Add open student registration with email confirmation and approval

Students could previously join by invite only. Add an optional
self-approval mode, toggled from Studio Settings → Registration: anyone
may sign up on the existing [us_student_register] page, confirm their
email via a tokenised link, and then be approved by a studio admin
before the account is usable.

- Enabling the toggle mirrors WordPress's own membership settings
  (users_can_register + default_role = us_student) and snapshots their
  previous values so disabling restores them.
- WordPress's native registration form is blocked while open
  registration is on (login_init redirect + registration_errors
  fail-safe + register_url) so it cannot bypass signup policy acceptance.
- Pending accounts: unconfirmed email cannot log in; confirmed but
  unapproved can log in but the booking capability is withheld and the
  booking page shows an "awaiting approval" screen.
- Approve/reject from Students → Pending Students; reject hard-deletes
  the account so the email is freed to re-apply.
- Invite registration is unchanged; both modes coexist.

Account lifecycle lives in user meta (RegistrationStatus); no new tables.

Closes #63

Co-Authored-By: Claude Opus 4.8 <[email protected]>

tests/Unit/Auth/RegistrationPageTest.php

@@ -0,0 +1,141 @@
+<?php
+declare(strict_types=1);
+
+namespace Unsupervised\Schedular\Tests\Unit\Auth;
+
+use Brain\Monkey\Functions;
+use Mockery;
+use Unsupervised\Schedular\Auth\Invite;
+use Unsupervised\Schedular\Auth\InviteRepository;
+use Unsupervised\Schedular\Auth\RegistrationMailer;
+use Unsupervised\Schedular\Auth\RegistrationPage;
+use Unsupervised\Schedular\Payment\StudioSettings;
+use Unsupervised\Schedular\Policy\AcceptanceRepository;
+use Unsupervised\Schedular\Policy\Policy;
+use Unsupervised\Schedular\Policy\PolicyRepository;
+use Unsupervised\Schedular\Policy\PolicyVersion;
+use Unsupervised\Schedular\Policy\PolicyVersionRepository;
+use Unsupervised\Schedular\Tests\Unit\TestCase;
+
+class RegistrationPageTest extends TestCase
+{
+    /** @var array<string, mixed> */
+    private array $ctx;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        Functions\when('wp_unslash')->alias(static fn ($v) => $v);
+        Functions\when('sanitize_text_field')->alias(static fn ($v) => $v);
+        Functions\when('sanitize_email')->alias(static fn ($v) => $v);
+        Functions\when('current_time')->justReturn('2024-01-01 00:00:00');
+
+        $invites  = Mockery::mock(InviteRepository::class);
+        $policies = Mockery::mock(PolicyRepository::class);
+        $policies->shouldReceive('findForScope')->andReturn([])->byDefault();
+
+        $this->ctx = [
+            'invites'  => $invites,
+            'policies' => $policies,
+            'mailer'   => Mockery::mock(RegistrationMailer::class),
+            'settings' => Mockery::mock(StudioSettings::class),
+        ];
+
+        $this->ctx['page'] = new RegistrationPage(
+            $invites,
+            $policies,
+            Mockery::mock(PolicyVersionRepository::class),
+            Mockery::mock(AcceptanceRepository::class),
+            $this->ctx['settings'],
+            $this->ctx['mailer'],
+        );
+
+        $_POST = [];
+    }
+
+    protected function tearDown(): void
+    {
+        $_POST = [];
+        parent::tearDown();
+    }
+
+    private function submit(?Invite $invite, bool $open): string
+    {
+        $method = new \ReflectionMethod(RegistrationPage::class, 'handleSubmit');
+
+        return (string) $method->invoke($this->ctx['page'], $invite, $open);
+    }
+
+    public function testInviteBranchCreatesAndLogsInTheStudent(): void
+    {
+        $_POST = [ 'password' => 'password123', 'display_name' => 'Ada' ];
+
+        Functions\when('email_exists')->justReturn(false);
+        Functions\when('wp_insert_user')->justReturn(42);
+        Functions\when('is_wp_error')->justReturn(false);
+
+        $this->ctx['invites']->shouldReceive('markAccepted')->once();
+        Functions\expect('wp_set_current_user')->once()->with(42);
+        Functions\expect('wp_set_auth_cookie')->once()->with(42);
+
+        $invite = new Invite(email: '[email protected]', token: 'hash');
+
+        self::assertSame('invite', $this->submit($invite, false));
+    }
+
+    public function testOpenBranchCreatesPendingWithoutLoginAndEmails(): void
+    {
+        $_POST = [ 'password' => 'password123', 'display_name' => 'Ada', 'email' => '[email protected]' ];
+
+        Functions\when('is_email')->justReturn(true);
+        Functions\when('email_exists')->justReturn(false);
+        Functions\when('wp_insert_user')->justReturn(42);
+        Functions\when('is_wp_error')->justReturn(false);
+        // markPending internals
+        Functions\when('wp_generate_password')->justReturn('rawtok');
+        Functions\when('update_user_meta')->justReturn(true);
+        // confirmUrl internals
+        Functions\when('get_option')->justReturn(0);
+        Functions\when('home_url')->justReturn('http://home.test/');
+        Functions\when('add_query_arg')->alias(static fn (string $k, string $v, string $u): string => $u . '?' . $k . '=' . $v);
+
+        $user = Mockery::mock(\WP_User::class);
+        Functions\when('get_user_by')->justReturn($user);
+
+        $this->ctx['mailer']->shouldReceive('sendConfirmation')->once()->with($user, Mockery::type('string'));
+        // No invite acceptance and no auto-login in the open branch.
+        $this->ctx['invites']->shouldReceive('markAccepted')->never();
+        Functions\expect('wp_set_auth_cookie')->never();
+
+        self::assertSame('confirm', $this->submit(null, true));
+    }
+
+    public function testClosedModeWithoutInviteReturnsError(): void
+    {
+        $result = $this->submit(null, false);
+
+        self::assertNotSame('invite', $result);
+        self::assertNotSame('confirm', $result);
+        self::assertNotSame('', $result);
+    }
+
+    public function testRejectsWhenARequiredPolicyIsUnaccepted(): void
+    {
+        $_POST = [ 'password' => 'password123', 'display_name' => 'Ada', 'email' => '[email protected]' ];
+
+        Functions\when('is_email')->justReturn(true);
+
+        $policy  = new Policy(title: 'Terms', slug: 'terms', currentVersionId: 3);
+        $version = new PolicyVersion(policyId: 1, versionNumber: 1, status: PolicyVersion::STATUS_PUBLISHED, id: 3);
+
+        $this->ctx['policies']->shouldReceive('findForScope')->andReturn([ $policy ]);
+        $versionRepo = (new \ReflectionProperty(RegistrationPage::class, 'versions'))->getValue($this->ctx['page']);
+        $versionRepo->shouldReceive('findById')->with(3)->andReturn($version);
+
+        $result = $this->submit(null, true);
+
+        self::assertNotSame('confirm', $result);
+        self::assertNotSame('', $result);
+    }
+}