Let parents register once and book for their children

A parent registers once and manages lessons for one or more children, who
need no login of their own. A child is a real wp_users row with the student
role but no usable login — so student_id keeps meaning "a WordPress user"
on every table, and booking, credits, policies and enrolments work unchanged.
A us_guardians link table maps guardian to child.

The signup form gains a parent/guardian tick that reveals a block per child,
with the account-signup questions asked per child rather than per guardian
— they describe the student, not the account holder. Signup policies are
recorded once per child with the guardian as the acceptor, which is the
record that actually means something. A family that half-creates is rolled
back entirely rather than leaving a guardian who cannot re-register.

The booking and enrolment forms gain a "Who is this for?" picker listing
children first, so the default selection is never the parent — booking for
the wrong child is correctable, quietly billing a parent for their kid's
lesson is not. POST /bookings and POST /enrollments take an optional
student_id honoured only for that child's guardian; anything else is a 403.
That check is the authorisation boundary of the feature.

Payments and credits gain a payer: the charge names the child it was for and
the guardian who owes it, so per-child reporting is unchanged while notices,
receipts and the payment step reach the parent. Credit is held by the payer,
so one child's cancellation can settle a sibling's charge, and the daily
billing scan sends a guardian one notice covering every child.

Closes #132

Co-Authored-By: Claude Opus 5 <[email protected]>

src/Registration/QuestionField.php

@@ -0,0 +1,61 @@
+<?php
+declare(strict_types=1);
+
+namespace Unsupervised\Schedular\Registration;
+
+/**
+ * Renders one registration question as a form field. Shared by the signup form
+ * and the guardian's family screen, which ask the same account-scope questions —
+ * once per guardian at signup, and once per child either way.
+ */
+class QuestionField {
+
+	/**
+	 * The field's markup, escaped and ready to echo.
+	 *
+	 * `$name` is the full input name (e.g. `us_answers[7]`), and `$id` the DOM id
+	 * the label points at — both supplied by the caller so the same question can
+	 * appear more than once on a page (one block per child) without colliding.
+	 *
+	 * `$enforceRequired` false keeps the required marker in the label but drops
+	 * the HTML attribute, for a block the browser must not block submission on
+	 * because it may not apply at all — the child blocks, which only count when
+	 * the parent/guardian box is ticked. The server validates those either way.
+	 */
+	public static function render( Question $question, string $name, string $id, bool $enforceRequired = true ): string {
+		$required = $question->isRequired && $enforceRequired ? ' required' : '';
+
+		$label = '<label for="' . esc_attr( $id ) . '">' . esc_html( $question->label )
+			. ( $question->isRequired ? ' <span class="us-required" aria-hidden="true">*</span>' : '' )
+			. '</label>';
+
+		return '<p>' . $label . self::input( $question, $name, $id, $required ) . '</p>';
+	}
+
+	/**
+	 * The input element itself, chosen by the question's field type. `$required`
+	 * is a literal attribute string (' required' or ''), not user input.
+	 */
+	private static function input( Question $question, string $name, string $id, string $required ): string {
+		$common = ' name="' . esc_attr( $name ) . '" id="' . esc_attr( $id ) . '"' . $required;
+
+		if ( Question::FIELD_TEXTAREA === $question->fieldType ) {
+			return '<textarea' . $common . ' rows="4"></textarea>';
+		}
+
+		if ( Question::FIELD_SELECT === $question->fieldType ) {
+			$options = '<option value="">' . esc_html__( '— Select —', 'unsupervised-schedular' ) . '</option>';
+			foreach ( (array) $question->options as $option ) {
+				$options .= '<option value="' . esc_attr( (string) $option ) . '">' . esc_html( (string) $option ) . '</option>';
+			}
+
+			return '<select' . $common . '>' . $options . '</select>';
+		}
+
+		if ( Question::FIELD_CHECKBOX === $question->fieldType ) {
+			return '<input type="checkbox"' . $common . ' value="1">';
+		}
+
+		return '<input type="text"' . $common . '>';
+	}
+}

src/Registration/RegistrationGate.php

@@ -58,10 +58,14 @@ class RegistrationGate {
 	/**
 	 * Persist answers and policy acceptances for a created registration.
 	 *
+	 * `$acceptedBy` is who actually agreed, when that is not the student — a
+	 * guardian booking for a child. It defaults to 0, read back as "the student
+	 * agreed for themselves".
+	 *
 	 * @param array<int, string> $answers            question_id => answer value
 	 * @param list<int>          $acceptedVersionIds Accepted policy version IDs
 	 */
-	public function record( string $registrationType, int $registrationId, int $studentId, int $offeringId, array $answers, array $acceptedVersionIds, ?string $ipAddress = null ): void {
+	public function record( string $registrationType, int $registrationId, int $studentId, int $offeringId, array $answers, array $acceptedVersionIds, ?string $ipAddress = null, int $acceptedBy = 0 ): void {
 		foreach ( $this->questions->findByOffering( $offeringId, true ) as $question ) {
 			$value = (string) ( $answers[ (int) $question->id ] ?? '' );
 			if ( '' === $value ) {
@@ -90,6 +94,7 @@ class RegistrationGate {
 					studentId:        $studentId,
 					registrationType: $registrationType,
 					registrationId:   $registrationId,
+					acceptedBy:       $acceptedBy > 0 ? $acceptedBy : $studentId,
 					ipAddress:        $ipAddress,
 				)
 			);