studio-os 0.4.0 → 0.6.0

package/CHANGELOG.md

@@ -1,5 +1,69 @@
 # Changelog
 
+## 0.6.0 — 2026-09-27
+
+**Upgrading:** in the Stripe dashboard, add `customer.subscription.updated`
+to your webhook endpoint's events. Without it, failed renewals still won't
+pause memberships. No database changes.
+
+- **A failed renewal left the membership active.** When a card was declined
+  the subscription went past due, but the client kept booking on it. The
+  membership now pauses until the payment goes through, and resumes by
+  itself when it does.
+- **Pausing or cancelling a Stripe membership didn't stop the billing.**
+  The buttons on the client page only changed the app's record. They now
+  pause, resume or cancel the subscription itself, and if Stripe says no,
+  nothing changes. An unrecognised status used to 500.
+- **Capacity changes skipped classes already on the schedule.** Raising a
+  class type's capacity, or a rule's override, left every class already
+  generated at the old size. Upcoming classes still at that size now follow,
+  and the extra spots go to the waitlist, same as editing one class.
+  Classes resized by hand keep their own number.
+- **Rate limiting on every route.** Magic links, login and booking already
+  had tight limits. Everything else now sits under a 1000 requests per
+  15 minutes ceiling per address, well above what a busy front desk uses.
+  IPv6 clients are counted per /56, so rotating addresses no longer gets
+  around any limit.
+- **A long junk email could stall the server.** The email check backtracked
+  on a 50kb input for about a second, blocking every other request. It's
+  linear now.
+- **Dependencies**: express-rate-limit 8.7.0 added.
+- **Tests**: 144 → 151.
+
+## 0.5.0 — 2026-09-27
+
+**Upgrading:** the database migrates itself on start (schema v4, one new
+column on `payments`). Drop-in dues recorded before the upgrade aren't linked
+to a booking, so they won't clear themselves if that booking is cancelled.
+Check the dashboard's Pending payments for stale ones.
+
+- **Editing a weekly rule moved nothing and doubled the schedule.** Changing
+  a rule's day or time left every future class at the old slot and then
+  generated a second set at the new one. Empty future classes now move with
+  the rule, and booked ones stay put with a note saying how many. A malformed
+  time used to save, 500, and then break the daily generator for every rule.
+  It's rejected now.
+- **Drop-in dues were charged to people who never got a spot.** Booking
+  onto the waitlist recorded a pending drop-in payment, and cancelling never
+  removed one. Dues are now tied to the booking: recorded when the client
+  holds a spot (including when the waitlist promotes them), dropped when
+  they cancel in time or the studio cancels the class. A forfeited late
+  cancel still owes, same as it would lose a pack credit.
+- **The waitlist got promoted into classes that had already started.** A
+  late cancel or a staff roster edit after start time moved the next person
+  in and charged them for a class they'd missed. Clients also can't cancel
+  once a class has started. Staff still can, to tidy the roster.
+- **The booking form renamed existing clients.** Anyone who typed a known
+  email with a different name overwrote that client's name. An existing
+  client now keeps theirs.
+- **Edit a single class.** The roster page can change one class's capacity,
+  instructor and notes. Extra capacity goes to the waitlist in order, and
+  those clients are emailed.
+- A two-credit class said "1 credit deducted". The purchase thank-you page
+  said the pass was active before Stripe had confirmed the payment.
+- **Dependencies**: dotenv → 18.0.3, marked → 18.0.14, supertest → 7.3.0.
+- **Tests**: 135 → 144.
+
 ## 0.4.0 — 2026-09-27
 
 **Upgrading with Stripe:** add `checkout.session.async_payment_succeeded` and

package/README.md

@@ -136,9 +136,12 @@ activate purchases manually from the client profile — fully usable cash-only.
    - `STRIPE_WEBHOOK_SECRET` — see step 3
 3. Add a webhook endpoint in Stripe: `https://your-domain/webhooks/stripe`,
    events `checkout.session.completed`, `checkout.session.async_payment_succeeded`,
-   `invoice.paid` and `customer.subscription.deleted`. The async event is what
-   fulfils payments that clear later, like bank debits; card-only studios never
-   see it. `invoice.paid` records each membership renewal in the revenue report.
+   `invoice.paid`, `customer.subscription.updated` and
+   `customer.subscription.deleted`. The async event is what fulfils payments
+   that clear later, like bank debits; card-only studios never see it.
+   `invoice.paid` records each membership renewal in the revenue report, and
+   `customer.subscription.updated` pauses a membership whose renewal failed
+   until the card goes through.
    Copy the signing secret into `STRIPE_WEBHOOK_SECRET`.
    (Local testing: `stripe listen --forward-to localhost:3000/webhooks/stripe`.)
    The webhook secret is not optional: online payment stays off until it is
@@ -170,7 +173,9 @@ What's protected out of the box:
   authenticated by Stripe's signature over the raw body instead.
 - **Rate limiting** (in-memory fixed window, per IP + route): magic-link
   requests 5/15 min, admin login 10/15 min, public booking/buy POSTs
-  30/15 min. Over the limit → friendly 429. Behind a reverse proxy, set
+  30/15 min, and 1000/15 min across the whole app. IPv6 clients are
+  counted per /56, so rotating addresses doesn't reset the count. Over the
+  limit → friendly 429. Behind a reverse proxy, set
   `TRUST_PROXY=1` so limits key on the first `X-Forwarded-For` hop; without
   it that header is ignored (it's spoofable).
 - **Reverse-proxy awareness**: `TRUST_PROXY=1` also makes the app honour

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "studio-os",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "Self-hosted studio management: booking, class packs, memberships. Bring your own Stripe.",
   "license": "MIT",
   "type": "module",
@@ -19,15 +19,16 @@
     "bcryptjs": "^3.0.3",
     "better-sqlite3": "^13.0.1",
     "cookie-session": "^2.1.0",
-    "dotenv": "^18.0.2",
+    "dotenv": "^18.0.3",
     "ejs": "^6.0.1",
     "express": "^5.2.1",
-    "marked": "^18.0.9",
-    "nodemailer": "^10.0.9",
+    "express-rate-limit": "^8.7.0",
+    "marked": "^18.0.14",
+    "nodemailer": "^10.0.10",
     "stripe": "^22.6.2"
   },
   "devDependencies": {
-    "supertest": "^7.0.0"
+    "supertest": "^7.3.0"
   },
   "repository": {
     "type": "git",

package/src/app.js

@@ -58,6 +58,12 @@ export function createApp({ db, mailer, stripeService, env = process.env, now =
   app.use('/admin/import', express.urlencoded({ extended: true, limit: '20mb' }));
   app.use(express.urlencoded({ extended: true }));
   app.use(express.static(path.join(__dirname, '..', 'public')));
+  // A ceiling on everything else, well above what a busy front desk or a
+  // shared studio wifi does. Static files don't count, and the Stripe
+  // webhook is mounted before this so a burst of events is never refused.
+  app.use(createRateLimiter({
+    windowMs: 15 * 60 * 1000, max: 1000, env, now, perRoute: false,
+  }));
   app.use(cookieSession({
     name: 'studio_session',
     keys: [getSetting(db, 'app_secret', 'dev-secret')],

package/src/db/004-payment-booking.sql

@@ -0,0 +1,5 @@
+-- v4: a drop-in paid at the studio is only owed while its booking stands, so
+-- the pending payment remembers which booking it's for.
+
+ALTER TABLE payments ADD COLUMN booking_id INTEGER REFERENCES bookings(id);
+CREATE INDEX IF NOT EXISTS idx_payments_booking ON payments(booking_id) WHERE booking_id IS NOT NULL;

package/src/db/index.js

@@ -10,6 +10,7 @@ const MIGRATIONS = [
   { version: 1, file: 'schema.sql' },
   { version: 2, file: '002-instructor-role.sql' },
   { version: 3, file: '003-stripe-invoices.sql' },
+  { version: 4, file: '004-payment-booking.sql' },
 ];
 
 const DEFAULT_SETTINGS = {

package/src/lib/email.js

@@ -0,0 +1,5 @@
+// Linear time on purpose. The old pattern let the domain overlap the dot and
+// backtracked quadratically: one 50kb POST held the event loop for ~1s.
+export function isEmail(s) {
+  return typeof s === 'string' && s.length <= 254 && /^[^@\s]+@[^@\s.]+(\.[^@\s.]+)+$/.test(s);
+}

package/src/lib/ratelimit.js

@@ -1,4 +1,4 @@
-// Tiny in-memory fixed-window rate limiter. No dependencies.
+// In-memory fixed-window rate limiting on top of express-rate-limit.
 //
 // Deliberately simple and honest about its limits: counters live in this
 // process's memory, so they reset on restart and are per-process (a
@@ -6,6 +6,7 @@
 // proxy, set TRUST_PROXY=1 so the client IP is read from the first
 // X-Forwarded-For hop; without it the header is ignored (spoofable) and the
 // socket address is used.
+import rateLimit, { ipKeyGenerator } from 'express-rate-limit';
 
 export function clientIp(req, env = process.env) {
   if (env.TRUST_PROXY) {
@@ -15,36 +16,76 @@ export function clientIp(req, env = process.env) {
   return (req.socket && req.socket.remoteAddress) || 'unknown';
 }
 
-/**
- * createRateLimiter({ windowMs, max, env?, now?, message? }) → Express middleware.
- * Fixed window keyed on client IP + matched route pattern (so /class/1/book
- * and /class/2/book share one bucket). `now` is injectable for tests.
- */
-export function createRateLimiter({ windowMs, max, env = process.env, now = Date.now, message } = {}) {
-  const buckets = new Map(); // key → { window, count }
-  const mw = (req, res, next) => {
-    const windowId = Math.floor(now() / windowMs);
-    const route = (req.route && req.route.path) || req.path;
-    const key = `${clientIp(req, env)}|${req.method} ${route}`;
-    let b = buckets.get(key);
+/** Fixed windows on an injectable clock, so tests can move time. */
+class FixedWindowStore {
+  constructor(now) {
+    this.now = now;
+    this.buckets = new Map(); // key → { window, count }
+    this.localKeys = true;
+  }
+
+  init({ windowMs }) {
+    this.windowMs = windowMs;
+  }
+
+  increment(key) {
+    const windowId = Math.floor(this.now() / this.windowMs);
+    let b = this.buckets.get(key);
     if (!b || b.window !== windowId) {
       b = { window: windowId, count: 0 };
-      buckets.set(key, b);
+      this.buckets.set(key, b);
     }
     b.count += 1;
-    if (b.count > max) {
+    // opportunistic cleanup so the map cannot grow without bound
+    if (this.buckets.size > 10000) {
+      for (const [k, v] of this.buckets) if (v.window !== windowId) this.buckets.delete(k);
+    }
+    return { totalHits: b.count, resetTime: new Date((windowId + 1) * this.windowMs) };
+  }
+
+  decrement(key) {
+    const b = this.buckets.get(key);
+    if (b && b.count > 0) b.count -= 1;
+  }
+
+  resetKey(key) {
+    this.buckets.delete(key);
+  }
+}
+
+/**
+ * createRateLimiter({ windowMs, max, env?, now?, message?, perRoute? }) → Express middleware.
+ * Keyed on client IP (IPv6 by /56, so one host can't rotate addresses) plus,
+ * unless perRoute is false, the matched route pattern (so /class/1/book and
+ * /class/2/book share one bucket). `now` is injectable for tests.
+ */
+export function createRateLimiter({
+  windowMs, max, env = process.env, now = Date.now, message, perRoute = true,
+} = {}) {
+  const store = new FixedWindowStore(now);
+  const mw = rateLimit({
+    windowMs,
+    limit: max,
+    store,
+    standardHeaders: false,
+    legacyHeaders: false,
+    // clientIp() does its own proxy handling; the library's checks assume req.ip.
+    validate: false,
+    keyGenerator(req) {
+      const ip = ipKeyGenerator(clientIp(req, env));
+      if (!perRoute) return ip;
+      return `${ip}|${req.method} ${(req.route && req.route.path) || req.path}`;
+    },
+    handler(req, res) {
+      // The app-wide limiter runs before the view locals exist.
+      res.locals = { settings: {}, user: null, flash: null, ...res.locals };
       res.set('Retry-After', String(Math.ceil(windowMs / 1000)));
-      return res.status(429).render('error', {
+      res.status(429).render('error', {
         title: 'Too many requests',
         message: message || 'Too many requests from your address — please wait a few minutes and try again.',
       });
-    }
-    // opportunistic cleanup so the map cannot grow without bound
-    if (buckets.size > 10000) {
-      for (const [k, v] of buckets) if (v.window !== windowId) buckets.delete(k);
-    }
-    next();
-  };
-  mw.buckets = buckets; // exposed for tests/inspection
+    },
+  });
+  mw.buckets = store.buckets; // exposed for tests/inspection
   return mw;
 }