Let parents register once and book for their children

A parent registers once and manages lessons for one or more children, who
need no login of their own. A child is a real wp_users row with the student
role but no usable login — so student_id keeps meaning "a WordPress user"
on every table, and booking, credits, policies and enrolments work unchanged.
A us_guardians link table maps guardian to child.

The signup form gains a parent/guardian tick that reveals a block per child,
with the account-signup questions asked per child rather than per guardian
— they describe the student, not the account holder. Signup policies are
recorded once per child with the guardian as the acceptor, which is the
record that actually means something. A family that half-creates is rolled
back entirely rather than leaving a guardian who cannot re-register.

The booking and enrolment forms gain a "Who is this for?" picker listing
children first, so the default selection is never the parent — booking for
the wrong child is correctable, quietly billing a parent for their kid's
lesson is not. POST /bookings and POST /enrollments take an optional
student_id honoured only for that child's guardian; anything else is a 403.
That check is the authorisation boundary of the feature.

Payments and credits gain a payer: the charge names the child it was for and
the guardian who owes it, so per-child reporting is unchanged while notices,
receipts and the payment step reach the parent. Credit is held by the payer,
so one child's cancellation can settle a sibling's charge, and the daily
billing scan sends a guardian one notice covering every child.

Closes #132

Co-Authored-By: Claude Opus 5 <[email protected]>

tests/Unit/Guardian/GuardianRepositoryTest.php

@@ -0,0 +1,126 @@
+<?php
+declare(strict_types=1);
+
+namespace Unsupervised\Schedular\Tests\Unit\Guardian;
+
+use Brain\Monkey\Functions;
+use Mockery;
+use Unsupervised\Schedular\Guardian\GuardianLink;
+use Unsupervised\Schedular\Guardian\GuardianRepository;
+use Unsupervised\Schedular\Tests\Unit\TestCase;
+
+class GuardianRepositoryTest extends TestCase
+{
+    private \wpdb $db;
+    private GuardianRepository $repo;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        $this->db         = Mockery::mock(\wpdb::class);
+        $this->db->prefix = 'wp_';
+        $this->repo       = new GuardianRepository($this->db);
+
+        $this->db->shouldReceive('prepare')->andReturnUsing(
+            static fn (string $sql, ...$args): string => $sql . '|' . implode(',', $args)
+        )->byDefault();
+    }
+
+    public function testInsertStoresTheLinkAndReturnsId(): void
+    {
+        Functions\expect('current_time')->with('mysql')->andReturn('2026-07-29 09:00:00');
+
+        $this->db->shouldReceive('get_row')->once()->andReturn(null);
+        $this->db->shouldReceive('insert')
+            ->once()
+            ->with(
+                'wp_us_guardians',
+                [
+                    'guardian_id'  => 5,
+                    'student_id'   => 42,
+                    'relationship' => 'Parent',
+                    'created_at'   => '2026-07-29 09:00:00',
+                ],
+                ['%d', '%d', '%s', '%s']
+            );
+        $this->db->insert_id = 7;
+
+        self::assertSame(7, $this->repo->insert(new GuardianLink(5, 42, 'Parent')));
+    }
+
+    /**
+     * v1 is one guardian per child. The check lives in the repository so every
+     * caller — signup, the family screen, admin — gets it without repeating it.
+     */
+    public function testInsertRefusesAChildThatAlreadyHasAGuardian(): void
+    {
+        $this->db->shouldReceive('get_row')->once()->andReturn((object) [
+            'id'           => 1,
+            'guardian_id'  => 9,
+            'student_id'   => 42,
+            'relationship' => '',
+            'created_at'   => '2026-07-01 09:00:00',
+        ]);
+        $this->db->shouldNotReceive('insert');
+
+        self::assertSame(0, $this->repo->insert(new GuardianLink(5, 42)));
+    }
+
+    public function testFindByStudentReturnsNullWhenTheyBookForThemselves(): void
+    {
+        $this->db->shouldReceive('get_row')->once()->andReturn(null);
+
+        self::assertNull($this->repo->findByStudent(42));
+    }
+
+    public function testFindByGuardianMapsEveryRow(): void
+    {
+        $this->db->shouldReceive('get_results')->once()->andReturn([
+            (object) ['id' => 1, 'guardian_id' => 5, 'student_id' => 42, 'relationship' => '', 'created_at' => '2026-07-01 09:00:00'],
+            (object) ['id' => 2, 'guardian_id' => 5, 'student_id' => 43, 'relationship' => '', 'created_at' => '2026-07-02 09:00:00'],
+        ]);
+
+        $links = $this->repo->findByGuardian(5);
+
+        self::assertCount(2, $links);
+        self::assertSame([42, 43], array_map(static fn (GuardianLink $l): int => $l->studentId, $links));
+    }
+
+    public function testFindByGuardianReturnsAnEmptyListWhenTheQueryReturnsNull(): void
+    {
+        $this->db->shouldReceive('get_results')->once()->andReturn(null);
+
+        self::assertSame([], $this->repo->findByGuardian(5));
+    }
+
+    public function testIsGuardianOfIsTrueOnlyForALinkedPair(): void
+    {
+        $this->db->shouldReceive('get_var')->once()->andReturn('1');
+        self::assertTrue($this->repo->isGuardianOf(5, 42));
+
+        $this->db->shouldReceive('get_var')->once()->andReturn(null);
+        self::assertFalse($this->repo->isGuardianOf(5, 99));
+    }
+
+    public function testDeleteReportsWhetherARowWasRemoved(): void
+    {
+        $this->db->shouldReceive('delete')
+            ->once()
+            ->with('wp_us_guardians', ['guardian_id' => 5, 'student_id' => 42], ['%d', '%d'])
+            ->andReturn(1);
+
+        self::assertTrue($this->repo->delete(5, 42));
+
+        $this->db->shouldReceive('delete')->once()->andReturn(0);
+
+        self::assertFalse($this->repo->delete(5, 99));
+    }
+
+    public function testCountChildrenReturnsAnInt(): void
+    {
+        $this->db->shouldReceive('get_var')->once()->andReturn('2');
+
+        self::assertSame(2, $this->repo->countChildren(5));
+    }
+}