Let students cancel their own lessons from the booking page

Adds POST /bookings/{id}/cancel (owner-only, idempotent): marks the lesson cancelled, releases the availability slot for rebooking, and voids a still-pending payment so it leaves the admin confirmation queue. Paid payments are untouched — refunds stay a manual admin decision. The instructor PATCH /bookings/{id}/status path now does the same slot release and payment voiding on cancellation (previously cancelled lessons left their slot permanently booked), and reinstating a cancelled lesson re-claims the slot, rejecting with 409 if the freed time was rebooked. The "Your upcoming lessons" panel gets a Cancel button with a confirm prompt; on success both the lesson list and the slot calendar refresh. Co-Authored-By: Claude Fable 5 <[email protected]>
2026-07-05 17:17:30 -03:00
parent 9dd3c39ddd
commit ab90dae638
9 changed files with 263 additions and 4 deletions
@@ -79,6 +79,18 @@ class BookingEndpoint {
 			]
 		);

+		register_rest_route(
+			$route_namespace,
+			'/bookings/(?P<id>\d+)/cancel',
+			[
+				[
+					'methods'             => \WP_REST_Server::CREATABLE,
+					'callback'            => [ $this, 'cancel' ],
+					'permission_callback' => [ $this, 'isLoggedIn' ],
+				],
+			]
+		);
+
 		register_rest_route(
 			$route_namespace,
 			'/bookings/(?P<id>\d+)/status',
@@ -262,6 +274,38 @@ class BookingEndpoint {
 		return '' !== $ip ? $ip : null;
 	}

+	/**
+	 * Student-initiated cancellation of their own lesson: marks it cancelled,
+	 * frees the slot for rebooking, and voids any still-pending payment. Paid
+	 * lessons keep their payment — refunds are a manual, admin-side decision.
+	 */
+	public function cancel( \WP_REST_Request $request ): \WP_REST_Response|\WP_Error {
+		$id     = absint( Val::int( $request->get_param( 'id' ) ) );
+		$lesson = $this->bookings->findById( $id );
+
+		if ( null === $lesson ) {
+			return new \WP_Error( 'not_found', __( 'Booking not found.', 'unsupervised-schedular' ), [ 'status' => 404 ] );
+		}
+
+		if ( get_current_user_id() !== $lesson->studentId ) {
+			return new \WP_Error( 'forbidden', __( 'You cannot cancel this booking.', 'unsupervised-schedular' ), [ 'status' => 403 ] );
+		}
+
+		if ( Lesson::STATUS_CANCELLED !== $lesson->status ) {
+			$this->bookings->updateStatus( $id, Lesson::STATUS_CANCELLED );
+			$this->availability->release( $lesson->slotId );
+			$this->payments->voidPending( $lesson->paymentId );
+		}
+
+		return new \WP_REST_Response(
+			[
+				'id'     => $id,
+				'status' => Lesson::STATUS_CANCELLED,
+			],
+			200
+		);
+	}
+
 	public function updateStatus( \WP_REST_Request $request ): \WP_REST_Response|\WP_Error {
 		$id     = absint( Val::int( $request->get_param( 'id' ) ) );
 		$lesson = $this->bookings->findById( $id );
@@ -274,12 +318,23 @@ class BookingEndpoint {
 			return new \WP_Error( 'forbidden', __( 'You cannot update this booking.', 'unsupervised-schedular' ), [ 'status' => 403 ] );
 		}

-		$this->bookings->updateStatus( $id, Val::string( $request->get_param( 'status' ) ) );
+		$status = Val::string( $request->get_param( 'status' ) );
+
+		if ( Lesson::STATUS_CANCELLED === $status && Lesson::STATUS_CANCELLED !== $lesson->status ) {
+			$this->availability->release( $lesson->slotId );
+			$this->payments->voidPending( $lesson->paymentId );
+		} elseif ( Lesson::STATUS_CANCELLED === $lesson->status && Lesson::STATUS_CANCELLED !== $status && ! $this->availability->claim( $lesson->slotId ) ) {
+			// Reinstating a cancelled lesson must re-reserve its slot, and
+			// someone else may have booked the freed time in the meantime.
+			return new \WP_Error( 'slot_taken', __( 'This slot is already booked.', 'unsupervised-schedular' ), [ 'status' => 409 ] );
+		}
+
+		$this->bookings->updateStatus( $id, $status );

 		return new \WP_REST_Response(
 			[
 				'id'     => $id,
-				'status' => $request->get_param( 'status' ),
+				'status' => $status,
 			],
 			200
 		);