diff --git a/test/api.js b/test/api.js
index cfcf6a1aac..ec2de15503 100644
--- a/test/api.js
+++ b/test/api.js
@@ -27,650 +27,650 @@ const utils = require('../src/utils');
 const api = require('../src/api');
 
 describe('API', async () => {
-  let readApi = false;
-  let writeApi = false;
-  const readApiPath = path.resolve(__dirname, '../public/openapi/read.yaml');
-  const writeApiPath = path.resolve(__dirname, '../public/openapi/write.yaml');
-  let jar;
-  let csrfToken;
-  let setup = false;
-  const unauthenticatedRoutes = ['/api/login', '/api/register']; // Everything else will be called with the admin user
-
-  const mocks = {
-    head: {},
-    get: {
-      '/api/email/unsubscribe/{token}': [
-        {
-          in: 'path',
-          name: 'token',
-          example: (() => jwt.sign({
-            template: 'digest',
-            uid: 1,
-          }, nconf.get('secret')))(),
-        },
-      ],
-      '/api/confirm/{code}': [
-        {
-          in: 'path',
-          name: 'code',
-          example: '', // to be defined later...
-        },
-      ],
-      '/admin/tokens/{token}': [
-        {
-          in: 'path',
-          name: 'token',
-          example: '', // to be defined later...
-        },
-      ],
-    },
-    post: {
-      '/admin/tokens/{token}/roll': [
-        {
-          in: 'path',
-          name: 'token',
-          example: '', // to be defined later...
-        },
-      ],
-    },
-    put: {
-      '/groups/{slug}/pending/{uid}': [
-        {
-          in: 'path',
-          name: 'slug',
-          example: 'private-group',
-        },
-        {
-          in: 'path',
-          name: 'uid',
-          example: '', // to be defined later...
-        },
-      ],
-      '/admin/tokens/{token}': [
-        {
-          in: 'path',
-          name: 'token',
-          example: '', // to be defined later...
-        },
-      ],
-    },
-    patch: {},
-    delete: {
-      '/users/{uid}/tokens/{token}': [
-        {
-          in: 'path',
-          name: 'uid',
-          example: 1,
-        },
-        {
-          in: 'path',
-          name: 'token',
-          example: utils.generateUUID(),
-        },
-      ],
-      '/users/{uid}/sessions/{uuid}': [
-        {
-          in: 'path',
-          name: 'uid',
-          example: 1,
-        },
-        {
-          in: 'path',
-          name: 'uuid',
-          example: '', // to be defined below...
-        },
-      ],
-      '/posts/{pid}/diffs/{timestamp}': [
-        {
-          in: 'path',
-          name: 'pid',
-          example: '', // to be defined below...
-        },
-        {
-          in: 'path',
-          name: 'timestamp',
-          example: '', // to be defined below...
-        },
-      ],
-      '/groups/{slug}/pending/{uid}': [
-        {
-          in: 'path',
-          name: 'slug',
-          example: 'private-group',
-        },
-        {
-          in: 'path',
-          name: 'uid',
-          example: '', // to be defined later...
-        },
-      ],
-      '/groups/{slug}/invites/{uid}': [
-        {
-          in: 'path',
-          name: 'slug',
-          example: 'invitations-only',
-        },
-        {
-          in: 'path',
-          name: 'uid',
-          example: '', // to be defined later...
-        },
-      ],
-      '/admin/tokens/{token}': [
-        {
-          in: 'path',
-          name: 'token',
-          example: '', // to be defined later...
-        },
-      ],
-    },
-  };
-
-  async function dummySearchHook(data) {
-    return [1];
-  }
-  async function dummyEmailerHook(data) {
-    // pretend to handle sending emails
-  }
-
-  after(async () => {
-    plugins.hooks.unregister('core', 'filter:search.query', dummySearchHook);
-    plugins.hooks.unregister('emailer-test', 'static:email.send');
-  });
-
-  async function setupData() {
-    if (setup) {
-      return;
-    }
-
-    // Create sample users
-    const adminUid = await user.create({ username: 'admin', password: '123456' });
-    const unprivUid = await user.create({ username: 'unpriv', password: '123456' });
-    const emailConfirmationUid = await user.create({ username: 'emailConf', email: 'emailConf@example.org' });
-    await user.setUserField(adminUid, 'email', 'test@example.org');
-    await user.setUserField(unprivUid, 'email', 'unpriv@example.org');
-    await user.email.confirmByUid(adminUid);
-    await user.email.confirmByUid(unprivUid);
-    mocks.get['/api/confirm/{code}'][0].example = await db.get(`confirm:byUid:${emailConfirmationUid}`);
-
-    for (let x = 0; x < 4; x++) {
-      // eslint-disable-next-line no-await-in-loop
-      await user.create({ username: 'deleteme', password: '123456' }); // for testing of DELETE /users (uids 5, 6) and DELETE /user/:uid/account (uid 7)
-    }
-    await groups.join('administrators', adminUid);
-
-    // Create api token for testing read/updating/deletion
-    const token = await api.utils.tokens.generate({ uid: adminUid });
-    mocks.get['/admin/tokens/{token}'][0].example = token;
-    mocks.put['/admin/tokens/{token}'][0].example = token;
-    mocks.delete['/admin/tokens/{token}'][0].example = token;
-
-    // Create another token for testing rolling
-    const token2 = await api.utils.tokens.generate({ uid: adminUid });
-    mocks.post['/admin/tokens/{token}/roll'][0].example = token2;
-
-    // Create sample group
-    await groups.create({
-      name: 'Test Group',
-    });
-
-    // Create private groups for pending/invitations
-    const [pending1, pending2, inviteUid] = await Promise.all([
-      await user.create({ username: utils.generateUUID().slice(0, 8) }),
-      await user.create({ username: utils.generateUUID().slice(0, 8) }),
-      await user.create({ username: utils.generateUUID().slice(0, 8) }),
-    ]);
-    mocks.put['/groups/{slug}/pending/{uid}'][1].example = pending1;
-    mocks.delete['/groups/{slug}/pending/{uid}'][1].example = pending2;
-    mocks.delete['/groups/{slug}/invites/{uid}'][1].example = inviteUid;
-    await Promise.all(['private-group', 'invitations-only'].map(async (name) => {
-      await groups.create({ name, private: true });
-    }));
-    await groups.requestMembership('private-group', pending1);
-    await groups.requestMembership('private-group', pending2);
-    await groups.invite('invitations-only', inviteUid);
-
-    await meta.settings.set('core.api', {
-      tokens: [{
-        token: mocks.delete['/users/{uid}/tokens/{token}'][1].example,
-        uid: 1,
-        description: 'for testing of token deletion route',
-        timestamp: Date.now(),
-      }],
-    });
-    meta.config.allowTopicsThumbnail = 1;
-    meta.config.termsOfUse = 'I, for one, welcome our new test-driven overlords';
-    meta.config.chatMessageDelay = 0;
-
-    // Create a category
-    const testCategory = await categories.create({ name: 'test' });
-
-    // Post a new topic
-    await topics.post({
-      uid: adminUid,
-      cid: testCategory.cid,
-      title: 'Test Topic',
-      content: 'Test topic content',
-    });
-    const unprivTopic = await topics.post({
-      uid: unprivUid,
-      cid: testCategory.cid,
-      title: 'Test Topic 2',
-      content: 'Test topic 2 content',
-    });
-    await topics.post({
-      uid: unprivUid,
-      cid: testCategory.cid,
-      title: 'Test Topic 3',
-      content: 'Test topic 3 content',
-    });
-
-    // Create a post diff
-    await posts.edit({
-      uid: adminUid,
-      pid: unprivTopic.postData.pid,
-      content: 'Test topic 2 edited content',
-      req: {},
-    });
-    mocks.delete['/posts/{pid}/diffs/{timestamp}'][0].example = unprivTopic.postData.pid;
-    mocks.delete['/posts/{pid}/diffs/{timestamp}'][1].example = (await posts.diffs.list(unprivTopic.postData.pid))[0];
-
-    // Create a sample flag
-    const { flagId } = await flags.create('post', 1, unprivUid, 'sample reasons', Date.now()); // deleted in DELETE /api/v3/flags/1
-    await flags.appendNote(flagId, 1, 'test note', 1626446956652);
-    await flags.create('post', 2, unprivUid, 'sample reasons', Date.now()); // for testing flag notes (since flag 1 deleted)
-
-    // Create a new chat room
-    await messaging.newRoom(adminUid, { uids: [unprivUid] });
-
-    // Create an empty file to test DELETE /files and thumb deletion
-    fs.closeSync(fs.openSync(path.resolve(nconf.get('upload_path'), 'files/test.txt'), 'w'));
-    fs.closeSync(fs.openSync(path.resolve(nconf.get('upload_path'), 'files/test.png'), 'w'));
-
-    // Associate thumb with topic to test thumb reordering
-    await topics.thumbs.associate({
-      id: 2,
-      path: 'files/test.png',
-    });
-
-    const socketAdmin = require('../src/socket.io/admin');
-    await Promise.all(['profile', 'posts', 'uploads'].map(async type => api.users.generateExport({ uid: adminUid }, { uid: adminUid, type })));
-    await socketAdmin.user.exportUsersCSV({ uid: adminUid }, {});
-    // wait for export child processes to complete
-    await wait(5000);
-
-    // Attach a search hook so /api/search is enabled
-    plugins.hooks.register('core', {
-      hook: 'filter:search.query',
-      method: dummySearchHook,
-    });
-    // Attach an emailer hook so related requests do not error
-    plugins.hooks.register('emailer-test', {
-      hook: 'static:email.send',
-      method: dummyEmailerHook,
-    });
-
-    // All tests run as admin user
-    ({ jar } = await helpers.loginUser('admin', '123456'));
-
-    // Retrieve CSRF token using cookie, to test Write API
-    csrfToken = await helpers.getCsrfToken(jar);
-
-    setup = true;
-  }
-
-  it('should pass OpenAPI v3 validation', async () => {
-    try {
-      await SwaggerParser.validate(readApiPath);
-      await SwaggerParser.validate(writeApiPath);
-    } catch (e) {
-      assert.ifError(e);
-    }
-  });
-
-  readApi = await SwaggerParser.dereference(readApiPath);
-  writeApi = await SwaggerParser.dereference(writeApiPath);
-
-  it('should grab all mounted routes and ensure a schema exists', async () => {
-    const webserver = require('../src/webserver');
-    const buildPaths = function (stack, prefix) {
-      const paths = stack.map((dispatch) => {
-        if (dispatch.route && dispatch.route.path && typeof dispatch.route.path === 'string') {
-          if (!prefix && !dispatch.route.path.startsWith('/api/')) {
-            return null;
-          }
-
-          if (prefix === nconf.get('relative_path')) {
-            prefix = '';
-          }
-
-          return {
-            method: Object.keys(dispatch.route.methods)[0],
-            path: (prefix || '') + dispatch.route.path,
-          };
-        } else if (dispatch.name === 'router') {
-          const prefix = dispatch.regexp.toString().replace('/^', '').replace('\\/?(?=\\/|$)/i', '').replace(/\\\//g, '/');
-          return buildPaths(dispatch.handle.stack, prefix);
-        }
-
-        // Drop any that aren't actual routes (middlewares, error handlers, etc.)
-        return null;
-      });
-
-      return _.flatten(paths);
-    };
-
-    let paths = buildPaths(webserver.app._router.stack).filter(Boolean).map((pathObj) => {
-      pathObj.path = pathObj.path.replace(/\/:([^\\/]+)/g, '/{$1}');
-      return pathObj;
-    });
-    const exclusionPrefixes = [
-      '/api/admin/plugins', '/api/compose', '/debug',
-      '/api/user/{userslug}/theme', // from persona
-    ];
-    paths = paths.filter(path => path.method !== '_all' && !exclusionPrefixes.some(prefix => path.path.startsWith(prefix)));
-
-
-    // For each express path, query for existence in read and write api schemas
-    paths.forEach((pathObj) => {
-      describe(`${pathObj.method.toUpperCase()} ${pathObj.path}`, () => {
-        it('should be defined in schema docs', () => {
-          let schema = readApi;
-          if (pathObj.path.startsWith('/api/v3')) {
-            schema = writeApi;
-            pathObj.path = pathObj.path.replace('/api/v3', '');
-          }
-
-          // Don't check non-GET routes in Read API
-          if (schema === readApi && pathObj.method !== 'get') {
-            return;
-          }
-
-          const normalizedPath = pathObj.path.replace(/\/:([^\\/]+)/g, '/{$1}').replace(/\?/g, '');
-          assert(schema.paths.hasOwnProperty(normalizedPath), `${pathObj.path} is not defined in schema docs`);
-          assert(schema.paths[normalizedPath].hasOwnProperty(pathObj.method), `${pathObj.path} was found in schema docs, but ${pathObj.method.toUpperCase()} method is not defined`);
-        });
-      });
-    });
-  });
-
-  generateTests(readApi, Object.keys(readApi.paths));
-  generateTests(writeApi, Object.keys(writeApi.paths), writeApi.servers[0].url);
-
-  function generateTests(api, paths, prefix) {
-    // Iterate through all documented paths, make a call to it,
-    // and compare the result body with what is defined in the spec
-    const pathLib = path; // for calling path module from inside this forEach
-    paths.forEach((path) => {
-      const context = api.paths[path];
-      let schema;
-      let result;
-      let url;
-      let method;
-      const headers = {};
-      const qs = {};
-
-      Object.keys(context).forEach((_method) => {
-        // Only test GET routes in the Read API
-        if (api.info.title === 'NodeBB Read API' && _method !== 'get') {
-          return;
-        }
-
-        it('should have each path parameter defined in its context', () => {
-          method = _method;
-          if (!context[method].parameters) {
-            return;
-          }
-
-          const pathParams = (path.match(/{[\w\-_*]+}?/g) || []).map(match => match.slice(1, -1));
-          const schemaParams = context[method].parameters.map(param => (param.in === 'path' ? param.name : null)).filter(Boolean);
-          assert(pathParams.every(param => schemaParams.includes(param)), `${method.toUpperCase()} ${path} has path parameters specified but not defined`);
-        });
-
-        it('should have examples when parameters are present', () => {
-          let { parameters } = context[method];
-          let testPath = path;
-
-          if (parameters) {
-            // Use mock data if provided
-            parameters = mocks[method][path] || parameters;
-
-            parameters.forEach((param) => {
-              assert(param.example !== null && param.example !== undefined, `${method.toUpperCase()} ${path} has parameters without examples`);
-
-              switch (param.in) {
-                case 'path':
-                  testPath = testPath.replace(`{${param.name}}`, param.example);
-                  break;
-                case 'header':
-                  headers[param.name] = param.example;
-                  break;
-                case 'query':
-                  qs[param.name] = param.example;
-                  break;
-              }
-            });
-          }
-
-          url = nconf.get('url') + (prefix || '') + testPath;
-        });
-
-        it('should contain a valid request body (if present) with application/json or multipart/form-data type if POST/PUT/DELETE', () => {
-          if (['post', 'put', 'delete'].includes(method) && context[method].hasOwnProperty('requestBody')) {
-            const failMessage = `${method.toUpperCase()} ${path} has a malformed request body`;
-            assert(context[method].requestBody, failMessage);
-            assert(context[method].requestBody.content, failMessage);
-
-            if (context[method].requestBody.content.hasOwnProperty('application/json')) {
-              assert(context[method].requestBody.content['application/json'], failMessage);
-              assert(context[method].requestBody.content['application/json'].schema, failMessage);
-              assert(context[method].requestBody.content['application/json'].schema.properties, failMessage);
-            } else if (context[method].requestBody.content.hasOwnProperty('multipart/form-data')) {
-              assert(context[method].requestBody.content['multipart/form-data'], failMessage);
-              assert(context[method].requestBody.content['multipart/form-data'].schema, failMessage);
-              assert(context[method].requestBody.content['multipart/form-data'].schema.properties, failMessage);
-            }
-          }
-        });
-
-        it('should not error out when called', async () => {
-          await setupData();
-
-          if (csrfToken) {
-            headers['x-csrf-token'] = csrfToken;
-          }
-
-          let body = {};
-          let type = 'json';
-          if (
-            context[method].hasOwnProperty('requestBody') &&
-            context[method].requestBody.required !== false &&
-            context[method].requestBody.content['application/json']) {
-            body = buildBody(context[method].requestBody.content['application/json'].schema.properties);
-          } else if (context[method].hasOwnProperty('requestBody') && context[method].requestBody.content['multipart/form-data']) {
-            type = 'form';
-          }
-
-          try {
-            if (type === 'json') {
-              const searchParams = new URLSearchParams(qs);
-              result = await request[method](`${url}?${searchParams}`, {
-                jar: !unauthenticatedRoutes.includes(path) ? jar : undefined,
-                maxRedirect: 0,
-                redirect: 'manual',
-                headers: headers,
-                body: body,
-              });
-            } else if (type === 'form') {
-              result = await helpers.uploadFile(url, pathLib.join(__dirname, './files/test.png'), {}, jar, csrfToken);
-            }
-          } catch (e) {
-            assert(!e, `${method.toUpperCase()} ${path} errored with: ${e.message}`);
-          }
-        });
-
-        it('response status code should match one of the schema defined responses', () => {
-          // HACK: allow HTTP 418 I am a teapot, for now   👇
-          const { responses } = context[method];
-          assert(
-            responses.hasOwnProperty('418') ||
-            Object.keys(responses).includes(String(result.response.statusCode)),
-            `${method.toUpperCase()} ${path} sent back unexpected HTTP status code: ${result.response.statusCode}`
-          );
-        });
-
-        // Recursively iterate through schema properties, comparing type
-        it('response body should match schema definition', () => {
-          const http302 = context[method].responses['302'];
-          if (http302 && result.response.statusCode === 302) {
-            // Compare headers instead
-            const expectedHeaders = Object.keys(http302.headers).reduce((memo, name) => {
-              const value = http302.headers[name].schema.example;
-              memo[name] = value.startsWith(nconf.get('relative_path')) ? value : nconf.get('relative_path') + value;
-              return memo;
-            }, {});
-
-            for (const header of Object.keys(expectedHeaders)) {
-              assert(result.response.headers[header.toLowerCase()]);
-              assert.strictEqual(result.response.headers[header.toLowerCase()], expectedHeaders[header]);
-            }
-            return;
-          }
-
-          if (result.response.statusCode === 400 && context[method].responses['400']) {
-            // TODO: check 400 schema to response.body?
-            return;
-          }
-
-          const http200 = context[method].responses['200'];
-          if (!http200) {
-            return;
-          }
-
-          assert.strictEqual(result.response.statusCode, 200, `HTTP 200 expected (path: ${method} ${path}`);
-
-          const hasJSON = http200.content && http200.content['application/json'];
-          if (hasJSON) {
-            schema = context[method].responses['200'].content['application/json'].schema;
-            compare(schema, result.body, method.toUpperCase(), path, 'root');
-          }
-
-          // TODO someday: text/csv, binary file type checking?
-        });
-
-        it('should successfully re-login if needed', async () => {
-          const reloginPaths = ['GET /api/user/{userslug}/edit/email', 'PUT /users/{uid}/password', 'DELETE /users/{uid}/sessions/{uuid}'];
-          if (reloginPaths.includes(`${method.toUpperCase()} ${path}`)) {
-            ({ jar } = await helpers.loginUser('admin', '123456'));
-            const sessionIds = await db.getSortedSetRange('uid:1:sessions', 0, -1);
-            const sessObj = await db.sessionStoreGet(sessionIds[0]);
-            const { uuid } = sessObj.meta;
-            mocks.delete['/users/{uid}/sessions/{uuid}'][1].example = uuid;
-
-            // Retrieve CSRF token using cookie, to test Write API
-            csrfToken = await helpers.getCsrfToken(jar);
-          }
-        });
-      });
-    });
-  }
-
-  function buildBody(schema) {
-    return Object.keys(schema).reduce((memo, cur) => {
-      memo[cur] = schema[cur].example;
-      return memo;
-    }, {});
-  }
-
-  function compare(schema, response, method, path, context) {
-    let required = [];
-    const additionalProperties = schema.hasOwnProperty('additionalProperties');
-
-    function flattenAllOf(obj) {
-      return obj.reduce((memo, obj) => {
-        if (obj.allOf) {
-          obj = { properties: flattenAllOf(obj.allOf) };
-        } else {
-          try {
-            required = required.concat(obj.required ? obj.required : Object.keys(obj.properties));
-          } catch (e) {
-            assert.fail(`Syntax error re: allOf, perhaps you allOf'd an array? (path: ${method} ${path}, context: ${context})`);
-          }
-        }
-
-        return { ...memo, ...obj.properties };
-      }, {});
-    }
-
-    if (schema.allOf) {
-      schema = flattenAllOf(schema.allOf);
-    } else if (schema.properties) {
-      required = schema.required || Object.keys(schema.properties);
-      schema = schema.properties;
-    } else {
-      // If schema contains no properties, check passes
-      return;
-    }
-
-    // Compare the schema to the response
-    required.forEach((prop) => {
-      if (schema.hasOwnProperty(prop)) {
-        assert(response.hasOwnProperty(prop), `"${prop}" is a required property (path: ${method} ${path}, context: ${context})`);
-
-        // Don't proceed with type-check if the value could possibly be unset (nullable: true, in spec)
-        if (response[prop] === null && schema[prop].nullable === true) {
-          return;
-        }
-
-        // Therefore, if the value is actually null, that's a problem (nullable is probably missing)
-        assert(response[prop] !== null, `"${prop}" was null, but schema does not specify it to be a nullable property (path: ${method} ${path}, context: ${context})`);
-
-        switch (schema[prop].type) {
-          case 'string':
-            assert.strictEqual(typeof response[prop], 'string', `"${prop}" was expected to be a string, but was ${typeof response[prop]} instead (path: ${method} ${path}, context: ${context})`);
-            break;
-          case 'boolean':
-            assert.strictEqual(typeof response[prop], 'boolean', `"${prop}" was expected to be a boolean, but was ${typeof response[prop]} instead (path: ${method} ${path}, context: ${context})`);
-            break;
-          case 'object':
-            assert.strictEqual(typeof response[prop], 'object', `"${prop}" was expected to be an object, but was ${typeof response[prop]} instead (path: ${method} ${path}, context: ${context})`);
-            compare(schema[prop], response[prop], method, path, context ? [context, prop].join('.') : prop);
-            break;
-          case 'array':
-            assert.strictEqual(Array.isArray(response[prop]), true, `"${prop}" was expected to be an array, but was ${typeof response[prop]} instead (path: ${method} ${path}, context: ${context})`);
-
-            if (schema[prop].items) {
-              // Ensure the array items have a schema defined
-              assert(schema[prop].items.type || schema[prop].items.allOf || schema[prop].items.anyOf || schema[prop].items.oneOf, `"${prop}" is defined to be an array, but its items have no schema defined (path: ${method} ${path}, context: ${context})`);
-
-              // Compare types
-              if (schema[prop].items.type === 'object' || Array.isArray(schema[prop].items.allOf || schema[prop].items.anyOf || schema[prop].items.oneOf)) {
-                response[prop].forEach((res) => {
-                  compare(schema[prop].items, res, method, path, context ? [context, prop].join('.') : prop);
-                });
-              } else if (response[prop].length) { // for now
-                response[prop].forEach((item) => {
-                  assert.strictEqual(typeof item, schema[prop].items.type, `"${prop}" should have ${schema[prop].items.type} items, but found ${typeof items} instead (path: ${method} ${path}, context: ${context})`);
-                });
-              }
-            }
-            break;
-        }
-      }
-    });
-
-    // Compare the response to the schema
-    Object.keys(response).forEach((prop) => {
-      if (additionalProperties) { // All bets are off
-        return;
-      }
-
-      // Define a whitelist of properties allowed in the response even if not in the schema
-      const allowedAdditionalProps = ['isEnglish', 'translatedContent']; // Add properties that you expect but are not in the schema
-
-      if (!schema[prop] && !allowedAdditionalProps.includes(prop)) {
-        assert.fail(`"${prop}" was found in response, but is not defined in schema (path: ${method} ${path}, context: ${context})`);
-      }
-    });
-  }
+	let readApi = false;
+	let writeApi = false;
+	const readApiPath = path.resolve(__dirname, '../public/openapi/read.yaml');
+	const writeApiPath = path.resolve(__dirname, '../public/openapi/write.yaml');
+	let jar;
+	let csrfToken;
+	let setup = false;
+	const unauthenticatedRoutes = ['/api/login', '/api/register']; // Everything else will be called with the admin user
+
+	const mocks = {
+		head: {},
+		get: {
+			'/api/email/unsubscribe/{token}': [
+				{
+					in: 'path',
+					name: 'token',
+					example: (() => jwt.sign({
+						template: 'digest',
+						uid: 1,
+					}, nconf.get('secret')))(),
+				},
+			],
+			'/api/confirm/{code}': [
+				{
+					in: 'path',
+					name: 'code',
+					example: '', // to be defined later...
+				},
+			],
+			'/admin/tokens/{token}': [
+				{
+					in: 'path',
+					name: 'token',
+					example: '', // to be defined later...
+				},
+			],
+		},
+		post: {
+			'/admin/tokens/{token}/roll': [
+				{
+					in: 'path',
+					name: 'token',
+					example: '', // to be defined later...
+				},
+			],
+		},
+		put: {
+			'/groups/{slug}/pending/{uid}': [
+				{
+					in: 'path',
+					name: 'slug',
+					example: 'private-group',
+				},
+				{
+					in: 'path',
+					name: 'uid',
+					example: '', // to be defined later...
+				},
+			],
+			'/admin/tokens/{token}': [
+				{
+					in: 'path',
+					name: 'token',
+					example: '', // to be defined later...
+				},
+			],
+		},
+		patch: {},
+		delete: {
+			'/users/{uid}/tokens/{token}': [
+				{
+					in: 'path',
+					name: 'uid',
+					example: 1,
+				},
+				{
+					in: 'path',
+					name: 'token',
+					example: utils.generateUUID(),
+				},
+			],
+			'/users/{uid}/sessions/{uuid}': [
+				{
+					in: 'path',
+					name: 'uid',
+					example: 1,
+				},
+				{
+					in: 'path',
+					name: 'uuid',
+					example: '', // to be defined below...
+				},
+			],
+			'/posts/{pid}/diffs/{timestamp}': [
+				{
+					in: 'path',
+					name: 'pid',
+					example: '', // to be defined below...
+				},
+				{
+					in: 'path',
+					name: 'timestamp',
+					example: '', // to be defined below...
+				},
+			],
+			'/groups/{slug}/pending/{uid}': [
+				{
+					in: 'path',
+					name: 'slug',
+					example: 'private-group',
+				},
+				{
+					in: 'path',
+					name: 'uid',
+					example: '', // to be defined later...
+				},
+			],
+			'/groups/{slug}/invites/{uid}': [
+				{
+					in: 'path',
+					name: 'slug',
+					example: 'invitations-only',
+				},
+				{
+					in: 'path',
+					name: 'uid',
+					example: '', // to be defined later...
+				},
+			],
+			'/admin/tokens/{token}': [
+				{
+					in: 'path',
+					name: 'token',
+					example: '', // to be defined later...
+				},
+			],
+		},
+	};
+
+	async function dummySearchHook(data) {
+		return [1];
+	}
+	async function dummyEmailerHook(data) {
+		// pretend to handle sending emails
+	}
+
+	after(async () => {
+		plugins.hooks.unregister('core', 'filter:search.query', dummySearchHook);
+		plugins.hooks.unregister('emailer-test', 'static:email.send');
+	});
+
+	async function setupData() {
+		if (setup) {
+			return;
+		}
+
+		// Create sample users
+		const adminUid = await user.create({ username: 'admin', password: '123456' });
+		const unprivUid = await user.create({ username: 'unpriv', password: '123456' });
+		const emailConfirmationUid = await user.create({ username: 'emailConf', email: 'emailConf@example.org' });
+		await user.setUserField(adminUid, 'email', 'test@example.org');
+		await user.setUserField(unprivUid, 'email', 'unpriv@example.org');
+		await user.email.confirmByUid(adminUid);
+		await user.email.confirmByUid(unprivUid);
+		mocks.get['/api/confirm/{code}'][0].example = await db.get(`confirm:byUid:${emailConfirmationUid}`);
+
+		for (let x = 0; x < 4; x++) {
+			// eslint-disable-next-line no-await-in-loop
+			await user.create({ username: 'deleteme', password: '123456' }); // for testing of DELETE /users (uids 5, 6) and DELETE /user/:uid/account (uid 7)
+		}
+		await groups.join('administrators', adminUid);
+
+		// Create api token for testing read/updating/deletion
+		const token = await api.utils.tokens.generate({ uid: adminUid });
+		mocks.get['/admin/tokens/{token}'][0].example = token;
+		mocks.put['/admin/tokens/{token}'][0].example = token;
+		mocks.delete['/admin/tokens/{token}'][0].example = token;
+
+		// Create another token for testing rolling
+		const token2 = await api.utils.tokens.generate({ uid: adminUid });
+		mocks.post['/admin/tokens/{token}/roll'][0].example = token2;
+
+		// Create sample group
+		await groups.create({
+			name: 'Test Group',
+		});
+
+		// Create private groups for pending/invitations
+		const [pending1, pending2, inviteUid] = await Promise.all([
+			await user.create({ username: utils.generateUUID().slice(0, 8) }),
+			await user.create({ username: utils.generateUUID().slice(0, 8) }),
+			await user.create({ username: utils.generateUUID().slice(0, 8) }),
+		]);
+		mocks.put['/groups/{slug}/pending/{uid}'][1].example = pending1;
+		mocks.delete['/groups/{slug}/pending/{uid}'][1].example = pending2;
+		mocks.delete['/groups/{slug}/invites/{uid}'][1].example = inviteUid;
+		await Promise.all(['private-group', 'invitations-only'].map(async (name) => {
+			await groups.create({ name, private: true });
+		}));
+		await groups.requestMembership('private-group', pending1);
+		await groups.requestMembership('private-group', pending2);
+		await groups.invite('invitations-only', inviteUid);
+
+		await meta.settings.set('core.api', {
+			tokens: [{
+				token: mocks.delete['/users/{uid}/tokens/{token}'][1].example,
+				uid: 1,
+				description: 'for testing of token deletion route',
+				timestamp: Date.now(),
+			}],
+		});
+		meta.config.allowTopicsThumbnail = 1;
+		meta.config.termsOfUse = 'I, for one, welcome our new test-driven overlords';
+		meta.config.chatMessageDelay = 0;
+
+		// Create a category
+		const testCategory = await categories.create({ name: 'test' });
+
+		// Post a new topic
+		await topics.post({
+			uid: adminUid,
+			cid: testCategory.cid,
+			title: 'Test Topic',
+			content: 'Test topic content',
+		});
+		const unprivTopic = await topics.post({
+			uid: unprivUid,
+			cid: testCategory.cid,
+			title: 'Test Topic 2',
+			content: 'Test topic 2 content',
+		});
+		await topics.post({
+			uid: unprivUid,
+			cid: testCategory.cid,
+			title: 'Test Topic 3',
+			content: 'Test topic 3 content',
+		});
+
+		// Create a post diff
+		await posts.edit({
+			uid: adminUid,
+			pid: unprivTopic.postData.pid,
+			content: 'Test topic 2 edited content',
+			req: {},
+		});
+		mocks.delete['/posts/{pid}/diffs/{timestamp}'][0].example = unprivTopic.postData.pid;
+		mocks.delete['/posts/{pid}/diffs/{timestamp}'][1].example = (await posts.diffs.list(unprivTopic.postData.pid))[0];
+
+		// Create a sample flag
+		const { flagId } = await flags.create('post', 1, unprivUid, 'sample reasons', Date.now()); // deleted in DELETE /api/v3/flags/1
+		await flags.appendNote(flagId, 1, 'test note', 1626446956652);
+		await flags.create('post', 2, unprivUid, 'sample reasons', Date.now()); // for testing flag notes (since flag 1 deleted)
+
+		// Create a new chat room
+		await messaging.newRoom(adminUid, { uids: [unprivUid] });
+
+		// Create an empty file to test DELETE /files and thumb deletion
+		fs.closeSync(fs.openSync(path.resolve(nconf.get('upload_path'), 'files/test.txt'), 'w'));
+		fs.closeSync(fs.openSync(path.resolve(nconf.get('upload_path'), 'files/test.png'), 'w'));
+
+		// Associate thumb with topic to test thumb reordering
+		await topics.thumbs.associate({
+			id: 2,
+			path: 'files/test.png',
+		});
+
+		const socketAdmin = require('../src/socket.io/admin');
+		await Promise.all(['profile', 'posts', 'uploads'].map(async type => api.users.generateExport({ uid: adminUid }, { uid: adminUid, type })));
+		await socketAdmin.user.exportUsersCSV({ uid: adminUid }, {});
+		// wait for export child processes to complete
+		await wait(5000);
+
+		// Attach a search hook so /api/search is enabled
+		plugins.hooks.register('core', {
+			hook: 'filter:search.query',
+			method: dummySearchHook,
+		});
+		// Attach an emailer hook so related requests do not error
+		plugins.hooks.register('emailer-test', {
+			hook: 'static:email.send',
+			method: dummyEmailerHook,
+		});
+
+		// All tests run as admin user
+		({ jar } = await helpers.loginUser('admin', '123456'));
+
+		// Retrieve CSRF token using cookie, to test Write API
+		csrfToken = await helpers.getCsrfToken(jar);
+
+		setup = true;
+	}
+
+	it('should pass OpenAPI v3 validation', async () => {
+		try {
+			await SwaggerParser.validate(readApiPath);
+			await SwaggerParser.validate(writeApiPath);
+		} catch (e) {
+			assert.ifError(e);
+		}
+	});
+
+	readApi = await SwaggerParser.dereference(readApiPath);
+	writeApi = await SwaggerParser.dereference(writeApiPath);
+
+	it('should grab all mounted routes and ensure a schema exists', async () => {
+		const webserver = require('../src/webserver');
+		const buildPaths = function (stack, prefix) {
+			const paths = stack.map((dispatch) => {
+				if (dispatch.route && dispatch.route.path && typeof dispatch.route.path === 'string') {
+					if (!prefix && !dispatch.route.path.startsWith('/api/')) {
+						return null;
+					}
+
+					if (prefix === nconf.get('relative_path')) {
+						prefix = '';
+					}
+
+					return {
+						method: Object.keys(dispatch.route.methods)[0],
+						path: (prefix || '') + dispatch.route.path,
+					};
+				} else if (dispatch.name === 'router') {
+					const prefix = dispatch.regexp.toString().replace('/^', '').replace('\\/?(?=\\/|$)/i', '').replace(/\\\//g, '/');
+					return buildPaths(dispatch.handle.stack, prefix);
+				}
+
+				// Drop any that aren't actual routes (middlewares, error handlers, etc.)
+				return null;
+			});
+
+			return _.flatten(paths);
+		};
+
+		let paths = buildPaths(webserver.app._router.stack).filter(Boolean).map((pathObj) => {
+			pathObj.path = pathObj.path.replace(/\/:([^\\/]+)/g, '/{$1}');
+			return pathObj;
+		});
+		const exclusionPrefixes = [
+			'/api/admin/plugins', '/api/compose', '/debug',
+			'/api/user/{userslug}/theme', // from persona
+		];
+		paths = paths.filter(path => path.method !== '_all' && !exclusionPrefixes.some(prefix => path.path.startsWith(prefix)));
+
+
+		// For each express path, query for existence in read and write api schemas
+		paths.forEach((pathObj) => {
+			describe(`${pathObj.method.toUpperCase()} ${pathObj.path}`, () => {
+				it('should be defined in schema docs', () => {
+					let schema = readApi;
+					if (pathObj.path.startsWith('/api/v3')) {
+						schema = writeApi;
+						pathObj.path = pathObj.path.replace('/api/v3', '');
+					}
+
+					// Don't check non-GET routes in Read API
+					if (schema === readApi && pathObj.method !== 'get') {
+						return;
+					}
+
+					const normalizedPath = pathObj.path.replace(/\/:([^\\/]+)/g, '/{$1}').replace(/\?/g, '');
+					assert(schema.paths.hasOwnProperty(normalizedPath), `${pathObj.path} is not defined in schema docs`);
+					assert(schema.paths[normalizedPath].hasOwnProperty(pathObj.method), `${pathObj.path} was found in schema docs, but ${pathObj.method.toUpperCase()} method is not defined`);
+				});
+			});
+		});
+	});
+
+	generateTests(readApi, Object.keys(readApi.paths));
+	generateTests(writeApi, Object.keys(writeApi.paths), writeApi.servers[0].url);
+
+	function generateTests(api, paths, prefix) {
+		// Iterate through all documented paths, make a call to it,
+		// and compare the result body with what is defined in the spec
+		const pathLib = path; // for calling path module from inside this forEach
+		paths.forEach((path) => {
+			const context = api.paths[path];
+			let schema;
+			let result;
+			let url;
+			let method;
+			const headers = {};
+			const qs = {};
+
+			Object.keys(context).forEach((_method) => {
+				// Only test GET routes in the Read API
+				if (api.info.title === 'NodeBB Read API' && _method !== 'get') {
+					return;
+				}
+
+				it('should have each path parameter defined in its context', () => {
+					method = _method;
+					if (!context[method].parameters) {
+						return;
+					}
+
+					const pathParams = (path.match(/{[\w\-_*]+}?/g) || []).map(match => match.slice(1, -1));
+					const schemaParams = context[method].parameters.map(param => (param.in === 'path' ? param.name : null)).filter(Boolean);
+					assert(pathParams.every(param => schemaParams.includes(param)), `${method.toUpperCase()} ${path} has path parameters specified but not defined`);
+				});
+
+				it('should have examples when parameters are present', () => {
+					let { parameters } = context[method];
+					let testPath = path;
+
+					if (parameters) {
+						// Use mock data if provided
+						parameters = mocks[method][path] || parameters;
+
+						parameters.forEach((param) => {
+							assert(param.example !== null && param.example !== undefined, `${method.toUpperCase()} ${path} has parameters without examples`);
+
+							switch (param.in) {
+								case 'path':
+									testPath = testPath.replace(`{${param.name}}`, param.example);
+									break;
+								case 'header':
+									headers[param.name] = param.example;
+									break;
+								case 'query':
+									qs[param.name] = param.example;
+									break;
+							}
+						});
+					}
+
+					url = nconf.get('url') + (prefix || '') + testPath;
+				});
+
+				it('should contain a valid request body (if present) with application/json or multipart/form-data type if POST/PUT/DELETE', () => {
+					if (['post', 'put', 'delete'].includes(method) && context[method].hasOwnProperty('requestBody')) {
+						const failMessage = `${method.toUpperCase()} ${path} has a malformed request body`;
+						assert(context[method].requestBody, failMessage);
+						assert(context[method].requestBody.content, failMessage);
+
+						if (context[method].requestBody.content.hasOwnProperty('application/json')) {
+							assert(context[method].requestBody.content['application/json'], failMessage);
+							assert(context[method].requestBody.content['application/json'].schema, failMessage);
+							assert(context[method].requestBody.content['application/json'].schema.properties, failMessage);
+						} else if (context[method].requestBody.content.hasOwnProperty('multipart/form-data')) {
+							assert(context[method].requestBody.content['multipart/form-data'], failMessage);
+							assert(context[method].requestBody.content['multipart/form-data'].schema, failMessage);
+							assert(context[method].requestBody.content['multipart/form-data'].schema.properties, failMessage);
+						}
+					}
+				});
+
+				it('should not error out when called', async () => {
+					await setupData();
+
+					if (csrfToken) {
+						headers['x-csrf-token'] = csrfToken;
+					}
+
+					let body = {};
+					let type = 'json';
+					if (
+						context[method].hasOwnProperty('requestBody') &&
+						context[method].requestBody.required !== false &&
+						context[method].requestBody.content['application/json']) {
+						body = buildBody(context[method].requestBody.content['application/json'].schema.properties);
+					} else if (context[method].hasOwnProperty('requestBody') && context[method].requestBody.content['multipart/form-data']) {
+						type = 'form';
+					}
+
+					try {
+						if (type === 'json') {
+							const searchParams = new URLSearchParams(qs);
+							result = await request[method](`${url}?${searchParams}`, {
+								jar: !unauthenticatedRoutes.includes(path) ? jar : undefined,
+								maxRedirect: 0,
+								redirect: 'manual',
+								headers: headers,
+								body: body,
+							});
+						} else if (type === 'form') {
+							result = await helpers.uploadFile(url, pathLib.join(__dirname, './files/test.png'), {}, jar, csrfToken);
+						}
+					} catch (e) {
+						assert(!e, `${method.toUpperCase()} ${path} errored with: ${e.message}`);
+					}
+				});
+
+				it('response status code should match one of the schema defined responses', () => {
+					// HACK: allow HTTP 418 I am a teapot, for now   👇
+					const { responses } = context[method];
+					assert(
+						responses.hasOwnProperty('418') ||
+						Object.keys(responses).includes(String(result.response.statusCode)),
+						`${method.toUpperCase()} ${path} sent back unexpected HTTP status code: ${result.response.statusCode}`
+					);
+				});
+
+				// Recursively iterate through schema properties, comparing type
+				it('response body should match schema definition', () => {
+					const http302 = context[method].responses['302'];
+					if (http302 && result.response.statusCode === 302) {
+						// Compare headers instead
+						const expectedHeaders = Object.keys(http302.headers).reduce((memo, name) => {
+							const value = http302.headers[name].schema.example;
+							memo[name] = value.startsWith(nconf.get('relative_path')) ? value : nconf.get('relative_path') + value;
+							return memo;
+						}, {});
+
+						for (const header of Object.keys(expectedHeaders)) {
+							assert(result.response.headers[header.toLowerCase()]);
+							assert.strictEqual(result.response.headers[header.toLowerCase()], expectedHeaders[header]);
+						}
+						return;
+					}
+
+					if (result.response.statusCode === 400 && context[method].responses['400']) {
+						// TODO: check 400 schema to response.body?
+						return;
+					}
+
+					const http200 = context[method].responses['200'];
+					if (!http200) {
+						return;
+					}
+
+					assert.strictEqual(result.response.statusCode, 200, `HTTP 200 expected (path: ${method} ${path}`);
+
+					const hasJSON = http200.content && http200.content['application/json'];
+					if (hasJSON) {
+						schema = context[method].responses['200'].content['application/json'].schema;
+						compare(schema, result.body, method.toUpperCase(), path, 'root');
+					}
+
+					// TODO someday: text/csv, binary file type checking?
+				});
+
+				it('should successfully re-login if needed', async () => {
+					const reloginPaths = ['GET /api/user/{userslug}/edit/email', 'PUT /users/{uid}/password', 'DELETE /users/{uid}/sessions/{uuid}'];
+					if (reloginPaths.includes(`${method.toUpperCase()} ${path}`)) {
+						({ jar } = await helpers.loginUser('admin', '123456'));
+						const sessionIds = await db.getSortedSetRange('uid:1:sessions', 0, -1);
+						const sessObj = await db.sessionStoreGet(sessionIds[0]);
+						const { uuid } = sessObj.meta;
+						mocks.delete['/users/{uid}/sessions/{uuid}'][1].example = uuid;
+
+						// Retrieve CSRF token using cookie, to test Write API
+						csrfToken = await helpers.getCsrfToken(jar);
+					}
+				});
+			});
+		});
+	}
+
+	function buildBody(schema) {
+		return Object.keys(schema).reduce((memo, cur) => {
+			memo[cur] = schema[cur].example;
+			return memo;
+		}, {});
+	}
+
+	function compare(schema, response, method, path, context) {
+		let required = [];
+		const additionalProperties = schema.hasOwnProperty('additionalProperties');
+
+		function flattenAllOf(obj) {
+			return obj.reduce((memo, obj) => {
+				if (obj.allOf) {
+					obj = { properties: flattenAllOf(obj.allOf) };
+				} else {
+					try {
+						required = required.concat(obj.required ? obj.required : Object.keys(obj.properties));
+					} catch (e) {
+						assert.fail(`Syntax error re: allOf, perhaps you allOf'd an array? (path: ${method} ${path}, context: ${context})`);
+					}
+				}
+
+				return { ...memo, ...obj.properties };
+			}, {});
+		}
+
+		if (schema.allOf) {
+			schema = flattenAllOf(schema.allOf);
+		} else if (schema.properties) {
+			required = schema.required || Object.keys(schema.properties);
+			schema = schema.properties;
+		} else {
+			// If schema contains no properties, check passes
+			return;
+		}
+
+		// Compare the schema to the response
+		required.forEach((prop) => {
+			if (schema.hasOwnProperty(prop)) {
+				assert(response.hasOwnProperty(prop), `"${prop}" is a required property (path: ${method} ${path}, context: ${context})`);
+
+				// Don't proceed with type-check if the value could possibly be unset (nullable: true, in spec)
+				if (response[prop] === null && schema[prop].nullable === true) {
+					return;
+				}
+
+				// Therefore, if the value is actually null, that's a problem (nullable is probably missing)
+				assert(response[prop] !== null, `"${prop}" was null, but schema does not specify it to be a nullable property (path: ${method} ${path}, context: ${context})`);
+
+				switch (schema[prop].type) {
+					case 'string':
+						assert.strictEqual(typeof response[prop], 'string', `"${prop}" was expected to be a string, but was ${typeof response[prop]} instead (path: ${method} ${path}, context: ${context})`);
+						break;
+					case 'boolean':
+						assert.strictEqual(typeof response[prop], 'boolean', `"${prop}" was expected to be a boolean, but was ${typeof response[prop]} instead (path: ${method} ${path}, context: ${context})`);
+						break;
+					case 'object':
+						assert.strictEqual(typeof response[prop], 'object', `"${prop}" was expected to be an object, but was ${typeof response[prop]} instead (path: ${method} ${path}, context: ${context})`);
+						compare(schema[prop], response[prop], method, path, context ? [context, prop].join('.') : prop);
+						break;
+					case 'array':
+						assert.strictEqual(Array.isArray(response[prop]), true, `"${prop}" was expected to be an array, but was ${typeof response[prop]} instead (path: ${method} ${path}, context: ${context})`);
+
+						if (schema[prop].items) {
+							// Ensure the array items have a schema defined
+							assert(schema[prop].items.type || schema[prop].items.allOf || schema[prop].items.anyOf || schema[prop].items.oneOf, `"${prop}" is defined to be an array, but its items have no schema defined (path: ${method} ${path}, context: ${context})`);
+
+							// Compare types
+							if (schema[prop].items.type === 'object' || Array.isArray(schema[prop].items.allOf || schema[prop].items.anyOf || schema[prop].items.oneOf)) {
+								response[prop].forEach((res) => {
+									compare(schema[prop].items, res, method, path, context ? [context, prop].join('.') : prop);
+								});
+							} else if (response[prop].length) { // for now
+								response[prop].forEach((item) => {
+									assert.strictEqual(typeof item, schema[prop].items.type, `"${prop}" should have ${schema[prop].items.type} items, but found ${typeof items} instead (path: ${method} ${path}, context: ${context})`);
+								});
+							}
+						}
+						break;
+				}
+			}
+		});
+
+		// Compare the response to the schema
+		Object.keys(response).forEach((prop) => {
+			if (additionalProperties) { // All bets are off
+				return;
+			}
+
+			// Define a whitelist of properties allowed in the response even if not in the schema
+			const allowedAdditionalProps = ['isEnglish', 'translatedContent']; // Add properties that you expect but are not in the schema
+
+			if (!schema[prop] && !allowedAdditionalProps.includes(prop)) {
+				assert.fail(`"${prop}" was found in response, but is not defined in schema (path: ${method} ${path}, context: ${context})`);
+			}
+		});
+	}
 });