Merge pull request 'Student detail: history sections and admin actions (cancel, withdraw, edit account)' (#75) from feature/student-detail-history into main

Reviewed-on: #75

docs/features/student-administration.md

@@ -1,15 +1,21 @@
 # Feature: Student Administration
 
 ## Overview
-A read-only studio-admin area to browse students and drill into one student's
-history and upcoming activity — lessons and group-class enrolments — without
-digging through individual records.
+A studio-admin area to browse students, drill into one student's history and
+upcoming activity — lessons and group-class enrolments — and act on their
+behalf: cancel a lesson, withdraw them from a group class, or fix their account
+details.
 
 ## Data Model
 No new tables. The views are composed from existing data:
 - Students are WordPress users with the `us_student` role (`get_users`, `get_userdata`).
 - Lessons come from `{prefix}us_lessons` (with `{prefix}us_availability` for slot times).
 - Group-class enrolments come from `{prefix}us_group_enrollments`.
+- Policy acceptances come from `{prefix}us_policy_acceptances` (with the policy
+  and version tables for titles/numbers).
+- Intake answers come from `{prefix}us_question_answers` (with `{prefix}us_questions`
+  for labels).
+- Payments come from `{prefix}us_payments`.
 
 ## Admin Interface
 **Students** in wp-admin (`manage_students`, studio admin only):
@@ -22,10 +28,25 @@ No new tables. The views are composed from existing data:
   - **Upcoming lessons** and **Past lessons** — split by the linked availability
     slot's `start_dt`; each shows date/time, offering, instructor, and status.
   - **Group-class enrolments** — active/past, with offering title and status.
-  - *(Later)* policy-acceptance history, intake answers, and payment history once
-    Payments lands.
+  - **Policy acceptances** — every acceptance the student has recorded, newest
+    first: policy title, version, context (account signup / lesson / enrolment),
+    and when it was accepted.
+  - **Intake answers** — every registration-question answer, newest first:
+    question label, answer, and the registration it was given for.
+  - **Payment history** (`manage_billing` only) — every payment, newest first:
+    date, context, method, status, subtotal, HST, total, and receipt number.
 
-Read-only in this iteration; cancel/edit actions are a possible follow-up.
+### Admin actions (detail view)
+All actions are nonce-protected POSTs handled on the detail page:
+
+- **Edit account** — display name and email. The email must be valid and not in
+  use by another account.
+- **Cancel lesson** — on any non-cancelled upcoming lesson. Uses the same path
+  as student-initiated cancellation: the lesson is marked `cancelled`, the
+  availability slot is freed for rebooking, and a still-pending payment is
+  voided. Paid lessons keep their payment — refunds stay a manual decision (#72).
+- **Withdraw** — on an active group-class enrolment: marked `cancelled` (freeing
+  its capacity seat), with the same pending-payment voiding.
 
 ## Capabilities
 - `manage_students` — studio admin (administrators inherit it via the
@@ -38,6 +59,15 @@ Read-only in this iteration; cancel/edit actions are a possible follow-up.
   `Availability\AvailabilityRepository::findById`,
   `Offering\OfferingRepository::findById`,
   `GroupClass\EnrollmentRepository::findByStudent` + `countActiveForStudent`
+- History sections: `Auth\StudentHistory` builds the display rows from
+  `Policy\AcceptanceRepository::findByStudent`,
+  `Registration\AnswerRepository::findByStudent`, and
+  `Payment\PaymentRepository::findByStudent`, resolving policy/version titles and
+  question labels (unit-tested with mocked repositories).
+- Actions: `Auth\StudentActions` — cancel lesson / withdraw enrolment (both
+  refuse records that don't belong to the student, and reuse
+  `Payment\PaymentService::voidPending`) and account updates via
+  `wp_update_user` (unit-tested with mocked repositories).
 - Upcoming/past split: `Auth\StudentSchedule::partition()` (pure, unit-tested)
 - The upcoming/past split is extracted into a small pure helper so it is
   unit-testable (the controller itself follows the repo convention of not being
@@ -45,3 +75,9 @@ Read-only in this iteration; cancel/edit actions are a possible follow-up.
 
 ## Tests
 - `tests/Unit/Auth/StudentScheduleTest.php` (the pure upcoming/past split helper)
+- `tests/Unit/Auth/StudentHistoryTest.php` (history display rows + fallbacks)
+- `tests/Unit/Auth/StudentActionsTest.php` (cancel/withdraw guards + side
+  effects, account validation)
+- `findByStudent` coverage in `tests/Unit/Policy/AcceptanceRepositoryTest.php`,
+  `tests/Unit/Registration/AnswerRepositoryTest.php`, and
+  `tests/Unit/Payment/PaymentRepositoryTest.php`

src/AdminMenu.php

@@ -12,7 +12,9 @@ use Unsupervised\Schedular\Auth\RegistrationApprovalController;
 use Unsupervised\Schedular\Auth\RegistrationController;
 use Unsupervised\Schedular\Auth\RegistrationMailer;
 use Unsupervised\Schedular\Auth\RoleManager;
+use Unsupervised\Schedular\Auth\StudentActions;
 use Unsupervised\Schedular\Auth\StudentController;
+use Unsupervised\Schedular\Auth\StudentHistory;
 use Unsupervised\Schedular\Booking\BookingRepository;
 use Unsupervised\Schedular\Booking\LessonController;
 use Unsupervised\Schedular\GroupClass\EnrollmentRepository;
@@ -25,10 +27,12 @@ use Unsupervised\Schedular\Payment\PaymentReportController;
 use Unsupervised\Schedular\Payment\PaymentRepository;
 use Unsupervised\Schedular\Payment\PaymentService;
 use Unsupervised\Schedular\Payment\StudioSettings;
+use Unsupervised\Schedular\Policy\AcceptanceRepository;
 use Unsupervised\Schedular\Policy\PolicyController;
 use Unsupervised\Schedular\Policy\PolicyRepository;
 use Unsupervised\Schedular\Policy\PolicyService;
 use Unsupervised\Schedular\Policy\PolicyVersionRepository;
+use Unsupervised\Schedular\Registration\AnswerRepository;
 use Unsupervised\Schedular\Registration\QuestionController;
 use Unsupervised\Schedular\Registration\QuestionRepository;
 
@@ -49,7 +53,7 @@ class AdminMenu {
 	private PaymentController $paymentController;
 	private PaymentReportController $paymentReportController;
 
-	public function __construct( AvailabilityRepository $availability, BookingRepository $bookings, OfferingRepository $offerings, QuestionRepository $questions, PolicyRepository $policies, PolicyVersionRepository $policyVersions, PolicyService $policyService, InviteRepository $invites, EnrollmentRepository $enrollments, StudioSettings $settings, PaymentRepository $payments, PaymentService $paymentService, BillingMethodResolver $resolver ) {
+	public function __construct( AvailabilityRepository $availability, BookingRepository $bookings, OfferingRepository $offerings, QuestionRepository $questions, AnswerRepository $answers, PolicyRepository $policies, PolicyVersionRepository $policyVersions, PolicyService $policyService, AcceptanceRepository $acceptances, InviteRepository $invites, EnrollmentRepository $enrollments, StudioSettings $settings, PaymentRepository $payments, PaymentService $paymentService, BillingMethodResolver $resolver ) {
 		$this->availabilityController         = new AvailabilityController( $availability, $offerings );
 		$this->lessonController               = new LessonController( $bookings, $payments, $availability );
 		$this->offeringController             = new OfferingController( $offerings );
@@ -58,7 +62,7 @@ class AdminMenu {
 		$this->registrationController         = new RegistrationController( $invites );
 		$this->registrationApprovalController = new RegistrationApprovalController( new RegistrationMailer() );
 		$this->groupClassController           = new GroupClassController( $enrollments, $offerings );
-		$this->studentController              = new StudentController( $bookings, $availability, $offerings, $enrollments, $resolver );
+		$this->studentController              = new StudentController( $bookings, $availability, $offerings, $enrollments, $resolver, new StudentHistory( $acceptances, $policies, $policyVersions, $answers, $questions, $payments ), new StudentActions( $bookings, $availability, $enrollments, $paymentService ) );
 		$this->instructorController           = new InstructorController();
 		$this->settings                       = $settings;
 		$this->accessSettings                 = new AccessSettings();

src/Auth/StudentActions.php

@@ -0,0 +1,92 @@
+<?php
+declare(strict_types=1);
+
+namespace Unsupervised\Schedular\Auth;
+
+use Unsupervised\Schedular\Availability\AvailabilityRepository;
+use Unsupervised\Schedular\Booking\BookingRepository;
+use Unsupervised\Schedular\Booking\Lesson;
+use Unsupervised\Schedular\GroupClass\Enrollment;
+use Unsupervised\Schedular\GroupClass\EnrollmentRepository;
+use Unsupervised\Schedular\Payment\PaymentService;
+
+/**
+ * Studio-admin actions on a single student from the student detail view:
+ * cancelling a lesson, withdrawing a group-class enrolment, and editing basic
+ * account details. Mutations go through the same paths as the student-facing
+ * flows so slot release and pending-payment voiding stay consistent.
+ */
+class StudentActions {
+
+	public function __construct(
+		private BookingRepository $bookings,
+		private AvailabilityRepository $availability,
+		private EnrollmentRepository $enrollments,
+		private PaymentService $payments,
+	) {}
+
+	/**
+	 * Cancel a lesson on the student's behalf: marks it cancelled, frees the
+	 * slot for rebooking, and voids a still-pending payment. Paid lessons keep
+	 * their payment — refunds are a manual, admin-side decision.
+	 */
+	public function cancelLesson( int $lessonId, int $studentId ): bool {
+		$lesson = $this->bookings->findById( $lessonId );
+
+		if ( null === $lesson || $lesson->studentId !== $studentId || Lesson::STATUS_CANCELLED === $lesson->status ) {
+			return false;
+		}
+
+		$this->bookings->updateStatus( $lessonId, Lesson::STATUS_CANCELLED );
+		$this->availability->release( $lesson->slotId );
+		$this->payments->voidPending( $lesson->paymentId );
+
+		return true;
+	}
+
+	/**
+	 * Withdraw the student from a group class: marks the active enrolment
+	 * cancelled (freeing its capacity seat) and voids a still-pending payment.
+	 */
+	public function withdrawEnrollment( int $enrollmentId, int $studentId ): bool {
+		$enrollment = $this->enrollments->findById( $enrollmentId );
+
+		if ( null === $enrollment || $enrollment->studentId !== $studentId || Enrollment::STATUS_ACTIVE !== $enrollment->status ) {
+			return false;
+		}
+
+		$this->enrollments->updateStatus( $enrollmentId, Enrollment::STATUS_CANCELLED );
+		$this->payments->voidPending( $enrollment->paymentId );
+
+		return true;
+	}
+
+	/**
+	 * Update the student's display name and email. The email must be valid and
+	 * not belong to another user.
+	 */
+	public function updateAccount( int $studentId, string $displayName, string $email ): bool|\WP_Error {
+		if ( '' === $displayName ) {
+			return new \WP_Error( 'empty_name', __( 'Display name cannot be empty.', 'unsupervised-schedular' ) );
+		}
+
+		if ( ! is_email( $email ) ) {
+			return new \WP_Error( 'invalid_email', __( 'Please enter a valid email address.', 'unsupervised-schedular' ) );
+		}
+
+		$existing = email_exists( $email );
+		if ( false !== $existing && (int) $existing !== $studentId ) {
+			return new \WP_Error( 'email_taken', __( 'Another account already uses this email address.', 'unsupervised-schedular' ) );
+		}
+
+		$result = wp_update_user(
+			[
+				'ID'           => $studentId,
+				'display_name' => $displayName,
+				'user_email'   => $email,
+			]
+		);
+
+		return $result instanceof \WP_Error ? $result : true;
+	}
+}

src/Auth/StudentController.php

@@ -21,6 +21,8 @@ class StudentController {
 		private OfferingRepository $offerings,
 		private EnrollmentRepository $enrollments,
 		private BillingMethodResolver $resolver,
+		private StudentHistory $history,
+		private StudentActions $actions,
 	) {}
 
 	public function renderPage(): void {
@@ -65,7 +67,13 @@ class StudentController {
 	private function renderDetail( \WP_User $student ): void {
 		$canBilling = current_user_can( RoleManager::CAP_MANAGE_BILLING );
 
-		if ( $canBilling && isset( $_POST['usc_action'] ) && check_admin_referer( 'usc_student_billing' ) ) {
+		// phpcs:ignore WordPress.Security.NonceVerification.Missing -- routing only; each action below verifies its own nonce.
+		$action = sanitize_key( Val::string( wp_unslash( $_POST['usc_action'] ?? '' ) ) );
+
+		$notice = '';
+		$error  = '';
+
+		if ( $canBilling && 'set_billing' === $action && check_admin_referer( 'usc_student_billing' ) ) {
 			// phpcs:ignore WordPress.Security.NonceVerification.Missing -- nonce checked above.
 			$method = sanitize_key( Val::string( wp_unslash( $_POST['payment_method'] ?? '' ) ) );
 			if ( in_array( $method, Payment::VALID_METHODS, true ) ) {
@@ -75,6 +83,42 @@ class StudentController {
 			}
 		}
 
+		if ( 'update_account' === $action && check_admin_referer( 'usc_student_actions' ) ) {
+			// phpcs:disable WordPress.Security.NonceVerification.Missing -- nonce checked above.
+			$displayName = sanitize_text_field( Val::string( wp_unslash( $_POST['display_name'] ?? '' ) ) );
+			$email       = sanitize_email( Val::string( wp_unslash( $_POST['user_email'] ?? '' ) ) );
+			// phpcs:enable WordPress.Security.NonceVerification.Missing
+
+			$result = $this->actions->updateAccount( (int) $student->ID, $displayName, $email );
+			if ( $result instanceof \WP_Error ) {
+				$error = $result->get_error_message();
+			} else {
+				$notice  = __( 'Account details updated.', 'unsupervised-schedular' );
+				$fresh   = get_userdata( (int) $student->ID );
+				$student = $fresh instanceof \WP_User ? $fresh : $student;
+			}
+		}
+
+		if ( 'cancel_lesson' === $action && check_admin_referer( 'usc_student_actions' ) ) {
+			// phpcs:ignore WordPress.Security.NonceVerification.Missing -- nonce checked above.
+			$lessonId = absint( Val::int( $_POST['lesson_id'] ?? 0 ) );
+			if ( $this->actions->cancelLesson( $lessonId, (int) $student->ID ) ) {
+				$notice = __( 'Lesson cancelled.', 'unsupervised-schedular' );
+			} else {
+				$error = __( 'This lesson could not be cancelled.', 'unsupervised-schedular' );
+			}
+		}
+
+		if ( 'withdraw_enrollment' === $action && check_admin_referer( 'usc_student_actions' ) ) {
+			// phpcs:ignore WordPress.Security.NonceVerification.Missing -- nonce checked above.
+			$enrollmentId = absint( Val::int( $_POST['enrollment_id'] ?? 0 ) );
+			if ( $this->actions->withdrawEnrollment( $enrollmentId, (int) $student->ID ) ) {
+				$notice = __( 'Enrolment withdrawn.', 'unsupervised-schedular' );
+			} else {
+				$error = __( 'This enrolment could not be withdrawn.', 'unsupervised-schedular' );
+			}
+		}
+
 		$billingOverride = Val::string( get_user_meta( (int) $student->ID, BillingMethodResolver::META_METHOD, true ) );
 		$billingDefault  = $this->resolver->defaultMethod();
 
@@ -93,6 +137,7 @@ class StudentController {
 				$offering = $this->offerings->findById( $enrollment->offeringId );
 
 				return [
+					'id'       => (int) $enrollment->id,
 					'offering' => $offering ? $offering->title : (string) $enrollment->offeringId,
 					'status'   => $enrollment->status,
 				];
@@ -100,6 +145,10 @@ class StudentController {
 			$this->enrollments->findByStudent( (int) $student->ID )
 		);
 
+		$acceptances = $this->history->policyAcceptances( (int) $student->ID );
+		$intake      = $this->history->intakeAnswers( (int) $student->ID );
+		$payments    = $canBilling ? $this->history->payments( (int) $student->ID ) : [];
+
 		$backUrl = admin_url( 'admin.php?page=us-students' );
 		include USC_PLUGIN_DIR . 'templates/admin/student-detail.php';
 	}
@@ -115,6 +164,7 @@ class StudentController {
 		$instructor = get_userdata( $lesson->instructorId );
 
 		return [
+			'id'         => (int) $lesson->id,
 			'start_dt'   => $slot ? $slot->startDt : '',
 			'end_dt'     => $slot ? $slot->endDt : '',
 			'offering'   => $offering ? $offering->title : '—',

src/Auth/StudentHistory.php

@@ -0,0 +1,112 @@
+<?php
+declare(strict_types=1);
+
+namespace Unsupervised\Schedular\Auth;
+
+use Unsupervised\Schedular\Payment\Payment;
+use Unsupervised\Schedular\Payment\PaymentRepository;
+use Unsupervised\Schedular\Policy\AcceptanceRepository;
+use Unsupervised\Schedular\Policy\PolicyAcceptance;
+use Unsupervised\Schedular\Policy\PolicyRepository;
+use Unsupervised\Schedular\Policy\PolicyVersionRepository;
+use Unsupervised\Schedular\Registration\Answer;
+use Unsupervised\Schedular\Registration\AnswerRepository;
+use Unsupervised\Schedular\Registration\QuestionRepository;
+
+/**
+ * Builds the display rows for the history sections of the admin student detail
+ * view: policy acceptances, intake answers, and payments.
+ */
+class StudentHistory {
+
+	public function __construct(
+		private AcceptanceRepository $acceptances,
+		private PolicyRepository $policies,
+		private PolicyVersionRepository $policyVersions,
+		private AnswerRepository $answers,
+		private QuestionRepository $questions,
+		private PaymentRepository $payments,
+	) {}
+
+	/**
+	 * Every policy acceptance the student has recorded, newest first.
+	 *
+	 * @return list<array{policy: string, version: string, context: string, accepted_at: string}>
+	 */
+	public function policyAcceptances( int $studentId ): array {
+		return array_map(
+			function ( PolicyAcceptance $acceptance ): array {
+				$version = $this->policyVersions->findById( $acceptance->policyVersionId );
+				$policy  = $version ? $this->policies->findById( $version->policyId ) : null;
+
+				return [
+					'policy'      => $policy ? $policy->title : sprintf( '#%d', $acceptance->policyVersionId ),
+					'version'     => $version ? sprintf( 'v%d', $version->versionNumber ) : '—',
+					'context'     => $this->contextLabel( $acceptance->registrationType, $acceptance->registrationId ),
+					'accepted_at' => $acceptance->acceptedAt ?? '',
+				];
+			},
+			$this->acceptances->findByStudent( $studentId )
+		);
+	}
+
+	/**
+	 * Every intake answer the student has submitted, newest registration first.
+	 *
+	 * @return list<array{question: string, answer: string, context: string}>
+	 */
+	public function intakeAnswers( int $studentId ): array {
+		return array_map(
+			function ( Answer $answer ): array {
+				$question = $this->questions->findById( $answer->questionId );
+
+				return [
+					'question' => $question ? $question->label : sprintf( '#%d', $answer->questionId ),
+					'answer'   => $answer->answerValue ?? '—',
+					'context'  => $this->contextLabel( $answer->registrationType, $answer->registrationId ),
+				];
+			},
+			$this->answers->findByStudent( $studentId )
+		);
+	}
+
+	/**
+	 * Every payment for the student, newest first.
+	 *
+	 * @return list<array{created_at: string, context: string, method: string, status: string, amount: float, tax_amount: float, total: float, currency: string, receipt: string}>
+	 */
+	public function payments( int $studentId ): array {
+		return array_map(
+			fn( Payment $payment ): array => [
+				'created_at' => $payment->createdAt ?? '',
+				'context'    => $this->contextLabel( $payment->registrationType, $payment->registrationId ),
+				'method'     => $payment->method,
+				'status'     => $payment->status,
+				'amount'     => $payment->amount,
+				'tax_amount' => $payment->taxAmount,
+				'total'      => $payment->total(),
+				'currency'   => $payment->currency,
+				'receipt'    => $payment->receiptNumber ?? '—',
+			],
+			$this->payments->findByStudent( $studentId )
+		);
+	}
+
+	/**
+	 * Human label for a polymorphic registration target.
+	 */
+	private function contextLabel( string $registrationType, int $registrationId ): string {
+		switch ( $registrationType ) {
+			case PolicyAcceptance::REG_ACCOUNT:
+				return __( 'Account signup', 'unsupervised-schedular' );
+			case PolicyAcceptance::REG_LESSON:
+				/* translators: %d: the lesson id */
+				return sprintf( __( 'Lesson #%d', 'unsupervised-schedular' ), $registrationId );
+			case PolicyAcceptance::REG_ENROLLMENT:
+				/* translators: %d: the group-class enrolment id */
+				return sprintf( __( 'Enrolment #%d', 'unsupervised-schedular' ), $registrationId );
+			default:
+				return sprintf( '%s #%d', $registrationType, $registrationId );
+		}
+	}
+}

src/Payment/Payment.php

@@ -49,6 +49,7 @@ class Payment {
 		public readonly ?string $receiptNumber = null,
 		public readonly ?string $receiptSentAt = null,
 		public readonly ?string $paidAt = null,
+		public readonly ?string $createdAt = null,
 		public readonly ?int $id = null,
 	) {}
 
@@ -69,6 +70,7 @@ class Payment {
 			receiptNumber:         Val::stringOrNull( $row->receipt_number ),
 			receiptSentAt:         Val::stringOrNull( $row->receipt_sent_at ),
 			paidAt:                Val::stringOrNull( $row->paid_at ),
+			createdAt:             Val::stringOrNull( $row->created_at ),
 			id:                    Val::int( $row->id ),
 		);
 	}
@@ -120,6 +122,7 @@ class Payment {
 			'status'            => $this->status,
 			'receipt_number'    => $this->receiptNumber,
 			'paid_at'           => $this->paidAt,
+			'created_at'        => $this->createdAt,
 		];
 	}
 }

src/Payment/PaymentRepository.php

@@ -132,6 +132,23 @@ class PaymentRepository {
 		return $row ? Payment::fromRow( $row ) : null;
 	}
 
+	/**
+	 * Every payment for a student, newest first (admin payment history).
+	 *
+	 * @return list<Payment>
+	 */
+	public function findByStudent( int $studentId ): array {
+		$rows = $this->db->get_results(
+			$this->db->prepare(
+				'SELECT * FROM %i WHERE student_id = %d ORDER BY created_at DESC, id DESC',
+				$this->table,
+				$studentId
+			)
+		);
+
+		return array_map( Payment::fromRow( ... ), $rows ?? [] );
+	}
+
 	/**
 	 * Pending payments, newest first (studio-admin confirmation queue).
 	 *

src/Plugin.php

@@ -79,7 +79,7 @@ class Plugin {
 		( new RoleManager() )->register();
 		( new RegistrationLoginGate() )->register();
 		( new EmailConfirmationHandler( $settings, $registrationMailer ) )->register();
-		( new AdminMenu( $availability, $bookings, $offerings, $questions, $policies, $policyVersions, $policyService, $invites, $enrollments, $settings, $paymentRepo, $paymentService, $resolver ) )->register();
+		( new AdminMenu( $availability, $bookings, $offerings, $questions, $answers, $policies, $policyVersions, $policyService, $acceptances, $invites, $enrollments, $settings, $paymentRepo, $paymentService, $resolver ) )->register();
 		( new RestRegistrar( $availability, $bookings, $offerings, $questions, $policies, $policyVersions, $policyService, $registrationGate, $enrollments, $paymentService ) )->register();
 		( new ShortcodeRegistrar( $bookingPage, $loginPage, $registrationPage, $groupClassPage ) )->register();
 		( new BlockRegistrar( $bookingPage, $loginPage, $registrationPage, $groupClassPage ) )->register();

src/Policy/AcceptanceRepository.php

@@ -55,4 +55,21 @@ class AcceptanceRepository {
 
 		return array_map( PolicyAcceptance::fromRow( ... ), $rows ?? [] );
 	}
+
+	/**
+	 * Find every acceptance a student has recorded, newest first.
+	 *
+	 * @return list<PolicyAcceptance>
+	 */
+	public function findByStudent( int $studentId ): array {
+		$rows = $this->db->get_results(
+			$this->db->prepare(
+				'SELECT * FROM %i WHERE student_id = %d ORDER BY accepted_at DESC, id DESC',
+				$this->table,
+				$studentId
+			)
+		);
+
+		return array_map( PolicyAcceptance::fromRow( ... ), $rows ?? [] );
+	}
 }

src/Registration/AnswerRepository.php

@@ -55,4 +55,21 @@ class AnswerRepository {
 
 		return array_map( Answer::fromRow( ... ), $rows ?? [] );
 	}
+
+	/**
+	 * Find every answer a student has submitted, newest registration first.
+	 *
+	 * @return list<Answer>
+	 */
+	public function findByStudent( int $studentId ): array {
+		$rows = $this->db->get_results(
+			$this->db->prepare(
+				'SELECT * FROM %i WHERE student_id = %d ORDER BY id DESC',
+				$this->table,
+				$studentId
+			)
+		);
+
+		return array_map( Answer::fromRow( ... ), $rows ?? [] );
+	}
 }

templates/admin/student-detail.php

@@ -7,16 +7,21 @@ if (! defined('ABSPATH')) {
 
 /**
  * @var \WP_User $student
- * @var list<array{start_dt: string, end_dt: string, offering: string, instructor: string, status: string}> $upcoming
- * @var list<array{start_dt: string, end_dt: string, offering: string, instructor: string, status: string}> $past
- * @var list<array{offering: string, status: string}> $enrolments
+ * @var list<array{id: int, start_dt: string, end_dt: string, offering: string, instructor: string, status: string}> $upcoming
+ * @var list<array{id: int, start_dt: string, end_dt: string, offering: string, instructor: string, status: string}> $past
+ * @var list<array{id: int, offering: string, status: string}> $enrolments
+ * @var list<array{policy: string, version: string, context: string, accepted_at: string}> $acceptances
+ * @var list<array{question: string, answer: string, context: string}> $intake
+ * @var list<array{created_at: string, context: string, method: string, status: string, amount: float, tax_amount: float, total: float, currency: string, receipt: string}> $payments
  * @var string $backUrl
  * @var bool   $canBilling
  * @var string $billingOverride
  * @var string $billingDefault
+ * @var string $notice
+ * @var string $error
  */
 
-$renderLessons = static function (array $rows): void {
+$renderLessons = static function (array $rows, bool $withActions = false): void {
     if (empty($rows)) {
         echo '<p>' . esc_html__('None.', 'unsupervised-schedular') . '</p>';
         return;
@@ -29,6 +34,9 @@ $renderLessons = static function (array $rows): void {
                 <th><?php esc_html_e('Offering', 'unsupervised-schedular'); ?></th>
                 <th><?php esc_html_e('Instructor', 'unsupervised-schedular'); ?></th>
                 <th><?php esc_html_e('Status', 'unsupervised-schedular'); ?></th>
+                <?php if ($withActions) : ?>
+                    <th><?php esc_html_e('Actions', 'unsupervised-schedular'); ?></th>
+                <?php endif; ?>
             </tr>
         </thead>
         <tbody>
@@ -38,6 +46,20 @@ $renderLessons = static function (array $rows): void {
                     <td><?php echo esc_html($row['offering']); ?></td>
                     <td><?php echo esc_html($row['instructor']); ?></td>
                     <td><?php echo esc_html($row['status']); ?></td>
+                    <?php if ($withActions) : ?>
+                        <td>
+                            <?php if ($row['status'] !== 'cancelled') : ?>
+                                <form method="post" style="display:inline">
+                                    <?php wp_nonce_field('usc_student_actions'); ?>
+                                    <input type="hidden" name="usc_action" value="cancel_lesson">
+                                    <input type="hidden" name="lesson_id" value="<?php echo esc_attr((string) $row['id']); ?>">
+                                    <button type="submit" class="button-link button-link-delete" onclick="return confirm('<?php echo esc_js(__('Cancel this lesson? The slot is freed and any pending payment is voided.', 'unsupervised-schedular')); ?>');">
+                                        <?php esc_html_e('Cancel lesson', 'unsupervised-schedular'); ?>
+                                    </button>
+                                </form>
+                            <?php endif; ?>
+                        </td>
+                    <?php endif; ?>
                 </tr>
             <?php endforeach; ?>
         </tbody>
@@ -51,11 +73,33 @@ $renderLessons = static function (array $rows): void {
         <a href="<?php echo esc_url($backUrl); ?>" class="page-title-action"><?php esc_html_e('Back to students', 'unsupervised-schedular'); ?></a>
     </h1>
 
+    <?php if ($notice !== '') : ?>
+        <div class="notice notice-success is-dismissible"><p><?php echo esc_html($notice); ?></p></div>
+    <?php endif; ?>
+    <?php if ($error !== '') : ?>
+        <div class="notice notice-error is-dismissible"><p><?php echo esc_html($error); ?></p></div>
+    <?php endif; ?>
+
     <h2><?php esc_html_e('Account', 'unsupervised-schedular'); ?></h2>
-    <table class="form-table">
-        <tr><th><?php esc_html_e('Email', 'unsupervised-schedular'); ?></th><td><?php echo esc_html($student->user_email); ?></td></tr>
-        <tr><th><?php esc_html_e('Registered', 'unsupervised-schedular'); ?></th><td><?php echo esc_html($student->user_registered); ?></td></tr>
-    </table>
+    <form method="post">
+        <?php wp_nonce_field('usc_student_actions'); ?>
+        <input type="hidden" name="usc_action" value="update_account">
+        <table class="form-table">
+            <tr>
+                <th><label for="usc-display-name"><?php esc_html_e('Display name', 'unsupervised-schedular'); ?></label></th>
+                <td><input type="text" id="usc-display-name" name="display_name" class="regular-text" value="<?php echo esc_attr($student->display_name); ?>" required></td>
+            </tr>
+            <tr>
+                <th><label for="usc-user-email"><?php esc_html_e('Email', 'unsupervised-schedular'); ?></label></th>
+                <td><input type="email" id="usc-user-email" name="user_email" class="regular-text" value="<?php echo esc_attr($student->user_email); ?>" required></td>
+            </tr>
+            <tr>
+                <th><?php esc_html_e('Registered', 'unsupervised-schedular'); ?></th>
+                <td><?php echo esc_html($student->user_registered); ?></td>
+            </tr>
+        </table>
+        <?php submit_button(esc_html__('Save account details', 'unsupervised-schedular'), 'secondary', 'submit', false); ?>
+    </form>
 
     <?php if ($canBilling) : ?>
         <h2><?php esc_html_e('Billing method', 'unsupervised-schedular'); ?></h2>
@@ -78,7 +122,7 @@ $renderLessons = static function (array $rows): void {
     <?php endif; ?>
 
     <h2><?php esc_html_e('Upcoming lessons', 'unsupervised-schedular'); ?></h2>
-    <?php $renderLessons($upcoming); ?>
+    <?php $renderLessons($upcoming, true); ?>
 
     <h2><?php esc_html_e('Past lessons', 'unsupervised-schedular'); ?></h2>
     <?php $renderLessons($past); ?>
@@ -92,6 +136,7 @@ $renderLessons = static function (array $rows): void {
                 <tr>
                     <th><?php esc_html_e('Class', 'unsupervised-schedular'); ?></th>
                     <th><?php esc_html_e('Status', 'unsupervised-schedular'); ?></th>
+                    <th><?php esc_html_e('Actions', 'unsupervised-schedular'); ?></th>
                 </tr>
             </thead>
             <tbody>
@@ -99,9 +144,107 @@ $renderLessons = static function (array $rows): void {
                     <tr>
                         <td><?php echo esc_html($enrolment['offering']); ?></td>
                         <td><?php echo esc_html($enrolment['status']); ?></td>
+                        <td>
+                            <?php if ($enrolment['status'] === 'active') : ?>
+                                <form method="post" style="display:inline">
+                                    <?php wp_nonce_field('usc_student_actions'); ?>
+                                    <input type="hidden" name="usc_action" value="withdraw_enrollment">
+                                    <input type="hidden" name="enrollment_id" value="<?php echo esc_attr((string) $enrolment['id']); ?>">
+                                    <button type="submit" class="button-link button-link-delete" onclick="return confirm('<?php echo esc_js(__('Withdraw this student from the class? The seat is freed and any pending payment is voided.', 'unsupervised-schedular')); ?>');">
+                                        <?php esc_html_e('Withdraw', 'unsupervised-schedular'); ?>
+                                    </button>
+                                </form>
+                            <?php endif; ?>
+                        </td>
                     </tr>
                 <?php endforeach; ?>
             </tbody>
         </table>
     <?php endif; ?>
+
+    <h2><?php esc_html_e('Policy acceptances', 'unsupervised-schedular'); ?></h2>
+    <?php if (empty($acceptances)) : ?>
+        <p><?php esc_html_e('None.', 'unsupervised-schedular'); ?></p>
+    <?php else : ?>
+        <table class="wp-list-table widefat fixed striped">
+            <thead>
+                <tr>
+                    <th><?php esc_html_e('Policy', 'unsupervised-schedular'); ?></th>
+                    <th><?php esc_html_e('Version', 'unsupervised-schedular'); ?></th>
+                    <th><?php esc_html_e('Context', 'unsupervised-schedular'); ?></th>
+                    <th><?php esc_html_e('Accepted', 'unsupervised-schedular'); ?></th>
+                </tr>
+            </thead>
+            <tbody>
+                <?php foreach ($acceptances as $acceptance) : ?>
+                    <tr>
+                        <td><?php echo esc_html($acceptance['policy']); ?></td>
+                        <td><?php echo esc_html($acceptance['version']); ?></td>
+                        <td><?php echo esc_html($acceptance['context']); ?></td>
+                        <td><?php echo esc_html($acceptance['accepted_at'] !== '' ? (string) mysql2date('M j, Y g:i A', $acceptance['accepted_at']) : '—'); ?></td>
+                    </tr>
+                <?php endforeach; ?>
+            </tbody>
+        </table>
+    <?php endif; ?>
+
+    <h2><?php esc_html_e('Intake answers', 'unsupervised-schedular'); ?></h2>
+    <?php if (empty($intake)) : ?>
+        <p><?php esc_html_e('None.', 'unsupervised-schedular'); ?></p>
+    <?php else : ?>
+        <table class="wp-list-table widefat fixed striped">
+            <thead>
+                <tr>
+                    <th><?php esc_html_e('Question', 'unsupervised-schedular'); ?></th>
+                    <th><?php esc_html_e('Answer', 'unsupervised-schedular'); ?></th>
+                    <th><?php esc_html_e('Context', 'unsupervised-schedular'); ?></th>
+                </tr>
+            </thead>
+            <tbody>
+                <?php foreach ($intake as $row) : ?>
+                    <tr>
+                        <td><?php echo esc_html($row['question']); ?></td>
+                        <td><?php echo esc_html($row['answer']); ?></td>
+                        <td><?php echo esc_html($row['context']); ?></td>
+                    </tr>
+                <?php endforeach; ?>
+            </tbody>
+        </table>
+    <?php endif; ?>
+
+    <?php if ($canBilling) : ?>
+        <h2><?php esc_html_e('Payment history', 'unsupervised-schedular'); ?></h2>
+        <?php if (empty($payments)) : ?>
+            <p><?php esc_html_e('None.', 'unsupervised-schedular'); ?></p>
+        <?php else : ?>
+            <table class="wp-list-table widefat fixed striped">
+                <thead>
+                    <tr>
+                        <th><?php esc_html_e('Date', 'unsupervised-schedular'); ?></th>
+                        <th><?php esc_html_e('Context', 'unsupervised-schedular'); ?></th>
+                        <th><?php esc_html_e('Method', 'unsupervised-schedular'); ?></th>
+                        <th><?php esc_html_e('Status', 'unsupervised-schedular'); ?></th>
+                        <th><?php esc_html_e('Subtotal', 'unsupervised-schedular'); ?></th>
+                        <th><?php esc_html_e('HST', 'unsupervised-schedular'); ?></th>
+                        <th><?php esc_html_e('Total', 'unsupervised-schedular'); ?></th>
+                        <th><?php esc_html_e('Receipt', 'unsupervised-schedular'); ?></th>
+                    </tr>
+                </thead>
+                <tbody>
+                    <?php foreach ($payments as $payment) : ?>
+                        <tr>
+                            <td><?php echo esc_html($payment['created_at'] !== '' ? (string) mysql2date('M j, Y g:i A', $payment['created_at']) : '—'); ?></td>
+                            <td><?php echo esc_html($payment['context']); ?></td>
+                            <td><?php echo esc_html($payment['method']); ?></td>
+                            <td><?php echo esc_html($payment['status']); ?></td>
+                            <td><?php echo esc_html(number_format_i18n($payment['amount'], 2)); ?></td>
+                            <td><?php echo esc_html(number_format_i18n($payment['tax_amount'], 2)); ?></td>
+                            <td><?php echo esc_html(number_format_i18n($payment['total'], 2) . ' ' . $payment['currency']); ?></td>
+                            <td><?php echo esc_html($payment['receipt']); ?></td>
+                        </tr>
+                    <?php endforeach; ?>
+                </tbody>
+            </table>
+        <?php endif; ?>
+    <?php endif; ?>
 </div>

tests/Unit/Auth/StudentActionsTest.php

@@ -0,0 +1,169 @@
+<?php
+declare(strict_types=1);
+
+namespace Unsupervised\Schedular\Tests\Unit\Auth;
+
+use Brain\Monkey\Functions;
+use Mockery;
+use Unsupervised\Schedular\Auth\StudentActions;
+use Unsupervised\Schedular\Availability\AvailabilityRepository;
+use Unsupervised\Schedular\Booking\BookingRepository;
+use Unsupervised\Schedular\Booking\Lesson;
+use Unsupervised\Schedular\GroupClass\Enrollment;
+use Unsupervised\Schedular\GroupClass\EnrollmentRepository;
+use Unsupervised\Schedular\Payment\PaymentService;
+use Unsupervised\Schedular\Tests\Unit\TestCase;
+
+class StudentActionsTest extends TestCase
+{
+    private BookingRepository&Mockery\MockInterface $bookings;
+    private AvailabilityRepository&Mockery\MockInterface $availability;
+    private EnrollmentRepository&Mockery\MockInterface $enrollments;
+    private PaymentService&Mockery\MockInterface $payments;
+    private StudentActions $actions;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        $this->bookings     = Mockery::mock(BookingRepository::class);
+        $this->availability = Mockery::mock(AvailabilityRepository::class);
+        $this->enrollments  = Mockery::mock(EnrollmentRepository::class);
+        $this->payments     = Mockery::mock(PaymentService::class);
+
+        $this->actions = new StudentActions($this->bookings, $this->availability, $this->enrollments, $this->payments);
+    }
+
+    public function testCancelLessonCancelsFreesSlotAndVoidsPayment(): void
+    {
+        $this->bookings->shouldReceive('findById')->with(12)
+            ->andReturn(new Lesson(7, 5, 3, status: Lesson::STATUS_PENDING, paymentId: 40, id: 12));
+
+        $this->bookings->shouldReceive('updateStatus')->once()->with(12, Lesson::STATUS_CANCELLED)->andReturn(true);
+        $this->availability->shouldReceive('release')->once()->with(7)->andReturn(true);
+        $this->payments->shouldReceive('voidPending')->once()->with(40);
+
+        self::assertTrue($this->actions->cancelLesson(12, 5));
+    }
+
+    public function testCancelLessonRefusesAnotherStudentsLesson(): void
+    {
+        $this->bookings->shouldReceive('findById')->with(12)
+            ->andReturn(new Lesson(7, 6, 3, status: Lesson::STATUS_PENDING, id: 12));
+
+        $this->bookings->shouldNotReceive('updateStatus');
+        $this->availability->shouldNotReceive('release');
+
+        self::assertFalse($this->actions->cancelLesson(12, 5));
+    }
+
+    public function testCancelLessonRefusesAlreadyCancelledLesson(): void
+    {
+        $this->bookings->shouldReceive('findById')->with(12)
+            ->andReturn(new Lesson(7, 5, 3, status: Lesson::STATUS_CANCELLED, id: 12));
+
+        $this->bookings->shouldNotReceive('updateStatus');
+
+        self::assertFalse($this->actions->cancelLesson(12, 5));
+    }
+
+    public function testCancelLessonRefusesMissingLesson(): void
+    {
+        $this->bookings->shouldReceive('findById')->with(99)->andReturn(null);
+
+        self::assertFalse($this->actions->cancelLesson(99, 5));
+    }
+
+    public function testWithdrawEnrollmentCancelsAndVoidsPayment(): void
+    {
+        $this->enrollments->shouldReceive('findById')->with(3)
+            ->andReturn(new Enrollment(1, 5, 3, Enrollment::STATUS_ACTIVE, 41, 3));
+
+        $this->enrollments->shouldReceive('updateStatus')->once()->with(3, Enrollment::STATUS_CANCELLED)->andReturn(true);
+        $this->payments->shouldReceive('voidPending')->once()->with(41);
+
+        self::assertTrue($this->actions->withdrawEnrollment(3, 5));
+    }
+
+    public function testWithdrawEnrollmentRefusesInactiveEnrolment(): void
+    {
+        $this->enrollments->shouldReceive('findById')->with(3)
+            ->andReturn(new Enrollment(1, 5, 3, Enrollment::STATUS_CANCELLED, null, 3));
+
+        $this->enrollments->shouldNotReceive('updateStatus');
+
+        self::assertFalse($this->actions->withdrawEnrollment(3, 5));
+    }
+
+    public function testWithdrawEnrollmentRefusesAnotherStudentsEnrolment(): void
+    {
+        $this->enrollments->shouldReceive('findById')->with(3)
+            ->andReturn(new Enrollment(1, 6, 3, Enrollment::STATUS_ACTIVE, null, 3));
+
+        $this->enrollments->shouldNotReceive('updateStatus');
+
+        self::assertFalse($this->actions->withdrawEnrollment(3, 5));
+    }
+
+    public function testUpdateAccountSavesNameAndEmail(): void
+    {
+        Functions\when('is_email')->justReturn(true);
+        Functions\when('email_exists')->justReturn(false);
+        Functions\expect('wp_update_user')
+            ->once()
+            ->with(['ID' => 5, 'display_name' => 'New Name', 'user_email' => '[email protected]'])
+            ->andReturn(5);
+
+        self::assertTrue($this->actions->updateAccount(5, 'New Name', '[email protected]'));
+    }
+
+    public function testUpdateAccountAllowsKeepingOwnEmail(): void
+    {
+        Functions\when('is_email')->justReturn(true);
+        Functions\when('email_exists')->justReturn(5);
+        Functions\when('wp_update_user')->justReturn(5);
+
+        self::assertTrue($this->actions->updateAccount(5, 'Name', '[email protected]'));
+    }
+
+    public function testUpdateAccountRejectsEmptyName(): void
+    {
+        $result = $this->actions->updateAccount(5, '', '[email protected]');
+
+        self::assertInstanceOf(\WP_Error::class, $result);
+        self::assertSame('empty_name', $result->get_error_code());
+    }
+
+    public function testUpdateAccountRejectsInvalidEmail(): void
+    {
+        Functions\when('is_email')->justReturn(false);
+
+        $result = $this->actions->updateAccount(5, 'Name', 'not-an-email');
+
+        self::assertInstanceOf(\WP_Error::class, $result);
+        self::assertSame('invalid_email', $result->get_error_code());
+    }
+
+    public function testUpdateAccountRejectsEmailOwnedByAnotherUser(): void
+    {
+        Functions\when('is_email')->justReturn(true);
+        Functions\when('email_exists')->justReturn(9);
+
+        $result = $this->actions->updateAccount(5, 'Name', '[email protected]');
+
+        self::assertInstanceOf(\WP_Error::class, $result);
+        self::assertSame('email_taken', $result->get_error_code());
+    }
+
+    public function testUpdateAccountPassesThroughWpError(): void
+    {
+        Functions\when('is_email')->justReturn(true);
+        Functions\when('email_exists')->justReturn(false);
+        Functions\when('wp_update_user')->justReturn(new \WP_Error('update_failed', 'nope'));
+
+        $result = $this->actions->updateAccount(5, 'Name', '[email protected]');
+
+        self::assertInstanceOf(\WP_Error::class, $result);
+        self::assertSame('update_failed', $result->get_error_code());
+    }
+}

tests/Unit/Auth/StudentHistoryTest.php

@@ -0,0 +1,180 @@
+<?php
+declare(strict_types=1);
+
+namespace Unsupervised\Schedular\Tests\Unit\Auth;
+
+use Mockery;
+use Unsupervised\Schedular\Auth\StudentHistory;
+use Unsupervised\Schedular\Payment\Payment;
+use Unsupervised\Schedular\Payment\PaymentRepository;
+use Unsupervised\Schedular\Policy\AcceptanceRepository;
+use Unsupervised\Schedular\Policy\Policy;
+use Unsupervised\Schedular\Policy\PolicyAcceptance;
+use Unsupervised\Schedular\Policy\PolicyRepository;
+use Unsupervised\Schedular\Policy\PolicyVersion;
+use Unsupervised\Schedular\Policy\PolicyVersionRepository;
+use Unsupervised\Schedular\Registration\Answer;
+use Unsupervised\Schedular\Registration\AnswerRepository;
+use Unsupervised\Schedular\Registration\Question;
+use Unsupervised\Schedular\Registration\QuestionRepository;
+use Unsupervised\Schedular\Tests\Unit\TestCase;
+
+class StudentHistoryTest extends TestCase
+{
+    private AcceptanceRepository&Mockery\MockInterface $acceptances;
+    private PolicyRepository&Mockery\MockInterface $policies;
+    private PolicyVersionRepository&Mockery\MockInterface $policyVersions;
+    private AnswerRepository&Mockery\MockInterface $answers;
+    private QuestionRepository&Mockery\MockInterface $questions;
+    private PaymentRepository&Mockery\MockInterface $payments;
+    private StudentHistory $history;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        $this->acceptances    = Mockery::mock(AcceptanceRepository::class);
+        $this->policies       = Mockery::mock(PolicyRepository::class);
+        $this->policyVersions = Mockery::mock(PolicyVersionRepository::class);
+        $this->answers        = Mockery::mock(AnswerRepository::class);
+        $this->questions      = Mockery::mock(QuestionRepository::class);
+        $this->payments       = Mockery::mock(PaymentRepository::class);
+
+        $this->history = new StudentHistory(
+            $this->acceptances,
+            $this->policies,
+            $this->policyVersions,
+            $this->answers,
+            $this->questions,
+            $this->payments
+        );
+    }
+
+    public function testPolicyAcceptancesResolvePolicyTitleAndVersion(): void
+    {
+        $this->acceptances->shouldReceive('findByStudent')->once()->with(5)->andReturn([
+            new PolicyAcceptance(9, 5, PolicyAcceptance::REG_ACCOUNT, 5, null, '2026-06-02 09:00:00', 1),
+        ]);
+        $this->policyVersions->shouldReceive('findById')->with(9)
+            ->andReturn(new PolicyVersion(2, 3, null, PolicyVersion::STATUS_PUBLISHED, id: 9));
+        $this->policies->shouldReceive('findById')->with(2)
+            ->andReturn(new Policy('Waiver', 'waiver', 9, Policy::SCOPE_SIGNUP, 2));
+
+        $rows = $this->history->policyAcceptances(5);
+
+        self::assertSame(
+            [
+                [
+                    'policy'      => 'Waiver',
+                    'version'     => 'v3',
+                    'context'     => 'Account signup',
+                    'accepted_at' => '2026-06-02 09:00:00',
+                ],
+            ],
+            $rows
+        );
+    }
+
+    public function testPolicyAcceptancesFallBackWhenVersionIsGone(): void
+    {
+        $this->acceptances->shouldReceive('findByStudent')->once()->with(5)->andReturn([
+            new PolicyAcceptance(9, 5, PolicyAcceptance::REG_LESSON, 12),
+        ]);
+        $this->policyVersions->shouldReceive('findById')->with(9)->andReturn(null);
+
+        $rows = $this->history->policyAcceptances(5);
+
+        self::assertSame('#9', $rows[0]['policy']);
+        self::assertSame('—', $rows[0]['version']);
+        self::assertSame('Lesson #12', $rows[0]['context']);
+        self::assertSame('', $rows[0]['accepted_at']);
+    }
+
+    public function testIntakeAnswersResolveQuestionLabels(): void
+    {
+        $this->answers->shouldReceive('findByStudent')->once()->with(5)->andReturn([
+            new Answer(4, Answer::REG_ENROLLMENT, 3, 5, 'Beginner', 1),
+        ]);
+        $this->questions->shouldReceive('findById')->with(4)
+            ->andReturn(new Question(1, 'Experience level', id: 4));
+
+        $rows = $this->history->intakeAnswers(5);
+
+        self::assertSame(
+            [
+                [
+                    'question' => 'Experience level',
+                    'answer'   => 'Beginner',
+                    'context'  => 'Enrolment #3',
+                ],
+            ],
+            $rows
+        );
+    }
+
+    public function testIntakeAnswersFallBackWhenQuestionIsGone(): void
+    {
+        $this->answers->shouldReceive('findByStudent')->once()->with(5)->andReturn([
+            new Answer(4, Answer::REG_LESSON, 12, 5, null, 1),
+        ]);
+        $this->questions->shouldReceive('findById')->with(4)->andReturn(null);
+
+        $rows = $this->history->intakeAnswers(5);
+
+        self::assertSame('#4', $rows[0]['question']);
+        self::assertSame('—', $rows[0]['answer']);
+    }
+
+    public function testPaymentsBuildDisplayRows(): void
+    {
+        $this->payments->shouldReceive('findByStudent')->once()->with(5)->andReturn([
+            new Payment(
+                5,
+                3,
+                Payment::REG_LESSON,
+                12,
+                100.00,
+                'CAD',
+                Payment::METHOD_CARD,
+                Payment::STATUS_PAID,
+                taxRate: 13.0,
+                taxAmount: 13.00,
+                receiptNumber: 'USC-7',
+                createdAt: '2026-06-08 09:00:00',
+                id: 50
+            ),
+        ]);
+
+        $rows = $this->history->payments(5);
+
+        self::assertSame(
+            [
+                [
+                    'created_at' => '2026-06-08 09:00:00',
+                    'context'    => 'Lesson #12',
+                    'method'     => Payment::METHOD_CARD,
+                    'status'     => Payment::STATUS_PAID,
+                    'amount'     => 100.00,
+                    'tax_amount' => 13.00,
+                    'total'      => 113.00,
+                    'currency'   => 'CAD',
+                    'receipt'    => 'USC-7',
+                ],
+            ],
+            $rows
+        );
+    }
+
+    public function testPaymentsFallBackWhenUnpaidAndUndated(): void
+    {
+        $this->payments->shouldReceive('findByStudent')->once()->with(5)->andReturn([
+            new Payment(5, 3, Payment::REG_ENROLLMENT, 3, 40.00, id: 51),
+        ]);
+
+        $rows = $this->history->payments(5);
+
+        self::assertSame('', $rows[0]['created_at']);
+        self::assertSame('Enrolment #3', $rows[0]['context']);
+        self::assertSame('—', $rows[0]['receipt']);
+    }
+}

tests/Unit/Payment/PaymentRepositoryTest.php

@@ -158,6 +158,22 @@ class PaymentRepositoryTest extends TestCase
         self::assertCount(1, $this->repo->findPending());
     }
 
+    public function testFindByStudentPreparesQueryAndMaps(): void
+    {
+        $this->db->shouldReceive('prepare')
+            ->once()
+            ->with(Mockery::pattern('/student_id = %d ORDER BY created_at DESC, id DESC/'), 'wp_us_payments', 5)
+            ->andReturn('SELECT ...');
+
+        $this->db->shouldReceive('get_results')->andReturn([$this->row()]);
+
+        $payments = $this->repo->findByStudent(5);
+
+        self::assertCount(1, $payments);
+        self::assertSame(5, $payments[0]->studentId);
+        self::assertSame('2026-06-08 09:00:00', $payments[0]->createdAt);
+    }
+
     private function row(): object
     {
         return (object) [
@@ -177,6 +193,7 @@ class PaymentRepositoryTest extends TestCase
             'receipt_number'           => null,
             'receipt_sent_at'          => null,
             'paid_at'                  => null,
+            'created_at'               => '2026-06-08 09:00:00',
         ];
     }
 }

tests/Unit/Payment/PaymentTest.php

@@ -46,6 +46,7 @@ class PaymentTest extends TestCase
             'receipt_number'           => 'USC-7',
             'receipt_sent_at'          => null,
             'paid_at'                  => '2026-06-08 10:00:00',
+            'created_at'               => '2026-06-08 09:00:00',
         ]);
 
         self::assertSame(7, $payment->id);
@@ -55,6 +56,7 @@ class PaymentTest extends TestCase
         self::assertSame(Payment::METHOD_COMP, $payment->method);
         self::assertTrue($payment->isPaid());
         self::assertSame('USC-7', $payment->receiptNumber);
+        self::assertSame('2026-06-08 09:00:00', $payment->createdAt);
     }
 
     public function testTotalAddsTaxToAmount(): void

tests/Unit/Policy/AcceptanceRepositoryTest.php

@@ -90,4 +90,29 @@ class AcceptanceRepositoryTest extends TestCase
         self::assertCount(1, $rows);
         self::assertInstanceOf(PolicyAcceptance::class, $rows[0]);
     }
+
+    public function testFindByStudentMapsRowsNewestFirst(): void
+    {
+        $this->db->shouldReceive('prepare')
+            ->once()
+            ->with(Mockery::pattern('/student_id = %d ORDER BY accepted_at DESC, id DESC/'), 'wp_us_policy_acceptances', 5)
+            ->andReturn('SELECT ...');
+
+        $this->db->shouldReceive('get_results')->andReturn([
+            (object) [
+                'id'                => '2',
+                'policy_version_id' => '9',
+                'student_id'        => '5',
+                'registration_type' => PolicyAcceptance::REG_ACCOUNT,
+                'registration_id'   => '5',
+                'accepted_at'       => '2026-06-03 09:00:00',
+                'ip_address'        => null,
+            ],
+        ]);
+
+        $rows = $this->repo->findByStudent(5);
+
+        self::assertCount(1, $rows);
+        self::assertSame(5, $rows[0]->studentId);
+    }
 }

tests/Unit/Registration/AnswerRepositoryTest.php

@@ -98,4 +98,32 @@ class AnswerRepositoryTest extends TestCase
         self::assertInstanceOf(Answer::class, $answers[0]);
         self::assertSame(3, $answers[0]->questionId);
     }
+
+    public function testFindByStudentPreparesQueryAndMaps(): void
+    {
+        $row = (object) [
+            'id'                => '1',
+            'question_id'       => '3',
+            'registration_type' => Answer::REG_LESSON,
+            'registration_id'   => '12',
+            'student_id'        => '5',
+            'answer_value'      => 'Beginner',
+        ];
+
+        $this->db->shouldReceive('prepare')
+            ->once()
+            ->with(
+                Mockery::pattern('/student_id = %d ORDER BY id DESC/'),
+                'wp_us_question_answers',
+                5
+            )
+            ->andReturn('SELECT ...');
+
+        $this->db->shouldReceive('get_results')->andReturn([$row]);
+
+        $answers = $this->repo->findByStudent(5);
+
+        self::assertCount(1, $answers);
+        self::assertSame(5, $answers[0]->studentId);
+    }
 }