studio-os 0.4.0 → 0.6.0

package/src/routes/me.js

@@ -1,9 +1,10 @@
 // Client self-service via signed magic links. No passwords.
 import { Router } from 'express';
-import { verifyMagicToken, makeMagicToken } from '../services/auth.js';
+import { verifyMagicToken } from '../services/auth.js';
 import { cancelBooking, BookingError } from '../services/booking.js';
 import { getSetting, audit } from '../db/index.js';
 import { emails } from '../services/mailer.js';
+import { notifyPromoted } from '../services/notify.js';
 
 export default function meRoutes(services) {
   const { db, mailer } = services;
@@ -76,14 +77,7 @@ export default function meRoutes(services) {
         to: client.email,
         ...emails.cancellation({ studio, clientName: client.name, className: inst.class_name, when, refunded: result.refunded }),
       });
-      if (result.promoted) {
-        const promotedClient = db.prepare('SELECT * FROM clients WHERE id = ?').get(result.promoted.client_id);
-        const magicUrl = `${services.baseUrl(req)}/me?token=${makeMagicToken(db, promotedClient.id)}`;
-        mailer.send({
-          to: promotedClient.email,
-          ...emails.waitlistPromotion({ studio, clientName: promotedClient.name, className: inst.class_name, when, magicUrl }),
-        });
-      }
+      if (result.promoted) notifyPromoted(services, req, res, result.promoted, inst);
       req.session.flash = result.refunded
         ? 'Booking cancelled — your credit has been returned.'
         : (result.late ? 'Booking cancelled. This was a late cancellation, so the credit was not returned.' : 'Booking cancelled.');

package/src/routes/public.js

@@ -5,21 +5,18 @@ import { upcomingInstances } from '../services/schedule.js';
 import { book, resolvePayment, BookingError } from '../services/booking.js';
 import { makeMagicToken } from '../services/auth.js';
 import { emails } from '../services/mailer.js';
+import { isEmail } from '../lib/email.js';
 
 function findOrCreateClient(db, name, email) {
   const cleanEmail = String(email || '').trim().toLowerCase();
-  let client = db.prepare('SELECT * FROM clients WHERE email = ?').get(cleanEmail);
-  if (!client) {
-    const info = db.prepare(
-      "INSERT INTO clients (name, email, source) VALUES (?, ?, 'self')"
-    ).run(String(name || cleanEmail.split('@')[0]).trim(), cleanEmail);
-    client = db.prepare('SELECT * FROM clients WHERE id = ?').get(info.lastInsertRowid);
-  } else if (name && name.trim() && client.name !== name.trim()) {
-    // keep the freshest name the client typed
-    db.prepare('UPDATE clients SET name = ? WHERE id = ?').run(name.trim(), client.id);
-    client.name = name.trim();
-  }
-  return client;
+  const client = db.prepare('SELECT * FROM clients WHERE email = ?').get(cleanEmail);
+  // An existing client keeps their name. The form proves nothing about who's
+  // typing, so it can't be allowed to rename whoever owns the address.
+  if (client) return client;
+  const info = db.prepare(
+    "INSERT INTO clients (name, email, source) VALUES (?, ?, 'self')"
+  ).run(String(name || cleanEmail.split('@')[0]).trim(), cleanEmail);
+  return db.prepare('SELECT * FROM clients WHERE id = ?').get(info.lastInsertRowid);
 }
 
 function loadInstanceFull(db, id) {
@@ -77,7 +74,7 @@ export default function publicRoutes(services) {
       error, form: { name, email },
     });
 
-    if (!email || !/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email)) return renderErr('A valid email is required.');
+    if (!isEmail(email)) return renderErr('A valid email is required.');
 
     try {
       const result = db.transaction(() => {
@@ -90,20 +87,10 @@ export default function publicRoutes(services) {
           db.prepare('UPDATE clients SET waiver_signed_at = ? WHERE id = ?')
             .run(new Date().toISOString(), client.id);
         }
-        const booked = book(db, client.id, inst.id);
-        // Drop-in without membership/pack: record the pending manual payment.
-        let payment = null;
-        if (booked.booking.paid_with === 'drop_in_manual' && inst.drop_in_price_cents > 0) {
-          const info = db.prepare(
-            `INSERT INTO payments (client_id, amount_cents, currency, method, reference, what, status)
-             VALUES (?, ?, ?, 'other', ?, 'drop_in', 'pending')`
-          ).run(client.id, inst.drop_in_price_cents, getSetting(db, 'currency', 'HKD'),
-            `Drop-in: ${inst.class_name} ${inst.starts_at}`);
-          payment = info.lastInsertRowid;
-        }
+        const booked = book(db, client.id, inst.id, { recordDue: true });
         audit(db, client.email, booked.waitlisted ? 'waitlist_join' : 'booking_create',
           `instance:${inst.id} booking:${booked.booking.id}`);
-        return { client, ...booked, paymentId: payment };
+        return { client, ...booked };
       })();
 
       const magicUrl = `${services.baseUrl(req)}/me?token=${makeMagicToken(db, result.client.id)}`;
@@ -157,7 +144,7 @@ export default function publicRoutes(services) {
     const product = db.prepare('SELECT * FROM pack_products WHERE id = ? AND active = 1').get(req.params.id);
     if (!product) return res.status(404).render('error', { title: 'Not found', message: 'Pack not found.' });
     const email = String(req.body.email || '').trim().toLowerCase();
-    if (!/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email)) {
+    if (!isEmail(email)) {
       return res.status(400).render('public/buy_manual', { title: 'Buy', product, plan: null, email: null, error: 'A valid email is required.' });
     }
     if (services.stripe.checkoutReady) {
@@ -178,7 +165,7 @@ export default function publicRoutes(services) {
     const plan = db.prepare('SELECT * FROM membership_plans WHERE id = ? AND active = 1').get(req.params.id);
     if (!plan) return res.status(404).render('error', { title: 'Not found', message: 'Plan not found.' });
     const email = String(req.body.email || '').trim().toLowerCase();
-    if (!/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email)) {
+    if (!isEmail(email)) {
       return res.status(400).render('public/buy_manual', { title: 'Buy', product: null, plan, email: null, error: 'A valid email is required.' });
     }
     if (services.stripe.checkoutReady && plan.stripe_price_id) {

package/src/routes/setup.js

@@ -1,6 +1,7 @@
 import { Router } from 'express';
 import { setSetting, getSetting, audit } from '../db/index.js';
 import { createUser } from '../services/auth.js';
+import { isEmail } from '../lib/email.js';
 
 const TIMEZONES = [
   'Asia/Hong_Kong', 'Asia/Singapore', 'Asia/Tokyo', 'Asia/Shanghai', 'Asia/Bangkok',
@@ -21,7 +22,7 @@ export default function setupRoutes({ db }) {
     const fail = (error) => res.status(400).render('setup', { title: 'Setup', timezones: TIMEZONES, error, form });
 
     if (!studio_name || !studio_name.trim()) return fail('Studio name is required.');
-    if (!email || !/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email)) return fail('A valid owner email is required.');
+    if (!isEmail(email)) return fail('A valid owner email is required.');
     if (!password || password.length < 8) return fail('Password must be at least 8 characters.');
     if (password !== password2) return fail('Passwords do not match.');
     try {

package/src/services/booking.js

@@ -118,6 +118,20 @@ function refund(db, booking, creditsNeeded) {
   }
 }
 
+/** A pay-at-studio drop-in is owed once the client holds a spot. */
+function recordDropInDue(db, booking, inst) {
+  if (booking.paid_with !== 'drop_in_manual' || !(inst.drop_in_price_cents > 0)) return null;
+  return db.prepare(
+    `INSERT INTO payments (client_id, amount_cents, currency, method, reference, what, status, booking_id)
+     VALUES (?, ?, ?, 'other', ?, 'drop_in', 'pending', ?)`
+  ).run(booking.client_id, inst.drop_in_price_cents, getSetting(db, 'currency', 'HKD'),
+    `Drop-in: ${inst.class_name} ${inst.starts_at}`, booking.id).lastInsertRowid;
+}
+
+function dropDropInDue(db, bookingId) {
+  db.prepare("DELETE FROM payments WHERE booking_id = ? AND status = 'pending'").run(bookingId);
+}
+
 function loadInstance(db, instanceId) {
   const inst = db.prepare(
     `SELECT ci.*, ct.credits_required, ct.name AS class_name, ct.drop_in_price_cents
@@ -131,8 +145,9 @@ function loadInstance(db, instanceId) {
 /**
  * Book a client into a class instance.
  * options: { paidWith } to force ('drop_in_online'|'drop_in_manual'|'comp'),
- *          { now } ISO override for tests, { allowPast } for admin walk-ins.
- * Returns the booking row plus { waitlisted: bool }.
+ *          { now } ISO override for tests, { allowPast } for admin walk-ins,
+ *          { recordDue } to record a pending payment for a pay-at-studio drop-in.
+ * Returns the booking row plus { waitlisted: bool, paymentId }.
  */
 export function book(db, clientId, instanceId, options = {}) {
   const nowIso = options.now || new Date().toISOString();
@@ -172,7 +187,8 @@ export function book(db, clientId, instanceId, options = {}) {
       status === 'booked' ? resolution.membershipId ?? null : null,
       nowIso);
     const booking = db.prepare('SELECT * FROM bookings WHERE id = ?').get(info.lastInsertRowid);
-    return { booking, waitlisted: full, instance: inst };
+    const paymentId = options.recordDue && !full ? recordDropInDue(db, booking, inst) : null;
+    return { booking, waitlisted: full, instance: inst, paymentId };
   })();
 }
 
@@ -190,12 +206,16 @@ function promoteNext(db, inst, nowIso) {
   db.prepare(
     'UPDATE bookings SET status = ?, paid_with = ?, pass_id = ?, membership_id = ? WHERE id = ?'
   ).run('booked', resolution.paidWith, resolution.passId ?? null, resolution.membershipId ?? null, next.id);
-  return db.prepare('SELECT * FROM bookings WHERE id = ?').get(next.id);
+  const promoted = db.prepare('SELECT * FROM bookings WHERE id = ?').get(next.id);
+  recordDropInDue(db, promoted, inst);
+  return promoted;
 }
 
 /**
  * Cancel a booking. Within the cancellation window → credit refunded; late →
- * per policy (default forfeit). Auto-promotes the first waitlisted booking.
+ * per policy (default forfeit). Auto-promotes the first waitlisted booking
+ * while the class has yet to start. { allowPast } lets staff tidy a roster
+ * after the fact.
  * Returns { booking, refunded, late, promoted } (promoted = booking row or null).
  */
 export function cancelBooking(db, bookingId, options = {}) {
@@ -207,6 +227,8 @@ export function cancelBooking(db, bookingId, options = {}) {
       throw new BookingError('not_cancellable', `Cannot cancel a ${booking.status} booking`);
     }
     const inst = loadInstance(db, booking.class_instance_id);
+    const started = inst.starts_at <= nowIso;
+    if (started && !options.allowPast) throw new BookingError('in_past', 'Class has already started');
     const windowHours = Number(getSetting(db, 'cancellation_window_hours', '12'));
     const policy = getSetting(db, 'late_cancel_policy', 'forfeit');
     const hoursToStart = hoursBetween(nowIso, inst.starts_at);
@@ -214,23 +236,53 @@ export function cancelBooking(db, bookingId, options = {}) {
     const wasBooked = booking.status === 'booked';
     const creditsNeeded = inst.credits_required ?? 1;
 
+    const excused = !late || policy === 'refund' || options.forceRefund;
     let refunded = false;
-    if (wasBooked && (!late || policy === 'refund' || options.forceRefund)) {
+    if (wasBooked && excused) {
       refund(db, booking, creditsNeeded);
       refunded = booking.paid_with === 'pack' || booking.paid_with === 'membership';
     }
+    // A forfeited late cancel still owes its drop-in, as it would lose a credit.
+    if (excused) dropDropInDue(db, bookingId);
     db.prepare("UPDATE bookings SET status = 'cancelled', cancelled_at = ? WHERE id = ?")
       .run(nowIso, bookingId);
 
-    // A freed confirmed spot promotes the first waitlisted booking.
+    // A freed confirmed spot promotes the first waitlisted booking, but not
+    // into a class that's already running: they'd be charged for missing it.
     let promoted = null;
-    if (wasBooked && bookedCount(db, inst.id) < inst.capacity) {
+    if (wasBooked && !started && bookedCount(db, inst.id) < inst.capacity) {
       promoted = promoteNext(db, inst, nowIso);
     }
     return { booking: { ...booking, status: 'cancelled', cancelled_at: nowIso }, refunded, late, promoted, instance: inst };
   })();
 }
 
+/**
+ * Staff edit of a single class. Extra capacity before the class starts is
+ * filled from the waitlist, first come first served. Lowering it below the
+ * booked count cancels nobody. Returns { instance, promoted } (promoted = rows).
+ */
+export function updateInstance(db, instanceId, changes, options = {}) {
+  const nowIso = options.now || new Date().toISOString();
+  return db.transaction(() => {
+    const inst = { ...loadInstance(db, instanceId), ...changes };
+    if (!Number.isInteger(inst.capacity) || inst.capacity < 1) {
+      throw new BookingError('bad_capacity', 'Capacity must be a whole number, at least 1');
+    }
+    db.prepare('UPDATE class_instances SET capacity = ?, instructor_id = ?, notes = ? WHERE id = ?')
+      .run(inst.capacity, inst.instructor_id, inst.notes, instanceId);
+    const promoted = [];
+    if (inst.status === 'scheduled' && inst.starts_at > nowIso) {
+      while (bookedCount(db, instanceId) < inst.capacity) {
+        const next = promoteNext(db, inst, nowIso);
+        if (!next) break;
+        promoted.push(next);
+      }
+    }
+    return { instance: inst, promoted };
+  })();
+}
+
 /** Staff roster actions. */
 export function markAttendance(db, bookingId, status) {
   if (!['attended', 'no_show', 'booked'].includes(status)) {
@@ -258,6 +310,7 @@ export function cancelClass(db, instanceId, options = {}) {
     ).all(instanceId);
     for (const b of affected) {
       if (b.status === 'booked') refund(db, b, creditsNeeded);
+      dropDropInDue(db, b.id);
       db.prepare("UPDATE bookings SET status = 'cancelled', cancelled_at = ? WHERE id = ?")
         .run(nowIso, b.id);
     }

package/src/services/importer.js

@@ -1,6 +1,7 @@
 // Mindbody CSV importer core. Used by scripts/import-mindbody.mjs and the
 // admin import page. Idempotent by client email: re-running updates, never
 // duplicates. No external CSV dependency — small RFC-4180-ish parser below.
+import { isEmail } from '../lib/email.js';
 
 /** Parse CSV text into an array of row objects keyed by header. Handles quoted
  *  fields, embedded commas/newlines, and doubled quotes. */
@@ -96,7 +97,7 @@ export function importClients(db, csvText, { mapping = DEFAULT_MAPPING.clients,
   const work = db.transaction(() => {
     for (const row of rows) {
       const email = pick(row, mapping.email).toLowerCase();
-      if (!email || !/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email)) {
+      if (!isEmail(email)) {
         result.skipped++;
         result.rows.push({ action: 'skip', reason: 'missing/invalid email', row });
         continue;
@@ -148,7 +149,7 @@ export function importPasses(db, csvText, { mapping = DEFAULT_MAPPING.passes, dr
   const work = db.transaction(() => {
     for (const row of rows) {
       const email = pick(row, mapping.email).toLowerCase();
-      if (!email || !/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email)) {
+      if (!isEmail(email)) {
         result.skipped++;
         result.rows.push({ action: 'skip', reason: 'missing/invalid email', row });
         continue;

package/src/services/notify.js

@@ -0,0 +1,19 @@
+// Emails that more than one route sends.
+import { getSetting } from '../db/index.js';
+import { makeMagicToken } from './auth.js';
+import { emails } from './mailer.js';
+
+/** Tell a client they've come off the waitlist, with a link to manage the booking. */
+export function notifyPromoted(services, req, res, booking, inst) {
+  const { db, mailer } = services;
+  const client = db.prepare('SELECT * FROM clients WHERE id = ?').get(booking.client_id);
+  if (!client) return;
+  const magicUrl = `${services.baseUrl(req)}/me?token=${makeMagicToken(db, client.id)}`;
+  mailer.send({
+    to: client.email,
+    ...emails.waitlistPromotion({
+      studio: getSetting(db, 'studio_name', 'the studio'), clientName: client.name,
+      className: inst.class_name, when: res.locals.fmtDt(inst.starts_at), magicUrl,
+    }),
+  });
+}

package/src/services/stripe.js

@@ -67,6 +67,29 @@ export function createStripeService({ env = process.env, client } = {}) {
       });
     },
 
+    /**
+     * Carry a staff status change over to the membership's subscription, so a
+     * cancelled or paused member stops being billed. Pausing voids invoices
+     * rather than deferring them.
+     */
+    async setSubscriptionStatus(subscriptionId, status) {
+      const s = await getClient();
+      if (status !== 'cancelled') {
+        return s.subscriptions.update(subscriptionId, {
+          pause_collection: status === 'paused' ? { behavior: 'void' } : '',
+        });
+      }
+      try {
+        return await s.subscriptions.cancel(subscriptionId);
+      } catch (err) {
+        // Already cancelled at Stripe's end is what we wanted anyway.
+        if (err.code === 'resource_missing') return null;
+        const sub = await s.subscriptions.retrieve(subscriptionId);
+        if (sub.status !== 'canceled') throw err;
+        return sub;
+      }
+    },
+
     /** Verify webhook signature and return the event. Throws on bad signature. */
     async parseWebhook(rawBody, signature) {
       const s = await getClient();
@@ -191,6 +214,31 @@ export function recordMembershipRenewal(db, invoice) {
   })();
 }
 
+// Subscription status → membership status. A failed renewal pauses the
+// membership, so it stops covering classes until the card goes through.
+const MEMBERSHIP_STATUS = {
+  active: 'active', trialing: 'active',
+  past_due: 'paused', unpaid: 'paused', paused: 'paused',
+  canceled: 'cancelled', incomplete_expired: 'cancelled',
+};
+
+/**
+ * Follow a subscription's status onto its membership. Only an actual status
+ * change counts: every renewal fires customer.subscription.updated too, and
+ * those mustn't undo a pause staff set in the app. A cancelled membership
+ * stays cancelled.
+ */
+function followSubscriptionStatus(db, sub, previous) {
+  const status = MEMBERSHIP_STATUS[sub.status];
+  if (!('status' in previous) || !status) return { fulfilled: false, reason: 'no_status_change' };
+  const r = db.prepare(
+    "UPDATE memberships SET status = ? WHERE stripe_subscription_id = ? AND status != 'cancelled'"
+  ).run(status, sub.id);
+  if (!r.changes) return { fulfilled: false, reason: 'unknown_subscription' };
+  audit(db, 'stripe-webhook', 'subscription_status', `${sub.id} ${previous.status} → ${sub.status}`);
+  return { fulfilled: true, kind: 'subscription_status', status };
+}
+
 /** Handle a parsed Stripe event. Returns a result object for logging. */
 export function handleStripeEvent(db, event) {
   if (event.type === 'checkout.session.completed'
@@ -208,5 +256,8 @@ export function handleStripeEvent(db, event) {
     audit(db, 'stripe-webhook', 'subscription_cancelled', sub.id);
     return { fulfilled: r.changes > 0, kind: 'subscription_cancelled' };
   }
+  if (event.type === 'customer.subscription.updated') {
+    return followSubscriptionStatus(db, event.data.object, event.data.previous_attributes || {});
+  }
   return { fulfilled: false, reason: `ignored event ${event.type}` };
 }

package/test/booking.test.js

@@ -5,7 +5,7 @@ import {
   getPass, getBooking, getMembership,
 } from './helpers.js';
 import {
-  book, cancelBooking, cancelClass, markAttendance, resolvePayment, BookingError,
+  book, cancelBooking, cancelClass, markAttendance, resolvePayment, updateInstance, BookingError,
 } from '../src/services/booking.js';
 
 test('booking deducts a pack credit at booking time, in the same transaction', () => {
@@ -262,6 +262,58 @@ test('cancelling a waitlist booking does not promote or refund', () => {
   assert.equal(res.promoted, null);
 });
 
+test('once a class has started, clients cannot cancel and nobody is promoted into it', () => {
+  const db = testDb();
+  const now = '2026-10-01T10:00:00Z';
+  const inst = makeInstance(db, makeClassType(db, { capacity: 1 }), { now, hoursFromNow: 2 });
+  const c1 = makeClient(db); const c2 = makeClient(db);
+  const waiting = makePass(db, c2, { total: 5 });
+  const { booking } = book(db, c1, inst, { now });
+  const { booking: wl } = book(db, c2, inst, { now });
+  const afterClass = '2026-10-01T13:30:00Z';
+
+  assert.throws(() => cancelBooking(db, booking.id, { now: afterClass }),
+    (e) => e instanceof BookingError && e.code === 'in_past');
+
+  // Staff tidying the roster afterwards still can, without dragging the
+  // waitlist into a class that's over.
+  const res = cancelBooking(db, booking.id, { now: afterClass, allowPast: true });
+  assert.equal(res.promoted, null);
+  assert.equal(getBooking(db, wl.id).status, 'waitlist');
+  assert.equal(getPass(db, waiting).credits_remaining, 5);
+});
+
+test('a pay-at-studio drop-in is owed only while the client holds a spot', () => {
+  const db = testDb();
+  const inst = makeInstance(db, makeClassType(db, { capacity: 1, price: 15000 }), { hoursFromNow: 48 });
+  const c1 = makeClient(db); const c2 = makeClient(db);
+  const dues = () => db.prepare(
+    "SELECT client_id, amount_cents FROM payments WHERE status = 'pending' ORDER BY id"
+  ).all();
+
+  const first = book(db, c1, inst, { recordDue: true });
+  assert.ok(first.paymentId);
+  const waiting = book(db, c2, inst, { recordDue: true });
+  assert.equal(waiting.paymentId, null, 'the waitlist owes nothing yet');
+  assert.deepEqual(dues(), [{ client_id: c1, amount_cents: 15000 }]);
+
+  // c1 cancels in time: their due goes, and c2 owes from the moment they're promoted.
+  cancelBooking(db, first.booking.id);
+  assert.deepEqual(dues(), [{ client_id: c2, amount_cents: 15000 }]);
+
+  // The studio cancelling the class clears it too.
+  cancelClass(db, inst);
+  assert.deepEqual(dues(), []);
+});
+
+test('a late cancel under the forfeit policy still owes the drop-in', () => {
+  const db = testDb();
+  const inst = makeInstance(db, makeClassType(db, { price: 15000 }), { hoursFromNow: 2 });
+  const { booking } = book(db, makeClient(db), inst, { recordDue: true });
+  cancelBooking(db, booking.id);
+  assert.equal(db.prepare("SELECT COUNT(*) c FROM payments WHERE status = 'pending'").get().c, 1);
+});
+
 test('promotion re-resolves payment if the waitlisted client acquired a membership meanwhile', () => {
   const db = testDb();
   const type = makeClassType(db, { capacity: 1 });
@@ -344,3 +396,30 @@ test('capacity race: concurrent-style bookings never exceed capacity (transactio
   assert.equal(booked, 5);
   assert.equal(wait, 15);
 });
+
+test('raising a class capacity fills the new spots from the waitlist, in order', () => {
+  const db = testDb();
+  const now = '2026-10-01T10:00:00Z';
+  const inst = makeInstance(db, makeClassType(db, { capacity: 1 }), { now, hoursFromNow: 24 });
+  const [c1, c2, c3, c4] = [1, 2, 3, 4].map(() => makeClient(db));
+  const passes = [c2, c3, c4].map((c) => makePass(db, c, { total: 5 }));
+  const [, b2, b3, b4] = [c1, c2, c3, c4].map((c) => book(db, c, inst, { now }).booking);
+
+  const res = updateInstance(db, inst, { capacity: 3 }, { now });
+  assert.deepEqual(res.promoted.map((b) => b.id), [b2.id, b3.id]);
+  assert.equal(getPass(db, passes[0]).credits_remaining, 4);
+  assert.equal(getPass(db, passes[1]).credits_remaining, 4);
+  assert.equal(getBooking(db, b4.id).status, 'waitlist');
+  assert.equal(getPass(db, passes[2]).credits_remaining, 5);
+
+  // Shrinking the room cancels nobody.
+  assert.deepEqual(updateInstance(db, inst, { capacity: 1 }, { now }).promoted, []);
+  assert.equal(db.prepare("SELECT COUNT(*) c FROM bookings WHERE status = 'booked'").get().c, 3);
+
+  // Nor does anyone get pulled into a class that has already started.
+  assert.deepEqual(updateInstance(db, inst, { capacity: 10 }, { now: '2026-10-02T11:00:00Z' }).promoted, []);
+  assert.equal(getBooking(db, b4.id).status, 'waitlist');
+
+  assert.throws(() => updateInstance(db, inst, { capacity: 0 }, { now }),
+    (e) => e instanceof BookingError && e.code === 'bad_capacity');
+});

package/test/ratelimit.test.js

@@ -121,3 +121,31 @@ test('X-Forwarded-For is ignored unless TRUST_PROXY is set', async () => {
     .set('X-Forwarded-For', '2.2.2.2').send({ email: 'a@t.test', _csrf: csrf2 });
   assert.equal(otherIp.status, 200, 'different forwarded IP has its own bucket');
 });
+
+test('one IPv6 host cannot dodge the limit by rotating addresses', async () => {
+  const { app } = makeApp({ env: { TRUST_PROXY: '1' }, now: () => 10 * WINDOW });
+  const agent = request.agent(app);
+  const _csrf = await csrfToken(agent, '/magic-link');
+  const statuses = [];
+  for (let i = 1; i <= 6; i++) {
+    const res = await agent.post('/magic-link').type('form')
+      .set('X-Forwarded-For', `2001:db8:0:1::${i}`).send({ email: 'a@t.test', _csrf });
+    statuses.push(res.status);
+  }
+  assert.deepEqual(statuses, [200, 200, 200, 200, 200, 429]);
+});
+
+test('every route sits under a 1000 per 15 min ceiling; static files do not count', async () => {
+  let t = 10 * WINDOW;
+  const { app } = makeApp({ now: () => t });
+  const agent = request.agent(app);
+  for (let i = 0; i < 50; i++) assert.equal((await agent.get('/css/custom.css')).status, 200);
+  for (let i = 1; i <= 1000; i++) {
+    const res = await agent.get('/magic-link');
+    if (res.status !== 200) assert.fail(`request ${i} got ${res.status}`);
+  }
+  const blocked = await agent.get('/admin');
+  assert.equal(blocked.status, 429);
+  t += WINDOW;
+  assert.equal((await agent.get('/magic-link')).status, 200);
+});

package/test/stripe.test.js

@@ -8,14 +8,23 @@ import { createStripeService, fulfillCheckoutSession } from '../src/services/str
 import { createMailer } from '../src/services/mailer.js';
 import { createUser } from '../src/services/auth.js';
 import { openDb, setSetting } from '../src/db/index.js';
+import { csrfToken } from './helpers.js';
 
 const VALID_SIG = 't=123,v1=goodsignature';
 
 /** Mock of the stripe npm client: signature check + checkout session capture. */
 function mockStripeClient() {
   const created = [];
-  return {
+  const subscriptionCalls = [];
+  const client = {
     created,
+    subscriptionCalls,
+    failNext: null,
+    subscriptions: {
+      async update(id, params) { return call(['update', id, params]); },
+      async cancel(id) { return call(['cancel', id]); },
+      async retrieve(id) { return { id, status: 'active' }; },
+    },
     checkout: {
       sessions: {
         create: async (params) => {
@@ -32,6 +41,16 @@ function mockStripeClient() {
       },
     },
   };
+  function call(entry) {
+    if (client.failNext) {
+      const err = client.failNext;
+      client.failNext = null;
+      throw err;
+    }
+    subscriptionCalls.push(entry);
+    return { id: entry[1] };
+  }
+  return client;
 }
 
 function makeApp() {
@@ -247,6 +266,76 @@ test('customer.subscription.deleted cancels the matching membership', async () =
   assert.equal(db.prepare('SELECT status FROM memberships WHERE client_id = ?').get(clientId).status, 'cancelled');
 });
 
+function membershipWithSub(db, subId, status = 'active') {
+  const clientId = db.prepare(
+    "INSERT INTO clients (name, email, source) VALUES ('M', ?, 'self')"
+  ).run(`${subId}@test.hk`).lastInsertRowid;
+  const id = db.prepare(
+    `INSERT INTO memberships (client_id, plan_name, status, started_on, stripe_subscription_id, unlimited)
+     VALUES (?, 'Unlimited', ?, '2026-07-01', ?, 1)`
+  ).run(clientId, status, subId).lastInsertRowid;
+  return { clientId, id, status: () => db.prepare('SELECT status FROM memberships WHERE id = ?').get(id).status };
+}
+
+test('a failed renewal pauses the membership until the card goes through', async () => {
+  const { db, app } = makeApp();
+  const m = membershipWithSub(db, 'sub_dunning');
+  const updated = (status, previous) => postEvent(app, {
+    type: 'customer.subscription.updated',
+    data: { object: { id: 'sub_dunning', status }, previous_attributes: previous },
+  });
+
+  await updated('past_due', { status: 'active' });
+  assert.equal(m.status(), 'paused');
+  await updated('active', { status: 'past_due' });
+  assert.equal(m.status(), 'active');
+
+  // A renewal also fires .updated, without a status change. It must not
+  // undo a pause staff set in the app.
+  db.prepare("UPDATE memberships SET status = 'paused' WHERE id = ?").run(m.id);
+  const renewal = await updated('active', { current_period_end: 1790000000 });
+  assert.equal(renewal.body.reason, 'no_status_change');
+  assert.equal(m.status(), 'paused');
+
+  db.prepare("UPDATE memberships SET status = 'cancelled' WHERE id = ?").run(m.id);
+  await updated('active', { status: 'past_due' });
+  assert.equal(m.status(), 'cancelled', 'a cancelled membership stays cancelled');
+});
+
+test('staff pausing, resuming or cancelling a Stripe membership changes the subscription too', async () => {
+  const { db, app, client } = makeApp();
+  const m = membershipWithSub(db, 'sub_staff');
+  const agent = request.agent(app);
+  let _csrf = await csrfToken(agent, '/admin/login');
+  await agent.post('/admin/login').type('form').send({ email: 'owner@test.test', password: 'password123', _csrf });
+  _csrf = await csrfToken(agent, `/admin/clients/${m.clientId}`);
+  const setStatus = (status) => agent.post(`/admin/clients/${m.clientId}/memberships`).type('form')
+    .send({ action: 'status', membership_id: String(m.id), status, _csrf });
+
+  await setStatus('paused');
+  assert.equal(m.status(), 'paused');
+  await setStatus('active');
+  assert.equal(m.status(), 'active');
+  assert.deepEqual(client.subscriptionCalls, [
+    ['update', 'sub_staff', { pause_collection: { behavior: 'void' } }],
+    ['update', 'sub_staff', { pause_collection: '' }],
+  ]);
+
+  // Stripe saying no leaves the membership as it was.
+  client.failNext = Object.assign(new Error('card_declined'), { code: 'card_declined' });
+  const refused = await setStatus('paused');
+  assert.equal(refused.status, 302);
+  assert.equal(m.status(), 'active');
+
+  const bogus = await setStatus('frozen');
+  assert.equal(bogus.status, 302, 'an unknown status is a flash, not a 500');
+  assert.equal(m.status(), 'active');
+
+  await setStatus('cancelled');
+  assert.equal(m.status(), 'cancelled');
+  assert.deepEqual(client.subscriptionCalls.at(-1), ['cancel', 'sub_staff']);
+});
+
 test('drop-in checkout marks the pending payment paid', async () => {
   const { db, app } = makeApp();
   const clientId = db.prepare(