From ab5212282d90b64908e59f9bd9e5b4497f605929 Mon Sep 17 00:00:00 2001 From: James Griffin Date: Wed, 29 Jul 2026 22:35:04 -0300 Subject: [PATCH] Show only the name and email, not who the account books for MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The block reports who is signed in and nothing more. Dropping the "Booking for …" line takes GuardianService with it — it was the only reason the page had a dependency at all, so AccountPage now constructs with no arguments. Co-Authored-By: Claude Opus 5 --- CHANGELOG.md | 2 +- assets/css/frontend.css | 3 +- assets/js/blocks.js | 2 +- docs/features/editor-blocks.md | 5 ++-- src/Auth/AccountPage.php | 13 --------- src/BlockPreview.php | 8 ------ src/Plugin.php | 2 +- templates/frontend/account-page.php | 13 --------- tests/Unit/Auth/AccountPageTest.php | 43 +---------------------------- 9 files changed, 7 insertions(+), 84 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 12f66e3..cd7eab8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -14,7 +14,7 @@ each change under the current top section as you work. ## [1.3.1] ### Added -- An **Account** block (`[us_account]`) showing who is signed in — their name, their email, the students they book for if that is anyone besides themselves — and a **Sign out** link. Signing out returns to the login page chosen in the block, or to the page the visitor was already on when none is set, so putting it in a site header does not also move people somewhere. To a signed-out visitor it shows a **Sign in** link when a login page is chosen, and nothing at all when one is not: a panel about who is signed in has nothing to tell a stranger, and a notice they cannot act on is just clutter in a header. +- An **Account** block (`[us_account]`) showing who is signed in — their name and their email — and a **Sign out** link. Signing out returns to the login page chosen in the block, or to the page the visitor was already on when none is set, so putting it in a site header does not also move people somewhere. To a signed-out visitor it shows a **Sign in** link when a login page is chosen, and nothing at all when one is not: a panel about who is signed in has nothing to tell a stranger, and a notice they cannot act on is just clutter in a header. ### Security - Signup now checks the password properly. The form scores it as you type with the same zxcvbn meter wp-admin uses and will not submit a weak one, and the server refuses — regardless of what the browser allowed — anything shorter than 8 characters, one of the well-known leaked passwords, one built from barely any distinct characters, or one containing your own name or email address. Composition rules ("must contain a symbol") are deliberately not imposed: they mostly produce predictable substitutions. Email addresses are validated on the server on every signup path, with a clear message when one is already registered. diff --git a/assets/css/frontend.css b/assets/css/frontend.css index 6a3c8c5..98a9d9d 100644 --- a/assets/css/frontend.css +++ b/assets/css/frontend.css @@ -562,8 +562,7 @@ font-weight: 600; } -.us-account-email, -.us-account-students { +.us-account-email { display: block; font-size: 0.9em; opacity: 0.75; diff --git a/assets/js/blocks.js b/assets/js/blocks.js index dcaf81b..8971ce0 100644 --- a/assets/js/blocks.js +++ b/assets/js/blocks.js @@ -310,7 +310,7 @@ { name: 'us-scheduler/account', title: __('Account', 'unsupervised-schedular'), - description: __('Shows who is signed in, who they book for, and a sign out link. Renders nothing for signed-out visitors unless a login page is chosen.', 'unsupervised-schedular'), + description: __('Shows the name and email of whoever is signed in, with a sign out link. Renders nothing for signed-out visitors unless a login page is chosen.', 'unsupervised-schedular'), icon: 'admin-users', keywords: ['account', 'sign out', 'log out', 'signed in', 'profile'], shortcode: 'us_account', diff --git a/docs/features/editor-blocks.md b/docs/features/editor-blocks.md index c30a16d..51d826f 100644 --- a/docs/features/editor-blocks.md +++ b/docs/features/editor-blocks.md @@ -142,7 +142,6 @@ header is noise that cannot be acted on, so: - **Login page chosen** → a single **Sign in** link. Signed in, it shows the display name (`Auth\UserName::format()`, so a username -is never exposed), the account email, a **Sign out** link, and — only on an -account that books for someone other than itself — the students it books for. -Signing out returns to the chosen login page, or to the current page when there +is never exposed), the account email, and a **Sign out** link — deliberately +nothing else. Signing out returns to the chosen login page, or to the current page when there is none, so a header sign-out does not also navigate the visitor somewhere. diff --git a/src/Auth/AccountPage.php b/src/Auth/AccountPage.php index 1ace546..3e89637 100644 --- a/src/Auth/AccountPage.php +++ b/src/Auth/AccountPage.php @@ -3,7 +3,6 @@ declare(strict_types=1); namespace Unsupervised\Schedular\Auth; -use Unsupervised\Schedular\Guardian\GuardianService; use Unsupervised\Schedular\Val; /** @@ -15,8 +14,6 @@ use Unsupervised\Schedular\Val; */ class AccountPage { - public function __construct( private GuardianService $guardians ) {} - /** * Renders the account shortcode/block output. * @@ -55,16 +52,6 @@ class AccountPage { $name = UserName::format( $user, get_current_user_id() ); $email = $user->user_email; - // Whose lessons this account books, when that is more than just their own. - // A parent's first question on seeing "signed in as Grace" is whether this - // is the account their children's lessons are on. - $students = []; - foreach ( $this->guardians->bookableStudents( get_current_user_id() ) as $student ) { - if ( ! $student['is_self'] ) { - $students[] = $student['name']; - } - } - // Back to where they were, so signing out of a header link does not also // navigate them somewhere. The login page is the better landing spot when // one is configured, since the current page may be members-only. diff --git a/src/BlockPreview.php b/src/BlockPreview.php index 9f5fd1d..c1c3f65 100644 --- a/src/BlockPreview.php +++ b/src/BlockPreview.php @@ -220,18 +220,10 @@ class BlockPreview { '', self::note( __( 'Editor preview — each visitor sees their own account here.', 'unsupervised-schedular' ) ), esc_html__( 'Grace Hopper', 'unsupervised-schedular' ), esc_html__( 'grace@example.com', 'unsupervised-schedular' ), - esc_html( - sprintf( - /* translators: %s: comma-separated list of the students this account books for. */ - __( 'Booking for %s', 'unsupervised-schedular' ), - __( 'Ada, Alan', 'unsupervised-schedular' ) - ) - ), esc_html__( 'Sign out', 'unsupervised-schedular' ) ); } diff --git a/src/Plugin.php b/src/Plugin.php index fa65c95..394f92e 100644 --- a/src/Plugin.php +++ b/src/Plugin.php @@ -100,7 +100,7 @@ class Plugin { $registrationPage = new RegistrationPage( $invites, $policies, $policyVersions, $acceptances, $settings, $registrationMailer, $questions, $answers, $groupAccess, $guardians ); $groupClassPage = new GroupClassPage( $guardians ); $familyPage = new FamilyPage( $guardians, $questions, $answers ); - $accountPage = new AccountPage( $guardians ); + $accountPage = new AccountPage(); ( new ScheduledBillingRunner( $paymentService, $bookings, $enrollments, $offerings, new PaymentDueMailer(), $guardians ) )->register(); diff --git a/templates/frontend/account-page.php b/templates/frontend/account-page.php index 3dcd446..b94a444 100644 --- a/templates/frontend/account-page.php +++ b/templates/frontend/account-page.php @@ -8,7 +8,6 @@ if (! defined('ABSPATH')) { /** * @var string $name Display name of the signed-in visitor. * @var string $email Their account email. - * @var list $students Names this account books for, excluding themselves; empty for a plain student account. * @var string $logoutUrl Nonced sign-out URL, already carrying its redirect. */ ?> @@ -20,18 +19,6 @@ if (! defined('ABSPATH')) {

- - - - diff --git a/tests/Unit/Auth/AccountPageTest.php b/tests/Unit/Auth/AccountPageTest.php index b1a672c..a6b8708 100644 --- a/tests/Unit/Auth/AccountPageTest.php +++ b/tests/Unit/Auth/AccountPageTest.php @@ -6,20 +6,17 @@ namespace Unsupervised\Schedular\Tests\Unit\Auth; use Brain\Monkey\Functions; use Mockery; use Unsupervised\Schedular\Auth\AccountPage; -use Unsupervised\Schedular\Guardian\GuardianService; use Unsupervised\Schedular\Tests\Unit\TestCase; class AccountPageTest extends TestCase { - private GuardianService&Mockery\MockInterface $guardians; private AccountPage $page; protected function setUp(): void { parent::setUp(); - $this->guardians = Mockery::mock(GuardianService::class); - $this->page = new AccountPage($this->guardians); + $this->page = new AccountPage(); Functions\when('is_user_logged_in')->justReturn(true); Functions\when('get_current_user_id')->justReturn(5); @@ -47,16 +44,8 @@ class AccountPageTest extends TestCase return $user; } - /** @param list $students */ - private function bookable(array $students): void - { - $this->guardians->shouldReceive('bookableStudents')->with(5)->andReturn($students); - } - public function testShowsTheSignedInNameAndEmail(): void { - $this->bookable([['id' => 5, 'name' => 'Grace Hopper', 'is_self' => true]]); - $html = $this->page->render([]); self::assertStringContainsString('Grace Hopper', $html); @@ -64,32 +53,8 @@ class AccountPageTest extends TestCase self::assertStringContainsString('Sign out', $html); } - public function testNamesTheStudentsTheAccountBooksFor(): void - { - $this->bookable([ - ['id' => 42, 'name' => 'Ada', 'is_self' => false], - ['id' => 43, 'name' => 'Alan', 'is_self' => false], - ['id' => 5, 'name' => 'Grace Hopper', 'is_self' => true], - ]); - - self::assertStringContainsString('Booking for Ada, Alan', $this->page->render([])); - } - - /** - * An account that only books for itself has nothing to add — "Booking for - * Grace Hopper" under "Grace Hopper" is noise. - */ - public function testSaysNothingAboutStudentsOnAPlainAccount(): void - { - $this->bookable([['id' => 5, 'name' => 'Grace Hopper', 'is_self' => true]]); - - self::assertStringNotContainsString('Booking for', $this->page->render([])); - } - public function testSigningOutReturnsToTheConfiguredLoginPage(): void { - $this->bookable([['id' => 5, 'name' => 'Grace Hopper', 'is_self' => true]]); - self::assertStringContainsString( rawurlencode('https://studio.test/sign-in/'), $this->page->render(['loginPageId' => 9]) @@ -102,8 +67,6 @@ class AccountPageTest extends TestCase */ public function testSigningOutReturnsToTheCurrentPageWhenNoLoginPageIsSet(): void { - $this->bookable([['id' => 5, 'name' => 'Grace Hopper', 'is_self' => true]]); - self::assertStringContainsString( rawurlencode('https://studio.test/current/'), $this->page->render([]) @@ -112,8 +75,6 @@ class AccountPageTest extends TestCase public function testTheShortcodeAttributeNameIsAccepted(): void { - $this->bookable([['id' => 5, 'name' => 'Grace Hopper', 'is_self' => true]]); - self::assertStringContainsString( rawurlencode('https://studio.test/sign-in/'), $this->page->render(['login_page_id' => 9]) @@ -127,7 +88,6 @@ class AccountPageTest extends TestCase public function testRendersNothingForASignedOutVisitorWithNoLoginPage(): void { Functions\when('is_user_logged_in')->justReturn(false); - $this->guardians->shouldNotReceive('bookableStudents'); self::assertSame('', $this->page->render([])); } @@ -135,7 +95,6 @@ class AccountPageTest extends TestCase public function testOffersASignInLinkToASignedOutVisitorWhenAPageIsChosen(): void { Functions\when('is_user_logged_in')->justReturn(false); - $this->guardians->shouldNotReceive('bookableStudents'); $html = $this->page->render(['loginPageId' => 9]);