studio-os 0.3.0 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,74 @@
 # Changelog
 
+## 0.5.0 — 2026-09-27
+
+**Upgrading:** the database migrates itself on start (schema v4, one new
+column on `payments`). Drop-in dues recorded before the upgrade aren't linked
+to a booking, so they won't clear themselves if that booking is cancelled.
+Check the dashboard's Pending payments for stale ones.
+
+- **Editing a weekly rule moved nothing and doubled the schedule.** Changing
+  a rule's day or time left every future class at the old slot and then
+  generated a second set at the new one. Empty future classes now move with
+  the rule, and booked ones stay put with a note saying how many. A malformed
+  time used to save, 500, and then break the daily generator for every rule.
+  It's rejected now.
+- **Drop-in dues were charged to people who never got a spot.** Booking
+  onto the waitlist recorded a pending drop-in payment, and cancelling never
+  removed one. Dues are now tied to the booking: recorded when the client
+  holds a spot (including when the waitlist promotes them), dropped when
+  they cancel in time or the studio cancels the class. A forfeited late
+  cancel still owes, same as it would lose a pack credit.
+- **The waitlist got promoted into classes that had already started.** A
+  late cancel or a staff roster edit after start time moved the next person
+  in and charged them for a class they'd missed. Clients also can't cancel
+  once a class has started. Staff still can, to tidy the roster.
+- **The booking form renamed existing clients.** Anyone who typed a known
+  email with a different name overwrote that client's name. An existing
+  client now keeps theirs.
+- **Edit a single class.** The roster page can change one class's capacity,
+  instructor and notes. Extra capacity goes to the waitlist in order, and
+  those clients are emailed.
+- A two-credit class said "1 credit deducted". The purchase thank-you page
+  said the pass was active before Stripe had confirmed the payment.
+- **Dependencies**: dotenv → 18.0.3, marked → 18.0.14, supertest → 7.3.0.
+- **Tests**: 135 → 144.
+
+## 0.4.0 — 2026-09-27
+
+**Upgrading with Stripe:** add `checkout.session.async_payment_succeeded` and
+`invoice.paid` to your webhook endpoint's events. Without them, delayed
+payments never turn into passes and renewals still go unrecorded. The database
+migrates itself on start (schema v3, one new column on `payments`).
+
+- **Security: booking in someone else's name handed over their magic link.**
+  Booking takes only a name and an email, and the confirmation page always
+  showed the booked client's `/me` link, a 7-day token to their bookings,
+  passes and cancel buttons. With SMTP configured the link now only goes out
+  by email. Without SMTP it's still shown on screen, as before, and the
+  README says what that means.
+- **Security: a 100kb POST to any public form leaked a stack trace.** The
+  body-size 413 reached the error handler before the layout locals were set,
+  `error.ejs` threw, and Express's fallback answered 500 with the
+  ReferenceError and server paths (hidden only when `NODE_ENV=production`,
+  which the Docker image sets). The error page now renders on its own and 4xx
+  statuses stay 4xx.
+- **Stripe renewals were never recorded.** Only a membership's first month
+  showed up as a payment, so the revenue report undercounted every
+  subscription after month one. `invoice.paid` now records each renewal,
+  keyed on the invoice id so webhook retries can't count a month twice.
+- **Delayed Stripe payments got a pass before the money cleared.** Bank
+  debits and other delayed methods complete Checkout with `payment_status:
+  unpaid`, and fulfilment ignored that. Unpaid sessions now wait for
+  `checkout.session.async_payment_succeeded`.
+- **Mindbody imports past a few hundred clients got a 413.** Admin → Import
+  now accepts up to 20mb.
+- **The waitlist page said "You're # in line"** with no number. It now shows
+  the actual position.
+- `GET /me` without a token answered 500 instead of the "link expired" page.
+- **Dependencies**: dotenv 17 → 18, nodemailer → 10.0.10.
+- **Tests**: 127 → 135.
+
 ## 0.3.0 — 2026-09-17
 
 - **Security: magic links were emailed as `http://` behind a reverse proxy.**

package/README.md

@@ -135,7 +135,10 @@ activate purchases manually from the client profile — fully usable cash-only.
    - `STRIPE_PUBLISHABLE_KEY`
    - `STRIPE_WEBHOOK_SECRET` — see step 3
 3. Add a webhook endpoint in Stripe: `https://your-domain/webhooks/stripe`,
-   events `checkout.session.completed` and `customer.subscription.deleted`.
+   events `checkout.session.completed`, `checkout.session.async_payment_succeeded`,
+   `invoice.paid` and `customer.subscription.deleted`. The async event is what
+   fulfils payments that clear later, like bank debits; card-only studios never
+   see it. `invoice.paid` records each membership renewal in the revenue report.
    Copy the signing secret into `STRIPE_WEBHOOK_SECRET`.
    (Local testing: `stripe listen --forward-to localhost:3000/webhooks/stripe`.)
    The webhook secret is not optional: online payment stays off until it is
@@ -184,6 +187,10 @@ What's protected out of the box:
 What's *not* there yet — plan accordingly:
 
 - **No 2FA** on staff logins.
+- **Without SMTP, client links are shown on screen**, so anyone who knows a
+  client's email can open their bookings page. That's fine for trying the app
+  out; configure SMTP before real clients use it. With SMTP on, links only
+  ever go to the inbox.
 - The rate limiter is **single-instance and in-memory**: counters are
   per-process and reset on restart. Fine for the one-container target; a
   multi-instance deployment needs a shared store (or limit at the proxy).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "studio-os",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "Self-hosted studio management: booking, class packs, memberships. Bring your own Stripe.",
   "license": "MIT",
   "type": "module",
@@ -19,15 +19,15 @@
     "bcryptjs": "^3.0.3",
     "better-sqlite3": "^13.0.1",
     "cookie-session": "^2.1.0",
-    "dotenv": "^17.4.2",
+    "dotenv": "^18.0.3",
     "ejs": "^6.0.1",
     "express": "^5.2.1",
-    "marked": "^18.0.9",
-    "nodemailer": "^10.0.9",
+    "marked": "^18.0.14",
+    "nodemailer": "^10.0.10",
     "stripe": "^22.6.2"
   },
   "devDependencies": {
-    "supertest": "^7.0.0"
+    "supertest": "^7.3.0"
   },
   "repository": {
     "type": "git",

package/src/app.js

@@ -53,6 +53,9 @@ export function createApp({ db, mailer, stripeService, env = process.env, now =
   // before any body parser.
   app.use('/webhooks/stripe', express.raw({ type: '*/*' }), webhookRoutes(services));
 
+  // A pasted Mindbody client export is 100+ bytes a row once URL-encoded, so
+  // the 100kb default refused any studio with more than a few hundred clients.
+  app.use('/admin/import', express.urlencoded({ extended: true, limit: '20mb' }));
   app.use(express.urlencoded({ extended: true }));
   app.use(express.static(path.join(__dirname, '..', 'public')));
   app.use(cookieSession({
@@ -149,7 +152,11 @@ export function createApp({ db, mailer, stripeService, env = process.env, now =
   // eslint-disable-next-line no-unused-vars
   app.use((err, req, res, next) => {
     console.error('[error]', err);
-    res.status(500).render('error', { title: 'Error', message: err.expose ? err.message : 'Something went wrong.' });
+    // Body-parser errors (oversized or malformed bodies) arrive before the
+    // locals middleware has run, and the layout can't render without these.
+    res.locals = { settings: {}, user: null, flash: null, ...res.locals };
+    const status = err.status >= 400 && err.status < 500 ? err.status : 500;
+    res.status(status).render('error', { title: 'Error', message: err.expose ? err.message : 'Something went wrong.' });
   });
 
   return app;

package/src/db/003-stripe-invoices.sql

@@ -0,0 +1,6 @@
+-- v3: membership renewals are recorded from Stripe invoices, keyed on the
+-- invoice id so webhook retries can't record the same month twice.
+
+ALTER TABLE payments ADD COLUMN stripe_invoice_id TEXT;
+CREATE UNIQUE INDEX IF NOT EXISTS uq_payments_invoice
+  ON payments(stripe_invoice_id) WHERE stripe_invoice_id IS NOT NULL;

package/src/db/004-payment-booking.sql

@@ -0,0 +1,5 @@
+-- v4: a drop-in paid at the studio is only owed while its booking stands, so
+-- the pending payment remembers which booking it's for.
+
+ALTER TABLE payments ADD COLUMN booking_id INTEGER REFERENCES bookings(id);
+CREATE INDEX IF NOT EXISTS idx_payments_booking ON payments(booking_id) WHERE booking_id IS NOT NULL;

package/src/db/index.js

@@ -1,82 +1,84 @@
-import Database from 'better-sqlite3';
-import fs from 'node:fs';
-import path from 'node:path';
-import crypto from 'node:crypto';
-import { fileURLToPath } from 'node:url';
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-
-const MIGRATIONS = [
-  { version: 1, file: 'schema.sql' },
-  { version: 2, file: '002-instructor-role.sql' },
-];
-
-const DEFAULT_SETTINGS = {
-  studio_name: '',
-  timezone: 'Asia/Hong_Kong',
-  currency: 'HKD',
-  cancellation_window_hours: '12',
-  late_cancel_policy: 'forfeit', // forfeit | refund
-  waiver_markdown: '## Liability Waiver\n\nI understand that participation in classes involves physical activity and I take part at my own risk. I confirm I am in good health and will inform the instructor of any injuries or conditions.\n\nBy checking the box I agree to this waiver.',
-  setup_complete: '0',
-  horizon_weeks: '8',
-};
-
-/**
- * Open (or create) the database, enable WAL, run migrations, seed defaults.
- * @param {string} [dbPath] file path or ':memory:' (tests)
- */
-export function openDb(dbPath) {
-  const file = dbPath || process.env.DB_PATH || path.join(process.cwd(), 'data', 'studio.db');
-  if (file !== ':memory:') fs.mkdirSync(path.dirname(file), { recursive: true });
-  const db = new Database(file);
-  db.pragma('journal_mode = WAL');
-  db.pragma('foreign_keys = ON');
-  db.pragma('busy_timeout = 5000');
-  migrate(db);
-  return db;
-}
-
-function migrate(db) {
-  db.exec('CREATE TABLE IF NOT EXISTS schema_migrations (version INTEGER PRIMARY KEY, applied_at TEXT NOT NULL)');
-  const applied = new Set(db.prepare('SELECT version FROM schema_migrations').all().map((r) => r.version));
-  for (const m of MIGRATIONS) {
-    if (applied.has(m.version)) continue;
-    const sql = fs.readFileSync(path.join(__dirname, m.file), 'utf8');
-    db.transaction(() => {
-      db.exec(sql);
-      db.prepare('INSERT INTO schema_migrations (version, applied_at) VALUES (?, ?)')
-        .run(m.version, new Date().toISOString());
-    })();
-  }
-  // seed default settings (INSERT OR IGNORE keeps existing values)
-  const ins = db.prepare('INSERT OR IGNORE INTO settings (key, value) VALUES (?, ?)');
-  for (const [k, v] of Object.entries(DEFAULT_SETTINGS)) ins.run(k, v);
-  // app secret: generated once, persisted, overridable via env
-  if (!process.env.APP_SECRET) {
-    ins.run('app_secret', crypto.randomBytes(32).toString('hex'));
-  }
-}
-
-export function getSetting(db, key, fallback = '') {
-  if (key === 'app_secret' && process.env.APP_SECRET) return process.env.APP_SECRET;
-  const row = db.prepare('SELECT value FROM settings WHERE key = ?').get(key);
-  return row ? row.value : fallback;
-}
-
-export function setSetting(db, key, value) {
-  db.prepare('INSERT INTO settings (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value')
-    .run(key, String(value));
-}
-
-export function allSettings(db) {
-  const out = {};
-  for (const r of db.prepare('SELECT key, value FROM settings').all()) out[r.key] = r.value;
-  if (process.env.APP_SECRET) out.app_secret = process.env.APP_SECRET;
-  return out;
-}
-
-export function audit(db, who, action, entity = '') {
-  db.prepare('INSERT INTO audit_log (who, action, entity, at) VALUES (?, ?, ?, ?)')
-    .run(who || '', action, entity, new Date().toISOString());
-}
+import Database from 'better-sqlite3';
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+
+const MIGRATIONS = [
+  { version: 1, file: 'schema.sql' },
+  { version: 2, file: '002-instructor-role.sql' },
+  { version: 3, file: '003-stripe-invoices.sql' },
+  { version: 4, file: '004-payment-booking.sql' },
+];
+
+const DEFAULT_SETTINGS = {
+  studio_name: '',
+  timezone: 'Asia/Hong_Kong',
+  currency: 'HKD',
+  cancellation_window_hours: '12',
+  late_cancel_policy: 'forfeit', // forfeit | refund
+  waiver_markdown: '## Liability Waiver\n\nI understand that participation in classes involves physical activity and I take part at my own risk. I confirm I am in good health and will inform the instructor of any injuries or conditions.\n\nBy checking the box I agree to this waiver.',
+  setup_complete: '0',
+  horizon_weeks: '8',
+};
+
+/**
+ * Open (or create) the database, enable WAL, run migrations, seed defaults.
+ * @param {string} [dbPath] file path or ':memory:' (tests)
+ */
+export function openDb(dbPath) {
+  const file = dbPath || process.env.DB_PATH || path.join(process.cwd(), 'data', 'studio.db');
+  if (file !== ':memory:') fs.mkdirSync(path.dirname(file), { recursive: true });
+  const db = new Database(file);
+  db.pragma('journal_mode = WAL');
+  db.pragma('foreign_keys = ON');
+  db.pragma('busy_timeout = 5000');
+  migrate(db);
+  return db;
+}
+
+function migrate(db) {
+  db.exec('CREATE TABLE IF NOT EXISTS schema_migrations (version INTEGER PRIMARY KEY, applied_at TEXT NOT NULL)');
+  const applied = new Set(db.prepare('SELECT version FROM schema_migrations').all().map((r) => r.version));
+  for (const m of MIGRATIONS) {
+    if (applied.has(m.version)) continue;
+    const sql = fs.readFileSync(path.join(__dirname, m.file), 'utf8');
+    db.transaction(() => {
+      db.exec(sql);
+      db.prepare('INSERT INTO schema_migrations (version, applied_at) VALUES (?, ?)')
+        .run(m.version, new Date().toISOString());
+    })();
+  }
+  // seed default settings (INSERT OR IGNORE keeps existing values)
+  const ins = db.prepare('INSERT OR IGNORE INTO settings (key, value) VALUES (?, ?)');
+  for (const [k, v] of Object.entries(DEFAULT_SETTINGS)) ins.run(k, v);
+  // app secret: generated once, persisted, overridable via env
+  if (!process.env.APP_SECRET) {
+    ins.run('app_secret', crypto.randomBytes(32).toString('hex'));
+  }
+}
+
+export function getSetting(db, key, fallback = '') {
+  if (key === 'app_secret' && process.env.APP_SECRET) return process.env.APP_SECRET;
+  const row = db.prepare('SELECT value FROM settings WHERE key = ?').get(key);
+  return row ? row.value : fallback;
+}
+
+export function setSetting(db, key, value) {
+  db.prepare('INSERT INTO settings (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value')
+    .run(key, String(value));
+}
+
+export function allSettings(db) {
+  const out = {};
+  for (const r of db.prepare('SELECT key, value FROM settings').all()) out[r.key] = r.value;
+  if (process.env.APP_SECRET) out.app_secret = process.env.APP_SECRET;
+  return out;
+}
+
+export function audit(db, who, action, entity = '') {
+  db.prepare('INSERT INTO audit_log (who, action, entity, at) VALUES (?, ?, ?, ?)')
+    .run(who || '', action, entity, new Date().toISOString());
+}