studio-os 0.2.0

package/src/services/stripe.js

@@ -0,0 +1,169 @@
+// All Stripe interaction lives here. The service is constructed with an
+// injectable client so tests never touch the network. When env keys are absent
+// the service reports unconfigured and every purchase flow falls back to manual.
+import { audit } from '../db/index.js';
+import { addDays, localDateStr } from '../lib/time.js';
+import { getSetting } from '../db/index.js';
+
+export function createStripeService({ env = process.env, client } = {}) {
+  const secretKey = env.STRIPE_SECRET_KEY || '';
+  const webhookSecret = env.STRIPE_WEBHOOK_SECRET || '';
+  const publishableKey = env.STRIPE_PUBLISHABLE_KEY || '';
+  let stripe = client || null;
+
+  async function getClient() {
+    if (!secretKey) throw new Error('Stripe not configured');
+    if (!stripe) {
+      const Stripe = (await import('stripe')).default;
+      stripe = new Stripe(secretKey);
+    }
+    return stripe;
+  }
+
+  return {
+    configured: Boolean(secretKey),
+    webhookConfigured: Boolean(webhookSecret),
+    publishableKey,
+
+    /** One-time Checkout for a class pack. Returns the session (url etc). */
+    async createPackCheckout({ product, clientEmail, baseUrl, currency }) {
+      const s = await getClient();
+      return s.checkout.sessions.create({
+        mode: 'payment',
+        customer_email: clientEmail,
+        line_items: product.stripe_price_id
+          ? [{ price: product.stripe_price_id, quantity: 1 }]
+          : [{
+              price_data: {
+                currency: currency.toLowerCase(),
+                unit_amount: product.price_cents,
+                product_data: { name: product.name },
+              },
+              quantity: 1,
+            }],
+        metadata: { kind: 'pack', pack_product_id: String(product.id), client_email: clientEmail },
+        success_url: `${baseUrl}/buy/thanks?session_id={CHECKOUT_SESSION_ID}`,
+        cancel_url: `${baseUrl}/buy`,
+      });
+    },
+
+    /** Subscription Checkout for a membership plan (needs stripe_price_id). */
+    async createMembershipCheckout({ plan, clientEmail, baseUrl }) {
+      const s = await getClient();
+      if (!plan.stripe_price_id) throw new Error('Plan has no Stripe Price ID');
+      return s.checkout.sessions.create({
+        mode: 'subscription',
+        customer_email: clientEmail,
+        line_items: [{ price: plan.stripe_price_id, quantity: 1 }],
+        metadata: { kind: 'membership', plan_id: String(plan.id), client_email: clientEmail },
+        success_url: `${baseUrl}/buy/thanks?session_id={CHECKOUT_SESSION_ID}`,
+        cancel_url: `${baseUrl}/buy`,
+      });
+    },
+
+    /** Verify webhook signature and return the event. Throws on bad signature. */
+    async parseWebhook(rawBody, signature) {
+      const s = await getClient();
+      if (!webhookSecret) throw new Error('STRIPE_WEBHOOK_SECRET not set');
+      return s.webhooks.constructEvent(rawBody, signature, webhookSecret);
+    },
+  };
+}
+
+/**
+ * Fulfill a completed Checkout session: create the pass or activate the
+ * membership, and record the payment. Idempotent via payments.stripe_session_id
+ * UNIQUE — a replayed webhook is a no-op. Pure DB logic (testable sans Stripe).
+ */
+export function fulfillCheckoutSession(db, session) {
+  const meta = session.metadata || {};
+  const email = (meta.client_email || session.customer_email
+    || (session.customer_details && session.customer_details.email) || '').toLowerCase();
+  if (!email) throw new Error('Checkout session has no client email');
+
+  return db.transaction(() => {
+    const existing = db.prepare('SELECT id FROM payments WHERE stripe_session_id = ?').get(session.id);
+    if (existing) return { fulfilled: false, reason: 'already_processed' };
+
+    let client = db.prepare('SELECT * FROM clients WHERE email = ?').get(email);
+    if (!client) {
+      const info = db.prepare(
+        "INSERT INTO clients (name, email, source) VALUES (?, ?, 'self')"
+      ).run(email.split('@')[0], email);
+      client = db.prepare('SELECT * FROM clients WHERE id = ?').get(info.lastInsertRowid);
+    }
+
+    const currency = (session.currency || getSetting(db, 'currency', 'HKD')).toUpperCase();
+    const amount = session.amount_total ?? 0;
+
+    if (meta.kind === 'pack') {
+      const product = db.prepare('SELECT * FROM pack_products WHERE id = ?').get(Number(meta.pack_product_id));
+      if (!product) throw new Error(`Unknown pack product ${meta.pack_product_id}`);
+      const tz = getSetting(db, 'timezone', 'Asia/Hong_Kong');
+      const expiresOn = product.validity_days
+        ? addDays(localDateStr(tz), product.validity_days) : null;
+      db.prepare(
+        `INSERT INTO passes (client_id, name, credits_total, credits_remaining, expires_on, price_paid_cents, source)
+         VALUES (?, ?, ?, ?, ?, ?, 'purchase')`
+      ).run(client.id, product.name, product.credits, product.credits, expiresOn, amount);
+      db.prepare(
+        `INSERT INTO payments (client_id, amount_cents, currency, method, reference, what, status, stripe_session_id)
+         VALUES (?, ?, ?, 'stripe', ?, 'pack', 'paid', ?)`
+      ).run(client.id, amount, currency, product.name, session.id);
+      audit(db, 'stripe-webhook', 'pack_fulfilled', `client:${client.id} product:${product.id}`);
+      return { fulfilled: true, kind: 'pack', clientId: client.id };
+    }
+
+    if (meta.kind === 'membership') {
+      const plan = db.prepare('SELECT * FROM membership_plans WHERE id = ?').get(Number(meta.plan_id));
+      if (!plan) throw new Error(`Unknown membership plan ${meta.plan_id}`);
+      const tz = getSetting(db, 'timezone', 'Asia/Hong_Kong');
+      const today = localDateStr(tz);
+      db.prepare(
+        `INSERT INTO memberships (client_id, plan_id, plan_name, status, started_on, renews_on,
+                                  stripe_subscription_id, unlimited, credits_per_month, cycle_started_on)
+         VALUES (?, ?, ?, 'active', ?, NULL, ?, ?, ?, ?)`
+      ).run(client.id, plan.id, plan.name, today, session.subscription || null,
+        plan.unlimited, plan.credits_per_month, today);
+      db.prepare(
+        `INSERT INTO payments (client_id, amount_cents, currency, method, reference, what, status, stripe_session_id)
+         VALUES (?, ?, ?, 'stripe', ?, 'membership', 'paid', ?)`
+      ).run(client.id, amount, currency, plan.name, session.id);
+      audit(db, 'stripe-webhook', 'membership_fulfilled', `client:${client.id} plan:${plan.id}`);
+      return { fulfilled: true, kind: 'membership', clientId: client.id };
+    }
+
+    if (meta.kind === 'drop_in') {
+      // Pay-online for a drop-in booking: mark the pending payment paid.
+      const payment = db.prepare(
+        "SELECT * FROM payments WHERE id = ? AND status = 'pending'"
+      ).get(Number(meta.payment_id));
+      if (payment) {
+        db.prepare(
+          "UPDATE payments SET status = 'paid', method = 'stripe', stripe_session_id = ? WHERE id = ?"
+        ).run(session.id, payment.id);
+        audit(db, 'stripe-webhook', 'drop_in_paid', `payment:${payment.id}`);
+        return { fulfilled: true, kind: 'drop_in', clientId: payment.client_id };
+      }
+      return { fulfilled: false, reason: 'payment_not_found' };
+    }
+
+    return { fulfilled: false, reason: `unknown kind ${meta.kind}` };
+  })();
+}
+
+/** Handle a parsed Stripe event. Returns a result object for logging. */
+export function handleStripeEvent(db, event) {
+  if (event.type === 'checkout.session.completed') {
+    return fulfillCheckoutSession(db, event.data.object);
+  }
+  if (event.type === 'customer.subscription.deleted') {
+    const sub = event.data.object;
+    const r = db.prepare(
+      "UPDATE memberships SET status = 'cancelled' WHERE stripe_subscription_id = ?"
+    ).run(sub.id);
+    audit(db, 'stripe-webhook', 'subscription_cancelled', sub.id);
+    return { fulfilled: r.changes > 0, kind: 'subscription_cancelled' };
+  }
+  return { fulfilled: false, reason: `ignored event ${event.type}` };
+}

package/test/booking.test.js

@@ -0,0 +1,346 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  testDb, makeClient, makeClassType, makeInstance, makePass, makeMembership,
+  getPass, getBooking, getMembership,
+} from './helpers.js';
+import {
+  book, cancelBooking, cancelClass, markAttendance, resolvePayment, BookingError,
+} from '../src/services/booking.js';
+
+test('booking deducts a pack credit at booking time, in the same transaction', () => {
+  const db = testDb();
+  const type = makeClassType(db);
+  const inst = makeInstance(db, type);
+  const client = makeClient(db);
+  const pass = makePass(db, client, { total: 10 });
+
+  const { booking, waitlisted } = book(db, client, inst);
+  assert.equal(waitlisted, false);
+  assert.equal(booking.status, 'booked');
+  assert.equal(booking.paid_with, 'pack');
+  assert.equal(booking.pass_id, pass);
+  assert.equal(getPass(db, pass).credits_remaining, 9);
+});
+
+test('pack selection prefers the soonest-expiring pass with credits', () => {
+  const db = testDb();
+  const type = makeClassType(db);
+  const inst = makeInstance(db, type, { hoursFromNow: 24 });
+  const client = makeClient(db);
+  const later = makePass(db, client, { name: 'Later', expiresOn: '2030-12-31' });
+  const sooner = makePass(db, client, { name: 'Sooner', expiresOn: '2027-06-01' });
+  const noExpiry = makePass(db, client, { name: 'NoExpiry', expiresOn: null });
+
+  const { booking } = book(db, client, inst);
+  assert.equal(booking.pass_id, sooner);
+  assert.equal(getPass(db, sooner).credits_remaining, 9);
+  assert.equal(getPass(db, later).credits_remaining, 10);
+  assert.equal(getPass(db, noExpiry).credits_remaining, 10);
+});
+
+test('expired and empty packs are skipped', () => {
+  const db = testDb();
+  const type = makeClassType(db);
+  const inst = makeInstance(db, type, { hoursFromNow: 24 });
+  const client = makeClient(db);
+  makePass(db, client, { name: 'Expired', expiresOn: '2020-01-01' });
+  makePass(db, client, { name: 'Empty', remaining: 0 });
+  const good = makePass(db, client, { name: 'Good', expiresOn: null });
+
+  const { booking } = book(db, client, inst);
+  assert.equal(booking.pass_id, good);
+});
+
+test('a pass expiring before the class date is not used for that class', () => {
+  const db = testDb();
+  const type = makeClassType(db);
+  const client = makeClient(db);
+  // class ~10 days out; pass expires in ~5 days
+  const inst = makeInstance(db, type, { hoursFromNow: 240 });
+  const soonExpiry = new Date(Date.now() + 5 * 86400000).toISOString().slice(0, 10);
+  makePass(db, client, { name: 'TooShort', expiresOn: soonExpiry });
+
+  const { booking } = book(db, client, inst);
+  assert.equal(booking.paid_with, 'drop_in_manual');
+});
+
+test('unlimited membership outranks packs', () => {
+  const db = testDb();
+  const type = makeClassType(db);
+  const inst = makeInstance(db, type);
+  const client = makeClient(db);
+  const pass = makePass(db, client);
+  const mem = makeMembership(db, client, { unlimited: true });
+
+  const { booking } = book(db, client, inst);
+  assert.equal(booking.paid_with, 'membership');
+  assert.equal(booking.membership_id, mem);
+  assert.equal(getPass(db, pass).credits_remaining, 10);
+});
+
+test('credit membership deducts monthly credits and falls back to pack when exhausted', () => {
+  const db = testDb();
+  const type = makeClassType(db, { capacity: 10 });
+  const client = makeClient(db);
+  const mem = makeMembership(db, client, { unlimited: false, creditsPerMonth: 2, startedOn: '2026-07-01' });
+  const pass = makePass(db, client);
+
+  const b1 = book(db, client, makeInstance(db, type, { hoursFromNow: 24 }));
+  const b2 = book(db, client, makeInstance(db, type, { hoursFromNow: 26 }));
+  assert.equal(b1.booking.paid_with, 'membership');
+  assert.equal(b2.booking.paid_with, 'membership');
+  assert.equal(getMembership(db, mem).credits_used_this_cycle, 2);
+
+  const b3 = book(db, client, makeInstance(db, type, { hoursFromNow: 28 }));
+  assert.equal(b3.booking.paid_with, 'pack');
+  assert.equal(getPass(db, pass).credits_remaining, 9);
+});
+
+test('paused/cancelled memberships are ignored', () => {
+  const db = testDb();
+  const type = makeClassType(db);
+  const inst = makeInstance(db, type);
+  const client = makeClient(db);
+  makeMembership(db, client, { status: 'paused' });
+  const res = resolvePayment(db, client, db.prepare('SELECT ci.*, ct.credits_required FROM class_instances ci JOIN class_types ct ON ct.id=ci.class_type_id WHERE ci.id=?').get(inst));
+  assert.equal(res.paidWith, 'drop_in');
+});
+
+test('no membership or pack falls through to drop-in', () => {
+  const db = testDb();
+  const type = makeClassType(db);
+  const inst = makeInstance(db, type);
+  const client = makeClient(db);
+  const { booking } = book(db, client, inst);
+  assert.equal(booking.paid_with, 'drop_in_manual');
+});
+
+test('capacity is enforced and overflow goes to the waitlist FIFO', () => {
+  const db = testDb();
+  const type = makeClassType(db, { capacity: 2 });
+  const inst = makeInstance(db, type);
+  const c1 = makeClient(db); const c2 = makeClient(db);
+  const c3 = makeClient(db); const c4 = makeClient(db);
+
+  assert.equal(book(db, c1, inst).waitlisted, false);
+  assert.equal(book(db, c2, inst).waitlisted, false);
+  const w1 = book(db, c3, inst, { now: '2026-07-27T01:00:00Z' });
+  const w2 = book(db, c4, inst, { now: '2026-07-27T02:00:00Z' });
+  assert.equal(w1.waitlisted, true);
+  assert.equal(w1.booking.status, 'waitlist');
+  assert.equal(w2.waitlisted, true);
+
+  const rows = db.prepare("SELECT status, COUNT(*) c FROM bookings WHERE class_instance_id=? GROUP BY status").all(inst);
+  const byStatus = Object.fromEntries(rows.map((r) => [r.status, r.c]));
+  assert.equal(byStatus.booked, 2);
+  assert.equal(byStatus.waitlist, 2);
+});
+
+test('waitlisted bookings do not deduct credits until promoted', () => {
+  const db = testDb();
+  const type = makeClassType(db, { capacity: 1 });
+  const inst = makeInstance(db, type);
+  const c1 = makeClient(db); const c2 = makeClient(db);
+  const pass2 = makePass(db, c2);
+
+  book(db, c1, inst);
+  const { booking: wl } = book(db, c2, inst);
+  assert.equal(wl.status, 'waitlist');
+  assert.equal(getPass(db, pass2).credits_remaining, 10);
+});
+
+test('duplicate booking for the same class is rejected; rebooking after cancel works', () => {
+  const db = testDb();
+  const type = makeClassType(db);
+  const inst = makeInstance(db, type);
+  const client = makeClient(db);
+  const { booking } = book(db, client, inst);
+  assert.throws(() => book(db, client, inst), (e) => e instanceof BookingError && e.code === 'already_booked');
+  cancelBooking(db, booking.id);
+  const again = book(db, client, inst);
+  assert.equal(again.booking.status, 'booked');
+});
+
+test('booking a cancelled or past class is rejected', () => {
+  const db = testDb();
+  const type = makeClassType(db);
+  const client = makeClient(db);
+  const past = makeInstance(db, type, { hoursFromNow: -2 });
+  assert.throws(() => book(db, client, past), (e) => e.code === 'in_past');
+
+  const inst = makeInstance(db, type);
+  db.prepare("UPDATE class_instances SET status='cancelled' WHERE id=?").run(inst);
+  assert.throws(() => book(db, client, inst), (e) => e.code === 'class_cancelled');
+});
+
+test('early cancel refunds the pack credit', () => {
+  const db = testDb({ cancellation_window_hours: '12' });
+  const type = makeClassType(db);
+  const inst = makeInstance(db, type, { hoursFromNow: 48 });
+  const client = makeClient(db);
+  const pass = makePass(db, client);
+  const { booking } = book(db, client, inst);
+  assert.equal(getPass(db, pass).credits_remaining, 9);
+
+  const res = cancelBooking(db, booking.id); // 48h out > 12h window
+  assert.equal(res.late, false);
+  assert.equal(res.refunded, true);
+  assert.equal(getPass(db, pass).credits_remaining, 10);
+  assert.equal(getBooking(db, booking.id).status, 'cancelled');
+});
+
+test('late cancel forfeits the credit under the default policy', () => {
+  const db = testDb({ cancellation_window_hours: '12' });
+  const type = makeClassType(db);
+  const inst = makeInstance(db, type, { hoursFromNow: 3 }); // inside 12h window
+  const client = makeClient(db);
+  const pass = makePass(db, client);
+  const { booking } = book(db, client, inst);
+
+  const res = cancelBooking(db, booking.id);
+  assert.equal(res.late, true);
+  assert.equal(res.refunded, false);
+  assert.equal(getPass(db, pass).credits_remaining, 9); // forfeited
+});
+
+test('late cancel refunds when policy is set to refund', () => {
+  const db = testDb({ cancellation_window_hours: '12', late_cancel_policy: 'refund' });
+  const type = makeClassType(db);
+  const inst = makeInstance(db, type, { hoursFromNow: 3 });
+  const client = makeClient(db);
+  const pass = makePass(db, client);
+  const { booking } = book(db, client, inst);
+
+  const res = cancelBooking(db, booking.id);
+  assert.equal(res.late, true);
+  assert.equal(res.refunded, true);
+  assert.equal(getPass(db, pass).credits_remaining, 10);
+});
+
+test('membership credit is returned on eligible cancellation', () => {
+  const db = testDb();
+  const type = makeClassType(db);
+  const inst = makeInstance(db, type, { hoursFromNow: 48 });
+  const client = makeClient(db);
+  const mem = makeMembership(db, client, { unlimited: false, creditsPerMonth: 4, startedOn: '2026-07-01' });
+  const { booking } = book(db, client, inst);
+  assert.equal(getMembership(db, mem).credits_used_this_cycle, 1);
+  cancelBooking(db, booking.id);
+  assert.equal(getMembership(db, mem).credits_used_this_cycle, 0);
+});
+
+test('cancellation promotes the first waitlisted booking (FIFO) and deducts their credit', () => {
+  const db = testDb();
+  const type = makeClassType(db, { capacity: 1 });
+  const inst = makeInstance(db, type, { hoursFromNow: 48 });
+  const c1 = makeClient(db); const c2 = makeClient(db); const c3 = makeClient(db);
+  const pass2 = makePass(db, c2);
+
+  const b1 = book(db, c1, inst, { now: '2026-07-26T01:00:00Z' });
+  const w2 = book(db, c2, inst, { now: '2026-07-26T02:00:00Z' });
+  const w3 = book(db, c3, inst, { now: '2026-07-26T03:00:00Z' });
+
+  const res = cancelBooking(db, b1.booking.id);
+  assert.ok(res.promoted, 'someone was promoted');
+  assert.equal(res.promoted.id, w2.booking.id, 'FIFO: earliest waitlist first');
+  assert.equal(res.promoted.status, 'booked');
+  assert.equal(res.promoted.paid_with, 'pack');
+  assert.equal(getPass(db, pass2).credits_remaining, 9);
+  assert.equal(getBooking(db, w3.booking.id).status, 'waitlist');
+});
+
+test('cancelling a waitlist booking does not promote or refund', () => {
+  const db = testDb();
+  const type = makeClassType(db, { capacity: 1 });
+  const inst = makeInstance(db, type);
+  const c1 = makeClient(db); const c2 = makeClient(db);
+  book(db, c1, inst);
+  const { booking: wl } = book(db, c2, inst);
+  const res = cancelBooking(db, wl.id);
+  assert.equal(res.refunded, false);
+  assert.equal(res.promoted, null);
+});
+
+test('promotion re-resolves payment if the waitlisted client acquired a membership meanwhile', () => {
+  const db = testDb();
+  const type = makeClassType(db, { capacity: 1 });
+  const inst = makeInstance(db, type, { hoursFromNow: 48 });
+  const c1 = makeClient(db); const c2 = makeClient(db);
+  const b1 = book(db, c1, inst);
+  book(db, c2, inst); // waitlisted as drop_in
+  makeMembership(db, c2, { unlimited: true });
+
+  const res = cancelBooking(db, b1.booking.id);
+  assert.equal(res.promoted.paid_with, 'membership');
+});
+
+test('cancelClass refunds all confirmed bookings regardless of window and cancels the instance', () => {
+  const db = testDb({ cancellation_window_hours: '12' });
+  const type = makeClassType(db, { capacity: 2 });
+  const inst = makeInstance(db, type, { hoursFromNow: 2 }); // inside window — still refunds
+  const c1 = makeClient(db); const c2 = makeClient(db); const c3 = makeClient(db);
+  const p1 = makePass(db, c1); const p2 = makePass(db, c2);
+  book(db, c1, inst); book(db, c2, inst);
+  const wl = book(db, c3, inst);
+
+  const { affected } = cancelClass(db, inst);
+  assert.equal(affected.length, 3);
+  assert.equal(getPass(db, p1).credits_remaining, 10);
+  assert.equal(getPass(db, p2).credits_remaining, 10);
+  assert.equal(getBooking(db, wl.booking.id).status, 'cancelled');
+  assert.equal(db.prepare('SELECT status FROM class_instances WHERE id=?').get(inst).status, 'cancelled');
+});
+
+test('attendance marking: attended, no_show, and cancelled bookings free capacity accounting correctly', () => {
+  const db = testDb();
+  const type = makeClassType(db, { capacity: 2 });
+  const inst = makeInstance(db, type);
+  const c1 = makeClient(db); const c2 = makeClient(db); const c3 = makeClient(db);
+  const b1 = book(db, c1, inst);
+  const b2 = book(db, c2, inst);
+  markAttendance(db, b1.booking.id, 'attended');
+  markAttendance(db, b2.booking.id, 'no_show');
+  // attended/no_show still occupy the class — next booking waitlists
+  const b3 = book(db, c3, inst);
+  assert.equal(b3.waitlisted, true);
+  assert.throws(() => markAttendance(db, b3.booking.id, 'attended'), (e) => e.code === 'not_found');
+});
+
+test('multi-credit classes deduct and refund credits_required', () => {
+  const db = testDb();
+  const type = makeClassType(db, { credits: 2 });
+  const inst = makeInstance(db, type, { hoursFromNow: 48 });
+  const client = makeClient(db);
+  const pass = makePass(db, client, { total: 5 });
+  const { booking } = book(db, client, inst);
+  assert.equal(getPass(db, pass).credits_remaining, 3);
+  cancelBooking(db, booking.id);
+  assert.equal(getPass(db, pass).credits_remaining, 5);
+});
+
+test('a pass with fewer credits than required is skipped', () => {
+  const db = testDb();
+  const type = makeClassType(db, { credits: 2 });
+  const inst = makeInstance(db, type);
+  const client = makeClient(db);
+  makePass(db, client, { total: 5, remaining: 1 });
+  const { booking } = book(db, client, inst);
+  assert.equal(booking.paid_with, 'drop_in_manual');
+});
+
+test('capacity race: concurrent-style bookings never exceed capacity (transactional)', () => {
+  const db = testDb();
+  const type = makeClassType(db, { capacity: 5 });
+  const inst = makeInstance(db, type);
+  const clients = Array.from({ length: 20 }, () => makeClient(db));
+  for (const c of clients) book(db, c, inst);
+  const booked = db.prepare(
+    "SELECT COUNT(*) c FROM bookings WHERE class_instance_id=? AND status='booked'"
+  ).get(inst).c;
+  const wait = db.prepare(
+    "SELECT COUNT(*) c FROM bookings WHERE class_instance_id=? AND status='waitlist'"
+  ).get(inst).c;
+  assert.equal(booked, 5);
+  assert.equal(wait, 15);
+});

package/test/fixtures/mindbody-clients.csv

@@ -0,0 +1,9 @@
+First Name,Last Name,Email,Mobile Phone,Home Phone,Address,City,Notes,Liability Waiver,Client Since
+Wing Yan,Chan,wingyan.chan@example.com,+852 9123 4567,,"Flat 12B, Harbour Towers",Hong Kong,"Prefers morning classes, shoulder injury (2024)",Yes,1/15/2023
+Ka Ming,Wong,kaming.wong@example.com,+852 9876 5432,+852 2345 6789,,Kowloon,,Yes,3/2/2024
+Siu Fung,Lee,siufung.lee@example.com,,,,,"Referred by Wing Yan",No,11/20/2025
+Emily,Tsang,emily.tsang@example.com,+852 6011 2233,,,"Sha Tin","VIP — annual member since 2022",Yes,6/6/2022
+David,Ng,,+852 5544 3322,,,,No email on file — front desk only,No,2/14/2025
+Hoi Ching,Lam,hoiching.lam@example.com,+852 6677 8899,,,Tsuen Wan,,Yes,9/9/2024
+Jason,"O'Brien, Jr.",jason.obrien@example.com,+852 9000 1111,,,Central,"Name contains comma, tests quoting",Yes,5/1/2025
+Mei,Cheung,MEI.CHEUNG@Example.com,+852 6123 9876,,,Mong Kok,Uppercase email in export,Yes,7/30/2025

package/test/fixtures/mindbody-passes.csv

@@ -0,0 +1,8 @@
+Client,Email,Pricing Option,Remaining,Total,Expiration,Price Paid,Purchase Date
+Wing Yan Chan,wingyan.chan@example.com,10 Class Pack,7,10,10/31/2026,"$1,500.00",4/12/2026
+Ka Ming Wong,kaming.wong@example.com,10 Class Pack,2,10,8/15/2026,"$1,500.00",1/20/2026
+Ka Ming Wong,kaming.wong@example.com,5 Class Intro Pack,0,5,3/1/2026,$550.00,12/2/2025
+Emily Tsang,emily.tsang@example.com,20 Class Pack,18,20,2026-12-31,"$2,800.00",6/1/2026
+Hoi Ching Lam,hoiching.lam@example.com,Single Class,1,1,9/30/2026,$180.00,7/1/2026
+Walk In,,10 Class Pack,10,10,12/31/2026,"$1,500.00",7/15/2026
+Priya Sharma,priya.sharma@example.com,10 Class Pack,5,11/11/2026,"$1,500.00",5/5/2026

package/test/helpers.js

@@ -0,0 +1,59 @@
+// Shared test fixtures: in-memory DB with a small studio.
+import { openDb, setSetting } from '../src/db/index.js';
+
+export function testDb(settings = {}) {
+  const db = openDb(':memory:');
+  setSetting(db, 'studio_name', 'Test Studio');
+  setSetting(db, 'timezone', 'Asia/Hong_Kong');
+  setSetting(db, 'setup_complete', '1');
+  for (const [k, v] of Object.entries(settings)) setSetting(db, k, v);
+  return db;
+}
+
+export function makeClient(db, { name = 'Alice Wong', email = `c${Math.random().toString(36).slice(2)}@t.test`, waiver = true } = {}) {
+  const info = db.prepare(
+    'INSERT INTO clients (name, email, waiver_signed_at, source) VALUES (?, ?, ?, ?)'
+  ).run(name, email, waiver ? new Date().toISOString() : null, 'manual');
+  return info.lastInsertRowid;
+}
+
+export function makeClassType(db, { name = 'Yoga', capacity = 3, credits = 1, price = 15000, duration = 60 } = {}) {
+  return db.prepare(
+    'INSERT INTO class_types (name, duration_min, capacity, drop_in_price_cents, credits_required) VALUES (?, ?, ?, ?, ?)'
+  ).run(name, duration, capacity, price, credits).lastInsertRowid;
+}
+
+/** A class instance N hours from `now` (default: from real now). */
+export function makeInstance(db, typeId, { hoursFromNow = 48, capacity, now } = {}) {
+  const base = now ? new Date(now).getTime() : Date.now();
+  const startsAt = new Date(base + hoursFromNow * 3600000).toISOString().replace(/\.\d{3}Z$/, 'Z');
+  const cap = capacity ?? db.prepare('SELECT capacity FROM class_types WHERE id = ?').get(typeId).capacity;
+  return db.prepare(
+    "INSERT INTO class_instances (class_type_id, starts_at, duration_min, capacity, status) VALUES (?, ?, 60, ?, 'scheduled')"
+  ).run(typeId, startsAt, cap).lastInsertRowid;
+}
+
+export function makePass(db, clientId, { name = '10 Pack', total = 10, remaining = total, expiresOn = null, source = 'manual' } = {}) {
+  return db.prepare(
+    'INSERT INTO passes (client_id, name, credits_total, credits_remaining, expires_on, source) VALUES (?, ?, ?, ?, ?, ?)'
+  ).run(clientId, name, total, remaining, expiresOn, source).lastInsertRowid;
+}
+
+export function makeMembership(db, clientId, { unlimited = true, creditsPerMonth = null, status = 'active', startedOn = '2026-01-01' } = {}) {
+  return db.prepare(
+    `INSERT INTO memberships (client_id, plan_name, status, started_on, unlimited, credits_per_month, cycle_started_on)
+     VALUES (?, 'Test Plan', ?, ?, ?, ?, ?)`
+  ).run(clientId, status, startedOn, unlimited ? 1 : 0, creditsPerMonth, startedOn).lastInsertRowid;
+}
+
+/** GET a page with a cookie-persisting supertest agent and pull the CSRF token out of its form HTML. */
+export async function csrfToken(agent, url) {
+  const res = await agent.get(url);
+  const m = res.text.match(/name="_csrf" value="([^"]+)"/);
+  if (!m) throw new Error(`no CSRF token found on ${url} (status ${res.status})`);
+  return m[1];
+}
+
+export const getPass = (db, id) => db.prepare('SELECT * FROM passes WHERE id = ?').get(id);
+export const getBooking = (db, id) => db.prepare('SELECT * FROM bookings WHERE id = ?').get(id);
+export const getMembership = (db, id) => db.prepare('SELECT * FROM memberships WHERE id = ?').get(id);