studio-os 0.2.0

package/test/importer.test.js

@@ -0,0 +1,173 @@
+// Mindbody importer: CSV parsing, fixture import, idempotency, mapping
+// overrides, dry-run, and the CLI script end-to-end. No network.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { openDb } from '../src/db/index.js';
+import { parseCsv, importClients, importPasses } from '../src/services/importer.js';
+import { testDb } from './helpers.js';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const FIXTURES = path.join(__dirname, 'fixtures');
+const clientsCsv = fs.readFileSync(path.join(FIXTURES, 'mindbody-clients.csv'), 'utf8');
+const passesCsv = fs.readFileSync(path.join(FIXTURES, 'mindbody-passes.csv'), 'utf8');
+
+test('parseCsv handles quoted fields, embedded commas and doubled quotes', () => {
+  const rows = parseCsv('A,B\n"x, y","he said ""hi"""\nplain,2');
+  assert.equal(rows.length, 2);
+  assert.equal(rows[0].A, 'x, y');
+  assert.equal(rows[0].B, 'he said "hi"');
+  assert.equal(rows[1].A, 'plain');
+});
+
+test('clients fixture import: creates valid rows, skips missing email, normalizes', () => {
+  const db = testDb();
+  const r = importClients(db, clientsCsv);
+  assert.equal(r.created, 7, 'seven rows have valid emails');
+  assert.equal(r.skipped, 1, 'David Ng has no email');
+  assert.equal(r.updated, 0);
+
+  // quoted comma inside a name survives
+  const jason = db.prepare('SELECT * FROM clients WHERE email = ?').get('jason.obrien@example.com');
+  assert.equal(jason.name, "Jason O'Brien, Jr.");
+  assert.equal(jason.source, 'import');
+
+  // uppercase email in the export is stored lowercase
+  const mei = db.prepare('SELECT * FROM clients WHERE email = ?').get('mei.cheung@example.com');
+  assert.ok(mei, 'MEI.CHEUNG@Example.com normalized to lowercase');
+
+  // waiver column mapped: Yes → signed, No → not signed
+  const wing = db.prepare('SELECT * FROM clients WHERE email = ?').get('wingyan.chan@example.com');
+  assert.ok(wing.waiver_signed_at, 'Liability Waiver=Yes sets waiver_signed_at');
+  const siufung = db.prepare('SELECT * FROM clients WHERE email = ?').get('siufung.lee@example.com');
+  assert.equal(siufung.waiver_signed_at, null, 'Liability Waiver=No leaves waiver unsigned');
+});
+
+test('clients import is idempotent by email: re-run updates, never duplicates', () => {
+  const db = testDb();
+  importClients(db, clientsCsv);
+  const before = db.prepare('SELECT COUNT(*) c FROM clients').get().c;
+
+  const r2 = importClients(db, clientsCsv);
+  assert.equal(r2.created, 0);
+  assert.equal(r2.updated, 7);
+  assert.equal(db.prepare('SELECT COUNT(*) c FROM clients').get().c, before, 'no duplicates');
+
+  // an updated export (new phone) updates in place, and blank columns do not wipe data
+  const changed = 'First Name,Last Name,Email,Mobile Phone\nWing Yan,Chan,wingyan.chan@example.com,+852 5555 0000\n';
+  const r3 = importClients(db, changed);
+  assert.equal(r3.updated, 1);
+  const wing = db.prepare('SELECT * FROM clients WHERE email = ?').get('wingyan.chan@example.com');
+  assert.equal(wing.phone, '+852 5555 0000');
+  assert.match(wing.notes, /morning classes/, 'notes kept when re-import omits the column');
+});
+
+test('clients dry-run reports work but writes nothing', () => {
+  const db = testDb();
+  const r = importClients(db, clientsCsv, { dryRun: true });
+  assert.equal(r.created, 7);
+  assert.equal(db.prepare('SELECT COUNT(*) c FROM clients').get().c, 0, 'dry run wrote nothing');
+});
+
+test('passes fixture import: attaches by email, parses money/dates, auto-creates unknown clients', () => {
+  const db = testDb();
+  importClients(db, clientsCsv);
+  const r = importPasses(db, passesCsv);
+  assert.equal(r.created, 6);
+  assert.equal(r.skipped, 1, 'Walk In row has no email');
+  assert.equal(r.clientsCreated, 1, 'Priya Sharma not in clients export → bare client created');
+
+  const wing = db.prepare('SELECT * FROM clients WHERE email = ?').get('wingyan.chan@example.com');
+  const pass = db.prepare('SELECT * FROM passes WHERE client_id = ?').get(wing.id);
+  assert.equal(pass.credits_remaining, 7);
+  assert.equal(pass.credits_total, 10);
+  assert.equal(pass.expires_on, '2026-10-31', 'M/D/YYYY normalized');
+  assert.equal(pass.price_paid_cents, 150000, '"$1,500.00" parsed to cents');
+  assert.equal(pass.source, 'import');
+
+  // ISO expiration passes through
+  const emily = db.prepare('SELECT * FROM clients WHERE email = ?').get('emily.tsang@example.com');
+  const epass = db.prepare('SELECT * FROM passes WHERE client_id = ?').get(emily.id);
+  assert.equal(epass.expires_on, '2026-12-31');
+
+  // two different pricing options for the same client → two passes
+  const kaming = db.prepare('SELECT * FROM clients WHERE email = ?').get('kaming.wong@example.com');
+  const kpasses = db.prepare('SELECT * FROM passes WHERE client_id = ? ORDER BY name').all(kaming.id);
+  assert.equal(kpasses.length, 2);
+  assert.equal(kpasses.find((p) => p.name === '5 Class Intro Pack').credits_remaining, 0);
+
+  const priya = db.prepare('SELECT * FROM clients WHERE email = ?').get('priya.sharma@example.com');
+  assert.equal(priya.name, 'Priya Sharma');
+  assert.equal(priya.source, 'import');
+});
+
+test('passes import is idempotent: re-run updates remaining, never duplicates', () => {
+  const db = testDb();
+  importClients(db, clientsCsv);
+  importPasses(db, passesCsv);
+  const before = db.prepare('SELECT COUNT(*) c FROM passes').get().c;
+
+  const r2 = importPasses(db, passesCsv);
+  assert.equal(r2.created, 0);
+  assert.equal(r2.updated, 6);
+  assert.equal(db.prepare('SELECT COUNT(*) c FROM passes').get().c, before, 'no duplicate passes');
+
+  // a newer export with fewer remaining credits updates the same pass row
+  const newer = 'Client,Email,Pricing Option,Remaining,Total,Expiration,Price Paid\n'
+    + 'Wing Yan Chan,wingyan.chan@example.com,10 Class Pack,5,10,10/31/2026,"$1,500.00"\n';
+  const r3 = importPasses(db, newer);
+  assert.equal(r3.updated, 1);
+  assert.equal(r3.created, 0);
+  const wing = db.prepare('SELECT * FROM clients WHERE email = ?').get('wingyan.chan@example.com');
+  const pass = db.prepare("SELECT * FROM passes WHERE client_id = ? AND name = '10 Class Pack'").get(wing.id);
+  assert.equal(pass.credits_remaining, 5);
+});
+
+test('column mapping overrides let non-standard exports import', () => {
+  const db = testDb();
+  const csv = 'Vorname,Nachname,E-Mail-Adresse\nHans,Muller,hans@example.com\n';
+  const r = importClients(db, csv, {
+    mapping: {
+      firstName: ['Vorname'], lastName: ['Nachname'], email: ['E-Mail-Adresse'],
+      phone: [], notes: [], waiverSigned: [],
+    },
+  });
+  assert.equal(r.created, 1);
+  assert.equal(db.prepare('SELECT name FROM clients WHERE email = ?').get('hans@example.com').name, 'Hans Muller');
+});
+
+test('CLI script: dry-run writes nothing, real run imports, re-run is idempotent', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'studio-import-'));
+  const dbPath = path.join(dir, 'studio.db');
+  const script = path.join(__dirname, '..', 'scripts', 'import-mindbody.mjs');
+  const run = (extra) => spawnSync(process.execPath, [
+    script,
+    '--clients', path.join(FIXTURES, 'mindbody-clients.csv'),
+    '--passes', path.join(FIXTURES, 'mindbody-passes.csv'),
+    '--db', dbPath, ...extra,
+  ], { encoding: 'utf8' });
+
+  const dry = run(['--dry-run']);
+  assert.equal(dry.status, 0, dry.stderr);
+  assert.match(dry.stdout, /DRY RUN/);
+  let db = openDb(dbPath);
+  assert.equal(db.prepare('SELECT COUNT(*) c FROM clients').get().c, 0, 'dry run wrote nothing');
+  db.close();
+
+  const real = run([]);
+  assert.equal(real.status, 0, real.stderr);
+  assert.match(real.stdout, /7 created/);
+  const rerun = run([]);
+  assert.equal(rerun.status, 0, rerun.stderr);
+  assert.match(rerun.stdout, /0 created, 7 updated/);
+
+  db = openDb(dbPath);
+  assert.equal(db.prepare('SELECT COUNT(*) c FROM clients').get().c, 8, '7 from clients + Priya');
+  assert.equal(db.prepare('SELECT COUNT(*) c FROM passes').get().c, 6);
+  db.close();
+  fs.rmSync(dir, { recursive: true, force: true });
+});

package/test/instructor.test.js

@@ -0,0 +1,217 @@
+// Instructor role (v0.2.0): migration, admin account management + class
+// assignment, portal route guards, roster scoping, check-in. No network.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import request from 'supertest';
+import { openDb, setSetting } from '../src/db/index.js';
+import { createApp } from '../src/app.js';
+import { createMailer } from '../src/services/mailer.js';
+import { createUser } from '../src/services/auth.js';
+import { makeClassType, makeInstance, makeClient, csrfToken } from './helpers.js';
+
+function makeApp() {
+  const db = openDb(':memory:');
+  setSetting(db, 'studio_name', 'Instructor Test Studio');
+  setSetting(db, 'setup_complete', '1');
+  createUser(db, { email: 'owner@test.test', password: 'password123', role: 'owner' });
+  const app = createApp({ db, mailer: createMailer({ env: {} }), env: {} });
+  return { db, app };
+}
+
+function makeInstructor(db, { email = 'teach@test.test', password = 'teachpass1', name = 'Kim Lee' } = {}) {
+  return createUser(db, { email, password, name, role: 'instructor' });
+}
+
+function assign(db, instructorId, classId) {
+  db.prepare('INSERT INTO instructor_class_assignments (instructor_id, class_id) VALUES (?, ?)')
+    .run(instructorId, classId);
+}
+
+async function login(agent, email, password) {
+  const _csrf = await csrfToken(agent, '/admin/login');
+  const res = await agent.post('/admin/login').type('form').send({ email, password, _csrf });
+  return { res, _csrf };
+}
+
+test('migration v2: instructor role accepted, assignments table exists, owner intact', () => {
+  const { db } = makeApp();
+  const id = makeInstructor(db);
+  assert.equal(db.prepare('SELECT role FROM users WHERE id = ?').get(id).role, 'instructor');
+  assert.equal(db.prepare("SELECT role FROM users WHERE email = 'owner@test.test'").get().role, 'owner');
+  assert.throws(() => db.prepare("UPDATE users SET role = 'bogus' WHERE id = ?").run(id), /CHECK/);
+  const type = makeClassType(db);
+  const inst = makeInstance(db, type);
+  assign(db, id, inst);
+  assert.ok(db.prepare('SELECT 1 FROM instructor_class_assignments WHERE instructor_id = ? AND class_id = ?').get(id, inst));
+});
+
+test('instructor login redirects to /instructor/schedule; /login aliases the form', async () => {
+  const { db, app } = makeApp();
+  makeInstructor(db);
+  const alias = await request(app).get('/login');
+  assert.equal(alias.status, 302);
+  assert.equal(alias.headers.location, '/admin/login');
+
+  const agent = request.agent(app);
+  const { res } = await login(agent, 'teach@test.test', 'teachpass1');
+  assert.equal(res.status, 302);
+  assert.equal(res.headers.location, '/instructor/schedule');
+
+  // owner still lands on /admin
+  const admin = request.agent(app);
+  const { res: res2 } = await login(admin, 'owner@test.test', 'password123');
+  assert.equal(res2.headers.location, '/admin');
+});
+
+test('instructor cannot access /admin/* (403); anonymous still 302 to login', async () => {
+  const { db, app } = makeApp();
+  makeInstructor(db);
+  const agent = request.agent(app);
+  const { _csrf } = await login(agent, 'teach@test.test', 'teachpass1');
+
+  for (const path of ['/admin', '/admin/clients', '/admin/schedule', '/admin/settings', '/admin/reports']) {
+    const res = await agent.get(path);
+    assert.equal(res.status, 403, `${path} should 403 for instructor`);
+  }
+  const post = await agent.post('/admin/settings').type('form').send({ studio_name: 'Hacked', _csrf });
+  assert.equal(post.status, 403);
+
+  const anon = await request(app).get('/admin');
+  assert.equal(anon.status, 302);
+  assert.equal(anon.headers.location, '/admin/login');
+});
+
+test('portal guards: anonymous → login; admin → back to /admin', async () => {
+  const { app } = makeApp();
+  const anon = await request(app).get('/instructor/schedule');
+  assert.equal(anon.status, 302);
+  assert.equal(anon.headers.location, '/admin/login');
+
+  const admin = request.agent(app);
+  await login(admin, 'owner@test.test', 'password123');
+  const res = await admin.get('/instructor/schedule');
+  assert.equal(res.status, 302);
+  assert.equal(res.headers.location, '/admin');
+});
+
+test('schedule shows only assigned upcoming classes', async () => {
+  const { db, app } = makeApp();
+  const me = makeInstructor(db);
+  const mine = makeClassType(db, { name: 'Assigned Aerial' });
+  const other = makeClassType(db, { name: 'Unassigned Boxing' });
+  const myClass = makeInstance(db, mine, { hoursFromNow: 24 });
+  makeInstance(db, other, { hoursFromNow: 24 });
+  assign(db, me, myClass);
+
+  const agent = request.agent(app);
+  await login(agent, 'teach@test.test', 'teachpass1');
+  const res = await agent.get('/instructor/schedule');
+  assert.equal(res.status, 200);
+  assert.match(res.text, /Assigned Aerial/);
+  assert.doesNotMatch(res.text, /Unassigned Boxing/);
+});
+
+test('roster: 200 for assigned class, 403 for unassigned', async () => {
+  const { db, app } = makeApp();
+  const me = makeInstructor(db);
+  const type = makeClassType(db, { name: 'Spin' });
+  const myClass = makeInstance(db, type, { hoursFromNow: 24 });
+  const otherClass = makeInstance(db, type, { hoursFromNow: 48 });
+  assign(db, me, myClass);
+  const clientId = makeClient(db, { name: 'Rider One', email: 'rider@test.hk' });
+  const { book } = await import('../src/services/booking.js');
+  book(db, clientId, myClass);
+
+  const agent = request.agent(app);
+  await login(agent, 'teach@test.test', 'teachpass1');
+
+  const ok = await agent.get(`/instructor/classes/${myClass}/roster`);
+  assert.equal(ok.status, 200);
+  assert.match(ok.text, /Rider One/);
+  assert.match(ok.text, /booked/);
+  assert.doesNotMatch(ok.text, /rider@test.hk/, 'client emails are not exposed to instructors');
+
+  const forbidden = await agent.get(`/instructor/classes/${otherClass}/roster`);
+  assert.equal(forbidden.status, 403);
+});
+
+test('check-in: works for assigned class, 403 unassigned, 404 booking from another class', async () => {
+  const { db, app } = makeApp();
+  const me = makeInstructor(db);
+  const type = makeClassType(db, { name: 'HIIT' });
+  const myClass = makeInstance(db, type, { hoursFromNow: 24 });
+  const otherClass = makeInstance(db, type, { hoursFromNow: 48 });
+  assign(db, me, myClass);
+  const c1 = makeClient(db, { email: 'a@test.hk' });
+  const c2 = makeClient(db, { email: 'b@test.hk' });
+  const { book } = await import('../src/services/booking.js');
+  const { booking: myBooking } = book(db, c1, myClass);
+  const { booking: otherBooking } = book(db, c2, otherClass);
+
+  const agent = request.agent(app);
+  const { _csrf } = await login(agent, 'teach@test.test', 'teachpass1');
+
+  const ok = await agent.post(`/instructor/classes/${myClass}/checkin/${myBooking.id}`).type('form').send({ _csrf });
+  assert.equal(ok.status, 302);
+  assert.equal(ok.headers.location, `/instructor/classes/${myClass}/roster`);
+  assert.equal(db.prepare('SELECT status FROM bookings WHERE id = ?').get(myBooking.id).status, 'attended');
+  const roster = await agent.get(`/instructor/classes/${myClass}/roster`);
+  assert.match(roster.text, /checked-in/);
+
+  const forbidden = await agent.post(`/instructor/classes/${otherClass}/checkin/${otherBooking.id}`).type('form').send({ _csrf });
+  assert.equal(forbidden.status, 403);
+  assert.equal(db.prepare('SELECT status FROM bookings WHERE id = ?').get(otherBooking.id).status, 'booked');
+
+  const wrongClass = await agent.post(`/instructor/classes/${myClass}/checkin/${otherBooking.id}`).type('form').send({ _csrf });
+  assert.equal(wrongClass.status, 404);
+});
+
+test('admin UI: create instructor login, assign + unassign classes via checkboxes', async () => {
+  const { db, app } = makeApp();
+  const type = makeClassType(db, { name: 'Yin' });
+  const ci1 = makeInstance(db, type, { hoursFromNow: 24 });
+  const ci2 = makeInstance(db, type, { hoursFromNow: 48 });
+
+  const agent = request.agent(app);
+  const { _csrf } = await login(agent, 'owner@test.test', 'password123');
+
+  // create: bad password rejected, good one lands on the assignment page
+  const bad = await agent.post('/admin/instructors/new').type('form')
+    .send({ name: 'New Teach', email: 'nt@test.test', password: 'short', _csrf });
+  assert.equal(bad.status, 400);
+  const good = await agent.post('/admin/instructors/new').type('form')
+    .send({ name: 'New Teach', email: 'nt@test.test', password: 'longenough1', _csrf });
+  assert.equal(good.status, 302);
+  const user = db.prepare("SELECT * FROM users WHERE email = 'nt@test.test'").get();
+  assert.equal(user.role, 'instructor');
+  assert.equal(good.headers.location, `/admin/instructors/${user.id}/classes`);
+  const dup = await agent.post('/admin/instructors/new').type('form')
+    .send({ name: 'Dup', email: 'nt@test.test', password: 'longenough1', _csrf });
+  assert.equal(dup.status, 400);
+  assert.match(dup.text, /already has an account/);
+
+  // listed on the instructors page
+  const list = await agent.get('/admin/instructors');
+  assert.match(list.text, /nt@test.test/);
+
+  // assign both, then keep only one — unchecked box is removed
+  const both = await agent.post(`/admin/instructors/${user.id}/classes`).type('form')
+    .send({ class_ids: [String(ci1), String(ci2)], _csrf });
+  assert.equal(both.status, 302);
+  assert.equal(db.prepare('SELECT COUNT(*) c FROM instructor_class_assignments WHERE instructor_id = ?').get(user.id).c, 2);
+
+  const one = await agent.post(`/admin/instructors/${user.id}/classes`).type('form')
+    .send({ class_ids: String(ci1), _csrf });
+  assert.equal(one.status, 302);
+  const left = db.prepare('SELECT class_id FROM instructor_class_assignments WHERE instructor_id = ?').all(user.id);
+  assert.deepEqual(left.map((r) => r.class_id), [ci1]);
+
+  // form page renders with the surviving box checked
+  const page = await agent.get(`/admin/instructors/${user.id}/classes`);
+  assert.equal(page.status, 200);
+  assert.match(page.text, new RegExp(`value="${ci1}" checked`));
+
+  // unknown account id → 404
+  const missing = await agent.get('/admin/instructors/9999/classes');
+  assert.equal(missing.status, 404);
+});

package/test/ratelimit.test.js

@@ -0,0 +1,123 @@
+// Rate limiter tests: fixed-window trigger + reset via an injected fake
+// clock (no sleeping), and X-Forwarded-For handling with/without TRUST_PROXY.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import request from 'supertest';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { openDb, setSetting } from '../src/db/index.js';
+import { createApp } from '../src/app.js';
+import { createMailer } from '../src/services/mailer.js';
+import { createUser } from '../src/services/auth.js';
+import { csrfToken, makeClassType, makeInstance } from './helpers.js';
+
+const OUTBOX = fs.mkdtempSync(path.join(os.tmpdir(), 'studio-rl-outbox-'));
+const WINDOW = 15 * 60 * 1000;
+
+function makeApp({ env = {}, now } = {}) {
+  const db = openDb(':memory:');
+  setSetting(db, 'studio_name', 'RL Studio');
+  setSetting(db, 'setup_complete', '1');
+  createUser(db, { email: 'owner@test.test', password: 'password123', role: 'owner' });
+  const mailer = createMailer({ env: {}, outboxDir: OUTBOX });
+  const app = createApp({ db, mailer, env, now });
+  return { db, app };
+}
+
+test('/magic-link: 5 per 15 min, 6th → 429, next window resets', async () => {
+  let t = 10 * WINDOW; // arbitrary fixed start
+  const { app } = makeApp({ now: () => t });
+  const agent = request.agent(app);
+  const _csrf = await csrfToken(agent, '/magic-link');
+
+  for (let i = 1; i <= 5; i++) {
+    const res = await agent.post('/magic-link').type('form').send({ email: `x${i}@t.test`, _csrf });
+    assert.equal(res.status, 200, `request ${i} allowed`);
+  }
+  const blocked = await agent.post('/magic-link').type('form').send({ email: 'x6@t.test', _csrf });
+  assert.equal(blocked.status, 429);
+  assert.match(blocked.text, /Too many link requests/);
+  assert.equal(blocked.headers['retry-after'], String(WINDOW / 1000));
+
+  // advance the clock into the next window — allowed again
+  t += WINDOW;
+  const fresh = await agent.post('/magic-link').type('form').send({ email: 'x7@t.test', _csrf });
+  assert.equal(fresh.status, 200);
+});
+
+test('/admin/login: 10 per 15 min, wrong passwords count, 11th → 429', async () => {
+  let t = 10 * WINDOW;
+  const { app } = makeApp({ now: () => t });
+  const agent = request.agent(app);
+  const _csrf = await csrfToken(agent, '/admin/login');
+
+  for (let i = 1; i <= 10; i++) {
+    const res = await agent.post('/admin/login').type('form')
+      .send({ email: 'owner@test.test', password: 'wrong', _csrf });
+    assert.equal(res.status, 401, `attempt ${i} rejected but not throttled`);
+  }
+  const blocked = await agent.post('/admin/login').type('form')
+    .send({ email: 'owner@test.test', password: 'password123', _csrf });
+  assert.equal(blocked.status, 429, 'even correct credentials are throttled');
+  assert.match(blocked.text, /Too many login attempts/);
+});
+
+test('booking POSTs: 30 per 15 min shared across /class/:id/book', async () => {
+  let t = 10 * WINDOW;
+  const { db, app } = makeApp({ now: () => t });
+  const type = makeClassType(db, { capacity: 100 });
+  const instA = makeInstance(db, type, { hoursFromNow: 48 });
+  const instB = makeInstance(db, type, { hoursFromNow: 72 });
+  const agent = request.agent(app);
+  const _csrf = await csrfToken(agent, `/class/${instA}`);
+
+  // 30 posts (invalid email → 400, but each one counts) split across two
+  // instances: the bucket is per route PATTERN, not per concrete URL.
+  for (let i = 1; i <= 30; i++) {
+    const inst = i % 2 ? instA : instB;
+    const res = await agent.post(`/class/${inst}/book`).type('form').send({ email: 'nope', _csrf });
+    assert.equal(res.status, 400, `request ${i} allowed through the limiter`);
+  }
+  const blocked = await agent.post(`/class/${instA}/book`).type('form')
+    .send({ email: 'real@t.test', waiver_agree: '1', _csrf });
+  assert.equal(blocked.status, 429);
+  assert.match(blocked.text, /Too many booking attempts/);
+  assert.equal(db.prepare('SELECT COUNT(*) c FROM bookings').get().c, 0);
+
+  t += WINDOW;
+  const fresh = await agent.post(`/class/${instA}/book`).type('form')
+    .send({ name: 'Real', email: 'real@t.test', waiver_agree: '1', _csrf });
+  assert.equal(fresh.status, 200, 'window reset allows booking again');
+});
+
+test('X-Forwarded-For is ignored unless TRUST_PROXY is set', async () => {
+  let t = 10 * WINDOW;
+  // TRUST_PROXY unset: spoofed XFF headers cannot dodge the limit
+  const { app } = makeApp({ now: () => t });
+  const agent = request.agent(app);
+  const _csrf = await csrfToken(agent, '/magic-link');
+  for (let i = 1; i <= 5; i++) {
+    await agent.post('/magic-link').type('form')
+      .set('X-Forwarded-For', `1.2.3.${i}`).send({ email: 'a@t.test', _csrf });
+  }
+  const blocked = await agent.post('/magic-link').type('form')
+    .set('X-Forwarded-For', '9.9.9.9').send({ email: 'a@t.test', _csrf });
+  assert.equal(blocked.status, 429, 'spoofed XFF still shares the socket-IP bucket');
+
+  // TRUST_PROXY=1: distinct forwarded IPs get distinct buckets
+  const trusted = makeApp({ env: { TRUST_PROXY: '1' }, now: () => t });
+  const agent2 = request.agent(trusted.app);
+  const csrf2 = await csrfToken(agent2, '/magic-link');
+  for (let i = 1; i <= 5; i++) {
+    const res = await agent2.post('/magic-link').type('form')
+      .set('X-Forwarded-For', '1.1.1.1').send({ email: 'a@t.test', _csrf: csrf2 });
+    assert.equal(res.status, 200);
+  }
+  const sameIp = await agent2.post('/magic-link').type('form')
+    .set('X-Forwarded-For', '1.1.1.1').send({ email: 'a@t.test', _csrf: csrf2 });
+  assert.equal(sameIp.status, 429, 'same forwarded IP is limited');
+  const otherIp = await agent2.post('/magic-link').type('form')
+    .set('X-Forwarded-For', '2.2.2.2').send({ email: 'a@t.test', _csrf: csrf2 });
+  assert.equal(otherIp.status, 200, 'different forwarded IP has its own bucket');
+});

package/test/schedule.test.js

@@ -0,0 +1,102 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { testDb, makeClassType } from './helpers.js';
+import { generateInstances, upcomingInstances } from '../src/services/schedule.js';
+import { zonedToUtc, localDateStr, utcToZoned } from '../src/lib/time.js';
+
+function makeRule(db, typeId, { weekday = 1, startTime = '09:00', capacityOverride = null, activeFrom = null, activeUntil = null } = {}) {
+  return db.prepare(
+    'INSERT INTO schedule_rules (class_type_id, weekday, start_time, capacity_override, active_from, active_until) VALUES (?, ?, ?, ?, ?, ?)'
+  ).run(typeId, weekday, startTime, capacityOverride, activeFrom, activeUntil).lastInsertRowid;
+}
+
+test('zonedToUtc converts Hong Kong wall time to UTC (-8h, no DST)', () => {
+  const d = zonedToUtc('Asia/Hong_Kong', 2026, 8, 3, 9, 0);
+  assert.equal(d.toISOString(), '2026-08-03T01:00:00.000Z');
+  const p = utcToZoned('Asia/Hong_Kong', d);
+  assert.equal(p.hh, 9);
+  assert.equal(p.weekday, 1); // Monday
+});
+
+test('generator materializes 8 weeks of weekly instances, idempotently', () => {
+  const db = testDb();
+  const type = makeClassType(db, { capacity: 12 });
+  makeRule(db, type, { weekday: 1, startTime: '09:00' });
+
+  const created = generateInstances(db);
+  assert.equal(created, 8); // one Monday per week over 8 weeks
+
+  const again = generateInstances(db);
+  assert.equal(again, 0, 'second run creates nothing');
+
+  const rows = db.prepare('SELECT * FROM class_instances ORDER BY starts_at').all();
+  assert.equal(rows.length, 8);
+  for (const r of rows) {
+    const p = utcToZoned('Asia/Hong_Kong', r.starts_at);
+    assert.equal(p.weekday, 1, 'lands on Monday in studio tz');
+    assert.equal(p.hh, 9, 'at 09:00 studio time');
+    assert.equal(r.capacity, 12, 'inherits class type capacity');
+  }
+});
+
+test('capacity_override wins over class type capacity', () => {
+  const db = testDb();
+  const type = makeClassType(db, { capacity: 12 });
+  makeRule(db, type, { capacityOverride: 4 });
+  generateInstances(db);
+  const row = db.prepare('SELECT capacity FROM class_instances LIMIT 1').get();
+  assert.equal(row.capacity, 4);
+});
+
+test('active_from / active_until bound the generated range', () => {
+  const db = testDb();
+  const type = makeClassType(db);
+  const tz = 'Asia/Hong_Kong';
+  const today = localDateStr(tz);
+  // only active for the next ~2 weeks
+  const until = new Date(Date.now() + 14 * 86400000).toISOString().slice(0, 10);
+  makeRule(db, type, { weekday: 3, activeFrom: today, activeUntil: until });
+  generateInstances(db);
+  const rows = db.prepare('SELECT starts_at FROM class_instances').all();
+  assert.ok(rows.length >= 1 && rows.length <= 3, `expected ~2 instances, got ${rows.length}`);
+});
+
+test('inactive rules and inactive class types generate nothing', () => {
+  const db = testDb();
+  const type = makeClassType(db);
+  const rule = makeRule(db, type);
+  db.prepare('UPDATE schedule_rules SET active = 0 WHERE id = ?').run(rule);
+  assert.equal(generateInstances(db), 0);
+
+  db.prepare('UPDATE schedule_rules SET active = 1 WHERE id = ?').run(rule);
+  db.prepare('UPDATE class_types SET active = 0 WHERE id = ?').run(type);
+  assert.equal(generateInstances(db), 0);
+});
+
+test('deleting future instances then regenerating restores them (idempotent by rule+time)', () => {
+  const db = testDb();
+  const type = makeClassType(db);
+  makeRule(db, type);
+  generateInstances(db);
+  db.prepare('DELETE FROM class_instances').run();
+  const recreated = generateInstances(db);
+  assert.equal(recreated, 8);
+});
+
+test('upcomingInstances filters by type and hides cancelled', () => {
+  const db = testDb();
+  const yoga = makeClassType(db, { name: 'Yoga' });
+  const boxing = makeClassType(db, { name: 'Boxing' });
+  makeRule(db, yoga, { weekday: 2 });
+  makeRule(db, boxing, { weekday: 4 });
+  generateInstances(db);
+
+  const all = upcomingInstances(db, { days: 14 });
+  const yogaOnly = upcomingInstances(db, { days: 14, classTypeId: yoga });
+  assert.ok(all.length > yogaOnly.length);
+  assert.ok(yogaOnly.every((r) => r.class_name === 'Yoga'));
+
+  db.prepare("UPDATE class_instances SET status='cancelled' WHERE id = ?").run(all[0].id);
+  const after = upcomingInstances(db, { days: 14 });
+  assert.equal(after.length, all.length - 1);
+});