Bulk delete availability slots from the admin list view

The list view of Current Slots gets a checkbox per unbooked slot, a
select-all header checkbox, and a Delete selected button submitting a
new bulk_delete form action. Each id is ownership-checked through the
same path as single delete; the repository's is_booked guard refuses
booked slots as a second layer. Row checkboxes attach to the bulk form
via the HTML form attribute because the table already contains the
per-row delete forms and forms cannot nest.

Closes #57

Co-Authored-By: Claude Fable 5 <[email protected]>

docs/features/availability-management.md

@@ -41,6 +41,7 @@ Instructors access **My Availability** in wp-admin (`?page=us-availability`).
 - Add availability: provide a same-day start/end window, lesson length, and (optionally) a linked private-lesson offering
 - Add a weekly series: tick weekly repeat and choose the number of weeks
 - Delete a slot: only allowed if `is_booked = 0`
+- Bulk delete: the list view has a checkbox per unbooked slot (with a select-all header checkbox) and a **Delete selected** button (`usc_action=bulk_delete`, `slot_ids[]`); each id is ownership-checked, and booked slots are refused at the repository level
 - Current slots can be shown as a **list** or a **weekly calendar** (`usc_view=week`, navigated with `usc_week=Y-m-d`); the grid honours the site's `start_of_week` option via `Availability\WeekCalendar`
 
 ## Public Calendar
@@ -77,6 +78,7 @@ lists.
 - REST endpoint: `Unsupervised\Schedular\Availability\AvailabilityEndpoint`
 
 ## Tests
+- `tests/Unit/Availability/AvailabilityControllerTest.php`
 - `tests/Unit/Availability/AvailabilityRepositoryTest.php`
 - `tests/Unit/Availability/AvailabilitySlotTest.php`
 - `tests/Unit/Availability/AvailabilityEndpointTest.php`

src/Availability/AvailabilityController.php

@@ -54,16 +54,35 @@ class AvailabilityController {
 		}
 
 		if ( 'delete' === $action ) {
-			$slotId = absint( Val::int( $_POST['slot_id'] ?? 0 ) );
-			if ( $slotId > 0 ) {
+			$this->deleteOwnSlot( absint( Val::int( $_POST['slot_id'] ?? 0 ) ), $instructorId );
+		}
+
+		if ( 'bulk_delete' === $action ) {
+			// The array itself carries no data; each element is coerced and
+			// absint-sanitized individually below.
+			// phpcs:ignore WordPress.Security.ValidatedSanitizedInput
+			$rawIds = $_POST['slot_ids'] ?? [];
+			foreach ( is_array( $rawIds ) ? $rawIds : [] as $rawId ) {
+				$this->deleteOwnSlot( absint( Val::int( $rawId ) ), $instructorId );
+			}
+		}
+		// phpcs:enable WordPress.Security.NonceVerification.Missing
+	}
+
+	/**
+	 * Delete a slot only when it exists and belongs to the given instructor.
+	 * The repository additionally refuses to delete booked slots.
+	 */
+	private function deleteOwnSlot( int $slotId, int $instructorId ): void {
+		if ( $slotId <= 0 ) {
+			return;
+		}
+
 		$slot = $this->repository->findById( $slotId );
 		if ( $slot && $slot->instructorId === $instructorId ) {
 			$this->repository->delete( $slotId );
 		}
 	}
-		}
-		// phpcs:enable WordPress.Security.NonceVerification.Missing
-	}
 
 	private function addSlot( int $instructorId ): void {
 		// phpcs:disable WordPress.Security.NonceVerification.Missing

templates/admin/availability.php

@@ -136,9 +136,22 @@ $deleteForm = static function (\Unsupervised\Schedular\Availability\Availability
     <?php elseif (empty($slots)) : ?>
         <p><?php esc_html_e('No availability slots configured.', 'unsupervised-schedular'); ?></p>
     <?php else : ?>
+        <?php
+        // Bulk-delete form. The row checkboxes live inside the table and are
+        // associated via the HTML form attribute, because the table also
+        // contains the per-row delete forms and forms cannot nest.
+        ?>
+        <form method="post" id="usc-bulk-delete-form" onsubmit="return confirm('<?php echo esc_js(__('Delete the selected slots?', 'unsupervised-schedular')); ?>');">
+            <?php wp_nonce_field('usc_availability_action'); ?>
+            <input type="hidden" name="usc_action" value="bulk_delete">
+        </form>
         <table class="wp-list-table widefat fixed striped">
             <thead>
                 <tr>
+                    <td class="manage-column column-cb check-column">
+                        <input type="checkbox" id="cb-select-all-1">
+                        <label for="cb-select-all-1"><span class="screen-reader-text"><?php esc_html_e('Select all', 'unsupervised-schedular'); ?></span></label>
+                    </td>
                     <th><?php esc_html_e('Start', 'unsupervised-schedular'); ?></th>
                     <th><?php esc_html_e('End', 'unsupervised-schedular'); ?></th>
                     <th><?php esc_html_e('Length', 'unsupervised-schedular'); ?></th>
@@ -149,6 +162,11 @@ $deleteForm = static function (\Unsupervised\Schedular\Availability\Availability
             <tbody>
                 <?php foreach ($slots as $slot) : ?>
                     <tr>
+                        <th scope="row" class="check-column">
+                            <?php if (! $slot->isBooked) : ?>
+                                <input type="checkbox" name="slot_ids[]" form="usc-bulk-delete-form" value="<?php echo esc_attr((string) $slot->id); ?>">
+                            <?php endif; ?>
+                        </th>
                         <td><?php echo esc_html((string) mysql2date('M j, Y g:i A', $slot->startDt)); ?></td>
                         <td><?php echo esc_html((string) mysql2date('M j, Y g:i A', $slot->endDt)); ?></td>
                         <td><?php echo esc_html((string) $slot->durationMinutes . ' min'); ?></td>
@@ -162,5 +180,10 @@ $deleteForm = static function (\Unsupervised\Schedular\Availability\Availability
                 <?php endforeach; ?>
             </tbody>
         </table>
+        <p>
+            <button type="submit" class="button" form="usc-bulk-delete-form">
+                <?php esc_html_e('Delete selected', 'unsupervised-schedular'); ?>
+            </button>
+        </p>
     <?php endif; ?>
 </div>

tests/Unit/Availability/AvailabilityControllerTest.php

@@ -0,0 +1,125 @@
+<?php
+declare(strict_types=1);
+
+namespace Unsupervised\Schedular\Tests\Unit\Availability;
+
+use Brain\Monkey\Functions;
+use Mockery;
+use Unsupervised\Schedular\Availability\AvailabilityController;
+use Unsupervised\Schedular\Availability\AvailabilityRepository;
+use Unsupervised\Schedular\Availability\AvailabilitySlot;
+use Unsupervised\Schedular\Offering\OfferingRepository;
+use Unsupervised\Schedular\Tests\Unit\TestCase;
+
+class AvailabilityControllerTest extends TestCase
+{
+    private AvailabilityRepository&Mockery\MockInterface $repository;
+    private OfferingRepository&Mockery\MockInterface $offerings;
+    private AvailabilityController $controller;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        $this->repository = Mockery::mock(AvailabilityRepository::class);
+        $this->offerings  = Mockery::mock(OfferingRepository::class);
+        $this->controller = new AvailabilityController($this->repository, $this->offerings);
+
+        $_POST = [];
+        $_GET  = [];
+
+        Functions\when('current_user_can')->justReturn(true);
+        Functions\when('get_current_user_id')->justReturn(3);
+        Functions\when('check_admin_referer')->justReturn(true);
+        Functions\when('wp_unslash')->returnArg();
+        Functions\when('sanitize_text_field')->returnArg();
+        Functions\when('sanitize_key')->alias(
+            static fn ($key) => strtolower((string) preg_replace('/[^a-zA-Z0-9_\-]/', '', (string) $key))
+        );
+        Functions\when('absint')->alias(static fn ($value) => abs((int) $value));
+        Functions\when('get_option')->justReturn(1);
+        Functions\when('current_time')->justReturn('2026-07-06');
+        Functions\when('admin_url')->justReturn('admin.php?page=us-availability');
+        Functions\when('add_query_arg')->justReturn('admin.php?page=us-availability&usc_view=week');
+        Functions\when('wp_nonce_field')->justReturn('');
+        Functions\when('submit_button')->justReturn('');
+        Functions\when('mysql2date')->alias(
+            static fn (string $format, string $date) => date($format, (int) strtotime($date))
+        );
+
+        $this->offerings->shouldReceive('findAll')->andReturn([]);
+    }
+
+    public function testBulkDeleteRemovesOnlyOwnedExistingSlots(): void
+    {
+        $_POST = [
+            'usc_action' => 'bulk_delete',
+            'slot_ids'   => ['5', 'junk', '7', '9'],
+        ];
+
+        $owned = new AvailabilitySlot(instructorId: 3, startDt: '2026-07-08 09:00:00', endDt: '2026-07-08 10:00:00', id: 5);
+        $other = new AvailabilitySlot(instructorId: 4, startDt: '2026-07-08 09:00:00', endDt: '2026-07-08 10:00:00', id: 7);
+
+        $this->repository->shouldReceive('findById')->once()->with(5)->andReturn($owned);
+        $this->repository->shouldReceive('findById')->once()->with(7)->andReturn($other);
+        $this->repository->shouldReceive('findById')->once()->with(9)->andReturn(null);
+        $this->repository->shouldReceive('delete')->once()->with(5)->andReturn(true);
+        $this->repository->shouldReceive('findByInstructor')->once()->with(3)->andReturn([]);
+
+        $this->render();
+    }
+
+    public function testBulkDeleteIgnoresNonArrayInput(): void
+    {
+        $_POST = [
+            'usc_action' => 'bulk_delete',
+            'slot_ids'   => '5',
+        ];
+
+        $this->repository->shouldNotReceive('findById');
+        $this->repository->shouldNotReceive('delete');
+        $this->repository->shouldReceive('findByInstructor')->once()->with(3)->andReturn([]);
+
+        $this->render();
+    }
+
+    public function testSingleDeleteChecksOwnership(): void
+    {
+        $_POST = [
+            'usc_action' => 'delete',
+            'slot_id'    => '7',
+        ];
+
+        $other = new AvailabilitySlot(instructorId: 4, startDt: '2026-07-08 09:00:00', endDt: '2026-07-08 10:00:00', id: 7);
+
+        $this->repository->shouldReceive('findById')->once()->with(7)->andReturn($other);
+        $this->repository->shouldNotReceive('delete');
+        $this->repository->shouldReceive('findByInstructor')->once()->with(3)->andReturn([]);
+
+        $this->render();
+    }
+
+    public function testListViewRendersBulkCheckboxesOnlyForUnbookedSlots(): void
+    {
+        $unbooked = new AvailabilitySlot(instructorId: 3, startDt: '2026-07-08 09:00:00', endDt: '2026-07-08 10:00:00', id: 5);
+        $booked   = new AvailabilitySlot(instructorId: 3, startDt: '2026-07-08 10:00:00', endDt: '2026-07-08 11:00:00', isBooked: true, id: 6);
+
+        $this->repository->shouldReceive('findByInstructor')->once()->with(3)->andReturn([$unbooked, $booked]);
+
+        $html = $this->render();
+
+        self::assertStringContainsString('id="usc-bulk-delete-form"', $html);
+        self::assertStringContainsString('value="bulk_delete"', $html);
+        self::assertStringContainsString('Delete selected', $html);
+        self::assertStringContainsString('name="slot_ids[]" form="usc-bulk-delete-form" value="5"', $html);
+        self::assertStringNotContainsString('name="slot_ids[]" form="usc-bulk-delete-form" value="6"', $html);
+    }
+
+    private function render(): string
+    {
+        ob_start();
+        $this->controller->renderPage();
+
+        return (string) ob_get_clean();
+    }
+}