Add admin actions to the student detail view: cancel, withdraw, edit account

Adds the #70 follow-up onto the student detail page: studio admins can now
cancel an upcoming lesson (same path as student cancellation — slot freed,
pending payment voided), withdraw an active group-class enrolment (seat
freed, pending payment voided), and edit the student's display name and
email with validation and uniqueness checks.

Action logic lives in the new Auth\StudentActions (unit-tested with mocked
repositories); the controller routes nonce-protected POSTs to it and shows
success/error notices.

Closes #70

Co-Authored-By: Claude Fable 5 <[email protected]>

src/Auth/StudentActions.php

@@ -0,0 +1,92 @@
+<?php
+declare(strict_types=1);
+
+namespace Unsupervised\Schedular\Auth;
+
+use Unsupervised\Schedular\Availability\AvailabilityRepository;
+use Unsupervised\Schedular\Booking\BookingRepository;
+use Unsupervised\Schedular\Booking\Lesson;
+use Unsupervised\Schedular\GroupClass\Enrollment;
+use Unsupervised\Schedular\GroupClass\EnrollmentRepository;
+use Unsupervised\Schedular\Payment\PaymentService;
+
+/**
+ * Studio-admin actions on a single student from the student detail view:
+ * cancelling a lesson, withdrawing a group-class enrolment, and editing basic
+ * account details. Mutations go through the same paths as the student-facing
+ * flows so slot release and pending-payment voiding stay consistent.
+ */
+class StudentActions {
+
+	public function __construct(
+		private BookingRepository $bookings,
+		private AvailabilityRepository $availability,
+		private EnrollmentRepository $enrollments,
+		private PaymentService $payments,
+	) {}
+
+	/**
+	 * Cancel a lesson on the student's behalf: marks it cancelled, frees the
+	 * slot for rebooking, and voids a still-pending payment. Paid lessons keep
+	 * their payment — refunds are a manual, admin-side decision.
+	 */
+	public function cancelLesson( int $lessonId, int $studentId ): bool {
+		$lesson = $this->bookings->findById( $lessonId );
+
+		if ( null === $lesson || $lesson->studentId !== $studentId || Lesson::STATUS_CANCELLED === $lesson->status ) {
+			return false;
+		}
+
+		$this->bookings->updateStatus( $lessonId, Lesson::STATUS_CANCELLED );
+		$this->availability->release( $lesson->slotId );
+		$this->payments->voidPending( $lesson->paymentId );
+
+		return true;
+	}
+
+	/**
+	 * Withdraw the student from a group class: marks the active enrolment
+	 * cancelled (freeing its capacity seat) and voids a still-pending payment.
+	 */
+	public function withdrawEnrollment( int $enrollmentId, int $studentId ): bool {
+		$enrollment = $this->enrollments->findById( $enrollmentId );
+
+		if ( null === $enrollment || $enrollment->studentId !== $studentId || Enrollment::STATUS_ACTIVE !== $enrollment->status ) {
+			return false;
+		}
+
+		$this->enrollments->updateStatus( $enrollmentId, Enrollment::STATUS_CANCELLED );
+		$this->payments->voidPending( $enrollment->paymentId );
+
+		return true;
+	}
+
+	/**
+	 * Update the student's display name and email. The email must be valid and
+	 * not belong to another user.
+	 */
+	public function updateAccount( int $studentId, string $displayName, string $email ): bool|\WP_Error {
+		if ( '' === $displayName ) {
+			return new \WP_Error( 'empty_name', __( 'Display name cannot be empty.', 'unsupervised-schedular' ) );
+		}
+
+		if ( ! is_email( $email ) ) {
+			return new \WP_Error( 'invalid_email', __( 'Please enter a valid email address.', 'unsupervised-schedular' ) );
+		}
+
+		$existing = email_exists( $email );
+		if ( false !== $existing && (int) $existing !== $studentId ) {
+			return new \WP_Error( 'email_taken', __( 'Another account already uses this email address.', 'unsupervised-schedular' ) );
+		}
+
+		$result = wp_update_user(
+			[
+				'ID'           => $studentId,
+				'display_name' => $displayName,
+				'user_email'   => $email,
+			]
+		);
+
+		return $result instanceof \WP_Error ? $result : true;
+	}
+}

src/Auth/StudentController.php

@@ -22,6 +22,7 @@ class StudentController {
 		private EnrollmentRepository $enrollments,
 		private BillingMethodResolver $resolver,
 		private StudentHistory $history,
+		private StudentActions $actions,
 	) {}
 
 	public function renderPage(): void {
@@ -66,7 +67,13 @@ class StudentController {
 	private function renderDetail( \WP_User $student ): void {
 		$canBilling = current_user_can( RoleManager::CAP_MANAGE_BILLING );
 
-		if ( $canBilling && isset( $_POST['usc_action'] ) && check_admin_referer( 'usc_student_billing' ) ) {
+		// phpcs:ignore WordPress.Security.NonceVerification.Missing -- routing only; each action below verifies its own nonce.
+		$action = sanitize_key( Val::string( wp_unslash( $_POST['usc_action'] ?? '' ) ) );
+
+		$notice = '';
+		$error  = '';
+
+		if ( $canBilling && 'set_billing' === $action && check_admin_referer( 'usc_student_billing' ) ) {
 			// phpcs:ignore WordPress.Security.NonceVerification.Missing -- nonce checked above.
 			$method = sanitize_key( Val::string( wp_unslash( $_POST['payment_method'] ?? '' ) ) );
 			if ( in_array( $method, Payment::VALID_METHODS, true ) ) {
@@ -76,6 +83,42 @@ class StudentController {
 			}
 		}
 
+		if ( 'update_account' === $action && check_admin_referer( 'usc_student_actions' ) ) {
+			// phpcs:disable WordPress.Security.NonceVerification.Missing -- nonce checked above.
+			$displayName = sanitize_text_field( Val::string( wp_unslash( $_POST['display_name'] ?? '' ) ) );
+			$email       = sanitize_email( Val::string( wp_unslash( $_POST['user_email'] ?? '' ) ) );
+			// phpcs:enable WordPress.Security.NonceVerification.Missing
+
+			$result = $this->actions->updateAccount( (int) $student->ID, $displayName, $email );
+			if ( $result instanceof \WP_Error ) {
+				$error = $result->get_error_message();
+			} else {
+				$notice  = __( 'Account details updated.', 'unsupervised-schedular' );
+				$fresh   = get_userdata( (int) $student->ID );
+				$student = $fresh instanceof \WP_User ? $fresh : $student;
+			}
+		}
+
+		if ( 'cancel_lesson' === $action && check_admin_referer( 'usc_student_actions' ) ) {
+			// phpcs:ignore WordPress.Security.NonceVerification.Missing -- nonce checked above.
+			$lessonId = absint( Val::int( $_POST['lesson_id'] ?? 0 ) );
+			if ( $this->actions->cancelLesson( $lessonId, (int) $student->ID ) ) {
+				$notice = __( 'Lesson cancelled.', 'unsupervised-schedular' );
+			} else {
+				$error = __( 'This lesson could not be cancelled.', 'unsupervised-schedular' );
+			}
+		}
+
+		if ( 'withdraw_enrollment' === $action && check_admin_referer( 'usc_student_actions' ) ) {
+			// phpcs:ignore WordPress.Security.NonceVerification.Missing -- nonce checked above.
+			$enrollmentId = absint( Val::int( $_POST['enrollment_id'] ?? 0 ) );
+			if ( $this->actions->withdrawEnrollment( $enrollmentId, (int) $student->ID ) ) {
+				$notice = __( 'Enrolment withdrawn.', 'unsupervised-schedular' );
+			} else {
+				$error = __( 'This enrolment could not be withdrawn.', 'unsupervised-schedular' );
+			}
+		}
+
 		$billingOverride = Val::string( get_user_meta( (int) $student->ID, BillingMethodResolver::META_METHOD, true ) );
 		$billingDefault  = $this->resolver->defaultMethod();
 
@@ -94,6 +137,7 @@ class StudentController {
 				$offering = $this->offerings->findById( $enrollment->offeringId );
 
 				return [
+					'id'       => (int) $enrollment->id,
 					'offering' => $offering ? $offering->title : (string) $enrollment->offeringId,
 					'status'   => $enrollment->status,
 				];
@@ -120,6 +164,7 @@ class StudentController {
 		$instructor = get_userdata( $lesson->instructorId );
 
 		return [
+			'id'         => (int) $lesson->id,
 			'start_dt'   => $slot ? $slot->startDt : '',
 			'end_dt'     => $slot ? $slot->endDt : '',
 			'offering'   => $offering ? $offering->title : '—',