Merge pull request 'Fix five findings from a security assessment of the plugin' (#197 ) from security/assessment-hardening into main

Reviewed-on: #197 Reviewed-by: James Griffin-Allwood <[email protected]>
Fix the CI failures in the uninstaller work
2026-09-05 15:00:33 +00:00 · 2026-09-05 11:55:53 -03:00 · 2026-09-05 11:55:53 -03:00
30 changed files with 1253 additions and 156 deletions
@@ -149,50 +149,6 @@ jobs:
            { print }
          ' CHANGELOG.md > CHANGELOG.md.tmp && mv CHANGELOG.md.tmp CHANGELOG.md

-      # main requires signed commits, and Gitea refuses to merge a pull request
-      # that carries an unsigned one. The key Gitea signs merge commits with
-      # lives on the server and is not reachable from a runner, so the bump
-      # commit is signed here with a dedicated release-bot key that the instance
-      # trusts via TRUSTED_SSH_KEYS. Generating that key, trusting it and storing
-      # the secret is documented in docs/ci.md.
-      - name: Configure signing as Release Bot
-        env:
-          SIGNING_KEY: ${{ secrets.RELEASE_BOT_SIGNING_KEY }}
-        run: |
-          if [ -z "${SIGNING_KEY}" ]; then
-            echo "RELEASE_BOT_SIGNING_KEY is not set - the bump commit would be unsigned and unmergeable." >&2
-            exit 1
-          fi
-          if ! command -v ssh-keygen > /dev/null; then
-            echo "ssh-keygen is missing from the runner image; git cannot make SSH signatures without it." >&2
-            exit 1
-          fi
-
-          # The secret holds an OpenSSH private key ("-----BEGIN OPENSSH PRIVATE
-          # KEY-----"). git signs by shelling out to ssh-keygen, which wants that
-          # key on disk next to the .pub it is pointed at, readable only by us,
-          # and rejects it unless the final newline survived the round trip.
-          keydir="${RUNNER_TEMP:-${TMPDIR:-/tmp}}/release-bot-signing"
-          install -m 700 -d "${keydir}"
-          printf '%s\n' "${SIGNING_KEY}" | tr -d '\r' > "${keydir}/key"
-          chmod 600 "${keydir}/key"
-          # Doubles as a format check: a truncated or re-wrapped key fails here,
-          # with a clearer cause than "gpg failed to sign the data" later on.
-          if ! ssh-keygen -y -f "${keydir}/key" < /dev/null > "${keydir}/key.pub"; then
-            echo "RELEASE_BOT_SIGNING_KEY is not a usable OpenSSH private key (passphrase-protected, truncated, or re-wrapped on paste)." >&2
-            exit 1
-          fi
-
-          # No Gitea account backs this address; TRUSTED_SSH_KEYS verifies the
-          # signature without an account lookup, so it is a label, not an identity.
-          git config user.name 'Release Bot'
-          git config user.email '[email protected]'
-          # Named gpg.format for historical reasons; "ssh" is what switches git
-          # over to signing with the SSH key above rather than a GPG key.
-          git config gpg.format ssh
-          git config user.signingkey "${keydir}/key.pub"
-          git config commit.gpgsign true
-
      - name: Open pull request
        env:
          TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -201,14 +157,10 @@ jobs:
          branch="release/bump-${next}"
          api="${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}"

+          git config user.name 'Release Bot'
+          git config user.email '[email protected]'
          git checkout -b "${branch}"
          git commit -am "Bump version to ${next} and open changelog section"
-          # A commit that came out unsigned would otherwise go unnoticed until
-          # someone tried to merge the PR, so fail here instead.
-          if ! git cat-file commit HEAD | grep -q '^gpgsig'; then
-            echo "Bump commit is unsigned; refusing to push it." >&2
-            exit 1
-          fi
          git push origin "${branch}"

          curl -fsS -X POST "${api}/pulls" \
@@ -13,6 +13,15 @@ each change under the current top section as you work.

 ## [1.5.6]

+### Security
+- **Signing in on the front end no longer hands out a session cookie that can travel over plain HTTP.** The studio's own login form told WordPress not to work out for itself whether the site was secure, and WordPress took that as "it is not" — so on an HTTPS site every student's session cookie was issued without the flag that keeps a browser from ever sending it unencrypted. Anyone able to watch the network and provoke a single `http://` request to the site could have lifted a signed-in session with it. The form now leaves that judgement to WordPress, which is what the standard login screen has always done. Nothing changes for you; existing sessions are unaffected.
+- **Plugin updates are now only accepted from the release server itself.** The update check asks the repository where to download the new version and used to take whatever answer came back. An answer that was not really the release server's — a hijacked hostname, a tampered response — could have pointed the site at any file on the internet, which WordPress would then have unpacked over the plugin. The download address must now be `https` on `git.unsupervised.ca` exactly; a lookalike, a subdomain, or an unencrypted address is refused and no update is offered. Ordinary updates are unaffected.
+- **A student can no longer tell a booking that is not theirs from one that does not exist.** Cancelling someone else's lesson was already refused, but the refusal was worded differently from "no such booking" — enough for a signed-in student to work through the numbers and learn how many lessons the studio holds. Both now answer identically. Withdrawing from a group class was the same and has had the same treatment.
+- **Students created by anything other than the studio's own signup form now wait for approval.** Turning on open registration switches on WordPress's site-wide "anyone can register" setting and makes Student the default role for new accounts — which is what the studio's registration page needs, but it also arms any *other* signup form the site happens to have. An account created that way arrived able to book and be billed immediately, with no email confirmed, no approval and no policies agreed to. Any student account that appears without going through the studio's own form is now held and listed under **Students → Pending Students**, exactly like a self-signup; it can sign in, but cannot book until you approve it. Students you add yourself from wp-admin, invited students, and the children a parent adds are all unaffected.
+
+### Added
+- **You can now decide what deleting the plugin takes with it, on Access → Plugin removal.** WordPress gives an uninstall nothing to ask you with, so the answer is given ahead of time. By default your records stay: delete the plugin and your lessons, enrolments, payments, credits, intake answers, policy agreements, invites and family links are still there when you reinstall, so a delete during a migration or a bit of troubleshooting costs you nothing. Ticking **Erase everything when the plugin is deleted** — which also asks you to type DELETE, because there is no undo — drops every table, setting and role the plugin made. Either way your Stripe secret key and webhook signing secret are now forgotten on deletion, where before they stayed in the database indefinitely: they take a minute to paste back in, and live keys on a site that no longer has the code to use them are worth nothing but risk. The two WordPress settings open registration borrows are put back as they were, too, so deleting the plugin can never leave the site quietly accepting signups into a role that no longer exists.
+
 ## [1.5.5]

 ### Changed
@@ -43,59 +43,3 @@ The Composer download cache lives at `/composer/cache` — `COMPOSER_HOME` is
 The image has to exist first. Add the version to the `php` matrix in
 `ci-php`'s `.gitea/workflows/publish.yml` and merge, then add it to the `test`
 matrix in `.gitea/workflows/ci.yml` here.
-
-## Signing the version bump commit
-
-`main` is a protected branch that requires signed commits, and Gitea will not
-merge a pull request containing an unsigned one. The `bump-version` job in
-`release.yml` therefore signs the commit it makes, using a dedicated
-`release-bot` SSH key rather than the key Gitea signs merge commits with —
-that one is `[repository.signing] SIGNING_KEY` on the server and no runner can
-reach it. Keeping the CI key separate also means it can be rotated on its own
-if the secret ever leaks.
-
-There is deliberately no `release-bot` Gitea account. A key attached to an
-account is only consulted for signature checking after it has been through the
-web *Verify* flow, and that flow has no API — a bot account would need an
-interactive login to be worth anything. Listing the key under
-`TRUSTED_SSH_KEYS` instead makes Gitea verify commits signed with it without
-any account lookup, which is all the protected branch asks for.
-
-Set up once for the instance, and again only if the key is rotated:
-
-1. Generate a passphrase-less key (it has to be usable unattended):
-
-   ```
-   ssh-keygen -t ed25519 -C '[email protected]' -f release-bot -N ''
-   ```
-
-2. Add the public half to `app.ini` and restart Gitea:
-
-   ```ini
-   [repository.signing]
-   TRUSTED_SSH_KEYS = ssh-ed25519 AAAAC3Nza... [email protected]
-   ```
-
-3. Store the private half as the **organisation** Actions secret
-   `RELEASE_BOT_SIGNING_KEY` (Org → Settings → Actions → Secrets): the whole
-   `release-bot` file verbatim, `-----BEGIN OPENSSH PRIVATE KEY-----` header
-   and footer included — not the `.pub`, and not a GPG export. Organisation
-   secrets are readable as `secrets.RELEASE_BOT_SIGNING_KEY` from every
-   repository in the org, so no repository-level copy is needed. Delete both
-   local files afterwards.
-
-Two consequences of trusting the key instance-wide are worth knowing. Any
-commit signed with it verifies in *every* repository on the instance, not just
-these — the trust is in the key, not in a user with permissions you can scope.
-And the signature is attributed to `SIGNING_NAME` / `SIGNING_EMAIL`, not to the
-`Release Bot <release-bot@unsupervised.ca>` committer the job sets; that
-address backs no account and is only a label.
-
-The job fails fast if the secret is missing or `ssh-keygen` is absent from the
-runner image, and it re-reads the commit it just made to confirm a signature
-is attached before pushing — an unsigned bump commit would otherwise look fine
-until someone tried to merge the PR.
-
-Nothing else in the pipeline signs anything: release tags are made by a human
-through Gitea's release UI, and the merge commit is signed by the server when
-the PR is merged.
@@ -42,6 +42,34 @@ never be used to create a policy-less account (`Auth\EmailConfirmationHandler`):
 - `login_init` action redirects any `action=register` request (GET **and** POST) to the registration page before any processing runs.
 - `registration_errors` filter is a fail-safe that rejects `register_new_user()` outright.

+### Holding signups that came from somewhere else
+Blocking core's own form is not the whole story. `users_can_register=1` and
+`default_role=us_student` are *site-wide* settings, so they also arm every other
+route into `wp_insert_user()` a site happens to have — another plugin's signup
+form, a membership add-on. An account minted that way arrives holding
+`book_lesson`, with no email confirmed, no studio approval and no policy
+acceptance on file, and could book and be billed immediately.
+
+So the pending state is not decided by whichever form created the account. It is
+decided once, on `user_register`, by
+`Auth\RegistrationLoginGate::holdUnknownSignup()`:
+
+| New account | Result |
+|---|---|
+| Not a `us_student` | untouched — instructors and everyone else are not this feature's business |
+| Created by someone holding `manage_students` (including an admin adding a user in wp-admin) | left active — a deliberate act by someone who could approve it in the next click |
+| Anything else | **held** via `RegistrationStatus::hold()` and queued under **Pending Students** |
+
+A hold sets `us_awaiting_approval=1` *and* `us_email_confirmed=1`. The account was
+never asked to confirm anything and has no token to answer with, so blocking its
+login would strand it; what the hold withholds is `book_lesson`, until a studio
+admin approves it.
+
+The plugin's own paths all land in the last row and then say what they meant:
+- a self-signup calls `RegistrationStatus::markPending()`, which replaces the hold with a real, unconfirmed pending state (it clears `us_email_confirmed` explicitly for exactly this reason);
+- an invited student is approved outright by `RegistrationPage` before the auto-login — the invitation *is* the approval;
+- a guardian's child is approved outright by `GuardianService::createChild()`; the account is never signed in to, and queueing every child a family adds would be nonsense.
+
 ## Account Lifecycle (self-approval)
 State lives entirely in user meta (`Auth\RegistrationStatus`). Only the raw
 confirmation token's SHA-256 hash is stored; the token expires after 48h
@@ -198,7 +226,7 @@ No-op when no registration page is set.
 - Repository: `Unsupervised\Schedular\Auth\InviteRepository`
 - Admin controllers: `Unsupervised\Schedular\Auth\RegistrationController` (invites), `Unsupervised\Schedular\Auth\RegistrationApprovalController` (pending students)
 - Frontend: `Unsupervised\Schedular\Auth\RegistrationPage`
- Self-approval flow: `Auth\RegistrationStatus` (lifecycle meta), `Auth\RegistrationLoginGate` (login + booking-cap gate), `Auth\EmailConfirmationHandler` (confirm link + native-form block), `Auth\RegistrationMailer` (emails)
+- Self-approval flow: `Auth\RegistrationStatus` (lifecycle meta, including `hold()`), `Auth\RegistrationLoginGate` (login gate, booking-cap gate, and the `user_register` hold), `Auth\EmailConfirmationHandler` (confirm link + native-form block), `Auth\RegistrationMailer` (emails)
 - Settings toggle: `Payment\StudioSettings` (`us_registration_mode`, core-option mirror/restore)
 - Reuses `Policy\PolicyRepository`, `Policy\PolicyVersionRepository`, `Policy\AcceptanceRepository`
 - Schema: `us_invites`; `us_policies.acceptance_scope`. Self-approval adds no tables — state is WordPress user meta.
@@ -0,0 +1,79 @@
+# Feature: Data Removal
+
+## Overview
+What deleting the plugin takes with it, and how the site owner says so.
+
+WordPress gives an uninstall no interface of its own: `uninstall.php` runs
+headless, after the plugin is already gone from the screen, with no opportunity
+to ask anything. So the answer is given in advance, on **Access → Plugin
+removal**, and read back at uninstall time.
+
+Two things are true at once, and the split below is how both are honoured:
+
+- **A studio's records are irreplaceable.** Lessons taught, payments taken, what
+  families agreed to and when. A delete during a migration, or a
+  delete-and-reinstall while troubleshooting, must not be the thing that loses
+  them. So the data is **kept unless the owner explicitly says otherwise**.
+- **Credentials are not records.** A Stripe secret and webhook signing key can be
+  re-pasted from the Stripe dashboard in under a minute. Live keys sitting in
+  `wp_options` on a site that no longer has the code to use them are nothing but
+  exposure. So those are **always** removed.
+
+## Option `us_delete_data_on_uninstall`
+`'1'` or `'0'` (default `'0'`). Written only from the Access page.
+
+## Always removed
+Whatever the setting says:
+
+| What | Why |
+|---|---|
+| `us_stripe_secret_key`, `us_stripe_webhook_secret`, `us_stripe_publishable_key`, `us_stripe_mode` | Credentials, not records — cheap to restore, dangerous to leave |
+| `us_schedular_latest_release` transient | Cached release metadata; meaningless without the plugin |
+| The `us_generate_due_payments` cron event | Deactivation clears it too, but a site whose plugin files simply vanished never ran that hook |
+| `users_can_register` / `default_role` | Restored from the snapshot open registration took (`us_registration_prev_*`). These are the *site's* settings, borrowed; leaving them behind would leave the site accepting public signups into a Student role that is about to stop existing. Only acts when a snapshot exists |
+
+## Removed only on an explicit full purge
+- Every table in `Schema::TABLES` — all 14, dropped by name.
+- Every remaining `us_*` option, including the removal setting itself.
+- Every `us_*` user meta key, for all users (`delete_metadata( 'user', 0, $key, '', true )`) — billing overrides, child markers, birth years, pending-signup state.
+- The `us_studio_admin`, `us_instructor` and `us_student` roles.
+
+Roles go **only** on a full purge. A site keeping its data is keeping its
+students, and a student whose role was deleted out from under them holds no
+capabilities at all until the plugin is reinstalled.
+
+`Schema::TABLES` is the single list of tables the plugin owns; the `CREATE TABLE`
+statements in `Schema::tables()` spell their own names out, so a new table has to
+be added in both places or uninstalling will leave it behind.
+
+## Admin Interface
+**Access → Plugin removal** (`manage_options` — the same capability as deleting a
+plugin, so the switch and the act it governs are in the same pair of hands):
+
+- A read-only note stating what is removed regardless.
+- **Erase everything when the plugin is deleted** — off by default.
+
+Turning it **on** takes the tick *and* the word `DELETE` typed into a confirmation
+box. It is the only place in the plugin where a stray click is unrecoverable, so
+the checkbox alone is not enough. A refused confirmation reports why and still
+saves everything else on the page — a mistyped word must not silently swallow a
+capability change made in the same submit.
+
+Turning it **off** needs nothing but unticking the box. Saving the page for some
+other reason while it is already on leaves it on, without asking for the word
+again.
+
+## Implementation
+- `Unsupervised\Schedular\Uninstaller` — the option, and the whole of `run()`
+- `uninstall.php` — guards on `WP_UNINSTALL_PLUGIN`, loads the autoloader, calls `Uninstaller::run()`
+- `Unsupervised\Schedular\Schema::TABLES` — the table list
+- `Unsupervised\Schedular\Auth\AccessSettings` — the setting's UI and the typed confirmation
+- `templates/admin/access.php`
+
+## Tests
+- `tests/Unit/UninstallerTest.php`
+- `tests/Unit/Auth/AccessSettingsTest.php` (the confirmation rules)
+
+## Related
+- `payments.md` — the Stripe credentials this always forgets
+- `account-registration.md` — the core options open registration borrows
@@ -136,10 +136,12 @@ Self-withdrawal is bounded by the class's **withdrawal deadline** (the instructo
 implicit default — a class with no deadline set stays open to withdrawal for its
 whole life. Past the deadline `POST /enrollments/{id}/withdraw` rejects the request
 with `403 withdrawal_closed`, and the class card shows "Withdrawal has closed —
-contact the studio to withdraw." in place of the Withdraw button. The endpoint also
-returns `404 not_found` for an unknown enrolment and `403 forbidden` when the
-enrolment is not the caller's own; a withdrawal of an already-cancelled enrolment is
-idempotent.
+contact the studio to withdraw." in place of the Withdraw button. An enrolment that
+does not exist and one that is not the caller's own both return the same
+`404 not_found`, deliberately: two different answers would let any signed-in student
+walk the id space and count the studio's enrolments, and there is nothing they could
+do with either answer. A withdrawal of an already-cancelled enrolment is idempotent.
+`POST /bookings/{id}/cancel` makes the same trade for the same reason.

 The deadline only bounds student **self**-withdrawal. A studio admin can withdraw a
 student at any time from the **student detail page** (`Auth\StudentActions::withdrawEnrollment`),
@@ -47,9 +47,21 @@ update for a same-slug plugin and makes core fire the
   `us_schedular_latest_release` transient for 6 hours.
 3. Strips the leading `v` from the tag and compares against `USC_VERSION`
   with `version_compare`; PHP orders `1.0.0-rc.2 < 1.0.0` correctly.
-4. When newer, returns the release's first `.zip` asset as the update
-   package. Core takes over from there: Plugins-screen notice, one-click
-   update, and WP-Cron auto-updates if enabled.
+4. When newer, returns the release's first `.zip` asset **whose download URL
+   is `https` on `git.unsupervised.ca` itself** as the update package. Core
+   takes over from there: Plugins-screen notice, one-click update, and
+   WP-Cron auto-updates if enabled.
+
+   The host check is not ceremony. Whatever this returns is downloaded and
+   unpacked over the installed plugin, so the URL is executable code by
+   another name — and it arrives in a JSON body. An answer that is not really
+   the release server's (a hijacked hostname, a tampered response, a repo host
+   handing out a package hosted somewhere else) would otherwise install
+   arbitrary code on every site running the plugin, silently for anyone with
+   auto-updates on. The host must match exactly: `evil-git.unsupervised.ca`,
+   `git.unsupervised.ca.evil.test` and `cdn.git.unsupervised.ca` are all
+   refused, and so is plain `http`. An asset that fails the check is skipped
+   and the scan continues, so one bad asset does not hide a good one.
 5. When not newer — the site is current, or the lookup failed — returns a
   `no_update` payload (installed version, empty package). This keeps the
   plugin in core's `update_plugins` transient so core's `update-supported`
@@ -3,17 +3,24 @@ declare(strict_types=1);

 namespace Unsupervised\Schedular\Auth;

+use Unsupervised\Schedular\Uninstaller;
 use Unsupervised\Schedular\Val;

 /**
- * Site-owner toggles for whether WordPress administrators automatically receive
- * the studio-admin and/or instructor capabilities.
+ * The site owner's page: whether WordPress administrators automatically receive
+ * the studio-admin and/or instructor capabilities, and what deleting the plugin
+ * takes with it.
 *
- * Both default on, preserving the out-of-the-box experience where a single
- * administrator runs the studio and teaches from one account. The settings page
- * is gated on `manage_options` (the core WordPress administrator capability,
- * which the plugin never grants or revokes) so an administrator can always reach
- * it to re-enable a grant — disabling one can never lock them out.
+ * Both capability grants default on, preserving the out-of-the-box experience
+ * where a single administrator runs the studio and teaches from one account. The
+ * settings page is gated on `manage_options` (the core WordPress administrator
+ * capability, which the plugin never grants or revokes) so an administrator can
+ * always reach it to re-enable a grant — disabling one can never lock them out.
+ *
+ * The data-removal choice lives here for the same reason: `manage_options` is
+ * held by exactly the people who can delete a plugin, so the switch and the act
+ * it governs are in the same pair of hands. {@see Uninstaller} explains what the
+ * two answers mean.
 */
 class AccessSettings {

@@ -49,21 +56,56 @@ class AccessSettings {
 			wp_die( esc_html__( 'You do not have permission to manage access settings.', 'unsupervised-schedular' ) );
 		}

+		$error = '';
 		if ( isset( $_POST['usc_action'] ) && check_admin_referer( 'usc_access_action' ) ) {
-			$this->save();
+			$error = $this->save();
 		}

 		$adminsAreStudioAdmins = $this->adminsAreStudioAdmins();
 		$adminsAreInstructors  = $this->adminsAreInstructors();
+		$deleteDataOnUninstall = Uninstaller::deletesDataOnUninstall();

 		include USC_PLUGIN_DIR . 'templates/admin/access.php';
 	}

-	private function save(): void {
+	/**
+	 * Persist the submitted settings, reporting why the data-removal choice was
+	 * refused when it was. Everything else on the page saves either way: a
+	 * mistyped confirmation must not also swallow a capability change.
+	 */
+	private function save(): string {
 		// Nonce is verified by the caller (renderPage) before this method runs.
 		// phpcs:disable WordPress.Security.NonceVerification.Missing
 		update_option( self::OPT_GRANT_STUDIO, isset( $_POST['grant_studio'] ) ? '1' : '0' );
 		update_option( self::OPT_GRANT_INSTRUCTOR, isset( $_POST['grant_instructor'] ) ? '1' : '0' );
+
+		$wanted = isset( $_POST['delete_data'] );
+
+		// Switching it off is not the dangerous direction, and needs no ceremony.
+		if ( ! $wanted ) {
+			Uninstaller::setDeletesDataOnUninstall( false );
+
+			return '';
+		}
+
+		// Already on and left on: this save is about something else on the page,
+		// so do not make them retype the word to keep a setting they already made.
+		if ( Uninstaller::deletesDataOnUninstall() ) {
+			return '';
+		}
+
+		// Turning it on erases records that cannot be got back, so the tick alone
+		// is not enough — it is one stray click, and this is the only place in the
+		// plugin where a stray click is unrecoverable.
+		$confirmed = 'delete' === sanitize_key( Val::string( wp_unslash( $_POST['delete_data_confirm'] ?? '' ) ) );
 		// phpcs:enable WordPress.Security.NonceVerification.Missing
+
+		if ( ! $confirmed ) {
+			return __( 'Data removal was not enabled: type DELETE in the confirmation box to turn it on. Everything else on this page was saved.', 'unsupervised-schedular' );
+		}
+
+		Uninstaller::setDeletesDataOnUninstall( true );
+
+		return '';
 	}
 }
@@ -36,7 +36,12 @@ class LoginPage {
 				'remember'      => isset( $_POST['rememberme'] ),
 			];

-			$user = wp_signon( $credentials, false );
+			// The secure-cookie argument is deliberately left at its default. Only
+			// the empty string makes wp_signon() work it out from is_ssl(); passing
+			// an explicit false skips that and issues the plain, non-Secure auth
+			// cookie on an HTTPS site — a session that then leaks over the first
+			// http:// request to the domain.
+			$user = wp_signon( $credentials );

 			if ( is_wp_error( $user ) ) {
 				$error = esc_html__( 'Invalid username or password.', 'unsupervised-schedular' );
@@ -11,12 +11,59 @@ namespace Unsupervised\Schedular\Auth;
 *
 * Both checks key solely off the pending user meta, so invite- and
 * admin-created students (which carry none of it) are unaffected.
+ *
+ * It also decides which new accounts land in that pending state to begin with —
+ * see {@see holdUnknownSignup()}, which closes the gap left by open registration
+ * turning the site's own `users_can_register` on.
 */
 class RegistrationLoginGate {

 	public function register(): void {
 		add_filter( 'wp_authenticate_user', [ $this, 'blockUnconfirmed' ], 10, 1 );
 		add_filter( 'user_has_cap', [ $this, 'withholdBookingWhilePending' ], 10, 4 );
+		add_action( 'user_register', [ $this, 'holdUnknownSignup' ], 10, 1 );
+	}
+
+	/**
+	 * Hold any student account created by an unauthenticated request that did not
+	 * come through the studio's own signup form.
+	 *
+	 * Enabling open registration switches the site's `users_can_register` on and
+	 * makes Student the default role for a new user, because that is what the
+	 * studio's registration page needs. But those are *site-wide* settings: they
+	 * also arm every other route into `wp_insert_user()` the site happens to have
+	 * — another plugin's signup form, a membership add-on — and an account minted
+	 * that way arrives holding `book_lesson`, with no email confirmed, no studio
+	 * approval, and no policy acceptance on file. It could book and be billed
+	 * immediately.
+	 *
+	 * So the state is decided here, at the one point every path passes through,
+	 * rather than trusted to whichever form happened to create the account:
+	 *
+	 * - **Not a student** — instructors and everyone else are none of this
+	 *   feature's business.
+	 * - **Created by staff** (anyone holding `manage_students`, which includes an
+	 *   administrator adding a user from wp-admin) — a deliberate act by someone
+	 *   who could have approved them anyway; approving their own creation is
+	 *   ceremony, so the account is left active.
+	 * - **Anything else** — held, and queued for review under **Pending
+	 *   Students**.
+	 *
+	 * The studio's own paths land in the last case and then say what they meant:
+	 * a self-signup calls {@see RegistrationStatus::markPending()} (which replaces
+	 * the hold with a real, unconfirmed pending state), and an invited student and
+	 * a guardian's child are approved outright by the code that creates them.
+	 */
+	public function holdUnknownSignup( int $userId ): void {
+		if ( $userId <= 0 || ! RoleManager::isStudent( $userId ) ) {
+			return;
+		}
+
+		if ( current_user_can( RoleManager::CAP_MANAGE_STUDENTS ) ) {
+			return;
+		}
+
+		RegistrationStatus::hold( $userId );
 	}

 	/**
@@ -431,6 +431,13 @@ class RegistrationPage {
 		}

 		if ( $inviteValid && ! $invite->isGroup() ) {
+			// An invited student is pre-approved by the invitation itself — the
+			// studio picked the address and sent the link. Clears the hold the
+			// registration gate puts on every student account created by an
+			// unauthenticated request ({@see RegistrationLoginGate::holdUnknownSignup()}),
+			// which would otherwise leave them signed in but unable to book.
+			RegistrationStatus::approve( (int) $userId );
+
 			$this->invites->markAccepted( (int) $invite->id, (int) $userId );

 			// A personal invite may carry a group-class grant (invited by email);
@@ -58,6 +58,11 @@ class RegistrationStatus {
 		$rawToken = wp_generate_password( 32, false );

 		update_user_meta( $userId, self::META_AWAITING_APPROVAL, '1' );
+		// Explicitly *un*confirmed. The account may already have been held by
+		// {@see hold()} on `user_register` — which counts the email as confirmed,
+		// having never asked for confirmation — and this signup did ask, so the
+		// answer has to be waited for rather than inherited.
+		delete_user_meta( $userId, self::META_EMAIL_CONFIRMED );
 		update_user_meta( $userId, self::META_CONFIRM_TOKEN, self::hashToken( $rawToken ) );
 		update_user_meta(
 			$userId,
@@ -72,6 +77,21 @@ class RegistrationStatus {
 		return $rawToken;
 	}

+	/**
+	 * Hold a student account that appeared without going through the studio's own
+	 * signup form — see {@see RegistrationLoginGate::holdUnknownSignup()}.
+	 *
+	 * The email counts as confirmed, because nobody ever asked for confirmation
+	 * and there is no token to answer with: blocking the login outright would
+	 * strand the account with no way forward. What the hold actually withholds is
+	 * the booking capability, until a studio admin approves them from **Pending
+	 * Students** — the same queue, and the same decision, as a self-signup.
+	 */
+	public static function hold( int $userId ): void {
+		update_user_meta( $userId, self::META_AWAITING_APPROVAL, '1' );
+		update_user_meta( $userId, self::META_EMAIL_CONFIRMED, '1' );
+	}
+
 	/**
 	 * Mark the account's email confirmed and discard the (now spent) token. The
 	 * account stays awaiting approval.
@@ -330,14 +330,19 @@ class BookingEndpoint {
 		$id     = absint( Val::int( $request->get_param( 'id' ) ) );
 		$lesson = $this->bookings->findById( $id );

-		if ( null === $lesson ) {
+		// A booking that is not the caller's is answered exactly as one that does
+		// not exist. Telling the two apart — 403 here, 404 there — would let any
+		// signed-in student walk the id space and learn which lessons the studio
+		// holds, and roughly how many. There is nothing a student can do with
+		// either answer, so there is no reason to distinguish them.
+		//
+		// The booking form's own 403 (see resolveStudent) is a different case: the
+		// student id there was chosen from a list of people the caller may act for,
+		// so "not yours" is a correction they need, not a fact they lack.
+		if ( null === $lesson || ! $this->guardians->canActFor( get_current_user_id(), $lesson->studentId ) ) {
 			return new \WP_Error( 'not_found', __( 'Booking not found.', 'unsupervised-schedular' ), [ 'status' => 404 ] );
 		}

-		if ( ! $this->guardians->canActFor( get_current_user_id(), $lesson->studentId ) ) {
-			return new \WP_Error( 'forbidden', __( 'You cannot cancel this booking.', 'unsupervised-schedular' ), [ 'status' => 403 ] );
-		}
-
 		if ( Lesson::STATUS_CANCELLED !== $lesson->status ) {
 			$slot = $this->availability->findById( $lesson->slotId );
 			if ( null !== $slot ) {
@@ -202,14 +202,14 @@ class EnrollmentEndpoint {
 		$id         = absint( Val::int( $request->get_param( 'id' ) ) );
 		$enrollment = $this->enrollments->findById( $id );

-		if ( null === $enrollment ) {
+		// Someone else's enrolment is answered exactly as a nonexistent one, so the
+		// id space cannot be walked to count the studio's enrolments. See
+		// {@see \Unsupervised\Schedular\Booking\BookingEndpoint::cancel()}, which
+		// makes the same trade for the same reason.
+		if ( null === $enrollment || ! $this->guardians->canActFor( get_current_user_id(), $enrollment->studentId ) ) {
 			return new \WP_Error( 'not_found', __( 'Enrolment not found.', 'unsupervised-schedular' ), [ 'status' => 404 ] );
 		}

-		if ( ! $this->guardians->canActFor( get_current_user_id(), $enrollment->studentId ) ) {
-			return new \WP_Error( 'forbidden', __( 'You cannot withdraw from this class.', 'unsupervised-schedular' ), [ 'status' => 403 ] );
-		}
-
 		if ( Enrollment::STATUS_ACTIVE === $enrollment->status ) {
 			$offering = $this->offerings->findById( $enrollment->offeringId );

@@ -3,6 +3,7 @@ declare(strict_types=1);

 namespace Unsupervised\Schedular\Guardian;

+use Unsupervised\Schedular\Auth\RegistrationStatus;
 use Unsupervised\Schedular\Auth\RoleManager;
 use Unsupervised\Schedular\Auth\UserName;
 use Unsupervised\Schedular\Booking\BookingRepository;
@@ -103,6 +104,14 @@ class GuardianService {
 		$userId = (int) $userId;

 		update_user_meta( $userId, self::META_CHILD, '1' );
+
+		// A child is a student created by someone who is not staff, so the
+		// registration gate holds it on `user_register` like any other unattributed
+		// signup. There is nothing here to approve: the account is never signed in
+		// to, and the guardian in front of us is the approval. Leaving the hold on
+		// would put every child a family adds into the studio's review queue.
+		RegistrationStatus::approve( $userId );
+
 		$this->setBirthYear( $userId, $birthYear );

 		$linkId = $this->guardians->insert(
@@ -5,6 +5,33 @@ namespace Unsupervised\Schedular;

 class Schema {

+	/**
+	 * Every table this plugin owns, unprefixed and in creation order.
+	 *
+	 * The statements in {@see tables()} spell their own names out, so this list is
+	 * what anything that needs to *name* the tables without building them reads —
+	 * {@see Uninstaller}, which drops them. Add a table below and add it here, or
+	 * uninstalling will leave it behind.
+	 *
+	 * @var list<string>
+	 */
+	public const TABLES = [
+		'us_availability',
+		'us_lessons',
+		'us_offerings',
+		'us_questions',
+		'us_question_answers',
+		'us_policies',
+		'us_policy_versions',
+		'us_policy_acceptances',
+		'us_payments',
+		'us_credits',
+		'us_group_enrollments',
+		'us_invites',
+		'us_guardians',
+		'us_group_access',
+	];
+
 	/**
 	 * Returns CREATE TABLE statements for dbDelta.
 	 *
@@ -0,0 +1,214 @@
+<?php
+declare(strict_types=1);
+
+namespace Unsupervised\Schedular;
+
+use Unsupervised\Schedular\Auth\AccessSettings;
+use Unsupervised\Schedular\Auth\RegistrationController;
+use Unsupervised\Schedular\Auth\RegistrationStatus;
+use Unsupervised\Schedular\Auth\RoleManager;
+use Unsupervised\Schedular\Guardian\GuardianService;
+use Unsupervised\Schedular\Payment\BillingMethodResolver;
+use Unsupervised\Schedular\Payment\ScheduledBillingRunner;
+use Unsupervised\Schedular\Payment\StudioSettings;
+use Unsupervised\Schedular\Update\UpdateChecker;
+
+/**
+ * What deleting the plugin takes with it.
+ *
+ * WordPress gives an uninstall no interface of its own — `uninstall.php` runs
+ * headless, after the plugin is already gone from the screen — so the choice has
+ * to be made in advance, on **Access → Plugin removal**, and read back here. Two
+ * things are true at once and the split below is how both are honoured:
+ *
+ * - A studio's records are irreplaceable. Lessons taught, payments taken, what
+ *   families agreed to and when: a deactivate-and-reinstall, or a delete during
+ *   a migration, must not be the thing that loses them. So the data is kept
+ *   unless the site owner has explicitly said otherwise.
+ * - Credentials are not records. The Stripe secret and webhook signing key can
+ *   be re-pasted from the Stripe dashboard in under a minute, and leaving live
+ *   keys in `wp_options` of a site that no longer has the code to use them is
+ *   nothing but exposure. So those go every time, choice or no choice.
+ *
+ * The two WordPress settings open registration borrows — `users_can_register`
+ * and `default_role` — are also always put back. They are the site's, not the
+ * plugin's, and leaving them behind would leave the site accepting public
+ * signups into a Student role that may no longer exist.
+ */
+class Uninstaller {
+
+	/**
+	 * Whether deleting the plugin also erases everything it recorded. Off unless
+	 * the site owner turns it on, because the mistake is unrecoverable in one
+	 * direction only.
+	 */
+	public const OPT_DELETE_DATA = 'us_delete_data_on_uninstall';
+
+	/**
+	 * Stripe credentials and configuration. Always removed — see the class
+	 * docblock.
+	 *
+	 * @var list<string>
+	 */
+	private const CREDENTIAL_OPTIONS = [
+		StudioSettings::OPT_PUBLISHABLE,
+		StudioSettings::OPT_SECRET,
+		StudioSettings::OPT_WEBHOOK_SECRET,
+		StudioSettings::OPT_MODE,
+	];
+
+	/**
+	 * Every remaining option the plugin writes. Removed only on a full purge.
+	 *
+	 * @var list<string>
+	 */
+	private const SETTING_OPTIONS = [
+		'us_schedular_version',
+		'us_questions_offering_nullable',
+		'us_questions_child_required_backfilled',
+		StudioSettings::OPT_CURRENCY,
+		StudioSettings::OPT_ETRANSFER_EMAIL,
+		StudioSettings::OPT_HST_RATE,
+		StudioSettings::OPT_DEFAULT_PAYMENT_METHOD,
+		StudioSettings::OPT_CANCELLATION_CUTOFF_HOURS,
+		StudioSettings::OPT_REGISTRATION_MODE,
+		RegistrationController::OPTION_PAGE,
+		AccessSettings::OPT_GRANT_STUDIO,
+		AccessSettings::OPT_GRANT_INSTRUCTOR,
+		self::OPT_DELETE_DATA,
+	];
+
+	/**
+	 * Every user meta key the plugin writes. Removed for all users on a full
+	 * purge, so no student is left carrying a billing override or a half-finished
+	 * signup for a plugin that is gone.
+	 *
+	 * @var list<string>
+	 */
+	private const USER_META = [
+		GuardianService::META_CHILD,
+		GuardianService::META_BIRTH_YEAR,
+		GuardianService::META_DOB,
+		GuardianService::META_GUARDIAN_ONLY,
+		BillingMethodResolver::META_METHOD,
+		RegistrationStatus::META_AWAITING_APPROVAL,
+		RegistrationStatus::META_EMAIL_CONFIRMED,
+		RegistrationStatus::META_CONFIRM_TOKEN,
+		RegistrationStatus::META_CONFIRM_EXPIRES,
+		RegistrationStatus::META_AUTO_APPROVE,
+	];
+
+	/**
+	 * Whether a full purge has been asked for.
+	 */
+	public static function deletesDataOnUninstall(): bool {
+		return '1' === Val::string( get_option( self::OPT_DELETE_DATA, '0' ) );
+	}
+
+	/**
+	 * Record the site owner's answer.
+	 */
+	public static function setDeletesDataOnUninstall( bool $delete ): void {
+		update_option( self::OPT_DELETE_DATA, $delete ? '1' : '0' );
+	}
+
+	/**
+	 * Run the uninstall. Called from `uninstall.php`, which WordPress loads in
+	 * isolation once the plugin has been deleted.
+	 */
+	public function run(): void {
+		$this->forgetCredentials();
+		$this->restoreCoreRegistrationSettings();
+
+		// The event is cleared on deactivation too, which always precedes a
+		// delete — repeated here because a site can be left with a stale schedule
+		// if the plugin files went away without deactivating cleanly.
+		wp_clear_scheduled_hook( ScheduledBillingRunner::HOOK );
+
+		if ( ! self::deletesDataOnUninstall() ) {
+			return;
+		}
+
+		$this->dropTables();
+		$this->deleteSettings();
+		$this->deleteUserMeta();
+		$this->removeRoles();
+	}
+
+	/**
+	 * Forget the Stripe credentials, always. {@see StudioSettings::clearStripeConfig()}
+	 * is the same act from the settings page; it is not reused here because that
+	 * object belongs to a plugin that, by this point, is no longer loaded as one.
+	 */
+	private function forgetCredentials(): void {
+		foreach ( self::CREDENTIAL_OPTIONS as $option ) {
+			delete_option( $option );
+		}
+
+		delete_transient( UpdateChecker::TRANSIENT );
+	}
+
+	/**
+	 * Put back the two core options open registration borrowed, from the snapshot
+	 * taken when it was switched on. Without this, deleting the plugin while open
+	 * registration is enabled leaves the site accepting public signups into a role
+	 * that is about to stop existing.
+	 *
+	 * Only acts when a snapshot exists, so a site that never enabled open
+	 * registration keeps its own settings untouched.
+	 */
+	private function restoreCoreRegistrationSettings(): void {
+		$snapshot = get_option( StudioSettings::OPT_PREV_USERS_CAN_REGISTER, null );
+		if ( null === $snapshot ) {
+			return;
+		}
+
+		$prevRole = Val::string( get_option( StudioSettings::OPT_PREV_DEFAULT_ROLE, 'subscriber' ) );
+
+		update_option( 'users_can_register', '1' === Val::string( $snapshot ) ? '1' : '0' );
+		update_option( 'default_role', '' !== $prevRole ? $prevRole : 'subscriber' );
+
+		delete_option( StudioSettings::OPT_PREV_USERS_CAN_REGISTER );
+		delete_option( StudioSettings::OPT_PREV_DEFAULT_ROLE );
+	}
+
+	private function dropTables(): void {
+		global $wpdb;
+		if ( ! $wpdb instanceof \wpdb ) {
+			return;
+		}
+
+		foreach ( Schema::TABLES as $table ) {
+			$sql = $wpdb->prepare( 'DROP TABLE IF EXISTS %i', $wpdb->prefix . $table );
+
+			if ( null !== $sql ) {
+				// phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.DirectDatabaseQuery.SchemaChange -- $sql is the prepared statement two lines up; the sniff cannot follow it across the null guard, which PHPStan requires because prepare() is nullable. The only interpolated value is a Schema::TABLES constant.
+				$wpdb->query( $sql );
+			}
+		}
+	}
+
+	private function deleteSettings(): void {
+		foreach ( self::SETTING_OPTIONS as $option ) {
+			delete_option( $option );
+		}
+	}
+
+	private function deleteUserMeta(): void {
+		foreach ( self::USER_META as $key ) {
+			delete_metadata( 'user', 0, $key, '', true );
+		}
+	}
+
+	/**
+	 * Drop the three roles the plugin adds. Only on a full purge: a site keeping
+	 * its data is keeping its students too, and a student whose role has been
+	 * deleted out from under them is a user with no capabilities at all until the
+	 * plugin is reinstalled.
+	 */
+	private function removeRoles(): void {
+		foreach ( [ RoleManager::STUDIO_ADMIN, RoleManager::INSTRUCTOR, RoleManager::STUDENT ] as $role ) {
+			remove_role( $role );
+		}
+	}
+}
@@ -178,8 +178,13 @@ class UpdateChecker {
 				if ( ! is_array( $asset ) ) {
 					continue;
 				}
-				if ( str_ends_with( strtolower( Val::string( $asset['name'] ?? '' ) ), '.zip' ) ) {
-					$package = Val::string( $asset['browser_download_url'] ?? '' );
+				if ( ! str_ends_with( strtolower( Val::string( $asset['name'] ?? '' ) ), '.zip' ) ) {
+					continue;
+				}
+
+				$url = Val::string( $asset['browser_download_url'] ?? '' );
+				if ( self::isTrustedPackage( $url ) ) {
+					$package = $url;
 					break;
 				}
 			}
@@ -194,4 +199,40 @@ class UpdateChecker {
 			'package' => $package,
 		];
 	}
+
+	/**
+	 * Whether a release asset's URL may be handed to core as a plugin package.
+	 *
+	 * Core downloads whatever this returns and unpacks it over the installed
+	 * plugin, so the URL is executable code by another name. It is taken from a
+	 * JSON body, which means an answer that is not really the release server's —
+	 * a hijacked hostname, a tampered response, a compromised repo host handing
+	 * out a package hosted elsewhere — would otherwise install arbitrary code on
+	 * every site running this plugin, silently for anyone with auto-updates on.
+	 *
+	 * So the package has to come from the release host itself, over TLS: the
+	 * scheme is `https` and the parsed host equals {@see HOSTNAME} exactly. The
+	 * comparison is on the parsed host and not on the string, because a name that
+	 * merely *contains* the right one is the whole trick — `evil-git.unsupervised.ca`
+	 * would satisfy an endsWith check, `git.unsupervised.ca.attacker.test` a
+	 * startsWith one, and `https://[email protected]/x.zip` reads
+	 * like the real host to a person while resolving to someone else's.
+	 * Subdomains are refused too: nothing but the release host publishes releases.
+	 *
+	 * This cannot defend against the release host serving a bad zip of its own —
+	 * nothing here can — but it keeps the blast radius to that one host.
+	 */
+	private static function isTrustedPackage( string $url ): bool {
+		if ( '' === $url ) {
+			return false;
+		}
+
+		$parts = wp_parse_url( $url );
+		if ( ! is_array( $parts ) ) {
+			return false;
+		}
+
+		return 'https' === strtolower( Val::string( $parts['scheme'] ?? '' ) )
+			&& self::HOSTNAME === strtolower( Val::string( $parts['host'] ?? '' ) );
+	}
 }
@@ -6,8 +6,10 @@ if (! defined('ABSPATH')) {
 }

 /**
- * @var bool $adminsAreStudioAdmins
- * @var bool $adminsAreInstructors
+ * @var bool   $adminsAreStudioAdmins
+ * @var bool   $adminsAreInstructors
+ * @var bool   $deleteDataOnUninstall
+ * @var string $error Why the data-removal choice was refused, if it was.
 */
 ?>
 <div class="wrap">
@@ -19,6 +21,12 @@ if (! defined('ABSPATH')) {
        </p>
    </div>

+    <?php if ($error !== '') : ?>
+        <div class="notice notice-error inline">
+            <p><?php echo esc_html($error); ?></p>
+        </div>
+    <?php endif; ?>
+
    <form method="post">
        <?php wp_nonce_field('usc_access_action'); ?>
        <input type="hidden" name="usc_action" value="save">
@@ -45,6 +53,50 @@ if (! defined('ABSPATH')) {
                </td>
            </tr>
        </table>
+
+        <h2><?php esc_html_e('Plugin removal', 'unsupervised-schedular'); ?></h2>
+        <p class="description" style="max-width:46em;">
+            <?php esc_html_e('Deleting a plugin happens on the Plugins screen, and WordPress gives it nothing to ask you at the time — so the answer is given here, in advance.', 'unsupervised-schedular'); ?>
+        </p>
+        <table class="form-table">
+            <tr>
+                <th scope="row"><?php esc_html_e('Always removed', 'unsupervised-schedular'); ?></th>
+                <td>
+                    <p class="description">
+                        <?php esc_html_e('Your Stripe secret key and webhook signing secret are forgotten whenever this plugin is deleted, whatever you choose below. They can be pasted back in from the Stripe dashboard in a minute; leaving live keys on a site that no longer has the code to use them cannot be undone as easily. The two WordPress settings open registration borrows — whether anyone can register, and the role new users get — are put back as they were, too.', 'unsupervised-schedular'); ?>
+                    </p>
+                </td>
+            </tr>
+            <tr>
+                <th scope="row"><?php esc_html_e('Studio records', 'unsupervised-schedular'); ?></th>
+                <td>
+                    <fieldset>
+                        <label>
+                            <input type="checkbox" name="delete_data" value="1" <?php checked($deleteDataOnUninstall); ?>>
+                            <?php esc_html_e('Erase everything when the plugin is deleted', 'unsupervised-schedular'); ?>
+                        </label>
+                        <p class="description">
+                            <?php esc_html_e('Off by default: deleting the plugin leaves your lessons, enrolments, payments, credits, intake answers, policy agreements, invites and family links in the database, so reinstalling picks up exactly where you left off — and a deletion during a migration or a bit of troubleshooting costs you nothing.', 'unsupervised-schedular'); ?>
+                        </p>
+                        <p class="description">
+                            <strong><?php esc_html_e('Turn it on and there is no way back.', 'unsupervised-schedular'); ?></strong>
+                            <?php esc_html_e('Every table this plugin made is dropped, every setting and student record it stored is deleted, and the Studio Admin, Instructor and Student roles are removed. WordPress does not ask twice and there is no undo. Take a database backup first if the studio has ever taken a payment.', 'unsupervised-schedular'); ?>
+                        </p>
+                        <?php if (! $deleteDataOnUninstall) : ?>
+                            <p>
+                                <label for="usc-delete-confirm"><?php esc_html_e('To turn it on, type DELETE:', 'unsupervised-schedular'); ?></label>
+                                <input type="text" name="delete_data_confirm" id="usc-delete-confirm" value="" autocomplete="off" class="regular-text" style="max-width:12em;">
+                            </p>
+                        <?php else : ?>
+                            <p class="description">
+                                <?php esc_html_e('Currently on. Untick the box and save to turn it off again.', 'unsupervised-schedular'); ?>
+                            </p>
+                        <?php endif; ?>
+                    </fieldset>
+                </td>
+            </tr>
+        </table>
+
        <?php submit_button(esc_html__('Save Access Settings', 'unsupervised-schedular')); ?>
    </form>
 </div>
@@ -6,6 +6,7 @@ namespace Unsupervised\Schedular\Tests\Unit\Auth;
 use Brain\Monkey\Functions;
 use Unsupervised\Schedular\Auth\AccessSettings;
 use Unsupervised\Schedular\Tests\Unit\TestCase;
+use Unsupervised\Schedular\Uninstaller;

 class AccessSettingsTest extends TestCase
 {
@@ -31,4 +32,108 @@ class AccessSettingsTest extends TestCase
        self::assertFalse($settings->adminsAreStudioAdmins());
        self::assertTrue($settings->adminsAreInstructors());
    }
+
+    /**
+     * Render the page with the given options stored and the given form posted,
+     * returning the options as they end up.
+     *
+     * @param  array<string, mixed> $options
+     * @param  array<string, mixed> $post
+     * @return array<string, mixed>
+     */
+    private function submit(array $options, array $post): array
+    {
+        // A regular closure, not an arrow fn: arrow functions capture by value,
+        // so reads after the save would still see the options as they were.
+        Functions\when('get_option')->alias(
+            static function (string $name, mixed $default = false) use (&$options): mixed {
+                return $options[$name] ?? $default;
+            }
+        );
+        Functions\when('update_option')->alias(
+            static function (string $name, mixed $value) use (&$options): bool {
+                $options[$name] = $value;
+
+                return true;
+            }
+        );
+        Functions\when('current_user_can')->justReturn(true);
+        Functions\when('check_admin_referer')->justReturn(true);
+        Functions\when('wp_unslash')->returnArg();
+        // The typed confirmation is read through sanitize_key, so "Delete",
+        // " delete " and "DELETE" all arrive here as the same word.
+        Functions\when('sanitize_key')->alias(
+            static fn($v): string => (string) preg_replace('/[^a-z0-9_\-]/', '', strtolower((string) $v))
+        );
+        Functions\when('wp_nonce_field')->justReturn('');
+        Functions\when('submit_button')->justReturn('');
+
+        $_POST = $post + ['usc_action' => 'save'];
+
+        ob_start();
+        (new AccessSettings())->renderPage();
+        ob_end_clean();
+
+        $_POST = [];
+
+        return $options;
+    }
+
+    /**
+     * Erasing the studio's records cannot be undone, and a checkbox is one stray
+     * click. The tick alone must not be enough.
+     */
+    public function testTickingDataRemovalWithoutTypingTheWordDoesNotEnableIt(): void
+    {
+        $options = $this->submit(
+            [Uninstaller::OPT_DELETE_DATA => '0'],
+            ['delete_data' => '1', 'grant_studio' => '1']
+        );
+
+        self::assertSame('0', $options[Uninstaller::OPT_DELETE_DATA]);
+        // The rest of the page still saved: a mistyped confirmation must not
+        // silently swallow a capability change made in the same submit.
+        self::assertSame('1', $options[AccessSettings::OPT_GRANT_STUDIO]);
+    }
+
+    public function testTickAndTypedConfirmationTogetherEnableIt(): void
+    {
+        $options = $this->submit(
+            [Uninstaller::OPT_DELETE_DATA => '0'],
+            ['delete_data' => '1', 'delete_data_confirm' => ' DELETE ']
+        );
+
+        self::assertSame('1', $options[Uninstaller::OPT_DELETE_DATA]);
+    }
+
+    public function testANearMissDoesNotCount(): void
+    {
+        $options = $this->submit(
+            [Uninstaller::OPT_DELETE_DATA => '0'],
+            ['delete_data' => '1', 'delete_data_confirm' => 'delete everything']
+        );
+
+        self::assertSame('0', $options[Uninstaller::OPT_DELETE_DATA]);
+    }
+
+    /**
+     * Once it is on, saving the page for some other reason must not turn it off
+     * — nor demand the word again for a setting already made.
+     */
+    public function testSavingOtherSettingsLeavesAnEnabledChoiceAlone(): void
+    {
+        $options = $this->submit(
+            [Uninstaller::OPT_DELETE_DATA => '1'],
+            ['delete_data' => '1', 'grant_instructor' => '1']
+        );
+
+        self::assertSame('1', $options[Uninstaller::OPT_DELETE_DATA]);
+    }
+
+    public function testUntickingTurnsItOffWithNoCeremony(): void
+    {
+        $options = $this->submit([Uninstaller::OPT_DELETE_DATA => '1'], ['grant_studio' => '1']);
+
+        self::assertSame('0', $options[Uninstaller::OPT_DELETE_DATA]);
+    }
 }
@@ -19,7 +19,7 @@ class LoginPageTest extends TestCase

    protected function tearDown(): void
    {
-        unset($_POST['us_login']);
+        unset($_POST['us_login'], $_POST['log'], $_POST['pwd']);
        parent::tearDown();
    }

@@ -91,4 +91,37 @@ class LoginPageTest extends TestCase

        self::assertSame('https://example.com/book/', $this->page->bookingUrl(9));
    }
+
+    /**
+     * wp_signon()'s second argument decides whether the auth cookie carries the
+     * Secure flag, and *only* its default (the empty string) makes it work that
+     * out from is_ssl(). Passing an explicit false — which reads like "no
+     * preference" and is not — issues the plain, non-Secure cookie on an HTTPS
+     * site, leaving every student's session to leak over the first http://
+     * request to the domain. So the call must pass the credentials and nothing
+     * else, which is what this asserts: a second argument of any kind fails it.
+     */
+    public function testSignOnDoesNotOverrideWordPressSecureCookieDetection(): void
+    {
+        $_POST['us_login'] = '1';
+        $_POST['log']      = '[email protected]';
+        $_POST['pwd']      = 'hunter2';
+
+        Functions\when('is_user_logged_in')->justReturn(false);
+        Functions\when('get_permalink')->justReturn('https://example.com/login/');
+        Functions\when('sanitize_url')->returnArg();
+        Functions\when('sanitize_user')->returnArg();
+        Functions\when('wp_unslash')->returnArg();
+        Functions\when('wp_nonce_field')->justReturn('');
+        Functions\when('check_admin_referer')->justReturn(true);
+        // The failure branch, so the render returns instead of redirecting and
+        // exiting the test process.
+        Functions\when('is_wp_error')->justReturn(true);
+
+        Functions\expect('wp_signon')->once()->with(\Mockery::type('array'))->andReturn(null);
+
+        $html = $this->page->render([]);
+
+        self::assertStringContainsString('Invalid username or password.', $html);
+    }
 }
@@ -115,4 +115,62 @@ class RegistrationLoginGateTest extends TestCase

        self::assertSame($allcaps, $result);
    }
+
+    /**
+     * Describe a user to the `user_register` guard: which role they hold, and
+     * whether whoever created them is studio staff.
+     */
+    private function stubSignup(string $role, bool $byStaff): void
+    {
+        $user        = Mockery::mock(\WP_User::class);
+        $user->roles = [$role];
+
+        Functions\when('get_userdata')->justReturn($user);
+        Functions\when('current_user_can')->justReturn($byStaff);
+    }
+
+    public function testStudentCreatedByAnUnknownSignupFormIsHeldForApproval(): void
+    {
+        // Open registration switches the site's own users_can_register on and
+        // makes Student the default role, so any other signup form on the site
+        // now mints students. They must not arrive able to book.
+        $this->stubSignup(RoleManager::STUDENT, byStaff: false);
+
+        Functions\expect('update_user_meta')->once()
+            ->with(7, RegistrationStatus::META_AWAITING_APPROVAL, '1');
+        // Counted as confirmed: nobody asked them to confirm, and there is no
+        // token for them to answer with, so blocking the login would strand them.
+        Functions\expect('update_user_meta')->once()
+            ->with(7, RegistrationStatus::META_EMAIL_CONFIRMED, '1');
+
+        (new RegistrationLoginGate())->holdUnknownSignup(7);
+    }
+
+    public function testStudentCreatedByStaffIsLeftActive(): void
+    {
+        // An administrator adding a student from wp-admin could have approved
+        // them in the next click; making them do so is ceremony.
+        $this->stubSignup(RoleManager::STUDENT, byStaff: true);
+
+        Functions\expect('update_user_meta')->never();
+
+        (new RegistrationLoginGate())->holdUnknownSignup(7);
+    }
+
+    public function testNonStudentSignupIsNotHeld(): void
+    {
+        $this->stubSignup(RoleManager::INSTRUCTOR, byStaff: false);
+
+        Functions\expect('update_user_meta')->never();
+
+        (new RegistrationLoginGate())->holdUnknownSignup(7);
+    }
+
+    public function testUnknownUserIdIsIgnored(): void
+    {
+        Functions\when('get_userdata')->justReturn(false);
+        Functions\expect('update_user_meta')->never();
+
+        (new RegistrationLoginGate())->holdUnknownSignup(0);
+    }
 }
@@ -9,6 +9,7 @@ use Unsupervised\Schedular\Auth\Invite;
 use Unsupervised\Schedular\Auth\InviteRepository;
 use Unsupervised\Schedular\Auth\RegistrationMailer;
 use Unsupervised\Schedular\Auth\RegistrationPage;
+use Unsupervised\Schedular\Auth\RegistrationStatus;
 use Unsupervised\Schedular\GroupClass\GroupAccessRepository;
 use Unsupervised\Schedular\Guardian\GuardianService;
 use Unsupervised\Schedular\Payment\StudioSettings;
@@ -29,6 +30,9 @@ class RegistrationPageTest extends TestCase
    /** @var array<string, mixed> */
    private array $ctx;

+    /** @var list<string> User meta keys cleared during the submit under test. */
+    private array $clearedMeta = [];
+
    protected function setUp(): void
    {
        parent::setUp();
@@ -52,6 +56,20 @@ class RegistrationPageTest extends TestCase
        Functions\when('wp_enqueue_script')->justReturn(null);
        Functions\when('wp_localize_script')->justReturn(true);

+        // Both success branches clear pending meta on the account they just
+        // created — the invited student is approved outright, the self-signup is
+        // marked unconfirmed. Recorded rather than counted so a test can say
+        // which, without every other test having to expect the calls.
+        $this->clearedMeta = [];
+        $cleared           = &$this->clearedMeta;
+        Functions\when('delete_user_meta')->alias(
+            static function (int $userId, string $key) use (&$cleared): bool {
+                $cleared[] = $key;
+
+                return true;
+            }
+        );
+
        $invites   = Mockery::mock(InviteRepository::class);
        $policies  = Mockery::mock(PolicyRepository::class);
        $questions = Mockery::mock(QuestionRepository::class);
@@ -149,6 +167,24 @@ class RegistrationPageTest extends TestCase
        self::assertSame('invite', $this->submit($invite, false));
    }

+    /**
+     * The registration gate holds every student account created by an
+     * unauthenticated request, which is what a signup is — so the invite branch
+     * has to say that this one is different. Without it an invited student is
+     * logged straight in and then told they cannot book.
+     */
+    public function testInvitedStudentIsApprovedRatherThanLeftAwaitingApproval(): void
+    {
+        $_POST = [ 'password' => 'thistle-marrow-42', 'display_name' => 'Ada', 'birth_year' => '1990' ];
+
+        $this->stubInviteSuccess();
+
+        $invite = new Invite(email: '[email protected]', token: 'hash');
+
+        self::assertSame('invite', $this->submit($invite, false));
+        self::assertContains(RegistrationStatus::META_AWAITING_APPROVAL, $this->clearedMeta);
+    }
+
    public function testInviteAcceptanceLinksClassGrantForTheEmail(): void
    {
        $_POST = [ 'password' => 'thistle-marrow-42', 'display_name' => 'Ada', 'birth_year' => '1990' ];
@@ -22,6 +22,12 @@ class RegistrationStatusTest extends TestCase
        Functions\expect('update_user_meta')
            ->once()
            ->with(7, RegistrationStatus::META_CONFIRM_EXPIRES, \Mockery::type('string'));
+        // Explicitly unconfirmed: the account may already have been held (and so
+        // counted as confirmed) by the user_register guard, and this signup did
+        // ask for a confirmation, so it has to be waited for.
+        Functions\expect('delete_user_meta')
+            ->once()
+            ->with(7, RegistrationStatus::META_EMAIL_CONFIRMED);

        self::assertSame('rawtoken', RegistrationStatus::markPending(7));
    }
@@ -63,10 +69,34 @@ class RegistrationStatusTest extends TestCase
        Functions\expect('update_user_meta')
            ->once()
            ->with(7, RegistrationStatus::META_AUTO_APPROVE, '1');
+        Functions\expect('delete_user_meta')
+            ->once()
+            ->with(7, RegistrationStatus::META_EMAIL_CONFIRMED);

        self::assertSame('rawtoken', RegistrationStatus::markPending(7, true));
    }

+    /**
+     * The hold put on a student account that turned up without going through the
+     * studio's signup form. Awaiting approval — so the booking capability is
+     * withheld — but counted as email-confirmed, because no confirmation was ever
+     * asked for and there is no token to answer with: blocking the login instead
+     * would strand the account with no way forward.
+     */
+    public function testHoldMarksAwaitingApprovalWithoutDemandingAConfirmationThatWasNeverSent(): void
+    {
+        Functions\expect('update_user_meta')
+            ->once()
+            ->with(7, RegistrationStatus::META_AWAITING_APPROVAL, '1');
+        Functions\expect('update_user_meta')
+            ->once()
+            ->with(7, RegistrationStatus::META_EMAIL_CONFIRMED, '1');
+        // No token is issued, so nothing is generated and nothing can be spent.
+        Functions\expect('wp_generate_password')->never();
+
+        RegistrationStatus::hold(7);
+    }
+
    public function testIsAutoApproveReadsMeta(): void
    {
        Functions\when('get_user_meta')->alias(static function (int $id, string $key) {
@@ -568,9 +568,11 @@ class BookingEndpointTest extends TestCase
        self::assertSame(Lesson::STATUS_CANCELLED, $result->get_data()['status']);
    }

-    public function testCancelByAnotherStudentIsForbidden(): void
+    public function testCancelByAnotherStudentAnswersExactlyLikeAnUnknownLesson(): void
    {
-        // Lesson belongs to student 9; current user is 5.
+        // Lesson belongs to student 9; current user is 5. The refusal must be
+        // indistinguishable from testCancelUnknownLessonReturns404 below, or the
+        // pair of answers tells a student which lesson ids exist.
        $lesson = new Lesson(slotId: 10, studentId: 9, instructorId: 3, status: Lesson::STATUS_PENDING, id: 77);
        $this->bookings->shouldReceive('findById')->with(77)->andReturn($lesson);
        $this->bookings->shouldNotReceive('updateStatus');
@@ -579,7 +581,8 @@ class BookingEndpointTest extends TestCase
        $result = $this->endpoint->cancel(new \WP_REST_Request(['id' => 77]));

        self::assertInstanceOf(\WP_Error::class, $result);
-        self::assertSame('forbidden', $result->get_error_code());
+        self::assertSame('not_found', $result->get_error_code());
+        self::assertSame(404, $result->error_data['not_found']['status']);
    }

    public function testCancelUnknownLessonReturns404(): void
@@ -590,6 +593,7 @@ class BookingEndpointTest extends TestCase

        self::assertInstanceOf(\WP_Error::class, $result);
        self::assertSame('not_found', $result->get_error_code());
+        self::assertSame(404, $result->error_data['not_found']['status']);
    }

    public function testCancelAlreadyCancelledLessonIsIdempotent(): void
@@ -224,17 +224,19 @@ class EnrollmentEndpointTest extends TestCase
        self::assertSame(403, $result->error_data['withdrawal_closed']['status']);
    }

-    public function testWithdrawRejectsAnotherStudentsEnrolment(): void
+    public function testWithdrawAnswersAnotherStudentsEnrolmentExactlyLikeAnUnknownOne(): void
    {
-        // Enrolment belongs to student 9, but the caller is student 5.
+        // Enrolment belongs to student 9, but the caller is student 5. The refusal
+        // must match testWithdrawReturnsNotFoundForUnknownEnrolment below exactly,
+        // or the two answers together enumerate the studio's enrolments.
        $this->enrollments->shouldReceive('findById')->with(3)->andReturn(new Enrollment(8, 9, 3, Enrollment::STATUS_ACTIVE, 41, 3));
        $this->enrollments->shouldReceive('updateStatus')->never();

        $result = $this->endpoint->withdraw(new \WP_REST_Request(['id' => 3]));

        self::assertInstanceOf(\WP_Error::class, $result);
-        self::assertSame('forbidden', $result->get_error_code());
-        self::assertSame(403, $result->error_data['forbidden']['status']);
+        self::assertSame('not_found', $result->get_error_code());
+        self::assertSame(404, $result->error_data['not_found']['status']);
    }

    public function testWithdrawReturnsNotFoundForUnknownEnrolment(): void
@@ -5,6 +5,7 @@ namespace Unsupervised\Schedular\Tests\Unit\Guardian;

 use Brain\Monkey\Functions;
 use Mockery;
+use Unsupervised\Schedular\Auth\RegistrationStatus;
 use Unsupervised\Schedular\Booking\BookingRepository;
 use Unsupervised\Schedular\GroupClass\EnrollmentRepository;
 use Unsupervised\Schedular\Guardian\GuardianLink;
@@ -96,6 +97,33 @@ class GuardianServiceTest extends TestCase
        self::assertSame('2015', $this->meta[42][GuardianService::META_BIRTH_YEAR]);
    }

+    /**
+     * A child is a student account created by someone who is not staff, so the
+     * registration gate holds it on `user_register` exactly as it holds an
+     * anonymous signup. There is nothing here to approve — the account is never
+     * signed in to, and the guardian in front of us is the approval — so the
+     * hold has to come off, or every child a family adds lands in the studio's
+     * review queue.
+     */
+    public function testCreateChildClearsTheHoldTheRegistrationGatePutsOnIt(): void
+    {
+        // Standing in for the user_register hook, which has already run by the
+        // time wp_insert_user() returns.
+        $meta = &$this->meta;
+        Functions\when('wp_insert_user')->alias(
+            static function (array $args) use (&$meta): int {
+                $meta[42][RegistrationStatus::META_AWAITING_APPROVAL] = '1';
+
+                return 42;
+            }
+        );
+
+        $this->guardians->shouldReceive('insert')->once()->andReturn(7);
+
+        self::assertSame(42, $this->service->createChild(5, 'Ada', '2015'));
+        self::assertArrayNotHasKey(RegistrationStatus::META_AWAITING_APPROVAL, $this->meta[42]);
+    }
+
    public function testCreateChildRejectsABlankName(): void
    {
        Functions\expect('wp_insert_user')->never();
@@ -0,0 +1,243 @@
+<?php
+declare(strict_types=1);
+
+namespace Unsupervised\Schedular\Tests\Unit;
+
+use Brain\Monkey\Functions;
+use Mockery;
+use Unsupervised\Schedular\Auth\RoleManager;
+use Unsupervised\Schedular\Payment\ScheduledBillingRunner;
+use Unsupervised\Schedular\Payment\StudioSettings;
+use Unsupervised\Schedular\Schema;
+use Unsupervised\Schedular\Uninstaller;
+
+class UninstallerTest extends TestCase
+{
+    /** @var array<string, mixed> Option store the stubs read and write. */
+    private array $options = [];
+
+    /** @var list<string> Options deleted during the run. */
+    private array $deleted = [];
+
+    /** @var list<string> SQL statements sent to the database. */
+    private array $queries = [];
+
+    /** @var list<string> User meta keys deleted for every user. */
+    private array $metaDeleted = [];
+
+    /** @var list<string> Roles removed. */
+    private array $rolesRemoved = [];
+
+    /** @var list<string> Cron hooks cleared. */
+    private array $hooksCleared = [];
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        $options      = &$this->options;
+        $deleted      = &$this->deleted;
+        $metaDeleted  = &$this->metaDeleted;
+        $rolesRemoved = &$this->rolesRemoved;
+        $hooksCleared = &$this->hooksCleared;
+
+        // A regular closure, not an arrow fn: arrow functions capture by value,
+        // so every read would answer from a snapshot of the options taken at
+        // setUp — before the test set any, and before the run wrote any.
+        Functions\when('get_option')->alias(
+            static function (string $key, mixed $default = false) use (&$options): mixed {
+                return $options[$key] ?? $default;
+            }
+        );
+        Functions\when('update_option')->alias(
+            static function (string $key, mixed $value) use (&$options): bool {
+                $options[$key] = $value;
+
+                return true;
+            }
+        );
+        Functions\when('delete_option')->alias(
+            static function (string $key) use (&$options, &$deleted): bool {
+                unset($options[$key]);
+                $deleted[] = $key;
+
+                return true;
+            }
+        );
+        Functions\when('delete_transient')->justReturn(true);
+        Functions\when('wp_clear_scheduled_hook')->alias(
+            static function (string $hook) use (&$hooksCleared): int {
+                $hooksCleared[] = $hook;
+
+                return 0;
+            }
+        );
+        Functions\when('delete_metadata')->alias(
+            static function (string $type, int $id, string $key) use (&$metaDeleted): bool {
+                $metaDeleted[] = $key;
+
+                return true;
+            }
+        );
+        Functions\when('remove_role')->alias(
+            static function (string $role) use (&$rolesRemoved): void {
+                $rolesRemoved[] = $role;
+            }
+        );
+
+        $db         = Mockery::mock(\wpdb::class);
+        $db->prefix = 'wp_';
+        $queries    = &$this->queries;
+        $db->shouldReceive('prepare')->andReturnUsing(
+            static fn(string $sql, mixed ...$args): string => str_replace('%i', (string) $args[0], $sql)
+        );
+        $db->shouldReceive('query')->andReturnUsing(
+            static function (string $sql) use (&$queries): int {
+                $queries[] = $sql;
+
+                return 1;
+            }
+        );
+
+        $GLOBALS['wpdb'] = $db;
+    }
+
+    protected function tearDown(): void
+    {
+        unset($GLOBALS['wpdb']);
+        parent::tearDown();
+    }
+
+    /**
+     * A Stripe secret is a credential, not a record. It can be pasted back in
+     * from the Stripe dashboard in a minute, and a site that no longer has the
+     * code to use it has no business still holding it — so it goes whether or
+     * not the studio asked to keep its data.
+     */
+    public function testStripeCredentialsAreForgottenEvenWhenTheDataIsKept(): void
+    {
+        $this->options = [
+            StudioSettings::OPT_SECRET         => 'sk_live_secret',
+            StudioSettings::OPT_WEBHOOK_SECRET => 'whsec_secret',
+            StudioSettings::OPT_PUBLISHABLE    => 'pk_live_key',
+            StudioSettings::OPT_MODE           => 'live',
+            StudioSettings::OPT_HST_RATE       => '13',
+        ];
+
+        (new Uninstaller())->run();
+
+        self::assertArrayNotHasKey(StudioSettings::OPT_SECRET, $this->options);
+        self::assertArrayNotHasKey(StudioSettings::OPT_WEBHOOK_SECRET, $this->options);
+        self::assertArrayNotHasKey(StudioSettings::OPT_PUBLISHABLE, $this->options);
+        self::assertArrayNotHasKey(StudioSettings::OPT_MODE, $this->options);
+
+        // The studio's own settings are records, and stay.
+        self::assertSame('13', $this->options[StudioSettings::OPT_HST_RATE]);
+    }
+
+    public function testKeepingDataDropsNoTablesAndRemovesNoRoles(): void
+    {
+        $this->options = [Uninstaller::OPT_DELETE_DATA => '0'];
+
+        (new Uninstaller())->run();
+
+        self::assertSame([], $this->queries);
+        self::assertSame([], $this->metaDeleted);
+        // A site keeping its data keeps the roles its students hold, or every one
+        // of them is left with no capabilities until the plugin is reinstalled.
+        self::assertSame([], $this->rolesRemoved);
+    }
+
+    public function testFullPurgeDropsEveryTableTheSchemaDeclares(): void
+    {
+        $this->options = [Uninstaller::OPT_DELETE_DATA => '1'];
+
+        (new Uninstaller())->run();
+
+        self::assertCount(count(Schema::TABLES), $this->queries);
+        foreach (Schema::TABLES as $table) {
+            self::assertContains('DROP TABLE IF EXISTS wp_' . $table, $this->queries);
+        }
+    }
+
+    public function testFullPurgeClearsSettingsUserMetaAndRoles(): void
+    {
+        $this->options = [
+            Uninstaller::OPT_DELETE_DATA   => '1',
+            'us_schedular_version'         => '1.5.6',
+            StudioSettings::OPT_HST_RATE   => '13',
+            StudioSettings::OPT_CURRENCY   => 'CAD',
+        ];
+
+        (new Uninstaller())->run();
+
+        self::assertContains('us_schedular_version', $this->deleted);
+        self::assertContains(StudioSettings::OPT_HST_RATE, $this->deleted);
+        self::assertContains(Uninstaller::OPT_DELETE_DATA, $this->deleted);
+
+        // Nothing student-shaped is left hanging off a user account.
+        self::assertContains('us_payment_method', $this->metaDeleted);
+        self::assertContains('us_child', $this->metaDeleted);
+        self::assertContains('us_awaiting_approval', $this->metaDeleted);
+
+        self::assertSame(
+            [RoleManager::STUDIO_ADMIN, RoleManager::INSTRUCTOR, RoleManager::STUDENT],
+            $this->rolesRemoved
+        );
+    }
+
+    /**
+     * Open registration switches the site's own `users_can_register` on and makes
+     * Student the default role. Leaving those behind would leave the site taking
+     * public signups into a role that is, one line later, about to stop existing.
+     */
+    public function testCoreRegistrationSettingsAreRestoredFromTheSnapshot(): void
+    {
+        $this->options = [
+            'users_can_register'                        => '1',
+            'default_role'                              => RoleManager::STUDENT,
+            StudioSettings::OPT_PREV_USERS_CAN_REGISTER => '0',
+            StudioSettings::OPT_PREV_DEFAULT_ROLE       => 'subscriber',
+        ];
+
+        (new Uninstaller())->run();
+
+        self::assertSame('0', $this->options['users_can_register']);
+        self::assertSame('subscriber', $this->options['default_role']);
+        // The snapshot is spent.
+        self::assertArrayNotHasKey(StudioSettings::OPT_PREV_USERS_CAN_REGISTER, $this->options);
+        self::assertArrayNotHasKey(StudioSettings::OPT_PREV_DEFAULT_ROLE, $this->options);
+    }
+
+    public function testSiteThatNeverOpenedRegistrationKeepsItsOwnSettings(): void
+    {
+        $this->options = ['users_can_register' => '1', 'default_role' => 'contributor'];
+
+        (new Uninstaller())->run();
+
+        // No snapshot means the plugin never touched these, so nor does this.
+        self::assertSame('1', $this->options['users_can_register']);
+        self::assertSame('contributor', $this->options['default_role']);
+    }
+
+    public function testTheScheduledBillingEventIsAlwaysCleared(): void
+    {
+        // Deactivation clears it too, and always precedes a delete — but a site
+        // whose plugin files simply vanished never ran that hook, and a schedule
+        // pointing at code that is gone is left firing into nothing.
+        (new Uninstaller())->run();
+
+        self::assertSame([ScheduledBillingRunner::HOOK], $this->hooksCleared);
+    }
+
+    public function testSettingIsOffUntilItIsExplicitlyTurnedOn(): void
+    {
+        self::assertFalse(Uninstaller::deletesDataOnUninstall());
+
+        Uninstaller::setDeletesDataOnUninstall(true);
+        self::assertTrue(Uninstaller::deletesDataOnUninstall());
+
+        Uninstaller::setDeletesDataOnUninstall(false);
+        self::assertFalse(Uninstaller::deletesDataOnUninstall());
+    }
+}
@@ -13,6 +13,17 @@ class UpdateCheckerTest extends TestCase
    private const PLUGIN_FILE = 'unsupervised-schedular/unsupervised-schedular.php';
    private const PACKAGE_URL = 'https://git.unsupervised.ca/attachments/abc123';

+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        // The package URL is checked against the release host before it is
+        // offered to core, so every path through provideUpdate() reaches this.
+        Functions\when('wp_parse_url')->alias(
+            static fn(string $url, int $component = -1): mixed => parse_url($url, $component)
+        );
+    }
+
    /** Stub a successful Gitea API response with the given decoded body. */
    private function stubApiResponse(int $code, mixed $body): void
    {
@@ -217,6 +228,63 @@ class UpdateCheckerTest extends TestCase
        self::assertSame($this->noUpdatePayload(), $result);
    }

+    /**
+     * A package URL is code core will download and unpack over the installed
+     * plugin, so an answer naming somewhere other than the release host is not
+     * an update — whoever gave it, and however plausible the version.
+     *
+     * @dataProvider untrustedPackageUrls
+     */
+    public function testPackageHostedAnywhereButTheReleaseHostIsRefused(string $url): void
+    {
+        Functions\when('plugin_basename')->justReturn(self::PLUGIN_FILE);
+        Functions\when('get_transient')->justReturn(false);
+        Functions\when('set_transient')->justReturn(true);
+        $this->stubApiResponse(200, $this->release('v9.9.9', [
+            ['name' => 'unsupervised-schedular-9.9.9.zip', 'browser_download_url' => $url],
+        ]));
+
+        $result = (new UpdateChecker())->provideUpdate(false, [], self::PLUGIN_FILE);
+
+        // Refused exactly as a release with no zip at all: nothing to install,
+        // and the plugin stays in `no_update` so the toggle does not vanish.
+        self::assertSame($this->noUpdatePayload(), $result);
+    }
+
+    /** @return array<string, array{string}> */
+    public static function untrustedPackageUrls(): array
+    {
+        return [
+            'unrelated host'      => ['https://evil.test/unsupervised-schedular-9.9.9.zip'],
+            // Would pass a naive "contains" or "ends with" check.
+            'lookalike prefix'    => ['https://evil-git.unsupervised.ca/plugin.zip'],
+            'lookalike suffix'    => ['https://git.unsupervised.ca.evil.test/plugin.zip'],
+            'subdomain'           => ['https://cdn.git.unsupervised.ca/plugin.zip'],
+            'credentials in host' => ['https://[email protected]/plugin.zip'],
+            'plain http'          => ['http://git.unsupervised.ca/attachments/abc123'],
+            'no scheme'           => ['git.unsupervised.ca/attachments/abc123'],
+            'empty'               => [''],
+        ];
+    }
+
+    public function testAZipFromTheReleaseHostIsStillOfferedAfterAnUntrustedOne(): void
+    {
+        Functions\when('plugin_basename')->justReturn(self::PLUGIN_FILE);
+        Functions\when('get_transient')->justReturn(false);
+        Functions\when('set_transient')->justReturn(true);
+        $this->stubApiResponse(200, $this->release('v9.9.9', [
+            ['name' => 'decoy.zip', 'browser_download_url' => 'https://evil.test/decoy.zip'],
+            $this->zipAsset(),
+        ]));
+
+        $result = (new UpdateChecker())->provideUpdate(false, [], self::PLUGIN_FILE);
+
+        // The scan does not stop at the first zip it sees — it stops at the
+        // first one it would actually install.
+        self::assertIsArray($result);
+        self::assertSame(self::PACKAGE_URL, $result['package']);
+    }
+
    public function testMalformedApiBodyOffersNoUpdatePayload(): void
    {
        Functions\when('plugin_basename')->justReturn(self::PLUGIN_FILE);
@@ -1,19 +1,14 @@
 <?php
 declare(strict_types=1);

+use Unsupervised\Schedular\Uninstaller;
+
 if (! defined('WP_UNINSTALL_PLUGIN')) {
    exit;
 }

 require_once plugin_dir_path(__FILE__) . 'vendor/autoload.php';

-global $wpdb;
-
-$wpdb->query("DROP TABLE IF EXISTS {$wpdb->prefix}us_lessons");
-$wpdb->query("DROP TABLE IF EXISTS {$wpdb->prefix}us_availability");
-
-remove_role('us_instructor');
-remove_role('us_student');
-
-delete_option('us_schedular_version');
-delete_transient('us_schedular_latest_release');
+// What this does and does not take with it is decided on Access → Plugin
+// removal, and explained in full in Uninstaller.
+(new Uninstaller())->run();