{
			Free: 10,
			Paid: 50,
		},
		Project: console.ProjectLimitConfig{
			Free: 1,
			Paid: 3,
		},
	}

	testplanet.Run(t, testplanet.Config{
		SatelliteCount: 1, StorageNodeCount: 0, UplinkCount: 1,
		Reconfigure: testplanet.Reconfigure{
			Satellite: func(log *zap.Logger, index int, config *satellite.Config) {
				config.Console.UsageLimits = usageConfig
			},
		},
	}, func(t *testing.T, ctx *testcontext.Context, planet *testplanet.Planet) {
		sat := planet.Satellites[0]
		service := sat.API.Console.Service
		projectID := planet.Uplinks[0].Projects[0].ID

		updatedName := "newName"
		updatedDescription := "newDescription"
		updatedStorageLimit := memory.Size(100) + memory.TB
		updatedBandwidthLimit := memory.Size(100) + memory.TB

		proj, err := sat.API.DB.Console().Projects().Get(ctx, projectID)
		require.NoError(t, err)

		userCtx1, err := sat.UserContext(ctx, proj.OwnerID)
		require.NoError(t, err)

		// project should have free tier usage limits
		require.Equal(t, usageConfig.Storage.Free, *proj.StorageLimit)
		require.Equal(t, usageConfig.Bandwidth.Free, *proj.BandwidthLimit)
		require.Equal(t, usageConfig.Segment.Free, *proj.SegmentLimit)

		// update project name should succeed
		_, err = service.UpdateProject(userCtx1, projectID, console.UpsertProjectInfo{
			Name:        updatedName,
			Description: updatedDescription,
		})
		require.NoError(t, err)

		// manually set project limits above defaults
		proj1, err := sat.API.DB.Console().Projects().Get(ctx, projectID)
		require.NoError(t, err)
		proj1.StorageLimit = new(memory.Size)
		*proj1.StorageLimit = updatedStorageLimit
		proj1.BandwidthLimit = new(memory.Size)
		*proj1.BandwidthLimit = updatedBandwidthLimit
		err = sat.DB.Console().Projects().Update(ctx, proj1)
		require.NoError(t, err)

		// try to update project name should succeed
		_, err = service.UpdateProject(userCtx1, projectID, console.UpsertProjectInfo{
			Name:        "updatedName",
			Description: "updatedDescription",
		})
		require.NoError(t, err)
	})
}

func TestMFA(t *testing.T) {
	testplanet.Run(t, testplanet.Config{
		SatelliteCount: 1, StorageNodeCount: 0, UplinkCount: 0,
	}, func(t *testing.T, ctx *testcontext.Context, planet *testplanet.Planet) {
		sat := planet.Satellites[0]
		service := sat.API.Console.Service

		user, err := sat.AddUser(ctx, console.CreateUser{
			FullName: "MFA Test User",
			Email:    "mfauser@mail.test",
		}, 1)
		require.NoError(t, err)

		updateContext := func() (context.Context, *console.User) {
			userCtx, err := sat.UserContext(ctx, user.ID)
			require.NoError(t, err)
			user, err := console.GetUser(userCtx)
			require.NoError(t, err)
			return userCtx, user
		}
		userCtx, user := updateContext()

		mfaTime := time.Now()
		var key string
		t.Run("ResetMFASecretKey", func(t *testing.T) {
			key, err = service.ResetMFASecretKey(userCtx)
			require.NoError(t, err)

			_, user := updateContext()
			require.NotEmpty(t, user.MFASecretKey)
		})

		t.Run("EnableUserMFABadPasscode", func(t *testing.T) {
			// Expect MFA-enabling attempt to be rejected when providing stale passcode.
			badCode, err := console.NewMFAPasscode(key, mfaTime.Add(time.Hour))
			require.NoError(t, err)

			err = service.EnableUserMFA(userCtx, badCode, mfaTime)
			require.True(t, console.ErrValidation.Has(err))

			userCtx, _ = updateContext()
			_, err = service.ResetMFARecoveryCodes(userCtx, false, "", "")
			require.True(t, console.ErrUnauthorized.Has(err))

			_, user = updateContext()
			require.False(t, user.MFAEnabled)
		})

		t.Run("EnableUserMFAGoodPasscode", func(t *testing.T) {
			// Expect MFA-enabling attempt to succeed when providing valid passcode.
			goodCode, err := console.NewMFAPasscode(key, mfaTime)
			require.NoError(t, err)

			userCtx, _ = updateContext()
			err = service.EnableUserMFA(userCtx, goodCode, mfaTime)
			require.NoError(t, err)

			_, user = updateContext()
			require.True(t, user.MFAEnabled)
			require.Equal(t, user.MFASecretKey, key)
		})

		t.Run("MFAGetToken", func(t *testing.T) {
			request := console.AuthUser{Email: user.Email, Password: user.FullName}

			// Expect no token due to lack of MFA passcode.
			token, err := service.Token(ctx, request)
			require.True(t, console.ErrMFAMissing.Has(err))
			require.Empty(t, token)

			// Expect no token due to bad MFA passcode.
			wrongCode, err := console.NewMFAPasscode(key, time.Now().Add(time.Hour))
			require.NoError(t, err)

			request.MFAPasscode = wrongCode
			token, err = service.Token(ctx, request)
			require.True(t, console.ErrMFAPasscode.Has(err))
			require.Empty(t, token)

			// Expect token when providing valid passcode.
			goodCode, err := console.NewMFAPasscode(key, time.Now())
			require.NoError(t, err)

			request.MFAPasscode = goodCode
			token, err = service.Token(ctx, request)
			require.NoError(t, err)
			require.NotEmpty(t, token)
		})

		t.Run("MFARecoveryCodes", func(t *testing.T) {
			_, err = service.ResetMFARecoveryCodes(userCtx, false, "", "")
			require.NoError(t, err)

			_, user = updateContext()
			require.Len(t, user.MFARecoveryCodes, console.MFARecoveryCodeCount)

			for _, code := range user.MFARecoveryCodes {
				// Ensure code is of the form XXXX-XXXX-XXXX where X is A-Z or 0-9.
				require.Regexp(t, "^([A-Z0-9]{4})((-[A-Z0-9]{4})){2}$", code)

				// Expect token when providing valid recovery code.
				request := console.AuthUser{Email: user.Email, Password: user.FullName, MFARecoveryCode: code}
				token, err := service.Token(ctx, request)
				require.NoError(t, err)
				require.NotEmpty(t, token)

				// Expect no token due to providing previously-used recovery code.
				token, err = service.Token(ctx, request)
				require.True(t, console.ErrMFARecoveryCode.Has(err))
				require.Empty(t, token)

				_, user = updateContext()
			}

			userCtx, _ = updateContext()

			// requiring MFA code to reset recovery codes should work
			code, err := console.NewMFAPasscode(key, mfaTime)
			require.NoError(t, err)
			_, err = service.ResetMFARecoveryCodes(userCtx, true, code, "")
			require.NoError(t, err)
		})

		t.Run("DisableUserMFABadPasscode", func(t *testing.T) {
			// Expect MFA-disabling attempt to fail when providing valid passcode.
			badCode, err := console.NewMFAPasscode(key, mfaTime.Add(time.Hour))
			require.NoError(t, err)

			userCtx, _ = updateContext()
			err = service.DisableUserMFA(userCtx, badCode, mfaTime, "")
			require.True(t, console.ErrValidation.Has(err))

			_, user = updateContext()
			require.True(t, user.MFAEnabled)
			require.NotEmpty(t, user.MFASecretKey)
			require.NotEmpty(t, user.MFARecoveryCodes)
		})

		t.Run("DisableUserMFAConflict", func(t *testing.T) {
			// Expect MFA-disabling attempt to fail when providing both recovery code and passcode.
			goodCode, err := console.NewMFAPasscode(key, mfaTime)
			require.NoError(t, err)

			userCtx, user = updateContext()
			err = service.DisableUserMFA(userCtx, goodCode, mfaTime, user.MFARecoveryCodes[0])
			require.True(t, console.ErrMFAConflict.Has(err))

			_, user = updateContext()
			require.True(t, user.MFAEnabled)
			require.NotEmpty(t, user.MFASecretKey)
			require.NotEmpty(t, user.MFARecoveryCodes)
		})

		t.Run("DisableUserMFAGoodPasscode", func(t *testing.T) {
			// Expect MFA-disabling attempt to succeed when providing valid passcode.
			goodCode, err := console.NewMFAPasscode(key, mfaTime)
			require.NoError(t, err)

			userCtx, _ = updateContext()
			err = service.DisableUserMFA(userCtx, goodCode, mfaTime, "")
			require.NoError(t, err)

			userCtx, user = updateContext()
			require.False(t, user.MFAEnabled)
			require.Empty(t, user.MFASecretKey)
			require.Empty(t, user.MFARecoveryCodes)
		})

		t.Run("DisableUserMFAGoodRecoveryCode", func(t *testing.T) {
			// Expect MFA-disabling attempt to succeed when providing valid recovery code.
			// Enable MFA
			key, err = service.ResetMFASecretKey(userCtx)
			require.NoError(t, err)

			goodCode, err := console.NewMFAPasscode(key, mfaTime)
			require.NoError(t, err)

			userCtx, _ = updateContext()
			err = service.EnableUserMFA(userCtx, goodCode, mfaTime)
			require.NoError(t, err)

			userCtx, _ = updateContext()
			_, err = service.ResetMFARecoveryCodes(userCtx, false, "", "")
			require.NoError(t, err)

			userCtx, user = updateContext()
			require.True(t, user.MFAEnabled)
			require.NotEmpty(t, user.MFASecretKey)
			require.NotEmpty(t, user.MFARecoveryCodes)

			// Disable MFA
			err = service.DisableUserMFA(userCtx, "", mfaTime, user.MFARecoveryCodes[0])
			require.NoError(t, err)

			_, user = updateContext()
			require.False(t, user.MFAEnabled)
			require.Empty(t, user.MFASecretKey)
			require.Empty(t, user.MFARecoveryCodes)
		})
	})
}

func TestResetPassword(t *testing.T) {
	testplanet.Run(t, testplanet.Config{
		SatelliteCount: 1, StorageNodeCount: 0, UplinkCount: 0,
	}, func(t *testing.T, ctx *testcontext.Context, planet *testplanet.Planet) {
		sat := planet.Satellites[0]
		service := sat.API.Console.Service

		user, err := sat.AddUser(ctx, console.CreateUser{
			FullName: "Test User",
			Email:    "test@mail.test",
		}, 1)
		require.NoError(t, err)

		newPass := user.FullName

		getNewResetToken := func() *console.ResetPasswordToken {
			token, err := sat.DB.Console().ResetPasswordTokens().Create(ctx, user.ID)
			require.NoError(t, err)
			require.NotNil(t, token)
			return token
		}
		token := getNewResetToken()

		// Expect error when providing bad token.
		err = service.ResetPassword(ctx, "badToken", newPass, "", "", token.CreatedAt)
		require.True(t, console.ErrRecoveryToken.Has(err))

		// Expect error when providing good but expired token.
		err = service.ResetPassword(
			ctx,
			token.Secret.String(),
			newPass,
			"",
			"",
			token.CreatedAt.Add(sat.Config.ConsoleAuth.TokenExpirationTime).Add(time.Second),
		)
		require.True(t, console.ErrTokenExpiration.Has(err))

		// Expect error when providing good token with bad (too short) password.
		err = service.ResetPassword(ctx, token.Secret.String(), "bad", "", "", token.CreatedAt)
		require.True(t, console.ErrValidation.Has(err))

		// Expect success when providing good token and good password.
		err = service.ResetPassword(ctx, token.Secret.String(), newPass, "", "", token.CreatedAt)
		require.NoError(t, err)

		token = getNewResetToken()

		// Enable MFA.
		userCtx, err := sat.UserContext(ctx, user.ID)
		require.NoError(t, err)

		key, err := service.ResetMFASecretKey(userCtx)
		require.NoError(t, err)
		userCtx, err = sat.UserContext(ctx, user.ID)
		require.NoError(t, err)

		passcode, err := console.NewMFAPasscode(key, token.CreatedAt)
		require.NoError(t, err)

		err = service.EnableUserMFA(userCtx, passcode, token.CreatedAt)
		require.NoError(t, err)

		// Expect error when providing bad passcode.
		badPasscode, err := console.NewMFAPasscode(key, token.CreatedAt.Add(time.Hour))
		require.NoError(t, err)
		err = service.ResetPassword(ctx, token.Secret.String(), newPass, badPasscode, "", token.CreatedAt)
		require.True(t, console.ErrMFAPasscode.Has(err))

		for _, recoveryCode := range user.MFARecoveryCodes {
			// Expect success when providing bad passcode and good recovery code.
			err = service.ResetPassword(ctx, token.Secret.String(), newPass, badPasscode, recoveryCode, token.CreatedAt)
			require.NoError(t, err)
			token = getNewResetToken()

			// Expect error when providing bad passcode and already-used recovery code.
			err = service.ResetPassword(ctx, token.Secret.String(), newPass, badPasscode, recoveryCode, token.CreatedAt)
			require.True(t, console.ErrMFARecoveryCode.Has(err))
		}

		// Expect success when providing good passcode.
		err = service.ResetPassword(ctx, token.Secret.String(), newPass, passcode, "", token.CreatedAt)
		require.NoError(t, err)
	})
}

func TestChangePassword(t *testing.T) {
	testplanet.Run(t, testplanet.Config{
		SatelliteCount: 1, StorageNodeCount: 0, UplinkCount: 1,
	}, func(t *testing.T, ctx *testcontext.Context, planet *testplanet.Planet) {
		sat := planet.Satellites[0]
		upl := planet.Uplinks[0]
		newPass := "newPass123!"

		user, err := sat.DB.Console().Users().GetByEmail(ctx, upl.User[sat.ID()].Email)
		require.NoError(t, err)
		userCtx, err := sat.UserContext(ctx, user.ID)
		require.NoError(t, err)

		// generate a password recovery token to test that changing password invalidates it
		passwordRecoveryToken, err := sat.API.Console.Service.GeneratePasswordRecoveryToken(userCtx, user.ID)
		require.NoError(t, err)

		require.NoError(t, sat.API.Console.Service.ChangePassword(userCtx, upl.User[sat.ID()].Password, newPass))
		user, err = sat.DB.Console().Users().Get(ctx, user.ID)
		require.NoError(t, err)
		require.NoError(t, bcrypt.CompareHashAndPassword(user.PasswordHash, []byte(newPass)))

		err = sat.API.Console.Service.ResetPassword(
			userCtx,
			passwordRecoveryToken,
			"aDifferentPassword123!",
			"",
			"",
			time.Now(),
		)
		require.Error(t, err)
		require.True(t, console.ErrRecoveryToken.Has(err))
	})
}

func TestGenerateSessionToken(t *testing.T) {
	testplanet.Run(t, testplanet.Config{
		SatelliteCount: 1, StorageNodeCount: 0, UplinkCount: 1,
		Reconfigure: testplanet.Reconfigure{
			Satellite: func(log *zap.Logger, index int, config *satellite.Config) {
				config.Console.Session.InactivityTimerEnabled = true
				config.Console.Session.InactivityTimerDuration = 600
			},
		},
	}, func(t *testing.T, ctx *testcontext.Context, planet *testplanet.Planet) {
		sat := planet.Satellites[0]
		srv := sat.API.Console.Service

		user, _, err := srv.GetUserByEmailWithUnverified(ctx, planet.Uplinks[0].User[sat.ID()].Email)
		require.NoError(t, err)

		userCtx, err := sat.UserContext(ctx, user.ID)
		require.NoError(t, err)

		now := time.Now()
		token1, err := srv.GenerateSessionToken(userCtx, user.ID, user.Email, "", "", nil)
		require.NoError(t, err)
		require.NotNil(t, token1)

		token1Duration := token1.ExpiresAt.Sub(now)
		increase := 10 * time.Minute
		increasedDuration := time.Duration(sat.Config.Console.Session.InactivityTimerDuration)*time.Second + increase
		ptr := &increasedDuration
		require.NoError(t, sat.DB.Console().Users().UpsertSettings(ctx, user.ID, console.UpsertUserSettingsRequest{
			SessionDuration: &ptr,
		}))

		now = time.Now()
		token2, err := srv.GenerateSessionToken(userCtx, user.ID, user.Email, "", "", nil)
		require.NoError(t, err)
		token2Duration := token2.ExpiresAt.Sub(now)
		require.Greater(t, token2Duration, token1Duration)

		decrease := -5 * time.Minute
		decreasedDuration := time.Duration(sat.Config.Console.Session.InactivityTimerDuration)*time.Second + decrease
		ptr = &decreasedDuration
		require.NoError(t, sat.DB.Console().Users().UpsertSettings(ctx, user.ID, console.UpsertUserSettingsRequest{
			SessionDuration: &ptr,
		}))

		now = time.Now()
		token3, err := srv.GenerateSessionToken(userCtx, user.ID, user.Email, "", "", nil)
		require.NoError(t, err)
		token3Duration := token3.ExpiresAt.Sub(now)
		require.Less(t, token3Duration, token1Duration)

		now = time.Now()
		customDuration := 7 * 24 * time.Hour
		inAWeek := now.Add(customDuration)
		token4, err := srv.GenerateSessionToken(userCtx, user.ID, user.Email, "", "", &customDuration)
		require.NoError(t, err)
		require.True(t, token4.ExpiresAt.After(inAWeek))
	})
}

func TestRefreshSessionToken(t *testing.T) {
	testplanet.Run(t, testplanet.Config{
		SatelliteCount: 1, StorageNodeCount: 0, UplinkCount: 1,
		Reconfigure: testplanet.Reconfigure{
			Satellite: func(log *zap.Logger, index int, config *satellite.Config) {
				config.Console.Session.InactivityTimerEnabled = true
				config.Console.Session.InactivityTimerDuration = 600
			},
		},
	}, func(t *testing.T, ctx *testcontext.Context, planet *testplanet.Planet) {
		sat := planet.Satellites[0]
		srv := sat.API.Console.Service

		user, _, err := srv.GetUserByEmailWithUnverified(ctx, planet.Uplinks[0].User[sat.ID()].Email)
		require.NoError(t, err)

		userCtx, err := sat.UserContext(ctx, user.ID)
		require.NoError(t, err)

		now := time.Now()
		token, err := srv.GenerateSessionToken(userCtx, user.ID, user.Email, "", "", nil)
		require.NoError(t, err)
		require.NotNil(t, token)

		defaultDuration := token.ExpiresAt.Sub(now)
		increase := 10 * time.Minute
		increasedDuration := time.Duration(sat.Config.Console.Session.InactivityTimerDuration)*time.Second + increase
		ptr := &increasedDuration
		require.NoError(t, sat.DB.Console().Users().UpsertSettings(ctx, user.ID, console.UpsertUserSettingsRequest{
			SessionDuration: &ptr,
		}))

		sessionID, err := uuid.FromBytes(token.Token.Payload)
		require.NoError(t, err)

		now = time.Now()
		increasedExpiration, err := srv.RefreshSession(userCtx, sessionID)
		require.NoError(t, err)
		require.Greater(t, increasedExpiration.Sub(now), defaultDuration)

		decrease := -5 * time.Minute
		decreasedDuration := time.Duration(sat.Config.Console.Session.InactivityTimerDuration)*time.Second + decrease
		ptr = &decreasedDuration
		require.NoError(t, sat.DB.Console().Users().UpsertSettings(ctx, user.ID, console.UpsertUserSettingsRequest{
			SessionDuration: &ptr,
		}))

		now = time.Now()
		decreasedExpiration, err := srv.RefreshSession(userCtx, sessionID)
		require.NoError(t, err)
		require.Less(t, decreasedExpiration.Sub(now), defaultDuration)
	})
}

func TestLoginRestricted(t *testing.T) {
	testplanet.Run(t, testplanet.Config{
		SatelliteCount: 1, StorageNodeCount: 0, UplinkCount: 1,
	}, func(t *testing.T, ctx *testcontext.Context, planet *testplanet.Planet) {
		sat := planet.Satellites[0]
		service := sat.API.Console.Service
		userDB := sat.DB.Console().Users()
		user := planet.Uplinks[0].User[sat.ID()]

		dbUser, _, err := service.GetUserByEmailWithUnverified(ctx, user.Email)
		require.NoError(t, err)

		status := console.PendingBotVerification
		err = userDB.Update(ctx, dbUser.ID, console.UpdateUserRequest{Status: &status})
		require.NoError(t, err)

		tokenInfo, err := service.Token(ctx, console.AuthUser{Email: user.Email, Password: user.Password})
		require.True(t, console.ErrLoginRestricted.Has(err))
		require.Nil(t, tokenInfo)

		status = console.LegalHold
		err = userDB.Update(ctx, dbUser.ID, console.UpdateUserRequest{Status: &status})
		require.NoError(t, err)

		tokenInfo, err = service.Token(ctx, console.AuthUser{Email: user.Email, Password: user.Password})
		require.True(t, console.ErrLoginRestricted.Has(err))
		require.Nil(t, tokenInfo)

		status = console.Active
		err = userDB.Update(ctx, dbUser.ID, console.UpdateUserRequest{Status: &status})
		require.NoError(t, err)

		tokenInfo, err = service.Token(ctx, console.AuthUser{Email: user.Email, Password: user.Password})
		require.NoError(t, err)
		require.NotNil(t, tokenInfo)
	})
}

func TestUserSettings(t *testing.T) {
	testplanet.Run(t, testplanet.Config{
		SatelliteCount: 1, StorageNodeCount: 0, UplinkCount: 1,
	}, func(t *testing.T, ctx *testcontext.Context, planet *testplanet.Planet) {
		sat := planet.Satellites[0]
		srv := sat.API.Console.Service
		userDB := sat.DB.Console().Users()

		existingUser, _, err := srv.GetUserByEmailWithUnverified(ctx, planet.Uplinks[0].User[sat.ID()].Email)
		require.NoError(t, err)

		userCtx, err := sat.UserContext(ctx, existingUser.ID)
		require.NoError(t, err)

		// getting non-existing settings directly from db should return error
		_, err = userDB.GetSettings(userCtx, existingUser.ID)
		require.Error(t, err)

		// a user that already has a project prior to getting user settings should not go through onboarding again
		// in other words, onboarding start and end should both be true for users who have a project
		settings, err := srv.GetUserSettings(userCtx)
		require.NoError(t, err)
		require.Equal(t, true, settings.OnboardingStart)
		require.Equal(t, true, settings.OnboardingEnd)
		require.Nil(t, settings.OnboardingStep)
		require.Nil(t, settings.SessionDuration)

		noticeDismissal := console.NoticeDismissal{
			FileGuide:                false,
			ServerSideEncryption:     false,
			PartnerUpgradeBanner:     false,
			ProjectMembersPassphrase: false,
		}
		require.Equal(t, noticeDismissal, settings.NoticeDismissal)

		newUser, err := userDB.Insert(ctx, &console.User{
			ID:           testrand.UUID(),
			Email:        "newuser@example.com",
			PasswordHash: []byte("i am a hash of a password, hello"),
		})
		require.NoError(t, err)

		userCtx, err = sat.UserContext(ctx, newUser.ID)
		require.NoError(t, err)

		// a brand new user with no project should go through onboarding
		// in other words, onboarding start and end should both be false for users withouut a project
		settings, err = srv.GetUserSettings(userCtx)
		require.NoError(t, err)
		require.Equal(t, false, settings.OnboardingStart)
		require.Equal(t, false, settings.OnboardingEnd)
		require.Nil(t, settings.OnboardingStep)
		require.Nil(t, settings.SessionDuration)
		require.Equal(t, noticeDismissal, settings.NoticeDismissal)

		onboardingBool := true
		onboardingStep := "Overview"
		sessionDur := time.Duration(rand.Int63()).Round(time.Minute)
		sessionDurPtr := &sessionDur
		noticeDismissal.ServerSideEncryption = true
		noticeDismissal.FileGuide = true
		noticeDismissal.PartnerUpgradeBanner = true
		noticeDismissal.ProjectMembersPassphrase = true
		settings, err = srv.SetUserSettings(userCtx, console.UpsertUserSettingsRequest{
			SessionDuration: &sessionDurPtr,
			OnboardingStart: &onboardingBool,
			OnboardingEnd:   &onboardingBool,
			OnboardingStep:  &onboardingStep,
			NoticeDismissal: &noticeDismissal,
		})
		require.NoError(t, err)
		require.Equal(t, onboardingBool, settings.OnboardingStart)
		require.Equal(t, onboardingBool, settings.OnboardingEnd)
		require.Equal(t, &onboardingStep, settings.OnboardingStep)
		require.Equal(t, sessionDurPtr, settings.SessionDuration)
		require.Equal(t, noticeDismissal, settings.NoticeDismissal)

		settings, err = userDB.GetSettings(userCtx, newUser.ID)
		require.NoError(t, err)
		require.Equal(t, onboardingBool, settings.OnboardingStart)
		require.Equal(t, onboardingBool, settings.OnboardingEnd)
		require.Equal(t, &onboardingStep, settings.OnboardingStep)
		require.Equal(t, sessionDurPtr, settings.SessionDuration)
		require.Equal(t, noticeDismissal, settings.NoticeDismissal)

		// passing nil should not override existing values
		settings, err = srv.SetUserSettings(userCtx, console.UpsertUserSettingsRequest{
			SessionDuration: nil,
			OnboardingStart: nil,
			OnboardingEnd:   nil,
			OnboardingStep:  nil,
			NoticeDismissal: nil,
		})
		require.NoError(t, err)
		require.Equal(t, onboardingBool, settings.OnboardingStart)
		require.Equal(t, onboardingBool, settings.OnboardingEnd)
		require.Equal(t, &onboardingStep, settings.OnboardingStep)
		require.Equal(t, sessionDurPtr, settings.SessionDuration)
		require.Equal(t, noticeDismissal, settings.NoticeDismissal)

		settings, err = userDB.GetSettings(userCtx, newUser.ID)
		require.NoError(t, err)
		require.Equal(t, onboardingBool, settings.OnboardingStart)
		require.Equal(t, onboardingBool, settings.OnboardingEnd)
		require.Equal(t, &onboardingStep, settings.OnboardingStep)
		require.Equal(t, sessionDurPtr, settings.SessionDuration)
		require.Equal(t, noticeDismissal, settings.NoticeDismissal)
	})
}

func TestSetActivationCodeAndSignupID(t *testing.T) {
	testplanet.Run(t, testplanet.Config{
		SatelliteCount: 1, StorageNodeCount: 0, UplinkCount: 1,
	}, func(t *testing.T, ctx *testcontext.Context, planet *testplanet.Planet) {
		sat := planet.Satellites[0]
		srv := sat.API.Console.Service

		existingUser, _, err := srv.GetUserByEmailWithUnverified(ctx, planet.Uplinks[0].User[sat.ID()].Email)
		require.NoError(t, err)
		require.Empty(t, existingUser.ActivationCode)

		updatedUser, err := srv.SetActivationCodeAndSignupID(ctx, *existingUser)
		require.NoError(t, err)
		require.NotEmpty(t, updatedUser.ActivationCode)

		updatedUser2, err := srv.SetActivationCodeAndSignupID(ctx, *existingUser)
		require.NoError(t, err)
		require.NotEqual(t, updatedUser.ActivationCode, updatedUser2.ActivationCode)
	})
}

func TestRESTKeys(t *testing.T) {
	testplanet.Run(t, testplanet.Config{
		SatelliteCount: 1, StorageNodeCount: 0, UplinkCount: 1,
	}, func(t *testing.T, ctx *testcontext.Context, planet *testplanet.Planet) {
		sat := planet.Satellites[0]
		service := sat.API.Console.Service

		proj1, err := sat.API.DB.Console().Projects().Get(ctx, planet.Uplinks[0].Projects[0].ID)
		require.NoError(t, err)

		user, err := service.GetUser(ctx, proj1.OwnerID)
		require.NoError(t, err)

		userCtx, err := sat.UserContext(ctx, user.ID)
		require.NoError(t, err)

		now := time.Now()
		expires := 5 * time.Hour
		apiKey, expiresAt, err := service.CreateRESTKey(userCtx, expires)
		require.NoError(t, err)
		require.NotEmpty(t, apiKey)
		require.True(t, expiresAt.After(now))
		require.True(t, expiresAt.Before(now.Add(expires+time.Hour)))

		// test revocation
		require.NoError(t, service.RevokeRESTKey(userCtx, apiKey))

		// test revoke non existent key
		nonexistent := testrand.UUID()
		err = service.RevokeRESTKey(userCtx, nonexistent.String())
		require.Error(t, err)
	})
}

// TestLockAccount ensures user's gets locked when incorrect credentials are provided.
func TestLockAccount(t *testing.T) {
	testplanet.Run(t, testplanet.Config{
		SatelliteCount: 1, StorageNodeCount: 0, UplinkCount: 0,
	}, func(t *testing.T, ctx *testcontext.Context, planet *testplanet.Planet) {
		sat := planet.Satellites[0]
		service := sat.API.Console.Service
		usersDB := sat.DB.Console().Users()
		consoleConfig := sat.Config.Console

		newUser := console.CreateUser{
			FullName: "token test",
			Email:    "token_test@mail.test",
		}

		user, err := sat.AddUser(ctx, newUser, 1)
		require.NoError(t, err)

		updateContext := func() (context.Context, *console.User) {
			userCtx, err := sat.UserContext(ctx, user.ID)
			require.NoError(t, err)
			user, err := console.GetUser(userCtx)
			require.NoError(t, err)
			return userCtx, user
		}

		userCtx, _ := updateContext()
		secret, err := service.ResetMFASecretKey(userCtx)
		require.NoError(t, err)

		goodCode0, err := console.NewMFAPasscode(secret, time.Time{})
		require.NoError(t, err)

		userCtx, _ = updateContext()
		err = service.EnableUserMFA(userCtx, goodCode0, time.Time{})
		require.NoError(t, err)

		now := time.Now()

		goodCode1, err := console.NewMFAPasscode(secret, now)
		require.NoError(t, err)

		authUser := console.AuthUser{
			Email:       newUser.Email,
			Password:    newUser.FullName,
			MFAPasscode: goodCode1,
		}

		// successful login.
		token, err := service.Token(ctx, authUser)
		require.NoError(t, err)
		require.NotEmpty(t, token)

		// check if user's account gets locked because of providing wrong password.
		authUser.Password = "qweQWE1@"
		for i := 1; i <= consoleConfig.LoginAttemptsWithoutPenalty; i++ {
			token, err = service.Token(ctx, authUser)
			require.Empty(t, token)
			require.True(t, console.ErrLoginCredentials.Has(err))
		}

		lockedUser, err := service.GetUser(userCtx, user.ID)
		require.NoError(t, err)
		require.True(t, lockedUser.FailedLoginCount == consoleConfig.LoginAttemptsWithoutPenalty)
		require.True(t, lockedUser.LoginLockoutExpiration.After(now))

		// lock account once again and check if lockout expiration time increased.
		err = service.UpdateUsersFailedLoginState(userCtx, lockedUser)
		require.NoError(t, err)

		lockedUser, err = service.GetUser(userCtx, user.ID)
		require.NoError(t, err)
		require.True(t, lockedUser.FailedLoginCount == consoleConfig.LoginAttemptsWithoutPenalty+1)

		diff := lockedUser.LoginLockoutExpiration.Sub(now)
		require.Greater(t, diff, time.Duration(consoleConfig.FailedLoginPenalty)*time.Minute)

		// unlock account by successful login
		lockedUser.LoginLockoutExpiration = now.Add(-time.Second)
		lockoutExpirationPtr := &lockedUser.LoginLockoutExpiration
		err = usersDB.Update(userCtx, lockedUser.ID, console.UpdateUserRequest{
			LoginLockoutExpiration: &lockoutExpirationPtr,
		})
		require.NoError(t, err)

		authUser.Password = newUser.FullName
		token, err = service.Token(ctx, authUser)
		require.NoError(t, err)
		require.NotEmpty(t, token)

		unlockedUser, err := service.GetUser(userCtx, user.ID)
		require.NoError(t, err)
		require.Zero(t, unlockedUser.FailedLoginCount)

		// check if user's account gets locked because of providing wrong mfa passcode.
		authUser.MFAPasscode = "000000"
		for i := 1; i <= consoleConfig.LoginAttemptsWithoutPenalty; i++ {
			token, err = service.Token(ctx, authUser)
			require.Empty(t, token)
			require.True(t, console.ErrMFAPasscode.Has(err))
		}

		lockedUser, err = service.GetUser(userCtx, user.ID)
		require.NoError(t, err)
		require.True(t, lockedUser.FailedLoginCount == consoleConfig.LoginAttemptsWithoutPenalty)
		require.True(t, lockedUser.LoginLockoutExpiration.After(now))

		// unlock account
		lockedUser.LoginLockoutExpiration = time.Time{}
		lockoutExpirationPtr = &lockedUser.LoginLockoutExpiration
		lockedUser.FailedLoginCount = 0
		err = usersDB.Update(userCtx, lockedUser.ID, console.UpdateUserRequest{
			LoginLockoutExpiration: &lockoutExpirationPtr,
			FailedLoginCount:       &lockedUser.FailedLoginCount,
		})
		require.NoError(t, err)

		// check if user's account gets locked because of providing wrong mfa recovery code.
		authUser.MFAPasscode = ""
		authUser.MFARecoveryCode = "000000"
		for i := 1; i <= consoleConfig.LoginAttemptsWithoutPenalty; i++ {
			token, err = service.Token(ctx, authUser)
			require.Empty(t, token)
			require.True(t, console.ErrMFARecoveryCode.Has(err))
		}

		lockedUser, err = service.GetUser(userCtx, user.ID)
		require.NoError(t, err)
		require.True(t, lockedUser.FailedLoginCount == consoleConfig.LoginAttemptsWithoutPenalty)
		require.True(t, lockedUser.LoginLockoutExpiration.After(now))
	})
}

func TestWalletJsonMarshall(t *testing.T) {
	wi := console.WalletInfo{
		Address: blockchain.Address{1, 2, 3},
		Balance: currency.AmountFromBaseUnits(10000, currency.USDollars),
	}

	out, err := json.Marshal(wi)
	require.NoError(t, err)
	require.Contains(t, string(out), "\"address\":\"0x0102030000000000000000000000000000000000\"")
	require.Contains(t, string(out), "\"balance\":{\"value\":\"100\",\"currency\":\"USD\"}")
}

func TestSessionExpiration(t *testing.T) {
	testplanet.Run(t, testplanet.Config{
		SatelliteCount: 1, StorageNodeCount: 0, UplinkCount: 0,
		Reconfigure: testplanet.Reconfigure{
			Satellite: func(log *zap.Logger, index int, config *satellite.Config) {
				config.Console.Session.InactivityTimerEnabled = false
				config.Console.Session.Duration = time.Hour
			},
		},
	}, func(t *testing.T, ctx *testcontext.Context, planet *testplanet.Planet) {
		sat := planet.Satellites[0]
		service := sat.API.Console.Service

		user, err := sat.AddUser(ctx, console.CreateUser{
			FullName: "Test User",
			Email:    "test@mail.test",
		}, 1)
		require.NoError(t, err)

		// Session should be added to DB after token request
		tokenInfo, err := service.Token(ctx, console.AuthUser{Email: user.Email, Password: user.FullName})
		require.NoError(t, err)

		_, err = service.TokenAuth(ctx, tokenInfo.Token, time.Now())
		require.NoError(t, err)

		sessionID, err := uuid.FromBytes(tokenInfo.Token.Payload)
		require.NoError(t, err)

		_, err = sat.DB.Console().WebappSessions().GetBySessionID(ctx, sessionID)
		require.NoError(t, err)

		// Session should be removed from DB after it has expired
		_, err = service.TokenAuth(ctx, tokenInfo.Token, time.Now().Add(2*time.Hour))
		require.True(t, console.ErrTokenExpiration.Has(err))

		_, err = sat.DB.Console().WebappSessions().GetBySessionID(ctx, sessionID)
		require.ErrorIs(t, sql.ErrNoRows, err)
	})
}

func TestDeleteAllSessionsByUserIDExcept(t *testing.T) {
	testplanet.Run(t, testplanet.Config{
		SatelliteCount: 1, StorageNodeCount: 0, UplinkCount: 0,
	}, func(t *testing.T, ctx *testcontext.Context, planet *testplanet.Planet) {
		sat := planet.Satellites[0]
		service := sat.API.Console.Service

		user, err := sat.AddUser(ctx, console.CreateUser{
			FullName: "Test User",
			Email:    "test@mail.test",
		}, 1)
		require.NoError(t, err)

		// Session should be added to DB after token request
		tokenInfo, err := service.Token(ctx, console.AuthUser{Email: user.Email, Password: user.FullName})
		require.NoError(t, err)

		_, err = service.TokenAuth(ctx, tokenInfo.Token, time.Now())
		require.NoError(t, err)

		sessionID, err := uuid.FromBytes(tokenInfo.Token.Payload)
		require.NoError(t, err)

		_, err = sat.DB.Console().WebappSessions().GetBySessionID(ctx, sessionID)
		require.NoError(t, err)

		// Session2 should be added to DB after token request
		tokenInfo2, err := service.Token(ctx, console.AuthUser{Email: user.Email, Password: user.FullName})
		require.NoError(t, err)

		_, err = service.TokenAuth(ctx, tokenInfo2.Token, time.Now())
		require.NoError(t, err)

		sessionID2, err := uuid.FromBytes(tokenInfo2.Token.Payload)
		require.NoError(t, err)

		_, err = sat.DB.Console().WebappSessions().GetBySessionID(ctx, sessionID2)
		require.NoError(t, err)

		// Session2 should be removed from DB after calling DeleteAllSessionByUserIDExcept with Session1
		err = service.DeleteAllSessionsByUserIDExcept(ctx, user.ID, sessionID)
		require.NoError(t, err)

		_, err = sat.DB.Console().WebappSessions().GetBySessionID(ctx, sessionID2)
		require.ErrorIs(t, sql.ErrNoRows, err)
	})
}

func TestPaymentsWalletPayments(t *testing.T) {
	testplanet.Run(t, testplanet.Config{
		SatelliteCount: 1, StorageNodeCount: 0, UplinkCount: 0,
		Reconfigure: testplanet.Reconfigure{
			Satellite: func(log *zap.Logger, index int, config *satellite.Config) {
				config.Payments.BillingConfig.DisableLoop = false
				config.Payments.BonusRate = 10
			},
		},
	}, func(t *testing.T, ctx *testcontext.Context, planet *testplanet.Planet) {
		sat := planet.Satellites[0]
		now := time.Now().Truncate(time.Second).UTC()

		user, err := sat.AddUser(ctx, console.CreateUser{
			FullName: "Test User",
			Email:    "test@mail.test",
			Password: "example",
		}, 1)
		require.NoError(t, err)

		wallet := blockchaintest.NewAddress()
		err = sat.DB.Wallets().Add(ctx, user.ID, wallet)
		require.NoError(t, err)

		var transactions []stripe.Transaction
		for i := 0; i < 5; i++ {
			tx := stripe.Transaction{
				ID:        coinpayments.TransactionID(fmt.Sprintf("%d", i)),
				AccountID: user.ID,
				Address:   blockchaintest.NewAddress().Hex(),
				Amount:    currency.AmountFromBaseUnits(1000000000, currency.StorjToken),
				Received:  currency.AmountFromBaseUnits(1000000000, currency.StorjToken),
				Status:    coinpayments.StatusCompleted,
				Key:       "key",
				Timeout:   0,
			}

			createdAt, err := sat.DB.StripeCoinPayments().Transactions().TestInsert(ctx, tx)
			require.NoError(t, err)
			err = sat.DB.StripeCoinPayments().Transactions().TestLockRate(ctx, tx.ID, decimal.NewFromInt(1))
			require.NoError(t, err)

			tx.CreatedAt = createdAt.UTC()
			transactions = append(transactions, tx)
		}

		var cachedPayments []storjscan.CachedPayment
		for i := 0; i < 10; i++ {
			cachedPayments = append(cachedPayments, storjscan.CachedPayment{
				From:        blockchaintest.NewAddress(),
				To:          wallet,
				TokenValue:  currency.AmountFromBaseUnits(1000, currency.StorjToken),
				USDValue:    currency.AmountFromBaseUnits(1000, currency.USDollarsMicro),
				Status:      payments.PaymentStatusConfirmed,
				BlockHash:   blockchaintest.NewHash(),
				BlockNumber: int64(i),
				Transaction: blockchaintest.NewHash(),
				LogIndex:    0,
				Timestamp:   now.Add(time.Duration(i) * 15 * time.Second),
			})
		}
		err = sat.DB.StorjscanPayments().InsertBatch(ctx, cachedPayments)
		require.NoError(t, err)

		reqCtx := console.WithUser(ctx, user)

		sort.Slice(cachedPayments, func(i, j int) bool {
			return cachedPayments[i].BlockNumber > cachedPayments[j].BlockNumber
		})
		sort.Slice(transactions, func(i, j int) bool {
			return transactions[i].CreatedAt.After(transactions[j].CreatedAt)
		})

		var expected []console.PaymentInfo
		for _, pmnt := range cachedPayments {
			expected = append(expected, console.PaymentInfo{
				ID:        fmt.Sprintf("%s#%d", pmnt.Transaction.Hex(), pmnt.LogIndex),
				Type:      "storjscan",
				Wallet:    pmnt.To.Hex(),
				Amount:    pmnt.USDValue,
				Status:    string(pmnt.Status),
				Link:      sat.API.Console.Service.Payments().EtherscanURL(pmnt.Transaction.Hex()),
				Timestamp: pmnt.Timestamp,
			})
		}
		for _, tx := range transactions {
			expected = append(expected, console.PaymentInfo{
				ID:        tx.ID.String(),
				Type:      "coinpayments",
				Wallet:    tx.Address,
				Amount:    currency.AmountFromBaseUnits(1000, currency.USDollars),
				Received:  currency.AmountFromBaseUnits(1000, currency.USDollars),
				Status:    tx.Status.String(),
				Link:      coinpayments.GetCheckoutURL(tx.Key, tx.ID),
				Timestamp: tx.CreatedAt,
			})
		}

		// get billing chore to insert bonuses for transactions.
		sat.Core.Payments.BillingChore.TransactionCycle.TriggerWait()

		txns, err := sat.DB.Billing().ListSource(ctx, user.ID, billing.StorjScanBonusSource)
		require.NoError(t, err)
		require.NotEmpty(t, txns)

		for _, txn := range txns {
			if txn.Source != billing.StorjScanBonusSource {
				continue
			}
			var meta struct {
				ReferenceID string
				Wallet      string
				LogIndex    int
			}
			err = json.NewDecoder(bytes.NewReader(txn.Metadata)).Decode(&meta)
			require.NoError(t, err)

			expected = append(expected, console.PaymentInfo{
				ID:        fmt.Sprintf("%s#%d", meta.ReferenceID, meta.LogIndex),
				Type:      txn.Source,
				Wallet:    meta.Wallet,
				Amount:    txn.Amount,
				Status:    string(txn.Status),
				Link:      sat.API.Console.Service.Payments().EtherscanURL(meta.ReferenceID),
				Timestamp: txn.Timestamp,
			})
		}

		walletPayments, err := sat.API.Console.Service.Payments().WalletPayments(reqCtx)
		require.NoError(t, err)
		require.Equal(t, expected, walletPayments.Payments)
	})
}

type mockDepositWallets struct {
	address  blockchain.Address
	payments []payments.WalletPaymentWithConfirmations
}

func (dw mockDepositWallets) Claim(_ context.Context, _ uuid.UUID) (blockchain.Address, error) {
	return dw.address, nil
}

func (dw mockDepositWallets) Get(_ context.Context, _ uuid.UUID) (blockchain.Address, error) {
	return dw.address, nil
}

func (dw mockDepositWallets) Payments(
	_ context.Context,
	_ blockchain.Address,
	_ int,
	_ int64,
) (p []payments.WalletPayment, err error) {
	return
}

func (dw mockDepositWallets) PaymentsWithConfirmations(
	_ context.Context,
	_ blockchain.Address,
) ([]payments.WalletPaymentWithConfirmations, error) {
	return dw.payments, nil
}

func TestWalletPaymentsWithConfirmations(t *testing.T) {
	testplanet.Run(t, testplanet.Config{
		SatelliteCount: 1, StorageNodeCount: 0, UplinkCount: 0,
	}, func(t *testing.T, ctx *testcontext.Context, planet *testplanet.Planet) {
		sat := planet.Satellites[0]
		service := sat.API.Console.Service
		paymentsService := service.Payments()

		user, err := sat.AddUser(ctx, console.CreateUser{
			FullName: "Test User",
			Email:    "test@mail.test",
			Password: "example",
		}, 1)
		require.NoError(t, err)

		now := time.Now()
		wallet := blockchaintest.NewAddress()

		var expected []payments.WalletPaymentWithConfirmations
		for i := 0; i < 3; i++ {
			expected = append(expected, payments.WalletPaymentWithConfirmations{
				From:          blockchaintest.NewAddress().Hex(),
				To:            wallet.Hex(),
				TokenValue:    currency.AmountFromBaseUnits(int64(i), currency.StorjToken).AsDecimal(),
				USDValue:      currency.AmountFromBaseUnits(int64(i), currency.USDollarsMicro).AsDecimal(),
				Status:        payments.PaymentStatusConfirmed,
				BlockHash:     blockchaintest.NewHash().Hex(),
				BlockNumber:   int64(i),
				Transaction:   blockchaintest.NewHash().Hex(),
				LogIndex:      i,
				Timestamp:     now,
				Confirmations: int64(i),
				BonusTokens:   decimal.NewFromInt(int64(i)),
			})
		}

		paymentsService.TestSwapDepositWallets(mockDepositWallets{address: wallet, payments: expected})

		reqCtx := console.WithUser(ctx, user)

		walletPayments, err := paymentsService.WalletPaymentsWithConfirmations(reqCtx)
		require.NoError(t, err)
		require.NotZero(t, len(walletPayments))

		for i, wp := range walletPayments {
			require.Equal(t, expected[i].From, wp.From)
			require.Equal(t, expected[i].To, wp.To)
			require.Equal(t, expected[i].TokenValue, wp.TokenValue)
			require.Equal(t, expected[i].USDValue, wp.USDValue)
			require.Equal(t, expected[i].Status, wp.Status)
			require.Equal(t, expected[i].BlockHash, wp.BlockHash)
			require.Equal(t, expected[i].BlockNumber, wp.BlockNumber)
			require.Equal(t, expected[i].Transaction, wp.Transaction)
			require.Equal(t, expected[i].LogIndex, wp.LogIndex)
			require.Equal(t, expected[i].Timestamp, wp.Timestamp)
		}
	})
}

func TestPaymentsPurchase(t *testing.T) {
	testplanet.Run(t, testplanet.Config{
		SatelliteCount: 1, StorageNodeCount: 0, UplinkCount: 0,
	}, func(t *testing.T, ctx *testcontext.Context, planet *testplanet.Planet) {
		sat := planet.Satellites[0]
		p := sat.API.Console.Service.Payments()
		user, err := sat.AddUser(ctx, console.CreateUser{
			FullName: "Test User",
			Email:    "test@mail.test",
		}, 1)
		require.NoError(t, err)

		userCtx, err := sat.UserContext(ctx, user.ID)
		require.NoError(t, err)

		testDesc := "testDescription"
		testPaymentMethod := "testPaymentMethod"

		tests := []struct {
			name          string
			purchaseDesc  string
			paymentMethod string
			shouldErr     bool
			ctx           context.Context
		}{
			{
				"Purchase returns error with unknown user",
				testDesc,
				testPaymentMethod,
				true,
				ctx,
			},
			{
				"Purchase returns error when underlying payments.Invoices.New returns error",
				stripe.MockInvoicesNewFailure,
				testPaymentMethod,
				true,
				userCtx,
			},
			{
				"Purchase returns error when underlying payments.Invoices.Pay returns error",
				testDesc,
				stripe.MockInvoicesPayFailure,
				true,
				userCtx,
			},
			{
				"Purchase success",
				testDesc,
				testPaymentMethod,
				false,
				userCtx,
			},
		}
		for _, tt := range tests {
			t.Run(tt.name, func(t *testing.T) {
				err := p.Purchase(tt.ctx, 1000, tt.purchaseDesc, tt.paymentMethod)
				if tt.shouldErr {
					require.NotNil(t, err)
				} else {
					require.Nil(t, err)
				}
			})
		}
	})
}

func TestPaymentsPurchasePreexistingInvoice(t *testing.T) {
	testplanet.Run(t, testplanet.Config{
		SatelliteCount: 1, StorageNodeCount: 0, UplinkCount: 0,
	}, func(t *testing.T, ctx *testcontext.Context, planet *testplanet.Planet) {
		sat := planet.Satellites[0]
		p := sat.API.Console.Service.Payments()

		user, err := sat.AddUser(ctx, console.CreateUser{
			FullName: "Test User",
			Email:    "test@mail.test",
		}, 1)
		require.NoError(t, err)

		userCtx, err := sat.UserContext(ctx, user.ID)
		require.NoError(t, err)

		draftInvDesc := "testDraftDescription"
		testPaymentMethod := "testPaymentMethod"

		invs, err := sat.API.Payments.StripeService.Accounts().Invoices().List(ctx, user.ID)
		require.NoError(t, err)
		require.Len(t, invs, 0)

		// test purchase with draft invoice
		inv, err := sat.API.Payments.StripeService.Accounts().Invoices().Create(ctx, user.ID, 1000, draftInvDesc)
		require.NoError(t, err)
		require.Equal(t, payments.InvoiceStatusDraft, inv.Status)

		draftInv := inv.ID

		invs, err = sat.API.Payments.StripeService.Accounts().Invoices().List(ctx, user.ID)
		require.NoError(t, err)
		require.Len(t, invs, 1)
		require.Equal(t, draftInv, invs[0].ID)

		require.NoError(t, p.Purchase(userCtx, 1000, draftInvDesc, stripe.MockInvoicesPaySuccess))

		invs, err = sat.API.Payments.StripeService.Accounts().Invoices().List(ctx, user.ID)
		require.NoError(t, err)
		require.Len(t, invs, 1)
		require.NotEqual(t, draftInv, invs[0].ID)
		require.Equal(t, payments.InvoiceStatusPaid, invs[0].Status)

		// test purchase with open invoice
		openInvDesc := "testOpenDescription"
		inv, err = sat.API.Payments.StripeService.Accounts().Invoices().Create(ctx, user.ID, 1000, openInvDesc)
		require.NoError(t, err)

		openInv := inv.ID

		// attempting to pay a draft invoice changes it to open if payment fails
		_, err = sat.API.Payments.StripeService.Accounts().Invoices().Pay(ctx, inv.ID, stripe.MockInvoicesPayFailure)
		require.Error(t, err)

		invs, err = sat.API.Payments.StripeService.Accounts().Invoices().List(ctx, user.ID)
		require.NoError(t, err)
		require.Len(t, invs, 2)
		var foundInv bool
		for _, inv := range invs {
			if inv.ID == openInv {
				foundInv = true
				require.Equal(t, payments.InvoiceStatusOpen, inv.Status)
			}
		}
		require.True(t, foundInv)

		require.NoError(t, p.Purchase(userCtx, 1000, openInvDesc, stripe.MockInvoicesPaySuccess))

		invs, err = sat.API.Payments.StripeService.Accounts().Invoices().List(ctx, user.ID)
		require.NoError(t, err)
		require.Len(t, invs, 2)
		foundInv = false
		for _, inv := range invs {
			if inv.ID == openInv {
				foundInv = true
				require.Equal(t, payments.InvoiceStatusPaid, inv.Status)
			}
		}
		require.True(t, foundInv)

		// purchase with paid invoice skips creating and or paying invoice
		require.NoError(t, p.Purchase(userCtx, 1000, openInvDesc, testPaymentMethod))

		invs, err = sat.API.Payments.StripeService.Accounts().Invoices().List(ctx, user.ID)
		require.NoError(t, err)
		require.Len(t, invs, 2)
	})
}

func TestServiceGenMethods(t *testing.T) {
	testplanet.Run(t, testplanet.Config{
		SatelliteCount: 1, StorageNodeCount: 0, UplinkCount: 2,
	}, func(t *testing.T, ctx *testcontext.Context, planet *testplanet.Planet) {
		sat := planet.Satellites[0]
		s := sat.API.Console.Service
		u0 := planet.Uplinks[0]
		u1 := planet.Uplinks[1]
		user0Ctx, err := sat.UserContext(ctx, u0.Projects[0].Owner.ID)
		require.NoError(t, err)
		user1Ctx, err := sat.UserContext(ctx, u1.Projects[0].Owner.ID)
		require.NoError(t, err)

		p0ID := u0.Projects[0].ID
		p, err := s.GetProject(user1Ctx, u1.Projects[0].ID)
		require.NoError(t, err)
		p1PublicID := p.PublicID

		for _, tt := range []struct {
			name   string
			ID     uuid.UUID
			ctx    context.Context
			uplink *testplanet.Uplink
		}{
			{"projectID", p0ID, user0Ctx, u0},
			{"publicID", p1PublicID, user1Ctx, u1},
		} {

			t.Run("GenUpdateProject with "+tt.name, func(t *testing.T) {
				updatedName := "name " + tt.name
				updatedDescription := "desc " + tt.name
				updatedStorageLimit := memory.Size(100)
				updatedBandwidthLimit := memory.Size(100)

				info := console.UpsertProjectInfo{
					Name:           updatedName,
					Description:    updatedDescription,
					StorageLimit:   updatedStorageLimit,
					BandwidthLimit: updatedBandwidthLimit,
				}
				updatedProject, err := s.GenUpdateProject(tt.ctx, tt.ID, info)
				require.NoError(t, err.Err)
				if tt.name == "projectID" {
					require.Equal(t, tt.ID, updatedProject.ID)
				} else {
					require.Equal(t, tt.ID, updatedProject.PublicID)
				}
				require.Equal(t, info.Name, updatedProject.Name)
				require.Equal(t, info.Description, updatedProject.Description)
			})
			t.Run("GenCreateAPIKey with "+tt.name, func(t *testing.T) {
				request := console.CreateAPIKeyRequest{
					ProjectID: tt.ID.String(),
					Name:      tt.name + " Key",
				}
				apiKey, err := s.GenCreateAPIKey(tt.ctx, request)
				require.NoError(t, err.Err)
				require.Equal(t, tt.ID, apiKey.KeyInfo.ProjectID)
				require.Equal(t, request.Name, apiKey.KeyInfo.Name)
			})
			t.Run("GenGetAPIKeys with "+tt.name, func(t *testing.T) {
				apiKeys, err := s.GenGetAPIKeys(tt.ctx, tt.ID, "", 10, 1, 0, 0)
				require.NoError(t, err.Err)
				require.NotEmpty(t, apiKeys)
				for _, key := range apiKeys.APIKeys {
					require.Equal(t, tt.ID, key.ProjectID)
				}
			})

			bucket := "testbucket"
			require.NoError(t, tt.uplink.CreateBucket(tt.ctx, sat, bucket))
			require.NoError(t, tt.uplink.Upload(tt.ctx, sat, bucket, "helloworld.txt", []byte("hello world")))
			sat.Accounting.Tally.Loop.TriggerWait()

			t.Run("GenGetSingleBucketUsageRollup with "+tt.name, func(t *testing.T) {
				rollup, err := s.GenGetSingleBucketUsageRollup(tt.ctx, tt.ID, bucket, time.Now().Add(-24*time.Hour), time.Now())
				require.NoError(t, err.Err)
				require.NotNil(t, rollup)
				require.Equal(t, tt.ID, rollup.ProjectID)
			})
			t.Run("GenGetBucketUsageRollups with "+tt.name, func(t *testing.T) {
				rollups, err := s.GenGetBucketUsageRollups(tt.ctx, tt.ID, time.Now().Add(-24*time.Hour), time.Now())
				require.NoError(t, err.Err)
				require.NotEmpty(t, rollups)
				for _, r := range rollups {
					require.Equal(t, tt.ID, r.ProjectID)
				}
			})

			// create empty project for easy deletion
			p, err := s.CreateProject(tt.ctx, console.UpsertProjectInfo{
				Name:        "foo",
				Description: "bar",
			})
			require.NoError(t, err)

			t.Run("GenDeleteProject with "+tt.name, func(t *testing.T) {
				var id uuid.UUID
				if tt.name == "projectID" {
					id = p.ID
				} else {
					id = p.PublicID
				}
				httpErr := s.GenDeleteProject(tt.ctx, id)
				require.NoError(t, httpErr.Err)
				p, err := s.GetProject(ctx, id)
				require.Error(t, err)
				require.Nil(t, p)
			})
		}
	})
}

type EmailVerifier struct {
	Data    consoleapi.ContextChannel
	Context context.Context
}

func (v *EmailVerifier) SendEmail(ctx context.Context, msg *post.Message) error {
	body := ""
	for _, part := range msg.Parts {
		body += part.Content
	}
	return v.Data.Send(v.Context, body)
}

func (v *EmailVerifier) FromAddress() post.Address {
	return post.Address{}
}

func TestProjectInvitations(t *testing.T) {
	testplanet.Run(t, testplanet.Config{
		SatelliteCount: 1,
	}, func(t *testing.T, ctx *testcontext.Context, planet *testplanet.Planet) {
		sat := planet.Satellites[0]
		service := sat.API.Console.Service
		invitesDB := sat.DB.Console().ProjectInvitations()

		addUser := func(t *testing.T, ctx context.Context) *console.User {
			user, err := sat.AddUser(ctx, console.CreateUser{
				FullName: "Test User",
				Email:    fmt.Sprintf("%s@mail.test", testrand.RandAlphaNumeric(16)),
			}, 1)
			require.NoError(t, err)
			return user
		}

		getUserAndCtx := func(t *testing.T) (*console.User, context.Context) {
			ctx := testcontext.New(t)
			user := addUser(t, ctx)
			userCtx, err := sat.UserContext(ctx, user.ID)
			require.NoError(t, err)
			return user, userCtx
		}

		addProject := func(t *testing.T, ctx context.Context) *console.Project {
			owner := addUser(t, ctx)
			project, err := sat.AddProject(ctx, owner.ID, "Test Project")
			require.NoError(t, err)
			return project
		}

		addInvite := func(t *testing.T, ctx context.Context, project *console.Project, email string) *console.ProjectInvitation {
			invite, err := invitesDB.Upsert(ctx, &console.ProjectInvitation{
				ProjectID: project.ID,
				Email:     email,
				InviterID: &project.OwnerID,
			})
			require.NoError(t, err)

			return invite
		}

		upgradeToPaidTier := func(t *testing.T, ctx context.Context, user *console.User) context.Context {
			paid := true
			err := sat.DB.Console().Users().Update(ctx, user.ID, console.UpdateUserRequest{PaidTier: &paid})
			require.NoError(t, err)
			ctx, err = sat.UserContext(ctx, user.ID)
			require.NoError(t, err)
			return ctx
		}

		setInviteDate := func(t *testing.T, ctx context.Context, invite *console.ProjectInvitation, createdAt time.Time) {
			result, err := sat.DB.Testing().RawDB().ExecContext(ctx,
				"UPDATE project_invitations SET created_at = $1 WHERE project_id = $2 AND email = $3",
				createdAt, invite.ProjectID, strings.ToUpper(invite.Email),
			)
			require.NoError(t, err)

			count, err := result.RowsAffected()
			require.NoError(t, err)
			require.EqualValues(t, 1, count)

			newInvite, err := invitesDB.Get(ctx, invite.ProjectID, invite.Email)
			require.NoError(t, err)
			*invite = *newInvite
		}

		t.Run("invite and reinvite users", func(t *testing.T) {
			user, ctx := getUserAndCtx(t)
			user2, ctx2 := getUserAndCtx(t)

			project, err := sat.AddProject(ctx, user.ID, "Test Project")
			require.NoError(t, err)

			// inviting without being a paid tier user should fail.
			invite, err := service.InviteNewProjectMember(ctx, project.ID, user2.Email)
			require.True(t, console.ErrNotPaidTier.Has(err))
			require.Nil(t, invite)

			ctx = upgradeToPaidTier(t, ctx, user)

			// expect reinvitation to fail due to lack of preexisting invitation record.
			invites, err := service.ReinviteProjectMembers(ctx, project.ID, []string{user2.Email})
			require.True(t, console.ErrProjectInviteInvalid.Has(err))
			require.Empty(t, invites)

			invite, err = service.InviteNewProjectMember(ctx, project.ID, user2.Email)
			require.NoError(t, err)
			require.NotNil(t, invite)

			// inviting while being a paid tier user should succeed.
			invites, err = service.GetUserProjectInvitations(ctx2)
			require.NoError(t, err)
			require.Len(t, invites, 1)

			// adding in a non-existent user should work.
			_, err = service.InviteNewProjectMember(ctx, project.ID, "notauser@mail.com")
			require.NoError(t, err)

			// prevent unauthorized users from inviting others (user2 is not a member of the project yet).
			const testEmail = "other@mail.com"
			ctx2 = upgradeToPaidTier(t, ctx2, user2)
			_, err = service.InviteNewProjectMember(ctx2, project.ID, testEmail)
			require.Error(t, err)
			require.True(t, console.ErrNoMembership.Has(err))

			require.NoError(t, service.RespondToProjectInvitation(ctx2, project.ID, console.ProjectInvitationAccept))

			// inviting a user with a preexisting invitation record should fail.
			_, err = service.InviteNewProjectMember(ctx2, project.ID, testEmail)
			require.NoError(t, err)
			_, err = service.InviteNewProjectMember(ctx2, project.ID, testEmail)
			require.True(t, console.ErrAlreadyInvited.Has(err))

			// reinviting a user with a preexisting, unexpired invitation record should fail.
			invites, err = service.ReinviteProjectMembers(ctx2, project.ID, []string{testEmail})
			require.True(t, console.ErrAlreadyInvited.Has(err))
			require.Empty(t, invites)

			// expire the invitation.
			user3Invite, err := invitesDB.Get(ctx, project.ID, testEmail)
			require.NoError(t, err)
			require.False(t, service.IsProjectInvitationExpired(user3Invite))
			oldCreatedAt := user3Invite.CreatedAt
			setInviteDate(t, ctx, user3Invite, time.Now().Add(-sat.Config.Console.ProjectInvitationExpiration))
			require.True(t, service.IsProjectInvitationExpired(user3Invite))

			// resending an expired invitation should succeed.
			invites, err = service.ReinviteProjectMembers(ctx2, project.ID, []string{testEmail})
			require.NoError(t, err)
			require.Len(t, invites, 1)
			require.Equal(t, user2.ID, *invites[0].InviterID)
			require.True(t, invites[0].CreatedAt.After(oldCreatedAt))

			// inviting a project member should fail.
			_, err = service.InviteNewProjectMember(ctx, project.ID, user2.Email)
			require.Error(t, err)

			// test inviting unverified user.
			sender := &EmailVerifier{Context: ctx}
			sat.API.Mail.Service.Sender = sender

			regToken, err := service.CreateRegToken(ctx, 1)
			require.NoError(t, err)

			unverified, err := service.CreateUser(ctx, console.CreateUser{
				FullName: "test user",
				Email:    "test-unverified-email@test",
				Password: "password",
			}, regToken.Secret)
			require.NoError(t, err)
			require.Zero(t, unverified.Status)

			invite, err = service.InviteNewProjectMember(ctx, project.ID, unverified.Email)
			require.NoError(t, err)
			require.Equal(t, unverified.Email, strings.ToLower(invite.Email))

			body, err := sender.Data.Get(ctx)
			require.NoError(t, err)
			require.Contains(t, body, "/activation")
		})

		t.Run("get invitation", func(t *testing.T) {
			user, ctx := getUserAndCtx(t)

			invites, err := service.GetUserProjectInvitations(ctx)
			require.NoError(t, err)
			require.Empty(t, invites)

			invite := addInvite(t, ctx, addProject(t, ctx), user.Email)
			invites, err = service.GetUserProjectInvitations(ctx)
			require.NoError(t, err)
			require.Len(t, invites, 1)
			require.Equal(t, invite.ProjectID, invites[0].ProjectID)
			require.Equal(t, invite.Email, invites[0].Email)
			require.Equal(t, invite.InviterID, invites[0].InviterID)
			require.WithinDuration(t, invite.CreatedAt, invites[0].CreatedAt, time.Second)

			setInviteDate(t, ctx, &invites[0], time.Now().Add(-sat.Config.Console.ProjectInvitationExpiration))
			invites, err = service.GetUserProjectInvitations(ctx)
			require.NoError(t, err)
			require.Empty(t, invites)
		})

		t.Run("invite tokens", func(t *testing.T) {
			user, ctx1 := getUserAndCtx(t)

			project, err := sat.AddProject(ctx1, user.ID, "Test Project")
			require.NoError(t, err)

			someToken, err := service.CreateInviteToken(ctx1, project.PublicID, email, time.Now())
			require.NoError(t, err)
			require.NotEmpty(t, someToken)

			id, mail, err := service.ParseInviteToken(ctx1, someToken)
			require.NoError(t, err)
			require.Equal(t, project.PublicID, id)
			require.Equal(t, email, mail)

			someToken, err = service.CreateInviteToken(ctx1, project.PublicID, email, time.Now().Add(-360*time.Hour))
			require.NoError(t, err)
			require.NotEmpty(t, someToken)

			_, _, err = service.ParseInviteToken(ctx, someToken)
			require.Error(t, err)
			require.True(t, console.ErrTokenExpiration.Has(err))
		})

		t.Run("invite links", func(t *testing.T) {
			user, ctx1 := getUserAndCtx(t)
			user2, ctx2 := getUserAndCtx(t)

			project, err := sat.AddProject(ctx1, user.ID, "Test Project")
			require.NoError(t, err)

			_, err = service.GetInviteLink(ctx2, project.PublicID, user2.Email)
			require.Error(t, err)
			require.True(t, console.ErrNoMembership.Has(err))

			// no such project
			_, err = service.GetInviteLink(ctx1, testrand.UUID(), user2.Email)
			require.Error(t, err)
			require.ErrorIs(t, err, sql.ErrNoRows)

			// no invite exists.
			_, err = service.GetInviteLink(ctx1, project.PublicID, user2.Email)
			require.Error(t, err)
			require.True(t, console.ErrProjectInviteInvalid.Has(err))

			invite := addInvite(t, ctx1, project, user2.Email)

			someLink, err := service.GetInviteLink(ctx1, project.PublicID, user2.Email)
			require.NoError(t, err)
			require.NotEmpty(t, someLink)

			someToken, err := service.CreateInviteToken(ctx1, project.PublicID, user2.Email, invite.CreatedAt)
			require.NoError(t, err)
			require.NotEmpty(t, someToken)

			require.Contains(t, someLink, someToken)
		})

		t.Run("get invite by invite token", func(t *testing.T) {
			owner, ctx := getUserAndCtx(t)
			user, _ := getUserAndCtx(t)

			project, err := sat.AddProject(ctx, owner.ID, "Test Project")
			require.NoError(t, err)

			invite := addInvite(t, ctx, project, user.Email)

			someToken, err := service.CreateInviteToken(ctx, project.PublicID, "some@email.com", invite.CreatedAt)
			require.NoError(t, err)

			inviteFromToken, err := service.GetInviteByToken(ctx, someToken)
			require.Error(t, err)
			require.True(t, console.ErrProjectInviteInvalid.Has(err))
			require.Nil(t, inviteFromToken)

			inviteToken, err := service.CreateInviteToken(ctx, project.PublicID, user.Email, invite.CreatedAt)
			require.NoError(t, err)

			inviteFromToken, err = service.GetInviteByToken(ctx, inviteToken)
			require.NoError(t, err)
			require.NotNil(t, inviteFromToken)
			require.Equal(t, invite, inviteFromToken)

			setInviteDate(t, ctx, invite, time.Now().Add(-sat.Config.Console.ProjectInvitationExpiration))
			invites, err := service.GetUserProjectInvitations(ctx)
			require.NoError(t, err)
			require.Empty(t, invites)

			_, err = service.GetInviteByToken(ctx, inviteToken)
			require.Error(t, err)
			require.True(t, console.ErrProjectInviteInvalid.Has(err))

			// invalid project id. GetInviteByToken supports only public ids.
			someToken, err = service.CreateInviteToken(ctx, project.ID, user.Email, invite.CreatedAt)
			require.NoError(t, err)

			_, err = service.GetInviteByToken(ctx, someToken)
			require.Error(t, err)
			require.True(t, console.ErrProjectInviteInvalid.Has(err))
		})

		t.Run("accept invitation", func(t *testing.T) {
			user, ctx := getUserAndCtx(t)
			proj := addProject(t, ctx)

			invite := addInvite(t, ctx, proj, user.Email)

			// Expect an error when accepting an expired invitation.
			// The invitation should remain in the database.
			setInviteDate(t, ctx, invite, time.Now().Add(-sat.Config.Console.ProjectInvitationExpiration))
			err := service.RespondToProjectInvitation(ctx, proj.ID, console.ProjectInvitationAccept)
			require.True(t, console.ErrProjectInviteInvalid.Has(err))

			_, err = invitesDB.Get(ctx, proj.ID, user.Email)
			require.NoError(t, err)

			// Expect no error when accepting an active invitation.
			// The invitation should be removed from the database, and the user should be added as a member.
			setInviteDate(t, ctx, invite, time.Now())
			require.NoError(t, err)
			require.NoError(t, service.RespondToProjectInvitation(ctx, proj.ID, console.ProjectInvitationAccept))

			_, err = invitesDB.Get(ctx, proj.ID, user.Email)
			require.ErrorIs(t, err, sql.ErrNoRows)

			memberships, err := sat.DB.Console().ProjectMembers().GetByMemberID(ctx, user.ID)
			require.NoError(t, err)
			require.Len(t, memberships, 1)
			require.Equal(t, proj.ID, memberships[0].ProjectID)

			// Ensure that accepting an invitation for a project you are already a member of doesn't return an error.
			// This is because the outcome of the operation is the same as if you weren't a member.
			require.NoError(t, service.RespondToProjectInvitation(ctx, proj.ID, console.ProjectInvitationAccept))
			// Ensure that an error is returned if you're a member of a project whose invitation you decline.
			err = service.RespondToProjectInvitation(ctx, proj.ID, console.ProjectInvitationDecline)
			require.True(t, console.ErrAlreadyMember.Has(err))
		})

		t.Run("reject invitation", func(t *testing.T) {
			user, ctx := getUserAndCtx(t)
			proj := addProject(t, ctx)

			invite := addInvite(t, ctx, proj, user.Email)

			// Expect an error when rejecting an expired invitation.
			// The invitation should remain in the database.
			setInviteDate(t, ctx, invite, time.Now().Add(-sat.Config.Console.ProjectInvitationExpiration))
			err := service.RespondToProjectInvitation(ctx, proj.ID, console.ProjectInvitationDecline)
			require.True(t, console.ErrProjectInviteInvalid.Has(err))

			_, err = invitesDB.Get(ctx, proj.ID, user.Email)
			require.NoError(t, err)

			// Expect no error when rejecting an active invitation.
			// The invitation should be removed from the database.
			setInviteDate(t, ctx, invite, time.Now())
			require.NoError(t, err)
			require.NoError(t, service.RespondToProjectInvitation(ctx, proj.ID, console.ProjectInvitationDecline))

			_, err = invitesDB.Get(ctx, proj.ID, user.Email)
			require.ErrorIs(t, err, sql.ErrNoRows)

			memberships, err := sat.DB.Console().ProjectMembers().GetByMemberID(ctx, user.ID)
			require.NoError(t, err)
			require.Empty(t, memberships)

			// Ensure that declining an invitation for a project you are not a member of doesn't return an error.
			// This is because the outcome of the operation is the same as if you were a member.
			require.NoError(t, service.RespondToProjectInvitation(ctx, proj.ID, console.ProjectInvitationDecline))
			// Ensure that an error is returned if you try to accept an invitation that you have already declined or doesn't exist.
			err = service.RespondToProjectInvitation(ctx, proj.ID, console.ProjectInvitationAccept)
			require.True(t, console.ErrProjectInviteInvalid.Has(err))
		})

		t.Run("respond by bot account", func(t *testing.T) {
			user := addUser(t, ctx)
			botStatus := console.PendingBotVerification
			err := sat.API.DB.Console().Users().Update(ctx, user.ID, console.UpdateUserRequest{
				Status: &botStatus,
			})
			require.NoError(t, err)

			proj := addProject(t, ctx)
			_ = addInvite(t, ctx, proj, user.Email)

			userCtx, err := sat.UserContext(ctx, user.ID)
			require.NoError(t, err)

			err = service.RespondToProjectInvitation(userCtx, proj.ID, console.ProjectInvitationDecline)
			require.Error(t, err)
			require.True(t, console.ErrBotUser.Has(err))
		})
	})
}

func TestDelayedBotFreeze(t *testing.T) {
	testplanet.Run(t, testplanet.Config{
		SatelliteCount: 1,
		Reconfigure: testplanet.Reconfigure{
			Satellite: func(log *zap.Logger, index int, config *satellite.Config) {
				config.Console.Captcha.FlagBotsEnabled = true
			},
		},
	}, func(t *testing.T, ctx *testcontext.Context, planet *testplanet.Planet) {
		sat := planet.Satellites[0]
		captchaConfig := sat.Config.Console.Captcha
		accFreezeDB := sat.DB.Console().AccountFreezeEvents()

		user, err := sat.AddUser(ctx, console.CreateUser{
			FullName: "Test User",
			Email:    "test@mail.test",
		}, 1)
		require.NoError(t, err)

		user.SignupCaptcha = &captchaConfig.ScoreCutoffThreshold

		err = sat.API.Console.Service.SetAccountActive(ctx, user)
		require.NoError(t, err)

		event, err := accFreezeDB.Get(ctx, user.ID, console.DelayedBotFreeze)
		require.NoError(t, err)
		require.NotNil(t, event)
		require.GreaterOrEqual(t, *event.DaysTillEscalation, captchaConfig.MinFlagBotDelay)
		require.LessOrEqual(t, *event.DaysTillEscalation, captchaConfig.MaxFlagBotDelay)

		event, err = accFreezeDB.Get(ctx, user.ID, console.BotFreeze)
		require.True(t, errs.Is(err, sql.ErrNoRows))
		require.Nil(t, event)
	})
}