studio-os 0.3.0 → 0.5.0

package/src/routes/me.js

@@ -1,16 +1,17 @@
 // Client self-service via signed magic links. No passwords.
 import { Router } from 'express';
-import { verifyMagicToken, makeMagicToken } from '../services/auth.js';
+import { verifyMagicToken } from '../services/auth.js';
 import { cancelBooking, BookingError } from '../services/booking.js';
 import { getSetting, audit } from '../db/index.js';
 import { emails } from '../services/mailer.js';
+import { notifyPromoted } from '../services/notify.js';
 
 export default function meRoutes(services) {
   const { db, mailer } = services;
   const r = Router();
 
   function requireClient(req, res) {
-    const token = req.query.token || req.body.token;
+    const token = req.query.token || (req.body && req.body.token);
     const clientId = verifyMagicToken(db, token);
     if (!clientId) {
       res.status(401).render('public/magic_request', {
@@ -76,14 +77,7 @@ export default function meRoutes(services) {
         to: client.email,
         ...emails.cancellation({ studio, clientName: client.name, className: inst.class_name, when, refunded: result.refunded }),
       });
-      if (result.promoted) {
-        const promotedClient = db.prepare('SELECT * FROM clients WHERE id = ?').get(result.promoted.client_id);
-        const magicUrl = `${services.baseUrl(req)}/me?token=${makeMagicToken(db, promotedClient.id)}`;
-        mailer.send({
-          to: promotedClient.email,
-          ...emails.waitlistPromotion({ studio, clientName: promotedClient.name, className: inst.class_name, when, magicUrl }),
-        });
-      }
+      if (result.promoted) notifyPromoted(services, req, res, result.promoted, inst);
       req.session.flash = result.refunded
         ? 'Booking cancelled — your credit has been returned.'
         : (result.late ? 'Booking cancelled. This was a late cancellation, so the credit was not returned.' : 'Booking cancelled.');

package/src/routes/public.js

@@ -8,18 +8,14 @@ import { emails } from '../services/mailer.js';
 
 function findOrCreateClient(db, name, email) {
   const cleanEmail = String(email || '').trim().toLowerCase();
-  let client = db.prepare('SELECT * FROM clients WHERE email = ?').get(cleanEmail);
-  if (!client) {
-    const info = db.prepare(
-      "INSERT INTO clients (name, email, source) VALUES (?, ?, 'self')"
-    ).run(String(name || cleanEmail.split('@')[0]).trim(), cleanEmail);
-    client = db.prepare('SELECT * FROM clients WHERE id = ?').get(info.lastInsertRowid);
-  } else if (name && name.trim() && client.name !== name.trim()) {
-    // keep the freshest name the client typed
-    db.prepare('UPDATE clients SET name = ? WHERE id = ?').run(name.trim(), client.id);
-    client.name = name.trim();
-  }
-  return client;
+  const client = db.prepare('SELECT * FROM clients WHERE email = ?').get(cleanEmail);
+  // An existing client keeps their name. The form proves nothing about who's
+  // typing, so it can't be allowed to rename whoever owns the address.
+  if (client) return client;
+  const info = db.prepare(
+    "INSERT INTO clients (name, email, source) VALUES (?, ?, 'self')"
+  ).run(String(name || cleanEmail.split('@')[0]).trim(), cleanEmail);
+  return db.prepare('SELECT * FROM clients WHERE id = ?').get(info.lastInsertRowid);
 }
 
 function loadInstanceFull(db, id) {
@@ -90,20 +86,10 @@ export default function publicRoutes(services) {
           db.prepare('UPDATE clients SET waiver_signed_at = ? WHERE id = ?')
             .run(new Date().toISOString(), client.id);
         }
-        const booked = book(db, client.id, inst.id);
-        // Drop-in without membership/pack: record the pending manual payment.
-        let payment = null;
-        if (booked.booking.paid_with === 'drop_in_manual' && inst.drop_in_price_cents > 0) {
-          const info = db.prepare(
-            `INSERT INTO payments (client_id, amount_cents, currency, method, reference, what, status)
-             VALUES (?, ?, ?, 'other', ?, 'drop_in', 'pending')`
-          ).run(client.id, inst.drop_in_price_cents, getSetting(db, 'currency', 'HKD'),
-            `Drop-in: ${inst.class_name} ${inst.starts_at}`);
-          payment = info.lastInsertRowid;
-        }
+        const booked = book(db, client.id, inst.id, { recordDue: true });
         audit(db, client.email, booked.waitlisted ? 'waitlist_join' : 'booking_create',
           `instance:${inst.id} booking:${booked.booking.id}`);
-        return { client, ...booked, paymentId: payment };
+        return { client, ...booked };
       })();
 
       const magicUrl = `${services.baseUrl(req)}/me?token=${makeMagicToken(db, result.client.id)}`;
@@ -117,9 +103,19 @@ export default function publicRoutes(services) {
           });
       mailer.send({ to: result.client.email, ...tpl });
 
+      // Same order promoteNext() uses to pick who gets the next free spot.
+      const b = result.booking;
+      const waitlistPosition = result.waitlisted ? db.prepare(
+        `SELECT COUNT(*) c FROM bookings WHERE class_instance_id = ? AND status = 'waitlist'
+           AND (created_at < ? OR (created_at = ? AND id <= ?))`
+      ).get(inst.id, b.created_at, b.created_at, b.id).c : null;
+
+      // Booking needs nothing but an email, so the link can't go on screen when
+      // it can go to the inbox: anyone who knows a client's address could book
+      // a class in their name and walk off with their self-service link.
       res.render('public/book_result', {
         title: result.waitlisted ? 'Waitlisted' : 'Booked',
-        inst, result, magicUrl,
+        inst, result, magicUrl: mailer.smtpConfigured ? null : magicUrl, waitlistPosition,
       });
     } catch (err) {
       if (err instanceof BookingError) {

package/src/services/booking.js

@@ -118,6 +118,20 @@ function refund(db, booking, creditsNeeded) {
   }
 }
 
+/** A pay-at-studio drop-in is owed once the client holds a spot. */
+function recordDropInDue(db, booking, inst) {
+  if (booking.paid_with !== 'drop_in_manual' || !(inst.drop_in_price_cents > 0)) return null;
+  return db.prepare(
+    `INSERT INTO payments (client_id, amount_cents, currency, method, reference, what, status, booking_id)
+     VALUES (?, ?, ?, 'other', ?, 'drop_in', 'pending', ?)`
+  ).run(booking.client_id, inst.drop_in_price_cents, getSetting(db, 'currency', 'HKD'),
+    `Drop-in: ${inst.class_name} ${inst.starts_at}`, booking.id).lastInsertRowid;
+}
+
+function dropDropInDue(db, bookingId) {
+  db.prepare("DELETE FROM payments WHERE booking_id = ? AND status = 'pending'").run(bookingId);
+}
+
 function loadInstance(db, instanceId) {
   const inst = db.prepare(
     `SELECT ci.*, ct.credits_required, ct.name AS class_name, ct.drop_in_price_cents
@@ -131,8 +145,9 @@ function loadInstance(db, instanceId) {
 /**
  * Book a client into a class instance.
  * options: { paidWith } to force ('drop_in_online'|'drop_in_manual'|'comp'),
- *          { now } ISO override for tests, { allowPast } for admin walk-ins.
- * Returns the booking row plus { waitlisted: bool }.
+ *          { now } ISO override for tests, { allowPast } for admin walk-ins,
+ *          { recordDue } to record a pending payment for a pay-at-studio drop-in.
+ * Returns the booking row plus { waitlisted: bool, paymentId }.
  */
 export function book(db, clientId, instanceId, options = {}) {
   const nowIso = options.now || new Date().toISOString();
@@ -172,7 +187,8 @@ export function book(db, clientId, instanceId, options = {}) {
       status === 'booked' ? resolution.membershipId ?? null : null,
       nowIso);
     const booking = db.prepare('SELECT * FROM bookings WHERE id = ?').get(info.lastInsertRowid);
-    return { booking, waitlisted: full, instance: inst };
+    const paymentId = options.recordDue && !full ? recordDropInDue(db, booking, inst) : null;
+    return { booking, waitlisted: full, instance: inst, paymentId };
   })();
 }
 
@@ -190,12 +206,16 @@ function promoteNext(db, inst, nowIso) {
   db.prepare(
     'UPDATE bookings SET status = ?, paid_with = ?, pass_id = ?, membership_id = ? WHERE id = ?'
   ).run('booked', resolution.paidWith, resolution.passId ?? null, resolution.membershipId ?? null, next.id);
-  return db.prepare('SELECT * FROM bookings WHERE id = ?').get(next.id);
+  const promoted = db.prepare('SELECT * FROM bookings WHERE id = ?').get(next.id);
+  recordDropInDue(db, promoted, inst);
+  return promoted;
 }
 
 /**
  * Cancel a booking. Within the cancellation window → credit refunded; late →
- * per policy (default forfeit). Auto-promotes the first waitlisted booking.
+ * per policy (default forfeit). Auto-promotes the first waitlisted booking
+ * while the class has yet to start. { allowPast } lets staff tidy a roster
+ * after the fact.
  * Returns { booking, refunded, late, promoted } (promoted = booking row or null).
  */
 export function cancelBooking(db, bookingId, options = {}) {
@@ -207,6 +227,8 @@ export function cancelBooking(db, bookingId, options = {}) {
       throw new BookingError('not_cancellable', `Cannot cancel a ${booking.status} booking`);
     }
     const inst = loadInstance(db, booking.class_instance_id);
+    const started = inst.starts_at <= nowIso;
+    if (started && !options.allowPast) throw new BookingError('in_past', 'Class has already started');
     const windowHours = Number(getSetting(db, 'cancellation_window_hours', '12'));
     const policy = getSetting(db, 'late_cancel_policy', 'forfeit');
     const hoursToStart = hoursBetween(nowIso, inst.starts_at);
@@ -214,23 +236,53 @@ export function cancelBooking(db, bookingId, options = {}) {
     const wasBooked = booking.status === 'booked';
     const creditsNeeded = inst.credits_required ?? 1;
 
+    const excused = !late || policy === 'refund' || options.forceRefund;
     let refunded = false;
-    if (wasBooked && (!late || policy === 'refund' || options.forceRefund)) {
+    if (wasBooked && excused) {
       refund(db, booking, creditsNeeded);
       refunded = booking.paid_with === 'pack' || booking.paid_with === 'membership';
     }
+    // A forfeited late cancel still owes its drop-in, as it would lose a credit.
+    if (excused) dropDropInDue(db, bookingId);
     db.prepare("UPDATE bookings SET status = 'cancelled', cancelled_at = ? WHERE id = ?")
       .run(nowIso, bookingId);
 
-    // A freed confirmed spot promotes the first waitlisted booking.
+    // A freed confirmed spot promotes the first waitlisted booking, but not
+    // into a class that's already running: they'd be charged for missing it.
     let promoted = null;
-    if (wasBooked && bookedCount(db, inst.id) < inst.capacity) {
+    if (wasBooked && !started && bookedCount(db, inst.id) < inst.capacity) {
       promoted = promoteNext(db, inst, nowIso);
     }
     return { booking: { ...booking, status: 'cancelled', cancelled_at: nowIso }, refunded, late, promoted, instance: inst };
   })();
 }
 
+/**
+ * Staff edit of a single class. Extra capacity before the class starts is
+ * filled from the waitlist, first come first served. Lowering it below the
+ * booked count cancels nobody. Returns { instance, promoted } (promoted = rows).
+ */
+export function updateInstance(db, instanceId, changes, options = {}) {
+  const nowIso = options.now || new Date().toISOString();
+  return db.transaction(() => {
+    const inst = { ...loadInstance(db, instanceId), ...changes };
+    if (!Number.isInteger(inst.capacity) || inst.capacity < 1) {
+      throw new BookingError('bad_capacity', 'Capacity must be a whole number, at least 1');
+    }
+    db.prepare('UPDATE class_instances SET capacity = ?, instructor_id = ?, notes = ? WHERE id = ?')
+      .run(inst.capacity, inst.instructor_id, inst.notes, instanceId);
+    const promoted = [];
+    if (inst.status === 'scheduled' && inst.starts_at > nowIso) {
+      while (bookedCount(db, instanceId) < inst.capacity) {
+        const next = promoteNext(db, inst, nowIso);
+        if (!next) break;
+        promoted.push(next);
+      }
+    }
+    return { instance: inst, promoted };
+  })();
+}
+
 /** Staff roster actions. */
 export function markAttendance(db, bookingId, status) {
   if (!['attended', 'no_show', 'booked'].includes(status)) {
@@ -258,6 +310,7 @@ export function cancelClass(db, instanceId, options = {}) {
     ).all(instanceId);
     for (const b of affected) {
       if (b.status === 'booked') refund(db, b, creditsNeeded);
+      dropDropInDue(db, b.id);
       db.prepare("UPDATE bookings SET status = 'cancelled', cancelled_at = ? WHERE id = ?")
         .run(nowIso, b.id);
     }

package/src/services/notify.js

@@ -0,0 +1,19 @@
+// Emails that more than one route sends.
+import { getSetting } from '../db/index.js';
+import { makeMagicToken } from './auth.js';
+import { emails } from './mailer.js';
+
+/** Tell a client they've come off the waitlist, with a link to manage the booking. */
+export function notifyPromoted(services, req, res, booking, inst) {
+  const { db, mailer } = services;
+  const client = db.prepare('SELECT * FROM clients WHERE id = ?').get(booking.client_id);
+  if (!client) return;
+  const magicUrl = `${services.baseUrl(req)}/me?token=${makeMagicToken(db, client.id)}`;
+  mailer.send({
+    to: client.email,
+    ...emails.waitlistPromotion({
+      studio: getSetting(db, 'studio_name', 'the studio'), clientName: client.name,
+      className: inst.class_name, when: res.locals.fmtDt(inst.starts_at), magicUrl,
+    }),
+  });
+}

package/src/services/stripe.js

@@ -86,6 +86,9 @@ export function fulfillCheckoutSession(db, session) {
   const email = (meta.client_email || session.customer_email
     || (session.customer_details && session.customer_details.email) || '').toLowerCase();
   if (!email) throw new Error('Checkout session has no client email');
+  // Bank debits and other delayed methods complete the session before the money
+  // arrives. checkout.session.async_payment_succeeded brings it back as 'paid'.
+  if (session.payment_status === 'unpaid') return { fulfilled: false, reason: 'awaiting_payment' };
 
   return db.transaction(() => {
     const existing = db.prepare('SELECT id FROM payments WHERE stripe_session_id = ?').get(session.id);
@@ -158,11 +161,45 @@ export function fulfillCheckoutSession(db, session) {
   })();
 }
 
+/**
+ * Record a membership renewal payment. The subscription's first invoice was
+ * already recorded from its Checkout session, so only later cycles count.
+ * Idempotent via payments.stripe_invoice_id.
+ */
+export function recordMembershipRenewal(db, invoice) {
+  if (invoice.billing_reason === 'subscription_create') return { fulfilled: false, reason: 'first_invoice' };
+  // Newer API versions moved this under parent.subscription_details, and a
+  // webhook payload follows the endpoint's API version, so read both.
+  const subscriptionId = (invoice.parent && invoice.parent.subscription_details
+    && invoice.parent.subscription_details.subscription) || invoice.subscription;
+  if (!subscriptionId) return { fulfilled: false, reason: 'not_a_subscription' };
+  if (!invoice.amount_paid) return { fulfilled: false, reason: 'nothing_paid' };
+
+  return db.transaction(() => {
+    const membership = db.prepare('SELECT * FROM memberships WHERE stripe_subscription_id = ?').get(subscriptionId);
+    if (!membership) return { fulfilled: false, reason: 'unknown_subscription' };
+    const existing = db.prepare('SELECT id FROM payments WHERE stripe_invoice_id = ?').get(invoice.id);
+    if (existing) return { fulfilled: false, reason: 'already_processed' };
+
+    const currency = (invoice.currency || getSetting(db, 'currency', 'HKD')).toUpperCase();
+    db.prepare(
+      `INSERT INTO payments (client_id, amount_cents, currency, method, reference, what, status, stripe_invoice_id)
+       VALUES (?, ?, ?, 'stripe', ?, 'membership', 'paid', ?)`
+    ).run(membership.client_id, invoice.amount_paid, currency, membership.plan_name, invoice.id);
+    audit(db, 'stripe-webhook', 'membership_renewed', `membership:${membership.id} invoice:${invoice.id}`);
+    return { fulfilled: true, kind: 'membership_renewal', clientId: membership.client_id };
+  })();
+}
+
 /** Handle a parsed Stripe event. Returns a result object for logging. */
 export function handleStripeEvent(db, event) {
-  if (event.type === 'checkout.session.completed') {
+  if (event.type === 'checkout.session.completed'
+      || event.type === 'checkout.session.async_payment_succeeded') {
     return fulfillCheckoutSession(db, event.data.object);
   }
+  if (event.type === 'invoice.paid') {
+    return recordMembershipRenewal(db, event.data.object);
+  }
   if (event.type === 'customer.subscription.deleted') {
     const sub = event.data.object;
     const r = db.prepare(

package/test/booking-link.test.js

@@ -0,0 +1,47 @@
+// Booking needs only an email, so the page it returns must not hand over the
+// self-service link for whatever address was typed.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import request from 'supertest';
+import { createApp } from '../src/app.js';
+import { testDb, makeClient, makeClassType, makeInstance, csrfToken } from './helpers.js';
+
+function appWith(db, { smtp }) {
+  const sent = [];
+  const mailer = { smtpConfigured: smtp, async send(msg) { sent.push(msg); return true; } };
+  return { app: createApp({ db, mailer, env: {} }), sent };
+}
+
+async function bookAs(app, instanceId, email) {
+  const agent = request.agent(app);
+  const _csrf = await csrfToken(agent, `/class/${instanceId}`);
+  return agent.post(`/class/${instanceId}/book`).type('form').send({ _csrf, email, waiver_agree: '1' });
+}
+
+test('with SMTP on, booking in someone else\'s name does not reveal their link', async () => {
+  const db = testDb();
+  makeClient(db, { email: 'member@test.hk', name: 'Member' });
+  const inst = makeInstance(db, makeClassType(db));
+  const { app, sent } = appWith(db, { smtp: true });
+
+  const res = await bookAs(app, inst, 'member@test.hk');
+
+  assert.equal(res.status, 200);
+  assert.doesNotMatch(res.text, /\/me\?token=/);
+  assert.match(res.text, /on its way/);
+  // The owner of the address still gets their link, by email.
+  assert.equal(sent.length, 1);
+  assert.equal(sent[0].to, 'member@test.hk');
+  assert.match(sent[0].text, /\/me\?token=/);
+});
+
+test('with SMTP off, the link is still shown so the studio works offline', async () => {
+  const db = testDb();
+  const inst = makeInstance(db, makeClassType(db));
+  const { app } = appWith(db, { smtp: false });
+
+  const res = await bookAs(app, inst, 'walkin@test.hk');
+
+  assert.equal(res.status, 200);
+  assert.match(res.text, /\/me\?token=/);
+});

package/test/booking.test.js

@@ -5,7 +5,7 @@ import {
   getPass, getBooking, getMembership,
 } from './helpers.js';
 import {
-  book, cancelBooking, cancelClass, markAttendance, resolvePayment, BookingError,
+  book, cancelBooking, cancelClass, markAttendance, resolvePayment, updateInstance, BookingError,
 } from '../src/services/booking.js';
 
 test('booking deducts a pack credit at booking time, in the same transaction', () => {
@@ -262,6 +262,58 @@ test('cancelling a waitlist booking does not promote or refund', () => {
   assert.equal(res.promoted, null);
 });
 
+test('once a class has started, clients cannot cancel and nobody is promoted into it', () => {
+  const db = testDb();
+  const now = '2026-10-01T10:00:00Z';
+  const inst = makeInstance(db, makeClassType(db, { capacity: 1 }), { now, hoursFromNow: 2 });
+  const c1 = makeClient(db); const c2 = makeClient(db);
+  const waiting = makePass(db, c2, { total: 5 });
+  const { booking } = book(db, c1, inst, { now });
+  const { booking: wl } = book(db, c2, inst, { now });
+  const afterClass = '2026-10-01T13:30:00Z';
+
+  assert.throws(() => cancelBooking(db, booking.id, { now: afterClass }),
+    (e) => e instanceof BookingError && e.code === 'in_past');
+
+  // Staff tidying the roster afterwards still can, without dragging the
+  // waitlist into a class that's over.
+  const res = cancelBooking(db, booking.id, { now: afterClass, allowPast: true });
+  assert.equal(res.promoted, null);
+  assert.equal(getBooking(db, wl.id).status, 'waitlist');
+  assert.equal(getPass(db, waiting).credits_remaining, 5);
+});
+
+test('a pay-at-studio drop-in is owed only while the client holds a spot', () => {
+  const db = testDb();
+  const inst = makeInstance(db, makeClassType(db, { capacity: 1, price: 15000 }), { hoursFromNow: 48 });
+  const c1 = makeClient(db); const c2 = makeClient(db);
+  const dues = () => db.prepare(
+    "SELECT client_id, amount_cents FROM payments WHERE status = 'pending' ORDER BY id"
+  ).all();
+
+  const first = book(db, c1, inst, { recordDue: true });
+  assert.ok(first.paymentId);
+  const waiting = book(db, c2, inst, { recordDue: true });
+  assert.equal(waiting.paymentId, null, 'the waitlist owes nothing yet');
+  assert.deepEqual(dues(), [{ client_id: c1, amount_cents: 15000 }]);
+
+  // c1 cancels in time: their due goes, and c2 owes from the moment they're promoted.
+  cancelBooking(db, first.booking.id);
+  assert.deepEqual(dues(), [{ client_id: c2, amount_cents: 15000 }]);
+
+  // The studio cancelling the class clears it too.
+  cancelClass(db, inst);
+  assert.deepEqual(dues(), []);
+});
+
+test('a late cancel under the forfeit policy still owes the drop-in', () => {
+  const db = testDb();
+  const inst = makeInstance(db, makeClassType(db, { price: 15000 }), { hoursFromNow: 2 });
+  const { booking } = book(db, makeClient(db), inst, { recordDue: true });
+  cancelBooking(db, booking.id);
+  assert.equal(db.prepare("SELECT COUNT(*) c FROM payments WHERE status = 'pending'").get().c, 1);
+});
+
 test('promotion re-resolves payment if the waitlisted client acquired a membership meanwhile', () => {
   const db = testDb();
   const type = makeClassType(db, { capacity: 1 });
@@ -344,3 +396,30 @@ test('capacity race: concurrent-style bookings never exceed capacity (transactio
   assert.equal(booked, 5);
   assert.equal(wait, 15);
 });
+
+test('raising a class capacity fills the new spots from the waitlist, in order', () => {
+  const db = testDb();
+  const now = '2026-10-01T10:00:00Z';
+  const inst = makeInstance(db, makeClassType(db, { capacity: 1 }), { now, hoursFromNow: 24 });
+  const [c1, c2, c3, c4] = [1, 2, 3, 4].map(() => makeClient(db));
+  const passes = [c2, c3, c4].map((c) => makePass(db, c, { total: 5 }));
+  const [, b2, b3, b4] = [c1, c2, c3, c4].map((c) => book(db, c, inst, { now }).booking);
+
+  const res = updateInstance(db, inst, { capacity: 3 }, { now });
+  assert.deepEqual(res.promoted.map((b) => b.id), [b2.id, b3.id]);
+  assert.equal(getPass(db, passes[0]).credits_remaining, 4);
+  assert.equal(getPass(db, passes[1]).credits_remaining, 4);
+  assert.equal(getBooking(db, b4.id).status, 'waitlist');
+  assert.equal(getPass(db, passes[2]).credits_remaining, 5);
+
+  // Shrinking the room cancels nobody.
+  assert.deepEqual(updateInstance(db, inst, { capacity: 1 }, { now }).promoted, []);
+  assert.equal(db.prepare("SELECT COUNT(*) c FROM bookings WHERE status = 'booked'").get().c, 3);
+
+  // Nor does anyone get pulled into a class that has already started.
+  assert.deepEqual(updateInstance(db, inst, { capacity: 10 }, { now: '2026-10-02T11:00:00Z' }).promoted, []);
+  assert.equal(getBooking(db, b4.id).status, 'waitlist');
+
+  assert.throws(() => updateInstance(db, inst, { capacity: 0 }, { now }),
+    (e) => e instanceof BookingError && e.code === 'bad_capacity');
+});

package/test/error-paths.test.js

@@ -0,0 +1,49 @@
+// Requests that used to end in a 500, or in a crashed error page.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import request from 'supertest';
+import { createApp } from '../src/app.js';
+import { createUser } from '../src/services/auth.js';
+import { testDb, csrfToken } from './helpers.js';
+
+function mindbodyClientsCsv(n) {
+  const rows = ['First Name,Last Name,Email,Mobile Phone,Notes,Liability Waiver'];
+  for (let i = 0; i < n; i++) {
+    rows.push(`Client${i},Surname${i},client${i}@example.com,+852 5555 ${String(i).padStart(4, '0')},Prefers a mat by the window,Yes`);
+  }
+  return rows.join('\n');
+}
+
+test('Admin → Import takes a Mindbody export bigger than 100kb', async () => {
+  const db = testDb();
+  createUser(db, { email: 'owner@test.hk', password: 'password123', role: 'owner' });
+  const agent = request.agent(createApp({ db, env: {} }));
+  let _csrf = await csrfToken(agent, '/admin/login');
+  await agent.post('/admin/login').type('form').send({ email: 'owner@test.hk', password: 'password123', _csrf });
+  _csrf = await csrfToken(agent, '/admin/import');
+
+  const csv = mindbodyClientsCsv(1500);
+  assert.ok(csv.length > 100 * 1024);
+  const res = await agent.post('/admin/import').type('form').send({ _csrf, kind: 'clients', csv });
+
+  assert.equal(res.status, 200);
+  assert.equal(db.prepare('SELECT COUNT(*) c FROM clients').get().c, 1500);
+});
+
+test('an oversized body elsewhere gets a 413 page, not a crashed error page', async () => {
+  const db = testDb();
+  const res = await request(createApp({ db, env: {} }))
+    .post('/magic-link').type('form').send({ email: 'x'.repeat(200 * 1024) });
+
+  assert.equal(res.status, 413);
+  assert.match(res.text, /<main class="container">/);
+  assert.doesNotMatch(res.text, /ReferenceError|at Layer/);
+});
+
+test('/me without a token asks for a new link instead of a 500', async () => {
+  const db = testDb();
+  const res = await request(createApp({ db, env: {} })).get('/me');
+
+  assert.equal(res.status, 401);
+  assert.match(res.text, /invalid or has expired/);
+});

package/test/stripe.test.js

@@ -121,6 +121,34 @@ test('replayed webhook is a no-op (idempotent by stripe_session_id)', async () =
   assert.equal(db.prepare('SELECT COUNT(*) c FROM payments').get().c, 1, 'no duplicate payment');
 });
 
+test('a delayed payment is fulfilled when it clears, not when checkout completes', async () => {
+  const { db, app } = makeApp();
+  const productId = db.prepare(
+    "INSERT INTO pack_products (name, credits, price_cents) VALUES ('5 Pack', 5, 55000)"
+  ).run().lastInsertRowid;
+  const session = {
+    id: 'cs_debit',
+    amount_total: 55000,
+    currency: 'hkd',
+    metadata: { kind: 'pack', pack_product_id: String(productId), client_email: 'debit@test.hk' },
+  };
+
+  const completed = await postEvent(app, checkoutCompleted({ ...session, payment_status: 'unpaid' }));
+  assert.equal(completed.status, 200);
+  assert.equal(completed.body.fulfilled, false);
+  assert.equal(completed.body.reason, 'awaiting_payment');
+  assert.equal(db.prepare('SELECT COUNT(*) c FROM passes').get().c, 0, 'no pass before the money arrives');
+  assert.equal(db.prepare('SELECT COUNT(*) c FROM payments').get().c, 0);
+
+  const cleared = await postEvent(app, {
+    type: 'checkout.session.async_payment_succeeded',
+    data: { object: { ...session, payment_status: 'paid' } },
+  });
+  assert.equal(cleared.body.fulfilled, true);
+  assert.equal(db.prepare('SELECT COUNT(*) c FROM passes').get().c, 1);
+  assert.equal(db.prepare("SELECT COUNT(*) c FROM payments WHERE status = 'paid'").get().c, 1);
+});
+
 test('membership checkout fulfillment: activates membership with subscription id', async () => {
   const { db, app } = makeApp();
   const planId = db.prepare(
@@ -148,6 +176,61 @@ test('membership checkout fulfillment: activates membership with subscription id
   assert.equal(payment.status, 'paid');
 });
 
+test('invoice.paid records each membership renewal once, but not the first month again', async () => {
+  const { db, app } = makeApp();
+  const planId = db.prepare(
+    "INSERT INTO membership_plans (name, price_cents, unlimited, stripe_price_id) VALUES ('Unlimited Monthly', 128000, 1, 'price_mock')"
+  ).run().lastInsertRowid;
+  await postEvent(app, checkoutCompleted({
+    id: 'cs_renew', amount_total: 128000, currency: 'hkd', subscription: 'sub_renew',
+    metadata: { kind: 'membership', plan_id: String(planId), client_email: 'renew@test.hk' },
+  }));
+  const invoicePaid = (invoice) => postEvent(app, { type: 'invoice.paid', data: { object: invoice } });
+  const payments = () => db.prepare("SELECT * FROM payments WHERE what = 'membership' ORDER BY id").all();
+
+  // Stripe also sends invoice.paid for the first month, which the Checkout
+  // session already recorded.
+  const first = await invoicePaid({
+    id: 'in_1', billing_reason: 'subscription_create', amount_paid: 128000, currency: 'hkd',
+    parent: { subscription_details: { subscription: 'sub_renew' } },
+  });
+  assert.equal(first.body.fulfilled, false);
+  assert.equal(payments().length, 1);
+
+  const renewal = {
+    id: 'in_2', billing_reason: 'subscription_cycle', amount_paid: 128000, currency: 'hkd',
+    parent: { subscription_details: { subscription: 'sub_renew' } },
+  };
+  const second = await invoicePaid(renewal);
+  assert.equal(second.body.fulfilled, true);
+  assert.equal(second.body.kind, 'membership_renewal');
+  const replay = await invoicePaid(renewal);
+  assert.equal(replay.body.reason, 'already_processed');
+
+  // Endpoints pinned to an older API version put the id at the top level.
+  const legacy = await invoicePaid({
+    id: 'in_3', billing_reason: 'subscription_cycle', amount_paid: 128000, currency: 'hkd',
+    subscription: 'sub_renew',
+  });
+  assert.equal(legacy.body.fulfilled, true);
+
+  const rows = payments();
+  assert.equal(rows.length, 3);
+  assert.deepEqual(rows.map((p) => p.stripe_invoice_id), [null, 'in_2', 'in_3']);
+  assert.ok(rows.every((p) => p.status === 'paid' && p.method === 'stripe' && p.amount_cents === 128000));
+});
+
+test('invoice.paid for a subscription Studio OS never sold is acknowledged and ignored', async () => {
+  const { db, app } = makeApp();
+  const res = await postEvent(app, {
+    type: 'invoice.paid',
+    data: { object: { id: 'in_other', billing_reason: 'subscription_cycle', amount_paid: 5000, subscription: 'sub_elsewhere' } },
+  });
+  assert.equal(res.status, 200);
+  assert.equal(res.body.reason, 'unknown_subscription');
+  assert.equal(db.prepare('SELECT COUNT(*) c FROM payments').get().c, 0);
+});
+
 test('customer.subscription.deleted cancels the matching membership', async () => {
   const { db, app } = makeApp();
   const clientId = db.prepare(
@@ -202,7 +285,7 @@ test('fulfillment failure returns 500 so Stripe retries', async () => {
 
 test('unhandled event types are acknowledged and ignored', async () => {
   const { app } = makeApp();
-  const res = await postEvent(app, { type: 'invoice.paid', data: { object: {} } });
+  const res = await postEvent(app, { type: 'charge.refunded', data: { object: {} } });
   assert.equal(res.status, 200);
   assert.equal(res.body.fulfilled, false);
   assert.match(res.body.reason, /ignored event/);