studio-os 0.2.0 → 0.4.0

package/package.json

@@ -1,54 +1,54 @@
-{
-  "name": "studio-os",
-  "version": "0.2.0",
-  "description": "Self-hosted studio management: booking, class packs, memberships. Bring your own Stripe.",
-  "license": "MIT",
-  "type": "module",
-  "main": "src/server.js",
-  "scripts": {
-    "start": "node src/server.js",
-    "dev": "node --watch src/server.js",
-    "test": "node --test \"test/*.test.js\"",
-    "seed": "node scripts/seed.mjs",
-    "import-mindbody": "node scripts/import-mindbody.mjs"
-  },
-  "engines": {
-    "node": ">=20"
-  },
-  "dependencies": {
-    "bcryptjs": "^2.4.3",
-    "better-sqlite3": "^11.10.0",
-    "cookie-session": "^2.1.0",
-    "dotenv": "^16.4.5",
-    "ejs": "^3.1.10",
-    "express": "^4.21.2",
-    "marked": "^12.0.2",
-    "nodemailer": "^6.9.16",
-    "stripe": "^16.12.0"
-  },
-  "devDependencies": {
-    "supertest": "^7.0.0"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/Booyaka101/studio-os.git"
-  },
-  "homepage": "https://github.com/Booyaka101/studio-os#readme",
-  "bugs": {
-    "url": "https://github.com/Booyaka101/studio-os/issues"
-  },
-  "keywords": [
-    "self-hosted",
-    "studio",
-    "yoga",
-    "pilates",
-    "gym",
-    "booking",
-    "class-packs",
-    "memberships",
-    "mindbody-alternative",
-    "stripe",
-    "scheduling",
-    "fitness"
-  ]
-}
+{
+  "name": "studio-os",
+  "version": "0.4.0",
+  "description": "Self-hosted studio management: booking, class packs, memberships. Bring your own Stripe.",
+  "license": "MIT",
+  "type": "module",
+  "main": "src/server.js",
+  "scripts": {
+    "start": "node src/server.js",
+    "dev": "node --watch src/server.js",
+    "test": "node --test \"test/*.test.js\"",
+    "seed": "node scripts/seed.mjs",
+    "import-mindbody": "node scripts/import-mindbody.mjs"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "dependencies": {
+    "bcryptjs": "^3.0.3",
+    "better-sqlite3": "^13.0.1",
+    "cookie-session": "^2.1.0",
+    "dotenv": "^18.0.2",
+    "ejs": "^6.0.1",
+    "express": "^5.2.1",
+    "marked": "^18.0.9",
+    "nodemailer": "^10.0.9",
+    "stripe": "^22.6.2"
+  },
+  "devDependencies": {
+    "supertest": "^7.0.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Booyaka101/studio-os.git"
+  },
+  "homepage": "https://github.com/Booyaka101/studio-os#readme",
+  "bugs": {
+    "url": "https://github.com/Booyaka101/studio-os/issues"
+  },
+  "keywords": [
+    "self-hosted",
+    "studio",
+    "yoga",
+    "pilates",
+    "gym",
+    "booking",
+    "class-packs",
+    "memberships",
+    "mindbody-alternative",
+    "stripe",
+    "scheduling",
+    "fitness"
+  ]
+}

package/runner-lock.json

@@ -0,0 +1,15 @@
+{
+  "schemaVersion": 1,
+  "label": "ubuntu-24.04",
+  "imageOS": "ubuntu24",
+  "imageVersion": "20260720.247.2",
+  "tools": {
+    "Node.js": {
+      "versions": [
+        "22.23.1"
+      ],
+      "source": "manifest"
+    }
+  },
+  "updatedAt": "2026-08-05T04:27:45.130Z"
+}

package/src/app.js

@@ -1,141 +1,163 @@
-import express from 'express';
-import cookieSession from 'cookie-session';
-import crypto from 'node:crypto';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { getSetting, allSettings } from './db/index.js';
-import { formatInTz } from './lib/time.js';
-import { createRateLimiter } from './lib/ratelimit.js';
-import { createMailer } from './services/mailer.js';
-import { createStripeService } from './services/stripe.js';
-import setupRoutes from './routes/setup.js';
-import authRoutes from './routes/auth.js';
-import publicRoutes from './routes/public.js';
-import meRoutes from './routes/me.js';
-import adminRoutes from './routes/admin.js';
-import instructorRoutes from './routes/instructor.js';
-import webhookRoutes from './routes/webhooks.js';
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-
-/**
- * Build the Express app. Dependencies are injectable for tests:
- * createApp({ db, mailer?, stripeService?, env?, now? })
- * `now` (clock) is used by the rate limiters so tests can move time.
- */
-export function createApp({ db, mailer, stripeService, env = process.env, now = Date.now }) {
-  const app = express();
-  app.set('view engine', 'ejs');
-  app.set('views', path.join(__dirname, '..', 'views'));
-  app.disable('x-powered-by');
-
-  const services = {
-    db,
-    mailer: mailer || createMailer({ env }),
-    stripe: stripeService || createStripeService({ env }),
-    env,
-    baseUrl(req) {
-      return env.BASE_URL || `${req.protocol}://${req.get('host')}`;
-    },
-  };
-  app.locals.services = services;
-
-  // Stripe webhook needs the raw body for signature verification — mount
-  // before any body parser.
-  app.use('/webhooks/stripe', express.raw({ type: '*/*' }), webhookRoutes(services));
-
-  app.use(express.urlencoded({ extended: true }));
-  app.use(express.static(path.join(__dirname, '..', 'public')));
-  app.use(cookieSession({
-    name: 'studio_session',
-    keys: [getSetting(db, 'app_secret', 'dev-secret')],
-    sameSite: 'lax',
-    httpOnly: true,
-    maxAge: 30 * 24 * 3600000,
-  }));
-
-  // View locals: settings + formatting helpers, refreshed per request.
-  app.use((req, res, next) => {
-    const s = allSettings(db);
-    res.locals.settings = s;
-    res.locals.tz = s.timezone || 'Asia/Hong_Kong';
-    res.locals.currency = s.currency || 'HKD';
-    res.locals.fmtDt = (iso, opts) => formatInTz(res.locals.tz, iso, opts);
-    res.locals.fmtMoney = (cents) => new Intl.NumberFormat('en', {
-      style: 'currency', currency: res.locals.currency, minimumFractionDigits: 0,
-    }).format((cents || 0) / 100);
-    res.locals.user = req.session && req.session.userId
-      ? db.prepare('SELECT id, email, name, role FROM users WHERE id = ?').get(req.session.userId)
-      : null;
-    res.locals.stripeConfigured = services.stripe.configured;
-    res.locals.smtpConfigured = services.mailer.smtpConfigured;
-    res.locals.flash = req.session ? req.session.flash : null;
-    if (req.session) delete req.session.flash;
-    next();
-  });
-
-  // Rate limiting (before CSRF so hammering can't even probe tokens):
-  // in-memory fixed window, per IP + route. Single-process; resets on restart.
-  const RL_WINDOW = 15 * 60 * 1000;
-  app.post('/magic-link', createRateLimiter({
-    windowMs: RL_WINDOW, max: 5, env, now,
-    message: 'Too many link requests — please wait 15 minutes and try again.',
-  }));
-  app.post('/admin/login', createRateLimiter({
-    windowMs: RL_WINDOW, max: 10, env, now,
-    message: 'Too many login attempts — please wait 15 minutes and try again.',
-  }));
-  app.post(['/class/:id/book', '/buy/pack/:id', '/buy/membership/:id'], createRateLimiter({
-    windowMs: RL_WINDOW, max: 30, env, now,
-    message: 'Too many booking attempts from your address — please wait a few minutes and try again.',
-  }));
-
-  // CSRF protection: a random per-session token lives in the signed cookie
-  // session and must be echoed back (hidden `_csrf` input or `x-csrf-token`
-  // header) on every state-changing request. /webhooks/stripe is exempt — it
-  // is mounted before this middleware and authenticated by Stripe signature.
-  app.use((req, res, next) => {
-    if (!req.session.csrf) req.session.csrf = crypto.randomBytes(24).toString('hex');
-    res.locals.csrfToken = req.session.csrf;
-    if (!['POST', 'PUT', 'DELETE', 'PATCH'].includes(req.method)) return next();
-    if (req.path.startsWith('/webhooks/')) return next();
-    const sent = (req.body && req.body._csrf) || req.get('x-csrf-token') || '';
-    const a = Buffer.from(String(sent));
-    const b = Buffer.from(req.session.csrf);
-    if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
-      return res.status(403).render('error', {
-        title: 'Session expired',
-        message: 'Your form session expired or the security token was missing. Please go back, refresh the page, and try again.',
-      });
-    }
-    next();
-  });
-
-  // First-run gate: until setup completes, everything routes to the wizard.
-  app.use((req, res, next) => {
-    const done = getSetting(db, 'setup_complete', '0') === '1';
-    if (!done && !req.path.startsWith('/setup') && !req.path.startsWith('/vendor')
-        && !req.path.startsWith('/css') && !req.path.startsWith('/js')) {
-      return res.redirect('/setup');
-    }
-    if (done && req.path.startsWith('/setup')) return res.redirect('/');
-    next();
-  });
-
-  app.use('/setup', setupRoutes(services));
-  app.use('/', authRoutes(services));
-  app.use('/admin', adminRoutes(services));
-  app.use('/instructor', instructorRoutes(services));
-  app.use('/me', meRoutes(services));
-  app.use('/', publicRoutes(services));
-
-  // 404 + error handler
-  app.use((req, res) => res.status(404).render('error', { title: 'Not found', message: 'Page not found.' }));
-  // eslint-disable-next-line no-unused-vars
-  app.use((err, req, res, next) => {
-    console.error('[error]', err);
-    res.status(500).render('error', { title: 'Error', message: err.expose ? err.message : 'Something went wrong.' });
-  });
-
-  return app;
-}
+import express from 'express';
+import cookieSession from 'cookie-session';
+import crypto from 'node:crypto';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { getSetting, allSettings } from './db/index.js';
+import { formatInTz } from './lib/time.js';
+import { createRateLimiter } from './lib/ratelimit.js';
+import { createMailer } from './services/mailer.js';
+import { createStripeService } from './services/stripe.js';
+import setupRoutes from './routes/setup.js';
+import authRoutes from './routes/auth.js';
+import publicRoutes from './routes/public.js';
+import meRoutes from './routes/me.js';
+import adminRoutes from './routes/admin.js';
+import instructorRoutes from './routes/instructor.js';
+import webhookRoutes from './routes/webhooks.js';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+
+/**
+ * Build the Express app. Dependencies are injectable for tests:
+ * createApp({ db, mailer?, stripeService?, env?, now? })
+ * `now` (clock) is used by the rate limiters so tests can move time.
+ */
+export function createApp({ db, mailer, stripeService, env = process.env, now = Date.now }) {
+  const app = express();
+  app.set('view engine', 'ejs');
+  app.set('views', path.join(__dirname, '..', 'views'));
+  app.disable('x-powered-by');
+
+  // Behind a TLS-terminating proxy the socket is plain HTTP, so req.protocol
+  // reads 'http' and every emailed magic link ships a 7-day auth token over
+  // plaintext. Honouring X-Forwarded-Proto is what makes baseUrl() correct.
+  // TRUST_PROXY is a hop count ('1') or any Express trust-proxy value.
+  if (env.TRUST_PROXY) {
+    const n = Number(env.TRUST_PROXY);
+    app.set('trust proxy', Number.isInteger(n) && n > 0 ? n : env.TRUST_PROXY);
+  }
+
+  const services = {
+    db,
+    mailer: mailer || createMailer({ env }),
+    stripe: stripeService || createStripeService({ env }),
+    env,
+    baseUrl(req) {
+      return env.BASE_URL || `${req.protocol}://${req.get('host')}`;
+    },
+  };
+  app.locals.services = services;
+
+  // Stripe webhook needs the raw body for signature verification — mount
+  // before any body parser.
+  app.use('/webhooks/stripe', express.raw({ type: '*/*' }), webhookRoutes(services));
+
+  // A pasted Mindbody client export is 100+ bytes a row once URL-encoded, so
+  // the 100kb default refused any studio with more than a few hundred clients.
+  app.use('/admin/import', express.urlencoded({ extended: true, limit: '20mb' }));
+  app.use(express.urlencoded({ extended: true }));
+  app.use(express.static(path.join(__dirname, '..', 'public')));
+  app.use(cookieSession({
+    name: 'studio_session',
+    keys: [getSetting(db, 'app_secret', 'dev-secret')],
+    sameSite: 'lax',
+    httpOnly: true,
+    maxAge: 30 * 24 * 3600000,
+  }));
+
+  // View locals: settings + formatting helpers, refreshed per request.
+  app.use((req, res, next) => {
+    // app_secret signs the session cookie and every magic-link token, so it
+    // stays out of the object every template can reach. No view renders it
+    // today; this is so none can start to.
+    const { app_secret: _secret, ...s } = allSettings(db);
+    res.locals.settings = s;
+    res.locals.tz = s.timezone || 'Asia/Hong_Kong';
+    res.locals.currency = s.currency || 'HKD';
+    res.locals.fmtDt = (iso, opts) => formatInTz(res.locals.tz, iso, opts);
+    res.locals.fmtMoney = (cents) => new Intl.NumberFormat('en', {
+      style: 'currency', currency: res.locals.currency, minimumFractionDigits: 0,
+    }).format((cents || 0) / 100);
+    res.locals.user = req.session && req.session.userId
+      ? db.prepare('SELECT id, email, name, role FROM users WHERE id = ?').get(req.session.userId)
+      : null;
+    // Public views ask "can we take money online?", which needs both keys.
+    res.locals.stripeConfigured = services.stripe.checkoutReady;
+    res.locals.stripeKeySet = services.stripe.configured;
+    res.locals.stripeWebhookSet = services.stripe.webhookConfigured;
+    res.locals.smtpConfigured = services.mailer.smtpConfigured;
+    res.locals.flash = req.session ? req.session.flash : null;
+    if (req.session) delete req.session.flash;
+    next();
+  });
+
+  // Rate limiting (before CSRF so hammering can't even probe tokens):
+  // in-memory fixed window, per IP + route. Single-process; resets on restart.
+  const RL_WINDOW = 15 * 60 * 1000;
+  app.post('/magic-link', createRateLimiter({
+    windowMs: RL_WINDOW, max: 5, env, now,
+    message: 'Too many link requests — please wait 15 minutes and try again.',
+  }));
+  app.post('/admin/login', createRateLimiter({
+    windowMs: RL_WINDOW, max: 10, env, now,
+    message: 'Too many login attempts — please wait 15 minutes and try again.',
+  }));
+  app.post(['/class/:id/book', '/buy/pack/:id', '/buy/membership/:id'], createRateLimiter({
+    windowMs: RL_WINDOW, max: 30, env, now,
+    message: 'Too many booking attempts from your address — please wait a few minutes and try again.',
+  }));
+
+  // CSRF protection: a random per-session token lives in the signed cookie
+  // session and must be echoed back (hidden `_csrf` input or `x-csrf-token`
+  // header) on every state-changing request. /webhooks/stripe is exempt — it
+  // is mounted before this middleware and authenticated by Stripe signature.
+  app.use((req, res, next) => {
+    if (!req.session.csrf) req.session.csrf = crypto.randomBytes(24).toString('hex');
+    res.locals.csrfToken = req.session.csrf;
+    if (!['POST', 'PUT', 'DELETE', 'PATCH'].includes(req.method)) return next();
+    if (req.path.startsWith('/webhooks/')) return next();
+    const sent = (req.body && req.body._csrf) || req.get('x-csrf-token') || '';
+    const a = Buffer.from(String(sent));
+    const b = Buffer.from(req.session.csrf);
+    if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
+      return res.status(403).render('error', {
+        title: 'Session expired',
+        message: 'Your form session expired or the security token was missing. Please go back, refresh the page, and try again.',
+      });
+    }
+    next();
+  });
+
+  // First-run gate: until setup completes, everything routes to the wizard.
+  app.use((req, res, next) => {
+    const done = getSetting(db, 'setup_complete', '0') === '1';
+    if (!done && !req.path.startsWith('/setup') && !req.path.startsWith('/vendor')
+        && !req.path.startsWith('/css') && !req.path.startsWith('/js')) {
+      return res.redirect('/setup');
+    }
+    if (done && req.path.startsWith('/setup')) return res.redirect('/');
+    next();
+  });
+
+  app.use('/setup', setupRoutes(services));
+  app.use('/', authRoutes(services));
+  app.use('/admin', adminRoutes(services));
+  app.use('/instructor', instructorRoutes(services));
+  app.use('/me', meRoutes(services));
+  app.use('/', publicRoutes(services));
+
+  // 404 + error handler
+  app.use((req, res) => res.status(404).render('error', { title: 'Not found', message: 'Page not found.' }));
+  // eslint-disable-next-line no-unused-vars
+  app.use((err, req, res, next) => {
+    console.error('[error]', err);
+    // Body-parser errors (oversized or malformed bodies) arrive before the
+    // locals middleware has run, and the layout can't render without these.
+    res.locals = { settings: {}, user: null, flash: null, ...res.locals };
+    const status = err.status >= 400 && err.status < 500 ? err.status : 500;
+    res.status(status).render('error', { title: 'Error', message: err.expose ? err.message : 'Something went wrong.' });
+  });
+
+  return app;
+}

package/src/db/003-stripe-invoices.sql

@@ -0,0 +1,6 @@
+-- v3: membership renewals are recorded from Stripe invoices, keyed on the
+-- invoice id so webhook retries can't record the same month twice.
+
+ALTER TABLE payments ADD COLUMN stripe_invoice_id TEXT;
+CREATE UNIQUE INDEX IF NOT EXISTS uq_payments_invoice
+  ON payments(stripe_invoice_id) WHERE stripe_invoice_id IS NOT NULL;

package/src/db/index.js

@@ -1,82 +1,83 @@
-import Database from 'better-sqlite3';
-import fs from 'node:fs';
-import path from 'node:path';
-import crypto from 'node:crypto';
-import { fileURLToPath } from 'node:url';
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-
-const MIGRATIONS = [
-  { version: 1, file: 'schema.sql' },
-  { version: 2, file: '002-instructor-role.sql' },
-];
-
-const DEFAULT_SETTINGS = {
-  studio_name: '',
-  timezone: 'Asia/Hong_Kong',
-  currency: 'HKD',
-  cancellation_window_hours: '12',
-  late_cancel_policy: 'forfeit', // forfeit | refund
-  waiver_markdown: '## Liability Waiver\n\nI understand that participation in classes involves physical activity and I take part at my own risk. I confirm I am in good health and will inform the instructor of any injuries or conditions.\n\nBy checking the box I agree to this waiver.',
-  setup_complete: '0',
-  horizon_weeks: '8',
-};
-
-/**
- * Open (or create) the database, enable WAL, run migrations, seed defaults.
- * @param {string} [dbPath] file path or ':memory:' (tests)
- */
-export function openDb(dbPath) {
-  const file = dbPath || process.env.DB_PATH || path.join(process.cwd(), 'data', 'studio.db');
-  if (file !== ':memory:') fs.mkdirSync(path.dirname(file), { recursive: true });
-  const db = new Database(file);
-  db.pragma('journal_mode = WAL');
-  db.pragma('foreign_keys = ON');
-  db.pragma('busy_timeout = 5000');
-  migrate(db);
-  return db;
-}
-
-function migrate(db) {
-  db.exec('CREATE TABLE IF NOT EXISTS schema_migrations (version INTEGER PRIMARY KEY, applied_at TEXT NOT NULL)');
-  const applied = new Set(db.prepare('SELECT version FROM schema_migrations').all().map((r) => r.version));
-  for (const m of MIGRATIONS) {
-    if (applied.has(m.version)) continue;
-    const sql = fs.readFileSync(path.join(__dirname, m.file), 'utf8');
-    db.transaction(() => {
-      db.exec(sql);
-      db.prepare('INSERT INTO schema_migrations (version, applied_at) VALUES (?, ?)')
-        .run(m.version, new Date().toISOString());
-    })();
-  }
-  // seed default settings (INSERT OR IGNORE keeps existing values)
-  const ins = db.prepare('INSERT OR IGNORE INTO settings (key, value) VALUES (?, ?)');
-  for (const [k, v] of Object.entries(DEFAULT_SETTINGS)) ins.run(k, v);
-  // app secret: generated once, persisted, overridable via env
-  if (!process.env.APP_SECRET) {
-    ins.run('app_secret', crypto.randomBytes(32).toString('hex'));
-  }
-}
-
-export function getSetting(db, key, fallback = '') {
-  if (key === 'app_secret' && process.env.APP_SECRET) return process.env.APP_SECRET;
-  const row = db.prepare('SELECT value FROM settings WHERE key = ?').get(key);
-  return row ? row.value : fallback;
-}
-
-export function setSetting(db, key, value) {
-  db.prepare('INSERT INTO settings (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value')
-    .run(key, String(value));
-}
-
-export function allSettings(db) {
-  const out = {};
-  for (const r of db.prepare('SELECT key, value FROM settings').all()) out[r.key] = r.value;
-  if (process.env.APP_SECRET) out.app_secret = process.env.APP_SECRET;
-  return out;
-}
-
-export function audit(db, who, action, entity = '') {
-  db.prepare('INSERT INTO audit_log (who, action, entity, at) VALUES (?, ?, ?, ?)')
-    .run(who || '', action, entity, new Date().toISOString());
-}
+import Database from 'better-sqlite3';
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+
+const MIGRATIONS = [
+  { version: 1, file: 'schema.sql' },
+  { version: 2, file: '002-instructor-role.sql' },
+  { version: 3, file: '003-stripe-invoices.sql' },
+];
+
+const DEFAULT_SETTINGS = {
+  studio_name: '',
+  timezone: 'Asia/Hong_Kong',
+  currency: 'HKD',
+  cancellation_window_hours: '12',
+  late_cancel_policy: 'forfeit', // forfeit | refund
+  waiver_markdown: '## Liability Waiver\n\nI understand that participation in classes involves physical activity and I take part at my own risk. I confirm I am in good health and will inform the instructor of any injuries or conditions.\n\nBy checking the box I agree to this waiver.',
+  setup_complete: '0',
+  horizon_weeks: '8',
+};
+
+/**
+ * Open (or create) the database, enable WAL, run migrations, seed defaults.
+ * @param {string} [dbPath] file path or ':memory:' (tests)
+ */
+export function openDb(dbPath) {
+  const file = dbPath || process.env.DB_PATH || path.join(process.cwd(), 'data', 'studio.db');
+  if (file !== ':memory:') fs.mkdirSync(path.dirname(file), { recursive: true });
+  const db = new Database(file);
+  db.pragma('journal_mode = WAL');
+  db.pragma('foreign_keys = ON');
+  db.pragma('busy_timeout = 5000');
+  migrate(db);
+  return db;
+}
+
+function migrate(db) {
+  db.exec('CREATE TABLE IF NOT EXISTS schema_migrations (version INTEGER PRIMARY KEY, applied_at TEXT NOT NULL)');
+  const applied = new Set(db.prepare('SELECT version FROM schema_migrations').all().map((r) => r.version));
+  for (const m of MIGRATIONS) {
+    if (applied.has(m.version)) continue;
+    const sql = fs.readFileSync(path.join(__dirname, m.file), 'utf8');
+    db.transaction(() => {
+      db.exec(sql);
+      db.prepare('INSERT INTO schema_migrations (version, applied_at) VALUES (?, ?)')
+        .run(m.version, new Date().toISOString());
+    })();
+  }
+  // seed default settings (INSERT OR IGNORE keeps existing values)
+  const ins = db.prepare('INSERT OR IGNORE INTO settings (key, value) VALUES (?, ?)');
+  for (const [k, v] of Object.entries(DEFAULT_SETTINGS)) ins.run(k, v);
+  // app secret: generated once, persisted, overridable via env
+  if (!process.env.APP_SECRET) {
+    ins.run('app_secret', crypto.randomBytes(32).toString('hex'));
+  }
+}
+
+export function getSetting(db, key, fallback = '') {
+  if (key === 'app_secret' && process.env.APP_SECRET) return process.env.APP_SECRET;
+  const row = db.prepare('SELECT value FROM settings WHERE key = ?').get(key);
+  return row ? row.value : fallback;
+}
+
+export function setSetting(db, key, value) {
+  db.prepare('INSERT INTO settings (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value')
+    .run(key, String(value));
+}
+
+export function allSettings(db) {
+  const out = {};
+  for (const r of db.prepare('SELECT key, value FROM settings').all()) out[r.key] = r.value;
+  if (process.env.APP_SECRET) out.app_secret = process.env.APP_SECRET;
+  return out;
+}
+
+export function audit(db, who, action, entity = '') {
+  db.prepare('INSERT INTO audit_log (who, action, entity, at) VALUES (?, ?, ?, ?)')
+    .run(who || '', action, entity, new Date().toISOString());
+}

package/src/routes/me.js

@@ -10,7 +10,7 @@ export default function meRoutes(services) {
   const r = Router();
 
   function requireClient(req, res) {
-    const token = req.query.token || req.body.token;
+    const token = req.query.token || (req.body && req.body.token);
     const clientId = verifyMagicToken(db, token);
     if (!clientId) {
       res.status(401).render('public/magic_request', {