studio-os 0.5.0 → 0.6.0

package/CHANGELOG.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## 0.6.0 — 2026-09-27
+
+**Upgrading:** in the Stripe dashboard, add `customer.subscription.updated`
+to your webhook endpoint's events. Without it, failed renewals still won't
+pause memberships. No database changes.
+
+- **A failed renewal left the membership active.** When a card was declined
+  the subscription went past due, but the client kept booking on it. The
+  membership now pauses until the payment goes through, and resumes by
+  itself when it does.
+- **Pausing or cancelling a Stripe membership didn't stop the billing.**
+  The buttons on the client page only changed the app's record. They now
+  pause, resume or cancel the subscription itself, and if Stripe says no,
+  nothing changes. An unrecognised status used to 500.
+- **Capacity changes skipped classes already on the schedule.** Raising a
+  class type's capacity, or a rule's override, left every class already
+  generated at the old size. Upcoming classes still at that size now follow,
+  and the extra spots go to the waitlist, same as editing one class.
+  Classes resized by hand keep their own number.
+- **Rate limiting on every route.** Magic links, login and booking already
+  had tight limits. Everything else now sits under a 1000 requests per
+  15 minutes ceiling per address, well above what a busy front desk uses.
+  IPv6 clients are counted per /56, so rotating addresses no longer gets
+  around any limit.
+- **A long junk email could stall the server.** The email check backtracked
+  on a 50kb input for about a second, blocking every other request. It's
+  linear now.
+- **Dependencies**: express-rate-limit 8.7.0 added.
+- **Tests**: 144 → 151.
+
 ## 0.5.0 — 2026-09-27
 
 **Upgrading:** the database migrates itself on start (schema v4, one new

package/README.md

@@ -136,9 +136,12 @@ activate purchases manually from the client profile — fully usable cash-only.
    - `STRIPE_WEBHOOK_SECRET` — see step 3
 3. Add a webhook endpoint in Stripe: `https://your-domain/webhooks/stripe`,
    events `checkout.session.completed`, `checkout.session.async_payment_succeeded`,
-   `invoice.paid` and `customer.subscription.deleted`. The async event is what
-   fulfils payments that clear later, like bank debits; card-only studios never
-   see it. `invoice.paid` records each membership renewal in the revenue report.
+   `invoice.paid`, `customer.subscription.updated` and
+   `customer.subscription.deleted`. The async event is what fulfils payments
+   that clear later, like bank debits; card-only studios never see it.
+   `invoice.paid` records each membership renewal in the revenue report, and
+   `customer.subscription.updated` pauses a membership whose renewal failed
+   until the card goes through.
    Copy the signing secret into `STRIPE_WEBHOOK_SECRET`.
    (Local testing: `stripe listen --forward-to localhost:3000/webhooks/stripe`.)
    The webhook secret is not optional: online payment stays off until it is
@@ -170,7 +173,9 @@ What's protected out of the box:
   authenticated by Stripe's signature over the raw body instead.
 - **Rate limiting** (in-memory fixed window, per IP + route): magic-link
   requests 5/15 min, admin login 10/15 min, public booking/buy POSTs
-  30/15 min. Over the limit → friendly 429. Behind a reverse proxy, set
+  30/15 min, and 1000/15 min across the whole app. IPv6 clients are
+  counted per /56, so rotating addresses doesn't reset the count. Over the
+  limit → friendly 429. Behind a reverse proxy, set
   `TRUST_PROXY=1` so limits key on the first `X-Forwarded-For` hop; without
   it that header is ignored (it's spoofable).
 - **Reverse-proxy awareness**: `TRUST_PROXY=1` also makes the app honour

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "studio-os",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Self-hosted studio management: booking, class packs, memberships. Bring your own Stripe.",
   "license": "MIT",
   "type": "module",
@@ -22,6 +22,7 @@
     "dotenv": "^18.0.3",
     "ejs": "^6.0.1",
     "express": "^5.2.1",
+    "express-rate-limit": "^8.7.0",
     "marked": "^18.0.14",
     "nodemailer": "^10.0.10",
     "stripe": "^22.6.2"

package/src/app.js

@@ -58,6 +58,12 @@ export function createApp({ db, mailer, stripeService, env = process.env, now =
   app.use('/admin/import', express.urlencoded({ extended: true, limit: '20mb' }));
   app.use(express.urlencoded({ extended: true }));
   app.use(express.static(path.join(__dirname, '..', 'public')));
+  // A ceiling on everything else, well above what a busy front desk or a
+  // shared studio wifi does. Static files don't count, and the Stripe
+  // webhook is mounted before this so a burst of events is never refused.
+  app.use(createRateLimiter({
+    windowMs: 15 * 60 * 1000, max: 1000, env, now, perRoute: false,
+  }));
   app.use(cookieSession({
     name: 'studio_session',
     keys: [getSetting(db, 'app_secret', 'dev-secret')],

package/src/lib/email.js

@@ -0,0 +1,5 @@
+// Linear time on purpose. The old pattern let the domain overlap the dot and
+// backtracked quadratically: one 50kb POST held the event loop for ~1s.
+export function isEmail(s) {
+  return typeof s === 'string' && s.length <= 254 && /^[^@\s]+@[^@\s.]+(\.[^@\s.]+)+$/.test(s);
+}

package/src/lib/ratelimit.js

@@ -1,4 +1,4 @@
-// Tiny in-memory fixed-window rate limiter. No dependencies.
+// In-memory fixed-window rate limiting on top of express-rate-limit.
 //
 // Deliberately simple and honest about its limits: counters live in this
 // process's memory, so they reset on restart and are per-process (a
@@ -6,6 +6,7 @@
 // proxy, set TRUST_PROXY=1 so the client IP is read from the first
 // X-Forwarded-For hop; without it the header is ignored (spoofable) and the
 // socket address is used.
+import rateLimit, { ipKeyGenerator } from 'express-rate-limit';
 
 export function clientIp(req, env = process.env) {
   if (env.TRUST_PROXY) {
@@ -15,36 +16,76 @@ export function clientIp(req, env = process.env) {
   return (req.socket && req.socket.remoteAddress) || 'unknown';
 }
 
-/**
- * createRateLimiter({ windowMs, max, env?, now?, message? }) → Express middleware.
- * Fixed window keyed on client IP + matched route pattern (so /class/1/book
- * and /class/2/book share one bucket). `now` is injectable for tests.
- */
-export function createRateLimiter({ windowMs, max, env = process.env, now = Date.now, message } = {}) {
-  const buckets = new Map(); // key → { window, count }
-  const mw = (req, res, next) => {
-    const windowId = Math.floor(now() / windowMs);
-    const route = (req.route && req.route.path) || req.path;
-    const key = `${clientIp(req, env)}|${req.method} ${route}`;
-    let b = buckets.get(key);
+/** Fixed windows on an injectable clock, so tests can move time. */
+class FixedWindowStore {
+  constructor(now) {
+    this.now = now;
+    this.buckets = new Map(); // key → { window, count }
+    this.localKeys = true;
+  }
+
+  init({ windowMs }) {
+    this.windowMs = windowMs;
+  }
+
+  increment(key) {
+    const windowId = Math.floor(this.now() / this.windowMs);
+    let b = this.buckets.get(key);
     if (!b || b.window !== windowId) {
       b = { window: windowId, count: 0 };
-      buckets.set(key, b);
+      this.buckets.set(key, b);
     }
     b.count += 1;
-    if (b.count > max) {
+    // opportunistic cleanup so the map cannot grow without bound
+    if (this.buckets.size > 10000) {
+      for (const [k, v] of this.buckets) if (v.window !== windowId) this.buckets.delete(k);
+    }
+    return { totalHits: b.count, resetTime: new Date((windowId + 1) * this.windowMs) };
+  }
+
+  decrement(key) {
+    const b = this.buckets.get(key);
+    if (b && b.count > 0) b.count -= 1;
+  }
+
+  resetKey(key) {
+    this.buckets.delete(key);
+  }
+}
+
+/**
+ * createRateLimiter({ windowMs, max, env?, now?, message?, perRoute? }) → Express middleware.
+ * Keyed on client IP (IPv6 by /56, so one host can't rotate addresses) plus,
+ * unless perRoute is false, the matched route pattern (so /class/1/book and
+ * /class/2/book share one bucket). `now` is injectable for tests.
+ */
+export function createRateLimiter({
+  windowMs, max, env = process.env, now = Date.now, message, perRoute = true,
+} = {}) {
+  const store = new FixedWindowStore(now);
+  const mw = rateLimit({
+    windowMs,
+    limit: max,
+    store,
+    standardHeaders: false,
+    legacyHeaders: false,
+    // clientIp() does its own proxy handling; the library's checks assume req.ip.
+    validate: false,
+    keyGenerator(req) {
+      const ip = ipKeyGenerator(clientIp(req, env));
+      if (!perRoute) return ip;
+      return `${ip}|${req.method} ${(req.route && req.route.path) || req.path}`;
+    },
+    handler(req, res) {
+      // The app-wide limiter runs before the view locals exist.
+      res.locals = { settings: {}, user: null, flash: null, ...res.locals };
       res.set('Retry-After', String(Math.ceil(windowMs / 1000)));
-      return res.status(429).render('error', {
+      res.status(429).render('error', {
         title: 'Too many requests',
         message: message || 'Too many requests from your address — please wait a few minutes and try again.',
       });
-    }
-    // opportunistic cleanup so the map cannot grow without bound
-    if (buckets.size > 10000) {
-      for (const [k, v] of buckets) if (v.window !== windowId) buckets.delete(k);
-    }
-    next();
-  };
-  mw.buckets = buckets; // exposed for tests/inspection
+    },
+  });
+  mw.buckets = store.buckets; // exposed for tests/inspection
   return mw;
 }

package/src/routes/admin.js

@@ -12,9 +12,10 @@ import { importClients, importPasses } from '../services/importer.js';
 import { emails } from '../services/mailer.js';
 import { notifyPromoted } from '../services/notify.js';
 import { localDateStr, localTimeStr, zonedToUtc, addDays, weekdayOf } from '../lib/time.js';
+import { isEmail } from '../lib/email.js';
 
 export default function adminRoutes(services) {
-  const { db, mailer } = services;
+  const { db, mailer, stripe } = services;
   const r = Router();
   r.use(requireAdmin);
 
@@ -75,16 +76,46 @@ export default function adminRoutes(services) {
     res.redirect('/admin/class-types');
   });
 
+  // Future classes still at the old size follow a capacity change, and anyone
+  // who moves up from the waitlist is emailed. A class resized by hand on its
+  // roster keeps its own number.
+  function resizeFuture(req, res, instanceIds, capacity) {
+    const results = db.transaction(() => instanceIds.map((id) => updateInstance(db, id, { capacity })))();
+    let promoted = 0;
+    for (const { instance, promoted: rows } of results) {
+      for (const p of rows) notifyPromoted(services, req, res, p, instance);
+      promoted += rows.length;
+    }
+    return promoted;
+  }
+  const resizedNote = (count, promoted) => (count
+    ? ` ${count} upcoming class(es) resized${promoted ? `, ${promoted} moved up from the waitlist and emailed` : ''}.`
+    : '');
+
   r.post('/class-types/:id', (req, res) => {
     const b = req.body;
     if (b.action === 'toggle') {
       db.prepare('UPDATE class_types SET active = 1 - active WHERE id = ?').run(req.params.id);
     } else {
+      const capacity = Number(b.capacity || 10);
+      if (!Number.isInteger(capacity) || capacity < 1) {
+        req.session.flash = 'Capacity must be a whole number, at least 1.';
+        return res.redirect('/admin/class-types');
+      }
+      const type = db.prepare('SELECT capacity FROM class_types WHERE id = ?').get(req.params.id);
+      if (!type) return res.redirect('/admin/class-types');
       db.prepare(
         'UPDATE class_types SET name=?, description=?, duration_min=?, capacity=?, drop_in_price_cents=?, credits_required=?, color=? WHERE id=?'
-      ).run(b.name, b.description || '', Number(b.duration_min) || 60, Number(b.capacity) || 10,
+      ).run(b.name, b.description || '', Number(b.duration_min) || 60, capacity,
         Math.round(Number(b.drop_in_price || 0) * 100), Number(b.credits_required) || 1,
         b.color || '#4f7cac', req.params.id);
+      const ids = capacity === type.capacity ? [] : db.prepare(
+        `SELECT ci.id FROM class_instances ci LEFT JOIN schedule_rules sr ON sr.id = ci.rule_id
+         WHERE ci.class_type_id = ? AND ci.status = 'scheduled' AND ci.starts_at > ?
+         AND ci.capacity = ? AND sr.capacity_override IS NULL`
+      ).pluck().all(req.params.id, new Date().toISOString(), type.capacity);
+      const promoted = resizeFuture(req, res, ids, capacity);
+      req.session.flash = `Class type updated.${resizedNote(ids.length, promoted)}`;
     }
     audit(db, who(req), 'class_type_update', `class_type:${req.params.id}`);
     res.redirect('/admin/class-types');
@@ -117,7 +148,7 @@ export default function adminRoutes(services) {
   r.post('/instructors/new', (req, res) => {
     const email = String(req.body.email || '').trim().toLowerCase();
     const password = String(req.body.password || '');
-    if (!/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email) || password.length < 8) {
+    if (!isEmail(email) || password.length < 8) {
       return res.status(400).render('admin/instructor_new', {
         title: 'New instructor login',
         error: 'A valid email and a password of at least 8 characters are required.',
@@ -242,15 +273,31 @@ export default function adminRoutes(services) {
         req.session.flash = 'Start time must be HH:MM.';
         return res.redirect('/admin/rules');
       }
+      const override = b.capacity_override ? Number(b.capacity_override) : null;
+      if (override !== null && (!Number.isInteger(override) || override < 1)) {
+        req.session.flash = 'Capacity override must be a whole number, at least 1.';
+        return res.redirect('/admin/rules');
+      }
+      const effectiveCapacity = (ruleId) => db.prepare(
+        `SELECT COALESCE(sr.capacity_override, ct.capacity) FROM schedule_rules sr
+         JOIN class_types ct ON ct.id = sr.class_type_id WHERE sr.id = ?`
+      ).pluck().get(ruleId);
+      const before = effectiveCapacity(req.params.id);
       db.transaction(() => {
         db.prepare(
           'UPDATE schedule_rules SET class_type_id=?, instructor_id=?, weekday=?, start_time=?, capacity_override=?, active_from=?, active_until=? WHERE id=?'
         ).run(Number(b.class_type_id), Number(b.instructor_id) || null, Number(b.weekday),
-          b.start_time, Number(b.capacity_override) || null, b.active_from || null,
+          b.start_time, override, b.active_from || null,
           b.active_until || null, req.params.id);
         dropUnbookedFutureInstances(req.params.id);
         generateInstances(db);
       })();
+      const after = effectiveCapacity(req.params.id);
+      const ids = after === before ? [] : db.prepare(
+        `SELECT id FROM class_instances WHERE rule_id = ? AND class_type_id = ? AND status = 'scheduled'
+         AND starts_at > ? AND capacity = ?`
+      ).pluck().all(req.params.id, Number(b.class_type_id), new Date().toISOString(), before);
+      const promoted = resizeFuture(req, res, ids, after);
       // Booked classes stay where they were, so say if any are now off-pattern.
       const tz = getSetting(db, 'timezone', 'Asia/Hong_Kong');
       const stranded = db.prepare(
@@ -259,9 +306,9 @@ export default function adminRoutes(services) {
         weekdayOf(localDateStr(tz, ci.starts_at)) !== Number(b.weekday)
         || localTimeStr(tz, ci.starts_at) !== b.start_time
       )).length;
-      req.session.flash = stranded
+      req.session.flash = (stranded
         ? `Rule updated. ${stranded} booked class(es) are still at the old time; cancel them from the schedule if they've moved.`
-        : 'Rule updated and schedule regenerated.';
+        : 'Rule updated and schedule regenerated.') + resizedNote(ids.length, promoted);
     }
     audit(db, who(req), 'rule_update', `rule:${req.params.id}`);
     res.redirect('/admin/rules');
@@ -386,7 +433,7 @@ export default function adminRoutes(services) {
   r.post('/instances/:id/walkin', (req, res) => {
     const email = String(req.body.email || '').trim().toLowerCase();
     const name = String(req.body.name || '').trim();
-    if (!/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email)) {
+    if (!isEmail(email)) {
       req.session.flash = 'A valid email is required for walk-ins.';
       return res.redirect(`/admin/instances/${req.params.id}`);
     }
@@ -425,7 +472,7 @@ export default function adminRoutes(services) {
 
   r.post('/clients', (req, res) => {
     const email = String(req.body.email || '').trim().toLowerCase();
-    if (!/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email)) {
+    if (!isEmail(email)) {
       req.session.flash = 'A valid email is required.';
       return res.redirect('/admin/clients');
     }
@@ -495,13 +542,29 @@ export default function adminRoutes(services) {
     res.redirect(`/admin/clients/${req.params.id}`);
   });
 
-  r.post('/clients/:id/memberships', (req, res) => {
+  r.post('/clients/:id/memberships', async (req, res) => {
     const b = req.body;
     if (b.action === 'status' && b.membership_id) {
-      db.prepare('UPDATE memberships SET status = ? WHERE id = ? AND client_id = ?')
-        .run(b.status, b.membership_id, req.params.id);
-      audit(db, who(req), 'membership_status', `membership:${b.membership_id} → ${b.status}`);
-      return res.redirect(`/admin/clients/${req.params.id}`);
+      const back = `/admin/clients/${req.params.id}`;
+      const m = db.prepare('SELECT * FROM memberships WHERE id = ? AND client_id = ?')
+        .get(b.membership_id, req.params.id);
+      if (!m || !['active', 'paused', 'cancelled'].includes(b.status)) {
+        req.session.flash = 'Membership or status not recognised.';
+        return res.redirect(back);
+      }
+      if (m.stripe_subscription_id && !stripe.configured) {
+        req.session.flash = "Stripe isn't configured, so the subscription behind this membership wasn't changed. Change it in the Stripe dashboard too.";
+      } else if (m.stripe_subscription_id) {
+        try {
+          await stripe.setSubscriptionStatus(m.stripe_subscription_id, b.status);
+        } catch (err) {
+          req.session.flash = `Stripe refused the change, so nothing changed here either: ${err.message}`;
+          return res.redirect(back);
+        }
+      }
+      db.prepare('UPDATE memberships SET status = ? WHERE id = ?').run(b.status, m.id);
+      audit(db, who(req), 'membership_status', `membership:${m.id} → ${b.status}`);
+      return res.redirect(back);
     }
     const tz = getSetting(db, 'timezone', 'Asia/Hong_Kong');
     const today = localDateStr(tz);

package/src/routes/public.js

@@ -5,6 +5,7 @@ import { upcomingInstances } from '../services/schedule.js';
 import { book, resolvePayment, BookingError } from '../services/booking.js';
 import { makeMagicToken } from '../services/auth.js';
 import { emails } from '../services/mailer.js';
+import { isEmail } from '../lib/email.js';
 
 function findOrCreateClient(db, name, email) {
   const cleanEmail = String(email || '').trim().toLowerCase();
@@ -73,7 +74,7 @@ export default function publicRoutes(services) {
       error, form: { name, email },
     });
 
-    if (!email || !/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email)) return renderErr('A valid email is required.');
+    if (!isEmail(email)) return renderErr('A valid email is required.');
 
     try {
       const result = db.transaction(() => {
@@ -143,7 +144,7 @@ export default function publicRoutes(services) {
     const product = db.prepare('SELECT * FROM pack_products WHERE id = ? AND active = 1').get(req.params.id);
     if (!product) return res.status(404).render('error', { title: 'Not found', message: 'Pack not found.' });
     const email = String(req.body.email || '').trim().toLowerCase();
-    if (!/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email)) {
+    if (!isEmail(email)) {
       return res.status(400).render('public/buy_manual', { title: 'Buy', product, plan: null, email: null, error: 'A valid email is required.' });
     }
     if (services.stripe.checkoutReady) {
@@ -164,7 +165,7 @@ export default function publicRoutes(services) {
     const plan = db.prepare('SELECT * FROM membership_plans WHERE id = ? AND active = 1').get(req.params.id);
     if (!plan) return res.status(404).render('error', { title: 'Not found', message: 'Plan not found.' });
     const email = String(req.body.email || '').trim().toLowerCase();
-    if (!/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email)) {
+    if (!isEmail(email)) {
       return res.status(400).render('public/buy_manual', { title: 'Buy', product: null, plan, email: null, error: 'A valid email is required.' });
     }
     if (services.stripe.checkoutReady && plan.stripe_price_id) {

package/src/routes/setup.js

@@ -1,6 +1,7 @@
 import { Router } from 'express';
 import { setSetting, getSetting, audit } from '../db/index.js';
 import { createUser } from '../services/auth.js';
+import { isEmail } from '../lib/email.js';
 
 const TIMEZONES = [
   'Asia/Hong_Kong', 'Asia/Singapore', 'Asia/Tokyo', 'Asia/Shanghai', 'Asia/Bangkok',
@@ -21,7 +22,7 @@ export default function setupRoutes({ db }) {
     const fail = (error) => res.status(400).render('setup', { title: 'Setup', timezones: TIMEZONES, error, form });
 
     if (!studio_name || !studio_name.trim()) return fail('Studio name is required.');
-    if (!email || !/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email)) return fail('A valid owner email is required.');
+    if (!isEmail(email)) return fail('A valid owner email is required.');
     if (!password || password.length < 8) return fail('Password must be at least 8 characters.');
     if (password !== password2) return fail('Passwords do not match.');
     try {

package/src/services/importer.js

@@ -1,6 +1,7 @@
 // Mindbody CSV importer core. Used by scripts/import-mindbody.mjs and the
 // admin import page. Idempotent by client email: re-running updates, never
 // duplicates. No external CSV dependency — small RFC-4180-ish parser below.
+import { isEmail } from '../lib/email.js';
 
 /** Parse CSV text into an array of row objects keyed by header. Handles quoted
  *  fields, embedded commas/newlines, and doubled quotes. */
@@ -96,7 +97,7 @@ export function importClients(db, csvText, { mapping = DEFAULT_MAPPING.clients,
   const work = db.transaction(() => {
     for (const row of rows) {
       const email = pick(row, mapping.email).toLowerCase();
-      if (!email || !/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email)) {
+      if (!isEmail(email)) {
         result.skipped++;
         result.rows.push({ action: 'skip', reason: 'missing/invalid email', row });
         continue;
@@ -148,7 +149,7 @@ export function importPasses(db, csvText, { mapping = DEFAULT_MAPPING.passes, dr
   const work = db.transaction(() => {
     for (const row of rows) {
       const email = pick(row, mapping.email).toLowerCase();
-      if (!email || !/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email)) {
+      if (!isEmail(email)) {
         result.skipped++;
         result.rows.push({ action: 'skip', reason: 'missing/invalid email', row });
         continue;

package/src/services/stripe.js

@@ -67,6 +67,29 @@ export function createStripeService({ env = process.env, client } = {}) {
       });
     },
 
+    /**
+     * Carry a staff status change over to the membership's subscription, so a
+     * cancelled or paused member stops being billed. Pausing voids invoices
+     * rather than deferring them.
+     */
+    async setSubscriptionStatus(subscriptionId, status) {
+      const s = await getClient();
+      if (status !== 'cancelled') {
+        return s.subscriptions.update(subscriptionId, {
+          pause_collection: status === 'paused' ? { behavior: 'void' } : '',
+        });
+      }
+      try {
+        return await s.subscriptions.cancel(subscriptionId);
+      } catch (err) {
+        // Already cancelled at Stripe's end is what we wanted anyway.
+        if (err.code === 'resource_missing') return null;
+        const sub = await s.subscriptions.retrieve(subscriptionId);
+        if (sub.status !== 'canceled') throw err;
+        return sub;
+      }
+    },
+
     /** Verify webhook signature and return the event. Throws on bad signature. */
     async parseWebhook(rawBody, signature) {
       const s = await getClient();
@@ -191,6 +214,31 @@ export function recordMembershipRenewal(db, invoice) {
   })();
 }
 
+// Subscription status → membership status. A failed renewal pauses the
+// membership, so it stops covering classes until the card goes through.
+const MEMBERSHIP_STATUS = {
+  active: 'active', trialing: 'active',
+  past_due: 'paused', unpaid: 'paused', paused: 'paused',
+  canceled: 'cancelled', incomplete_expired: 'cancelled',
+};
+
+/**
+ * Follow a subscription's status onto its membership. Only an actual status
+ * change counts: every renewal fires customer.subscription.updated too, and
+ * those mustn't undo a pause staff set in the app. A cancelled membership
+ * stays cancelled.
+ */
+function followSubscriptionStatus(db, sub, previous) {
+  const status = MEMBERSHIP_STATUS[sub.status];
+  if (!('status' in previous) || !status) return { fulfilled: false, reason: 'no_status_change' };
+  const r = db.prepare(
+    "UPDATE memberships SET status = ? WHERE stripe_subscription_id = ? AND status != 'cancelled'"
+  ).run(status, sub.id);
+  if (!r.changes) return { fulfilled: false, reason: 'unknown_subscription' };
+  audit(db, 'stripe-webhook', 'subscription_status', `${sub.id} ${previous.status} → ${sub.status}`);
+  return { fulfilled: true, kind: 'subscription_status', status };
+}
+
 /** Handle a parsed Stripe event. Returns a result object for logging. */
 export function handleStripeEvent(db, event) {
   if (event.type === 'checkout.session.completed'
@@ -208,5 +256,8 @@ export function handleStripeEvent(db, event) {
     audit(db, 'stripe-webhook', 'subscription_cancelled', sub.id);
     return { fulfilled: r.changes > 0, kind: 'subscription_cancelled' };
   }
+  if (event.type === 'customer.subscription.updated') {
+    return followSubscriptionStatus(db, event.data.object, event.data.previous_attributes || {});
+  }
   return { fulfilled: false, reason: `ignored event ${event.type}` };
 }

package/test/ratelimit.test.js

@@ -121,3 +121,31 @@ test('X-Forwarded-For is ignored unless TRUST_PROXY is set', async () => {
     .set('X-Forwarded-For', '2.2.2.2').send({ email: 'a@t.test', _csrf: csrf2 });
   assert.equal(otherIp.status, 200, 'different forwarded IP has its own bucket');
 });
+
+test('one IPv6 host cannot dodge the limit by rotating addresses', async () => {
+  const { app } = makeApp({ env: { TRUST_PROXY: '1' }, now: () => 10 * WINDOW });
+  const agent = request.agent(app);
+  const _csrf = await csrfToken(agent, '/magic-link');
+  const statuses = [];
+  for (let i = 1; i <= 6; i++) {
+    const res = await agent.post('/magic-link').type('form')
+      .set('X-Forwarded-For', `2001:db8:0:1::${i}`).send({ email: 'a@t.test', _csrf });
+    statuses.push(res.status);
+  }
+  assert.deepEqual(statuses, [200, 200, 200, 200, 200, 429]);
+});
+
+test('every route sits under a 1000 per 15 min ceiling; static files do not count', async () => {
+  let t = 10 * WINDOW;
+  const { app } = makeApp({ now: () => t });
+  const agent = request.agent(app);
+  for (let i = 0; i < 50; i++) assert.equal((await agent.get('/css/custom.css')).status, 200);
+  for (let i = 1; i <= 1000; i++) {
+    const res = await agent.get('/magic-link');
+    if (res.status !== 200) assert.fail(`request ${i} got ${res.status}`);
+  }
+  const blocked = await agent.get('/admin');
+  assert.equal(blocked.status, 429);
+  t += WINDOW;
+  assert.equal((await agent.get('/magic-link')).status, 200);
+});

package/test/stripe.test.js

@@ -8,14 +8,23 @@ import { createStripeService, fulfillCheckoutSession } from '../src/services/str
 import { createMailer } from '../src/services/mailer.js';
 import { createUser } from '../src/services/auth.js';
 import { openDb, setSetting } from '../src/db/index.js';
+import { csrfToken } from './helpers.js';
 
 const VALID_SIG = 't=123,v1=goodsignature';
 
 /** Mock of the stripe npm client: signature check + checkout session capture. */
 function mockStripeClient() {
   const created = [];
-  return {
+  const subscriptionCalls = [];
+  const client = {
     created,
+    subscriptionCalls,
+    failNext: null,
+    subscriptions: {
+      async update(id, params) { return call(['update', id, params]); },
+      async cancel(id) { return call(['cancel', id]); },
+      async retrieve(id) { return { id, status: 'active' }; },
+    },
     checkout: {
       sessions: {
         create: async (params) => {
@@ -32,6 +41,16 @@ function mockStripeClient() {
       },
     },
   };
+  function call(entry) {
+    if (client.failNext) {
+      const err = client.failNext;
+      client.failNext = null;
+      throw err;
+    }
+    subscriptionCalls.push(entry);
+    return { id: entry[1] };
+  }
+  return client;
 }
 
 function makeApp() {
@@ -247,6 +266,76 @@ test('customer.subscription.deleted cancels the matching membership', async () =
   assert.equal(db.prepare('SELECT status FROM memberships WHERE client_id = ?').get(clientId).status, 'cancelled');
 });
 
+function membershipWithSub(db, subId, status = 'active') {
+  const clientId = db.prepare(
+    "INSERT INTO clients (name, email, source) VALUES ('M', ?, 'self')"
+  ).run(`${subId}@test.hk`).lastInsertRowid;
+  const id = db.prepare(
+    `INSERT INTO memberships (client_id, plan_name, status, started_on, stripe_subscription_id, unlimited)
+     VALUES (?, 'Unlimited', ?, '2026-07-01', ?, 1)`
+  ).run(clientId, status, subId).lastInsertRowid;
+  return { clientId, id, status: () => db.prepare('SELECT status FROM memberships WHERE id = ?').get(id).status };
+}
+
+test('a failed renewal pauses the membership until the card goes through', async () => {
+  const { db, app } = makeApp();
+  const m = membershipWithSub(db, 'sub_dunning');
+  const updated = (status, previous) => postEvent(app, {
+    type: 'customer.subscription.updated',
+    data: { object: { id: 'sub_dunning', status }, previous_attributes: previous },
+  });
+
+  await updated('past_due', { status: 'active' });
+  assert.equal(m.status(), 'paused');
+  await updated('active', { status: 'past_due' });
+  assert.equal(m.status(), 'active');
+
+  // A renewal also fires .updated, without a status change. It must not
+  // undo a pause staff set in the app.
+  db.prepare("UPDATE memberships SET status = 'paused' WHERE id = ?").run(m.id);
+  const renewal = await updated('active', { current_period_end: 1790000000 });
+  assert.equal(renewal.body.reason, 'no_status_change');
+  assert.equal(m.status(), 'paused');
+
+  db.prepare("UPDATE memberships SET status = 'cancelled' WHERE id = ?").run(m.id);
+  await updated('active', { status: 'past_due' });
+  assert.equal(m.status(), 'cancelled', 'a cancelled membership stays cancelled');
+});
+
+test('staff pausing, resuming or cancelling a Stripe membership changes the subscription too', async () => {
+  const { db, app, client } = makeApp();
+  const m = membershipWithSub(db, 'sub_staff');
+  const agent = request.agent(app);
+  let _csrf = await csrfToken(agent, '/admin/login');
+  await agent.post('/admin/login').type('form').send({ email: 'owner@test.test', password: 'password123', _csrf });
+  _csrf = await csrfToken(agent, `/admin/clients/${m.clientId}`);
+  const setStatus = (status) => agent.post(`/admin/clients/${m.clientId}/memberships`).type('form')
+    .send({ action: 'status', membership_id: String(m.id), status, _csrf });
+
+  await setStatus('paused');
+  assert.equal(m.status(), 'paused');
+  await setStatus('active');
+  assert.equal(m.status(), 'active');
+  assert.deepEqual(client.subscriptionCalls, [
+    ['update', 'sub_staff', { pause_collection: { behavior: 'void' } }],
+    ['update', 'sub_staff', { pause_collection: '' }],
+  ]);
+
+  // Stripe saying no leaves the membership as it was.
+  client.failNext = Object.assign(new Error('card_declined'), { code: 'card_declined' });
+  const refused = await setStatus('paused');
+  assert.equal(refused.status, 302);
+  assert.equal(m.status(), 'active');
+
+  const bogus = await setStatus('frozen');
+  assert.equal(bogus.status, 302, 'an unknown status is a flash, not a 500');
+  assert.equal(m.status(), 'active');
+
+  await setStatus('cancelled');
+  assert.equal(m.status(), 'cancelled');
+  assert.deepEqual(client.subscriptionCalls.at(-1), ['cancel', 'sub_staff']);
+});
+
 test('drop-in checkout marks the pending payment paid', async () => {
   const { db, app } = makeApp();
   const clientId = db.prepare(

package/test/web.test.js

@@ -173,6 +173,19 @@ test('a two-credit class says two credits came off the pack', async () => {
   assert.match(res.text, /2 credits deducted from your class pack/);
 });
 
+test('a 50kb junk email is turned away without stalling the server', async () => {
+  const { db, app } = makeApp();
+  const inst = makeInstance(db, makeClassType(db), { hoursFromNow: 48 });
+  const agent = request.agent(app);
+  const _csrf = await csrfToken(agent, `/class/${inst}`);
+  const started = Date.now();
+  const res = await agent.post(`/class/${inst}/book`).type('form')
+    .send({ email: `a@${'.'.repeat(50000)}@`, waiver_agree: '1', _csrf });
+  assert.equal(res.status, 400);
+  // The old regex took ~850ms on this; the event loop was blocked throughout.
+  assert.ok(Date.now() - started < 300, `took ${Date.now() - started}ms`);
+});
+
 test("booking with an existing client's email does not rename them", async () => {
   const { db, app } = makeApp();
   const inst = makeInstance(db, makeClassType(db), { hoursFromNow: 48 });
@@ -386,6 +399,69 @@ test('admin: editing a rule moves its empty classes instead of adding a second s
   assert.equal(db.prepare('SELECT start_time FROM schedule_rules WHERE id = ?').get(ruleId).start_time, '19:00');
 });
 
+test('admin: a class type capacity change reaches upcoming classes still at the old size', async () => {
+  const { db, app } = makeApp();
+  const agent = request.agent(app);
+  const _csrf = await adminLogin(agent);
+  const { book } = await import('../src/services/booking.js');
+  const type = makeClassType(db, { name: 'Barre', capacity: 1 });
+  const booked = makeInstance(db, type, { hoursFromNow: 48 });
+  const handSized = makeInstance(db, type, { hoursFromNow: 72, capacity: 5 });
+  const past = makeInstance(db, type, { hoursFromNow: -24 });
+  const ruleId = db.prepare(
+    "INSERT INTO schedule_rules (class_type_id, weekday, start_time, capacity_override) VALUES (?, 1, '09:00', 1)"
+  ).run(type).lastInsertRowid;
+  const fromRule = makeInstance(db, type, { hoursFromNow: 96 });
+  db.prepare('UPDATE class_instances SET rule_id = ? WHERE id = ?').run(ruleId, fromRule);
+  book(db, makeClient(db, { email: 'first@type.hk' }), booked);
+  const { booking: wl } = book(db, makeClient(db, { email: 'waiting@type.hk' }), booked);
+  const capacity = (id) => db.prepare('SELECT capacity FROM class_instances WHERE id = ?').get(id).capacity;
+
+  const res = await agent.post(`/admin/class-types/${type}`).type('form')
+    .send({ name: 'Barre', capacity: '2', drop_in_price: '150', _csrf });
+  assert.equal(res.status, 302);
+  assert.deepEqual([booked, handSized, past, fromRule].map(capacity), [2, 5, 1, 1]);
+  assert.equal(db.prepare('SELECT status FROM bookings WHERE id = ?').get(wl.id).status, 'booked');
+  assert.match((await agent.get('/admin/class-types')).text, /1 upcoming class\(es\) resized, 1 moved up from the waitlist/);
+  await new Promise((r) => setTimeout(r, 100));
+  const mails = fs.readdirSync(OUTBOX).map((f) => fs.readFileSync(path.join(OUTBOX, f), 'utf8'));
+  assert.ok(mails.some((m) => m.includes('To: waiting@type.hk')));
+
+  const bad = await agent.post(`/admin/class-types/${type}`).type('form')
+    .send({ name: 'Barre', capacity: '-3', _csrf });
+  assert.equal(bad.status, 302);
+  assert.equal(db.prepare('SELECT capacity FROM class_types WHERE id = ?').get(type).capacity, 2);
+});
+
+test('admin: a rule capacity change reaches its booked classes too', async () => {
+  const { db, app } = makeApp();
+  const agent = request.agent(app);
+  const _csrf = await adminLogin(agent);
+  const { book } = await import('../src/services/booking.js');
+  const type = makeClassType(db, { name: 'Reformer', capacity: 1 });
+  await agent.post('/admin/rules').type('form').send({
+    class_type_id: String(type), weekday: '2', start_time: '07:00', _csrf,
+  });
+  const ruleId = db.prepare('SELECT id FROM schedule_rules').get().id;
+  const next = db.prepare('SELECT id FROM class_instances WHERE rule_id = ? ORDER BY starts_at').get(ruleId).id;
+  book(db, makeClient(db, { email: 'first@rule.hk' }), next);
+  const { booking: wl } = book(db, makeClient(db, { email: 'waiting@rule.hk' }), next);
+
+  const res = await agent.post(`/admin/rules/${ruleId}`).type('form').send({
+    class_type_id: String(type), weekday: '2', start_time: '07:00', capacity_override: '3', _csrf,
+  });
+  assert.equal(res.status, 302);
+  const caps = db.prepare('SELECT DISTINCT capacity FROM class_instances WHERE rule_id = ?').pluck().all(ruleId);
+  assert.deepEqual(caps, [3]);
+  assert.equal(db.prepare('SELECT status FROM bookings WHERE id = ?').get(wl.id).status, 'booked');
+
+  const bad = await agent.post(`/admin/rules/${ruleId}`).type('form').send({
+    class_type_id: String(type), weekday: '2', start_time: '07:00', capacity_override: '-1', _csrf,
+  });
+  assert.equal(bad.status, 302, 'a negative override is a flash, not a 500');
+  assert.equal(db.prepare('SELECT capacity_override FROM schedule_rules WHERE id = ?').get(ruleId).capacity_override, 3);
+});
+
 test('admin: manual pass sale + payment, revenue report and CSV export', async () => {
   const { db, app } = makeApp();
   const agent = request.agent(app);

package/views/admin/class_types.ejs

@@ -31,7 +31,7 @@
       <label>Description <input name="description" value="<%= t.description %>"></label>
       <div class="grid">
         <label>Duration <input type="number" name="duration_min" value="<%= t.duration_min %>"></label>
-        <label>Capacity <input type="number" name="capacity" value="<%= t.capacity %>"></label>
+        <label>Capacity <input type="number" name="capacity" value="<%= t.capacity %>" min="1"></label>
         <label>Drop-in price <input type="number" name="drop_in_price" value="<%= (t.drop_in_price_cents / 100).toFixed(2) %>" step="0.01"></label>
         <label>Credits <input type="number" name="credits_required" value="<%= t.credits_required %>"></label>
       </div>

package/views/admin/rules.ejs

@@ -57,7 +57,7 @@
         <label>Start <input name="start_time" value="<%= rule.start_time %>"></label>
       </div>
       <div class="grid">
-        <label>Capacity override <input type="number" name="capacity_override" value="<%= rule.capacity_override || '' %>"></label>
+        <label>Capacity override <input type="number" name="capacity_override" value="<%= rule.capacity_override || '' %>" min="1" placeholder="(class default)"></label>
         <label>Active from <input type="date" name="active_from" value="<%= rule.active_from || '' %>"></label>
         <label>Active until <input type="date" name="active_until" value="<%= rule.active_until || '' %>"></label>
       </div>