Require an offering on every lesson booking, with a student-facing picker

Generic slots (no tied offering) were bookable with no offering at all:
free, instantly confirmed, and with no intake questions. POST /bookings
now rejects offering-less bookings (400 offering_required), and a
student-chosen offering must be an active private-lesson type owned by
the slot's instructor whose duration matches the slot.

The registration form gains a Lesson type field: locked to the slot's
tied offering (title, duration, price) so the student sees what they
are booking, or a required picker of fitting offerings for generic
slots, with intake questions following the selection.

Fixes #55

Co-Authored-By: Claude Fable 5 <[email protected]>

src/Booking/BookingEndpoint.php

@@ -5,6 +5,7 @@ namespace Unsupervised\Schedular\Booking;
 
 use Unsupervised\Schedular\Availability\AvailabilityRepository;
 use Unsupervised\Schedular\Auth\RoleManager;
+use Unsupervised\Schedular\Offering\Offering;
 use Unsupervised\Schedular\Offering\OfferingRepository;
 use Unsupervised\Schedular\Payment\Payment;
 use Unsupervised\Schedular\Payment\PaymentService;
@@ -165,15 +166,35 @@ class BookingEndpoint {
 			$offeringId = $requestedOfferingId;
 		}
 
-		$offering = $offeringId > 0 ? $this->offerings->findById( $offeringId ) : null;
-		if ( $offeringId > 0 && null === $offering ) {
+		// Every lesson books against an offering: it carries the price, intake
+		// questions, and payment routing. Without one the booking would silently
+		// be free and unquestioned, so generic slots require the student's choice.
+		if ( $offeringId <= 0 ) {
+			return new \WP_Error( 'offering_required', __( 'Choose a lesson type to book this slot.', 'unsupervised-schedular' ), [ 'status' => 400 ] );
+		}
+
+		$offering = $this->offerings->findById( $offeringId );
+		if ( null === $offering ) {
 			return new \WP_Error( 'invalid_offering', __( 'Offering not found.', 'unsupervised-schedular' ), [ 'status' => 400 ] );
 		}
 
-		if ( null !== $offering && $offering->instructorId !== $slot->instructorId ) {
+		if ( $offering->instructorId !== $slot->instructorId ) {
 			return new \WP_Error( 'offering_mismatch', __( 'That offering is not available for this slot.', 'unsupervised-schedular' ), [ 'status' => 400 ] );
 		}
 
+		// A slot-tied offering was the instructor's explicit choice and is honoured
+		// as-is; a student-chosen one must be something the catalog actually offers
+		// for this slot: an active private-lesson type whose length fits the slot.
+		if ( 0 === $slotOfferingId ) {
+			if ( ! $offering->isActive || Offering::KIND_PRIVATE_LESSON !== $offering->kind ) {
+				return new \WP_Error( 'invalid_offering', __( 'That offering cannot be booked as a private lesson.', 'unsupervised-schedular' ), [ 'status' => 400 ] );
+			}
+
+			if ( null !== $offering->durationMinutes && $offering->durationMinutes !== $slot->durationMinutes ) {
+				return new \WP_Error( 'offering_mismatch', __( 'That offering does not match this slot\'s lesson length.', 'unsupervised-schedular' ), [ 'status' => 400 ] );
+			}
+		}
+
 		$answers            = $this->answers( $request );
 		$acceptedVersionIds = array_values( array_map( static fn( mixed $v ): int => absint( Val::int( $v ) ), (array) $request->get_param( 'accepted_policy_version_ids' ) ) );
 
@@ -192,7 +213,7 @@ class BookingEndpoint {
 			slotId:       $slotId,
 			studentId:    $studentId,
 			instructorId: $slot->instructorId,
-			offeringId:   $offeringId > 0 ? $offeringId : null,
+			offeringId:   $offeringId,
 			recurrence:   $recurrence,
 			notes:        '' !== $notes ? $notes : null,
 		);
@@ -227,14 +248,14 @@ class BookingEndpoint {
 		$payment = null;
 		$status  = Lesson::STATUS_PENDING;
 
-		if ( null !== $offering && $offering->price > 0.0 ) {
+		if ( $offering->price > 0.0 ) {
 			$payment = $this->payments->createForRegistration( Payment::REG_LESSON, $anchorId, $studentId, $slot->instructorId, $offering->price, $offering->currency, $offering->etransferEmail );
 
 			if ( null !== $payment && $payment->isPaid() ) {
 				$status = Lesson::STATUS_CONFIRMED;
 			}
 		} else {
-			// Nothing owed: there is no payment step that would confirm these
+			// Free offering: there is no payment step that would confirm these
 			// lessons later, so they are confirmed at booking time.
 			foreach ( $ids as $lessonId ) {
 				$this->bookings->updateStatus( $lessonId, Lesson::STATUS_CONFIRMED );