unsupervised-scheduler

Unsupervised/unsupervised-scheduler

Fork 0

Author	SHA1	Message	Date
thatguygriffandClaude Opus 4.8	061d09e034	Harden booking, offering exposure, payments, and invites CI / No Debug Code (pull_request) Successful in 3s Details CI / Tests (PHP 8.1) (pull_request) Successful in 49s Details CI / Coding Standards (pull_request) Successful in 55s Details CI / PHPStan (pull_request) Successful in 1m7s Details CI / Tests (PHP 8.3) (pull_request) Successful in 1m41s Details CI / Tests (PHP 8.2) (pull_request) Successful in 44s Details CI / Build Plugin Zip (pull_request) Has been skipped Details Security fixes from a pen-test review (issues #31–#37): - #31 Booking no longer trusts a client-supplied offering_id: a slot-tied offering is authoritative and any offering used must belong to the slot's instructor, closing a free/misrouted-payment bypass. - #34 Availability slot creation rejects an offering the instructor does not own (AvailabilityEndpoint now takes OfferingRepository). - #32 Offering/question/policy listing endpoints now require book_lesson instead of being public (no anonymous consumer exists); Offering::toArray also omits etransfer_email from listings as defense-in-depth. - #33 Slots are claimed atomically (UPDATE ... WHERE is_booked = 0) before a lesson is inserted, preventing a double-booking race. - #35 A single weekly booking is capped (MAX_WEEKLY_OCCURRENCES) and only creates lessons for slots it actually claimed. - #36 Stripe secret/webhook keys are write-only in the settings UI and a blank submit keeps the stored value; secrets are never echoed back into HTML. - #37 Pending invites expire after 14 days (Invite::isAcceptable), enforced at registration and surfaced on the admin invites list. Adds BookingEndpointTest plus Invite/Offering/AvailabilityRepository coverage and minimal WP_REST_Request/WP_REST_Response stubs. composer test (200), lint, and cs all green. Co-Authored-By: Claude Opus 4.8 <[email protected]>	2026-06-09 17:08:22 -03:00
thatguygriff	fe43f91fb1	Merge pull request 'Add Instructors admin page (create + per-capability access)' (#30 ) from feature/instructor-management into main CI / No Debug Code (push) Successful in 3s Details CI / Tests (PHP 8.3) (push) Successful in 45s Details CI / Tests (PHP 8.1) (push) Successful in 47s Details CI / Tests (PHP 8.2) (push) Successful in 50s Details CI / Coding Standards (push) Successful in 54s Details CI / PHPStan (push) Successful in 1m5s Details CI / Build Plugin Zip (push) Successful in 50s Details Reviewed-on: #30	2026-06-08 20:05:33 +00:00

Author

SHA1

Message

Date

thatguygriffandClaude Opus 4.8

061d09e034

Harden booking, offering exposure, payments, and invites

CI / No Debug Code (pull_request) Successful in 3s

Details

CI / Tests (PHP 8.1) (pull_request) Successful in 49s

Details

CI / Coding Standards (pull_request) Successful in 55s

Details

CI / PHPStan (pull_request) Successful in 1m7s

Details

CI / Tests (PHP 8.3) (pull_request) Successful in 1m41s

Details

CI / Tests (PHP 8.2) (pull_request) Successful in 44s

Details

CI / Build Plugin Zip (pull_request) Has been skipped

Details

Security fixes from a pen-test review (issues #31–#37):

- #31 Booking no longer trusts a client-supplied offering_id: a slot-tied
  offering is authoritative and any offering used must belong to the slot's
  instructor, closing a free/misrouted-payment bypass.
- #34 Availability slot creation rejects an offering the instructor does not
  own (AvailabilityEndpoint now takes OfferingRepository).
- #32 Offering/question/policy listing endpoints now require book_lesson
  instead of being public (no anonymous consumer exists); Offering::toArray
  also omits etransfer_email from listings as defense-in-depth.
- #33 Slots are claimed atomically (UPDATE ... WHERE is_booked = 0) before a
  lesson is inserted, preventing a double-booking race.
- #35 A single weekly booking is capped (MAX_WEEKLY_OCCURRENCES) and only
  creates lessons for slots it actually claimed.
- #36 Stripe secret/webhook keys are write-only in the settings UI and a blank
  submit keeps the stored value; secrets are never echoed back into HTML.
- #37 Pending invites expire after 14 days (Invite::isAcceptable), enforced at
  registration and surfaced on the admin invites list.

Adds BookingEndpointTest plus Invite/Offering/AvailabilityRepository coverage
and minimal WP_REST_Request/WP_REST_Response stubs. composer test (200),
lint, and cs all green.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

2026-06-09 17:08:22 -03:00

thatguygriff

fe43f91fb1

Merge pull request 'Add Instructors admin page (create + per-capability access)' (#30 ) from feature/instructor-management into main

CI / No Debug Code (push) Successful in 3s

Details

CI / Tests (PHP 8.3) (push) Successful in 45s

Details

CI / Tests (PHP 8.1) (push) Successful in 47s

Details

CI / Tests (PHP 8.2) (push) Successful in 50s

Details

CI / Coding Standards (push) Successful in 54s

Details

CI / PHPStan (push) Successful in 1m5s

Details

CI / Build Plugin Zip (push) Successful in 50s

Details

Reviewed-on: #30

2026-06-08 20:05:33 +00:00

Compare commits

Diff Content Not Available