Harden booking, offering exposure, payments, and invites

Security fixes from a pen-test review (issues #31–#37):

- #31 Booking no longer trusts a client-supplied offering_id: a slot-tied
  offering is authoritative and any offering used must belong to the slot's
  instructor, closing a free/misrouted-payment bypass.
- #34 Availability slot creation rejects an offering the instructor does not
  own (AvailabilityEndpoint now takes OfferingRepository).
- #32 Offering/question/policy listing endpoints now require book_lesson
  instead of being public (no anonymous consumer exists); Offering::toArray
  also omits etransfer_email from listings as defense-in-depth.
- #33 Slots are claimed atomically (UPDATE ... WHERE is_booked = 0) before a
  lesson is inserted, preventing a double-booking race.
- #35 A single weekly booking is capped (MAX_WEEKLY_OCCURRENCES) and only
  creates lessons for slots it actually claimed.
- #36 Stripe secret/webhook keys are write-only in the settings UI and a blank
  submit keeps the stored value; secrets are never echoed back into HTML.
- #37 Pending invites expire after 14 days (Invite::isAcceptable), enforced at
  registration and surfaced on the admin invites list.

Adds BookingEndpointTest plus Invite/Offering/AvailabilityRepository coverage
and minimal WP_REST_Request/WP_REST_Response stubs. composer test (200),
lint, and cs all green.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

src/Booking/BookingEndpoint.php

@@ -13,6 +13,12 @@ use Unsupervised\Schedular\Registration\RegistrationGate;
 
 class BookingEndpoint {
 
+	/**
+	 * The most occurrences a single weekly booking may reserve at once, so one
+	 * student cannot lock up an instructor's entire recurring schedule.
+	 */
+	private const MAX_WEEKLY_OCCURRENCES = 12;
+
 	public function __construct(
 		private AvailabilityRepository $availability,
 		private BookingRepository $bookings,
@@ -108,15 +114,33 @@ class BookingEndpoint {
 			return new \WP_Error( 'slot_taken', __( 'This slot is already booked.', 'unsupervised-schedular' ), [ 'status' => 409 ] );
 		}
 
-		$offeringId = absint( $request->get_param( 'offering_id' ) );
-		if ( 0 === $offeringId ) {
-			$offeringId = (int) ( $slot->offeringId ?? 0 );
+		// Resolve the offering for this booking. A client-supplied offering must
+		// never override the slot's price or payment routing: when the slot is tied
+		// to a specific offering that offering is authoritative, and any offering
+		// used must belong to the slot's instructor. This prevents substituting a
+		// cheaper/free offering to dodge payment, or another instructor's offering
+		// to misroute it.
+		$requestedOfferingId = absint( $request->get_param( 'offering_id' ) );
+		$slotOfferingId      = (int) ( $slot->offeringId ?? 0 );
+
+		if ( $slotOfferingId > 0 ) {
+			if ( $requestedOfferingId > 0 && $requestedOfferingId !== $slotOfferingId ) {
+				return new \WP_Error( 'offering_mismatch', __( 'This slot is tied to a different offering.', 'unsupervised-schedular' ), [ 'status' => 400 ] );
+			}
+			$offeringId = $slotOfferingId;
+		} else {
+			$offeringId = $requestedOfferingId;
 		}
+
 		$offering = $offeringId > 0 ? $this->offerings->findById( $offeringId ) : null;
 		if ( $offeringId > 0 && null === $offering ) {
 			return new \WP_Error( 'invalid_offering', __( 'Offering not found.', 'unsupervised-schedular' ), [ 'status' => 400 ] );
 		}
 
+		if ( null !== $offering && $offering->instructorId !== $slot->instructorId ) {
+			return new \WP_Error( 'offering_mismatch', __( 'That offering is not available for this slot.', 'unsupervised-schedular' ), [ 'status' => 400 ] );
+		}
+
 		$answers            = $this->answers( $request );
 		$acceptedVersionIds = array_map( 'absint', (array) $request->get_param( 'accepted_policy_version_ids' ) );
 
@@ -142,16 +166,27 @@ class BookingEndpoint {
 
 		// Weekly reservation across the slot's recurring group; otherwise a single lesson.
 		if ( Lesson::RECURRENCE_WEEKLY === $recurrence && null !== $slot->recurrenceGroup ) {
-			$slotIds = array_map( static fn( $s ): int => (int) $s->id, $this->availability->findUnbookedInGroup( $slot->recurrenceGroup ) );
-			$ids     = $this->bookings->insertSeries( $template, $slotIds );
-			foreach ( $slotIds as $reservedSlotId ) {
-				$this->availability->markBooked( $reservedSlotId );
+			// Claim each occurrence atomically (capped so one booking cannot lock an
+			// instructor's entire schedule), then create a lesson only for the slots
+			// this request actually won — never for one already taken by someone else.
+			$candidates = array_map( static fn( $s ): int => (int) $s->id, $this->availability->findUnbookedInGroup( $slot->recurrenceGroup ) );
+			$candidates = array_slice( $candidates, 0, self::MAX_WEEKLY_OCCURRENCES );
+
+			$claimed = array_values( array_filter( $candidates, fn( int $candidateId ): bool => $this->availability->claim( $candidateId ) ) );
+			if ( [] === $claimed ) {
+				return new \WP_Error( 'slot_taken', __( 'This slot is already booked.', 'unsupervised-schedular' ), [ 'status' => 409 ] );
 			}
+
+			$ids      = $this->bookings->insertSeries( $template, $claimed );
 			$anchorId = $ids[0] ?? 0;
 		} else {
+			// Claim before inserting: if another request already took the slot, the
+			// guarded update reports no rows and we reject rather than double-book.
+			if ( ! $this->availability->claim( $slotId ) ) {
+				return new \WP_Error( 'slot_taken', __( 'This slot is already booked.', 'unsupervised-schedular' ), [ 'status' => 409 ] );
+			}
 			$anchorId = $this->bookings->insert( $template );
-			$this->availability->markBooked( $slotId );
-			$ids = [ $anchorId ];
+			$ids      = [ $anchorId ];
 		}
 
 		$this->gate->record( PolicyAcceptance::REG_LESSON, $anchorId, $studentId, $offeringId, $answers, $acceptedVersionIds, $this->clientIp() );