studio-os 0.2.0 → 0.4.0

package/test/proxy-auth.test.js

@@ -0,0 +1,114 @@
+// Deployment-shape regressions: the app behind a TLS-terminating reverse proxy
+// (the layout README recommends), and the staff login as an email oracle.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import request from 'supertest';
+import { createApp } from '../src/app.js';
+import { createStripeService } from '../src/services/stripe.js';
+import { createUser, authenticate } from '../src/services/auth.js';
+import { testDb, makeClient, csrfToken } from './helpers.js';
+import { setSetting } from '../src/db/index.js';
+
+/** The documented reverse-proxy deployment: TRUST_PROXY set, BASE_URL unset. */
+function proxiedApp(db, extraEnv = {}) {
+  return createApp({ db, env: { TRUST_PROXY: '1', ...extraEnv } });
+}
+
+const asHttps = (r) => r
+  .set('X-Forwarded-Proto', 'https')
+  .set('Host', 'booking.example.com');
+
+test('magic links use https when the proxy terminated TLS', async () => {
+  const db = testDb();
+  makeClient(db, { email: 'rider@test.hk' });
+  const agent = request.agent(proxiedApp(db));
+  const token = await csrfToken(agent, '/magic-link');
+
+  const res = await asHttps(agent.post('/magic-link'))
+    .type('form').send({ _csrf: token, email: 'rider@test.hk' });
+
+  const link = res.text.match(/https?:\/\/[^\s"<]+\/me\?token=[^\s"<&]+/);
+  assert.ok(link, 'magic link should be shown on screen when SMTP is off');
+  // The link carries a 7-day auth token. Emitting it as http:// puts that
+  // token on the wire in plaintext.
+  assert.match(link[0], /^https:\/\/booking\.example\.com\/me\?token=/);
+});
+
+test('the session cookie is marked Secure behind an https proxy, not on plain http', async () => {
+  const db = testDb();
+  const app = proxiedApp(db);
+  const secureCookies = (r) => (r.headers['set-cookie'] || []).join(' ');
+
+  const https = await asHttps(request(app).get('/magic-link'));
+  assert.match(secureCookies(https), /secure/i);
+
+  const http = await request(app).get('/magic-link').set('Host', 'booking.example.com');
+  assert.doesNotMatch(secureCookies(http), /secure/i, 'local http dev must still work');
+});
+
+test('Stripe redirect URLs inherit the proxied scheme', async () => {
+  const db = testDb();
+  const created = [];
+  const stripeService = createStripeService({
+    env: { STRIPE_SECRET_KEY: 'sk_test_x', STRIPE_WEBHOOK_SECRET: 'whsec_x' },
+    client: {
+      checkout: { sessions: { create: async (p) => { created.push(p); return { id: 'cs_1', url: 'https://checkout.test/s' }; } } },
+    },
+  });
+  db.prepare(
+    "INSERT INTO pack_products (name, credits, price_cents, active) VALUES ('10 Pack', 10, 150000, 1)"
+  ).run();
+  const productId = db.prepare('SELECT id FROM pack_products').get().id;
+
+  const app = createApp({ db, stripeService, env: { TRUST_PROXY: '1' } });
+  const agent = request.agent(app);
+  const token = await csrfToken(agent, '/buy');
+  await asHttps(agent.post(`/buy/pack/${productId}`))
+    .type('form').send({ _csrf: token, email: 'rider@test.hk' });
+
+  assert.equal(created.length, 1, 'checkout session should have been created');
+  assert.match(created[0].success_url, /^https:\/\/booking\.example\.com\//);
+  assert.match(created[0].cancel_url, /^https:\/\/booking\.example\.com\//);
+});
+
+test('app_secret is not reachable from templates', async () => {
+  const db = testDb();
+  setSetting(db, 'app_secret', 'SECRET-THAT-MUST-NOT-RENDER');
+  const app = createApp({ db, env: {} });
+  // Swap the view engine for one that dumps everything the template was given,
+  // so this asserts on what a view can actually reach rather than on internals.
+  app.engine('ejs', (file, options, cb) => cb(null, JSON.stringify(options)));
+
+  const body = (await request(app).get('/no-such-page')).text;
+
+  assert.doesNotMatch(body, /SECRET-THAT-MUST-NOT-RENDER/,
+    'app_secret signs sessions and magic tokens — a view must not be able to render it');
+  assert.match(body, /studio_name/, 'the rest of settings should still be there');
+});
+
+test('login takes the same work for a known and an unknown email', async () => {
+  const db = testDb();
+  createUser(db, { email: 'owner@studio.hk', password: 'correct horse battery', role: 'owner' });
+
+  // Skipping bcrypt on a missing user answered ~3000x faster and made the
+  // login form enumerate staff emails. Wall-clock is too flaky to assert on,
+  // so assert the observable cause: a bcrypt comparison happens either way.
+  const { default: bcrypt } = await import('bcryptjs');
+  const realCompare = bcrypt.compareSync;
+  let compares = 0;
+  bcrypt.compareSync = (...args) => { compares += 1; return realCompare.apply(bcrypt, args); };
+  try {
+    compares = 0;
+    assert.equal(authenticate(db, 'nosuchuser@studio.hk', 'guess'), null);
+    assert.equal(compares, 1, 'an unknown email must still pay for a bcrypt comparison');
+
+    compares = 0;
+    assert.equal(authenticate(db, 'owner@studio.hk', 'guess'), null);
+    assert.equal(compares, 1);
+  } finally {
+    bcrypt.compareSync = realCompare;
+  }
+
+  // and the happy path still works
+  assert.ok(authenticate(db, 'owner@studio.hk', 'correct horse battery'));
+});

package/test/stripe-halfconfig.test.js

@@ -0,0 +1,98 @@
+// A Stripe secret key without STRIPE_WEBHOOK_SECRET used to send clients to
+// Checkout anyway. They paid, /webhooks/stripe answered 501, and no pass and no
+// payment row was ever created.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import request from 'supertest';
+import { createApp } from '../src/app.js';
+import { createStripeService } from '../src/services/stripe.js';
+import { createUser } from '../src/services/auth.js';
+import { testDb, csrfToken } from './helpers.js';
+
+/** A studio with one pack, one subscribable plan, and the given Stripe env. */
+function studio(env) {
+  const db = testDb();
+  createUser(db, { email: 'owner@test.test', password: 'password123', role: 'owner' });
+  db.prepare("INSERT INTO pack_products (name, credits, price_cents, active) VALUES ('10 Pack', 10, 150000, 1)").run();
+  db.prepare("INSERT INTO membership_plans (name, price_cents, unlimited, active, stripe_price_id) VALUES ('Unlimited', 90000, 1, 1, 'price_x')").run();
+  const created = [];
+  const stripeService = createStripeService({
+    env,
+    client: {
+      checkout: {
+        sessions: {
+          create: async (params) => {
+            created.push(params);
+            return { id: 'cs_1', url: 'https://checkout.stripe.test/cs_1' };
+          },
+        },
+      },
+    },
+  });
+  return {
+    db,
+    created,
+    packId: db.prepare('SELECT id FROM pack_products').get().id,
+    planId: db.prepare('SELECT id FROM membership_plans').get().id,
+    app: createApp({ db, stripeService, env: {} }),
+  };
+}
+
+const HALF = { STRIPE_SECRET_KEY: 'sk_test_x' };
+const FULL = { STRIPE_SECRET_KEY: 'sk_test_x', STRIPE_WEBHOOK_SECRET: 'whsec_x' };
+
+async function buy(app, path, form) {
+  const agent = request.agent(app);
+  const _csrf = await csrfToken(agent, '/buy');
+  return agent.post(path).type('form').send({ _csrf, ...form });
+}
+
+test('a secret key without a webhook secret does not take money online', async () => {
+  const { app, created, packId, planId } = studio(HALF);
+
+  const pack = await buy(app, `/buy/pack/${packId}`, { email: 'rider@test.hk' });
+  assert.equal(pack.status, 200, 'no redirect to Checkout');
+  assert.match(pack.text, /pay/i);
+
+  const plan = await buy(app, `/buy/membership/${planId}`, { email: 'rider@test.hk' });
+  assert.equal(plan.status, 200);
+
+  assert.deepEqual(created, [], 'no Checkout session should be created at all');
+});
+
+test('the buy page offers pay-at-studio when the webhook secret is missing', async () => {
+  const half = await request(studio(HALF).app).get('/buy');
+  assert.doesNotMatch(half.text, /Buy online|Subscribe online/);
+
+  const full = await request(studio(FULL).app).get('/buy');
+  assert.match(full.text, /Buy online/);
+  assert.match(full.text, /Subscribe online/);
+});
+
+test('both keys present still redirects to Checkout', async () => {
+  const { app, created, packId, planId } = studio(FULL);
+
+  const pack = await buy(app, `/buy/pack/${packId}`, { email: 'rider@test.hk' });
+  assert.equal(pack.status, 303);
+  assert.equal(pack.headers.location, 'https://checkout.stripe.test/cs_1');
+
+  const plan = await buy(app, `/buy/membership/${planId}`, { email: 'rider@test.hk' });
+  assert.equal(plan.status, 303);
+
+  assert.equal(created.length, 2);
+});
+
+test('admin pages report the missing webhook secret instead of "connected"', async () => {
+  const { app } = studio(HALF);
+  const agent = request.agent(app);
+  const _csrf = await csrfToken(agent, '/admin/login');
+  await agent.post('/admin/login').type('form').send({ email: 'owner@test.test', password: 'password123', _csrf });
+
+  const dash = await agent.get('/admin');
+  assert.doesNotMatch(dash.text, /Stripe: connected/);
+  assert.match(dash.text, /webhook secret missing/i);
+
+  const settings = await agent.get('/admin/settings');
+  assert.match(settings.text, /Online payment is off/i);
+  assert.doesNotMatch(settings.text, /see \.env/);
+});

package/test/stripe.test.js

@@ -121,6 +121,34 @@ test('replayed webhook is a no-op (idempotent by stripe_session_id)', async () =
   assert.equal(db.prepare('SELECT COUNT(*) c FROM payments').get().c, 1, 'no duplicate payment');
 });
 
+test('a delayed payment is fulfilled when it clears, not when checkout completes', async () => {
+  const { db, app } = makeApp();
+  const productId = db.prepare(
+    "INSERT INTO pack_products (name, credits, price_cents) VALUES ('5 Pack', 5, 55000)"
+  ).run().lastInsertRowid;
+  const session = {
+    id: 'cs_debit',
+    amount_total: 55000,
+    currency: 'hkd',
+    metadata: { kind: 'pack', pack_product_id: String(productId), client_email: 'debit@test.hk' },
+  };
+
+  const completed = await postEvent(app, checkoutCompleted({ ...session, payment_status: 'unpaid' }));
+  assert.equal(completed.status, 200);
+  assert.equal(completed.body.fulfilled, false);
+  assert.equal(completed.body.reason, 'awaiting_payment');
+  assert.equal(db.prepare('SELECT COUNT(*) c FROM passes').get().c, 0, 'no pass before the money arrives');
+  assert.equal(db.prepare('SELECT COUNT(*) c FROM payments').get().c, 0);
+
+  const cleared = await postEvent(app, {
+    type: 'checkout.session.async_payment_succeeded',
+    data: { object: { ...session, payment_status: 'paid' } },
+  });
+  assert.equal(cleared.body.fulfilled, true);
+  assert.equal(db.prepare('SELECT COUNT(*) c FROM passes').get().c, 1);
+  assert.equal(db.prepare("SELECT COUNT(*) c FROM payments WHERE status = 'paid'").get().c, 1);
+});
+
 test('membership checkout fulfillment: activates membership with subscription id', async () => {
   const { db, app } = makeApp();
   const planId = db.prepare(
@@ -148,6 +176,61 @@ test('membership checkout fulfillment: activates membership with subscription id
   assert.equal(payment.status, 'paid');
 });
 
+test('invoice.paid records each membership renewal once, but not the first month again', async () => {
+  const { db, app } = makeApp();
+  const planId = db.prepare(
+    "INSERT INTO membership_plans (name, price_cents, unlimited, stripe_price_id) VALUES ('Unlimited Monthly', 128000, 1, 'price_mock')"
+  ).run().lastInsertRowid;
+  await postEvent(app, checkoutCompleted({
+    id: 'cs_renew', amount_total: 128000, currency: 'hkd', subscription: 'sub_renew',
+    metadata: { kind: 'membership', plan_id: String(planId), client_email: 'renew@test.hk' },
+  }));
+  const invoicePaid = (invoice) => postEvent(app, { type: 'invoice.paid', data: { object: invoice } });
+  const payments = () => db.prepare("SELECT * FROM payments WHERE what = 'membership' ORDER BY id").all();
+
+  // Stripe also sends invoice.paid for the first month, which the Checkout
+  // session already recorded.
+  const first = await invoicePaid({
+    id: 'in_1', billing_reason: 'subscription_create', amount_paid: 128000, currency: 'hkd',
+    parent: { subscription_details: { subscription: 'sub_renew' } },
+  });
+  assert.equal(first.body.fulfilled, false);
+  assert.equal(payments().length, 1);
+
+  const renewal = {
+    id: 'in_2', billing_reason: 'subscription_cycle', amount_paid: 128000, currency: 'hkd',
+    parent: { subscription_details: { subscription: 'sub_renew' } },
+  };
+  const second = await invoicePaid(renewal);
+  assert.equal(second.body.fulfilled, true);
+  assert.equal(second.body.kind, 'membership_renewal');
+  const replay = await invoicePaid(renewal);
+  assert.equal(replay.body.reason, 'already_processed');
+
+  // Endpoints pinned to an older API version put the id at the top level.
+  const legacy = await invoicePaid({
+    id: 'in_3', billing_reason: 'subscription_cycle', amount_paid: 128000, currency: 'hkd',
+    subscription: 'sub_renew',
+  });
+  assert.equal(legacy.body.fulfilled, true);
+
+  const rows = payments();
+  assert.equal(rows.length, 3);
+  assert.deepEqual(rows.map((p) => p.stripe_invoice_id), [null, 'in_2', 'in_3']);
+  assert.ok(rows.every((p) => p.status === 'paid' && p.method === 'stripe' && p.amount_cents === 128000));
+});
+
+test('invoice.paid for a subscription Studio OS never sold is acknowledged and ignored', async () => {
+  const { db, app } = makeApp();
+  const res = await postEvent(app, {
+    type: 'invoice.paid',
+    data: { object: { id: 'in_other', billing_reason: 'subscription_cycle', amount_paid: 5000, subscription: 'sub_elsewhere' } },
+  });
+  assert.equal(res.status, 200);
+  assert.equal(res.body.reason, 'unknown_subscription');
+  assert.equal(db.prepare('SELECT COUNT(*) c FROM payments').get().c, 0);
+});
+
 test('customer.subscription.deleted cancels the matching membership', async () => {
   const { db, app } = makeApp();
   const clientId = db.prepare(
@@ -202,7 +285,7 @@ test('fulfillment failure returns 500 so Stripe retries', async () => {
 
 test('unhandled event types are acknowledged and ignored', async () => {
   const { app } = makeApp();
-  const res = await postEvent(app, { type: 'invoice.paid', data: { object: {} } });
+  const res = await postEvent(app, { type: 'charge.refunded', data: { object: {} } });
   assert.equal(res.status, 200);
   assert.equal(res.body.fulfilled, false);
   assert.match(res.body.reason, /ignored event/);

package/test/web.test.js

@@ -178,6 +178,11 @@ test('full class books to waitlist via HTTP', async () => {
     .send({ email: 'b@t.hk', waiver_agree: '1', name: 'B', _csrf });
   assert.equal(res.status, 200);
   assert.match(res.text, /waitlist/i);
+  assert.match(res.text, /You're #1 in line/);
+
+  const second = await agent.post(`/class/${inst}/book`).type('form')
+    .send({ email: 'c@t.hk', waiver_agree: '1', name: 'C', _csrf });
+  assert.match(second.text, /You're #2 in line/);
 });
 
 test('magic link: verify round-trip, view bookings, cancel within policy', async () => {
@@ -257,7 +262,11 @@ test('admin: rules CRUD generates instances; roster check-in works over HTTP', a
 
   // book someone in, then check them in via admin
   const clientId = makeClient(db, { email: 'roster@test.hk' });
-  const instId = db.prepare('SELECT id FROM class_instances ORDER BY starts_at LIMIT 1').get().id;
+  // the earliest instance of a Tuesday 18:30 rule is today's when the suite
+  // runs on a Tuesday evening, and book() rejects a class that has started
+  const instId = db.prepare(
+    'SELECT id FROM class_instances WHERE starts_at > ? ORDER BY starts_at LIMIT 1'
+  ).get(new Date().toISOString()).id;
   const { book } = await import('../src/services/booking.js');
   const { booking } = book(db, clientId, instId);
 

package/views/admin/dashboard.ejs

@@ -7,7 +7,7 @@
   </article>
   <article>
     <h4>Status</h4>
-    <p><small>Stripe: <%= stripeConfigured ? 'connected' : 'not connected — purchases fall back to pay-at-studio' %><br>
+    <p><small>Stripe: <%= stripeConfigured ? 'connected' : (stripeKeySet ? 'key set, webhook secret missing. Online payment is off, see Settings' : 'not connected — purchases fall back to pay-at-studio') %><br>
     Email: <%= smtpConfigured ? 'SMTP configured' : 'off — messages saved to data/outbox, links shown on screen' %></small></p>
   </article>
 </div>

package/views/admin/settings.ejs

@@ -26,8 +26,13 @@
   <article>
     <h5>Integrations (set via environment / .env)</h5>
     <p><small>
-      Stripe secret key: <strong><%= stripeConfigured ? 'set' : 'not set' %></strong><br>
-      Stripe webhook secret: <strong><%= locals.services ? '' : '' %><%= stripeConfigured ? (settings.stripe_webhook_hint || 'see .env') : '—' %></strong><br>
+      Stripe secret key: <strong><%= stripeKeySet ? 'set' : 'not set' %></strong><br>
+      Stripe webhook secret: <strong><%= stripeWebhookSet ? 'set' : 'not set' %></strong><br>
+      <% if (stripeKeySet && !stripeWebhookSet) { %>
+      <strong>Online payment is off.</strong> Without STRIPE_WEBHOOK_SECRET the
+      fulfilment webhook is rejected, so a client would be charged and receive
+      nothing. Purchases use pay-at-studio until it is set.<br>
+      <% } %>
       SMTP: <strong><%= smtpConfigured ? 'configured' : 'not set (emails go to data/outbox/, links shown on screen)' %></strong>
     </small></p>
   </article>

package/views/public/book_result.ejs

@@ -3,7 +3,7 @@
   <% if (result.waitlisted) { %>
     <h2>You're on the waitlist</h2>
     <p><strong><%= inst.class_name %></strong> on <%= fmtDt(inst.starts_at) %> is currently full.
-       You're #<%= result.booking.id ? '' : '' %> in line — if a spot opens we'll book you in automatically<%= smtpConfigured ? ' and email you' : '' %>.</p>
+       You're #<%= waitlistPosition %> in line — if a spot opens we'll book you in automatically<%= smtpConfigured ? ' and email you' : '' %>.</p>
   <% } else { %>
     <h2>You're booked!</h2>
     <p><strong><%= inst.class_name %></strong> · <%= fmtDt(inst.starts_at) %></p>
@@ -15,12 +15,12 @@
       <% } %>
     </p>
   <% } %>
-  <p>Manage or cancel your bookings any time:</p>
-  <p><a href="<%= magicUrl %>" role="button" class="outline">My bookings</a></p>
-  <% if (!smtpConfigured) { %>
+  <% if (magicUrl) { %>
+    <p>Manage or cancel your bookings any time:</p>
+    <p><a href="<%= magicUrl %>" role="button" class="outline">My bookings</a></p>
     <p><small>Save that link — it's your personal booking manager (valid 7 days; you can request a new one from “My bookings” in the menu).</small></p>
   <% } else { %>
-    <p><small>A confirmation email with your personal link is on its way.</small></p>
+    <p>A confirmation email with a link to manage or cancel your booking is on its way.</p>
   <% } %>
 </article>
 <%- include('../partials/foot') %>

package/PROGRESS.md

@@ -1,60 +0,0 @@
-# Studio OS — build progress
-
-Authoritative spec: `SPEC.md`. Node used: **v22.18.0** (better-sqlite3 11.x prebuilt, SQLite 3.49.2 — no compile needed).
-Run tests: `npm test`. Start: `npm start` (PORT env, default 3000).
-
-## Done
-- [x] Scaffold: package.json (studio-os, MIT, type:module), deps installed, htmx 1.9.12 + pico.css 2.0.6 vendored in `public/vendor/` (commit 2cb4364)
-- [x] DB: `src/db/schema.sql` (migration v1), `src/db/index.js` (WAL, FK on, migrations, settings helpers, audit), `src/lib/time.js` (Intl-based tz conversion, no tz lib)
-- [x] Core booking engine `src/services/booking.js`: payment resolution (membership → soonest-expiring pack → drop-in), atomic capacity via transactions, waitlist FIFO + promotion (re-resolves payment at promotion), cancellation window refund / late-cancel forfeit (policy setting), cancelClass full refund, attendance marking
-- [x] Rolling schedule generator `src/services/schedule.js` (8-week horizon, idempotent on (rule_id, starts_at))
-- [x] Tests: 31 passing (`test/booking.test.js`, `test/schedule.test.js`) covering every SPEC booking rule incl. capacity race, FIFO promotion, credit deduct/refund, soonest-expiring pack selection, tz materialization (commit fadbc47)
-- [x] Auth service (bcryptjs + HMAC magic-link tokens), mailer (SMTP or `data/outbox/*.eml` fallback + all templates), Stripe service (isolated, injectable client, idempotent fulfillment by `payments.stripe_session_id` UNIQUE)
-- [x] App skeleton `src/app.js` (webhook raw-body mounted before parsers, cookie-session, setup gate, view locals) + `src/server.js` (boot + daily generator)
-- [x] Routes: setup wizard, staff login/logout, webhooks, public (schedule/class/book with waiver/buy/magic-link request), `src/routes/me.js` (magic-link self-service + cancel)
-- [x] Admin routes + full EJS UI (public + admin), PWA assets (manifest, sw.js, custom.css), 16 supertest web tests (commits 897ad8e, 7449c52)
-- [x] Mindbody importer: `src/services/importer.js` (CSV parser, mapping defaults + overrides, idempotent by email), `scripts/import-mindbody.mjs` CLI (--clients/--passes/--mapping/--db/--dry-run), realistic fixtures `test/fixtures/mindbody-{clients,passes}.csv` (edge cases: missing email, quoted commas, uppercase email, malformed row), admin `/admin/import` page wired, 8 importer tests + 1 web test (56 total green)
-
-- [x] Stripe webhook tests `test/stripe.test.js` (11 tests, mock client, no network): signature reject, pack/membership/drop-in fulfillment, replay idempotency, subscription cancel, 500-retry on unknown product, checkout session params (67 total green)
-- [x] `scripts/seed.mjs` (demo studio: 3 instructors, 4 class types, 8 weekly rules → 64 instances, products, 4 clients w/ passes+membership, 2×2 demo bookings; refuses non-empty DB without --force; login owner@example.com/studio-demo), Dockerfile (node:22-slim, VOLUME /app/data) + .dockerignore + docker-compose.yml (studio-data volume), README.md (quickstart Docker+Node, Mindbody migration guide, Stripe guide, limitations, roadmap), CHANGELOG.md. NOTE: docker build not run at the time — verified later, see the hardening pass below.
-
-## Self-verification (2026-07-27, item 8) — ALL PASSED
-Live server on PORT=3791, DB_PATH=data/verify-studio.db (deleted after), Node v22.18.0:
-1. `npm test` → **67/67 pass, 0 fail** (booking 21 + schedule 10 + web 17 + importer 8 + stripe 11).
-2. Fresh empty DB boot: `GET /` → 302 `Location: /setup`; `GET /setup` → 200 "Welcome to Studio OS".
-3. `node scripts/seed.mjs` → 3 instructors, 4 class types, 8 rules → 64 instances, products, 4 clients, 4 demo bookings. Re-run without `--force` correctly refused (exit 1).
-4. Seeded boot: `GET /` → 200; schedule lists 20 upcoming instances (Vinyasa/Pilates/Handstand/Yin) with "spots left".
-5. Booking round-trip: `POST /class/33/book` (new guest, waiver_agree=1) → 200 "Booked"; duplicate re-POST did NOT create a second booking; admin login (`POST /admin/login` → 302) then `GET /admin/instances/33` roster shows the client, paid_with `drop_in_manual` ("pay at studio"), check-in buttons.
-6. Magic-link cancel: `POST /magic-link` → on-screen `/me?token=...` (SMTP off); `GET /me?token` → 200 listing the booking; `POST /me/cancel/5` → 302 back to /me, flash "cancelled", list empty; DB row: status='cancelled', cancelled_at set; roster no longer shows the client.
-7. Server stopped cleanly. NOT verified: `docker build` ($0/no-network guardrail — Dockerfile untested).
-
-## Hardening pass (2026-07-28)
-- [x] CSRF protection: random per-session token stored in the cookie-session, exposed as `res.locals.csrfToken`, hidden `_csrf` input added to all 36 POST forms (public book/buy/magic-link, /me cancel, setup, admin login/logout and every admin form). Middleware in `src/app.js` rejects POST/PUT/DELETE/PATCH with missing/mismatched token (403, timing-safe compare; `x-csrf-token` header also accepted). `/webhooks/stripe` exempt (mounted before the session layer + explicit path guard; authenticated by Stripe signature instead). Tests updated to cookie agents + `csrfToken()` helper; 2 explicit tests (no/wrong token → 403 + nothing written; valid token works; webhook stays exempt). 69/69 green.
-
-- [x] Docker verification (2026-07-28, Docker Desktop 4.44.2 / Engine 28.3.2, linux/amd64): `docker compose build` succeeded first try — `node:22-slim` + better-sqlite3 prebuilt glibc binary, no python3/make/g++ stage needed. Found + fixed a real compose bug: `environment:` list containing only comments parses as null → "must be a mapping" validation error; block now fully commented in mapping form. Live run: `docker compose up -d` → `GET /` 302 `/setup` on fresh volume → completed setup wizard via curl (CSRF cookie+token round-trip) → admin one-off class POST → public schedule renders Yoga Flow → guest booking on `/class/1` → "Booked"; booking POST without CSRF token → 403 in-container. `docker compose down -v` clean. Verified commands recorded in README.
-- [x] Rate limiting: `src/lib/ratelimit.js` (dependency-free in-memory fixed window, key = client IP + matched route pattern, injectable clock, X-Forwarded-For honored only when `TRUST_PROXY` env set). Wired in `src/app.js` before the CSRF check: `/magic-link` 5/15min, `/admin/login` 10/15min, booking/buy POSTs (`/class/:id/book`, `/buy/pack/:id`, `/buy/membership/:id`) 30/15min → friendly 429 + Retry-After. 4 tests in `test/ratelimit.test.js` (trigger, window reset via fake clock — no sleeps, XFF spoof/trust behavior). README limitations updated → new Security section; `TRUST_PROXY` documented in `.env.example`. 73/73 green. NOTE: limiter is per-process and resets on restart (documented).
-
-## v0.2.0 — instructor logins (2026-07-28) — SHIPPED, ALL VERIFIED
-- [x] Migration v2 (`src/db/002-instructor-role.sql`): users role CHECK rebuilt to allow 'instructor' (owner/staff untouched — verified against a real v1 file DB: both users kept, v2 applied, instructor insert OK); new `instructor_class_assignments (instructor_id→users, class_id→class_instances, PK both, ON DELETE CASCADE)` + idx_ica_class.
-- [x] Guards (`src/services/auth.js`): `requireAdmin` (admin router; instructor → 403, anon → 302 login), `requireInstructor` (instructor portal; admins → /admin). Login (`src/routes/auth.js`): `/login` aliases `/admin/login`; POST redirects by role (instructor → /instructor/schedule).
-- [x] Instructor portal (`src/routes/instructor.js` + `views/instructor/{schedule,roster}.ejs`): schedule (assigned classes from studio-local today, sorted by date), roster (attendee + status, 'attended' displayed as 'checked-in'; NO client emails exposed), POST checkin (assignment-guarded, booking must belong to the class, reuses `markAttendance`).
-- [x] Admin UI: Instructors page gains logins section; `/admin/instructors/new` (GET+POST, password ≥8, UNIQUE-email friendly error); `/admin/instructors/:id/classes` checkbox assignment (rewrites only the displayed upcoming window; past assignments kept). Routes declared BEFORE `POST /instructors/:id` so 'new' isn't captured as :id.
-- [x] Tests: `test/instructor.test.js` (8) + 4 new view-integrity tests = **110/110 green** (`npm test`).
-- [x] Live E2E on PORT=3799 (seeded DB, curl, then killed + scratch DB deleted): owner created kim@studio.test, assigned class 25 of 2; instructor login → 302 /instructor/schedule; schedule showed only Mat Pilates #25; /admin → 403; roster #9 → 403; roster #25 → 200; check-in booking 1 → Alice Chan 'checked-in'; check-in on #9 → 403; POST without CSRF → 403.
-- [x] package.json 0.2.0, CHANGELOG 0.2.0 entry, README (feature bullet + walkthrough step 6, roadmap line removed).
-
-## Next
-- v0.2.0 complete. Optional future: docker rebuild sanity check on next release; screenshots of the instructor portal for README.
-
-## Pragmatic choices where SPEC is silent (decided, noted per guardrail)
-- **pack_products table added** (schema v1): SPEC's buy page sells "class packs" but only defines per-client `passes`; a purchasable catalogue was needed. Same for drop-in pending payments → `payments.status` ('paid'|'pending').
-- **Waitlisted bookings do not deduct credits**; deduction happens at promotion (same tx), payment re-resolved at promotion time.
-- **Drop-in online**: booking is created immediately; payment row pending; Stripe checkout (kind=drop_in metadata) marks it paid via webhook. Capacity is not held hostage to checkout completion.
-- **Sessions**: cookie-session (signed cookie) — SPEC allows either. app_secret auto-generated into settings, overridable via APP_SECRET env.
-- ~~No CSRF tokens in v0.1 (same-site=lax cookies); listed in README limitations.~~ Added in the 2026-07-28 hardening pass (session-bound `_csrf` token, no csurf dependency).
-- `npm test` uses glob `"test/*.test.js"` — `node --test test/` breaks under Git Bash path mangling on Windows.
-
-## How to resume
-- `cd D:\Repos\ideas\studio-os && npm test` (expect 31+ green) and `git log --oneline` to see where things stand.
-- Work top-down through “Next”. Commit after each numbered item at minimum.
-- Guardrails: stay inside this folder; $0 / no network at boot or in tests; no remotes/publishing; Stripe/SMTP env-gated.