Unsupervised/unsupervised-scheduler
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases 12 Wiki Activity

Let parents register once and book for their children

Browse Source 
A parent registers once and manages lessons for one or more children, who
need no login of their own. A child is a real wp_users row with the student
role but no usable login — so student_id keeps meaning "a WordPress user"
on every table, and booking, credits, policies and enrolments work unchanged.
A us_guardians link table maps guardian to child.

The signup form gains a parent/guardian tick that reveals a block per child,
with the account-signup questions asked per child rather than per guardian
— they describe the student, not the account holder. Signup policies are
recorded once per child with the guardian as the acceptor, which is the
record that actually means something. A family that half-creates is rolled
back entirely rather than leaving a guardian who cannot re-register.

The booking and enrolment forms gain a "Who is this for?" picker listing
children first, so the default selection is never the parent — booking for
the wrong child is correctable, quietly billing a parent for their kid's
lesson is not. POST /bookings and POST /enrollments take an optional
student_id honoured only for that child's guardian; anything else is a 403.
That check is the authorisation boundary of the feature.

Payments and credits gain a payer: the charge names the child it was for and
the guardian who owes it, so per-child reporting is unchanged while notices,
receipts and the payment step reach the parent. Credit is held by the payer,
so one child's cancellation can settle a sibling's charge, and the daily
billing scan sends a guardian one notice covering every child.

Closes #132

Co-Authored-By: Claude Opus 5 <[email protected]>
This commit is contained in:
thatguygriff
2026-07-29 16:07:52 -03:00
co-authored by Claude Opus 5
parent c25260a367
commit b772e1811e
71 changed files with 4192 additions and 191 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Booking/BookingEndpoint.php
+84 -10
View File
@@ -5,6 +5,7 @@ namespace Unsupervised\Schedular\Booking;
use Unsupervised\Schedular\Availability\AvailabilityRepository;
use Unsupervised\Schedular\Auth\RoleManager;
use Unsupervised\Schedular\Guardian\GuardianService;
use Unsupervised\Schedular\Offering\Offering;
use Unsupervised\Schedular\Offering\OfferingRepository;
use Unsupervised\Schedular\Payment\Payment;
@@ -28,6 +29,7 @@ class BookingEndpoint {
private RegistrationGate $gate,
private PaymentService $payments,
private CancellationPolicy $cancellationPolicy,
private GuardianService $guardians,
) {}
/**
@@ -59,6 +61,13 @@ class BookingEndpoint {
'type' => 'integer',
'default' => 0,
],
// Who the lesson is for. 0/absent means the caller books for
// themselves; a child's id is honoured only for their guardian.
'student_id' => [
'type' => 'integer',
'default' => 0,
'sanitize_callback' => 'absint',
],
'recurrence' => [
'type' => 'string',
'default' => 'single',
@@ -114,12 +123,26 @@ class BookingEndpoint {
}
public function myLessons( \WP_REST_Request $request ): \WP_REST_Response { // phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter.Found
$userId = get_current_user_id();
$lessons = current_user_can( RoleManager::CAP_MANAGE_AVAILABILITY )
? $this->bookings->findUpcomingForInstructor( $userId )
: $this->bookings->findUpcomingForStudent( $userId );
$userId = get_current_user_id();
return new \WP_REST_Response( array_map( fn( Lesson $l ): array => $this->lessonWithTimes( $l ), $lessons ), 200 );
if ( current_user_can( RoleManager::CAP_MANAGE_AVAILABILITY ) ) {
$lessons = $this->bookings->findUpcomingForInstructor( $userId );
} else {
// A guardian's list covers the whole household — their own lessons and
// every child's — merged and re-sorted so the soonest is first
// regardless of whose it is.
$lessons = [];
foreach ( $this->guardians->householdIds( $userId ) as $studentId ) {
$lessons = array_merge( $lessons, $this->bookings->findUpcomingForStudent( $studentId ) );
}
}
$rows = array_map( fn( Lesson $l ): array => $this->lessonWithTimes( $l ), $lessons );
// usort reindexes in place, so the response is already a list.
usort( $rows, static fn( array $a, array $b ): int => Val::string( $a['start_dt'] ?? '' ) <=> Val::string( $b['start_dt'] ?? '' ) );
return new \WP_REST_Response( $rows, 200 );
}
/**
@@ -144,10 +167,21 @@ class BookingEndpoint {
'end_dt' => $slot?->endDt,
'offering_title' => $offering?->title,
'duration_minutes' => $duration,
// Whose lesson it is, so a guardian's merged list can say which child
// each row belongs to.
'student_name' => $this->guardians->studentName( $lesson->studentId ),
];
}
public function book( \WP_REST_Request $request ): \WP_REST_Response|\WP_Error {
// Who the lesson is for is settled before anything else is touched: an
// unauthorised student id must never get as far as claiming a slot, and
// certainly never as far as raising a payment against someone's account.
$studentId = $this->resolveStudent( $request );
if ( $studentId instanceof \WP_Error ) {
return $studentId;
}
$slotId = Val::int( $request->get_param( 'slot_id' ) );
$slot = $this->availability->findById( $slotId );
@@ -214,7 +248,6 @@ class BookingEndpoint {
return $gateError;
}
$studentId = get_current_user_id();
$notes = Val::string( $request->get_param( 'notes' ) );
$recurrence = Lesson::RECURRENCE_WEEKLY === $request->get_param( 'recurrence' )
? Lesson::RECURRENCE_WEEKLY
@@ -254,7 +287,9 @@ class BookingEndpoint {
$ids = [ $anchorId ];
}
$this->gate->record( PolicyAcceptance::REG_LESSON, $anchorId, $studentId, $offeringId, $answers, $acceptedVersionIds, $this->clientIp() );
// The acceptance binds the student but is attributed to whoever actually
// ticked the boxes — the guardian, when they booked for a child.
$this->gate->record( PolicyAcceptance::REG_LESSON, $anchorId, $studentId, $offeringId, $answers, $acceptedVersionIds, $this->clientIp(), get_current_user_id() );
$payment = null;
$status = Lesson::STATUS_PENDING;
@@ -276,7 +311,16 @@ class BookingEndpoint {
? $offering->price
: $offering->price * count( $ids );
$payment = $this->payments->createForRegistration( Payment::REG_LESSON, $anchorId, $studentId, $slot->instructorId, $amount, $offering->currency, $offering->etransferEmail );
$payment = $this->payments->createForRegistration(
Payment::REG_LESSON,
$anchorId,
$studentId,
$slot->instructorId,
$amount,
$offering->currency,
$offering->etransferEmail,
payerId: $this->guardians->payerFor( $studentId )
);
if ( null !== $payment && $payment->isPaid() ) {
$status = Lesson::STATUS_CONFIRMED;
@@ -303,6 +347,35 @@ class BookingEndpoint {
);
}
/**
* Who this booking is for: the caller by default, or one of their children
* when a `student_id` is supplied and they are that child's guardian.
*
* This is the authorisation boundary of guardian booking — without it any
* signed-in student could book, and bill, against any user id they chose to
* send. An id the caller may not act for is a 403, never a silent fallback to
* themselves: a guardian who picked the wrong child needs to be told, not to
* have the lesson quietly booked in their own name.
*/
private function resolveStudent( \WP_REST_Request $request ): int|\WP_Error {
$userId = get_current_user_id();
$requested = absint( Val::int( $request->get_param( 'student_id' ) ) );
if ( $requested <= 0 || $requested === $userId ) {
return $userId;
}
if ( ! $this->guardians->canActFor( $userId, $requested ) ) {
return new \WP_Error(
'forbidden',
__( 'You cannot book on behalf of that student.', 'unsupervised-schedular' ),
[ 'status' => 403 ]
);
}
return $requested;
}
/**
* Extract a question_id => value map from the request.
*
@@ -342,7 +415,8 @@ class BookingEndpoint {
}
/**
* Student-initiated cancellation of their own lesson: marks it cancelled,
* Student-initiated cancellation of their own lesson — or a guardian's, of one
* of their children's: marks it cancelled,
* frees the slot for rebooking, and voids any still-pending payment. A lesson
* already paid for is credited back to the student's account (a per-lesson
* share of the covering payment) to offset their future scheduled billing.
@@ -355,7 +429,7 @@ class BookingEndpoint {
return new \WP_Error( 'not_found', __( 'Booking not found.', 'unsupervised-schedular' ), [ 'status' => 404 ] );
}
if ( get_current_user_id() !== $lesson->studentId ) {
if ( ! $this->guardians->canActFor( get_current_user_id(), $lesson->studentId ) ) {
return new \WP_Error( 'forbidden', __( 'You cannot cancel this booking.', 'unsupervised-schedular' ), [ 'status' => 403 ] );
}