studio-os 0.4.0 → 0.6.0

package/test/web.test.js

@@ -160,7 +160,43 @@ test('returning client with signed waiver books without checkbox, uses pack cred
   const res = await agent.post(`/class/${inst}/book`).type('form')
     .send({ email: 'returning@test.hk', _csrf });
   assert.equal(res.status, 200);
-  assert.match(res.text, /credit deducted from your class pack/);
+  assert.match(res.text, /1 credit deducted from your class pack/);
+});
+
+test('a two-credit class says two credits came off the pack', async () => {
+  const { db, app } = makeApp();
+  const inst = makeInstance(db, makeClassType(db, { credits: 2 }), { hoursFromNow: 48 });
+  makePass(db, makeClient(db, { email: 'double@test.hk', waiver: true }));
+  const agent = request.agent(app);
+  const _csrf = await csrfToken(agent, `/class/${inst}`);
+  const res = await agent.post(`/class/${inst}/book`).type('form').send({ email: 'double@test.hk', _csrf });
+  assert.match(res.text, /2 credits deducted from your class pack/);
+});
+
+test('a 50kb junk email is turned away without stalling the server', async () => {
+  const { db, app } = makeApp();
+  const inst = makeInstance(db, makeClassType(db), { hoursFromNow: 48 });
+  const agent = request.agent(app);
+  const _csrf = await csrfToken(agent, `/class/${inst}`);
+  const started = Date.now();
+  const res = await agent.post(`/class/${inst}/book`).type('form')
+    .send({ email: `a@${'.'.repeat(50000)}@`, waiver_agree: '1', _csrf });
+  assert.equal(res.status, 400);
+  // The old regex took ~850ms on this; the event loop was blocked throughout.
+  assert.ok(Date.now() - started < 300, `took ${Date.now() - started}ms`);
+});
+
+test("booking with an existing client's email does not rename them", async () => {
+  const { db, app } = makeApp();
+  const inst = makeInstance(db, makeClassType(db), { hoursFromNow: 48 });
+  const clientId = makeClient(db, { name: 'Mei Chan', email: 'mei@test.hk', waiver: true });
+
+  const agent = request.agent(app);
+  const _csrf = await csrfToken(agent, `/class/${inst}`);
+  const res = await agent.post(`/class/${inst}/book`).type('form')
+    .send({ name: 'Someone Else', email: 'mei@test.hk', _csrf });
+  assert.equal(res.status, 200);
+  assert.equal(db.prepare('SELECT name FROM clients WHERE id = ?').get(clientId).name, 'Mei Chan');
 });
 
 test('full class books to waitlist via HTTP', async () => {
@@ -185,6 +221,54 @@ test('full class books to waitlist via HTTP', async () => {
   assert.match(second.text, /You're #2 in line/);
 });
 
+test('drop-in dues: nothing owed on the waitlist, and a cancelled booking owes nothing', async () => {
+  const { db, app } = makeApp();
+  const inst = makeInstance(db, makeClassType(db, { capacity: 1, price: 15000 }), { hoursFromNow: 48 });
+  const agent = request.agent(app);
+  const _csrf = await csrfToken(agent, `/class/${inst}`);
+  for (const email of ['first@t.hk', 'second@t.hk']) {
+    await agent.post(`/class/${inst}/book`).type('form').send({ email, waiver_agree: '1', _csrf });
+  }
+  const owing = () => db.prepare(
+    `SELECT c.email FROM payments p JOIN clients c ON c.id = p.client_id
+     WHERE p.status = 'pending' ORDER BY p.id`
+  ).all().map((r) => r.email);
+  assert.deepEqual(owing(), ['first@t.hk']);
+
+  const { cancelBooking } = await import('../src/services/booking.js');
+  const first = db.prepare("SELECT id FROM bookings WHERE status = 'booked'").get();
+  cancelBooking(db, first.id);
+  assert.deepEqual(owing(), ['second@t.hk']);
+});
+
+test('admin: editing a class from the roster moves the waitlist up and emails them', async () => {
+  const { db, app } = makeApp();
+  const agent = request.agent(app);
+  const _csrf = await adminLogin(agent);
+  const inst = makeInstance(db, makeClassType(db, { capacity: 1 }), { hoursFromNow: 48 });
+  const kim = db.prepare("INSERT INTO instructors (name) VALUES ('Kim')").run().lastInsertRowid;
+  const { book } = await import('../src/services/booking.js');
+  book(db, makeClient(db, { email: 'first@edit.hk' }), inst);
+  const { booking: wl } = book(db, makeClient(db, { email: 'waiting@edit.hk' }), inst);
+
+  const roster = await agent.get(`/admin/instances/${inst}`);
+  assert.match(roster.text, /Edit class/);
+  const res = await agent.post(`/admin/instances/${inst}/edit`).type('form')
+    .send({ capacity: '2', instructor_id: String(kim), notes: 'Room B', _csrf });
+  assert.equal(res.status, 302);
+  const row = db.prepare('SELECT capacity, instructor_id, notes FROM class_instances WHERE id = ?').get(inst);
+  assert.deepEqual({ ...row }, { capacity: 2, instructor_id: kim, notes: 'Room B' });
+  assert.equal(db.prepare('SELECT status FROM bookings WHERE id = ?').get(wl.id).status, 'booked');
+  await new Promise((r) => setTimeout(r, 100));
+  const mails = fs.readdirSync(OUTBOX).map((f) => fs.readFileSync(path.join(OUTBOX, f), 'utf8'));
+  assert.ok(mails.some((m) => m.includes('To: waiting@edit.hk') && m.includes('/me?token=')));
+
+  const bad = await agent.post(`/admin/instances/${inst}/edit`).type('form')
+    .send({ capacity: '2', instructor_id: '999', _csrf });
+  assert.equal(bad.status, 302, 'an unknown instructor is a flash, not a 500');
+  assert.equal(db.prepare('SELECT instructor_id FROM class_instances WHERE id = ?').get(inst).instructor_id, kim);
+});
+
 test('magic link: verify round-trip, view bookings, cancel within policy', async () => {
   const { db, app } = makeApp();
   const type = makeClassType(db, { name: 'Spin' });
@@ -279,6 +363,105 @@ test('admin: rules CRUD generates instances; roster check-in works over HTTP', a
   assert.equal(db.prepare('SELECT status FROM bookings WHERE id=?').get(booking.id).status, 'attended');
 });
 
+test('admin: editing a rule moves its empty classes instead of adding a second slot', async () => {
+  const { db, app } = makeApp();
+  const agent = request.agent(app);
+  const _csrf = await adminLogin(agent);
+  const { book } = await import('../src/services/booking.js');
+  const { localTimeStr } = await import('../src/lib/time.js');
+
+  const type = makeClassType(db, { name: 'Pilates' });
+  await agent.post('/admin/rules').type('form').send({
+    class_type_id: String(type), weekday: '4', start_time: '18:00', _csrf,
+  });
+  const ruleId = db.prepare('SELECT id FROM schedule_rules').get().id;
+  const nowIso = new Date().toISOString();
+  const future = () => db.prepare(
+    'SELECT starts_at FROM class_instances WHERE rule_id = ? AND starts_at > ? ORDER BY starts_at'
+  ).all(ruleId, nowIso).map((ci) => localTimeStr('Asia/Hong_Kong', ci.starts_at));
+  const slots = future().length;
+  const last = db.prepare('SELECT id FROM class_instances WHERE rule_id = ? ORDER BY starts_at DESC').get(ruleId).id;
+  book(db, makeClient(db), last);
+
+  const edit = await agent.post(`/admin/rules/${ruleId}`).type('form').send({
+    class_type_id: String(type), weekday: '4', start_time: '19:00', _csrf,
+  });
+  assert.equal(edit.status, 302);
+  const times = future();
+  assert.equal(times.filter((t) => t === '18:00').length, 1, 'only the booked class stays at the old time');
+  assert.equal(times.filter((t) => t === '19:00').length, slots);
+  assert.match((await agent.get('/admin/rules')).text, /1 booked class\(es\) are still at the old time/);
+
+  const bad = await agent.post(`/admin/rules/${ruleId}`).type('form').send({
+    class_type_id: String(type), weekday: '4', start_time: 'seven', _csrf,
+  });
+  assert.equal(bad.status, 302);
+  assert.equal(db.prepare('SELECT start_time FROM schedule_rules WHERE id = ?').get(ruleId).start_time, '19:00');
+});
+
+test('admin: a class type capacity change reaches upcoming classes still at the old size', async () => {
+  const { db, app } = makeApp();
+  const agent = request.agent(app);
+  const _csrf = await adminLogin(agent);
+  const { book } = await import('../src/services/booking.js');
+  const type = makeClassType(db, { name: 'Barre', capacity: 1 });
+  const booked = makeInstance(db, type, { hoursFromNow: 48 });
+  const handSized = makeInstance(db, type, { hoursFromNow: 72, capacity: 5 });
+  const past = makeInstance(db, type, { hoursFromNow: -24 });
+  const ruleId = db.prepare(
+    "INSERT INTO schedule_rules (class_type_id, weekday, start_time, capacity_override) VALUES (?, 1, '09:00', 1)"
+  ).run(type).lastInsertRowid;
+  const fromRule = makeInstance(db, type, { hoursFromNow: 96 });
+  db.prepare('UPDATE class_instances SET rule_id = ? WHERE id = ?').run(ruleId, fromRule);
+  book(db, makeClient(db, { email: 'first@type.hk' }), booked);
+  const { booking: wl } = book(db, makeClient(db, { email: 'waiting@type.hk' }), booked);
+  const capacity = (id) => db.prepare('SELECT capacity FROM class_instances WHERE id = ?').get(id).capacity;
+
+  const res = await agent.post(`/admin/class-types/${type}`).type('form')
+    .send({ name: 'Barre', capacity: '2', drop_in_price: '150', _csrf });
+  assert.equal(res.status, 302);
+  assert.deepEqual([booked, handSized, past, fromRule].map(capacity), [2, 5, 1, 1]);
+  assert.equal(db.prepare('SELECT status FROM bookings WHERE id = ?').get(wl.id).status, 'booked');
+  assert.match((await agent.get('/admin/class-types')).text, /1 upcoming class\(es\) resized, 1 moved up from the waitlist/);
+  await new Promise((r) => setTimeout(r, 100));
+  const mails = fs.readdirSync(OUTBOX).map((f) => fs.readFileSync(path.join(OUTBOX, f), 'utf8'));
+  assert.ok(mails.some((m) => m.includes('To: waiting@type.hk')));
+
+  const bad = await agent.post(`/admin/class-types/${type}`).type('form')
+    .send({ name: 'Barre', capacity: '-3', _csrf });
+  assert.equal(bad.status, 302);
+  assert.equal(db.prepare('SELECT capacity FROM class_types WHERE id = ?').get(type).capacity, 2);
+});
+
+test('admin: a rule capacity change reaches its booked classes too', async () => {
+  const { db, app } = makeApp();
+  const agent = request.agent(app);
+  const _csrf = await adminLogin(agent);
+  const { book } = await import('../src/services/booking.js');
+  const type = makeClassType(db, { name: 'Reformer', capacity: 1 });
+  await agent.post('/admin/rules').type('form').send({
+    class_type_id: String(type), weekday: '2', start_time: '07:00', _csrf,
+  });
+  const ruleId = db.prepare('SELECT id FROM schedule_rules').get().id;
+  const next = db.prepare('SELECT id FROM class_instances WHERE rule_id = ? ORDER BY starts_at').get(ruleId).id;
+  book(db, makeClient(db, { email: 'first@rule.hk' }), next);
+  const { booking: wl } = book(db, makeClient(db, { email: 'waiting@rule.hk' }), next);
+
+  const res = await agent.post(`/admin/rules/${ruleId}`).type('form').send({
+    class_type_id: String(type), weekday: '2', start_time: '07:00', capacity_override: '3', _csrf,
+  });
+  assert.equal(res.status, 302);
+  const caps = db.prepare('SELECT DISTINCT capacity FROM class_instances WHERE rule_id = ?').pluck().all(ruleId);
+  assert.deepEqual(caps, [3]);
+  assert.equal(db.prepare('SELECT status FROM bookings WHERE id = ?').get(wl.id).status, 'booked');
+
+  const bad = await agent.post(`/admin/rules/${ruleId}`).type('form').send({
+    class_type_id: String(type), weekday: '2', start_time: '07:00', capacity_override: '-1', _csrf,
+  });
+  assert.equal(bad.status, 302, 'a negative override is a flash, not a 500');
+  assert.equal(db.prepare('SELECT capacity_override FROM schedule_rules WHERE id = ?').get(ruleId).capacity_override, 3);
+});
+
 test('admin: manual pass sale + payment, revenue report and CSV export', async () => {
   const { db, app } = makeApp();
   const agent = request.agent(app);

package/views/admin/class_types.ejs

@@ -31,7 +31,7 @@
       <label>Description <input name="description" value="<%= t.description %>"></label>
       <div class="grid">
         <label>Duration <input type="number" name="duration_min" value="<%= t.duration_min %>"></label>
-        <label>Capacity <input type="number" name="capacity" value="<%= t.capacity %>"></label>
+        <label>Capacity <input type="number" name="capacity" value="<%= t.capacity %>" min="1"></label>
         <label>Drop-in price <input type="number" name="drop_in_price" value="<%= (t.drop_in_price_cents / 100).toFixed(2) %>" step="0.01"></label>
         <label>Credits <input type="number" name="credits_required" value="<%= t.credits_required %>"></label>
       </div>

package/views/admin/roster.ejs

@@ -5,6 +5,7 @@
      <% if (inst.instructor_name) { %> · <%= inst.instructor_name %><% } %>
      <% if (inst.status === 'cancelled') { %> · <mark>CANCELLED</mark><% } %></p>
 </hgroup>
+<% if (inst.notes) { %><p><small><%= inst.notes %></small></p><% } %>
 <table>
   <thead><tr><th>Client</th><th>Paid with</th><th>Status</th><th>Actions</th></tr></thead>
   <tbody>
@@ -38,6 +39,24 @@
   <% } %>
   </ol>
 <% } %>
+<% if (inst.status === 'scheduled') { %>
+<details>
+  <summary role="button" class="outline">Edit class</summary>
+  <form method="post" action="/admin/instances/<%= inst.id %>/edit"><input type="hidden" name="_csrf" value="<%= csrfToken %>">
+    <div class="grid">
+      <label>Capacity <input type="number" name="capacity" min="1" required value="<%= inst.capacity %>"></label>
+      <label>Instructor
+        <select name="instructor_id"><option value="">—</option>
+          <% for (const i of instructors) { %><option value="<%= i.id %>" <%= i.id === inst.instructor_id ? 'selected' : '' %>><%= i.name %></option><% } %>
+        </select>
+      </label>
+    </div>
+    <label>Notes <input name="notes" value="<%= inst.notes || '' %>"></label>
+    <small>Extra spots go to the waitlist in order, and they're emailed.</small>
+    <button>Save</button>
+  </form>
+</details>
+<% } %>
 <details>
   <summary role="button" class="outline">Add walk-in</summary>
   <form method="post" action="/admin/instances/<%= inst.id %>/walkin"><input type="hidden" name="_csrf" value="<%= csrfToken %>">

package/views/admin/rules.ejs

@@ -57,7 +57,7 @@
         <label>Start <input name="start_time" value="<%= rule.start_time %>"></label>
       </div>
       <div class="grid">
-        <label>Capacity override <input type="number" name="capacity_override" value="<%= rule.capacity_override || '' %>"></label>
+        <label>Capacity override <input type="number" name="capacity_override" value="<%= rule.capacity_override || '' %>" min="1" placeholder="(class default)"></label>
         <label>Active from <input type="date" name="active_from" value="<%= rule.active_from || '' %>"></label>
         <label>Active until <input type="date" name="active_until" value="<%= rule.active_until || '' %>"></label>
       </div>

package/views/public/book_result.ejs

@@ -8,7 +8,7 @@
     <h2>You're booked!</h2>
     <p><strong><%= inst.class_name %></strong> · <%= fmtDt(inst.starts_at) %></p>
     <p>Payment:
-      <% if (result.booking.paid_with === 'pack') { %>1 credit deducted from your class pack.
+      <% if (result.booking.paid_with === 'pack') { const n = result.instance.credits_required ?? 1; %><%= n %> credit<%= n === 1 ? '' : 's' %> deducted from your class pack.
       <% } else if (result.booking.paid_with === 'membership') { %>covered by your membership.
       <% } else if (result.paymentId) { %>please pay <%= fmtMoney(inst.drop_in_price_cents) %> at the studio (cash/FPS) before class.
       <% } else { %>drop-in.

package/views/public/buy_thanks.ejs

@@ -1,7 +1,7 @@
 <%- include('../partials/head', { adminNav: false }) %>
 <article>
   <h2>Thank you!</h2>
-  <p>Your payment was received. Your pass or membership is now active on your account — just book with the same email.</p>
+  <p>Your pass or membership goes on your account as soon as Stripe confirms the payment. For cards that's usually within a minute. Some bank payments take a few days. Book with the same email you paid with.</p>
   <p><a href="/" role="button">Browse the schedule</a></p>
 </article>
 <%- include('../partials/foot') %>