studio-os 0.2.0 → 0.4.0

package/src/routes/public.js

@@ -117,9 +117,19 @@ export default function publicRoutes(services) {
           });
       mailer.send({ to: result.client.email, ...tpl });
 
+      // Same order promoteNext() uses to pick who gets the next free spot.
+      const b = result.booking;
+      const waitlistPosition = result.waitlisted ? db.prepare(
+        `SELECT COUNT(*) c FROM bookings WHERE class_instance_id = ? AND status = 'waitlist'
+           AND (created_at < ? OR (created_at = ? AND id <= ?))`
+      ).get(inst.id, b.created_at, b.created_at, b.id).c : null;
+
+      // Booking needs nothing but an email, so the link can't go on screen when
+      // it can go to the inbox: anyone who knows a client's address could book
+      // a class in their name and walk off with their self-service link.
       res.render('public/book_result', {
         title: result.waitlisted ? 'Waitlisted' : 'Booked',
-        inst, result, magicUrl,
+        inst, result, magicUrl: mailer.smtpConfigured ? null : magicUrl, waitlistPosition,
       });
     } catch (err) {
       if (err instanceof BookingError) {
@@ -150,7 +160,7 @@ export default function publicRoutes(services) {
     if (!/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email)) {
       return res.status(400).render('public/buy_manual', { title: 'Buy', product, plan: null, email: null, error: 'A valid email is required.' });
     }
-    if (services.stripe.configured) {
+    if (services.stripe.checkoutReady) {
       try {
         const session = await services.stripe.createPackCheckout({
           product, clientEmail: email, baseUrl: services.baseUrl(req),
@@ -171,7 +181,7 @@ export default function publicRoutes(services) {
     if (!/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email)) {
       return res.status(400).render('public/buy_manual', { title: 'Buy', product: null, plan, email: null, error: 'A valid email is required.' });
     }
-    if (services.stripe.configured && plan.stripe_price_id) {
+    if (services.stripe.checkoutReady && plan.stripe_price_id) {
       try {
         const session = await services.stripe.createMembershipCheckout({
           plan, clientEmail: email, baseUrl: services.baseUrl(req),

package/src/services/auth.js

@@ -1,81 +1,88 @@
-// Staff auth (bcryptjs) + HMAC magic-link tokens for client self-service.
-import bcrypt from 'bcryptjs';
-import crypto from 'node:crypto';
-import { getSetting } from '../db/index.js';
-
-export function hashPassword(plain) {
-  return bcrypt.hashSync(plain, 10);
-}
-
-export function verifyPassword(plain, hash) {
-  return bcrypt.compareSync(plain, hash);
-}
-
-export function createUser(db, { email, password, name = '', role = 'staff' }) {
-  const info = db.prepare(
-    'INSERT INTO users (email, password_hash, name, role) VALUES (?, ?, ?, ?)'
-  ).run(email.trim().toLowerCase(), hashPassword(password), name, role);
-  return info.lastInsertRowid;
-}
-
-export function authenticate(db, email, password) {
-  const user = db.prepare('SELECT * FROM users WHERE email = ?').get(String(email || '').trim().toLowerCase());
-  if (!user) return null;
-  return verifyPassword(String(password || ''), user.password_hash) ? user : null;
-}
-
-// --- magic links -----------------------------------------------------------
-
-function hmac(secret, payload) {
-  return crypto.createHmac('sha256', secret).update(payload).digest('base64url');
-}
-
-/** Signed token for a client, valid for ttlHours (default 7 days). */
-export function makeMagicToken(db, clientId, { ttlHours = 24 * 7, now = Date.now() } = {}) {
-  const secret = getSetting(db, 'app_secret');
-  const expires = now + ttlHours * 3600000;
-  const payload = `${clientId}.${expires}`;
-  return `${payload}.${hmac(secret, payload)}`;
-}
-
-/** Returns clientId or null. Constant-time signature check. */
-export function verifyMagicToken(db, token, { now = Date.now() } = {}) {
-  if (typeof token !== 'string') return null;
-  const parts = token.split('.');
-  if (parts.length !== 3) return null;
-  const [idStr, expStr, sig] = parts;
-  const secret = getSetting(db, 'app_secret');
-  const expected = hmac(secret, `${idStr}.${expStr}`);
-  const a = Buffer.from(sig);
-  const b = Buffer.from(expected);
-  if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) return null;
-  if (Number(expStr) < now) return null;
-  const id = Number(idStr);
-  return Number.isInteger(id) && id > 0 ? id : null;
-}
-
-// --- express middleware ----------------------------------------------------
-
-export function requireStaff(req, res, next) {
-  if (req.session && req.session.userId) return next();
-  return res.redirect('/admin/login');
-}
-
-/** Admin area: any logged-in owner/staff. Instructors get a hard 403. */
-export function requireAdmin(req, res, next) {
-  if (!req.session || !req.session.userId || !res.locals.user) return res.redirect('/admin/login');
-  if (res.locals.user.role === 'instructor') {
-    return res.status(403).render('error', {
-      title: 'Forbidden',
-      message: 'Instructor accounts cannot access the admin area.',
-    });
-  }
-  next();
-}
-
-/** Instructor portal: instructor role only; admins are sent to their own UI. */
-export function requireInstructor(req, res, next) {
-  if (!req.session || !req.session.userId || !res.locals.user) return res.redirect('/admin/login');
-  if (res.locals.user.role !== 'instructor') return res.redirect('/admin');
-  next();
-}
+// Staff auth (bcryptjs) + HMAC magic-link tokens for client self-service.
+import bcrypt from 'bcryptjs';
+import crypto from 'node:crypto';
+import { getSetting } from '../db/index.js';
+
+export function hashPassword(plain) {
+  return bcrypt.hashSync(plain, 10);
+}
+
+export function verifyPassword(plain, hash) {
+  return bcrypt.compareSync(plain, hash);
+}
+
+export function createUser(db, { email, password, name = '', role = 'staff' }) {
+  const info = db.prepare(
+    'INSERT INTO users (email, password_hash, name, role) VALUES (?, ?, ?, ?)'
+  ).run(email.trim().toLowerCase(), hashPassword(password), name, role);
+  return info.lastInsertRowid;
+}
+
+// Returning early for an unknown email skips bcrypt entirely, which answers in
+// microseconds instead of tens of milliseconds and turns the login form into a
+// staff-email oracle. Comparing against a throwaway hash of the same cost keeps
+// both paths the same shape. /magic-link already refuses to leak which emails
+// exist; this is the same promise on the staff side.
+const DUMMY_HASH = bcrypt.hashSync('password-that-is-never-valid', 10);
+
+export function authenticate(db, email, password) {
+  const user = db.prepare('SELECT * FROM users WHERE email = ?').get(String(email || '').trim().toLowerCase());
+  const ok = verifyPassword(String(password || ''), user ? user.password_hash : DUMMY_HASH);
+  return user && ok ? user : null;
+}
+
+// --- magic links -----------------------------------------------------------
+
+function hmac(secret, payload) {
+  return crypto.createHmac('sha256', secret).update(payload).digest('base64url');
+}
+
+/** Signed token for a client, valid for ttlHours (default 7 days). */
+export function makeMagicToken(db, clientId, { ttlHours = 24 * 7, now = Date.now() } = {}) {
+  const secret = getSetting(db, 'app_secret');
+  const expires = now + ttlHours * 3600000;
+  const payload = `${clientId}.${expires}`;
+  return `${payload}.${hmac(secret, payload)}`;
+}
+
+/** Returns clientId or null. Constant-time signature check. */
+export function verifyMagicToken(db, token, { now = Date.now() } = {}) {
+  if (typeof token !== 'string') return null;
+  const parts = token.split('.');
+  if (parts.length !== 3) return null;
+  const [idStr, expStr, sig] = parts;
+  const secret = getSetting(db, 'app_secret');
+  const expected = hmac(secret, `${idStr}.${expStr}`);
+  const a = Buffer.from(sig);
+  const b = Buffer.from(expected);
+  if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) return null;
+  if (Number(expStr) < now) return null;
+  const id = Number(idStr);
+  return Number.isInteger(id) && id > 0 ? id : null;
+}
+
+// --- express middleware ----------------------------------------------------
+
+export function requireStaff(req, res, next) {
+  if (req.session && req.session.userId) return next();
+  return res.redirect('/admin/login');
+}
+
+/** Admin area: any logged-in owner/staff. Instructors get a hard 403. */
+export function requireAdmin(req, res, next) {
+  if (!req.session || !req.session.userId || !res.locals.user) return res.redirect('/admin/login');
+  if (res.locals.user.role === 'instructor') {
+    return res.status(403).render('error', {
+      title: 'Forbidden',
+      message: 'Instructor accounts cannot access the admin area.',
+    });
+  }
+  next();
+}
+
+/** Instructor portal: instructor role only; admins are sent to their own UI. */
+export function requireInstructor(req, res, next) {
+  if (!req.session || !req.session.userId || !res.locals.user) return res.redirect('/admin/login');
+  if (res.locals.user.role !== 'instructor') return res.redirect('/admin');
+  next();
+}

package/src/services/booking.js

@@ -24,22 +24,28 @@ function bookedCount(db, instanceId) {
 /** Lazy monthly-credit cycle reset for a credit-based membership. */
 function refreshMembershipCycle(db, m, todayLocal) {
   if (m.unlimited || !m.credits_per_month) return m;
-  let cycleStart = m.cycle_started_on || m.started_on;
-  let changed = false;
-  // advance cycle start by whole months until it is the current cycle
-  while (addMonths(cycleStart, 1) <= todayLocal) {
-    cycleStart = addMonths(cycleStart, 1);
-    changed = true;
-  }
-  if (changed) {
+  // Cycles anchor on the join date rather than stepping from the previous
+  // cycle. Stepping compounds February's day clamp: a membership joined on the
+  // 31st becomes the 28th that month and then stays the 28th for good. From
+  // the anchor it clamps only where it has to — 31 Jan, 28 Feb, 31 Mar.
+  const anchor = m.started_on;
+  const [ay, am] = anchor.split('-').map(Number);
+  const [ty, tm] = todayLocal.split('-').map(Number);
+  let n = (ty - ay) * 12 + (tm - am);
+  if (n > 0 && addMonths(anchor, n) > todayLocal) n -= 1;
+  const cycleStart = addMonths(anchor, Math.max(0, n));
+
+  if (m.cycle_started_on === cycleStart) return m;
+  // Only a new month refills credits. Correcting a drifted day inside the
+  // current month must not hand the client a free reset.
+  const newMonth = (m.cycle_started_on || anchor).slice(0, 7) !== cycleStart.slice(0, 7);
+  if (newMonth) {
     db.prepare('UPDATE memberships SET cycle_started_on = ?, credits_used_this_cycle = 0 WHERE id = ?')
       .run(cycleStart, m.id);
-    m = { ...m, cycle_started_on: cycleStart, credits_used_this_cycle: 0 };
-  } else if (!m.cycle_started_on) {
-    db.prepare('UPDATE memberships SET cycle_started_on = ? WHERE id = ?').run(cycleStart, m.id);
-    m = { ...m, cycle_started_on: cycleStart };
+    return { ...m, cycle_started_on: cycleStart, credits_used_this_cycle: 0 };
   }
-  return m;
+  db.prepare('UPDATE memberships SET cycle_started_on = ? WHERE id = ?').run(cycleStart, m.id);
+  return { ...m, cycle_started_on: cycleStart };
 }
 
 function addMonths(dateStr, n) {

package/src/services/stripe.js

@@ -23,6 +23,12 @@ export function createStripeService({ env = process.env, client } = {}) {
   return {
     configured: Boolean(secretKey),
     webhookConfigured: Boolean(webhookSecret),
+    // Checkout is only safe to offer when the webhook that fulfils it will be
+    // accepted. With a secret key but no webhook secret the client pays at
+    // Stripe and /webhooks/stripe answers 501, so no pass is ever created and
+    // no payment is recorded — the money lands in Stripe with nothing to show
+    // for it. Half-configured falls back to the manual pay-at-studio flow.
+    checkoutReady: Boolean(secretKey && webhookSecret),
     publishableKey,
 
     /** One-time Checkout for a class pack. Returns the session (url etc). */
@@ -80,6 +86,9 @@ export function fulfillCheckoutSession(db, session) {
   const email = (meta.client_email || session.customer_email
     || (session.customer_details && session.customer_details.email) || '').toLowerCase();
   if (!email) throw new Error('Checkout session has no client email');
+  // Bank debits and other delayed methods complete the session before the money
+  // arrives. checkout.session.async_payment_succeeded brings it back as 'paid'.
+  if (session.payment_status === 'unpaid') return { fulfilled: false, reason: 'awaiting_payment' };
 
   return db.transaction(() => {
     const existing = db.prepare('SELECT id FROM payments WHERE stripe_session_id = ?').get(session.id);
@@ -152,11 +161,45 @@ export function fulfillCheckoutSession(db, session) {
   })();
 }
 
+/**
+ * Record a membership renewal payment. The subscription's first invoice was
+ * already recorded from its Checkout session, so only later cycles count.
+ * Idempotent via payments.stripe_invoice_id.
+ */
+export function recordMembershipRenewal(db, invoice) {
+  if (invoice.billing_reason === 'subscription_create') return { fulfilled: false, reason: 'first_invoice' };
+  // Newer API versions moved this under parent.subscription_details, and a
+  // webhook payload follows the endpoint's API version, so read both.
+  const subscriptionId = (invoice.parent && invoice.parent.subscription_details
+    && invoice.parent.subscription_details.subscription) || invoice.subscription;
+  if (!subscriptionId) return { fulfilled: false, reason: 'not_a_subscription' };
+  if (!invoice.amount_paid) return { fulfilled: false, reason: 'nothing_paid' };
+
+  return db.transaction(() => {
+    const membership = db.prepare('SELECT * FROM memberships WHERE stripe_subscription_id = ?').get(subscriptionId);
+    if (!membership) return { fulfilled: false, reason: 'unknown_subscription' };
+    const existing = db.prepare('SELECT id FROM payments WHERE stripe_invoice_id = ?').get(invoice.id);
+    if (existing) return { fulfilled: false, reason: 'already_processed' };
+
+    const currency = (invoice.currency || getSetting(db, 'currency', 'HKD')).toUpperCase();
+    db.prepare(
+      `INSERT INTO payments (client_id, amount_cents, currency, method, reference, what, status, stripe_invoice_id)
+       VALUES (?, ?, ?, 'stripe', ?, 'membership', 'paid', ?)`
+    ).run(membership.client_id, invoice.amount_paid, currency, membership.plan_name, invoice.id);
+    audit(db, 'stripe-webhook', 'membership_renewed', `membership:${membership.id} invoice:${invoice.id}`);
+    return { fulfilled: true, kind: 'membership_renewal', clientId: membership.client_id };
+  })();
+}
+
 /** Handle a parsed Stripe event. Returns a result object for logging. */
 export function handleStripeEvent(db, event) {
-  if (event.type === 'checkout.session.completed') {
+  if (event.type === 'checkout.session.completed'
+      || event.type === 'checkout.session.async_payment_succeeded') {
     return fulfillCheckoutSession(db, event.data.object);
   }
+  if (event.type === 'invoice.paid') {
+    return recordMembershipRenewal(db, event.data.object);
+  }
   if (event.type === 'customer.subscription.deleted') {
     const sub = event.data.object;
     const r = db.prepare(

package/test/booking-link.test.js

@@ -0,0 +1,47 @@
+// Booking needs only an email, so the page it returns must not hand over the
+// self-service link for whatever address was typed.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import request from 'supertest';
+import { createApp } from '../src/app.js';
+import { testDb, makeClient, makeClassType, makeInstance, csrfToken } from './helpers.js';
+
+function appWith(db, { smtp }) {
+  const sent = [];
+  const mailer = { smtpConfigured: smtp, async send(msg) { sent.push(msg); return true; } };
+  return { app: createApp({ db, mailer, env: {} }), sent };
+}
+
+async function bookAs(app, instanceId, email) {
+  const agent = request.agent(app);
+  const _csrf = await csrfToken(agent, `/class/${instanceId}`);
+  return agent.post(`/class/${instanceId}/book`).type('form').send({ _csrf, email, waiver_agree: '1' });
+}
+
+test('with SMTP on, booking in someone else\'s name does not reveal their link', async () => {
+  const db = testDb();
+  makeClient(db, { email: 'member@test.hk', name: 'Member' });
+  const inst = makeInstance(db, makeClassType(db));
+  const { app, sent } = appWith(db, { smtp: true });
+
+  const res = await bookAs(app, inst, 'member@test.hk');
+
+  assert.equal(res.status, 200);
+  assert.doesNotMatch(res.text, /\/me\?token=/);
+  assert.match(res.text, /on its way/);
+  // The owner of the address still gets their link, by email.
+  assert.equal(sent.length, 1);
+  assert.equal(sent[0].to, 'member@test.hk');
+  assert.match(sent[0].text, /\/me\?token=/);
+});
+
+test('with SMTP off, the link is still shown so the studio works offline', async () => {
+  const db = testDb();
+  const inst = makeInstance(db, makeClassType(db));
+  const { app } = appWith(db, { smtp: false });
+
+  const res = await bookAs(app, inst, 'walkin@test.hk');
+
+  assert.equal(res.status, 200);
+  assert.match(res.text, /\/me\?token=/);
+});

package/test/deps.test.js

@@ -0,0 +1,108 @@
+// The Stripe and mailer suites both run against stand-ins: test/stripe.test.js
+// injects a mock client, and every other test leaves SMTP_HOST unset so the
+// mailer takes the outbox branch. Neither imports the real package, so a major
+// bump can rewrite the API and still see a green suite. These tests pin the two
+// bits of third-party behaviour the app cannot work without.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import net from 'node:net';
+import crypto from 'node:crypto';
+import { createStripeService } from '../src/services/stripe.js';
+import { createMailer } from '../src/services/mailer.js';
+
+/**
+ * Enough of an SMTP server for nodemailer to complete a send. Resolves with the
+ * DATA payload it received. No STARTTLS advertised, so the client stays plain.
+ */
+function smtpSink() {
+  let resolveData;
+  const received = new Promise((r) => { resolveData = r; });
+  const server = net.createServer((socket) => {
+    let inData = false;
+    let body = '';
+    socket.write('220 sink.test ESMTP\r\n');
+    socket.on('data', (chunk) => {
+      if (inData) {
+        body += chunk.toString('utf8');
+        if (body.includes('\r\n.\r\n')) {
+          inData = false;
+          socket.write('250 2.0.0 Ok: queued\r\n');
+          resolveData(body.slice(0, body.indexOf('\r\n.\r\n')));
+        }
+        return;
+      }
+      for (const line of chunk.toString('utf8').split('\r\n').filter(Boolean)) {
+        const verb = line.slice(0, 4).toUpperCase();
+        if (verb === 'EHLO' || verb === 'HELO') socket.write('250-sink.test\r\n250 8BITMIME\r\n');
+        else if (verb === 'DATA') { inData = true; socket.write('354 End data with <CR><LF>.<CR><LF>\r\n'); }
+        else if (verb === 'QUIT') { socket.write('221 Bye\r\n'); socket.end(); }
+        else socket.write('250 2.0.0 Ok\r\n');
+      }
+    });
+    socket.on('error', () => {});
+  });
+  return { server, received };
+}
+
+test('mailer: the real nodemailer SMTP path delivers when SMTP_HOST is set', async (t) => {
+  const { server, received } = smtpSink();
+  await new Promise((r) => server.listen(0, '127.0.0.1', r));
+  t.after(() => server.close());
+
+  const mailer = createMailer({
+    env: { SMTP_HOST: '127.0.0.1', SMTP_PORT: String(server.address().port), SMTP_FROM: 'studio@test.hk' },
+  });
+  assert.equal(mailer.smtpConfigured, true);
+
+  const ok = await mailer.send({ to: 'rider@test.hk', subject: 'Booked: Yoga', text: 'See you there' });
+  assert.equal(ok, true, 'send() reported failure — it swallows errors, so check the mailer log');
+
+  const raw = await received;
+  assert.match(raw, /^To: rider@test\.hk$/m);
+  assert.match(raw, /^From: studio@test\.hk$/m);
+  assert.match(raw, /Booked: Yoga/);
+  assert.match(raw, /See you there/);
+});
+
+test('mailer: send() resolves false rather than throwing when SMTP is unreachable', async () => {
+  // A dead port: booking flows call send() fire-and-forget and must not 500.
+  const mailer = createMailer({ env: { SMTP_HOST: '127.0.0.1', SMTP_PORT: '1' } });
+  assert.equal(await mailer.send({ to: 'a@test.hk', subject: 's', text: 't' }), false);
+});
+
+test('stripe: the real SDK verifies a good webhook signature and rejects a forged one', async () => {
+  const secret = 'whsec_deps_test';
+  const svc = createStripeService({
+    env: { STRIPE_SECRET_KEY: 'sk_test_deps', STRIPE_WEBHOOK_SECRET: secret },
+  });
+
+  const payload = JSON.stringify({
+    id: 'evt_1', type: 'checkout.session.completed', data: { object: { id: 'cs_1' } },
+  });
+  const ts = Math.floor(Date.now() / 1000);
+  const sign = (body) => crypto.createHmac('sha256', secret).update(`${ts}.${body}`).digest('hex');
+
+  const event = await svc.parseWebhook(payload, `t=${ts},v1=${sign(payload)}`);
+  assert.equal(event.type, 'checkout.session.completed');
+  assert.equal(event.data.object.id, 'cs_1');
+
+  // A payload swapped after signing must not verify — this is the only thing
+  // stopping anyone who knows the URL from granting themselves a membership.
+  const forged = payload.replace('cs_1', 'cs_forged');
+  await assert.rejects(
+    () => svc.parseWebhook(forged, `t=${ts},v1=${sign(payload)}`),
+    /signature/i,
+  );
+  await assert.rejects(() => svc.parseWebhook(payload, `t=${ts},v1=deadbeef`), /signature/i);
+});
+
+test('stripe: the real SDK still exposes the Checkout surface the mock stands in for', async () => {
+  const svc = createStripeService({ env: { STRIPE_SECRET_KEY: 'sk_test_deps' } });
+  // Reaches into the client without a network call: a rename of
+  // checkout.sessions.create is a TypeError here, not a runtime 500 in prod.
+  const Stripe = (await import('stripe')).default;
+  const client = new Stripe('sk_test_deps');
+  assert.equal(typeof client.checkout.sessions.create, 'function');
+  assert.equal(typeof client.webhooks.constructEvent, 'function');
+  assert.equal(svc.configured, true);
+});

package/test/error-paths.test.js

@@ -0,0 +1,49 @@
+// Requests that used to end in a 500, or in a crashed error page.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import request from 'supertest';
+import { createApp } from '../src/app.js';
+import { createUser } from '../src/services/auth.js';
+import { testDb, csrfToken } from './helpers.js';
+
+function mindbodyClientsCsv(n) {
+  const rows = ['First Name,Last Name,Email,Mobile Phone,Notes,Liability Waiver'];
+  for (let i = 0; i < n; i++) {
+    rows.push(`Client${i},Surname${i},client${i}@example.com,+852 5555 ${String(i).padStart(4, '0')},Prefers a mat by the window,Yes`);
+  }
+  return rows.join('\n');
+}
+
+test('Admin → Import takes a Mindbody export bigger than 100kb', async () => {
+  const db = testDb();
+  createUser(db, { email: 'owner@test.hk', password: 'password123', role: 'owner' });
+  const agent = request.agent(createApp({ db, env: {} }));
+  let _csrf = await csrfToken(agent, '/admin/login');
+  await agent.post('/admin/login').type('form').send({ email: 'owner@test.hk', password: 'password123', _csrf });
+  _csrf = await csrfToken(agent, '/admin/import');
+
+  const csv = mindbodyClientsCsv(1500);
+  assert.ok(csv.length > 100 * 1024);
+  const res = await agent.post('/admin/import').type('form').send({ _csrf, kind: 'clients', csv });
+
+  assert.equal(res.status, 200);
+  assert.equal(db.prepare('SELECT COUNT(*) c FROM clients').get().c, 1500);
+});
+
+test('an oversized body elsewhere gets a 413 page, not a crashed error page', async () => {
+  const db = testDb();
+  const res = await request(createApp({ db, env: {} }))
+    .post('/magic-link').type('form').send({ email: 'x'.repeat(200 * 1024) });
+
+  assert.equal(res.status, 413);
+  assert.match(res.text, /<main class="container">/);
+  assert.doesNotMatch(res.text, /ReferenceError|at Layer/);
+});
+
+test('/me without a token asks for a new link instead of a 500', async () => {
+  const db = testDb();
+  const res = await request(createApp({ db, env: {} })).get('/me');
+
+  assert.equal(res.status, 401);
+  assert.match(res.text, /invalid or has expired/);
+});

package/test/membership-cycle.test.js

@@ -0,0 +1,78 @@
+// Monthly credit cycles for a membership joined near the end of a month.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { resolvePayment } from '../src/services/booking.js';
+import { testDb, makeClient, makeMembership } from './helpers.js';
+
+/** Run the lazy cycle refresh for `today` and report the stored cycle start. */
+function cycleOn(startedOn, today) {
+  const db = testDb();
+  const clientId = makeClient(db);
+  const id = makeMembership(db, clientId, { unlimited: false, creditsPerMonth: 4, startedOn });
+  db.prepare('UPDATE memberships SET cycle_started_on = ? WHERE id = ?').run(startedOn, id);
+  resolvePayment(db, clientId, { starts_at: `${today}T10:00:00Z`, credits_required: 1 }, { now: `${today}T09:00:00Z` });
+  return db.prepare('SELECT cycle_started_on FROM memberships WHERE id = ?').get(id).cycle_started_on;
+}
+
+test('a cycle anchored on the 31st returns to the 31st after February', () => {
+  // Stepping each cycle from the last one clamped to 28 Feb and then kept the
+  // 28th for good, quietly moving the client's refill date forward for ever.
+  const cases = [
+    ['2026-01-31', '2026-02-27', '2026-01-31'],
+    ['2026-01-31', '2026-02-28', '2026-02-28'], // February has to clamp
+    ['2026-01-31', '2026-03-30', '2026-02-28'],
+    ['2026-01-31', '2026-03-31', '2026-03-31'], // and March must recover
+    ['2026-01-31', '2026-04-30', '2026-04-30'],
+    ['2026-01-31', '2026-05-31', '2026-05-31'],
+  ];
+  for (const [started, today, want] of cases) {
+    assert.equal(cycleOn(started, today), want, `started ${started}, on ${today}`);
+  }
+});
+
+test('cycle anchoring handles leap years, year boundaries and mid-month joins', () => {
+  const cases = [
+    ['2024-01-31', '2024-02-29', '2024-02-29'], // leap February
+    ['2024-01-31', '2024-03-31', '2024-03-31'],
+    ['2025-11-30', '2026-02-27', '2026-01-30'], // across a year boundary
+    ['2025-11-30', '2026-02-28', '2026-02-28'], // 30th anchor clamps, and it is today
+    ['2026-01-15', '2026-03-14', '2026-02-15'], // ordinary anchor, unaffected
+    ['2026-01-15', '2026-03-15', '2026-03-15'],
+  ];
+  for (const [started, today, want] of cases) {
+    assert.equal(cycleOn(started, today), want, `started ${started}, on ${today}`);
+  }
+});
+
+test('correcting an already-drifted cycle does not refill credits mid-month', () => {
+  const db = testDb();
+  const clientId = makeClient(db);
+  const id = makeMembership(db, clientId, { unlimited: false, creditsPerMonth: 4, startedOn: '2026-01-31' });
+  // The state the old stepping logic left behind: June pinned to the 28th,
+  // three of four credits already spent this cycle.
+  db.prepare("UPDATE memberships SET cycle_started_on = '2026-06-28', credits_used_this_cycle = 3 WHERE id = ?")
+    .run(id);
+
+  resolvePayment(db, clientId, { starts_at: '2026-06-30T10:00:00Z', credits_required: 1 }, { now: '2026-06-30T09:00:00Z' });
+
+  const row = db.prepare('SELECT cycle_started_on, credits_used_this_cycle FROM memberships WHERE id = ?').get(id);
+  assert.equal(row.cycle_started_on, '2026-06-30', 'the drifted date should be corrected');
+  assert.equal(row.credits_used_this_cycle, 3, 'same month, so credits must not be refilled');
+});
+
+test('a genuinely new month still refills credits', () => {
+  const db = testDb();
+  const clientId = makeClient(db);
+  const id = makeMembership(db, clientId, { unlimited: false, creditsPerMonth: 4, startedOn: '2026-01-31' });
+  db.prepare("UPDATE memberships SET cycle_started_on = '2026-01-31', credits_used_this_cycle = 4 WHERE id = ?")
+    .run(id);
+
+  const resolved = resolvePayment(
+    db, clientId, { starts_at: '2026-03-31T10:00:00Z', credits_required: 1 }, { now: '2026-03-31T09:00:00Z' },
+  );
+
+  const row = db.prepare('SELECT cycle_started_on, credits_used_this_cycle FROM memberships WHERE id = ?').get(id);
+  assert.equal(row.cycle_started_on, '2026-03-31');
+  assert.equal(row.credits_used_this_cycle, 0);
+  assert.equal(resolved.paidWith, 'membership', 'a refilled cycle should cover the class again');
+});