Let parents register once and book for their children

A parent registers once and manages lessons for one or more children, who
need no login of their own. A child is a real wp_users row with the student
role but no usable login — so student_id keeps meaning "a WordPress user"
on every table, and booking, credits, policies and enrolments work unchanged.
A us_guardians link table maps guardian to child.

The signup form gains a parent/guardian tick that reveals a block per child,
with the account-signup questions asked per child rather than per guardian
— they describe the student, not the account holder. Signup policies are
recorded once per child with the guardian as the acceptor, which is the
record that actually means something. A family that half-creates is rolled
back entirely rather than leaving a guardian who cannot re-register.

The booking and enrolment forms gain a "Who is this for?" picker listing
children first, so the default selection is never the parent — booking for
the wrong child is correctable, quietly billing a parent for their kid's
lesson is not. POST /bookings and POST /enrollments take an optional
student_id honoured only for that child's guardian; anything else is a 403.
That check is the authorisation boundary of the feature.

Payments and credits gain a payer: the charge names the child it was for and
the guardian who owes it, so per-child reporting is unchanged while notices,
receipts and the payment step reach the parent. Credit is held by the payer,
so one child's cancellation can settle a sibling's charge, and the daily
billing scan sends a guardian one notice covering every child.

Closes #132

Co-Authored-By: Claude Opus 5 <[email protected]>

tests/Unit/Auth/RegistrationPageTest.php

@@ -10,9 +10,11 @@ use Unsupervised\Schedular\Auth\InviteRepository;
 use Unsupervised\Schedular\Auth\RegistrationMailer;
 use Unsupervised\Schedular\Auth\RegistrationPage;
 use Unsupervised\Schedular\GroupClass\GroupAccessRepository;
+use Unsupervised\Schedular\Guardian\GuardianService;
 use Unsupervised\Schedular\Payment\StudioSettings;
 use Unsupervised\Schedular\Policy\AcceptanceRepository;
 use Unsupervised\Schedular\Policy\Policy;
+use Unsupervised\Schedular\Policy\PolicyAcceptance;
 use Unsupervised\Schedular\Policy\PolicyRepository;
 use Unsupervised\Schedular\Policy\PolicyVersion;
 use Unsupervised\Schedular\Policy\PolicyVersionRepository;
@@ -63,6 +65,7 @@ class RegistrationPageTest extends TestCase
 
         $this->ctx['versions']    = Mockery::mock(PolicyVersionRepository::class);
         $this->ctx['acceptances'] = Mockery::mock(AcceptanceRepository::class);
+        $this->ctx['guardians']   = Mockery::mock(GuardianService::class);
 
         $this->ctx['page'] = new RegistrationPage(
             $invites,
@@ -74,6 +77,7 @@ class RegistrationPageTest extends TestCase
             $questions,
             $answers,
             $access,
+            $this->ctx['guardians'],
         );
 
         $_POST = [];
@@ -444,6 +448,7 @@ class RegistrationPageTest extends TestCase
                 $this->ctx['questions'],
                 $this->ctx['answers'],
                 $this->ctx['access'],
+                $this->ctx['guardians'],
             ]
         )->makePartial()->shouldAllowMockingProtectedMethods();
 
@@ -600,4 +605,192 @@ class RegistrationPageTest extends TestCase
         self::assertStringContainsString('Ask the front desk for a link.', $html);
         self::assertStringNotContainsString('by invitation only', $html);
     }
+
+    /**
+     * A guardian's signup creates one login-less child per filled block, links
+     * them, and records each child's answers against the child rather than the
+     * account holder — the questions describe the student, not the parent.
+     */
+    public function testGuardianSignupCreatesEachChildAndRecordsTheirAnswers(): void
+    {
+        $_POST = [
+            'password'       => 'password123',
+            'display_name'   => 'Grace',
+            'us_is_guardian' => '1',
+            'children'       => [
+                ['name' => 'Ada', 'dob' => '2015-04-02', 'answers' => [7 => 'Piano']],
+                ['name' => 'Alan', 'dob' => '', 'answers' => [7 => 'Violin']],
+                // An untouched spare block is dropped, not rejected.
+                ['name' => '  ', 'dob' => '', 'answers' => []],
+            ],
+        ];
+
+        $this->ctx['questions']->shouldReceive('findByScope')->andReturn([
+            new Question(offeringId: null, label: 'Instrument', isRequired: true, scope: Question::SCOPE_ACCOUNT, id: 7),
+        ]);
+
+        Functions\when('email_exists')->justReturn(false);
+        Functions\when('wp_insert_user')->justReturn(42);
+        Functions\when('is_wp_error')->alias(static fn ($thing): bool => $thing instanceof \WP_Error);
+
+        $this->ctx['guardians']->shouldReceive('createChild')->once()->with(42, 'Ada', '2015-04-02')->andReturn(101);
+        $this->ctx['guardians']->shouldReceive('createChild')->once()->with(42, 'Alan', '')->andReturn(102);
+
+        $recorded = [];
+        $this->ctx['answers']->shouldReceive('insert')->andReturnUsing(
+            static function (Answer $a) use (&$recorded): int {
+                $recorded[] = [$a->studentId, $a->answerValue];
+                return 1;
+            }
+        );
+
+        $this->ctx['invites']->shouldReceive('markAccepted')->once();
+        Functions\expect('wp_set_current_user')->once()->with(42);
+        Functions\expect('wp_set_auth_cookie')->once()->with(42);
+
+        self::assertSame('invite', $this->submit(new Invite(email: '[email protected]', token: 'hash'), false));
+        self::assertSame([[101, 'Piano'], [102, 'Violin']], $recorded);
+    }
+
+    public function testGuardianSignupWithNoChildrenIsRejected(): void
+    {
+        $_POST = [
+            'password'       => 'password123',
+            'display_name'   => 'Grace',
+            'us_is_guardian' => '1',
+            'children'       => [['name' => '', 'dob' => '', 'answers' => []]],
+        ];
+
+        Functions\when('email_exists')->justReturn(false);
+        Functions\expect('wp_insert_user')->never();
+        $this->ctx['guardians']->shouldNotReceive('createChild');
+
+        $result = $this->submit(new Invite(email: '[email protected]', token: 'hash'), false);
+
+        self::assertStringContainsString('at least one child', $result);
+    }
+
+    /**
+     * Required per-child answers are validated before any user exists, so a
+     * missing one never leaves a half-registered family behind.
+     */
+    public function testGuardianSignupRejectsAChildMissingARequiredAnswer(): void
+    {
+        $_POST = [
+            'password'       => 'password123',
+            'display_name'   => 'Grace',
+            'us_is_guardian' => '1',
+            'children'       => [
+                ['name' => 'Ada', 'dob' => '', 'answers' => [7 => 'Piano']],
+                ['name' => 'Alan', 'dob' => '', 'answers' => [7 => '  ']],
+            ],
+        ];
+
+        $this->ctx['questions']->shouldReceive('findByScope')->andReturn([
+            new Question(offeringId: null, label: 'Instrument', isRequired: true, scope: Question::SCOPE_ACCOUNT, id: 7),
+        ]);
+
+        Functions\when('email_exists')->justReturn(false);
+        Functions\expect('wp_insert_user')->never();
+        $this->ctx['guardians']->shouldNotReceive('createChild');
+
+        self::assertStringContainsString('for each child', $this->submit(new Invite(email: '[email protected]', token: 'hash'), false));
+    }
+
+    /**
+     * A family that half-created would leave the guardian unable to re-register
+     * and their children unconfirmed, so the whole signup is undone.
+     */
+    public function testAFailedChildRollsBackEveryUserCreatedIncludingTheGuardian(): void
+    {
+        $_POST = [
+            'password'       => 'password123',
+            'display_name'   => 'Grace',
+            'us_is_guardian' => '1',
+            'children'       => [
+                ['name' => 'Ada', 'dob' => '', 'answers' => []],
+                ['name' => 'Alan', 'dob' => '', 'answers' => []],
+            ],
+        ];
+
+        Functions\when('email_exists')->justReturn(false);
+        Functions\when('wp_insert_user')->justReturn(42);
+        Functions\when('is_wp_error')->alias(static fn ($thing): bool => $thing instanceof \WP_Error);
+
+        $this->ctx['guardians']->shouldReceive('createChild')->once()->with(42, 'Ada', '')->andReturn(101);
+        $this->ctx['guardians']->shouldReceive('createChild')->once()->with(42, 'Alan', '')
+            ->andReturn(new \WP_Error('link_failed', 'Nope.'));
+
+        $deleted = [];
+        $this->ctx['guardians']->shouldReceive('deleteUser')->andReturnUsing(
+            static function (int $id) use (&$deleted): void {
+                $deleted[] = $id;
+            }
+        );
+
+        $result = $this->submit(new Invite(email: '[email protected]', token: 'hash'), false);
+
+        self::assertStringContainsString('Could not create the account', $result);
+        self::assertSame([101, 42], $deleted);
+    }
+
+    /**
+     * The child is who the policy binds; the guardian is who agreed. Both are
+     * recorded, which is what makes the acceptance legally meaningful.
+     */
+    public function testSignupPoliciesAreAcceptedPerChildAndAttributedToTheGuardian(): void
+    {
+        $_POST = [
+            'password'       => 'password123',
+            'display_name'   => 'Grace',
+            'us_is_guardian' => '1',
+            'accept'         => [3],
+            'children'       => [['name' => 'Ada', 'dob' => '', 'answers' => []]],
+        ];
+
+        $version = new PolicyVersion(policyId: 1, versionNumber: 1, body: 'Terms', status: PolicyVersion::STATUS_PUBLISHED, id: 3);
+        $this->ctx['policies']->shouldReceive('findForScope')->andReturn([
+            new Policy(title: 'Studio Terms', slug: 'terms', currentVersionId: 3, id: 1),
+        ]);
+        $this->ctx['versions']->shouldReceive('findById')->with(3)->andReturn($version);
+
+        Functions\when('email_exists')->justReturn(false);
+        Functions\when('wp_insert_user')->justReturn(42);
+        Functions\when('is_wp_error')->alias(static fn ($thing): bool => $thing instanceof \WP_Error);
+
+        $this->ctx['guardians']->shouldReceive('createChild')->once()->andReturn(101);
+
+        $recorded = [];
+        $this->ctx['acceptances']->shouldReceive('insert')->andReturnUsing(
+            static function (PolicyAcceptance $a) use (&$recorded): int {
+                $recorded[] = [$a->studentId, $a->acceptedBy];
+                return 1;
+            }
+        );
+
+        $this->ctx['invites']->shouldReceive('markAccepted')->once();
+        Functions\expect('wp_set_current_user')->once();
+        Functions\expect('wp_set_auth_cookie')->once();
+
+        self::assertSame('invite', $this->submit(new Invite(email: '[email protected]', token: 'hash'), false));
+
+        // The guardian agreed for themselves as an account holder, and for the child.
+        self::assertSame([[42, 42], [101, 42]], $recorded);
+    }
+
+    public function testANonGuardianSignupIsUnchangedAndCreatesNoChildren(): void
+    {
+        $_POST = ['password' => 'password123', 'display_name' => 'Ada'];
+
+        Functions\when('email_exists')->justReturn(false);
+        Functions\when('wp_insert_user')->justReturn(42);
+        Functions\when('is_wp_error')->justReturn(false);
+
+        $this->ctx['guardians']->shouldNotReceive('createChild');
+        $this->ctx['invites']->shouldReceive('markAccepted')->once();
+        Functions\expect('wp_set_current_user')->once();
+        Functions\expect('wp_set_auth_cookie')->once();
+
+        self::assertSame('invite', $this->submit(new Invite(email: '[email protected]', token: 'hash'), false));
+    }
 }

tests/Unit/Auth/StudentHistoryTest.php

@@ -58,7 +58,7 @@ class StudentHistoryTest extends TestCase
     public function testPolicyAcceptancesResolvePolicyTitleAndVersion(): void
     {
         $this->acceptances->shouldReceive('findByStudent')->once()->with(5)->andReturn([
-            new PolicyAcceptance(9, 5, PolicyAcceptance::REG_ACCOUNT, 5, null, '2026-06-02 09:00:00', 1),
+            new PolicyAcceptance(9, 5, PolicyAcceptance::REG_ACCOUNT, 5, ipAddress: null, acceptedAt: '2026-06-02 09:00:00', id: 1),
         ]);
         $this->policyVersions->shouldReceive('findById')->with(9)
             ->andReturn(new PolicyVersion(2, 3, null, PolicyVersion::STATUS_PUBLISHED, id: 9));
@@ -177,9 +177,9 @@ class StudentHistoryTest extends TestCase
                 Payment::REG_LESSON,
                 12,
                 100.00,
-                'CAD',
-                Payment::METHOD_CARD,
-                Payment::STATUS_PAID,
+                currency: 'CAD',
+                method: Payment::METHOD_CARD,
+                status: Payment::STATUS_PAID,
                 taxRate: 13.0,
                 taxAmount: 13.00,
                 receiptNumber: 'USC-7',
@@ -231,7 +231,7 @@ class StudentHistoryTest extends TestCase
     public function testCreditsBuildDisplayRows(): void
     {
         $this->credits->shouldReceive('findByStudent')->once()->with(5)->andReturn([
-            new Credit(5, 33.00, 13.00, 'CAD', 12, 77, 'Credit for cancelled lesson #77', Credit::STATUS_AVAILABLE, '2026-07-01 09:00:00', id: 300),
+            new Credit(5, 33.00, 13.00, currency: 'CAD', sourcePaymentId: 12, sourceLessonId: 77, reason: 'Credit for cancelled lesson #77', status: Credit::STATUS_AVAILABLE, createdAt: '2026-07-01 09:00:00', id: 300),
         ]);
 
         $rows = $this->history->credits(5);