Add invite-only group classes

Group classes can now be marked invite-only (us_offerings.access_mode).
Invite-only classes are hidden from the public catalog and reachable only
when the instructor lets someone in via one of three paths, managed from
My Lessons -> My Group Classes:

- Add students directly: enrols them now with a pending payment.
- Make available: grants registered students access to self-enrol through
  the normal paid flow (multi-select, emailed a notice).
- Invite by email: tokenised registration invite tied to the class for a
  non-account address; after they register the class becomes enrollable.
  Reuses an existing pending invite instead of sending a second link.

New us_group_access table records grants; GET /offerings merges granted
invite-only classes for the caller; enrolment requires a grant
(403 invite_required) and flips it to enrolled on success.

composer test (487), composer lint, composer cs all pass.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

tests/Unit/GroupClass/EnrollmentEndpointTest.php

@@ -7,6 +7,7 @@ use Brain\Monkey\Functions;
 use Mockery;
 use Unsupervised\Schedular\GroupClass\EnrollmentEndpoint;
 use Unsupervised\Schedular\GroupClass\EnrollmentRepository;
+use Unsupervised\Schedular\GroupClass\GroupAccessRepository;
 use Unsupervised\Schedular\Offering\Offering;
 use Unsupervised\Schedular\Offering\OfferingRepository;
 use Unsupervised\Schedular\Payment\Payment;
@@ -20,6 +21,7 @@ class EnrollmentEndpointTest extends TestCase
     private OfferingRepository $offerings;
     private RegistrationGate $gate;
     private PaymentService $payments;
+    private GroupAccessRepository $access;
     private EnrollmentEndpoint $endpoint;
 
     protected function setUp(): void
@@ -35,12 +37,14 @@ class EnrollmentEndpointTest extends TestCase
         $this->offerings   = Mockery::mock(OfferingRepository::class);
         $this->gate        = Mockery::mock(RegistrationGate::class);
         $this->payments    = Mockery::mock(PaymentService::class);
+        $this->access      = Mockery::mock(GroupAccessRepository::class);
 
         $this->endpoint = new EnrollmentEndpoint(
             $this->enrollments,
             $this->offerings,
             $this->gate,
             $this->payments,
+            $this->access,
         );
     }
 
@@ -49,6 +53,11 @@ class EnrollmentEndpointTest extends TestCase
         return new Offering(instructorId: 3, kind: Offering::KIND_GROUP_CLASS, title: 'Choir', price: $price, id: 8);
     }
 
+    private function inviteOnlyOffering(): Offering
+    {
+        return new Offering(instructorId: 3, kind: Offering::KIND_GROUP_CLASS, title: 'Private Choir', accessMode: Offering::ACCESS_INVITE_ONLY, id: 8);
+    }
+
     private function expectSuccessfulEnrollment(): void
     {
         $this->enrollments->shouldReceive('hasActiveEnrollment')->with(8, 5)->andReturn(false);
@@ -98,4 +107,31 @@ class EnrollmentEndpointTest extends TestCase
             $result->get_data()['payment']
         );
     }
+
+    public function testInviteOnlyClassRejectsStudentWithoutGrant(): void
+    {
+        $this->offerings->shouldReceive('findById')->with(8)->andReturn($this->inviteOnlyOffering());
+        $this->enrollments->shouldReceive('hasActiveEnrollment')->with(8, 5)->andReturn(false);
+        $this->access->shouldReceive('hasGrant')->with(8, 5)->andReturn(false);
+        $this->enrollments->shouldReceive('insert')->never();
+
+        $result = $this->endpoint->enroll(new \WP_REST_Request(['offering_id' => 8]));
+
+        self::assertInstanceOf(\WP_Error::class, $result);
+        self::assertSame('invite_required', $result->get_error_code());
+        self::assertSame(403, $result->error_data['invite_required']['status']);
+    }
+
+    public function testInviteOnlyClassAllowsGrantedStudentAndMarksEnrolled(): void
+    {
+        $this->offerings->shouldReceive('findById')->with(8)->andReturn($this->inviteOnlyOffering());
+        $this->access->shouldReceive('hasGrant')->with(8, 5)->andReturn(true);
+        $this->expectSuccessfulEnrollment();
+        $this->access->shouldReceive('markEnrolled')->once()->with(8, 5);
+
+        $result = $this->endpoint->enroll(new \WP_REST_Request(['offering_id' => 8]));
+
+        self::assertInstanceOf(\WP_REST_Response::class, $result);
+        self::assertSame(201, $result->get_status());
+    }
 }