studio-os 0.2.0 → 0.3.0

package/package.json

@@ -1,54 +1,54 @@
-{
-  "name": "studio-os",
-  "version": "0.2.0",
-  "description": "Self-hosted studio management: booking, class packs, memberships. Bring your own Stripe.",
-  "license": "MIT",
-  "type": "module",
-  "main": "src/server.js",
-  "scripts": {
-    "start": "node src/server.js",
-    "dev": "node --watch src/server.js",
-    "test": "node --test \"test/*.test.js\"",
-    "seed": "node scripts/seed.mjs",
-    "import-mindbody": "node scripts/import-mindbody.mjs"
-  },
-  "engines": {
-    "node": ">=20"
-  },
-  "dependencies": {
-    "bcryptjs": "^2.4.3",
-    "better-sqlite3": "^11.10.0",
-    "cookie-session": "^2.1.0",
-    "dotenv": "^16.4.5",
-    "ejs": "^3.1.10",
-    "express": "^4.21.2",
-    "marked": "^12.0.2",
-    "nodemailer": "^6.9.16",
-    "stripe": "^16.12.0"
-  },
-  "devDependencies": {
-    "supertest": "^7.0.0"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/Booyaka101/studio-os.git"
-  },
-  "homepage": "https://github.com/Booyaka101/studio-os#readme",
-  "bugs": {
-    "url": "https://github.com/Booyaka101/studio-os/issues"
-  },
-  "keywords": [
-    "self-hosted",
-    "studio",
-    "yoga",
-    "pilates",
-    "gym",
-    "booking",
-    "class-packs",
-    "memberships",
-    "mindbody-alternative",
-    "stripe",
-    "scheduling",
-    "fitness"
-  ]
-}
+{
+  "name": "studio-os",
+  "version": "0.3.0",
+  "description": "Self-hosted studio management: booking, class packs, memberships. Bring your own Stripe.",
+  "license": "MIT",
+  "type": "module",
+  "main": "src/server.js",
+  "scripts": {
+    "start": "node src/server.js",
+    "dev": "node --watch src/server.js",
+    "test": "node --test \"test/*.test.js\"",
+    "seed": "node scripts/seed.mjs",
+    "import-mindbody": "node scripts/import-mindbody.mjs"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "dependencies": {
+    "bcryptjs": "^3.0.3",
+    "better-sqlite3": "^13.0.1",
+    "cookie-session": "^2.1.0",
+    "dotenv": "^17.4.2",
+    "ejs": "^6.0.1",
+    "express": "^5.2.1",
+    "marked": "^18.0.9",
+    "nodemailer": "^10.0.9",
+    "stripe": "^22.6.2"
+  },
+  "devDependencies": {
+    "supertest": "^7.0.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Booyaka101/studio-os.git"
+  },
+  "homepage": "https://github.com/Booyaka101/studio-os#readme",
+  "bugs": {
+    "url": "https://github.com/Booyaka101/studio-os/issues"
+  },
+  "keywords": [
+    "self-hosted",
+    "studio",
+    "yoga",
+    "pilates",
+    "gym",
+    "booking",
+    "class-packs",
+    "memberships",
+    "mindbody-alternative",
+    "stripe",
+    "scheduling",
+    "fitness"
+  ]
+}

package/runner-lock.json

@@ -0,0 +1,15 @@
+{
+  "schemaVersion": 1,
+  "label": "ubuntu-24.04",
+  "imageOS": "ubuntu24",
+  "imageVersion": "20260720.247.2",
+  "tools": {
+    "Node.js": {
+      "versions": [
+        "22.23.1"
+      ],
+      "source": "manifest"
+    }
+  },
+  "updatedAt": "2026-08-05T04:27:45.130Z"
+}

package/src/app.js

@@ -1,141 +1,156 @@
-import express from 'express';
-import cookieSession from 'cookie-session';
-import crypto from 'node:crypto';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { getSetting, allSettings } from './db/index.js';
-import { formatInTz } from './lib/time.js';
-import { createRateLimiter } from './lib/ratelimit.js';
-import { createMailer } from './services/mailer.js';
-import { createStripeService } from './services/stripe.js';
-import setupRoutes from './routes/setup.js';
-import authRoutes from './routes/auth.js';
-import publicRoutes from './routes/public.js';
-import meRoutes from './routes/me.js';
-import adminRoutes from './routes/admin.js';
-import instructorRoutes from './routes/instructor.js';
-import webhookRoutes from './routes/webhooks.js';
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-
-/**
- * Build the Express app. Dependencies are injectable for tests:
- * createApp({ db, mailer?, stripeService?, env?, now? })
- * `now` (clock) is used by the rate limiters so tests can move time.
- */
-export function createApp({ db, mailer, stripeService, env = process.env, now = Date.now }) {
-  const app = express();
-  app.set('view engine', 'ejs');
-  app.set('views', path.join(__dirname, '..', 'views'));
-  app.disable('x-powered-by');
-
-  const services = {
-    db,
-    mailer: mailer || createMailer({ env }),
-    stripe: stripeService || createStripeService({ env }),
-    env,
-    baseUrl(req) {
-      return env.BASE_URL || `${req.protocol}://${req.get('host')}`;
-    },
-  };
-  app.locals.services = services;
-
-  // Stripe webhook needs the raw body for signature verification — mount
-  // before any body parser.
-  app.use('/webhooks/stripe', express.raw({ type: '*/*' }), webhookRoutes(services));
-
-  app.use(express.urlencoded({ extended: true }));
-  app.use(express.static(path.join(__dirname, '..', 'public')));
-  app.use(cookieSession({
-    name: 'studio_session',
-    keys: [getSetting(db, 'app_secret', 'dev-secret')],
-    sameSite: 'lax',
-    httpOnly: true,
-    maxAge: 30 * 24 * 3600000,
-  }));
-
-  // View locals: settings + formatting helpers, refreshed per request.
-  app.use((req, res, next) => {
-    const s = allSettings(db);
-    res.locals.settings = s;
-    res.locals.tz = s.timezone || 'Asia/Hong_Kong';
-    res.locals.currency = s.currency || 'HKD';
-    res.locals.fmtDt = (iso, opts) => formatInTz(res.locals.tz, iso, opts);
-    res.locals.fmtMoney = (cents) => new Intl.NumberFormat('en', {
-      style: 'currency', currency: res.locals.currency, minimumFractionDigits: 0,
-    }).format((cents || 0) / 100);
-    res.locals.user = req.session && req.session.userId
-      ? db.prepare('SELECT id, email, name, role FROM users WHERE id = ?').get(req.session.userId)
-      : null;
-    res.locals.stripeConfigured = services.stripe.configured;
-    res.locals.smtpConfigured = services.mailer.smtpConfigured;
-    res.locals.flash = req.session ? req.session.flash : null;
-    if (req.session) delete req.session.flash;
-    next();
-  });
-
-  // Rate limiting (before CSRF so hammering can't even probe tokens):
-  // in-memory fixed window, per IP + route. Single-process; resets on restart.
-  const RL_WINDOW = 15 * 60 * 1000;
-  app.post('/magic-link', createRateLimiter({
-    windowMs: RL_WINDOW, max: 5, env, now,
-    message: 'Too many link requests — please wait 15 minutes and try again.',
-  }));
-  app.post('/admin/login', createRateLimiter({
-    windowMs: RL_WINDOW, max: 10, env, now,
-    message: 'Too many login attempts — please wait 15 minutes and try again.',
-  }));
-  app.post(['/class/:id/book', '/buy/pack/:id', '/buy/membership/:id'], createRateLimiter({
-    windowMs: RL_WINDOW, max: 30, env, now,
-    message: 'Too many booking attempts from your address — please wait a few minutes and try again.',
-  }));
-
-  // CSRF protection: a random per-session token lives in the signed cookie
-  // session and must be echoed back (hidden `_csrf` input or `x-csrf-token`
-  // header) on every state-changing request. /webhooks/stripe is exempt — it
-  // is mounted before this middleware and authenticated by Stripe signature.
-  app.use((req, res, next) => {
-    if (!req.session.csrf) req.session.csrf = crypto.randomBytes(24).toString('hex');
-    res.locals.csrfToken = req.session.csrf;
-    if (!['POST', 'PUT', 'DELETE', 'PATCH'].includes(req.method)) return next();
-    if (req.path.startsWith('/webhooks/')) return next();
-    const sent = (req.body && req.body._csrf) || req.get('x-csrf-token') || '';
-    const a = Buffer.from(String(sent));
-    const b = Buffer.from(req.session.csrf);
-    if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
-      return res.status(403).render('error', {
-        title: 'Session expired',
-        message: 'Your form session expired or the security token was missing. Please go back, refresh the page, and try again.',
-      });
-    }
-    next();
-  });
-
-  // First-run gate: until setup completes, everything routes to the wizard.
-  app.use((req, res, next) => {
-    const done = getSetting(db, 'setup_complete', '0') === '1';
-    if (!done && !req.path.startsWith('/setup') && !req.path.startsWith('/vendor')
-        && !req.path.startsWith('/css') && !req.path.startsWith('/js')) {
-      return res.redirect('/setup');
-    }
-    if (done && req.path.startsWith('/setup')) return res.redirect('/');
-    next();
-  });
-
-  app.use('/setup', setupRoutes(services));
-  app.use('/', authRoutes(services));
-  app.use('/admin', adminRoutes(services));
-  app.use('/instructor', instructorRoutes(services));
-  app.use('/me', meRoutes(services));
-  app.use('/', publicRoutes(services));
-
-  // 404 + error handler
-  app.use((req, res) => res.status(404).render('error', { title: 'Not found', message: 'Page not found.' }));
-  // eslint-disable-next-line no-unused-vars
-  app.use((err, req, res, next) => {
-    console.error('[error]', err);
-    res.status(500).render('error', { title: 'Error', message: err.expose ? err.message : 'Something went wrong.' });
-  });
-
-  return app;
-}
+import express from 'express';
+import cookieSession from 'cookie-session';
+import crypto from 'node:crypto';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { getSetting, allSettings } from './db/index.js';
+import { formatInTz } from './lib/time.js';
+import { createRateLimiter } from './lib/ratelimit.js';
+import { createMailer } from './services/mailer.js';
+import { createStripeService } from './services/stripe.js';
+import setupRoutes from './routes/setup.js';
+import authRoutes from './routes/auth.js';
+import publicRoutes from './routes/public.js';
+import meRoutes from './routes/me.js';
+import adminRoutes from './routes/admin.js';
+import instructorRoutes from './routes/instructor.js';
+import webhookRoutes from './routes/webhooks.js';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+
+/**
+ * Build the Express app. Dependencies are injectable for tests:
+ * createApp({ db, mailer?, stripeService?, env?, now? })
+ * `now` (clock) is used by the rate limiters so tests can move time.
+ */
+export function createApp({ db, mailer, stripeService, env = process.env, now = Date.now }) {
+  const app = express();
+  app.set('view engine', 'ejs');
+  app.set('views', path.join(__dirname, '..', 'views'));
+  app.disable('x-powered-by');
+
+  // Behind a TLS-terminating proxy the socket is plain HTTP, so req.protocol
+  // reads 'http' and every emailed magic link ships a 7-day auth token over
+  // plaintext. Honouring X-Forwarded-Proto is what makes baseUrl() correct.
+  // TRUST_PROXY is a hop count ('1') or any Express trust-proxy value.
+  if (env.TRUST_PROXY) {
+    const n = Number(env.TRUST_PROXY);
+    app.set('trust proxy', Number.isInteger(n) && n > 0 ? n : env.TRUST_PROXY);
+  }
+
+  const services = {
+    db,
+    mailer: mailer || createMailer({ env }),
+    stripe: stripeService || createStripeService({ env }),
+    env,
+    baseUrl(req) {
+      return env.BASE_URL || `${req.protocol}://${req.get('host')}`;
+    },
+  };
+  app.locals.services = services;
+
+  // Stripe webhook needs the raw body for signature verification — mount
+  // before any body parser.
+  app.use('/webhooks/stripe', express.raw({ type: '*/*' }), webhookRoutes(services));
+
+  app.use(express.urlencoded({ extended: true }));
+  app.use(express.static(path.join(__dirname, '..', 'public')));
+  app.use(cookieSession({
+    name: 'studio_session',
+    keys: [getSetting(db, 'app_secret', 'dev-secret')],
+    sameSite: 'lax',
+    httpOnly: true,
+    maxAge: 30 * 24 * 3600000,
+  }));
+
+  // View locals: settings + formatting helpers, refreshed per request.
+  app.use((req, res, next) => {
+    // app_secret signs the session cookie and every magic-link token, so it
+    // stays out of the object every template can reach. No view renders it
+    // today; this is so none can start to.
+    const { app_secret: _secret, ...s } = allSettings(db);
+    res.locals.settings = s;
+    res.locals.tz = s.timezone || 'Asia/Hong_Kong';
+    res.locals.currency = s.currency || 'HKD';
+    res.locals.fmtDt = (iso, opts) => formatInTz(res.locals.tz, iso, opts);
+    res.locals.fmtMoney = (cents) => new Intl.NumberFormat('en', {
+      style: 'currency', currency: res.locals.currency, minimumFractionDigits: 0,
+    }).format((cents || 0) / 100);
+    res.locals.user = req.session && req.session.userId
+      ? db.prepare('SELECT id, email, name, role FROM users WHERE id = ?').get(req.session.userId)
+      : null;
+    // Public views ask "can we take money online?", which needs both keys.
+    res.locals.stripeConfigured = services.stripe.checkoutReady;
+    res.locals.stripeKeySet = services.stripe.configured;
+    res.locals.stripeWebhookSet = services.stripe.webhookConfigured;
+    res.locals.smtpConfigured = services.mailer.smtpConfigured;
+    res.locals.flash = req.session ? req.session.flash : null;
+    if (req.session) delete req.session.flash;
+    next();
+  });
+
+  // Rate limiting (before CSRF so hammering can't even probe tokens):
+  // in-memory fixed window, per IP + route. Single-process; resets on restart.
+  const RL_WINDOW = 15 * 60 * 1000;
+  app.post('/magic-link', createRateLimiter({
+    windowMs: RL_WINDOW, max: 5, env, now,
+    message: 'Too many link requests — please wait 15 minutes and try again.',
+  }));
+  app.post('/admin/login', createRateLimiter({
+    windowMs: RL_WINDOW, max: 10, env, now,
+    message: 'Too many login attempts — please wait 15 minutes and try again.',
+  }));
+  app.post(['/class/:id/book', '/buy/pack/:id', '/buy/membership/:id'], createRateLimiter({
+    windowMs: RL_WINDOW, max: 30, env, now,
+    message: 'Too many booking attempts from your address — please wait a few minutes and try again.',
+  }));
+
+  // CSRF protection: a random per-session token lives in the signed cookie
+  // session and must be echoed back (hidden `_csrf` input or `x-csrf-token`
+  // header) on every state-changing request. /webhooks/stripe is exempt — it
+  // is mounted before this middleware and authenticated by Stripe signature.
+  app.use((req, res, next) => {
+    if (!req.session.csrf) req.session.csrf = crypto.randomBytes(24).toString('hex');
+    res.locals.csrfToken = req.session.csrf;
+    if (!['POST', 'PUT', 'DELETE', 'PATCH'].includes(req.method)) return next();
+    if (req.path.startsWith('/webhooks/')) return next();
+    const sent = (req.body && req.body._csrf) || req.get('x-csrf-token') || '';
+    const a = Buffer.from(String(sent));
+    const b = Buffer.from(req.session.csrf);
+    if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
+      return res.status(403).render('error', {
+        title: 'Session expired',
+        message: 'Your form session expired or the security token was missing. Please go back, refresh the page, and try again.',
+      });
+    }
+    next();
+  });
+
+  // First-run gate: until setup completes, everything routes to the wizard.
+  app.use((req, res, next) => {
+    const done = getSetting(db, 'setup_complete', '0') === '1';
+    if (!done && !req.path.startsWith('/setup') && !req.path.startsWith('/vendor')
+        && !req.path.startsWith('/css') && !req.path.startsWith('/js')) {
+      return res.redirect('/setup');
+    }
+    if (done && req.path.startsWith('/setup')) return res.redirect('/');
+    next();
+  });
+
+  app.use('/setup', setupRoutes(services));
+  app.use('/', authRoutes(services));
+  app.use('/admin', adminRoutes(services));
+  app.use('/instructor', instructorRoutes(services));
+  app.use('/me', meRoutes(services));
+  app.use('/', publicRoutes(services));
+
+  // 404 + error handler
+  app.use((req, res) => res.status(404).render('error', { title: 'Not found', message: 'Page not found.' }));
+  // eslint-disable-next-line no-unused-vars
+  app.use((err, req, res, next) => {
+    console.error('[error]', err);
+    res.status(500).render('error', { title: 'Error', message: err.expose ? err.message : 'Something went wrong.' });
+  });
+
+  return app;
+}

package/src/routes/public.js

@@ -150,7 +150,7 @@ export default function publicRoutes(services) {
     if (!/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email)) {
       return res.status(400).render('public/buy_manual', { title: 'Buy', product, plan: null, email: null, error: 'A valid email is required.' });
     }
-    if (services.stripe.configured) {
+    if (services.stripe.checkoutReady) {
       try {
         const session = await services.stripe.createPackCheckout({
           product, clientEmail: email, baseUrl: services.baseUrl(req),
@@ -171,7 +171,7 @@ export default function publicRoutes(services) {
     if (!/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email)) {
       return res.status(400).render('public/buy_manual', { title: 'Buy', product: null, plan, email: null, error: 'A valid email is required.' });
     }
-    if (services.stripe.configured && plan.stripe_price_id) {
+    if (services.stripe.checkoutReady && plan.stripe_price_id) {
       try {
         const session = await services.stripe.createMembershipCheckout({
           plan, clientEmail: email, baseUrl: services.baseUrl(req),

package/src/services/auth.js

@@ -1,81 +1,88 @@
-// Staff auth (bcryptjs) + HMAC magic-link tokens for client self-service.
-import bcrypt from 'bcryptjs';
-import crypto from 'node:crypto';
-import { getSetting } from '../db/index.js';
-
-export function hashPassword(plain) {
-  return bcrypt.hashSync(plain, 10);
-}
-
-export function verifyPassword(plain, hash) {
-  return bcrypt.compareSync(plain, hash);
-}
-
-export function createUser(db, { email, password, name = '', role = 'staff' }) {
-  const info = db.prepare(
-    'INSERT INTO users (email, password_hash, name, role) VALUES (?, ?, ?, ?)'
-  ).run(email.trim().toLowerCase(), hashPassword(password), name, role);
-  return info.lastInsertRowid;
-}
-
-export function authenticate(db, email, password) {
-  const user = db.prepare('SELECT * FROM users WHERE email = ?').get(String(email || '').trim().toLowerCase());
-  if (!user) return null;
-  return verifyPassword(String(password || ''), user.password_hash) ? user : null;
-}
-
-// --- magic links -----------------------------------------------------------
-
-function hmac(secret, payload) {
-  return crypto.createHmac('sha256', secret).update(payload).digest('base64url');
-}
-
-/** Signed token for a client, valid for ttlHours (default 7 days). */
-export function makeMagicToken(db, clientId, { ttlHours = 24 * 7, now = Date.now() } = {}) {
-  const secret = getSetting(db, 'app_secret');
-  const expires = now + ttlHours * 3600000;
-  const payload = `${clientId}.${expires}`;
-  return `${payload}.${hmac(secret, payload)}`;
-}
-
-/** Returns clientId or null. Constant-time signature check. */
-export function verifyMagicToken(db, token, { now = Date.now() } = {}) {
-  if (typeof token !== 'string') return null;
-  const parts = token.split('.');
-  if (parts.length !== 3) return null;
-  const [idStr, expStr, sig] = parts;
-  const secret = getSetting(db, 'app_secret');
-  const expected = hmac(secret, `${idStr}.${expStr}`);
-  const a = Buffer.from(sig);
-  const b = Buffer.from(expected);
-  if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) return null;
-  if (Number(expStr) < now) return null;
-  const id = Number(idStr);
-  return Number.isInteger(id) && id > 0 ? id : null;
-}
-
-// --- express middleware ----------------------------------------------------
-
-export function requireStaff(req, res, next) {
-  if (req.session && req.session.userId) return next();
-  return res.redirect('/admin/login');
-}
-
-/** Admin area: any logged-in owner/staff. Instructors get a hard 403. */
-export function requireAdmin(req, res, next) {
-  if (!req.session || !req.session.userId || !res.locals.user) return res.redirect('/admin/login');
-  if (res.locals.user.role === 'instructor') {
-    return res.status(403).render('error', {
-      title: 'Forbidden',
-      message: 'Instructor accounts cannot access the admin area.',
-    });
-  }
-  next();
-}
-
-/** Instructor portal: instructor role only; admins are sent to their own UI. */
-export function requireInstructor(req, res, next) {
-  if (!req.session || !req.session.userId || !res.locals.user) return res.redirect('/admin/login');
-  if (res.locals.user.role !== 'instructor') return res.redirect('/admin');
-  next();
-}
+// Staff auth (bcryptjs) + HMAC magic-link tokens for client self-service.
+import bcrypt from 'bcryptjs';
+import crypto from 'node:crypto';
+import { getSetting } from '../db/index.js';
+
+export function hashPassword(plain) {
+  return bcrypt.hashSync(plain, 10);
+}
+
+export function verifyPassword(plain, hash) {
+  return bcrypt.compareSync(plain, hash);
+}
+
+export function createUser(db, { email, password, name = '', role = 'staff' }) {
+  const info = db.prepare(
+    'INSERT INTO users (email, password_hash, name, role) VALUES (?, ?, ?, ?)'
+  ).run(email.trim().toLowerCase(), hashPassword(password), name, role);
+  return info.lastInsertRowid;
+}
+
+// Returning early for an unknown email skips bcrypt entirely, which answers in
+// microseconds instead of tens of milliseconds and turns the login form into a
+// staff-email oracle. Comparing against a throwaway hash of the same cost keeps
+// both paths the same shape. /magic-link already refuses to leak which emails
+// exist; this is the same promise on the staff side.
+const DUMMY_HASH = bcrypt.hashSync('password-that-is-never-valid', 10);
+
+export function authenticate(db, email, password) {
+  const user = db.prepare('SELECT * FROM users WHERE email = ?').get(String(email || '').trim().toLowerCase());
+  const ok = verifyPassword(String(password || ''), user ? user.password_hash : DUMMY_HASH);
+  return user && ok ? user : null;
+}
+
+// --- magic links -----------------------------------------------------------
+
+function hmac(secret, payload) {
+  return crypto.createHmac('sha256', secret).update(payload).digest('base64url');
+}
+
+/** Signed token for a client, valid for ttlHours (default 7 days). */
+export function makeMagicToken(db, clientId, { ttlHours = 24 * 7, now = Date.now() } = {}) {
+  const secret = getSetting(db, 'app_secret');
+  const expires = now + ttlHours * 3600000;
+  const payload = `${clientId}.${expires}`;
+  return `${payload}.${hmac(secret, payload)}`;
+}
+
+/** Returns clientId or null. Constant-time signature check. */
+export function verifyMagicToken(db, token, { now = Date.now() } = {}) {
+  if (typeof token !== 'string') return null;
+  const parts = token.split('.');
+  if (parts.length !== 3) return null;
+  const [idStr, expStr, sig] = parts;
+  const secret = getSetting(db, 'app_secret');
+  const expected = hmac(secret, `${idStr}.${expStr}`);
+  const a = Buffer.from(sig);
+  const b = Buffer.from(expected);
+  if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) return null;
+  if (Number(expStr) < now) return null;
+  const id = Number(idStr);
+  return Number.isInteger(id) && id > 0 ? id : null;
+}
+
+// --- express middleware ----------------------------------------------------
+
+export function requireStaff(req, res, next) {
+  if (req.session && req.session.userId) return next();
+  return res.redirect('/admin/login');
+}
+
+/** Admin area: any logged-in owner/staff. Instructors get a hard 403. */
+export function requireAdmin(req, res, next) {
+  if (!req.session || !req.session.userId || !res.locals.user) return res.redirect('/admin/login');
+  if (res.locals.user.role === 'instructor') {
+    return res.status(403).render('error', {
+      title: 'Forbidden',
+      message: 'Instructor accounts cannot access the admin area.',
+    });
+  }
+  next();
+}
+
+/** Instructor portal: instructor role only; admins are sent to their own UI. */
+export function requireInstructor(req, res, next) {
+  if (!req.session || !req.session.userId || !res.locals.user) return res.redirect('/admin/login');
+  if (res.locals.user.role !== 'instructor') return res.redirect('/admin');
+  next();
+}