Let the studio register the students who cannot register themselves

The Book a lesson for a student panel built its picker from the us_student role but vetted the submission with the book_lesson capability. ChildLoginGate and RegistrationLoginGate withhold that capability from accounts that keep the role, so the panel offered every guardian-managed child and every unapproved signup and then refused them — with a message claiming no student had been chosen, and a form cleared of all five fields. Withholding book_lesson stops those accounts registering in their own name. It was never meant to stop the studio acting for them, which is what the panel is for, and for a child is the only route to a lesson besides their guardian. Guard the student role instead, via a new RoleManager::isStudent() shared with every picker and guard on the staff side so the two cannot drift apart again. Group enrolment gets the same predicate: addDirect() and grantAccess() vetted their posted ids not at all, and would enrol an instructor, an administrator, or an account deleted since the page was drawn — raising a real payment against them for a priced class. Keep a refused booking's fields as submitted, reading the form through one LessonController::submittedBooking() so what gets booked and what is shown again cannot disagree about a field name. A booking that succeeds still leaves an empty form, so the next one does not inherit it. Closes #185 Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01XunBYk2sFEc1oL14sUiuBU
2026-08-24 18:42:59 -03:00
parent 76530878b5
commit 5ce42f0003
12 changed files with 371 additions and 31 deletions
@@ -177,7 +177,7 @@ class LessonController {
 	 *
 	 * @param list<array<string, mixed>> $rows
 	 */
-	// phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter -- $notice and $error are read by the included template.
+	// phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter -- $notice is read by the included template.
 	private function renderLessonsPage( array $rows, string $pageSlug, int $onlyInstructorId, string $notice, string $error ): void {
 		// View-state query params only (which view, which week) — nothing is
 		// mutated from them, so no nonce applies.
@@ -193,6 +193,11 @@ class LessonController {
 		$baseUrl   = admin_url( 'admin.php?page=' . $pageSlug );
 		$bookForm  = $this->adminBooking->formData( $onlyInstructorId );

+		// A refused booking is shown again as it was typed — losing five fields to a
+		// single mistake is what made the panel infuriating to correct. A successful
+		// one starts empty, so the next booking does not inherit the last one's.
+		$bookValues = '' !== $error ? $this->submittedBooking() : $this->emptyBooking();
+
 		include USC_PLUGIN_DIR . 'templates/admin/lessons.php';
 	}

@@ -229,23 +234,59 @@ class LessonController {
 	 * @return array{string, string}
 	 */
 	private function bookForStudent( int $onlyInstructorId ): array {
-		// phpcs:disable WordPress.Security.NonceVerification.Missing -- nonce checked by the caller.
+		$submitted = $this->submittedBooking();
+
 		$result = $this->adminBooking->book(
-			absint( Val::int( $_POST['student_id'] ?? 0 ) ),
-			absint( Val::int( $_POST['slot_id'] ?? 0 ) ),
-			absint( Val::int( $_POST['offering_id'] ?? 0 ) ),
-			isset( $_POST['recurrence_weekly'] ) ? Lesson::RECURRENCE_WEEKLY : Lesson::RECURRENCE_SINGLE,
-			isset( $_POST['no_charge'] ),
-			sanitize_text_field( Val::string( wp_unslash( $_POST['notes'] ?? '' ) ) ),
+			$submitted['student_id'],
+			$submitted['slot_id'],
+			$submitted['offering_id'],
+			$submitted['weekly'] ? Lesson::RECURRENCE_WEEKLY : Lesson::RECURRENCE_SINGLE,
+			$submitted['no_charge'],
+			$submitted['notes'],
 			$onlyInstructorId
 		);
-		// phpcs:enable WordPress.Security.NonceVerification.Missing

 		return $result instanceof \WP_Error
 			? [ '', $result->get_error_message() ]
 			: [ $result, '' ];
 	}

+	/**
+	 * The book-for-a-student form exactly as submitted. Read in one place so what
+	 * gets booked and what the form shows again after a refusal cannot drift apart
+	 * on a field name.
+	 *
+	 * @return array{student_id: int, slot_id: int, offering_id: int, weekly: bool, no_charge: bool, notes: string}
+	 */
+	private function submittedBooking(): array {
+		// phpcs:disable WordPress.Security.NonceVerification.Missing -- read only after handleFormAction() has verified the nonce: to book, or to re-render (escaped) a form it refused.
+		return [
+			'student_id'  => absint( Val::int( $_POST['student_id'] ?? 0 ) ),
+			'slot_id'     => absint( Val::int( $_POST['slot_id'] ?? 0 ) ),
+			'offering_id' => absint( Val::int( $_POST['offering_id'] ?? 0 ) ),
+			'weekly'      => isset( $_POST['recurrence_weekly'] ),
+			'no_charge'   => isset( $_POST['no_charge'] ),
+			'notes'       => sanitize_text_field( Val::string( wp_unslash( $_POST['notes'] ?? '' ) ) ),
+		];
+		// phpcs:enable WordPress.Security.NonceVerification.Missing
+	}
+
+	/**
+	 * An untouched book-for-a-student form.
+	 *
+	 * @return array{student_id: int, slot_id: int, offering_id: int, weekly: bool, no_charge: bool, notes: string}
+	 */
+	private function emptyBooking(): array {
+		return [
+			'student_id'  => 0,
+			'slot_id'     => 0,
+			'offering_id' => 0,
+			'weekly'      => false,
+			'no_charge'   => false,
+			'notes'       => '',
+		];
+	}
+
 	/**
 	 * Apply a per-lesson payment override. When $onlyOwn, the payment must belong
 	 * to the current instructor.