Security fixes: CSV injection, policy body output, invite hashing, slot datetimes

Four fixes from a security review pass:

- Neutralise CSV formula injection in the payments export: fields with a
  leading =, +, -, @, tab, or CR (e.g. a hostile student display name) are
  apostrophe-prefixed in PaymentReport::csvLine() so they open as text in
  Excel/Google Sheets. Fixes #39.
- Sanitise policy bodies with wp_kses_post at output in
  PolicyEndpoint::index() (the booking JS renders that HTML raw), so a
  future write path that forgets kses can never become stored XSS.
  Fixes #40.
- Store invite tokens hashed (SHA-256) at rest: a database leak can no
  longer redeem pending invites. The registration link is shown once, at
  creation; the pending list shows email/invited date; lookups hash the
  submitted token. Existing plaintext pending invites must be re-issued.
  Fixes #41.
- Validate availability slot datetimes on both creation paths (REST and
  admin form) via AvailabilitySlot::normalizeDateTime(): canonical and
  datetime-local forms normalise to Y-m-d H:i:s, garbage and end <= start
  are rejected (REST 400) instead of reaching the DATETIME column or
  throwing inside the weekly-series date arithmetic. Fixes #42.

composer test (204 tests, 594 assertions), PHPStan L6, and PHPCS all green.

Co-Authored-By: Claude Fable 5 <[email protected]>

src/Availability/AvailabilityController.php

@@ -54,10 +54,10 @@ class AvailabilityController {
 
 	private function addSlot( int $instructorId ): void {
 		// phpcs:disable WordPress.Security.NonceVerification.Missing
-		$startDt = sanitize_text_field( wp_unslash( $_POST['start_dt'] ?? '' ) );
-		$endDt   = sanitize_text_field( wp_unslash( $_POST['end_dt'] ?? '' ) );
+		$startDt = AvailabilitySlot::normalizeDateTime( sanitize_text_field( wp_unslash( $_POST['start_dt'] ?? '' ) ) );
+		$endDt   = AvailabilitySlot::normalizeDateTime( sanitize_text_field( wp_unslash( $_POST['end_dt'] ?? '' ) ) );
 
-		if ( '' === $startDt || '' === $endDt ) {
+		if ( null === $startDt || null === $endDt || $endDt <= $startDt ) {
 			return;
 		}
 

src/Availability/AvailabilityEndpoint.php

@@ -120,10 +120,17 @@ class AvailabilityEndpoint {
 			}
 		}
 
+		$startDt = AvailabilitySlot::normalizeDateTime( (string) $request->get_param( 'start_dt' ) );
+		$endDt   = AvailabilitySlot::normalizeDateTime( (string) $request->get_param( 'end_dt' ) );
+
+		if ( null === $startDt || null === $endDt || $endDt <= $startDt ) {
+			return new \WP_Error( 'invalid_datetime', __( 'Provide a valid start and end, with the end after the start.', 'unsupervised-schedular' ), [ 'status' => 400 ] );
+		}
+
 		$slot = new AvailabilitySlot(
 			instructorId:    $instructorId,
-			startDt:         (string) $request->get_param( 'start_dt' ),
-			endDt:           (string) $request->get_param( 'end_dt' ),
+			startDt:         $startDt,
+			endDt:           $endDt,
 			durationMinutes: $duration > 0 ? $duration : 60,
 			offeringId:      $offeringId > 0 ? $offeringId : null,
 		);

src/Availability/AvailabilitySlot.php

@@ -16,6 +16,25 @@ class AvailabilitySlot {
 		public readonly ?int $id = null,
 	) {}
 
+	/**
+	 * Normalise a submitted slot datetime to canonical `Y-m-d H:i:s`, or null when
+	 * it is not a real datetime. Accepts the HTML `datetime-local` form
+	 * (`Y-m-d\TH:i`, optionally with seconds) and the canonical form (optionally
+	 * without seconds). Anything else — including strings PHP would "helpfully"
+	 * coerce — is rejected so garbage never reaches the DATETIME column or throws
+	 * inside the weekly-series date arithmetic.
+	 */
+	public static function normalizeDateTime( string $value ): ?string {
+		foreach ( [ 'Y-m-d H:i:s', 'Y-m-d H:i', 'Y-m-d\TH:i:s', 'Y-m-d\TH:i' ] as $format ) {
+			$dt = \DateTimeImmutable::createFromFormat( '!' . $format, $value );
+			if ( false !== $dt && $dt->format( $format ) === $value ) {
+				return $dt->format( 'Y-m-d H:i:s' );
+			}
+		}
+
+		return null;
+	}
+
 	public static function fromRow( object $row ): self {
 		return new self(
 			instructorId:    (int) $row->instructor_id,