Harden booking, offering exposure, payments, and invites

Security fixes from a pen-test review (issues #31–#37):

- #31 Booking no longer trusts a client-supplied offering_id: a slot-tied
  offering is authoritative and any offering used must belong to the slot's
  instructor, closing a free/misrouted-payment bypass.
- #34 Availability slot creation rejects an offering the instructor does not
  own (AvailabilityEndpoint now takes OfferingRepository).
- #32 Offering/question/policy listing endpoints now require book_lesson
  instead of being public (no anonymous consumer exists); Offering::toArray
  also omits etransfer_email from listings as defense-in-depth.
- #33 Slots are claimed atomically (UPDATE ... WHERE is_booked = 0) before a
  lesson is inserted, preventing a double-booking race.
- #35 A single weekly booking is capped (MAX_WEEKLY_OCCURRENCES) and only
  creates lessons for slots it actually claimed.
- #36 Stripe secret/webhook keys are write-only in the settings UI and a blank
  submit keeps the stored value; secrets are never echoed back into HTML.
- #37 Pending invites expire after 14 days (Invite::isAcceptable), enforced at
  registration and surfaced on the admin invites list.

Adds BookingEndpointTest plus Invite/Offering/AvailabilityRepository coverage
and minimal WP_REST_Request/WP_REST_Response stubs. composer test (200),
lint, and cs all green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/Unit/Auth/InviteTest.php

@@ -60,6 +60,41 @@ class InviteTest extends TestCase
         self::assertTrue($invite->isPending());
     }
 
+    public function testIsExpiredWhenOlderThanExpiryWindow(): void
+    {
+        $created = gmdate('Y-m-d H:i:s', strtotime('2026-06-01 09:00:00'));
+        $now     = '2026-06-20 09:00:00'; // 19 days later, beyond the 14-day window.
+
+        $invite = new Invite('a@b.test', 'tok', createdAt: $created);
+
+        self::assertTrue($invite->isExpired($now));
+        self::assertFalse($invite->isAcceptable($now));
+    }
+
+    public function testIsNotExpiredWithinExpiryWindow(): void
+    {
+        $invite = new Invite('a@b.test', 'tok', createdAt: '2026-06-01 09:00:00');
+        $now    = '2026-06-10 09:00:00'; // 9 days later, inside the window.
+
+        self::assertFalse($invite->isExpired($now));
+        self::assertTrue($invite->isAcceptable($now));
+    }
+
+    public function testIsNotExpiredWhenCreatedAtUnknown(): void
+    {
+        $invite = new Invite('a@b.test', 'tok');
+
+        self::assertFalse($invite->isExpired('2030-01-01 00:00:00'));
+        self::assertTrue($invite->isAcceptable('2030-01-01 00:00:00'));
+    }
+
+    public function testAcceptedInviteIsNotAcceptableEvenWhenFresh(): void
+    {
+        $invite = new Invite('a@b.test', 'tok', status: Invite::STATUS_ACCEPTED, createdAt: '2026-06-01 09:00:00');
+
+        self::assertFalse($invite->isAcceptable('2026-06-02 09:00:00'));
+    }
+
     public function testToArrayContainsExpectedKeys(): void
     {
         $arr = (new Invite('a@b.test', 'tok', id: 1))->toArray();

tests/Unit/Availability/AvailabilityRepositoryTest.php

@@ -116,16 +116,25 @@ class AvailabilityRepositoryTest extends TestCase
         self::assertSame(5, $slot->instructorId);
     }
 
-    public function testMarkBookedUpdatesRecord(): void
+    public function testClaimReturnsTrueWhenSlotWasUnbooked(): void
     {
         $this->db->shouldReceive('update')
             ->once()
-            ->with('wp_us_availability', ['is_booked' => 1], ['id' => 7], ['%d'], ['%d'])
+            ->with('wp_us_availability', ['is_booked' => 1], ['id' => 7, 'is_booked' => 0], ['%d'], ['%d', '%d'])
             ->andReturn(1);
 
-        $result = $this->repo->markBooked(7);
+        self::assertTrue($this->repo->claim(7));
+    }
 
-        self::assertTrue($result);
+    public function testClaimReturnsFalseWhenSlotAlreadyBooked(): void
+    {
+        // The is_booked = 0 guard matches no row once the slot is taken.
+        $this->db->shouldReceive('update')
+            ->once()
+            ->with('wp_us_availability', ['is_booked' => 1], ['id' => 7, 'is_booked' => 0], ['%d'], ['%d', '%d'])
+            ->andReturn(0);
+
+        self::assertFalse($this->repo->claim(7));
     }
 
     public function testDeleteReturnsFalseWhenRowNotDeleted(): void

tests/Unit/Booking/BookingEndpointTest.php

@@ -0,0 +1,132 @@
+<?php
+declare(strict_types=1);
+
+namespace Unsupervised\Schedular\Tests\Unit\Booking;
+
+use Brain\Monkey\Functions;
+use Mockery;
+use Unsupervised\Schedular\Availability\AvailabilityRepository;
+use Unsupervised\Schedular\Availability\AvailabilitySlot;
+use Unsupervised\Schedular\Booking\BookingEndpoint;
+use Unsupervised\Schedular\Booking\BookingRepository;
+use Unsupervised\Schedular\Offering\Offering;
+use Unsupervised\Schedular\Offering\OfferingRepository;
+use Unsupervised\Schedular\Payment\PaymentService;
+use Unsupervised\Schedular\Registration\RegistrationGate;
+use Unsupervised\Schedular\Tests\Unit\TestCase;
+
+class BookingEndpointTest extends TestCase
+{
+    private AvailabilityRepository $availability;
+    private BookingRepository $bookings;
+    private OfferingRepository $offerings;
+    private RegistrationGate $gate;
+    private PaymentService $payments;
+    private BookingEndpoint $endpoint;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        Functions\when('absint')->alias(static fn ($v): int => abs((int) $v));
+        Functions\when('wp_unslash')->returnArg();
+        Functions\when('sanitize_text_field')->returnArg();
+        Functions\when('get_current_user_id')->justReturn(5);
+
+        $this->availability = Mockery::mock(AvailabilityRepository::class);
+        $this->bookings     = Mockery::mock(BookingRepository::class);
+        $this->offerings    = Mockery::mock(OfferingRepository::class);
+        $this->gate         = Mockery::mock(RegistrationGate::class);
+        $this->payments     = Mockery::mock(PaymentService::class);
+
+        $this->endpoint = new BookingEndpoint(
+            $this->availability,
+            $this->bookings,
+            $this->offerings,
+            $this->gate,
+            $this->payments,
+        );
+    }
+
+    private function slot(int $id, int $instructorId, ?int $offeringId, bool $isBooked = false, ?int $recurrenceGroup = null): AvailabilitySlot
+    {
+        return new AvailabilitySlot(
+            instructorId:    $instructorId,
+            startDt:         '2026-07-01 10:00:00',
+            endDt:           '2026-07-01 11:00:00',
+            offeringId:      $offeringId,
+            isBooked:        $isBooked,
+            recurrenceGroup: $recurrenceGroup,
+            id:              $id,
+        );
+    }
+
+    public function testBookRejectsOfferingFromAnotherInstructor(): void
+    {
+        // Generic slot owned by instructor 3; attacker supplies instructor 7's offering.
+        $this->availability->shouldReceive('findById')->with(10)->andReturn($this->slot(10, 3, null));
+        $this->offerings->shouldReceive('findById')->with(99)->andReturn(
+            new Offering(instructorId: 7, kind: Offering::KIND_PRIVATE_LESSON, title: 'Cheap', price: 0.0, id: 99)
+        );
+
+        // No booking should be created.
+        $this->availability->shouldNotReceive('claim');
+        $this->bookings->shouldNotReceive('insert');
+
+        $request = new \WP_REST_Request(['slot_id' => 10, 'offering_id' => 99]);
+        $result  = $this->endpoint->book($request);
+
+        self::assertInstanceOf(\WP_Error::class, $result);
+        self::assertSame('offering_mismatch', $result->get_error_code());
+    }
+
+    public function testBookRejectsOfferingThatDoesNotMatchSlotTiedOffering(): void
+    {
+        // Slot is tied to offering 5; attacker tries to swap in offering 99.
+        $this->availability->shouldReceive('findById')->with(10)->andReturn($this->slot(10, 3, 5));
+        $this->offerings->shouldNotReceive('findById');
+        $this->availability->shouldNotReceive('claim');
+
+        $request = new \WP_REST_Request(['slot_id' => 10, 'offering_id' => 99]);
+        $result  = $this->endpoint->book($request);
+
+        self::assertInstanceOf(\WP_Error::class, $result);
+        self::assertSame('offering_mismatch', $result->get_error_code());
+    }
+
+    public function testBookReturns409WhenSlotClaimFails(): void
+    {
+        // Generic slot, no offering; another request wins the claim first.
+        $this->availability->shouldReceive('findById')->with(10)->andReturn($this->slot(10, 3, null));
+        $this->gate->shouldReceive('validate')->andReturn(null);
+        $this->availability->shouldReceive('claim')->with(10)->once()->andReturn(false);
+        $this->bookings->shouldNotReceive('insert');
+
+        $request = new \WP_REST_Request(['slot_id' => 10]);
+        $result  = $this->endpoint->book($request);
+
+        self::assertInstanceOf(\WP_Error::class, $result);
+        self::assertSame('slot_taken', $result->get_error_code());
+    }
+
+    public function testBookSucceedsForGenericSlotWithSameInstructorOffering(): void
+    {
+        $this->availability->shouldReceive('findById')->with(10)->andReturn($this->slot(10, 3, null));
+        $this->offerings->shouldReceive('findById')->with(8)->andReturn(
+            new Offering(instructorId: 3, kind: Offering::KIND_PRIVATE_LESSON, title: 'Lesson', price: 0.0, id: 8)
+        );
+        $this->gate->shouldReceive('validate')->andReturn(null);
+        $this->availability->shouldReceive('claim')->with(10)->once()->andReturn(true);
+        $this->bookings->shouldReceive('insert')->once()->andReturn(77);
+        $this->gate->shouldReceive('record')->once();
+        // Free offering → no payment.
+        $this->payments->shouldNotReceive('createForRegistration');
+
+        $request = new \WP_REST_Request(['slot_id' => 10, 'offering_id' => 8]);
+        $result  = $this->endpoint->book($request);
+
+        self::assertInstanceOf(\WP_REST_Response::class, $result);
+        self::assertSame(201, $result->get_status());
+        self::assertSame([77], $result->get_data()['ids']);
+    }
+}

tests/Unit/Offering/OfferingTest.php

@@ -84,6 +84,21 @@ class OfferingTest extends TestCase
         }
     }
 
+    public function testToArrayIncludesEtransferEmailByDefault(): void
+    {
+        $offering = new Offering(1, Offering::KIND_PRIVATE_LESSON, 'Lesson', etransferEmail: 'studio@example.com', id: 10);
+
+        self::assertArrayHasKey('etransfer_email', $offering->toArray());
+        self::assertSame('studio@example.com', $offering->toArray()['etransfer_email']);
+    }
+
+    public function testToArrayOmitsEtransferEmailWhenExcluded(): void
+    {
+        $offering = new Offering(1, Offering::KIND_PRIVATE_LESSON, 'Lesson', etransferEmail: 'studio@example.com', id: 10);
+
+        self::assertArrayNotHasKey('etransfer_email', $offering->toArray(includeEtransferEmail: false));
+    }
+
     public function testValidKindAndBillingConstants(): void
     {
         self::assertContains(Offering::KIND_PRIVATE_LESSON, Offering::VALID_KINDS);