studio-os 0.2.0 → 0.3.0

package/src/services/booking.js

@@ -24,22 +24,28 @@ function bookedCount(db, instanceId) {
 /** Lazy monthly-credit cycle reset for a credit-based membership. */
 function refreshMembershipCycle(db, m, todayLocal) {
   if (m.unlimited || !m.credits_per_month) return m;
-  let cycleStart = m.cycle_started_on || m.started_on;
-  let changed = false;
-  // advance cycle start by whole months until it is the current cycle
-  while (addMonths(cycleStart, 1) <= todayLocal) {
-    cycleStart = addMonths(cycleStart, 1);
-    changed = true;
-  }
-  if (changed) {
+  // Cycles anchor on the join date rather than stepping from the previous
+  // cycle. Stepping compounds February's day clamp: a membership joined on the
+  // 31st becomes the 28th that month and then stays the 28th for good. From
+  // the anchor it clamps only where it has to — 31 Jan, 28 Feb, 31 Mar.
+  const anchor = m.started_on;
+  const [ay, am] = anchor.split('-').map(Number);
+  const [ty, tm] = todayLocal.split('-').map(Number);
+  let n = (ty - ay) * 12 + (tm - am);
+  if (n > 0 && addMonths(anchor, n) > todayLocal) n -= 1;
+  const cycleStart = addMonths(anchor, Math.max(0, n));
+
+  if (m.cycle_started_on === cycleStart) return m;
+  // Only a new month refills credits. Correcting a drifted day inside the
+  // current month must not hand the client a free reset.
+  const newMonth = (m.cycle_started_on || anchor).slice(0, 7) !== cycleStart.slice(0, 7);
+  if (newMonth) {
     db.prepare('UPDATE memberships SET cycle_started_on = ?, credits_used_this_cycle = 0 WHERE id = ?')
       .run(cycleStart, m.id);
-    m = { ...m, cycle_started_on: cycleStart, credits_used_this_cycle: 0 };
-  } else if (!m.cycle_started_on) {
-    db.prepare('UPDATE memberships SET cycle_started_on = ? WHERE id = ?').run(cycleStart, m.id);
-    m = { ...m, cycle_started_on: cycleStart };
+    return { ...m, cycle_started_on: cycleStart, credits_used_this_cycle: 0 };
   }
-  return m;
+  db.prepare('UPDATE memberships SET cycle_started_on = ? WHERE id = ?').run(cycleStart, m.id);
+  return { ...m, cycle_started_on: cycleStart };
 }
 
 function addMonths(dateStr, n) {

package/src/services/stripe.js

@@ -23,6 +23,12 @@ export function createStripeService({ env = process.env, client } = {}) {
   return {
     configured: Boolean(secretKey),
     webhookConfigured: Boolean(webhookSecret),
+    // Checkout is only safe to offer when the webhook that fulfils it will be
+    // accepted. With a secret key but no webhook secret the client pays at
+    // Stripe and /webhooks/stripe answers 501, so no pass is ever created and
+    // no payment is recorded — the money lands in Stripe with nothing to show
+    // for it. Half-configured falls back to the manual pay-at-studio flow.
+    checkoutReady: Boolean(secretKey && webhookSecret),
     publishableKey,
 
     /** One-time Checkout for a class pack. Returns the session (url etc). */

package/test/deps.test.js

@@ -0,0 +1,108 @@
+// The Stripe and mailer suites both run against stand-ins: test/stripe.test.js
+// injects a mock client, and every other test leaves SMTP_HOST unset so the
+// mailer takes the outbox branch. Neither imports the real package, so a major
+// bump can rewrite the API and still see a green suite. These tests pin the two
+// bits of third-party behaviour the app cannot work without.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import net from 'node:net';
+import crypto from 'node:crypto';
+import { createStripeService } from '../src/services/stripe.js';
+import { createMailer } from '../src/services/mailer.js';
+
+/**
+ * Enough of an SMTP server for nodemailer to complete a send. Resolves with the
+ * DATA payload it received. No STARTTLS advertised, so the client stays plain.
+ */
+function smtpSink() {
+  let resolveData;
+  const received = new Promise((r) => { resolveData = r; });
+  const server = net.createServer((socket) => {
+    let inData = false;
+    let body = '';
+    socket.write('220 sink.test ESMTP\r\n');
+    socket.on('data', (chunk) => {
+      if (inData) {
+        body += chunk.toString('utf8');
+        if (body.includes('\r\n.\r\n')) {
+          inData = false;
+          socket.write('250 2.0.0 Ok: queued\r\n');
+          resolveData(body.slice(0, body.indexOf('\r\n.\r\n')));
+        }
+        return;
+      }
+      for (const line of chunk.toString('utf8').split('\r\n').filter(Boolean)) {
+        const verb = line.slice(0, 4).toUpperCase();
+        if (verb === 'EHLO' || verb === 'HELO') socket.write('250-sink.test\r\n250 8BITMIME\r\n');
+        else if (verb === 'DATA') { inData = true; socket.write('354 End data with <CR><LF>.<CR><LF>\r\n'); }
+        else if (verb === 'QUIT') { socket.write('221 Bye\r\n'); socket.end(); }
+        else socket.write('250 2.0.0 Ok\r\n');
+      }
+    });
+    socket.on('error', () => {});
+  });
+  return { server, received };
+}
+
+test('mailer: the real nodemailer SMTP path delivers when SMTP_HOST is set', async (t) => {
+  const { server, received } = smtpSink();
+  await new Promise((r) => server.listen(0, '127.0.0.1', r));
+  t.after(() => server.close());
+
+  const mailer = createMailer({
+    env: { SMTP_HOST: '127.0.0.1', SMTP_PORT: String(server.address().port), SMTP_FROM: 'studio@test.hk' },
+  });
+  assert.equal(mailer.smtpConfigured, true);
+
+  const ok = await mailer.send({ to: 'rider@test.hk', subject: 'Booked: Yoga', text: 'See you there' });
+  assert.equal(ok, true, 'send() reported failure — it swallows errors, so check the mailer log');
+
+  const raw = await received;
+  assert.match(raw, /^To: rider@test\.hk$/m);
+  assert.match(raw, /^From: studio@test\.hk$/m);
+  assert.match(raw, /Booked: Yoga/);
+  assert.match(raw, /See you there/);
+});
+
+test('mailer: send() resolves false rather than throwing when SMTP is unreachable', async () => {
+  // A dead port: booking flows call send() fire-and-forget and must not 500.
+  const mailer = createMailer({ env: { SMTP_HOST: '127.0.0.1', SMTP_PORT: '1' } });
+  assert.equal(await mailer.send({ to: 'a@test.hk', subject: 's', text: 't' }), false);
+});
+
+test('stripe: the real SDK verifies a good webhook signature and rejects a forged one', async () => {
+  const secret = 'whsec_deps_test';
+  const svc = createStripeService({
+    env: { STRIPE_SECRET_KEY: 'sk_test_deps', STRIPE_WEBHOOK_SECRET: secret },
+  });
+
+  const payload = JSON.stringify({
+    id: 'evt_1', type: 'checkout.session.completed', data: { object: { id: 'cs_1' } },
+  });
+  const ts = Math.floor(Date.now() / 1000);
+  const sign = (body) => crypto.createHmac('sha256', secret).update(`${ts}.${body}`).digest('hex');
+
+  const event = await svc.parseWebhook(payload, `t=${ts},v1=${sign(payload)}`);
+  assert.equal(event.type, 'checkout.session.completed');
+  assert.equal(event.data.object.id, 'cs_1');
+
+  // A payload swapped after signing must not verify — this is the only thing
+  // stopping anyone who knows the URL from granting themselves a membership.
+  const forged = payload.replace('cs_1', 'cs_forged');
+  await assert.rejects(
+    () => svc.parseWebhook(forged, `t=${ts},v1=${sign(payload)}`),
+    /signature/i,
+  );
+  await assert.rejects(() => svc.parseWebhook(payload, `t=${ts},v1=deadbeef`), /signature/i);
+});
+
+test('stripe: the real SDK still exposes the Checkout surface the mock stands in for', async () => {
+  const svc = createStripeService({ env: { STRIPE_SECRET_KEY: 'sk_test_deps' } });
+  // Reaches into the client without a network call: a rename of
+  // checkout.sessions.create is a TypeError here, not a runtime 500 in prod.
+  const Stripe = (await import('stripe')).default;
+  const client = new Stripe('sk_test_deps');
+  assert.equal(typeof client.checkout.sessions.create, 'function');
+  assert.equal(typeof client.webhooks.constructEvent, 'function');
+  assert.equal(svc.configured, true);
+});

package/test/membership-cycle.test.js

@@ -0,0 +1,78 @@
+// Monthly credit cycles for a membership joined near the end of a month.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { resolvePayment } from '../src/services/booking.js';
+import { testDb, makeClient, makeMembership } from './helpers.js';
+
+/** Run the lazy cycle refresh for `today` and report the stored cycle start. */
+function cycleOn(startedOn, today) {
+  const db = testDb();
+  const clientId = makeClient(db);
+  const id = makeMembership(db, clientId, { unlimited: false, creditsPerMonth: 4, startedOn });
+  db.prepare('UPDATE memberships SET cycle_started_on = ? WHERE id = ?').run(startedOn, id);
+  resolvePayment(db, clientId, { starts_at: `${today}T10:00:00Z`, credits_required: 1 }, { now: `${today}T09:00:00Z` });
+  return db.prepare('SELECT cycle_started_on FROM memberships WHERE id = ?').get(id).cycle_started_on;
+}
+
+test('a cycle anchored on the 31st returns to the 31st after February', () => {
+  // Stepping each cycle from the last one clamped to 28 Feb and then kept the
+  // 28th for good, quietly moving the client's refill date forward for ever.
+  const cases = [
+    ['2026-01-31', '2026-02-27', '2026-01-31'],
+    ['2026-01-31', '2026-02-28', '2026-02-28'], // February has to clamp
+    ['2026-01-31', '2026-03-30', '2026-02-28'],
+    ['2026-01-31', '2026-03-31', '2026-03-31'], // and March must recover
+    ['2026-01-31', '2026-04-30', '2026-04-30'],
+    ['2026-01-31', '2026-05-31', '2026-05-31'],
+  ];
+  for (const [started, today, want] of cases) {
+    assert.equal(cycleOn(started, today), want, `started ${started}, on ${today}`);
+  }
+});
+
+test('cycle anchoring handles leap years, year boundaries and mid-month joins', () => {
+  const cases = [
+    ['2024-01-31', '2024-02-29', '2024-02-29'], // leap February
+    ['2024-01-31', '2024-03-31', '2024-03-31'],
+    ['2025-11-30', '2026-02-27', '2026-01-30'], // across a year boundary
+    ['2025-11-30', '2026-02-28', '2026-02-28'], // 30th anchor clamps, and it is today
+    ['2026-01-15', '2026-03-14', '2026-02-15'], // ordinary anchor, unaffected
+    ['2026-01-15', '2026-03-15', '2026-03-15'],
+  ];
+  for (const [started, today, want] of cases) {
+    assert.equal(cycleOn(started, today), want, `started ${started}, on ${today}`);
+  }
+});
+
+test('correcting an already-drifted cycle does not refill credits mid-month', () => {
+  const db = testDb();
+  const clientId = makeClient(db);
+  const id = makeMembership(db, clientId, { unlimited: false, creditsPerMonth: 4, startedOn: '2026-01-31' });
+  // The state the old stepping logic left behind: June pinned to the 28th,
+  // three of four credits already spent this cycle.
+  db.prepare("UPDATE memberships SET cycle_started_on = '2026-06-28', credits_used_this_cycle = 3 WHERE id = ?")
+    .run(id);
+
+  resolvePayment(db, clientId, { starts_at: '2026-06-30T10:00:00Z', credits_required: 1 }, { now: '2026-06-30T09:00:00Z' });
+
+  const row = db.prepare('SELECT cycle_started_on, credits_used_this_cycle FROM memberships WHERE id = ?').get(id);
+  assert.equal(row.cycle_started_on, '2026-06-30', 'the drifted date should be corrected');
+  assert.equal(row.credits_used_this_cycle, 3, 'same month, so credits must not be refilled');
+});
+
+test('a genuinely new month still refills credits', () => {
+  const db = testDb();
+  const clientId = makeClient(db);
+  const id = makeMembership(db, clientId, { unlimited: false, creditsPerMonth: 4, startedOn: '2026-01-31' });
+  db.prepare("UPDATE memberships SET cycle_started_on = '2026-01-31', credits_used_this_cycle = 4 WHERE id = ?")
+    .run(id);
+
+  const resolved = resolvePayment(
+    db, clientId, { starts_at: '2026-03-31T10:00:00Z', credits_required: 1 }, { now: '2026-03-31T09:00:00Z' },
+  );
+
+  const row = db.prepare('SELECT cycle_started_on, credits_used_this_cycle FROM memberships WHERE id = ?').get(id);
+  assert.equal(row.cycle_started_on, '2026-03-31');
+  assert.equal(row.credits_used_this_cycle, 0);
+  assert.equal(resolved.paidWith, 'membership', 'a refilled cycle should cover the class again');
+});

package/test/proxy-auth.test.js

@@ -0,0 +1,114 @@
+// Deployment-shape regressions: the app behind a TLS-terminating reverse proxy
+// (the layout README recommends), and the staff login as an email oracle.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import request from 'supertest';
+import { createApp } from '../src/app.js';
+import { createStripeService } from '../src/services/stripe.js';
+import { createUser, authenticate } from '../src/services/auth.js';
+import { testDb, makeClient, csrfToken } from './helpers.js';
+import { setSetting } from '../src/db/index.js';
+
+/** The documented reverse-proxy deployment: TRUST_PROXY set, BASE_URL unset. */
+function proxiedApp(db, extraEnv = {}) {
+  return createApp({ db, env: { TRUST_PROXY: '1', ...extraEnv } });
+}
+
+const asHttps = (r) => r
+  .set('X-Forwarded-Proto', 'https')
+  .set('Host', 'booking.example.com');
+
+test('magic links use https when the proxy terminated TLS', async () => {
+  const db = testDb();
+  makeClient(db, { email: 'rider@test.hk' });
+  const agent = request.agent(proxiedApp(db));
+  const token = await csrfToken(agent, '/magic-link');
+
+  const res = await asHttps(agent.post('/magic-link'))
+    .type('form').send({ _csrf: token, email: 'rider@test.hk' });
+
+  const link = res.text.match(/https?:\/\/[^\s"<]+\/me\?token=[^\s"<&]+/);
+  assert.ok(link, 'magic link should be shown on screen when SMTP is off');
+  // The link carries a 7-day auth token. Emitting it as http:// puts that
+  // token on the wire in plaintext.
+  assert.match(link[0], /^https:\/\/booking\.example\.com\/me\?token=/);
+});
+
+test('the session cookie is marked Secure behind an https proxy, not on plain http', async () => {
+  const db = testDb();
+  const app = proxiedApp(db);
+  const secureCookies = (r) => (r.headers['set-cookie'] || []).join(' ');
+
+  const https = await asHttps(request(app).get('/magic-link'));
+  assert.match(secureCookies(https), /secure/i);
+
+  const http = await request(app).get('/magic-link').set('Host', 'booking.example.com');
+  assert.doesNotMatch(secureCookies(http), /secure/i, 'local http dev must still work');
+});
+
+test('Stripe redirect URLs inherit the proxied scheme', async () => {
+  const db = testDb();
+  const created = [];
+  const stripeService = createStripeService({
+    env: { STRIPE_SECRET_KEY: 'sk_test_x', STRIPE_WEBHOOK_SECRET: 'whsec_x' },
+    client: {
+      checkout: { sessions: { create: async (p) => { created.push(p); return { id: 'cs_1', url: 'https://checkout.test/s' }; } } },
+    },
+  });
+  db.prepare(
+    "INSERT INTO pack_products (name, credits, price_cents, active) VALUES ('10 Pack', 10, 150000, 1)"
+  ).run();
+  const productId = db.prepare('SELECT id FROM pack_products').get().id;
+
+  const app = createApp({ db, stripeService, env: { TRUST_PROXY: '1' } });
+  const agent = request.agent(app);
+  const token = await csrfToken(agent, '/buy');
+  await asHttps(agent.post(`/buy/pack/${productId}`))
+    .type('form').send({ _csrf: token, email: 'rider@test.hk' });
+
+  assert.equal(created.length, 1, 'checkout session should have been created');
+  assert.match(created[0].success_url, /^https:\/\/booking\.example\.com\//);
+  assert.match(created[0].cancel_url, /^https:\/\/booking\.example\.com\//);
+});
+
+test('app_secret is not reachable from templates', async () => {
+  const db = testDb();
+  setSetting(db, 'app_secret', 'SECRET-THAT-MUST-NOT-RENDER');
+  const app = createApp({ db, env: {} });
+  // Swap the view engine for one that dumps everything the template was given,
+  // so this asserts on what a view can actually reach rather than on internals.
+  app.engine('ejs', (file, options, cb) => cb(null, JSON.stringify(options)));
+
+  const body = (await request(app).get('/no-such-page')).text;
+
+  assert.doesNotMatch(body, /SECRET-THAT-MUST-NOT-RENDER/,
+    'app_secret signs sessions and magic tokens — a view must not be able to render it');
+  assert.match(body, /studio_name/, 'the rest of settings should still be there');
+});
+
+test('login takes the same work for a known and an unknown email', async () => {
+  const db = testDb();
+  createUser(db, { email: 'owner@studio.hk', password: 'correct horse battery', role: 'owner' });
+
+  // Skipping bcrypt on a missing user answered ~3000x faster and made the
+  // login form enumerate staff emails. Wall-clock is too flaky to assert on,
+  // so assert the observable cause: a bcrypt comparison happens either way.
+  const { default: bcrypt } = await import('bcryptjs');
+  const realCompare = bcrypt.compareSync;
+  let compares = 0;
+  bcrypt.compareSync = (...args) => { compares += 1; return realCompare.apply(bcrypt, args); };
+  try {
+    compares = 0;
+    assert.equal(authenticate(db, 'nosuchuser@studio.hk', 'guess'), null);
+    assert.equal(compares, 1, 'an unknown email must still pay for a bcrypt comparison');
+
+    compares = 0;
+    assert.equal(authenticate(db, 'owner@studio.hk', 'guess'), null);
+    assert.equal(compares, 1);
+  } finally {
+    bcrypt.compareSync = realCompare;
+  }
+
+  // and the happy path still works
+  assert.ok(authenticate(db, 'owner@studio.hk', 'correct horse battery'));
+});

package/test/stripe-halfconfig.test.js

@@ -0,0 +1,98 @@
+// A Stripe secret key without STRIPE_WEBHOOK_SECRET used to send clients to
+// Checkout anyway. They paid, /webhooks/stripe answered 501, and no pass and no
+// payment row was ever created.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import request from 'supertest';
+import { createApp } from '../src/app.js';
+import { createStripeService } from '../src/services/stripe.js';
+import { createUser } from '../src/services/auth.js';
+import { testDb, csrfToken } from './helpers.js';
+
+/** A studio with one pack, one subscribable plan, and the given Stripe env. */
+function studio(env) {
+  const db = testDb();
+  createUser(db, { email: 'owner@test.test', password: 'password123', role: 'owner' });
+  db.prepare("INSERT INTO pack_products (name, credits, price_cents, active) VALUES ('10 Pack', 10, 150000, 1)").run();
+  db.prepare("INSERT INTO membership_plans (name, price_cents, unlimited, active, stripe_price_id) VALUES ('Unlimited', 90000, 1, 1, 'price_x')").run();
+  const created = [];
+  const stripeService = createStripeService({
+    env,
+    client: {
+      checkout: {
+        sessions: {
+          create: async (params) => {
+            created.push(params);
+            return { id: 'cs_1', url: 'https://checkout.stripe.test/cs_1' };
+          },
+        },
+      },
+    },
+  });
+  return {
+    db,
+    created,
+    packId: db.prepare('SELECT id FROM pack_products').get().id,
+    planId: db.prepare('SELECT id FROM membership_plans').get().id,
+    app: createApp({ db, stripeService, env: {} }),
+  };
+}
+
+const HALF = { STRIPE_SECRET_KEY: 'sk_test_x' };
+const FULL = { STRIPE_SECRET_KEY: 'sk_test_x', STRIPE_WEBHOOK_SECRET: 'whsec_x' };
+
+async function buy(app, path, form) {
+  const agent = request.agent(app);
+  const _csrf = await csrfToken(agent, '/buy');
+  return agent.post(path).type('form').send({ _csrf, ...form });
+}
+
+test('a secret key without a webhook secret does not take money online', async () => {
+  const { app, created, packId, planId } = studio(HALF);
+
+  const pack = await buy(app, `/buy/pack/${packId}`, { email: 'rider@test.hk' });
+  assert.equal(pack.status, 200, 'no redirect to Checkout');
+  assert.match(pack.text, /pay/i);
+
+  const plan = await buy(app, `/buy/membership/${planId}`, { email: 'rider@test.hk' });
+  assert.equal(plan.status, 200);
+
+  assert.deepEqual(created, [], 'no Checkout session should be created at all');
+});
+
+test('the buy page offers pay-at-studio when the webhook secret is missing', async () => {
+  const half = await request(studio(HALF).app).get('/buy');
+  assert.doesNotMatch(half.text, /Buy online|Subscribe online/);
+
+  const full = await request(studio(FULL).app).get('/buy');
+  assert.match(full.text, /Buy online/);
+  assert.match(full.text, /Subscribe online/);
+});
+
+test('both keys present still redirects to Checkout', async () => {
+  const { app, created, packId, planId } = studio(FULL);
+
+  const pack = await buy(app, `/buy/pack/${packId}`, { email: 'rider@test.hk' });
+  assert.equal(pack.status, 303);
+  assert.equal(pack.headers.location, 'https://checkout.stripe.test/cs_1');
+
+  const plan = await buy(app, `/buy/membership/${planId}`, { email: 'rider@test.hk' });
+  assert.equal(plan.status, 303);
+
+  assert.equal(created.length, 2);
+});
+
+test('admin pages report the missing webhook secret instead of "connected"', async () => {
+  const { app } = studio(HALF);
+  const agent = request.agent(app);
+  const _csrf = await csrfToken(agent, '/admin/login');
+  await agent.post('/admin/login').type('form').send({ email: 'owner@test.test', password: 'password123', _csrf });
+
+  const dash = await agent.get('/admin');
+  assert.doesNotMatch(dash.text, /Stripe: connected/);
+  assert.match(dash.text, /webhook secret missing/i);
+
+  const settings = await agent.get('/admin/settings');
+  assert.match(settings.text, /Online payment is off/i);
+  assert.doesNotMatch(settings.text, /see \.env/);
+});

package/test/web.test.js

@@ -257,7 +257,11 @@ test('admin: rules CRUD generates instances; roster check-in works over HTTP', a
 
   // book someone in, then check them in via admin
   const clientId = makeClient(db, { email: 'roster@test.hk' });
-  const instId = db.prepare('SELECT id FROM class_instances ORDER BY starts_at LIMIT 1').get().id;
+  // the earliest instance of a Tuesday 18:30 rule is today's when the suite
+  // runs on a Tuesday evening, and book() rejects a class that has started
+  const instId = db.prepare(
+    'SELECT id FROM class_instances WHERE starts_at > ? ORDER BY starts_at LIMIT 1'
+  ).get(new Date().toISOString()).id;
   const { book } = await import('../src/services/booking.js');
   const { booking } = book(db, clientId, instId);
 

package/views/admin/dashboard.ejs

@@ -7,7 +7,7 @@
   </article>
   <article>
     <h4>Status</h4>
-    <p><small>Stripe: <%= stripeConfigured ? 'connected' : 'not connected — purchases fall back to pay-at-studio' %><br>
+    <p><small>Stripe: <%= stripeConfigured ? 'connected' : (stripeKeySet ? 'key set, webhook secret missing. Online payment is off, see Settings' : 'not connected — purchases fall back to pay-at-studio') %><br>
     Email: <%= smtpConfigured ? 'SMTP configured' : 'off — messages saved to data/outbox, links shown on screen' %></small></p>
   </article>
 </div>

package/views/admin/settings.ejs

@@ -26,8 +26,13 @@
   <article>
     <h5>Integrations (set via environment / .env)</h5>
     <p><small>
-      Stripe secret key: <strong><%= stripeConfigured ? 'set' : 'not set' %></strong><br>
-      Stripe webhook secret: <strong><%= locals.services ? '' : '' %><%= stripeConfigured ? (settings.stripe_webhook_hint || 'see .env') : '—' %></strong><br>
+      Stripe secret key: <strong><%= stripeKeySet ? 'set' : 'not set' %></strong><br>
+      Stripe webhook secret: <strong><%= stripeWebhookSet ? 'set' : 'not set' %></strong><br>
+      <% if (stripeKeySet && !stripeWebhookSet) { %>
+      <strong>Online payment is off.</strong> Without STRIPE_WEBHOOK_SECRET the
+      fulfilment webhook is rejected, so a client would be charged and receive
+      nothing. Purchases use pay-at-studio until it is set.<br>
+      <% } %>
       SMTP: <strong><%= smtpConfigured ? 'configured' : 'not set (emails go to data/outbox/, links shown on screen)' %></strong>
     </small></p>
   </article>

package/PROGRESS.md

@@ -1,60 +0,0 @@
-# Studio OS — build progress
-
-Authoritative spec: `SPEC.md`. Node used: **v22.18.0** (better-sqlite3 11.x prebuilt, SQLite 3.49.2 — no compile needed).
-Run tests: `npm test`. Start: `npm start` (PORT env, default 3000).
-
-## Done
-- [x] Scaffold: package.json (studio-os, MIT, type:module), deps installed, htmx 1.9.12 + pico.css 2.0.6 vendored in `public/vendor/` (commit 2cb4364)
-- [x] DB: `src/db/schema.sql` (migration v1), `src/db/index.js` (WAL, FK on, migrations, settings helpers, audit), `src/lib/time.js` (Intl-based tz conversion, no tz lib)
-- [x] Core booking engine `src/services/booking.js`: payment resolution (membership → soonest-expiring pack → drop-in), atomic capacity via transactions, waitlist FIFO + promotion (re-resolves payment at promotion), cancellation window refund / late-cancel forfeit (policy setting), cancelClass full refund, attendance marking
-- [x] Rolling schedule generator `src/services/schedule.js` (8-week horizon, idempotent on (rule_id, starts_at))
-- [x] Tests: 31 passing (`test/booking.test.js`, `test/schedule.test.js`) covering every SPEC booking rule incl. capacity race, FIFO promotion, credit deduct/refund, soonest-expiring pack selection, tz materialization (commit fadbc47)
-- [x] Auth service (bcryptjs + HMAC magic-link tokens), mailer (SMTP or `data/outbox/*.eml` fallback + all templates), Stripe service (isolated, injectable client, idempotent fulfillment by `payments.stripe_session_id` UNIQUE)
-- [x] App skeleton `src/app.js` (webhook raw-body mounted before parsers, cookie-session, setup gate, view locals) + `src/server.js` (boot + daily generator)
-- [x] Routes: setup wizard, staff login/logout, webhooks, public (schedule/class/book with waiver/buy/magic-link request), `src/routes/me.js` (magic-link self-service + cancel)
-- [x] Admin routes + full EJS UI (public + admin), PWA assets (manifest, sw.js, custom.css), 16 supertest web tests (commits 897ad8e, 7449c52)
-- [x] Mindbody importer: `src/services/importer.js` (CSV parser, mapping defaults + overrides, idempotent by email), `scripts/import-mindbody.mjs` CLI (--clients/--passes/--mapping/--db/--dry-run), realistic fixtures `test/fixtures/mindbody-{clients,passes}.csv` (edge cases: missing email, quoted commas, uppercase email, malformed row), admin `/admin/import` page wired, 8 importer tests + 1 web test (56 total green)
-
-- [x] Stripe webhook tests `test/stripe.test.js` (11 tests, mock client, no network): signature reject, pack/membership/drop-in fulfillment, replay idempotency, subscription cancel, 500-retry on unknown product, checkout session params (67 total green)
-- [x] `scripts/seed.mjs` (demo studio: 3 instructors, 4 class types, 8 weekly rules → 64 instances, products, 4 clients w/ passes+membership, 2×2 demo bookings; refuses non-empty DB without --force; login owner@example.com/studio-demo), Dockerfile (node:22-slim, VOLUME /app/data) + .dockerignore + docker-compose.yml (studio-data volume), README.md (quickstart Docker+Node, Mindbody migration guide, Stripe guide, limitations, roadmap), CHANGELOG.md. NOTE: docker build not run at the time — verified later, see the hardening pass below.
-
-## Self-verification (2026-07-27, item 8) — ALL PASSED
-Live server on PORT=3791, DB_PATH=data/verify-studio.db (deleted after), Node v22.18.0:
-1. `npm test` → **67/67 pass, 0 fail** (booking 21 + schedule 10 + web 17 + importer 8 + stripe 11).
-2. Fresh empty DB boot: `GET /` → 302 `Location: /setup`; `GET /setup` → 200 "Welcome to Studio OS".
-3. `node scripts/seed.mjs` → 3 instructors, 4 class types, 8 rules → 64 instances, products, 4 clients, 4 demo bookings. Re-run without `--force` correctly refused (exit 1).
-4. Seeded boot: `GET /` → 200; schedule lists 20 upcoming instances (Vinyasa/Pilates/Handstand/Yin) with "spots left".
-5. Booking round-trip: `POST /class/33/book` (new guest, waiver_agree=1) → 200 "Booked"; duplicate re-POST did NOT create a second booking; admin login (`POST /admin/login` → 302) then `GET /admin/instances/33` roster shows the client, paid_with `drop_in_manual` ("pay at studio"), check-in buttons.
-6. Magic-link cancel: `POST /magic-link` → on-screen `/me?token=...` (SMTP off); `GET /me?token` → 200 listing the booking; `POST /me/cancel/5` → 302 back to /me, flash "cancelled", list empty; DB row: status='cancelled', cancelled_at set; roster no longer shows the client.
-7. Server stopped cleanly. NOT verified: `docker build` ($0/no-network guardrail — Dockerfile untested).
-
-## Hardening pass (2026-07-28)
-- [x] CSRF protection: random per-session token stored in the cookie-session, exposed as `res.locals.csrfToken`, hidden `_csrf` input added to all 36 POST forms (public book/buy/magic-link, /me cancel, setup, admin login/logout and every admin form). Middleware in `src/app.js` rejects POST/PUT/DELETE/PATCH with missing/mismatched token (403, timing-safe compare; `x-csrf-token` header also accepted). `/webhooks/stripe` exempt (mounted before the session layer + explicit path guard; authenticated by Stripe signature instead). Tests updated to cookie agents + `csrfToken()` helper; 2 explicit tests (no/wrong token → 403 + nothing written; valid token works; webhook stays exempt). 69/69 green.
-
-- [x] Docker verification (2026-07-28, Docker Desktop 4.44.2 / Engine 28.3.2, linux/amd64): `docker compose build` succeeded first try — `node:22-slim` + better-sqlite3 prebuilt glibc binary, no python3/make/g++ stage needed. Found + fixed a real compose bug: `environment:` list containing only comments parses as null → "must be a mapping" validation error; block now fully commented in mapping form. Live run: `docker compose up -d` → `GET /` 302 `/setup` on fresh volume → completed setup wizard via curl (CSRF cookie+token round-trip) → admin one-off class POST → public schedule renders Yoga Flow → guest booking on `/class/1` → "Booked"; booking POST without CSRF token → 403 in-container. `docker compose down -v` clean. Verified commands recorded in README.
-- [x] Rate limiting: `src/lib/ratelimit.js` (dependency-free in-memory fixed window, key = client IP + matched route pattern, injectable clock, X-Forwarded-For honored only when `TRUST_PROXY` env set). Wired in `src/app.js` before the CSRF check: `/magic-link` 5/15min, `/admin/login` 10/15min, booking/buy POSTs (`/class/:id/book`, `/buy/pack/:id`, `/buy/membership/:id`) 30/15min → friendly 429 + Retry-After. 4 tests in `test/ratelimit.test.js` (trigger, window reset via fake clock — no sleeps, XFF spoof/trust behavior). README limitations updated → new Security section; `TRUST_PROXY` documented in `.env.example`. 73/73 green. NOTE: limiter is per-process and resets on restart (documented).
-
-## v0.2.0 — instructor logins (2026-07-28) — SHIPPED, ALL VERIFIED
-- [x] Migration v2 (`src/db/002-instructor-role.sql`): users role CHECK rebuilt to allow 'instructor' (owner/staff untouched — verified against a real v1 file DB: both users kept, v2 applied, instructor insert OK); new `instructor_class_assignments (instructor_id→users, class_id→class_instances, PK both, ON DELETE CASCADE)` + idx_ica_class.
-- [x] Guards (`src/services/auth.js`): `requireAdmin` (admin router; instructor → 403, anon → 302 login), `requireInstructor` (instructor portal; admins → /admin). Login (`src/routes/auth.js`): `/login` aliases `/admin/login`; POST redirects by role (instructor → /instructor/schedule).
-- [x] Instructor portal (`src/routes/instructor.js` + `views/instructor/{schedule,roster}.ejs`): schedule (assigned classes from studio-local today, sorted by date), roster (attendee + status, 'attended' displayed as 'checked-in'; NO client emails exposed), POST checkin (assignment-guarded, booking must belong to the class, reuses `markAttendance`).
-- [x] Admin UI: Instructors page gains logins section; `/admin/instructors/new` (GET+POST, password ≥8, UNIQUE-email friendly error); `/admin/instructors/:id/classes` checkbox assignment (rewrites only the displayed upcoming window; past assignments kept). Routes declared BEFORE `POST /instructors/:id` so 'new' isn't captured as :id.
-- [x] Tests: `test/instructor.test.js` (8) + 4 new view-integrity tests = **110/110 green** (`npm test`).
-- [x] Live E2E on PORT=3799 (seeded DB, curl, then killed + scratch DB deleted): owner created kim@studio.test, assigned class 25 of 2; instructor login → 302 /instructor/schedule; schedule showed only Mat Pilates #25; /admin → 403; roster #9 → 403; roster #25 → 200; check-in booking 1 → Alice Chan 'checked-in'; check-in on #9 → 403; POST without CSRF → 403.
-- [x] package.json 0.2.0, CHANGELOG 0.2.0 entry, README (feature bullet + walkthrough step 6, roadmap line removed).
-
-## Next
-- v0.2.0 complete. Optional future: docker rebuild sanity check on next release; screenshots of the instructor portal for README.
-
-## Pragmatic choices where SPEC is silent (decided, noted per guardrail)
-- **pack_products table added** (schema v1): SPEC's buy page sells "class packs" but only defines per-client `passes`; a purchasable catalogue was needed. Same for drop-in pending payments → `payments.status` ('paid'|'pending').
-- **Waitlisted bookings do not deduct credits**; deduction happens at promotion (same tx), payment re-resolved at promotion time.
-- **Drop-in online**: booking is created immediately; payment row pending; Stripe checkout (kind=drop_in metadata) marks it paid via webhook. Capacity is not held hostage to checkout completion.
-- **Sessions**: cookie-session (signed cookie) — SPEC allows either. app_secret auto-generated into settings, overridable via APP_SECRET env.
-- ~~No CSRF tokens in v0.1 (same-site=lax cookies); listed in README limitations.~~ Added in the 2026-07-28 hardening pass (session-bound `_csrf` token, no csurf dependency).
-- `npm test` uses glob `"test/*.test.js"` — `node --test test/` breaks under Git Bash path mangling on Windows.
-
-## How to resume
-- `cd D:\Repos\ideas\studio-os && npm test` (expect 31+ green) and `git log --oneline` to see where things stand.
-- Work top-down through “Next”. Commit after each numbered item at minimum.
-- Guardrails: stay inside this folder; $0 / no network at boot or in tests; no remotes/publishing; Stripe/SMTP env-gated.