Let parents register once and book for their children

A parent registers once and manages lessons for one or more children, who
need no login of their own. A child is a real wp_users row with the student
role but no usable login — so student_id keeps meaning "a WordPress user"
on every table, and booking, credits, policies and enrolments work unchanged.
A us_guardians link table maps guardian to child.

The signup form gains a parent/guardian tick that reveals a block per child,
with the account-signup questions asked per child rather than per guardian
— they describe the student, not the account holder. Signup policies are
recorded once per child with the guardian as the acceptor, which is the
record that actually means something. A family that half-creates is rolled
back entirely rather than leaving a guardian who cannot re-register.

The booking and enrolment forms gain a "Who is this for?" picker listing
children first, so the default selection is never the parent — booking for
the wrong child is correctable, quietly billing a parent for their kid's
lesson is not. POST /bookings and POST /enrollments take an optional
student_id honoured only for that child's guardian; anything else is a 403.
That check is the authorisation boundary of the feature.

Payments and credits gain a payer: the charge names the child it was for and
the guardian who owes it, so per-child reporting is unchanged while notices,
receipts and the payment step reach the parent. Credit is held by the payer,
so one child's cancellation can settle a sibling's charge, and the daily
billing scan sends a guardian one notice covering every child.

Closes #132

Co-Authored-By: Claude Opus 5 <[email protected]>

tests/Unit/GroupClass/EnrollmentEndpointTest.php

@@ -9,15 +9,18 @@ use Unsupervised\Schedular\GroupClass\Enrollment;
 use Unsupervised\Schedular\GroupClass\EnrollmentEndpoint;
 use Unsupervised\Schedular\GroupClass\EnrollmentRepository;
 use Unsupervised\Schedular\GroupClass\GroupAccessRepository;
+use Unsupervised\Schedular\Guardian\GuardianService;
 use Unsupervised\Schedular\Offering\Offering;
 use Unsupervised\Schedular\Offering\OfferingRepository;
 use Unsupervised\Schedular\Payment\Payment;
 use Unsupervised\Schedular\Payment\PaymentService;
+use Unsupervised\Schedular\Policy\PolicyAcceptance;
 use Unsupervised\Schedular\Registration\RegistrationGate;
 use Unsupervised\Schedular\Tests\Unit\TestCase;
 
 class EnrollmentEndpointTest extends TestCase
 {
+    private GuardianService&Mockery\MockInterface $guardians;
     private EnrollmentRepository $enrollments;
     private OfferingRepository $offerings;
     private RegistrationGate $gate;
@@ -41,12 +44,19 @@ class EnrollmentEndpointTest extends TestCase
         $this->payments    = Mockery::mock(PaymentService::class);
         $this->access      = Mockery::mock(GroupAccessRepository::class);
 
+        $this->guardians = Mockery::mock(GuardianService::class);
+        $this->guardians->shouldReceive('canActFor')
+            ->andReturnUsing(static fn (int $actor, int $student): bool => $actor === $student)->byDefault();
+        $this->guardians->shouldReceive('payerFor')->andReturnUsing(static fn (int $id): int => $id)->byDefault();
+        $this->guardians->shouldReceive('householdIds')->andReturnUsing(static fn (int $id): array => [$id])->byDefault();
+
         $this->endpoint = new EnrollmentEndpoint(
             $this->enrollments,
             $this->offerings,
             $this->gate,
             $this->payments,
             $this->access,
+            $this->guardians,
         );
     }
 
@@ -89,7 +99,7 @@ class EnrollmentEndpointTest extends TestCase
         $this->expectSuccessfulEnrollment();
         $this->payments->shouldReceive('createForRegistration')
             ->once()
-            ->with(Payment::REG_ENROLLMENT, 44, 5, 3, 120.0, 'CAD', null)
+            ->with(Payment::REG_ENROLLMENT, 44, 5, 3, 120.0, 'CAD', null, null, null, 5)
             ->andReturn(new Payment(
                 studentId:        5,
                 instructorId:     3,
@@ -252,4 +262,82 @@ class EnrollmentEndpointTest extends TestCase
         self::assertSame(200, $result->get_status());
         self::assertSame(Enrollment::STATUS_CANCELLED, $result->get_data()['status']);
     }
+
+    /**
+     * The same boundary as booking: a student id the caller may not act for is
+     * a 403, never a silent fallback that enrols the wrong person.
+     */
+    public function testEnrolForAStudentTheCallerDoesNotGuardIsForbidden(): void
+    {
+        $this->guardians->shouldReceive('canActFor')->with(5, 99)->andReturn(false);
+
+        $this->offerings->shouldNotReceive('findById');
+        $this->enrollments->shouldNotReceive('insert');
+        $this->payments->shouldNotReceive('createForRegistration');
+
+        $request = new \WP_REST_Request(['offering_id' => 8, 'student_id' => 99]);
+        $result  = $this->endpoint->enroll($request);
+
+        self::assertInstanceOf(\WP_Error::class, $result);
+        self::assertSame('forbidden', $result->get_error_code());
+    }
+
+    public function testGuardianEnrolsTheChildAndIsBilledForIt(): void
+    {
+        $this->guardians->shouldReceive('canActFor')->with(5, 42)->andReturn(true);
+        $this->guardians->shouldReceive('payerFor')->with(42)->andReturn(5);
+
+        $this->offerings->shouldReceive('findById')->with(8)->andReturn($this->offering(120.0));
+        $this->enrollments->shouldReceive('hasActiveEnrollment')->with(8, 42)->andReturn(false);
+        $this->enrollments->shouldReceive('countActiveForOffering')->andReturn(0);
+        $this->gate->shouldReceive('validate')->andReturn(null);
+
+        $this->enrollments->shouldReceive('insert')
+            ->once()
+            ->with(Mockery::on(static fn (Enrollment $e): bool => $e->studentId === 42))
+            ->andReturn(44);
+
+        $this->gate->shouldReceive('record')
+            ->once()
+            ->with(PolicyAcceptance::REG_ENROLLMENT, 44, 42, 8, Mockery::any(), Mockery::any(), Mockery::any(), 5);
+
+        $this->payments->shouldReceive('createForRegistration')
+            ->once()
+            ->with(Payment::REG_ENROLLMENT, 44, 42, 3, 120.0, 'CAD', null, null, null, 5)
+            ->andReturn(new Payment(42, 3, Payment::REG_ENROLLMENT, 44, 120.0, payerId: 5, currency: 'CAD', method: Payment::METHOD_ETRANSFER, status: Payment::STATUS_PENDING, id: 12));
+
+        $result = $this->endpoint->enroll(new \WP_REST_Request(['offering_id' => 8, 'student_id' => 42]));
+
+        self::assertInstanceOf(\WP_REST_Response::class, $result);
+        self::assertSame(201, $result->get_status());
+    }
+
+    public function testGuardianMayWithdrawTheirChild(): void
+    {
+        $this->guardians->shouldReceive('canActFor')->with(5, 42)->andReturn(true);
+
+        $enrollment = new Enrollment(offeringId: 8, studentId: 42, instructorId: 3, status: Enrollment::STATUS_ACTIVE, id: 44);
+        $this->enrollments->shouldReceive('findById')->with(44)->andReturn($enrollment);
+        $this->offerings->shouldReceive('findById')->with(8)->andReturn($this->offering(0.0));
+        $this->enrollments->shouldReceive('updateStatus')->once()->with(44, Enrollment::STATUS_CANCELLED)->andReturn(true);
+        $this->payments->shouldReceive('voidPending')->once();
+
+        self::assertInstanceOf(\WP_REST_Response::class, $this->endpoint->withdraw(new \WP_REST_Request(['id' => 44])));
+    }
+
+    public function testIndexCoversTheWholeHouseholdForAGuardian(): void
+    {
+        Functions\when('current_user_can')->justReturn(false);
+
+        $this->guardians->shouldReceive('householdIds')->with(5)->andReturn([5, 42]);
+        $this->enrollments->shouldReceive('findByStudent')->with(5)->andReturn([]);
+        $this->enrollments->shouldReceive('findByStudent')->with(42)->andReturn([
+            new Enrollment(offeringId: 8, studentId: 42, instructorId: 3, id: 44),
+        ]);
+
+        $data = $this->endpoint->index(new \WP_REST_Request([]))->get_data();
+
+        self::assertCount(1, $data);
+        self::assertSame(42, $data[0]['student_id']);
+    }
 }

tests/Unit/GroupClass/GroupClassPageTest.php

@@ -4,20 +4,29 @@ declare(strict_types=1);
 namespace Unsupervised\Schedular\Tests\Unit\GroupClass;
 
 use Brain\Monkey\Functions;
+use Mockery;
 use Unsupervised\Schedular\GroupClass\GroupClassPage;
+use Unsupervised\Schedular\Guardian\GuardianService;
 use Unsupervised\Schedular\Tests\Unit\TestCase;
 
 class GroupClassPageTest extends TestCase
 {
     private GroupClassPage $page;
+    private GuardianService&Mockery\MockInterface $guardians;
 
     protected function setUp(): void
     {
         parent::setUp();
 
-        $this->page = new GroupClassPage();
+        $this->guardians = Mockery::mock(GuardianService::class);
+        $this->guardians->shouldReceive('bookableStudents')->andReturn(
+            [['id' => 3, 'name' => 'Ada', 'is_self' => true]]
+        )->byDefault();
+
+        $this->page = new GroupClassPage($this->guardians);
 
         Functions\when('is_user_logged_in')->justReturn(true);
+        Functions\when('get_current_user_id')->justReturn(3);
         Functions\when('current_user_can')->justReturn(true);
         Functions\when('wp_enqueue_style')->justReturn(null);
         Functions\when('wp_enqueue_script')->justReturn(null);