studio-os 0.2.0

package/src/routes/auth.js

@@ -0,0 +1,34 @@
+import { Router } from 'express';
+import { authenticate } from '../services/auth.js';
+import { audit } from '../db/index.js';
+
+export default function authRoutes({ db }) {
+  const r = Router();
+
+  const homeFor = (user) => (user.role === 'instructor' ? '/instructor/schedule' : '/admin');
+
+  // One login form for every staff role; /login is a friendly alias.
+  r.get('/login', (req, res) => res.redirect('/admin/login'));
+
+  r.get('/admin/login', (req, res) => {
+    if (req.session.userId && res.locals.user) return res.redirect(homeFor(res.locals.user));
+    res.render('login', { title: 'Staff login', error: null });
+  });
+
+  r.post('/admin/login', (req, res) => {
+    const user = authenticate(db, req.body.email, req.body.password);
+    if (!user) {
+      return res.status(401).render('login', { title: 'Staff login', error: 'Invalid email or password.' });
+    }
+    req.session.userId = user.id;
+    audit(db, user.email, 'login', 'user:' + user.id);
+    res.redirect(homeFor(user));
+  });
+
+  r.post('/admin/logout', (req, res) => {
+    req.session = null;
+    res.redirect('/');
+  });
+
+  return r;
+}

package/src/routes/instructor.js

@@ -0,0 +1,82 @@
+import { Router } from 'express';
+import { requireInstructor } from '../services/auth.js';
+import { getSetting, audit } from '../db/index.js';
+import { markAttendance, BookingError } from '../services/booking.js';
+import { localDateStr, zonedToUtc } from '../lib/time.js';
+
+export default function instructorRoutes(services) {
+  const { db } = services;
+  const r = Router();
+  r.use(requireInstructor);
+
+  const isAssigned = (instructorId, classId) => !!db.prepare(
+    'SELECT 1 FROM instructor_class_assignments WHERE instructor_id = ? AND class_id = ?'
+  ).get(instructorId, classId);
+
+  // From studio-local midnight today, so a class stays visible for check-in
+  // while it is running, not just before it starts.
+  const todayStartUtc = () => {
+    const tz = getSetting(db, 'timezone', 'Asia/Hong_Kong');
+    const [y, m, d] = localDateStr(tz).split('-').map(Number);
+    return zonedToUtc(tz, y, m, d, 0, 0).toISOString();
+  };
+
+  // ---------------------------------------------------------------- schedule
+  r.get('/schedule', (req, res) => {
+    const classes = db.prepare(
+      `SELECT ci.*, ct.name AS class_name, ct.color,
+              (SELECT COUNT(*) FROM bookings b WHERE b.class_instance_id = ci.id
+                 AND b.status IN ('booked','attended','no_show')) AS booked_count
+       FROM instructor_class_assignments ica
+       JOIN class_instances ci ON ci.id = ica.class_id
+       JOIN class_types ct ON ct.id = ci.class_type_id
+       WHERE ica.instructor_id = ? AND ci.starts_at >= ?
+       ORDER BY ci.starts_at`
+    ).all(req.session.userId, todayStartUtc());
+    res.render('instructor/schedule', { title: 'My schedule', classes });
+  });
+
+  // ------------------------------------------------------------------ roster
+  r.get('/classes/:id/roster', (req, res) => {
+    if (!isAssigned(req.session.userId, Number(req.params.id))) {
+      return res.status(403).render('error', {
+        title: 'Forbidden', message: 'You are not assigned to this class.',
+      });
+    }
+    const inst = db.prepare(
+      `SELECT ci.*, ct.name AS class_name FROM class_instances ci
+       JOIN class_types ct ON ct.id = ci.class_type_id WHERE ci.id = ?`
+    ).get(req.params.id);
+    if (!inst) return res.status(404).render('error', { title: 'Not found', message: 'Class not found.' });
+    const roster = db.prepare(
+      `SELECT b.*, c.name AS client_name FROM bookings b JOIN clients c ON c.id = b.client_id
+       WHERE b.class_instance_id = ? AND b.status IN ('booked','attended','no_show','cancelled')
+       ORDER BY b.status = 'cancelled', b.created_at`
+    ).all(inst.id);
+    res.render('instructor/roster', { title: `Roster — ${inst.class_name}`, inst, roster });
+  });
+
+  // ----------------------------------------------------------------- check-in
+  r.post('/classes/:id/checkin/:booking_id', (req, res) => {
+    const classId = Number(req.params.id);
+    if (!isAssigned(req.session.userId, classId)) {
+      return res.status(403).render('error', {
+        title: 'Forbidden', message: 'You are not assigned to this class.',
+      });
+    }
+    const booking = db.prepare('SELECT * FROM bookings WHERE id = ?').get(req.params.booking_id);
+    if (!booking || booking.class_instance_id !== classId) {
+      return res.status(404).render('error', { title: 'Not found', message: 'Booking not found in this class.' });
+    }
+    try {
+      markAttendance(db, booking.id, 'attended');
+      audit(db, res.locals.user.email, 'booking_attended', `booking:${booking.id}`);
+    } catch (err) {
+      if (!(err instanceof BookingError)) throw err;
+      req.session.flash = err.message;
+    }
+    res.redirect(`/instructor/classes/${classId}/roster`);
+  });
+
+  return r;
+}

package/src/routes/me.js

@@ -0,0 +1,101 @@
+// Client self-service via signed magic links. No passwords.
+import { Router } from 'express';
+import { verifyMagicToken, makeMagicToken } from '../services/auth.js';
+import { cancelBooking, BookingError } from '../services/booking.js';
+import { getSetting, audit } from '../db/index.js';
+import { emails } from '../services/mailer.js';
+
+export default function meRoutes(services) {
+  const { db, mailer } = services;
+  const r = Router();
+
+  function requireClient(req, res) {
+    const token = req.query.token || req.body.token;
+    const clientId = verifyMagicToken(db, token);
+    if (!clientId) {
+      res.status(401).render('public/magic_request', {
+        title: 'My bookings', sent: false, magicUrl: null,
+        error: 'That link is invalid or has expired. Request a new one below.',
+      });
+      return null;
+    }
+    const client = db.prepare('SELECT * FROM clients WHERE id = ?').get(clientId);
+    if (!client) {
+      res.status(401).render('public/magic_request', {
+        title: 'My bookings', sent: false, magicUrl: null, error: 'Unknown client.',
+      });
+      return null;
+    }
+    return { client, token };
+  }
+
+  r.get('/', (req, res) => {
+    const auth = requireClient(req, res);
+    if (!auth) return;
+    const { client, token } = auth;
+    const nowIso = new Date().toISOString();
+    const bookings = db.prepare(
+      `SELECT b.*, ci.starts_at, ci.status AS instance_status, ct.name AS class_name,
+              i.name AS instructor_name
+       FROM bookings b
+       JOIN class_instances ci ON ci.id = b.class_instance_id
+       JOIN class_types ct ON ct.id = ci.class_type_id
+       LEFT JOIN instructors i ON i.id = ci.instructor_id
+       WHERE b.client_id = ? AND b.status IN ('booked','waitlist') AND ci.starts_at >= ?
+       ORDER BY ci.starts_at`
+    ).all(client.id, nowIso);
+    const passes = db.prepare(
+      'SELECT * FROM passes WHERE client_id = ? AND credits_remaining > 0 ORDER BY expires_on IS NULL, expires_on'
+    ).all(client.id);
+    const memberships = db.prepare(
+      "SELECT * FROM memberships WHERE client_id = ? AND status = 'active'"
+    ).all(client.id);
+    const windowHours = Number(getSetting(db, 'cancellation_window_hours', '12'));
+    // NB: the local is named clientInfo because `client` is a reserved EJS
+    // option name (client-mode compilation) when present in render data.
+    res.render('public/me', {
+      title: 'My bookings', clientInfo: client, token, bookings, passes, memberships, windowHours,
+    });
+  });
+
+  r.post('/cancel/:bookingId', (req, res) => {
+    const auth = requireClient(req, res);
+    if (!auth) return;
+    const { client, token } = auth;
+    const booking = db.prepare('SELECT * FROM bookings WHERE id = ?').get(req.params.bookingId);
+    if (!booking || booking.client_id !== client.id) {
+      return res.status(404).render('error', { title: 'Not found', message: 'Booking not found.' });
+    }
+    try {
+      const result = cancelBooking(db, booking.id);
+      audit(db, client.email, 'client_cancel', `booking:${booking.id}`);
+      const studio = getSetting(db, 'studio_name', 'the studio');
+      const inst = result.instance;
+      const when = res.locals.fmtDt(inst.starts_at);
+      mailer.send({
+        to: client.email,
+        ...emails.cancellation({ studio, clientName: client.name, className: inst.class_name, when, refunded: result.refunded }),
+      });
+      if (result.promoted) {
+        const promotedClient = db.prepare('SELECT * FROM clients WHERE id = ?').get(result.promoted.client_id);
+        const magicUrl = `${services.baseUrl(req)}/me?token=${makeMagicToken(db, promotedClient.id)}`;
+        mailer.send({
+          to: promotedClient.email,
+          ...emails.waitlistPromotion({ studio, clientName: promotedClient.name, className: inst.class_name, when, magicUrl }),
+        });
+      }
+      req.session.flash = result.refunded
+        ? 'Booking cancelled — your credit has been returned.'
+        : (result.late ? 'Booking cancelled. This was a late cancellation, so the credit was not returned.' : 'Booking cancelled.');
+    } catch (err) {
+      if (err instanceof BookingError) {
+        req.session.flash = err.message;
+      } else {
+        throw err;
+      }
+    }
+    res.redirect(`/me?token=${encodeURIComponent(token)}`);
+  });
+
+  return r;
+}

package/src/routes/public.js

@@ -0,0 +1,215 @@
+import { Router } from 'express';
+import { marked } from 'marked';
+import { getSetting, audit } from '../db/index.js';
+import { upcomingInstances } from '../services/schedule.js';
+import { book, resolvePayment, BookingError } from '../services/booking.js';
+import { makeMagicToken } from '../services/auth.js';
+import { emails } from '../services/mailer.js';
+
+function findOrCreateClient(db, name, email) {
+  const cleanEmail = String(email || '').trim().toLowerCase();
+  let client = db.prepare('SELECT * FROM clients WHERE email = ?').get(cleanEmail);
+  if (!client) {
+    const info = db.prepare(
+      "INSERT INTO clients (name, email, source) VALUES (?, ?, 'self')"
+    ).run(String(name || cleanEmail.split('@')[0]).trim(), cleanEmail);
+    client = db.prepare('SELECT * FROM clients WHERE id = ?').get(info.lastInsertRowid);
+  } else if (name && name.trim() && client.name !== name.trim()) {
+    // keep the freshest name the client typed
+    db.prepare('UPDATE clients SET name = ? WHERE id = ?').run(name.trim(), client.id);
+    client.name = name.trim();
+  }
+  return client;
+}
+
+function loadInstanceFull(db, id) {
+  return db.prepare(
+    `SELECT ci.*, ct.name AS class_name, ct.description AS class_description, ct.color,
+            ct.credits_required, ct.drop_in_price_cents, i.name AS instructor_name,
+            (SELECT COUNT(*) FROM bookings b WHERE b.class_instance_id = ci.id
+               AND b.status IN ('booked','attended','no_show')) AS booked_count
+     FROM class_instances ci
+     JOIN class_types ct ON ct.id = ci.class_type_id
+     LEFT JOIN instructors i ON i.id = ci.instructor_id
+     WHERE ci.id = ?`
+  ).get(id);
+}
+
+export default function publicRoutes(services) {
+  const { db, mailer } = services;
+  const r = Router();
+
+  // Public schedule, next 14 days, filterable.
+  r.get('/', (req, res) => {
+    const classTypeId = Number(req.query.type) || null;
+    const instructorId = Number(req.query.instructor) || null;
+    const instances = upcomingInstances(db, { days: 14, classTypeId, instructorId });
+    const types = db.prepare('SELECT * FROM class_types WHERE active = 1 ORDER BY name').all();
+    const instructors = db.prepare('SELECT * FROM instructors WHERE active = 1 ORDER BY name').all();
+    res.render('public/schedule', {
+      title: 'Schedule', instances, types, instructors,
+      filterType: classTypeId, filterInstructor: instructorId,
+    });
+  });
+
+  r.get('/class/:id', (req, res) => {
+    const inst = loadInstanceFull(db, req.params.id);
+    if (!inst || inst.status !== 'scheduled') {
+      return res.status(404).render('error', { title: 'Not found', message: 'Class not found.' });
+    }
+    res.render('public/class', {
+      title: inst.class_name, inst,
+      full: inst.booked_count >= inst.capacity,
+      waiverHtml: marked.parse(getSetting(db, 'waiver_markdown', '')),
+      error: null, form: {},
+    });
+  });
+
+  r.post('/class/:id/book', async (req, res) => {
+    const inst = loadInstanceFull(db, req.params.id);
+    if (!inst || inst.status !== 'scheduled') {
+      return res.status(404).render('error', { title: 'Not found', message: 'Class not found.' });
+    }
+    const { name, email, waiver_agree } = req.body;
+    const renderErr = (error, status = 400) => res.status(status).render('public/class', {
+      title: inst.class_name, inst, full: inst.booked_count >= inst.capacity,
+      waiverHtml: marked.parse(getSetting(db, 'waiver_markdown', '')),
+      error, form: { name, email },
+    });
+
+    if (!email || !/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email)) return renderErr('A valid email is required.');
+
+    try {
+      const result = db.transaction(() => {
+        const client = findOrCreateClient(db, name, email);
+        if (!client.waiver_signed_at) {
+          if (!waiver_agree) {
+            const e = new BookingError('waiver_required', 'Please read and accept the waiver to book.');
+            throw e;
+          }
+          db.prepare('UPDATE clients SET waiver_signed_at = ? WHERE id = ?')
+            .run(new Date().toISOString(), client.id);
+        }
+        const booked = book(db, client.id, inst.id);
+        // Drop-in without membership/pack: record the pending manual payment.
+        let payment = null;
+        if (booked.booking.paid_with === 'drop_in_manual' && inst.drop_in_price_cents > 0) {
+          const info = db.prepare(
+            `INSERT INTO payments (client_id, amount_cents, currency, method, reference, what, status)
+             VALUES (?, ?, ?, 'other', ?, 'drop_in', 'pending')`
+          ).run(client.id, inst.drop_in_price_cents, getSetting(db, 'currency', 'HKD'),
+            `Drop-in: ${inst.class_name} ${inst.starts_at}`);
+          payment = info.lastInsertRowid;
+        }
+        audit(db, client.email, booked.waitlisted ? 'waitlist_join' : 'booking_create',
+          `instance:${inst.id} booking:${booked.booking.id}`);
+        return { client, ...booked, paymentId: payment };
+      })();
+
+      const magicUrl = `${services.baseUrl(req)}/me?token=${makeMagicToken(db, result.client.id)}`;
+      const when = res.locals.fmtDt(inst.starts_at);
+      const studio = getSetting(db, 'studio_name', 'the studio');
+      const tpl = result.waitlisted
+        ? emails.waitlisted({ studio, clientName: result.client.name, className: inst.class_name, when, magicUrl })
+        : emails.bookingConfirmation({
+            studio, clientName: result.client.name, className: inst.class_name, when,
+            paidWith: result.booking.paid_with.replace(/_/g, ' '), magicUrl,
+          });
+      mailer.send({ to: result.client.email, ...tpl });
+
+      res.render('public/book_result', {
+        title: result.waitlisted ? 'Waitlisted' : 'Booked',
+        inst, result, magicUrl,
+      });
+    } catch (err) {
+      if (err instanceof BookingError) {
+        const messages = {
+          waiver_required: 'Please read and accept the waiver to book.',
+          already_booked: 'You already have a booking for this class. Check your email for your management link.',
+          in_past: 'This class has already started.',
+          class_cancelled: 'This class has been cancelled.',
+          no_credits: 'Your pass no longer has enough credits.',
+        };
+        return renderErr(messages[err.code] || err.message, 409);
+      }
+      throw err;
+    }
+  });
+
+  // Buy page — packs + memberships.
+  r.get('/buy', (req, res) => {
+    const packs = db.prepare('SELECT * FROM pack_products WHERE active = 1 ORDER BY price_cents').all();
+    const plans = db.prepare('SELECT * FROM membership_plans WHERE active = 1 ORDER BY price_cents').all();
+    res.render('public/buy', { title: 'Passes & Memberships', packs, plans, error: null });
+  });
+
+  r.post('/buy/pack/:id', async (req, res, next) => {
+    const product = db.prepare('SELECT * FROM pack_products WHERE id = ? AND active = 1').get(req.params.id);
+    if (!product) return res.status(404).render('error', { title: 'Not found', message: 'Pack not found.' });
+    const email = String(req.body.email || '').trim().toLowerCase();
+    if (!/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email)) {
+      return res.status(400).render('public/buy_manual', { title: 'Buy', product, plan: null, email: null, error: 'A valid email is required.' });
+    }
+    if (services.stripe.configured) {
+      try {
+        const session = await services.stripe.createPackCheckout({
+          product, clientEmail: email, baseUrl: services.baseUrl(req),
+          currency: getSetting(db, 'currency', 'HKD'),
+        });
+        return res.redirect(303, session.url);
+      } catch (err) {
+        return next(err);
+      }
+    }
+    res.render('public/buy_manual', { title: 'Almost there', product, plan: null, email, error: null });
+  });
+
+  r.post('/buy/membership/:id', async (req, res, next) => {
+    const plan = db.prepare('SELECT * FROM membership_plans WHERE id = ? AND active = 1').get(req.params.id);
+    if (!plan) return res.status(404).render('error', { title: 'Not found', message: 'Plan not found.' });
+    const email = String(req.body.email || '').trim().toLowerCase();
+    if (!/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email)) {
+      return res.status(400).render('public/buy_manual', { title: 'Buy', product: null, plan, email: null, error: 'A valid email is required.' });
+    }
+    if (services.stripe.configured && plan.stripe_price_id) {
+      try {
+        const session = await services.stripe.createMembershipCheckout({
+          plan, clientEmail: email, baseUrl: services.baseUrl(req),
+        });
+        return res.redirect(303, session.url);
+      } catch (err) {
+        return next(err);
+      }
+    }
+    res.render('public/buy_manual', { title: 'Almost there', product: null, plan, email, error: null });
+  });
+
+  r.get('/buy/thanks', (req, res) => {
+    res.render('public/buy_thanks', { title: 'Thank you' });
+  });
+
+  // Request a magic link by email.
+  r.get('/magic-link', (req, res) => {
+    res.render('public/magic_request', { title: 'My bookings', sent: false, magicUrl: null, error: null });
+  });
+
+  r.post('/magic-link', (req, res) => {
+    const email = String(req.body.email || '').trim().toLowerCase();
+    const client = db.prepare('SELECT * FROM clients WHERE email = ?').get(email);
+    if (!client) {
+      // Don't leak which emails exist; show the same confirmation.
+      return res.render('public/magic_request', { title: 'My bookings', sent: true, magicUrl: null, error: null });
+    }
+    const magicUrl = `${services.baseUrl(req)}/me?token=${makeMagicToken(db, client.id)}`;
+    const studio = getSetting(db, 'studio_name', 'the studio');
+    if (mailer.smtpConfigured) {
+      mailer.send({ to: email, ...emails.magicLink({ studio, clientName: client.name, magicUrl }) });
+      return res.render('public/magic_request', { title: 'My bookings', sent: true, magicUrl: null, error: null });
+    }
+    // SMTP off: surface the link on screen (spec: testable without SMTP).
+    mailer.send({ to: email, ...emails.magicLink({ studio, clientName: client.name, magicUrl }) });
+    res.render('public/magic_request', { title: 'My bookings', sent: true, magicUrl, error: null });
+  });
+
+  return r;
+}

package/src/routes/setup.js

@@ -0,0 +1,55 @@
+import { Router } from 'express';
+import { setSetting, getSetting, audit } from '../db/index.js';
+import { createUser } from '../services/auth.js';
+
+const TIMEZONES = [
+  'Asia/Hong_Kong', 'Asia/Singapore', 'Asia/Tokyo', 'Asia/Shanghai', 'Asia/Bangkok',
+  'Australia/Sydney', 'Europe/London', 'Europe/Berlin', 'Europe/Paris',
+  'America/New_York', 'America/Chicago', 'America/Denver', 'America/Los_Angeles', 'UTC',
+];
+
+export default function setupRoutes({ db }) {
+  const r = Router();
+
+  r.get('/', (req, res) => {
+    res.render('setup', { title: 'Setup', timezones: TIMEZONES, error: null, form: {} });
+  });
+
+  r.post('/', (req, res) => {
+    const { studio_name, timezone, currency, email, password, password2, seed_examples } = req.body;
+    const form = { studio_name, timezone, currency, email };
+    const fail = (error) => res.status(400).render('setup', { title: 'Setup', timezones: TIMEZONES, error, form });
+
+    if (!studio_name || !studio_name.trim()) return fail('Studio name is required.');
+    if (!email || !/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email)) return fail('A valid owner email is required.');
+    if (!password || password.length < 8) return fail('Password must be at least 8 characters.');
+    if (password !== password2) return fail('Passwords do not match.');
+    try {
+      new Intl.DateTimeFormat('en', { timeZone: timezone });
+    } catch {
+      return fail('Invalid timezone.');
+    }
+
+    const userId = db.transaction(() => {
+      setSetting(db, 'studio_name', studio_name.trim());
+      setSetting(db, 'timezone', timezone || 'Asia/Hong_Kong');
+      setSetting(db, 'currency', (currency || 'HKD').toUpperCase().slice(0, 3));
+      const id = createUser(db, { email, password, name: 'Owner', role: 'owner' });
+      if (seed_examples) {
+        const ins = db.prepare(
+          'INSERT INTO class_types (name, description, duration_min, capacity, drop_in_price_cents, credits_required, color) VALUES (?, ?, ?, ?, ?, ?, ?)'
+        );
+        ins.run('Yoga Flow', 'All-levels vinyasa flow.', 60, 14, 18000, 1, '#4f7cac');
+        ins.run('Mat Pilates', 'Core-focused mat work.', 55, 10, 20000, 1, '#a06cd5');
+      }
+      setSetting(db, 'setup_complete', '1');
+      audit(db, email, 'setup_complete', 'studio');
+      return id;
+    })();
+
+    req.session.userId = userId;
+    res.redirect('/admin');
+  });
+
+  return r;
+}

package/src/routes/webhooks.js

@@ -0,0 +1,28 @@
+import { Router } from 'express';
+import { handleStripeEvent } from '../services/stripe.js';
+
+export default function webhookRoutes({ db, stripe }) {
+  const r = Router();
+
+  r.post('/', async (req, res) => {
+    if (!stripe.configured || !stripe.webhookConfigured) {
+      return res.status(501).json({ error: 'Stripe not configured' });
+    }
+    let event;
+    try {
+      event = await stripe.parseWebhook(req.body, req.headers['stripe-signature']);
+    } catch (err) {
+      return res.status(400).json({ error: `Signature verification failed: ${err.message}` });
+    }
+    try {
+      const result = handleStripeEvent(db, event);
+      return res.json({ received: true, ...result });
+    } catch (err) {
+      console.error('[webhook] fulfillment failed:', err.message);
+      // 500 so Stripe retries
+      return res.status(500).json({ error: err.message });
+    }
+  });
+
+  return r;
+}

package/src/server.js

@@ -0,0 +1,29 @@
+import 'dotenv/config';
+import { openDb, getSetting } from './db/index.js';
+import { createApp } from './app.js';
+import { generateInstances } from './services/schedule.js';
+
+const db = openDb();
+const app = createApp({ db });
+
+// Materialize the rolling schedule at boot and daily thereafter.
+if (getSetting(db, 'setup_complete', '0') === '1') {
+  const created = generateInstances(db);
+  if (created) console.log(`[schedule] materialized ${created} class instances`);
+}
+const daily = setInterval(() => {
+  try {
+    if (getSetting(db, 'setup_complete', '0') === '1') generateInstances(db);
+  } catch (err) {
+    console.error('[schedule] generator failed:', err.message);
+  }
+}, 24 * 3600000);
+daily.unref();
+
+const port = Number(process.env.PORT || 3000);
+app.listen(port, () => {
+  console.log(`Studio OS listening on http://localhost:${port}`);
+  if (getSetting(db, 'setup_complete', '0') !== '1') {
+    console.log(`First run: open http://localhost:${port}/setup to create your studio.`);
+  }
+});

package/src/services/auth.js

@@ -0,0 +1,81 @@
+// Staff auth (bcryptjs) + HMAC magic-link tokens for client self-service.
+import bcrypt from 'bcryptjs';
+import crypto from 'node:crypto';
+import { getSetting } from '../db/index.js';
+
+export function hashPassword(plain) {
+  return bcrypt.hashSync(plain, 10);
+}
+
+export function verifyPassword(plain, hash) {
+  return bcrypt.compareSync(plain, hash);
+}
+
+export function createUser(db, { email, password, name = '', role = 'staff' }) {
+  const info = db.prepare(
+    'INSERT INTO users (email, password_hash, name, role) VALUES (?, ?, ?, ?)'
+  ).run(email.trim().toLowerCase(), hashPassword(password), name, role);
+  return info.lastInsertRowid;
+}
+
+export function authenticate(db, email, password) {
+  const user = db.prepare('SELECT * FROM users WHERE email = ?').get(String(email || '').trim().toLowerCase());
+  if (!user) return null;
+  return verifyPassword(String(password || ''), user.password_hash) ? user : null;
+}
+
+// --- magic links -----------------------------------------------------------
+
+function hmac(secret, payload) {
+  return crypto.createHmac('sha256', secret).update(payload).digest('base64url');
+}
+
+/** Signed token for a client, valid for ttlHours (default 7 days). */
+export function makeMagicToken(db, clientId, { ttlHours = 24 * 7, now = Date.now() } = {}) {
+  const secret = getSetting(db, 'app_secret');
+  const expires = now + ttlHours * 3600000;
+  const payload = `${clientId}.${expires}`;
+  return `${payload}.${hmac(secret, payload)}`;
+}
+
+/** Returns clientId or null. Constant-time signature check. */
+export function verifyMagicToken(db, token, { now = Date.now() } = {}) {
+  if (typeof token !== 'string') return null;
+  const parts = token.split('.');
+  if (parts.length !== 3) return null;
+  const [idStr, expStr, sig] = parts;
+  const secret = getSetting(db, 'app_secret');
+  const expected = hmac(secret, `${idStr}.${expStr}`);
+  const a = Buffer.from(sig);
+  const b = Buffer.from(expected);
+  if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) return null;
+  if (Number(expStr) < now) return null;
+  const id = Number(idStr);
+  return Number.isInteger(id) && id > 0 ? id : null;
+}
+
+// --- express middleware ----------------------------------------------------
+
+export function requireStaff(req, res, next) {
+  if (req.session && req.session.userId) return next();
+  return res.redirect('/admin/login');
+}
+
+/** Admin area: any logged-in owner/staff. Instructors get a hard 403. */
+export function requireAdmin(req, res, next) {
+  if (!req.session || !req.session.userId || !res.locals.user) return res.redirect('/admin/login');
+  if (res.locals.user.role === 'instructor') {
+    return res.status(403).render('error', {
+      title: 'Forbidden',
+      message: 'Instructor accounts cannot access the admin area.',
+    });
+  }
+  next();
+}
+
+/** Instructor portal: instructor role only; admins are sent to their own UI. */
+export function requireInstructor(req, res, next) {
+  if (!req.session || !req.session.userId || !res.locals.user) return res.redirect('/admin/login');
+  if (res.locals.user.role !== 'instructor') return res.redirect('/admin');
+  next();
+}