studio-os 0.3.0 → 0.4.0

package/CHANGELOG.md

@@ -1,5 +1,40 @@
 # Changelog
 
+## 0.4.0 — 2026-09-27
+
+**Upgrading with Stripe:** add `checkout.session.async_payment_succeeded` and
+`invoice.paid` to your webhook endpoint's events. Without them, delayed
+payments never turn into passes and renewals still go unrecorded. The database
+migrates itself on start (schema v3, one new column on `payments`).
+
+- **Security: booking in someone else's name handed over their magic link.**
+  Booking takes only a name and an email, and the confirmation page always
+  showed the booked client's `/me` link, a 7-day token to their bookings,
+  passes and cancel buttons. With SMTP configured the link now only goes out
+  by email. Without SMTP it's still shown on screen, as before, and the
+  README says what that means.
+- **Security: a 100kb POST to any public form leaked a stack trace.** The
+  body-size 413 reached the error handler before the layout locals were set,
+  `error.ejs` threw, and Express's fallback answered 500 with the
+  ReferenceError and server paths (hidden only when `NODE_ENV=production`,
+  which the Docker image sets). The error page now renders on its own and 4xx
+  statuses stay 4xx.
+- **Stripe renewals were never recorded.** Only a membership's first month
+  showed up as a payment, so the revenue report undercounted every
+  subscription after month one. `invoice.paid` now records each renewal,
+  keyed on the invoice id so webhook retries can't count a month twice.
+- **Delayed Stripe payments got a pass before the money cleared.** Bank
+  debits and other delayed methods complete Checkout with `payment_status:
+  unpaid`, and fulfilment ignored that. Unpaid sessions now wait for
+  `checkout.session.async_payment_succeeded`.
+- **Mindbody imports past a few hundred clients got a 413.** Admin → Import
+  now accepts up to 20mb.
+- **The waitlist page said "You're # in line"** with no number. It now shows
+  the actual position.
+- `GET /me` without a token answered 500 instead of the "link expired" page.
+- **Dependencies**: dotenv 17 → 18, nodemailer → 10.0.10.
+- **Tests**: 127 → 135.
+
 ## 0.3.0 — 2026-09-17
 
 - **Security: magic links were emailed as `http://` behind a reverse proxy.**

package/README.md

@@ -135,7 +135,10 @@ activate purchases manually from the client profile — fully usable cash-only.
    - `STRIPE_PUBLISHABLE_KEY`
    - `STRIPE_WEBHOOK_SECRET` — see step 3
 3. Add a webhook endpoint in Stripe: `https://your-domain/webhooks/stripe`,
-   events `checkout.session.completed` and `customer.subscription.deleted`.
+   events `checkout.session.completed`, `checkout.session.async_payment_succeeded`,
+   `invoice.paid` and `customer.subscription.deleted`. The async event is what
+   fulfils payments that clear later, like bank debits; card-only studios never
+   see it. `invoice.paid` records each membership renewal in the revenue report.
    Copy the signing secret into `STRIPE_WEBHOOK_SECRET`.
    (Local testing: `stripe listen --forward-to localhost:3000/webhooks/stripe`.)
    The webhook secret is not optional: online payment stays off until it is
@@ -184,6 +187,10 @@ What's protected out of the box:
 What's *not* there yet — plan accordingly:
 
 - **No 2FA** on staff logins.
+- **Without SMTP, client links are shown on screen**, so anyone who knows a
+  client's email can open their bookings page. That's fine for trying the app
+  out; configure SMTP before real clients use it. With SMTP on, links only
+  ever go to the inbox.
 - The rate limiter is **single-instance and in-memory**: counters are
   per-process and reset on restart. Fine for the one-container target; a
   multi-instance deployment needs a shared store (or limit at the proxy).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "studio-os",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Self-hosted studio management: booking, class packs, memberships. Bring your own Stripe.",
   "license": "MIT",
   "type": "module",
@@ -19,7 +19,7 @@
     "bcryptjs": "^3.0.3",
     "better-sqlite3": "^13.0.1",
     "cookie-session": "^2.1.0",
-    "dotenv": "^17.4.2",
+    "dotenv": "^18.0.2",
     "ejs": "^6.0.1",
     "express": "^5.2.1",
     "marked": "^18.0.9",

package/src/app.js

@@ -53,6 +53,9 @@ export function createApp({ db, mailer, stripeService, env = process.env, now =
   // before any body parser.
   app.use('/webhooks/stripe', express.raw({ type: '*/*' }), webhookRoutes(services));
 
+  // A pasted Mindbody client export is 100+ bytes a row once URL-encoded, so
+  // the 100kb default refused any studio with more than a few hundred clients.
+  app.use('/admin/import', express.urlencoded({ extended: true, limit: '20mb' }));
   app.use(express.urlencoded({ extended: true }));
   app.use(express.static(path.join(__dirname, '..', 'public')));
   app.use(cookieSession({
@@ -149,7 +152,11 @@ export function createApp({ db, mailer, stripeService, env = process.env, now =
   // eslint-disable-next-line no-unused-vars
   app.use((err, req, res, next) => {
     console.error('[error]', err);
-    res.status(500).render('error', { title: 'Error', message: err.expose ? err.message : 'Something went wrong.' });
+    // Body-parser errors (oversized or malformed bodies) arrive before the
+    // locals middleware has run, and the layout can't render without these.
+    res.locals = { settings: {}, user: null, flash: null, ...res.locals };
+    const status = err.status >= 400 && err.status < 500 ? err.status : 500;
+    res.status(status).render('error', { title: 'Error', message: err.expose ? err.message : 'Something went wrong.' });
   });
 
   return app;

package/src/db/003-stripe-invoices.sql

@@ -0,0 +1,6 @@
+-- v3: membership renewals are recorded from Stripe invoices, keyed on the
+-- invoice id so webhook retries can't record the same month twice.
+
+ALTER TABLE payments ADD COLUMN stripe_invoice_id TEXT;
+CREATE UNIQUE INDEX IF NOT EXISTS uq_payments_invoice
+  ON payments(stripe_invoice_id) WHERE stripe_invoice_id IS NOT NULL;

package/src/db/index.js

@@ -1,82 +1,83 @@
-import Database from 'better-sqlite3';
-import fs from 'node:fs';
-import path from 'node:path';
-import crypto from 'node:crypto';
-import { fileURLToPath } from 'node:url';
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-
-const MIGRATIONS = [
-  { version: 1, file: 'schema.sql' },
-  { version: 2, file: '002-instructor-role.sql' },
-];
-
-const DEFAULT_SETTINGS = {
-  studio_name: '',
-  timezone: 'Asia/Hong_Kong',
-  currency: 'HKD',
-  cancellation_window_hours: '12',
-  late_cancel_policy: 'forfeit', // forfeit | refund
-  waiver_markdown: '## Liability Waiver\n\nI understand that participation in classes involves physical activity and I take part at my own risk. I confirm I am in good health and will inform the instructor of any injuries or conditions.\n\nBy checking the box I agree to this waiver.',
-  setup_complete: '0',
-  horizon_weeks: '8',
-};
-
-/**
- * Open (or create) the database, enable WAL, run migrations, seed defaults.
- * @param {string} [dbPath] file path or ':memory:' (tests)
- */
-export function openDb(dbPath) {
-  const file = dbPath || process.env.DB_PATH || path.join(process.cwd(), 'data', 'studio.db');
-  if (file !== ':memory:') fs.mkdirSync(path.dirname(file), { recursive: true });
-  const db = new Database(file);
-  db.pragma('journal_mode = WAL');
-  db.pragma('foreign_keys = ON');
-  db.pragma('busy_timeout = 5000');
-  migrate(db);
-  return db;
-}
-
-function migrate(db) {
-  db.exec('CREATE TABLE IF NOT EXISTS schema_migrations (version INTEGER PRIMARY KEY, applied_at TEXT NOT NULL)');
-  const applied = new Set(db.prepare('SELECT version FROM schema_migrations').all().map((r) => r.version));
-  for (const m of MIGRATIONS) {
-    if (applied.has(m.version)) continue;
-    const sql = fs.readFileSync(path.join(__dirname, m.file), 'utf8');
-    db.transaction(() => {
-      db.exec(sql);
-      db.prepare('INSERT INTO schema_migrations (version, applied_at) VALUES (?, ?)')
-        .run(m.version, new Date().toISOString());
-    })();
-  }
-  // seed default settings (INSERT OR IGNORE keeps existing values)
-  const ins = db.prepare('INSERT OR IGNORE INTO settings (key, value) VALUES (?, ?)');
-  for (const [k, v] of Object.entries(DEFAULT_SETTINGS)) ins.run(k, v);
-  // app secret: generated once, persisted, overridable via env
-  if (!process.env.APP_SECRET) {
-    ins.run('app_secret', crypto.randomBytes(32).toString('hex'));
-  }
-}
-
-export function getSetting(db, key, fallback = '') {
-  if (key === 'app_secret' && process.env.APP_SECRET) return process.env.APP_SECRET;
-  const row = db.prepare('SELECT value FROM settings WHERE key = ?').get(key);
-  return row ? row.value : fallback;
-}
-
-export function setSetting(db, key, value) {
-  db.prepare('INSERT INTO settings (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value')
-    .run(key, String(value));
-}
-
-export function allSettings(db) {
-  const out = {};
-  for (const r of db.prepare('SELECT key, value FROM settings').all()) out[r.key] = r.value;
-  if (process.env.APP_SECRET) out.app_secret = process.env.APP_SECRET;
-  return out;
-}
-
-export function audit(db, who, action, entity = '') {
-  db.prepare('INSERT INTO audit_log (who, action, entity, at) VALUES (?, ?, ?, ?)')
-    .run(who || '', action, entity, new Date().toISOString());
-}
+import Database from 'better-sqlite3';
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+
+const MIGRATIONS = [
+  { version: 1, file: 'schema.sql' },
+  { version: 2, file: '002-instructor-role.sql' },
+  { version: 3, file: '003-stripe-invoices.sql' },
+];
+
+const DEFAULT_SETTINGS = {
+  studio_name: '',
+  timezone: 'Asia/Hong_Kong',
+  currency: 'HKD',
+  cancellation_window_hours: '12',
+  late_cancel_policy: 'forfeit', // forfeit | refund
+  waiver_markdown: '## Liability Waiver\n\nI understand that participation in classes involves physical activity and I take part at my own risk. I confirm I am in good health and will inform the instructor of any injuries or conditions.\n\nBy checking the box I agree to this waiver.',
+  setup_complete: '0',
+  horizon_weeks: '8',
+};
+
+/**
+ * Open (or create) the database, enable WAL, run migrations, seed defaults.
+ * @param {string} [dbPath] file path or ':memory:' (tests)
+ */
+export function openDb(dbPath) {
+  const file = dbPath || process.env.DB_PATH || path.join(process.cwd(), 'data', 'studio.db');
+  if (file !== ':memory:') fs.mkdirSync(path.dirname(file), { recursive: true });
+  const db = new Database(file);
+  db.pragma('journal_mode = WAL');
+  db.pragma('foreign_keys = ON');
+  db.pragma('busy_timeout = 5000');
+  migrate(db);
+  return db;
+}
+
+function migrate(db) {
+  db.exec('CREATE TABLE IF NOT EXISTS schema_migrations (version INTEGER PRIMARY KEY, applied_at TEXT NOT NULL)');
+  const applied = new Set(db.prepare('SELECT version FROM schema_migrations').all().map((r) => r.version));
+  for (const m of MIGRATIONS) {
+    if (applied.has(m.version)) continue;
+    const sql = fs.readFileSync(path.join(__dirname, m.file), 'utf8');
+    db.transaction(() => {
+      db.exec(sql);
+      db.prepare('INSERT INTO schema_migrations (version, applied_at) VALUES (?, ?)')
+        .run(m.version, new Date().toISOString());
+    })();
+  }
+  // seed default settings (INSERT OR IGNORE keeps existing values)
+  const ins = db.prepare('INSERT OR IGNORE INTO settings (key, value) VALUES (?, ?)');
+  for (const [k, v] of Object.entries(DEFAULT_SETTINGS)) ins.run(k, v);
+  // app secret: generated once, persisted, overridable via env
+  if (!process.env.APP_SECRET) {
+    ins.run('app_secret', crypto.randomBytes(32).toString('hex'));
+  }
+}
+
+export function getSetting(db, key, fallback = '') {
+  if (key === 'app_secret' && process.env.APP_SECRET) return process.env.APP_SECRET;
+  const row = db.prepare('SELECT value FROM settings WHERE key = ?').get(key);
+  return row ? row.value : fallback;
+}
+
+export function setSetting(db, key, value) {
+  db.prepare('INSERT INTO settings (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value')
+    .run(key, String(value));
+}
+
+export function allSettings(db) {
+  const out = {};
+  for (const r of db.prepare('SELECT key, value FROM settings').all()) out[r.key] = r.value;
+  if (process.env.APP_SECRET) out.app_secret = process.env.APP_SECRET;
+  return out;
+}
+
+export function audit(db, who, action, entity = '') {
+  db.prepare('INSERT INTO audit_log (who, action, entity, at) VALUES (?, ?, ?, ?)')
+    .run(who || '', action, entity, new Date().toISOString());
+}

package/src/routes/me.js

@@ -10,7 +10,7 @@ export default function meRoutes(services) {
   const r = Router();
 
   function requireClient(req, res) {
-    const token = req.query.token || req.body.token;
+    const token = req.query.token || (req.body && req.body.token);
     const clientId = verifyMagicToken(db, token);
     if (!clientId) {
       res.status(401).render('public/magic_request', {

package/src/routes/public.js

@@ -117,9 +117,19 @@ export default function publicRoutes(services) {
           });
       mailer.send({ to: result.client.email, ...tpl });
 
+      // Same order promoteNext() uses to pick who gets the next free spot.
+      const b = result.booking;
+      const waitlistPosition = result.waitlisted ? db.prepare(
+        `SELECT COUNT(*) c FROM bookings WHERE class_instance_id = ? AND status = 'waitlist'
+           AND (created_at < ? OR (created_at = ? AND id <= ?))`
+      ).get(inst.id, b.created_at, b.created_at, b.id).c : null;
+
+      // Booking needs nothing but an email, so the link can't go on screen when
+      // it can go to the inbox: anyone who knows a client's address could book
+      // a class in their name and walk off with their self-service link.
       res.render('public/book_result', {
         title: result.waitlisted ? 'Waitlisted' : 'Booked',
-        inst, result, magicUrl,
+        inst, result, magicUrl: mailer.smtpConfigured ? null : magicUrl, waitlistPosition,
       });
     } catch (err) {
       if (err instanceof BookingError) {

package/src/services/stripe.js

@@ -86,6 +86,9 @@ export function fulfillCheckoutSession(db, session) {
   const email = (meta.client_email || session.customer_email
     || (session.customer_details && session.customer_details.email) || '').toLowerCase();
   if (!email) throw new Error('Checkout session has no client email');
+  // Bank debits and other delayed methods complete the session before the money
+  // arrives. checkout.session.async_payment_succeeded brings it back as 'paid'.
+  if (session.payment_status === 'unpaid') return { fulfilled: false, reason: 'awaiting_payment' };
 
   return db.transaction(() => {
     const existing = db.prepare('SELECT id FROM payments WHERE stripe_session_id = ?').get(session.id);
@@ -158,11 +161,45 @@ export function fulfillCheckoutSession(db, session) {
   })();
 }
 
+/**
+ * Record a membership renewal payment. The subscription's first invoice was
+ * already recorded from its Checkout session, so only later cycles count.
+ * Idempotent via payments.stripe_invoice_id.
+ */
+export function recordMembershipRenewal(db, invoice) {
+  if (invoice.billing_reason === 'subscription_create') return { fulfilled: false, reason: 'first_invoice' };
+  // Newer API versions moved this under parent.subscription_details, and a
+  // webhook payload follows the endpoint's API version, so read both.
+  const subscriptionId = (invoice.parent && invoice.parent.subscription_details
+    && invoice.parent.subscription_details.subscription) || invoice.subscription;
+  if (!subscriptionId) return { fulfilled: false, reason: 'not_a_subscription' };
+  if (!invoice.amount_paid) return { fulfilled: false, reason: 'nothing_paid' };
+
+  return db.transaction(() => {
+    const membership = db.prepare('SELECT * FROM memberships WHERE stripe_subscription_id = ?').get(subscriptionId);
+    if (!membership) return { fulfilled: false, reason: 'unknown_subscription' };
+    const existing = db.prepare('SELECT id FROM payments WHERE stripe_invoice_id = ?').get(invoice.id);
+    if (existing) return { fulfilled: false, reason: 'already_processed' };
+
+    const currency = (invoice.currency || getSetting(db, 'currency', 'HKD')).toUpperCase();
+    db.prepare(
+      `INSERT INTO payments (client_id, amount_cents, currency, method, reference, what, status, stripe_invoice_id)
+       VALUES (?, ?, ?, 'stripe', ?, 'membership', 'paid', ?)`
+    ).run(membership.client_id, invoice.amount_paid, currency, membership.plan_name, invoice.id);
+    audit(db, 'stripe-webhook', 'membership_renewed', `membership:${membership.id} invoice:${invoice.id}`);
+    return { fulfilled: true, kind: 'membership_renewal', clientId: membership.client_id };
+  })();
+}
+
 /** Handle a parsed Stripe event. Returns a result object for logging. */
 export function handleStripeEvent(db, event) {
-  if (event.type === 'checkout.session.completed') {
+  if (event.type === 'checkout.session.completed'
+      || event.type === 'checkout.session.async_payment_succeeded') {
     return fulfillCheckoutSession(db, event.data.object);
   }
+  if (event.type === 'invoice.paid') {
+    return recordMembershipRenewal(db, event.data.object);
+  }
   if (event.type === 'customer.subscription.deleted') {
     const sub = event.data.object;
     const r = db.prepare(

package/test/booking-link.test.js

@@ -0,0 +1,47 @@
+// Booking needs only an email, so the page it returns must not hand over the
+// self-service link for whatever address was typed.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import request from 'supertest';
+import { createApp } from '../src/app.js';
+import { testDb, makeClient, makeClassType, makeInstance, csrfToken } from './helpers.js';
+
+function appWith(db, { smtp }) {
+  const sent = [];
+  const mailer = { smtpConfigured: smtp, async send(msg) { sent.push(msg); return true; } };
+  return { app: createApp({ db, mailer, env: {} }), sent };
+}
+
+async function bookAs(app, instanceId, email) {
+  const agent = request.agent(app);
+  const _csrf = await csrfToken(agent, `/class/${instanceId}`);
+  return agent.post(`/class/${instanceId}/book`).type('form').send({ _csrf, email, waiver_agree: '1' });
+}
+
+test('with SMTP on, booking in someone else\'s name does not reveal their link', async () => {
+  const db = testDb();
+  makeClient(db, { email: 'member@test.hk', name: 'Member' });
+  const inst = makeInstance(db, makeClassType(db));
+  const { app, sent } = appWith(db, { smtp: true });
+
+  const res = await bookAs(app, inst, 'member@test.hk');
+
+  assert.equal(res.status, 200);
+  assert.doesNotMatch(res.text, /\/me\?token=/);
+  assert.match(res.text, /on its way/);
+  // The owner of the address still gets their link, by email.
+  assert.equal(sent.length, 1);
+  assert.equal(sent[0].to, 'member@test.hk');
+  assert.match(sent[0].text, /\/me\?token=/);
+});
+
+test('with SMTP off, the link is still shown so the studio works offline', async () => {
+  const db = testDb();
+  const inst = makeInstance(db, makeClassType(db));
+  const { app } = appWith(db, { smtp: false });
+
+  const res = await bookAs(app, inst, 'walkin@test.hk');
+
+  assert.equal(res.status, 200);
+  assert.match(res.text, /\/me\?token=/);
+});

package/test/error-paths.test.js

@@ -0,0 +1,49 @@
+// Requests that used to end in a 500, or in a crashed error page.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import request from 'supertest';
+import { createApp } from '../src/app.js';
+import { createUser } from '../src/services/auth.js';
+import { testDb, csrfToken } from './helpers.js';
+
+function mindbodyClientsCsv(n) {
+  const rows = ['First Name,Last Name,Email,Mobile Phone,Notes,Liability Waiver'];
+  for (let i = 0; i < n; i++) {
+    rows.push(`Client${i},Surname${i},client${i}@example.com,+852 5555 ${String(i).padStart(4, '0')},Prefers a mat by the window,Yes`);
+  }
+  return rows.join('\n');
+}
+
+test('Admin → Import takes a Mindbody export bigger than 100kb', async () => {
+  const db = testDb();
+  createUser(db, { email: 'owner@test.hk', password: 'password123', role: 'owner' });
+  const agent = request.agent(createApp({ db, env: {} }));
+  let _csrf = await csrfToken(agent, '/admin/login');
+  await agent.post('/admin/login').type('form').send({ email: 'owner@test.hk', password: 'password123', _csrf });
+  _csrf = await csrfToken(agent, '/admin/import');
+
+  const csv = mindbodyClientsCsv(1500);
+  assert.ok(csv.length > 100 * 1024);
+  const res = await agent.post('/admin/import').type('form').send({ _csrf, kind: 'clients', csv });
+
+  assert.equal(res.status, 200);
+  assert.equal(db.prepare('SELECT COUNT(*) c FROM clients').get().c, 1500);
+});
+
+test('an oversized body elsewhere gets a 413 page, not a crashed error page', async () => {
+  const db = testDb();
+  const res = await request(createApp({ db, env: {} }))
+    .post('/magic-link').type('form').send({ email: 'x'.repeat(200 * 1024) });
+
+  assert.equal(res.status, 413);
+  assert.match(res.text, /<main class="container">/);
+  assert.doesNotMatch(res.text, /ReferenceError|at Layer/);
+});
+
+test('/me without a token asks for a new link instead of a 500', async () => {
+  const db = testDb();
+  const res = await request(createApp({ db, env: {} })).get('/me');
+
+  assert.equal(res.status, 401);
+  assert.match(res.text, /invalid or has expired/);
+});

package/test/stripe.test.js

@@ -121,6 +121,34 @@ test('replayed webhook is a no-op (idempotent by stripe_session_id)', async () =
   assert.equal(db.prepare('SELECT COUNT(*) c FROM payments').get().c, 1, 'no duplicate payment');
 });
 
+test('a delayed payment is fulfilled when it clears, not when checkout completes', async () => {
+  const { db, app } = makeApp();
+  const productId = db.prepare(
+    "INSERT INTO pack_products (name, credits, price_cents) VALUES ('5 Pack', 5, 55000)"
+  ).run().lastInsertRowid;
+  const session = {
+    id: 'cs_debit',
+    amount_total: 55000,
+    currency: 'hkd',
+    metadata: { kind: 'pack', pack_product_id: String(productId), client_email: 'debit@test.hk' },
+  };
+
+  const completed = await postEvent(app, checkoutCompleted({ ...session, payment_status: 'unpaid' }));
+  assert.equal(completed.status, 200);
+  assert.equal(completed.body.fulfilled, false);
+  assert.equal(completed.body.reason, 'awaiting_payment');
+  assert.equal(db.prepare('SELECT COUNT(*) c FROM passes').get().c, 0, 'no pass before the money arrives');
+  assert.equal(db.prepare('SELECT COUNT(*) c FROM payments').get().c, 0);
+
+  const cleared = await postEvent(app, {
+    type: 'checkout.session.async_payment_succeeded',
+    data: { object: { ...session, payment_status: 'paid' } },
+  });
+  assert.equal(cleared.body.fulfilled, true);
+  assert.equal(db.prepare('SELECT COUNT(*) c FROM passes').get().c, 1);
+  assert.equal(db.prepare("SELECT COUNT(*) c FROM payments WHERE status = 'paid'").get().c, 1);
+});
+
 test('membership checkout fulfillment: activates membership with subscription id', async () => {
   const { db, app } = makeApp();
   const planId = db.prepare(
@@ -148,6 +176,61 @@ test('membership checkout fulfillment: activates membership with subscription id
   assert.equal(payment.status, 'paid');
 });
 
+test('invoice.paid records each membership renewal once, but not the first month again', async () => {
+  const { db, app } = makeApp();
+  const planId = db.prepare(
+    "INSERT INTO membership_plans (name, price_cents, unlimited, stripe_price_id) VALUES ('Unlimited Monthly', 128000, 1, 'price_mock')"
+  ).run().lastInsertRowid;
+  await postEvent(app, checkoutCompleted({
+    id: 'cs_renew', amount_total: 128000, currency: 'hkd', subscription: 'sub_renew',
+    metadata: { kind: 'membership', plan_id: String(planId), client_email: 'renew@test.hk' },
+  }));
+  const invoicePaid = (invoice) => postEvent(app, { type: 'invoice.paid', data: { object: invoice } });
+  const payments = () => db.prepare("SELECT * FROM payments WHERE what = 'membership' ORDER BY id").all();
+
+  // Stripe also sends invoice.paid for the first month, which the Checkout
+  // session already recorded.
+  const first = await invoicePaid({
+    id: 'in_1', billing_reason: 'subscription_create', amount_paid: 128000, currency: 'hkd',
+    parent: { subscription_details: { subscription: 'sub_renew' } },
+  });
+  assert.equal(first.body.fulfilled, false);
+  assert.equal(payments().length, 1);
+
+  const renewal = {
+    id: 'in_2', billing_reason: 'subscription_cycle', amount_paid: 128000, currency: 'hkd',
+    parent: { subscription_details: { subscription: 'sub_renew' } },
+  };
+  const second = await invoicePaid(renewal);
+  assert.equal(second.body.fulfilled, true);
+  assert.equal(second.body.kind, 'membership_renewal');
+  const replay = await invoicePaid(renewal);
+  assert.equal(replay.body.reason, 'already_processed');
+
+  // Endpoints pinned to an older API version put the id at the top level.
+  const legacy = await invoicePaid({
+    id: 'in_3', billing_reason: 'subscription_cycle', amount_paid: 128000, currency: 'hkd',
+    subscription: 'sub_renew',
+  });
+  assert.equal(legacy.body.fulfilled, true);
+
+  const rows = payments();
+  assert.equal(rows.length, 3);
+  assert.deepEqual(rows.map((p) => p.stripe_invoice_id), [null, 'in_2', 'in_3']);
+  assert.ok(rows.every((p) => p.status === 'paid' && p.method === 'stripe' && p.amount_cents === 128000));
+});
+
+test('invoice.paid for a subscription Studio OS never sold is acknowledged and ignored', async () => {
+  const { db, app } = makeApp();
+  const res = await postEvent(app, {
+    type: 'invoice.paid',
+    data: { object: { id: 'in_other', billing_reason: 'subscription_cycle', amount_paid: 5000, subscription: 'sub_elsewhere' } },
+  });
+  assert.equal(res.status, 200);
+  assert.equal(res.body.reason, 'unknown_subscription');
+  assert.equal(db.prepare('SELECT COUNT(*) c FROM payments').get().c, 0);
+});
+
 test('customer.subscription.deleted cancels the matching membership', async () => {
   const { db, app } = makeApp();
   const clientId = db.prepare(
@@ -202,7 +285,7 @@ test('fulfillment failure returns 500 so Stripe retries', async () => {
 
 test('unhandled event types are acknowledged and ignored', async () => {
   const { app } = makeApp();
-  const res = await postEvent(app, { type: 'invoice.paid', data: { object: {} } });
+  const res = await postEvent(app, { type: 'charge.refunded', data: { object: {} } });
   assert.equal(res.status, 200);
   assert.equal(res.body.fulfilled, false);
   assert.match(res.body.reason, /ignored event/);

package/test/web.test.js

@@ -178,6 +178,11 @@ test('full class books to waitlist via HTTP', async () => {
     .send({ email: 'b@t.hk', waiver_agree: '1', name: 'B', _csrf });
   assert.equal(res.status, 200);
   assert.match(res.text, /waitlist/i);
+  assert.match(res.text, /You're #1 in line/);
+
+  const second = await agent.post(`/class/${inst}/book`).type('form')
+    .send({ email: 'c@t.hk', waiver_agree: '1', name: 'C', _csrf });
+  assert.match(second.text, /You're #2 in line/);
 });
 
 test('magic link: verify round-trip, view bookings, cancel within policy', async () => {

package/views/public/book_result.ejs

@@ -3,7 +3,7 @@
   <% if (result.waitlisted) { %>
     <h2>You're on the waitlist</h2>
     <p><strong><%= inst.class_name %></strong> on <%= fmtDt(inst.starts_at) %> is currently full.
-       You're #<%= result.booking.id ? '' : '' %> in line — if a spot opens we'll book you in automatically<%= smtpConfigured ? ' and email you' : '' %>.</p>
+       You're #<%= waitlistPosition %> in line — if a spot opens we'll book you in automatically<%= smtpConfigured ? ' and email you' : '' %>.</p>
   <% } else { %>
     <h2>You're booked!</h2>
     <p><strong><%= inst.class_name %></strong> · <%= fmtDt(inst.starts_at) %></p>
@@ -15,12 +15,12 @@
       <% } %>
     </p>
   <% } %>
-  <p>Manage or cancel your bookings any time:</p>
-  <p><a href="<%= magicUrl %>" role="button" class="outline">My bookings</a></p>
-  <% if (!smtpConfigured) { %>
+  <% if (magicUrl) { %>
+    <p>Manage or cancel your bookings any time:</p>
+    <p><a href="<%= magicUrl %>" role="button" class="outline">My bookings</a></p>
     <p><small>Save that link — it's your personal booking manager (valid 7 days; you can request a new one from “My bookings” in the menu).</small></p>
   <% } else { %>
-    <p><small>A confirmation email with your personal link is on its way.</small></p>
+    <p>A confirmation email with a link to manage or cancel your booking is on its way.</p>
   <% } %>
 </article>
 <%- include('../partials/foot') %>