Add invite-only group classes

Group classes can now be marked invite-only (us_offerings.access_mode).
Invite-only classes are hidden from the public catalog and reachable only
when the instructor lets someone in via one of three paths, managed from
My Lessons -> My Group Classes:

- Add students directly: enrols them now with a pending payment.
- Make available: grants registered students access to self-enrol through
  the normal paid flow (multi-select, emailed a notice).
- Invite by email: tokenised registration invite tied to the class for a
  non-account address; after they register the class becomes enrollable.
  Reuses an existing pending invite instead of sending a second link.

New us_group_access table records grants; GET /offerings merges granted
invite-only classes for the caller; enrolment requires a grant
(403 invite_required) and flips it to enrolled on success.

composer test (487), composer lint, composer cs all pass.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

tests/Unit/Offering/OfferingControllerTest.php

@@ -70,6 +70,39 @@ class OfferingControllerTest extends TestCase
         $this->render();
     }
 
+    public function testAddInviteOnlyGroupClassStoresInviteOnlyAccess(): void
+    {
+        $_POST = [
+            'usc_action'  => 'add',
+            'title'       => 'Private Choir',
+            'kind'        => Offering::KIND_GROUP_CLASS,
+            'invite_only' => '1',
+        ];
+
+        $this->repository->shouldReceive('insert')->once()->with(Mockery::on(
+            static fn (Offering $o) => Offering::ACCESS_INVITE_ONLY === $o->accessMode
+        ))->andReturn(1);
+        $this->repository->shouldReceive('findAll')->andReturn([]);
+
+        $this->render();
+    }
+
+    public function testAddWithoutInviteOnlyDefaultsToPublicAccess(): void
+    {
+        $_POST = [
+            'usc_action' => 'add',
+            'title'      => 'Open Choir',
+            'kind'       => Offering::KIND_GROUP_CLASS,
+        ];
+
+        $this->repository->shouldReceive('insert')->once()->with(Mockery::on(
+            static fn (Offering $o) => Offering::ACCESS_PUBLIC === $o->accessMode
+        ))->andReturn(1);
+        $this->repository->shouldReceive('findAll')->andReturn([]);
+
+        $this->render();
+    }
+
     public function testAddOneOffGroupClassEndsOnItsStartDate(): void
     {
         $_POST = [

tests/Unit/Offering/OfferingEndpointTest.php

@@ -0,0 +1,102 @@
+<?php
+declare(strict_types=1);
+
+namespace Unsupervised\Schedular\Tests\Unit\Offering;
+
+use Brain\Monkey\Functions;
+use Mockery;
+use Unsupervised\Schedular\GroupClass\GroupAccessRepository;
+use Unsupervised\Schedular\Offering\Offering;
+use Unsupervised\Schedular\Offering\OfferingEndpoint;
+use Unsupervised\Schedular\Offering\OfferingRepository;
+use Unsupervised\Schedular\Tests\Unit\TestCase;
+
+class OfferingEndpointTest extends TestCase
+{
+    private OfferingRepository&Mockery\MockInterface $repository;
+    private GroupAccessRepository&Mockery\MockInterface $access;
+    private OfferingEndpoint $endpoint;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        Functions\when('get_current_user_id')->justReturn(5);
+
+        $this->repository = Mockery::mock(OfferingRepository::class);
+        $this->access     = Mockery::mock(GroupAccessRepository::class);
+        $this->endpoint   = new OfferingEndpoint($this->repository, $this->access);
+    }
+
+    private function group(int $id, string $access): Offering
+    {
+        return new Offering(instructorId: 3, kind: Offering::KIND_GROUP_CLASS, title: "Class $id", accessMode: $access, id: $id);
+    }
+
+    public function testIndexReturnsPublicOfferingsOnlyWhenNoGrants(): void
+    {
+        $this->repository->shouldReceive('findAll')
+            ->once()
+            ->with(0, '', Mockery::on(static fn ($v): bool => true === $v), Offering::ACCESS_PUBLIC)
+            ->andReturn([$this->group(1, Offering::ACCESS_PUBLIC)]);
+        $this->access->shouldReceive('findGrantedOfferingIds')->with(5)->andReturn([]);
+
+        $data = $this->endpoint->index(new \WP_REST_Request())->get_data();
+
+        self::assertCount(1, $data);
+        self::assertSame(1, $data[0]['id']);
+    }
+
+    public function testIndexMergesGrantedInviteOnlyOfferings(): void
+    {
+        $this->repository->shouldReceive('findAll')
+            ->once()
+            ->with(0, '', Mockery::any(), Offering::ACCESS_PUBLIC)
+            ->andReturn([$this->group(1, Offering::ACCESS_PUBLIC)]);
+        $this->access->shouldReceive('findGrantedOfferingIds')->with(5)->andReturn([8]);
+        $this->repository->shouldReceive('findById')->with(8)->andReturn($this->group(8, Offering::ACCESS_INVITE_ONLY));
+
+        $data = $this->endpoint->index(new \WP_REST_Request())->get_data();
+
+        self::assertSame([1, 8], array_column($data, 'id'));
+    }
+
+    public function testIndexOmitsGrantedOfferingThatIsNoLongerInviteOnly(): void
+    {
+        $this->repository->shouldReceive('findAll')->andReturn([]);
+        $this->access->shouldReceive('findGrantedOfferingIds')->with(5)->andReturn([8]);
+        // Grant persists but the class was flipped back to public — it is already
+        // in the public list, so it must not be appended a second time.
+        $this->repository->shouldReceive('findById')->with(8)->andReturn($this->group(8, Offering::ACCESS_PUBLIC));
+
+        $data = $this->endpoint->index(new \WP_REST_Request())->get_data();
+
+        self::assertSame([], $data);
+    }
+
+    public function testIndexRespectsKindFilterForGrantedOfferings(): void
+    {
+        $this->repository->shouldReceive('findAll')
+            ->with(0, Offering::KIND_PRIVATE_LESSON, Mockery::any(), Offering::ACCESS_PUBLIC)
+            ->andReturn([]);
+        $this->access->shouldReceive('findGrantedOfferingIds')->with(5)->andReturn([8]);
+        // Granted class is a group class; the request filters to private lessons.
+        $this->repository->shouldReceive('findById')->with(8)->andReturn($this->group(8, Offering::ACCESS_INVITE_ONLY));
+
+        $data = $this->endpoint->index(new \WP_REST_Request(['kind' => Offering::KIND_PRIVATE_LESSON]))->get_data();
+
+        self::assertSame([], $data);
+    }
+
+    public function testIndexOmitsEtransferEmailFromPublicListing(): void
+    {
+        $this->repository->shouldReceive('findAll')->andReturn([
+            new Offering(instructorId: 3, kind: Offering::KIND_GROUP_CLASS, title: 'Choir', etransferEmail: '[email protected]', id: 1),
+        ]);
+        $this->access->shouldReceive('findGrantedOfferingIds')->with(5)->andReturn([]);
+
+        $data = $this->endpoint->index(new \WP_REST_Request())->get_data();
+
+        self::assertArrayNotHasKey('etransfer_email', $data[0]);
+    }
+}

tests/Unit/Offering/OfferingRepositoryTest.php

@@ -154,6 +154,44 @@ class OfferingRepositoryTest extends TestCase
         $this->repo->findAll(3, Offering::KIND_GROUP_CLASS);
     }
 
+    public function testFindAllFiltersByAccessMode(): void
+    {
+        $this->db->shouldReceive('prepare')
+            ->once()
+            ->with(
+                Mockery::pattern('/access_mode = %s/'),
+                Mockery::on(static fn (array $p): bool => $p === ['wp_us_offerings', Offering::ACCESS_PUBLIC])
+            )
+            ->andReturn('SELECT ...');
+
+        $this->db->shouldReceive('get_results')->andReturn([]);
+
+        self::assertSame([], $this->repo->findAll(accessMode: Offering::ACCESS_PUBLIC));
+    }
+
+    public function testInsertPersistsAccessMode(): void
+    {
+        Functions\expect('current_time')->with('mysql')->andReturn('2026-04-01 12:00:00');
+
+        $this->db->shouldReceive('insert')
+            ->once()
+            ->with(
+                'wp_us_offerings',
+                Mockery::on(static fn (array $data): bool => $data['access_mode'] === Offering::ACCESS_INVITE_ONLY),
+                Mockery::type('array')
+            );
+        $this->db->insert_id = 1;
+
+        $offering = new Offering(
+            instructorId: 5,
+            kind:         Offering::KIND_GROUP_CLASS,
+            title:        'Private Choir',
+            accessMode:   Offering::ACCESS_INVITE_ONLY,
+        );
+
+        self::assertSame(1, $this->repo->insert($offering));
+    }
+
     public function testDeleteCallsWpdbDelete(): void
     {
         $this->db->shouldReceive('delete')

tests/Unit/Offering/OfferingTest.php

@@ -132,11 +132,53 @@ class OfferingTest extends TestCase
         $offering = new Offering(1, Offering::KIND_PRIVATE_LESSON, 'Lesson', id: 10);
         $arr      = $offering->toArray();
 
-        foreach (['id', 'instructor_id', 'kind', 'title', 'price', 'billing_mode', 'is_active'] as $key) {
+        foreach (['id', 'instructor_id', 'kind', 'title', 'price', 'billing_mode', 'access_mode', 'is_active'] as $key) {
             self::assertArrayHasKey($key, $arr);
         }
     }
 
+    public function testDefaultsToPublicAccess(): void
+    {
+        $offering = new Offering(1, Offering::KIND_GROUP_CLASS, 'Choir', id: 10);
+
+        self::assertSame(Offering::ACCESS_PUBLIC, $offering->accessMode);
+        self::assertFalse($offering->isInviteOnly());
+    }
+
+    public function testInviteOnlyAccessIsReported(): void
+    {
+        $offering = new Offering(1, Offering::KIND_GROUP_CLASS, 'Choir', accessMode: Offering::ACCESS_INVITE_ONLY, id: 10);
+
+        self::assertTrue($offering->isInviteOnly());
+        self::assertSame(Offering::ACCESS_INVITE_ONLY, $offering->toArray()['access_mode']);
+    }
+
+    public function testFromRowReadsInviteOnlyAccessMode(): void
+    {
+        $row = (object) [
+            'id'               => '7',
+            'instructor_id'    => '3',
+            'kind'             => Offering::KIND_GROUP_CLASS,
+            'title'            => 'Private Choir',
+            'description'      => null,
+            'duration_minutes' => null,
+            'price'            => '0.00',
+            'currency'         => 'CAD',
+            'billing_mode'     => Offering::BILLING_FULL_TERM,
+            'allow_weekly'     => '0',
+            'capacity'         => null,
+            'term_start'       => null,
+            'term_end'         => null,
+            'schedule_note'    => null,
+            'etransfer_email'  => null,
+            'cancellation_cutoff_hours' => null,
+            'access_mode'      => Offering::ACCESS_INVITE_ONLY,
+            'is_active'        => '1',
+        ];
+
+        self::assertTrue(Offering::fromRow($row)->isInviteOnly());
+    }
+
     public function testToArrayIncludesEtransferEmailByDefault(): void
     {
         $offering = new Offering(1, Offering::KIND_PRIVATE_LESSON, 'Lesson', etransferEmail: '[email protected]', id: 10);