Unsupervised/unsupervised-scheduler
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases 12 Wiki Activity

Let parents register once and book for their children

Browse Source 
A parent registers once and manages lessons for one or more children, who
need no login of their own. A child is a real wp_users row with the student
role but no usable login — so student_id keeps meaning "a WordPress user"
on every table, and booking, credits, policies and enrolments work unchanged.
A us_guardians link table maps guardian to child.

The signup form gains a parent/guardian tick that reveals a block per child,
with the account-signup questions asked per child rather than per guardian
— they describe the student, not the account holder. Signup policies are
recorded once per child with the guardian as the acceptor, which is the
record that actually means something. A family that half-creates is rolled
back entirely rather than leaving a guardian who cannot re-register.

The booking and enrolment forms gain a "Who is this for?" picker listing
children first, so the default selection is never the parent — booking for
the wrong child is correctable, quietly billing a parent for their kid's
lesson is not. POST /bookings and POST /enrollments take an optional
student_id honoured only for that child's guardian; anything else is a 403.
That check is the authorisation boundary of the feature.

Payments and credits gain a payer: the charge names the child it was for and
the guardian who owes it, so per-child reporting is unchanged while notices,
receipts and the payment step reach the parent. Credit is held by the payer,
so one child's cancellation can settle a sibling's charge, and the daily
billing scan sends a guardian one notice covering every child.

Closes #132

Co-Authored-By: Claude Opus 5 <[email protected]>
This commit is contained in:
thatguygriff
2026-07-29 16:07:52 -03:00
co-authored by Claude Opus 5
parent c25260a367
commit b772e1811e
71 changed files with 4192 additions and 191 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/GroupClass/EnrollmentEndpoint.php
+60 -6
View File
@@ -4,6 +4,7 @@ declare(strict_types=1);
namespace Unsupervised\Schedular\GroupClass;
use Unsupervised\Schedular\Auth\RoleManager;
use Unsupervised\Schedular\Guardian\GuardianService;
use Unsupervised\Schedular\Offering\Offering;
use Unsupervised\Schedular\Offering\OfferingRepository;
use Unsupervised\Schedular\Payment\Payment;
@@ -20,6 +21,7 @@ class EnrollmentEndpoint {
private RegistrationGate $gate,
private PaymentService $payments,
private GroupAccessRepository $access,
private GuardianService $guardians,
) {}
/**
@@ -47,6 +49,13 @@ class EnrollmentEndpoint {
'required' => true,
'sanitize_callback' => 'absint',
],
// Who is being enrolled. 0/absent means the caller enrols
// themselves; a child's id is honoured only for their guardian.
'student_id' => [
'type' => 'integer',
'default' => 0,
'sanitize_callback' => 'absint',
],
'answers' => [
'type' => 'object',
'default' => [],
@@ -81,13 +90,25 @@ class EnrollmentEndpoint {
} elseif ( current_user_can( RoleManager::CAP_MANAGE_AVAILABILITY ) ) {
$enrollments = $this->enrollments->findByInstructor( $userId );
} else {
$enrollments = $this->enrollments->findByStudent( $userId );
// A guardian sees the whole household's enrolments — their own and
// every child's — so one account covers the family.
$enrollments = [];
foreach ( $this->guardians->householdIds( $userId ) as $studentId ) {
$enrollments = array_merge( $enrollments, $this->enrollments->findByStudent( $studentId ) );
}
}
return new \WP_REST_Response( array_map( fn( Enrollment $e ) => $e->toArray(), $enrollments ), 200 );
}
public function enroll( \WP_REST_Request $request ): \WP_REST_Response|\WP_Error {
// Who is being enrolled is settled before anything else, so an
// unauthorised student id never reaches a seat claim or a charge.
$studentId = $this->resolveStudent( $request );
if ( $studentId instanceof \WP_Error ) {
return $studentId;
}
$offeringId = absint( Val::int( $request->get_param( 'offering_id' ) ) );
$offering = $this->offerings->findById( $offeringId );
@@ -95,8 +116,6 @@ class EnrollmentEndpoint {
return new \WP_Error( 'invalid_offering', __( 'Group class not found.', 'unsupervised-schedular' ), [ 'status' => 404 ] );
}
$studentId = get_current_user_id();
if ( $this->enrollments->hasActiveEnrollment( $offeringId, $studentId ) ) {
return new \WP_Error( 'already_enrolled', __( 'You are already enrolled in this class.', 'unsupervised-schedular' ), [ 'status' => 409 ] );
}
@@ -133,7 +152,9 @@ class EnrollmentEndpoint {
)
);
$this->gate->record( PolicyAcceptance::REG_ENROLLMENT, $id, $studentId, $offeringId, $answers, $acceptedVersionIds, $this->clientIp() );
// The acceptance binds the student but is attributed to whoever ticked the
// boxes — the guardian, when they enrolled a child.
$this->gate->record( PolicyAcceptance::REG_ENROLLMENT, $id, $studentId, $offeringId, $answers, $acceptedVersionIds, $this->clientIp(), get_current_user_id() );
// Mark the access grant used so instructor rosters distinguish invited
// students from enrolled ones (a no-op for public classes).
@@ -146,7 +167,16 @@ class EnrollmentEndpoint {
// regardless of payment.
$payment = null;
if ( $offering->price > 0.0 && ! $offering->isScheduledBilling() ) {
$payment = $this->payments->createForRegistration( Payment::REG_ENROLLMENT, $id, $studentId, $offering->instructorId, $offering->price, $offering->currency, $offering->etransferEmail );
$payment = $this->payments->createForRegistration(
Payment::REG_ENROLLMENT,
$id,
$studentId,
$offering->instructorId,
$offering->price,
$offering->currency,
$offering->etransferEmail,
payerId: $this->guardians->payerFor( $studentId )
);
}
// `payment: null` tells the front end to skip the payment step entirely.
@@ -176,7 +206,7 @@ class EnrollmentEndpoint {
return new \WP_Error( 'not_found', __( 'Enrolment not found.', 'unsupervised-schedular' ), [ 'status' => 404 ] );
}
if ( get_current_user_id() !== $enrollment->studentId ) {
if ( ! $this->guardians->canActFor( get_current_user_id(), $enrollment->studentId ) ) {
return new \WP_Error( 'forbidden', __( 'You cannot withdraw from this class.', 'unsupervised-schedular' ), [ 'status' => 403 ] );
}
@@ -212,6 +242,30 @@ class EnrollmentEndpoint {
return is_user_logged_in() && current_user_can( RoleManager::CAP_BOOK_LESSON );
}
/**
* Who this enrolment is for: the caller by default, or one of their children
* when a `student_id` is supplied and they are that child's guardian. An id
* the caller may not act for is a 403, never a silent fallback to themselves.
*/
private function resolveStudent( \WP_REST_Request $request ): int|\WP_Error {
$userId = get_current_user_id();
$requested = absint( Val::int( $request->get_param( 'student_id' ) ) );
if ( $requested <= 0 || $requested === $userId ) {
return $userId;
}
if ( ! $this->guardians->canActFor( $userId, $requested ) ) {
return new \WP_Error(
'forbidden',
__( 'You cannot enrol that student.', 'unsupervised-schedular' ),
[ 'status' => 403 ]
);
}
return $requested;
}
/**
* Extract a question_id => value map from the request.
*
src/GroupClass/GroupClassPage.php
+7
View File
@@ -4,10 +4,13 @@ declare(strict_types=1);
namespace Unsupervised\Schedular\GroupClass;
use Unsupervised\Schedular\Auth\RoleManager;
use Unsupervised\Schedular\Guardian\GuardianService;
use Unsupervised\Schedular\Val;
class GroupClassPage {
public function __construct( private GuardianService $guardians ) {}
/**
* Renders the group-class enrolment shortcode output.
*
@@ -39,6 +42,10 @@ class GroupClassPage {
$offeringId = absint( Val::int( $atts['offering'] ?? $atts['offeringId'] ?? 0 ) );
// Who this account may enrol — children first, the account holder last, so
// a guardian's default choice is a child rather than themselves.
$students = $this->guardians->bookableStudents( get_current_user_id() );
ob_start();
include USC_PLUGIN_DIR . 'templates/frontend/group-classes-page.php';
return (string) ob_get_clean();