Let parents register once and book for their children

A parent registers once and manages lessons for one or more children, who need no login of their own. A child is a real wp_users row with the student role but no usable login — so student_id keeps meaning "a WordPress user" on every table, and booking, credits, policies and enrolments work unchanged. A us_guardians link table maps guardian to child. The signup form gains a parent/guardian tick that reveals a block per child, with the account-signup questions asked per child rather than per guardian — they describe the student, not the account holder. Signup policies are recorded once per child with the guardian as the acceptor, which is the record that actually means something. A family that half-creates is rolled back entirely rather than leaving a guardian who cannot re-register. The booking and enrolment forms gain a "Who is this for?" picker listing children first, so the default selection is never the parent — booking for the wrong child is correctable, quietly billing a parent for their kid's lesson is not. POST /bookings and POST /enrollments take an optional student_id honoured only for that child's guardian; anything else is a 403. That check is the authorisation boundary of the feature. Payments and credits gain a payer: the charge names the child it was for and the guardian who owes it, so per-child reporting is unchanged while notices, receipts and the payment step reach the parent. Credit is held by the payer, so one child's cancellation can settle a sibling's charge, and the daily billing scan sends a guardian one notice covering every child. Closes #132 Co-Authored-By: Claude Opus 5 <[email protected]>
2026-07-29 16:07:52 -03:00
parent c25260a367
commit b772e1811e
71 changed files with 4192 additions and 191 deletions
@@ -0,0 +1,122 @@
+<?php
+declare(strict_types=1);
+
+namespace Unsupervised\Schedular\Guardian;
+
+class GuardianRepository {
+
+	private string $table;
+
+	public function __construct( private \wpdb $db ) {
+		$this->table = $db->prefix . 'us_guardians';
+	}
+
+	/**
+	 * Link a child to a guardian. Returns 0 without inserting when the child
+	 * already has a guardian: v1 is one guardian per child, and the check lives
+	 * here so every caller (signup, the family screen, admin) gets it.
+	 */
+	public function insert( GuardianLink $link ): int {
+		if ( null !== $this->findByStudent( $link->studentId ) ) {
+			return 0;
+		}
+
+		$this->db->insert(
+			$this->table,
+			[
+				'guardian_id'  => $link->guardianId,
+				'student_id'   => $link->studentId,
+				'relationship' => $link->relationship,
+				'created_at'   => current_time( 'mysql' ),
+			],
+			[ '%d', '%d', '%s', '%s' ]
+		);
+
+		return $this->db->insert_id;
+	}
+
+	/**
+	 * The link naming this child's guardian, or null when they book for
+	 * themselves.
+	 */
+	public function findByStudent( int $studentId ): ?GuardianLink {
+		$row = $this->db->get_row(
+			$this->db->prepare(
+				'SELECT * FROM %i WHERE student_id = %d LIMIT 1',
+				$this->table,
+				$studentId
+			)
+		);
+
+		return $row ? GuardianLink::fromRow( $row ) : null;
+	}
+
+	/**
+	 * Every child linked to a guardian, oldest link first — the order they are
+	 * offered in the booking selector, so it stays stable as children are added.
+	 *
+	 * @return list<GuardianLink>
+	 */
+	public function findByGuardian( int $guardianId ): array {
+		$rows = $this->db->get_results(
+			$this->db->prepare(
+				'SELECT * FROM %i WHERE guardian_id = %d ORDER BY created_at ASC, id ASC',
+				$this->table,
+				$guardianId
+			)
+		);
+
+		return array_map( GuardianLink::fromRow( ... ), $rows ?? [] );
+	}
+
+	/**
+	 * Whether this exact guardian↔child pair is linked — the authorisation check
+	 * behind every "act for this student" boundary.
+	 */
+	public function isGuardianOf( int $guardianId, int $studentId ): bool {
+		$found = $this->db->get_var(
+			$this->db->prepare(
+				'SELECT id FROM %i WHERE guardian_id = %d AND student_id = %d LIMIT 1',
+				$this->table,
+				$guardianId,
+				$studentId
+			)
+		);
+
+		return null !== $found;
+	}
+
+	/**
+	 * Remove the link between a guardian and one of their children. Deleting the
+	 * child user itself is the caller's decision ({@see GuardianService::removeChild()});
+	 * this only unlinks.
+	 */
+	public function delete( int $guardianId, int $studentId ): bool {
+		$deleted = $this->db->delete(
+			$this->table,
+			[
+				'guardian_id' => $guardianId,
+				'student_id'  => $studentId,
+			],
+			[ '%d', '%d' ]
+		);
+
+		return (int) $deleted > 0;
+	}
+
+	/**
+	 * How many children a guardian has — enough to decide whether the booking
+	 * page needs a "who is this for?" selector at all.
+	 */
+	public function countChildren( int $guardianId ): int {
+		$count = $this->db->get_var(
+			$this->db->prepare(
+				'SELECT COUNT(*) FROM %i WHERE guardian_id = %d',
+				$this->table,
+				$guardianId
+			)
+		);
+
+		return (int) $count;
+	}
+}