Unsupervised/unsupervised-scheduler
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases 12 Wiki Activity

Let offering managers read the offerings catalogue
CI / Tests (PHP 8.1) (pull_request) Successful in 46s
Details
CI / No Debug Code (pull_request) Successful in 2s
Details
CI / Tests (PHP 8.2) (pull_request) Successful in 56s
Details
CI / PHPStan (pull_request) Successful in 2m56s
Details
CI / Coding Standards (pull_request) Successful in 2m58s
Details
CI / Tests (PHP 8.3) (pull_request) Successful in 2m41s
Details
CI / Build Plugin Zip (pull_request) Skipped
Details

Browse Source 
The block editor's group-class picker fetches GET /offerings, whose
permission callback only accepted book_lesson — a capability held by
students alone. Administrators and instructors editing a page were
rejected with a 403 and the picker silently rendered an empty list.

Read access now accepts book_lesson or manage_offerings. The listing is
unchanged: active offerings only, public ones plus the invite-only
classes the caller has been granted, without the e-transfer email.

Closes #121

Co-Authored-By: Claude Opus 5 <[email protected]>
This commit is contained in:
thatguygriff
2026-07-28 12:54:58 -03:00
co-authored by Claude Opus 5
parent add6605141
commit 0f30f28e92
3 changed files with 48 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/Unit/Offering/OfferingEndpointTest.php
+37
View File
@@ -5,6 +5,7 @@ namespace Unsupervised\Schedular\Tests\Unit\Offering;
use Brain\Monkey\Functions;
use Mockery;
use Unsupervised\Schedular\Auth\RoleManager;
use Unsupervised\Schedular\GroupClass\GroupAccessRepository;
use Unsupervised\Schedular\Offering\Offering;
use Unsupervised\Schedular\Offering\OfferingEndpoint;
@@ -119,6 +120,42 @@ class OfferingEndpointTest extends TestCase
self::assertArrayNotHasKey('etransfer_email', $data[0]);
}
public function testCanReadAllowsStudentsWhoMayBook(): void
{
Functions\when('is_user_logged_in')->justReturn(true);
Functions\when('current_user_can')->alias(
static fn (string $cap): bool => RoleManager::CAP_BOOK_LESSON === $cap
);
self::assertTrue($this->endpoint->canRead());
}
public function testCanReadAllowsOfferingManagersWhoCannotBook(): void
{
Functions\when('is_user_logged_in')->justReturn(true);
Functions\when('current_user_can')->alias(
static fn (string $cap): bool => RoleManager::CAP_MANAGE_OFFERINGS === $cap
);
self::assertTrue($this->endpoint->canRead());
}
public function testCanReadRejectsLoggedInUserWithNeitherCapability(): void
{
Functions\when('is_user_logged_in')->justReturn(true);
Functions\when('current_user_can')->justReturn(false);
self::assertFalse($this->endpoint->canRead());
}
public function testCanReadRejectsLoggedOutVisitors(): void
{
Functions\when('is_user_logged_in')->justReturn(false);
Functions\when('current_user_can')->justReturn(true);
self::assertFalse($this->endpoint->canRead());
}
public function testCreateRejectsTitleLongerThanColumnLimit(): void
{
Functions\when('sanitize_text_field')->returnArg();