Ask some registration questions of students only

Every account-signup question was asked of everybody who registered, on the
same terms: "school and grade" had to be put to an adult signing themselves
up, and a question a studio needed answered for each student could only be
made required by demanding it of everyone.

A question now carries an audience — everyone, or only the students someone
registers on behalf of — and its own required flag for each side, so optional
for you and required for every student you enrol is expressible. Both settings
are account-scope only: an offering asks its questions once, about the student
being booked, so there is no second audience to differ from, and an offering
question mirrors its single "required" into both columns.

Every caller reads askedOfSelf()/isRequiredForSelf()/isRequiredForChild()
rather than the raw flags, so a students-only question can neither block the
account holder nor have an answer filed against them by a crafted post. The
family screen, which only ever adds a student, is held to the students' rule.

is_required_child arrives from dbDelta defaulting to 0, which would quietly
stop every existing required question being required of the students a
guardian registers — the case it most likely existed for. A one-time backfill
copies is_required across, guarded by its own option so a question later made
optional for students stays that way.

Closes #163

Co-Authored-By: Claude Opus 5 <[email protected]>

tests/Unit/Auth/RegistrationPageTest.php

@@ -1017,7 +1017,7 @@ class RegistrationPageTest extends TestCase
         ];
 
         $this->ctx['questions']->shouldReceive('findByScope')->andReturn([
-            new Question(offeringId: null, label: 'Instrument', isRequired: true, scope: Question::SCOPE_ACCOUNT, id: 7),
+            new Question(offeringId: null, label: 'Instrument', isRequired: true, scope: Question::SCOPE_ACCOUNT, isRequiredChild: true, id: 7),
         ]);
 
         Functions\when('email_exists')->justReturn(false);
@@ -1247,4 +1247,157 @@ class RegistrationPageTest extends TestCase
             'The account holder answers the questions above the students they are adding.'
         );
     }
+
+    /**
+     * A "students only" question describes a child being registered, so it is put
+     * to each student and never to the account holder about themselves.
+     */
+    public function testAStudentsOnlyQuestionIsAskedOfTheStudentsAndNotOfTheAccountHolder(): void
+    {
+        $this->stubRenderContext();
+
+        $question = new Question(
+            null,
+            'School and grade',
+            scope: Question::SCOPE_ACCOUNT,
+            audience: Question::AUDIENCE_CHILD,
+            isRequiredChild: true,
+            id: 7
+        );
+        $this->ctx['questions']->shouldReceive('findByScope')->with(Question::SCOPE_ACCOUNT, Mockery::any())->andReturn([$question]);
+
+        $html = $this->ctx['page']->render([]);
+
+        self::assertStringNotContainsString('name="us_answers[7]"', $html);
+        self::assertStringContainsString('name="children[0][answers][7]"', $html);
+    }
+
+    /**
+     * The two required flags are read where each applies: the browser is asked to
+     * enforce the account holder's, and the students' block carries the marker
+     * without the attribute (it may not be in play at all).
+     */
+    public function testTheFormMarksAQuestionRequiredWhereItActuallyIs(): void
+    {
+        $this->stubRenderContext();
+
+        $question = new Question(
+            null,
+            'Previous experience',
+            scope: Question::SCOPE_ACCOUNT,
+            isRequired: false,
+            isRequiredChild: true,
+            id: 7
+        );
+        $this->ctx['questions']->shouldReceive('findByScope')->with(Question::SCOPE_ACCOUNT, Mockery::any())->andReturn([$question]);
+
+        $html = $this->ctx['page']->render([]);
+
+        // No `required` attribute on the account holder's copy, and no marker on
+        // its label — they may leave it blank.
+        self::assertStringContainsString('<input type="text" name="us_answers[7]" id="us-reg-q-7">', $html);
+        self::assertStringContainsString('<label for="us-reg-q-7">Previous experience</label>', $html);
+
+        // The student's copy is marked required, without the attribute: the block
+        // may not be in play at all, so the server is what enforces it.
+        self::assertStringContainsString('<label for="us-child-0-q-7">Previous experience <span class="us-required" aria-hidden="true">*</span></label>', $html);
+        self::assertStringContainsString('<input type="text" name="children[0][answers][7]" id="us-child-0-q-7">', $html);
+    }
+
+    /**
+     * The point of the two flags: an adult signing themselves up can leave the
+     * question blank, while every student they enrol must answer it.
+     */
+    public function testAQuestionOptionalForYouIsStillRequiredOfEachStudent(): void
+    {
+        $_POST = [
+            'password'           => 'thistle-marrow-42',
+            'display_name'       => 'Grace',
+            'birth_year'         => '1990',
+            'us_registering_for' => RegistrationPage::FOR_BOTH,
+            'us_answers'         => ['7' => '  '],
+            'children'           => [['name' => 'Ada', 'birth_year' => '2015', 'answers' => [7 => '  ']]],
+        ];
+
+        $question = new Question(null, 'Instrument', isRequired: false, scope: Question::SCOPE_ACCOUNT, isRequiredChild: true, id: 7);
+        $this->ctx['questions']->shouldReceive('findByScope')->andReturn([$question]);
+        Functions\when('email_exists')->justReturn(false);
+        Functions\expect('wp_insert_user')->never();
+
+        $result = $this->submit(new Invite(email: '[email protected]', token: 'hash'), false);
+
+        // The student's blank is what stopped it — the account holder's was fine.
+        self::assertStringContainsString('for each student', $result);
+    }
+
+    public function testTheAccountHolderMayLeaveBlankWhatTheirStudentsMustAnswer(): void
+    {
+        $_POST = [
+            'password'           => 'thistle-marrow-42',
+            'display_name'       => 'Grace',
+            'birth_year'         => '1990',
+            'us_registering_for' => RegistrationPage::FOR_BOTH,
+            'us_answers'         => ['7' => '  '],
+            'children'           => [['name' => 'Ada', 'birth_year' => '2015', 'answers' => [7 => 'Piano']]],
+        ];
+
+        $question = new Question(null, 'Instrument', isRequired: false, scope: Question::SCOPE_ACCOUNT, isRequiredChild: true, id: 7);
+        $this->ctx['questions']->shouldReceive('findByScope')->andReturn([$question]);
+        $this->ctx['guardians']->shouldReceive('createChild')->once()->andReturn(101);
+        $this->stubInviteSuccess();
+
+        $students = [];
+        $this->ctx['answers']->shouldReceive('insert')->andReturnUsing(
+            static function (Answer $answer) use (&$students): int {
+                $students[] = $answer->studentId;
+                return 1;
+            }
+        );
+
+        self::assertSame('invite', $this->submit(new Invite(email: '[email protected]', token: 'hash'), false));
+
+        // Only the student answered, so only the student has an answer stored.
+        self::assertSame([101], $students);
+    }
+
+    /**
+     * A question the account holder is never shown cannot be one they are held
+     * to, nor one an answer can be filed against them for — a crafted post that
+     * supplies both is ignored on both counts.
+     */
+    public function testAStudentsOnlyQuestionNeitherBlocksNorStoresAgainstTheAccountHolder(): void
+    {
+        $_POST = [
+            'password'           => 'thistle-marrow-42',
+            'display_name'       => 'Grace',
+            'birth_year'         => '1990',
+            'us_registering_for' => RegistrationPage::FOR_BOTH,
+            'us_answers'         => ['7' => 'Crafted by hand'],
+            'children'           => [['name' => 'Ada', 'birth_year' => '2015', 'answers' => [7 => 'Grade 4']]],
+        ];
+
+        $question = new Question(
+            null,
+            'School and grade',
+            isRequired: true,
+            scope: Question::SCOPE_ACCOUNT,
+            audience: Question::AUDIENCE_CHILD,
+            isRequiredChild: true,
+            id: 7
+        );
+        $this->ctx['questions']->shouldReceive('findByScope')->andReturn([$question]);
+        $this->ctx['guardians']->shouldReceive('createChild')->once()->andReturn(101);
+        $this->stubInviteSuccess();
+
+        $recorded = [];
+        $this->ctx['answers']->shouldReceive('insert')->andReturnUsing(
+            static function (Answer $answer) use (&$recorded): int {
+                $recorded[] = [$answer->studentId, $answer->answerValue];
+                return 1;
+            }
+        );
+
+        self::assertSame('invite', $this->submit(new Invite(email: '[email protected]', token: 'hash'), false));
+        self::assertSame([[101, 'Grade 4']], $recorded);
+    }
 }