Compare commits
1
Commits
v1.4.1
..
5140e76347
| Author | SHA1 | Date | |
|---|---|---|---|
  thatguygriffandClaude Opus 4.8
|
5140e76347
|
@@ -5,8 +5,7 @@
|
||||
"Bash(composer lint *)",
|
||||
"Bash(tea actions:*)",
|
||||
"Bash(tea issue *)",
|
||||
"Bash(tea label *)",
|
||||
"Bash(composer cs *)"
|
||||
"Bash(tea label *)"
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
@@ -97,8 +97,7 @@ jobs:
|
||||
- uses: actions/checkout@v4
|
||||
- name: Check for debug statements
|
||||
run: |
|
||||
# \b keeps method calls like DateTimeImmutable::add() from matching dd(.
|
||||
if grep -rn --include="*.php" -E "\b(var_dump|var_export|print_r|error_log|dd|dump)\s*\(" src/; then
|
||||
if grep -rn --include="*.php" -E "(var_dump|var_export|print_r|error_log|dd\(|dump\()" src/; then
|
||||
echo "Debug code found in src/ — please remove before merging."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
@@ -1,165 +0,0 @@
|
||||
name: Release
|
||||
|
||||
# Fires when a v* tag is pushed — including tags created through Gitea's
|
||||
# "New Release" UI. Builds the distributable plugin zip and attaches it to
|
||||
# the release for that tag (creating the release if only a bare tag was
|
||||
# pushed). The attached zip is what UpdateChecker serves to WordPress
|
||||
# sites as the update package.
|
||||
|
||||
on:
|
||||
push:
|
||||
tags:
|
||||
- 'v*'
|
||||
|
||||
jobs:
|
||||
release:
|
||||
name: Build and Publish Release
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Setup PHP
|
||||
uses: shivammathur/setup-php@v2
|
||||
with:
|
||||
php-version: '8.3'
|
||||
tools: composer:v2
|
||||
|
||||
# A tag that disagrees with the plugin header would make sites see a
|
||||
# phantom update forever (or never see a real one), so fail fast.
|
||||
- name: Verify tag matches plugin version
|
||||
id: meta
|
||||
run: |
|
||||
tag_version="${GITHUB_REF_NAME#v}"
|
||||
header_version="$(sed -nE 's/^[[:space:]]*\*?[[:space:]]*Version:[[:space:]]*([^[:space:]]+).*/\1/p' unsupervised-schedular.php | head -1)"
|
||||
if [ "$tag_version" != "$header_version" ]; then
|
||||
echo "Tag ${GITHUB_REF_NAME} does not match plugin header Version: ${header_version}" >&2
|
||||
exit 1
|
||||
fi
|
||||
echo "version=${header_version}" >> "$GITHUB_OUTPUT"
|
||||
|
||||
- name: Install dependencies
|
||||
run: composer install --prefer-dist --no-progress --no-interaction
|
||||
|
||||
- name: Run tests
|
||||
run: composer test
|
||||
|
||||
- name: Build plugin zip
|
||||
run: composer build
|
||||
|
||||
# Pull the section for this version out of CHANGELOG.md so it can become
|
||||
# the release body. Matches "## [x.y.z]" and prints every line up to the
|
||||
# next "## " heading. A missing section is a warning, not a failure — the
|
||||
# release still publishes with empty notes.
|
||||
- name: Extract changelog notes
|
||||
run: |
|
||||
version="${{ steps.meta.outputs.version }}"
|
||||
awk -v ver="$version" '
|
||||
$0 ~ "^## \\[" ver "\\]" { found = 1; next }
|
||||
found && /^## / { exit }
|
||||
found { print }
|
||||
' CHANGELOG.md | sed -e '/./,$!d' | tac | sed -e '/./,$!d' | tac > release-notes.md
|
||||
if [ ! -s release-notes.md ]; then
|
||||
echo "::warning::No CHANGELOG.md section found for version ${version}"
|
||||
fi
|
||||
|
||||
- name: Publish release with zip asset
|
||||
env:
|
||||
TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
run: |
|
||||
api="${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}"
|
||||
version="${{ steps.meta.outputs.version }}"
|
||||
zip="dist/unsupervised-schedular-${version}.zip"
|
||||
|
||||
# Pre-release versions (1.2.3-rc.1) are flagged so Gitea's
|
||||
# /releases/latest endpoint — and therefore the update checker —
|
||||
# skips them.
|
||||
prerelease=false
|
||||
case "$version" in *-*) prerelease=true ;; esac
|
||||
|
||||
# Reuse the release if the tag was created via Gitea's release UI.
|
||||
release_id="$(curl -sS -H "Authorization: token ${TOKEN}" \
|
||||
"${api}/releases/tags/${GITHUB_REF_NAME}" | jq -r '.id // empty' || true)"
|
||||
|
||||
if [ -z "$release_id" ]; then
|
||||
body="$(jq -Rs --arg tag "${GITHUB_REF_NAME}" --argjson pre "${prerelease}" \
|
||||
'{tag_name:$tag, name:$tag, prerelease:$pre, body:.}' release-notes.md)"
|
||||
release_id="$(curl -fsS -X POST "${api}/releases" \
|
||||
-H "Authorization: token ${TOKEN}" \
|
||||
-H 'Content-Type: application/json' \
|
||||
-d "${body}" | jq -r '.id')"
|
||||
else
|
||||
# Release pre-created via the UI: fill in the notes from the changelog.
|
||||
body="$(jq -Rs '{body:.}' release-notes.md)"
|
||||
curl -fsS -X PATCH "${api}/releases/${release_id}" \
|
||||
-H "Authorization: token ${TOKEN}" \
|
||||
-H 'Content-Type: application/json' \
|
||||
-d "${body}" > /dev/null
|
||||
fi
|
||||
|
||||
echo "Attaching ${zip} to release ${release_id}"
|
||||
curl -fsS -X POST \
|
||||
"${api}/releases/${release_id}/assets?name=unsupervised-schedular-${version}.zip" \
|
||||
-H "Authorization: token ${TOKEN}" \
|
||||
-F "attachment=@${zip}" > /dev/null
|
||||
|
||||
# After a stable release, move main forward: bump the plugin to the next patch
|
||||
# version and open a fresh changelog section for it, via a PR. Skipped for
|
||||
# pre-releases (tags containing a hyphen, e.g. v1.2.0-rc.1) — those don't
|
||||
# advance the mainline version.
|
||||
bump-version:
|
||||
name: Open next-version bump PR
|
||||
needs: release
|
||||
if: ${{ !contains(github.ref_name, '-') }}
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
ref: main
|
||||
fetch-depth: 0
|
||||
token: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Compute next patch version
|
||||
id: next
|
||||
run: |
|
||||
current="$(sed -nE 's/^[[:space:]]*\*?[[:space:]]*Version:[[:space:]]*([^[:space:]]+).*/\1/p' unsupervised-schedular.php | head -1)"
|
||||
base="${current%%-*}" # drop any pre-release suffix
|
||||
major="${base%%.*}"
|
||||
rest="${base#*.}"
|
||||
minor="${rest%%.*}"
|
||||
patch="${rest#*.}"
|
||||
next="${major}.${minor}.$((patch + 1))"
|
||||
echo "next=${next}" >> "$GITHUB_OUTPUT"
|
||||
|
||||
- name: Apply version bump and open changelog section
|
||||
run: |
|
||||
next="${{ steps.next.outputs.next }}"
|
||||
# Plugin header + USC_VERSION constant must stay in lockstep.
|
||||
sed -i -E "s/^([[:space:]]*\*?[[:space:]]*Version:[[:space:]]*).*/\1${next}/" unsupervised-schedular.php
|
||||
sed -i -E "s/(define\('USC_VERSION', ')[^']+('\);)/\1${next}\2/" unsupervised-schedular.php
|
||||
# Insert an empty section for the new version above the current top one
|
||||
# (the first "## [" heading in the file).
|
||||
awk -v ver="$next" '
|
||||
!done && /^## \[/ { print "## [" ver "]"; print ""; done = 1 }
|
||||
{ print }
|
||||
' CHANGELOG.md > CHANGELOG.md.tmp && mv CHANGELOG.md.tmp CHANGELOG.md
|
||||
|
||||
- name: Open pull request
|
||||
env:
|
||||
TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
run: |
|
||||
next="${{ steps.next.outputs.next }}"
|
||||
branch="release/bump-${next}"
|
||||
api="${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}"
|
||||
|
||||
git config user.name 'Release Bot'
|
||||
git config user.email '[email protected]'
|
||||
git checkout -b "${branch}"
|
||||
git commit -am "Bump version to ${next} and open changelog section"
|
||||
git push origin "${branch}"
|
||||
|
||||
curl -fsS -X POST "${api}/pulls" \
|
||||
-H "Authorization: token ${TOKEN}" \
|
||||
-H 'Content-Type: application/json' \
|
||||
-d "$(jq -n --arg head "${branch}" --arg title "Bump version to ${next}" \
|
||||
'{head:$head, base:"main", title:$title, body:"Automated post-release bump to the next patch version. Record changes for this version under its changelog heading."}')" \
|
||||
> /dev/null
|
||||
-143
@@ -1,143 +0,0 @@
|
||||
# Changelog
|
||||
|
||||
All notable changes to Unsupervised Scheduler are documented in this file, one
|
||||
section per version, newest first. The top section is always the version the code
|
||||
on `main` currently carries (the `Version:` header in `unsupervised-schedular.php`).
|
||||
Whether a version is "released" is purely a matter of whether its tag exists — the
|
||||
changelog itself does not track that.
|
||||
|
||||
When a `v*` tag is pushed, `.gitea/workflows/release.yml` publishes the matching
|
||||
`## [x.y.z]` section verbatim as the Gitea release notes, then opens a PR that bumps
|
||||
the plugin to the next patch version and adds a fresh section here for it. Record
|
||||
each change under the current top section as you work.
|
||||
|
||||
## [1.4.1]
|
||||
|
||||
### Added
|
||||
- **Group classes now appear in "Your upcoming lessons".** A class is stored as a term rather than as bookable slots, so nothing that listed lessons could ever show one — a student whose whole term was a group class saw an empty schedule, and an instructor teaching one saw nothing on their My Lessons page. Each remaining session of a class you are enrolled in now sorts in among your lessons by date, labelled **group class**; instructors see every session of the classes they teach, one row per session however many students are in it. A session has no Cancel button, because there is no such thing as cancelling one date of a term — withdrawing from the class is still done from the class page.
|
||||
- A class you are enrolled in shows up **whether or not its schedule is pinned to a clock**. Class time and duration are both optional on the offering form, and the schedule note is there so a studio can simply write "Tuesdays 4:00pm" — so a class with a time but no duration lists its dates and says when each session starts rather than guessing when it ends, and a class with no time at all gets a single row carrying its schedule note (or its term dates) where the time would go. Only a class whose last day has passed drops off the list.
|
||||
- A student's admin detail page now shows **Booked by** in the Account section — the name of the parent or guardian who books and pays for them, linked to their own page. It was only stated further down under Profile, and only when there was one; the row is now always there, saying in words when a student books for themselves.
|
||||
- The same group-class sessions now appear in **Upcoming lessons** on a student's admin detail page, so one table answers "what are they booked into next week?". Only upcoming ones — the **Group-class enrolments** table below already holds the history.
|
||||
- **A policy can be renamed.** The title was fixed at creation, so a typo or a change of wording meant creating a second policy and re-collecting everyone's acceptance. Renaming changes only what students read above the policy text: the slug stays put, so every version already accepted stays attached.
|
||||
|
||||
### Fixed
|
||||
- **People are named by their name again, not their email address.** Anywhere the plugin named a person it could show their email instead — "Managed by grace@example.com" in the students table, the same under **Booked by**, and instructor names on the class pages. WordPress starts a new account's nickname off as its username, and signup uses the email address as the username, so the address became the nickname of every self-registered account; the name they had typed was sitting in the account's display name the whole time. Names are now read from there when the nickname turns out to be an address, so existing accounts read correctly with nothing to fix by hand, and new signups store the name properly in the first place. Students added by a parent were never affected.
|
||||
- **Deleting a parent now removes the students they booked for.** A managed student account has no login of its own and exists only so its parent has somebody to book for — with the parent gone nobody can reach it, book for it, or be billed for it, so it was left stranded on the roster still holding lesson times. Deleting a parent now releases each of their students' upcoming lessons and enrolments on the same terms as their own, and deletes the accounts. Removing a student from the family screen is unchanged and still refuses one with lessons on record.
|
||||
- **The upcoming-lessons panel no longer collapses onto itself in some themes.** Rows could render on top of one another and the status badge's colour could stop short of the text inside it. Both came from the same thing: the panel never stated its own line spacing, so a theme setting a line height of zero anywhere above it — a common icon-font reset — was inherited straight through, leaving each line of text taller than the space allotted to it. The panel now sets its own.
|
||||
- **Deleting a student now gives back what they had booked.** WordPress deletes a user without knowing anything about lessons, so their bookings were left behind: the times stayed marked as booked and nobody else could take them, the lessons stayed on the instructor's schedule under a name that no longer resolved, and a group class kept a seat filled by nobody. Deleting an account now cancels each of its upcoming lessons, frees the time for rebooking, cancels its active class enrolments, and voids any payment still pending on them. Past lessons are left exactly as they are — they happened, and the payment report has to keep adding up. A paid lesson is not credited back: a credit could only be spent on the account being deleted, so a refund owed to someone who has left stays the studio's decision to make.
|
||||
- **A weak password is now caught before the form is submitted, not after.** The strength meter scores the password as you type, but zxcvbn's dictionary arrives a moment after the page loads — so a password typed straight away was never scored at all, and the first you heard of it was the server rejecting the whole form. The password is now re-scored on submit, so the verdict is always the one your password actually earns.
|
||||
|
||||
### Changed
|
||||
- **Signup is one page again.** The studio's registration questions used to be a second step behind a **Next** button; they are now asked on the main form, in an **About you** panel above the students you are adding. What the studio needs to know about you is part of registering, not a sequel to it — and there is now one submit rather than three.
|
||||
- **Signup asks an adult student for their birth year**, the same four-digit year already asked of every student being registered on someone else's behalf. It is asked only when you are a student yourself — choosing **on behalf of one or more students** leaves the whole **About you** panel out, since those questions describe a student and in that case you are not one.
|
||||
|
||||
## [1.4.0]
|
||||
|
||||
### Added
|
||||
- An **Account** block (`[us_account]`) showing who is signed in — their name and their email — and a **Sign out** link. Signing out returns to the login page chosen in the block, or to the page the visitor was already on when none is set, so putting it in a site header does not also move people somewhere. To a signed-out visitor it shows a **Sign in** link when a login page is chosen, and nothing at all when one is not: a panel about who is signed in has nothing to tell a stranger, and a notice they cannot act on is just clutter in a header.
|
||||
|
||||
### Security
|
||||
- Signup now checks the password properly. The form scores it as you type with the same zxcvbn meter wp-admin uses and will not submit a weak one, and the server refuses — regardless of what the browser allowed — anything shorter than 8 characters, one of the well-known leaked passwords, one built from barely any distinct characters, or one containing your own name or email address. Composition rules ("must contain a symbol") are deliberately not imposed: they mostly produce predictable substitutions. Email addresses are validated on the server on every signup path, with a clear message when one is already registered.
|
||||
|
||||
### Changed
|
||||
- Signup now asks **"Who are you registering?"** as a three-way choice — **just myself**, **on behalf of one or more students**, or **both** — in place of the single parent/guardian tick. The tick could only ever say "I have children to add"; it could not say whether the account holder was a student themselves, so every account was offered its own name in the **Who is this for?** picker whether or not anyone meant to book them a lesson. Choosing *on behalf of* now leaves the account holder out of that picker. Existing accounts are unaffected and stay bookable, since the flag records only the new "not a student" case.
|
||||
- The studio's **account-signup questions are now asked of anyone registering as a student**, including someone registering themselves alongside their children. Choosing **both** previously collected the questions per child only, so the account holder's own instrument, level and the rest were never asked for or stored, even though they could book lessons. Their answers are recorded against their own account, and a blank required answer now names them rather than blaming "each student".
|
||||
- A student's **name and birth year are now required**, marked in the form the same way a required registration question is and enforced on the server whichever way they were submitted. On signup the requirement applies only once the parent/guardian box is ticked, so registering for yourself is unaffected. A student block you have started filling in is now reported back to you rather than silently dropped when the name is missing — only a completely untouched spare block is still ignored.
|
||||
- Signup and the profile page now ask for a **birth year** rather than a full date of birth — a four-digit year between 1900 and the current year, with anything else discarded rather than stored. Students added before this change keep showing a birth year, derived from the date already on file; that old full date is then dropped the first time the record is saved, so the studio ends up holding only what it now asks for. No bulk purge runs, so a site wanting the remaining old dates gone should clear the `us_date_of_birth` user meta directly.
|
||||
- The interface now says **student** where it said "child" and **profile** where it said "family". The `[us_family]` page is headed **Your profile**, its form is **Add a student**, signup asks for a **Student's name**, and the wp-admin students list and student screen both label the relationship **Profile**. Two strings were reworded rather than swapped: the students list reads **Managed by _name_** (a bare "Student of _name_" would read as a teacher's pupil), and a managed account is described as a **managed student account** so it is not confused with the account holder. Internal names — database columns, request parameters, form field names, the `us_family` shortcode and the `us-scheduler/family` block — are unchanged, since they are contracts with existing installs and saved post content.
|
||||
|
||||
### Fixed
|
||||
- **Booking a lesson no longer dead-ends on the confirmation.** The confirmation used to replace the calendar entirely, leaving a student who wanted a second lesson with nothing to click and no way back short of reloading the page. It is now a dismissible notice sitting above a freshly loaded calendar — the slot just taken already gone from it, the upcoming-lessons panel already updated — so "it worked" and "book another" are the same screen. Enrolling in a group class did the same thing and is fixed the same way.
|
||||
- Upcoming lesson rows no longer render on top of each other. The row's text sits in inline elements that a theme can pull out of normal flow, which dropped the date and time onto the lesson title and the status pill onto the Cancel button; those elements are now pinned into flow alongside the rest of the panel's theme-proofing. The rows held behind **Show all** also stayed visible under the `div { display: block }` reset that many themes still carry, since `[hidden]` is only a browser default — they are now hidden for real.
|
||||
|
||||
## [1.3.0]
|
||||
|
||||
### Added
|
||||
- **Parent and guardian accounts.** A parent registers once and manages lessons for one or more children, who need no login of their own. The signup form gains an **"I'm registering as a parent or guardian"** tick that reveals a block per child — name, date of birth, and the studio's account-signup questions asked **per child**, since those describe the student rather than the account holder. Signup policies are recorded once per child with the guardian named as the person who agreed, which is the record that actually means something: "this guardian accepted version N on behalf of this child, at this time, from this address." A guardian can also be a student themselves and book their own lessons from the same account.
|
||||
- A **"Who is this for?"** picker on the booking and group-class forms, listing **children first** and the account holder last — so the default selection is never the parent, and a lesson meant for a child is not quietly booked and billed in the parent's name. An account with only itself on the list sees no picker and behaves exactly as before. A guardian's upcoming-lessons panel covers the whole household, each row naming whose lesson it is, and they can cancel or withdraw for any of their children.
|
||||
- A **Family** page for guardians (`[us_family]`, or the **Family** block) to add, edit and remove children after signup. Removing a child is refused once they have lessons or enrolments on record — that history belongs to them, and the studio unpicks it by hand rather than the page orphaning it.
|
||||
- **One family, one bill.** Payments record the child the lesson was for *and* the guardian who owes it, so per-child reporting is unchanged while notices, receipts and the payment step all go to the parent. Account credit is held by the payer, so a credit from one child's cancelled lesson can settle a sibling's next charge, and the billing-method override (comp / card / e-transfer) is one setting on the guardian rather than one per child. The daily billing scan sends a guardian **one** notice covering every child, with each line naming whose lesson it is.
|
||||
- **Students** in wp-admin gains a **Family** column linking a child to their guardian and a guardian to their children, and the student screen gains a **Family** panel. A child's row shows the guardian's email — a child's own address is a placeholder that can never receive mail — and their credit balance is labelled with whose account actually holds it.
|
||||
|
||||
### Changed
|
||||
- Child accounts **cannot be signed in to**. They hold the student role so every existing lookup keeps working, but authentication is refused outright and the booking capability is withheld, so the only route to a lesson in a child's name is their guardian's authorised booking.
|
||||
|
||||
## [1.2.4]
|
||||
|
||||
### Fixed
|
||||
- **Adding availability no longer fails in silence.** Entering a window shorter than the chosen lesson length — 5:30–6:00 PM with the lesson length left on its default of 60 minutes, say — saved nothing and said nothing: the page just reloaded, whether the window was one-off or set to repeat for 41 weeks. The **Lesson length** menu now offers only the lengths that actually fit the window you have entered, and the form refuses to submit when none of them do. Every other way the form could quietly do nothing now explains itself too — an unreadable date, an end time before the start, a window running past midnight into the next day — and a successful save says how many bookable slots it created. Deleting says whether the slot went, and tells you when one is refused because it is already booked. Availability added through the API is checked against exactly the same rules, which it previously enforced slightly differently.
|
||||
- A student's **upcoming lessons no longer pile on top of each other**. On the booking page, the lesson name, its date and time, the status badge and the **Cancel** button could render over one another instead of sitting in a tidy row — worst with a long lesson-type name, and on narrow screens, where the row had no phone layout at all. The panel now keeps its shape whatever the theme around it does, long names wrap instead of shoving the Cancel button out of the row, and on a phone the lesson details stack above the buttons.
|
||||
- The registration page **no longer dead-ends a visitor who is already signed in**. It used to greet them with "You already have an account and are logged in." and nothing else, leaving them to find their own way to the studio. They now get a link onward to the page chosen under the block's **After registration** panel, and the link names it — "Continue to Book a Lesson" rather than the vaguer wording an invited student used to see. With no page chosen, the message appears on its own as before, because sending someone who is already signed in to the sign-in screen helps nobody.
|
||||
|
||||
## [1.2.3]
|
||||
|
||||
### Changed
|
||||
- A **monthly group class is now billed its price once per month**, however many times the class meets in that month. Previously the monthly charge multiplied the price by the number of sessions in the month — a class priced at `40.00 CAD` meeting weekly was billed `160.00 CAD` on the 1st — which no studio could quote honestly on a class card. A monthly **private lesson** is unchanged: its price is a per-lesson fee and the month is still billed one fee per lesson, which is why it is quoted per lesson. Studios running a monthly group class should check the class price now reads as the monthly fee they intend to charge.
|
||||
|
||||
### Added
|
||||
- Every price a student sees now says **when** it is due. Lesson types in the booking form read `50.00 CAD at booking`, and group-class cards read `120.00 CAD up front`, `40.00 CAD weekly` or `40.00 CAD monthly` — the offering's billing mode, in the student's words. A monthly **private lesson** is quoted per lesson (`50.00 CAD per lesson monthly`), since its monthly charge covers every lesson booked that month; a monthly group class is quoted as the monthly figure it is. A free offering still just reads **Free**.
|
||||
- The **Policies** admin page can now **show you what is actually in a version**. Every row in the versions table has a **View** button that opens that version's text below the table, rendered exactly as students see it at booking and signup, whether the version is the published one, an old archived one, or a draft nobody has seen yet. The text is editable straight from the viewer, and what happens when you save depends on the version: a draft is simply updated in place, while editing a **published or archived version saves your text as a new draft version** and leaves the original exactly as students accepted it. The new draft then opens in the viewer ready to publish. Nothing a student has agreed to is ever rewritten.
|
||||
- Booking a lesson and enrolling in a class now take a **second confirmation that the student agrees to pay**. Above the Confirm button the form restates the price with its cadence, spells out how it is collected ("Charged on the 1st of each month, for that month's lessons"), adds the studio's HST so the figure matches the total actually billed, and requires a tick on "I agree to pay 56.50 CAD at booking." before it will submit — separate from, and in addition to, the studio policies the student accepts above it. Reserving a time weekly quotes the per-lesson fee and the most it can add up to ("up to 12 lessons, 678.00 CAD in total"), since a week another student takes first is simply not booked. Free offerings have nothing to agree to and show no price block.
|
||||
|
||||
### Fixed
|
||||
- Policies are **readable where students have to accept them**. A policy typed as plain paragraphs — the normal way to write one, with no HTML — was being dropped into the booking, enrolment, and signup forms unformatted, collapsing the whole document into a single squashed line with a horizontal scrollbar and words piling on top of each other. Policy text is now formatted the same way WordPress formats post content, so blank lines become real paragraphs, and the acceptance box is styled as a proper bounded reading panel: long policies scroll vertically instead of running off the side of the page, long pasted links wrap rather than forcing the page sideways, and the "I have read and agree" tick stays in view. Policies written with HTML are unaffected. The studio registration page was also missing the plugin's stylesheet entirely, which is why the problem was at its worst there.
|
||||
|
||||
## [1.2.2]
|
||||
|
||||
### Added
|
||||
- The **Lesson Booking** block gained three embedding options in its sidebar. **Lesson type** pins the block to a single private-lesson type — only the times bookable as that type are listed and it is the only thing bookable there, auto-selected on the registration form — so a page about one lesson type can carry its own calendar. **Show the lesson-type filter** turns the **Show Only** control on or off. **Sections** embeds just one half of the page: booking calendar only, or the student's upcoming lessons only, so the two can live on different pages. All three are available to the shortcode as `[us_booking lesson_type="…" show_filter="no" show="booking|upcoming"]`, and the block's editor preview follows the chosen sections.
|
||||
- The booking calendar now has a **Show Only** button beside the List/Week toggle that opens a lesson-type filter, so a student browsing open times can narrow them to the types they actually want. Because not every open time can be booked as every private-lesson type — some times are tied to a specific type, others only take types of a matching length — the filter shows just the times bookable as the ticked types, and re-anchors the week view on the earliest one so it never opens on an empty week. Picking one of those times narrows the **Lesson type** picker on the registration form to the same list, and when only one type is left it is chosen automatically with its questions loaded. The type list starts collapsed and can be tucked away again without losing the filter; the button shows how many types are ticked. Tick nothing (or use **Show all types**) to see every open time as before. The filter is hidden when the studio only offers one private-lesson type.
|
||||
- The **Group Classes** block can now be pinned to a single class, under **Classes shown → Class** in the block sidebar (shortcode: `[us_group_classes offering="…"]`). Pick a class and the block shows only that one, so it can be embedded on a page that describes the class. In this mode the class's own description is left out to avoid repeating the page copy — the card shows the schedule, instructor, price, enrolment deadline and the enrol/withdraw controls. Leaving it on **All classes** keeps the full browsable catalog with descriptions.
|
||||
- The **Student Registration** block can now send students onward to a page of your choosing once they finish registering. Its **After email confirmation** panel is now **After registration**: the page you pick there is where the link shown to a newly registered student points — the "Sign in to your account" link after they confirm their email, and a "Continue to your account" link for an invited student, who is signed in immediately. A new **Redirect automatically** option takes them straight there instead of showing the link. Registration errors are never skipped — a failed sign-up and an expired confirmation link still show their message on the page, as does the "check your email to confirm your address" step. The redirect needs a page to be chosen; with none set, students see the link (or, for invited students, just the confirmation) as before.
|
||||
|
||||
## [1.2.1]
|
||||
|
||||
### Fixed
|
||||
- Registration questions, offering titles/notes, and policy names longer than their storage limit are no longer silently discarded. Previously typing a fixed-size field past its maximum length reported success but saved nothing — the database quietly rejected the over-long value. These fields now cap the input in the form, and the API rejects an over-long value with a clear error.
|
||||
- Students can no longer reach the WordPress dashboard. A student who navigates to `wp-admin` is redirected to the site front end and the admin toolbar is hidden for them, so they only ever see the studio's booking pages. Anyone who runs the studio — administrators, studio admins, and instructors — keeps full `wp-admin` access.
|
||||
- The instructor picker on the **Add/Edit Offering** form no longer comes up empty for a solo studio owner. When the person running the studio teaches from a WordPress administrator account (the default single-account setup), they now appear in the instructor dropdown and can be assigned to a class.
|
||||
|
||||
## [1.2.0]
|
||||
|
||||
### Added
|
||||
- Offerings can now bill on a schedule: **weekly** (a pending payment 24 hours before each lesson) or **monthly** (one payment on the 1st for that month's lessons), alongside the existing one-time and full-term modes. Applies to both private lessons and group classes. A daily job generates due payments, and each student receives one consolidated itemised email per scan; batched payments share a reference so the admin Payments queue groups them with a lump-sum total for e-transfer reconciliation. Cancelling a lesson never voids a scheduled payment.
|
||||
- Cancelling a lesson that was **already paid for** now credits the student that money instead of leaving it as a manual refund. The credit is one lesson's share of what they paid — the whole amount for a single lesson, or a per-lesson slice of a monthly charge or a full-term series. The daily billing scan automatically applies any available credit against a student's upcoming weekly/monthly charges before emailing their notice, which shows the credit applied and the reduced total due; a charge fully covered by credit is settled and leaves the admin Payments queue. A student's outstanding credit balance is shown on their **student detail** page in the studio admin. Still-pending (unpaid) payments continue to be voided on cancellation as before.
|
||||
- Group classes now carry an **enrolment deadline** the instructor sets on the offering. It defaults to the first day of the class, and once it passes students can no longer enrol — the enrolment page shows the class as closed and the API rejects late enrolments. While enrolment is open, each class card shows an "Enrol by" date.
|
||||
- Group classes now also carry a **withdrawal deadline** the instructor sets per class. Up to that day a student can withdraw themselves from the class (the group-class page shows a **Withdraw** button) — this frees their seat and voids any pending payment but does **not** credit their account. After the deadline self-withdrawal closes and the student must ask the studio, who can still withdraw them by hand from the student detail page. Leaving the deadline blank keeps self-withdrawal open indefinitely.
|
||||
- The **Add/Edit Offering** form now shows only the fields relevant to the selected kind: the group-class settings (capacity, dates, times, enrolment/withdrawal deadlines, sessions, schedule note, invite-only) appear only for a group class, and the weekly-reservation option only for a private lesson.
|
||||
- Instructors can add students to any group class by hand from its details page (**Add students directly**), which now appears for public classes too, not just invite-only ones. This bypasses the enrolment deadline and capacity, so a student can be enrolled as a **late enrolment** after the class has closed to self-enrolment.
|
||||
- Studio admins and instructors can open a **lesson detail view** from the Scheduler and My Lessons lists, showing the offering booked, the policy versions the student accepted (with acceptance time and IP), and their intake answers. On My Lessons an instructor may only open their own lessons; the studio Scheduler may open any.
|
||||
- The **Student Registration** block's "registration is by invitation only" message is now customisable, under a new **Invitation-only notice** panel (shortcode: `invite_only_message`). Leaving it blank keeps the default wording.
|
||||
|
||||
### Changed
|
||||
- The student **upcoming lessons** panel now shows each booked offering's name and length beside the time, and lists only the soonest five lessons with a "Show all" reveal. The Scheduler and My Lessons week/list views likewise show the booked offering.
|
||||
|
||||
### Fixed
|
||||
- Accepting an invitation now keeps the student signed in. Previously the registration form processed the submission after the page had started rendering, so the sign-in cookie was never sent and the new student was bounced back to the (logged-out) registration page; it is now handled before any output, and the student lands logged in.
|
||||
- Account-registration questions now save. On sites first installed before account-scope questions existed, the `us_questions.offering_id` column was left `NOT NULL` (the schema migration relied on `dbDelta`, which does not reliably relax a column to allow `NULL`), so saving an account question failed with "Column 'offering_id' cannot be null". A one-time, self-healing migration relaxes the column on the next load.
|
||||
|
||||
## [1.1.1]
|
||||
|
||||
### Fixed
|
||||
- The **Enable auto-updates** toggle now appears for the plugin on the Plugins screen. The self-updater now reports the plugin to WordPress even when it is already current, so core marks it update-supported and shows the toggle; previously the toggle was hidden between releases.
|
||||
|
||||
## [1.1.0]
|
||||
|
||||
### Added
|
||||
- Invite-only group classes, so a class can be restricted to students who hold an invite.
|
||||
- Instructor group-class roster view under **My Lessons**.
|
||||
- Cancellation cutoff that limits how close to a lesson a student can cancel.
|
||||
- Studio-defined account-registration questions collected during student sign-up.
|
||||
- Group classes now carry a specific class time (alongside the date and duration), and studio admins can assign the teaching instructor. Assigning an instructor clears their open booking slots at the class time and flags any already-booked lesson that clashes.
|
||||
- Students see who teaches each group class and when it meets on the enrolment page. Instructor names in the group-class views (front and back end) show the instructor's real name (first + last) or nickname, never their login/username.
|
||||
|
||||
### Changed
|
||||
- Plugin metadata links now point at Unsupervised and the Gitea repository.
|
||||
- The instructor **My Group Classes** view is now a summary of classes with enrolment counts; each class links through to a per-class **details page** (class schedule, roster, and — for invite-only classes — the controls to add or invite students), rather than listing every student inline. Managing who is in an invite-only class is now done from that details page. The studio-admin **Group Classes** page is likewise a per-class summary that links through to the same details page, so a studio admin — including an owner-operator who also teaches — can view any class's roster and manage its invite-only membership.
|
||||
|
||||
## [1.0.0]
|
||||
|
||||
First stable release: instructor/student lesson scheduling for WordPress, including
|
||||
availability management, one-on-one and group-class booking, Stripe payments, student
|
||||
self-registration with email confirmation and admin approval, group invite links, and
|
||||
self-update from tagged Gitea releases.
|
||||
@@ -4,28 +4,106 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
|
||||
|
||||
## Commands
|
||||
|
||||
```bash
|
||||
composer install # Install all dependencies
|
||||
|
||||
composer test # Run the full test suite (required after every change)
|
||||
composer lint # PHPStan static analysis
|
||||
composer cs # PHPCS coding standards check
|
||||
composer cs:fix # Auto-fix coding standards
|
||||
|
||||
# Run a single test file
|
||||
./vendor/bin/phpunit tests/Unit/Availability/AvailabilityRepositoryTest.php
|
||||
|
||||
# Run a single test by name
|
||||
./vendor/bin/phpunit --filter testInsertCallsWpdbInsertAndReturnsId
|
||||
```
|
||||
|
||||
**Run `composer test` after every code change before considering a task complete.**
|
||||
|
||||
## Architecture
|
||||
|
||||
### Code organisation
|
||||
**Code is organised package-by-domain.** Each domain package under `src/<Domain>/` contains everything related to that domain: value objects, repositories, controllers, REST endpoints, and shortcode pages. Cross-cutting wiring classes (Plugin, AdminMenu, RestRegistrar, ShortcodeRegistrar, Schema) live directly under `src/`.
|
||||
### Plugin Bootstrap
|
||||
`unsupervised-schedular.php` defines constants (`USC_VERSION`, `USC_PLUGIN_DIR`, `USC_PLUGIN_URL`), registers activation/deactivation hooks, then calls `Plugin::boot()` on `plugins_loaded`. No logic lives in the root file.
|
||||
|
||||
### Directory Structure
|
||||
```
|
||||
src/ — All plugin PHP (PSR-4 namespace: Unsupervised\Schedular\)
|
||||
Availability/ — Availability slots: value object, repository, controller, REST endpoint
|
||||
Booking/ — Lessons/bookings: value object, repository, controller, REST endpoint, shortcode page
|
||||
Auth/ — Roles, capabilities, login page
|
||||
Plugin.php — Wires all components together on plugins_loaded
|
||||
Installer.php — Creates DB tables and roles on activation
|
||||
Schema.php — CREATE TABLE SQL for dbDelta
|
||||
AdminMenu.php — Registers wp-admin menu pages
|
||||
RestRegistrar.php — Registers all REST routes under us-scheduler/v1
|
||||
ShortcodeRegistrar.php — Registers [us_booking] and [us_student_login] shortcodes
|
||||
templates/ — PHP view files included by controllers/shortcodes
|
||||
assets/ — CSS and JS (vanilla JS, no build step)
|
||||
tests/Unit/ — PHPUnit unit tests (PSR-4: Unsupervised\Schedular\Tests\)
|
||||
Availability/ — Tests for src/Availability/
|
||||
Booking/ — Tests for src/Booking/
|
||||
Auth/ — Tests for src/Auth/
|
||||
docs/features/ — One markdown file per feature describing data model, API, and test locations
|
||||
```
|
||||
|
||||
**Code is organised package-by-domain** (Availability, Booking, Auth). Each domain package contains everything related to that domain: value objects, repositories, controllers, REST endpoints, and shortcode pages. Cross-cutting wiring classes (Plugin, AdminMenu, RestRegistrar, ShortcodeRegistrar, Schema) live directly under `src/`.
|
||||
|
||||
### Data Storage
|
||||
Custom database tables are created via `dbDelta` on activation; `Schema.php` holds the SQL.
|
||||
Two custom database tables (created via `dbDelta` on activation):
|
||||
- `{prefix}us_availability` — instructor availability windows
|
||||
- `{prefix}us_lessons` — booked lessons
|
||||
|
||||
All database access goes through repository classes within their domain package. No direct `$wpdb` calls outside repositories.
|
||||
|
||||
### Key Classes
|
||||
|
||||
| Class | Responsibility |
|
||||
|---|---|
|
||||
| `Plugin` | Wires all components together on `plugins_loaded` |
|
||||
| `Installer` | Creates DB tables and roles on activation |
|
||||
| `Schema` | CREATE TABLE SQL strings for dbDelta |
|
||||
| `AdminMenu` | Registers wp-admin menu pages |
|
||||
| `RestRegistrar` | Registers all REST routes under `us-scheduler/v1` |
|
||||
| `ShortcodeRegistrar` | Registers `[us_booking]` and `[us_student_login]` shortcodes |
|
||||
| `Auth\RoleManager` | Registers `us_instructor` and `us_student` roles with custom caps |
|
||||
| `Auth\LoginPage` | Renders front-end student login form |
|
||||
| `Availability\AvailabilitySlot` | Immutable value object for a slot row |
|
||||
| `Availability\AvailabilityRepository` | CRUD for availability slots |
|
||||
| `Availability\AvailabilityController` | Instructor availability management page |
|
||||
| `Availability\AvailabilityEndpoint` | REST handlers for availability CRUD |
|
||||
| `Booking\Lesson` | Immutable value object for a lesson row |
|
||||
| `Booking\BookingRepository` | CRUD for lesson bookings |
|
||||
| `Booking\BookingEndpoint` | REST handlers for booking and status updates |
|
||||
| `Booking\BookingPage` | Renders student booking UI shell (JS takes over) |
|
||||
| `Booking\LessonController` | Admin and instructor lesson list pages |
|
||||
|
||||
### REST API Namespace
|
||||
All endpoints live under `/wp-json/us-scheduler/v1/`. Permissions are enforced via `permission_callback` using capability checks (`manage_availability`, `book_lesson`), never role name checks.
|
||||
|
||||
### Testing Approach
|
||||
Tests stub WordPress with Brain\Monkey rather than booting a real WP install. The setup and the Brain\Monkey/Mockery API gotchas are in `tests/CLAUDE.md`.
|
||||
Tests use [Brain\Monkey](https://brain-wp.github.io/BrainMonkey/) to stub WordPress functions without a full WP installation, and Mockery to mock `$wpdb` and other dependencies.
|
||||
|
||||
All test classes extend `tests/Unit/TestCase.php`, which handles `Monkey\setUp()` / `Monkey\tearDown()` and stubs all WP translation/escape functions automatically.
|
||||
|
||||
**Brain\Monkey API notes:**
|
||||
- `Functions\when('fn')->alias(fn() => ...)` — stub with a closure (NOT `returnUsing()`)
|
||||
- `Functions\when('fn')->justReturn($val)` — stub returning a fixed value
|
||||
- `Functions\expect('fn')->once()->with(...)` — assert call count and arguments
|
||||
- Use `Functions\when()` (not `Functions\expect()`) when you need argument-routing (e.g. `get_role` returning different values per argument) to avoid chaining ambiguity
|
||||
- Mockery matchers (e.g. `\Mockery::type()`) inside plain PHP arrays do not work with `with()` — use `\Mockery::on(fn($arr) => ...)` or `\Mockery::any()` instead
|
||||
- When mocking `$wpdb`, set `$mock->prefix = 'wp_'` explicitly — it is a public property, not a method
|
||||
|
||||
### Adding a Feature
|
||||
0. **If the feature touches `Schema.php`, bump both the `Version:` header and `USC_VERSION` in `unsupervised-schedular.php`.** `Plugin::boot()` only re-runs `Installer`/`dbDelta` when the stored `us_schedular_version` differs, so a schema change without a version bump never reaches existing sites and inserts into new columns fail silently.
|
||||
1. Write the feature doc in `docs/features/<feature-name>.md` (data model, API, classes, test paths).
|
||||
2. Create a domain package under `src/<Domain>/` containing all classes for that feature.
|
||||
3. Add template(s) under `templates/` if needed.
|
||||
4. Write unit tests under `tests/Unit/<Domain>/` mirroring the `src/<Domain>/` structure.
|
||||
5. Run `composer test` — all tests must pass before the feature is complete.
|
||||
|
||||
### CI
|
||||
Gitea Actions (`.gitea/workflows/ci.yml`) runs on every push and pull request:
|
||||
- **lint** — PHPCS WordPress coding standards
|
||||
- **static-analysis** — PHPStan level 6
|
||||
- **test** — PHPUnit on PHP 8.1, 8.2, 8.3
|
||||
- **no-debug** — rejects commits with `var_dump`, `error_log`, etc. in `src/`
|
||||
|
||||
@@ -2,9 +2,9 @@
|
||||
|
||||
A WordPress plugin for instructor/student lesson scheduling — private lessons and
|
||||
group classes — with offerings, intake questions, versioned policies, account
|
||||
registration, and online payments.
|
||||
registration, and (coming) online payments.
|
||||
|
||||
**Version:** 1.0.0 · **Requires:** WordPress 6.0+, PHP 8.1+ · **License:** GPL-2.0-or-later
|
||||
**Version:** 1.0.0-rc.1 · **Requires:** WordPress 6.0+, PHP 8.1+ · **License:** GPL-2.0-or-later
|
||||
|
||||
> Pre-release. The booking platform is being built feature-by-feature; see
|
||||
> [Implementation status](#implementation-status) below.
|
||||
@@ -31,13 +31,17 @@ model, REST API, classes, and tests. For contributor/architecture guidance see
|
||||
| Availability (durations, weekly recurrence, calendar) | [availability-management.md](docs/features/availability-management.md) | ✅ Implemented |
|
||||
| Registration questions (per-offering intake) | [registration-questions.md](docs/features/registration-questions.md) | ✅ Implemented |
|
||||
| Policies (drafting, versioning, tracked acceptance) | [policies.md](docs/features/policies.md) | ✅ Implemented |
|
||||
| Account registration (invite or open self-approval, email confirmation, signup policy acceptance) | [account-registration.md](docs/features/account-registration.md) | ✅ Implemented |
|
||||
| Account registration (invite-only, signup policy acceptance) | [account-registration.md](docs/features/account-registration.md) | ✅ Implemented |
|
||||
| Lesson booking (offering → questions → policies) | [lesson-booking.md](docs/features/lesson-booking.md) | ✅ Implemented |
|
||||
| Group classes (capacity-enforced enrolment) | [group-classes.md](docs/features/group-classes.md) | ✅ Implemented |
|
||||
| Student administration (studio-admin view) | [student-administration.md](docs/features/student-administration.md) | ✅ Implemented |
|
||||
| Payments (Stripe card charge + e-transfer/comp + receipts + HST) | [payments.md](docs/features/payments.md) | ✅ Implemented |
|
||||
| Payments (e-transfer/comp + receipts + HST; Stripe card charge pending) | [payments.md](docs/features/payments.md) | 🟡 Partial |
|
||||
| Payment reporting (monthly per-instructor + HST + CSV) | [payment-reporting.md](docs/features/payment-reporting.md) | ✅ Implemented |
|
||||
|
||||
> Payments are deliberately deferred to the end: booking and enrolment ship with a
|
||||
> clean seam (a lesson lands `pending`, an enrolment `active`, with `payment_id`
|
||||
> null) into which the pay→confirm + receipt step plugs later.
|
||||
|
||||
## Shortcodes
|
||||
|
||||
| Shortcode | Purpose |
|
||||
@@ -45,7 +49,7 @@ model, REST API, classes, and tests. For contributor/architecture guidance see
|
||||
| `[us_booking]` | Student calendar + private-lesson registration flow |
|
||||
| `[us_group_classes]` | Browse and enrol in group classes |
|
||||
| `[us_student_login]` | Front-end student login |
|
||||
| `[us_student_register]` | Account registration — invite-based, or open self-signup with email confirmation + admin approval (accepts signup policies) |
|
||||
| `[us_student_register]` | Invite-based account registration (accepts signup policies) |
|
||||
|
||||
## REST API
|
||||
|
||||
|
||||
@@ -33,639 +33,3 @@
|
||||
color: #c00;
|
||||
margin-top: 8px;
|
||||
}
|
||||
|
||||
/*
|
||||
* The upcoming-lessons panel. Every rule here is scoped under #us-booking-app —
|
||||
* the same id-level specificity .us-slot above uses — because these rows sit in
|
||||
* whatever layout the theme provides and carry more content than a calendar
|
||||
* cell. Bare class selectors lost to theme rules on div/span/strong, which
|
||||
* collapsed the flex layout and piled the details on top of the actions.
|
||||
*/
|
||||
#us-booking-app .us-my-lessons {
|
||||
margin-bottom: 24px;
|
||||
}
|
||||
|
||||
#us-booking-app .us-my-lesson {
|
||||
box-sizing: border-box;
|
||||
max-width: 100%;
|
||||
border: 1px solid #ddd;
|
||||
border-radius: 4px;
|
||||
padding: 12px 16px;
|
||||
margin-bottom: 8px;
|
||||
display: flex;
|
||||
flex-wrap: wrap;
|
||||
justify-content: space-between;
|
||||
align-items: center;
|
||||
gap: 8px 12px;
|
||||
}
|
||||
|
||||
/*
|
||||
* `min-width: 0` lets the title column shrink below its content width — without
|
||||
* it a long offering title cannot compress and shoves the status pill and
|
||||
* Cancel button out of the row. The flex-basis keeps the details and the
|
||||
* actions on one line while there is room, and wraps them once there is not.
|
||||
*/
|
||||
#us-booking-app .us-my-lesson-info {
|
||||
display: flex;
|
||||
flex-direction: column;
|
||||
gap: 2px;
|
||||
flex: 1 1 14em;
|
||||
min-width: 0;
|
||||
}
|
||||
|
||||
#us-booking-app .us-my-lesson-title,
|
||||
#us-booking-app .us-my-lesson-when {
|
||||
overflow-wrap: break-word;
|
||||
word-break: break-word;
|
||||
}
|
||||
|
||||
#us-booking-app .us-my-lesson-title {
|
||||
font-size: 1.05em;
|
||||
}
|
||||
|
||||
#us-booking-app .us-my-lesson-duration {
|
||||
font-weight: normal;
|
||||
color: #666;
|
||||
}
|
||||
|
||||
#us-booking-app .us-my-lesson-when {
|
||||
color: #555;
|
||||
}
|
||||
|
||||
#us-booking-app .us-my-lesson-actions {
|
||||
display: flex;
|
||||
flex-wrap: wrap;
|
||||
gap: 8px 12px;
|
||||
align-items: center;
|
||||
}
|
||||
|
||||
/*
|
||||
* Theme-proofing for the leaf text. The row and its two columns are divs with
|
||||
* explicit flex rules above, but the text itself still sits in inline elements
|
||||
* a theme is free to take out of normal flow — an absolutely positioned,
|
||||
* floated or negatively offset span drops the date/time on top of the title and
|
||||
* the status pill on top of the Cancel button. Pinning the properties that
|
||||
* would have to change keeps the leaves in flow, at the same id-level
|
||||
* specificity the rules above rely on.
|
||||
*
|
||||
* `line-height` is pinned for the same reason and is the subtler one, because a
|
||||
* theme does not have to target this panel to break it — it is inherited, so a
|
||||
* `line-height: 0` anywhere above (the usual icon-font or sprite reset) reaches
|
||||
* these elements untouched. Below 1 it produces both halves of the same bug: a
|
||||
* line box shorter than its glyphs, so stacked lines in the details column
|
||||
* overlap, and an inline-block pill whose background is shorter than the text
|
||||
* sitting in it. Nothing here should ever inherit a line-height, so the panel
|
||||
* states its own.
|
||||
*/
|
||||
#us-booking-app .us-my-lesson,
|
||||
#us-booking-app .us-my-lesson-info,
|
||||
#us-booking-app .us-my-lesson-actions,
|
||||
#us-booking-app .us-my-lesson-title,
|
||||
#us-booking-app .us-my-lesson-when,
|
||||
#us-booking-app .us-my-lesson-duration,
|
||||
#us-booking-app .us-my-lesson-who,
|
||||
#us-booking-app .us-my-lesson-kind,
|
||||
#us-booking-app .us-lesson-status {
|
||||
line-height: 1.45;
|
||||
}
|
||||
|
||||
#us-booking-app .us-my-lesson-title,
|
||||
#us-booking-app .us-my-lesson-when,
|
||||
#us-booking-app .us-my-lesson-duration,
|
||||
#us-booking-app .us-my-lesson-who,
|
||||
#us-booking-app .us-my-lesson-kind,
|
||||
#us-booking-app .us-lesson-status {
|
||||
position: static;
|
||||
float: none;
|
||||
margin: 0;
|
||||
vertical-align: middle;
|
||||
}
|
||||
|
||||
/*
|
||||
* The rows the "Show all" button reveals. `[hidden]` is only a UA-stylesheet
|
||||
* rule, so any author rule setting a display on div beats it — the html5-reset
|
||||
* `div { display: block }` is still widespread in themes — and the rows the
|
||||
* button is meant to gate render anyway. An author !important is the only way
|
||||
* to win that cascade.
|
||||
*/
|
||||
#us-booking-app [hidden] {
|
||||
display: none !important;
|
||||
}
|
||||
|
||||
#us-booking-app .us-show-all-lessons {
|
||||
background: transparent;
|
||||
border: 1px solid #ccc;
|
||||
border-radius: 4px;
|
||||
padding: 6px 14px;
|
||||
cursor: pointer;
|
||||
}
|
||||
|
||||
#us-booking-app .us-show-all-lessons:hover {
|
||||
border-color: #888;
|
||||
}
|
||||
|
||||
#us-booking-app .us-cancel-lesson {
|
||||
background: transparent;
|
||||
border: 1px solid #ccc;
|
||||
border-radius: 4px;
|
||||
padding: 4px 12px;
|
||||
cursor: pointer;
|
||||
color: #c00;
|
||||
}
|
||||
|
||||
#us-booking-app .us-cancel-lesson:hover {
|
||||
border-color: #c00;
|
||||
}
|
||||
|
||||
#us-booking-app .us-lesson-status {
|
||||
display: inline-block;
|
||||
font-size: 0.85em;
|
||||
font-weight: 600;
|
||||
padding: 2px 10px;
|
||||
border-radius: 10px;
|
||||
background: #eee;
|
||||
white-space: nowrap;
|
||||
}
|
||||
|
||||
#us-booking-app .us-lesson-status-confirmed {
|
||||
background: #e2f5e5;
|
||||
color: #1a7d2e;
|
||||
}
|
||||
|
||||
#us-booking-app .us-lesson-status-pending {
|
||||
background: #fdf3d7;
|
||||
color: #8a6d1a;
|
||||
}
|
||||
|
||||
.us-calendar-controls {
|
||||
display: flex;
|
||||
flex-wrap: wrap;
|
||||
justify-content: space-between;
|
||||
align-items: center;
|
||||
gap: 8px;
|
||||
margin-bottom: 12px;
|
||||
}
|
||||
|
||||
.us-filter-toggle {
|
||||
padding: 6px 16px;
|
||||
border: 1px solid #ccc;
|
||||
border-radius: 4px;
|
||||
background: transparent;
|
||||
cursor: pointer;
|
||||
}
|
||||
|
||||
.us-filter-toggle.us-active {
|
||||
background: #333;
|
||||
border-color: #333;
|
||||
color: #fff;
|
||||
}
|
||||
|
||||
.us-type-filter {
|
||||
margin-bottom: 12px;
|
||||
padding: 8px 12px;
|
||||
border: 1px solid #eee;
|
||||
border-radius: 4px;
|
||||
}
|
||||
|
||||
.us-type-filter-heading {
|
||||
display: block;
|
||||
margin-bottom: 6px;
|
||||
font-weight: 600;
|
||||
}
|
||||
|
||||
.us-type-filter-choices {
|
||||
display: flex;
|
||||
flex-wrap: wrap;
|
||||
align-items: center;
|
||||
gap: 8px 16px;
|
||||
}
|
||||
|
||||
.us-type-filter-choice {
|
||||
display: inline-flex;
|
||||
align-items: center;
|
||||
gap: 6px;
|
||||
}
|
||||
|
||||
.us-type-filter-clear {
|
||||
margin-left: auto;
|
||||
padding: 4px 12px;
|
||||
border: 1px solid #ccc;
|
||||
border-radius: 4px;
|
||||
background: transparent;
|
||||
cursor: pointer;
|
||||
}
|
||||
|
||||
.us-view-toggle {
|
||||
display: flex;
|
||||
gap: 8px;
|
||||
}
|
||||
|
||||
.us-view-toggle button {
|
||||
padding: 6px 16px;
|
||||
border: 1px solid #ccc;
|
||||
border-radius: 4px;
|
||||
background: transparent;
|
||||
cursor: pointer;
|
||||
}
|
||||
|
||||
.us-view-toggle button.us-active {
|
||||
background: #333;
|
||||
border-color: #333;
|
||||
color: #fff;
|
||||
}
|
||||
|
||||
.us-week-nav {
|
||||
display: flex;
|
||||
justify-content: space-between;
|
||||
align-items: center;
|
||||
gap: 8px;
|
||||
margin-bottom: 12px;
|
||||
}
|
||||
|
||||
.us-week-nav button {
|
||||
padding: 6px 12px;
|
||||
border: 1px solid #ccc;
|
||||
border-radius: 4px;
|
||||
background: transparent;
|
||||
cursor: pointer;
|
||||
}
|
||||
|
||||
.us-week-grid {
|
||||
display: grid;
|
||||
grid-template-columns: repeat(7, 1fr);
|
||||
gap: 8px;
|
||||
}
|
||||
|
||||
.us-week-day {
|
||||
border: 1px solid #ddd;
|
||||
border-radius: 4px;
|
||||
padding: 8px;
|
||||
min-height: 90px;
|
||||
}
|
||||
|
||||
.us-week-day-heading {
|
||||
margin: 0 0 8px;
|
||||
font-size: 0.85em;
|
||||
text-align: center;
|
||||
}
|
||||
|
||||
.us-week-slot {
|
||||
display: block;
|
||||
width: 100%;
|
||||
margin-bottom: 6px;
|
||||
}
|
||||
|
||||
.us-week-empty {
|
||||
display: block;
|
||||
text-align: center;
|
||||
opacity: 0.4;
|
||||
}
|
||||
|
||||
/* The price and pay agreement on a booking / enrolment form. */
|
||||
.us-price {
|
||||
border: 1px solid #ddd;
|
||||
border-radius: 4px;
|
||||
padding: 12px 16px;
|
||||
margin: 16px 0;
|
||||
}
|
||||
|
||||
.us-price h4 {
|
||||
margin: 0 0 8px;
|
||||
}
|
||||
|
||||
.us-price p {
|
||||
margin: 0 0 4px;
|
||||
}
|
||||
|
||||
.us-price-amount strong {
|
||||
font-size: 1.15em;
|
||||
}
|
||||
|
||||
.us-price-cadence {
|
||||
margin-left: 4px;
|
||||
}
|
||||
|
||||
.us-price-tax,
|
||||
.us-price-note {
|
||||
font-size: 0.9em;
|
||||
opacity: 0.8;
|
||||
}
|
||||
|
||||
.us-price-agree {
|
||||
display: block;
|
||||
margin-top: 12px;
|
||||
font-weight: 600;
|
||||
}
|
||||
|
||||
/* The cadence-carrying price on a group-class card. */
|
||||
.us-class-price {
|
||||
font-weight: 600;
|
||||
}
|
||||
|
||||
/* Policy acceptance — booking, enrolment, and signup all render this markup. */
|
||||
.us-policy {
|
||||
margin: 16px 0;
|
||||
}
|
||||
|
||||
.us-policy h4 {
|
||||
margin: 0 0 6px;
|
||||
}
|
||||
|
||||
/*
|
||||
* The body is admin-authored HTML sitting inside whatever layout the theme
|
||||
* provides, so it gets an explicit reading box rather than inheriting one.
|
||||
* `overflow-wrap` breaks pasted URLs instead of letting one long token force
|
||||
* the horizontal scrollbar, and the bounded height keeps a long policy from
|
||||
* pushing the accept checkbox off the screen.
|
||||
*/
|
||||
.us-policy-body {
|
||||
box-sizing: border-box;
|
||||
max-width: 100%;
|
||||
max-height: 260px;
|
||||
overflow-y: auto;
|
||||
overflow-x: hidden;
|
||||
padding: 12px 14px;
|
||||
margin-bottom: 8px;
|
||||
border: 1px solid #ddd;
|
||||
border-radius: 4px;
|
||||
background: #fafafa;
|
||||
white-space: normal;
|
||||
overflow-wrap: break-word;
|
||||
word-break: break-word;
|
||||
line-height: 1.5;
|
||||
text-align: left;
|
||||
}
|
||||
|
||||
.us-policy-body p,
|
||||
.us-policy-body ul,
|
||||
.us-policy-body ol {
|
||||
margin: 0 0 0.75em;
|
||||
max-width: 100%;
|
||||
}
|
||||
|
||||
.us-policy-body ul,
|
||||
.us-policy-body ol {
|
||||
padding-left: 1.5em;
|
||||
}
|
||||
|
||||
.us-policy-body > :last-child {
|
||||
margin-bottom: 0;
|
||||
}
|
||||
|
||||
.us-policy-accept,
|
||||
.us-policies input[type="checkbox"] {
|
||||
margin-right: 6px;
|
||||
}
|
||||
|
||||
@media (max-width: 640px) {
|
||||
.us-week-grid {
|
||||
grid-template-columns: 1fr;
|
||||
}
|
||||
|
||||
.us-week-day {
|
||||
min-height: 0;
|
||||
}
|
||||
|
||||
/*
|
||||
* A lesson row carries a title, a date/time, a status pill and a button —
|
||||
* more than fits one narrow line, so stack the details above the actions
|
||||
* rather than letting them wrap into each other.
|
||||
*/
|
||||
#us-booking-app .us-my-lesson {
|
||||
flex-direction: column;
|
||||
align-items: stretch;
|
||||
}
|
||||
|
||||
#us-booking-app .us-my-lesson-info {
|
||||
flex: 0 0 auto;
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
* "Who is this for?" picker — booking and enrolment. Present only on an account
|
||||
* that books for more than one person, so it is styled as a normal field rather
|
||||
* than a callout.
|
||||
*/
|
||||
.us-student-picker select {
|
||||
max-width: 100%;
|
||||
}
|
||||
|
||||
/*
|
||||
* Whose lesson a row in the upcoming panel is — only shown on an account that
|
||||
* books for more than one person. Scoped under #us-booking-app like the rest of
|
||||
* the panel; as a bare class it was the one rule in the group a theme could
|
||||
* outrank on a plain span.
|
||||
*/
|
||||
#us-booking-app .us-my-lesson-who {
|
||||
font-weight: normal;
|
||||
opacity: 0.75;
|
||||
}
|
||||
|
||||
/*
|
||||
* Marks a row in the upcoming panel as a group-class session. The list mixes
|
||||
* one-to-one lessons and classes, and only the class rows have no Cancel button
|
||||
* — without a label that reads as a missing button rather than a different kind
|
||||
* of thing.
|
||||
*/
|
||||
#us-booking-app .us-my-lesson-kind {
|
||||
display: inline-block;
|
||||
margin-left: 6px;
|
||||
padding: 1px 6px;
|
||||
border-radius: 10px;
|
||||
background: #eef1f5;
|
||||
color: #3c434a;
|
||||
font-size: 0.75em;
|
||||
font-weight: 600;
|
||||
text-transform: uppercase;
|
||||
letter-spacing: 0.03em;
|
||||
vertical-align: middle;
|
||||
}
|
||||
|
||||
/*
|
||||
* The signup form's grouped sections: who you are registering, your own
|
||||
* details, and the students you are adding. One box style for all three so the
|
||||
* form reads as a short list of decisions rather than an undifferentiated
|
||||
* column of fields.
|
||||
*/
|
||||
.us-reg-group {
|
||||
margin: 16px 0;
|
||||
padding: 12px 14px;
|
||||
border: 1px solid #ddd;
|
||||
border-radius: 4px;
|
||||
}
|
||||
|
||||
.us-reg-group legend {
|
||||
padding: 0 6px;
|
||||
font-weight: 600;
|
||||
}
|
||||
|
||||
.us-children-intro {
|
||||
margin-top: 0;
|
||||
font-size: 0.9em;
|
||||
opacity: 0.8;
|
||||
}
|
||||
|
||||
/*
|
||||
* Each child is a bordered group so a family of three does not read as one long
|
||||
* undifferentiated column of fields.
|
||||
*/
|
||||
.us-child {
|
||||
margin-bottom: 12px;
|
||||
padding: 10px 12px;
|
||||
border-left: 3px solid #ddd;
|
||||
background: #fafafa;
|
||||
}
|
||||
|
||||
.us-child > p:last-child {
|
||||
margin-bottom: 0;
|
||||
}
|
||||
|
||||
/* The guardian's manage-children screen ([us_family]). */
|
||||
.us-family-list {
|
||||
margin: 0 0 20px;
|
||||
padding: 0;
|
||||
list-style: none;
|
||||
}
|
||||
|
||||
.us-family-child {
|
||||
display: flex;
|
||||
flex-wrap: wrap;
|
||||
gap: 8px 12px;
|
||||
align-items: baseline;
|
||||
padding: 10px 0;
|
||||
border-bottom: 1px solid #eee;
|
||||
}
|
||||
|
||||
.us-family-child-name {
|
||||
font-weight: 600;
|
||||
}
|
||||
|
||||
.us-family-child-birth-year {
|
||||
font-size: 0.9em;
|
||||
opacity: 0.75;
|
||||
}
|
||||
|
||||
/*
|
||||
* The actions sit at the far end of the row. Remove is its own form (it posts),
|
||||
* so it is forced inline rather than taking a block of its own.
|
||||
*/
|
||||
.us-family-child-actions {
|
||||
display: flex;
|
||||
gap: 10px;
|
||||
align-items: baseline;
|
||||
margin-left: auto;
|
||||
}
|
||||
|
||||
.us-family-remove {
|
||||
display: inline;
|
||||
}
|
||||
|
||||
/* The editing row replaces the child's line, so it spans the whole width. */
|
||||
.us-family-edit {
|
||||
width: 100%;
|
||||
}
|
||||
|
||||
@media (max-width: 640px) {
|
||||
/* A name, a date and two actions do not fit one narrow line. */
|
||||
.us-family-child-actions {
|
||||
margin-left: 0;
|
||||
width: 100%;
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
* The live password verdict under the signup field. Colour is a reinforcement,
|
||||
* not the message — the text says what is wrong on its own, so this still reads
|
||||
* correctly to anyone who cannot separate the hues.
|
||||
*/
|
||||
.us-password-strength {
|
||||
display: block;
|
||||
margin-top: 4px;
|
||||
font-size: 0.85em;
|
||||
}
|
||||
|
||||
.us-password-strength.is-short,
|
||||
.us-password-strength.is-weak {
|
||||
color: #c00;
|
||||
}
|
||||
|
||||
.us-password-strength.is-medium {
|
||||
color: #7a5c00;
|
||||
}
|
||||
|
||||
.us-password-strength.is-strong {
|
||||
color: #1a7d2e;
|
||||
}
|
||||
|
||||
/*
|
||||
* The account panel: who is signed in, and the way out. Sized to sit in a
|
||||
* header or sidebar, so the rules stay minimal and inherit the theme's type —
|
||||
* a block that lands in a site header should look like it belongs there.
|
||||
*/
|
||||
.us-account p {
|
||||
margin: 0 0 4px;
|
||||
}
|
||||
|
||||
.us-account-name {
|
||||
font-weight: 600;
|
||||
}
|
||||
|
||||
.us-account-email {
|
||||
display: block;
|
||||
font-size: 0.9em;
|
||||
opacity: 0.75;
|
||||
}
|
||||
|
||||
.us-account-actions {
|
||||
margin-top: 8px;
|
||||
}
|
||||
|
||||
/*
|
||||
* `[hidden]` is a UA-stylesheet rule, so the widespread `div { display: block }`
|
||||
* theme reset outranks it — the same trap the upcoming-lessons panel hit. An
|
||||
* author !important is the only way to win, and it has to sit before the
|
||||
* display rule it guards against.
|
||||
*/
|
||||
.us-notice[hidden] {
|
||||
display: none !important;
|
||||
}
|
||||
|
||||
/*
|
||||
* The "you're booked" / "you're enrolled" notice. It sits above the calendar
|
||||
* or class list rather than replacing it, so it needs to read as a banner
|
||||
* about something that just happened — not as the page's content.
|
||||
*/
|
||||
.us-notice {
|
||||
display: flex;
|
||||
flex-wrap: wrap;
|
||||
justify-content: space-between;
|
||||
align-items: center;
|
||||
gap: 8px 16px;
|
||||
margin-bottom: 16px;
|
||||
padding: 12px 16px;
|
||||
border: 1px solid #b7dfc0;
|
||||
border-left-width: 4px;
|
||||
border-radius: 4px;
|
||||
background: #f2faf4;
|
||||
color: #1a5c2a;
|
||||
}
|
||||
|
||||
.us-notice p {
|
||||
margin: 0;
|
||||
}
|
||||
|
||||
.us-notice-dismiss {
|
||||
background: transparent;
|
||||
border: 1px solid currentColor;
|
||||
border-radius: 4px;
|
||||
padding: 4px 12px;
|
||||
color: inherit;
|
||||
cursor: pointer;
|
||||
}
|
||||
|
||||
/* Shown only in block-editor previews (see BlockPreview). */
|
||||
.us-editor-note {
|
||||
font-size: 0.85em;
|
||||
font-style: italic;
|
||||
opacity: 0.7;
|
||||
}
|
||||
|
||||
@@ -1,98 +0,0 @@
|
||||
/**
|
||||
* Availability form: keep the lesson-length choices honest.
|
||||
*
|
||||
* A window is stored as consecutive lesson-length slots, so one shorter than the
|
||||
* chosen lesson length holds no slots at all and saves nothing. Picking 5:30–6:00
|
||||
* PM while the length select sat on its default of 60 minutes used to do exactly
|
||||
* that, silently. The server now rejects it with a message; this narrows the
|
||||
* choices first so the mistake is hard to make.
|
||||
*
|
||||
* This is a convenience only — AvailabilityController and the REST endpoint both
|
||||
* validate the same window server-side regardless of what happens here.
|
||||
*/
|
||||
(function () {
|
||||
'use strict';
|
||||
|
||||
const form = document.getElementById('usc-add-availability');
|
||||
if (!form) return;
|
||||
|
||||
const startEl = document.getElementById('start_dt');
|
||||
const endEl = document.getElementById('end_dt');
|
||||
const durationEl = document.getElementById('duration_minutes');
|
||||
const warningEl = document.getElementById('usc-duration-warning');
|
||||
const submitEl = form.querySelector('input[type="submit"], button[type="submit"]');
|
||||
|
||||
if (!startEl || !endEl || !durationEl) return;
|
||||
|
||||
/**
|
||||
* Minutes between the two datetime-local inputs, or 0 when the pair is not a
|
||||
* usable window yet — empty, unparseable, backwards, or spanning two days
|
||||
* (which the server rejects on its own terms, with its own message).
|
||||
*/
|
||||
function windowMinutes() {
|
||||
const start = new Date(startEl.value);
|
||||
const end = new Date(endEl.value);
|
||||
|
||||
if (!startEl.value || !endEl.value || isNaN(start) || isNaN(end)) return 0;
|
||||
if (end <= start) return 0;
|
||||
if (startEl.value.slice(0, 10) !== endEl.value.slice(0, 10)) return 0;
|
||||
|
||||
return Math.round((end - start) / 60000);
|
||||
}
|
||||
|
||||
function refresh() {
|
||||
const minutes = windowMinutes();
|
||||
const options = Array.from(durationEl.options);
|
||||
|
||||
// No usable window yet: leave every choice alone rather than fighting
|
||||
// someone part-way through typing a date.
|
||||
if (minutes === 0) {
|
||||
options.forEach((option) => {
|
||||
option.hidden = false;
|
||||
option.disabled = false;
|
||||
});
|
||||
setBlocked(false);
|
||||
return;
|
||||
}
|
||||
|
||||
let fits = [];
|
||||
|
||||
options.forEach((option) => {
|
||||
const tooLong = Number(option.value) > minutes;
|
||||
|
||||
option.hidden = tooLong;
|
||||
option.disabled = tooLong;
|
||||
|
||||
if (!tooLong) fits.push(option);
|
||||
});
|
||||
|
||||
if (fits.length === 0) {
|
||||
// Nothing bookable fits, so the form cannot produce a single slot.
|
||||
setBlocked(true);
|
||||
return;
|
||||
}
|
||||
|
||||
setBlocked(false);
|
||||
|
||||
// The selection may have just been hidden — fall back to the longest
|
||||
// length that still fits, which is what the instructor most likely wants.
|
||||
if (durationEl.selectedOptions[0] && durationEl.selectedOptions[0].disabled) {
|
||||
durationEl.value = fits.reduce(
|
||||
(longest, option) => (Number(option.value) > Number(longest.value) ? option : longest),
|
||||
fits[0]
|
||||
).value;
|
||||
}
|
||||
}
|
||||
|
||||
function setBlocked(blocked) {
|
||||
if (warningEl) warningEl.hidden = !blocked;
|
||||
if (submitEl) submitEl.disabled = blocked;
|
||||
}
|
||||
|
||||
startEl.addEventListener('change', refresh);
|
||||
startEl.addEventListener('input', refresh);
|
||||
endEl.addEventListener('change', refresh);
|
||||
endEl.addEventListener('input', refresh);
|
||||
|
||||
refresh();
|
||||
}());
|
||||
@@ -1,363 +0,0 @@
|
||||
/* global wp */
|
||||
(function () {
|
||||
'use strict';
|
||||
|
||||
const { registerBlockType } = wp.blocks;
|
||||
const { createElement: el, useState, useEffect } = wp.element;
|
||||
const { useBlockProps, InspectorControls } = wp.blockEditor;
|
||||
const { PanelBody, SelectControl, ToggleControl, TextareaControl } = wp.components;
|
||||
const { useSelect } = wp.data;
|
||||
const apiFetch = wp.apiFetch;
|
||||
const ServerSideRender = wp.serverSideRender;
|
||||
const { __ } = wp.i18n;
|
||||
|
||||
/**
|
||||
* Dropdown of published pages with a leading "default" choice.
|
||||
* Values are page IDs; 0 means the default behaviour.
|
||||
*/
|
||||
function PageSelect(props) {
|
||||
const pages = useSelect(
|
||||
(select) => select('core').getEntityRecords('postType', 'page', {
|
||||
per_page: -1,
|
||||
orderby: 'title',
|
||||
order: 'asc',
|
||||
status: 'publish',
|
||||
_fields: 'id,title',
|
||||
}),
|
||||
[]
|
||||
);
|
||||
|
||||
const options = [{ label: props.defaultLabel, value: '0' }].concat(
|
||||
(pages || []).map((page) => ({
|
||||
label: (page.title && page.title.rendered) || __('(no title)', 'unsupervised-schedular'),
|
||||
value: String(page.id),
|
||||
}))
|
||||
);
|
||||
|
||||
return el(SelectControl, {
|
||||
label: props.label,
|
||||
help: props.help,
|
||||
value: String(props.value || 0),
|
||||
options: options,
|
||||
onChange: (value) => props.onChange(parseInt(value, 10) || 0),
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Dropdown of active group classes fetched from the plugin's public
|
||||
* offerings endpoint. Values are offering IDs; 0 means all classes.
|
||||
*/
|
||||
function GroupClassSelect(props) {
|
||||
const [offerings, setOfferings] = useState(null);
|
||||
|
||||
useEffect(() => {
|
||||
apiFetch({ path: '/us-scheduler/v1/offerings?kind=group_class' })
|
||||
.then(setOfferings)
|
||||
.catch(() => setOfferings([]));
|
||||
}, []);
|
||||
|
||||
const options = [{ label: __('All classes', 'unsupervised-schedular'), value: '0' }].concat(
|
||||
(offerings || []).map((o) => ({
|
||||
label: o.title || __('(no title)', 'unsupervised-schedular'),
|
||||
value: String(o.id),
|
||||
}))
|
||||
);
|
||||
|
||||
// A previously chosen class that is no longer offered (deleted or
|
||||
// deactivated) keeps its stored id visible instead of silently
|
||||
// pretending "All classes" is selected.
|
||||
const value = String(props.value || 0);
|
||||
if (offerings !== null && !options.some((opt) => opt.value === value)) {
|
||||
options.push({
|
||||
label: __('Unavailable class #', 'unsupervised-schedular') + value,
|
||||
value: value,
|
||||
});
|
||||
}
|
||||
|
||||
return el(SelectControl, {
|
||||
label: props.label,
|
||||
help: props.help,
|
||||
value: value,
|
||||
options: options,
|
||||
onChange: (newValue) => props.onChange(parseInt(newValue, 10) || 0),
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Dropdown of active private-lesson types fetched from the plugin's public
|
||||
* offerings endpoint. Values are offering IDs; 0 means every type.
|
||||
*/
|
||||
function LessonTypeSelect(props) {
|
||||
const [offerings, setOfferings] = useState(null);
|
||||
|
||||
useEffect(() => {
|
||||
apiFetch({ path: '/us-scheduler/v1/offerings?kind=private_lesson' })
|
||||
.then(setOfferings)
|
||||
.catch(() => setOfferings([]));
|
||||
}, []);
|
||||
|
||||
const options = [{ label: __('All lesson types', 'unsupervised-schedular'), value: '0' }].concat(
|
||||
(offerings || []).map((o) => ({
|
||||
label: o.duration_minutes
|
||||
? `${o.title} (${o.duration_minutes} min)`
|
||||
: (o.title || __('(no title)', 'unsupervised-schedular')),
|
||||
value: String(o.id),
|
||||
}))
|
||||
);
|
||||
|
||||
// A previously chosen type that is no longer offered keeps its stored
|
||||
// id visible instead of silently pretending "All lesson types" is set.
|
||||
const value = String(props.value || 0);
|
||||
if (offerings !== null && !options.some((opt) => opt.value === value)) {
|
||||
options.push({
|
||||
label: __('Unavailable lesson type #', 'unsupervised-schedular') + value,
|
||||
value: value,
|
||||
});
|
||||
}
|
||||
|
||||
return el(SelectControl, {
|
||||
label: props.label,
|
||||
help: props.help,
|
||||
value: value,
|
||||
options: options,
|
||||
onChange: (newValue) => props.onChange(parseInt(newValue, 10) || 0),
|
||||
});
|
||||
}
|
||||
|
||||
const blocks = [
|
||||
{
|
||||
name: 'us-scheduler/booking',
|
||||
title: __('Lesson Booking', 'unsupervised-schedular'),
|
||||
description: __('Lets students browse availability and book lessons. Shows a styled preview in the editor.', 'unsupervised-schedular'),
|
||||
icon: 'calendar-alt',
|
||||
keywords: ['booking', 'lesson', 'schedule'],
|
||||
shortcode: 'us_booking',
|
||||
attributes: {
|
||||
loginPageId: { type: 'number', default: 0 },
|
||||
autoRedirect: { type: 'boolean', default: false },
|
||||
lessonTypeId: { type: 'number', default: 0 },
|
||||
showTypeFilter: { type: 'boolean', default: true },
|
||||
displayMode: { type: 'string', default: 'both' },
|
||||
},
|
||||
inspector: (attributes, setAttributes) => [
|
||||
el(
|
||||
PanelBody,
|
||||
{ title: __('What to show', 'unsupervised-schedular'), key: 'display' },
|
||||
el(SelectControl, {
|
||||
label: __('Sections', 'unsupervised-schedular'),
|
||||
help: __('Split the page in two: a booking calendar here, the student’s upcoming lessons somewhere else.', 'unsupervised-schedular'),
|
||||
value: attributes.displayMode || 'both',
|
||||
options: [
|
||||
{ label: __('Booking and upcoming lessons', 'unsupervised-schedular'), value: 'both' },
|
||||
{ label: __('Booking only', 'unsupervised-schedular'), value: 'booking' },
|
||||
{ label: __('Upcoming lessons only', 'unsupervised-schedular'), value: 'upcoming' },
|
||||
],
|
||||
onChange: (displayMode) => setAttributes({ displayMode }),
|
||||
})
|
||||
),
|
||||
el(
|
||||
PanelBody,
|
||||
{ title: __('Lesson types', 'unsupervised-schedular'), key: 'lesson-types' },
|
||||
el(LessonTypeSelect, {
|
||||
label: __('Lesson type', 'unsupervised-schedular'),
|
||||
help: __('Show only the times bookable as one lesson type, for embedding on a page dedicated to it. That type is then the only one students can book here.', 'unsupervised-schedular'),
|
||||
value: attributes.lessonTypeId,
|
||||
onChange: (lessonTypeId) => setAttributes({ lessonTypeId }),
|
||||
}),
|
||||
el(ToggleControl, {
|
||||
label: __('Show the lesson-type filter', 'unsupervised-schedular'),
|
||||
help: __('Offer students the “Show Only” button that narrows the calendar to chosen lesson types. Not used when a single lesson type is set above.', 'unsupervised-schedular'),
|
||||
checked: attributes.showTypeFilter !== false,
|
||||
onChange: (showTypeFilter) => setAttributes({ showTypeFilter }),
|
||||
})
|
||||
),
|
||||
el(
|
||||
PanelBody,
|
||||
{ title: __('Logged-out visitors', 'unsupervised-schedular'), key: 'logged-out' },
|
||||
el(PageSelect, {
|
||||
label: __('Login page', 'unsupervised-schedular'),
|
||||
help: __('Where the log-in link sends visitors who are not logged in.', 'unsupervised-schedular'),
|
||||
defaultLabel: __('WordPress login screen', 'unsupervised-schedular'),
|
||||
value: attributes.loginPageId,
|
||||
onChange: (loginPageId) => setAttributes({ loginPageId }),
|
||||
}),
|
||||
el(ToggleControl, {
|
||||
label: __('Redirect automatically', 'unsupervised-schedular'),
|
||||
help: __('Send logged-out visitors straight to the login page instead of showing a link.', 'unsupervised-schedular'),
|
||||
checked: !!attributes.autoRedirect,
|
||||
onChange: (autoRedirect) => setAttributes({ autoRedirect }),
|
||||
})
|
||||
),
|
||||
],
|
||||
},
|
||||
{
|
||||
name: 'us-scheduler/student-login',
|
||||
title: __('Student Login', 'unsupervised-schedular'),
|
||||
description: __('The front-end login form for students.', 'unsupervised-schedular'),
|
||||
icon: 'admin-users',
|
||||
keywords: ['login', 'student', 'sign in'],
|
||||
shortcode: 'us_student_login',
|
||||
attributes: {
|
||||
bookingPageId: { type: 'number', default: 0 },
|
||||
autoRedirect: { type: 'boolean', default: false },
|
||||
},
|
||||
inspector: (attributes, setAttributes) => el(
|
||||
PanelBody,
|
||||
{ title: __('Logged-in visitors', 'unsupervised-schedular') },
|
||||
el(PageSelect, {
|
||||
label: __('Booking page', 'unsupervised-schedular'),
|
||||
help: __('Where students are sent after logging in, and where the link shown to already-logged-in visitors points.', 'unsupervised-schedular'),
|
||||
defaultLabel: __('This page', 'unsupervised-schedular'),
|
||||
value: attributes.bookingPageId,
|
||||
onChange: (bookingPageId) => setAttributes({ bookingPageId }),
|
||||
}),
|
||||
el(ToggleControl, {
|
||||
label: __('Redirect automatically', 'unsupervised-schedular'),
|
||||
help: __('Send logged-in visitors straight to the booking page instead of showing a link. Requires a booking page to be chosen.', 'unsupervised-schedular'),
|
||||
checked: !!attributes.autoRedirect,
|
||||
onChange: (autoRedirect) => setAttributes({ autoRedirect }),
|
||||
})
|
||||
),
|
||||
},
|
||||
{
|
||||
name: 'us-scheduler/student-register',
|
||||
title: __('Student Registration', 'unsupervised-schedular'),
|
||||
description: __('The invite-only student registration form.', 'unsupervised-schedular'),
|
||||
icon: 'welcome-add-page',
|
||||
keywords: ['register', 'student', 'invite'],
|
||||
shortcode: 'us_student_register',
|
||||
attributes: {
|
||||
loginPageId: { type: 'number', default: 0 },
|
||||
autoRedirect: { type: 'boolean', default: false },
|
||||
inviteOnlyMessage: { type: 'string', default: '' },
|
||||
},
|
||||
inspector: (attributes, setAttributes) => [
|
||||
el(
|
||||
PanelBody,
|
||||
{ title: __('After registration', 'unsupervised-schedular'), key: 'confirmation' },
|
||||
el(PageSelect, {
|
||||
label: __('Sign-in page', 'unsupervised-schedular'),
|
||||
help: __('Where students are sent once registration finishes — after they confirm their email address, or straight away for an invited student.', 'unsupervised-schedular'),
|
||||
defaultLabel: __('WordPress login screen', 'unsupervised-schedular'),
|
||||
value: attributes.loginPageId,
|
||||
onChange: (loginPageId) => setAttributes({ loginPageId }),
|
||||
}),
|
||||
el(ToggleControl, {
|
||||
label: __('Redirect automatically', 'unsupervised-schedular'),
|
||||
help: __('Send students straight to that page instead of showing the link. Requires a page to be chosen; errors and the "check your email" step are never skipped.', 'unsupervised-schedular'),
|
||||
checked: !!attributes.autoRedirect,
|
||||
onChange: (autoRedirect) => setAttributes({ autoRedirect }),
|
||||
})
|
||||
),
|
||||
el(
|
||||
PanelBody,
|
||||
{ title: __('Invitation-only notice', 'unsupervised-schedular'), key: 'invite-only' },
|
||||
el(TextareaControl, {
|
||||
label: __('Message', 'unsupervised-schedular'),
|
||||
help: __('Shown when registration is invite-only and the visitor has no valid invite link. Leave blank to use the default wording.', 'unsupervised-schedular'),
|
||||
value: attributes.inviteOnlyMessage,
|
||||
onChange: (inviteOnlyMessage) => setAttributes({ inviteOnlyMessage }),
|
||||
})
|
||||
),
|
||||
],
|
||||
},
|
||||
{
|
||||
name: 'us-scheduler/group-classes',
|
||||
title: __('Group Classes', 'unsupervised-schedular'),
|
||||
description: __('Lets students browse and enrol in group classes. Shows a styled preview in the editor.', 'unsupervised-schedular'),
|
||||
icon: 'groups',
|
||||
keywords: ['group', 'class', 'enrol'],
|
||||
shortcode: 'us_group_classes',
|
||||
attributes: {
|
||||
offeringId: { type: 'number', default: 0 },
|
||||
},
|
||||
inspector: (attributes, setAttributes) => el(
|
||||
PanelBody,
|
||||
{ title: __('Classes shown', 'unsupervised-schedular') },
|
||||
el(GroupClassSelect, {
|
||||
label: __('Class', 'unsupervised-schedular'),
|
||||
help: __('Show only one group class, for embedding on a page dedicated to it. That class’s description is left out — the card shows just the schedule, price and enrolment controls.', 'unsupervised-schedular'),
|
||||
value: attributes.offeringId,
|
||||
onChange: (offeringId) => setAttributes({ offeringId }),
|
||||
})
|
||||
),
|
||||
},
|
||||
{
|
||||
name: 'us-scheduler/family',
|
||||
title: __('Profile', 'unsupervised-schedular'),
|
||||
description: __('Lets a parent or guardian add, edit and remove the students they book lessons for.', 'unsupervised-schedular'),
|
||||
icon: 'groups',
|
||||
// 'family' and 'children' are kept as search terms only — they are
|
||||
// never displayed, and the block answered to them before it was
|
||||
// renamed, so anyone reaching for the old word still finds it.
|
||||
keywords: ['profile', 'students', 'family', 'children', 'guardian', 'parent'],
|
||||
shortcode: 'us_family',
|
||||
attributes: {
|
||||
loginPageId: { type: 'number', default: 0 },
|
||||
},
|
||||
inspector: (attributes, setAttributes) => el(
|
||||
PanelBody,
|
||||
{ title: __('Logged-out visitors', 'unsupervised-schedular') },
|
||||
el(PageSelect, {
|
||||
label: __('Login page', 'unsupervised-schedular'),
|
||||
help: __('Where visitors who are not signed in are sent to log in.', 'unsupervised-schedular'),
|
||||
defaultLabel: __('WordPress login screen', 'unsupervised-schedular'),
|
||||
value: attributes.loginPageId,
|
||||
onChange: (loginPageId) => setAttributes({ loginPageId }),
|
||||
})
|
||||
),
|
||||
},
|
||||
{
|
||||
name: 'us-scheduler/account',
|
||||
title: __('Account', 'unsupervised-schedular'),
|
||||
description: __('Shows the name and email of whoever is signed in, with a sign out link. Renders nothing for signed-out visitors unless a login page is chosen.', 'unsupervised-schedular'),
|
||||
icon: 'admin-users',
|
||||
keywords: ['account', 'sign out', 'log out', 'signed in', 'profile'],
|
||||
shortcode: 'us_account',
|
||||
attributes: {
|
||||
loginPageId: { type: 'number', default: 0 },
|
||||
},
|
||||
inspector: (attributes, setAttributes) => el(
|
||||
PanelBody,
|
||||
{ title: __('Signing in and out', 'unsupervised-schedular') },
|
||||
el(PageSelect, {
|
||||
label: __('Login page', 'unsupervised-schedular'),
|
||||
help: __('Where signing out returns to, and where signed-out visitors are offered a link to sign in. Without one, signing out returns to the current page and signed-out visitors see nothing.', 'unsupervised-schedular'),
|
||||
defaultLabel: __('Stay on the current page', 'unsupervised-schedular'),
|
||||
value: attributes.loginPageId,
|
||||
onChange: (loginPageId) => setAttributes({ loginPageId }),
|
||||
})
|
||||
),
|
||||
},
|
||||
];
|
||||
|
||||
blocks.forEach((def) => {
|
||||
registerBlockType(def.name, {
|
||||
apiVersion: 3,
|
||||
title: def.title,
|
||||
description: def.description,
|
||||
icon: def.icon,
|
||||
category: 'widgets',
|
||||
keywords: def.keywords,
|
||||
supports: { html: false, multiple: false },
|
||||
attributes: def.attributes || {},
|
||||
example: {},
|
||||
edit: function Edit(props) {
|
||||
const inspector = def.inspector
|
||||
? el(InspectorControls, {}, def.inspector(props.attributes, props.setAttributes))
|
||||
: null;
|
||||
|
||||
return el(
|
||||
'div',
|
||||
useBlockProps(),
|
||||
inspector,
|
||||
el(ServerSideRender, { block: def.name, attributes: props.attributes })
|
||||
);
|
||||
},
|
||||
save: () => null,
|
||||
transforms: {
|
||||
from: [{ type: 'shortcode', tag: def.shortcode }],
|
||||
},
|
||||
});
|
||||
});
|
||||
}());
|
||||
+36
-626
@@ -5,22 +5,11 @@
|
||||
const app = document.getElementById('us-booking-app');
|
||||
if (!app) return;
|
||||
|
||||
const slotList = document.getElementById('us-slot-list');
|
||||
const myLessons = document.getElementById('us-my-lessons');
|
||||
const confirm = document.getElementById('us-booking-confirmation');
|
||||
const errorBox = document.getElementById('us-booking-error');
|
||||
const slotList = document.getElementById('us-slot-list');
|
||||
const confirm = document.getElementById('us-booking-confirmation');
|
||||
const errorBox = document.getElementById('us-booking-error');
|
||||
const { restUrl, nonce } = usScheduler;
|
||||
|
||||
// Per-instance options from the block/shortcode: pin the page to a single
|
||||
// lesson type, and whether the "Show Only" filter is offered at all.
|
||||
const pinnedTypeId = Number(app.dataset.lessonType) || 0;
|
||||
const filterEnabled = app.dataset.typeFilter !== '0';
|
||||
|
||||
// Who this account may book for — children first, the account holder last,
|
||||
// so a guardian's default selection is a child rather than themselves. A
|
||||
// single-student account has one entry and gets no picker.
|
||||
const students = window.usGuardian.parseStudents(app.dataset.students);
|
||||
|
||||
function apiFetch(path, options = {}) {
|
||||
return fetch(restUrl + path, {
|
||||
...options,
|
||||
@@ -54,13 +43,7 @@
|
||||
}
|
||||
|
||||
const dayKey = (dt) => String(dt).slice(0, 10);
|
||||
|
||||
// "2026-07-06 14:30:00" → "2:30 PM"
|
||||
function timeOf(dt) {
|
||||
const hours = Number(String(dt).slice(11, 13));
|
||||
const minutes = String(dt).slice(14, 16);
|
||||
return `${hours % 12 || 12}:${minutes} ${hours < 12 ? 'AM' : 'PM'}`;
|
||||
}
|
||||
const timeOf = (dt) => String(dt).slice(11, 16);
|
||||
|
||||
function dayLabel(key) {
|
||||
const date = new Date(key + 'T00:00:00');
|
||||
@@ -70,12 +53,6 @@
|
||||
});
|
||||
}
|
||||
|
||||
function shortDayLabel(key) {
|
||||
const date = new Date(key + 'T00:00:00');
|
||||
if (Number.isNaN(date.getTime())) return key;
|
||||
return date.toLocaleDateString(undefined, { weekday: 'short', month: 'short', day: 'numeric' });
|
||||
}
|
||||
|
||||
function groupByDay(slots) {
|
||||
const groups = new Map();
|
||||
slots.forEach((slot) => {
|
||||
@@ -86,128 +63,14 @@
|
||||
return [...groups.entries()].sort((a, b) => a[0].localeCompare(b[0]));
|
||||
}
|
||||
|
||||
// --- calendar view state (week is the default; week keeps its position) ---
|
||||
let allSlots = [];
|
||||
let view = 'week';
|
||||
let weekStart = null;
|
||||
|
||||
// Every active private-lesson type the student may book, across instructors.
|
||||
let catalog = [];
|
||||
|
||||
// Lesson types the student has filtered the calendar down to; empty means
|
||||
// "no filter" — every open slot is shown. The list starts collapsed behind
|
||||
// the "Show Only" button and stays open across re-renders once revealed.
|
||||
const selectedTypeIds = new Set();
|
||||
let filterOpen = false;
|
||||
|
||||
// Whether an offering can be booked into a slot — the client-side mirror of
|
||||
// the rule `POST /bookings` enforces: a slot tied to an offering takes that
|
||||
// offering only, and a generic slot takes any of its instructor's types
|
||||
// whose length fits.
|
||||
function offeringFitsSlot(offering, slot) {
|
||||
if (Number(offering.instructor_id) !== Number(slot.instructor_id)) return false;
|
||||
|
||||
const tiedId = Number(slot.offering_id) || 0;
|
||||
if (tiedId) return Number(offering.id) === tiedId;
|
||||
|
||||
return !offering.duration_minutes
|
||||
|| Number(offering.duration_minutes) === Number(slot.duration_minutes);
|
||||
}
|
||||
|
||||
const filterActive = () => selectedTypeIds.size > 0;
|
||||
|
||||
const typeSelected = (offering) => !filterActive() || selectedTypeIds.has(Number(offering.id));
|
||||
|
||||
// The lesson types this slot could be booked as, honouring the filter.
|
||||
function slotChoices(slot) {
|
||||
return catalog.filter((o) => offeringFitsSlot(o, slot) && typeSelected(o));
|
||||
}
|
||||
|
||||
// With a filter set, a slot is only shown when one of the chosen lesson
|
||||
// types can actually be booked into it.
|
||||
function visibleSlots() {
|
||||
if (!filterActive()) return allSlots;
|
||||
return allSlots.filter((slot) => slotChoices(slot).length > 0);
|
||||
}
|
||||
|
||||
const pad = (n) => String(n).padStart(2, '0');
|
||||
const toKey = (d) => `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())}`;
|
||||
|
||||
function addDays(key, days) {
|
||||
const date = new Date(key + 'T00:00:00');
|
||||
date.setDate(date.getDate() + days);
|
||||
return toKey(date);
|
||||
}
|
||||
|
||||
// First day of the week containing `key`, honouring the site's
|
||||
// start-of-week setting (0 = Sunday … 6 = Saturday).
|
||||
function weekStartOf(key) {
|
||||
const startOfWeek = Number(usScheduler.startOfWeek) || 0;
|
||||
const date = new Date(key + 'T00:00:00');
|
||||
return addDays(key, -((date.getDay() - startOfWeek + 7) % 7));
|
||||
}
|
||||
|
||||
// The calendar's control row: the view toggle, and the button that reveals
|
||||
// the lesson-type filter beneath it.
|
||||
function controlsHtml() {
|
||||
return `
|
||||
<div class="us-calendar-controls">
|
||||
<div class="us-view-toggle" role="group" aria-label="Calendar view">
|
||||
<button type="button" id="us-view-list" class="${view === 'list' ? 'us-active' : ''}">List</button>
|
||||
<button type="button" id="us-view-week" class="${view === 'week' ? 'us-active' : ''}">Week</button>
|
||||
</div>
|
||||
${filterToggleHtml()}
|
||||
</div>`;
|
||||
}
|
||||
|
||||
// Nothing to filter with a single bookable type, so the control only
|
||||
// appears once there is a choice to make.
|
||||
function filterToggleHtml() {
|
||||
if (!filterEnabled || catalog.length < 2) return '';
|
||||
|
||||
const count = filterActive() ? ` (${selectedTypeIds.size})` : '';
|
||||
|
||||
return `
|
||||
<button type="button" id="us-filter-toggle" class="us-filter-toggle${filterActive() ? ' us-active' : ''}"
|
||||
aria-expanded="${filterOpen}" aria-controls="us-type-filter">Show Only${count}</button>`;
|
||||
}
|
||||
|
||||
// "Piano Lesson (30 min)" — the instructor's name is only worth the space
|
||||
// when the catalog spans more than one of them.
|
||||
function filterLabel(offering) {
|
||||
const duration = offering.duration_minutes ? ` (${offering.duration_minutes} min)` : '';
|
||||
const instructors = new Set(catalog.map((o) => Number(o.instructor_id)));
|
||||
const who = instructors.size > 1 && offering.instructor_name
|
||||
? ` — ${offering.instructor_name}`
|
||||
: '';
|
||||
return `${offering.title}${duration}${who}`;
|
||||
}
|
||||
|
||||
// The lesson-type list itself — collapsed until the student opens it, and
|
||||
// rendered between the control row and the calendar.
|
||||
function filterHtml() {
|
||||
if (!filterEnabled || catalog.length < 2 || !filterOpen) return '';
|
||||
|
||||
const choices = catalog.map((o) => `
|
||||
<label class="us-type-filter-choice">
|
||||
<input type="checkbox" class="us-type-filter-option" value="${o.id}" ${selectedTypeIds.has(Number(o.id)) ? 'checked' : ''}>
|
||||
${escHtml(filterLabel(o))}
|
||||
</label>
|
||||
`).join('');
|
||||
|
||||
return `
|
||||
<div class="us-type-filter" id="us-type-filter" role="group" aria-label="Filter by lesson type">
|
||||
<span class="us-type-filter-heading">Lesson type</span>
|
||||
<div class="us-type-filter-choices">
|
||||
${choices}
|
||||
${filterActive() ? '<button type="button" id="us-type-filter-clear" class="us-type-filter-clear">Show all types</button>' : ''}
|
||||
</div>
|
||||
</div>`;
|
||||
}
|
||||
|
||||
// Agenda-style calendar: available slots grouped by day.
|
||||
function listHtml(slots) {
|
||||
return groupByDay(slots).map(([key, daySlots]) => `
|
||||
function renderSlots(slots) {
|
||||
if (!slots.length) {
|
||||
slotList.innerHTML = '<p>No available lesson slots at this time.</p>';
|
||||
return;
|
||||
}
|
||||
|
||||
slotList.innerHTML = groupByDay(slots).map(([key, daySlots]) => `
|
||||
<div class="us-day">
|
||||
<h3 class="us-day-heading">${escHtml(dayLabel(key))}</h3>
|
||||
${daySlots.map((slot) => `
|
||||
@@ -218,129 +81,10 @@
|
||||
`).join('')}
|
||||
</div>
|
||||
`).join('');
|
||||
}
|
||||
|
||||
// Weekly calendar: seven day columns with a bookable button per slot.
|
||||
function weekHtml(slots) {
|
||||
const byDay = new Map(groupByDay(slots));
|
||||
const days = [...Array(7).keys()].map((i) => addDays(weekStart, i));
|
||||
|
||||
const columns = days.map((key) => {
|
||||
const daySlots = byDay.get(key) || [];
|
||||
const buttons = daySlots.map((slot) => `
|
||||
<button data-slot-id="${slot.id}" class="us-book-btn us-week-slot" title="${escHtml(String(slot.duration_minutes))} min">
|
||||
${escHtml(timeOf(slot.start_dt))}
|
||||
</button>
|
||||
`).join('');
|
||||
|
||||
return `
|
||||
<div class="us-week-day">
|
||||
<h4 class="us-week-day-heading">${escHtml(shortDayLabel(key))}</h4>
|
||||
${buttons || '<span class="us-week-empty" aria-hidden="true">—</span>'}
|
||||
</div>`;
|
||||
}).join('');
|
||||
|
||||
return `
|
||||
<div class="us-week-nav">
|
||||
<button type="button" id="us-week-prev">‹ Previous week</button>
|
||||
<strong class="us-week-label">Week of ${escHtml(shortDayLabel(weekStart))}</strong>
|
||||
<button type="button" id="us-week-next">Next week ›</button>
|
||||
</div>
|
||||
<div class="us-week-grid">${columns}</div>`;
|
||||
}
|
||||
|
||||
function render() {
|
||||
const slots = visibleSlots();
|
||||
|
||||
// The pinned lesson type is no longer on offer (deactivated or
|
||||
// deleted), so this page has nothing it is allowed to book.
|
||||
if (pinnedTypeId && !catalog.length) {
|
||||
slotList.innerHTML = '<p>This lesson type is not available for booking right now.</p>';
|
||||
return;
|
||||
}
|
||||
|
||||
// Nothing open at all: there is nothing for the controls to act on.
|
||||
if (!allSlots.length) {
|
||||
slotList.innerHTML = '<p>No available lesson slots at this time.</p>';
|
||||
return;
|
||||
}
|
||||
|
||||
if (!slots.length) {
|
||||
const message = pinnedTypeId
|
||||
? '<p>No open times for this lesson type right now.</p>'
|
||||
: '<p>No open times match the selected lesson types.</p>';
|
||||
|
||||
slotList.innerHTML = controlsHtml() + filterHtml() + message;
|
||||
wireControlEvents();
|
||||
return;
|
||||
}
|
||||
|
||||
// Anchor the week view to the week of the earliest matching slot (the
|
||||
// API returns slots ordered by start), so the first look is never empty.
|
||||
if (view === 'week' && !weekStart) weekStart = weekStartOf(dayKey(slots[0].start_dt));
|
||||
|
||||
slotList.innerHTML = controlsHtml() + filterHtml() + (view === 'week' ? weekHtml(slots) : listHtml(slots));
|
||||
wireControlEvents();
|
||||
wireCalendarEvents();
|
||||
}
|
||||
|
||||
function wireControlEvents() {
|
||||
document.getElementById('us-view-list').addEventListener('click', () => {
|
||||
view = 'list';
|
||||
render();
|
||||
});
|
||||
document.getElementById('us-view-week').addEventListener('click', () => {
|
||||
view = 'week';
|
||||
render();
|
||||
});
|
||||
|
||||
const toggle = document.getElementById('us-filter-toggle');
|
||||
if (toggle) {
|
||||
toggle.addEventListener('click', () => {
|
||||
filterOpen = !filterOpen;
|
||||
render();
|
||||
});
|
||||
}
|
||||
|
||||
slotList.querySelectorAll('.us-type-filter-option').forEach((input) => {
|
||||
input.addEventListener('change', () => {
|
||||
const id = Number(input.value);
|
||||
if (input.checked) {
|
||||
selectedTypeIds.add(id);
|
||||
} else {
|
||||
selectedTypeIds.delete(id);
|
||||
}
|
||||
// The nearest matching time may be weeks away, so re-anchor the
|
||||
// week view instead of leaving the student on an empty week.
|
||||
weekStart = null;
|
||||
render();
|
||||
});
|
||||
});
|
||||
|
||||
const clear = document.getElementById('us-type-filter-clear');
|
||||
if (clear) {
|
||||
clear.addEventListener('click', () => {
|
||||
selectedTypeIds.clear();
|
||||
weekStart = null;
|
||||
render();
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
function wireCalendarEvents() {
|
||||
const prev = document.getElementById('us-week-prev');
|
||||
const next = document.getElementById('us-week-next');
|
||||
if (prev) prev.addEventListener('click', () => { weekStart = addDays(weekStart, -7); render(); });
|
||||
if (next) next.addEventListener('click', () => { weekStart = addDays(weekStart, 7); render(); });
|
||||
|
||||
slotList.querySelectorAll('.us-book-btn[data-slot-id]').forEach((btn) => {
|
||||
const slot = allSlots.find((s) => String(s.id) === btn.dataset.slotId);
|
||||
if (slot) {
|
||||
btn.addEventListener('click', () => {
|
||||
hideConfirmation();
|
||||
openRegistration(slot);
|
||||
});
|
||||
}
|
||||
slotList.querySelectorAll('.us-book-btn').forEach((btn) => {
|
||||
const slot = slots.find((s) => String(s.id) === btn.dataset.slotId);
|
||||
btn.addEventListener('click', () => openRegistration(slot));
|
||||
});
|
||||
}
|
||||
|
||||
@@ -370,91 +114,23 @@
|
||||
</div>`;
|
||||
}
|
||||
|
||||
// "Piano Lesson (60 min — 50.00 CAD at booking)" / "Trial Lesson (Free)"
|
||||
function offeringLabel(o) {
|
||||
const duration = o.duration_minutes ? `${o.duration_minutes} min — ` : '';
|
||||
return `${o.title} (${duration}${window.usPricing.priceLabel(o)})`;
|
||||
}
|
||||
|
||||
// How many lessons a weekly reservation can claim, mirroring
|
||||
// BookingEndpoint::MAX_WEEKLY_OCCURRENCES so the quoted total is never
|
||||
// higher than the server will actually charge for.
|
||||
const MAX_WEEKLY_OCCURRENCES = 12;
|
||||
|
||||
// The open times a weekly reservation of this slot would claim: every
|
||||
// still-unbooked slot of its recurring group, capped the way the server
|
||||
// caps it. Some may be taken by another student first, so this is the
|
||||
// upper bound on what will be booked, not a guarantee.
|
||||
function weeklyOccurrences(slot) {
|
||||
if (!slot.recurrence_group) return 1;
|
||||
|
||||
const inGroup = allSlots.filter((s) => s.recurrence_group === slot.recurrence_group).length;
|
||||
|
||||
return Math.min(Math.max(inGroup, 1), MAX_WEEKLY_OCCURRENCES);
|
||||
}
|
||||
|
||||
function openRegistration(slot) {
|
||||
clearError();
|
||||
|
||||
apiFetch('policies?scope=booking')
|
||||
.then((policies) => renderRegistration(slot, policies))
|
||||
const offeringId = Number(slot.offering_id) || 0;
|
||||
const qPath = offeringId ? `offerings/${offeringId}/questions` : null;
|
||||
|
||||
Promise.all([
|
||||
qPath ? apiFetch(qPath) : Promise.resolve([]),
|
||||
apiFetch('policies?scope=booking'),
|
||||
])
|
||||
.then(([questions, policies]) => {
|
||||
renderRegistration(slot, offeringId, questions, policies);
|
||||
})
|
||||
.catch((err) => showError(err.message));
|
||||
}
|
||||
|
||||
function offeringFieldHtml(tied, tiedId, choices) {
|
||||
if (tiedId) {
|
||||
// The slot is tied to one offering: show it locked so the student
|
||||
// sees exactly what they are booking.
|
||||
const label = tied ? offeringLabel(tied) : `Offering #${tiedId}`;
|
||||
return `
|
||||
<p class="us-offering">
|
||||
<label>Lesson type<br>
|
||||
<select id="us-offering" disabled><option>${escHtml(label)}</option></select></label>
|
||||
</p>`;
|
||||
}
|
||||
|
||||
// Only one type is left to book this slot as — usually because the
|
||||
// filter narrowed it down — so it is chosen for the student.
|
||||
if (choices.length === 1) {
|
||||
return `
|
||||
<p class="us-offering">
|
||||
<label>Lesson type<br>
|
||||
<select id="us-offering" required>
|
||||
<option value="${choices[0].id}" selected>${escHtml(offeringLabel(choices[0]))}</option>
|
||||
</select></label>
|
||||
</p>`;
|
||||
}
|
||||
|
||||
return `
|
||||
<p class="us-offering">
|
||||
<label>Lesson type<br>
|
||||
<select id="us-offering" required>
|
||||
<option value="">— Choose a lesson type —</option>
|
||||
${choices.map((o) => `<option value="${o.id}">${escHtml(offeringLabel(o))}</option>`).join('')}
|
||||
</select></label>
|
||||
</p>`;
|
||||
}
|
||||
|
||||
function renderRegistration(slot, policies) {
|
||||
const tiedId = Number(slot.offering_id) || 0;
|
||||
const tied = tiedId ? catalog.find((o) => Number(o.id) === tiedId) : null;
|
||||
|
||||
// Generic slots offer every lesson type that fits the slot — narrowed to
|
||||
// the filtered types when the student has set a filter.
|
||||
const choices = tiedId ? [] : slotChoices(slot);
|
||||
|
||||
if (!tiedId && !choices.length) {
|
||||
// The server rejects offering-less bookings, so without a matching
|
||||
// lesson type this time cannot be booked online.
|
||||
slotList.innerHTML = `
|
||||
<div class="us-register">
|
||||
<p>This time cannot be booked online right now. Please contact the instructor.</p>
|
||||
<p><button type="button" id="us-cancel" class="us-cancel-btn">Back</button></p>
|
||||
</div>`;
|
||||
document.getElementById('us-cancel').addEventListener('click', loadSlots);
|
||||
return;
|
||||
}
|
||||
|
||||
function renderRegistration(slot, offeringId, questions, policies) {
|
||||
const weekly = slot.recurrence_group
|
||||
? `<p><label><input type="checkbox" id="us-weekly"> Reserve this time weekly for the term</label></p>`
|
||||
: '';
|
||||
@@ -463,12 +139,9 @@
|
||||
<div class="us-register">
|
||||
<h3>${escHtml(dayLabel(dayKey(slot.start_dt)))} · ${escHtml(timeOf(slot.start_dt))}–${escHtml(timeOf(slot.end_dt))}</h3>
|
||||
<form id="us-register-form">
|
||||
${window.usGuardian.selectorHtml(students, 'us-booking-student')}
|
||||
${offeringFieldHtml(tied, tiedId, choices)}
|
||||
<div id="us-questions"></div>
|
||||
${questions.map(questionField).join('')}
|
||||
${policies.map(policyField).join('')}
|
||||
${weekly}
|
||||
<div id="us-price-summary"></div>
|
||||
<p>
|
||||
<button type="submit" class="us-book-btn">Confirm Booking</button>
|
||||
<button type="button" id="us-cancel" class="us-cancel-btn">Back</button>
|
||||
@@ -476,73 +149,10 @@
|
||||
</form>
|
||||
</div>`;
|
||||
|
||||
// The intake questions belong to the selected offering, so they follow
|
||||
// the picker instead of being fixed at render time. A tied slot — or a
|
||||
// lone remaining type — is already decided, so its questions load
|
||||
// straight away.
|
||||
let selectedId = tiedId || (choices.length === 1 ? Number(choices[0].id) : 0);
|
||||
let questions = [];
|
||||
|
||||
const questionsBox = document.getElementById('us-questions');
|
||||
const priceBox = document.getElementById('us-price-summary');
|
||||
const weeklyEl = document.getElementById('us-weekly');
|
||||
|
||||
// What the booking will cost and the agreement to pay it, restated
|
||||
// whenever the choices that decide the amount change: the lesson type
|
||||
// carries the price, and a weekly reservation multiplies a per-lesson
|
||||
// one-time price by every week it claims. A slot tied to a type the
|
||||
// catalog no longer carries has no price to quote, so it shows nothing
|
||||
// rather than a figure it cannot stand behind.
|
||||
function renderPrice() {
|
||||
const offering = selectedId ? catalog.find((o) => Number(o.id) === selectedId) : null;
|
||||
priceBox.innerHTML = offering
|
||||
? window.usPricing.summaryHtml({
|
||||
price: offering.price,
|
||||
currency: offering.currency,
|
||||
billing_mode: offering.billing_mode,
|
||||
kind: offering.kind,
|
||||
occurrences: weeklyEl && weeklyEl.checked ? weeklyOccurrences(slot) : 1,
|
||||
})
|
||||
: '';
|
||||
}
|
||||
|
||||
function loadQuestions() {
|
||||
questions = [];
|
||||
questionsBox.innerHTML = '';
|
||||
if (!selectedId) return;
|
||||
apiFetch(`offerings/${selectedId}/questions`)
|
||||
.then((qs) => {
|
||||
questions = qs;
|
||||
questionsBox.innerHTML = qs.map(questionField).join('');
|
||||
})
|
||||
.catch((err) => showError(err.message));
|
||||
}
|
||||
|
||||
if (!tiedId) {
|
||||
document.getElementById('us-offering').addEventListener('change', (e) => {
|
||||
selectedId = Number(e.target.value) || 0;
|
||||
loadQuestions();
|
||||
renderPrice();
|
||||
});
|
||||
}
|
||||
|
||||
if (weeklyEl) weeklyEl.addEventListener('change', renderPrice);
|
||||
|
||||
loadQuestions();
|
||||
renderPrice();
|
||||
|
||||
document.getElementById('us-cancel').addEventListener('click', loadSlots);
|
||||
document.getElementById('us-register-form').addEventListener('submit', (e) => {
|
||||
e.preventDefault();
|
||||
if (!selectedId) {
|
||||
showError('Please choose a lesson type.');
|
||||
return;
|
||||
}
|
||||
if (!window.usPricing.agreed(e.target)) {
|
||||
showError(window.usPricing.AGREE_REQUIRED);
|
||||
return;
|
||||
}
|
||||
submitBooking(e.target, slot, selectedId, questions);
|
||||
submitBooking(e.target, slot, offeringId, questions);
|
||||
});
|
||||
}
|
||||
|
||||
@@ -564,228 +174,28 @@
|
||||
body: JSON.stringify({
|
||||
slot_id: slot.id,
|
||||
offering_id: offeringId,
|
||||
student_id: window.usGuardian.selectedId('us-booking-student'),
|
||||
recurrence: weeklyEl && weeklyEl.checked ? 'weekly' : 'single',
|
||||
answers,
|
||||
accepted_policy_version_ids: accepted,
|
||||
}),
|
||||
})
|
||||
// A booking with nothing owed has no payment, so there is no payment
|
||||
// step to run — the booking is already confirmed server-side.
|
||||
.then((res) => (res.payment
|
||||
? window.usPayment.collect('lesson', (res.ids || [])[0], slotList)
|
||||
: null))
|
||||
.then((result) => {
|
||||
const message = window.usPayment.message(result);
|
||||
|
||||
// Order matters: loadSlots() clears any standing notice, and it
|
||||
// is what puts the calendar back with the booked slot gone.
|
||||
return loadSlots().then(() => showConfirmation(message));
|
||||
})
|
||||
.then((res) => window.usPayment.collect('lesson', (res.ids || [])[0], slotList))
|
||||
.then((result) => showConfirmation(window.usPayment.message(result)))
|
||||
.catch((err) => showError(err.message));
|
||||
}
|
||||
|
||||
function lessonStatusLabel(status) {
|
||||
if (status === 'pending') return 'Pending payment';
|
||||
if (status === 'confirmed') return 'Confirmed';
|
||||
// A group-class session carries its enrolment's status, and "active"
|
||||
// reads as jargon next to "Confirmed".
|
||||
if (status === 'active') return 'Enrolled';
|
||||
return status.charAt(0).toUpperCase() + status.slice(1);
|
||||
}
|
||||
|
||||
// How many upcoming lessons to show before the "Show all" reveal.
|
||||
const INITIAL_LESSON_COUNT = 5;
|
||||
|
||||
// Whose lesson this is. Only shown on an account that books for more than
|
||||
// one person — on a single-student account the name is on every row and says
|
||||
// nothing.
|
||||
function lessonWhoHtml(l) {
|
||||
if (students.length < 2 || !l.student_name) return '';
|
||||
|
||||
return ` <span class="us-my-lesson-who">— ${escHtml(String(l.student_name))}</span>`;
|
||||
}
|
||||
|
||||
// A group-class session is a date in a term, not a booked slot: there is no
|
||||
// lesson to cancel and no time to release, so it carries no Cancel button.
|
||||
// Withdrawing from the class is a separate decision, made on the class page.
|
||||
function isGroupSession(l) {
|
||||
return l.kind === 'group_class';
|
||||
}
|
||||
|
||||
// When a row meets. A class with no class time set has no clock to put it on,
|
||||
// so it carries `schedule` — the studio's own wording, or its term dates — and
|
||||
// that is shown verbatim in place of a date and time. A dated row with no
|
||||
// duration knows when it starts but not when it ends, and says only that
|
||||
// rather than inventing a finish.
|
||||
function lessonWhenHtml(l) {
|
||||
if (l.schedule) {
|
||||
return escHtml(String(l.schedule));
|
||||
}
|
||||
|
||||
const when = `${escHtml(dayLabel(dayKey(l.start_dt)))} · ${escHtml(timeOf(l.start_dt))}`;
|
||||
|
||||
return l.end_dt ? `${when}–${escHtml(timeOf(l.end_dt))}` : when;
|
||||
}
|
||||
|
||||
function lessonRowHtml(l) {
|
||||
const group = isGroupSession(l);
|
||||
const title = l.offering_title ? escHtml(String(l.offering_title)) : (group ? 'Group class' : 'Lesson');
|
||||
const duration = l.duration_minutes ? ` <span class="us-my-lesson-duration">(${escHtml(String(l.duration_minutes))} min)</span>` : '';
|
||||
const badge = group ? ' <span class="us-my-lesson-kind">Group class</span>' : '';
|
||||
const action = group ? '' : `<button type="button" class="us-cancel-lesson" data-lesson-id="${l.id}">Cancel</button>`;
|
||||
// The two columns are divs, not spans: as spans the layout only held up
|
||||
// while the stylesheet's display:flex won, and a theme rule on span
|
||||
// collapsed the row onto itself.
|
||||
return `
|
||||
<div class="us-my-lesson">
|
||||
<div class="us-my-lesson-info">
|
||||
<strong class="us-my-lesson-title">${title}${duration}${badge}${lessonWhoHtml(l)}</strong>
|
||||
<span class="us-my-lesson-when">${lessonWhenHtml(l)}</span>
|
||||
</div>
|
||||
<div class="us-my-lesson-actions">
|
||||
<span class="us-lesson-status us-lesson-status-${escHtml(String(l.status))}">${escHtml(lessonStatusLabel(String(l.status)))}</span>
|
||||
${action}
|
||||
</div>
|
||||
</div>`;
|
||||
}
|
||||
|
||||
function renderMyLessons(lessons) {
|
||||
const upcoming = lessons.filter((l) => l.start_dt);
|
||||
if (!upcoming.length) {
|
||||
myLessons.innerHTML = '';
|
||||
return;
|
||||
}
|
||||
|
||||
// Show only the soonest few by default; the rest sit hidden behind a
|
||||
// reveal so a busy student's list stays short.
|
||||
const visible = upcoming.slice(0, INITIAL_LESSON_COUNT);
|
||||
const hidden = upcoming.slice(INITIAL_LESSON_COUNT);
|
||||
|
||||
// Named for what the list actually holds now that group-class sessions
|
||||
// sit in it alongside booked lessons.
|
||||
const heading = upcoming.some(isGroupSession)
|
||||
? 'Your upcoming lessons and classes'
|
||||
: 'Your upcoming lessons';
|
||||
|
||||
myLessons.innerHTML = `
|
||||
<div class="us-my-lessons">
|
||||
<h3>${heading}</h3>
|
||||
${visible.map(lessonRowHtml).join('')}
|
||||
${hidden.length ? `
|
||||
<div class="us-my-lessons-more" hidden>${hidden.map(lessonRowHtml).join('')}</div>
|
||||
<button type="button" class="us-show-all-lessons">Show all ${upcoming.length}</button>
|
||||
` : ''}
|
||||
</div>`;
|
||||
|
||||
const moreBox = myLessons.querySelector('.us-my-lessons-more');
|
||||
const showAll = myLessons.querySelector('.us-show-all-lessons');
|
||||
if (showAll && moreBox) {
|
||||
showAll.addEventListener('click', () => {
|
||||
moreBox.hidden = false;
|
||||
showAll.remove();
|
||||
});
|
||||
}
|
||||
|
||||
myLessons.querySelectorAll('.us-cancel-lesson').forEach((btn) => {
|
||||
btn.addEventListener('click', () => cancelLesson(Number(btn.dataset.lessonId)));
|
||||
});
|
||||
}
|
||||
|
||||
function cancelLesson(id) {
|
||||
if (!window.confirm('Cancel this lesson? The time will be released for other students.')) {
|
||||
return;
|
||||
}
|
||||
clearError();
|
||||
apiFetch(`bookings/${id}/cancel`, { method: 'POST' })
|
||||
.then(loadSlots)
|
||||
.catch((err) => showError(err.message));
|
||||
}
|
||||
|
||||
function loadMyLessons() {
|
||||
if (!myLessons) return;
|
||||
// The lesson list is a bonus panel: never let it break slot browsing.
|
||||
apiFetch('bookings')
|
||||
.then(renderMyLessons)
|
||||
.catch(() => { myLessons.innerHTML = ''; });
|
||||
}
|
||||
|
||||
/**
|
||||
* Report a completed booking without taking the calendar away.
|
||||
*
|
||||
* This used to hide the slot list and leave the confirmation as the whole
|
||||
* page, which is a dead end: the student had nothing to click and no way
|
||||
* back to booking short of reloading. The notice now sits above a freshly
|
||||
* loaded calendar, so "it worked" and "you can book again" are the same
|
||||
* screen.
|
||||
*
|
||||
* Built from nodes rather than innerHTML because the message can carry a
|
||||
* studio's e-transfer address.
|
||||
*/
|
||||
function showConfirmation(message) {
|
||||
confirm.textContent = '';
|
||||
|
||||
const text = document.createElement('p');
|
||||
text.textContent = message;
|
||||
|
||||
const dismiss = document.createElement('button');
|
||||
dismiss.type = 'button';
|
||||
dismiss.className = 'us-notice-dismiss';
|
||||
dismiss.textContent = 'Dismiss';
|
||||
dismiss.addEventListener('click', hideConfirmation);
|
||||
|
||||
confirm.appendChild(text);
|
||||
confirm.appendChild(dismiss);
|
||||
|
||||
// The `hidden` attribute rather than an inline display, which would
|
||||
// outrank the stylesheet's `display: flex` and stack the notice's
|
||||
// parts instead of laying them out in a row.
|
||||
confirm.hidden = false;
|
||||
confirm.textContent = message;
|
||||
slotList.style.display = 'none';
|
||||
confirm.style.display = 'block';
|
||||
}
|
||||
|
||||
function hideConfirmation() {
|
||||
if (!confirm) return;
|
||||
confirm.hidden = true;
|
||||
confirm.textContent = '';
|
||||
}
|
||||
|
||||
// The private-lesson catalog drives both the filter and the registration
|
||||
// form's lesson-type picker, and it does not change while the student
|
||||
// browses — so it is fetched once and kept.
|
||||
let catalogLoaded = false;
|
||||
|
||||
function loadCatalog() {
|
||||
if (catalogLoaded) return Promise.resolve(catalog);
|
||||
return apiFetch('offerings?kind=private_lesson').then((list) => {
|
||||
// A pinned lesson type is the only one this page may book, so the
|
||||
// catalog is narrowed to it and the filter is fixed on it. With a
|
||||
// single type left the "Show Only" control hides itself.
|
||||
catalog = pinnedTypeId
|
||||
? list.filter((o) => Number(o.id) === pinnedTypeId)
|
||||
: list;
|
||||
|
||||
if (pinnedTypeId) selectedTypeIds.add(pinnedTypeId);
|
||||
|
||||
catalogLoaded = true;
|
||||
return catalog;
|
||||
});
|
||||
}
|
||||
|
||||
/** Returns the load, so a caller can act once the calendar is back. */
|
||||
function loadSlots() {
|
||||
clearError();
|
||||
loadMyLessons();
|
||||
|
||||
// An upcoming-lessons-only embed has no calendar to fill.
|
||||
if (!slotList) return Promise.resolve();
|
||||
|
||||
hideConfirmation();
|
||||
|
||||
return Promise.all([apiFetch('availability'), loadCatalog()])
|
||||
.then(([slots]) => {
|
||||
allSlots = slots;
|
||||
render();
|
||||
})
|
||||
slotList.style.display = 'block';
|
||||
confirm.style.display = 'none';
|
||||
apiFetch('availability')
|
||||
.then(renderSlots)
|
||||
.catch((err) => showError(err.message));
|
||||
}
|
||||
|
||||
|
||||
+16
-177
@@ -10,17 +10,6 @@
|
||||
const errorBox = document.getElementById('us-group-error');
|
||||
const { restUrl, nonce } = usScheduler;
|
||||
|
||||
// When the shortcode/block pins a single offering, only that class is
|
||||
// shown, so the page can be embedded alongside a full class description.
|
||||
// The class's own description is then omitted from the card — the page it
|
||||
// sits on already describes the class — leaving the schedule, price and
|
||||
// enrolment controls.
|
||||
const singleOfferingId = Number(app.dataset.offering || 0);
|
||||
|
||||
// Who this account may enrol — children first, the account holder last, so a
|
||||
// guardian's default selection is a child. One entry means no picker.
|
||||
const students = window.usGuardian.parseStudents(app.dataset.students);
|
||||
|
||||
function apiFetch(path, options = {}) {
|
||||
return fetch(restUrl + path, {
|
||||
...options,
|
||||
@@ -79,119 +68,27 @@
|
||||
</div>`;
|
||||
}
|
||||
|
||||
// Parse a Y-m-d date into local time; new Date('Y-m-d') would parse as
|
||||
// UTC midnight and can display as the previous day in western timezones.
|
||||
function formatDate(ymd) {
|
||||
const [y, m, d] = ymd.split('-').map(Number);
|
||||
return new Date(y, m - 1, d).toLocaleDateString(undefined, { year: 'numeric', month: 'short', day: 'numeric' });
|
||||
}
|
||||
|
||||
function termLabel(o) {
|
||||
if (!o.term_start) return '';
|
||||
if (!o.term_end || o.term_end === o.term_start) {
|
||||
return formatDate(o.term_start);
|
||||
}
|
||||
const weekMs = 7 * 24 * 60 * 60 * 1000;
|
||||
const sessions = Math.round((new Date(o.term_end) - new Date(o.term_start)) / weekMs) + 1;
|
||||
return `${formatDate(o.term_start)} – ${formatDate(o.term_end)} (${sessions} weekly sessions)`;
|
||||
}
|
||||
|
||||
// Format a stored H:i(:s) class time as a friendly local-clock label.
|
||||
function timeLabel(o) {
|
||||
if (!o.class_time) return '';
|
||||
const [h, m] = o.class_time.split(':').map(Number);
|
||||
const d = new Date();
|
||||
d.setHours(h, m, 0, 0);
|
||||
return d.toLocaleTimeString(undefined, { hour: 'numeric', minute: '2-digit' });
|
||||
}
|
||||
|
||||
// The "when" line combines the date (or date range) with the class time.
|
||||
function whenLabel(o) {
|
||||
return [termLabel(o), timeLabel(o)].filter(Boolean).join(' · ');
|
||||
}
|
||||
|
||||
// Today as a Y-m-d string in the visitor's local timezone, for lexicographic
|
||||
// comparison against the class's Y-m-d enrolment deadline.
|
||||
function todayYmd() {
|
||||
const now = new Date();
|
||||
return `${now.getFullYear()}-${String(now.getMonth() + 1).padStart(2, '0')}-${String(now.getDate()).padStart(2, '0')}`;
|
||||
}
|
||||
|
||||
// The effective enrolment deadline: the instructor's set deadline, or the
|
||||
// first class day by default. Empty when the class has no dates at all.
|
||||
function enrolmentDeadline(o) {
|
||||
return o.enrollment_deadline || o.term_start || '';
|
||||
}
|
||||
|
||||
// Enrolment closes at the end of the deadline day. Mirrors the server-side
|
||||
// Offering::isEnrollmentOpen() gate.
|
||||
function isEnrollmentOpen(o) {
|
||||
const deadline = enrolmentDeadline(o);
|
||||
return !deadline || todayYmd() <= deadline;
|
||||
}
|
||||
|
||||
// Self-withdrawal closes at the end of the withdrawal-deadline day. Unlike
|
||||
// enrolment there is no implicit default: an unset deadline keeps withdrawal
|
||||
// open. Mirrors the server-side Offering::isWithdrawalOpen() gate.
|
||||
function isWithdrawalOpen(o) {
|
||||
return !o.withdrawal_deadline || todayYmd() <= o.withdrawal_deadline;
|
||||
}
|
||||
|
||||
function renderClasses(offerings, enrolledMap) {
|
||||
let groups = offerings.filter((o) => o.kind === 'group_class');
|
||||
if (singleOfferingId) {
|
||||
groups = groups.filter((o) => Number(o.id) === singleOfferingId);
|
||||
}
|
||||
function renderClasses(offerings) {
|
||||
const groups = offerings.filter((o) => o.kind === 'group_class');
|
||||
if (!groups.length) {
|
||||
list.innerHTML = singleOfferingId
|
||||
? '<p>This class is not open for enrolment right now.</p>'
|
||||
: '<p>No group classes are open for enrolment right now.</p>';
|
||||
list.innerHTML = '<p>No group classes are open for enrolment right now.</p>';
|
||||
return;
|
||||
}
|
||||
|
||||
list.innerHTML = groups.map((o) => `
|
||||
<div class="us-class">
|
||||
<h3>${escHtml(o.title)}</h3>
|
||||
${whenLabel(o) ? `<p class="us-class-when">${escHtml(whenLabel(o))}</p>` : ''}
|
||||
${o.instructor_name ? `<p class="us-class-instructor">With ${escHtml(o.instructor_name)}</p>` : ''}
|
||||
${o.schedule_note ? `<p>${escHtml(o.schedule_note)}</p>` : ''}
|
||||
${!singleOfferingId && o.description ? `<p>${escHtml(o.description)}</p>` : ''}
|
||||
<p class="us-class-price">${escHtml(window.usPricing.priceLabel(o))}</p>
|
||||
${!enrolledMap.has(Number(o.id)) && isEnrollmentOpen(o) && enrolmentDeadline(o)
|
||||
? `<p class="us-enrol-deadline">Enrol by ${escHtml(formatDate(enrolmentDeadline(o)))}</p>`
|
||||
: ''}
|
||||
${enrolledMap.has(Number(o.id))
|
||||
? `<p class="us-enrolled"><strong>You are enrolled in this class.</strong></p>
|
||||
${isWithdrawalOpen(o)
|
||||
? `<button data-enrollment-id="${enrolledMap.get(Number(o.id))}" class="us-withdraw-btn">Withdraw</button>`
|
||||
: '<p class="us-withdraw-closed">Withdrawal has closed — contact the studio to withdraw.</p>'}`
|
||||
: (isEnrollmentOpen(o)
|
||||
? `<button data-offering-id="${o.id}" class="us-enrol-btn">Enrol</button>`
|
||||
: '<p class="us-enrol-closed"><strong>Enrolment has closed.</strong></p>')}
|
||||
${o.description ? `<p>${escHtml(o.description)}</p>` : ''}
|
||||
<p>${escHtml(Number(o.price).toFixed(2))} ${escHtml(o.currency)}</p>
|
||||
<button data-offering-id="${o.id}" class="us-enrol-btn">Enrol</button>
|
||||
</div>
|
||||
`).join('');
|
||||
|
||||
list.querySelectorAll('.us-enrol-btn').forEach((btn) => {
|
||||
const offering = groups.find((o) => String(o.id) === btn.dataset.offeringId);
|
||||
btn.addEventListener('click', () => {
|
||||
hideConfirmation();
|
||||
openEnrolment(offering);
|
||||
});
|
||||
btn.addEventListener('click', () => openEnrolment(offering));
|
||||
});
|
||||
|
||||
list.querySelectorAll('.us-withdraw-btn').forEach((btn) => {
|
||||
btn.addEventListener('click', () => withdraw(btn.dataset.enrollmentId));
|
||||
});
|
||||
}
|
||||
|
||||
function withdraw(enrollmentId) {
|
||||
clearError();
|
||||
if (!window.confirm('Withdraw from this class? Your seat is released and any pending payment is cancelled.')) {
|
||||
return;
|
||||
}
|
||||
apiFetch(`enrollments/${enrollmentId}/withdraw`, { method: 'POST' })
|
||||
.then(loadClasses)
|
||||
.catch((err) => showError(err.message));
|
||||
}
|
||||
|
||||
function openEnrolment(offering) {
|
||||
@@ -209,10 +106,8 @@
|
||||
<div class="us-register">
|
||||
<h3>${escHtml(offering.title)}</h3>
|
||||
<form id="us-enrol-form">
|
||||
${window.usGuardian.selectorHtml(students, 'us-enrol-student')}
|
||||
${questions.map(questionField).join('')}
|
||||
${policies.map(policyField).join('')}
|
||||
${window.usPricing.summaryHtml(offering)}
|
||||
<p>
|
||||
<button type="submit" class="us-enrol-btn">Confirm Enrolment</button>
|
||||
<button type="button" id="us-group-cancel" class="us-cancel-btn">Back</button>
|
||||
@@ -223,10 +118,6 @@
|
||||
document.getElementById('us-group-cancel').addEventListener('click', loadClasses);
|
||||
document.getElementById('us-enrol-form').addEventListener('submit', (e) => {
|
||||
e.preventDefault();
|
||||
if (!window.usPricing.agreed(e.target)) {
|
||||
showError(window.usPricing.AGREE_REQUIRED);
|
||||
return;
|
||||
}
|
||||
submitEnrolment(e.target, offering, questions);
|
||||
});
|
||||
}
|
||||
@@ -247,79 +138,27 @@
|
||||
method: 'POST',
|
||||
body: JSON.stringify({
|
||||
offering_id: offering.id,
|
||||
student_id: window.usGuardian.selectedId('us-enrol-student'),
|
||||
answers,
|
||||
accepted_policy_version_ids: accepted,
|
||||
}),
|
||||
})
|
||||
// An enrolment with nothing owed has no payment, so there is no
|
||||
// payment step to run.
|
||||
.then((res) => (res.payment
|
||||
? window.usPayment.collect('enrollment', res.id, list)
|
||||
: null))
|
||||
.then((result) => {
|
||||
const message = window.usPayment.message(result);
|
||||
|
||||
// Order matters: loadClasses() clears any standing notice, and
|
||||
// it is what puts the list back showing the new enrolment.
|
||||
return loadClasses().then(() => showConfirmation(message));
|
||||
})
|
||||
.then((res) => window.usPayment.collect('enrollment', res.id, list))
|
||||
.then((result) => showConfirmation(window.usPayment.message(result)))
|
||||
.catch((err) => showError(err.message));
|
||||
}
|
||||
|
||||
/**
|
||||
* Report a completed enrolment without taking the class list away. Hiding
|
||||
* the list left the student on a dead-end screen with no way back to
|
||||
* browsing short of a reload; the notice now sits above a freshly loaded
|
||||
* list instead. Mirrors booking.js.
|
||||
*
|
||||
* Built from nodes rather than innerHTML because the message can carry a
|
||||
* studio's e-transfer address.
|
||||
*/
|
||||
function showConfirmation(message) {
|
||||
confirm.textContent = '';
|
||||
|
||||
const text = document.createElement('p');
|
||||
text.textContent = message;
|
||||
|
||||
const dismiss = document.createElement('button');
|
||||
dismiss.type = 'button';
|
||||
dismiss.className = 'us-notice-dismiss';
|
||||
dismiss.textContent = 'Dismiss';
|
||||
dismiss.addEventListener('click', hideConfirmation);
|
||||
|
||||
confirm.appendChild(text);
|
||||
confirm.appendChild(dismiss);
|
||||
|
||||
// The `hidden` attribute rather than an inline display, which would
|
||||
// outrank the stylesheet's `display: flex` and stack the notice's
|
||||
// parts instead of laying them out in a row.
|
||||
confirm.hidden = false;
|
||||
confirm.textContent = message;
|
||||
list.style.display = 'none';
|
||||
confirm.style.display = 'block';
|
||||
}
|
||||
|
||||
function hideConfirmation() {
|
||||
confirm.hidden = true;
|
||||
confirm.textContent = '';
|
||||
}
|
||||
|
||||
/** Returns the load, so a caller can act once the list is back. */
|
||||
function loadClasses() {
|
||||
clearError();
|
||||
hideConfirmation();
|
||||
// The student's own enrolments are fetched alongside the catalog so a
|
||||
// class they already have an active enrolment in shows its status
|
||||
// instead of offering to enrol them again (the API would reject the
|
||||
// duplicate anyway). A cancelled enrolment does not block re-enrolling.
|
||||
return Promise.all([
|
||||
apiFetch('offerings?kind=group_class'),
|
||||
apiFetch('enrollments'),
|
||||
])
|
||||
.then(([offerings, enrollments]) => renderClasses(
|
||||
offerings,
|
||||
new Map(enrollments
|
||||
.filter((e) => e.status === 'active')
|
||||
.map((e) => [Number(e.offering_id), e.id]))
|
||||
))
|
||||
list.style.display = 'block';
|
||||
confirm.style.display = 'none';
|
||||
apiFetch('offerings?kind=group_class')
|
||||
.then(renderClasses)
|
||||
.catch((err) => showError(err.message));
|
||||
}
|
||||
|
||||
|
||||
@@ -1,68 +0,0 @@
|
||||
/**
|
||||
* "Who is this for?" picker, shared by the lesson-booking and group-class
|
||||
* registration forms.
|
||||
*
|
||||
* The list arrives from the server already ordered children-first, with the
|
||||
* account holder last, and this module preserves that order: a guardian's
|
||||
* default selection is their first child, never themselves. Booking for the
|
||||
* wrong child is a correctable mistake; quietly enrolling the parent in a class
|
||||
* meant for their kid is not.
|
||||
*/
|
||||
(function () {
|
||||
'use strict';
|
||||
|
||||
function escHtml(str) {
|
||||
return String(str)
|
||||
.replace(/&/g, '&')
|
||||
.replace(/</g, '<')
|
||||
.replace(/>/g, '>')
|
||||
.replace(/"/g, '"');
|
||||
}
|
||||
|
||||
/**
|
||||
* Read the server-rendered student list off a `data-students` attribute.
|
||||
* Anything unparseable degrades to an empty list, which renders no picker
|
||||
* and books for the signed-in user — the pre-guardian behaviour.
|
||||
*/
|
||||
function parseStudents(raw) {
|
||||
if (!raw) return [];
|
||||
try {
|
||||
const list = JSON.parse(raw);
|
||||
return Array.isArray(list) ? list : [];
|
||||
} catch (e) {
|
||||
return [];
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* The picker's markup, or an empty string when there is nothing to choose:
|
||||
* an account with only itself on the list never sees the question.
|
||||
*/
|
||||
function selectorHtml(students, id) {
|
||||
if (!students || students.length < 2) return '';
|
||||
|
||||
const options = students.map((s) => {
|
||||
// The account holder reads as "Myself" — their own name next to their
|
||||
// children's is ambiguous about which row is the parent.
|
||||
const label = s.is_self ? `Myself (${s.name})` : s.name;
|
||||
return `<option value="${Number(s.id)}">${escHtml(label)}</option>`;
|
||||
}).join('');
|
||||
|
||||
return `
|
||||
<p class="us-student-picker">
|
||||
<label for="${id}">Who is this for?<br>
|
||||
<select id="${id}" required>${options}</select></label>
|
||||
</p>`;
|
||||
}
|
||||
|
||||
/**
|
||||
* The chosen student id, or 0 when no picker was rendered — the server
|
||||
* reads 0 as "the caller books for themselves".
|
||||
*/
|
||||
function selectedId(id) {
|
||||
const el = document.getElementById(id);
|
||||
return el ? Number(el.value) || 0 : 0;
|
||||
}
|
||||
|
||||
window.usGuardian = { parseStudents, selectorHtml, selectedId };
|
||||
}());
|
||||
@@ -1,170 +0,0 @@
|
||||
/* global usScheduler */
|
||||
(function () {
|
||||
'use strict';
|
||||
|
||||
// Cadence wording for each offering billing mode, in the phrasing a student
|
||||
// sees beside a price. Mirrors Offering::VALID_BILLING_MODES.
|
||||
const CADENCE = {
|
||||
one_time: 'at booking',
|
||||
full_term: 'up front',
|
||||
weekly: 'weekly',
|
||||
monthly: 'monthly',
|
||||
};
|
||||
|
||||
// How each cadence is actually collected, spelled out beneath the price so
|
||||
// the one-word cadence is never the only thing a student has to go on.
|
||||
const CADENCE_NOTE = {
|
||||
one_time: 'Charged once, when you book.',
|
||||
full_term: 'Charged once, up front, for the whole term.',
|
||||
weekly: 'Charged for each lesson, 24 hours before it starts.',
|
||||
monthly: 'Charged on the 1st of each month, for that month’s lessons.',
|
||||
};
|
||||
|
||||
// The billing modes whose price is a per-lesson fee billed again and again,
|
||||
// rather than a single charge. Mirrors Offering::SCHEDULED_BILLING_MODES.
|
||||
const RECURRING = ['weekly', 'monthly'];
|
||||
|
||||
function escHtml(str) {
|
||||
return String(str)
|
||||
.replace(/&/g, '&')
|
||||
.replace(/</g, '<')
|
||||
.replace(/>/g, '>')
|
||||
.replace(/"/g, '"');
|
||||
}
|
||||
|
||||
function mode(billingMode) {
|
||||
return CADENCE[billingMode] ? billingMode : 'one_time';
|
||||
}
|
||||
|
||||
// A monthly charge rolls up every lesson that falls in the month, so a
|
||||
// private lesson's monthly price is quoted *per lesson* — the fee is
|
||||
// multiplied by the lessons booked that month. A group class is enrolled in
|
||||
// once, as one schedule, so its monthly figure is quoted as it stands.
|
||||
function isPerLessonMonthly(billingMode, kind) {
|
||||
return 'monthly' === billingMode && 'group_class' !== kind;
|
||||
}
|
||||
|
||||
// "50.00 CAD" — amount then currency code, the format used throughout the
|
||||
// ledger, receipts and payment notices.
|
||||
function money(amount, currency) {
|
||||
return `${(Number(amount) || 0).toFixed(2)} ${String(currency || '')}`.trim();
|
||||
}
|
||||
|
||||
// The studio's HST rate as a percentage, frozen onto every payment at
|
||||
// booking time (comped students are the one exception — they are not taxed).
|
||||
function taxRate() {
|
||||
return Number(usScheduler.taxRate) || 0;
|
||||
}
|
||||
|
||||
// Tax on a pre-tax amount, rounded the same way PaymentService does.
|
||||
function tax(amount) {
|
||||
return Math.round((Number(amount) || 0) * taxRate()) / 100;
|
||||
}
|
||||
|
||||
function total(amount) {
|
||||
return (Number(amount) || 0) + tax(amount);
|
||||
}
|
||||
|
||||
// "50.00 CAD at booking" / "50.00 CAD per lesson monthly" / "Free" — the
|
||||
// catalogue label, always carrying the cadence so a price is never shown
|
||||
// without saying when it is due.
|
||||
function priceLabel(offering) {
|
||||
const price = Number(offering.price) || 0;
|
||||
if (price <= 0) {
|
||||
return 'Free';
|
||||
}
|
||||
|
||||
const billingMode = mode(offering.billing_mode);
|
||||
const perLesson = isPerLessonMonthly(billingMode, offering.kind) ? 'per lesson ' : '';
|
||||
|
||||
return `${money(price, offering.currency)} ${perLesson}${CADENCE[billingMode]}`;
|
||||
}
|
||||
|
||||
// The price block shown on a booking/enrolment form, followed by the
|
||||
// agreement the student must tick to confirm they will pay it. A free
|
||||
// offering has nothing to agree to, so it renders nothing at all.
|
||||
//
|
||||
// opts: { price, currency, billing_mode, kind, occurrences }
|
||||
// `occurrences` is how many lessons a one-time price is charged for in this
|
||||
// one registration (a weekly reservation claims several at once); it is
|
||||
// ignored for the other modes, whose price is charged per period regardless.
|
||||
function summaryHtml(opts) {
|
||||
const price = Number(opts.price) || 0;
|
||||
if (price <= 0) {
|
||||
return '';
|
||||
}
|
||||
|
||||
const billingMode = mode(opts.billing_mode);
|
||||
const currency = opts.currency;
|
||||
const each = total(price);
|
||||
const count = 'one_time' === billingMode ? Math.max(1, Number(opts.occurrences) || 1) : 1;
|
||||
|
||||
const taxLine = taxRate() > 0
|
||||
? `<p class="us-price-tax">${escHtml(`Plus ${taxRate()}% HST — ${money(each, currency)}${count > 1 ? ' per lesson' : ''}.`)}</p>`
|
||||
: '';
|
||||
|
||||
return `
|
||||
<div class="us-price">
|
||||
<h4>Price</h4>
|
||||
<p class="us-price-amount">
|
||||
<strong>${escHtml(money(price, currency))}</strong>
|
||||
<span class="us-price-cadence">${escHtml(cadenceLabel(billingMode, opts.kind))}</span>
|
||||
</p>
|
||||
${taxLine}
|
||||
<p class="us-price-note">${escHtml(count > 1
|
||||
? 'Charged once, when you book — for every week reserved.'
|
||||
: CADENCE_NOTE[billingMode])}</p>
|
||||
<label class="us-price-agree">
|
||||
<input type="checkbox" class="us-price-accept" required>
|
||||
${escHtml(agreeText(each, currency, billingMode, count, opts.kind))}
|
||||
</label>
|
||||
</div>`;
|
||||
}
|
||||
|
||||
// The cadence as it reads beside an amount: a private lesson billed monthly
|
||||
// adds "per lesson", since the month's charge is that fee times the lessons
|
||||
// it covers.
|
||||
function cadenceLabel(billingMode, kind) {
|
||||
return isPerLessonMonthly(billingMode, kind)
|
||||
? `per lesson ${CADENCE[billingMode]}`
|
||||
: CADENCE[billingMode];
|
||||
}
|
||||
|
||||
// What the student is ticking: the amount actually billed (tax included),
|
||||
// and when. A weekly reservation is charged per lesson for every week it
|
||||
// claims, and the claim can come up short when another student takes one of
|
||||
// the times first — so its total is stated as a ceiling, never a promise.
|
||||
function agreeText(each, currency, billingMode, count, kind) {
|
||||
if (RECURRING.indexOf(billingMode) !== -1) {
|
||||
// A monthly group class is enrolled in once and quoted as it stands;
|
||||
// everything else recurring is a per-lesson fee.
|
||||
return 'monthly' === billingMode && !isPerLessonMonthly(billingMode, kind)
|
||||
? `I agree to pay ${money(each, currency)} monthly.`
|
||||
: `I agree to pay ${money(each, currency)} per lesson, billed ${CADENCE[billingMode]}.`;
|
||||
}
|
||||
|
||||
if (count > 1) {
|
||||
return `I agree to pay ${money(each, currency)} per lesson at booking — `
|
||||
+ `up to ${count} lessons, ${money(each * count, currency)} in total.`;
|
||||
}
|
||||
|
||||
return `I agree to pay ${money(each, currency)} ${CADENCE[billingMode]}.`;
|
||||
}
|
||||
|
||||
// Whether the payment agreement has been ticked. A form without one (a free
|
||||
// offering) has nothing outstanding, so it counts as agreed.
|
||||
function agreed(root) {
|
||||
const box = root.querySelector('.us-price-accept');
|
||||
|
||||
return !box || box.checked;
|
||||
}
|
||||
|
||||
// Shared by the booking and group-class flows so a price reads the same
|
||||
// wherever a student meets it.
|
||||
window.usPricing = {
|
||||
priceLabel,
|
||||
summaryHtml,
|
||||
agreed,
|
||||
AGREE_REQUIRED: 'Please confirm you agree to pay the amount shown.',
|
||||
};
|
||||
}());
|
||||
@@ -1,258 +0,0 @@
|
||||
/**
|
||||
* Progressive enhancement for the student registration form.
|
||||
*
|
||||
* Two independent behaviours, both optional — without JS every panel stays
|
||||
* visible and the single submit still works:
|
||||
*
|
||||
* 1. **Who are you registering?** The student section is hidden until the
|
||||
* choice is "on behalf of students" or "both", and "Add another student"
|
||||
* clones the student block. "On behalf of students" *alone* also takes the
|
||||
* account holder's own **About you** panel out of play — they are not a
|
||||
* student in that case, so the server ignores their birth year and answers
|
||||
* and the browser must not demand them. Under "both" they are a student and
|
||||
* do fill it in.
|
||||
* 2. **Password strength.** The password is scored with zxcvbn (via WordPress's
|
||||
* own `wp.passwordStrength`) and a weak one is refused. The server applies
|
||||
* its own, coarser rule regardless — see `Auth\PasswordPolicy`.
|
||||
*/
|
||||
(function () {
|
||||
'use strict';
|
||||
|
||||
var PASSWORD = window.usSchedulerPassword || {};
|
||||
|
||||
/**
|
||||
* Gate the form on password strength.
|
||||
*
|
||||
* The verdict is attached to the field with `setCustomValidity()` rather than
|
||||
* by disabling the submit button: an invalid field blocks the submit without
|
||||
* the button having to know why.
|
||||
*
|
||||
* It is also re-scored on submit, which is the case the input handler alone
|
||||
* misses. zxcvbn's dictionary arrives after page load, and until it does the
|
||||
* meter has no opinion and the field is left valid — so a password typed in
|
||||
* the first second and submitted straight away would otherwise never be
|
||||
* scored at all, and the first the student heard of it would be the server
|
||||
* rejecting the whole form.
|
||||
*/
|
||||
function enhancePassword(form) {
|
||||
var field = form.querySelector('#us-reg-pass');
|
||||
var output = form.querySelector('#us-reg-pass-strength');
|
||||
var strings = PASSWORD.strings || {};
|
||||
|
||||
if (!field || !PASSWORD.minScore) {
|
||||
return;
|
||||
}
|
||||
|
||||
// What the password must not simply repeat back. Mirrors the identity
|
||||
// check PasswordPolicy makes server-side.
|
||||
function identity() {
|
||||
var out = [];
|
||||
var sources = form.querySelectorAll('#us-reg-email, #us-reg-name');
|
||||
|
||||
for (var i = 0; i < sources.length; i++) {
|
||||
var value = (sources[i].value || '').trim();
|
||||
if (value) {
|
||||
out.push(value);
|
||||
if (value.indexOf('@') > 0) {
|
||||
out.push(value.split('@')[0]);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return out;
|
||||
}
|
||||
|
||||
function assess() {
|
||||
var value = field.value || '';
|
||||
|
||||
if (!value) {
|
||||
report('', '');
|
||||
return;
|
||||
}
|
||||
|
||||
if (value.length < (PASSWORD.minLength || 8)) {
|
||||
report(strings.short, 'short');
|
||||
return;
|
||||
}
|
||||
|
||||
// zxcvbn's dictionary is fetched after load, and wp.passwordStrength
|
||||
// reports -1 until it arrives. Say nothing and allow the submit in that
|
||||
// window — the server still checks, and the next keystroke re-runs this
|
||||
// once the dictionary is in.
|
||||
if (!window.wp || !window.wp.passwordStrength || typeof window.zxcvbn === 'undefined') {
|
||||
report('', '');
|
||||
return;
|
||||
}
|
||||
|
||||
var score = window.wp.passwordStrength.meter(value, identity(), '');
|
||||
|
||||
if (score < 0) {
|
||||
report('', '');
|
||||
return;
|
||||
}
|
||||
|
||||
if (score >= 3) {
|
||||
report(strings.strong, 'strong');
|
||||
} else if (score >= PASSWORD.minScore) {
|
||||
report(strings.medium, 'medium');
|
||||
} else {
|
||||
report(score <= 0 ? strings.veryWeak : strings.weak, 'weak');
|
||||
}
|
||||
}
|
||||
|
||||
/** Show the verdict, and make it the field's validity at the same time. */
|
||||
function report(message, level) {
|
||||
var acceptable = '' === level || 'medium' === level || 'strong' === level;
|
||||
|
||||
if (output) {
|
||||
output.textContent = message || '';
|
||||
output.className = 'us-password-strength' + (level ? ' is-' + level : '');
|
||||
}
|
||||
|
||||
field.setCustomValidity(acceptable ? '' : message || '');
|
||||
}
|
||||
|
||||
field.addEventListener('input', assess);
|
||||
field.addEventListener('blur', assess);
|
||||
|
||||
// The identity check depends on these, so a password typed first and an
|
||||
// email typed second is still caught.
|
||||
var sources = form.querySelectorAll('#us-reg-email, #us-reg-name');
|
||||
for (var i = 0; i < sources.length; i++) {
|
||||
sources[i].addEventListener('change', assess);
|
||||
}
|
||||
|
||||
// Native validation has already run by the time `submit` fires, so a
|
||||
// verdict reached here has to stop the submit by hand.
|
||||
form.addEventListener('submit', function (event) {
|
||||
assess();
|
||||
|
||||
if (!field.checkValidity()) {
|
||||
event.preventDefault();
|
||||
field.reportValidity();
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Rewrite a cloned child block's `children[0][…]` names and ids to the new
|
||||
* index, and clear the values carried over from the block it was cloned from.
|
||||
*/
|
||||
function reindex(block, index) {
|
||||
block.setAttribute('data-child-index', String(index));
|
||||
|
||||
var fields = block.querySelectorAll('input, select, textarea');
|
||||
for (var i = 0; i < fields.length; i++) {
|
||||
var field = fields[i];
|
||||
|
||||
if (field.name) {
|
||||
field.name = field.name.replace(/^children\[\d+\]/, 'children[' + index + ']');
|
||||
}
|
||||
|
||||
var oldId = field.id;
|
||||
if (oldId) {
|
||||
field.id = oldId.replace(/^us-child-\d+-/, 'us-child-' + index + '-');
|
||||
|
||||
var label = block.querySelector('label[for="' + oldId + '"]');
|
||||
if (label) {
|
||||
label.setAttribute('for', field.id);
|
||||
}
|
||||
}
|
||||
|
||||
if (field.type === 'checkbox' || field.type === 'radio') {
|
||||
field.checked = false;
|
||||
} else {
|
||||
field.value = '';
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
function enhanceGuardian(form) {
|
||||
var choices = form.querySelectorAll('.us-registering-for');
|
||||
var children = form.querySelector('#us-children');
|
||||
var self = form.querySelector('#us-reg-self');
|
||||
|
||||
if (!choices.length || !children) {
|
||||
return;
|
||||
}
|
||||
|
||||
var addButton = children.querySelector('.us-add-child');
|
||||
var nextIndex = 1;
|
||||
|
||||
/** The selected "who are you registering?" value; 'self' if somehow none is. */
|
||||
function mode() {
|
||||
for (var i = 0; i < choices.length; i++) {
|
||||
if (choices[i].checked) return choices[i].value;
|
||||
}
|
||||
return 'self';
|
||||
}
|
||||
|
||||
/**
|
||||
* Keep the form in step with the choice.
|
||||
*
|
||||
* Two independent questions, which is why "both" needs its own answer to
|
||||
* each:
|
||||
*
|
||||
* - Are student blocks in play? For "students" and "both".
|
||||
* - Is the account holder a student themselves? For "self" and "both" —
|
||||
* only then are they asked for their own birth year and answers. A pure
|
||||
* guardian gives those per student instead.
|
||||
*
|
||||
* Each panel is disabled as well as hidden. Disabling is what actually
|
||||
* settles it: a `required` field inside a hidden container makes the form
|
||||
* unsubmittable with no way to reach the offending control, and a disabled
|
||||
* fieldset is neither validated nor submitted. The server enforces the
|
||||
* same rules either way.
|
||||
*/
|
||||
function sync() {
|
||||
var current = mode();
|
||||
var wantsStudents = current !== 'self';
|
||||
var asksSelf = current !== 'students';
|
||||
|
||||
children.hidden = !wantsStudents;
|
||||
children.disabled = !wantsStudents;
|
||||
|
||||
// Belt and braces alongside the disabled fieldset, so the required
|
||||
// state is right if a browser ever renders the block on its own.
|
||||
var required = children.querySelectorAll('[data-us-child-required]');
|
||||
for (var r = 0; r < required.length; r++) {
|
||||
required[r].required = wantsStudents;
|
||||
}
|
||||
|
||||
if (self) {
|
||||
self.hidden = !asksSelf;
|
||||
self.disabled = !asksSelf;
|
||||
}
|
||||
}
|
||||
|
||||
for (var c = 0; c < choices.length; c++) {
|
||||
choices[c].addEventListener('change', sync);
|
||||
}
|
||||
sync();
|
||||
|
||||
if (addButton) {
|
||||
addButton.addEventListener('click', function () {
|
||||
var blocks = children.querySelectorAll('.us-child');
|
||||
var clone = blocks[blocks.length - 1].cloneNode(true);
|
||||
|
||||
reindex(clone, nextIndex);
|
||||
nextIndex += 1;
|
||||
|
||||
children.insertBefore(clone, addButton.parentNode);
|
||||
|
||||
// The clone carries the data attribute but not necessarily the
|
||||
// current required state, so settle it the same way as the rest.
|
||||
sync();
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
document.addEventListener('DOMContentLoaded', function () {
|
||||
var forms = document.querySelectorAll('.us-register-form form');
|
||||
|
||||
for (var i = 0; i < forms.length; i++) {
|
||||
enhanceGuardian(forms[i]);
|
||||
enhancePassword(forms[i]);
|
||||
}
|
||||
});
|
||||
})();
|
||||
+3
-3
@@ -11,8 +11,8 @@
|
||||
"phpunit/phpunit": "^10.5",
|
||||
"brain/monkey": "^2.6",
|
||||
"mockery/mockery": "^1.6",
|
||||
"phpstan/phpstan": "^2.0",
|
||||
"szepeviktor/phpstan-wordpress": "^2.0",
|
||||
"phpstan/phpstan": "^1.10",
|
||||
"szepeviktor/phpstan-wordpress": "^1.3",
|
||||
"php-stubs/wordpress-stubs": "^6.0",
|
||||
"squizlabs/php_codesniffer": "^3.7",
|
||||
"wp-coding-standards/wpcs": "^3.0"
|
||||
@@ -30,7 +30,7 @@
|
||||
"scripts": {
|
||||
"test": "phpunit --configuration phpunit.xml",
|
||||
"test:coverage": "phpunit --configuration phpunit.xml --coverage-html coverage/",
|
||||
"lint": "phpstan analyse --configuration phpstan.neon --memory-limit=1G",
|
||||
"lint": "phpstan analyse src/ --level=6 --configuration phpstan.neon --memory-limit=1G",
|
||||
"cs": "phpcs --standard=phpcs.xml.dist",
|
||||
"cs:fix": "phpcbf --standard=phpcs.xml.dist",
|
||||
"build": "bash bin/build-zip.sh"
|
||||
|
||||
@@ -4,135 +4,27 @@
|
||||
People register for a student account through a front-end page, accepting any
|
||||
signup-scoped policies at that time. Registration is **invite-only** by default: a
|
||||
studio admin sends an invite, and the invitee completes signup via a tokenised
|
||||
link. A studio can instead switch on **open (self-approval) registration**, where
|
||||
anyone may sign up, confirm their email, and then be approved by a studio admin
|
||||
before the account can be used. Both modes coexist — invites keep working when
|
||||
open registration is on.
|
||||
|
||||
A studio admin can also generate a **group invite link** — a multi-use, tokenised
|
||||
link with an explicit expiry date (e.g. for a newsletter). Anyone with the link
|
||||
may register while it is valid, regardless of the registration mode: they supply
|
||||
their own email, must confirm it, and are then **approved automatically** —
|
||||
group-link signups never enter the Pending Students queue.
|
||||
link. A settings seam (`us_registration_mode`) allows switching to open
|
||||
self-registration with approval later.
|
||||
|
||||
## Registration Modes
|
||||
Stored in the `us_registration_mode` option (default `invite`), toggled from
|
||||
**Studio Settings → Registration**:
|
||||
- `invite` — only a valid, pending invite token grants access to the registration form.
|
||||
- `self_approval` — anyone may register on the registration page; each account is created in a pending state, must confirm its email, and is then approved (or rejected) by a studio admin.
|
||||
|
||||
### Enabling open registration
|
||||
The Studio Settings toggle is the source of truth. Enabling it mirrors into the
|
||||
two core WordPress options the flow relies on, and **snapshots** their previous
|
||||
values (`us_registration_prev_can_register`, `us_registration_prev_default_role`):
|
||||
- `users_can_register` → `1` (Settings → General "Anyone can register")
|
||||
- `default_role` → `us_student`
|
||||
|
||||
Disabling restores the snapshot, so the toggle never permanently overwrites a
|
||||
site's own membership settings. Only enable/disable *transitions* touch the core
|
||||
options — saving unrelated settings leaves them alone.
|
||||
See `Payment\StudioSettings::applyRegistrationMode()`.
|
||||
|
||||
### Blocking the native registration form
|
||||
Because `users_can_register=1` also switches on WordPress's own
|
||||
`wp-login.php?action=register` form — which cannot collect the required signup
|
||||
policy acceptances — that form is blocked while open registration is on, so it can
|
||||
never be used to create a policy-less account (`Auth\EmailConfirmationHandler`):
|
||||
- `register_url` filter points WordPress's "Register" links at the registration page.
|
||||
- `login_init` action redirects any `action=register` request (GET **and** POST) to the registration page before any processing runs.
|
||||
- `registration_errors` filter is a fail-safe that rejects `register_new_user()` outright.
|
||||
|
||||
## Account Lifecycle (self-approval)
|
||||
State lives entirely in user meta (`Auth\RegistrationStatus`). Only the raw
|
||||
confirmation token's SHA-256 hash is stored; the token expires after 48h
|
||||
(`EMAIL_CONFIRM_EXPIRY_HOURS`).
|
||||
|
||||
| State | User meta | Login | Booking |
|
||||
|---|---|---|---|
|
||||
| Email unconfirmed | `us_awaiting_approval=1`, `us_email_confirm_token`(hash) + `us_email_confirm_expires` set | blocked ("confirm your email") | — |
|
||||
| Confirmed, awaiting approval | `us_awaiting_approval=1`, `us_email_confirmed=1`, token/expiry cleared | allowed | withheld → pending screen |
|
||||
| Approved / active | `us_awaiting_approval` deleted, `us_email_confirmed=1` | allowed | full student |
|
||||
| Rejected | account hard-deleted (`wp_delete_user`) | n/a | n/a |
|
||||
| Invite/admin-created student | none of these metas | allowed | full student |
|
||||
|
||||
- **Login gate** (`Auth\RegistrationLoginGate`): the `wp_authenticate_user` filter blocks login while the email is unconfirmed; the `user_has_cap` filter withholds `book_lesson` while `us_awaiting_approval` is set, so a confirmed-but-unapproved student only reaches the "awaiting approval" screen on the booking page.
|
||||
- **Email confirmation** (`Auth\EmailConfirmationHandler` on `template_redirect`): opening the emailed `?us_confirm=<token>` link confirms the email, notifies the studio admins, and redirects back to the registration page with `?us_confirmed=1` (or `expired`). On `?us_confirmed=1` the registration page replaces the form with the confirmation message plus a "Sign in to your account" link — the configured sign-in page (block `loginPageId` / shortcode `login_page_id` attribute), falling back to the WordPress login screen. The `expired` notice keeps the form.
|
||||
- **Approval** (`Auth\RegistrationApprovalController`, **Students → Pending Students**, `manage_students`): approve clears the pending flags and emails the student; reject emails them and hard-deletes the account so the email is freed to re-apply.
|
||||
- **Emails**: `Auth\RegistrationMailer` sends the confirmation link, the admin heads-up, and the approval/rejection notices.
|
||||
Stored in the `us_registration_mode` option (default `invite`):
|
||||
- `invite` — only a valid, pending invite token grants access to the registration form. *(implemented)*
|
||||
- `self_approval` — anyone may register; the account is created in a pending state until a studio admin approves it. *(reserved for a later iteration)*
|
||||
|
||||
## Data Model — `{prefix}us_invites`
|
||||
|
||||
| Column | Type | Notes |
|
||||
|--------------------|------------------|--------------------------------------------------------|
|
||||
| `id` | BIGINT UNSIGNED | Primary key |
|
||||
| `email` | VARCHAR(191) | Invited email address; empty string for group links |
|
||||
| `token` | VARCHAR(64) | SHA-256 hash of the token embedded in the registration link (raw token is never stored) |
|
||||
| `email` | VARCHAR(191) | Invited email address |
|
||||
| `token` | VARCHAR(64) | Opaque token embedded in the registration link |
|
||||
| `role` | VARCHAR(32) | Role granted on acceptance (default `us_student`) |
|
||||
| `kind` | VARCHAR(10) | `personal` (single-use, per email) or `group` (multi-use link) |
|
||||
| `offering_id` | BIGINT UNSIGNED | Set when a personal invite is tied to an invite-only group class (see `group-classes.md`); NULL otherwise |
|
||||
| `status` | VARCHAR(20) | `pending` / `accepted` / `revoked` (group links stay `pending` until revoked/expired) |
|
||||
| `status` | VARCHAR(20) | `pending` / `accepted` / `revoked` |
|
||||
| `invited_by` | BIGINT UNSIGNED | WordPress user ID of the studio admin who invited |
|
||||
| `accepted_user_id` | BIGINT UNSIGNED | The created user's ID once accepted; NULL while pending / for group links |
|
||||
| `accepted_user_id` | BIGINT UNSIGNED | The created user's ID once accepted; NULL while pending |
|
||||
| `created_at` | DATETIME | Insertion time |
|
||||
| `accepted_at` | DATETIME | When accepted; NULL while pending / for group links |
|
||||
| `expires_at` | DATETIME | Explicit expiry (end of the chosen day); set on every group link, NULL for personal invites (which expire 14 days after creation) |
|
||||
|
||||
## Email and password validation
|
||||
|
||||
Both are checked on the server on every signup path, and the browser is given a
|
||||
matching but *stricter* job so a bad password is caught before submitting.
|
||||
|
||||
**Email** — `type="email"` and `required` in the markup, `is_email()` on the
|
||||
server, then `email_exists()` for "an account already exists for this email". A
|
||||
personal invite fixes the address and the server always uses the invite's own
|
||||
value, so a tampered field is ignored rather than validated.
|
||||
|
||||
**Password** — `Auth\PasswordPolicy` is the authority. It deliberately does
|
||||
*not* try to reproduce a strength score in PHP; it rejects the categorically
|
||||
bad, which is what a server can check without shipping a dictionary:
|
||||
|
||||
- shorter than `PasswordPolicy::MIN_LENGTH` (8 — NIST SP 800-63B's floor;
|
||||
composition rules like "must contain a symbol" are deliberately **not** used,
|
||||
as they push people towards predictable substitutions),
|
||||
- one of the well-known leaked passwords,
|
||||
- built from fewer than four distinct characters (`aaaaaaaa`, `abababab`),
|
||||
- containing the user's own display name, email, or the part before the `@`.
|
||||
|
||||
The nuance happens in the browser. `register.js` scores the password with
|
||||
zxcvbn through WordPress's own `password-strength-meter` script and refuses to
|
||||
submit below `PasswordPolicy::MIN_SCORE` (2 of 4 — "medium"; enough to stop a
|
||||
guessable password without demanding a passphrase to book a piano lesson). The
|
||||
thresholds reach JavaScript via `wp_localize_script()` from the same constants
|
||||
the server enforces, so the two cannot drift apart.
|
||||
|
||||
The verdict is applied with `setCustomValidity()` on the password field rather
|
||||
than by disabling a button: an invalid field stops the submit without the button
|
||||
needing to know why. zxcvbn's dictionary loads asynchronously, so the gate stays
|
||||
open until it arrives — the server is the check that always runs.
|
||||
|
||||
The password is also **re-scored on submit**, not only as it is typed. Native
|
||||
validation has already run by the time the `submit` event fires, so a verdict
|
||||
reached there stops the submit by hand (`preventDefault()` + `reportValidity()`).
|
||||
Without that, a password typed in the second before the dictionary arrived was
|
||||
never scored at all, and the first the person heard of it was the server
|
||||
rejecting the whole form.
|
||||
|
||||
## Registration Questions
|
||||
When the studio has configured **account-scope** registration questions
|
||||
(**Offerings → Questions → "Account signup"**, see `registration-questions.md`), they
|
||||
are asked on the main form in an **About you** panel — alongside the account
|
||||
holder's birth year, above the students they are adding, and only when they are a
|
||||
student themselves (`self` or `both`). This applies to **every** signup path
|
||||
(invite, group link, self-approval). Required answers are validated before the
|
||||
account is created, and are stored against the new user (`us_question_answers`,
|
||||
`registration_type = 'account'`). A studio admin reviews them under **Registration
|
||||
Information** on the student's admin screen.
|
||||
|
||||
The form is one page with one submit. The questions used to be a second step
|
||||
behind a "Next" button; that put what the studio needs to know about an adult
|
||||
student on a screen reached only after everything else, and the two-step gate is
|
||||
what made a weak password reachable — it advanced on a `checkValidity()` that had
|
||||
not yet scored anything.
|
||||
| `accepted_at` | DATETIME | When accepted; NULL while pending |
|
||||
|
||||
## Policy Acceptance Scope
|
||||
Policies declare **when** they must be accepted via `us_policies.acceptance_scope`:
|
||||
@@ -142,46 +34,19 @@ recorded in `us_policy_acceptances` with `registration_type = account` and
|
||||
`registration_id = <new user ID>`.
|
||||
|
||||
## Flow (invite mode)
|
||||
1. Studio admin opens **Invites** (`manage_students`) and invites an email; an invite row is created storing the token's SHA-256 hash, and the registration link (with the raw token) is shown **once** in a notice. To re-send a lost link, revoke and re-invite.
|
||||
2. The invitee opens `[us_student_register]` with the token (`?us_invite=<token>`); the lookup hashes the submitted token and matches it against the stored hash.
|
||||
3. The form shows the invited email **pre-filled and read-only** (the server always uses the invite's address on submit, so a tampered value is ignored) and collects a display name and password, and renders the signup-scoped published policies, each with a required acceptance checkbox. A token that is no longer redeemable (expired / accepted / revoked) renders the normal editable email field instead when open registration is on.
|
||||
4. On submit, the token is re-validated (hashed lookup); a `us_student` user is created, the policy acceptances are recorded (`account` type), the invite is marked `accepted`, and the user is logged in. The submission is processed on `template_redirect` (`RegistrationPage::maybeHandleSubmit()`) **before** any page output so `wp_set_auth_cookie()` actually persists — it then post/redirect/gets back to the page with `?us_registered=invite`, where the now-logged-in student sees the "created and logged in" confirmation. (Processing the form inside `render()`, which runs during `the_content`, sent the cookie after headers and left the student logged out on the next view.) If the invite carries an `offering_id` (a group-class email invite), the new account is linked to the matching access grant so the invite-only class becomes enrollable for them — see `group-classes.md`.
|
||||
|
||||
## Flow (self-approval mode)
|
||||
1. Studio admin enables **Studio Settings → Registration** and selects the registration page (shared with invites, `us_registration_page_id`).
|
||||
2. Anyone opens `[us_student_register]`; the form collects an editable email, display name, password, and the required signup policies.
|
||||
3. On submit a `us_student` user is created in the pending state (`RegistrationStatus::markPending()`), acceptances are recorded (`account` type), a confirmation email is sent, and the user is **not** logged in.
|
||||
4. The applicant opens the emailed `?us_confirm=<token>` link → email confirmed, studio admins notified.
|
||||
5. Studio admin approves under **Students → Pending Students** → pending flags cleared, student emailed; they can now log in and book. Rejection deletes the account.
|
||||
|
||||
## Flow (group invite link)
|
||||
1. Studio admin opens **Invites** and generates a **group link**, choosing the expiry date (required; the link stops working at the end of that day). The link is shown **once**, like personal invite links.
|
||||
2. Anyone opens the link while it is pending and unexpired — in **any** registration mode — and the form collects an **editable email**, display name, password, and the signup policies.
|
||||
3. On submit the account is created pending with the auto-approve marker (`RegistrationStatus::markPending($userId, autoApprove: true)`, meta `us_auto_approve`) and a confirmation email is sent. The invite row is **not** marked accepted — the link remains usable by others.
|
||||
4. Opening the `?us_confirm=<token>` link confirms the email and **approves the account immediately** (`EmailConfirmationHandler`): no admin heads-up, no Pending Students entry; the student gets the "approved" email and the page shows a "ready to use" notice (`?us_confirmed=ready`) with a sign-in link.
|
||||
5. The link can be revoked at any time from the Invites page.
|
||||
1. Studio admin opens **Invites** (`manage_students`) and invites an email; an invite row is created with a token and a registration link.
|
||||
2. The invitee opens `[us_student_register]` with the token (`?us_invite=<token>`).
|
||||
3. The form pre-fills the email and collects a display name and password, and renders the signup-scoped published policies, each with a required acceptance checkbox.
|
||||
4. On submit, the token is re-validated; a `us_student` user is created, the policy acceptances are recorded (`account` type), the invite is marked `accepted`, and the user is logged in.
|
||||
|
||||
## Admin Interface
|
||||
**Invites** in wp-admin (`manage_students`, studio admin only):
|
||||
- Select the **registration page** (the page hosting `[us_student_register]`), stored in the `us_registration_page_id` option; invitation links point there (falling back to the home page if unset)
|
||||
- Invite an email (creates a pending invite; the link is displayed once, at creation only)
|
||||
- Generate a **group invite link** with a required expiry date (link displayed once)
|
||||
- List pending invites (email or "Group link", created + expiry dates); revoke an invite
|
||||
|
||||
**Pending Students** — submenu under Students (`manage_students`), only relevant in `self_approval` mode:
|
||||
- "Awaiting approval" (email confirmed) — approve or reject
|
||||
- "Awaiting email confirmation" (not yet confirmed) — reject only
|
||||
- Invite an email (creates a pending invite + link)
|
||||
- List pending invites; revoke an invite
|
||||
|
||||
## Frontend Shortcode
|
||||
- `[us_student_register]` — the registration page. In `invite` mode: shows the form for a valid pending invite, else an "by invitation only" message. In `self_approval` mode: shows the form to anyone (editable email), and renders confirmation-result notices from `?us_confirmed=1|expired`.
|
||||
- The invitation-only message is customisable: block attribute `inviteOnlyMessage` (set under the block's **Invitation-only notice** panel) / shortcode attribute `invite_only_message`. Blank falls back to the default wording (`RegistrationPage::inviteOnlyMessage()`).
|
||||
|
||||
## Where Students Go Next
|
||||
The block's **After registration** panel picks the page a student continues to once
|
||||
registration finishes, and whether they get there by hand or automatically.
|
||||
|
||||
- **Sign-in page** (`loginPageId` / `login_page_id`) — the target of the "Sign in to your account" link shown after email confirmation (`?us_confirmed=1|ready`, falling back to the WordPress login screen) and of the **"Continue to _<page title>_"** link every **logged-in** visitor gets (`RegistrationPage::continueLink()`): an invited student who just finished signing up (`?us_registered=invite`), and anyone who simply arrives at the registration page already signed in. The link names the chosen page (via `get_the_title()`) so the visitor knows where it goes; an untitled page falls back to "Continue to your account" rather than reading "Continue to ". Neither gets the WordPress-login-screen fallback — with no page chosen there is no link at all, since sending someone already signed in to the login screen is the same dead end with extra steps.
|
||||
- **Redirect automatically** (`autoRedirect`, block only) — sends the student to that page instead of showing the link, via `BlockRegistrar::maybeAutoRedirect()` on `template_redirect`. It fires only on those two finished states (`RegistrationPage::isRegistrationComplete()`), so the "check your email" step, a validation error, and an `expired` confirmation link are always shown rather than redirected past. With no page chosen nothing happens — there is deliberately no login-screen fallback for the redirect. See `editor-blocks.md`.
|
||||
- `[us_student_register]` — the registration page. Shows the form for a valid pending invite; otherwise shows an "by invitation only" message (in `invite` mode).
|
||||
|
||||
## Token Redirect
|
||||
A `template_redirect` handler (`RegistrationPage::maybeRedirectToRegistrationPage()`)
|
||||
@@ -191,34 +56,16 @@ covers invitation links generated/shared before a registration page was selected
|
||||
No-op when no registration page is set.
|
||||
|
||||
## Capabilities
|
||||
- `manage_students` — manage invites and approve/reject pending students (studio admin; administrators inherit it via the `user_has_cap` filter). Added to `RoleManager::STUDIO_ADMIN_CAPS`.
|
||||
- `manage_students` — manage invites (studio admin; administrators inherit it via the `user_has_cap` filter). Added to `RoleManager::STUDIO_ADMIN_CAPS`.
|
||||
|
||||
## Implementation
|
||||
- Models: `Unsupervised\Schedular\Auth\Invite`
|
||||
- Repository: `Unsupervised\Schedular\Auth\InviteRepository`
|
||||
- Admin controllers: `Unsupervised\Schedular\Auth\RegistrationController` (invites), `Unsupervised\Schedular\Auth\RegistrationApprovalController` (pending students)
|
||||
- Admin controller: `Unsupervised\Schedular\Auth\RegistrationController`
|
||||
- Frontend: `Unsupervised\Schedular\Auth\RegistrationPage`
|
||||
- Self-approval flow: `Auth\RegistrationStatus` (lifecycle meta), `Auth\RegistrationLoginGate` (login + booking-cap gate), `Auth\EmailConfirmationHandler` (confirm link + native-form block), `Auth\RegistrationMailer` (emails)
|
||||
- Settings toggle: `Payment\StudioSettings` (`us_registration_mode`, core-option mirror/restore)
|
||||
- Reuses `Policy\PolicyRepository`, `Policy\PolicyVersionRepository`, `Policy\AcceptanceRepository`
|
||||
- Schema: `us_invites`; `us_policies.acceptance_scope`. Self-approval adds no tables — state is WordPress user meta.
|
||||
- Schema: `us_invites`; `us_policies.acceptance_scope`
|
||||
|
||||
## Tests
|
||||
- `tests/Unit/Auth/InviteTest.php`
|
||||
- `tests/Unit/Auth/InviteRepositoryTest.php`
|
||||
- `tests/Unit/Auth/RegistrationStatusTest.php`
|
||||
- `tests/Unit/Auth/RegistrationLoginGateTest.php`
|
||||
- `tests/Unit/Auth/EmailConfirmationHandlerTest.php`
|
||||
- `tests/Unit/Auth/RegistrationPageTest.php`
|
||||
- `tests/Unit/Auth/RegistrationApprovalControllerTest.php`
|
||||
- `tests/Unit/Auth/RegistrationMailerTest.php`
|
||||
- `tests/Unit/Payment/StudioSettingsTest.php`
|
||||
|
||||
## Parent/Guardian Signup
|
||||
The registration form asks **"Who are you registering?"** — just myself, on behalf
|
||||
of one or more students, or both — and the student-bearing choices reveal a
|
||||
repeatable child block (name, birth year, and the account-scope questions asked
|
||||
**per child**). Each child becomes a login-less `us_student` user linked to the
|
||||
guardian, and the signup policies are recorded once per child with the guardian as
|
||||
the acceptor. Available on every signup path — personal invite, group link, and
|
||||
self-approval. See `parent-guardian-accounts.md`.
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
# Feature: Availability Management
|
||||
|
||||
## Overview
|
||||
Instructors define same-day date/time windows during which they are available for private lessons. On save, a window is split into consecutive lesson-length slots (09:00–16:00 with 60-minute lessons becomes seven rows), each independently bookable by students. Windows may be generated as a weekly-recurring series.
|
||||
Instructors define date/time windows during which they are available for private lessons. Students book from these windows. Windows carry a lesson length and may be generated as a weekly-recurring series.
|
||||
|
||||
## Data Model — `{prefix}us_availability`
|
||||
|
||||
@@ -11,68 +11,31 @@ Instructors define same-day date/time windows during which they are available fo
|
||||
| `instructor_id` | BIGINT UNSIGNED | WordPress user ID |
|
||||
| `offering_id` | BIGINT UNSIGNED | Nullable FK → `us_offerings.id` (private-lesson type) |
|
||||
| `start_dt` | DATETIME | Slot start — stored as `Y-m-d H:i:s` |
|
||||
| `end_dt` | DATETIME | Slot end — always `start_dt + duration_minutes` |
|
||||
| `duration_minutes` | SMALLINT | Lesson length (e.g. 30, 60) |
|
||||
| `end_dt` | DATETIME | Slot end — stored as `Y-m-d H:i:s` |
|
||||
| `duration_minutes` | SMALLINT | Lesson length the window accommodates (e.g. 30, 60) |
|
||||
| `is_booked` | TINYINT(1) | 0 = available, 1 = booked |
|
||||
| `recurrence_group` | BIGINT UNSIGNED | Nullable — weekly-recurring windows share one group id |
|
||||
| `created_at` | DATETIME | Insertion time |
|
||||
|
||||
A slot's `duration_minutes` is matched against the offering a student picks: a
|
||||
30-minute private offering can only be booked into a slot whose
|
||||
A window's `duration_minutes` is matched against the offering a student picks: a
|
||||
30-minute private offering can only be booked into a window whose
|
||||
`duration_minutes` accommodates it.
|
||||
|
||||
## Window Splitting
|
||||
`AvailabilitySlot::splitByDuration()` chunks a submitted window into consecutive
|
||||
`duration_minutes` slots; `AvailabilityRepository::createFromWindow()` persists
|
||||
one row per chunk. A trailing remainder shorter than the lesson length is
|
||||
dropped. Windows must start and end on the same day and fit at least one lesson;
|
||||
both the REST endpoint and the admin form reject one that does not, with a
|
||||
message saying so (see **REST API** below).
|
||||
`AvailabilityRepository::splitOversizedWindows()` is a data migration (run by
|
||||
`Installer` on activation or version change) that rewrites pre-split rows.
|
||||
|
||||
## Weekly-Recurring Windows
|
||||
Instructors may generate a window weekly across a date range. Each lesson-length
|
||||
chunk becomes its own weekly series: occurrences of the same time-of-day share
|
||||
one `recurrence_group` id, so a recurring set can be added or removed together
|
||||
while individual occurrences are still booked independently.
|
||||
Instructors may generate a window weekly across a date range. Each occurrence is a
|
||||
separate row sharing one `recurrence_group` id, so a recurring set can be added or
|
||||
removed together while individual occurrences are still booked independently.
|
||||
|
||||
## Admin Interface
|
||||
Instructors access **My Availability** in wp-admin (`?page=us-availability`).
|
||||
- Add availability: provide a same-day start/end window, lesson length, and (optionally) a linked private-lesson offering
|
||||
- Add a weekly series: tick weekly repeat and choose the number of weeks
|
||||
- Add a slot: provide start/end datetime, duration, and (optionally) a linked private-lesson offering
|
||||
- Add a weekly series: provide the weekday/time plus a date range
|
||||
- Delete a slot: only allowed if `is_booked = 0`
|
||||
- Bulk delete: the list view has a checkbox per unbooked slot (with a select-all header checkbox) and a **Delete selected** button (`usc_action=bulk_delete`, `slot_ids[]`); each id is ownership-checked, and booked slots are refused at the repository level
|
||||
- Current slots can be shown as a **weekly calendar** (the default, navigated with `usc_week=Y-m-d`) or a **list** (`usc_view=list`); the grid honours the site's `start_of_week` option via `Availability\WeekCalendar`
|
||||
|
||||
### Feedback
|
||||
Every submitted action reports its outcome as a wp-admin notice — a success
|
||||
notice naming the number of slots created or deleted, or an error explaining the
|
||||
refusal. `AvailabilityController::handleFormAction()` returns a
|
||||
`[$notice, $error]` pair that `templates/admin/availability.php` renders.
|
||||
|
||||
This matters because the form used to fail **silently**: a window shorter than
|
||||
the chosen lesson length splits into no slots, so nothing was written, nothing
|
||||
was said, and the page simply reloaded. Submitting 5:30–6:00 PM with the length
|
||||
select on its 60-minute default was the reported case. Invalid datetimes, an end
|
||||
before the start, a window spanning two days, and an offering belonging to
|
||||
another instructor were all silent in the same way.
|
||||
|
||||
### Lesson-length choices
|
||||
`assets/js/availability-admin.js` (enqueued by `AdminMenu::enqueueAssets()` on
|
||||
this screen only) hides any lesson length longer than the entered window, falls
|
||||
back to the longest one that still fits when the current pick is hidden, and
|
||||
disables the submit button when nothing fits. It is a convenience, not a
|
||||
guarantee — the server validates the same window regardless. The choices come
|
||||
from `AvailabilitySlot::DURATION_CHOICES`.
|
||||
|
||||
## Public Calendar
|
||||
The front-end booking shortcode renders open slots from `GET /availability`
|
||||
either as an agenda-style list grouped by day or as a **weekly calendar** with
|
||||
previous/next-week navigation (toggle rendered by `assets/js/booking.js`; the
|
||||
site's `start_of_week` option is passed through the `usScheduler` JS config).
|
||||
Both views can be narrowed to the slots bookable as chosen private-lesson types
|
||||
with the **Show Only** lesson-type filter — see `lesson-booking.md`.
|
||||
The front-end booking shortcode renders a month/week calendar of open windows,
|
||||
populated from `GET /availability`. Students can filter by instructor and by
|
||||
offering/duration before selecting a slot to register for.
|
||||
|
||||
## REST API
|
||||
| Method | Endpoint | Permission |
|
||||
@@ -82,48 +45,13 @@ with the **Show Only** lesson-type filter — see `lesson-booking.md`.
|
||||
| `DELETE` | `/wp-json/us-scheduler/v1/availability/{id}` | `manage_availability` + slot owner |
|
||||
|
||||
`GET` supports query params: `instructor_id`, `offering_id`, `duration_minutes`, `from` (datetime), `to` (datetime).
|
||||
Slots whose start has already passed are never returned.
|
||||
|
||||
`POST` runs every submitted window — admin form and REST alike — through
|
||||
`Availability\WindowValidator`, which returns either the window ready to persist
|
||||
or a `WP_Error`. The REST endpoint returns that error directly (its `status`
|
||||
data makes it a 400); the admin screen shows `get_error_message()` in a notice.
|
||||
Sharing one validator is deliberate: the two paths previously checked the same
|
||||
rules separately, and the admin copy was both laxer (no offering-ownership
|
||||
check) and mute (a bare `return` on every rejection).
|
||||
|
||||
| Rejection | Code |
|
||||
|---|---|
|
||||
| Start or end not a real datetime | `invalid_datetime` |
|
||||
| End at or before the start | `invalid_datetime` |
|
||||
| Window spans two days | `invalid_window` |
|
||||
| Window shorter than the lesson length (so it holds no slots) | `invalid_window` |
|
||||
| Offering missing, or owned by another instructor | `invalid_offering` |
|
||||
|
||||
`start_dt`/`end_dt` are normalised by `AvailabilitySlot::normalizeDateTime()`:
|
||||
the canonical `Y-m-d H:i[:s]` and HTML `datetime-local` (`Y-m-d\TH:i[:s]`) forms
|
||||
become `Y-m-d H:i:s`; anything else is rejected. A valid window is stored as
|
||||
lesson-length slots and `201` returns `{ "ids": [...] }` for every row created.
|
||||
`weeks` is clamped to `AvailabilitySlot::MAX_WEEKLY_OCCURRENCES` in the
|
||||
repository, so the form's `max` cannot be bypassed by posting directly. A write
|
||||
that fails entirely returns `500 not_saved` rather than a `201` listing no ids.
|
||||
|
||||
Times are displayed in 12-hour AM/PM form in the booking calendar and wp-admin
|
||||
lists.
|
||||
|
||||
## Implementation
|
||||
- Repository: `Unsupervised\Schedular\Availability\AvailabilityRepository`
|
||||
- Model: `Unsupervised\Schedular\Availability\AvailabilitySlot`
|
||||
- Week bucketing: `Unsupervised\Schedular\Availability\WeekCalendar`
|
||||
- Admin controller: `Unsupervised\Schedular\Availability\AvailabilityController`
|
||||
- REST endpoint: `Unsupervised\Schedular\Availability\AvailabilityEndpoint`
|
||||
- Shared window validation: `Unsupervised\Schedular\Availability\WindowValidator`
|
||||
- Admin form script: `assets/js/availability-admin.js`, enqueued by `AdminMenu::enqueueAssets()`
|
||||
|
||||
## Tests
|
||||
- `tests/Unit/Availability/AvailabilityControllerTest.php`
|
||||
- `tests/Unit/Availability/AvailabilityRepositoryTest.php`
|
||||
- `tests/Unit/Availability/AvailabilitySlotTest.php`
|
||||
- `tests/Unit/Availability/AvailabilityEndpointTest.php`
|
||||
- `tests/Unit/Availability/WeekCalendarTest.php`
|
||||
- `tests/Unit/Availability/WindowValidatorTest.php`
|
||||
|
||||
@@ -1,69 +0,0 @@
|
||||
# Feature: Cancellation Cutoff
|
||||
|
||||
## Overview
|
||||
Students may cancel their own lessons online — but not indefinitely close to the
|
||||
start time. A **cancellation cutoff** closes student-initiated cancellation once
|
||||
a lesson begins within a configured window. Instructors and studio admins are
|
||||
never subject to the cutoff: they can cancel a lesson at any time through the
|
||||
lesson-status and student-management flows.
|
||||
|
||||
The window is resolved per lesson:
|
||||
|
||||
1. If the lesson's **offering** sets its own cutoff, that value is used.
|
||||
2. Otherwise the **studio default** applies.
|
||||
|
||||
Both values are expressed and computed in **hours**. The studio default is
|
||||
entered and displayed to the admin in **days** for convenience; a per-offering
|
||||
override is entered directly in hours (a finer-grained "time").
|
||||
|
||||
## Data Model
|
||||
|
||||
### Option `us_cancellation_cutoff_hours`
|
||||
Studio-wide default cutoff, stored as an integer number of **hours**. Defaults to
|
||||
`24` (one day) when unset. `0` means students may cancel at any time.
|
||||
|
||||
### Column `{prefix}us_offerings.cancellation_cutoff_hours`
|
||||
Nullable `SMALLINT UNSIGNED`. `NULL` means "inherit the studio default"; any set
|
||||
value (including `0` — cancel any time) overrides it for that offering.
|
||||
|
||||
## Resolution & Enforcement
|
||||
`Booking\CancellationPolicy` owns the logic:
|
||||
|
||||
- `cutoffHours(?int $offeringCutoffHours): int` — the offering's override when it
|
||||
is a non-negative value, otherwise the studio default.
|
||||
- `studentMayCancel(string $slotStartDt, ?int $offeringCutoffHours, ?string $now): bool`
|
||||
— false once `now` is within the effective cutoff of the slot start. A zero
|
||||
cutoff always allows cancellation; unparseable datetimes fail open so a student
|
||||
is never trapped by bad data. Comparisons use WordPress-local time
|
||||
(`current_time('mysql')`), matching how upcoming lessons are computed.
|
||||
- `describeCutoff(int $hours): string` — humanises a cutoff for messages
|
||||
(whole days as days, otherwise hours).
|
||||
|
||||
`Booking\BookingEndpoint::cancel()` (the student endpoint,
|
||||
`POST /bookings/{id}/cancel`) consults the policy before cancelling and returns a
|
||||
`cancellation_closed` (HTTP 403) error explaining the window when it is too late.
|
||||
The instructor status endpoint (`PATCH /bookings/{id}/status`) and
|
||||
`Auth\StudentActions::cancelLesson()` (studio-admin student view) bypass the
|
||||
policy entirely.
|
||||
|
||||
## Admin Interface
|
||||
- **Studio Settings → Cancellations**: "Cancellation cutoff (days)" — the studio
|
||||
default, entered/displayed in days, stored in hours.
|
||||
- **Offerings** add/edit form: "Cancellation cutoff (hours)" — an optional
|
||||
per-offering override; blank inherits the studio default, `0` allows anytime
|
||||
cancellation.
|
||||
|
||||
## Implementation
|
||||
- Service: `Unsupervised\Schedular\Booking\CancellationPolicy`
|
||||
- Studio default: `Unsupervised\Schedular\Payment\StudioSettings::cancellationCutoffHours()`
|
||||
(option `us_cancellation_cutoff_hours`)
|
||||
- Per-offering value: `Unsupervised\Schedular\Offering\Offering::$cancellationCutoffHours`
|
||||
- Enforcement: `Unsupervised\Schedular\Booking\BookingEndpoint::cancel()`
|
||||
- Wiring: `RestRegistrar` constructs `new CancellationPolicy( new StudioSettings() )`
|
||||
|
||||
## Tests
|
||||
- `tests/Unit/Booking/CancellationPolicyTest.php`
|
||||
- `tests/Unit/Booking/BookingEndpointTest.php` (cutoff cases in `cancel()`)
|
||||
- `tests/Unit/Payment/StudioSettingsTest.php` (default getter)
|
||||
- `tests/Unit/Offering/OfferingTest.php`, `tests/Unit/Offering/OfferingRepositoryTest.php`
|
||||
(new column round-trips)
|
||||
@@ -1,132 +0,0 @@
|
||||
# Feature: Student Credits (cancelled paid lessons)
|
||||
|
||||
## Overview
|
||||
When a lesson that has **already been paid for** is cancelled, the student is
|
||||
credited the amount they paid for *that lesson*. The credit sits on their account
|
||||
and is automatically applied against their future scheduled-billing charges
|
||||
(weekly / monthly) before they are asked to pay — so a cancelled-and-paid lesson
|
||||
becomes money toward the next one rather than a manual refund.
|
||||
|
||||
This complements — it does not replace — the existing cancellation behaviour: a
|
||||
still-**pending** payment is voided (`PaymentService::voidPending`), and only a
|
||||
**paid** payment produces a credit.
|
||||
|
||||
## Credit amount — one lesson's share
|
||||
The credit is one lesson's share of the covering payment's **total (including
|
||||
tax)**:
|
||||
|
||||
| Covering payment | Lessons it covers | Credit on cancelling one |
|
||||
|------------------|-------------------|--------------------------|
|
||||
| Single booking (one-time / full-term single) | 1 | the whole total |
|
||||
| Weekly **scheduled** lesson | 1 (one payment per lesson) | the whole total |
|
||||
| Monthly **scheduled** charge | N lessons that month | `total ÷ N` |
|
||||
| Weekly reservation **series** paid upfront (full-term) | the whole series | `total ÷ series size` |
|
||||
|
||||
The divisor is resolved in `PaymentService::coveredLessonCount`: a weekly series
|
||||
paid upfront (an *unscheduled* payment on a lesson that has a `series_id`) divides
|
||||
by the series size (`BookingRepository::countBySeries`); every other case divides
|
||||
by how many lessons point at the payment (`BookingRepository::countByPaymentId`),
|
||||
which is 1 for a single or weekly-scheduled lesson and N for a monthly charge.
|
||||
|
||||
The original payment is **left untouched** — the studio keeps the money it
|
||||
collected; the credit is a forward-looking liability offset against future
|
||||
billing, never a refund of past revenue.
|
||||
|
||||
### Guards
|
||||
- Only a **paid** payment credits; an unpaid/pending one is voided instead.
|
||||
- A lesson is credited **once** — `CreditRepository::existsForLesson` blocks a
|
||||
second credit if the same lesson is cancelled again after being reinstated.
|
||||
- A non-anchor lesson in a series (no `payment_id` of its own) is credited through
|
||||
the series anchor's payment.
|
||||
|
||||
## Applying credit at billing time
|
||||
The daily scan (`Payment\ScheduledBillingRunner`) generates each student's due
|
||||
payments, then — before sending the notice — applies their available credit
|
||||
across those charges oldest-first (`PaymentService::applyCredits`):
|
||||
|
||||
- Each payment's `us_payments.credit_applied` is raised by the amount covered,
|
||||
reducing what the student owes (`Payment::netDue()`).
|
||||
- A payment **fully** covered by credit is marked **paid-by-credit** (status
|
||||
`paid`, registration confirmed) so it drops out of the admin confirmation queue.
|
||||
- A payment **partially** covered stays `pending` at its reduced net due, shown in
|
||||
the admin Payments queue and on the notice.
|
||||
- The credit ledger is drawn down by the total applied
|
||||
(`CreditRepository::consume`, FIFO), marking each spent credit `consumed`.
|
||||
|
||||
The consolidated notice email (`Payment\PaymentDueMailer`) lists each charge at
|
||||
its full amount, then an **"Account credit applied: -X"** line and the reduced
|
||||
**Total due**. When the balance is zero the notice still goes out (so the student
|
||||
knows their credit covered it) but carries no e-transfer destination or reference.
|
||||
|
||||
## Admin visibility
|
||||
The studio admin sees a student's credit on their **student detail** page (gated by
|
||||
`manage_billing`, like the payment history). An **Account credit** section shows the
|
||||
available balance and a table of every credit — date, reason, original amount,
|
||||
remaining, and status (`available` / `consumed`). Built by
|
||||
`Auth\StudentHistory::creditBalance` / `::credits`.
|
||||
|
||||
## Data model — `{prefix}us_credits`
|
||||
|
||||
| Column | Type | Notes |
|
||||
|---------------------|-----------------|---------------------------------------------------|
|
||||
| `id` | BIGINT UNSIGNED | Primary key |
|
||||
| `student_id` | BIGINT UNSIGNED | WordPress user ID |
|
||||
| `amount` | DECIMAL(10,2) | Original credit amount |
|
||||
| `remaining` | DECIMAL(10,2) | Unused balance |
|
||||
| `currency` | VARCHAR(3) | ISO 4217 |
|
||||
| `source_payment_id` | BIGINT UNSIGNED | Payment that paid for the cancelled lesson |
|
||||
| `source_lesson_id` | BIGINT UNSIGNED | The cancelled lesson (dedup key) |
|
||||
| `reason` | VARCHAR(191) | Human-readable note |
|
||||
| `status` | VARCHAR(20) | `available` / `consumed` |
|
||||
| `created_at` | DATETIME | Insertion time |
|
||||
| `updated_at` | DATETIME | Last draw-down; NULL until first consumed |
|
||||
|
||||
A new column on `{prefix}us_payments`:
|
||||
|
||||
| Column | Type | Notes |
|
||||
|------------------|---------------|-----------------------------------------------------------|
|
||||
| `credit_applied` | DECIMAL(10,2) | Account credit applied to this payment; `netDue = total − credit_applied` |
|
||||
|
||||
> **Schema change:** `us_credits` and `us_payments.credit_applied` ship as part of
|
||||
> the (as-yet-unreleased) **1.2.0** — the same release as scheduled billing — so
|
||||
> `Installer`/`dbDelta` create them when a pre-1.2.0 site upgrades. If you are on a
|
||||
> 1.2.0 *dev* build that predates this feature, the stored `us_schedular_version`
|
||||
> already matches `USC_VERSION`, so `Plugin::boot()` will not re-run the installer;
|
||||
> reactivate the plugin (or bump the version) to pick the new table/column up.
|
||||
|
||||
## Reporting caveat
|
||||
Credits never touch past revenue and a credit-covered future charge is still
|
||||
marked `paid`, so `PaymentReport` (which sums `status = paid`) counts the original
|
||||
paid lesson and the later credit-covered lesson as gross revenue. This mirrors the
|
||||
design choice to leave the original payment intact rather than represent a partial
|
||||
refund of a shared payment.
|
||||
|
||||
## Implementation
|
||||
- Model: `Unsupervised\Schedular\Payment\Credit`
|
||||
- Repository: `Unsupervised\Schedular\Payment\CreditRepository`
|
||||
- Issue on cancel: `PaymentService::creditForCancelledLesson`
|
||||
(called from `Booking\BookingEndpoint::cancel` and `::updateStatus`)
|
||||
- Apply at billing: `PaymentService::applyCredits`, driven by
|
||||
`Payment\ScheduledBillingRunner::sendNotices`
|
||||
- Net due: `Payment::netDue()`, `PaymentRepository::addCreditApplied`
|
||||
- Lesson counts: `Booking\BookingRepository::countByPaymentId` / `countBySeries`
|
||||
- Admin view: `Auth\StudentHistory::creditBalance` / `::credits`, rendered in
|
||||
`templates/admin/student-detail.php`
|
||||
|
||||
## Tests
|
||||
- `tests/Unit/Payment/CreditRepositoryTest.php`
|
||||
- `tests/Unit/Payment/PaymentServiceTest.php` (`creditForCancelledLesson`, `applyCredits`)
|
||||
- `tests/Unit/Payment/ScheduledBillingRunnerTest.php` (credit applied to a run)
|
||||
- `tests/Unit/Payment/PaymentDueMailerTest.php` (credit line + reduced total)
|
||||
- `tests/Unit/Payment/PaymentTest.php` (`netDue`)
|
||||
- `tests/Unit/Booking/BookingEndpointTest.php` (credit issued on cancel)
|
||||
- `tests/Unit/Auth/StudentHistoryTest.php` (`creditBalance`, `credits`)
|
||||
|
||||
## Family Balances
|
||||
A credit records the student it was earned for (`student_id`) and the account
|
||||
that **holds** it (`payer_id`). Balance lookups — `availableBalance()`,
|
||||
`findAvailableByPayer()`, `consume()` — key on the payer, so a family shares one
|
||||
balance and a credit from one child's cancelled lesson can settle a sibling's
|
||||
next charge. A child's admin screen still lists the credits their own
|
||||
cancellations produced, labelled with whose account holds the balance. See
|
||||
`parent-guardian-accounts.md`.
|
||||
@@ -1,147 +0,0 @@
|
||||
# Editor Blocks
|
||||
|
||||
Gutenberg dynamic-block wrappers for the plugin's front-end shortcodes, so the
|
||||
pages can be previewed and styled inside the block editor instead of appearing
|
||||
as grey shortcode text.
|
||||
|
||||
## Blocks
|
||||
|
||||
| Block | Wraps shortcode | Front-end renderer |
|
||||
|---|---|---|
|
||||
| `us-scheduler/booking` | `[us_booking]` | `Booking\BookingPage::render()` |
|
||||
| `us-scheduler/student-login` | `[us_student_login]` | `Auth\LoginPage::render()` |
|
||||
| `us-scheduler/student-register` | `[us_student_register]` | `Auth\RegistrationPage::render()` |
|
||||
| `us-scheduler/group-classes` | `[us_group_classes]` | `GroupClass\GroupClassPage::render()` |
|
||||
| `us-scheduler/family` | `[us_family]` | `Guardian\FamilyPage::render()` |
|
||||
| `us-scheduler/account` | `[us_account]` | `Auth\AccountPage::render()` |
|
||||
|
||||
The shortcodes remain registered for back-compat; blocks and shortcodes share
|
||||
the same page objects (constructed once in `Plugin::boot()`), so front-end
|
||||
output is identical either way. Pasting a shortcode into the block editor
|
||||
auto-converts it to the matching block via a `transforms.from` shortcode
|
||||
transform.
|
||||
|
||||
## Block options
|
||||
|
||||
Most blocks have sidebar (inspector) options:
|
||||
|
||||
| Block | Attribute | Default | Effect |
|
||||
|---|---|---|---|
|
||||
| `us-scheduler/booking` | `loginPageId` (number) | `0` | Page the "log in to book a lesson" link points to for logged-out visitors. `0` = the WordPress login screen (with a redirect back to the current page). |
|
||||
| `us-scheduler/booking` | `autoRedirect` (boolean) | `false` | Send logged-out visitors straight to the login page instead of showing the link. |
|
||||
| `us-scheduler/booking` | `lessonTypeId` (number) | `0` | Pin the calendar to a single private-lesson type: only the times bookable as that type are listed, and it is the only type students can book here (auto-selected on the registration form). `0` = every type. Shortcode equivalent: `[us_booking lesson_type="…"]`. |
|
||||
| `us-scheduler/booking` | `showTypeFilter` (boolean) | `true` | Whether students get the **Show Only** button that narrows the calendar to chosen lesson types. Unused when a single type is pinned (there is nothing to choose). Shortcode equivalent: `[us_booking show_filter="no"]`. |
|
||||
| `us-scheduler/booking` | `displayMode` (string) | `both` | Which halves of the page to embed: `both`, `booking` (calendar only, no upcoming-lessons panel) or `upcoming` (the student's lessons only, nothing bookable) — so the two halves can live on different pages. Anything unrecognised falls back to `both`. Shortcode equivalent: `[us_booking show="booking"]`. |
|
||||
| `us-scheduler/student-login` | `bookingPageId` (number) | `0` | Page the "View available lessons" link points to for logged-in visitors, and the post-login redirect target. `0` = the current page. |
|
||||
| `us-scheduler/student-login` | `autoRedirect` (boolean) | `false` | Send logged-in visitors straight to the booking page instead of showing the link. Does nothing until a booking page is chosen. |
|
||||
| `us-scheduler/student-register` | `loginPageId` (number) | `0` | Page students continue to once registration finishes — the "Sign in to your account" link after they confirm their email, and the "Continue to your account" link an invited student gets on the spot. `0` = the WordPress login screen for the confirmation link, and no link at all for the (already signed-in) invited student. Shortcode equivalent: `[us_student_register login_page_id="…"]`. |
|
||||
| `us-scheduler/student-register` | `autoRedirect` (boolean) | `false` | Send students straight to that page instead of showing the link. Does nothing until a page is chosen — there is no login-screen fallback here. |
|
||||
| `us-scheduler/family` | `loginPageId` (number) | `0` | Where visitors who are not signed in are sent to log in. Shortcode equivalent: `[us_family login_page_id="…"]`. |
|
||||
| `us-scheduler/account` | `loginPageId` (number) | `0` | Where signing out returns to, and where a signed-out visitor is offered a **Sign in** link. `0` = signing out returns to the current page, and a signed-out visitor sees **nothing at all** — see below. Shortcode equivalent: `[us_account login_page_id="…"]`. |
|
||||
| `us-scheduler/group-classes` | `offeringId` (number) | `0` | Restrict the page to a single group class, for embedding on a page dedicated to that class. The class description is then omitted — only the schedule, instructor, price and enrolment controls are shown, so the surrounding page's own copy is not repeated. `0` = browse all classes, descriptions included. Shortcode equivalent: `[us_group_classes offering="…"]`. |
|
||||
|
||||
The page selects list all published pages; if a chosen page is later deleted,
|
||||
the blocks fall back to their defaults. The group-classes block's class
|
||||
select is a dropdown of active group classes fetched from
|
||||
`GET /us-scheduler/v1/offerings?kind=group_class`; a stored class that is no
|
||||
longer offered shows as "Unavailable class #N" rather than silently falling
|
||||
back to all classes. The booking block's lesson-type select works the same way
|
||||
against `?kind=private_lesson` ("Unavailable lesson type #N"), and the live
|
||||
page says so plainly when the pinned type has been withdrawn.
|
||||
|
||||
The booking block's options reach the front end as data attributes on
|
||||
`#us-booking-app` (`data-lesson-type`, `data-type-filter`) or as omitted
|
||||
containers (`displayMode`), which `assets/js/booking.js` reads on load — see
|
||||
`lesson-booking.md`. Its editor preview follows `displayMode`, showing the
|
||||
calendar, the upcoming-lessons panel, or both. The link targets are also available
|
||||
to the shortcodes as `[us_booking login_page_id="…"]` and
|
||||
`[us_student_login booking_page_id="…"]`; auto-redirect is block-only.
|
||||
|
||||
Auto-redirect cannot happen during block rendering (output has already
|
||||
started, so a `Location` header cannot be sent). Instead
|
||||
`BlockRegistrar::maybeAutoRedirect()` runs on `template_redirect`, parses the
|
||||
queried singular post's content for the block (including inside nested
|
||||
blocks), and redirects when the block opts in. A block whose target is its
|
||||
own page is ignored to avoid a redirect loop.
|
||||
|
||||
The registration block's auto-redirect additionally only fires on a
|
||||
**finished** registration — `RegistrationPage::isRegistrationComplete()`: an
|
||||
invited student who is now logged in (`?us_registered=invite`), or a
|
||||
self-signup back from the emailed confirmation link (`?us_confirmed=ready|1`).
|
||||
The intermediate "check your email" step and every failure (a validation
|
||||
error, `?us_confirmed=expired`) stay on the page so the student reads the
|
||||
message. That check runs before the content is parsed, so an ordinary page
|
||||
view does not pay for the extra block scan.
|
||||
|
||||
## How it works
|
||||
|
||||
- **`BlockRegistrar`** (`src/BlockRegistrar.php`) hooks `init` and registers
|
||||
each block with `register_block_type()`: a `render_callback` per block, the
|
||||
shared editor script (`assets/js/blocks.js`, handle
|
||||
`us-scheduler-blocks`), and the front-end stylesheet
|
||||
(`assets/css/frontend.css`, handle `us-scheduler`) as the block `style` so
|
||||
it also loads inside the editor and previews pick up theme styling.
|
||||
- **`assets/js/blocks.js`** (vanilla JS, no build step) registers the client
|
||||
side of each block — title, icon, keywords, shortcode transform — and
|
||||
renders the editor preview with `wp.serverSideRender`, which fetches the
|
||||
server-rendered markup via the `/wp/v2/block-renderer` REST route.
|
||||
- **`BlockPreview`** (`src/BlockPreview.php`) supplies static, script-free
|
||||
markup for editor previews. `BlockRegistrar::isEditorPreview()` detects the
|
||||
block-renderer context via the `REST_REQUEST` constant (front-end template
|
||||
rendering never happens inside a REST request) and renders the preview
|
||||
instead of the live page.
|
||||
|
||||
## Editor preview behaviour
|
||||
|
||||
Live pages cannot run in the editor: booking and group classes are populated
|
||||
by JavaScript making authenticated REST calls (and may load Stripe.js),
|
||||
registration requires a valid invite token, and login short-circuits for
|
||||
logged-in users (the editing admin always is). Each preview therefore
|
||||
reproduces the live wrapper elements and CSS classes with representative
|
||||
placeholder content:
|
||||
|
||||
- **Booking** — `#us-booking-app` with sample `.us-day` / `.us-slot` rows and
|
||||
disabled Book buttons.
|
||||
- **Group classes** — `#us-group-app` with a sample `.us-class` card and a
|
||||
disabled Enrol button. When `offeringId` pins a single class the preview
|
||||
drops the sample description, matching what the live page renders in that
|
||||
mode.
|
||||
- **Login** — the real `templates/frontend/login-page.php` template (it has
|
||||
no request-state dependencies).
|
||||
- **Registration** — a disabled sample of the `.us-register-form` fields.
|
||||
- **Account** — a populated sample panel. Deliberately populated whatever the
|
||||
editor user's own state: on the published page a signed-out visitor may see
|
||||
nothing at all, and an empty box tells the person placing the block nothing
|
||||
about where it will sit.
|
||||
|
||||
Each preview starts with a `.us-editor-note` paragraph explaining what the
|
||||
published page shows instead. The note class only appears in editor previews.
|
||||
|
||||
## Tests
|
||||
|
||||
- `tests/Unit/BlockRegistrarTest.php` — hook registration, block/asset
|
||||
registration, attribute schemas, front-end delegation to the page objects,
|
||||
preview-mode routing, auto-redirect behaviour.
|
||||
- `tests/Unit/Booking/BookingPageTest.php` — logged-out login-link targets
|
||||
and fallbacks.
|
||||
- `tests/Unit/Auth/LoginPageTest.php` — logged-in booking-link targets and
|
||||
fallbacks.
|
||||
- `tests/Unit/Auth/AccountPageTest.php` — what each visitor sees, the
|
||||
sign-out redirect target, and the signed-out empty render.
|
||||
- `tests/Unit/BlockPreviewTest.php` — preview markup mirrors the live CSS
|
||||
classes/ids and includes the editor note.
|
||||
|
||||
## The account block's signed-out behaviour
|
||||
|
||||
`us-scheduler/account` is the one block that can render **nothing**. It is meant
|
||||
for a header, sidebar or account page, and its whole subject is the person
|
||||
signed in — which a stranger is not. A bare "you are not signed in" in a site
|
||||
header is noise that cannot be acted on, so:
|
||||
|
||||
- **No login page chosen** → empty string for signed-out visitors.
|
||||
- **Login page chosen** → a single **Sign in** link.
|
||||
|
||||
Signed in, it shows the display name (`Auth\UserName::format()`, so a username
|
||||
is never exposed), the account email, and a **Sign out** link — deliberately
|
||||
nothing else. Signing out returns to the chosen login page, or to the current page when there
|
||||
is none, so a header sign-out does not also navigate the visitor somewhere.
|
||||
+18
-210
@@ -3,8 +3,6 @@
|
||||
## Overview
|
||||
Students enrol in a group class — an offering of kind `group_class` — as a commitment for the year. Enrolment is capacity-enforced and billed full-term upfront. Registration reuses the same flow as private lessons (intake questions + policy acceptance + payment).
|
||||
|
||||
A group class can be marked **invite-only** (`us_offerings.access_mode = invite_only`, see `offerings.md`). Invite-only classes are hidden from the public catalog — they never appear in the student booking/group-class list — and can only be enrolled in by students the instructor has let in. See **Invite-only access** below.
|
||||
|
||||
## Data Model — `{prefix}us_group_enrollments`
|
||||
|
||||
| Column | Type | Notes |
|
||||
@@ -17,237 +15,47 @@ A group class can be marked **invite-only** (`us_offerings.access_mode = invite_
|
||||
| `payment_id` | BIGINT UNSIGNED | Nullable FK → `us_payments.id` |
|
||||
| `enrolled_at` | DATETIME | Insertion time |
|
||||
|
||||
## Class Dates, Time, and Instructor
|
||||
A group class offering carries `term_start`/`term_end` plus a `class_time` and an
|
||||
owning `instructor_id` (see `offerings.md`): one-off classes end the day they
|
||||
start; weekly classes run a set number of sessions, all at `class_time`. The class
|
||||
card on the enrolment page shows **when** the class meets (the date or date range
|
||||
plus the start time) and **who** teaches it (the assigned instructor's name,
|
||||
surfaced as `instructor_name` on the `GET /offerings` response). Instructor names
|
||||
in the group-class views (front and back end) use the instructor's real name
|
||||
(first + last) or nickname, never their login — see `Auth\UserName::format()`.
|
||||
|
||||
Assigning an instructor to a scheduled class removes that instructor's open
|
||||
booking slots at the class time and flags any already-booked lesson that clashes;
|
||||
see **Instructor assignment** in `offerings.md`.
|
||||
|
||||
### Sessions in the "upcoming" views
|
||||
`GroupClass\SessionSchedule` turns an enrolment into the dated sessions behind it,
|
||||
so a class appears alongside one-to-one lessons wherever upcoming lessons are
|
||||
listed. A class is a term, not rows in `us_availability`, so an enrolment carries
|
||||
no date of its own — the concrete windows come from `Offering::sessionWindows()`,
|
||||
the same derivation the billing scan and the class-slot reconciler use, which is
|
||||
what keeps a student's list, an instructor's list and the invoice agreeing on when
|
||||
the class meets.
|
||||
|
||||
- `upcomingForStudent()` — every not-yet-started session of each enrolment that is
|
||||
not `cancelled`. `completed` is a *billing* state and says nothing about the
|
||||
calendar, so those sessions stay listed.
|
||||
- `upcomingForInstructor()` — every session of each active group class they own,
|
||||
one row per session however many students are enrolled; enrolments are not
|
||||
consulted, because a class still has to be taught if nobody has signed up yet.
|
||||
|
||||
**A class you are enrolled in must never silently vanish from these lists.** Both
|
||||
the class time and the duration are optional on the offering form, and the
|
||||
schedule note exists precisely so a studio can write "Tuesdays 4:00pm" rather than
|
||||
pin the class to a clock. So the schedule degrades instead of disappearing:
|
||||
|
||||
| Class has | What the list gets |
|
||||
|---|---|
|
||||
| date + time + duration | one dated row per remaining session, with an end time |
|
||||
| date + time, no duration | one dated row per remaining session, `end_dt` empty — when it starts is worth showing without guessing when it ends |
|
||||
| no class time | **one** row for the class as a whole, sorted by term start (or by "now" once the term is under way), with `schedule` text from `Offering::scheduleLabel()` — the studio's note, else the term dates, else "Schedule to be confirmed" |
|
||||
| a term whose last day has passed | nothing |
|
||||
|
||||
`schedule` is the tell: non-null means "a class, described in words, not a session
|
||||
at a known time", and every renderer shows that text in place of a date and time.
|
||||
An undated row's `start_dt` is a **sort key only** — never displayed.
|
||||
|
||||
`Offering::sessionStarts()` is the split that makes this work: it needs only the
|
||||
date and the time, because knowing *when* a class meets is a separate question
|
||||
from knowing how long it runs. `sessionWindows()` is that plus the duration, and
|
||||
still returns nothing without one — availability blocking and per-session billing
|
||||
need both ends of a window.
|
||||
|
||||
Consumers mark these rows `kind = 'group_class'` (`SessionSchedule::KIND`) and
|
||||
withhold the per-lesson actions from them: a session is one date in a term, not a
|
||||
booked slot, so there is nothing to cancel session by session and no slot to
|
||||
release. Withdrawing from the class is the separate, whole-enrolment decision.
|
||||
|
||||
Where they show up: the `[us_scheduler]` upcoming panel via `GET /bookings`
|
||||
(students and instructors both), and the **Upcoming lessons** table on the admin
|
||||
student detail page. Only *upcoming* sessions are added there — the
|
||||
**Group-class enrolments** table below already records the whole history, and a
|
||||
term's worth of past dates would bury the lessons under "Past lessons".
|
||||
|
||||
## Enrolment Flow
|
||||
The class list is loaded together with the student's own enrolments
|
||||
(`GET /enrollments`); a class the student already has an `active` enrolment in
|
||||
shows "You are enrolled in this class." instead of the Enrol button (the
|
||||
server would reject the duplicate with `409 already_enrolled` regardless — a
|
||||
cancelled enrolment does not block re-enrolling).
|
||||
|
||||
1. Student opens a group class from the offering catalog. Each class card shows its price with the **cadence** it is billed on — `120.00 CAD up front`, `40.00 CAD monthly`, and so on.
|
||||
1. Student opens a group class from the offering catalog.
|
||||
2. Student answers the offering's questions (`GET /offerings/{id}/questions`).
|
||||
3. Student accepts the current published policy versions (`GET /policies`) — required to continue.
|
||||
4. The enrolment form restates the price (with HST) and requires a second, separate agreement to pay that amount before it will submit. See **Price Display and the Pay Agreement** in `payments.md`.
|
||||
5. Full-term payment is taken per the student's billing method (card by default; `pending` for e-transfer; skipped for comp). See `payments.md`.
|
||||
6. `POST /enrollments` creates the enrolment (`status = active`), records answers and policy acceptances, and links the payment — but only if the offering's `capacity` has not been reached.
|
||||
7. On successful payment (or comp) a receipt is emailed.
|
||||
4. Full-term payment is taken per the student's billing method (card by default; `pending` for e-transfer; skipped for comp). See `payments.md`.
|
||||
5. `POST /enrollments` creates the enrolment (`status = active`), records answers and policy acceptances, and links the payment — but only if the offering's `capacity` has not been reached.
|
||||
6. On successful payment (or comp) a receipt is emailed.
|
||||
|
||||
Capacity is enforced at enrolment time by counting `active` rows for the offering;
|
||||
a class at capacity rejects further enrolments.
|
||||
|
||||
Enrolment also closes after the class's **enrolment deadline** (the instructor's
|
||||
`enrollment_deadline`, defaulting to `term_start` — the first class day; see
|
||||
`offerings.md`). Past the deadline `POST /enrollments` rejects the enrolment with
|
||||
`403 enrollment_closed`, and the class list shows "Enrolment has closed." in place
|
||||
of the Enrol button. While enrolment is still open the class card shows an
|
||||
"Enrol by" line with the effective deadline date.
|
||||
|
||||
The deadline only bounds student **self**-enrolment. An instructor (or studio admin)
|
||||
can still enrol someone by hand from the class **details page** — the **Add students
|
||||
directly** control, available for every group class, deliberately bypasses the
|
||||
deadline (and capacity) so a **late enrolment** can be added after the class has
|
||||
closed. Past the deadline the details page labels these as late enrolments. See
|
||||
**Admin Interface** below.
|
||||
|
||||
## Withdrawal Flow
|
||||
A student may withdraw themselves from a class they are enrolled in through the same
|
||||
group-class page: an active enrolment shows a **Withdraw** button.
|
||||
`POST /enrollments/{id}/withdraw` marks the enrolment `cancelled` (freeing its
|
||||
capacity seat) and voids any still-pending payment. It **never issues an account
|
||||
credit** — a timely withdrawal is a clean exit, not a refund (credits are reserved
|
||||
for cancelled lessons; see `credits.md`).
|
||||
|
||||
Self-withdrawal is bounded by the class's **withdrawal deadline** (the instructor's
|
||||
`withdrawal_deadline`; see `offerings.md`). Unlike the enrolment deadline it has no
|
||||
implicit default — a class with no deadline set stays open to withdrawal for its
|
||||
whole life. Past the deadline `POST /enrollments/{id}/withdraw` rejects the request
|
||||
with `403 withdrawal_closed`, and the class card shows "Withdrawal has closed —
|
||||
contact the studio to withdraw." in place of the Withdraw button. The endpoint also
|
||||
returns `404 not_found` for an unknown enrolment and `403 forbidden` when the
|
||||
enrolment is not the caller's own; a withdrawal of an already-cancelled enrolment is
|
||||
idempotent.
|
||||
|
||||
The deadline only bounds student **self**-withdrawal. A studio admin can withdraw a
|
||||
student at any time from the **student detail page** (`Auth\StudentActions::withdrawEnrollment`),
|
||||
which is never subject to the deadline.
|
||||
|
||||
## REST API
|
||||
| Method | Endpoint | Permission |
|
||||
|----------|-------------------------------------------------|----------------------------------|
|
||||
| `GET` | `/wp-json/us-scheduler/v1/enrollments` | Any logged-in user |
|
||||
| `POST` | `/wp-json/us-scheduler/v1/enrollments` | `book_lesson` |
|
||||
| `POST` | `/wp-json/us-scheduler/v1/enrollments/{id}/withdraw` | Owner (the enrolled student) |
|
||||
| Method | Endpoint | Permission |
|
||||
|----------|----------------------------------------------|----------------------------------|
|
||||
| `GET` | `/wp-json/us-scheduler/v1/enrollments` | Any logged-in user |
|
||||
| `POST` | `/wp-json/us-scheduler/v1/enrollments` | `book_lesson` |
|
||||
|
||||
`POST /enrollments` body: `offering_id`, `answers[]` (`question_id` → value),
|
||||
`accepted_policy_version_ids[]`, and payment data (see `payments.md`). The
|
||||
response includes `id`, `status`, and `payment` — a `{id, method, status}`
|
||||
summary, or `null` when the class is free (the front end then skips the
|
||||
payment step).
|
||||
`accepted_policy_version_ids[]`, and payment data (see `payments.md`).
|
||||
|
||||
`GET /enrollments` returns the caller's own enrolments, or all enrolments for the
|
||||
instructor's group classes if the caller has `view_own_lessons` on those offerings.
|
||||
|
||||
`GET /offerings` (the catalog that feeds the group-class list) returns public
|
||||
offerings **plus** any invite-only offerings the caller has an access grant for, so a
|
||||
granted student sees the private class alongside public ones. Ungranted students never
|
||||
receive it. Enrolling in an invite-only class requires a grant: `POST /enrollments`
|
||||
rejects an ungranted student with `403 invite_required`, and a successful enrolment
|
||||
flips their grant from `invited` to `enrolled`.
|
||||
|
||||
## Invite-only access
|
||||
|
||||
Access to an invite-only class is recorded in `{prefix}us_group_access` — a grant per
|
||||
person, separate from the enrolment itself. The instructor manages access from
|
||||
**My Lessons → My Group Classes**. **Add students directly** is available on every
|
||||
class's details page (see **Admin Interface**); invite-only classes add two more
|
||||
controls beneath it:
|
||||
|
||||
1. **Add students directly** — the selected registered students are enrolled immediately
|
||||
(`status = active`) with a **pending payment** at the class price (comp students are
|
||||
settled at once by `PaymentService`). No access grant is needed — this writes straight
|
||||
to `us_group_enrollments` + `us_payments`. It bypasses the enrolment deadline and
|
||||
capacity, so it doubles as the **late-enrolment** path after a class has closed.
|
||||
2. **Make available** — the selected registered students get an `invited` grant so the
|
||||
class appears in their own group-class list; they then self-enrol through the normal
|
||||
paid flow. Each is emailed a "you've been added" notice.
|
||||
3. **Invite by email** — for an address with no account yet: a tokenised personal invite
|
||||
(`us_invites`, carrying `offering_id`) is created and the registration link emailed,
|
||||
alongside an `invited` grant keyed by `email` + `invite_id`. If the address already has
|
||||
a **pending** invite, the grant is attached to that invite and **no second link is
|
||||
sent**. An address that already has an account is treated as **Make available** instead.
|
||||
|
||||
When an email-invited person completes registration, `RegistrationPage` links their new
|
||||
account to the grant (`GroupAccessRepository::linkStudentByEmail`), so the invite-only
|
||||
class becomes enrollable for them — they choose whether to enrol.
|
||||
|
||||
### Data Model — `{prefix}us_group_access`
|
||||
|
||||
| Column | Type | Notes |
|
||||
|---------------|-----------------|-----------------------------------------------------------------------|
|
||||
| `id` | BIGINT UNSIGNED | Primary key |
|
||||
| `offering_id` | BIGINT UNSIGNED | FK → `us_offerings.id` (an invite-only group class) |
|
||||
| `student_id` | BIGINT UNSIGNED | WordPress user ID; NULL until an email invitee registers |
|
||||
| `email` | VARCHAR(191) | Email-invite grants only; used to link the account once it registers |
|
||||
| `invite_id` | BIGINT UNSIGNED | FK → `us_invites.id` for email-invite grants; NULL otherwise |
|
||||
| `status` | VARCHAR(20) | `invited` / `enrolled` / `revoked` |
|
||||
| `invited_by` | BIGINT UNSIGNED | Instructor who granted access |
|
||||
| `created_at` | DATETIME | Insertion time |
|
||||
|
||||
## Admin Interface
|
||||
- **Group Classes** (`view_all_lessons` / studio admin): a per-class summary across
|
||||
instructors — each class with its instructor, when it meets, and its active-enrolment
|
||||
count against capacity (not a flat list of individual student enrolments). Selecting a
|
||||
class (`?class_id=<id>`) opens the same per-class **details page** described below, so a
|
||||
studio admin — including an owner-operator who also teaches, for whom the instructor
|
||||
**My Group Classes** menu is hidden — can view any class's roster and manage invite-only
|
||||
membership from here. Invite actions are permitted for the class's own instructor or any
|
||||
`view_all_lessons` studio admin.
|
||||
- **My Lessons → My Group Classes** (`view_own_lessons` / instructor): a summary of the
|
||||
instructor's own group classes — each with when it meets and its active-enrolment count
|
||||
against capacity, plus a **View details** link (**View & invite** for invite-only
|
||||
classes). Selecting a class (`?class_id=<id>`, scoped to the owning instructor) opens its
|
||||
**details page**: a class-details panel (when, instructor, enrolled/capacity, duration,
|
||||
price, schedule note, enrolment deadline, status), the roster of enrolled students with
|
||||
enrolment and payment status, and an **Add students** section. Every class — public or
|
||||
invite-only — carries the **Add students directly** control there, which enrols the
|
||||
selected students immediately (a late enrolment past the deadline; the section says so
|
||||
when the deadline has passed). Invite-only classes additionally get the
|
||||
**make-available** and **invite-by-email** controls plus the list of who has been invited
|
||||
but not yet enrolled. These are nonce-checked `usc_action` POSTs, scoped to the owning
|
||||
instructor. The summary (`templates/admin/my-group-classes.php`) and the details page
|
||||
(`templates/admin/my-group-class-detail.php`) are separate templates.
|
||||
- **Group Classes** (`manage_options` / studio admin): all enrolments across instructors
|
||||
- Instructors see enrolments for their own group classes under **My Lessons**
|
||||
|
||||
## Implementation
|
||||
- Repository: `Unsupervised\Schedular\GroupClass\EnrollmentRepository` (`countActiveForOffering`/`hasActiveEnrollment` enforce capacity and prevent duplicates)
|
||||
- Access grants: `Unsupervised\Schedular\GroupClass\GroupAccess` + `GroupAccessRepository` (`hasGrant`, `findGrantedOfferingIds`, `markEnrolled`, `linkStudentByEmail`)
|
||||
- Model: `Unsupervised\Schedular\GroupClass\Enrollment`
|
||||
- Sessions: `Unsupervised\Schedular\GroupClass\SessionSchedule` (`upcomingForStudent`, `upcomingForInstructor`) — consumed by `Booking\BookingEndpoint::myLessons()` and `Auth\StudentController`
|
||||
- Admin controller: `Unsupervised\Schedular\GroupClass\GroupClassController` — `renderPage` (studio admin per-class summary, `view_all_lessons`) and `renderInstructorPage` (instructor summary + `?class_id` roster detail, `view_own_lessons`)
|
||||
- Admin controller: `Unsupervised\Schedular\GroupClass\GroupClassController` (gated on `view_all_lessons`)
|
||||
- REST endpoint: `Unsupervised\Schedular\GroupClass\EnrollmentEndpoint`
|
||||
- Frontend: `Unsupervised\Schedular\GroupClass\GroupClassPage` (`[us_group_classes]` shortcode; `offering="…"` restricts it to a single class for embedding on a dedicated page — the block equivalent is the `offeringId` attribute). In single-class mode `assets/js/group-classes.js` leaves the class description out of the card, since the page it is embedded on already describes the class; the schedule, instructor, schedule note, price and enrolment controls are still shown.
|
||||
- Frontend: `Unsupervised\Schedular\GroupClass\GroupClassPage` (`[us_group_classes]` shortcode)
|
||||
- Reuses `Registration\RegistrationGate` (intake answers + booking-scoped policy acceptance, type `enrollment`)
|
||||
|
||||
> **Payment:** a priced enrolment creates a payment via `Payment\PaymentService`
|
||||
> (`registration_type = enrollment`) and links it as `payment_id`; unpriced
|
||||
> enrolments return `payment: null` and skip the payment step. See `payments.md`
|
||||
> for the card/e-transfer/comp flows.
|
||||
> **Payment seam:** payment is deferred to #7. An enrolment is created with
|
||||
> `status = active` and `payment_id = null`; the pay→confirm + receipt step plugs
|
||||
> in later. Instructor-specific enrolment views (the spec's "under My Lessons")
|
||||
> are a follow-up — this iteration ships the studio-admin **Group Classes** page
|
||||
> (`view_all_lessons`) plus per-student/per-instructor REST queries.
|
||||
|
||||
## Tests
|
||||
- `tests/Unit/GroupClass/GroupClassControllerTest.php` (roster + add/make-available/invite actions)
|
||||
- `tests/Unit/GroupClass/EnrollmentTest.php`
|
||||
- `tests/Unit/GroupClass/EnrollmentRepositoryTest.php`
|
||||
- `tests/Unit/GroupClass/EnrollmentEndpointTest.php` (invite-only gating)
|
||||
- `tests/Unit/GroupClass/GroupAccessTest.php`
|
||||
- `tests/Unit/GroupClass/GroupAccessRepositoryTest.php`
|
||||
- `tests/Unit/GroupClass/GroupClassPageTest.php`
|
||||
- `tests/Unit/GroupClass/SessionScheduleTest.php`
|
||||
- `tests/Unit/Offering/OfferingEndpointTest.php` (catalog merges granted invite-only classes)
|
||||
|
||||
## Enrolling A Child
|
||||
`POST /enrollments` accepts the same optional **`student_id`** as booking,
|
||||
authorised through `Guardian\GuardianService::canActFor()`; `GET /enrollments`
|
||||
covers the guardian's whole household, and a guardian may withdraw any of their
|
||||
children. See `parent-guardian-accounts.md`.
|
||||
|
||||
+17
-135
@@ -20,139 +20,44 @@ Students register for a private lesson by choosing an offering, picking a time (
|
||||
| `created_at` | DATETIME | Insertion time |
|
||||
|
||||
## Registration Flow
|
||||
1. Student opens the page with the `[us_booking]` shortcode and browses open slots as a weekly calendar (the default, anchored to the week of the earliest open slot) or an agenda list (view toggle with previous/next-week navigation; times shown in 12-hour AM/PM form). A **Show Only** button beside the view toggle opens a lesson-type filter that narrows the open times to those bookable as the chosen types (see **Lesson-Type Filter**).
|
||||
2. Student picks a slot and an **offering** (a 30 or 60-minute private-lesson type). When the slot is tied to an offering the form shows it locked (the student sees exactly what they are booking); otherwise the form presents the instructor's active private-lesson offerings whose duration fits the slot, narrowed to the filtered types. When exactly one type remains it is pre-selected (its intake questions load immediately). Every booking requires an offering — a generic slot with no fitting offering cannot be booked online.
|
||||
1. Student opens the page with the `[us_booking]` shortcode and browses the calendar.
|
||||
2. Student picks an **offering** (a 30 or 60-minute private-lesson type) and a slot.
|
||||
3. For a `weekly` reservation, the same weekday/time is held for the rest of the offering's term.
|
||||
4. Student answers the offering's questions (`GET /offerings/{id}/questions`).
|
||||
5. Student accepts the current published policy versions (`GET /policies`) — required to continue.
|
||||
6. Student is shown what the booking costs — the offering's price with its **cadence** (at booking / up front / weekly / monthly), plus HST — and must tick a second, separate agreement to pay that amount before the form will submit. A weekly reservation quotes the per-lesson fee and the ceiling on the total it can claim. A free offering shows no price block. See **Price Display and the Pay Agreement** in `payments.md`.
|
||||
7. Payment is taken per the student's billing method (card by default; `pending` for e-transfer; skipped for comp). See `payments.md`.
|
||||
8. `POST /bookings` creates the lesson row(s) (`status = pending`), records answers and policy acceptances, marks `us_availability.is_booked = 1`, and links the payment. A booking with nothing owed (a free offering) creates no payment and is `confirmed` immediately.
|
||||
9. On successful payment (or comp) the lesson is `confirmed` and a receipt is emailed.
|
||||
10. Instructor sees the booking under **My Lessons** and may update status via `PATCH /bookings/{id}/status`.
|
||||
11. The confirmation is a **dismissible notice above the calendar**, not a screen of its own. The calendar is reloaded first — so the slot just taken is gone and the upcoming-lessons panel is current — and the notice is shown over it. Booking again therefore needs no page reload. The notice clears when it is dismissed, when another slot's booking form is opened, and on any reload of the calendar. `group-classes.js` does the same for enrolments.
|
||||
12. The booking page also shows the student their upcoming lessons (`GET /bookings`) — each with the booked offering's name and length, when it happens, a per-lesson status badge (pending payment / confirmed), and a **Cancel** button. Only the soonest five are shown; a **Show all** control reveals the rest. `GET /bookings` includes `offering_title` and `duration_minutes` for each lesson so the list needs no extra request.
|
||||
|
||||
## Lesson-Type Filter
|
||||
Not every open slot can be booked as every private-lesson type — a slot tied to
|
||||
an offering takes that offering only, and a generic slot only takes types whose
|
||||
length fits. The booking calendar therefore carries a lesson-type filter,
|
||||
collapsed behind a **Show Only** button that sits in the calendar's control row
|
||||
beside the List/Week toggle. Opening it reveals the type list between that row
|
||||
and the calendar: a checkbox per active private-lesson type (from
|
||||
`GET /offerings?kind=private_lesson`, fetched once per page load), showing the
|
||||
instructor's name alongside the title when the catalog spans more than one
|
||||
instructor. The button carries the number of ticked types and stays highlighted
|
||||
while the filter is on, so a collapsed filter is never invisible. Both button and
|
||||
list are hidden when there is only one bookable type.
|
||||
|
||||
Ticking one or more types narrows the calendar to the slots bookable as one of
|
||||
them; no ticks means no filter, and collapsing the list leaves the filter
|
||||
applied. Picking a filtered slot narrows the registration form's **Lesson type**
|
||||
picker the same way, and when exactly one type remains it is pre-selected and its
|
||||
intake questions load immediately. Changing the filter re-anchors the week view
|
||||
on the earliest matching slot, so the student never lands on an empty week.
|
||||
**Show all types** clears the filter.
|
||||
|
||||
Bookability is decided client-side by `offeringFitsSlot()` in
|
||||
`assets/js/booking.js` — the mirror of the rule `POST /bookings` enforces (same
|
||||
instructor, the tied offering when there is one, otherwise a matching
|
||||
`duration_minutes`). The filter is a browsing aid only: the server re-checks
|
||||
every booking regardless.
|
||||
|
||||
Two block/shortcode options change what the filter has to work with (see
|
||||
`editor-blocks.md`), passed to the script as data attributes on
|
||||
`#us-booking-app`:
|
||||
|
||||
- **A pinned lesson type** (`data-lesson-type`) narrows the catalog to that one
|
||||
offering, so the page lists only the times bookable as it and books nothing
|
||||
else — the filter control hides itself, there being one type left. A pinned
|
||||
type that is no longer offered shows "This lesson type is not available for
|
||||
booking right now" rather than an empty calendar.
|
||||
- **Filter off** (`data-type-filter="0"`) drops the **Show Only** button
|
||||
entirely; every open time is listed, as before the filter existed.
|
||||
|
||||
## Embedding Halves of the Page
|
||||
The page has two halves — the booking calendar and the student's upcoming
|
||||
lessons — and the block/shortcode can embed either on its own (`displayMode` /
|
||||
`show`: `both` (default), `booking`, `upcoming`). The template simply omits the
|
||||
containers of the half that is not wanted, and the script skips the work that
|
||||
belongs to a missing container: an upcoming-only embed never requests
|
||||
availability or the offering catalog, and a booking-only embed never requests
|
||||
`GET /bookings`. An unrecognised value renders the whole page, so a typo cannot
|
||||
silently hide half of it.
|
||||
|
||||
## Cancellation
|
||||
Students cancel their own lessons via `POST /bookings/{id}/cancel` (idempotent).
|
||||
Cancelling marks the lesson `cancelled`, frees the availability slot for
|
||||
rebooking, and voids a still-pending payment (marked `failed` so it leaves the
|
||||
admin confirmation queue). A `paid` payment is never touched — refunds are a
|
||||
manual, admin-side decision. Instructors cancelling via
|
||||
`PATCH /bookings/{id}/status` get the same slot release and payment voiding;
|
||||
reinstating a cancelled lesson re-claims its slot and fails with `409
|
||||
slot_taken` if the freed time was booked by someone else in the meantime.
|
||||
6. Payment is taken per the student's billing method (card by default; `pending` for e-transfer; skipped for comp). See `payments.md`.
|
||||
7. `POST /bookings` creates the lesson row(s) (`status = pending`), records answers and policy acceptances, marks `us_availability.is_booked = 1`, and links the payment.
|
||||
8. On successful payment (or comp) the lesson is `confirmed` and a receipt is emailed.
|
||||
9. Instructor sees the booking under **My Lessons** and may update status via `PATCH /bookings/{id}/status`.
|
||||
|
||||
## Weekly Reservations
|
||||
A weekly reservation creates one `series_id` shared across N lesson rows (one per
|
||||
week in the term) and reserves the matching availability windows. It is billed
|
||||
**upfront as a single payment** linked to the series' first (anchor) lesson:
|
||||
- `billing_mode = full_term` — the offering's price already covers the term and is charged once.
|
||||
- `billing_mode = one_time` — the per-lesson price is charged **once per occurrence actually claimed** (price × N).
|
||||
|
||||
Settling that payment (Stripe webhook, e-transfer confirmation, comp) confirms
|
||||
**every non-cancelled lesson in the series**
|
||||
(`BookingRepository::updateStatusForSeries()`), not just the anchor row.
|
||||
**full-term upfront** as a single payment (`billing_mode = full_term` on the
|
||||
offering).
|
||||
|
||||
## REST API
|
||||
| Method | Endpoint | Permission |
|
||||
|-----------|-------------------------------------------------|--------------------------------|
|
||||
| `GET` | `/wp-json/us-scheduler/v1/bookings` | Any logged-in user |
|
||||
| `POST` | `/wp-json/us-scheduler/v1/bookings` | `book_lesson` |
|
||||
| `POST` | `/wp-json/us-scheduler/v1/bookings/{id}/cancel` | Logged-in owner of the lesson |
|
||||
| `PATCH` | `/wp-json/us-scheduler/v1/bookings/{id}/status` | `manage_availability` or admin |
|
||||
|
||||
`POST /bookings` body: `offering_id`, `slot_id`, `recurrence`, `answers[]`
|
||||
(`question_id` → value), `accepted_policy_version_ids[]`, and payment data
|
||||
(see `payments.md`). The response includes `ids`, the resulting lesson
|
||||
`status`, and `payment` — a `{id, method, status}` summary, or `null` when
|
||||
nothing is owed (the front end then skips the payment step).
|
||||
(see `payments.md`).
|
||||
|
||||
An offering is always required (`400 offering_required` otherwise): a slot tied
|
||||
to an offering uses that offering regardless of the request, while a generic
|
||||
slot uses the student's `offering_id`, which must be one of the instructor's
|
||||
active `private_lesson` offerings whose `duration_minutes` matches the slot.
|
||||
|
||||
`GET /bookings` returns the caller's upcoming, non-cancelled lessons (their own
|
||||
for students; the instructor's for callers with `manage_availability`), each
|
||||
with the slot's `start_dt`/`end_dt`.
|
||||
|
||||
It also returns **upcoming group-class sessions**, sorted in among the lessons by
|
||||
start time (`GroupClass\SessionSchedule`). A student gets every remaining session
|
||||
of every class they are enrolled in; an instructor gets every session of the
|
||||
classes they teach. These rows carry `kind: "group_class"` — a session is a date
|
||||
in a term rather than a booked slot, so `booking.js` labels it and gives it no
|
||||
Cancel button. Lesson rows carry no `kind`, and that absence is what marks them
|
||||
cancellable.
|
||||
`GET /bookings` returns the caller's own lessons (student view) or upcoming lessons for the instructor if the caller has `manage_availability`.
|
||||
|
||||
Group classes follow the same registration flow but enrol against an offering of
|
||||
kind `group_class`; see `group-classes.md`.
|
||||
|
||||
## Admin Interface
|
||||
- **Scheduler** (`view_all_lessons` — studio admin / administrators): all upcoming lessons across all instructors
|
||||
- **My Lessons** (`view_own_lessons`): upcoming lessons — and upcoming sessions of the instructor's own group classes — for the logged-in instructor. Hidden for users who also hold `view_all_lessons` — Scheduler is a superset, so the menu item would only duplicate it.
|
||||
|
||||
Both pages open in a **Week** calendar view by default (`usc_view`/`usc_week`
|
||||
query params, same pattern as the availability page, bucketed via
|
||||
`Availability\WeekCalendar`), with the original table available as the **List**
|
||||
view — the list is where the per-lesson HST and e-transfer edit forms live. Both
|
||||
views show the booked offering's name, and each lesson links through (`?lesson_id=`)
|
||||
to a **detail view** (`LessonController::maybeRenderDetail()`) that shows the
|
||||
offering, time, status, notes, the policy versions the student accepted (with
|
||||
acceptance time and IP), and their intake-question answers. On **My Lessons** an
|
||||
instructor may only open their own lessons; the studio **Scheduler** may open any.
|
||||
- **My Lessons** (`view_own_lessons`): upcoming lessons for the logged-in instructor
|
||||
|
||||
## Frontend Shortcodes
|
||||
- `[us_booking]` — student calendar + registration flow; requires `book_lesson` capability. Attributes: `login_page_id`, `lesson_type` (pin one private-lesson offering), `show_filter` (`no` hides the **Show Only** filter), `show` (`both` / `booking` / `upcoming`)
|
||||
- `[us_booking]` — student calendar + registration flow; requires `book_lesson` capability
|
||||
- `[us_student_login]` — front-end login form for students
|
||||
|
||||
## Implementation
|
||||
@@ -160,38 +65,15 @@ instructor may only open their own lessons; the studio **Scheduler** may open an
|
||||
- Model: `Unsupervised\Schedular\Booking\Lesson`
|
||||
- Registration gate: `Unsupervised\Schedular\Registration\RegistrationGate` — validates and records intake answers + booking-scoped policy acceptances; shared with group enrolment
|
||||
- Admin controller: `Unsupervised\Schedular\Booking\LessonController`
|
||||
- Admin lesson detail presenter: `Unsupervised\Schedular\Booking\LessonDetail` (per-lesson intake answers + policy acceptances), template `templates/admin/lesson-detail.php`
|
||||
- REST endpoint: `Unsupervised\Schedular\Booking\BookingEndpoint`
|
||||
- Frontend: `Unsupervised\Schedular\Booking\BookingPage`, `Unsupervised\Schedular\Auth\LoginPage`
|
||||
- Upcoming-lessons panel: rendered client-side into `#us-my-lessons` by `assets/js/booking.js` (`lessonRowHtml`/`renderMyLessons`), mirrored for the editor by `BlockPreview::upcomingLessons()` — keep the two markup shapes in step.
|
||||
|
||||
> **Payment seam:** a priced booking is created with `status = pending` and its
|
||||
> payment linked via `payment_id`; the lesson is confirmed when the payment is
|
||||
> settled (see `payments.md`) or manually via `PATCH /bookings/{id}/status`.
|
||||
> Unpriced bookings skip the seam entirely and are confirmed at creation.
|
||||
> `GET /policies?scope=booking` returns just the booking-gate policies the form
|
||||
> must collect.
|
||||
>
|
||||
> **Frontend CSS scoping:** every rule for the booking page's own markup is
|
||||
> written under `#us-booking-app` (`assets/css/frontend.css`). These panels sit
|
||||
> inside whatever layout the active theme provides, and bare class selectors lose
|
||||
> to theme rules on `div`/`span`/`strong` — which flattens the flex layout and
|
||||
> renders the lesson details on top of the actions. The row's two columns are
|
||||
> `div`s for the same reason: the layout must not depend on overriding the
|
||||
> inline default. New booking-page rules should follow both conventions.
|
||||
> **Payment seam:** payment is deferred to the Payments feature (#7). For now a
|
||||
> booking is created with `status = pending` and `payment_id = null`; the
|
||||
> instructor confirms via `PATCH /bookings/{id}/status`. When payments land, the
|
||||
> pay→confirm + receipt step plugs into this seam. `GET /policies?scope=booking`
|
||||
> returns just the booking-gate policies the form must collect.
|
||||
|
||||
## Tests
|
||||
- `tests/Unit/Booking/BookingRepositoryTest.php`
|
||||
- `tests/Unit/Booking/LessonTest.php`
|
||||
- `tests/Unit/Booking/LessonControllerTest.php`
|
||||
- `tests/Unit/Booking/LessonDetailTest.php`
|
||||
- `tests/Unit/Booking/BookingEndpointTest.php`
|
||||
|
||||
## Booking For Someone Else
|
||||
A guardian books for their children from their own account. `POST /bookings`
|
||||
accepts an optional **`student_id`**, honoured only when
|
||||
`Guardian\GuardianService::canActFor()` confirms the caller is that student's
|
||||
guardian — anything else is a `403`. The booking form's "Who is this for?" picker
|
||||
lists **children first**, so the default selection is never the parent.
|
||||
`GET /bookings` returns the whole household, and a guardian may cancel any of
|
||||
their children's lessons. See `parent-guardian-accounts.md`.
|
||||
|
||||
@@ -15,104 +15,29 @@ An offering is anything a student can register for: a private-lesson type (30 or
|
||||
| `duration_minutes` | SMALLINT | Private lessons only (e.g. 30, 60); NULL for group classes |
|
||||
| `price` | DECIMAL(10,2) | Price in dollars |
|
||||
| `currency` | VARCHAR(3) | ISO 4217, e.g. `CAD` |
|
||||
| `billing_mode` | VARCHAR(20) | `one_time`, `full_term`, `weekly`, or `monthly` (see Billing Mode below) |
|
||||
| `billing_mode` | VARCHAR(20) | `one_time` (single booking) or `full_term` (weekly / group) |
|
||||
| `allow_weekly` | TINYINT(1) | Private only — may be reserved weekly for the term |
|
||||
| `capacity` | SMALLINT | Group only — max enrolments; NULL for private |
|
||||
| `term_start` | DATE | Group / term offerings — first day; NULL otherwise |
|
||||
| `term_end` | DATE | Group / term offerings — last day; NULL otherwise |
|
||||
| `class_time` | TIME | Group only — time of day each session starts; NULL otherwise |
|
||||
| `enrollment_deadline` | DATE | Group only — last day students may enrol; NULL defaults to `term_start` (the first class day) |
|
||||
| `withdrawal_deadline` | DATE | Group only — last day a student may withdraw themselves; NULL keeps self-withdrawal open indefinitely |
|
||||
| `schedule_note` | VARCHAR(191) | Group only — human-readable schedule, e.g. "Tuesdays 4:00pm"|
|
||||
| `cancellation_cutoff_hours` | SMALLINT UNSIGNED | Optional per-offering cancellation cutoff in hours; NULL inherits the studio default (see `cancellation-cutoff.md`) |
|
||||
| `access_mode` | VARCHAR(20) | `public` (listed in the catalog) or `invite_only` (group classes hidden from the catalog — see `group-classes.md`) |
|
||||
| `is_active` | TINYINT(1) | 0 = hidden from registration, 1 = bookable |
|
||||
| `created_at` | DATETIME | Insertion time |
|
||||
|
||||
## Billing Mode
|
||||
- `one_time` — charged once at booking (a single private lesson).
|
||||
- `full_term` — charged in full upfront at registration (a weekly private reservation or a year-long group class). See `payments.md`.
|
||||
- `weekly` — **not** charged at registration; a pending payment for one lesson's fee is generated **24 hours before each lesson** by the daily billing scan.
|
||||
- `monthly` — **not** charged at registration; on the **1st of each month** a single pending payment is generated for that month. A **private lesson**'s price is a per-lesson fee, so the month is billed (#lessons in the month) × fee; a **group class**'s price is the monthly fee itself, billed once for the month however many times the class meets in it.
|
||||
|
||||
Students see the mode as a **cadence** beside every price on the front end — *at
|
||||
booking*, *up front*, *weekly*, *monthly* — and confirm it explicitly before a
|
||||
booking or enrolment goes through. See **Price Display and the Pay Agreement** in
|
||||
`payments.md`.
|
||||
|
||||
`weekly` and `monthly` are *scheduled* billing (`Offering::isScheduledBilling()`): the
|
||||
booking/enrolment succeeds with no payment step, and payments are created later by the
|
||||
daily `us_generate_due_payments` cron scan. See `scheduled-billing.md` and `payments.md`.
|
||||
|
||||
## Term Dates
|
||||
Group classes carry a term: `term_start` is the date of the first class and
|
||||
`term_end` the last. The add-offering form takes a start date plus a sessions
|
||||
control — **one-off** (the term ends the day it starts) or **weekly for N
|
||||
sessions** (`term_end = term_start + (N−1) weeks`, computed by
|
||||
`Offering::weeklyTermEnd()`). Dates are validated by `Offering::normalizeDate()`
|
||||
(strict `Y-m-d`); an invalid start date leaves both term columns NULL. The
|
||||
student-facing class card shows the date (one-off) or the date range with the
|
||||
weekly session count.
|
||||
|
||||
## Class Time and Sessions
|
||||
A group class also carries `class_time` — the time of day each session starts —
|
||||
validated by `Offering::normalizeTime()` (strict `H:i`/`H:i:s`; garbage leaves it
|
||||
NULL). `class_time` + `term_start`/`term_end` + `duration_minutes` together define
|
||||
the concrete session windows: `Offering::sessionWindows()` returns one
|
||||
`{start, end}` per session (weekly across the term, or a single window for a
|
||||
one-off), and returns an empty list unless date, time, and a positive duration are
|
||||
all set. These windows drive availability reconciliation (see **Instructor
|
||||
assignment** below and `group-classes.md`).
|
||||
|
||||
## Enrolment deadline
|
||||
A group class carries an optional `enrollment_deadline` the instructor sets on the
|
||||
offering form (blank leaves it NULL). `Offering::effectiveEnrollmentDeadline()`
|
||||
resolves it to the stored date, or to `term_start` (the first class day) when unset,
|
||||
so a class with no explicit deadline still closes to new enrolments once the first
|
||||
class arrives. `Offering::isEnrollmentOpen($today)` compares a `Y-m-d` "today"
|
||||
against that effective deadline (inclusive — the deadline day is still open). The
|
||||
enrolment endpoint enforces it (`403 enrollment_closed`) and the front-end
|
||||
group-class list mirrors the same rule; see `group-classes.md`.
|
||||
|
||||
## Withdrawal deadline
|
||||
A group class also carries an optional `withdrawal_deadline` — the last day a
|
||||
student may withdraw *themselves* from the class. Unlike the enrolment deadline it
|
||||
has **no implicit default**: `Offering::isWithdrawalOpen($today)` treats an unset
|
||||
(NULL) deadline as always open, so a class only closes to self-withdrawal once the
|
||||
instructor sets a date and it passes (comparison is inclusive — the deadline day is
|
||||
still open). A withdrawal made while open frees the seat and voids any still-pending
|
||||
payment but **never issues an account credit** (credits are reserved for cancelled
|
||||
lessons; see `credits.md`). Once the deadline passes the student must contact the
|
||||
studio, and an admin withdraws them by hand from the student detail page — the admin
|
||||
path is never subject to the deadline. The student endpoint enforces it
|
||||
(`403 withdrawal_closed`) and the front-end group-class list mirrors the rule; see
|
||||
`group-classes.md`.
|
||||
|
||||
## Instructor assignment
|
||||
Every offering has an owning `instructor_id`. A studio admin
|
||||
(`manage_instructors`) sees an **Instructor** picker on the offering form and may
|
||||
assign a group class to any instructor; a plain instructor never sees the picker
|
||||
and always owns the classes they create (the posted value is ignored for them, and
|
||||
updates never reassign the owner otherwise). When a group class is saved with an
|
||||
assigned instructor and a full schedule, `Offering\ClassSlotReconciler` clears that
|
||||
instructor's **open** availability slots overlapping each session so students can't
|
||||
book them, and reports any **already-booked** lesson that clashes as a conflict for
|
||||
the studio to resolve by hand (a booked lesson is never deleted). The result is
|
||||
surfaced as an admin notice after saving.
|
||||
|
||||
## Admin Interface
|
||||
Studio admin and instructors manage offerings under **Offerings** in wp-admin.
|
||||
- Studio admin (`manage_offerings`) manages offerings for any instructor.
|
||||
- Instructor (`manage_offerings`) manages only their own.
|
||||
- Each offering's intake questions are edited from the offering screen (see `registration-questions.md`).
|
||||
- The offerings list shows each offering's ID (needed for `[us_group_classes offering="…"]`) and its term dates.
|
||||
- **Edit** on a row reloads the page (`?usc_edit=<id>`) with the form prefilled; saving posts `usc_action=update`. Owner and currency are always preserved on update, so a form submission can never reassign an offering. Non-admin instructors can only load and update their own offerings.
|
||||
- The form includes a **description** textarea and an **Active — open for registration** checkbox (unchecking hides the offering from students without deleting it — the admin-UI counterpart of the REST `is_active` flag).
|
||||
|
||||
## REST API
|
||||
| Method | Endpoint | Permission |
|
||||
|----------|---------------------------------------------|----------------------------------|
|
||||
| `GET` | `/wp-json/us-scheduler/v1/offerings` | `book_lesson` or `manage_offerings` (active offerings only) |
|
||||
| `GET` | `/wp-json/us-scheduler/v1/offerings` | Public (active offerings only) |
|
||||
| `POST` | `/wp-json/us-scheduler/v1/offerings` | `manage_offerings` |
|
||||
| `PATCH` | `/wp-json/us-scheduler/v1/offerings/{id}` | `manage_offerings` + owner |
|
||||
| `DELETE` | `/wp-json/us-scheduler/v1/offerings/{id}` | `manage_offerings` + owner |
|
||||
@@ -121,14 +46,10 @@ Studio admin and instructors manage offerings under **Offerings** in wp-admin.
|
||||
|
||||
## Implementation
|
||||
- Repository: `Unsupervised\Schedular\Offering\OfferingRepository`
|
||||
- Model: `Unsupervised\Schedular\Offering\Offering` (`normalizeTime`, `sessionWindows`, `effectiveEnrollmentDeadline`, `isEnrollmentOpen`)
|
||||
- Model: `Unsupervised\Schedular\Offering\Offering`
|
||||
- Admin controller: `Unsupervised\Schedular\Offering\OfferingController`
|
||||
- REST endpoint: `Unsupervised\Schedular\Offering\OfferingEndpoint` (public listing includes `instructor_name`)
|
||||
- Availability reconciliation: `Unsupervised\Schedular\Offering\ClassSlotReconciler` (uses `Availability\AvailabilityRepository::findOverlapping`)
|
||||
- REST endpoint: `Unsupervised\Schedular\Offering\OfferingEndpoint`
|
||||
|
||||
## Tests
|
||||
- `tests/Unit/Offering/OfferingControllerTest.php`
|
||||
- `tests/Unit/Offering/OfferingRepositoryTest.php`
|
||||
- `tests/Unit/Offering/OfferingTest.php`
|
||||
- `tests/Unit/Offering/OfferingEndpointTest.php`
|
||||
- `tests/Unit/Offering/ClassSlotReconcilerTest.php`
|
||||
|
||||
@@ -1,408 +0,0 @@
|
||||
# Feature: Parent/Guardian Accounts
|
||||
|
||||
## Overview
|
||||
A parent or guardian registers **once** and manages lessons for **one or more
|
||||
children**, without each child needing their own login. The guardian signs in,
|
||||
picks which child a booking is for, and pays for all of them from one account.
|
||||
|
||||
A guardian may also be a student in their own right — they appear in their own
|
||||
"who is this for?" selector alongside their children, so a parent taking lessons
|
||||
next to their kids needs only the one account.
|
||||
|
||||
## Vocabulary: "child" in the code, "student" in the UI
|
||||
|
||||
The interface says **student** and **profile**; the code says **child** and
|
||||
**family**. This is deliberate, not drift. Every identifier below — the
|
||||
`us_guardian_links` columns, `GuardianService::createChild()`, the `children[]`
|
||||
request parameters, the `child_name` form fields, the `us-scheduler/family`
|
||||
block name and the `[us_family]` shortcode — is a stable contract with the
|
||||
database, saved post content and existing installs, so renaming them would break
|
||||
sites for no user-visible gain. Only the strings a person reads were changed.
|
||||
|
||||
When adding to this feature, keep the split: internal names follow the
|
||||
data model, translatable strings follow the interface.
|
||||
|
||||
## Core Decision: children are accountless WordPress users
|
||||
|
||||
Every `student_id` column in `src/Schema.php` (`us_lessons`, `us_payments`,
|
||||
`us_credits`, `us_group_enrollments`, `us_question_answers`,
|
||||
`us_policy_acceptances`, `us_group_access`) is a `wp_users` id, and booking,
|
||||
billing, credits, policies and registration answers all resolve it directly.
|
||||
|
||||
Rather than change what `student_id` means, **a child is a real `wp_users` row**
|
||||
with the `us_student` role, created without a usable login:
|
||||
|
||||
- no password (`wp_generate_password()` is used and discarded — nothing is ever
|
||||
emailed, so it cannot be guessed into a session),
|
||||
- no real email address; a child gets a placeholder login on the RFC 2606
|
||||
reserved `.invalid` TLD (`us-child-<random>@child.invalid`, see
|
||||
`GuardianService::childEmail()`) — a well-formed address that can never
|
||||
resolve, so nothing about a child's account can be emailed somewhere real,
|
||||
- the `us_child` user meta flag set to `1`, which
|
||||
`Guardian\ChildLoginGate` uses to block authentication outright.
|
||||
|
||||
Consequences:
|
||||
|
||||
- `us_lessons`, `us_group_enrollments`, `us_question_answers` and
|
||||
`us_group_access` are **unchanged** — a child books like any other student.
|
||||
- A child can be promoted to their own login later by setting a password and a
|
||||
real email and clearing `us_child`; no data migrates.
|
||||
- A `us_guardians` link table maps guardian → child.
|
||||
|
||||
The alternative — a standalone `us_students` table decoupled from `wp_users` —
|
||||
was rejected for v1: it changes the meaning of `student_id` on seven tables and
|
||||
requires migrating every existing row.
|
||||
|
||||
## Data Model — `{prefix}us_guardians`
|
||||
|
||||
| Column | Type | Notes |
|
||||
|----------------|-----------------|-----------------------------------------------------------|
|
||||
| `id` | BIGINT UNSIGNED | Primary key |
|
||||
| `guardian_id` | BIGINT UNSIGNED | WordPress user ID of the parent/guardian |
|
||||
| `student_id` | BIGINT UNSIGNED | WordPress user ID of the child |
|
||||
| `relationship` | VARCHAR(50) | Free text shown in admin (e.g. "Parent", "Grandparent"); may be empty |
|
||||
| `created_at` | DATETIME | Insertion time |
|
||||
|
||||
`UNIQUE KEY guardian_student (guardian_id, student_id)` — the same pair can
|
||||
never be linked twice.
|
||||
|
||||
The table is a link table, not a child record: the child's **name** is their
|
||||
`display_name` on `wp_users`, and their birth year is the `us_birth_year`
|
||||
user meta. Keeping them on the user row means the admin student screens,
|
||||
`get_users()` ordering, and every existing `student_id` lookup keep working with
|
||||
no special-casing.
|
||||
|
||||
### The legacy `us_date_of_birth` meta
|
||||
|
||||
This feature originally collected a full date of birth in `us_date_of_birth`.
|
||||
Nothing writes that key any more. It is handled entirely inside
|
||||
`GuardianService`:
|
||||
|
||||
- **Read** — `birthYear()` falls back to the year of the old date when
|
||||
`us_birth_year` is absent, so a child added before the change still shows one
|
||||
without a migration step.
|
||||
- **Write** — `setBirthYear()` deletes `us_date_of_birth` on *every* save,
|
||||
including a save that clears the year. Without that the fallback would
|
||||
resurrect the old date on the next read and the year could never be cleared.
|
||||
|
||||
The upshot is a lazy migration: a child's full date survives until their record
|
||||
is next edited, then goes for good. There is no bulk purge — a site that wants
|
||||
the remaining old dates gone should delete the `us_date_of_birth` meta directly.
|
||||
|
||||
v1 is deliberately **one guardian per child**: `GuardianRepository::insert()`
|
||||
refuses to link a child that already has a guardian. The unique key and the
|
||||
guardian-side lookups already support many-to-many, so adding a second guardian
|
||||
(separated parents) later is an insert, not a migration.
|
||||
|
||||
## Schema changes to existing tables
|
||||
|
||||
| Table | Change | Why |
|
||||
|---|---|---|
|
||||
| `us_payments` | `payer_id BIGINT UNSIGNED NOT NULL DEFAULT 0` + `KEY payer_id` | Who owes the money, when that is not the student |
|
||||
| `us_credits` | `payer_id BIGINT UNSIGNED NOT NULL DEFAULT 0` + `KEY payer_id` | Which account holds the balance |
|
||||
| `us_policy_acceptances` | `accepted_by BIGINT UNSIGNED NOT NULL DEFAULT 0` | Who actually clicked, when that is not the student |
|
||||
|
||||
All three default to `0`, read back as "same as `student_id`" (see
|
||||
`Payment::payerOrStudent()`, `Credit::payerOrStudent()`,
|
||||
`PolicyAcceptance::acceptorOrStudent()`), so **an existing row keeps its current
|
||||
meaning whatever happens** — a pre-guardian payment is still owed by, and was
|
||||
still accepted by, the student it names.
|
||||
|
||||
The installer additionally backfills them (`PaymentRepository::backfillPayerIds()`,
|
||||
`CreditRepository::backfillPayerIds()`, `AcceptanceRepository::backfillAcceptedBy()`,
|
||||
run from `Installer::migrateData()`), because the *balance* lookups key on
|
||||
`payer_id` directly and an indexed `WHERE payer_id = 5` would not see a legacy row
|
||||
still holding `0`. The backfill is idempotent — it only touches rows still at `0` —
|
||||
and the `payerOrStudent()` fallbacks remain as the belt to its braces.
|
||||
|
||||
## Billing: the guardian is the payer, the child is the subject
|
||||
|
||||
- `us_payments.student_id` keeps naming **the child the lesson was for**, so
|
||||
per-child payment reporting is unchanged.
|
||||
- `us_payments.payer_id` names **the guardian who owes it**. Payment notices,
|
||||
receipts and the Stripe intent all resolve the payer.
|
||||
- `us_credits.payer_id` is where a **family balance** lives. A credit from one
|
||||
child's cancelled lesson is held by the guardian and can settle a sibling's
|
||||
charge; `CreditRepository::availableBalance()` and `consume()` operate on the
|
||||
payer.
|
||||
- The **billing-method override** (`comp` / `card` / `etransfer`, user meta read
|
||||
by `BillingMethodResolver`) resolves against the payer, so comping a family is
|
||||
one setting on the guardian rather than one per child.
|
||||
|
||||
`PaymentService::createForRegistration()` takes the payer id alongside the
|
||||
student id; `BookingEndpoint` and `ScheduledBillingRunner` both pass
|
||||
`GuardianService::payerFor( $studentId )` — the child's guardian when they have
|
||||
one, otherwise the student themselves.
|
||||
|
||||
Family discounts are **out of scope** for v1 but are not designed out: with the
|
||||
payer on both the payment and the credit ledger, a discount rule has a family to
|
||||
apply to.
|
||||
|
||||
## Registration
|
||||
|
||||
A **"Who are you registering?"** choice on the existing `[us_student_register]`
|
||||
form (all three signup paths — personal invite, group link, self-approval), as
|
||||
three radios:
|
||||
|
||||
| Choice | `us_registering_for` | Student blocks | Account holder is a student | Answers the studio's questions |
|
||||
|---|---|---|---|---|
|
||||
| Just myself | `self` | no | yes | for themselves |
|
||||
| On behalf of one or more students | `students` | yes | **no** | per student only |
|
||||
| Both — myself and one or more students | `both` | yes | yes | **per student *and* for themselves** |
|
||||
|
||||
The last column follows from the third, and is the whole of it: the
|
||||
account-scope questions describe a *student* — instrument, level, school — so
|
||||
they are asked of everyone being registered as one. Under `both` that is each
|
||||
student **and** the account holder, whose answers are stored against their own
|
||||
user id, not shared with anyone. Under `students` the account holder is not a
|
||||
student, so anything posted for them is ignored outright.
|
||||
|
||||
Required answers are checked in two passes rather than one, so the error can say
|
||||
whose are missing: `both` would otherwise have to blame "each student" for the
|
||||
account holder's own blank field.
|
||||
|
||||
Radios rather than checkboxes because the three answers are mutually exclusive:
|
||||
"both" only means anything as a third choice alongside the other two. Either
|
||||
student-bearing choice requires at least one student name.
|
||||
|
||||
Anything unrecognised — a form posted without the field, an old cached page, a
|
||||
crafted request — is read as `self`, the choice that collects the least and
|
||||
grants the least. A missing radio must never be taken as "register these
|
||||
children".
|
||||
|
||||
### The account holder as a student
|
||||
|
||||
This replaced a single "I'm registering as a parent or guardian" checkbox, which
|
||||
could only say *whether there were children to add*. It could not say whether the
|
||||
**account holder** was a student, so `bookableStudents()` always offered them
|
||||
their own name and every guardian could book themselves a lesson nobody intended
|
||||
to sell.
|
||||
|
||||
`students` now records `us_guardian_only = 1` and `bookableStudents()` leaves the
|
||||
account holder out. The flag is stored as the **negative** deliberately: every
|
||||
account predating the choice is a bookable student, and absence has to keep
|
||||
meaning exactly that, or the picker would silently stop offering people
|
||||
themselves on upgrade. `GuardianService::setGuardianOnly()` clears the key rather
|
||||
than writing `0`, so "not set" stays the one spelling of "yes, a student".
|
||||
|
||||
One guard: a guardian-only account with **nobody linked to it** is still offered
|
||||
itself, because an empty picker is no way to book at all. They can put the
|
||||
account right from the profile page.
|
||||
|
||||
Per child the form collects:
|
||||
- **Name** (required)
|
||||
- **Birth year** (required, `us_birth_year` meta) — a four-digit year between
|
||||
1900 and the current year. `GuardianService::normaliseBirthYear()` is the one
|
||||
definition of what counts, shared by the signup form's up-front validation and
|
||||
by `createChild()`/`updateChild()` themselves, so a bad year is refused rather
|
||||
than quietly discarded and a typo cannot leave a nonsense age on the record.
|
||||
- **Every account-scope registration question** (`Registration\Question`,
|
||||
`SCOPE_ACCOUNT`) — asked once per child, not once per guardian, because in
|
||||
practice they describe the student (instrument, level, school). The guardian
|
||||
answers them on the child's behalf; the answer row's `student_id` is the child.
|
||||
|
||||
### What the account holder gives when they are a student
|
||||
|
||||
Under `self` and `both` the account holder is a student too, so the **About you**
|
||||
panel asks them for exactly the same two things every other student gives: their
|
||||
**birth year** (`us_birth_year`, the same meta key and the same
|
||||
`normaliseBirthYear()` rule — `GuardianService::setBirthYear()` writes both cases)
|
||||
and the **account-scope questions**. Both are stored against their own user id.
|
||||
|
||||
The panel sits on the main form, above the students, rather than behind a "Next".
|
||||
The questions used to be a second step, which put what the studio needs to know
|
||||
about an adult student on a screen they reached only after everything else; now
|
||||
one page holds one decision each — who you are registering, about you, about
|
||||
them.
|
||||
|
||||
`register.js` takes the whole **About you** fieldset out of play under
|
||||
`students`, by `disabled` as well as `hidden`: a disabled fieldset is neither
|
||||
validated nor submitted, so a `required` field cannot block a form on a control
|
||||
nobody can reach. The students block is toggled the same way, and the server
|
||||
enforces both rules regardless — which is what makes them hold with JavaScript
|
||||
off. The profile screen has no such problem: its forms are always visible, so the
|
||||
attribute is static there.
|
||||
|
||||
Name and birth year are marked required in the labels the same way a required
|
||||
question is; `[data-us-child-required]` keeps the attribute on the child fields
|
||||
in step with the block they live in.
|
||||
|
||||
Order of operations in `RegistrationPage::handleSubmit()`:
|
||||
|
||||
1. Validate the account holder's own fields (email, password, policies, and —
|
||||
when they are a student — their birth year and answers).
|
||||
2. Validate **every** child block — a missing name, a missing or unusable birth
|
||||
year, or a missing required per-child answer fails the whole submission
|
||||
**before** any user is created, so a half-registered family is never left
|
||||
behind. An **entirely empty** block is dropped instead, because the form
|
||||
always renders one spare for "add another"; a block with anything at all
|
||||
typed into it is kept and reported on, rather than silently discarding what
|
||||
the guardian entered.
|
||||
3. Create the guardian user, and record `us_guardian_only` and (when they are a
|
||||
student) their birth year against it.
|
||||
4. For each child: create the accountless user, link it, record its answers, and
|
||||
record the signup policy acceptances **against the child** with
|
||||
`accepted_by = <guardian>`.
|
||||
5. Roll back — every child user created so far is deleted and the guardian user
|
||||
with them — if any child creation fails, so a partial family never persists.
|
||||
|
||||
A guardian who does not tick the box registers exactly as before; nothing about
|
||||
the single-student flow changes.
|
||||
|
||||
### Policy acceptance
|
||||
|
||||
`us_policy_acceptances` records **one row per child** for each signup-scoped
|
||||
policy, with:
|
||||
|
||||
- `student_id` = the child (who the policy binds),
|
||||
- `accepted_by` = the guardian (who actually agreed),
|
||||
- `registration_type = 'account'`, `registration_id` = the child's user ID.
|
||||
|
||||
The guardian also gets their own acceptance row (`student_id = accepted_by =
|
||||
guardian`) whether or not they book for themselves — they agreed to the terms as
|
||||
an account holder. This is the legally meaningful record: "guardian X accepted
|
||||
policy version N on behalf of child Y at time T from IP Z".
|
||||
|
||||
Booking-scope policies are accepted at booking time by whoever is signed in;
|
||||
`BookingEndpoint` passes the same `accepted_by` when a guardian books for a
|
||||
child.
|
||||
|
||||
## Managing children
|
||||
|
||||
`[us_family]` (block: **Profile**) renders the guardian's manage-children screen:
|
||||
list the children, add one, edit a name/birth year, remove one.
|
||||
|
||||
- **Add** creates another accountless child user and links it. Account-scope
|
||||
questions are asked here too, so a child added later carries the same
|
||||
information as one added at signup.
|
||||
- **Edit** updates `display_name` and `us_birth_year`.
|
||||
- **Remove** unlinks the child and **deletes the child user**, but only when the
|
||||
child has no lessons and no enrolments — a child with history is refused, so
|
||||
removing one can never orphan a lesson, payment or credit
|
||||
(`GuardianService::removeChild()`). The guardian is told to contact the studio
|
||||
instead.
|
||||
|
||||
Submissions are processed on `template_redirect` (like registration) and
|
||||
post/redirect/get back to the page, so a refresh cannot resubmit.
|
||||
|
||||
## Booking
|
||||
|
||||
`GET /bookings` returns the lessons of the signed-in user **and of every child
|
||||
they are guardian for**, each row carrying `student_id` and `student_name` so
|
||||
the list can be grouped by child.
|
||||
|
||||
`POST /bookings` takes an optional **`student_id`**:
|
||||
|
||||
- absent or `0` → the current user books for themselves (unchanged),
|
||||
- a child's id → the endpoint verifies with `GuardianService::canActFor()` that
|
||||
the current user is that child's guardian, and returns `403 forbidden` when
|
||||
they are not. **This is the authorisation boundary of the feature**: without
|
||||
it any student could book, and bill, against any user id they cared to send.
|
||||
|
||||
The booking form gains a "Who is this for?" `<select>`, rendered only when the
|
||||
account has more than one person on it, so a single-student account's form is
|
||||
unchanged.
|
||||
|
||||
**Children are listed first and the account holder last**
|
||||
(`GuardianService::bookableStudents()`). The order is the whole point: a
|
||||
guardian's normal case is booking for a child, so the default selection — the
|
||||
one a parent gets by not touching the picker at all — is a child, never
|
||||
themselves. Booking for the wrong child is a correctable inconvenience; silently
|
||||
billing a parent's account for a lesson meant for their kid is the error worth
|
||||
designing out. The guardian is still offered, last, so a parent taking lessons
|
||||
alongside their children can book for themselves.
|
||||
|
||||
The list is rendered server-side into `data-students` on the page wrapper and
|
||||
read by `assets/js/guardian.js`, which both the booking and group-class scripts
|
||||
share.
|
||||
|
||||
`POST /bookings/<id>/cancel` accepts a cancellation from the lesson's student
|
||||
**or** their guardian, subject to the same cancellation cutoff.
|
||||
|
||||
## Group classes
|
||||
|
||||
`POST /enrollments` carries the same optional `student_id` and the same
|
||||
`canActFor()` check, `GET /enrollments` covers the household, and
|
||||
`POST /enrollments/<id>/withdraw` accepts the guardian — group enrolment is the
|
||||
other place a family books and pays, so it gets the identical treatment rather
|
||||
than being left as a single-student-only path.
|
||||
|
||||
## Admin
|
||||
|
||||
- **Students list** gains a **Profile** column: a child links to its
|
||||
guardian's detail screen, a guardian lists its children as links. Children are
|
||||
listed alongside every other student rather than nested, so nothing about
|
||||
finding a student changes.
|
||||
- **Student detail** gains a **Profile** panel — the guardian (for a child) or
|
||||
the children (for a guardian), each a link to the other's screen — and the
|
||||
credit balance shown is the **payer's** balance, labelled with whose it is, so
|
||||
an admin looking at a child sees the family balance that will actually settle
|
||||
their charges rather than an empty per-child one.
|
||||
- Registration answers and policy acceptances on a child's screen show
|
||||
"accepted by <guardian>" where the acceptor differs from the student.
|
||||
|
||||
Creating or attaching a child from wp-admin is **out of scope** for v1; a studio
|
||||
admin adds children through the guardian's own family screen or asks the
|
||||
guardian to.
|
||||
|
||||
## Capabilities
|
||||
|
||||
No new capability. A child user holds the `us_student` role (so every existing
|
||||
`student_id` capability check keeps working) but can never sign in
|
||||
(`Guardian\ChildLoginGate` blocks `wp_authenticate_user` and forces
|
||||
`user_has_cap` to withhold `book_lesson` from a child), so the role grants them
|
||||
nothing in practice. Guardians act for children through
|
||||
`GuardianService::canActFor()`, checked at every REST and form boundary, rather
|
||||
than through a capability.
|
||||
|
||||
## Instructor view
|
||||
|
||||
Lesson lists show the student's name. Where that student is a child, the
|
||||
instructor also sees the guardian's name and email — the contact they actually
|
||||
need — via `GuardianService::contactFor()`.
|
||||
|
||||
## Implementation
|
||||
|
||||
- Models: `Unsupervised\Schedular\Guardian\GuardianLink`
|
||||
- Repository: `Unsupervised\Schedular\Guardian\GuardianRepository`
|
||||
- Service: `Unsupervised\Schedular\Guardian\GuardianService` (child creation,
|
||||
`canActFor()`, `payerFor()`, `contactFor()`, removal rules)
|
||||
- Login block: `Unsupervised\Schedular\Guardian\ChildLoginGate`
|
||||
- Frontend: `Unsupervised\Schedular\Guardian\FamilyPage` (`[us_family]`)
|
||||
- Shared question field: `Unsupervised\Schedular\Registration\QuestionField`
|
||||
(one question rendered under a caller-supplied input name, so the same
|
||||
question can appear once per child without colliding)
|
||||
- Front-end script: `assets/js/guardian.js` (the shared picker),
|
||||
`assets/js/register.js` (guardian toggle + "add another child")
|
||||
- Extended: `Auth\RegistrationPage` (guardian checkbox, child blocks, per-child
|
||||
answers/acceptances, rollback), `Booking\BookingEndpoint` and
|
||||
`GroupClass\EnrollmentEndpoint` (`student_id` param + guardian
|
||||
authorisation, household listings), `Booking\BookingPage`,
|
||||
`GroupClass\GroupClassPage`, `Payment\PaymentService`,
|
||||
`Payment\PaymentRepository`, `Payment\CreditRepository`,
|
||||
`Payment\ScheduledBillingRunner` (one notice per payer),
|
||||
`Policy\AcceptanceRepository`, `Registration\RegistrationGate`,
|
||||
`Auth\StudentController`, `Installer` (backfills)
|
||||
- Schema: `us_guardians`; `us_payments.payer_id`; `us_credits.payer_id`;
|
||||
`us_policy_acceptances.accepted_by`
|
||||
|
||||
## Tests
|
||||
|
||||
- `tests/Unit/Guardian/GuardianLinkTest.php`
|
||||
- `tests/Unit/Guardian/GuardianRepositoryTest.php`
|
||||
- `tests/Unit/Guardian/GuardianServiceTest.php`
|
||||
- `tests/Unit/Guardian/ChildLoginGateTest.php`
|
||||
- `tests/Unit/Guardian/FamilyPageTest.php`
|
||||
- `tests/Unit/Auth/RegistrationPageTest.php` (guardian signup path)
|
||||
- `tests/Unit/Booking/BookingEndpointTest.php` and
|
||||
`tests/Unit/GroupClass/EnrollmentEndpointTest.php` (booking/enrolling for a
|
||||
child, and the 403 when the caller is not the guardian)
|
||||
- `tests/Unit/Booking/BookingPageTest.php` (children lead the embedded list)
|
||||
- `tests/Unit/Payment/PaymentServiceTest.php`, `CreditRepositoryTest.php`,
|
||||
`ScheduledBillingRunnerTest.php` (payer, family balance, one notice)
|
||||
|
||||
## Related
|
||||
|
||||
`account-registration.md`, `lesson-booking.md`, `payments.md`, `credits.md`,
|
||||
`group-classes.md`, `student-administration.md`, `policies.md`,
|
||||
`registration-questions.md`.
|
||||
@@ -54,11 +54,6 @@ and `instructor_id` query params as the page and returns `text/csv` with a
|
||||
`Content-Disposition: attachment` header. Instructor requests are scoped to
|
||||
their own rows regardless of `instructor_id`.
|
||||
|
||||
Fields that a spreadsheet would interpret as a formula (leading `=`, `+`, `-`,
|
||||
`@`, tab, or CR — e.g. a hostile student display name) are prefixed with an
|
||||
apostrophe so the export can never carry CSV formula injection into Excel or
|
||||
Google Sheets.
|
||||
|
||||
## Implementation
|
||||
|
||||
- Report aggregator (pure totals + CSV): `Unsupervised\Schedular\Payment\PaymentReport`
|
||||
|
||||
@@ -6,9 +6,7 @@ falls back to **e-transfer** — a pending payment a studio admin marks received
|
||||
so everything works without any credentials. When Stripe **is** configured the
|
||||
default rail becomes the **credit card**. The studio admin can override any
|
||||
student's method (card / e-transfer / comp). Single bookings are charged once;
|
||||
weekly reservations and group classes are charged the full term upfront (a
|
||||
`full_term` price once, or a per-lesson `one_time` price × the occurrences
|
||||
reserved — see `lesson-booking.md`). A
|
||||
weekly reservations and group classes are charged the full term upfront. A
|
||||
numbered receipt is emailed automatically when a payment is marked paid.
|
||||
|
||||
> **Implemented:** the payment ledger, studio settings, method resolution
|
||||
@@ -88,9 +86,6 @@ After booking, the destination on a payment can be corrected per booking:
|
||||
| `status` | VARCHAR(20) | `pending` / `paid` / `failed` / `refunded` |
|
||||
| `tax_rate` | DECIMAL(5,2) | HST rate % frozen at booking; editable until paid |
|
||||
| `tax_amount` | DECIMAL(10,2) | Computed tax in dollars (`amount × tax_rate / 100`) |
|
||||
| `due_date` | DATE | When a *scheduled* payment is due; NULL = due at registration (`Payment::isScheduled()`) |
|
||||
| `period_key` | VARCHAR(20) | Scheduled-billing dedup key: session date (weekly) or `YYYY-MM` (monthly); NULL otherwise |
|
||||
| `notice_batch` | VARCHAR(32) | Shared reference for the payments one due-notice email covers, so a lump-sum e-transfer reconciles to them; NULL otherwise |
|
||||
| `etransfer_email` | VARCHAR(191) | Frozen e-transfer destination; editable until confirmed |
|
||||
| `stripe_payment_intent_id` | VARCHAR(255) | Stripe PaymentIntent id; NULL for e-transfer / comp |
|
||||
| `receipt_number` | VARCHAR(50) | Sequential receipt id; set when `paid` |
|
||||
@@ -98,84 +93,13 @@ After booking, the destination on a payment can be corrected per booking:
|
||||
| `created_at` | DATETIME | Insertion time |
|
||||
| `paid_at` | DATETIME | When marked `paid`; NULL otherwise |
|
||||
|
||||
## Price Display and the Pay Agreement
|
||||
Every price a student is shown on the front end carries its **cadence** — the
|
||||
offering's `billing_mode` in the words the student needs:
|
||||
|
||||
| `billing_mode` | Shown as | Explained beneath as |
|
||||
|----------------|-----------------------------------|------------------------------------------------------------|
|
||||
| `one_time` | `at booking` | Charged once, when you book. |
|
||||
| `full_term` | `up front` | Charged once, up front, for the whole term. |
|
||||
| `weekly` | `weekly` | Charged for each lesson, 24 hours before it starts. |
|
||||
| `monthly` | `per lesson monthly` / `monthly` | Charged on the 1st of each month, for that month's lessons.|
|
||||
|
||||
So a lesson type reads `50.00 CAD at booking` in the booking form's type picker,
|
||||
and a group class card reads `120.00 CAD up front`. A free offering shows `Free`.
|
||||
|
||||
**`monthly` reads differently per offering kind, because it *bills* differently.**
|
||||
A private lesson's price is a per-lesson fee and its monthly charge is that
|
||||
month's lessons × the fee, so the fee is quoted **per lesson**
|
||||
(`50.00 CAD per lesson monthly`). A monthly group class is priced **per month** —
|
||||
`ScheduledBillingRunner::billGroupMonthly()` charges the fee once for the month
|
||||
however many times the class meets in it — so its figure is quoted as it stands
|
||||
(`120.00 CAD monthly`). The display split is `isPerLessonMonthly()` in
|
||||
`assets/js/pricing.js`; the billing split is the one place the monthly rule
|
||||
differs between the two kinds.
|
||||
|
||||
Before a booking or enrolment can be submitted, the form shows the price again as
|
||||
a summary block with a **required agreement checkbox** — the second confirmation,
|
||||
distinct from the policy acceptances above it:
|
||||
|
||||
> ☐ I agree to pay 56.50 CAD at booking.
|
||||
|
||||
The agreed figure is the amount actually billed, so the studio **HST rate** is
|
||||
added to it (`usScheduler.taxRate`, localized from `us_hst_rate`) and broken out
|
||||
above the checkbox — matching the total `Payment::total()` charges. A comped
|
||||
student is not taxed and is not charged at all, so for them the quoted figure is
|
||||
an upper bound. A free offering has nothing to agree to and shows no block.
|
||||
|
||||
Cadence-specific wording:
|
||||
|
||||
- **Weekly reservation of a `one_time` lesson type** — the fee is charged once per
|
||||
week claimed, so the agreement states the per-lesson amount and the total as a
|
||||
ceiling ("up to 12 lessons, 678.00 CAD in total"). The occurrence count mirrors
|
||||
`BookingEndpoint::MAX_WEEKLY_OCCURRENCES`; a slot another student takes first is
|
||||
simply not claimed, so the real charge can come in under it.
|
||||
- **`weekly` / `monthly`** — nothing is taken at registration, so the agreement is
|
||||
to the recurring charge: "I agree to pay 56.50 CAD per lesson, billed monthly."
|
||||
A monthly **group class** agrees to its monthly figure instead ("I agree to pay
|
||||
138.00 CAD monthly."), matching how its price is quoted on the card.
|
||||
|
||||
All of this lives in `assets/js/pricing.js` (`window.usPricing`), shared by the
|
||||
booking and group-class flows so a price reads the same wherever it is met. The
|
||||
script is registered as `us-scheduler-pricing` and is a dependency of both
|
||||
`us-scheduler` and `us-scheduler-group`.
|
||||
|
||||
## Payment Flow
|
||||
1. During registration the front-end calls `POST /payments/intent` — but only when the registration response carried a `payment` summary (unpriced registrations return `payment: null` and skip the payment step). The intent call creates a Stripe PaymentIntent for a `card` student and returns the client secret. (`etransfer` returns a `pending` payment; `comp` returns none.)
|
||||
1. During registration the front-end calls `POST /payments/intent`, which creates a Stripe PaymentIntent for a `card` student and returns the client secret. (`etransfer` returns a `pending` payment; `comp` returns none.)
|
||||
2. The browser confirms the card payment with Stripe.
|
||||
3. Stripe calls `POST /payments/webhook`; on `payment_intent.succeeded` the payment is marked `paid`, `paid_at` is stamped, and the linked lesson/enrolment is `confirmed`.
|
||||
4. On transition to `paid`, `ReceiptMailer` assigns a `receipt_number`, emails the student a receipt, and stamps `receipt_sent_at`.
|
||||
5. For an e-transfer, the studio admin later calls `PATCH /payments/{id}` to mark it `paid`, which triggers the same confirmation + receipt.
|
||||
|
||||
## Scheduled Billing (weekly / monthly)
|
||||
`weekly` and `monthly` offerings are **not** charged at registration. The booking /
|
||||
enrolment succeeds with `payment: null`; the lesson is confirmed (or the enrolment stays
|
||||
active) immediately, and payments are generated later by the daily
|
||||
`us_generate_due_payments` cron scan (`Payment\ScheduledBillingRunner`). Each generated
|
||||
payment carries a `due_date` and `period_key`, flows through the same
|
||||
`PaymentService::createForRegistration` (so HST, method resolution, e-transfer freezing
|
||||
and comp auto-pay are identical), and the student is emailed one consolidated itemised
|
||||
notice per scan (`Payment\PaymentDueMailer`). Because these payments are scheduled,
|
||||
`PaymentService::voidPending` never voids them — cancelling one lesson leaves a shared
|
||||
monthly charge (and every other lesson it covers) untouched, and never rebills. Full
|
||||
model, dedup, and the four generation cases are documented in `scheduled-billing.md`.
|
||||
|
||||
Cancelling a lesson that was **already paid** issues the student an account credit for
|
||||
that lesson's share of what they paid; the next daily scan applies any available credit
|
||||
against their due charges (reducing `us_payments.credit_applied` → `Payment::netDue()`)
|
||||
before emailing the notice. See `credits.md`.
|
||||
|
||||
## REST API
|
||||
| Method | Endpoint | Permission |
|
||||
|---------|---------------------------------------------|-----------------------------|
|
||||
@@ -192,19 +116,9 @@ See `payment-reporting.md` for the monthly report and CSV export endpoints.
|
||||
- Receipts: `Unsupervised\Schedular\Payment\ReceiptMailer`
|
||||
- Settings page: `Unsupervised\Schedular\Payment\StudioSettings`
|
||||
- REST endpoint: `Unsupervised\Schedular\Payment\PaymentEndpoint`
|
||||
- Front-end price display + pay agreement: `assets/js/pricing.js` (`window.usPricing`), registered and localized with `taxRate` by `Unsupervised\Schedular\ShortcodeRegistrar`
|
||||
|
||||
## Tests
|
||||
- `tests/Unit/ShortcodeRegistrarTest.php` (pricing helper registration + localized `taxRate`)
|
||||
- `tests/Unit/Payment/PaymentRepositoryTest.php`
|
||||
- `tests/Unit/Payment/PaymentTest.php`
|
||||
- `tests/Unit/Payment/StripeGatewayTest.php`
|
||||
- `tests/Unit/Payment/ReceiptMailerTest.php`
|
||||
|
||||
## Who Pays
|
||||
`us_payments.student_id` names the student the charge is *for*;
|
||||
`us_payments.payer_id` names who **owes** it — a child's guardian, or 0 meaning
|
||||
the student pays for themselves (`Payment::payerOrStudent()`). The billing
|
||||
method, receipts, payment notices and the Stripe payment step all resolve the
|
||||
payer, so a family is billed and comped as one account while per-child reporting
|
||||
is unchanged. See `parent-guardian-accounts.md`.
|
||||
|
||||
@@ -1,80 +0,0 @@
|
||||
# Feature: Plugin Self-Update from Gitea Releases
|
||||
|
||||
## Overview
|
||||
WordPress sites running this plugin receive updates directly from the Gitea
|
||||
repository's releases — no wordpress.org listing and no manual zip uploads.
|
||||
Publishing a release is the whole deploy: bump the version, merge to `main`,
|
||||
tag `vX.Y.Z` in Gitea. Every site sees the update on its next check and can
|
||||
install it with one click, or unattended if the site admin enables
|
||||
auto-updates for the plugin.
|
||||
|
||||
## How It Works
|
||||
|
||||
### Release side (`.gitea/workflows/release.yml`)
|
||||
Pushing a `v*` tag (including tags created through Gitea's "New Release" UI)
|
||||
triggers the release workflow, which:
|
||||
|
||||
1. Fails if the tag does not match the `Version:` plugin header — a mismatch
|
||||
would make sites see a phantom update forever, or never see a real one.
|
||||
2. Runs the test suite.
|
||||
3. Builds the distributable zip via `composer build` (`bin/build-zip.sh`):
|
||||
a single top-level `unsupervised-schedular/` folder with a production
|
||||
(no-dev) Composer autoloader.
|
||||
4. Creates the release for the tag (or reuses one created via the UI) and
|
||||
attaches the zip as a release asset. Versions containing a hyphen
|
||||
(e.g. `1.2.3-rc.1`) are flagged as pre-releases.
|
||||
|
||||
The attached asset — not Gitea's auto-generated source archive — is the
|
||||
update package. Source archives have the wrong top-level folder name and no
|
||||
`vendor/` directory, so WordPress could not install them.
|
||||
|
||||
### Site side (`src/Update/UpdateChecker.php`)
|
||||
The plugin header declares:
|
||||
|
||||
```
|
||||
Update URI: https://git.unsupervised.ca/Unsupervised/unsupervised-scheduler
|
||||
```
|
||||
|
||||
Since WP 5.8 that header both blocks wordpress.org from ever serving an
|
||||
update for a same-slug plugin and makes core fire the
|
||||
`update_plugins_git.unsupervised.ca` filter during update checks.
|
||||
`UpdateChecker` (registered in `Plugin::boot()`) answers that filter:
|
||||
|
||||
1. Fetches `GET /api/v1/repos/Unsupervised/unsupervised-scheduler/releases/latest`
|
||||
(anonymous — the repo is public). The `/latest` endpoint excludes drafts
|
||||
and pre-releases, so `-rc` builds are never offered to sites.
|
||||
2. Caches the result (including failures) in the
|
||||
`us_schedular_latest_release` transient for 6 hours.
|
||||
3. Strips the leading `v` from the tag and compares against `USC_VERSION`
|
||||
with `version_compare`; PHP orders `1.0.0-rc.2 < 1.0.0` correctly.
|
||||
4. When newer, returns the release's first `.zip` asset as the update
|
||||
package. Core takes over from there: Plugins-screen notice, one-click
|
||||
update, and WP-Cron auto-updates if enabled.
|
||||
5. When not newer — the site is current, or the lookup failed — returns a
|
||||
`no_update` payload (installed version, empty package). This keeps the
|
||||
plugin in core's `update_plugins` transient so core's `update-supported`
|
||||
flag stays set and the **Enable auto-updates** toggle shows on the
|
||||
Plugins screen. Without it, an off-directory plugin is absent from the
|
||||
transient between releases and the toggle never appears.
|
||||
|
||||
Any API failure, malformed response, or asset-less release degrades to
|
||||
"no update available" (the `no_update` payload) — never an error surfaced
|
||||
to the site, and never a lost auto-update toggle during a Gitea blip.
|
||||
|
||||
## Cutting a Release
|
||||
1. Bump the version in `unsupervised-schedular.php` (both the `Version:`
|
||||
header and the `USC_VERSION` constant) and merge to `main`.
|
||||
2. Tag the merge commit `vX.Y.Z` — via Gitea's New Release UI or
|
||||
`git tag vX.Y.Z && git push origin vX.Y.Z`.
|
||||
3. The release workflow attaches the zip; sites pick the update up on their
|
||||
next check (twice daily via cron, or immediately from
|
||||
Dashboard → Updates → Check again).
|
||||
|
||||
## Classes
|
||||
|
||||
| Class | Responsibility |
|
||||
|---|---|
|
||||
| `Update\UpdateChecker` | Answers core's `update_plugins_{hostname}` filter from the Gitea releases API |
|
||||
|
||||
## Tests
|
||||
- `tests/Unit/Update/UpdateCheckerTest.php`
|
||||
@@ -40,23 +40,14 @@ The studio admin drafts, versions, and publishes policies (e.g. cancellation, pa
|
||||
|
||||
## Versioning & Acceptance Rules
|
||||
- Editing a published policy creates a new `draft` version; the old version stays `published` until the draft is published.
|
||||
- Editing a `draft` version rewrites it in place — nobody has accepted it yet, so there is nothing to preserve and no new version is created. `PATCH /policies/{id}/versions/{vid}` allows only this case; the admin page also accepts an edit to a `published` or `archived` version and branches a new draft from it.
|
||||
- Publishing a draft sets it `published`, stamps `published_at`, archives the prior version, and points `us_policies.current_version_id` at it.
|
||||
- The registration gate requires acceptance of the `current_version_id` of every policy. Because acceptance is tied to `policy_version_id`, a newly published version is unaccepted and must be re-accepted at the student's next booking.
|
||||
|
||||
## Admin Interface
|
||||
**Policies** in wp-admin (`manage_policies`, studio admin only):
|
||||
- Create a policy; draft version bodies
|
||||
- **Rename** the selected policy (`rename_policy`, `PolicyRepository::updateTitle()`). Only the title changes: the slug is the identifier `findBySlug()` and the gates resolve policies by, so renaming can never detach a policy from versions students have already accepted. A blank title, or one longer than `Policy::MAX_TITLE_LENGTH`, is ignored
|
||||
- View the content of any version (`?page=us-policies&policy_id={id}&version_id={vid}`), whatever its status
|
||||
- Edit from the viewer: a draft is saved in place; editing a published or archived version instead saves the text as a **new draft version** (the viewer follows to it), so text students have already accepted is never rewritten
|
||||
- Create a policy; draft and edit version bodies
|
||||
- Publish a draft version; view acceptance history per version
|
||||
|
||||
## Rendering a Policy Body
|
||||
Bodies are typed into a plain textarea, so most are written as blank-line-separated prose with no markup. `PolicyVersion::bodyHtml()` is the single render path — `wp_kses_post()` then `wpautop()`, the same treatment WordPress gives post content — so unmarked-up text arrives as real paragraphs and bodies that do carry markup are left alone. It feeds the booking/enrolment JSON (`GET /policies`), the signup form, and the admin version viewer, which therefore previews exactly what students see.
|
||||
|
||||
The acceptance markup (`.us-policy` / `.us-policy-body`) is styled in `assets/css/frontend.css` as a bounded, vertically scrolling reading box with `overflow-wrap: break-word`, so a long policy or a pasted URL cannot force a horizontal scrollbar or push the accept checkbox out of view. `RegistrationPage` enqueues that stylesheet for the signup gate; `BookingPage` and `GroupClassPage` already did.
|
||||
|
||||
## REST API
|
||||
| Method | Endpoint | Permission |
|
||||
|----------|-----------------------------------------------------------------|-------------------|
|
||||
@@ -83,11 +74,3 @@ cover every policy's current version or the registration is rejected.
|
||||
- `tests/Unit/Policy/PolicyVersionRepositoryTest.php`
|
||||
- `tests/Unit/Policy/AcceptanceRepositoryTest.php`
|
||||
- `tests/Unit/Policy/PolicyServiceTest.php`
|
||||
- `tests/Unit/Policy/PolicyControllerTest.php`
|
||||
- `tests/Unit/Policy/PolicyEndpointTest.php`
|
||||
|
||||
## Who Accepted
|
||||
`us_policy_acceptances.accepted_by` records the person who actually ticked the
|
||||
box, where that differs from `student_id` — a guardian agreeing on a child's
|
||||
behalf. It defaults to 0, read back as "the student agreed for themselves"
|
||||
(`PolicyAcceptance::acceptorOrStudent()`). See `parent-guardian-accounts.md`.
|
||||
|
||||
@@ -1,30 +1,19 @@
|
||||
# Feature: Registration Questions
|
||||
|
||||
## Overview
|
||||
Questions come in two **scopes**:
|
||||
|
||||
- **Offering scope** (`scope = 'offering'`) — intake questions a registrant answers when
|
||||
booking a specific offering; authored per offering by the studio admin or the owning
|
||||
instructor, and stored against the resulting lesson or group enrolment.
|
||||
- **Account scope** (`scope = 'account'`) — studio-wide questions every new student answers
|
||||
**once at account signup**, on the same page as their name and password. Authored by the
|
||||
studio admin only, and stored against the new user account.
|
||||
|
||||
Both scopes share the `us_questions` / `us_question_answers` tables, the same field types,
|
||||
and the same authoring page (**Offerings → Questions**).
|
||||
Each offering can carry a set of intake questions the registrant must answer when booking. Questions are authored per offering by the studio admin or the owning instructor, and answers are stored against the resulting lesson or group enrolment.
|
||||
|
||||
## Data Model — `{prefix}us_questions`
|
||||
|
||||
| Column | Type | Notes |
|
||||
|---------------|------------------|-------------------------------------------------------------|
|
||||
| `id` | BIGINT UNSIGNED | Primary key |
|
||||
| `offering_id` | BIGINT UNSIGNED | FK → `us_offerings.id` for offering-scoped questions; NULL for account-scoped |
|
||||
| `scope` | VARCHAR(20) | `offering` (default) or `account` |
|
||||
| `offering_id` | BIGINT UNSIGNED | FK → `us_offerings.id` — questions are scoped per offering |
|
||||
| `label` | VARCHAR(255) | The question text shown to the registrant |
|
||||
| `field_type` | VARCHAR(20) | `text` / `textarea` / `select` / `checkbox` |
|
||||
| `options` | TEXT | JSON array of choices (for `select`); NULL otherwise |
|
||||
| `is_required` | TINYINT(1) | 1 = registrant must answer to continue |
|
||||
| `sort_order` | INT | Display order within the scope |
|
||||
| `sort_order` | INT | Display order within the offering |
|
||||
| `is_active` | TINYINT(1) | 0 = retired, 1 = shown on the form |
|
||||
| `created_at` | DATETIME | Insertion time |
|
||||
|
||||
@@ -34,37 +23,27 @@ and the same authoring page (**Offerings → Questions**).
|
||||
|---------------------|------------------|--------------------------------------------------------|
|
||||
| `id` | BIGINT UNSIGNED | Primary key |
|
||||
| `question_id` | BIGINT UNSIGNED | FK → `us_questions.id` |
|
||||
| `registration_type` | VARCHAR(20) | `lesson`, `enrollment`, or `account` |
|
||||
| `registration_id` | BIGINT UNSIGNED | FK → `us_lessons.id`, `us_group_enrollments.id`, or the user ID (account scope) |
|
||||
| `registration_type` | VARCHAR(20) | `lesson` or `enrollment` |
|
||||
| `registration_id` | BIGINT UNSIGNED | FK → `us_lessons.id` or `us_group_enrollments.id` |
|
||||
| `student_id` | BIGINT UNSIGNED | WordPress user ID (denormalised for fast lookup) |
|
||||
| `answer_value` | TEXT | The submitted answer (checkbox stored as `0`/`1`) |
|
||||
| `created_at` | DATETIME | Insertion time |
|
||||
|
||||
The `registration_type` + `registration_id` pair is a polymorphic reference shared
|
||||
with `us_policy_acceptances` (see `policies.md`), letting answers attach to a private
|
||||
lesson, a group enrolment, or an account signup (`account` + the user ID).
|
||||
with `us_policy_acceptances` (see `policies.md`), letting answers attach to either a
|
||||
private lesson or a group enrolment.
|
||||
|
||||
## Offering-scope Flow
|
||||
1. On the booking form, the front-end calls `GET /offerings/{id}/questions`.
|
||||
## Flow
|
||||
1. On the registration form, the front-end calls `GET /offerings/{id}/questions`.
|
||||
2. Required questions block submission until answered.
|
||||
3. Answers are sent in the `answers[]` array on `POST /bookings` or `POST /enrollments` and written to `us_question_answers` alongside the new registration row.
|
||||
|
||||
## Account-scope Flow (signup)
|
||||
1. The `[us_student_register]` page (`Auth\RegistrationPage`) loads active account-scope questions via `QuestionRepository::findByScope('account')`.
|
||||
2. The form is a single page. The questions sit in an **About you** panel, alongside the account holder's birth year, between the "Who are you registering?" choice and the students being added. `assets/js/register.js` disables and hides that whole panel when the choice is "on behalf of students" — the questions describe a student and a pure guardian is not one — and puts the same questions in every child block instead. Progressive enhancement: without JS every panel shows and the single submit still works. This applies to **every** signup path (invite, group link, self-approval).
|
||||
3. On submit, required answers are validated **before** the user is created (a missing answer returns an error and creates no account); after creation each answered question is written to `us_question_answers` with `registration_type = 'account'`, `registration_id = student_id = <new user ID>`.
|
||||
4. A studio admin reviews the answers on the student's admin screen under **Registration Information** (`Auth\StudentHistory::registrationInfo()` lists every account question paired with the student's answer, "—" when unanswered). These rows are excluded from the offering-scope "Intake answers" table.
|
||||
|
||||
## Admin Interface
|
||||
Both scopes are edited from **Offerings → Questions** (`Registration\QuestionController`):
|
||||
- Pick an offering to edit its questions, or **"Account signup (all registrations)"** for the account-scope questions.
|
||||
- Studio admin (`manage_questions` + `manage_instructors`) edits any offering's questions and the account-scope questions.
|
||||
- Instructor (`manage_questions`) edits questions only on their own offerings; the account-scope option is hidden.
|
||||
Questions are edited from each offering's screen (**Offerings → Questions**).
|
||||
- Studio admin (`manage_questions`) edits questions on any offering.
|
||||
- Instructor (`manage_questions`) edits questions only on their own offerings.
|
||||
|
||||
## REST API
|
||||
Only offering-scope questions are exposed over REST. Account-scope questions are managed
|
||||
through the server-rendered admin page and read directly by `RegistrationPage`.
|
||||
|
||||
| Method | Endpoint | Permission |
|
||||
|----------|---------------------------------------------------|----------------------|
|
||||
| `GET` | `/wp-json/us-scheduler/v1/offerings/{id}/questions`| Public |
|
||||
@@ -73,28 +52,12 @@ through the server-rendered admin page and read directly by `RegistrationPage`.
|
||||
| `DELETE` | `/wp-json/us-scheduler/v1/questions/{id}` | `manage_questions` + owner |
|
||||
|
||||
## Implementation
|
||||
- Repositories: `Unsupervised\Schedular\Registration\QuestionRepository` (`findByOffering`, `findByScope`), `Unsupervised\Schedular\Registration\AnswerRepository`
|
||||
- Models: `Unsupervised\Schedular\Registration\Question` (`scope`, nullable `offeringId`), `Unsupervised\Schedular\Registration\Answer` (`REG_ACCOUNT`)
|
||||
- Repositories: `Unsupervised\Schedular\Registration\QuestionRepository`, `Unsupervised\Schedular\Registration\AnswerRepository`
|
||||
- Models: `Unsupervised\Schedular\Registration\Question`, `Unsupervised\Schedular\Registration\Answer`
|
||||
- Admin controller: `Unsupervised\Schedular\Registration\QuestionController`
|
||||
- REST endpoint: `Unsupervised\Schedular\Registration\QuestionEndpoint` (offering scope only)
|
||||
- Signup form: `Unsupervised\Schedular\Auth\RegistrationPage`, `templates/frontend/register-page.php`, `assets/js/register.js`
|
||||
- Admin review: `Unsupervised\Schedular\Auth\StudentHistory::registrationInfo()`, `templates/admin/student-detail.php`
|
||||
- Schema: `us_questions.scope` + nullable `us_questions.offering_id` (requires a plugin version bump so `dbDelta` runs)
|
||||
- Nullability repair: `dbDelta` does **not** reliably relax a column from `NOT NULL` to `NULL`, so sites created before account-scope questions kept `offering_id NOT NULL` and rejected account inserts. `QuestionRepository::ensureOfferingNullable()` re-applies the nullable definition (idempotent `ALTER … MODIFY`); `Plugin::boot()` runs it once, guarded by the `us_questions_offering_nullable` option rather than the version gate (affected sites may already be on the current version)
|
||||
- REST endpoint: `Unsupervised\Schedular\Registration\QuestionEndpoint`
|
||||
|
||||
## Tests
|
||||
- `tests/Unit/Registration/QuestionRepositoryTest.php`
|
||||
- `tests/Unit/Registration/AnswerRepositoryTest.php`
|
||||
- `tests/Unit/Registration/QuestionTest.php`
|
||||
- `tests/Unit/Registration/AnswerTest.php`
|
||||
- `tests/Unit/Auth/RegistrationPageTest.php`
|
||||
- `tests/Unit/Auth/StudentHistoryTest.php`
|
||||
|
||||
## Per-Child Answers
|
||||
For a parent/guardian signup, **account-scope** questions are asked **once per
|
||||
child** rather than once per guardian — in practice they describe the student
|
||||
(instrument, level, school), not the account holder. Each answer's `student_id`
|
||||
and `registration_id` are the child's user ID, so a studio admin reading a
|
||||
child's screen sees the information that describes them. The guardian's family
|
||||
screen asks the same questions when a child is added later. See
|
||||
`parent-guardian-accounts.md`.
|
||||
|
||||
@@ -1,103 +0,0 @@
|
||||
# Feature: Scheduled Billing (weekly / monthly)
|
||||
|
||||
## Overview
|
||||
Two offering billing modes defer payment past registration and generate pending
|
||||
payments on a recurring schedule:
|
||||
|
||||
- **`weekly`** — one payment per lesson, due **24 hours before** that lesson.
|
||||
- **`monthly`** — one payment per calendar month, due on the **1st**, covering every
|
||||
lesson that falls in the month. A **private lesson**'s fee is per lesson, so the
|
||||
month costs (#lessons) × fee. A **group class**'s fee is per month: the class is
|
||||
billed that fee once for the month, however many times it meets in it.
|
||||
|
||||
Both apply to **private lessons** and **group classes**. At registration the
|
||||
booking/enrolment succeeds with `payment: null` (no payment step); the lesson is
|
||||
confirmed / the enrolment stays active immediately. Payments are created later by a daily
|
||||
WP-Cron scan, and the student is emailed one consolidated notice per scan. Collection
|
||||
uses the existing rails (e-transfer confirmed by the studio admin, or card) — there is no
|
||||
automatic card charging.
|
||||
|
||||
## The daily scan — `Payment\ScheduledBillingRunner`
|
||||
Hooked to the WP-Cron action **`us_generate_due_payments`** (scheduled `daily` by
|
||||
`Installer`, cleared on plugin deactivation). `run()` is self-healing: it re-derives
|
||||
everything due from current ledger state each run, so a missed day is simply picked up
|
||||
next time. Every payment is created through `PaymentService::createForRegistration` (HST,
|
||||
method resolution, e-transfer freezing, comp auto-pay reused) with a `due_date` and
|
||||
`period_key` set.
|
||||
|
||||
### The four generation cases
|
||||
| Source | When it bills | Amount | Dedup |
|
||||
|--------|---------------|--------|-------|
|
||||
| **Private weekly** | lesson `start_dt` ≤ now + 24h | 1 × fee | `us_lessons.payment_id` set on the lesson |
|
||||
| **Private monthly** | the lesson's month's 1st ≤ today | (#lessons in month) × fee | `payment_id` set on every lesson in the month |
|
||||
| **Group weekly** | session (from `Offering::sessionWindows()`) − 1 day ≤ now | 1 × fee | `us_payments.period_key` = session date |
|
||||
| **Group monthly** | the month's 1st ≤ today | 1 × fee (a monthly class is priced per month, not per session) | `period_key` = `YYYY-MM` |
|
||||
|
||||
- Private lessons dedup on `us_lessons.payment_id IS NULL` — a lesson with no payment is
|
||||
unbilled. A monthly group links its earliest lesson via `createForRegistration` and the
|
||||
runner points the remaining lessons at the same payment.
|
||||
- Group enrolments (one row per whole term) dedup on `period_key` via
|
||||
`PaymentRepository::existsForPeriod()`, since one enrolment maps to many periodic
|
||||
charges.
|
||||
- Only offerings with a positive price are billed; cancelled lessons are excluded, so a
|
||||
lesson cancelled before its payment is generated is simply never billed.
|
||||
|
||||
### Late bookings charge at booking time
|
||||
A single scheduled lesson booked **after** its due date has already passed is charged at
|
||||
booking instead of deferred (`BookingEndpoint::scheduledDueHasPassed`): an extra monthly
|
||||
lesson added to a month that was already billed (its 1st has arrived), or a weekly lesson
|
||||
booked within 24 hours of the session. These create a normal at-registration payment (no
|
||||
`due_date`), so the fee is collected once, at booking, and never billed late by the scan.
|
||||
This applies only to single bookings — a weekly reservation series always defers, each
|
||||
lesson billed by the scan on its own schedule.
|
||||
|
||||
## Notification — `Payment\PaymentDueMailer`
|
||||
As the runner creates each **pending** payment it appends an itemised line to that
|
||||
student's notice bucket; after all cases run it sends **one** email per student with a
|
||||
line per item (label · due date · amount) and a grand total, plus the e-transfer
|
||||
destination(s). A student billed for several lessons on one day is emailed once, never
|
||||
per lesson. Comp payments (auto-paid) are not bucketed.
|
||||
|
||||
### Notice batch (lump-sum reconciliation)
|
||||
All the payments in one student's notice are tagged with a shared **notice batch**
|
||||
reference (`us_payments.notice_batch`, `PaymentRepository::assignNoticeBatch`), which is
|
||||
printed on the email so the student can quote it. In the **Payments** admin queue those
|
||||
payments are shown grouped under that reference with a combined lump-sum total
|
||||
(`PaymentController::groupPending`), so when one e-transfer arrives for the whole notice
|
||||
the admin can see exactly which pending payments — and therefore which bookings — it
|
||||
covers. Each is still confirmed individually with **Mark received**. Legacy
|
||||
at-registration payments have no batch and appear on their own.
|
||||
|
||||
## Cancellation
|
||||
Scheduled payments are never auto-voided. `PaymentService::voidPending` acts only on
|
||||
legacy at-registration payments (`! Payment::isScheduled()`), so cancelling one lesson
|
||||
never voids a shared monthly charge, never refunds, and never rebills.
|
||||
|
||||
Cancelling a lesson that was **already paid** credits the student one lesson's share
|
||||
of what they paid (`PaymentService::creditForCancelledLesson`), and the next scan
|
||||
applies that credit against their due charges before emailing the notice
|
||||
(`PaymentService::applyCredits`). See `credits.md` for the full model.
|
||||
|
||||
## Implementation
|
||||
- Runner: `Unsupervised\Schedular\Payment\ScheduledBillingRunner`
|
||||
- Notice email: `Unsupervised\Schedular\Payment\PaymentDueMailer`
|
||||
- Finders: `Booking\BookingRepository::findUnbilledScheduledLessons`,
|
||||
`GroupClass\EnrollmentRepository::findActiveByBillingModes`
|
||||
- Dedup: `Payment\PaymentRepository::existsForPeriod`
|
||||
- Session windows: `Offering\Offering::sessionWindows`
|
||||
- Cron scheduling: `Installer::scheduleBilling`; cleared in `unsupervised-schedular.php`
|
||||
deactivation hook.
|
||||
|
||||
## Tests
|
||||
- `tests/Unit/Payment/ScheduledBillingRunnerTest.php`
|
||||
- `tests/Unit/Payment/PaymentDueMailerTest.php`
|
||||
- `tests/Unit/Payment/PaymentRepositoryTest.php` (`existsForPeriod`, `due_date`/`period_key`)
|
||||
- `tests/Unit/Payment/PaymentServiceTest.php` (`voidPending` skips scheduled)
|
||||
- `tests/Unit/Booking/BookingEndpointTest.php` / `tests/Unit/GroupClass/EnrollmentEndpointTest.php` (deferred payment)
|
||||
|
||||
## One Notice Per Family
|
||||
Charges are bucketed by **payer**, not student, so a guardian gets a single
|
||||
notice covering every child rather than one email per child. Each line names the
|
||||
student it is for when that is not the payer ("Ada: Piano Lesson — Mar 3, 2026"),
|
||||
and account credit is applied across the whole bucket from the family balance.
|
||||
See `parent-guardian-accounts.md`.
|
||||
@@ -1,21 +1,15 @@
|
||||
# Feature: Student Administration
|
||||
|
||||
## Overview
|
||||
A studio-admin area to browse students, drill into one student's history and
|
||||
upcoming activity — lessons and group-class enrolments — and act on their
|
||||
behalf: cancel a lesson, withdraw them from a group class, or fix their account
|
||||
details.
|
||||
A read-only studio-admin area to browse students and drill into one student's
|
||||
history and upcoming activity — lessons and group-class enrolments — without
|
||||
digging through individual records.
|
||||
|
||||
## Data Model
|
||||
No new tables. The views are composed from existing data:
|
||||
- Students are WordPress users with the `us_student` role (`get_users`, `get_userdata`).
|
||||
- Lessons come from `{prefix}us_lessons` (with `{prefix}us_availability` for slot times).
|
||||
- Group-class enrolments come from `{prefix}us_group_enrollments`.
|
||||
- Policy acceptances come from `{prefix}us_policy_acceptances` (with the policy
|
||||
and version tables for titles/numbers).
|
||||
- Intake answers come from `{prefix}us_question_answers` (with `{prefix}us_questions`
|
||||
for labels).
|
||||
- Payments come from `{prefix}us_payments`.
|
||||
|
||||
## Admin Interface
|
||||
**Students** in wp-admin (`manage_students`, studio admin only):
|
||||
@@ -24,73 +18,14 @@ No new tables. The views are composed from existing data:
|
||||
quick counts (upcoming lessons, active group enrolments). Each row links to the
|
||||
detail view.
|
||||
- **Detail** (`?student_id=`):
|
||||
- **Account** — display name, email, registered date, and **Booked by**: the
|
||||
name of the parent/guardian who books and pays for this student, linked to
|
||||
their own detail page. Always rendered — a student who books for themselves
|
||||
says so in words, so an empty row can never be mistaken for a lookup that
|
||||
failed.
|
||||
- **Account** — display name, email, registered date.
|
||||
- **Upcoming lessons** and **Past lessons** — split by the linked availability
|
||||
slot's `start_dt`; each shows date/time, offering, instructor, and status.
|
||||
**Upcoming lessons** also lists the student's upcoming group-class sessions
|
||||
(`GroupClass\SessionSchedule`, marked "group class"), so one table answers
|
||||
"what are they booked into next week?". Only upcoming ones: past dates would
|
||||
bury the lessons, and the enrolment table below already holds the history.
|
||||
- **Group-class enrolments** — active/past, with offering title and status.
|
||||
- **Policy acceptances** — every acceptance the student has recorded, newest
|
||||
first: policy title, version, context (account signup / lesson / enrolment),
|
||||
and when it was accepted.
|
||||
- **Intake answers** — every registration-question answer, newest first:
|
||||
question label, answer, and the registration it was given for.
|
||||
- **Account credit** (`manage_billing` only) — the student's available credit
|
||||
balance plus every credit (date, reason, amount, remaining, status). Credit
|
||||
comes from cancelled paid lessons and is applied automatically to upcoming
|
||||
scheduled billing. See `credits.md`.
|
||||
- **Payment history** (`manage_billing` only) — every payment, newest first:
|
||||
date, context, method, status, subtotal, HST, total, and receipt number.
|
||||
- *(Later)* policy-acceptance history, intake answers, and payment history once
|
||||
Payments lands.
|
||||
|
||||
### Admin actions (detail view)
|
||||
All actions are nonce-protected POSTs handled on the detail page:
|
||||
|
||||
- **Edit account** — display name and email. The email must be valid and not in
|
||||
use by another account.
|
||||
- **Cancel lesson** — on any non-cancelled upcoming lesson. Uses the same path
|
||||
as student-initiated cancellation: the lesson is marked `cancelled`, the
|
||||
availability slot is freed for rebooking, and a still-pending payment is
|
||||
voided. A paid lesson is credited back to the student's account (see
|
||||
`credits.md`) rather than refunded.
|
||||
- **Withdraw** — on an active group-class enrolment: marked `cancelled` (freeing
|
||||
its capacity seat), with the same pending-payment voiding. This is the only way
|
||||
to remove a class; the group-class rows in **Upcoming lessons** carry no Cancel
|
||||
action, because there is no such thing as cancelling one session of a term.
|
||||
|
||||
## Deleting a user
|
||||
Deleting a WordPress user is a core action that knows nothing about lessons, so
|
||||
`Auth\DeletedUserCleanup` hooks `delete_user` (and `wpmu_delete_user`) and gives
|
||||
back what the account was holding: every **upcoming** lesson is marked
|
||||
`cancelled`, its availability slot released for rebooking, and its still-pending
|
||||
payment voided; every **active** group-class enrolment is cancelled and its
|
||||
pending payment voided. Without it the slots stayed marked booked and unbookable
|
||||
by anyone else, the lessons stayed on the instructor's schedule under a name that
|
||||
no longer resolved, and a class kept a seat filled by nobody.
|
||||
|
||||
**A guardian takes their children with them.** A child account is login-less and
|
||||
exists only so the guardian has somebody to book for; without the guardian nobody
|
||||
can reach it, book for it, or be billed for it, so leaving it behind leaves an
|
||||
unreachable student on the roster holding slots that will never be used. Each
|
||||
child's bookings are released on the same terms, the `us_guardians` link row is
|
||||
deleted, and the account goes. Deleting a child fires `delete_user` again and
|
||||
re-enters the same handler; a `handled` set of user ids makes that a no-op and
|
||||
also stops a self-referential or circular link recursing.
|
||||
|
||||
(This is a different rule from the family screen's **Remove**, which still refuses
|
||||
a child with any lesson or enrolment history — that is a guardian tidying up, not
|
||||
an admin deleting an account, and `GuardianService::removeChild()` is unchanged.)
|
||||
|
||||
Past lessons are deliberately untouched: they happened, they may have been paid
|
||||
for, and the payment report has to keep adding up. No account credit is issued
|
||||
for a paid lesson either, unlike a cancellation the student asks for — a credit
|
||||
can only be spent on the account being deleted, so a refund owed to someone who
|
||||
has left is the studio's decision to make and record.
|
||||
Read-only in this iteration; cancel/edit actions are a possible follow-up.
|
||||
|
||||
## Capabilities
|
||||
- `manage_students` — studio admin (administrators inherit it via the
|
||||
@@ -103,17 +38,6 @@ has left is the studio's decision to make and record.
|
||||
`Availability\AvailabilityRepository::findById`,
|
||||
`Offering\OfferingRepository::findById`,
|
||||
`GroupClass\EnrollmentRepository::findByStudent` + `countActiveForStudent`
|
||||
- History sections: `Auth\StudentHistory` builds the display rows from
|
||||
`Policy\AcceptanceRepository::findByStudent`,
|
||||
`Registration\AnswerRepository::findByStudent`, and
|
||||
`Payment\PaymentRepository::findByStudent`, resolving policy/version titles and
|
||||
question labels (unit-tested with mocked repositories).
|
||||
- Actions: `Auth\StudentActions` — cancel lesson / withdraw enrolment (both
|
||||
refuse records that don't belong to the student, and reuse
|
||||
`Payment\PaymentService::voidPending`) and account updates via
|
||||
`wp_update_user` (unit-tested with mocked repositories).
|
||||
- Group-class sessions in the upcoming table: `GroupClass\SessionSchedule::upcomingForStudent()`
|
||||
- Deletion cleanup: `Auth\DeletedUserCleanup` (hooked in `Plugin::boot()`)
|
||||
- Upcoming/past split: `Auth\StudentSchedule::partition()` (pure, unit-tested)
|
||||
- The upcoming/past split is extracted into a small pure helper so it is
|
||||
unit-testable (the controller itself follows the repo convention of not being
|
||||
@@ -121,17 +45,3 @@ has left is the studio's decision to make and record.
|
||||
|
||||
## Tests
|
||||
- `tests/Unit/Auth/StudentScheduleTest.php` (the pure upcoming/past split helper)
|
||||
- `tests/Unit/Auth/DeletedUserCleanupTest.php` (release on user deletion)
|
||||
- `tests/Unit/Auth/StudentHistoryTest.php` (history display rows + fallbacks)
|
||||
- `tests/Unit/Auth/StudentActionsTest.php` (cancel/withdraw guards + side
|
||||
effects, account validation)
|
||||
- `findByStudent` coverage in `tests/Unit/Policy/AcceptanceRepositoryTest.php`,
|
||||
`tests/Unit/Registration/AnswerRepositoryTest.php`, and
|
||||
`tests/Unit/Payment/PaymentRepositoryTest.php`
|
||||
|
||||
## Family Relationships
|
||||
The students list gains a **Profile** column — a child links to their guardian,
|
||||
a guardian lists their children — and the student screen a **Profile** panel. A
|
||||
child's listed email is their guardian's, since a child's own address is an
|
||||
undeliverable placeholder, and the credit balance shown is the payer's, labelled
|
||||
with whose account holds it. See `parent-guardian-accounts.md`.
|
||||
|
||||
+1
-26
@@ -44,32 +44,7 @@
|
||||
</properties>
|
||||
</rule>
|
||||
|
||||
<!--
|
||||
Val::* type-narrowing helpers (src/Val.php) wrap superglobal reads so
|
||||
PHPStan level 10 sees a typed value, e.g.
|
||||
`absint( Val::int( $_GET['id'] ?? 0 ) )`. The sniff walks wrapping
|
||||
calls innermost-out and aborts at the first unrecognised function
|
||||
name, so the Val method names must be registered for it to look past
|
||||
them. Because they are static calls (`::`), the sniff never credits
|
||||
them as sanitizers themselves — it skips them and still requires a
|
||||
real sanitizing function around the read.
|
||||
-->
|
||||
<rule ref="WordPress.Security.ValidatedSanitizedInput">
|
||||
<properties>
|
||||
<property name="customUnslashingSanitizingFunctions" type="array">
|
||||
<element value="int"/>
|
||||
<element value="intOrNull"/>
|
||||
<element value="float"/>
|
||||
<element value="bool"/>
|
||||
</property>
|
||||
<property name="customSanitizingFunctions" type="array">
|
||||
<element value="string"/>
|
||||
<element value="stringOrNull"/>
|
||||
</property>
|
||||
</properties>
|
||||
</rule>
|
||||
|
||||
<!-- PHP 8.1+ minimum — allow modern syntax. -->
|
||||
<config name="minimum_supported_wp_version" value="6.2"/>
|
||||
<config name="minimum_supported_wp_version" value="6.0"/>
|
||||
<config name="testVersion" value="8.1-"/>
|
||||
</ruleset>
|
||||
|
||||
+1
-8
@@ -2,14 +2,7 @@ includes:
|
||||
- vendor/szepeviktor/phpstan-wordpress/extension.neon
|
||||
|
||||
parameters:
|
||||
level: 10
|
||||
# Analyse against the whole supported range, not whatever PHP happens to be
|
||||
# running. Without this, syntax newer than the `Requires PHP: 8.1` header
|
||||
# promises passes lint on a modern local PHP and only fails in the 8.1 test
|
||||
# job — which is how a PHP 8.2 `true` return type once reached CI.
|
||||
phpVersion:
|
||||
min: 80100
|
||||
max: 80300
|
||||
level: 6
|
||||
paths:
|
||||
- src
|
||||
bootstrapFiles:
|
||||
|
||||
+25
-91
@@ -5,59 +5,39 @@ namespace Unsupervised\Schedular;
|
||||
|
||||
use Unsupervised\Schedular\Availability\AvailabilityController;
|
||||
use Unsupervised\Schedular\Availability\AvailabilityRepository;
|
||||
use Unsupervised\Schedular\Availability\WindowValidator;
|
||||
use Unsupervised\Schedular\Auth\AccessSettings;
|
||||
use Unsupervised\Schedular\Auth\InstructorController;
|
||||
use Unsupervised\Schedular\Auth\InviteRepository;
|
||||
use Unsupervised\Schedular\Auth\RegistrationApprovalController;
|
||||
use Unsupervised\Schedular\Auth\RegistrationController;
|
||||
use Unsupervised\Schedular\Auth\RegistrationMailer;
|
||||
use Unsupervised\Schedular\Auth\RoleManager;
|
||||
use Unsupervised\Schedular\Auth\StudentActions;
|
||||
use Unsupervised\Schedular\Auth\StudentController;
|
||||
use Unsupervised\Schedular\Guardian\GuardianService;
|
||||
use Unsupervised\Schedular\Auth\StudentHistory;
|
||||
use Unsupervised\Schedular\Booking\BookingRepository;
|
||||
use Unsupervised\Schedular\Booking\LessonController;
|
||||
use Unsupervised\Schedular\Booking\LessonDetail;
|
||||
use Unsupervised\Schedular\GroupClass\EnrollmentRepository;
|
||||
use Unsupervised\Schedular\GroupClass\GroupAccessRepository;
|
||||
use Unsupervised\Schedular\GroupClass\GroupClassController;
|
||||
use Unsupervised\Schedular\GroupClass\SessionSchedule;
|
||||
use Unsupervised\Schedular\Offering\ClassSlotReconciler;
|
||||
use Unsupervised\Schedular\Offering\OfferingController;
|
||||
use Unsupervised\Schedular\Offering\OfferingRepository;
|
||||
use Unsupervised\Schedular\Payment\BillingMethodResolver;
|
||||
use Unsupervised\Schedular\Payment\CreditRepository;
|
||||
use Unsupervised\Schedular\Payment\PaymentController;
|
||||
use Unsupervised\Schedular\Payment\PaymentReportController;
|
||||
use Unsupervised\Schedular\Payment\PaymentRepository;
|
||||
use Unsupervised\Schedular\Payment\PaymentService;
|
||||
use Unsupervised\Schedular\Payment\StudioSettings;
|
||||
use Unsupervised\Schedular\Policy\AcceptanceRepository;
|
||||
use Unsupervised\Schedular\Policy\PolicyController;
|
||||
use Unsupervised\Schedular\Policy\PolicyRepository;
|
||||
use Unsupervised\Schedular\Policy\PolicyService;
|
||||
use Unsupervised\Schedular\Policy\PolicyVersionRepository;
|
||||
use Unsupervised\Schedular\Registration\AnswerRepository;
|
||||
use Unsupervised\Schedular\Registration\QuestionController;
|
||||
use Unsupervised\Schedular\Registration\QuestionRepository;
|
||||
|
||||
class AdminMenu {
|
||||
|
||||
/**
|
||||
* Hook suffix of the availability screen, captured when the page is added so
|
||||
* its script loads on that screen only.
|
||||
*/
|
||||
private string $availabilityHook = '';
|
||||
|
||||
private AvailabilityController $availabilityController;
|
||||
private LessonController $lessonController;
|
||||
private OfferingController $offeringController;
|
||||
private QuestionController $questionController;
|
||||
private PolicyController $policyController;
|
||||
private RegistrationController $registrationController;
|
||||
private RegistrationApprovalController $registrationApprovalController;
|
||||
private GroupClassController $groupClassController;
|
||||
private StudentController $studentController;
|
||||
private InstructorController $instructorController;
|
||||
@@ -66,48 +46,27 @@ class AdminMenu {
|
||||
private PaymentController $paymentController;
|
||||
private PaymentReportController $paymentReportController;
|
||||
|
||||
public function __construct( AvailabilityRepository $availability, BookingRepository $bookings, OfferingRepository $offerings, QuestionRepository $questions, AnswerRepository $answers, PolicyRepository $policies, PolicyVersionRepository $policyVersions, PolicyService $policyService, AcceptanceRepository $acceptances, InviteRepository $invites, EnrollmentRepository $enrollments, GroupAccessRepository $groupAccess, StudioSettings $settings, PaymentRepository $payments, PaymentService $paymentService, BillingMethodResolver $resolver, RegistrationMailer $registrationMailer, CreditRepository $credits, GuardianService $guardians ) {
|
||||
$this->availabilityController = new AvailabilityController( $availability, $offerings, new WindowValidator( $offerings ) );
|
||||
$this->lessonController = new LessonController( $bookings, $payments, $availability, $offerings, new LessonDetail( $answers, $questions, $acceptances, $policies, $policyVersions ) );
|
||||
$this->offeringController = new OfferingController( $offerings, new ClassSlotReconciler( $availability ) );
|
||||
$this->questionController = new QuestionController( $questions, $offerings );
|
||||
$this->policyController = new PolicyController( $policies, $policyVersions, $policyService );
|
||||
$this->registrationController = new RegistrationController( $invites );
|
||||
$this->registrationApprovalController = new RegistrationApprovalController( $registrationMailer );
|
||||
$this->groupClassController = new GroupClassController( $enrollments, $offerings, $payments, $groupAccess, $paymentService, $invites, $registrationMailer );
|
||||
$this->studentController = new StudentController( $bookings, $availability, $offerings, $enrollments, $resolver, new StudentHistory( $acceptances, $policies, $policyVersions, $answers, $questions, $payments, $credits ), new StudentActions( $bookings, $availability, $enrollments, $paymentService ), $guardians, new SessionSchedule( $enrollments, $offerings ) );
|
||||
$this->instructorController = new InstructorController();
|
||||
$this->settings = $settings;
|
||||
$this->accessSettings = new AccessSettings();
|
||||
$this->paymentController = new PaymentController( $payments, $paymentService );
|
||||
$this->paymentReportController = new PaymentReportController( $payments );
|
||||
public function __construct( AvailabilityRepository $availability, BookingRepository $bookings, OfferingRepository $offerings, QuestionRepository $questions, PolicyRepository $policies, PolicyVersionRepository $policyVersions, PolicyService $policyService, InviteRepository $invites, EnrollmentRepository $enrollments, StudioSettings $settings, PaymentRepository $payments, PaymentService $paymentService, BillingMethodResolver $resolver ) {
|
||||
$this->availabilityController = new AvailabilityController( $availability, $offerings );
|
||||
$this->lessonController = new LessonController( $bookings, $payments );
|
||||
$this->offeringController = new OfferingController( $offerings );
|
||||
$this->questionController = new QuestionController( $questions, $offerings );
|
||||
$this->policyController = new PolicyController( $policies, $policyVersions, $policyService );
|
||||
$this->registrationController = new RegistrationController( $invites );
|
||||
$this->groupClassController = new GroupClassController( $enrollments, $offerings );
|
||||
$this->studentController = new StudentController( $bookings, $availability, $offerings, $enrollments, $resolver );
|
||||
$this->instructorController = new InstructorController();
|
||||
$this->settings = $settings;
|
||||
$this->accessSettings = new AccessSettings();
|
||||
$this->paymentController = new PaymentController( $payments, $paymentService );
|
||||
$this->paymentReportController = new PaymentReportController( $payments );
|
||||
}
|
||||
|
||||
public function register(): void {
|
||||
add_action( 'admin_menu', [ $this, 'addPages' ] );
|
||||
add_action( 'admin_enqueue_scripts', [ $this, 'enqueueAssets' ] );
|
||||
add_action( 'admin_post_' . PaymentReportController::EXPORT_ACTION, [ $this->paymentReportController, 'export' ] );
|
||||
}
|
||||
|
||||
/**
|
||||
* Load a screen's script on that screen only.
|
||||
*
|
||||
* @param string $hookSuffix Screen the enqueue is running for.
|
||||
*/
|
||||
public function enqueueAssets( string $hookSuffix ): void {
|
||||
if ( '' === $this->availabilityHook || $hookSuffix !== $this->availabilityHook ) {
|
||||
return;
|
||||
}
|
||||
|
||||
wp_enqueue_script(
|
||||
'us-scheduler-availability-admin',
|
||||
USC_PLUGIN_URL . 'assets/js/availability-admin.js',
|
||||
[],
|
||||
USC_VERSION,
|
||||
true
|
||||
);
|
||||
}
|
||||
|
||||
public function addPages(): void {
|
||||
$this->addStudioSeparators();
|
||||
|
||||
@@ -123,7 +82,7 @@ class AdminMenu {
|
||||
);
|
||||
|
||||
// Instructor: manage their own availability.
|
||||
$this->availabilityHook = (string) add_menu_page(
|
||||
add_menu_page(
|
||||
__( 'My Availability', 'unsupervised-schedular' ),
|
||||
__( 'My Availability', 'unsupervised-schedular' ),
|
||||
RoleManager::CAP_MANAGE_AVAILABILITY,
|
||||
@@ -209,16 +168,6 @@ class AdminMenu {
|
||||
35
|
||||
);
|
||||
|
||||
// Studio admin: approve or reject self-signup students (open registration).
|
||||
add_submenu_page(
|
||||
'us-students',
|
||||
__( 'Pending Students', 'unsupervised-schedular' ),
|
||||
__( 'Pending Students', 'unsupervised-schedular' ),
|
||||
RoleManager::CAP_MANAGE_STUDENTS,
|
||||
RegistrationApprovalController::PAGE_SLUG,
|
||||
[ $this->registrationApprovalController, 'renderPage' ]
|
||||
);
|
||||
|
||||
// Studio admin: confirm pending (e-transfer) payments.
|
||||
add_menu_page(
|
||||
__( 'Payments', 'unsupervised-schedular' ),
|
||||
@@ -266,31 +215,16 @@ class AdminMenu {
|
||||
30.5
|
||||
);
|
||||
|
||||
// Instructor: view their upcoming lessons. Hidden for anyone who can
|
||||
// already see the Scheduler — it shows every instructor's lessons
|
||||
// (including their own, with the same payment edit forms), so the two
|
||||
// menu items would just duplicate each other for an owner-operator.
|
||||
if ( ! current_user_can( RoleManager::CAP_VIEW_ALL_LESSONS ) ) {
|
||||
add_menu_page(
|
||||
__( 'My Lessons', 'unsupervised-schedular' ),
|
||||
__( 'My Lessons', 'unsupervised-schedular' ),
|
||||
RoleManager::CAP_VIEW_LESSONS,
|
||||
'us-my-lessons',
|
||||
[ $this->lessonController, 'renderInstructorLessons' ],
|
||||
'dashicons-welcome-learn-more',
|
||||
42
|
||||
);
|
||||
|
||||
// Instructor: their own group classes with per-class rosters.
|
||||
add_submenu_page(
|
||||
'us-my-lessons',
|
||||
__( 'My Group Classes', 'unsupervised-schedular' ),
|
||||
__( 'My Group Classes', 'unsupervised-schedular' ),
|
||||
RoleManager::CAP_VIEW_LESSONS,
|
||||
'us-my-group-classes',
|
||||
[ $this->groupClassController, 'renderInstructorPage' ]
|
||||
);
|
||||
}
|
||||
// Instructor: view their upcoming lessons.
|
||||
add_menu_page(
|
||||
__( 'My Lessons', 'unsupervised-schedular' ),
|
||||
__( 'My Lessons', 'unsupervised-schedular' ),
|
||||
RoleManager::CAP_VIEW_LESSONS,
|
||||
'us-my-lessons',
|
||||
[ $this->lessonController, 'renderInstructorLessons' ],
|
||||
'dashicons-welcome-learn-more',
|
||||
42
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
|
||||
@@ -3,8 +3,6 @@ declare(strict_types=1);
|
||||
|
||||
namespace Unsupervised\Schedular\Auth;
|
||||
|
||||
use Unsupervised\Schedular\Val;
|
||||
|
||||
/**
|
||||
* Site-owner toggles for whether WordPress administrators automatically receive
|
||||
* the studio-admin and/or instructor capabilities.
|
||||
@@ -41,7 +39,7 @@ class AccessSettings {
|
||||
* single-account behaviour.
|
||||
*/
|
||||
private function flag( string $option ): bool {
|
||||
return '0' !== Val::string( get_option( $option, '1' ) );
|
||||
return '0' !== (string) get_option( $option, '1' );
|
||||
}
|
||||
|
||||
public function renderPage(): void {
|
||||
|
||||
@@ -1,78 +0,0 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace Unsupervised\Schedular\Auth;
|
||||
|
||||
use Unsupervised\Schedular\Val;
|
||||
|
||||
/**
|
||||
* Who is signed in, and the way out.
|
||||
*
|
||||
* Meant for a header, sidebar or account page — somewhere it sits alongside
|
||||
* other content rather than being the whole of it. That shapes the two
|
||||
* decisions below.
|
||||
*/
|
||||
class AccountPage {
|
||||
|
||||
/**
|
||||
* Renders the account shortcode/block output.
|
||||
*
|
||||
* Signed out, this renders a sign-in link when a login page is configured and
|
||||
* **nothing at all** when one is not. A block whose whole job is "you are
|
||||
* signed in as X" has nothing to say to a stranger, and a bare "you are not
|
||||
* signed in" in a site header is noise with no way to act on it. The editor
|
||||
* preview shows the populated state regardless, so the block is never
|
||||
* invisible to the person placing it.
|
||||
*
|
||||
* @param array<int|string, mixed> $atts Block attributes (`loginPageId`) or
|
||||
* shortcode attributes (`login_page_id`).
|
||||
*/
|
||||
public function render( array $atts ): string {
|
||||
$loginPageId = Val::int( $atts['loginPageId'] ?? $atts['login_page_id'] ?? 0 );
|
||||
$loginUrl = $this->pageUrl( $loginPageId );
|
||||
|
||||
wp_enqueue_style( 'us-scheduler' );
|
||||
|
||||
if ( ! is_user_logged_in() ) {
|
||||
if ( null === $loginUrl ) {
|
||||
return '';
|
||||
}
|
||||
|
||||
return sprintf(
|
||||
'<div class="us-account us-account-out"><a class="us-account-signin" href="%s">%s</a></div>',
|
||||
esc_url( $loginUrl ),
|
||||
esc_html__( 'Sign in', 'unsupervised-schedular' )
|
||||
);
|
||||
}
|
||||
|
||||
// Always a WP_User here — is_user_logged_in() above rules out the
|
||||
// id-0 placeholder wp_get_current_user() returns for a visitor.
|
||||
$user = wp_get_current_user();
|
||||
|
||||
$name = UserName::format( $user, get_current_user_id() );
|
||||
$email = $user->user_email;
|
||||
|
||||
// Back to where they were, so signing out of a header link does not also
|
||||
// navigate them somewhere. The login page is the better landing spot when
|
||||
// one is configured, since the current page may be members-only.
|
||||
$logoutUrl = wp_logout_url( $loginUrl ?? (string) get_permalink() );
|
||||
|
||||
ob_start();
|
||||
include USC_PLUGIN_DIR . 'templates/frontend/account-page.php';
|
||||
return (string) ob_get_clean();
|
||||
}
|
||||
|
||||
/**
|
||||
* Permalink of a configured page, or null when none is chosen or the chosen
|
||||
* page has since been deleted.
|
||||
*/
|
||||
private function pageUrl( int $pageId ): ?string {
|
||||
if ( $pageId <= 0 ) {
|
||||
return null;
|
||||
}
|
||||
|
||||
$url = get_permalink( $pageId );
|
||||
|
||||
return is_string( $url ) ? $url : null;
|
||||
}
|
||||
}
|
||||
@@ -1,130 +0,0 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace Unsupervised\Schedular\Auth;
|
||||
|
||||
use Unsupervised\Schedular\Availability\AvailabilityRepository;
|
||||
use Unsupervised\Schedular\Booking\BookingRepository;
|
||||
use Unsupervised\Schedular\Booking\Lesson;
|
||||
use Unsupervised\Schedular\GroupClass\Enrollment;
|
||||
use Unsupervised\Schedular\GroupClass\EnrollmentRepository;
|
||||
use Unsupervised\Schedular\Guardian\GuardianRepository;
|
||||
use Unsupervised\Schedular\Guardian\GuardianService;
|
||||
use Unsupervised\Schedular\Payment\PaymentService;
|
||||
|
||||
/**
|
||||
* Gives back what a deleted account was holding, and takes the accounts that
|
||||
* only existed underneath it with it.
|
||||
*
|
||||
* WordPress deletes a user without knowing anything about lessons, so a student
|
||||
* removed from **Users → Delete** used to leave their bookings behind: the
|
||||
* availability slots stayed marked booked and unbookable by anyone else, the
|
||||
* lessons stayed on the instructor's schedule under a name that no longer
|
||||
* resolved, and a group class kept a seat filled by nobody.
|
||||
*
|
||||
* So each upcoming booking is cancelled the same way a real cancellation is —
|
||||
* marked cancelled, its slot released, its still-pending payment voided. Past
|
||||
* lessons are deliberately left alone: they happened, they may have been paid
|
||||
* for, and the payment report has to keep adding up.
|
||||
*
|
||||
* A **guardian** takes their children with them. A child account is login-less
|
||||
* and exists only so the guardian has somebody to book for; without the
|
||||
* guardian nobody can reach it, book for it, or be billed for it, so leaving it
|
||||
* behind leaves an unreachable student on the roster holding slots that will
|
||||
* never be used. Each child's bookings are released on the same terms, the link
|
||||
* row goes, and the account is deleted.
|
||||
*
|
||||
* No account credit is issued for a paid lesson, unlike a cancellation the
|
||||
* student asks for. A credit only has value against future billing on the
|
||||
* account it belongs to, and that account is being deleted; a refund owed to
|
||||
* someone who has left is a decision for the studio to make and record, not one
|
||||
* to silently write into a table nobody will read again.
|
||||
*/
|
||||
class DeletedUserCleanup {
|
||||
|
||||
/**
|
||||
* Accounts already dealt with this request, so deleting a guardian's child
|
||||
* — which fires `delete_user` again and re-enters this very handler — cannot
|
||||
* loop or redo work. It also makes a self-referential or circular guardian
|
||||
* link, however it got into the table, terminate rather than recurse.
|
||||
*
|
||||
* @var array<int, true>
|
||||
*/
|
||||
private array $handled = [];
|
||||
|
||||
public function __construct(
|
||||
private BookingRepository $bookings,
|
||||
private AvailabilityRepository $availability,
|
||||
private EnrollmentRepository $enrollments,
|
||||
private PaymentService $payments,
|
||||
private GuardianRepository $links,
|
||||
private GuardianService $guardians,
|
||||
) {}
|
||||
|
||||
public function register(): void {
|
||||
// `delete_user` fires before the row goes, which is what lets the lookups
|
||||
// below still find the account's bookings and children. `wpmu_delete_user`
|
||||
// is the multisite equivalent for a user removed from the network entirely.
|
||||
add_action( 'delete_user', [ $this, 'releaseBookings' ] );
|
||||
add_action( 'wpmu_delete_user', [ $this, 'releaseBookings' ] );
|
||||
}
|
||||
|
||||
/**
|
||||
* Release everything the account had booked ahead of it, then remove any
|
||||
* children that only existed to be booked for.
|
||||
*/
|
||||
public function releaseBookings( int $userId ): void {
|
||||
if ( $userId <= 0 || isset( $this->handled[ $userId ] ) ) {
|
||||
return;
|
||||
}
|
||||
|
||||
$this->handled[ $userId ] = true;
|
||||
|
||||
$this->release( $userId );
|
||||
$this->removeChildren( $userId );
|
||||
}
|
||||
|
||||
/**
|
||||
* Cancel one account's upcoming lessons and active enrolments, freeing the
|
||||
* slot and voiding the pending payment behind each.
|
||||
*/
|
||||
private function release( int $studentId ): void {
|
||||
// Upcoming and not already cancelled — the only bookings that are still
|
||||
// holding anything.
|
||||
foreach ( $this->bookings->findUpcomingForStudent( $studentId ) as $lesson ) {
|
||||
$this->bookings->updateStatus( (int) $lesson->id, Lesson::STATUS_CANCELLED );
|
||||
$this->availability->release( $lesson->slotId );
|
||||
$this->payments->voidPending( $lesson->paymentId );
|
||||
}
|
||||
|
||||
foreach ( $this->enrollments->findByStudent( $studentId ) as $enrollment ) {
|
||||
if ( Enrollment::STATUS_ACTIVE !== $enrollment->status ) {
|
||||
continue;
|
||||
}
|
||||
|
||||
$this->enrollments->updateStatus( (int) $enrollment->id, Enrollment::STATUS_CANCELLED );
|
||||
$this->payments->voidPending( $enrollment->paymentId );
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Delete every child linked to a departing guardian, releasing what each was
|
||||
* holding first. Each child is marked handled *before* it is deleted, so the
|
||||
* `delete_user` this fires re-enters and returns without redoing the release.
|
||||
*/
|
||||
private function removeChildren( int $guardianId ): void {
|
||||
foreach ( $this->links->findByGuardian( $guardianId ) as $link ) {
|
||||
$childId = $link->studentId;
|
||||
|
||||
if ( $childId <= 0 || $childId === $guardianId || isset( $this->handled[ $childId ] ) ) {
|
||||
continue;
|
||||
}
|
||||
|
||||
$this->handled[ $childId ] = true;
|
||||
|
||||
$this->release( $childId );
|
||||
$this->links->delete( $guardianId, $childId );
|
||||
$this->guardians->deleteUser( $childId );
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,143 +0,0 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace Unsupervised\Schedular\Auth;
|
||||
|
||||
use Unsupervised\Schedular\Payment\StudioSettings;
|
||||
use Unsupervised\Schedular\Val;
|
||||
|
||||
/**
|
||||
* Handles the self-signup email-confirmation link, and keeps WordPress's own
|
||||
* registration form from being used to bypass the studio's policy-accepting
|
||||
* registration page while open registration is enabled.
|
||||
*/
|
||||
class EmailConfirmationHandler {
|
||||
|
||||
public function __construct(
|
||||
private StudioSettings $settings,
|
||||
private RegistrationMailer $mailer,
|
||||
) {}
|
||||
|
||||
public function register(): void {
|
||||
add_action( 'template_redirect', [ $this, 'maybeConfirm' ] );
|
||||
add_filter( 'register_url', [ $this, 'registerUrl' ] );
|
||||
// login_init fires at the top of wp-login.php for every request (GET form
|
||||
// display AND a direct POST) before any registration processing, so it is
|
||||
// the reliable choke point; registration_errors is a fail-safe in case a
|
||||
// POST ever reaches register_new_user().
|
||||
add_action( 'login_init', [ $this, 'blockNativeRegistration' ] );
|
||||
add_filter( 'registration_errors', [ $this, 'blockRegistrationErrors' ], 10, 1 );
|
||||
}
|
||||
|
||||
/**
|
||||
* Confirm a self-signup's email when the emailed `?us_confirm=<token>` link
|
||||
* is opened, then redirect back to the registration page with a result flag.
|
||||
*/
|
||||
public function maybeConfirm(): void {
|
||||
if ( is_admin() ) {
|
||||
return;
|
||||
}
|
||||
|
||||
// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- the token is itself the capability-bearing secret (like a password-reset key); nonces do not apply to an emailed link.
|
||||
$rawToken = sanitize_text_field( Val::string( wp_unslash( $_GET['us_confirm'] ?? '' ) ) );
|
||||
if ( '' === $rawToken ) {
|
||||
return;
|
||||
}
|
||||
|
||||
$base = $this->registrationPageUrl();
|
||||
$userId = RegistrationStatus::userIdForToken( $rawToken );
|
||||
|
||||
if ( null === $userId || RegistrationStatus::isTokenExpired( $userId, gmdate( 'Y-m-d H:i:s' ) ) ) {
|
||||
wp_safe_redirect( add_query_arg( 'us_confirmed', 'expired', $base ) );
|
||||
exit;
|
||||
}
|
||||
|
||||
RegistrationStatus::confirmEmail( $userId );
|
||||
|
||||
$user = get_user_by( 'id', $userId );
|
||||
|
||||
// Group invite link signups skip the admin review queue: confirming the
|
||||
// email approves the account on the spot, so the student can sign in
|
||||
// immediately instead of waiting for a studio admin.
|
||||
if ( RegistrationStatus::isAutoApprove( $userId ) ) {
|
||||
RegistrationStatus::approve( $userId );
|
||||
|
||||
if ( $user instanceof \WP_User ) {
|
||||
$this->mailer->sendApproved( $user );
|
||||
}
|
||||
|
||||
wp_safe_redirect( add_query_arg( 'us_confirmed', 'ready', $base ) );
|
||||
exit;
|
||||
}
|
||||
|
||||
if ( $user instanceof \WP_User ) {
|
||||
$this->mailer->notifyAdminsPending( $user );
|
||||
}
|
||||
|
||||
wp_safe_redirect( add_query_arg( 'us_confirmed', '1', $base ) );
|
||||
exit;
|
||||
}
|
||||
|
||||
/**
|
||||
* Point WordPress's own "Register" links at the studio registration page
|
||||
* while open registration is on and a page is configured.
|
||||
*/
|
||||
public function registerUrl( string $url ): string {
|
||||
if ( ! $this->settings->openRegistrationEnabled() ) {
|
||||
return $url;
|
||||
}
|
||||
|
||||
$pageId = Val::int( get_option( RegistrationController::OPTION_PAGE, 0 ) );
|
||||
|
||||
return $pageId > 0 ? (string) get_permalink( $pageId ) : $url;
|
||||
}
|
||||
|
||||
/**
|
||||
* Redirect any `wp-login.php?action=register` request (GET or POST) to the
|
||||
* studio registration page, so the bare native form — which cannot collect
|
||||
* required policy acceptances — is never used.
|
||||
*/
|
||||
public function blockNativeRegistration(): void {
|
||||
if ( ! $this->settings->openRegistrationEnabled() ) {
|
||||
return;
|
||||
}
|
||||
|
||||
// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only routing decision; no state is changed here.
|
||||
$action = sanitize_key( Val::string( wp_unslash( $_REQUEST['action'] ?? '' ) ) );
|
||||
if ( 'register' !== $action ) {
|
||||
return;
|
||||
}
|
||||
|
||||
$pageId = Val::int( get_option( RegistrationController::OPTION_PAGE, 0 ) );
|
||||
if ( $pageId <= 0 ) {
|
||||
return;
|
||||
}
|
||||
|
||||
wp_safe_redirect( (string) get_permalink( $pageId ) );
|
||||
exit;
|
||||
}
|
||||
|
||||
/**
|
||||
* Fail-safe: reject any native registration attempt while open registration
|
||||
* is on, so `register_new_user()` can never create a policy-less account.
|
||||
*
|
||||
* @param \WP_Error $errors Accumulated registration errors.
|
||||
* @return \WP_Error
|
||||
*/
|
||||
public function blockRegistrationErrors( \WP_Error $errors ): \WP_Error {
|
||||
if ( $this->settings->openRegistrationEnabled() ) {
|
||||
$errors->add(
|
||||
'us_registration_redirect',
|
||||
esc_html__( 'Please register on the studio registration page.', 'unsupervised-schedular' )
|
||||
);
|
||||
}
|
||||
|
||||
return $errors;
|
||||
}
|
||||
|
||||
private function registrationPageUrl(): string {
|
||||
$pageId = Val::int( get_option( RegistrationController::OPTION_PAGE, 0 ) );
|
||||
|
||||
return $pageId > 0 ? (string) get_permalink( $pageId ) : home_url( '/' );
|
||||
}
|
||||
}
|
||||
@@ -3,8 +3,6 @@ declare(strict_types=1);
|
||||
|
||||
namespace Unsupervised\Schedular\Auth;
|
||||
|
||||
use Unsupervised\Schedular\Val;
|
||||
|
||||
/**
|
||||
* Studio-admin **Instructors** page: create instructor accounts and toggle each
|
||||
* instructor's managed capabilities. Gated on `manage_instructors`. A studio
|
||||
@@ -26,7 +24,7 @@ class InstructorController {
|
||||
}
|
||||
|
||||
// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only instructor selector.
|
||||
$instructorId = absint( Val::int( $_GET['instructor_id'] ?? 0 ) );
|
||||
$instructorId = absint( $_GET['instructor_id'] ?? 0 );
|
||||
$instructor = $instructorId > 0 ? get_userdata( $instructorId ) : false;
|
||||
|
||||
if ( $instructor && in_array( RoleManager::INSTRUCTOR, (array) $instructor->roles, true ) ) {
|
||||
@@ -52,15 +50,12 @@ class InstructorController {
|
||||
'email' => $user->user_email,
|
||||
'registered' => $user->user_registered,
|
||||
],
|
||||
array_filter(
|
||||
get_users(
|
||||
[
|
||||
'role' => RoleManager::INSTRUCTOR,
|
||||
'orderby' => 'display_name',
|
||||
'order' => 'ASC',
|
||||
]
|
||||
),
|
||||
static fn( mixed $user ): bool => $user instanceof \WP_User
|
||||
get_users(
|
||||
[
|
||||
'role' => RoleManager::INSTRUCTOR,
|
||||
'orderby' => 'display_name',
|
||||
'order' => 'ASC',
|
||||
]
|
||||
)
|
||||
);
|
||||
|
||||
@@ -71,7 +66,7 @@ class InstructorController {
|
||||
private function handleFormAction(): string {
|
||||
// Nonce is verified by the caller (renderPage) before this method runs.
|
||||
// phpcs:disable WordPress.Security.NonceVerification.Missing
|
||||
$action = sanitize_key( Val::string( wp_unslash( $_POST['usc_action'] ?? '' ) ) );
|
||||
$action = sanitize_key( wp_unslash( $_POST['usc_action'] ?? '' ) );
|
||||
// phpcs:enable WordPress.Security.NonceVerification.Missing
|
||||
|
||||
if ( 'create' === $action ) {
|
||||
@@ -87,8 +82,8 @@ class InstructorController {
|
||||
|
||||
private function createInstructor(): string {
|
||||
// phpcs:disable WordPress.Security.NonceVerification.Missing
|
||||
$email = sanitize_email( Val::string( wp_unslash( $_POST['email'] ?? '' ) ) );
|
||||
$name = sanitize_text_field( Val::string( wp_unslash( $_POST['display_name'] ?? '' ) ) );
|
||||
$email = sanitize_email( wp_unslash( $_POST['email'] ?? '' ) );
|
||||
$name = sanitize_text_field( wp_unslash( $_POST['display_name'] ?? '' ) );
|
||||
// phpcs:enable WordPress.Security.NonceVerification.Missing
|
||||
|
||||
if ( ! is_email( $email ) ) {
|
||||
@@ -130,9 +125,8 @@ class InstructorController {
|
||||
|
||||
private function updateCaps(): string {
|
||||
// phpcs:disable WordPress.Security.NonceVerification.Missing
|
||||
$instructorId = absint( Val::int( $_POST['instructor_id'] ?? 0 ) );
|
||||
// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- each capability key is sanitized with sanitize_key() in the array_map callback.
|
||||
$submitted = array_values( array_map( static fn( mixed $cap ): string => sanitize_key( Val::string( $cap ) ), (array) wp_unslash( $_POST['capabilities'] ?? [] ) ) );
|
||||
$instructorId = absint( $_POST['instructor_id'] ?? 0 );
|
||||
$submitted = array_map( 'sanitize_key', (array) wp_unslash( $_POST['capabilities'] ?? [] ) );
|
||||
// phpcs:enable WordPress.Security.NonceVerification.Missing
|
||||
|
||||
$instructor = $instructorId > 0 ? get_userdata( $instructorId ) : false;
|
||||
|
||||
+15
-57
@@ -3,20 +3,12 @@ declare(strict_types=1);
|
||||
|
||||
namespace Unsupervised\Schedular\Auth;
|
||||
|
||||
use Unsupervised\Schedular\Val;
|
||||
|
||||
class Invite {
|
||||
|
||||
public const STATUS_PENDING = 'pending';
|
||||
public const STATUS_ACCEPTED = 'accepted';
|
||||
public const STATUS_REVOKED = 'revoked';
|
||||
|
||||
/** Single-use invite addressed to one email. */
|
||||
public const KIND_PERSONAL = 'personal';
|
||||
|
||||
/** Multi-use shareable link (e.g. for a newsletter) with an explicit expiry. */
|
||||
public const KIND_GROUP = 'group';
|
||||
|
||||
/**
|
||||
* All valid invite statuses.
|
||||
*
|
||||
@@ -30,16 +22,6 @@ class Invite {
|
||||
*/
|
||||
public const EXPIRY_DAYS = 14;
|
||||
|
||||
/**
|
||||
* Hash a raw invitation token for storage and lookup. Only the hash is
|
||||
* persisted, so a database leak (backup, SQL injection elsewhere) cannot be
|
||||
* used to redeem pending invites; the raw token exists only in the emailed
|
||||
* link and is shown to the admin once, at creation.
|
||||
*/
|
||||
public static function hashToken( string $rawToken ): string {
|
||||
return hash( 'sha256', $rawToken );
|
||||
}
|
||||
|
||||
public function __construct(
|
||||
public readonly string $email,
|
||||
public readonly string $token,
|
||||
@@ -49,61 +31,40 @@ class Invite {
|
||||
public readonly ?int $acceptedUserId = null,
|
||||
public readonly ?string $acceptedAt = null,
|
||||
public readonly ?string $createdAt = null,
|
||||
public readonly string $kind = self::KIND_PERSONAL,
|
||||
public readonly ?string $expiresAt = null,
|
||||
public readonly ?int $offeringId = null,
|
||||
public readonly ?int $id = null,
|
||||
) {}
|
||||
|
||||
public static function fromRow( \stdClass $row ): self {
|
||||
public static function fromRow( object $row ): self {
|
||||
return new self(
|
||||
email: Val::string( $row->email ),
|
||||
token: Val::string( $row->token ),
|
||||
role: Val::string( $row->role ),
|
||||
status: Val::string( $row->status ),
|
||||
invitedBy: Val::intOrNull( $row->invited_by ),
|
||||
acceptedUserId: Val::intOrNull( $row->accepted_user_id ),
|
||||
acceptedAt: Val::stringOrNull( $row->accepted_at ),
|
||||
createdAt: Val::stringOrNull( $row->created_at ?? null ),
|
||||
kind: '' !== Val::string( $row->kind ?? '' ) ? Val::string( $row->kind ) : self::KIND_PERSONAL,
|
||||
expiresAt: Val::stringOrNull( $row->expires_at ?? null ),
|
||||
offeringId: Val::intOrNull( $row->offering_id ?? null ),
|
||||
id: Val::int( $row->id ),
|
||||
email: $row->email,
|
||||
token: $row->token,
|
||||
role: $row->role,
|
||||
status: $row->status,
|
||||
invitedBy: null !== $row->invited_by ? (int) $row->invited_by : null,
|
||||
acceptedUserId: null !== $row->accepted_user_id ? (int) $row->accepted_user_id : null,
|
||||
acceptedAt: $row->accepted_at,
|
||||
createdAt: $row->created_at ?? null,
|
||||
id: (int) $row->id,
|
||||
);
|
||||
}
|
||||
|
||||
public function isGroup(): bool {
|
||||
return self::KIND_GROUP === $this->kind;
|
||||
}
|
||||
|
||||
public function isPending(): bool {
|
||||
return self::STATUS_PENDING === $this->status;
|
||||
}
|
||||
|
||||
/**
|
||||
* Whether the invite has expired, measured against the supplied current
|
||||
* `Y-m-d H:i:s` timestamp. An explicit `expires_at` (set on every group
|
||||
* link) wins; otherwise a personal invite expires {@see EXPIRY_DAYS} after
|
||||
* creation. An invite with neither timestamp is treated as not expired.
|
||||
* Whether the invite was created more than {@see EXPIRY_DAYS} ago, measured
|
||||
* against the supplied current `Y-m-d H:i:s` timestamp. An invite with no
|
||||
* known creation time is treated as not expired.
|
||||
*/
|
||||
public function isExpired( string $now ): bool {
|
||||
$current = strtotime( $now );
|
||||
if ( false === $current ) {
|
||||
return false;
|
||||
}
|
||||
|
||||
if ( null !== $this->expiresAt ) {
|
||||
$expires = strtotime( $this->expiresAt );
|
||||
|
||||
return false !== $expires && $current > $expires;
|
||||
}
|
||||
|
||||
if ( null === $this->createdAt ) {
|
||||
return false;
|
||||
}
|
||||
|
||||
$created = strtotime( $this->createdAt );
|
||||
if ( false === $created ) {
|
||||
$current = strtotime( $now );
|
||||
if ( false === $created || false === $current ) {
|
||||
return false;
|
||||
}
|
||||
|
||||
@@ -128,13 +89,10 @@ class Invite {
|
||||
'email' => $this->email,
|
||||
'token' => $this->token,
|
||||
'role' => $this->role,
|
||||
'kind' => $this->kind,
|
||||
'status' => $this->status,
|
||||
'invited_by' => $this->invitedBy,
|
||||
'accepted_user_id' => $this->acceptedUserId,
|
||||
'accepted_at' => $this->acceptedAt,
|
||||
'expires_at' => $this->expiresAt,
|
||||
'offering_id' => $this->offeringId,
|
||||
];
|
||||
}
|
||||
}
|
||||
|
||||
@@ -11,35 +11,28 @@ class InviteRepository {
|
||||
$this->table = $db->prefix . 'us_invites';
|
||||
}
|
||||
|
||||
/**
|
||||
* Persist an invite. Returns the new row id, or 0 when the insert failed —
|
||||
* callers must not hand out a registration link for an unstored token.
|
||||
*/
|
||||
public function insert( Invite $invite ): int {
|
||||
$result = $this->db->insert(
|
||||
$this->db->insert(
|
||||
$this->table,
|
||||
[
|
||||
'email' => $invite->email,
|
||||
'token' => $invite->token,
|
||||
'role' => $invite->role,
|
||||
'kind' => $invite->kind,
|
||||
'offering_id' => $invite->offeringId,
|
||||
'status' => $invite->status,
|
||||
'invited_by' => $invite->invitedBy,
|
||||
'accepted_user_id' => $invite->acceptedUserId,
|
||||
'created_at' => current_time( 'mysql' ),
|
||||
'accepted_at' => $invite->acceptedAt,
|
||||
'expires_at' => $invite->expiresAt,
|
||||
],
|
||||
[ '%s', '%s', '%s', '%s', '%d', '%s', '%d', '%d', '%s', '%s', '%s' ]
|
||||
[ '%s', '%s', '%s', '%s', '%d', '%d', '%s', '%s' ]
|
||||
);
|
||||
|
||||
return false === $result ? 0 : $this->db->insert_id;
|
||||
return $this->db->insert_id;
|
||||
}
|
||||
|
||||
public function findByToken( string $token ): ?Invite {
|
||||
$row = $this->db->get_row(
|
||||
$this->db->prepare( 'SELECT * FROM %i WHERE token = %s', $this->table, $token )
|
||||
$this->db->prepare( "SELECT * FROM {$this->table} WHERE token = %s", $token )
|
||||
);
|
||||
|
||||
return $row ? Invite::fromRow( $row ) : null;
|
||||
@@ -47,7 +40,7 @@ class InviteRepository {
|
||||
|
||||
public function findById( int $id ): ?Invite {
|
||||
$row = $this->db->get_row(
|
||||
$this->db->prepare( 'SELECT * FROM %i WHERE id = %d', $this->table, $id )
|
||||
$this->db->prepare( "SELECT * FROM {$this->table} WHERE id = %d", $id )
|
||||
);
|
||||
|
||||
return $row ? Invite::fromRow( $row ) : null;
|
||||
@@ -59,8 +52,7 @@ class InviteRepository {
|
||||
public function findPendingByEmail( string $email ): ?Invite {
|
||||
$row = $this->db->get_row(
|
||||
$this->db->prepare(
|
||||
'SELECT * FROM %i WHERE email = %s AND status = %s ORDER BY id DESC LIMIT 1',
|
||||
$this->table,
|
||||
"SELECT * FROM {$this->table} WHERE email = %s AND status = %s ORDER BY id DESC LIMIT 1",
|
||||
$email,
|
||||
Invite::STATUS_PENDING
|
||||
)
|
||||
@@ -77,8 +69,7 @@ class InviteRepository {
|
||||
public function findPending(): array {
|
||||
$rows = $this->db->get_results(
|
||||
$this->db->prepare(
|
||||
'SELECT * FROM %i WHERE status = %s ORDER BY created_at DESC',
|
||||
$this->table,
|
||||
"SELECT * FROM {$this->table} WHERE status = %s ORDER BY created_at DESC",
|
||||
Invite::STATUS_PENDING
|
||||
)
|
||||
);
|
||||
|
||||
+8
-27
@@ -3,36 +3,32 @@ declare(strict_types=1);
|
||||
|
||||
namespace Unsupervised\Schedular\Auth;
|
||||
|
||||
use Unsupervised\Schedular\Val;
|
||||
|
||||
class LoginPage {
|
||||
|
||||
/**
|
||||
* Renders the student login shortcode/block output.
|
||||
* Renders the student login shortcode output.
|
||||
*
|
||||
* @param array<int|string, mixed> $atts Block attributes (`bookingPageId`) or
|
||||
* shortcode attributes (`booking_page_id`).
|
||||
* @param array<string, string> $atts Shortcode attributes (unused — reserved for future options).
|
||||
*/
|
||||
public function render( array $atts ): string {
|
||||
$bookingPageId = Val::int( $atts['bookingPageId'] ?? $atts['booking_page_id'] ?? 0 );
|
||||
|
||||
public function render( array $atts ): string { // phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter.Found
|
||||
if ( is_user_logged_in() ) {
|
||||
$redirect = esc_url( (string) get_permalink() );
|
||||
return sprintf(
|
||||
'<p>%s <a href="%s">%s</a>.</p>',
|
||||
esc_html__( 'You are already logged in.', 'unsupervised-schedular' ),
|
||||
esc_url( $this->bookingUrl( $bookingPageId ) ?? (string) get_permalink() ),
|
||||
$redirect,
|
||||
esc_html__( 'View available lessons', 'unsupervised-schedular' )
|
||||
);
|
||||
}
|
||||
|
||||
$error = '';
|
||||
$redirect = sanitize_url( $this->bookingUrl( $bookingPageId ) ?? (string) get_permalink() );
|
||||
$redirect = sanitize_url( (string) get_permalink() );
|
||||
|
||||
if ( isset( $_POST['us_login'] ) && check_admin_referer( 'us_student_login' ) ) {
|
||||
$credentials = [
|
||||
'user_login' => sanitize_user( Val::string( wp_unslash( $_POST['log'] ?? '' ) ) ),
|
||||
'user_login' => sanitize_user( wp_unslash( $_POST['log'] ?? '' ) ),
|
||||
// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- passwords must not be sanitized.
|
||||
'user_password' => Val::string( wp_unslash( $_POST['pwd'] ?? '' ) ),
|
||||
'user_password' => wp_unslash( $_POST['pwd'] ?? '' ),
|
||||
'remember' => isset( $_POST['rememberme'] ),
|
||||
];
|
||||
|
||||
@@ -50,19 +46,4 @@ class LoginPage {
|
||||
include USC_PLUGIN_DIR . 'templates/frontend/login-page.php';
|
||||
return (string) ob_get_clean();
|
||||
}
|
||||
|
||||
/**
|
||||
* Permalink of the configured booking page, or null when no page is
|
||||
* chosen (or the chosen page no longer exists). Logged-in visitors are
|
||||
* linked (and redirected after login) there instead of the current page.
|
||||
*/
|
||||
public function bookingUrl( int $bookingPageId ): ?string {
|
||||
if ( $bookingPageId <= 0 ) {
|
||||
return null;
|
||||
}
|
||||
|
||||
$url = get_permalink( $bookingPageId );
|
||||
|
||||
return is_string( $url ) ? $url : null;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,165 +0,0 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace Unsupervised\Schedular\Auth;
|
||||
|
||||
/**
|
||||
* What counts as an acceptable signup password.
|
||||
*
|
||||
* The check is deliberately split across the two sides, because the two sides
|
||||
* can do different things:
|
||||
*
|
||||
* - **The browser** runs zxcvbn (WordPress ships it as `password-strength-meter`)
|
||||
* and gates the submit button on {@see MIN_SCORE}. That is the nuanced test —
|
||||
* it knows that `Tr0ub4dor&3` is weaker than `correct horse battery staple` —
|
||||
* but it is only advice, because anything in a browser can be turned off.
|
||||
* - **This class** runs on the server and is the rule that actually holds. It
|
||||
* cannot score a password the way zxcvbn does without shipping a dictionary,
|
||||
* so it does not pretend to: it rejects the categorically bad — too short,
|
||||
* the user's own name or email, a password from the well-known lists, or one
|
||||
* built from almost no distinct characters.
|
||||
*
|
||||
* Neither half is sufficient alone, which is the point. A password that clears
|
||||
* both is not guaranteed strong; one that fails either is definitely not.
|
||||
*/
|
||||
class PasswordPolicy {
|
||||
|
||||
/**
|
||||
* Minimum length. NIST SP 800-63B puts the floor at 8 and explicitly advises
|
||||
* against composition rules ("must contain a symbol") on the grounds that they
|
||||
* push people towards predictable substitutions. Length plus the checks below
|
||||
* does more for less annoyance.
|
||||
*/
|
||||
public const MIN_LENGTH = 8;
|
||||
|
||||
/**
|
||||
* The zxcvbn score the browser demands before it will let the form submit,
|
||||
* on WordPress's 0-4 scale: 0-1 weak, 2 medium, 3-4 strong. Two rejects the
|
||||
* passwords a stranger would guess while still accepting an ordinary
|
||||
* memorable one — a studio signup form is not a bank.
|
||||
*/
|
||||
public const MIN_SCORE = 2;
|
||||
|
||||
/**
|
||||
* How much of the user's own identity has to appear in the password before it
|
||||
* is refused. Short enough to catch a name inside a longer password, long
|
||||
* enough that a two- or three-letter coincidence does not trip it.
|
||||
*/
|
||||
private const IDENTITY_FRAGMENT_LENGTH = 4;
|
||||
|
||||
/** Fewest distinct characters a password may be built from. */
|
||||
private const MIN_DISTINCT_CHARACTERS = 4;
|
||||
|
||||
/**
|
||||
* Why this password is unacceptable, or null when it passes.
|
||||
*
|
||||
* `$email` and `$displayName` are what the same submission is claiming as an
|
||||
* identity, so they can be checked against the password before either exists
|
||||
* as a user.
|
||||
*/
|
||||
public static function validate( string $password, string $email = '', string $displayName = '' ): ?string {
|
||||
// Not trimmed: a leading or trailing space is a legitimate character, and
|
||||
// silently changing what someone typed would lock them out later.
|
||||
if ( strlen( $password ) < self::MIN_LENGTH ) {
|
||||
return sprintf(
|
||||
/* translators: %d: minimum number of characters. */
|
||||
__( 'Please choose a password of at least %d characters.', 'unsupervised-schedular' ),
|
||||
self::MIN_LENGTH
|
||||
);
|
||||
}
|
||||
|
||||
$lower = strtolower( $password );
|
||||
|
||||
if ( in_array( $lower, self::commonPasswords(), true ) ) {
|
||||
return __( 'That password is one of the most commonly used ones. Please choose something less guessable.', 'unsupervised-schedular' );
|
||||
}
|
||||
|
||||
if ( count( array_unique( str_split( $lower ) ) ) < self::MIN_DISTINCT_CHARACTERS ) {
|
||||
return __( 'Please choose a password built from more than a few repeated characters.', 'unsupervised-schedular' );
|
||||
}
|
||||
|
||||
if ( self::echoesIdentity( $lower, $email, $displayName ) ) {
|
||||
return __( 'Please choose a password that does not contain your name or email address.', 'unsupervised-schedular' );
|
||||
}
|
||||
|
||||
return null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Whether the password contains the user's display name, their email address,
|
||||
* or the part of it before the `@` — the first things anyone guessing would
|
||||
* try, and the reason "grace2019" is worse than its length suggests.
|
||||
*/
|
||||
private static function echoesIdentity( string $lowerPassword, string $email, string $displayName ): bool {
|
||||
$email = strtolower( trim( $email ) );
|
||||
$localPart = '' !== $email ? (string) strstr( $email . '@', '@', true ) : '';
|
||||
|
||||
$fragments = [ $email, $localPart, strtolower( trim( $displayName ) ) ];
|
||||
|
||||
foreach ( $fragments as $fragment ) {
|
||||
if ( strlen( $fragment ) >= self::IDENTITY_FRAGMENT_LENGTH && str_contains( $lowerPassword, $fragment ) ) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
/**
|
||||
* Passwords common enough that a guess costs nothing. Only entries at least
|
||||
* {@see MIN_LENGTH} long are worth listing — anything shorter is already
|
||||
* refused — so this is the long tail of the usual leaked-password lists
|
||||
* rather than the whole of it. zxcvbn in the browser covers the rest.
|
||||
*
|
||||
* @return list<string>
|
||||
*/
|
||||
private static function commonPasswords(): array {
|
||||
return [
|
||||
'password',
|
||||
'password1',
|
||||
'password12',
|
||||
'password123',
|
||||
'passw0rd',
|
||||
'p@ssword',
|
||||
'p@ssw0rd',
|
||||
'12345678',
|
||||
'123456789',
|
||||
'1234567890',
|
||||
'123123123',
|
||||
'qwertyui',
|
||||
'qwertyuiop',
|
||||
'qwerty123',
|
||||
'qwerty12',
|
||||
'1qaz2wsx',
|
||||
'zaq12wsx',
|
||||
'iloveyou',
|
||||
'princess',
|
||||
'sunshine',
|
||||
'football',
|
||||
'baseball',
|
||||
'basketball',
|
||||
'superman',
|
||||
'batman123',
|
||||
'trustno1',
|
||||
'welcome1',
|
||||
'welcome123',
|
||||
'letmein1',
|
||||
'letmein123',
|
||||
'admin123',
|
||||
'administrator',
|
||||
'abc12345',
|
||||
'abcd1234',
|
||||
'monkey123',
|
||||
'dragon123',
|
||||
'michael1',
|
||||
'jennifer',
|
||||
'starwars',
|
||||
'computer',
|
||||
'whatever',
|
||||
'freedom1',
|
||||
'changeme',
|
||||
'secret123',
|
||||
'login123',
|
||||
];
|
||||
}
|
||||
}
|
||||
@@ -1,102 +0,0 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace Unsupervised\Schedular\Auth;
|
||||
|
||||
use Unsupervised\Schedular\Val;
|
||||
|
||||
/**
|
||||
* Admin page (Students → Pending Students) for reviewing self-signup accounts:
|
||||
* approve a confirmed applicant into a full student, or reject (delete) them.
|
||||
* Only relevant while open registration is enabled.
|
||||
*/
|
||||
class RegistrationApprovalController {
|
||||
|
||||
public const PAGE_SLUG = 'us-pending-students';
|
||||
public const NONCE_ACTION = 'usc_registration_approval';
|
||||
|
||||
public function __construct( private RegistrationMailer $mailer ) {}
|
||||
|
||||
public function renderPage(): void {
|
||||
if ( ! current_user_can( RoleManager::CAP_MANAGE_STUDENTS ) ) {
|
||||
wp_die( esc_html__( 'You do not have permission to manage student registrations.', 'unsupervised-schedular' ) );
|
||||
}
|
||||
|
||||
if ( isset( $_POST['usc_action'] ) && check_admin_referer( self::NONCE_ACTION ) ) {
|
||||
$this->handleAction();
|
||||
}
|
||||
|
||||
$awaitingApproval = [];
|
||||
$awaitingConfirmation = [];
|
||||
foreach ( $this->pendingUsers() as $user ) {
|
||||
if ( RegistrationStatus::emailConfirmed( (int) $user->ID ) ) {
|
||||
$awaitingApproval[] = $user;
|
||||
} else {
|
||||
$awaitingConfirmation[] = $user;
|
||||
}
|
||||
}
|
||||
|
||||
include USC_PLUGIN_DIR . 'templates/admin/registrations.php';
|
||||
}
|
||||
|
||||
/**
|
||||
* Approve or reject the posted user. Approval clears the pending flags and
|
||||
* emails the student; rejection emails them, then hard-deletes the account so
|
||||
* the email is freed to re-apply.
|
||||
*/
|
||||
private function handleAction(): void {
|
||||
// Nonce is verified by the caller (renderPage) before this method runs.
|
||||
// phpcs:disable WordPress.Security.NonceVerification.Missing
|
||||
$action = sanitize_key( Val::string( wp_unslash( $_POST['usc_action'] ?? '' ) ) );
|
||||
$userId = absint( Val::int( $_POST['user_id'] ?? 0 ) );
|
||||
// phpcs:enable WordPress.Security.NonceVerification.Missing
|
||||
|
||||
if ( $userId <= 0 || ! RegistrationStatus::isAwaitingApproval( $userId ) ) {
|
||||
return;
|
||||
}
|
||||
|
||||
if ( 'approve' === $action ) {
|
||||
RegistrationStatus::approve( $userId );
|
||||
$user = get_user_by( 'id', $userId );
|
||||
if ( $user instanceof \WP_User ) {
|
||||
$this->mailer->sendApproved( $user );
|
||||
}
|
||||
return;
|
||||
}
|
||||
|
||||
if ( 'reject' === $action ) {
|
||||
$user = get_user_by( 'id', $userId );
|
||||
$email = $user instanceof \WP_User ? (string) $user->user_email : '';
|
||||
if ( '' !== $email ) {
|
||||
$this->mailer->sendRejected( $email );
|
||||
}
|
||||
|
||||
if ( ! function_exists( 'wp_delete_user' ) ) {
|
||||
require_once ABSPATH . 'wp-admin/includes/user.php';
|
||||
}
|
||||
wp_delete_user( $userId );
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Every account still awaiting approval (confirmed or not).
|
||||
*
|
||||
* @return list<\WP_User>
|
||||
*/
|
||||
private function pendingUsers(): array {
|
||||
return array_values(
|
||||
array_filter(
|
||||
get_users(
|
||||
[
|
||||
'meta_key' => RegistrationStatus::META_AWAITING_APPROVAL, // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_key
|
||||
'meta_value' => '1', // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_value
|
||||
'number' => 500,
|
||||
'orderby' => 'user_registered',
|
||||
'order' => 'ASC',
|
||||
]
|
||||
),
|
||||
static fn( mixed $user ): bool => $user instanceof \WP_User
|
||||
)
|
||||
);
|
||||
}
|
||||
}
|
||||
@@ -3,8 +3,6 @@ declare(strict_types=1);
|
||||
|
||||
namespace Unsupervised\Schedular\Auth;
|
||||
|
||||
use Unsupervised\Schedular\Val;
|
||||
|
||||
class RegistrationController {
|
||||
|
||||
/**
|
||||
@@ -19,132 +17,50 @@ class RegistrationController {
|
||||
wp_die( esc_html__( 'You do not have permission to manage invites.', 'unsupervised-schedular' ) );
|
||||
}
|
||||
|
||||
$newInviteUrl = '';
|
||||
$inviteError = '';
|
||||
if ( isset( $_POST['usc_action'] ) && check_admin_referer( 'usc_invite_action' ) ) {
|
||||
[ $newInviteUrl, $inviteError ] = $this->handleFormAction();
|
||||
$this->handleFormAction();
|
||||
}
|
||||
|
||||
$pendingInvites = $this->invites->findPending();
|
||||
$registrationPageId = Val::int( get_option( self::OPTION_PAGE, 0 ) );
|
||||
$registrationPageId = (int) get_option( self::OPTION_PAGE, 0 );
|
||||
$registrationPageUrl = $registrationPageId > 0 ? (string) get_permalink( $registrationPageId ) : '';
|
||||
|
||||
include USC_PLUGIN_DIR . 'templates/admin/invites.php';
|
||||
}
|
||||
|
||||
/**
|
||||
* Handle a posted admin action. Returns `[link, error]`: the registration
|
||||
* link for a freshly created invite — the only time it can be shown, since
|
||||
* just the token's hash is stored — or an error message when creation
|
||||
* failed; both empty for every other action.
|
||||
*
|
||||
* @return array{string, string}
|
||||
*/
|
||||
private function handleFormAction(): array {
|
||||
private function handleFormAction(): void {
|
||||
// Nonce is verified by the caller (renderPage) before this method runs.
|
||||
// phpcs:disable WordPress.Security.NonceVerification.Missing
|
||||
$action = sanitize_key( Val::string( wp_unslash( $_POST['usc_action'] ?? '' ) ) );
|
||||
$action = sanitize_key( wp_unslash( $_POST['usc_action'] ?? '' ) );
|
||||
|
||||
if ( 'set_page' === $action ) {
|
||||
update_option( self::OPTION_PAGE, absint( Val::int( $_POST['registration_page_id'] ?? 0 ) ) );
|
||||
update_option( self::OPTION_PAGE, absint( $_POST['registration_page_id'] ?? 0 ) );
|
||||
}
|
||||
|
||||
if ( 'invite' === $action ) {
|
||||
$email = sanitize_email( Val::string( wp_unslash( $_POST['email'] ?? '' ) ) );
|
||||
$email = sanitize_email( wp_unslash( $_POST['email'] ?? '' ) );
|
||||
|
||||
if (
|
||||
! is_email( $email )
|
||||
|| false !== email_exists( $email )
|
||||
|| null !== $this->invites->findPendingByEmail( $email )
|
||||
is_email( $email )
|
||||
&& false === email_exists( $email )
|
||||
&& null === $this->invites->findPendingByEmail( $email )
|
||||
) {
|
||||
return [ '', esc_html__( 'Could not create the invite: enter a valid email address that has no account and no pending invite.', 'unsupervised-schedular' ) ];
|
||||
$this->invites->insert(
|
||||
new Invite(
|
||||
email: $email,
|
||||
token: wp_generate_password( 32, false ),
|
||||
invitedBy: get_current_user_id(),
|
||||
)
|
||||
);
|
||||
}
|
||||
|
||||
$rawToken = wp_generate_password( 32, false );
|
||||
|
||||
$id = $this->invites->insert(
|
||||
new Invite(
|
||||
email: $email,
|
||||
token: Invite::hashToken( $rawToken ),
|
||||
invitedBy: get_current_user_id(),
|
||||
)
|
||||
);
|
||||
|
||||
return $this->linkOrError( $id, $rawToken );
|
||||
}
|
||||
|
||||
if ( 'group_invite' === $action ) {
|
||||
$expiresAt = $this->normalizeExpiry( sanitize_text_field( Val::string( wp_unslash( $_POST['expires_at'] ?? '' ) ) ) );
|
||||
|
||||
if ( null === $expiresAt ) {
|
||||
return [ '', esc_html__( 'Could not create the group link: choose an expiry date of today or later.', 'unsupervised-schedular' ) ];
|
||||
}
|
||||
|
||||
$rawToken = wp_generate_password( 32, false );
|
||||
|
||||
$id = $this->invites->insert(
|
||||
new Invite(
|
||||
email: '',
|
||||
token: Invite::hashToken( $rawToken ),
|
||||
invitedBy: get_current_user_id(),
|
||||
kind: Invite::KIND_GROUP,
|
||||
expiresAt: $expiresAt,
|
||||
)
|
||||
);
|
||||
|
||||
return $this->linkOrError( $id, $rawToken );
|
||||
}
|
||||
|
||||
if ( 'revoke' === $action ) {
|
||||
$inviteId = absint( Val::int( $_POST['invite_id'] ?? 0 ) );
|
||||
$inviteId = absint( $_POST['invite_id'] ?? 0 );
|
||||
if ( $inviteId > 0 ) {
|
||||
$this->invites->revoke( $inviteId );
|
||||
}
|
||||
}
|
||||
// phpcs:enable WordPress.Security.NonceVerification.Missing
|
||||
|
||||
return [ '', '' ];
|
||||
}
|
||||
|
||||
/**
|
||||
* The registration link for a stored invite, or an error when the insert
|
||||
* failed — a link must never be shown for a token that was not persisted,
|
||||
* since it could only ever dead-end as "invalid or expired".
|
||||
*
|
||||
* @return array{string, string}
|
||||
*/
|
||||
private function linkOrError( int $insertedId, string $rawToken ): array {
|
||||
if ( $insertedId <= 0 ) {
|
||||
return [ '', esc_html__( 'Could not save the invite. Deactivate and reactivate the plugin to update the database, then try again.', 'unsupervised-schedular' ) ];
|
||||
}
|
||||
|
||||
return [ $this->registrationLink( $rawToken ), '' ];
|
||||
}
|
||||
|
||||
/**
|
||||
* Validate a submitted group-link expiry date (strict `Y-m-d`, today or
|
||||
* later) and expand it to the end of that day; null when invalid or past.
|
||||
*/
|
||||
private function normalizeExpiry( string $date ): ?string {
|
||||
$day = \DateTimeImmutable::createFromFormat( '!Y-m-d', $date );
|
||||
if ( false === $day || $day->format( 'Y-m-d' ) !== $date ) {
|
||||
return null;
|
||||
}
|
||||
|
||||
if ( $date < Val::string( current_time( 'Y-m-d' ) ) ) {
|
||||
return null;
|
||||
}
|
||||
|
||||
return $date . ' 23:59:59';
|
||||
}
|
||||
|
||||
/**
|
||||
* Build the registration URL for a raw invite token.
|
||||
*/
|
||||
private function registrationLink( string $rawToken ): string {
|
||||
$pageId = Val::int( get_option( self::OPTION_PAGE, 0 ) );
|
||||
$linkBase = $pageId > 0 ? (string) get_permalink( $pageId ) : '';
|
||||
|
||||
return add_query_arg( 'us_invite', rawurlencode( $rawToken ), '' !== $linkBase ? $linkBase : home_url( '/' ) );
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,61 +0,0 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace Unsupervised\Schedular\Auth;
|
||||
|
||||
/**
|
||||
* Enforces the pending state of self-signup accounts:
|
||||
* - an account whose email is not yet confirmed cannot log in at all;
|
||||
* - a confirmed-but-unapproved account may log in, but its booking capability
|
||||
* is withheld so it only reaches the "awaiting approval" screen.
|
||||
*
|
||||
* Both checks key solely off the pending user meta, so invite- and
|
||||
* admin-created students (which carry none of it) are unaffected.
|
||||
*/
|
||||
class RegistrationLoginGate {
|
||||
|
||||
public function register(): void {
|
||||
add_filter( 'wp_authenticate_user', [ $this, 'blockUnconfirmed' ], 10, 1 );
|
||||
add_filter( 'user_has_cap', [ $this, 'withholdBookingWhilePending' ], 10, 4 );
|
||||
}
|
||||
|
||||
/**
|
||||
* Block authentication for a self-signup that has not yet confirmed its
|
||||
* email. Runs after password verification.
|
||||
*
|
||||
* @param \WP_User|\WP_Error $user Authenticating user, or an earlier error.
|
||||
* @return \WP_User|\WP_Error
|
||||
*/
|
||||
public function blockUnconfirmed( $user ) {
|
||||
if (
|
||||
$user instanceof \WP_User
|
||||
&& RegistrationStatus::isAwaitingApproval( (int) $user->ID )
|
||||
&& ! RegistrationStatus::emailConfirmed( (int) $user->ID )
|
||||
) {
|
||||
return new \WP_Error(
|
||||
'us_email_unconfirmed',
|
||||
esc_html__( 'Please confirm your email address before logging in — check your inbox for the confirmation link.', 'unsupervised-schedular' )
|
||||
);
|
||||
}
|
||||
|
||||
return $user;
|
||||
}
|
||||
|
||||
/**
|
||||
* Strip the booking capability from any account still awaiting approval, so a
|
||||
* confirmed-but-unapproved student cannot book until a studio admin approves.
|
||||
*
|
||||
* @param array<string, bool> $allcaps All capabilities currently held.
|
||||
* @param array<int, string> $caps Required capabilities (unused).
|
||||
* @param array<int, mixed> $args Callback args (unused).
|
||||
* @param mixed $user The user being checked (a WP_User in practice).
|
||||
* @return array<string, bool>
|
||||
*/
|
||||
public function withholdBookingWhilePending( array $allcaps, array $caps, array $args, mixed $user ): array {
|
||||
if ( $user instanceof \WP_User && RegistrationStatus::isAwaitingApproval( (int) $user->ID ) ) {
|
||||
unset( $allcaps[ RoleManager::CAP_BOOK_LESSON ] );
|
||||
}
|
||||
|
||||
return $allcaps;
|
||||
}
|
||||
}
|
||||
@@ -1,163 +0,0 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace Unsupervised\Schedular\Auth;
|
||||
|
||||
use Unsupervised\Schedular\Val;
|
||||
|
||||
/**
|
||||
* Transactional emails for the self-approval registration flow: the email
|
||||
* confirmation link, the studio-admin heads-up that someone is ready to
|
||||
* approve, and the approval / rejection notices to the student.
|
||||
*/
|
||||
class RegistrationMailer {
|
||||
|
||||
/**
|
||||
* Email the new student a link to confirm their address. Returns false when
|
||||
* there is no recipient.
|
||||
*/
|
||||
public function sendConfirmation( \WP_User $user, string $confirmUrl ): bool {
|
||||
if ( '' === (string) $user->user_email ) {
|
||||
return false;
|
||||
}
|
||||
|
||||
$subject = sprintf(
|
||||
/* translators: %s: site name */
|
||||
__( 'Confirm your email for %s', 'unsupervised-schedular' ),
|
||||
$this->siteName()
|
||||
);
|
||||
|
||||
$body = sprintf(
|
||||
/* translators: 1: site name, 2: confirmation URL */
|
||||
__( "Thanks for signing up at %1\$s.\n\nPlease confirm your email address by opening this link:\n%2\$s\n\nOnce confirmed, a studio admin will review and approve your account. You'll get another email when it's ready.", 'unsupervised-schedular' ),
|
||||
$this->siteName(),
|
||||
$confirmUrl
|
||||
);
|
||||
|
||||
return (bool) wp_mail( $user->user_email, $subject, $body );
|
||||
}
|
||||
|
||||
/**
|
||||
* Tell the studio admins a self-signup has confirmed their email and is
|
||||
* waiting for approval. Sent to the site admin email.
|
||||
*/
|
||||
public function notifyAdminsPending( \WP_User $user ): bool {
|
||||
$adminEmail = Val::string( get_option( 'admin_email', '' ) );
|
||||
if ( '' === $adminEmail ) {
|
||||
return false;
|
||||
}
|
||||
|
||||
$subject = __( 'A new student is awaiting approval', 'unsupervised-schedular' );
|
||||
$body = sprintf(
|
||||
/* translators: 1: student name, 2: student email */
|
||||
__( "%1\$s (%2\$s) has confirmed their email and is awaiting approval.\n\nReview them under Students → Pending Students in wp-admin.", 'unsupervised-schedular' ),
|
||||
(string) $user->display_name,
|
||||
(string) $user->user_email
|
||||
);
|
||||
|
||||
return (bool) wp_mail( $adminEmail, $subject, $body );
|
||||
}
|
||||
|
||||
/**
|
||||
* Tell the student their account has been approved. Returns false when there
|
||||
* is no recipient.
|
||||
*/
|
||||
public function sendApproved( \WP_User $user ): bool {
|
||||
if ( '' === (string) $user->user_email ) {
|
||||
return false;
|
||||
}
|
||||
|
||||
$subject = sprintf(
|
||||
/* translators: %s: site name */
|
||||
__( 'Your %s account is approved', 'unsupervised-schedular' ),
|
||||
$this->siteName()
|
||||
);
|
||||
$body = sprintf(
|
||||
/* translators: 1: site name, 2: login URL */
|
||||
__( "Good news — your account at %1\$s has been approved. You can now log in and book:\n%2\$s", 'unsupervised-schedular' ),
|
||||
$this->siteName(),
|
||||
wp_login_url()
|
||||
);
|
||||
|
||||
return (bool) wp_mail( $user->user_email, $subject, $body );
|
||||
}
|
||||
|
||||
/**
|
||||
* Tell an applicant their registration was declined. Takes the email address
|
||||
* directly, since the account is deleted as part of rejection.
|
||||
*/
|
||||
public function sendRejected( string $email ): bool {
|
||||
if ( '' === $email ) {
|
||||
return false;
|
||||
}
|
||||
|
||||
$subject = sprintf(
|
||||
/* translators: %s: site name */
|
||||
__( 'Your %s registration', 'unsupervised-schedular' ),
|
||||
$this->siteName()
|
||||
);
|
||||
$body = sprintf(
|
||||
/* translators: %s: site name */
|
||||
__( 'Thank you for your interest in %s. We are unable to approve your registration at this time. Please contact the studio if you have any questions.', 'unsupervised-schedular' ),
|
||||
$this->siteName()
|
||||
);
|
||||
|
||||
return (bool) wp_mail( $email, $subject, $body );
|
||||
}
|
||||
|
||||
/**
|
||||
* Tell a registered student they have been given access to an invite-only
|
||||
* group class and can now enrol. Returns false when there is no recipient.
|
||||
*/
|
||||
public function sendClassAccessGranted( \WP_User $user, string $className ): bool {
|
||||
if ( '' === (string) $user->user_email ) {
|
||||
return false;
|
||||
}
|
||||
|
||||
$subject = sprintf(
|
||||
/* translators: %s: class title */
|
||||
__( 'You have been invited to %s', 'unsupervised-schedular' ),
|
||||
$className
|
||||
);
|
||||
$body = sprintf(
|
||||
/* translators: 1: class title, 2: site name, 3: login URL */
|
||||
__( "You have been given access to the group class \"%1\$s\" at %2\$s.\n\nLog in and open the group classes page to enrol:\n%3\$s", 'unsupervised-schedular' ),
|
||||
$className,
|
||||
$this->siteName(),
|
||||
wp_login_url()
|
||||
);
|
||||
|
||||
return (bool) wp_mail( $user->user_email, $subject, $body );
|
||||
}
|
||||
|
||||
/**
|
||||
* Email a tokenised registration link to someone invited to a group class who
|
||||
* does not yet have an account. Returns false when there is no recipient.
|
||||
*/
|
||||
public function sendClassInvite( string $email, string $link, string $className ): bool {
|
||||
if ( '' === $email ) {
|
||||
return false;
|
||||
}
|
||||
|
||||
$subject = sprintf(
|
||||
/* translators: %s: class title */
|
||||
__( 'You are invited to join %s', 'unsupervised-schedular' ),
|
||||
$className
|
||||
);
|
||||
$body = sprintf(
|
||||
/* translators: 1: class title, 2: site name, 3: registration URL */
|
||||
__( "You have been invited to the group class \"%1\$s\" at %2\$s.\n\nCreate your account using this link, then choose to enrol in the class:\n%3\$s", 'unsupervised-schedular' ),
|
||||
$className,
|
||||
$this->siteName(),
|
||||
$link
|
||||
);
|
||||
|
||||
return (bool) wp_mail( $email, $subject, $body );
|
||||
}
|
||||
|
||||
private function siteName(): string {
|
||||
$name = (string) get_bloginfo( 'name' );
|
||||
|
||||
return '' !== $name ? $name : __( 'the studio', 'unsupervised-schedular' );
|
||||
}
|
||||
}
|
||||
+42
-642
@@ -3,237 +3,55 @@ declare(strict_types=1);
|
||||
|
||||
namespace Unsupervised\Schedular\Auth;
|
||||
|
||||
use Unsupervised\Schedular\GroupClass\GroupAccessRepository;
|
||||
use Unsupervised\Schedular\Guardian\GuardianService;
|
||||
use Unsupervised\Schedular\Payment\StudioSettings;
|
||||
use Unsupervised\Schedular\Policy\AcceptanceRepository;
|
||||
use Unsupervised\Schedular\Policy\Policy;
|
||||
use Unsupervised\Schedular\Policy\PolicyAcceptance;
|
||||
use Unsupervised\Schedular\Policy\PolicyRepository;
|
||||
use Unsupervised\Schedular\Policy\PolicyVersionRepository;
|
||||
use Unsupervised\Schedular\Registration\Answer;
|
||||
use Unsupervised\Schedular\Registration\AnswerRepository;
|
||||
use Unsupervised\Schedular\Registration\Question;
|
||||
use Unsupervised\Schedular\Registration\QuestionRepository;
|
||||
use Unsupervised\Schedular\Val;
|
||||
|
||||
class RegistrationPage {
|
||||
|
||||
/** "Who are you registering?": the account holder, and nobody else. */
|
||||
public const FOR_SELF = 'self';
|
||||
|
||||
/** Only other people — the account holder is not a student. */
|
||||
public const FOR_STUDENTS = 'students';
|
||||
|
||||
/** The account holder *and* other people. */
|
||||
public const FOR_BOTH = 'both';
|
||||
|
||||
/** Success signal: an invited student was created and logged in. */
|
||||
private const RESULT_INVITE = 'invite';
|
||||
|
||||
/** Success signal: a self-signup was created and must confirm their email. */
|
||||
private const RESULT_CONFIRM = 'confirm';
|
||||
|
||||
/**
|
||||
* Success signal: a group-link signup was created and must confirm their
|
||||
* email — confirming approves the account immediately (no admin review).
|
||||
*/
|
||||
private const RESULT_CONFIRM_GROUP = 'confirm_group';
|
||||
|
||||
/**
|
||||
* Validation error from the most recent submission processed on
|
||||
* `template_redirect`, carried over to {@see render()} so it can be shown
|
||||
* inline with the form. Empty when the last submit succeeded or none ran.
|
||||
*/
|
||||
private string $submitError = '';
|
||||
|
||||
public function __construct(
|
||||
private InviteRepository $invites,
|
||||
private PolicyRepository $policies,
|
||||
private PolicyVersionRepository $versions,
|
||||
private AcceptanceRepository $acceptances,
|
||||
private StudioSettings $settings,
|
||||
private RegistrationMailer $mailer,
|
||||
private QuestionRepository $questions,
|
||||
private AnswerRepository $answers,
|
||||
private GroupAccessRepository $access,
|
||||
private GuardianService $guardians,
|
||||
) {}
|
||||
|
||||
/**
|
||||
* Renders the student registration shortcode output.
|
||||
*
|
||||
* @param array<int|string, mixed> $atts Block attributes (`loginPageId`,
|
||||
* `inviteOnlyMessage`) or shortcode
|
||||
* attributes (`login_page_id`,
|
||||
* `invite_only_message`).
|
||||
* @param array<string, string> $atts Shortcode attributes (unused — reserved for future options).
|
||||
*/
|
||||
public function render( array $atts ): string {
|
||||
// A just-completed invite signup is redirected back here already logged
|
||||
// in (see maybeHandleSubmit); its success flag distinguishes that from a
|
||||
// visitor who simply happens to be signed in already.
|
||||
// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only display flag; the submit that set it was nonce-checked.
|
||||
$registered = sanitize_key( Val::string( wp_unslash( $_GET['us_registered'] ?? '' ) ) );
|
||||
|
||||
public function render( array $atts ): string { // phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter.Found
|
||||
if ( is_user_logged_in() ) {
|
||||
// Both logged-in outcomes are dead ends without somewhere to go next,
|
||||
// so both offer the same "continue" link to the configured page.
|
||||
wp_enqueue_style( 'us-scheduler' );
|
||||
$link = $this->continueLink( $atts );
|
||||
return '<p>' . esc_html__( 'You already have an account and are logged in.', 'unsupervised-schedular' ) . '</p>';
|
||||
}
|
||||
|
||||
if ( self::RESULT_INVITE === $registered ) {
|
||||
// An invited student is done the moment they land here logged in.
|
||||
return '<div class="us-register-form"><p class="us-success">'
|
||||
. esc_html__( 'Your account has been created and you are now logged in.', 'unsupervised-schedular' )
|
||||
. '</p>' . $link . '</div>';
|
||||
// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- token identifies the invite; the form submit is nonce-checked below.
|
||||
$token = sanitize_text_field( wp_unslash( $_REQUEST['us_invite'] ?? '' ) );
|
||||
$invite = '' !== $token ? $this->invites->findByToken( $token ) : null;
|
||||
|
||||
$error = '';
|
||||
$success = false;
|
||||
|
||||
if ( isset( $_POST['us_register'] ) && check_admin_referer( 'us_student_register' ) ) {
|
||||
$result = $this->handleSubmit( $invite );
|
||||
if ( true === $result ) {
|
||||
$success = true;
|
||||
} else {
|
||||
$error = $result;
|
||||
}
|
||||
|
||||
return '<div class="us-register-form"><p>'
|
||||
. esc_html__( 'You already have an account and are logged in.', 'unsupervised-schedular' )
|
||||
. '</p>' . $link . '</div>';
|
||||
}
|
||||
|
||||
// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- token identifies the invite; the form submit is nonce-checked in maybeHandleSubmit.
|
||||
$token = sanitize_text_field( Val::string( wp_unslash( $_REQUEST['us_invite'] ?? '' ) ) );
|
||||
// Only the token's hash is stored, so hash the submitted token for lookup.
|
||||
$invite = '' !== $token ? $this->invites->findByToken( Invite::hashToken( $token ) ) : null;
|
||||
$open = $this->settings->openRegistrationEnabled();
|
||||
|
||||
// Only a redeemable invite fixes the form's email to the invited address.
|
||||
// A stale token (expired / accepted / revoked) with open registration on
|
||||
// must fall back to the normal editable email field, not show — and then
|
||||
// fail to submit — the stale invite's address.
|
||||
$inviteValid = null !== $invite && $invite->isAcceptable( current_time( 'mysql' ) );
|
||||
|
||||
// The submission itself is processed in maybeHandleSubmit on
|
||||
// template_redirect (before any output), so the invite auto-login cookie
|
||||
// is actually sent. Its success signal returns here as ?us_registered;
|
||||
// only a validation error is carried on the instance to show inline.
|
||||
$successType = in_array( $registered, [ self::RESULT_CONFIRM, self::RESULT_CONFIRM_GROUP ], true ) ? $registered : '';
|
||||
$error = $this->submitError;
|
||||
|
||||
// Result of an email-confirmation link (set by EmailConfirmationHandler's redirect).
|
||||
// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only display flag, not a state change.
|
||||
$confirmResult = sanitize_key( Val::string( wp_unslash( $_GET['us_confirmed'] ?? '' ) ) );
|
||||
|
||||
// Where the post-confirmation prompt sends students to sign in.
|
||||
$loginUrl = $this->loginUrl( $this->successPageId( $atts ) );
|
||||
|
||||
$policyForms = $this->signupPolicies();
|
||||
$accountQuestions = $this->questions->findByScope( Question::SCOPE_ACCOUNT, activeOnly: true );
|
||||
$canRegister = $open || $inviteValid;
|
||||
$inviteOnlyMessage = $this->inviteOnlyMessage( $atts );
|
||||
|
||||
// The signup form carries the same policy-acceptance markup as the booking
|
||||
// gate, so it needs the plugin stylesheet that formats it.
|
||||
wp_enqueue_style( 'us-scheduler' );
|
||||
|
||||
// The script drives the parent/guardian section (revealing it, taking the
|
||||
// account holder's own panel out of play, and cloning the child block for
|
||||
// "add another") and the password meter, so it is needed whenever the form
|
||||
// itself is on screen.
|
||||
if ( $canRegister && '' === $successType ) {
|
||||
wp_enqueue_script( 'us-scheduler-register' );
|
||||
|
||||
// The browser gate reads the same numbers the server enforces, so the
|
||||
// two cannot drift into disagreeing about what it accepted.
|
||||
wp_localize_script(
|
||||
'us-scheduler-register',
|
||||
'usSchedulerPassword',
|
||||
[
|
||||
'minLength' => PasswordPolicy::MIN_LENGTH,
|
||||
'minScore' => PasswordPolicy::MIN_SCORE,
|
||||
'strings' => [
|
||||
'short' => sprintf(
|
||||
/* translators: %d: minimum number of characters. */
|
||||
__( 'At least %d characters, please.', 'unsupervised-schedular' ),
|
||||
PasswordPolicy::MIN_LENGTH
|
||||
),
|
||||
'veryWeak' => __( 'Too weak — a stranger could guess this.', 'unsupervised-schedular' ),
|
||||
'weak' => __( 'Still too weak. Try a longer phrase.', 'unsupervised-schedular' ),
|
||||
'medium' => __( 'Good enough.', 'unsupervised-schedular' ),
|
||||
'strong' => __( 'Strong password.', 'unsupervised-schedular' ),
|
||||
],
|
||||
]
|
||||
);
|
||||
}
|
||||
$policyForms = $this->signupPolicies();
|
||||
$canRegister = null !== $invite && $invite->isAcceptable( current_time( 'mysql' ) );
|
||||
|
||||
ob_start();
|
||||
include USC_PLUGIN_DIR . 'templates/frontend/register-page.php';
|
||||
return (string) ob_get_clean();
|
||||
}
|
||||
|
||||
/**
|
||||
* Process a submitted registration on `template_redirect`, before any page
|
||||
* output. Running here (rather than inside {@see render()}, which fires
|
||||
* during `the_content` after headers are sent) is what lets the invite
|
||||
* branch's `wp_set_auth_cookie()` actually persist — otherwise the student
|
||||
* appears logged in for a single render and is logged out on the next view.
|
||||
*
|
||||
* On success the request is redirected (post/redirect/get) with a
|
||||
* `?us_registered` flag so a refresh cannot resubmit; a validation error is
|
||||
* stashed for {@see render()} to show inline with the form.
|
||||
*/
|
||||
public function maybeHandleSubmit(): void {
|
||||
if ( ! isset( $_POST['us_register'] ) || is_user_logged_in() ) {
|
||||
return;
|
||||
}
|
||||
|
||||
if ( ! check_admin_referer( 'us_student_register' ) ) {
|
||||
return;
|
||||
}
|
||||
|
||||
// phpcs:ignore WordPress.Security.NonceVerification.Missing -- verified by check_admin_referer above.
|
||||
$token = sanitize_text_field( Val::string( wp_unslash( $_REQUEST['us_invite'] ?? '' ) ) );
|
||||
$invite = '' !== $token ? $this->invites->findByToken( Invite::hashToken( $token ) ) : null;
|
||||
$open = $this->settings->openRegistrationEnabled();
|
||||
|
||||
$result = $this->handleSubmit( $invite, $open );
|
||||
|
||||
if ( in_array( $result, [ self::RESULT_INVITE, self::RESULT_CONFIRM, self::RESULT_CONFIRM_GROUP ], true ) ) {
|
||||
$this->redirect( add_query_arg( 'us_registered', $result, $this->currentUrl() ) );
|
||||
return;
|
||||
}
|
||||
|
||||
$this->submitError = $result;
|
||||
}
|
||||
|
||||
/**
|
||||
* The current page's clean permalink, used as the post/redirect/get target
|
||||
* so the invite token and any stale flags are dropped from the URL.
|
||||
*/
|
||||
private function currentUrl(): string {
|
||||
$url = get_permalink();
|
||||
|
||||
return is_string( $url ) ? $url : home_url( '/' );
|
||||
}
|
||||
|
||||
/**
|
||||
* Issues the post-submit redirect and stops the request. Split out so tests
|
||||
* can observe the target without the process exiting.
|
||||
*/
|
||||
protected function redirect( string $url ): void {
|
||||
wp_safe_redirect( $url );
|
||||
exit;
|
||||
}
|
||||
|
||||
/**
|
||||
* The message shown when registration is closed and no valid invite is
|
||||
* present. Studios can override the default via the block
|
||||
* (`inviteOnlyMessage`) or shortcode (`invite_only_message`) attribute.
|
||||
*
|
||||
* @param array<int|string, mixed> $atts
|
||||
*/
|
||||
private function inviteOnlyMessage( array $atts ): string {
|
||||
$custom = trim( Val::string( $atts['inviteOnlyMessage'] ?? $atts['invite_only_message'] ?? '' ) );
|
||||
|
||||
if ( '' !== $custom ) {
|
||||
return $custom;
|
||||
}
|
||||
|
||||
return esc_html__( 'Registration is by invitation only. Please use the link from your invitation email, or contact the studio.', 'unsupervised-schedular' );
|
||||
}
|
||||
|
||||
/**
|
||||
* Redirect to the configured registration page when an invite token lands
|
||||
* elsewhere (e.g. a link generated before the page was selected). Hooked on
|
||||
@@ -245,12 +63,12 @@ class RegistrationPage {
|
||||
}
|
||||
|
||||
// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only token used only to build the redirect target.
|
||||
$token = sanitize_text_field( Val::string( wp_unslash( $_GET['us_invite'] ?? '' ) ) );
|
||||
$token = sanitize_text_field( wp_unslash( $_GET['us_invite'] ?? '' ) );
|
||||
if ( '' === $token ) {
|
||||
return;
|
||||
}
|
||||
|
||||
$pageId = Val::int( get_option( RegistrationController::OPTION_PAGE, 0 ) );
|
||||
$pageId = (int) get_option( RegistrationController::OPTION_PAGE, 0 );
|
||||
if ( $pageId <= 0 || is_page( $pageId ) ) {
|
||||
return;
|
||||
}
|
||||
@@ -260,49 +78,26 @@ class RegistrationPage {
|
||||
}
|
||||
|
||||
/**
|
||||
* Process the submitted registration. Returns a success signal
|
||||
* ({@see RESULT_INVITE} or {@see RESULT_CONFIRM}) or an error message string
|
||||
* on failure.
|
||||
*
|
||||
* The invite branch is tried first, so an invited student always completes
|
||||
* signup regardless of whether open registration is enabled.
|
||||
* Process the submitted registration. Returns true on success or an error
|
||||
* message string on failure.
|
||||
*/
|
||||
private function handleSubmit( ?Invite $invite, bool $open ): string {
|
||||
$inviteValid = null !== $invite && $invite->isAcceptable( current_time( 'mysql' ) );
|
||||
|
||||
if ( ! $inviteValid && ! $open ) {
|
||||
private function handleSubmit( ?Invite $invite ): string|bool {
|
||||
if ( null === $invite || ! $invite->isAcceptable( current_time( 'mysql' ) ) ) {
|
||||
return esc_html__( 'This invitation is invalid, expired, or has already been used.', 'unsupervised-schedular' );
|
||||
}
|
||||
|
||||
// The submit nonce is verified by the caller (render) before this runs.
|
||||
// phpcs:disable WordPress.Security.NonceVerification.Missing
|
||||
// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- passwords must not be sanitized.
|
||||
$password = Val::string( wp_unslash( $_POST['password'] ?? '' ) );
|
||||
$displayName = sanitize_text_field( Val::string( wp_unslash( $_POST['display_name'] ?? '' ) ) );
|
||||
$password = (string) wp_unslash( $_POST['password'] ?? '' );
|
||||
$displayName = sanitize_text_field( wp_unslash( $_POST['display_name'] ?? '' ) );
|
||||
|
||||
// The email is fixed by a personal invite; group-link signups and
|
||||
// self-signups supply their own.
|
||||
if ( $inviteValid && ! $invite->isGroup() ) {
|
||||
$email = $invite->email;
|
||||
} else {
|
||||
$email = sanitize_email( Val::string( wp_unslash( $_POST['email'] ?? '' ) ) );
|
||||
if ( ! is_email( $email ) ) {
|
||||
return esc_html__( 'Please enter a valid email address.', 'unsupervised-schedular' );
|
||||
}
|
||||
}
|
||||
|
||||
// After the email, so the password can be checked against it. The browser
|
||||
// scores the password with zxcvbn and refuses to submit a weak one, but
|
||||
// that is advice a client can decline to take — this is the check that
|
||||
// holds. See PasswordPolicy for why the two halves differ.
|
||||
$passwordError = PasswordPolicy::validate( $password, $email, $displayName );
|
||||
if ( null !== $passwordError ) {
|
||||
return esc_html( $passwordError );
|
||||
if ( strlen( $password ) < 8 ) {
|
||||
return esc_html__( 'Please choose a password of at least 8 characters.', 'unsupervised-schedular' );
|
||||
}
|
||||
|
||||
$policyForms = $this->signupPolicies();
|
||||
// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- each element is coerced to a positive int in the array_map callback; slashes cannot survive integer coercion.
|
||||
$accepted = array_map( static fn( mixed $v ): int => absint( Val::int( $v ) ), (array) ( $_POST['accept'] ?? [] ) );
|
||||
$accepted = array_map( 'absint', (array) ( $_POST['accept'] ?? [] ) );
|
||||
// phpcs:enable WordPress.Security.NonceVerification.Missing
|
||||
|
||||
foreach ( $policyForms as $form ) {
|
||||
@@ -311,88 +106,17 @@ class RegistrationPage {
|
||||
}
|
||||
}
|
||||
|
||||
$accountQuestions = $this->questions->findByScope( Question::SCOPE_ACCOUNT, activeOnly: true );
|
||||
|
||||
// The account-signup questions describe a *student* — instrument, level,
|
||||
// school — not whoever holds the account. So they are asked of each
|
||||
// student being added, and of the account holder only when they are a
|
||||
// student themselves. "Both" is both.
|
||||
$registeringFor = $this->submittedRegisteringFor();
|
||||
|
||||
// "Students" and "both" collect student blocks; only "self" does not.
|
||||
$isGuardian = self::FOR_SELF !== $registeringFor;
|
||||
|
||||
// "Self" and "both" make the account holder a student, so they answer the
|
||||
// questions in their own right. Only a pure guardian does not.
|
||||
$asksSelf = self::FOR_STUDENTS !== $registeringFor;
|
||||
|
||||
$children = $isGuardian ? $this->submittedChildren() : [];
|
||||
$answers = $asksSelf ? $this->submittedAnswers() : [];
|
||||
|
||||
// phpcs:ignore WordPress.Security.NonceVerification.Missing -- verified by the caller.
|
||||
$birthYear = $asksSelf ? trim( sanitize_text_field( Val::string( wp_unslash( $_POST['birth_year'] ?? '' ) ) ) ) : '';
|
||||
|
||||
// Everything is validated before a single user is created, so a bad child
|
||||
// block never leaves a half-registered family behind.
|
||||
if ( $isGuardian && [] === $children ) {
|
||||
return esc_html__( 'Please add at least one student, or choose "Just myself" instead.', 'unsupervised-schedular' );
|
||||
}
|
||||
|
||||
// Name and birth year are required per student, and are checked here for
|
||||
// the same reason the questions below are: the child blocks are hidden
|
||||
// until the guardian box is ticked, so the browser cannot be asked to
|
||||
// enforce them without blocking a signup that has no children at all.
|
||||
foreach ( $children as $child ) {
|
||||
if ( '' === $child['name'] ) {
|
||||
return esc_html__( 'Please give each student a name.', 'unsupervised-schedular' );
|
||||
}
|
||||
|
||||
if ( 0 === GuardianService::normaliseBirthYear( $child['birth_year'] ) ) {
|
||||
return esc_html( GuardianService::birthYearError() );
|
||||
}
|
||||
}
|
||||
|
||||
// Checked as two passes rather than one so the message can say *whose*
|
||||
// answers are missing — under "both" a single message could not.
|
||||
foreach ( array_column( $children, 'answers' ) as $set ) {
|
||||
if ( $this->hasUnansweredRequired( $accountQuestions, $set ) ) {
|
||||
return esc_html__( 'Please answer all required registration questions for each student.', 'unsupervised-schedular' );
|
||||
}
|
||||
}
|
||||
|
||||
// The account holder is a student too under "self" and "both", so the same
|
||||
// birth year every other student gives is asked of them — and checked
|
||||
// here rather than left to the browser, for the same reason as the
|
||||
// children's: the panel is hidden for a pure guardian, so `required`
|
||||
// alone cannot be trusted to have applied.
|
||||
if ( $asksSelf && 0 === GuardianService::normaliseBirthYear( $birthYear ) ) {
|
||||
return esc_html( GuardianService::ownBirthYearError() );
|
||||
}
|
||||
|
||||
if ( $asksSelf && $this->hasUnansweredRequired( $accountQuestions, $answers ) ) {
|
||||
return esc_html__( 'Please answer all required registration questions.', 'unsupervised-schedular' );
|
||||
}
|
||||
|
||||
if ( email_exists( $email ) ) {
|
||||
if ( email_exists( $invite->email ) ) {
|
||||
return esc_html__( 'An account already exists for this email.', 'unsupervised-schedular' );
|
||||
}
|
||||
|
||||
// Nickname as well as display name. WordPress defaults nickname to
|
||||
// `user_login`, which here is the email address — so without this the
|
||||
// account's own address became its nickname, and every screen that names
|
||||
// a person through `UserName` showed the address instead of the name they
|
||||
// had just typed. `UserName` copes with the accounts already created that
|
||||
// way; this stops any more of them.
|
||||
$name = '' !== $displayName ? $displayName : $email;
|
||||
|
||||
$userId = wp_insert_user(
|
||||
[
|
||||
'user_login' => $email,
|
||||
'user_email' => $email,
|
||||
'user_login' => $invite->email,
|
||||
'user_email' => $invite->email,
|
||||
'user_pass' => $password,
|
||||
'display_name' => $name,
|
||||
'nickname' => $name,
|
||||
'role' => $inviteValid ? $invite->role : RoleManager::STUDENT,
|
||||
'display_name' => '' !== $displayName ? $displayName : $invite->email,
|
||||
'role' => $invite->role,
|
||||
]
|
||||
);
|
||||
|
||||
@@ -400,346 +124,23 @@ class RegistrationPage {
|
||||
return esc_html__( 'Could not create the account. Please contact the studio.', 'unsupervised-schedular' );
|
||||
}
|
||||
|
||||
$this->recordAcceptances( $policyForms, (int) $userId, (int) $userId );
|
||||
$this->recordAcceptances( $policyForms, (int) $userId );
|
||||
$this->invites->markAccepted( (int) $invite->id, (int) $userId );
|
||||
|
||||
// Only "students" means the account holder is not a student themselves;
|
||||
// "both" registers them alongside the people they book for.
|
||||
$this->guardians->setGuardianOnly( (int) $userId, self::FOR_STUDENTS === $registeringFor );
|
||||
wp_set_current_user( (int) $userId );
|
||||
wp_set_auth_cookie( (int) $userId );
|
||||
|
||||
if ( $asksSelf ) {
|
||||
$this->guardians->setBirthYear( (int) $userId, $birthYear );
|
||||
}
|
||||
|
||||
if ( $isGuardian ) {
|
||||
$failure = $this->createChildren( $children, $accountQuestions, $policyForms, (int) $userId );
|
||||
if ( '' !== $failure ) {
|
||||
return $failure;
|
||||
}
|
||||
}
|
||||
|
||||
// After the children, so a rollback that deletes this account cannot
|
||||
// leave its answers behind pointing at a user that no longer exists.
|
||||
if ( $asksSelf ) {
|
||||
$this->recordAnswers( $accountQuestions, $answers, (int) $userId );
|
||||
}
|
||||
|
||||
if ( $inviteValid && ! $invite->isGroup() ) {
|
||||
$this->invites->markAccepted( (int) $invite->id, (int) $userId );
|
||||
|
||||
// A personal invite may carry a group-class grant (invited by email);
|
||||
// point any grants for this address at the new account so the class
|
||||
// becomes enrollable for them.
|
||||
$this->access->linkStudentByEmail( $email, (int) $userId );
|
||||
|
||||
wp_set_current_user( (int) $userId );
|
||||
wp_set_auth_cookie( (int) $userId );
|
||||
|
||||
return self::RESULT_INVITE;
|
||||
}
|
||||
|
||||
// Group-link signups and self-signups both stay pending until they
|
||||
// confirm their email; the group link is multi-use so it is never marked
|
||||
// accepted. A group signup auto-approves on confirmation — no admin
|
||||
// review — while a self-signup then waits for studio approval.
|
||||
$autoApprove = $inviteValid && $invite->isGroup();
|
||||
|
||||
$rawToken = RegistrationStatus::markPending( (int) $userId, $autoApprove );
|
||||
$user = get_user_by( 'id', (int) $userId );
|
||||
if ( $user instanceof \WP_User ) {
|
||||
$this->mailer->sendConfirmation( $user, $this->confirmUrl( $rawToken ) );
|
||||
}
|
||||
|
||||
return $autoApprove ? self::RESULT_CONFIRM_GROUP : self::RESULT_CONFIRM;
|
||||
}
|
||||
|
||||
/**
|
||||
* The page id chosen for the post-registration destination, from either the
|
||||
* block (`loginPageId`) or shortcode (`login_page_id`) attribute.
|
||||
*
|
||||
* @param array<int|string, mixed> $atts
|
||||
*/
|
||||
private function successPageId( array $atts ): int {
|
||||
return Val::int( $atts['loginPageId'] ?? $atts['login_page_id'] ?? 0 );
|
||||
}
|
||||
|
||||
/**
|
||||
* URL the post-confirmation sign-in link points to: the chosen login page
|
||||
* when one is configured (and still exists), otherwise the WordPress login
|
||||
* screen.
|
||||
*/
|
||||
private function loginUrl( int $loginPageId ): string {
|
||||
return $this->continueUrl( $loginPageId ) ?? wp_login_url();
|
||||
}
|
||||
|
||||
/**
|
||||
* The "continue" paragraph shown to a logged-in visitor, or an empty string
|
||||
* when no destination page is configured. The link names the chosen page, so
|
||||
* the visitor knows where it goes before clicking; an untitled page falls
|
||||
* back to generic wording rather than reading "Continue to ".
|
||||
*
|
||||
* The sign-in-page fallback {@see loginUrl()} applies is deliberately not
|
||||
* used here: pointing someone who is already signed in at the login screen is
|
||||
* the same dead end with extra steps, so no link is better than that one.
|
||||
*
|
||||
* @param array<int|string, mixed> $atts
|
||||
*/
|
||||
private function continueLink( array $atts ): string {
|
||||
$pageId = $this->successPageId( $atts );
|
||||
$continue = $this->continueUrl( $pageId );
|
||||
|
||||
if ( null === $continue ) {
|
||||
return '';
|
||||
}
|
||||
|
||||
$title = trim( Val::string( get_the_title( $pageId ) ) );
|
||||
$label = '' === $title
|
||||
? esc_html__( 'Continue to your account', 'unsupervised-schedular' )
|
||||
: esc_html(
|
||||
sprintf(
|
||||
/* translators: %s: title of the page the student continues to. */
|
||||
__( 'Continue to %s', 'unsupervised-schedular' ),
|
||||
$title
|
||||
)
|
||||
);
|
||||
|
||||
return '<p><a href="' . esc_url( $continue ) . '">' . $label . '</a></p>';
|
||||
}
|
||||
|
||||
/**
|
||||
* The chosen post-registration page's URL, or null when none is configured
|
||||
* (or it has since been deleted). Unlike {@see loginUrl()} this has no
|
||||
* WordPress-login-screen fallback, so callers that need a page the student
|
||||
* was actually sent to — the invited-student link and the block's
|
||||
* auto-redirect — can tell "not configured" from "configured".
|
||||
*/
|
||||
public function continueUrl( int $pageId ): ?string {
|
||||
if ( $pageId <= 0 ) {
|
||||
return null;
|
||||
}
|
||||
|
||||
$url = get_permalink( $pageId );
|
||||
|
||||
return is_string( $url ) ? $url : null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Whether this request is a *finished* registration — the states the
|
||||
* block's auto-redirect may act on:
|
||||
*
|
||||
* - an invited student who just signed up and is now logged in, and
|
||||
* - a self-signup returning from the emailed confirmation link, whether
|
||||
* their account is ready (`ready`) or awaiting studio approval (`1`).
|
||||
*
|
||||
* Deliberately excluded: the intermediate "check your email" step (the
|
||||
* student would never see the instruction) and every failure — a validation
|
||||
* error or an expired confirmation link (`expired`) — so the message always
|
||||
* gets shown. The `us_confirmed` values are set by
|
||||
* {@see EmailConfirmationHandler::maybeConfirm()}.
|
||||
*/
|
||||
public function isRegistrationComplete(): bool {
|
||||
// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only display flag; the submit that set it was nonce-checked.
|
||||
$registered = sanitize_key( Val::string( wp_unslash( $_GET['us_registered'] ?? '' ) ) );
|
||||
|
||||
if ( self::RESULT_INVITE === $registered ) {
|
||||
return is_user_logged_in();
|
||||
}
|
||||
|
||||
// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only display flag set by EmailConfirmationHandler's redirect.
|
||||
$confirmed = sanitize_key( Val::string( wp_unslash( $_GET['us_confirmed'] ?? '' ) ) );
|
||||
|
||||
return in_array( $confirmed, [ '1', 'ready' ], true );
|
||||
}
|
||||
|
||||
/**
|
||||
* Build the email-confirmation URL for a raw token: the configured
|
||||
* registration page (falling back to the home page) with `?us_confirm=`.
|
||||
*/
|
||||
private function confirmUrl( string $rawToken ): string {
|
||||
$pageId = Val::int( get_option( RegistrationController::OPTION_PAGE, 0 ) );
|
||||
$base = $pageId > 0 ? (string) get_permalink( $pageId ) : home_url( '/' );
|
||||
|
||||
return add_query_arg( 'us_confirm', rawurlencode( $rawToken ), $base );
|
||||
}
|
||||
|
||||
/**
|
||||
* Whether any required question in `$questions` is left blank in `$answers`.
|
||||
*
|
||||
* @param list<Question> $questions
|
||||
* @param array<int, string> $answers
|
||||
*/
|
||||
private function hasUnansweredRequired( array $questions, array $answers ): bool {
|
||||
foreach ( $questions as $question ) {
|
||||
if ( $question->isRequired && '' === trim( (string) ( $answers[ (int) $question->id ] ?? '' ) ) ) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
/**
|
||||
* Who this signup is for: {@see FOR_SELF}, {@see FOR_STUDENTS} or
|
||||
* {@see FOR_BOTH}.
|
||||
*
|
||||
* Anything unrecognised — including a form posted without the field at all —
|
||||
* falls back to "just myself", the choice that collects the least and grants
|
||||
* the least. A missing radio must not be read as "register these children".
|
||||
*/
|
||||
private function submittedRegisteringFor(): string {
|
||||
// The submit nonce is verified by the caller before this runs.
|
||||
// phpcs:ignore WordPress.Security.NonceVerification.Missing
|
||||
$value = sanitize_key( Val::string( wp_unslash( $_POST['us_registering_for'] ?? '' ) ) );
|
||||
|
||||
return in_array( $value, [ self::FOR_STUDENTS, self::FOR_BOTH ], true ) ? $value : self::FOR_SELF;
|
||||
}
|
||||
|
||||
/**
|
||||
* The child blocks submitted with a guardian signup, as
|
||||
* `children[<n>][name|birth_year|answers]`.
|
||||
*
|
||||
* An **entirely empty** block is dropped rather than rejected — the form always
|
||||
* renders one spare for "add another", and an untouched spare is not a mistake
|
||||
* the guardian needs telling about. A block with anything at all filled in is
|
||||
* kept, so {@see handleSubmit()} can reject it for the missing name or birth
|
||||
* year rather than silently discarding what they typed.
|
||||
*
|
||||
* @return list<array{name: string, birth_year: string, answers: array<int, string>}>
|
||||
*/
|
||||
private function submittedChildren(): array {
|
||||
// The submit nonce is verified by the caller before this runs.
|
||||
// phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- each field is unslashed and sanitized below.
|
||||
$raw = $_POST['children'] ?? [];
|
||||
if ( ! is_array( $raw ) ) {
|
||||
return [];
|
||||
}
|
||||
|
||||
$out = [];
|
||||
foreach ( $raw as $child ) {
|
||||
if ( ! is_array( $child ) ) {
|
||||
continue;
|
||||
}
|
||||
|
||||
$name = trim( sanitize_text_field( Val::string( wp_unslash( $child['name'] ?? '' ) ) ) );
|
||||
$birthYear = trim( sanitize_text_field( Val::string( wp_unslash( $child['birth_year'] ?? '' ) ) ) );
|
||||
|
||||
$answers = [];
|
||||
foreach ( (array) ( $child['answers'] ?? [] ) as $questionId => $value ) {
|
||||
$answers[ absint( Val::int( $questionId ) ) ] = sanitize_textarea_field( Val::string( wp_unslash( $value ) ) );
|
||||
}
|
||||
|
||||
if ( '' === $name && '' === $birthYear && '' === trim( implode( '', $answers ) ) ) {
|
||||
continue;
|
||||
}
|
||||
|
||||
$out[] = [
|
||||
'name' => $name,
|
||||
'birth_year' => $birthYear,
|
||||
'answers' => $answers,
|
||||
];
|
||||
}
|
||||
|
||||
return $out;
|
||||
}
|
||||
|
||||
/**
|
||||
* Create each child of a guardian signup: the login-less account, its answers
|
||||
* to the per-child questions, and a signup-policy acceptance recorded against
|
||||
* the child but attributed to the guardian who agreed for them.
|
||||
*
|
||||
* Returns an empty string on success, or an error message after rolling the
|
||||
* whole family back — every child created so far *and* the guardian. A signup
|
||||
* that half-worked would leave the guardian with an account they cannot
|
||||
* re-register and children they never confirmed, so it is undone entirely and
|
||||
* they simply try again.
|
||||
*
|
||||
* @param list<array{name: string, birth_year: string, answers: array<int, string>}> $children
|
||||
* @param list<Question> $questions
|
||||
* @param list<array{policy: Policy, version: \Unsupervised\Schedular\Policy\PolicyVersion}> $policyForms
|
||||
*/
|
||||
private function createChildren( array $children, array $questions, array $policyForms, int $guardianId ): string {
|
||||
$created = [];
|
||||
|
||||
foreach ( $children as $child ) {
|
||||
$childId = $this->guardians->createChild( $guardianId, $child['name'], $child['birth_year'] );
|
||||
|
||||
if ( $childId instanceof \WP_Error ) {
|
||||
foreach ( $created as $id ) {
|
||||
$this->guardians->deleteUser( $id );
|
||||
}
|
||||
$this->guardians->deleteUser( $guardianId );
|
||||
|
||||
return esc_html__( 'Could not create the account. Please contact the studio.', 'unsupervised-schedular' );
|
||||
}
|
||||
|
||||
$created[] = $childId;
|
||||
|
||||
$this->recordAnswers( $questions, $child['answers'], $childId );
|
||||
$this->recordAcceptances( $policyForms, $childId, $guardianId );
|
||||
}
|
||||
|
||||
return '';
|
||||
}
|
||||
|
||||
/**
|
||||
* The account-question answers submitted with the form, keyed by question id.
|
||||
*
|
||||
* @return array<int, string>
|
||||
*/
|
||||
private function submittedAnswers(): array {
|
||||
// The submit nonce is verified by the caller (render) before this runs.
|
||||
// phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- each value is unslashed and sanitized in the loop below.
|
||||
$raw = $_POST['us_answers'] ?? [];
|
||||
if ( ! is_array( $raw ) ) {
|
||||
return [];
|
||||
}
|
||||
|
||||
$out = [];
|
||||
foreach ( $raw as $questionId => $value ) {
|
||||
$out[ absint( Val::int( $questionId ) ) ] = sanitize_textarea_field( Val::string( wp_unslash( $value ) ) );
|
||||
}
|
||||
|
||||
return $out;
|
||||
}
|
||||
|
||||
/**
|
||||
* Persist the submitted answers for each active account-signup question.
|
||||
*
|
||||
* @param list<Question> $questions
|
||||
* @param array<int, string> $answers question_id => submitted value
|
||||
*/
|
||||
private function recordAnswers( array $questions, array $answers, int $userId ): void {
|
||||
foreach ( $questions as $question ) {
|
||||
$value = trim( (string) ( $answers[ (int) $question->id ] ?? '' ) );
|
||||
if ( '' === $value ) {
|
||||
continue;
|
||||
}
|
||||
|
||||
$this->answers->insert(
|
||||
new Answer(
|
||||
questionId: (int) $question->id,
|
||||
registrationType: Answer::REG_ACCOUNT,
|
||||
registrationId: $userId,
|
||||
studentId: $userId,
|
||||
answerValue: $value,
|
||||
)
|
||||
);
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* Record account-time acceptances for each signup policy version.
|
||||
*
|
||||
* `$userId` is who the policy binds — the guardian for their own acceptance,
|
||||
* or the child for one accepted on their behalf — and `$acceptedBy` is who
|
||||
* actually ticked the box. Recording both is what makes the row legally
|
||||
* meaningful: "guardian X agreed to version N for child Y, at this time, from
|
||||
* this IP".
|
||||
*
|
||||
* @param list<array{policy: Policy, version: \Unsupervised\Schedular\Policy\PolicyVersion}> $policyForms
|
||||
*/
|
||||
private function recordAcceptances( array $policyForms, int $userId, int $acceptedBy ): void {
|
||||
private function recordAcceptances( array $policyForms, int $userId ): void {
|
||||
// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- IP is stored verbatim for audit.
|
||||
$ip = sanitize_text_field( Val::string( wp_unslash( $_SERVER['REMOTE_ADDR'] ?? '' ) ) );
|
||||
$ip = sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ?? '' ) );
|
||||
|
||||
foreach ( $policyForms as $form ) {
|
||||
$this->acceptances->insert(
|
||||
@@ -748,7 +149,6 @@ class RegistrationPage {
|
||||
studentId: $userId,
|
||||
registrationType: PolicyAcceptance::REG_ACCOUNT,
|
||||
registrationId: $userId,
|
||||
acceptedBy: $acceptedBy,
|
||||
ipAddress: '' !== $ip ? $ip : null,
|
||||
)
|
||||
);
|
||||
|
||||
@@ -1,156 +0,0 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace Unsupervised\Schedular\Auth;
|
||||
|
||||
use Unsupervised\Schedular\Val;
|
||||
|
||||
/**
|
||||
* The account lifecycle for a self-signup student, expressed entirely as user
|
||||
* meta so it lives alongside the WordPress user and needs no extra table.
|
||||
*
|
||||
* States (see {@see docs/features/account-registration.md}):
|
||||
* - Email unconfirmed — `us_awaiting_approval='1'`, no `us_email_confirmed`, a
|
||||
* hashed confirmation token + expiry set. Login is blocked.
|
||||
* - Confirmed, awaiting approval — `us_awaiting_approval='1'`,
|
||||
* `us_email_confirmed='1'`, token/expiry cleared. Login allowed but the
|
||||
* booking capability is withheld.
|
||||
* - Approved / active — `us_awaiting_approval` deleted; a normal student.
|
||||
*
|
||||
* Invite- and admin-created students carry none of these metas, so they behave
|
||||
* exactly as before.
|
||||
*/
|
||||
class RegistrationStatus {
|
||||
|
||||
public const META_AWAITING_APPROVAL = 'us_awaiting_approval';
|
||||
public const META_EMAIL_CONFIRMED = 'us_email_confirmed';
|
||||
public const META_CONFIRM_TOKEN = 'us_email_confirm_token';
|
||||
public const META_CONFIRM_EXPIRES = 'us_email_confirm_expires';
|
||||
|
||||
/**
|
||||
* Set on accounts created via a group invite link: confirming the email
|
||||
* approves the account immediately instead of queueing it for admin review.
|
||||
*/
|
||||
public const META_AUTO_APPROVE = 'us_auto_approve';
|
||||
|
||||
/**
|
||||
* Hours a self-signup email-confirmation link stays valid after the account
|
||||
* is created. Limits the window in which a leaked link can be redeemed.
|
||||
*/
|
||||
public const EMAIL_CONFIRM_EXPIRY_HOURS = 48;
|
||||
|
||||
/**
|
||||
* Hash a raw confirmation token for storage and lookup. Only the hash is
|
||||
* persisted (mirrors {@see Invite::hashToken()}), so a database leak cannot
|
||||
* be used to confirm an account — the raw token exists only in the email.
|
||||
*/
|
||||
public static function hashToken( string $rawToken ): string {
|
||||
return hash( 'sha256', $rawToken );
|
||||
}
|
||||
|
||||
/**
|
||||
* Put a freshly created user into the pending state and issue an email
|
||||
* confirmation token. Returns the raw token to embed in the emailed link.
|
||||
* With `$autoApprove` (group invite links) confirming the email approves
|
||||
* the account immediately — no admin review step.
|
||||
*/
|
||||
public static function markPending( int $userId, bool $autoApprove = false ): string {
|
||||
$rawToken = wp_generate_password( 32, false );
|
||||
|
||||
update_user_meta( $userId, self::META_AWAITING_APPROVAL, '1' );
|
||||
update_user_meta( $userId, self::META_CONFIRM_TOKEN, self::hashToken( $rawToken ) );
|
||||
update_user_meta(
|
||||
$userId,
|
||||
self::META_CONFIRM_EXPIRES,
|
||||
gmdate( 'Y-m-d H:i:s', time() + self::EMAIL_CONFIRM_EXPIRY_HOURS * 3600 )
|
||||
);
|
||||
|
||||
if ( $autoApprove ) {
|
||||
update_user_meta( $userId, self::META_AUTO_APPROVE, '1' );
|
||||
}
|
||||
|
||||
return $rawToken;
|
||||
}
|
||||
|
||||
/**
|
||||
* Mark the account's email confirmed and discard the (now spent) token. The
|
||||
* account stays awaiting approval.
|
||||
*/
|
||||
public static function confirmEmail( int $userId ): void {
|
||||
update_user_meta( $userId, self::META_EMAIL_CONFIRMED, '1' );
|
||||
delete_user_meta( $userId, self::META_CONFIRM_TOKEN );
|
||||
delete_user_meta( $userId, self::META_CONFIRM_EXPIRES );
|
||||
}
|
||||
|
||||
/**
|
||||
* Approve the account: clear the pending flag and any leftover token so the
|
||||
* student becomes a normal, active student.
|
||||
*/
|
||||
public static function approve( int $userId ): void {
|
||||
delete_user_meta( $userId, self::META_AWAITING_APPROVAL );
|
||||
delete_user_meta( $userId, self::META_CONFIRM_TOKEN );
|
||||
delete_user_meta( $userId, self::META_CONFIRM_EXPIRES );
|
||||
delete_user_meta( $userId, self::META_AUTO_APPROVE );
|
||||
}
|
||||
|
||||
public static function isAwaitingApproval( int $userId ): bool {
|
||||
return '1' === Val::string( get_user_meta( $userId, self::META_AWAITING_APPROVAL, true ) );
|
||||
}
|
||||
|
||||
/**
|
||||
* Whether confirming this account's email should approve it immediately
|
||||
* (group invite link signups).
|
||||
*/
|
||||
public static function isAutoApprove( int $userId ): bool {
|
||||
return '1' === Val::string( get_user_meta( $userId, self::META_AUTO_APPROVE, true ) );
|
||||
}
|
||||
|
||||
public static function emailConfirmed( int $userId ): bool {
|
||||
return '1' === Val::string( get_user_meta( $userId, self::META_EMAIL_CONFIRMED, true ) );
|
||||
}
|
||||
|
||||
/**
|
||||
* Find the user awaiting confirmation whose stored hash matches the supplied
|
||||
* raw token, or null when none matches.
|
||||
*/
|
||||
public static function userIdForToken( string $rawToken ): ?int {
|
||||
if ( '' === $rawToken ) {
|
||||
return null;
|
||||
}
|
||||
|
||||
$users = get_users(
|
||||
[
|
||||
'meta_key' => self::META_CONFIRM_TOKEN, // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_key
|
||||
'meta_value' => self::hashToken( $rawToken ), // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_value
|
||||
'number' => 1,
|
||||
'fields' => 'ID',
|
||||
]
|
||||
);
|
||||
|
||||
if ( [] === $users ) {
|
||||
return null;
|
||||
}
|
||||
|
||||
return Val::int( $users[0] );
|
||||
}
|
||||
|
||||
/**
|
||||
* Whether the confirmation token for a user has passed its expiry, measured
|
||||
* against the supplied `Y-m-d H:i:s` (UTC) timestamp. A user with no stored
|
||||
* expiry is treated as expired (there is nothing valid to confirm).
|
||||
*/
|
||||
public static function isTokenExpired( int $userId, string $now ): bool {
|
||||
$expires = Val::string( get_user_meta( $userId, self::META_CONFIRM_EXPIRES, true ) );
|
||||
if ( '' === $expires ) {
|
||||
return true;
|
||||
}
|
||||
|
||||
$expiresTs = strtotime( $expires );
|
||||
$nowTs = strtotime( $now );
|
||||
if ( false === $expiresTs || false === $nowTs ) {
|
||||
return true;
|
||||
}
|
||||
|
||||
return $nowTs > $expiresTs;
|
||||
}
|
||||
}
|
||||
@@ -1,94 +0,0 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace Unsupervised\Schedular\Auth;
|
||||
|
||||
use Unsupervised\Schedular\Availability\AvailabilityRepository;
|
||||
use Unsupervised\Schedular\Booking\BookingRepository;
|
||||
use Unsupervised\Schedular\Booking\Lesson;
|
||||
use Unsupervised\Schedular\GroupClass\Enrollment;
|
||||
use Unsupervised\Schedular\GroupClass\EnrollmentRepository;
|
||||
use Unsupervised\Schedular\Payment\PaymentService;
|
||||
|
||||
/**
|
||||
* Studio-admin actions on a single student from the student detail view:
|
||||
* cancelling a lesson, withdrawing a group-class enrolment, and editing basic
|
||||
* account details. Mutations go through the same paths as the student-facing
|
||||
* flows so slot release and pending-payment voiding stay consistent.
|
||||
*/
|
||||
class StudentActions {
|
||||
|
||||
public function __construct(
|
||||
private BookingRepository $bookings,
|
||||
private AvailabilityRepository $availability,
|
||||
private EnrollmentRepository $enrollments,
|
||||
private PaymentService $payments,
|
||||
) {}
|
||||
|
||||
/**
|
||||
* Cancel a lesson on the student's behalf: marks it cancelled, frees the
|
||||
* slot for rebooking, and voids a still-pending payment. A paid lesson is
|
||||
* credited back to the student's account (a per-lesson share of what they
|
||||
* paid) to offset their future scheduled billing.
|
||||
*/
|
||||
public function cancelLesson( int $lessonId, int $studentId ): bool {
|
||||
$lesson = $this->bookings->findById( $lessonId );
|
||||
|
||||
if ( null === $lesson || $lesson->studentId !== $studentId || Lesson::STATUS_CANCELLED === $lesson->status ) {
|
||||
return false;
|
||||
}
|
||||
|
||||
$this->bookings->updateStatus( $lessonId, Lesson::STATUS_CANCELLED );
|
||||
$this->availability->release( $lesson->slotId );
|
||||
$this->payments->voidPending( $lesson->paymentId );
|
||||
$this->payments->creditForCancelledLesson( $lesson );
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* Withdraw the student from a group class: marks the active enrolment
|
||||
* cancelled (freeing its capacity seat) and voids a still-pending payment.
|
||||
*/
|
||||
public function withdrawEnrollment( int $enrollmentId, int $studentId ): bool {
|
||||
$enrollment = $this->enrollments->findById( $enrollmentId );
|
||||
|
||||
if ( null === $enrollment || $enrollment->studentId !== $studentId || Enrollment::STATUS_ACTIVE !== $enrollment->status ) {
|
||||
return false;
|
||||
}
|
||||
|
||||
$this->enrollments->updateStatus( $enrollmentId, Enrollment::STATUS_CANCELLED );
|
||||
$this->payments->voidPending( $enrollment->paymentId );
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* Update the student's display name and email. The email must be valid and
|
||||
* not belong to another user.
|
||||
*/
|
||||
public function updateAccount( int $studentId, string $displayName, string $email ): bool|\WP_Error {
|
||||
if ( '' === $displayName ) {
|
||||
return new \WP_Error( 'empty_name', __( 'Display name cannot be empty.', 'unsupervised-schedular' ) );
|
||||
}
|
||||
|
||||
if ( ! is_email( $email ) ) {
|
||||
return new \WP_Error( 'invalid_email', __( 'Please enter a valid email address.', 'unsupervised-schedular' ) );
|
||||
}
|
||||
|
||||
$existing = email_exists( $email );
|
||||
if ( false !== $existing && (int) $existing !== $studentId ) {
|
||||
return new \WP_Error( 'email_taken', __( 'Another account already uses this email address.', 'unsupervised-schedular' ) );
|
||||
}
|
||||
|
||||
$result = wp_update_user(
|
||||
[
|
||||
'ID' => $studentId,
|
||||
'display_name' => $displayName,
|
||||
'user_email' => $email,
|
||||
]
|
||||
);
|
||||
|
||||
return $result instanceof \WP_Error ? $result : true;
|
||||
}
|
||||
}
|
||||
@@ -1,103 +0,0 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace Unsupervised\Schedular\Auth;
|
||||
|
||||
/**
|
||||
* Keeps front-end-only users (students) out of wp-admin entirely.
|
||||
*
|
||||
* Students authenticate through the front-end login shortcode and do all of
|
||||
* their work — booking, viewing lessons, paying — on the site's public pages.
|
||||
* They have no reason to see the WordPress dashboard, profile screen, or admin
|
||||
* bar, so this guard redirects them to the front end if they reach wp-admin and
|
||||
* hides the admin bar for them everywhere.
|
||||
*
|
||||
* Access is decided by capability, not role: anyone holding a back-office
|
||||
* capability (a WordPress administrator, studio admin, or instructor) keeps full
|
||||
* wp-admin access, while a user with none of them is treated as front-end only.
|
||||
*/
|
||||
class StudentAdminGuard {
|
||||
|
||||
/**
|
||||
* Capabilities that grant a genuine reason to be in wp-admin. A user holding
|
||||
* none of these is front-end only and is kept out of the dashboard.
|
||||
*
|
||||
* @var list<string>
|
||||
*/
|
||||
private const BACK_OFFICE_CAPS = [
|
||||
'manage_options',
|
||||
RoleManager::CAP_MANAGE_INSTRUCTORS,
|
||||
RoleManager::CAP_MANAGE_STUDENTS,
|
||||
RoleManager::CAP_MANAGE_OFFERINGS,
|
||||
RoleManager::CAP_MANAGE_QUESTIONS,
|
||||
RoleManager::CAP_MANAGE_POLICIES,
|
||||
RoleManager::CAP_MANAGE_BILLING,
|
||||
RoleManager::CAP_MANAGE_AVAILABILITY,
|
||||
RoleManager::CAP_VIEW_ALL_LESSONS,
|
||||
RoleManager::CAP_VIEW_ALL_PAYMENTS,
|
||||
RoleManager::CAP_VIEW_OWN_PAYMENTS,
|
||||
RoleManager::CAP_EXPORT_PAYMENTS,
|
||||
];
|
||||
|
||||
public function register(): void {
|
||||
add_action( 'admin_init', [ $this, 'redirectFromDashboard' ] );
|
||||
add_filter( 'show_admin_bar', [ $this, 'hideAdminBar' ] );
|
||||
}
|
||||
|
||||
/**
|
||||
* Redirect a front-end-only user away from any wp-admin page to the site
|
||||
* home, so the dashboard and profile screens are never reachable.
|
||||
*/
|
||||
public function redirectFromDashboard(): void {
|
||||
if ( ! $this->shouldBlockAdminAccess() ) {
|
||||
return;
|
||||
}
|
||||
|
||||
wp_safe_redirect( home_url( '/' ) );
|
||||
exit;
|
||||
}
|
||||
|
||||
/**
|
||||
* Whether the current request into wp-admin should be bounced to the front
|
||||
* end. AJAX requests are always allowed through so front-end features that
|
||||
* call admin-ajax keep working.
|
||||
*/
|
||||
public function shouldBlockAdminAccess(): bool {
|
||||
if ( wp_doing_ajax() ) {
|
||||
return false;
|
||||
}
|
||||
|
||||
if ( ! is_user_logged_in() ) {
|
||||
return false;
|
||||
}
|
||||
|
||||
return ! $this->hasBackOfficeAccess();
|
||||
}
|
||||
|
||||
/**
|
||||
* Hide the admin bar for front-end-only users; leave it untouched for anyone
|
||||
* with back-office access.
|
||||
*
|
||||
* @param bool $show Whether WordPress would otherwise show the admin bar.
|
||||
*/
|
||||
public function hideAdminBar( bool $show ): bool {
|
||||
if ( is_user_logged_in() && ! $this->hasBackOfficeAccess() ) {
|
||||
return false;
|
||||
}
|
||||
|
||||
return $show;
|
||||
}
|
||||
|
||||
/**
|
||||
* Whether the current user holds any capability that warrants wp-admin access.
|
||||
*/
|
||||
private function hasBackOfficeAccess(): bool {
|
||||
foreach ( self::BACK_OFFICE_CAPS as $cap ) {
|
||||
if ( current_user_can( $cap ) ) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
}
|
||||
+13
-138
@@ -8,12 +8,9 @@ use Unsupervised\Schedular\Booking\BookingRepository;
|
||||
use Unsupervised\Schedular\Booking\Lesson;
|
||||
use Unsupervised\Schedular\GroupClass\Enrollment;
|
||||
use Unsupervised\Schedular\GroupClass\EnrollmentRepository;
|
||||
use Unsupervised\Schedular\GroupClass\SessionSchedule;
|
||||
use Unsupervised\Schedular\Guardian\GuardianService;
|
||||
use Unsupervised\Schedular\Offering\OfferingRepository;
|
||||
use Unsupervised\Schedular\Payment\BillingMethodResolver;
|
||||
use Unsupervised\Schedular\Payment\Payment;
|
||||
use Unsupervised\Schedular\Val;
|
||||
|
||||
class StudentController {
|
||||
|
||||
@@ -23,10 +20,6 @@ class StudentController {
|
||||
private OfferingRepository $offerings,
|
||||
private EnrollmentRepository $enrollments,
|
||||
private BillingMethodResolver $resolver,
|
||||
private StudentHistory $history,
|
||||
private StudentActions $actions,
|
||||
private GuardianService $guardians,
|
||||
private SessionSchedule $sessions,
|
||||
) {}
|
||||
|
||||
public function renderPage(): void {
|
||||
@@ -35,7 +28,7 @@ class StudentController {
|
||||
}
|
||||
|
||||
// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only student selector.
|
||||
$studentId = absint( Val::int( $_GET['student_id'] ?? 0 ) );
|
||||
$studentId = absint( $_GET['student_id'] ?? 0 );
|
||||
$student = $studentId > 0 ? get_userdata( $studentId ) : false;
|
||||
|
||||
if ( $student && in_array( RoleManager::STUDENT, (array) $student->roles, true ) ) {
|
||||
@@ -47,24 +40,17 @@ class StudentController {
|
||||
fn( \WP_User $user ): array => [
|
||||
'id' => (int) $user->ID,
|
||||
'name' => $user->display_name,
|
||||
// A child's own address is an undeliverable placeholder, so the
|
||||
// list shows the guardian's — the address an admin would use.
|
||||
'email' => $this->guardians->contactFor( (int) $user->ID )['email'],
|
||||
'email' => $user->user_email,
|
||||
'registered' => $user->user_registered,
|
||||
'upcoming' => $this->bookings->countUpcomingForStudent( (int) $user->ID ),
|
||||
'enrolments' => $this->enrollments->countActiveForStudent( (int) $user->ID ),
|
||||
'guardian' => $this->guardians->guardianOf( (int) $user->ID ),
|
||||
'children' => $this->guardians->children( (int) $user->ID ),
|
||||
],
|
||||
array_filter(
|
||||
get_users(
|
||||
[
|
||||
'role' => RoleManager::STUDENT,
|
||||
'orderby' => 'display_name',
|
||||
'order' => 'ASC',
|
||||
]
|
||||
),
|
||||
static fn( mixed $user ): bool => $user instanceof \WP_User
|
||||
get_users(
|
||||
[
|
||||
'role' => RoleManager::STUDENT,
|
||||
'orderby' => 'display_name',
|
||||
'order' => 'ASC',
|
||||
]
|
||||
)
|
||||
);
|
||||
|
||||
@@ -75,15 +61,9 @@ class StudentController {
|
||||
private function renderDetail( \WP_User $student ): void {
|
||||
$canBilling = current_user_can( RoleManager::CAP_MANAGE_BILLING );
|
||||
|
||||
// phpcs:ignore WordPress.Security.NonceVerification.Missing -- routing only; each action below verifies its own nonce.
|
||||
$action = sanitize_key( Val::string( wp_unslash( $_POST['usc_action'] ?? '' ) ) );
|
||||
|
||||
$notice = '';
|
||||
$error = '';
|
||||
|
||||
if ( $canBilling && 'set_billing' === $action && check_admin_referer( 'usc_student_billing' ) ) {
|
||||
if ( $canBilling && isset( $_POST['usc_action'] ) && check_admin_referer( 'usc_student_billing' ) ) {
|
||||
// phpcs:ignore WordPress.Security.NonceVerification.Missing -- nonce checked above.
|
||||
$method = sanitize_key( Val::string( wp_unslash( $_POST['payment_method'] ?? '' ) ) );
|
||||
$method = sanitize_key( wp_unslash( $_POST['payment_method'] ?? '' ) );
|
||||
if ( in_array( $method, Payment::VALID_METHODS, true ) ) {
|
||||
update_user_meta( (int) $student->ID, BillingMethodResolver::META_METHOD, $method );
|
||||
} else {
|
||||
@@ -91,43 +71,7 @@ class StudentController {
|
||||
}
|
||||
}
|
||||
|
||||
if ( 'update_account' === $action && check_admin_referer( 'usc_student_actions' ) ) {
|
||||
// phpcs:disable WordPress.Security.NonceVerification.Missing -- nonce checked above.
|
||||
$displayName = sanitize_text_field( Val::string( wp_unslash( $_POST['display_name'] ?? '' ) ) );
|
||||
$email = sanitize_email( Val::string( wp_unslash( $_POST['user_email'] ?? '' ) ) );
|
||||
// phpcs:enable WordPress.Security.NonceVerification.Missing
|
||||
|
||||
$result = $this->actions->updateAccount( (int) $student->ID, $displayName, $email );
|
||||
if ( $result instanceof \WP_Error ) {
|
||||
$error = $result->get_error_message();
|
||||
} else {
|
||||
$notice = __( 'Account details updated.', 'unsupervised-schedular' );
|
||||
$fresh = get_userdata( (int) $student->ID );
|
||||
$student = $fresh instanceof \WP_User ? $fresh : $student;
|
||||
}
|
||||
}
|
||||
|
||||
if ( 'cancel_lesson' === $action && check_admin_referer( 'usc_student_actions' ) ) {
|
||||
// phpcs:ignore WordPress.Security.NonceVerification.Missing -- nonce checked above.
|
||||
$lessonId = absint( Val::int( $_POST['lesson_id'] ?? 0 ) );
|
||||
if ( $this->actions->cancelLesson( $lessonId, (int) $student->ID ) ) {
|
||||
$notice = __( 'Lesson cancelled.', 'unsupervised-schedular' );
|
||||
} else {
|
||||
$error = __( 'This lesson could not be cancelled.', 'unsupervised-schedular' );
|
||||
}
|
||||
}
|
||||
|
||||
if ( 'withdraw_enrollment' === $action && check_admin_referer( 'usc_student_actions' ) ) {
|
||||
// phpcs:ignore WordPress.Security.NonceVerification.Missing -- nonce checked above.
|
||||
$enrollmentId = absint( Val::int( $_POST['enrollment_id'] ?? 0 ) );
|
||||
if ( $this->actions->withdrawEnrollment( $enrollmentId, (int) $student->ID ) ) {
|
||||
$notice = __( 'Enrolment withdrawn.', 'unsupervised-schedular' );
|
||||
} else {
|
||||
$error = __( 'This enrolment could not be withdrawn.', 'unsupervised-schedular' );
|
||||
}
|
||||
}
|
||||
|
||||
$billingOverride = Val::string( get_user_meta( (int) $student->ID, BillingMethodResolver::META_METHOD, true ) );
|
||||
$billingOverride = (string) get_user_meta( (int) $student->ID, BillingMethodResolver::META_METHOD, true );
|
||||
$billingDefault = $this->resolver->defaultMethod();
|
||||
|
||||
$now = current_time( 'mysql' );
|
||||
@@ -136,15 +80,7 @@ class StudentController {
|
||||
$this->bookings->findByStudent( (int) $student->ID )
|
||||
);
|
||||
|
||||
// Group classes join the upcoming table so "what is this student booked
|
||||
// into next week?" has one answer instead of two. Only their upcoming
|
||||
// sessions are added: the enrolment table below already records the whole
|
||||
// history, and a term's worth of past dates would bury the lessons under
|
||||
// "Past lessons".
|
||||
$schedule = StudentSchedule::partition(
|
||||
array_merge( $rows, $this->groupSessionRows( (int) $student->ID, $now ) ),
|
||||
$now
|
||||
);
|
||||
$schedule = StudentSchedule::partition( $rows, $now );
|
||||
$upcoming = $schedule['upcoming'];
|
||||
$past = $schedule['past'];
|
||||
|
||||
@@ -153,7 +89,6 @@ class StudentController {
|
||||
$offering = $this->offerings->findById( $enrollment->offeringId );
|
||||
|
||||
return [
|
||||
'id' => (int) $enrollment->id,
|
||||
'offering' => $offering ? $offering->title : (string) $enrollment->offeringId,
|
||||
'status' => $enrollment->status,
|
||||
];
|
||||
@@ -161,37 +96,10 @@ class StudentController {
|
||||
$this->enrollments->findByStudent( (int) $student->ID )
|
||||
);
|
||||
|
||||
$acceptances = $this->history->policyAcceptances( (int) $student->ID );
|
||||
$registrationInfo = $this->history->registrationInfo( (int) $student->ID );
|
||||
$intake = $this->history->intakeAnswers( (int) $student->ID );
|
||||
$payments = $canBilling ? $this->history->payments( (int) $student->ID ) : [];
|
||||
$credits = $canBilling ? $this->history->credits( (int) $student->ID ) : [];
|
||||
$creditCurrency = $this->creditCurrency( $credits );
|
||||
|
||||
// The family panel, and the account whose balance actually settles this
|
||||
// student's charges — a child's is their guardian's, so showing the
|
||||
// child's own (always empty) balance would be actively misleading.
|
||||
$guardian = $this->guardians->guardianOf( (int) $student->ID );
|
||||
$children = $this->guardians->children( (int) $student->ID );
|
||||
$payer = $this->guardians->contactFor( (int) $student->ID );
|
||||
|
||||
$creditBalance = $canBilling ? $this->history->creditBalance( $payer['id'] ) : 0.0;
|
||||
|
||||
$backUrl = admin_url( 'admin.php?page=us-students' );
|
||||
$pageSlug = 'us-students';
|
||||
$backUrl = admin_url( 'admin.php?page=us-students' );
|
||||
include USC_PLUGIN_DIR . 'templates/admin/student-detail.php';
|
||||
}
|
||||
|
||||
/**
|
||||
* Currency to label the credit balance with — taken from the student's credits
|
||||
* (they share a currency in practice), defaulting to CAD when they have none.
|
||||
*
|
||||
* @param list<array{created_at: string, amount: float, remaining: float, currency: string, reason: string, status: string}> $credits
|
||||
*/
|
||||
private function creditCurrency( array $credits ): string {
|
||||
return [] !== $credits ? (string) $credits[0]['currency'] : 'CAD';
|
||||
}
|
||||
|
||||
/**
|
||||
* Build a display row for a lesson (slot time, offering, instructor, status).
|
||||
*
|
||||
@@ -203,9 +111,6 @@ class StudentController {
|
||||
$instructor = get_userdata( $lesson->instructorId );
|
||||
|
||||
return [
|
||||
'id' => (int) $lesson->id,
|
||||
'kind' => 'lesson',
|
||||
'schedule' => null,
|
||||
'start_dt' => $slot ? $slot->startDt : '',
|
||||
'end_dt' => $slot ? $slot->endDt : '',
|
||||
'offering' => $offering ? $offering->title : '—',
|
||||
@@ -213,34 +118,4 @@ class StudentController {
|
||||
'status' => $lesson->status,
|
||||
];
|
||||
}
|
||||
|
||||
/**
|
||||
* The student's upcoming group-class sessions, shaped like the lesson rows
|
||||
* they sit beside. `kind` is what keeps the table honest: a session is a date
|
||||
* in a term, not a booked slot, so the row offers no "Cancel" — withdrawing
|
||||
* is done from the enrolment table, which removes the whole class at once.
|
||||
*
|
||||
* @return list<array<string, mixed>>
|
||||
*/
|
||||
private function groupSessionRows( int $studentId, string $now ): array {
|
||||
return array_map(
|
||||
static function ( array $session ): array {
|
||||
$instructor = get_userdata( $session['instructor_id'] );
|
||||
|
||||
return [
|
||||
'id' => $session['enrollment_id'],
|
||||
'kind' => SessionSchedule::KIND,
|
||||
'start_dt' => $session['start_dt'],
|
||||
'end_dt' => $session['end_dt'],
|
||||
// Set when the class has no time to put on a clock; shown in the
|
||||
// When column in place of a date. See GroupClass\SessionSchedule.
|
||||
'schedule' => $session['schedule'],
|
||||
'offering' => $session['offering_title'],
|
||||
'instructor' => $instructor ? $instructor->display_name : (string) $session['instructor_id'],
|
||||
'status' => $session['status'],
|
||||
];
|
||||
},
|
||||
$this->sessions->upcomingForStudent( $studentId, $now )
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,180 +0,0 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace Unsupervised\Schedular\Auth;
|
||||
|
||||
use Unsupervised\Schedular\Payment\Credit;
|
||||
use Unsupervised\Schedular\Payment\CreditRepository;
|
||||
use Unsupervised\Schedular\Payment\Payment;
|
||||
use Unsupervised\Schedular\Payment\PaymentRepository;
|
||||
use Unsupervised\Schedular\Policy\AcceptanceRepository;
|
||||
use Unsupervised\Schedular\Policy\PolicyAcceptance;
|
||||
use Unsupervised\Schedular\Policy\PolicyRepository;
|
||||
use Unsupervised\Schedular\Policy\PolicyVersionRepository;
|
||||
use Unsupervised\Schedular\Registration\Answer;
|
||||
use Unsupervised\Schedular\Registration\AnswerRepository;
|
||||
use Unsupervised\Schedular\Registration\Question;
|
||||
use Unsupervised\Schedular\Registration\QuestionRepository;
|
||||
|
||||
/**
|
||||
* Builds the display rows for the history sections of the admin student detail
|
||||
* view: policy acceptances, intake answers, and payments.
|
||||
*/
|
||||
class StudentHistory {
|
||||
|
||||
public function __construct(
|
||||
private AcceptanceRepository $acceptances,
|
||||
private PolicyRepository $policies,
|
||||
private PolicyVersionRepository $policyVersions,
|
||||
private AnswerRepository $answers,
|
||||
private QuestionRepository $questions,
|
||||
private PaymentRepository $payments,
|
||||
private CreditRepository $credits,
|
||||
) {}
|
||||
|
||||
/**
|
||||
* Every policy acceptance the student has recorded, newest first.
|
||||
*
|
||||
* @return list<array{policy: string, version: string, context: string, accepted_at: string}>
|
||||
*/
|
||||
public function policyAcceptances( int $studentId ): array {
|
||||
return array_map(
|
||||
function ( PolicyAcceptance $acceptance ): array {
|
||||
$version = $this->policyVersions->findById( $acceptance->policyVersionId );
|
||||
$policy = $version ? $this->policies->findById( $version->policyId ) : null;
|
||||
|
||||
return [
|
||||
'policy' => $policy ? $policy->title : sprintf( '#%d', $acceptance->policyVersionId ),
|
||||
'version' => $version ? sprintf( 'v%d', $version->versionNumber ) : '—',
|
||||
'context' => $this->contextLabel( $acceptance->registrationType, $acceptance->registrationId ),
|
||||
'accepted_at' => $acceptance->acceptedAt ?? '',
|
||||
];
|
||||
},
|
||||
$this->acceptances->findByStudent( $studentId )
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Booking/enrolment intake answers the student has submitted, newest first.
|
||||
* Account-signup answers are excluded — those are shown on their own under
|
||||
* {@see registrationInfo()}.
|
||||
*
|
||||
* @return list<array{question: string, answer: string, context: string}>
|
||||
*/
|
||||
public function intakeAnswers( int $studentId ): array {
|
||||
$bookingAnswers = array_filter(
|
||||
$this->answers->findByStudent( $studentId ),
|
||||
static fn( Answer $answer ): bool => Answer::REG_ACCOUNT !== $answer->registrationType
|
||||
);
|
||||
|
||||
return array_values(
|
||||
array_map(
|
||||
function ( Answer $answer ): array {
|
||||
$question = $this->questions->findById( $answer->questionId );
|
||||
|
||||
return [
|
||||
'question' => $question ? $question->label : sprintf( '#%d', $answer->questionId ),
|
||||
'answer' => $answer->answerValue ?? '—',
|
||||
'context' => $this->contextLabel( $answer->registrationType, $answer->registrationId ),
|
||||
];
|
||||
},
|
||||
$bookingAnswers
|
||||
)
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* The student's answers to the studio-wide account-signup questions: every
|
||||
* configured account question paired with the student's answer ("—" when
|
||||
* unanswered, e.g. a question added after they registered).
|
||||
*
|
||||
* @return list<array{question: string, answer: string, required: bool}>
|
||||
*/
|
||||
public function registrationInfo( int $studentId ): array {
|
||||
$byQuestion = [];
|
||||
foreach ( $this->answers->findByRegistration( Answer::REG_ACCOUNT, $studentId ) as $answer ) {
|
||||
$byQuestion[ $answer->questionId ] = $answer->answerValue ?? '';
|
||||
}
|
||||
|
||||
return array_map(
|
||||
static function ( Question $question ) use ( $byQuestion ): array {
|
||||
$value = $byQuestion[ (int) $question->id ] ?? '';
|
||||
|
||||
return [
|
||||
'question' => $question->label,
|
||||
'answer' => '' === $value ? '—' : $value,
|
||||
'required' => $question->isRequired,
|
||||
];
|
||||
},
|
||||
$this->questions->findByScope( Question::SCOPE_ACCOUNT )
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Every payment for the student, newest first.
|
||||
*
|
||||
* @return list<array{created_at: string, context: string, method: string, status: string, amount: float, tax_amount: float, total: float, currency: string, receipt: string}>
|
||||
*/
|
||||
public function payments( int $studentId ): array {
|
||||
return array_map(
|
||||
fn( Payment $payment ): array => [
|
||||
'created_at' => $payment->createdAt ?? '',
|
||||
'context' => $this->contextLabel( $payment->registrationType, $payment->registrationId ),
|
||||
'method' => $payment->method,
|
||||
'status' => $payment->status,
|
||||
'amount' => $payment->amount,
|
||||
'tax_amount' => $payment->taxAmount,
|
||||
'total' => $payment->total(),
|
||||
'currency' => $payment->currency,
|
||||
'receipt' => $payment->receiptNumber ?? '—',
|
||||
],
|
||||
$this->payments->findByStudent( $studentId )
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* The student's total unused credit balance (from cancelled paid lessons),
|
||||
* applied automatically against future scheduled-billing charges.
|
||||
*/
|
||||
public function creditBalance( int $studentId ): float {
|
||||
return $this->credits->availableBalance( $studentId );
|
||||
}
|
||||
|
||||
/**
|
||||
* Every credit the student has been issued, newest first, with the amount, what
|
||||
* remains, and its state.
|
||||
*
|
||||
* @return list<array{created_at: string, amount: float, remaining: float, currency: string, reason: string, status: string}>
|
||||
*/
|
||||
public function credits( int $studentId ): array {
|
||||
return array_map(
|
||||
static fn( Credit $credit ): array => [
|
||||
'created_at' => $credit->createdAt ?? '',
|
||||
'amount' => $credit->amount,
|
||||
'remaining' => $credit->remaining,
|
||||
'currency' => $credit->currency,
|
||||
'reason' => $credit->reason ?? '—',
|
||||
'status' => $credit->status,
|
||||
],
|
||||
$this->credits->findByStudent( $studentId )
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Human label for a polymorphic registration target.
|
||||
*/
|
||||
private function contextLabel( string $registrationType, int $registrationId ): string {
|
||||
switch ( $registrationType ) {
|
||||
case PolicyAcceptance::REG_ACCOUNT:
|
||||
return __( 'Account signup', 'unsupervised-schedular' );
|
||||
case PolicyAcceptance::REG_LESSON:
|
||||
/* translators: %d: the lesson id */
|
||||
return sprintf( __( 'Lesson #%d', 'unsupervised-schedular' ), $registrationId );
|
||||
case PolicyAcceptance::REG_ENROLLMENT:
|
||||
/* translators: %d: the group-class enrolment id */
|
||||
return sprintf( __( 'Enrolment #%d', 'unsupervised-schedular' ), $registrationId );
|
||||
default:
|
||||
return sprintf( '%s #%d', $registrationType, $registrationId );
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -3,8 +3,6 @@ declare(strict_types=1);
|
||||
|
||||
namespace Unsupervised\Schedular\Auth;
|
||||
|
||||
use Unsupervised\Schedular\Val;
|
||||
|
||||
/**
|
||||
* Pure helper for splitting a student's dated rows into upcoming and past.
|
||||
*/
|
||||
@@ -23,7 +21,7 @@ class StudentSchedule {
|
||||
$past = [];
|
||||
|
||||
foreach ( $rows as $row ) {
|
||||
$start = Val::string( $row['start_dt'] ?? '' );
|
||||
$start = (string) ( $row['start_dt'] ?? '' );
|
||||
if ( '' !== $start && $start >= $now ) {
|
||||
$upcoming[] = $row;
|
||||
} else {
|
||||
@@ -31,12 +29,12 @@ class StudentSchedule {
|
||||
}
|
||||
}
|
||||
|
||||
usort( $upcoming, static fn( array $a, array $b ): int => strcmp( Val::string( $a['start_dt'] ?? '' ), Val::string( $b['start_dt'] ?? '' ) ) );
|
||||
usort( $past, static fn( array $a, array $b ): int => strcmp( Val::string( $b['start_dt'] ?? '' ), Val::string( $a['start_dt'] ?? '' ) ) );
|
||||
usort( $upcoming, static fn( array $a, array $b ): int => strcmp( (string) ( $a['start_dt'] ?? '' ), (string) ( $b['start_dt'] ?? '' ) ) );
|
||||
usort( $past, static fn( array $a, array $b ): int => strcmp( (string) ( $b['start_dt'] ?? '' ), (string) ( $a['start_dt'] ?? '' ) ) );
|
||||
|
||||
return [
|
||||
'upcoming' => $upcoming,
|
||||
'past' => $past,
|
||||
'upcoming' => array_values( $upcoming ),
|
||||
'past' => array_values( $past ),
|
||||
];
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,59 +0,0 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace Unsupervised\Schedular\Auth;
|
||||
|
||||
/**
|
||||
* Resolves a person's public-facing name for display. Prefers their real name
|
||||
* (first + last), then their nickname, then the display name — skipping any of
|
||||
* them that is really the account's login or email address, which is the thing
|
||||
* this class exists to keep off the screen.
|
||||
*/
|
||||
class UserName {
|
||||
|
||||
/**
|
||||
* The display name for a user: "First Last" when a real name is set, else the
|
||||
* first of nickname / display name that is an actual name. Falls back to the
|
||||
* numeric id (or an empty string when none is given) when the user cannot be
|
||||
* loaded or has nothing but identifiers on file.
|
||||
*
|
||||
* Display name is consulted at all because WordPress defaults **nickname** to
|
||||
* `user_login`, and signup uses the email address as the login — so a
|
||||
* self-registered account carries its own email as its nickname, and every
|
||||
* screen naming that person showed the address instead. The name they typed
|
||||
* was on file the whole time, in `display_name`. (Accounts created by a
|
||||
* guardian never hit this: `GuardianService::createChild()` sets `nickname`
|
||||
* outright, which is why children read correctly and their parents did not.)
|
||||
*/
|
||||
public static function format( ?\WP_User $user, int $fallbackId = 0 ): string {
|
||||
if ( ! $user instanceof \WP_User ) {
|
||||
return $fallbackId > 0 ? (string) $fallbackId : '';
|
||||
}
|
||||
|
||||
$full = trim( $user->first_name . ' ' . $user->last_name );
|
||||
if ( '' !== $full ) {
|
||||
return $full;
|
||||
}
|
||||
|
||||
foreach ( [ $user->nickname, $user->display_name ] as $candidate ) {
|
||||
$candidate = trim( (string) $candidate );
|
||||
|
||||
if ( '' !== $candidate && ! self::isIdentifier( $candidate, $user ) ) {
|
||||
return $candidate;
|
||||
}
|
||||
}
|
||||
|
||||
return $fallbackId > 0 ? (string) $fallbackId : '';
|
||||
}
|
||||
|
||||
/**
|
||||
* Whether a candidate name is really the account's login or email address
|
||||
* wearing a name's clothing — the case this class must never pass through.
|
||||
*/
|
||||
private static function isIdentifier( string $candidate, \WP_User $user ): bool {
|
||||
$candidate = strtolower( $candidate );
|
||||
|
||||
return strtolower( (string) $user->user_login ) === $candidate
|
||||
|| strtolower( (string) $user->user_email ) === $candidate;
|
||||
}
|
||||
}
|
||||
@@ -6,14 +6,12 @@ namespace Unsupervised\Schedular\Availability;
|
||||
use Unsupervised\Schedular\Auth\RoleManager;
|
||||
use Unsupervised\Schedular\Offering\Offering;
|
||||
use Unsupervised\Schedular\Offering\OfferingRepository;
|
||||
use Unsupervised\Schedular\Val;
|
||||
|
||||
class AvailabilityController {
|
||||
|
||||
public function __construct(
|
||||
private AvailabilityRepository $repository,
|
||||
private OfferingRepository $offerings,
|
||||
private WindowValidator $validator,
|
||||
) {}
|
||||
|
||||
public function renderPage(): void {
|
||||
@@ -22,169 +20,64 @@ class AvailabilityController {
|
||||
}
|
||||
|
||||
$instructorId = get_current_user_id();
|
||||
$notice = '';
|
||||
$error = '';
|
||||
|
||||
if ( isset( $_POST['usc_action'] ) && check_admin_referer( 'usc_availability_action' ) ) {
|
||||
[ $notice, $error ] = $this->handleFormAction( $instructorId );
|
||||
$this->handleFormAction( $instructorId );
|
||||
}
|
||||
|
||||
$slots = $this->repository->findByInstructor( $instructorId );
|
||||
$offeringChoices = $this->offerings->findAll( $instructorId, Offering::KIND_PRIVATE_LESSON, true );
|
||||
|
||||
// View-state query params only (which view, which week) — nothing is
|
||||
// mutated from them, so no nonce applies.
|
||||
// phpcs:disable WordPress.Security.NonceVerification.Recommended
|
||||
$view = 'list' === sanitize_key( Val::string( wp_unslash( $_GET['usc_view'] ?? '' ) ) ) ? 'list' : 'week';
|
||||
$requestedWeek = sanitize_text_field( Val::string( wp_unslash( $_GET['usc_week'] ?? '' ) ) );
|
||||
// phpcs:enable WordPress.Security.NonceVerification.Recommended
|
||||
|
||||
$weekStart = WeekCalendar::weekStart( $requestedWeek, Val::int( get_option( 'start_of_week', 1 ) ), current_time( 'Y-m-d' ) );
|
||||
$weekDays = WeekCalendar::days( $weekStart, $slots );
|
||||
$prevWeek = ( new \DateTimeImmutable( $weekStart ) )->modify( '-7 days' )->format( 'Y-m-d' );
|
||||
$nextWeek = ( new \DateTimeImmutable( $weekStart ) )->modify( '+7 days' )->format( 'Y-m-d' );
|
||||
|
||||
include USC_PLUGIN_DIR . 'templates/admin/availability.php';
|
||||
}
|
||||
|
||||
/**
|
||||
* Run the submitted action and report what happened. Every branch returns a
|
||||
* message: a form that silently reloads leaves the instructor unable to tell
|
||||
* "saved 41 slots" from "saved nothing".
|
||||
*
|
||||
* @return array{string, string} Success notice and error message; each is
|
||||
* empty when it does not apply.
|
||||
*/
|
||||
private function handleFormAction( int $instructorId ): array {
|
||||
private function handleFormAction( int $instructorId ): void {
|
||||
// Nonce is verified by the caller (renderPage) before this method runs.
|
||||
// phpcs:disable WordPress.Security.NonceVerification.Missing
|
||||
$action = sanitize_key( Val::string( wp_unslash( $_POST['usc_action'] ?? '' ) ) );
|
||||
$action = sanitize_key( wp_unslash( $_POST['usc_action'] ?? '' ) );
|
||||
|
||||
if ( 'add' === $action ) {
|
||||
return $this->addSlot( $instructorId );
|
||||
$this->addSlot( $instructorId );
|
||||
}
|
||||
|
||||
if ( 'delete' === $action ) {
|
||||
return $this->deleteOwnSlot( absint( Val::int( $_POST['slot_id'] ?? 0 ) ), $instructorId )
|
||||
? [ __( 'Availability slot deleted.', 'unsupervised-schedular' ), '' ]
|
||||
: [ '', __( 'That slot could not be deleted. It may already be booked, or belong to someone else.', 'unsupervised-schedular' ) ];
|
||||
}
|
||||
|
||||
if ( 'bulk_delete' === $action ) {
|
||||
// The array itself carries no data; each element is coerced and
|
||||
// absint-sanitized individually below.
|
||||
// phpcs:ignore WordPress.Security.ValidatedSanitizedInput
|
||||
$rawIds = $_POST['slot_ids'] ?? [];
|
||||
$deleted = 0;
|
||||
$failed = 0;
|
||||
|
||||
foreach ( is_array( $rawIds ) ? $rawIds : [] as $rawId ) {
|
||||
if ( $this->deleteOwnSlot( absint( Val::int( $rawId ) ), $instructorId ) ) {
|
||||
++$deleted;
|
||||
continue;
|
||||
$slotId = absint( $_POST['slot_id'] ?? 0 );
|
||||
if ( $slotId > 0 ) {
|
||||
$slot = $this->repository->findById( $slotId );
|
||||
if ( $slot && $slot->instructorId === $instructorId ) {
|
||||
$this->repository->delete( $slotId );
|
||||
}
|
||||
|
||||
++$failed;
|
||||
}
|
||||
|
||||
return $this->bulkDeleteResult( $deleted, $failed );
|
||||
}
|
||||
// phpcs:enable WordPress.Security.NonceVerification.Missing
|
||||
|
||||
return [ '', '' ];
|
||||
}
|
||||
|
||||
/**
|
||||
* Wording for a bulk delete, which can partly succeed.
|
||||
*
|
||||
* @return array{string, string}
|
||||
*/
|
||||
private function bulkDeleteResult( int $deleted, int $failed ): array {
|
||||
$notice = $deleted > 0
|
||||
? sprintf(
|
||||
/* translators: %d: number of availability slots deleted. */
|
||||
_n( '%d slot deleted.', '%d slots deleted.', $deleted, 'unsupervised-schedular' ),
|
||||
$deleted
|
||||
)
|
||||
: '';
|
||||
|
||||
$error = $failed > 0
|
||||
? sprintf(
|
||||
/* translators: %d: number of slots that could not be deleted. */
|
||||
_n(
|
||||
'%d slot could not be deleted — it may already be booked.',
|
||||
'%d slots could not be deleted — they may already be booked.',
|
||||
$failed,
|
||||
'unsupervised-schedular'
|
||||
),
|
||||
$failed
|
||||
)
|
||||
: '';
|
||||
|
||||
if ( 0 === $deleted && 0 === $failed ) {
|
||||
$error = __( 'No slots were selected.', 'unsupervised-schedular' );
|
||||
}
|
||||
|
||||
return [ $notice, $error ];
|
||||
}
|
||||
|
||||
/**
|
||||
* Delete a slot only when it exists and belongs to the given instructor.
|
||||
* The repository additionally refuses to delete booked slots. Returns whether
|
||||
* the row actually went away.
|
||||
*/
|
||||
private function deleteOwnSlot( int $slotId, int $instructorId ): bool {
|
||||
if ( $slotId <= 0 ) {
|
||||
return false;
|
||||
}
|
||||
|
||||
$slot = $this->repository->findById( $slotId );
|
||||
|
||||
if ( null === $slot || $slot->instructorId !== $instructorId ) {
|
||||
return false;
|
||||
}
|
||||
|
||||
return $this->repository->delete( $slotId );
|
||||
}
|
||||
|
||||
/**
|
||||
* Validate and persist a submitted window.
|
||||
*
|
||||
* @return array{string, string}
|
||||
*/
|
||||
private function addSlot( int $instructorId ): array {
|
||||
private function addSlot( int $instructorId ): void {
|
||||
// phpcs:disable WordPress.Security.NonceVerification.Missing
|
||||
$window = $this->validator->validate(
|
||||
$instructorId,
|
||||
sanitize_text_field( Val::string( wp_unslash( $_POST['start_dt'] ?? '' ) ) ),
|
||||
sanitize_text_field( Val::string( wp_unslash( $_POST['end_dt'] ?? '' ) ) ),
|
||||
absint( Val::int( $_POST['duration_minutes'] ?? 0 ) ),
|
||||
absint( Val::int( $_POST['offering_id'] ?? 0 ) ),
|
||||
$startDt = sanitize_text_field( wp_unslash( $_POST['start_dt'] ?? '' ) );
|
||||
$endDt = sanitize_text_field( wp_unslash( $_POST['end_dt'] ?? '' ) );
|
||||
|
||||
if ( '' === $startDt || '' === $endDt ) {
|
||||
return;
|
||||
}
|
||||
|
||||
$offeringId = absint( $_POST['offering_id'] ?? 0 );
|
||||
$duration = absint( $_POST['duration_minutes'] ?? 0 );
|
||||
|
||||
$slot = new AvailabilitySlot(
|
||||
instructorId: $instructorId,
|
||||
startDt: $startDt,
|
||||
endDt: $endDt,
|
||||
durationMinutes: $duration > 0 ? $duration : 60,
|
||||
offeringId: $offeringId > 0 ? $offeringId : null,
|
||||
);
|
||||
|
||||
if ( $window instanceof \WP_Error ) {
|
||||
return [ '', $window->get_error_message() ];
|
||||
if ( 'weekly' === sanitize_key( wp_unslash( $_POST['recurrence'] ?? 'single' ) ) ) {
|
||||
$this->repository->createWeeklySeries( $slot, absint( $_POST['weeks'] ?? 1 ) );
|
||||
return;
|
||||
}
|
||||
|
||||
$recurrence = sanitize_key( Val::string( wp_unslash( $_POST['recurrence'] ?? 'single' ) ) );
|
||||
$weeks = absint( Val::int( $_POST['weeks'] ?? 1 ) );
|
||||
$this->repository->insert( $slot );
|
||||
// phpcs:enable WordPress.Security.NonceVerification.Missing
|
||||
|
||||
$ids = $this->repository->createFromWindow( $window, 'weekly' === $recurrence, $weeks );
|
||||
|
||||
// The window was valid, so it split into at least one slot — an empty
|
||||
// result means every insert failed.
|
||||
if ( [] === $ids ) {
|
||||
return [ '', __( 'The availability could not be saved. Please try again.', 'unsupervised-schedular' ) ];
|
||||
}
|
||||
|
||||
return [
|
||||
sprintf(
|
||||
/* translators: %d: number of bookable slots created. */
|
||||
_n( 'Added %d bookable slot.', 'Added %d bookable slots.', count( $ids ), 'unsupervised-schedular' ),
|
||||
count( $ids )
|
||||
),
|
||||
'',
|
||||
];
|
||||
}
|
||||
}
|
||||
|
||||
@@ -4,20 +4,15 @@ declare(strict_types=1);
|
||||
namespace Unsupervised\Schedular\Availability;
|
||||
|
||||
use Unsupervised\Schedular\Auth\RoleManager;
|
||||
use Unsupervised\Schedular\Val;
|
||||
use Unsupervised\Schedular\Offering\OfferingRepository;
|
||||
|
||||
class AvailabilityEndpoint {
|
||||
|
||||
public function __construct(
|
||||
private AvailabilityRepository $repository,
|
||||
private WindowValidator $validator,
|
||||
private OfferingRepository $offerings,
|
||||
) {}
|
||||
|
||||
/**
|
||||
* Registers this endpoint's REST routes.
|
||||
*
|
||||
* @param non-falsy-string $route_namespace REST namespace the routes are registered under (e.g. `us-scheduler/v1`).
|
||||
*/
|
||||
public function registerRoutes( string $route_namespace ): void {
|
||||
register_rest_route(
|
||||
$route_namespace,
|
||||
@@ -101,48 +96,51 @@ class AvailabilityEndpoint {
|
||||
|
||||
public function index( \WP_REST_Request $request ): \WP_REST_Response {
|
||||
$slots = $this->repository->findAvailable(
|
||||
Val::int( $request->get_param( 'instructor_id' ) ),
|
||||
Val::int( $request->get_param( 'offering_id' ) ),
|
||||
Val::int( $request->get_param( 'duration_minutes' ) ),
|
||||
Val::string( $request->get_param( 'from' ) ),
|
||||
Val::string( $request->get_param( 'to' ) ),
|
||||
(int) $request->get_param( 'instructor_id' ),
|
||||
(int) $request->get_param( 'offering_id' ),
|
||||
(int) $request->get_param( 'duration_minutes' ),
|
||||
(string) $request->get_param( 'from' ),
|
||||
(string) $request->get_param( 'to' ),
|
||||
);
|
||||
|
||||
return new \WP_REST_Response( array_map( fn( AvailabilitySlot $s ) => $s->toArray(), $slots ), 200 );
|
||||
}
|
||||
|
||||
public function create( \WP_REST_Request $request ): \WP_REST_Response|\WP_Error {
|
||||
// Validation lives in WindowValidator so this endpoint and the admin form
|
||||
// enforce exactly the same rules.
|
||||
$window = $this->validator->validate(
|
||||
get_current_user_id(),
|
||||
Val::string( $request->get_param( 'start_dt' ) ),
|
||||
Val::string( $request->get_param( 'end_dt' ) ),
|
||||
absint( Val::int( $request->get_param( 'duration_minutes' ) ) ),
|
||||
absint( Val::int( $request->get_param( 'offering_id' ) ) ),
|
||||
);
|
||||
$instructorId = get_current_user_id();
|
||||
$offeringId = absint( $request->get_param( 'offering_id' ) );
|
||||
$duration = absint( $request->get_param( 'duration_minutes' ) );
|
||||
|
||||
if ( $window instanceof \WP_Error ) {
|
||||
return $window;
|
||||
// A slot may only be tied to an offering the instructor owns, so it can
|
||||
// never inherit another instructor's price or payment routing at booking.
|
||||
if ( $offeringId > 0 ) {
|
||||
$offering = $this->offerings->findById( $offeringId );
|
||||
if ( null === $offering || $offering->instructorId !== $instructorId ) {
|
||||
return new \WP_Error( 'invalid_offering', __( 'That offering is not available.', 'unsupervised-schedular' ), [ 'status' => 400 ] );
|
||||
}
|
||||
}
|
||||
|
||||
$ids = $this->repository->createFromWindow(
|
||||
$window,
|
||||
'weekly' === $request->get_param( 'recurrence' ),
|
||||
absint( Val::int( $request->get_param( 'weeks' ) ) )
|
||||
$slot = new AvailabilitySlot(
|
||||
instructorId: $instructorId,
|
||||
startDt: (string) $request->get_param( 'start_dt' ),
|
||||
endDt: (string) $request->get_param( 'end_dt' ),
|
||||
durationMinutes: $duration > 0 ? $duration : 60,
|
||||
offeringId: $offeringId > 0 ? $offeringId : null,
|
||||
);
|
||||
|
||||
// A valid window splits into at least one slot, so nothing written means
|
||||
// every insert failed.
|
||||
if ( [] === $ids ) {
|
||||
return new \WP_Error( 'not_saved', __( 'The availability could not be saved.', 'unsupervised-schedular' ), [ 'status' => 500 ] );
|
||||
if ( 'weekly' === $request->get_param( 'recurrence' ) ) {
|
||||
$ids = $this->repository->createWeeklySeries( $slot, absint( $request->get_param( 'weeks' ) ) );
|
||||
|
||||
return new \WP_REST_Response( [ 'ids' => $ids ], 201 );
|
||||
}
|
||||
|
||||
return new \WP_REST_Response( [ 'ids' => $ids ], 201 );
|
||||
$id = $this->repository->insert( $slot );
|
||||
|
||||
return new \WP_REST_Response( [ 'id' => $id ], 201 );
|
||||
}
|
||||
|
||||
public function delete( \WP_REST_Request $request ): \WP_REST_Response|\WP_Error {
|
||||
$id = absint( Val::int( $request->get_param( 'id' ) ) );
|
||||
$id = absint( $request->get_param( 'id' ) );
|
||||
$slot = $this->repository->findById( $id );
|
||||
|
||||
if ( null === $slot ) {
|
||||
|
||||
@@ -11,14 +11,8 @@ class AvailabilityRepository {
|
||||
$this->table = $db->prefix . 'us_availability';
|
||||
}
|
||||
|
||||
/**
|
||||
* Insert one slot row. Returns its id, or 0 when the write failed —
|
||||
* `insert_id` still holds the *previous* statement's id after a failed
|
||||
* insert, so returning it unconditionally made a failed write look like a
|
||||
* successful one.
|
||||
*/
|
||||
public function insert( AvailabilitySlot $slot ): int {
|
||||
$written = $this->db->insert(
|
||||
$this->db->insert(
|
||||
$this->table,
|
||||
[
|
||||
'instructor_id' => $slot->instructorId,
|
||||
@@ -33,35 +27,7 @@ class AvailabilityRepository {
|
||||
[ '%d', '%d', '%s', '%s', '%d', '%d', '%d', '%s' ]
|
||||
);
|
||||
|
||||
return false === $written ? 0 : $this->db->insert_id;
|
||||
}
|
||||
|
||||
/**
|
||||
* Persist an availability window as individually bookable lesson-length slots.
|
||||
* The window is split into consecutive `duration_minutes` chunks; each chunk
|
||||
* becomes its own row (and, when weekly, its own weekly series) so students can
|
||||
* book any open lesson-length block within the window.
|
||||
*
|
||||
* @return list<int> Inserted slot IDs.
|
||||
*/
|
||||
public function createFromWindow( AvailabilitySlot $window, bool $weekly = false, int $weeks = 1 ): array {
|
||||
$ids = [];
|
||||
|
||||
foreach ( $window->splitByDuration() as $slot ) {
|
||||
if ( $weekly ) {
|
||||
$ids = array_merge( $ids, $this->createWeeklySeries( $slot, $weeks ) );
|
||||
continue;
|
||||
}
|
||||
|
||||
$id = $this->insert( $slot );
|
||||
|
||||
// A failed insert returns 0; it must not reach the caller as an id.
|
||||
if ( $id > 0 ) {
|
||||
$ids[] = $id;
|
||||
}
|
||||
}
|
||||
|
||||
return $ids;
|
||||
return $this->db->insert_id;
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -69,14 +35,10 @@ class AvailabilityRepository {
|
||||
* separate row one week apart, all sharing a `recurrence_group` (the id of the
|
||||
* first row).
|
||||
*
|
||||
* The count is clamped to `AvailabilitySlot::MAX_WEEKLY_OCCURRENCES`. The
|
||||
* form's `max` attribute says the same, but only this is binding — a
|
||||
* hand-crafted POST used to be able to ask for an unbounded number of rows.
|
||||
*
|
||||
* @return list<int> Inserted slot IDs.
|
||||
*/
|
||||
public function createWeeklySeries( AvailabilitySlot $first, int $occurrences ): array {
|
||||
$occurrences = max( 1, min( AvailabilitySlot::MAX_WEEKLY_OCCURRENCES, $occurrences ) );
|
||||
$occurrences = max( 1, $occurrences );
|
||||
$start = new \DateTimeImmutable( $first->startDt );
|
||||
$end = new \DateTimeImmutable( $first->endDt );
|
||||
|
||||
@@ -97,13 +59,6 @@ class AvailabilityRepository {
|
||||
)
|
||||
);
|
||||
|
||||
// A failed insert returns 0. Skipping it keeps a bogus id out of the
|
||||
// returned list and, more importantly, stops 0 becoming the series'
|
||||
// recurrence group — which would orphan every later occurrence.
|
||||
if ( $id <= 0 ) {
|
||||
continue;
|
||||
}
|
||||
|
||||
if ( 0 === $groupId ) {
|
||||
$groupId = $id;
|
||||
$this->setRecurrenceGroup( $id, $groupId );
|
||||
@@ -132,10 +87,8 @@ class AvailabilityRepository {
|
||||
* @return list<AvailabilitySlot>
|
||||
*/
|
||||
public function findAvailable( int $instructorId = 0, int $offeringId = 0, int $durationMinutes = 0, string $from = '', string $to = '' ): array {
|
||||
// A slot whose start has passed can no longer be booked, so it is never
|
||||
// "available" regardless of the requested range.
|
||||
$where = [ 'is_booked = 0', 'start_dt >= %s' ];
|
||||
$params = [ current_time( 'mysql' ) ];
|
||||
$where = [ 'is_booked = 0' ];
|
||||
$params = [];
|
||||
|
||||
if ( $instructorId > 0 ) {
|
||||
$where[] = 'instructor_id = %d';
|
||||
@@ -163,11 +116,11 @@ class AvailabilityRepository {
|
||||
}
|
||||
|
||||
$whereClause = implode( ' AND ', $where );
|
||||
$sql = "SELECT * FROM %i WHERE {$whereClause} ORDER BY start_dt ASC";
|
||||
$sql = "SELECT * FROM {$this->table} WHERE {$whereClause} ORDER BY start_dt ASC";
|
||||
|
||||
$rows = $this->db->get_results(
|
||||
$this->db->prepare( $sql, array_merge( [ $this->table ], $params ) )
|
||||
);
|
||||
$rows = $params
|
||||
? $this->db->get_results( $this->db->prepare( $sql, $params ) )
|
||||
: $this->db->get_results( $sql );
|
||||
|
||||
return array_map( AvailabilitySlot::fromRow( ... ), $rows ?? [] );
|
||||
}
|
||||
@@ -180,8 +133,7 @@ class AvailabilityRepository {
|
||||
public function findByInstructor( int $instructorId ): array {
|
||||
$rows = $this->db->get_results(
|
||||
$this->db->prepare(
|
||||
'SELECT * FROM %i WHERE instructor_id = %d ORDER BY start_dt ASC',
|
||||
$this->table,
|
||||
"SELECT * FROM {$this->table} WHERE instructor_id = %d ORDER BY start_dt ASC",
|
||||
$instructorId
|
||||
)
|
||||
);
|
||||
@@ -197,8 +149,7 @@ class AvailabilityRepository {
|
||||
public function findUnbookedInGroup( int $recurrenceGroup ): array {
|
||||
$rows = $this->db->get_results(
|
||||
$this->db->prepare(
|
||||
'SELECT * FROM %i WHERE recurrence_group = %d AND is_booked = 0 ORDER BY start_dt ASC',
|
||||
$this->table,
|
||||
"SELECT * FROM {$this->table} WHERE recurrence_group = %d AND is_booked = 0 ORDER BY start_dt ASC",
|
||||
$recurrenceGroup
|
||||
)
|
||||
);
|
||||
@@ -206,31 +157,9 @@ class AvailabilityRepository {
|
||||
return array_map( AvailabilitySlot::fromRow( ... ), $rows ?? [] );
|
||||
}
|
||||
|
||||
/**
|
||||
* An instructor's slots (booked and unbooked) that overlap a time window —
|
||||
* they share any time with the half-open interval [$start, $end). Used when a
|
||||
* group class is scheduled to find the private-booking slots that collide with
|
||||
* it, so open ones can be cleared and booked ones flagged as conflicts.
|
||||
*
|
||||
* @return list<AvailabilitySlot>
|
||||
*/
|
||||
public function findOverlapping( int $instructorId, string $start, string $end ): array {
|
||||
$rows = $this->db->get_results(
|
||||
$this->db->prepare(
|
||||
'SELECT * FROM %i WHERE instructor_id = %d AND start_dt < %s AND end_dt > %s ORDER BY start_dt ASC',
|
||||
$this->table,
|
||||
$instructorId,
|
||||
$end,
|
||||
$start
|
||||
)
|
||||
);
|
||||
|
||||
return array_map( AvailabilitySlot::fromRow( ... ), $rows ?? [] );
|
||||
}
|
||||
|
||||
public function findById( int $id ): ?AvailabilitySlot {
|
||||
$row = $this->db->get_row(
|
||||
$this->db->prepare( 'SELECT * FROM %i WHERE id = %d', $this->table, $id )
|
||||
$this->db->prepare( "SELECT * FROM {$this->table} WHERE id = %d", $id )
|
||||
);
|
||||
|
||||
return $row ? AvailabilitySlot::fromRow( $row ) : null;
|
||||
@@ -258,60 +187,6 @@ class AvailabilityRepository {
|
||||
return 1 === $updated;
|
||||
}
|
||||
|
||||
/**
|
||||
* Free a slot whose lesson was cancelled so the time can be booked again.
|
||||
*/
|
||||
public function release( int $id ): bool {
|
||||
return false !== $this->db->update(
|
||||
$this->table,
|
||||
[ 'is_booked' => 0 ],
|
||||
[ 'id' => $id ],
|
||||
[ '%d' ],
|
||||
[ '%d' ]
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* One-time upgrade for rows created before windows were split on save: a
|
||||
* window stored as a single row (e.g. 09:00–16:00 with 60-minute lessons)
|
||||
* showed to students as one giant slot. Rewrites every unbooked same-day
|
||||
* window longer than its lesson length as lesson-length rows: the original
|
||||
* row is trimmed to the first chunk (keeping its id and any recurrence
|
||||
* group), and the remaining chunks are inserted as one-off rows.
|
||||
*/
|
||||
public function splitOversizedWindows(): void {
|
||||
$rows = $this->db->get_results(
|
||||
$this->db->prepare(
|
||||
'SELECT * FROM %i
|
||||
WHERE is_booked = 0
|
||||
AND DATE(start_dt) = DATE(end_dt)
|
||||
AND TIMESTAMPDIFF(MINUTE, start_dt, end_dt) > duration_minutes',
|
||||
$this->table
|
||||
)
|
||||
);
|
||||
|
||||
foreach ( $rows ?? [] as $row ) {
|
||||
$window = AvailabilitySlot::fromRow( $row );
|
||||
$chunks = $window->splitByDuration();
|
||||
|
||||
if ( [] === $chunks ) {
|
||||
continue;
|
||||
}
|
||||
|
||||
$this->db->update(
|
||||
$this->table,
|
||||
[ 'end_dt' => $chunks[0]->endDt ],
|
||||
[ 'id' => $window->id ],
|
||||
[ '%s' ],
|
||||
[ '%d' ]
|
||||
);
|
||||
|
||||
foreach ( array_slice( $chunks, 1 ) as $chunk ) {
|
||||
$this->insert( $chunk );
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Delete an unbooked slot. Returns false if the slot is already booked.
|
||||
*/
|
||||
|
||||
@@ -3,27 +3,8 @@ declare(strict_types=1);
|
||||
|
||||
namespace Unsupervised\Schedular\Availability;
|
||||
|
||||
use Unsupervised\Schedular\Val;
|
||||
|
||||
class AvailabilitySlot {
|
||||
|
||||
/** Lesson length used when none was submitted. */
|
||||
public const DEFAULT_DURATION_MINUTES = 60;
|
||||
|
||||
/**
|
||||
* Lesson lengths a window can be split into, offered by the availability
|
||||
* form. The form hides the ones a given window is too short for.
|
||||
*
|
||||
* @var list<int>
|
||||
*/
|
||||
public const DURATION_CHOICES = [ 30, 60 ];
|
||||
|
||||
/**
|
||||
* Ceiling on a weekly series, matching the form's `max`. Enforced in the
|
||||
* repository too, so a hand-crafted POST cannot ask for ten thousand rows.
|
||||
*/
|
||||
public const MAX_WEEKLY_OCCURRENCES = 52;
|
||||
|
||||
public function __construct(
|
||||
public readonly int $instructorId,
|
||||
public readonly string $startDt,
|
||||
@@ -35,71 +16,16 @@ class AvailabilitySlot {
|
||||
public readonly ?int $id = null,
|
||||
) {}
|
||||
|
||||
/**
|
||||
* Normalise a submitted slot datetime to canonical `Y-m-d H:i:s`, or null when
|
||||
* it is not a real datetime. Accepts the HTML `datetime-local` form
|
||||
* (`Y-m-d\TH:i`, optionally with seconds) and the canonical form (optionally
|
||||
* without seconds). Anything else — including strings PHP would "helpfully"
|
||||
* coerce — is rejected so garbage never reaches the DATETIME column or throws
|
||||
* inside the weekly-series date arithmetic.
|
||||
*/
|
||||
public static function normalizeDateTime( string $value ): ?string {
|
||||
foreach ( [ 'Y-m-d H:i:s', 'Y-m-d H:i', 'Y-m-d\TH:i:s', 'Y-m-d\TH:i' ] as $format ) {
|
||||
$dt = \DateTimeImmutable::createFromFormat( '!' . $format, $value );
|
||||
if ( false !== $dt && $dt->format( $format ) === $value ) {
|
||||
return $dt->format( 'Y-m-d H:i:s' );
|
||||
}
|
||||
}
|
||||
|
||||
return null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Split this window into consecutive lesson-length slots: 09:00–16:00 with
|
||||
* 60-minute lessons yields seven bookable slots. A trailing remainder shorter
|
||||
* than the lesson length is dropped, and an empty list is returned when the
|
||||
* window cannot fit a single lesson.
|
||||
*
|
||||
* @return list<self>
|
||||
*/
|
||||
public function splitByDuration(): array {
|
||||
if ( $this->durationMinutes <= 0 ) {
|
||||
return [];
|
||||
}
|
||||
|
||||
$end = new \DateTimeImmutable( $this->endDt );
|
||||
$step = new \DateInterval( 'PT' . $this->durationMinutes . 'M' );
|
||||
|
||||
$cursor = new \DateTimeImmutable( $this->startDt );
|
||||
$chunkEnd = $cursor->add( $step );
|
||||
|
||||
$slots = [];
|
||||
while ( $chunkEnd <= $end ) {
|
||||
$slots[] = new self(
|
||||
instructorId: $this->instructorId,
|
||||
startDt: $cursor->format( 'Y-m-d H:i:s' ),
|
||||
endDt: $chunkEnd->format( 'Y-m-d H:i:s' ),
|
||||
durationMinutes: $this->durationMinutes,
|
||||
offeringId: $this->offeringId,
|
||||
);
|
||||
|
||||
$cursor = $chunkEnd;
|
||||
$chunkEnd = $cursor->add( $step );
|
||||
}
|
||||
|
||||
return $slots;
|
||||
}
|
||||
|
||||
public static function fromRow( \stdClass $row ): self {
|
||||
public static function fromRow( object $row ): self {
|
||||
return new self(
|
||||
instructorId: Val::int( $row->instructor_id ),
|
||||
startDt: Val::string( $row->start_dt ),
|
||||
endDt: Val::string( $row->end_dt ),
|
||||
durationMinutes: Val::int( $row->duration_minutes ),
|
||||
offeringId: Val::intOrNull( $row->offering_id ),
|
||||
isBooked: Val::bool( $row->is_booked ),
|
||||
recurrenceGroup: Val::intOrNull( $row->recurrence_group ),
|
||||
id: Val::int( $row->id ),
|
||||
instructorId: (int) $row->instructor_id,
|
||||
startDt: $row->start_dt,
|
||||
endDt: $row->end_dt,
|
||||
durationMinutes: (int) $row->duration_minutes,
|
||||
offeringId: null !== $row->offering_id ? (int) $row->offering_id : null,
|
||||
isBooked: (bool) $row->is_booked,
|
||||
recurrenceGroup: null !== $row->recurrence_group ? (int) $row->recurrence_group : null,
|
||||
id: (int) $row->id,
|
||||
);
|
||||
}
|
||||
|
||||
|
||||
@@ -1,87 +0,0 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace Unsupervised\Schedular\Availability;
|
||||
|
||||
/**
|
||||
* Pure helpers for the weekly calendar views: resolving which week to show and
|
||||
* bucketing slots into that week's seven days.
|
||||
*/
|
||||
class WeekCalendar {
|
||||
|
||||
/**
|
||||
* Resolve a requested week anchor to the date of the first day of its week.
|
||||
* `$requested` may be any date (`Y-m-d`) inside the wanted week; anything
|
||||
* unparseable falls back to `$today`. `$startOfWeek` follows WordPress's
|
||||
* `start_of_week` option (0 = Sunday … 6 = Saturday).
|
||||
*/
|
||||
public static function weekStart( string $requested, int $startOfWeek, string $today ): string {
|
||||
$anchor = self::parseDay( $requested ) ?? self::parseDay( $today ) ?? new \DateTimeImmutable( 'today' );
|
||||
$shift = ( (int) $anchor->format( 'w' ) - $startOfWeek + 7 ) % 7;
|
||||
|
||||
return $anchor->modify( '-' . $shift . ' days' )->format( 'Y-m-d' );
|
||||
}
|
||||
|
||||
/**
|
||||
* Bucket slots into the seven days of the week starting at `$weekStart`
|
||||
* (`Y-m-d`). Every day is present, empty or not, in calendar order.
|
||||
*
|
||||
* @param list<AvailabilitySlot> $slots
|
||||
* @return list<array{date: string, slots: list<AvailabilitySlot>}>
|
||||
*/
|
||||
public static function days( string $weekStart, array $slots ): array {
|
||||
$start = self::parseDay( $weekStart ) ?? new \DateTimeImmutable( 'today' );
|
||||
|
||||
$byDay = [];
|
||||
foreach ( $slots as $slot ) {
|
||||
$byDay[ substr( $slot->startDt, 0, 10 ) ][] = $slot;
|
||||
}
|
||||
|
||||
$days = [];
|
||||
for ( $i = 0; $i < 7; $i++ ) {
|
||||
$date = $start->modify( '+' . $i . ' days' )->format( 'Y-m-d' );
|
||||
$days[] = [
|
||||
'date' => $date,
|
||||
'slots' => $byDay[ $date ] ?? [],
|
||||
];
|
||||
}
|
||||
|
||||
return $days;
|
||||
}
|
||||
|
||||
/**
|
||||
* Bucket arbitrary items into the seven days of the week starting at
|
||||
* `$weekStart` (`Y-m-d`), using `$dayOf` to extract each item's `Y-m-d` day.
|
||||
* Every day is present, empty or not, in calendar order.
|
||||
*
|
||||
* @template T
|
||||
* @param list<T> $items
|
||||
* @param callable(T): string $dayOf
|
||||
* @return list<array{date: string, items: list<T>}>
|
||||
*/
|
||||
public static function bucket( string $weekStart, array $items, callable $dayOf ): array {
|
||||
$start = self::parseDay( $weekStart ) ?? new \DateTimeImmutable( 'today' );
|
||||
|
||||
$byDay = [];
|
||||
foreach ( $items as $item ) {
|
||||
$byDay[ $dayOf( $item ) ][] = $item;
|
||||
}
|
||||
|
||||
$days = [];
|
||||
for ( $i = 0; $i < 7; $i++ ) {
|
||||
$date = $start->modify( '+' . $i . ' days' )->format( 'Y-m-d' );
|
||||
$days[] = [
|
||||
'date' => $date,
|
||||
'items' => $byDay[ $date ] ?? [],
|
||||
];
|
||||
}
|
||||
|
||||
return $days;
|
||||
}
|
||||
|
||||
private static function parseDay( string $value ): ?\DateTimeImmutable {
|
||||
$day = \DateTimeImmutable::createFromFormat( '!Y-m-d', $value );
|
||||
|
||||
return false !== $day && $day->format( 'Y-m-d' ) === $value ? $day : null;
|
||||
}
|
||||
}
|
||||
@@ -1,105 +0,0 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace Unsupervised\Schedular\Availability;
|
||||
|
||||
use Unsupervised\Schedular\Offering\OfferingRepository;
|
||||
|
||||
/**
|
||||
* Validates a submitted availability window.
|
||||
*
|
||||
* The admin form and the REST endpoint both accept the same window, and used to
|
||||
* check it independently — the endpoint returning a specific 400 for each
|
||||
* failure while the form simply returned, saving nothing and saying nothing. A
|
||||
* 30-minute window submitted with the default 60-minute lesson length was the
|
||||
* visible symptom: no rows, no error, no clue. Both callers now come through
|
||||
* here, so neither can drift from the other again.
|
||||
*
|
||||
* Every rejection is a `WP_Error` carrying a message written for the person who
|
||||
* submitted the form: the endpoint returns it as-is (the `status` data makes it
|
||||
* a 400), and the admin screen shows `get_error_message()` in a notice.
|
||||
*/
|
||||
class WindowValidator {
|
||||
|
||||
public function __construct( private OfferingRepository $offerings ) {}
|
||||
|
||||
/**
|
||||
* Check a submitted window and return it ready to persist.
|
||||
*
|
||||
* @param int $instructorId Instructor the window belongs to.
|
||||
* @param string $rawStart Submitted start, in any form {@see AvailabilitySlot::normalizeDateTime()} accepts.
|
||||
* @param string $rawEnd Submitted end, likewise.
|
||||
* @param int $durationMinutes Lesson length the window is split into; 0 falls back to the 60-minute default.
|
||||
* @param int $offeringId Offering the slots are tied to, or 0 for any private lesson.
|
||||
*
|
||||
* @return AvailabilitySlot|\WP_Error The window, or why it was rejected.
|
||||
*/
|
||||
public function validate( int $instructorId, string $rawStart, string $rawEnd, int $durationMinutes, int $offeringId ): AvailabilitySlot|\WP_Error {
|
||||
$startDt = AvailabilitySlot::normalizeDateTime( $rawStart );
|
||||
$endDt = AvailabilitySlot::normalizeDateTime( $rawEnd );
|
||||
|
||||
if ( null === $startDt || null === $endDt ) {
|
||||
return new \WP_Error(
|
||||
'invalid_datetime',
|
||||
__( 'Enter a valid start and end date and time.', 'unsupervised-schedular' ),
|
||||
[ 'status' => 400 ]
|
||||
);
|
||||
}
|
||||
|
||||
if ( $endDt <= $startDt ) {
|
||||
return new \WP_Error(
|
||||
'invalid_datetime',
|
||||
__( 'The end time must be after the start time.', 'unsupervised-schedular' ),
|
||||
[ 'status' => 400 ]
|
||||
);
|
||||
}
|
||||
|
||||
if ( substr( $startDt, 0, 10 ) !== substr( $endDt, 0, 10 ) ) {
|
||||
return new \WP_Error(
|
||||
'invalid_window',
|
||||
__( 'Availability must start and end on the same day. Use the weekly repeat to cover multiple weeks.', 'unsupervised-schedular' ),
|
||||
[ 'status' => 400 ]
|
||||
);
|
||||
}
|
||||
|
||||
// A slot may only be tied to an offering the instructor owns, so it can
|
||||
// never inherit another instructor's price or payment routing at booking.
|
||||
if ( $offeringId > 0 ) {
|
||||
$offering = $this->offerings->findById( $offeringId );
|
||||
|
||||
if ( null === $offering || $offering->instructorId !== $instructorId ) {
|
||||
return new \WP_Error(
|
||||
'invalid_offering',
|
||||
__( 'That offering is not available.', 'unsupervised-schedular' ),
|
||||
[ 'status' => 400 ]
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
$duration = $durationMinutes > 0 ? $durationMinutes : AvailabilitySlot::DEFAULT_DURATION_MINUTES;
|
||||
|
||||
$window = new AvailabilitySlot(
|
||||
instructorId: $instructorId,
|
||||
startDt: $startDt,
|
||||
endDt: $endDt,
|
||||
durationMinutes: $duration,
|
||||
offeringId: $offeringId > 0 ? $offeringId : null,
|
||||
);
|
||||
|
||||
// The window is stored as lesson-length slots, so one that cannot fit a
|
||||
// single lesson would persist nothing at all.
|
||||
if ( [] === $window->splitByDuration() ) {
|
||||
return new \WP_Error(
|
||||
'invalid_window',
|
||||
sprintf(
|
||||
/* translators: %d: the selected lesson length, in minutes. */
|
||||
__( 'This window is shorter than the %d-minute lesson length, so it holds no bookable slots. Choose a shorter lesson length or a longer window.', 'unsupervised-schedular' ),
|
||||
$duration
|
||||
),
|
||||
[ 'status' => 400 ]
|
||||
);
|
||||
}
|
||||
|
||||
return $window;
|
||||
}
|
||||
}
|
||||
@@ -1,234 +0,0 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace Unsupervised\Schedular;
|
||||
|
||||
/**
|
||||
* Static, script-free markup for the editor previews of the front-end blocks.
|
||||
*
|
||||
* The booking and group-class pages are populated by JavaScript on the live
|
||||
* site, and the registration page requires a valid invite token — none of
|
||||
* which exist inside the block editor. These previews reproduce the same
|
||||
* wrapper elements and CSS classes the live pages use, filled with
|
||||
* representative placeholder content, so themes can be styled against
|
||||
* realistic markup without firing REST calls, redirects, or Stripe.js.
|
||||
*/
|
||||
class BlockPreview {
|
||||
|
||||
/**
|
||||
* The marker a required field's label carries, matching the one
|
||||
* {@see Registration\QuestionField::render()} puts on a required question.
|
||||
*/
|
||||
private const REQUIRED_MARK = ' <span class="us-required" aria-hidden="true">*</span>';
|
||||
|
||||
/**
|
||||
* Sample booking page.
|
||||
*
|
||||
* @param string $mode Which halves the block embeds — one of
|
||||
* {@see Booking\BookingPage::MODE_BOTH},
|
||||
* `MODE_BOOKING` or `MODE_UPCOMING`. The preview shows
|
||||
* the same sections the published page would.
|
||||
*/
|
||||
public static function booking( string $mode = Booking\BookingPage::MODE_BOTH ): string {
|
||||
if ( Booking\BookingPage::MODE_UPCOMING === $mode ) {
|
||||
return sprintf(
|
||||
'<div id="us-booking-app">%s<div id="us-my-lessons">%s</div></div>',
|
||||
self::note( __( 'Editor preview — students see their own lessons on the published page.', 'unsupervised-schedular' ) ),
|
||||
self::upcomingLessons()
|
||||
);
|
||||
}
|
||||
|
||||
$days = [
|
||||
[
|
||||
'label' => __( 'Monday', 'unsupervised-schedular' ),
|
||||
'slots' => [
|
||||
[ '4:00 PM–4:30 PM', 30 ],
|
||||
[ '4:30 PM–5:00 PM', 30 ],
|
||||
],
|
||||
],
|
||||
[
|
||||
'label' => __( 'Wednesday', 'unsupervised-schedular' ),
|
||||
'slots' => [
|
||||
[ '5:00 PM–5:45 PM', 45 ],
|
||||
],
|
||||
],
|
||||
];
|
||||
|
||||
$dayHtml = '';
|
||||
foreach ( $days as $day ) {
|
||||
$slotHtml = '';
|
||||
foreach ( $day['slots'] as $slot ) {
|
||||
$slotHtml .= sprintf(
|
||||
'<div class="us-slot"><span>%s (%d min)</span><button type="button" class="us-book-btn" disabled>%s</button></div>',
|
||||
esc_html( $slot[0] ),
|
||||
(int) $slot[1],
|
||||
esc_html__( 'Book', 'unsupervised-schedular' )
|
||||
);
|
||||
}
|
||||
|
||||
$dayHtml .= sprintf(
|
||||
'<div class="us-day"><h3 class="us-day-heading">%s</h3>%s</div>',
|
||||
esc_html( $day['label'] ),
|
||||
$slotHtml
|
||||
);
|
||||
}
|
||||
|
||||
$lessons = Booking\BookingPage::MODE_BOOKING === $mode
|
||||
? ''
|
||||
: sprintf( '<div id="us-my-lessons">%s</div>', self::upcomingLessons() );
|
||||
|
||||
return sprintf(
|
||||
'<div id="us-booking-app">%s%s<div id="us-slot-list">%s</div></div>',
|
||||
self::note( __( 'Editor preview — students see live availability on the published page.', 'unsupervised-schedular' ) ),
|
||||
$lessons,
|
||||
$dayHtml
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Sample "your upcoming lessons" panel, shared by the booking preview's
|
||||
* full and upcoming-only modes.
|
||||
*/
|
||||
private static function upcomingLessons(): string {
|
||||
return sprintf(
|
||||
'<div class="us-my-lessons"><h3>%s</h3>'
|
||||
. '<div class="us-my-lesson"><div class="us-my-lesson-info">'
|
||||
. '<strong class="us-my-lesson-title">%s <span class="us-my-lesson-duration">(30 min)</span></strong>'
|
||||
. '<span class="us-my-lesson-when">%s</span></div>'
|
||||
. '<div class="us-my-lesson-actions">'
|
||||
. '<span class="us-lesson-status us-lesson-status-confirmed">%s</span>'
|
||||
. '<button type="button" class="us-cancel-lesson" disabled>%s</button>'
|
||||
. '</div></div></div>',
|
||||
esc_html__( 'Your upcoming lessons', 'unsupervised-schedular' ),
|
||||
esc_html__( 'Piano Lesson', 'unsupervised-schedular' ),
|
||||
esc_html__( 'Monday · 4:00 PM–4:30 PM', 'unsupervised-schedular' ),
|
||||
esc_html__( 'Confirmed', 'unsupervised-schedular' ),
|
||||
esc_html__( 'Cancel', 'unsupervised-schedular' )
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Sample group-class card.
|
||||
*
|
||||
* @param bool $singleClass Whether the block is pinned to one class, in
|
||||
* which case the live page omits the class
|
||||
* description and the preview does too.
|
||||
*/
|
||||
public static function groupClasses( bool $singleClass = false ): string {
|
||||
$note = $singleClass
|
||||
? __( 'Editor preview — the published page shows the chosen class with its live schedule and enrolment status.', 'unsupervised-schedular' )
|
||||
: __( 'Editor preview — students see live group classes on the published page.', 'unsupervised-schedular' );
|
||||
|
||||
$description = $singleClass
|
||||
? ''
|
||||
: '<p>' . esc_html__( 'A sample class shown so the page can be styled.', 'unsupervised-schedular' ) . '</p>';
|
||||
|
||||
return sprintf(
|
||||
'<div id="us-group-app">%s<div id="us-group-list"><div class="us-class"><h3>%s</h3><p class="us-class-when">%s</p>%s<p class="us-class-price">%s</p><p class="us-enrol-deadline">%s</p><button type="button" class="us-enrol-btn" disabled>%s</button></div></div></div>',
|
||||
self::note( $note ),
|
||||
esc_html__( 'Beginner Group Class', 'unsupervised-schedular' ),
|
||||
esc_html__( 'Saturdays 10:00 AM–11:00 AM', 'unsupervised-schedular' ),
|
||||
$description,
|
||||
// Prices on the live page always carry their cadence, so the sample does too.
|
||||
esc_html__( '25.00 CAD up front', 'unsupervised-schedular' ),
|
||||
esc_html__( 'Enrol by Sep 6, 2026', 'unsupervised-schedular' ),
|
||||
esc_html__( 'Enrol', 'unsupervised-schedular' )
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* The live login form renders fine without any request state, so the
|
||||
* preview includes the real template (the editing user is logged in, which
|
||||
* would otherwise short-circuit to an "already logged in" message).
|
||||
*/
|
||||
public static function login(): string {
|
||||
$error = '';
|
||||
|
||||
ob_start();
|
||||
include USC_PLUGIN_DIR . 'templates/frontend/login-page.php';
|
||||
|
||||
return self::note( __( 'Editor preview — logged-in visitors are offered a link to the booking page instead.', 'unsupervised-schedular' ) ) . (string) ob_get_clean();
|
||||
}
|
||||
|
||||
public static function registration(): string {
|
||||
$fields = sprintf(
|
||||
'<p><label for="us-reg-email">%s</label><input type="email" id="us-reg-email" value="[email protected]" readonly></p>',
|
||||
esc_html__( 'Email', 'unsupervised-schedular' )
|
||||
);
|
||||
$fields .= sprintf(
|
||||
'<p><label for="us-reg-name">%s</label><input type="text" id="us-reg-name"></p>',
|
||||
esc_html__( 'Your name', 'unsupervised-schedular' )
|
||||
);
|
||||
$fields .= sprintf(
|
||||
'<p><label for="us-reg-pass">%s</label><input type="password" id="us-reg-pass"></p>',
|
||||
esc_html__( 'Password', 'unsupervised-schedular' )
|
||||
);
|
||||
$fields .= sprintf(
|
||||
'<p><input type="submit" value="%s" disabled></p>',
|
||||
esc_attr__( 'Create Account', 'unsupervised-schedular' )
|
||||
);
|
||||
|
||||
return sprintf(
|
||||
'<div class="us-register-form">%s<form>%s</form></div>',
|
||||
self::note( __( 'Editor preview — the live form requires a valid invite link and lists signup policies.', 'unsupervised-schedular' ) ),
|
||||
$fields
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Sample family (manage-children) page: two representative children and the
|
||||
* add form, with the controls inert so the editor preview cannot post.
|
||||
*/
|
||||
public static function family(): string {
|
||||
$children = '';
|
||||
foreach ( [ 'Ada Lovelace', 'Alan Turing' ] as $name ) {
|
||||
$children .= sprintf(
|
||||
'<li class="us-family-child"><span class="us-family-child-name">%s</span>'
|
||||
. '<span class="us-family-child-actions"><a href="#">%s</a> <button type="button" disabled>%s</button></span></li>',
|
||||
esc_html( $name ),
|
||||
esc_html__( 'Edit', 'unsupervised-schedular' ),
|
||||
esc_html__( 'Remove', 'unsupervised-schedular' )
|
||||
);
|
||||
}
|
||||
|
||||
$add = sprintf(
|
||||
'<h4>%s</h4><p><label for="us-child-name">%s' . self::REQUIRED_MARK . '</label><input type="text" id="us-child-name"></p>'
|
||||
. '<p><label for="us-child-birth-year">%s' . self::REQUIRED_MARK . '</label><input type="number" id="us-child-birth-year" placeholder="YYYY"></p>'
|
||||
. '<p><button type="button" disabled>%s</button></p>',
|
||||
esc_html__( 'Add a student', 'unsupervised-schedular' ),
|
||||
esc_html__( 'Name', 'unsupervised-schedular' ),
|
||||
esc_html__( 'Birth year', 'unsupervised-schedular' ),
|
||||
esc_html__( 'Add student', 'unsupervised-schedular' )
|
||||
);
|
||||
|
||||
return sprintf(
|
||||
'<div class="us-family">%s<h3>%s</h3><ul class="us-family-list">%s</ul><form class="us-family-add">%s</form></div>',
|
||||
self::note( __( 'Editor preview — signed-in guardians see and manage their own students here.', 'unsupervised-schedular' ) ),
|
||||
esc_html__( 'Your profile', 'unsupervised-schedular' ),
|
||||
$children,
|
||||
$add
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Sample account panel. Shown populated whatever the editor's own login
|
||||
* state, since on the published page a signed-out visitor may see nothing at
|
||||
* all and an empty box tells the person placing the block nothing.
|
||||
*/
|
||||
public static function account(): string {
|
||||
return sprintf(
|
||||
'<div class="us-account">%s'
|
||||
. '<p class="us-account-who"><span class="us-account-name">%s</span>'
|
||||
. '<span class="us-account-email">%s</span></p>'
|
||||
. '<p class="us-account-actions"><a class="us-account-signout" href="#">%s</a></p></div>',
|
||||
self::note( __( 'Editor preview — each visitor sees their own account here.', 'unsupervised-schedular' ) ),
|
||||
esc_html__( 'Grace Hopper', 'unsupervised-schedular' ),
|
||||
esc_html__( '[email protected]', 'unsupervised-schedular' ),
|
||||
esc_html__( 'Sign out', 'unsupervised-schedular' )
|
||||
);
|
||||
}
|
||||
|
||||
private static function note( string $text ): string {
|
||||
return '<p class="us-editor-note">' . esc_html( $text ) . '</p>';
|
||||
}
|
||||
}
|
||||
@@ -1,376 +0,0 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace Unsupervised\Schedular;
|
||||
|
||||
use Unsupervised\Schedular\Auth\AccountPage;
|
||||
use Unsupervised\Schedular\Auth\LoginPage;
|
||||
use Unsupervised\Schedular\Auth\RegistrationPage;
|
||||
use Unsupervised\Schedular\Booking\BookingPage;
|
||||
use Unsupervised\Schedular\GroupClass\GroupClassPage;
|
||||
use Unsupervised\Schedular\Guardian\FamilyPage;
|
||||
|
||||
/**
|
||||
* Registers Gutenberg dynamic-block wrappers for the front-end shortcodes so
|
||||
* the pages can be previewed and styled inside the block editor.
|
||||
*
|
||||
* On the front end each block delegates to the same page object its shortcode
|
||||
* uses, so output is identical either way. Inside the editor (the
|
||||
* block-renderer REST preview used by wp.serverSideRender) a static preview
|
||||
* from BlockPreview is rendered instead — same markup and CSS classes, no
|
||||
* live REST calls, redirects, or Stripe.js.
|
||||
*/
|
||||
class BlockRegistrar {
|
||||
|
||||
public const SCRIPT_HANDLE = 'us-scheduler-blocks';
|
||||
public const STYLE_HANDLE = 'us-scheduler';
|
||||
|
||||
public function __construct(
|
||||
private BookingPage $bookingPage,
|
||||
private LoginPage $loginPage,
|
||||
private RegistrationPage $registrationPage,
|
||||
private GroupClassPage $groupClassPage,
|
||||
private FamilyPage $familyPage,
|
||||
private AccountPage $accountPage,
|
||||
) {}
|
||||
|
||||
public function register(): void {
|
||||
add_action( 'init', [ $this, 'registerBlocks' ] );
|
||||
add_action( 'template_redirect', [ $this, 'maybeAutoRedirect' ] );
|
||||
}
|
||||
|
||||
public function registerBlocks(): void {
|
||||
// The editor script registers the client side of each block (title,
|
||||
// icon, shortcode transform, inspector controls) and previews it via
|
||||
// wp.serverSideRender.
|
||||
wp_register_script(
|
||||
self::SCRIPT_HANDLE,
|
||||
USC_PLUGIN_URL . 'assets/js/blocks.js',
|
||||
[ 'wp-blocks', 'wp-element', 'wp-block-editor', 'wp-components', 'wp-data', 'wp-core-data', 'wp-server-side-render', 'wp-i18n', 'wp-api-fetch' ],
|
||||
USC_VERSION,
|
||||
true
|
||||
);
|
||||
|
||||
// The front-end stylesheet doubles as the block style so editor
|
||||
// previews look like the published page. ShortcodeRegistrar registers
|
||||
// the same handle on the front end, hence the guard.
|
||||
if ( ! wp_style_is( self::STYLE_HANDLE, 'registered' ) ) {
|
||||
wp_register_style( self::STYLE_HANDLE, USC_PLUGIN_URL . 'assets/css/frontend.css', [], USC_VERSION );
|
||||
}
|
||||
|
||||
foreach ( $this->blocks() as $name => $config ) {
|
||||
register_block_type(
|
||||
$name,
|
||||
[
|
||||
'api_version' => '3',
|
||||
'editor_script' => self::SCRIPT_HANDLE,
|
||||
'style' => self::STYLE_HANDLE,
|
||||
'attributes' => $config['attributes'],
|
||||
'render_callback' => $config['render'],
|
||||
]
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Block definitions: render callback plus the attribute schema. The
|
||||
* schema must be declared server-side too, or the block-renderer preview
|
||||
* endpoint rejects the attributes wp.serverSideRender sends.
|
||||
*
|
||||
* @return array<string, array{render: callable(array<string, mixed>=): string, attributes: array<string, array{type: string, default: mixed}>}>
|
||||
*/
|
||||
private function blocks(): array {
|
||||
$redirectToggle = [
|
||||
'type' => 'boolean',
|
||||
'default' => false,
|
||||
];
|
||||
|
||||
return [
|
||||
'us-scheduler/booking' => [
|
||||
'render' => [ $this, 'renderBooking' ],
|
||||
'attributes' => [
|
||||
'loginPageId' => [
|
||||
'type' => 'number',
|
||||
'default' => 0,
|
||||
],
|
||||
'autoRedirect' => $redirectToggle,
|
||||
'lessonTypeId' => [
|
||||
'type' => 'number',
|
||||
'default' => 0,
|
||||
],
|
||||
'showTypeFilter' => [
|
||||
'type' => 'boolean',
|
||||
'default' => true,
|
||||
],
|
||||
'displayMode' => [
|
||||
'type' => 'string',
|
||||
'default' => BookingPage::MODE_BOTH,
|
||||
],
|
||||
],
|
||||
],
|
||||
'us-scheduler/student-login' => [
|
||||
'render' => [ $this, 'renderLogin' ],
|
||||
'attributes' => [
|
||||
'bookingPageId' => [
|
||||
'type' => 'number',
|
||||
'default' => 0,
|
||||
],
|
||||
'autoRedirect' => $redirectToggle,
|
||||
],
|
||||
],
|
||||
'us-scheduler/student-register' => [
|
||||
'render' => [ $this, 'renderRegistration' ],
|
||||
'attributes' => [
|
||||
'loginPageId' => [
|
||||
'type' => 'number',
|
||||
'default' => 0,
|
||||
],
|
||||
'autoRedirect' => $redirectToggle,
|
||||
'inviteOnlyMessage' => [
|
||||
'type' => 'string',
|
||||
'default' => '',
|
||||
],
|
||||
],
|
||||
],
|
||||
'us-scheduler/group-classes' => [
|
||||
'render' => [ $this, 'renderGroupClasses' ],
|
||||
'attributes' => [
|
||||
'offeringId' => [
|
||||
'type' => 'number',
|
||||
'default' => 0,
|
||||
],
|
||||
],
|
||||
],
|
||||
'us-scheduler/family' => [
|
||||
'render' => [ $this, 'renderFamily' ],
|
||||
'attributes' => [
|
||||
'loginPageId' => [
|
||||
'type' => 'number',
|
||||
'default' => 0,
|
||||
],
|
||||
],
|
||||
],
|
||||
'us-scheduler/account' => [
|
||||
'render' => [ $this, 'renderAccount' ],
|
||||
'attributes' => [
|
||||
'loginPageId' => [
|
||||
'type' => 'number',
|
||||
'default' => 0,
|
||||
],
|
||||
],
|
||||
],
|
||||
];
|
||||
}
|
||||
|
||||
/**
|
||||
* Renders the booking block.
|
||||
*
|
||||
* @param array<string, mixed> $attributes Block attributes.
|
||||
*/
|
||||
public function renderBooking( array $attributes = [] ): string {
|
||||
if ( ! $this->isEditorPreview() ) {
|
||||
return $this->bookingPage->render( $attributes );
|
||||
}
|
||||
|
||||
return BlockPreview::booking( Val::string( $attributes['displayMode'] ?? BookingPage::MODE_BOTH ) );
|
||||
}
|
||||
|
||||
/**
|
||||
* Renders the student-login block.
|
||||
*
|
||||
* @param array<string, mixed> $attributes Block attributes.
|
||||
*/
|
||||
public function renderLogin( array $attributes = [] ): string {
|
||||
return $this->isEditorPreview() ? BlockPreview::login() : $this->loginPage->render( $attributes );
|
||||
}
|
||||
|
||||
/**
|
||||
* Renders the student-registration block.
|
||||
*
|
||||
* @param array<string, mixed> $attributes Block attributes.
|
||||
*/
|
||||
public function renderRegistration( array $attributes = [] ): string {
|
||||
return $this->isEditorPreview() ? BlockPreview::registration() : $this->registrationPage->render( $attributes );
|
||||
}
|
||||
|
||||
/**
|
||||
* Renders the group-classes block.
|
||||
*
|
||||
* @param array<string, mixed> $attributes Block attributes.
|
||||
*/
|
||||
public function renderGroupClasses( array $attributes = [] ): string {
|
||||
if ( ! $this->isEditorPreview() ) {
|
||||
return $this->groupClassPage->render( $attributes );
|
||||
}
|
||||
|
||||
return BlockPreview::groupClasses( Val::int( $attributes['offeringId'] ?? 0 ) > 0 );
|
||||
}
|
||||
|
||||
/**
|
||||
* Renders the account (who is signed in) block.
|
||||
*
|
||||
* @param array<string, mixed> $attributes Block attributes.
|
||||
*/
|
||||
public function renderAccount( array $attributes = [] ): string {
|
||||
return $this->isEditorPreview() ? BlockPreview::account() : $this->accountPage->render( $attributes );
|
||||
}
|
||||
|
||||
/**
|
||||
* Renders the family (manage-children) block.
|
||||
*
|
||||
* @param array<string, mixed> $attributes Block attributes.
|
||||
*/
|
||||
public function renderFamily( array $attributes = [] ): string {
|
||||
return $this->isEditorPreview() ? BlockPreview::family() : $this->familyPage->render( $attributes );
|
||||
}
|
||||
|
||||
/**
|
||||
* Server-side auto-redirect for blocks that opt in via their autoRedirect
|
||||
* attribute: logged-out visitors on a page containing the booking block
|
||||
* are sent to its login page, logged-in visitors on a page containing the
|
||||
* student-login block are sent to its booking page, and a student who has
|
||||
* just finished registering is sent to the register block's chosen page.
|
||||
* Hooked on `template_redirect` because block rendering happens after
|
||||
* output has started, too late to send a Location header.
|
||||
*/
|
||||
public function maybeAutoRedirect(): void {
|
||||
if ( is_admin() || ! is_singular() ) {
|
||||
return;
|
||||
}
|
||||
|
||||
$post = get_post();
|
||||
if ( ! $post instanceof \WP_Post ) {
|
||||
return;
|
||||
}
|
||||
|
||||
if ( $this->maybeRedirectAfterRegistration( $post ) ) {
|
||||
return;
|
||||
}
|
||||
|
||||
if ( is_user_logged_in() ) {
|
||||
$attrs = $this->firstBlockAttrs( $post->post_content, 'us-scheduler/student-login' );
|
||||
if ( null === $attrs || ! Val::bool( $attrs['autoRedirect'] ?? false ) ) {
|
||||
return;
|
||||
}
|
||||
|
||||
$bookingPageId = Val::int( $attrs['bookingPageId'] ?? 0 );
|
||||
if ( $bookingPageId === $post->ID ) {
|
||||
return; // Redirecting the page to itself would loop.
|
||||
}
|
||||
|
||||
$url = $this->loginPage->bookingUrl( $bookingPageId );
|
||||
if ( null !== $url ) {
|
||||
$this->redirect( $url );
|
||||
}
|
||||
|
||||
return;
|
||||
}
|
||||
|
||||
$attrs = $this->firstBlockAttrs( $post->post_content, 'us-scheduler/booking' );
|
||||
if ( null === $attrs || ! Val::bool( $attrs['autoRedirect'] ?? false ) ) {
|
||||
return;
|
||||
}
|
||||
|
||||
$loginPageId = Val::int( $attrs['loginPageId'] ?? 0 );
|
||||
if ( $loginPageId === $post->ID ) {
|
||||
return; // Redirecting the page to itself would loop.
|
||||
}
|
||||
|
||||
$this->redirect( $this->bookingPage->loginUrl( $loginPageId ) );
|
||||
}
|
||||
|
||||
/**
|
||||
* Sends a student whose registration has just completed to the register
|
||||
* block's chosen page, when the block opts in. Only the finished states
|
||||
* qualify (see {@see RegistrationPage::isRegistrationComplete()}): a
|
||||
* failure or the "check your email" step stays put so its message is read.
|
||||
* Unlike the other blocks there is no login-screen fallback — with no page
|
||||
* chosen there is nowhere to send them, so the link is shown instead.
|
||||
*
|
||||
* Returns whether the redirect was issued (it only ever returns in tests;
|
||||
* {@see redirect()} exits in production).
|
||||
*/
|
||||
private function maybeRedirectAfterRegistration( \WP_Post $post ): bool {
|
||||
// Checked before parsing the content because it is a couple of query
|
||||
// args, whereas every front-end request would otherwise pay for a
|
||||
// third block scan.
|
||||
if ( ! $this->registrationPage->isRegistrationComplete() ) {
|
||||
return false;
|
||||
}
|
||||
|
||||
$attrs = $this->firstBlockAttrs( $post->post_content, 'us-scheduler/student-register' );
|
||||
if ( null === $attrs || ! Val::bool( $attrs['autoRedirect'] ?? false ) ) {
|
||||
return false;
|
||||
}
|
||||
|
||||
$pageId = Val::int( $attrs['loginPageId'] ?? 0 );
|
||||
if ( $pageId === $post->ID ) {
|
||||
return false; // Redirecting the page to itself would loop.
|
||||
}
|
||||
|
||||
$url = $this->registrationPage->continueUrl( $pageId );
|
||||
if ( null === $url ) {
|
||||
return false;
|
||||
}
|
||||
|
||||
$this->redirect( $url );
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* Attributes of the first occurrence of the named block in the content,
|
||||
* searching inner blocks so blocks nested inside groups or columns are
|
||||
* still found. Null when the block is absent. Attributes equal to their
|
||||
* schema default are omitted from the serialized block, so callers must
|
||||
* apply defaults themselves.
|
||||
*
|
||||
* @return array<mixed>|null
|
||||
*/
|
||||
private function firstBlockAttrs( string $content, string $blockName ): ?array {
|
||||
if ( ! has_block( $blockName, $content ) ) {
|
||||
return null;
|
||||
}
|
||||
|
||||
$queue = parse_blocks( $content );
|
||||
|
||||
while ( [] !== $queue ) {
|
||||
$block = array_shift( $queue );
|
||||
|
||||
if ( ! is_array( $block ) ) {
|
||||
continue;
|
||||
}
|
||||
|
||||
if ( ( $block['blockName'] ?? null ) === $blockName ) {
|
||||
$attrs = $block['attrs'] ?? null;
|
||||
|
||||
return is_array( $attrs ) ? $attrs : [];
|
||||
}
|
||||
|
||||
$inner = $block['innerBlocks'] ?? null;
|
||||
if ( is_array( $inner ) && [] !== $inner ) {
|
||||
$queue = array_merge( $queue, array_values( $inner ) );
|
||||
}
|
||||
}
|
||||
|
||||
return null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Issues the redirect and stops the request. Split out so tests can
|
||||
* observe redirects without the process exiting.
|
||||
*/
|
||||
protected function redirect( string $url ): void {
|
||||
wp_safe_redirect( $url );
|
||||
exit;
|
||||
}
|
||||
|
||||
/**
|
||||
* Whether this render is the editor's block-renderer REST preview rather
|
||||
* than a real front-end page render. Front-end template rendering never
|
||||
* happens inside a REST request, so REST_REQUEST is a reliable signal.
|
||||
*/
|
||||
protected function isEditorPreview(): bool {
|
||||
return defined( 'REST_REQUEST' ) && (bool) constant( 'REST_REQUEST' );
|
||||
}
|
||||
}
|
||||
+24
-311
@@ -5,15 +5,11 @@ namespace Unsupervised\Schedular\Booking;
|
||||
|
||||
use Unsupervised\Schedular\Availability\AvailabilityRepository;
|
||||
use Unsupervised\Schedular\Auth\RoleManager;
|
||||
use Unsupervised\Schedular\GroupClass\SessionSchedule;
|
||||
use Unsupervised\Schedular\Guardian\GuardianService;
|
||||
use Unsupervised\Schedular\Offering\Offering;
|
||||
use Unsupervised\Schedular\Offering\OfferingRepository;
|
||||
use Unsupervised\Schedular\Payment\Payment;
|
||||
use Unsupervised\Schedular\Payment\PaymentService;
|
||||
use Unsupervised\Schedular\Policy\PolicyAcceptance;
|
||||
use Unsupervised\Schedular\Registration\RegistrationGate;
|
||||
use Unsupervised\Schedular\Val;
|
||||
|
||||
class BookingEndpoint {
|
||||
|
||||
@@ -29,16 +25,8 @@ class BookingEndpoint {
|
||||
private OfferingRepository $offerings,
|
||||
private RegistrationGate $gate,
|
||||
private PaymentService $payments,
|
||||
private CancellationPolicy $cancellationPolicy,
|
||||
private GuardianService $guardians,
|
||||
private SessionSchedule $sessions,
|
||||
) {}
|
||||
|
||||
/**
|
||||
* Registers this endpoint's REST routes.
|
||||
*
|
||||
* @param non-falsy-string $route_namespace REST namespace the routes are registered under (e.g. `us-scheduler/v1`).
|
||||
*/
|
||||
public function registerRoutes( string $route_namespace ): void {
|
||||
register_rest_route(
|
||||
$route_namespace,
|
||||
@@ -63,13 +51,6 @@ class BookingEndpoint {
|
||||
'type' => 'integer',
|
||||
'default' => 0,
|
||||
],
|
||||
// Who the lesson is for. 0/absent means the caller books for
|
||||
// themselves; a child's id is honoured only for their guardian.
|
||||
'student_id' => [
|
||||
'type' => 'integer',
|
||||
'default' => 0,
|
||||
'sanitize_callback' => 'absint',
|
||||
],
|
||||
'recurrence' => [
|
||||
'type' => 'string',
|
||||
'default' => 'single',
|
||||
@@ -92,18 +73,6 @@ class BookingEndpoint {
|
||||
]
|
||||
);
|
||||
|
||||
register_rest_route(
|
||||
$route_namespace,
|
||||
'/bookings/(?P<id>\d+)/cancel',
|
||||
[
|
||||
[
|
||||
'methods' => \WP_REST_Server::CREATABLE,
|
||||
'callback' => [ $this, 'cancel' ],
|
||||
'permission_callback' => [ $this, 'isLoggedIn' ],
|
||||
],
|
||||
]
|
||||
);
|
||||
|
||||
register_rest_route(
|
||||
$route_namespace,
|
||||
'/bookings/(?P<id>\d+)/status',
|
||||
@@ -125,98 +94,16 @@ class BookingEndpoint {
|
||||
}
|
||||
|
||||
public function myLessons( \WP_REST_Request $request ): \WP_REST_Response { // phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter.Found
|
||||
$userId = get_current_user_id();
|
||||
$now = current_time( 'mysql' );
|
||||
$userId = get_current_user_id();
|
||||
$lessons = current_user_can( RoleManager::CAP_MANAGE_AVAILABILITY )
|
||||
? $this->bookings->findUpcomingForInstructor( $userId )
|
||||
: $this->bookings->findByStudent( $userId );
|
||||
|
||||
// Group classes are listed here too. A term-based class has no row in
|
||||
// us_availability, so nothing that only read lessons could show one, and a
|
||||
// student whose whole week was a group class saw an empty schedule.
|
||||
if ( current_user_can( RoleManager::CAP_MANAGE_AVAILABILITY ) ) {
|
||||
$lessons = $this->bookings->findUpcomingForInstructor( $userId );
|
||||
|
||||
// One row per session the instructor teaches, not per student in it.
|
||||
$sessions = array_map(
|
||||
static fn( array $session ): array => $session + [ 'kind' => SessionSchedule::KIND ],
|
||||
$this->sessions->upcomingForInstructor( $userId, $now )
|
||||
);
|
||||
} else {
|
||||
// A guardian's list covers the whole household — their own lessons and
|
||||
// every child's — merged and re-sorted so the soonest is first
|
||||
// regardless of whose it is.
|
||||
$lessons = [];
|
||||
$sessions = [];
|
||||
foreach ( $this->guardians->householdIds( $userId ) as $studentId ) {
|
||||
$lessons = array_merge( $lessons, $this->bookings->findUpcomingForStudent( $studentId ) );
|
||||
$sessions = array_merge( $sessions, $this->sessionRows( $studentId, $now ) );
|
||||
}
|
||||
}
|
||||
|
||||
$rows = array_merge(
|
||||
array_map( fn( Lesson $l ): array => $this->lessonWithTimes( $l ), $lessons ),
|
||||
$sessions
|
||||
);
|
||||
|
||||
// usort reindexes in place, so the response is already a list.
|
||||
usort( $rows, static fn( array $a, array $b ): int => Val::string( $a['start_dt'] ?? '' ) <=> Val::string( $b['start_dt'] ?? '' ) );
|
||||
|
||||
return new \WP_REST_Response( $rows, 200 );
|
||||
}
|
||||
|
||||
/**
|
||||
* One student's upcoming group-class sessions, shaped like the lesson rows
|
||||
* beside them so a single list renders both. `kind` is what tells them apart:
|
||||
* a session is not a booked slot, so it carries no cancel action.
|
||||
*
|
||||
* @return list<array<string, mixed>>
|
||||
*/
|
||||
private function sessionRows( int $studentId, string $now ): array {
|
||||
return array_map(
|
||||
fn( array $session ): array => $session + [
|
||||
'kind' => SessionSchedule::KIND,
|
||||
'student_name' => $this->guardians->studentName( $studentId ),
|
||||
],
|
||||
$this->sessions->upcomingForStudent( $studentId, $now )
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* A lesson's array form plus its slot's start/end times and the booked
|
||||
* offering's name, so front-end lists can show what the session is and when
|
||||
* it happens without a second request.
|
||||
*
|
||||
* @return array<string, mixed>
|
||||
*/
|
||||
private function lessonWithTimes( Lesson $lesson ): array {
|
||||
$slot = $this->availability->findById( $lesson->slotId );
|
||||
$offering = null !== $lesson->offeringId ? $this->offerings->findById( $lesson->offeringId ) : null;
|
||||
|
||||
// Prefer the offering's own length; fall back to the slot's when the
|
||||
// offering has none (a generic, duration-less type).
|
||||
$duration = null !== $offering && null !== $offering->durationMinutes
|
||||
? $offering->durationMinutes
|
||||
: $slot?->durationMinutes;
|
||||
|
||||
return $lesson->toArray() + [
|
||||
'start_dt' => $slot?->startDt,
|
||||
'end_dt' => $slot?->endDt,
|
||||
'offering_title' => $offering?->title,
|
||||
'duration_minutes' => $duration,
|
||||
// Whose lesson it is, so a guardian's merged list can say which child
|
||||
// each row belongs to.
|
||||
'student_name' => $this->guardians->studentName( $lesson->studentId ),
|
||||
];
|
||||
return new \WP_REST_Response( array_map( fn( Lesson $l ) => $l->toArray(), $lessons ), 200 );
|
||||
}
|
||||
|
||||
public function book( \WP_REST_Request $request ): \WP_REST_Response|\WP_Error {
|
||||
// Who the lesson is for is settled before anything else is touched: an
|
||||
// unauthorised student id must never get as far as claiming a slot, and
|
||||
// certainly never as far as raising a payment against someone's account.
|
||||
$studentId = $this->resolveStudent( $request );
|
||||
if ( $studentId instanceof \WP_Error ) {
|
||||
return $studentId;
|
||||
}
|
||||
|
||||
$slotId = Val::int( $request->get_param( 'slot_id' ) );
|
||||
$slotId = (int) $request->get_param( 'slot_id' );
|
||||
$slot = $this->availability->findById( $slotId );
|
||||
|
||||
if ( null === $slot ) {
|
||||
@@ -233,7 +120,7 @@ class BookingEndpoint {
|
||||
// used must belong to the slot's instructor. This prevents substituting a
|
||||
// cheaper/free offering to dodge payment, or another instructor's offering
|
||||
// to misroute it.
|
||||
$requestedOfferingId = absint( Val::int( $request->get_param( 'offering_id' ) ) );
|
||||
$requestedOfferingId = absint( $request->get_param( 'offering_id' ) );
|
||||
$slotOfferingId = (int) ( $slot->offeringId ?? 0 );
|
||||
|
||||
if ( $slotOfferingId > 0 ) {
|
||||
@@ -245,44 +132,25 @@ class BookingEndpoint {
|
||||
$offeringId = $requestedOfferingId;
|
||||
}
|
||||
|
||||
// Every lesson books against an offering: it carries the price, intake
|
||||
// questions, and payment routing. Without one the booking would silently
|
||||
// be free and unquestioned, so generic slots require the student's choice.
|
||||
if ( $offeringId <= 0 ) {
|
||||
return new \WP_Error( 'offering_required', __( 'Choose a lesson type to book this slot.', 'unsupervised-schedular' ), [ 'status' => 400 ] );
|
||||
}
|
||||
|
||||
$offering = $this->offerings->findById( $offeringId );
|
||||
if ( null === $offering ) {
|
||||
$offering = $offeringId > 0 ? $this->offerings->findById( $offeringId ) : null;
|
||||
if ( $offeringId > 0 && null === $offering ) {
|
||||
return new \WP_Error( 'invalid_offering', __( 'Offering not found.', 'unsupervised-schedular' ), [ 'status' => 400 ] );
|
||||
}
|
||||
|
||||
if ( $offering->instructorId !== $slot->instructorId ) {
|
||||
if ( null !== $offering && $offering->instructorId !== $slot->instructorId ) {
|
||||
return new \WP_Error( 'offering_mismatch', __( 'That offering is not available for this slot.', 'unsupervised-schedular' ), [ 'status' => 400 ] );
|
||||
}
|
||||
|
||||
// A slot-tied offering was the instructor's explicit choice and is honoured
|
||||
// as-is; a student-chosen one must be something the catalog actually offers
|
||||
// for this slot: an active private-lesson type whose length fits the slot.
|
||||
if ( 0 === $slotOfferingId ) {
|
||||
if ( ! $offering->isActive || Offering::KIND_PRIVATE_LESSON !== $offering->kind ) {
|
||||
return new \WP_Error( 'invalid_offering', __( 'That offering cannot be booked as a private lesson.', 'unsupervised-schedular' ), [ 'status' => 400 ] );
|
||||
}
|
||||
|
||||
if ( null !== $offering->durationMinutes && $offering->durationMinutes !== $slot->durationMinutes ) {
|
||||
return new \WP_Error( 'offering_mismatch', __( 'That offering does not match this slot\'s lesson length.', 'unsupervised-schedular' ), [ 'status' => 400 ] );
|
||||
}
|
||||
}
|
||||
|
||||
$answers = $this->answers( $request );
|
||||
$acceptedVersionIds = array_values( array_map( static fn( mixed $v ): int => absint( Val::int( $v ) ), (array) $request->get_param( 'accepted_policy_version_ids' ) ) );
|
||||
$acceptedVersionIds = array_map( 'absint', (array) $request->get_param( 'accepted_policy_version_ids' ) );
|
||||
|
||||
$gateError = $this->gate->validate( $offeringId, $answers, $acceptedVersionIds );
|
||||
if ( $gateError instanceof \WP_Error ) {
|
||||
return $gateError;
|
||||
}
|
||||
|
||||
$notes = Val::string( $request->get_param( 'notes' ) );
|
||||
$studentId = get_current_user_id();
|
||||
$notes = (string) $request->get_param( 'notes' );
|
||||
$recurrence = Lesson::RECURRENCE_WEEKLY === $request->get_param( 'recurrence' )
|
||||
? Lesson::RECURRENCE_WEEKLY
|
||||
: Lesson::RECURRENCE_SINGLE;
|
||||
@@ -291,7 +159,7 @@ class BookingEndpoint {
|
||||
slotId: $slotId,
|
||||
studentId: $studentId,
|
||||
instructorId: $slot->instructorId,
|
||||
offeringId: $offeringId,
|
||||
offeringId: $offeringId > 0 ? $offeringId : null,
|
||||
recurrence: $recurrence,
|
||||
notes: '' !== $notes ? $notes : null,
|
||||
);
|
||||
@@ -321,95 +189,21 @@ class BookingEndpoint {
|
||||
$ids = [ $anchorId ];
|
||||
}
|
||||
|
||||
// The acceptance binds the student but is attributed to whoever actually
|
||||
// ticked the boxes — the guardian, when they booked for a child.
|
||||
$this->gate->record( PolicyAcceptance::REG_LESSON, $anchorId, $studentId, $offeringId, $answers, $acceptedVersionIds, $this->clientIp(), get_current_user_id() );
|
||||
$this->gate->record( PolicyAcceptance::REG_LESSON, $anchorId, $studentId, $offeringId, $answers, $acceptedVersionIds, $this->clientIp() );
|
||||
|
||||
$payment = null;
|
||||
$status = Lesson::STATUS_PENDING;
|
||||
|
||||
// Scheduled billing (weekly / monthly) normally defers payment to the daily
|
||||
// scan, but a single lesson booked once its scheduled due date has already
|
||||
// passed — e.g. an extra lesson added to a month that was already billed — is
|
||||
// charged at booking instead, so it is never missed or billed late.
|
||||
$chargeAtBooking = $offering->price > 0.0 && (
|
||||
! $offering->isScheduledBilling()
|
||||
|| ( 1 === count( $ids ) && $this->scheduledDueHasPassed( $offering, $slot->startDt ) )
|
||||
);
|
||||
|
||||
if ( $chargeAtBooking ) {
|
||||
// A full-term price already covers the whole reservation; a per-lesson
|
||||
// (one_time) price is owed once per occurrence actually claimed, so a
|
||||
// weekly reservation cannot hold a term while paying for one week.
|
||||
$amount = Offering::BILLING_FULL_TERM === $offering->billingMode
|
||||
? $offering->price
|
||||
: $offering->price * count( $ids );
|
||||
|
||||
$payment = $this->payments->createForRegistration(
|
||||
Payment::REG_LESSON,
|
||||
$anchorId,
|
||||
$studentId,
|
||||
$slot->instructorId,
|
||||
$amount,
|
||||
$offering->currency,
|
||||
$offering->etransferEmail,
|
||||
payerId: $this->guardians->payerFor( $studentId )
|
||||
);
|
||||
|
||||
if ( null !== $payment && $payment->isPaid() ) {
|
||||
$status = Lesson::STATUS_CONFIRMED;
|
||||
}
|
||||
} else {
|
||||
// Either a free offering, or scheduled billing (weekly / monthly) whose
|
||||
// payment is deferred to the daily billing scan. Either way there is no
|
||||
// payment step now to confirm the lessons, so the reserved slots are
|
||||
// confirmed at booking time; the billing scan bills them when they come due.
|
||||
foreach ( $ids as $lessonId ) {
|
||||
$this->bookings->updateStatus( $lessonId, Lesson::STATUS_CONFIRMED );
|
||||
}
|
||||
$status = Lesson::STATUS_CONFIRMED;
|
||||
if ( null !== $offering && $offering->price > 0.0 ) {
|
||||
$this->payments->createForRegistration( Payment::REG_LESSON, $anchorId, $studentId, $slot->instructorId, $offering->price, $offering->currency, $offering->etransferEmail );
|
||||
}
|
||||
|
||||
// `payment: null` tells the front end to skip the payment step entirely.
|
||||
return new \WP_REST_Response(
|
||||
[
|
||||
'ids' => $ids,
|
||||
'status' => $status,
|
||||
'payment' => $payment?->toSummaryArray(),
|
||||
'ids' => $ids,
|
||||
'status' => Lesson::STATUS_PENDING,
|
||||
],
|
||||
201
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Who this booking is for: the caller by default, or one of their children
|
||||
* when a `student_id` is supplied and they are that child's guardian.
|
||||
*
|
||||
* This is the authorisation boundary of guardian booking — without it any
|
||||
* signed-in student could book, and bill, against any user id they chose to
|
||||
* send. An id the caller may not act for is a 403, never a silent fallback to
|
||||
* themselves: a guardian who picked the wrong child needs to be told, not to
|
||||
* have the lesson quietly booked in their own name.
|
||||
*/
|
||||
private function resolveStudent( \WP_REST_Request $request ): int|\WP_Error {
|
||||
$userId = get_current_user_id();
|
||||
$requested = absint( Val::int( $request->get_param( 'student_id' ) ) );
|
||||
|
||||
if ( $requested <= 0 || $requested === $userId ) {
|
||||
return $userId;
|
||||
}
|
||||
|
||||
if ( ! $this->guardians->canActFor( $userId, $requested ) ) {
|
||||
return new \WP_Error(
|
||||
'forbidden',
|
||||
__( 'You cannot book on behalf of that student.', 'unsupervised-schedular' ),
|
||||
[ 'status' => 403 ]
|
||||
);
|
||||
}
|
||||
|
||||
return $requested;
|
||||
}
|
||||
|
||||
/**
|
||||
* Extract a question_id => value map from the request.
|
||||
*
|
||||
@@ -418,90 +212,21 @@ class BookingEndpoint {
|
||||
private function answers( \WP_REST_Request $request ): array {
|
||||
$out = [];
|
||||
foreach ( (array) $request->get_param( 'answers' ) as $questionId => $value ) {
|
||||
$out[ (int) $questionId ] = sanitize_text_field( Val::string( $value ) );
|
||||
$out[ (int) $questionId ] = sanitize_text_field( (string) $value );
|
||||
}
|
||||
|
||||
return $out;
|
||||
}
|
||||
|
||||
/**
|
||||
* Whether a scheduled-billing offering's due date for a given session has
|
||||
* already passed at booking time. Weekly bills 24 hours before the lesson;
|
||||
* monthly bills on the 1st, so its due moment has passed once "now" is in the
|
||||
* lesson's month or later. Only meaningful for weekly / monthly offerings.
|
||||
*/
|
||||
private function scheduledDueHasPassed( Offering $offering, string $slotStart ): bool {
|
||||
$now = new \DateTimeImmutable( Val::string( current_time( 'mysql' ) ) );
|
||||
$start = new \DateTimeImmutable( $slotStart );
|
||||
|
||||
if ( Offering::BILLING_MONTHLY === $offering->billingMode ) {
|
||||
return $now->format( 'Y-m-d' ) >= $start->format( 'Y-m-01' );
|
||||
}
|
||||
|
||||
return $now >= $start->modify( '-1 day' );
|
||||
}
|
||||
|
||||
private function clientIp(): ?string {
|
||||
// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- IP stored verbatim for audit.
|
||||
$ip = sanitize_text_field( Val::string( wp_unslash( $_SERVER['REMOTE_ADDR'] ?? '' ) ) );
|
||||
$ip = sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ?? '' ) );
|
||||
|
||||
return '' !== $ip ? $ip : null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Student-initiated cancellation of their own lesson — or a guardian's, of one
|
||||
* of their children's: marks it cancelled,
|
||||
* frees the slot for rebooking, and voids any still-pending payment. A lesson
|
||||
* already paid for is credited back to the student's account (a per-lesson
|
||||
* share of the covering payment) to offset their future scheduled billing.
|
||||
*/
|
||||
public function cancel( \WP_REST_Request $request ): \WP_REST_Response|\WP_Error {
|
||||
$id = absint( Val::int( $request->get_param( 'id' ) ) );
|
||||
$lesson = $this->bookings->findById( $id );
|
||||
|
||||
if ( null === $lesson ) {
|
||||
return new \WP_Error( 'not_found', __( 'Booking not found.', 'unsupervised-schedular' ), [ 'status' => 404 ] );
|
||||
}
|
||||
|
||||
if ( ! $this->guardians->canActFor( get_current_user_id(), $lesson->studentId ) ) {
|
||||
return new \WP_Error( 'forbidden', __( 'You cannot cancel this booking.', 'unsupervised-schedular' ), [ 'status' => 403 ] );
|
||||
}
|
||||
|
||||
if ( Lesson::STATUS_CANCELLED !== $lesson->status ) {
|
||||
$slot = $this->availability->findById( $lesson->slotId );
|
||||
if ( null !== $slot ) {
|
||||
$offering = null !== $lesson->offeringId ? $this->offerings->findById( $lesson->offeringId ) : null;
|
||||
$overrideHours = $offering?->cancellationCutoffHours;
|
||||
if ( ! $this->cancellationPolicy->studentMayCancel( $slot->startDt, $overrideHours ) ) {
|
||||
return new \WP_Error(
|
||||
'cancellation_closed',
|
||||
sprintf(
|
||||
/* translators: %s: humanised cutoff window, e.g. "2 days" or "12 hours". */
|
||||
__( 'This lesson can no longer be cancelled online — cancellations close %s before the lesson starts. Please contact the studio.', 'unsupervised-schedular' ),
|
||||
$this->cancellationPolicy->describeCutoff( $this->cancellationPolicy->cutoffHours( $overrideHours ) )
|
||||
),
|
||||
[ 'status' => 403 ]
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
$this->bookings->updateStatus( $id, Lesson::STATUS_CANCELLED );
|
||||
$this->availability->release( $lesson->slotId );
|
||||
$this->payments->voidPending( $lesson->paymentId );
|
||||
$this->payments->creditForCancelledLesson( $lesson );
|
||||
}
|
||||
|
||||
return new \WP_REST_Response(
|
||||
[
|
||||
'id' => $id,
|
||||
'status' => Lesson::STATUS_CANCELLED,
|
||||
],
|
||||
200
|
||||
);
|
||||
}
|
||||
|
||||
public function updateStatus( \WP_REST_Request $request ): \WP_REST_Response|\WP_Error {
|
||||
$id = absint( Val::int( $request->get_param( 'id' ) ) );
|
||||
$id = absint( $request->get_param( 'id' ) );
|
||||
$lesson = $this->bookings->findById( $id );
|
||||
|
||||
if ( null === $lesson ) {
|
||||
@@ -512,24 +237,12 @@ class BookingEndpoint {
|
||||
return new \WP_Error( 'forbidden', __( 'You cannot update this booking.', 'unsupervised-schedular' ), [ 'status' => 403 ] );
|
||||
}
|
||||
|
||||
$status = Val::string( $request->get_param( 'status' ) );
|
||||
|
||||
if ( Lesson::STATUS_CANCELLED === $status && Lesson::STATUS_CANCELLED !== $lesson->status ) {
|
||||
$this->availability->release( $lesson->slotId );
|
||||
$this->payments->voidPending( $lesson->paymentId );
|
||||
$this->payments->creditForCancelledLesson( $lesson );
|
||||
} elseif ( Lesson::STATUS_CANCELLED === $lesson->status && Lesson::STATUS_CANCELLED !== $status && ! $this->availability->claim( $lesson->slotId ) ) {
|
||||
// Reinstating a cancelled lesson must re-reserve its slot, and
|
||||
// someone else may have booked the freed time in the meantime.
|
||||
return new \WP_Error( 'slot_taken', __( 'This slot is already booked.', 'unsupervised-schedular' ), [ 'status' => 409 ] );
|
||||
}
|
||||
|
||||
$this->bookings->updateStatus( $id, $status );
|
||||
$this->bookings->updateStatus( $id, (string) $request->get_param( 'status' ) );
|
||||
|
||||
return new \WP_REST_Response(
|
||||
[
|
||||
'id' => $id,
|
||||
'status' => $status,
|
||||
'status' => $request->get_param( 'status' ),
|
||||
],
|
||||
200
|
||||
);
|
||||
|
||||
@@ -3,56 +3,25 @@ declare(strict_types=1);
|
||||
|
||||
namespace Unsupervised\Schedular\Booking;
|
||||
|
||||
use Unsupervised\Schedular\Auth\RegistrationStatus;
|
||||
use Unsupervised\Schedular\Auth\RoleManager;
|
||||
use Unsupervised\Schedular\Guardian\GuardianService;
|
||||
use Unsupervised\Schedular\Val;
|
||||
|
||||
class BookingPage {
|
||||
|
||||
/** Booking calendar and the student's upcoming lessons (the default). */
|
||||
public const MODE_BOTH = 'both';
|
||||
|
||||
/** Booking calendar only — no upcoming-lessons panel. */
|
||||
public const MODE_BOOKING = 'booking';
|
||||
|
||||
/** The student's upcoming lessons only — nothing bookable. */
|
||||
public const MODE_UPCOMING = 'upcoming';
|
||||
|
||||
public function __construct( private GuardianService $guardians ) {}
|
||||
|
||||
/**
|
||||
* Renders the booking shortcode/block output.
|
||||
* Renders the booking shortcode output.
|
||||
*
|
||||
* Supported attributes (block / shortcode form):
|
||||
* - `loginPageId` / `login_page_id` — where logged-out visitors are sent.
|
||||
* - `lessonTypeId` / `lesson_type` — a private-lesson offering id that pins
|
||||
* the calendar to one lesson type: only the times bookable as that type
|
||||
* are listed, and only it can be booked. 0 or absent shows every type.
|
||||
* - `showTypeFilter` / `show_filter` — whether the "Show Only" lesson-type
|
||||
* filter is offered (default true; irrelevant when a type is pinned).
|
||||
* - `displayMode` / `show` — which halves of the page to embed:
|
||||
* {@see self::MODE_BOTH} (default), {@see self::MODE_BOOKING} (calendar
|
||||
* only) or {@see self::MODE_UPCOMING} (the student's lessons only).
|
||||
*
|
||||
* @param array<int|string, mixed> $atts Block or shortcode attributes.
|
||||
* @param array<string, string> $atts Shortcode attributes (unused — reserved for future options).
|
||||
*/
|
||||
public function render( array $atts ): string {
|
||||
public function render( array $atts ): string { // phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter.Found
|
||||
if ( ! is_user_logged_in() ) {
|
||||
$loginPageId = Val::int( $atts['loginPageId'] ?? $atts['login_page_id'] ?? 0 );
|
||||
|
||||
return sprintf(
|
||||
'<p>%s <a href="%s">%s</a>.</p>',
|
||||
esc_html__( 'Please', 'unsupervised-schedular' ),
|
||||
esc_url( $this->loginUrl( $loginPageId ) ),
|
||||
esc_url( wp_login_url( get_permalink() ) ),
|
||||
esc_html__( 'log in to book a lesson', 'unsupervised-schedular' )
|
||||
);
|
||||
}
|
||||
|
||||
if ( RegistrationStatus::isAwaitingApproval( get_current_user_id() ) ) {
|
||||
return '<p>' . esc_html__( 'Your account is awaiting studio approval. You will be able to book once a studio admin approves it.', 'unsupervised-schedular' ) . '</p>';
|
||||
}
|
||||
|
||||
if ( ! current_user_can( RoleManager::CAP_BOOK_LESSON ) ) {
|
||||
return '<p>' . esc_html__( 'This page is for students only.', 'unsupervised-schedular' ) . '</p>';
|
||||
}
|
||||
@@ -60,63 +29,8 @@ class BookingPage {
|
||||
wp_enqueue_style( 'us-scheduler' );
|
||||
wp_enqueue_script( 'us-scheduler' );
|
||||
|
||||
$lessonTypeId = absint( Val::int( $atts['lessonTypeId'] ?? $atts['lesson_type'] ?? 0 ) );
|
||||
$showTypeFilter = self::toBool( $atts['showTypeFilter'] ?? $atts['show_filter'] ?? true );
|
||||
|
||||
$mode = self::mode( $atts['displayMode'] ?? $atts['show'] ?? self::MODE_BOTH );
|
||||
$showBooking = self::MODE_UPCOMING !== $mode;
|
||||
$showUpcoming = self::MODE_BOOKING !== $mode;
|
||||
|
||||
// Who this account may book for. A single-student account gets one entry
|
||||
// (themselves) and no selector at all; a guardian's list leads with their
|
||||
// children, so the default choice is never the parent.
|
||||
$students = $this->guardians->bookableStudents( get_current_user_id() );
|
||||
|
||||
ob_start();
|
||||
include USC_PLUGIN_DIR . 'templates/frontend/booking-page.php';
|
||||
return (string) ob_get_clean();
|
||||
}
|
||||
|
||||
/**
|
||||
* Normalises the display-mode attribute; anything unrecognised embeds the
|
||||
* whole page, so a typo never silently hides half of it.
|
||||
*/
|
||||
private static function mode( mixed $value ): string {
|
||||
$mode = strtolower( trim( Val::string( $value ) ) );
|
||||
|
||||
return in_array( $mode, [ self::MODE_BOOKING, self::MODE_UPCOMING ], true ) ? $mode : self::MODE_BOTH;
|
||||
}
|
||||
|
||||
/**
|
||||
* Reads a boolean attribute. Block attributes arrive as real booleans,
|
||||
* shortcode attributes as strings — where the words people actually write
|
||||
* for "off" ("no", "false", "off") are all truthy to PHP, so they are
|
||||
* matched explicitly rather than cast.
|
||||
*/
|
||||
private static function toBool( mixed $value ): bool {
|
||||
if ( is_string( $value ) ) {
|
||||
return ! in_array( strtolower( trim( $value ) ), [ '', '0', 'no', 'false', 'off' ], true );
|
||||
}
|
||||
|
||||
return Val::bool( $value );
|
||||
}
|
||||
|
||||
/**
|
||||
* URL the logged-out prompt sends visitors to: the chosen login page when
|
||||
* one is configured (and still exists), otherwise the WordPress login
|
||||
* screen with a redirect back to the current page.
|
||||
*/
|
||||
public function loginUrl( int $loginPageId ): string {
|
||||
if ( $loginPageId > 0 ) {
|
||||
$url = get_permalink( $loginPageId );
|
||||
|
||||
if ( is_string( $url ) ) {
|
||||
return $url;
|
||||
}
|
||||
}
|
||||
|
||||
$permalink = get_permalink();
|
||||
|
||||
return wp_login_url( false === $permalink ? '' : $permalink );
|
||||
}
|
||||
}
|
||||
|
||||
@@ -80,7 +80,7 @@ class BookingRepository {
|
||||
|
||||
public function findById( int $id ): ?Lesson {
|
||||
$row = $this->db->get_row(
|
||||
$this->db->prepare( 'SELECT * FROM %i WHERE id = %d', $this->table, $id )
|
||||
$this->db->prepare( "SELECT * FROM {$this->table} WHERE id = %d", $id )
|
||||
);
|
||||
|
||||
return $row ? Lesson::fromRow( $row ) : null;
|
||||
@@ -96,14 +96,12 @@ class BookingRepository {
|
||||
|
||||
$rows = $this->db->get_results(
|
||||
$this->db->prepare(
|
||||
'SELECT l.* FROM %i l
|
||||
JOIN %i a ON a.id = l.slot_id
|
||||
"SELECT l.* FROM {$this->table} l
|
||||
JOIN {$avTable} a ON a.id = l.slot_id
|
||||
WHERE l.instructor_id = %d
|
||||
AND l.status != %s
|
||||
AND a.start_dt >= %s
|
||||
ORDER BY a.start_dt ASC',
|
||||
$this->table,
|
||||
$avTable,
|
||||
ORDER BY a.start_dt ASC",
|
||||
$instructorId,
|
||||
Lesson::STATUS_CANCELLED,
|
||||
current_time( 'mysql' )
|
||||
@@ -113,33 +111,6 @@ class BookingRepository {
|
||||
return array_map( Lesson::fromRow( ... ), $rows ?? [] );
|
||||
}
|
||||
|
||||
/**
|
||||
* Upcoming lessons for a student (status != cancelled, slot in the future).
|
||||
*
|
||||
* @return list<Lesson>
|
||||
*/
|
||||
public function findUpcomingForStudent( int $studentId ): array {
|
||||
$avTable = str_replace( 'us_lessons', 'us_availability', $this->table );
|
||||
|
||||
$rows = $this->db->get_results(
|
||||
$this->db->prepare(
|
||||
'SELECT l.* FROM %i l
|
||||
JOIN %i a ON a.id = l.slot_id
|
||||
WHERE l.student_id = %d
|
||||
AND l.status != %s
|
||||
AND a.start_dt >= %s
|
||||
ORDER BY a.start_dt ASC',
|
||||
$this->table,
|
||||
$avTable,
|
||||
$studentId,
|
||||
Lesson::STATUS_CANCELLED,
|
||||
current_time( 'mysql' )
|
||||
)
|
||||
);
|
||||
|
||||
return array_map( Lesson::fromRow( ... ), $rows ?? [] );
|
||||
}
|
||||
|
||||
/**
|
||||
* Count a student's upcoming, non-cancelled lessons (slot in the future).
|
||||
*/
|
||||
@@ -148,13 +119,11 @@ class BookingRepository {
|
||||
|
||||
return (int) $this->db->get_var(
|
||||
$this->db->prepare(
|
||||
'SELECT COUNT(*) FROM %i l
|
||||
JOIN %i a ON a.id = l.slot_id
|
||||
"SELECT COUNT(*) FROM {$this->table} l
|
||||
JOIN {$avTable} a ON a.id = l.slot_id
|
||||
WHERE l.student_id = %d
|
||||
AND l.status != %s
|
||||
AND a.start_dt >= %s',
|
||||
$this->table,
|
||||
$avTable,
|
||||
AND a.start_dt >= %s",
|
||||
$studentId,
|
||||
Lesson::STATUS_CANCELLED,
|
||||
current_time( 'mysql' )
|
||||
@@ -170,8 +139,7 @@ class BookingRepository {
|
||||
public function findByStudent( int $studentId ): array {
|
||||
$rows = $this->db->get_results(
|
||||
$this->db->prepare(
|
||||
'SELECT * FROM %i WHERE student_id = %d ORDER BY created_at DESC',
|
||||
$this->table,
|
||||
"SELECT * FROM {$this->table} WHERE student_id = %d ORDER BY created_at DESC",
|
||||
$studentId
|
||||
)
|
||||
);
|
||||
@@ -189,13 +157,11 @@ class BookingRepository {
|
||||
|
||||
$rows = $this->db->get_results(
|
||||
$this->db->prepare(
|
||||
'SELECT l.* FROM %i l
|
||||
JOIN %i a ON a.id = l.slot_id
|
||||
"SELECT l.* FROM {$this->table} l
|
||||
JOIN {$avTable} a ON a.id = l.slot_id
|
||||
WHERE l.status != %s
|
||||
AND a.start_dt >= %s
|
||||
ORDER BY a.start_dt ASC',
|
||||
$this->table,
|
||||
$avTable,
|
||||
ORDER BY a.start_dt ASC",
|
||||
Lesson::STATUS_CANCELLED,
|
||||
current_time( 'mysql' )
|
||||
)
|
||||
@@ -204,76 +170,6 @@ class BookingRepository {
|
||||
return array_map( Lesson::fromRow( ... ), $rows ?? [] );
|
||||
}
|
||||
|
||||
/**
|
||||
* Not-yet-billed lessons on a scheduled-billing (weekly / monthly) offering:
|
||||
* status not cancelled and no payment attached yet. Each row carries the slot
|
||||
* start time and the offering's billing fields so the daily billing scan can
|
||||
* decide what is due without a second query per lesson. Ordered by student,
|
||||
* offering and time so the scan can group a student's monthly lessons cheaply.
|
||||
*
|
||||
* @return list<\stdClass> Rows: id, student_id, instructor_id, offering_id,
|
||||
* start_dt, billing_mode, title, price, currency,
|
||||
* etransfer_email.
|
||||
*/
|
||||
public function findUnbilledScheduledLessons(): array {
|
||||
$avTable = str_replace( 'us_lessons', 'us_availability', $this->table );
|
||||
$offTable = str_replace( 'us_lessons', 'us_offerings', $this->table );
|
||||
|
||||
$rows = $this->db->get_results(
|
||||
$this->db->prepare(
|
||||
'SELECT l.id, l.student_id, l.instructor_id, l.offering_id,
|
||||
a.start_dt,
|
||||
o.billing_mode, o.title, o.price, o.currency, o.etransfer_email
|
||||
FROM %i l
|
||||
JOIN %i a ON a.id = l.slot_id
|
||||
JOIN %i o ON o.id = l.offering_id
|
||||
WHERE l.status != %s
|
||||
AND l.payment_id IS NULL
|
||||
AND o.billing_mode IN ( %s, %s )
|
||||
ORDER BY l.student_id ASC, l.offering_id ASC, a.start_dt ASC',
|
||||
$this->table,
|
||||
$avTable,
|
||||
$offTable,
|
||||
Lesson::STATUS_CANCELLED,
|
||||
\Unsupervised\Schedular\Offering\Offering::BILLING_WEEKLY,
|
||||
\Unsupervised\Schedular\Offering\Offering::BILLING_MONTHLY
|
||||
)
|
||||
);
|
||||
|
||||
return $rows ?? [];
|
||||
}
|
||||
|
||||
/**
|
||||
* How many lessons a payment covers — every lesson pointed at it, cancelled or
|
||||
* not, since the payment was billed for all of them. Used to split a paid
|
||||
* payment's total into a per-lesson share when one covered lesson is cancelled
|
||||
* and credited. Never below zero.
|
||||
*/
|
||||
public function countByPaymentId( int $paymentId ): int {
|
||||
return (int) $this->db->get_var(
|
||||
$this->db->prepare(
|
||||
'SELECT COUNT(*) FROM %i WHERE payment_id = %d',
|
||||
$this->table,
|
||||
$paymentId
|
||||
)
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* How many lessons belong to a weekly series — the whole reservation an upfront
|
||||
* (full-term) payment covers, so cancelling one lesson credits its per-lesson
|
||||
* share. Counts every lesson in the series, cancelled or not.
|
||||
*/
|
||||
public function countBySeries( int $seriesId ): int {
|
||||
return (int) $this->db->get_var(
|
||||
$this->db->prepare(
|
||||
'SELECT COUNT(*) FROM %i WHERE series_id = %d',
|
||||
$this->table,
|
||||
$seriesId
|
||||
)
|
||||
);
|
||||
}
|
||||
|
||||
public function setPaymentId( int $id, int $paymentId ): bool {
|
||||
return false !== $this->db->update(
|
||||
$this->table,
|
||||
@@ -284,26 +180,6 @@ class BookingRepository {
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Update every non-cancelled lesson in a weekly series at once — e.g.
|
||||
* confirming the whole reservation when its single upfront payment settles.
|
||||
*/
|
||||
public function updateStatusForSeries( int $seriesId, string $status ): bool {
|
||||
if ( ! in_array( $status, Lesson::VALID_STATUSES, true ) ) {
|
||||
return false;
|
||||
}
|
||||
|
||||
$sql = $this->db->prepare(
|
||||
'UPDATE %i SET status = %s WHERE series_id = %d AND status != %s',
|
||||
$this->table,
|
||||
$status,
|
||||
$seriesId,
|
||||
Lesson::STATUS_CANCELLED
|
||||
);
|
||||
|
||||
return null !== $sql && false !== $this->db->query( $sql );
|
||||
}
|
||||
|
||||
public function updateStatus( int $id, string $status ): bool {
|
||||
if ( ! in_array( $status, Lesson::VALID_STATUSES, true ) ) {
|
||||
return false;
|
||||
|
||||
@@ -1,69 +0,0 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace Unsupervised\Schedular\Booking;
|
||||
|
||||
use Unsupervised\Schedular\Payment\StudioSettings;
|
||||
|
||||
/**
|
||||
* Decides whether a student may still cancel a lesson. Cancellation closes once
|
||||
* the lesson starts within the effective cutoff window; instructors and studio
|
||||
* admins bypass this entirely and cancel through other paths.
|
||||
*
|
||||
* The window is resolved per lesson: the offering's own cutoff when it sets one,
|
||||
* otherwise the studio default. Both are expressed in hours.
|
||||
*/
|
||||
class CancellationPolicy {
|
||||
|
||||
public function __construct( private StudioSettings $settings ) {}
|
||||
|
||||
/**
|
||||
* The effective cutoff in hours for a lesson: the offering's override when
|
||||
* set (a non-negative value), otherwise the studio default.
|
||||
*/
|
||||
public function cutoffHours( ?int $offeringCutoffHours ): int {
|
||||
if ( null !== $offeringCutoffHours && $offeringCutoffHours >= 0 ) {
|
||||
return $offeringCutoffHours;
|
||||
}
|
||||
|
||||
return $this->settings->cancellationCutoffHours();
|
||||
}
|
||||
|
||||
/**
|
||||
* Whether a student may still cancel a lesson starting at $slotStartDt
|
||||
* (WordPress-local `Y-m-d H:i:s`), given the offering's optional cutoff
|
||||
* override. A zero cutoff always allows cancellation; unparseable input
|
||||
* fails open so a student is never trapped by bad data. Pass $now to make
|
||||
* the comparison deterministic in tests.
|
||||
*/
|
||||
public function studentMayCancel( string $slotStartDt, ?int $offeringCutoffHours, ?string $now = null ): bool {
|
||||
$hours = $this->cutoffHours( $offeringCutoffHours );
|
||||
if ( $hours <= 0 ) {
|
||||
return true;
|
||||
}
|
||||
|
||||
$start = strtotime( $slotStartDt );
|
||||
$current = strtotime( $now ?? current_time( 'mysql' ) );
|
||||
if ( false === $start || false === $current ) {
|
||||
return true;
|
||||
}
|
||||
|
||||
return ( $start - $current ) >= $hours * 3600;
|
||||
}
|
||||
|
||||
/**
|
||||
* A human-readable description of a cutoff for student-facing messages:
|
||||
* whole days as days, anything else as hours.
|
||||
*/
|
||||
public function describeCutoff( int $hours ): string {
|
||||
if ( $hours > 0 && 0 === $hours % 24 ) {
|
||||
$days = $hours / 24;
|
||||
|
||||
/* translators: %d: number of days. */
|
||||
return sprintf( _n( '%d day', '%d days', $days, 'unsupervised-schedular' ), $days );
|
||||
}
|
||||
|
||||
/* translators: %d: number of hours. */
|
||||
return sprintf( _n( '%d hour', '%d hours', $hours, 'unsupervised-schedular' ), $hours );
|
||||
}
|
||||
}
|
||||
+11
-13
@@ -3,8 +3,6 @@ declare(strict_types=1);
|
||||
|
||||
namespace Unsupervised\Schedular\Booking;
|
||||
|
||||
use Unsupervised\Schedular\Val;
|
||||
|
||||
class Lesson {
|
||||
|
||||
public const STATUS_PENDING = 'pending';
|
||||
@@ -41,18 +39,18 @@ class Lesson {
|
||||
public readonly ?int $id = null,
|
||||
) {}
|
||||
|
||||
public static function fromRow( \stdClass $row ): self {
|
||||
public static function fromRow( object $row ): self {
|
||||
return new self(
|
||||
slotId: Val::int( $row->slot_id ),
|
||||
studentId: Val::int( $row->student_id ),
|
||||
instructorId: Val::int( $row->instructor_id ),
|
||||
offeringId: Val::intOrNull( $row->offering_id ),
|
||||
recurrence: Val::string( $row->recurrence ),
|
||||
seriesId: Val::intOrNull( $row->series_id ),
|
||||
status: Val::string( $row->status ),
|
||||
paymentId: Val::intOrNull( $row->payment_id ),
|
||||
notes: Val::stringOrNull( $row->notes ),
|
||||
id: Val::int( $row->id ),
|
||||
slotId: (int) $row->slot_id,
|
||||
studentId: (int) $row->student_id,
|
||||
instructorId: (int) $row->instructor_id,
|
||||
offeringId: null !== $row->offering_id ? (int) $row->offering_id : null,
|
||||
recurrence: $row->recurrence,
|
||||
seriesId: null !== $row->series_id ? (int) $row->series_id : null,
|
||||
status: $row->status,
|
||||
paymentId: null !== $row->payment_id ? (int) $row->payment_id : null,
|
||||
notes: $row->notes,
|
||||
id: (int) $row->id,
|
||||
);
|
||||
}
|
||||
|
||||
|
||||
@@ -4,22 +4,14 @@ declare(strict_types=1);
|
||||
namespace Unsupervised\Schedular\Booking;
|
||||
|
||||
use Unsupervised\Schedular\Auth\RoleManager;
|
||||
use Unsupervised\Schedular\Availability\AvailabilityRepository;
|
||||
use Unsupervised\Schedular\Availability\AvailabilitySlot;
|
||||
use Unsupervised\Schedular\Availability\WeekCalendar;
|
||||
use Unsupervised\Schedular\Offering\OfferingRepository;
|
||||
use Unsupervised\Schedular\Payment\Payment;
|
||||
use Unsupervised\Schedular\Payment\PaymentRepository;
|
||||
use Unsupervised\Schedular\Val;
|
||||
|
||||
class LessonController {
|
||||
|
||||
public function __construct(
|
||||
private BookingRepository $repository,
|
||||
private PaymentRepository $payments,
|
||||
private AvailabilityRepository $availability,
|
||||
private OfferingRepository $offerings,
|
||||
private LessonDetail $detail,
|
||||
) {}
|
||||
|
||||
public function renderAdminDashboard(): void {
|
||||
@@ -27,15 +19,11 @@ class LessonController {
|
||||
wp_die( esc_html__( 'You do not have permission to view this page.', 'unsupervised-schedular' ) );
|
||||
}
|
||||
|
||||
if ( $this->maybeRenderDetail( 'us-scheduler', false ) ) {
|
||||
return;
|
||||
}
|
||||
|
||||
$this->handleEtransferUpdate( false );
|
||||
|
||||
$rows = array_map( fn( Lesson $lesson ): array => $this->row( $lesson ), $this->repository->findAllUpcoming() );
|
||||
|
||||
$this->renderLessonsPage( $rows, 'us-scheduler' );
|
||||
include USC_PLUGIN_DIR . 'templates/admin/lessons.php';
|
||||
}
|
||||
|
||||
public function renderInstructorLessons(): void {
|
||||
@@ -43,67 +31,10 @@ class LessonController {
|
||||
wp_die( esc_html__( 'You do not have permission to view lessons.', 'unsupervised-schedular' ) );
|
||||
}
|
||||
|
||||
if ( $this->maybeRenderDetail( 'us-my-lessons', true ) ) {
|
||||
return;
|
||||
}
|
||||
|
||||
$this->handleEtransferUpdate( true );
|
||||
|
||||
$rows = array_map( fn( Lesson $lesson ): array => $this->row( $lesson ), $this->repository->findUpcomingForInstructor( get_current_user_id() ) );
|
||||
|
||||
$this->renderLessonsPage( $rows, 'us-my-lessons' );
|
||||
}
|
||||
|
||||
/**
|
||||
* When the request targets a single lesson (`?lesson_id=`), render its detail
|
||||
* view and report that the page has been handled. Instructors may only open
|
||||
* their own lessons; the studio dashboard ($onlyOwn = false) may open any.
|
||||
*/
|
||||
private function maybeRenderDetail( string $pageSlug, bool $onlyOwn ): bool {
|
||||
// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only lesson selector.
|
||||
$lessonId = absint( Val::int( $_GET['lesson_id'] ?? 0 ) );
|
||||
if ( $lessonId <= 0 ) {
|
||||
return false;
|
||||
}
|
||||
|
||||
$lesson = $this->repository->findById( $lessonId );
|
||||
$backUrl = admin_url( 'admin.php?page=' . $pageSlug );
|
||||
|
||||
if ( null === $lesson || ( $onlyOwn && get_current_user_id() !== $lesson->instructorId ) ) {
|
||||
$row = null;
|
||||
$answers = [];
|
||||
$accepts = [];
|
||||
} else {
|
||||
$row = $this->row( $lesson );
|
||||
$answers = $this->detail->answers( $lessonId );
|
||||
$accepts = $this->detail->acceptances( $lessonId );
|
||||
}
|
||||
|
||||
include USC_PLUGIN_DIR . 'templates/admin/lesson-detail.php';
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* Render the lessons template with its calendar view state: week (default)
|
||||
* or list, plus which week the week view shows.
|
||||
*
|
||||
* @param list<array<string, mixed>> $rows
|
||||
*/
|
||||
private function renderLessonsPage( array $rows, string $pageSlug ): void {
|
||||
// View-state query params only (which view, which week) — nothing is
|
||||
// mutated from them, so no nonce applies.
|
||||
// phpcs:disable WordPress.Security.NonceVerification.Recommended
|
||||
$view = 'list' === sanitize_key( Val::string( wp_unslash( $_GET['usc_view'] ?? '' ) ) ) ? 'list' : 'week';
|
||||
$requestedWeek = sanitize_text_field( Val::string( wp_unslash( $_GET['usc_week'] ?? '' ) ) );
|
||||
// phpcs:enable WordPress.Security.NonceVerification.Recommended
|
||||
|
||||
$weekStart = WeekCalendar::weekStart( $requestedWeek, Val::int( get_option( 'start_of_week', 1 ) ), current_time( 'Y-m-d' ) );
|
||||
$weekDays = WeekCalendar::bucket( $weekStart, $rows, static fn( array $row ): string => Val::string( $row['day'] ) );
|
||||
$prevWeek = ( new \DateTimeImmutable( $weekStart ) )->modify( '-7 days' )->format( 'Y-m-d' );
|
||||
$nextWeek = ( new \DateTimeImmutable( $weekStart ) )->modify( '+7 days' )->format( 'Y-m-d' );
|
||||
$baseUrl = admin_url( 'admin.php?page=' . $pageSlug );
|
||||
|
||||
include USC_PLUGIN_DIR . 'templates/admin/lessons.php';
|
||||
}
|
||||
|
||||
@@ -117,11 +48,10 @@ class LessonController {
|
||||
}
|
||||
|
||||
// phpcs:disable WordPress.Security.NonceVerification.Missing -- nonce checked above.
|
||||
$action = sanitize_key( Val::string( wp_unslash( $_POST['usc_action'] ) ) );
|
||||
$paymentId = absint( Val::int( $_POST['payment_id'] ?? 0 ) );
|
||||
$email = sanitize_email( Val::string( wp_unslash( $_POST['etransfer_email'] ?? '' ) ) );
|
||||
// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Val::float() coerces to float; slashes cannot survive numeric coercion.
|
||||
$taxRate = isset( $_POST['tax_rate'] ) ? max( 0.0, Val::float( $_POST['tax_rate'] ) ) : 0.0;
|
||||
$action = sanitize_key( wp_unslash( $_POST['usc_action'] ?? '' ) );
|
||||
$paymentId = absint( $_POST['payment_id'] ?? 0 );
|
||||
$email = sanitize_email( wp_unslash( $_POST['etransfer_email'] ?? '' ) );
|
||||
$taxRate = isset( $_POST['tax_rate'] ) ? max( 0.0, (float) $_POST['tax_rate'] ) : 0.0;
|
||||
// phpcs:enable WordPress.Security.NonceVerification.Missing
|
||||
|
||||
if ( $paymentId <= 0 || ! in_array( $action, [ 'set_etransfer', 'set_tax' ], true ) ) {
|
||||
@@ -151,19 +81,11 @@ class LessonController {
|
||||
$student = get_userdata( $lesson->studentId );
|
||||
$instructor = get_userdata( $lesson->instructorId );
|
||||
$payment = null !== $lesson->paymentId ? $this->payments->findById( $lesson->paymentId ) : null;
|
||||
$slot = $this->availability->findById( $lesson->slotId );
|
||||
$offering = null !== $lesson->offeringId ? $this->offerings->findById( $lesson->offeringId ) : null;
|
||||
|
||||
return [
|
||||
'lesson_id' => (int) $lesson->id,
|
||||
'student' => $student ? $student->display_name : (string) $lesson->studentId,
|
||||
'instructor' => $instructor ? $instructor->display_name : (string) $lesson->instructorId,
|
||||
'offering' => $offering ? $offering->title : '—',
|
||||
'duration' => null !== $offering && null !== $offering->durationMinutes ? $offering->durationMinutes : 0,
|
||||
'recurrence' => $lesson->recurrence,
|
||||
'time' => $slot ? $this->formatSlotTime( $slot ) : '—',
|
||||
'day' => $slot ? substr( $slot->startDt, 0, 10 ) : '',
|
||||
'time_short' => $slot ? Val::string( mysql2date( 'g:i A', $slot->startDt ) ) : '—',
|
||||
'slot_id' => (int) $lesson->slotId,
|
||||
'status' => $lesson->status,
|
||||
'notes' => $lesson->notes ?? '',
|
||||
'payment_id' => $payment ? (int) $payment->id : 0,
|
||||
@@ -177,16 +99,4 @@ class LessonController {
|
||||
'tax_editable' => null !== $payment && ! $payment->isPaid(),
|
||||
];
|
||||
}
|
||||
|
||||
/**
|
||||
* Format a slot's window as e.g. "Jul 6, 2026 9:00 AM–10:00 AM", repeating the
|
||||
* date on the end time only when the slot crosses midnight.
|
||||
*/
|
||||
private function formatSlotTime( AvailabilitySlot $slot ): string {
|
||||
$sameDay = substr( $slot->startDt, 0, 10 ) === substr( $slot->endDt, 0, 10 );
|
||||
|
||||
return Val::string( mysql2date( 'M j, Y g:i A', $slot->startDt ) )
|
||||
. '–'
|
||||
. Val::string( mysql2date( $sameDay ? 'g:i A' : 'M j, Y g:i A', $slot->endDt ) );
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,73 +0,0 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace Unsupervised\Schedular\Booking;
|
||||
|
||||
use Unsupervised\Schedular\Policy\AcceptanceRepository;
|
||||
use Unsupervised\Schedular\Policy\PolicyAcceptance;
|
||||
use Unsupervised\Schedular\Policy\PolicyRepository;
|
||||
use Unsupervised\Schedular\Policy\PolicyVersionRepository;
|
||||
use Unsupervised\Schedular\Registration\Answer;
|
||||
use Unsupervised\Schedular\Registration\AnswerRepository;
|
||||
use Unsupervised\Schedular\Registration\QuestionRepository;
|
||||
|
||||
/**
|
||||
* Builds the display rows for the admin lesson detail view: the intake answers
|
||||
* the student submitted and the policy versions they accepted when booking.
|
||||
*
|
||||
* Scoped to a single lesson (the `lesson` registration type), mirroring the
|
||||
* per-student history in {@see \Unsupervised\Schedular\Auth\StudentHistory}.
|
||||
*/
|
||||
class LessonDetail {
|
||||
|
||||
public function __construct(
|
||||
private AnswerRepository $answers,
|
||||
private QuestionRepository $questions,
|
||||
private AcceptanceRepository $acceptances,
|
||||
private PolicyRepository $policies,
|
||||
private PolicyVersionRepository $versions,
|
||||
) {}
|
||||
|
||||
/**
|
||||
* The intake-question answers recorded for this lesson, in submission order.
|
||||
*
|
||||
* @return list<array{question: string, answer: string}>
|
||||
*/
|
||||
public function answers( int $lessonId ): array {
|
||||
return array_map(
|
||||
function ( Answer $answer ): array {
|
||||
$question = $this->questions->findById( $answer->questionId );
|
||||
$value = $answer->answerValue ?? '';
|
||||
|
||||
return [
|
||||
'question' => $question ? $question->label : sprintf( '#%d', $answer->questionId ),
|
||||
'answer' => '' === $value ? '—' : $value,
|
||||
];
|
||||
},
|
||||
$this->answers->findByRegistration( Answer::REG_LESSON, $lessonId )
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* The policy versions the student accepted when booking this lesson, with the
|
||||
* captured acceptance time and IP for the audit trail.
|
||||
*
|
||||
* @return list<array{policy: string, version: string, accepted_at: string, ip: string}>
|
||||
*/
|
||||
public function acceptances( int $lessonId ): array {
|
||||
return array_map(
|
||||
function ( PolicyAcceptance $acceptance ): array {
|
||||
$version = $this->versions->findById( $acceptance->policyVersionId );
|
||||
$policy = $version ? $this->policies->findById( $version->policyId ) : null;
|
||||
|
||||
return [
|
||||
'policy' => $policy ? $policy->title : sprintf( '#%d', $acceptance->policyVersionId ),
|
||||
'version' => $version ? sprintf( 'v%d', $version->versionNumber ) : '—',
|
||||
'accepted_at' => $acceptance->acceptedAt ?? '',
|
||||
'ip' => $acceptance->ipAddress ?? '',
|
||||
];
|
||||
},
|
||||
$this->acceptances->findByRegistration( PolicyAcceptance::REG_LESSON, $lessonId )
|
||||
);
|
||||
}
|
||||
}
|
||||
@@ -3,8 +3,6 @@ declare(strict_types=1);
|
||||
|
||||
namespace Unsupervised\Schedular\GroupClass;
|
||||
|
||||
use Unsupervised\Schedular\Val;
|
||||
|
||||
class Enrollment {
|
||||
|
||||
public const STATUS_ACTIVE = 'active';
|
||||
@@ -27,14 +25,14 @@ class Enrollment {
|
||||
public readonly ?int $id = null,
|
||||
) {}
|
||||
|
||||
public static function fromRow( \stdClass $row ): self {
|
||||
public static function fromRow( object $row ): self {
|
||||
return new self(
|
||||
offeringId: Val::int( $row->offering_id ),
|
||||
studentId: Val::int( $row->student_id ),
|
||||
instructorId: Val::int( $row->instructor_id ),
|
||||
status: Val::string( $row->status ),
|
||||
paymentId: Val::intOrNull( $row->payment_id ),
|
||||
id: Val::int( $row->id ),
|
||||
offeringId: (int) $row->offering_id,
|
||||
studentId: (int) $row->student_id,
|
||||
instructorId: (int) $row->instructor_id,
|
||||
status: $row->status,
|
||||
paymentId: null !== $row->payment_id ? (int) $row->payment_id : null,
|
||||
id: (int) $row->id,
|
||||
);
|
||||
}
|
||||
|
||||
|
||||
@@ -4,14 +4,12 @@ declare(strict_types=1);
|
||||
namespace Unsupervised\Schedular\GroupClass;
|
||||
|
||||
use Unsupervised\Schedular\Auth\RoleManager;
|
||||
use Unsupervised\Schedular\Guardian\GuardianService;
|
||||
use Unsupervised\Schedular\Offering\Offering;
|
||||
use Unsupervised\Schedular\Offering\OfferingRepository;
|
||||
use Unsupervised\Schedular\Payment\Payment;
|
||||
use Unsupervised\Schedular\Payment\PaymentService;
|
||||
use Unsupervised\Schedular\Policy\PolicyAcceptance;
|
||||
use Unsupervised\Schedular\Registration\RegistrationGate;
|
||||
use Unsupervised\Schedular\Val;
|
||||
|
||||
class EnrollmentEndpoint {
|
||||
|
||||
@@ -20,15 +18,8 @@ class EnrollmentEndpoint {
|
||||
private OfferingRepository $offerings,
|
||||
private RegistrationGate $gate,
|
||||
private PaymentService $payments,
|
||||
private GroupAccessRepository $access,
|
||||
private GuardianService $guardians,
|
||||
) {}
|
||||
|
||||
/**
|
||||
* Registers this endpoint's REST routes.
|
||||
*
|
||||
* @param non-falsy-string $route_namespace REST namespace the routes are registered under (e.g. `us-scheduler/v1`).
|
||||
*/
|
||||
public function registerRoutes( string $route_namespace ): void {
|
||||
register_rest_route(
|
||||
$route_namespace,
|
||||
@@ -49,13 +40,6 @@ class EnrollmentEndpoint {
|
||||
'required' => true,
|
||||
'sanitize_callback' => 'absint',
|
||||
],
|
||||
// Who is being enrolled. 0/absent means the caller enrols
|
||||
// themselves; a child's id is honoured only for their guardian.
|
||||
'student_id' => [
|
||||
'type' => 'integer',
|
||||
'default' => 0,
|
||||
'sanitize_callback' => 'absint',
|
||||
],
|
||||
'answers' => [
|
||||
'type' => 'object',
|
||||
'default' => [],
|
||||
@@ -68,18 +52,6 @@ class EnrollmentEndpoint {
|
||||
],
|
||||
]
|
||||
);
|
||||
|
||||
register_rest_route(
|
||||
$route_namespace,
|
||||
'/enrollments/(?P<id>\d+)/withdraw',
|
||||
[
|
||||
[
|
||||
'methods' => \WP_REST_Server::CREATABLE,
|
||||
'callback' => [ $this, 'withdraw' ],
|
||||
'permission_callback' => [ $this, 'isLoggedIn' ],
|
||||
],
|
||||
]
|
||||
);
|
||||
}
|
||||
|
||||
public function index( \WP_REST_Request $request ): \WP_REST_Response { // phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter.Found
|
||||
@@ -90,54 +62,32 @@ class EnrollmentEndpoint {
|
||||
} elseif ( current_user_can( RoleManager::CAP_MANAGE_AVAILABILITY ) ) {
|
||||
$enrollments = $this->enrollments->findByInstructor( $userId );
|
||||
} else {
|
||||
// A guardian sees the whole household's enrolments — their own and
|
||||
// every child's — so one account covers the family.
|
||||
$enrollments = [];
|
||||
foreach ( $this->guardians->householdIds( $userId ) as $studentId ) {
|
||||
$enrollments = array_merge( $enrollments, $this->enrollments->findByStudent( $studentId ) );
|
||||
}
|
||||
$enrollments = $this->enrollments->findByStudent( $userId );
|
||||
}
|
||||
|
||||
return new \WP_REST_Response( array_map( fn( Enrollment $e ) => $e->toArray(), $enrollments ), 200 );
|
||||
}
|
||||
|
||||
public function enroll( \WP_REST_Request $request ): \WP_REST_Response|\WP_Error {
|
||||
// Who is being enrolled is settled before anything else, so an
|
||||
// unauthorised student id never reaches a seat claim or a charge.
|
||||
$studentId = $this->resolveStudent( $request );
|
||||
if ( $studentId instanceof \WP_Error ) {
|
||||
return $studentId;
|
||||
}
|
||||
|
||||
$offeringId = absint( Val::int( $request->get_param( 'offering_id' ) ) );
|
||||
$offeringId = absint( $request->get_param( 'offering_id' ) );
|
||||
$offering = $this->offerings->findById( $offeringId );
|
||||
|
||||
if ( null === $offering || Offering::KIND_GROUP_CLASS !== $offering->kind ) {
|
||||
return new \WP_Error( 'invalid_offering', __( 'Group class not found.', 'unsupervised-schedular' ), [ 'status' => 404 ] );
|
||||
}
|
||||
|
||||
$studentId = get_current_user_id();
|
||||
|
||||
if ( $this->enrollments->hasActiveEnrollment( $offeringId, $studentId ) ) {
|
||||
return new \WP_Error( 'already_enrolled', __( 'You are already enrolled in this class.', 'unsupervised-schedular' ), [ 'status' => 409 ] );
|
||||
}
|
||||
|
||||
// Invite-only classes can only be enrolled in by students who were granted
|
||||
// access (or added directly); everyone else never sees the class at all.
|
||||
if ( $offering->isInviteOnly() && ! $this->access->hasGrant( $offeringId, $studentId ) ) {
|
||||
return new \WP_Error( 'invite_required', __( 'This class is by invitation only.', 'unsupervised-schedular' ), [ 'status' => 403 ] );
|
||||
}
|
||||
|
||||
// Enrolment closes at the end of the deadline day — the instructor's set
|
||||
// deadline, or the first class day by default.
|
||||
if ( ! $offering->isEnrollmentOpen( Val::string( current_time( 'Y-m-d' ) ) ) ) {
|
||||
return new \WP_Error( 'enrollment_closed', __( 'Enrolment for this class has closed.', 'unsupervised-schedular' ), [ 'status' => 403 ] );
|
||||
}
|
||||
|
||||
if ( null !== $offering->capacity && $this->enrollments->countActiveForOffering( $offeringId ) >= $offering->capacity ) {
|
||||
return new \WP_Error( 'class_full', __( 'This class is full.', 'unsupervised-schedular' ), [ 'status' => 409 ] );
|
||||
}
|
||||
|
||||
$answers = $this->answers( $request );
|
||||
$acceptedVersionIds = array_values( array_map( static fn( mixed $v ): int => absint( Val::int( $v ) ), (array) $request->get_param( 'accepted_policy_version_ids' ) ) );
|
||||
$acceptedVersionIds = array_map( 'absint', (array) $request->get_param( 'accepted_policy_version_ids' ) );
|
||||
|
||||
$gateError = $this->gate->validate( $offeringId, $answers, $acceptedVersionIds );
|
||||
if ( $gateError instanceof \WP_Error ) {
|
||||
@@ -152,85 +102,18 @@ class EnrollmentEndpoint {
|
||||
)
|
||||
);
|
||||
|
||||
// The acceptance binds the student but is attributed to whoever ticked the
|
||||
// boxes — the guardian, when they enrolled a child.
|
||||
$this->gate->record( PolicyAcceptance::REG_ENROLLMENT, $id, $studentId, $offeringId, $answers, $acceptedVersionIds, $this->clientIp(), get_current_user_id() );
|
||||
$this->gate->record( PolicyAcceptance::REG_ENROLLMENT, $id, $studentId, $offeringId, $answers, $acceptedVersionIds, $this->clientIp() );
|
||||
|
||||
// Mark the access grant used so instructor rosters distinguish invited
|
||||
// students from enrolled ones (a no-op for public classes).
|
||||
if ( $offering->isInviteOnly() ) {
|
||||
$this->access->markEnrolled( $offeringId, $studentId );
|
||||
}
|
||||
|
||||
// Scheduled billing (weekly / monthly) is generated later by the daily
|
||||
// billing scan, so nothing is charged at enrolment; the enrolment is active
|
||||
// regardless of payment.
|
||||
$payment = null;
|
||||
if ( $offering->price > 0.0 && ! $offering->isScheduledBilling() ) {
|
||||
$payment = $this->payments->createForRegistration(
|
||||
Payment::REG_ENROLLMENT,
|
||||
$id,
|
||||
$studentId,
|
||||
$offering->instructorId,
|
||||
$offering->price,
|
||||
$offering->currency,
|
||||
$offering->etransferEmail,
|
||||
payerId: $this->guardians->payerFor( $studentId )
|
||||
);
|
||||
}
|
||||
|
||||
// `payment: null` tells the front end to skip the payment step entirely.
|
||||
return new \WP_REST_Response(
|
||||
[
|
||||
'id' => $id,
|
||||
'status' => Enrollment::STATUS_ACTIVE,
|
||||
'payment' => $payment?->toSummaryArray(),
|
||||
],
|
||||
201
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Withdraw the current student from a group class they enrolled in. Allowed
|
||||
* only while the offering's withdrawal deadline is open (a class with no
|
||||
* deadline set stays open indefinitely); once it passes, the student must
|
||||
* contact the studio and an admin withdraws them by hand. A timely withdrawal
|
||||
* frees the seat and voids any still-pending payment but never issues an
|
||||
* account credit — that is reserved for cancelled lessons.
|
||||
*/
|
||||
public function withdraw( \WP_REST_Request $request ): \WP_REST_Response|\WP_Error {
|
||||
$id = absint( Val::int( $request->get_param( 'id' ) ) );
|
||||
$enrollment = $this->enrollments->findById( $id );
|
||||
|
||||
if ( null === $enrollment ) {
|
||||
return new \WP_Error( 'not_found', __( 'Enrolment not found.', 'unsupervised-schedular' ), [ 'status' => 404 ] );
|
||||
}
|
||||
|
||||
if ( ! $this->guardians->canActFor( get_current_user_id(), $enrollment->studentId ) ) {
|
||||
return new \WP_Error( 'forbidden', __( 'You cannot withdraw from this class.', 'unsupervised-schedular' ), [ 'status' => 403 ] );
|
||||
}
|
||||
|
||||
if ( Enrollment::STATUS_ACTIVE === $enrollment->status ) {
|
||||
$offering = $this->offerings->findById( $enrollment->offeringId );
|
||||
|
||||
if ( null !== $offering && ! $offering->isWithdrawalOpen( Val::string( current_time( 'Y-m-d' ) ) ) ) {
|
||||
return new \WP_Error(
|
||||
'withdrawal_closed',
|
||||
__( 'Withdrawal for this class has closed. Please contact the studio.', 'unsupervised-schedular' ),
|
||||
[ 'status' => 403 ]
|
||||
);
|
||||
}
|
||||
|
||||
$this->enrollments->updateStatus( $id, Enrollment::STATUS_CANCELLED );
|
||||
$this->payments->voidPending( $enrollment->paymentId );
|
||||
if ( $offering->price > 0.0 ) {
|
||||
$this->payments->createForRegistration( Payment::REG_ENROLLMENT, $id, $studentId, $offering->instructorId, $offering->price, $offering->currency, $offering->etransferEmail );
|
||||
}
|
||||
|
||||
return new \WP_REST_Response(
|
||||
[
|
||||
'id' => $id,
|
||||
'status' => Enrollment::STATUS_CANCELLED,
|
||||
'status' => Enrollment::STATUS_ACTIVE,
|
||||
],
|
||||
200
|
||||
201
|
||||
);
|
||||
}
|
||||
|
||||
@@ -242,30 +125,6 @@ class EnrollmentEndpoint {
|
||||
return is_user_logged_in() && current_user_can( RoleManager::CAP_BOOK_LESSON );
|
||||
}
|
||||
|
||||
/**
|
||||
* Who this enrolment is for: the caller by default, or one of their children
|
||||
* when a `student_id` is supplied and they are that child's guardian. An id
|
||||
* the caller may not act for is a 403, never a silent fallback to themselves.
|
||||
*/
|
||||
private function resolveStudent( \WP_REST_Request $request ): int|\WP_Error {
|
||||
$userId = get_current_user_id();
|
||||
$requested = absint( Val::int( $request->get_param( 'student_id' ) ) );
|
||||
|
||||
if ( $requested <= 0 || $requested === $userId ) {
|
||||
return $userId;
|
||||
}
|
||||
|
||||
if ( ! $this->guardians->canActFor( $userId, $requested ) ) {
|
||||
return new \WP_Error(
|
||||
'forbidden',
|
||||
__( 'You cannot enrol that student.', 'unsupervised-schedular' ),
|
||||
[ 'status' => 403 ]
|
||||
);
|
||||
}
|
||||
|
||||
return $requested;
|
||||
}
|
||||
|
||||
/**
|
||||
* Extract a question_id => value map from the request.
|
||||
*
|
||||
@@ -274,7 +133,7 @@ class EnrollmentEndpoint {
|
||||
private function answers( \WP_REST_Request $request ): array {
|
||||
$out = [];
|
||||
foreach ( (array) $request->get_param( 'answers' ) as $questionId => $value ) {
|
||||
$out[ (int) $questionId ] = sanitize_text_field( Val::string( $value ) );
|
||||
$out[ (int) $questionId ] = sanitize_text_field( (string) $value );
|
||||
}
|
||||
|
||||
return $out;
|
||||
@@ -282,7 +141,7 @@ class EnrollmentEndpoint {
|
||||
|
||||
private function clientIp(): ?string {
|
||||
// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- IP stored verbatim for audit.
|
||||
$ip = sanitize_text_field( Val::string( wp_unslash( $_SERVER['REMOTE_ADDR'] ?? '' ) ) );
|
||||
$ip = sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ?? '' ) );
|
||||
|
||||
return '' !== $ip ? $ip : null;
|
||||
}
|
||||
|
||||
@@ -30,7 +30,7 @@ class EnrollmentRepository {
|
||||
|
||||
public function findById( int $id ): ?Enrollment {
|
||||
$row = $this->db->get_row(
|
||||
$this->db->prepare( 'SELECT * FROM %i WHERE id = %d', $this->table, $id )
|
||||
$this->db->prepare( "SELECT * FROM {$this->table} WHERE id = %d", $id )
|
||||
);
|
||||
|
||||
return $row ? Enrollment::fromRow( $row ) : null;
|
||||
@@ -42,8 +42,7 @@ class EnrollmentRepository {
|
||||
public function countActiveForOffering( int $offeringId ): int {
|
||||
return (int) $this->db->get_var(
|
||||
$this->db->prepare(
|
||||
'SELECT COUNT(*) FROM %i WHERE offering_id = %d AND status = %s',
|
||||
$this->table,
|
||||
"SELECT COUNT(*) FROM {$this->table} WHERE offering_id = %d AND status = %s",
|
||||
$offeringId,
|
||||
Enrollment::STATUS_ACTIVE
|
||||
)
|
||||
@@ -56,8 +55,7 @@ class EnrollmentRepository {
|
||||
public function countActiveForStudent( int $studentId ): int {
|
||||
return (int) $this->db->get_var(
|
||||
$this->db->prepare(
|
||||
'SELECT COUNT(*) FROM %i WHERE student_id = %d AND status = %s',
|
||||
$this->table,
|
||||
"SELECT COUNT(*) FROM {$this->table} WHERE student_id = %d AND status = %s",
|
||||
$studentId,
|
||||
Enrollment::STATUS_ACTIVE
|
||||
)
|
||||
@@ -70,8 +68,7 @@ class EnrollmentRepository {
|
||||
public function hasActiveEnrollment( int $offeringId, int $studentId ): bool {
|
||||
$count = (int) $this->db->get_var(
|
||||
$this->db->prepare(
|
||||
'SELECT COUNT(*) FROM %i WHERE offering_id = %d AND student_id = %d AND status = %s',
|
||||
$this->table,
|
||||
"SELECT COUNT(*) FROM {$this->table} WHERE offering_id = %d AND student_id = %d AND status = %s",
|
||||
$offeringId,
|
||||
$studentId,
|
||||
Enrollment::STATUS_ACTIVE
|
||||
@@ -89,8 +86,7 @@ class EnrollmentRepository {
|
||||
public function findByStudent( int $studentId ): array {
|
||||
$rows = $this->db->get_results(
|
||||
$this->db->prepare(
|
||||
'SELECT * FROM %i WHERE student_id = %d ORDER BY enrolled_at DESC',
|
||||
$this->table,
|
||||
"SELECT * FROM {$this->table} WHERE student_id = %d ORDER BY enrolled_at DESC",
|
||||
$studentId
|
||||
)
|
||||
);
|
||||
@@ -106,8 +102,7 @@ class EnrollmentRepository {
|
||||
public function findByInstructor( int $instructorId ): array {
|
||||
$rows = $this->db->get_results(
|
||||
$this->db->prepare(
|
||||
'SELECT * FROM %i WHERE instructor_id = %d ORDER BY enrolled_at DESC',
|
||||
$this->table,
|
||||
"SELECT * FROM {$this->table} WHERE instructor_id = %d ORDER BY enrolled_at DESC",
|
||||
$instructorId
|
||||
)
|
||||
);
|
||||
@@ -123,8 +118,7 @@ class EnrollmentRepository {
|
||||
public function findAllActive(): array {
|
||||
$rows = $this->db->get_results(
|
||||
$this->db->prepare(
|
||||
'SELECT * FROM %i WHERE status = %s ORDER BY enrolled_at DESC',
|
||||
$this->table,
|
||||
"SELECT * FROM {$this->table} WHERE status = %s ORDER BY enrolled_at DESC",
|
||||
Enrollment::STATUS_ACTIVE
|
||||
)
|
||||
);
|
||||
@@ -132,39 +126,6 @@ class EnrollmentRepository {
|
||||
return array_map( Enrollment::fromRow( ... ), $rows ?? [] );
|
||||
}
|
||||
|
||||
/**
|
||||
* Active enrolments whose group class bills on a scheduled mode (weekly /
|
||||
* monthly) — the source rows for the daily billing scan. Filtered by joining
|
||||
* the offering so only classes actually on a scheduled plan are returned.
|
||||
*
|
||||
* @param list<string> $modes Billing modes to include (e.g. weekly, monthly).
|
||||
* @return list<Enrollment>
|
||||
*/
|
||||
public function findActiveByBillingModes( array $modes ): array {
|
||||
if ( [] === $modes ) {
|
||||
return [];
|
||||
}
|
||||
|
||||
$offTable = str_replace( 'us_group_enrollments', 'us_offerings', $this->table );
|
||||
$placeholders = implode( ', ', array_fill( 0, count( $modes ), '%s' ) );
|
||||
|
||||
$rows = $this->db->get_results(
|
||||
$this->db->prepare(
|
||||
"SELECT e.* FROM %i e
|
||||
JOIN %i o ON o.id = e.offering_id
|
||||
WHERE e.status = %s
|
||||
AND o.billing_mode IN ( {$placeholders} )
|
||||
ORDER BY e.student_id ASC, e.offering_id ASC",
|
||||
$this->table,
|
||||
$offTable,
|
||||
Enrollment::STATUS_ACTIVE,
|
||||
...$modes
|
||||
)
|
||||
);
|
||||
|
||||
return array_map( Enrollment::fromRow( ... ), $rows ?? [] );
|
||||
}
|
||||
|
||||
public function setPaymentId( int $id, int $paymentId ): bool {
|
||||
return false !== $this->db->update(
|
||||
$this->table,
|
||||
|
||||
@@ -1,67 +0,0 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace Unsupervised\Schedular\GroupClass;
|
||||
|
||||
use Unsupervised\Schedular\Val;
|
||||
|
||||
/**
|
||||
* A grant of access to an invite-only group class. Registered students who have
|
||||
* been "made available" a class hold an `invited` grant (`student_id` set);
|
||||
* email-invited people who do not yet have an account hold a grant keyed by
|
||||
* `email` and linked to a `us_invites` row, which is pointed at the new
|
||||
* `student_id` once they register. A grant flips to `enrolled` when the student
|
||||
* enrols through the normal flow.
|
||||
*/
|
||||
class GroupAccess {
|
||||
|
||||
public const STATUS_INVITED = 'invited';
|
||||
public const STATUS_ENROLLED = 'enrolled';
|
||||
public const STATUS_REVOKED = 'revoked';
|
||||
|
||||
/**
|
||||
* All valid grant statuses.
|
||||
*
|
||||
* @var list<string>
|
||||
*/
|
||||
public const VALID_STATUSES = [ self::STATUS_INVITED, self::STATUS_ENROLLED, self::STATUS_REVOKED ];
|
||||
|
||||
public function __construct(
|
||||
public readonly int $offeringId,
|
||||
public readonly ?int $studentId = null,
|
||||
public readonly string $email = '',
|
||||
public readonly ?int $inviteId = null,
|
||||
public readonly string $status = self::STATUS_INVITED,
|
||||
public readonly ?int $invitedBy = null,
|
||||
public readonly ?int $id = null,
|
||||
) {}
|
||||
|
||||
public static function fromRow( \stdClass $row ): self {
|
||||
return new self(
|
||||
offeringId: Val::int( $row->offering_id ),
|
||||
studentId: Val::intOrNull( $row->student_id ),
|
||||
email: Val::string( $row->email ?? '' ),
|
||||
inviteId: Val::intOrNull( $row->invite_id ?? null ),
|
||||
status: Val::string( $row->status ),
|
||||
invitedBy: Val::intOrNull( $row->invited_by ?? null ),
|
||||
id: Val::int( $row->id ),
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns a plain array representation of the grant.
|
||||
*
|
||||
* @return array<string, mixed>
|
||||
*/
|
||||
public function toArray(): array {
|
||||
return [
|
||||
'id' => $this->id,
|
||||
'offering_id' => $this->offeringId,
|
||||
'student_id' => $this->studentId,
|
||||
'email' => $this->email,
|
||||
'invite_id' => $this->inviteId,
|
||||
'status' => $this->status,
|
||||
'invited_by' => $this->invitedBy,
|
||||
];
|
||||
}
|
||||
}
|
||||
@@ -1,132 +0,0 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace Unsupervised\Schedular\GroupClass;
|
||||
|
||||
class GroupAccessRepository {
|
||||
|
||||
private string $table;
|
||||
|
||||
public function __construct( private \wpdb $db ) {
|
||||
$this->table = $db->prefix . 'us_group_access';
|
||||
}
|
||||
|
||||
public function insert( GroupAccess $access ): int {
|
||||
$this->db->insert(
|
||||
$this->table,
|
||||
[
|
||||
'offering_id' => $access->offeringId,
|
||||
'student_id' => $access->studentId,
|
||||
'email' => $access->email,
|
||||
'invite_id' => $access->inviteId,
|
||||
'status' => $access->status,
|
||||
'invited_by' => $access->invitedBy,
|
||||
'created_at' => current_time( 'mysql' ),
|
||||
],
|
||||
[ '%d', '%d', '%s', '%d', '%s', '%d', '%s' ]
|
||||
);
|
||||
|
||||
return $this->db->insert_id;
|
||||
}
|
||||
|
||||
/**
|
||||
* Whether a student holds a live (invited or enrolled) grant for an offering.
|
||||
*/
|
||||
public function hasGrant( int $offeringId, int $studentId ): bool {
|
||||
$count = (int) $this->db->get_var(
|
||||
$this->db->prepare(
|
||||
'SELECT COUNT(*) FROM %i WHERE offering_id = %d AND student_id = %d AND status IN ( %s, %s )',
|
||||
$this->table,
|
||||
$offeringId,
|
||||
$studentId,
|
||||
GroupAccess::STATUS_INVITED,
|
||||
GroupAccess::STATUS_ENROLLED
|
||||
)
|
||||
);
|
||||
|
||||
return $count > 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* The offering ids a student holds a live grant for — the invite-only classes
|
||||
* to fold into their catalogue view.
|
||||
*
|
||||
* @return list<int>
|
||||
*/
|
||||
public function findGrantedOfferingIds( int $studentId ): array {
|
||||
$rows = $this->db->get_col(
|
||||
$this->db->prepare(
|
||||
'SELECT DISTINCT offering_id FROM %i WHERE student_id = %d AND status IN ( %s, %s )',
|
||||
$this->table,
|
||||
$studentId,
|
||||
GroupAccess::STATUS_INVITED,
|
||||
GroupAccess::STATUS_ENROLLED
|
||||
)
|
||||
);
|
||||
|
||||
return array_values( array_map( \Unsupervised\Schedular\Val::int( ... ), $rows ) );
|
||||
}
|
||||
|
||||
/**
|
||||
* All grants for an offering, newest first.
|
||||
*
|
||||
* @return list<GroupAccess>
|
||||
*/
|
||||
public function findByOffering( int $offeringId ): array {
|
||||
$rows = $this->db->get_results(
|
||||
$this->db->prepare(
|
||||
'SELECT * FROM %i WHERE offering_id = %d ORDER BY id DESC',
|
||||
$this->table,
|
||||
$offeringId
|
||||
)
|
||||
);
|
||||
|
||||
return array_map( GroupAccess::fromRow( ... ), $rows ?? [] );
|
||||
}
|
||||
|
||||
/**
|
||||
* Point email-invite grants for an address at the account created when the
|
||||
* invitation was accepted, so the granted class unlocks for the new student.
|
||||
* Only grants still awaiting an account (`student_id` NULL) are linked.
|
||||
*/
|
||||
public function linkStudentByEmail( string $email, int $studentId ): bool {
|
||||
if ( '' === $email ) {
|
||||
return false;
|
||||
}
|
||||
|
||||
$sql = $this->db->prepare(
|
||||
'UPDATE %i SET student_id = %d WHERE email = %s AND student_id IS NULL',
|
||||
$this->table,
|
||||
$studentId,
|
||||
$email
|
||||
);
|
||||
|
||||
return null !== $sql && false !== $this->db->query( $sql );
|
||||
}
|
||||
|
||||
/**
|
||||
* Flip a student's live grant for an offering to enrolled.
|
||||
*/
|
||||
public function markEnrolled( int $offeringId, int $studentId ): bool {
|
||||
return false !== $this->db->update(
|
||||
$this->table,
|
||||
[ 'status' => GroupAccess::STATUS_ENROLLED ],
|
||||
[
|
||||
'offering_id' => $offeringId,
|
||||
'student_id' => $studentId,
|
||||
],
|
||||
[ '%s' ],
|
||||
[ '%d', '%d' ]
|
||||
);
|
||||
}
|
||||
|
||||
public function revoke( int $id ): bool {
|
||||
return false !== $this->db->update(
|
||||
$this->table,
|
||||
[ 'status' => GroupAccess::STATUS_REVOKED ],
|
||||
[ 'id' => $id ],
|
||||
[ '%s' ],
|
||||
[ '%d' ]
|
||||
);
|
||||
}
|
||||
}
|
||||
@@ -3,513 +3,35 @@ declare(strict_types=1);
|
||||
|
||||
namespace Unsupervised\Schedular\GroupClass;
|
||||
|
||||
use Unsupervised\Schedular\Auth\Invite;
|
||||
use Unsupervised\Schedular\Auth\InviteRepository;
|
||||
use Unsupervised\Schedular\Auth\RegistrationController;
|
||||
use Unsupervised\Schedular\Auth\RegistrationMailer;
|
||||
use Unsupervised\Schedular\Auth\RoleManager;
|
||||
use Unsupervised\Schedular\Auth\UserName;
|
||||
use Unsupervised\Schedular\Offering\Offering;
|
||||
use Unsupervised\Schedular\Offering\OfferingRepository;
|
||||
use Unsupervised\Schedular\Payment\Payment;
|
||||
use Unsupervised\Schedular\Payment\PaymentRepository;
|
||||
use Unsupervised\Schedular\Payment\PaymentService;
|
||||
use Unsupervised\Schedular\Val;
|
||||
|
||||
class GroupClassController {
|
||||
|
||||
public function __construct(
|
||||
private EnrollmentRepository $enrollments,
|
||||
private OfferingRepository $offerings,
|
||||
private PaymentRepository $payments,
|
||||
private GroupAccessRepository $access,
|
||||
private PaymentService $paymentService,
|
||||
private InviteRepository $invites,
|
||||
private RegistrationMailer $mailer,
|
||||
) {}
|
||||
|
||||
/**
|
||||
* Studio-admin overview: every group class across instructors as a summary —
|
||||
* who teaches it, when it meets, and how full it is — rather than a flat list
|
||||
* of individual student enrolments. Selecting a class (`?class_id=<id>`) opens
|
||||
* the same per-class details page instructors use, so a studio admin (including
|
||||
* an owner-operator who also teaches) can view any class's roster and manage
|
||||
* invite-only membership from here.
|
||||
*/
|
||||
public function renderPage(): void {
|
||||
if ( ! current_user_can( RoleManager::CAP_VIEW_ALL_LESSONS ) ) {
|
||||
wp_die( esc_html__( 'You do not have permission to view group classes.', 'unsupervised-schedular' ) );
|
||||
}
|
||||
|
||||
$notice = '';
|
||||
if ( isset( $_POST['usc_action'] ) && check_admin_referer( 'usc_group_action' ) ) {
|
||||
$notice = $this->handleFormAction( get_current_user_id() );
|
||||
}
|
||||
|
||||
$offerings = $this->offerings->findAll( 0, Offering::KIND_GROUP_CLASS );
|
||||
$baseUrl = admin_url( 'admin.php?page=us-group-classes' );
|
||||
|
||||
// View-state query param only (which class to drill into) — nothing is
|
||||
// mutated from it, so no nonce applies.
|
||||
// phpcs:ignore WordPress.Security.NonceVerification.Recommended
|
||||
$classId = absint( Val::int( $_GET['class_id'] ?? 0 ) );
|
||||
$current = null;
|
||||
foreach ( $offerings as $offering ) {
|
||||
if ( $offering->id === $classId ) {
|
||||
$current = $offering;
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
if ( null !== $current ) {
|
||||
// Enrolments are looked up by the class's own instructor; classDetail
|
||||
// filters them down to this offering.
|
||||
$class = $this->classDetail( $current, $this->enrollments->findByInstructor( $current->instructorId ) );
|
||||
$students = $this->studentOptions();
|
||||
|
||||
include USC_PLUGIN_DIR . 'templates/admin/my-group-class-detail.php';
|
||||
|
||||
return;
|
||||
}
|
||||
|
||||
$rows = array_map(
|
||||
function ( Offering $offering ): array {
|
||||
function ( Enrollment $enrollment ): array {
|
||||
$offering = $this->offerings->findById( $enrollment->offeringId );
|
||||
$student = get_userdata( $enrollment->studentId );
|
||||
|
||||
return [
|
||||
'id' => $offering->id,
|
||||
'title' => $offering->title,
|
||||
'instructor' => $this->instructorName( $offering ),
|
||||
'when' => $this->whenLabel( $offering ),
|
||||
'capacity' => $offering->capacity,
|
||||
'enrolled' => $this->enrollments->countActiveForOffering( (int) $offering->id ),
|
||||
'invite_only' => $offering->isInviteOnly(),
|
||||
'student' => $student ? $student->display_name : (string) $enrollment->studentId,
|
||||
'offering' => $offering ? $offering->title : (string) $enrollment->offeringId,
|
||||
'status' => $enrollment->status,
|
||||
];
|
||||
},
|
||||
$offerings
|
||||
$this->enrollments->findAllActive()
|
||||
);
|
||||
|
||||
include USC_PLUGIN_DIR . 'templates/admin/group-classes.php';
|
||||
}
|
||||
|
||||
/**
|
||||
* Instructor view. By default a summary of the instructor's own group classes
|
||||
* — each with when it meets and how many are enrolled — rather than a dump of
|
||||
* every roster. A `class_id` query param drills into one class to show its
|
||||
* roster of enrolled students and, for invite-only classes, the controls to
|
||||
* add, grant access to, or email-invite students.
|
||||
*/
|
||||
public function renderInstructorPage(): void {
|
||||
if ( ! current_user_can( RoleManager::CAP_VIEW_LESSONS ) ) {
|
||||
wp_die( esc_html__( 'You do not have permission to view group classes.', 'unsupervised-schedular' ) );
|
||||
}
|
||||
|
||||
$instructorId = get_current_user_id();
|
||||
|
||||
$notice = '';
|
||||
if ( isset( $_POST['usc_action'] ) && check_admin_referer( 'usc_group_action' ) ) {
|
||||
$notice = $this->handleFormAction( $instructorId );
|
||||
}
|
||||
|
||||
$offerings = $this->offerings->findAll( $instructorId, Offering::KIND_GROUP_CLASS );
|
||||
$enrollments = $this->enrollments->findByInstructor( $instructorId );
|
||||
|
||||
// View-state query param only (which class to drill into) — nothing is
|
||||
// mutated from it, so no nonce applies.
|
||||
// phpcs:ignore WordPress.Security.NonceVerification.Recommended
|
||||
$classId = absint( Val::int( $_GET['class_id'] ?? 0 ) );
|
||||
$current = null;
|
||||
foreach ( $offerings as $offering ) {
|
||||
if ( $offering->id === $classId ) {
|
||||
$current = $offering;
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
if ( null !== $current ) {
|
||||
$baseUrl = admin_url( 'admin.php?page=us-my-group-classes' );
|
||||
$class = $this->classDetail( $current, $enrollments );
|
||||
$students = $this->studentOptions();
|
||||
|
||||
include USC_PLUGIN_DIR . 'templates/admin/my-group-class-detail.php';
|
||||
|
||||
return;
|
||||
}
|
||||
|
||||
$classes = array_map(
|
||||
fn( Offering $offering ): array => $this->classSummary( $offering, $enrollments ),
|
||||
$offerings
|
||||
);
|
||||
|
||||
$baseUrl = admin_url( 'admin.php?page=us-my-group-classes' );
|
||||
|
||||
include USC_PLUGIN_DIR . 'templates/admin/my-group-classes.php';
|
||||
}
|
||||
|
||||
/**
|
||||
* Summary row for one class in the instructor overview: its identity, when it
|
||||
* meets, and how many active enrolments it holds against capacity.
|
||||
*
|
||||
* @param list<Enrollment> $enrollments
|
||||
* @return array{id: int|null, title: string, when: string, capacity: int|null, enrolled: int, invite_only: bool}
|
||||
*/
|
||||
private function classSummary( Offering $offering, array $enrollments ): array {
|
||||
$enrolled = 0;
|
||||
foreach ( $enrollments as $enrollment ) {
|
||||
if ( $enrollment->offeringId === $offering->id && Enrollment::STATUS_ACTIVE === $enrollment->status ) {
|
||||
++$enrolled;
|
||||
}
|
||||
}
|
||||
|
||||
return [
|
||||
'id' => $offering->id,
|
||||
'title' => $offering->title,
|
||||
'when' => $this->whenLabel( $offering ),
|
||||
'capacity' => $offering->capacity,
|
||||
'enrolled' => $enrolled,
|
||||
'invite_only' => $offering->isInviteOnly(),
|
||||
];
|
||||
}
|
||||
|
||||
/**
|
||||
* Full details for one class: the summary fields, the class's own settings
|
||||
* (instructor, price, duration, description, schedule, active state), the
|
||||
* roster of enrolled students (with enrolment and payment status), and — for
|
||||
* invite-only classes — the list of people invited but not yet enrolled.
|
||||
*
|
||||
* @param list<Enrollment> $enrollments
|
||||
* @return array{id: int|null, title: string, when: string, capacity: int|null, enrolled: int, invite_only: bool, instructor: string, price: float, currency: string, duration: int|null, description: string|null, schedule_note: string|null, deadline: string, enrollment_open: bool, active: bool, roster: list<array{student: string, status: string, payment: string|null}>, invited: list<array{who: string, kind: string}>}
|
||||
*/
|
||||
private function classDetail( Offering $offering, array $enrollments ): array {
|
||||
$roster = [];
|
||||
foreach ( $enrollments as $enrollment ) {
|
||||
if ( $enrollment->offeringId !== $offering->id ) {
|
||||
continue;
|
||||
}
|
||||
|
||||
$student = get_userdata( $enrollment->studentId );
|
||||
$payment = null !== $enrollment->paymentId ? $this->payments->findById( $enrollment->paymentId ) : null;
|
||||
|
||||
$roster[] = [
|
||||
'student' => $student ? $student->display_name : (string) $enrollment->studentId,
|
||||
'status' => $enrollment->status,
|
||||
'payment' => $payment?->status,
|
||||
];
|
||||
}
|
||||
|
||||
$deadline = $offering->effectiveEnrollmentDeadline();
|
||||
|
||||
return $this->classSummary( $offering, $enrollments ) + [
|
||||
'instructor' => $this->instructorName( $offering ),
|
||||
'price' => $offering->price,
|
||||
'currency' => $offering->currency,
|
||||
'duration' => $offering->durationMinutes,
|
||||
'description' => $offering->description,
|
||||
'schedule_note' => $offering->scheduleNote,
|
||||
'deadline' => null !== $deadline ? (string) mysql2date( 'M j, Y', $deadline ) : '',
|
||||
'enrollment_open' => $offering->isEnrollmentOpen( Val::string( current_time( 'Y-m-d' ) ) ),
|
||||
'active' => $offering->isActive,
|
||||
'roster' => $roster,
|
||||
'invited' => $offering->isInviteOnly() ? $this->pendingInvites( (int) $offering->id ) : [],
|
||||
];
|
||||
}
|
||||
|
||||
/**
|
||||
* The teaching instructor's display name — their real name or nickname, never
|
||||
* the login. Falls back to the numeric id when the account is gone. See
|
||||
* {@see UserName::format()}.
|
||||
*/
|
||||
private function instructorName( Offering $offering ): string {
|
||||
$user = get_userdata( $offering->instructorId );
|
||||
|
||||
return UserName::format( $user instanceof \WP_User ? $user : null, $offering->instructorId );
|
||||
}
|
||||
|
||||
/**
|
||||
* Human-readable "when" label for a class: the class date (or weekly date
|
||||
* range) and, when set, the start time. Empty when the class has no date.
|
||||
*/
|
||||
private function whenLabel( Offering $offering ): string {
|
||||
if ( null === $offering->termStart ) {
|
||||
return '';
|
||||
}
|
||||
|
||||
$label = null === $offering->termEnd || $offering->termEnd === $offering->termStart
|
||||
? (string) mysql2date( 'M j, Y', $offering->termStart )
|
||||
: (string) mysql2date( 'M j, Y', $offering->termStart ) . ' – ' . (string) mysql2date( 'M j, Y', $offering->termEnd );
|
||||
|
||||
if ( null !== $offering->classTime ) {
|
||||
$label .= ' · ' . (string) mysql2date( 'g:i a', $offering->termStart . ' ' . $offering->classTime );
|
||||
}
|
||||
|
||||
return $label;
|
||||
}
|
||||
|
||||
/**
|
||||
* Pending (not-yet-enrolled) access grants for an invite-only class, shown so
|
||||
* the instructor can see who has been invited but has not enrolled yet.
|
||||
*
|
||||
* @return list<array{who: string, kind: string}>
|
||||
*/
|
||||
private function pendingInvites( int $offeringId ): array {
|
||||
$out = [];
|
||||
foreach ( $this->access->findByOffering( $offeringId ) as $grant ) {
|
||||
if ( GroupAccess::STATUS_INVITED !== $grant->status ) {
|
||||
continue;
|
||||
}
|
||||
|
||||
if ( null !== $grant->studentId ) {
|
||||
$user = get_userdata( $grant->studentId );
|
||||
$out[] = [
|
||||
'who' => $user ? $user->display_name : (string) $grant->studentId,
|
||||
'kind' => __( 'Granted', 'unsupervised-schedular' ),
|
||||
];
|
||||
} else {
|
||||
$out[] = [
|
||||
'who' => $grant->email,
|
||||
'kind' => __( 'Email invite', 'unsupervised-schedular' ),
|
||||
];
|
||||
}
|
||||
}
|
||||
|
||||
return $out;
|
||||
}
|
||||
|
||||
/**
|
||||
* Handle a posted management action, returning a status notice for display.
|
||||
* The action is scoped to a group class the current instructor owns, unless
|
||||
* the caller is a studio admin (`view_all_lessons`) — who may manage any
|
||||
* instructor's class, since the studio-admin Group Classes page reaches the
|
||||
* same controls for every class.
|
||||
*/
|
||||
private function handleFormAction( int $instructorId ): string {
|
||||
// Nonce is verified by the caller before this method runs.
|
||||
// phpcs:disable WordPress.Security.NonceVerification.Missing
|
||||
$action = sanitize_key( Val::string( wp_unslash( $_POST['usc_action'] ?? '' ) ) );
|
||||
$offeringId = absint( Val::int( $_POST['offering_id'] ?? 0 ) );
|
||||
$offering = $offeringId > 0 ? $this->offerings->findById( $offeringId ) : null;
|
||||
|
||||
$ownsOrManagesAll = null !== $offering
|
||||
&& ( $offering->instructorId === $instructorId || current_user_can( RoleManager::CAP_VIEW_ALL_LESSONS ) );
|
||||
|
||||
if ( null === $offering || ! $ownsOrManagesAll || Offering::KIND_GROUP_CLASS !== $offering->kind ) {
|
||||
return esc_html__( 'That group class was not found.', 'unsupervised-schedular' );
|
||||
}
|
||||
|
||||
if ( 'add_direct' === $action ) {
|
||||
return $this->addDirect( $offering, $this->postedStudentIds() );
|
||||
}
|
||||
|
||||
if ( 'grant_access' === $action ) {
|
||||
return $this->grantAccess( $offering, $this->postedStudentIds() );
|
||||
}
|
||||
|
||||
if ( 'invite_email' === $action ) {
|
||||
$email = sanitize_email( Val::string( wp_unslash( $_POST['email'] ?? '' ) ) );
|
||||
|
||||
return $this->inviteEmail( $offering, $email );
|
||||
}
|
||||
// phpcs:enable WordPress.Security.NonceVerification.Missing
|
||||
|
||||
return '';
|
||||
}
|
||||
|
||||
/**
|
||||
* Directly enrol registered students, each with a pending payment at the
|
||||
* class price (comp students are settled immediately by the payment service).
|
||||
*
|
||||
* This is the instructor's manual enrolment path and deliberately bypasses the
|
||||
* enrolment deadline and capacity, so a student can be added as a late
|
||||
* enrolment after the class has closed to self-enrolment.
|
||||
*
|
||||
* @param list<int> $studentIds
|
||||
*/
|
||||
private function addDirect( Offering $offering, array $studentIds ): string {
|
||||
$added = 0;
|
||||
foreach ( $studentIds as $studentId ) {
|
||||
if ( $this->enrollments->hasActiveEnrollment( (int) $offering->id, $studentId ) ) {
|
||||
continue;
|
||||
}
|
||||
|
||||
$enrollmentId = $this->enrollments->insert(
|
||||
new Enrollment(
|
||||
offeringId: (int) $offering->id,
|
||||
studentId: $studentId,
|
||||
instructorId: $offering->instructorId,
|
||||
)
|
||||
);
|
||||
|
||||
if ( $offering->price > 0.0 ) {
|
||||
$payment = $this->paymentService->createForRegistration(
|
||||
Payment::REG_ENROLLMENT,
|
||||
$enrollmentId,
|
||||
$studentId,
|
||||
$offering->instructorId,
|
||||
$offering->price,
|
||||
$offering->currency,
|
||||
$offering->etransferEmail
|
||||
);
|
||||
|
||||
if ( null !== $payment && null !== $payment->id ) {
|
||||
$this->enrollments->setPaymentId( $enrollmentId, $payment->id );
|
||||
}
|
||||
}
|
||||
|
||||
$this->access->markEnrolled( (int) $offering->id, $studentId );
|
||||
++$added;
|
||||
}
|
||||
|
||||
/* translators: %d: number of students added. */
|
||||
return sprintf( esc_html__( '%d student(s) added to the class.', 'unsupervised-schedular' ), $added );
|
||||
}
|
||||
|
||||
/**
|
||||
* Grant registered students access to the class so it appears in their list
|
||||
* for self-enrolment, notifying each by email.
|
||||
*
|
||||
* @param list<int> $studentIds
|
||||
*/
|
||||
private function grantAccess( Offering $offering, array $studentIds ): string {
|
||||
$granted = 0;
|
||||
foreach ( $studentIds as $studentId ) {
|
||||
if (
|
||||
$this->enrollments->hasActiveEnrollment( (int) $offering->id, $studentId )
|
||||
|| $this->access->hasGrant( (int) $offering->id, $studentId )
|
||||
) {
|
||||
continue;
|
||||
}
|
||||
|
||||
$this->access->insert(
|
||||
new GroupAccess(
|
||||
offeringId: (int) $offering->id,
|
||||
studentId: $studentId,
|
||||
status: GroupAccess::STATUS_INVITED,
|
||||
invitedBy: get_current_user_id(),
|
||||
)
|
||||
);
|
||||
|
||||
$user = get_userdata( $studentId );
|
||||
if ( $user instanceof \WP_User ) {
|
||||
$this->mailer->sendClassAccessGranted( $user, $offering->title );
|
||||
}
|
||||
|
||||
++$granted;
|
||||
}
|
||||
|
||||
/* translators: %d: number of students granted access. */
|
||||
return sprintf( esc_html__( '%d student(s) granted access.', 'unsupervised-schedular' ), $granted );
|
||||
}
|
||||
|
||||
/**
|
||||
* Invite someone by email. A registered address is treated as a grant; an
|
||||
* unknown address gets a tokenised registration invite tied to the class,
|
||||
* reusing any pending invite already outstanding for that address (in which
|
||||
* case no new link is sent).
|
||||
*/
|
||||
private function inviteEmail( Offering $offering, string $email ): string {
|
||||
if ( ! is_email( $email ) ) {
|
||||
return esc_html__( 'Enter a valid email address.', 'unsupervised-schedular' );
|
||||
}
|
||||
|
||||
$existingUserId = email_exists( $email );
|
||||
if ( false !== $existingUserId ) {
|
||||
return $this->grantAccess( $offering, [ (int) $existingUserId ] );
|
||||
}
|
||||
|
||||
// Reuse an outstanding invite rather than mailing a second link; still
|
||||
// attach a class grant so enrolment unlocks once they register.
|
||||
$pending = $this->invites->findPendingByEmail( $email );
|
||||
if ( null !== $pending ) {
|
||||
$this->access->insert(
|
||||
new GroupAccess(
|
||||
offeringId: (int) $offering->id,
|
||||
email: $email,
|
||||
inviteId: $pending->id,
|
||||
status: GroupAccess::STATUS_INVITED,
|
||||
invitedBy: get_current_user_id(),
|
||||
)
|
||||
);
|
||||
|
||||
return esc_html__( 'This person already has a pending invitation; the class was added to it. No new link was sent.', 'unsupervised-schedular' );
|
||||
}
|
||||
|
||||
$rawToken = wp_generate_password( 32, false );
|
||||
$inviteId = $this->invites->insert(
|
||||
new Invite(
|
||||
email: $email,
|
||||
token: Invite::hashToken( $rawToken ),
|
||||
invitedBy: get_current_user_id(),
|
||||
offeringId: (int) $offering->id,
|
||||
)
|
||||
);
|
||||
|
||||
if ( $inviteId <= 0 ) {
|
||||
return esc_html__( 'Could not create the invite. Deactivate and reactivate the plugin to update the database, then try again.', 'unsupervised-schedular' );
|
||||
}
|
||||
|
||||
$this->access->insert(
|
||||
new GroupAccess(
|
||||
offeringId: (int) $offering->id,
|
||||
email: $email,
|
||||
inviteId: $inviteId,
|
||||
status: GroupAccess::STATUS_INVITED,
|
||||
invitedBy: get_current_user_id(),
|
||||
)
|
||||
);
|
||||
|
||||
$this->mailer->sendClassInvite( $email, $this->registrationLink( $rawToken ), $offering->title );
|
||||
|
||||
return esc_html__( 'Invitation sent.', 'unsupervised-schedular' );
|
||||
}
|
||||
|
||||
/**
|
||||
* Registered students to offer in the add/grant selects, by display name.
|
||||
*
|
||||
* @return list<array{id: int, name: string}>
|
||||
*/
|
||||
private function studentOptions(): array {
|
||||
$users = array_filter(
|
||||
get_users(
|
||||
[
|
||||
'role' => RoleManager::STUDENT,
|
||||
'orderby' => 'display_name',
|
||||
'order' => 'ASC',
|
||||
]
|
||||
),
|
||||
static fn( mixed $u ): bool => $u instanceof \WP_User
|
||||
);
|
||||
|
||||
return array_values(
|
||||
array_map(
|
||||
static fn( \WP_User $u ): array => [
|
||||
'id' => (int) $u->ID,
|
||||
'name' => '' !== (string) $u->display_name ? (string) $u->display_name : (string) $u->user_email,
|
||||
],
|
||||
$users
|
||||
)
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* The de-duplicated positive student ids posted from a multi-select.
|
||||
*
|
||||
* @return list<int>
|
||||
*/
|
||||
private function postedStudentIds(): array {
|
||||
// Nonce is verified by the caller before this method runs.
|
||||
// phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- each element is coerced to a positive int below; slashes cannot survive integer coercion.
|
||||
$raw = (array) ( $_POST['student_ids'] ?? [] );
|
||||
$ids = array_filter( array_map( static fn( mixed $v ): int => absint( Val::int( $v ) ), $raw ) );
|
||||
|
||||
return array_values( array_unique( $ids ) );
|
||||
}
|
||||
|
||||
/**
|
||||
* Build the registration URL for a raw invite token, mirroring the invites
|
||||
* admin page so class invites land on the same registration page.
|
||||
*/
|
||||
private function registrationLink( string $rawToken ): string {
|
||||
$pageId = Val::int( get_option( RegistrationController::OPTION_PAGE, 0 ) );
|
||||
$linkBase = $pageId > 0 ? (string) get_permalink( $pageId ) : '';
|
||||
|
||||
return add_query_arg( 'us_invite', rawurlencode( $rawToken ), '' !== $linkBase ? $linkBase : home_url( '/' ) );
|
||||
}
|
||||
}
|
||||
|
||||
@@ -4,31 +4,20 @@ declare(strict_types=1);
|
||||
namespace Unsupervised\Schedular\GroupClass;
|
||||
|
||||
use Unsupervised\Schedular\Auth\RoleManager;
|
||||
use Unsupervised\Schedular\Guardian\GuardianService;
|
||||
use Unsupervised\Schedular\Val;
|
||||
|
||||
class GroupClassPage {
|
||||
|
||||
public function __construct( private GuardianService $guardians ) {}
|
||||
|
||||
/**
|
||||
* Renders the group-class enrolment shortcode output.
|
||||
*
|
||||
* Supported attributes: `offering` (shortcode) / `offeringId` (block) — an
|
||||
* offering id that restricts the page to a single class, so the shortcode
|
||||
* can be embedded on a page dedicated to that class. 0 or absent shows the
|
||||
* full browsable catalog.
|
||||
*
|
||||
* @param array<int|string, mixed> $atts Shortcode or block attributes.
|
||||
* @param array<string, string> $atts Shortcode attributes (unused — reserved for future options).
|
||||
*/
|
||||
public function render( array $atts ): string {
|
||||
public function render( array $atts ): string { // phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter.Found
|
||||
if ( ! is_user_logged_in() ) {
|
||||
$permalink = get_permalink();
|
||||
|
||||
return sprintf(
|
||||
'<p>%s <a href="%s">%s</a>.</p>',
|
||||
esc_html__( 'Please', 'unsupervised-schedular' ),
|
||||
esc_url( wp_login_url( false === $permalink ? '' : $permalink ) ),
|
||||
esc_url( wp_login_url( get_permalink() ) ),
|
||||
esc_html__( 'log in to enrol in a class', 'unsupervised-schedular' )
|
||||
);
|
||||
}
|
||||
@@ -40,12 +29,6 @@ class GroupClassPage {
|
||||
wp_enqueue_style( 'us-scheduler' );
|
||||
wp_enqueue_script( 'us-scheduler-group' );
|
||||
|
||||
$offeringId = absint( Val::int( $atts['offering'] ?? $atts['offeringId'] ?? 0 ) );
|
||||
|
||||
// Who this account may enrol — children first, the account holder last, so
|
||||
// a guardian's default choice is a child rather than themselves.
|
||||
$students = $this->guardians->bookableStudents( get_current_user_id() );
|
||||
|
||||
ob_start();
|
||||
include USC_PLUGIN_DIR . 'templates/frontend/group-classes-page.php';
|
||||
return (string) ob_get_clean();
|
||||
|
||||
@@ -1,214 +0,0 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace Unsupervised\Schedular\GroupClass;
|
||||
|
||||
use Unsupervised\Schedular\Offering\Offering;
|
||||
use Unsupervised\Schedular\Offering\OfferingRepository;
|
||||
|
||||
/**
|
||||
* Turns group-class enrolments into dated sessions, so a class can appear
|
||||
* alongside one-to-one lessons in every "upcoming" view.
|
||||
*
|
||||
* A group class is stored as a term (`term_start`, `term_end`, `class_time`)
|
||||
* rather than as rows in `us_availability`, which is why an enrolment on its own
|
||||
* has no date on it and why nothing that listed lessons ever showed one. The
|
||||
* dates come from {@see Offering::sessionStarts()} — the same derivation the
|
||||
* billing scan and the class-slot reconciler build on, so a student's list, an
|
||||
* instructor's list and the invoice all agree on when the class meets.
|
||||
*
|
||||
* **A class you are enrolled in must never silently vanish from the list.** Both
|
||||
* the class time and the duration are optional on the offering form, and the
|
||||
* schedule note exists precisely so a studio can write "Tuesdays 4:00pm" instead
|
||||
* of pinning the class to a clock. So the schedule degrades rather than
|
||||
* disappearing:
|
||||
*
|
||||
* - date **and** time set — one dated row per remaining session, closed off with
|
||||
* the duration when there is one and left open-ended when there is not;
|
||||
* - no time to derive dates from — a single row for the class as a whole, sorted
|
||||
* by when the term starts and labelled with `schedule` text
|
||||
* ({@see Offering::scheduleLabel()}) in place of a time.
|
||||
*
|
||||
* A row's `schedule` is the tell: non-null means "this is a class, described in
|
||||
* words, not a session at a known time", and every renderer shows that text
|
||||
* instead of a date and time.
|
||||
*/
|
||||
class SessionSchedule {
|
||||
|
||||
/**
|
||||
* Marks a row as a group-class session rather than a one-to-one lesson.
|
||||
* Callers use it to withhold the per-lesson actions (cancel, detail links)
|
||||
* that only mean something for a booked slot.
|
||||
*/
|
||||
public const KIND = 'group_class';
|
||||
|
||||
public function __construct(
|
||||
private EnrollmentRepository $enrollments,
|
||||
private OfferingRepository $offerings,
|
||||
) {}
|
||||
|
||||
/**
|
||||
* Upcoming sessions of every class a student is enrolled in, soonest first.
|
||||
*
|
||||
* A withdrawn (cancelled) enrolment contributes nothing; a completed one is
|
||||
* kept, since "completed" describes the enrolment's billing state and says
|
||||
* nothing about whether the class has met yet.
|
||||
*
|
||||
* @return list<array{enrollment_id: int, offering_id: int, offering_title: string, instructor_id: int, status: string, start_dt: string, end_dt: string, duration_minutes: int|null, schedule: string|null}>
|
||||
*/
|
||||
public function upcomingForStudent( int $studentId, string $now ): array {
|
||||
$rows = [];
|
||||
|
||||
foreach ( $this->enrollments->findByStudent( $studentId ) as $enrollment ) {
|
||||
if ( Enrollment::STATUS_CANCELLED === $enrollment->status ) {
|
||||
continue;
|
||||
}
|
||||
|
||||
$offering = $this->offerings->findById( $enrollment->offeringId );
|
||||
if ( null === $offering ) {
|
||||
continue;
|
||||
}
|
||||
|
||||
$rows = array_merge(
|
||||
$rows,
|
||||
$this->rowsFor( $offering, $now, (int) $enrollment->id, $enrollment->instructorId, $enrollment->status )
|
||||
);
|
||||
}
|
||||
|
||||
return self::sortedByStart( $rows );
|
||||
}
|
||||
|
||||
/**
|
||||
* Upcoming sessions of every active group class an instructor teaches,
|
||||
* soonest first — one row per session, not per enrolled student. Enrolments
|
||||
* are not consulted at all: a class the instructor has to turn up and teach
|
||||
* belongs on their schedule whether or not anyone has signed up yet.
|
||||
*
|
||||
* @return list<array{enrollment_id: int, offering_id: int, offering_title: string, instructor_id: int, status: string, start_dt: string, end_dt: string, duration_minutes: int|null, schedule: string|null}>
|
||||
*/
|
||||
public function upcomingForInstructor( int $instructorId, string $now ): array {
|
||||
$rows = [];
|
||||
|
||||
$classes = $this->offerings->findAll( $instructorId, Offering::KIND_GROUP_CLASS, activeOnly: true );
|
||||
|
||||
foreach ( $classes as $offering ) {
|
||||
$rows = array_merge( $rows, $this->rowsFor( $offering, $now, 0, $instructorId, Enrollment::STATUS_ACTIVE ) );
|
||||
}
|
||||
|
||||
return self::sortedByStart( $rows );
|
||||
}
|
||||
|
||||
/**
|
||||
* One class's contribution to an upcoming list: its remaining dated sessions,
|
||||
* or — when it has no time to derive dates from — a single row describing the
|
||||
* class in words. Empty only when the class has demonstrably finished.
|
||||
*
|
||||
* @return list<array{enrollment_id: int, offering_id: int, offering_title: string, instructor_id: int, status: string, start_dt: string, end_dt: string, duration_minutes: int|null, schedule: string|null}>
|
||||
*/
|
||||
private function rowsFor( Offering $offering, string $now, int $enrollmentId, int $instructorId, string $status ): array {
|
||||
$base = [
|
||||
'enrollment_id' => $enrollmentId,
|
||||
'offering_id' => (int) $offering->id,
|
||||
'offering_title' => $offering->title,
|
||||
'instructor_id' => $instructorId,
|
||||
'status' => $status,
|
||||
'duration_minutes' => $offering->durationMinutes,
|
||||
];
|
||||
|
||||
$starts = $offering->sessionStarts();
|
||||
|
||||
// Dated: the class says exactly when it meets, so list what is left of it
|
||||
// — and nothing at all once the term is over.
|
||||
if ( [] !== $starts ) {
|
||||
$rows = [];
|
||||
|
||||
foreach ( $starts as $start ) {
|
||||
if ( $start < $now ) {
|
||||
continue;
|
||||
}
|
||||
|
||||
$rows[] = $base + [
|
||||
'start_dt' => $start,
|
||||
// Left open when no duration is set. Knowing a class starts at
|
||||
// four o'clock is worth showing even without knowing when it
|
||||
// ends; guessing an end time is not.
|
||||
'end_dt' => $this->endOf( $offering, $start ),
|
||||
'schedule' => null,
|
||||
];
|
||||
}
|
||||
|
||||
return $rows;
|
||||
}
|
||||
|
||||
// Undated: no class time, so there is nothing to put on a clock. The class
|
||||
// still gets a row — it is enrolled in and running — described by the
|
||||
// studio's own schedule note or its term dates.
|
||||
if ( ! $this->isStillRunning( $offering, $now ) ) {
|
||||
return [];
|
||||
}
|
||||
|
||||
return [
|
||||
$base + [
|
||||
// A sort key, not a claim about when the class meets: a class yet to
|
||||
// start sorts to its first day, one already under way to right now.
|
||||
// `schedule` is what any renderer actually shows.
|
||||
'start_dt' => $this->sortKeyFor( $offering, $now ),
|
||||
'end_dt' => '',
|
||||
'schedule' => $offering->scheduleLabel(),
|
||||
],
|
||||
];
|
||||
}
|
||||
|
||||
/**
|
||||
* When a session that starts at `$start` finishes, or an empty string when the
|
||||
* class has no duration to close it off with.
|
||||
*/
|
||||
private function endOf( Offering $offering, string $start ): string {
|
||||
if ( null === $offering->durationMinutes || $offering->durationMinutes <= 0 ) {
|
||||
return '';
|
||||
}
|
||||
|
||||
return ( new \DateTimeImmutable( $start ) )
|
||||
->add( new \DateInterval( 'PT' . $offering->durationMinutes . 'M' ) )
|
||||
->format( 'Y-m-d H:i:s' );
|
||||
}
|
||||
|
||||
/**
|
||||
* Whether an undated class still has life in it: its last day has not passed,
|
||||
* or it has no dates at all (in which case nothing says it has ended, and
|
||||
* dropping it would be the very disappearance this class exists to prevent).
|
||||
*/
|
||||
private function isStillRunning( Offering $offering, string $now ): bool {
|
||||
$lastDay = $offering->lastClassDay();
|
||||
|
||||
return null === $lastDay || $lastDay >= substr( $now, 0, 10 );
|
||||
}
|
||||
|
||||
/**
|
||||
* Where an undated class sits in a list ordered by time: at its first day when
|
||||
* that is still ahead, otherwise at `$now`, so a term already under way reads
|
||||
* as current rather than as ancient history.
|
||||
*/
|
||||
private function sortKeyFor( Offering $offering, string $now ): string {
|
||||
if ( null === $offering->termStart ) {
|
||||
return $now;
|
||||
}
|
||||
|
||||
$firstDay = $offering->termStart . ' 00:00:00';
|
||||
|
||||
return $firstDay > $now ? $firstDay : $now;
|
||||
}
|
||||
|
||||
/**
|
||||
* Soonest session first, so classes from separate enrolments interleave by
|
||||
* date rather than arriving grouped by class.
|
||||
*
|
||||
* @param list<array{enrollment_id: int, offering_id: int, offering_title: string, instructor_id: int, status: string, start_dt: string, end_dt: string, duration_minutes: int|null, schedule: string|null}> $rows
|
||||
* @return list<array{enrollment_id: int, offering_id: int, offering_title: string, instructor_id: int, status: string, start_dt: string, end_dt: string, duration_minutes: int|null, schedule: string|null}>
|
||||
*/
|
||||
private static function sortedByStart( array $rows ): array {
|
||||
usort( $rows, static fn( array $a, array $b ): int => strcmp( $a['start_dt'], $b['start_dt'] ) );
|
||||
|
||||
return $rows;
|
||||
}
|
||||
}
|
||||
@@ -1,62 +0,0 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace Unsupervised\Schedular\Guardian;
|
||||
|
||||
use Unsupervised\Schedular\Auth\RoleManager;
|
||||
|
||||
/**
|
||||
* Keeps child accounts unusable as logins. A child holds the `us_student` role
|
||||
* so every `student_id` lookup in the schema keeps working, but nobody is ever
|
||||
* given its credentials — this closes the door the role would otherwise leave
|
||||
* open:
|
||||
*
|
||||
* - authentication is refused outright, and
|
||||
* - the booking capability is withheld, so nothing that reaches a capability
|
||||
* check on a child's own session (there should be none) can book as them.
|
||||
*
|
||||
* Both key off the `us_child` meta, so ordinary students are untouched.
|
||||
*/
|
||||
class ChildLoginGate {
|
||||
|
||||
public function register(): void {
|
||||
add_filter( 'wp_authenticate_user', [ $this, 'blockChildLogin' ], 10, 1 );
|
||||
add_filter( 'user_has_cap', [ $this, 'withholdBooking' ], 10, 4 );
|
||||
}
|
||||
|
||||
/**
|
||||
* Refuse authentication for a child account. Runs after password
|
||||
* verification, so it holds even if a password were somehow set on one.
|
||||
*
|
||||
* @param \WP_User|\WP_Error $user Authenticating user, or an earlier error.
|
||||
* @return \WP_User|\WP_Error
|
||||
*/
|
||||
public function blockChildLogin( $user ) {
|
||||
if ( $user instanceof \WP_User && GuardianService::isChild( (int) $user->ID ) ) {
|
||||
return new \WP_Error(
|
||||
'us_child_account',
|
||||
esc_html__( 'This is a managed student account and cannot be signed in to. Please sign in with the parent or guardian account.', 'unsupervised-schedular' )
|
||||
);
|
||||
}
|
||||
|
||||
return $user;
|
||||
}
|
||||
|
||||
/**
|
||||
* Strip the booking capability from a child account, so the only route to a
|
||||
* lesson in their name is their guardian's authorised booking.
|
||||
*
|
||||
* @param array<string, bool> $allcaps All capabilities currently held.
|
||||
* @param array<int, string> $caps Required capabilities (unused).
|
||||
* @param array<int, mixed> $args Callback args (unused).
|
||||
* @param mixed $user The user being checked (a WP_User in practice).
|
||||
* @return array<string, bool>
|
||||
*/
|
||||
public function withholdBooking( array $allcaps, array $caps, array $args, mixed $user ): array {
|
||||
if ( $user instanceof \WP_User && GuardianService::isChild( (int) $user->ID ) ) {
|
||||
unset( $allcaps[ RoleManager::CAP_BOOK_LESSON ] );
|
||||
}
|
||||
|
||||
return $allcaps;
|
||||
}
|
||||
}
|
||||
@@ -1,284 +0,0 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace Unsupervised\Schedular\Guardian;
|
||||
|
||||
use Unsupervised\Schedular\Registration\Answer;
|
||||
use Unsupervised\Schedular\Registration\AnswerRepository;
|
||||
use Unsupervised\Schedular\Registration\Question;
|
||||
use Unsupervised\Schedular\Registration\QuestionRepository;
|
||||
use Unsupervised\Schedular\Val;
|
||||
|
||||
/**
|
||||
* The guardian's "my family" screen (`[us_family]`): list, add, edit and remove
|
||||
* the children they book for.
|
||||
*
|
||||
* Submissions are processed on `template_redirect` — before any output — and
|
||||
* post/redirect/get back to the page, so a refresh cannot resubmit and add the
|
||||
* same child twice.
|
||||
*/
|
||||
class FamilyPage {
|
||||
|
||||
/** Query flag carrying a completed action back to {@see render()}. */
|
||||
private const RESULT_ADDED = 'added';
|
||||
private const RESULT_UPDATED = 'updated';
|
||||
private const RESULT_REMOVED = 'removed';
|
||||
|
||||
/**
|
||||
* Error from the most recent submission processed on `template_redirect`,
|
||||
* carried over to {@see render()} so it can be shown inline with the form.
|
||||
*/
|
||||
private string $submitError = '';
|
||||
|
||||
public function __construct(
|
||||
private GuardianService $guardians,
|
||||
private QuestionRepository $questions,
|
||||
private AnswerRepository $answers,
|
||||
) {}
|
||||
|
||||
/**
|
||||
* Renders the family shortcode/block output.
|
||||
*
|
||||
* @param array<int|string, mixed> $atts Block attributes (`loginPageId`) or
|
||||
* shortcode attributes (`login_page_id`).
|
||||
*/
|
||||
public function render( array $atts ): string {
|
||||
if ( ! is_user_logged_in() ) {
|
||||
$loginPageId = Val::int( $atts['loginPageId'] ?? $atts['login_page_id'] ?? 0 );
|
||||
|
||||
return sprintf(
|
||||
'<p>%s <a href="%s">%s</a>.</p>',
|
||||
esc_html__( 'Please', 'unsupervised-schedular' ),
|
||||
esc_url( $this->loginUrl( $loginPageId ) ),
|
||||
esc_html__( 'log in to manage your profile', 'unsupervised-schedular' )
|
||||
);
|
||||
}
|
||||
|
||||
wp_enqueue_style( 'us-scheduler' );
|
||||
|
||||
$userId = get_current_user_id();
|
||||
|
||||
$children = $this->guardians->children( $userId );
|
||||
$questions = $this->questions->findByScope( Question::SCOPE_ACCOUNT, activeOnly: true );
|
||||
$error = $this->submitError;
|
||||
|
||||
// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only display flag; the submit that set it was nonce-checked.
|
||||
$result = sanitize_key( Val::string( wp_unslash( $_GET['us_family'] ?? '' ) ) );
|
||||
$notice = $this->noticeFor( $result );
|
||||
|
||||
// Which child the "edit" link opened, if any — the row is swapped for an
|
||||
// editable form rather than every row carrying one.
|
||||
// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only routing; the edit submit is nonce-checked.
|
||||
$editingId = absint( Val::int( $_GET['us_edit_child'] ?? 0 ) );
|
||||
|
||||
ob_start();
|
||||
include USC_PLUGIN_DIR . 'templates/frontend/family-page.php';
|
||||
return (string) ob_get_clean();
|
||||
}
|
||||
|
||||
/**
|
||||
* Process an add/edit/remove submission on `template_redirect`, before any
|
||||
* page output, then post/redirect/get back to the page. An error is stashed
|
||||
* for {@see render()} to show inline with the form.
|
||||
*/
|
||||
public function maybeHandleSubmit(): void {
|
||||
// phpcs:ignore WordPress.Security.NonceVerification.Missing -- routing only; the action is nonce-checked immediately below.
|
||||
$action = sanitize_key( Val::string( wp_unslash( $_POST['us_family_action'] ?? '' ) ) );
|
||||
|
||||
if ( '' === $action || ! is_user_logged_in() ) {
|
||||
return;
|
||||
}
|
||||
|
||||
if ( ! check_admin_referer( 'us_family' ) ) {
|
||||
return;
|
||||
}
|
||||
|
||||
$userId = get_current_user_id();
|
||||
|
||||
$result = match ( $action ) {
|
||||
'add' => $this->handleAdd( $userId ),
|
||||
'edit' => $this->handleEdit( $userId ),
|
||||
'remove' => $this->handleRemove( $userId ),
|
||||
default => new \WP_Error( 'unknown_action', __( 'Unrecognised request.', 'unsupervised-schedular' ) ),
|
||||
};
|
||||
|
||||
if ( $result instanceof \WP_Error ) {
|
||||
$this->submitError = $result->get_error_message();
|
||||
return;
|
||||
}
|
||||
|
||||
$this->redirect( add_query_arg( 'us_family', $result, $this->currentUrl() ) );
|
||||
}
|
||||
|
||||
/**
|
||||
* Add a child, then record their answers to the account-signup questions —
|
||||
* asked per child, since they describe the student rather than the account.
|
||||
*
|
||||
* Required answers are validated *before* the child is created, so a missing
|
||||
* one never leaves a nameless half-added child behind.
|
||||
*/
|
||||
private function handleAdd( int $guardianId ): string|\WP_Error {
|
||||
$name = $this->postString( 'child_name' );
|
||||
$birthYear = $this->postString( 'child_birth_year' );
|
||||
$relationship = $this->postString( 'child_relationship' );
|
||||
|
||||
$questions = $this->questions->findByScope( Question::SCOPE_ACCOUNT, activeOnly: true );
|
||||
$answers = $this->submittedAnswers();
|
||||
|
||||
$missing = $this->firstMissingAnswer( $questions, $answers );
|
||||
if ( null !== $missing ) {
|
||||
return $missing;
|
||||
}
|
||||
|
||||
$childId = $this->guardians->createChild( $guardianId, $name, $birthYear, $relationship );
|
||||
if ( $childId instanceof \WP_Error ) {
|
||||
return $childId;
|
||||
}
|
||||
|
||||
$this->recordAnswers( $questions, $answers, $childId );
|
||||
|
||||
return self::RESULT_ADDED;
|
||||
}
|
||||
|
||||
private function handleEdit( int $guardianId ): string|\WP_Error {
|
||||
// phpcs:ignore WordPress.Security.NonceVerification.Missing -- nonce checked by the caller.
|
||||
$childId = absint( Val::int( $_POST['child_id'] ?? 0 ) );
|
||||
|
||||
$error = $this->guardians->updateChild( $guardianId, $childId, $this->postString( 'child_name' ), $this->postString( 'child_birth_year' ) );
|
||||
|
||||
return $error ?? self::RESULT_UPDATED;
|
||||
}
|
||||
|
||||
private function handleRemove( int $guardianId ): string|\WP_Error {
|
||||
// phpcs:ignore WordPress.Security.NonceVerification.Missing -- nonce checked by the caller.
|
||||
$childId = absint( Val::int( $_POST['child_id'] ?? 0 ) );
|
||||
|
||||
$error = $this->guardians->removeChild( $guardianId, $childId );
|
||||
|
||||
return $error ?? self::RESULT_REMOVED;
|
||||
}
|
||||
|
||||
/**
|
||||
* The first required question left unanswered, as the error to show — or null
|
||||
* when every required question has a value.
|
||||
*
|
||||
* @param list<Question> $questions
|
||||
* @param array<int, string> $answers question_id => submitted value
|
||||
*/
|
||||
private function firstMissingAnswer( array $questions, array $answers ): ?\WP_Error {
|
||||
foreach ( $questions as $question ) {
|
||||
if ( $question->isRequired && '' === trim( (string) ( $answers[ (int) $question->id ] ?? '' ) ) ) {
|
||||
return new \WP_Error( 'missing_answer', __( 'Please answer all required questions for this student.', 'unsupervised-schedular' ) );
|
||||
}
|
||||
}
|
||||
|
||||
return null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Persist a child's answers to the account-signup questions. The answer is
|
||||
* recorded against the child, not the guardian, so a studio admin reading a
|
||||
* child's screen sees the information that describes them.
|
||||
*
|
||||
* @param list<Question> $questions
|
||||
* @param array<int, string> $answers question_id => submitted value
|
||||
*/
|
||||
private function recordAnswers( array $questions, array $answers, int $childId ): void {
|
||||
foreach ( $questions as $question ) {
|
||||
$value = trim( (string) ( $answers[ (int) $question->id ] ?? '' ) );
|
||||
if ( '' === $value ) {
|
||||
continue;
|
||||
}
|
||||
|
||||
$this->answers->insert(
|
||||
new Answer(
|
||||
questionId: (int) $question->id,
|
||||
registrationType: Answer::REG_ACCOUNT,
|
||||
registrationId: $childId,
|
||||
studentId: $childId,
|
||||
answerValue: $value,
|
||||
)
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* The account-question answers submitted with the form, keyed by question id.
|
||||
*
|
||||
* @return array<int, string>
|
||||
*/
|
||||
private function submittedAnswers(): array {
|
||||
// phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- nonce checked by the caller; each value is unslashed and sanitized in the loop below.
|
||||
$raw = $_POST['us_answers'] ?? [];
|
||||
if ( ! is_array( $raw ) ) {
|
||||
return [];
|
||||
}
|
||||
|
||||
$out = [];
|
||||
foreach ( $raw as $questionId => $value ) {
|
||||
$out[ absint( Val::int( $questionId ) ) ] = sanitize_textarea_field( Val::string( wp_unslash( $value ) ) );
|
||||
}
|
||||
|
||||
return $out;
|
||||
}
|
||||
|
||||
/**
|
||||
* A sanitized text field from the submission. The caller has already verified
|
||||
* the nonce.
|
||||
*/
|
||||
private function postString( string $key ): string {
|
||||
// phpcs:ignore WordPress.Security.NonceVerification.Missing -- nonce checked by the caller.
|
||||
return sanitize_text_field( Val::string( wp_unslash( $_POST[ $key ] ?? '' ) ) );
|
||||
}
|
||||
|
||||
/**
|
||||
* The confirmation to show for a completed action, or an empty string when
|
||||
* the flag is absent or unrecognised.
|
||||
*/
|
||||
private function noticeFor( string $result ): string {
|
||||
return match ( $result ) {
|
||||
self::RESULT_ADDED => __( 'Student added.', 'unsupervised-schedular' ),
|
||||
self::RESULT_UPDATED => __( 'Details updated.', 'unsupervised-schedular' ),
|
||||
self::RESULT_REMOVED => __( 'Student removed.', 'unsupervised-schedular' ),
|
||||
default => '',
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* The current page's clean permalink, used as the post/redirect/get target so
|
||||
* the edit flag and any stale notice are dropped from the URL.
|
||||
*/
|
||||
private function currentUrl(): string {
|
||||
$url = get_permalink();
|
||||
|
||||
return is_string( $url ) ? $url : home_url( '/' );
|
||||
}
|
||||
|
||||
/**
|
||||
* Issues the post-submit redirect and stops the request. Split out so tests
|
||||
* can observe the target without the process exiting.
|
||||
*/
|
||||
protected function redirect( string $url ): void {
|
||||
wp_safe_redirect( $url );
|
||||
exit;
|
||||
}
|
||||
|
||||
/**
|
||||
* URL the logged-out prompt sends visitors to: the chosen login page when one
|
||||
* is configured (and still exists), otherwise the WordPress login screen with
|
||||
* a redirect back to the current page.
|
||||
*/
|
||||
public function loginUrl( int $loginPageId ): string {
|
||||
if ( $loginPageId > 0 ) {
|
||||
$url = get_permalink( $loginPageId );
|
||||
|
||||
if ( is_string( $url ) ) {
|
||||
return $url;
|
||||
}
|
||||
}
|
||||
|
||||
$permalink = get_permalink();
|
||||
|
||||
return wp_login_url( false === $permalink ? '' : $permalink );
|
||||
}
|
||||
}
|
||||
@@ -1,47 +0,0 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace Unsupervised\Schedular\Guardian;
|
||||
|
||||
use Unsupervised\Schedular\Val;
|
||||
|
||||
/**
|
||||
* One parent/guardian ↔ child link. The child is a real (login-less) WordPress
|
||||
* user, so `studentId` is a `wp_users` ID exactly like every other student id in
|
||||
* the schema — this row only records who books and pays on their behalf.
|
||||
*/
|
||||
class GuardianLink {
|
||||
|
||||
public function __construct(
|
||||
public readonly int $guardianId,
|
||||
public readonly int $studentId,
|
||||
public readonly string $relationship = '',
|
||||
public readonly ?string $createdAt = null,
|
||||
public readonly ?int $id = null,
|
||||
) {}
|
||||
|
||||
public static function fromRow( \stdClass $row ): self {
|
||||
return new self(
|
||||
guardianId: Val::int( $row->guardian_id ),
|
||||
studentId: Val::int( $row->student_id ),
|
||||
relationship: Val::string( $row->relationship ?? '' ),
|
||||
createdAt: Val::stringOrNull( $row->created_at ?? null ),
|
||||
id: Val::int( $row->id ),
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns a plain array representation of the link.
|
||||
*
|
||||
* @return array<string, mixed>
|
||||
*/
|
||||
public function toArray(): array {
|
||||
return [
|
||||
'id' => $this->id,
|
||||
'guardian_id' => $this->guardianId,
|
||||
'student_id' => $this->studentId,
|
||||
'relationship' => $this->relationship,
|
||||
'created_at' => $this->createdAt,
|
||||
];
|
||||
}
|
||||
}
|
||||
@@ -1,122 +0,0 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace Unsupervised\Schedular\Guardian;
|
||||
|
||||
class GuardianRepository {
|
||||
|
||||
private string $table;
|
||||
|
||||
public function __construct( private \wpdb $db ) {
|
||||
$this->table = $db->prefix . 'us_guardians';
|
||||
}
|
||||
|
||||
/**
|
||||
* Link a child to a guardian. Returns 0 without inserting when the child
|
||||
* already has a guardian: v1 is one guardian per child, and the check lives
|
||||
* here so every caller (signup, the family screen, admin) gets it.
|
||||
*/
|
||||
public function insert( GuardianLink $link ): int {
|
||||
if ( null !== $this->findByStudent( $link->studentId ) ) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
$this->db->insert(
|
||||
$this->table,
|
||||
[
|
||||
'guardian_id' => $link->guardianId,
|
||||
'student_id' => $link->studentId,
|
||||
'relationship' => $link->relationship,
|
||||
'created_at' => current_time( 'mysql' ),
|
||||
],
|
||||
[ '%d', '%d', '%s', '%s' ]
|
||||
);
|
||||
|
||||
return $this->db->insert_id;
|
||||
}
|
||||
|
||||
/**
|
||||
* The link naming this child's guardian, or null when they book for
|
||||
* themselves.
|
||||
*/
|
||||
public function findByStudent( int $studentId ): ?GuardianLink {
|
||||
$row = $this->db->get_row(
|
||||
$this->db->prepare(
|
||||
'SELECT * FROM %i WHERE student_id = %d LIMIT 1',
|
||||
$this->table,
|
||||
$studentId
|
||||
)
|
||||
);
|
||||
|
||||
return $row ? GuardianLink::fromRow( $row ) : null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Every child linked to a guardian, oldest link first — the order they are
|
||||
* offered in the booking selector, so it stays stable as children are added.
|
||||
*
|
||||
* @return list<GuardianLink>
|
||||
*/
|
||||
public function findByGuardian( int $guardianId ): array {
|
||||
$rows = $this->db->get_results(
|
||||
$this->db->prepare(
|
||||
'SELECT * FROM %i WHERE guardian_id = %d ORDER BY created_at ASC, id ASC',
|
||||
$this->table,
|
||||
$guardianId
|
||||
)
|
||||
);
|
||||
|
||||
return array_map( GuardianLink::fromRow( ... ), $rows ?? [] );
|
||||
}
|
||||
|
||||
/**
|
||||
* Whether this exact guardian↔child pair is linked — the authorisation check
|
||||
* behind every "act for this student" boundary.
|
||||
*/
|
||||
public function isGuardianOf( int $guardianId, int $studentId ): bool {
|
||||
$found = $this->db->get_var(
|
||||
$this->db->prepare(
|
||||
'SELECT id FROM %i WHERE guardian_id = %d AND student_id = %d LIMIT 1',
|
||||
$this->table,
|
||||
$guardianId,
|
||||
$studentId
|
||||
)
|
||||
);
|
||||
|
||||
return null !== $found;
|
||||
}
|
||||
|
||||
/**
|
||||
* Remove the link between a guardian and one of their children. Deleting the
|
||||
* child user itself is the caller's decision ({@see GuardianService::removeChild()});
|
||||
* this only unlinks.
|
||||
*/
|
||||
public function delete( int $guardianId, int $studentId ): bool {
|
||||
$deleted = $this->db->delete(
|
||||
$this->table,
|
||||
[
|
||||
'guardian_id' => $guardianId,
|
||||
'student_id' => $studentId,
|
||||
],
|
||||
[ '%d', '%d' ]
|
||||
);
|
||||
|
||||
return (int) $deleted > 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* How many children a guardian has — enough to decide whether the booking
|
||||
* page needs a "who is this for?" selector at all.
|
||||
*/
|
||||
public function countChildren( int $guardianId ): int {
|
||||
$count = $this->db->get_var(
|
||||
$this->db->prepare(
|
||||
'SELECT COUNT(*) FROM %i WHERE guardian_id = %d',
|
||||
$this->table,
|
||||
$guardianId
|
||||
)
|
||||
);
|
||||
|
||||
return (int) $count;
|
||||
}
|
||||
}
|
||||
@@ -1,499 +0,0 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace Unsupervised\Schedular\Guardian;
|
||||
|
||||
use Unsupervised\Schedular\Auth\RoleManager;
|
||||
use Unsupervised\Schedular\Auth\UserName;
|
||||
use Unsupervised\Schedular\Booking\BookingRepository;
|
||||
use Unsupervised\Schedular\GroupClass\EnrollmentRepository;
|
||||
use Unsupervised\Schedular\Val;
|
||||
|
||||
/**
|
||||
* Everything a guardian does on a child's behalf: creating the child's
|
||||
* login-less account, deciding who may act for whom, and resolving the payer and
|
||||
* contact behind a student id.
|
||||
*/
|
||||
class GuardianService {
|
||||
|
||||
/**
|
||||
* Marks a `wp_users` row as a child account: created by a guardian, holding
|
||||
* the student role so every `student_id` lookup keeps working, but with no
|
||||
* usable login. {@see ChildLoginGate} enforces the "no login" half.
|
||||
*/
|
||||
public const META_CHILD = 'us_child';
|
||||
|
||||
/** A child's birth year (`YYYY`), collected at signup and editable after. */
|
||||
public const META_BIRTH_YEAR = 'us_birth_year';
|
||||
|
||||
/**
|
||||
* The full date of birth this feature used to collect. Nothing writes it any
|
||||
* more: it is read once, to derive a birth year for a child who predates the
|
||||
* change, and cleared the moment that child's record is next saved. Kept
|
||||
* public so a site that wants to purge the old dates outright can find them.
|
||||
*/
|
||||
public const META_DOB = 'us_date_of_birth';
|
||||
|
||||
/**
|
||||
* Set on an account that registered **only** to book for other people, so it
|
||||
* is not offered as a student in its own right.
|
||||
*
|
||||
* Stored as the negative on purpose. Every account that existed before this
|
||||
* choice was offered is a bookable student, and absence of the flag has to
|
||||
* keep meaning exactly that — otherwise the picker would quietly stop
|
||||
* offering people themselves on upgrade.
|
||||
*/
|
||||
public const META_GUARDIAN_ONLY = 'us_guardian_only';
|
||||
|
||||
/**
|
||||
* The earliest birth year the form will accept. Old enough for any student a
|
||||
* studio will ever enrol, and late enough to reject a typo like `19` or `190`
|
||||
* that would otherwise be stored as a plausible-looking year.
|
||||
*/
|
||||
private const MIN_BIRTH_YEAR = 1900;
|
||||
|
||||
/**
|
||||
* Domain used for a child's placeholder login address. `.invalid` is reserved
|
||||
* by RFC 2606 and can never resolve, so a child's address is guaranteed
|
||||
* undeliverable — nothing about a child's account can ever be emailed to
|
||||
* somewhere real by mistake.
|
||||
*/
|
||||
private const CHILD_EMAIL_DOMAIN = 'child.invalid';
|
||||
|
||||
public function __construct(
|
||||
private GuardianRepository $guardians,
|
||||
private BookingRepository $bookings,
|
||||
private EnrollmentRepository $enrollments,
|
||||
) {}
|
||||
|
||||
/**
|
||||
* Create a login-less child account and link it to its guardian. The password
|
||||
* is random and discarded — it is never stored anywhere readable, emailed, or
|
||||
* shown — so the account cannot be signed into even if the gate were removed.
|
||||
*
|
||||
* Returns the new user ID, or a `WP_Error` when the name is blank, the birth
|
||||
* year is missing or unusable, or WordPress refuses the insert.
|
||||
*/
|
||||
public function createChild( int $guardianId, string $name, string $birthYear = '', string $relationship = '' ): int|\WP_Error {
|
||||
$name = trim( $name );
|
||||
if ( '' === $name ) {
|
||||
return new \WP_Error( 'missing_name', __( 'Please give each student a name.', 'unsupervised-schedular' ) );
|
||||
}
|
||||
|
||||
if ( 0 === self::normaliseBirthYear( $birthYear ) ) {
|
||||
return new \WP_Error( 'missing_birth_year', self::birthYearError() );
|
||||
}
|
||||
|
||||
$email = $this->childEmail();
|
||||
$userId = wp_insert_user(
|
||||
[
|
||||
'user_login' => $email,
|
||||
'user_email' => $email,
|
||||
'user_pass' => wp_generate_password( 24, true, true ),
|
||||
'display_name' => $name,
|
||||
'nickname' => $name,
|
||||
'role' => RoleManager::STUDENT,
|
||||
]
|
||||
);
|
||||
|
||||
if ( is_wp_error( $userId ) ) {
|
||||
return $userId;
|
||||
}
|
||||
|
||||
$userId = (int) $userId;
|
||||
|
||||
update_user_meta( $userId, self::META_CHILD, '1' );
|
||||
$this->setBirthYear( $userId, $birthYear );
|
||||
|
||||
$linkId = $this->guardians->insert(
|
||||
new GuardianLink(
|
||||
guardianId: $guardianId,
|
||||
studentId: $userId,
|
||||
relationship: trim( $relationship ),
|
||||
)
|
||||
);
|
||||
|
||||
// The child was just created, so it cannot already be linked — a failure
|
||||
// here means the insert itself failed, and leaving an unreachable orphan
|
||||
// user behind would be worse than reporting it.
|
||||
if ( $linkId <= 0 ) {
|
||||
$this->deleteUser( $userId );
|
||||
|
||||
return new \WP_Error( 'link_failed', __( 'Could not add this student. Please contact the studio.', 'unsupervised-schedular' ) );
|
||||
}
|
||||
|
||||
return $userId;
|
||||
}
|
||||
|
||||
/**
|
||||
* Rename a child and update their birth year. Refuses a student the caller
|
||||
* is not the guardian of, so the family screen cannot be turned into an
|
||||
* arbitrary user editor by posting someone else's id.
|
||||
*
|
||||
* Returns null on success, mirroring {@see \Unsupervised\Schedular\Registration\RegistrationGate::validate()}.
|
||||
*/
|
||||
public function updateChild( int $guardianId, int $studentId, string $name, string $birthYear = '' ): ?\WP_Error {
|
||||
if ( ! $this->guardians->isGuardianOf( $guardianId, $studentId ) ) {
|
||||
return new \WP_Error( 'forbidden', __( 'That is not one of your students.', 'unsupervised-schedular' ) );
|
||||
}
|
||||
|
||||
$name = trim( $name );
|
||||
if ( '' === $name ) {
|
||||
return new \WP_Error( 'missing_name', __( 'Please give each student a name.', 'unsupervised-schedular' ) );
|
||||
}
|
||||
|
||||
if ( 0 === self::normaliseBirthYear( $birthYear ) ) {
|
||||
return new \WP_Error( 'missing_birth_year', self::birthYearError() );
|
||||
}
|
||||
|
||||
$result = wp_update_user(
|
||||
[
|
||||
'ID' => $studentId,
|
||||
'display_name' => $name,
|
||||
'nickname' => $name,
|
||||
]
|
||||
);
|
||||
|
||||
if ( is_wp_error( $result ) ) {
|
||||
return $result;
|
||||
}
|
||||
|
||||
$this->setBirthYear( $studentId, $birthYear );
|
||||
|
||||
return null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Unlink a child and delete their account. Refused once the child has any
|
||||
* lesson or enrolment history: their id is referenced by lessons, payments and
|
||||
* credits, and deleting the user would orphan all of it. A studio admin
|
||||
* handles those cases by hand.
|
||||
*
|
||||
* Returns null on success.
|
||||
*/
|
||||
public function removeChild( int $guardianId, int $studentId ): ?\WP_Error {
|
||||
if ( ! $this->guardians->isGuardianOf( $guardianId, $studentId ) ) {
|
||||
return new \WP_Error( 'forbidden', __( 'That is not one of your students.', 'unsupervised-schedular' ) );
|
||||
}
|
||||
|
||||
if ( [] !== $this->bookings->findByStudent( $studentId ) || [] !== $this->enrollments->findByStudent( $studentId ) ) {
|
||||
return new \WP_Error(
|
||||
'has_history',
|
||||
__( 'This student has lessons or enrolments on record and cannot be removed here. Please contact the studio.', 'unsupervised-schedular' )
|
||||
);
|
||||
}
|
||||
|
||||
$this->guardians->delete( $guardianId, $studentId );
|
||||
$this->deleteUser( $studentId );
|
||||
|
||||
return null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Whether `$actorId` may book, cancel and pay as `$studentId` — true for
|
||||
* themselves, and for a guardian acting as one of their own children. This is
|
||||
* the authorisation boundary the REST endpoints and form handlers check before
|
||||
* honouring a submitted student id.
|
||||
*/
|
||||
public function canActFor( int $actorId, int $studentId ): bool {
|
||||
if ( $actorId <= 0 || $studentId <= 0 ) {
|
||||
return false;
|
||||
}
|
||||
|
||||
return $actorId === $studentId || $this->guardians->isGuardianOf( $actorId, $studentId );
|
||||
}
|
||||
|
||||
/**
|
||||
* Who owes a student's charges: their guardian when they have one, otherwise
|
||||
* themselves. Payments, credits and the billing-method override all resolve
|
||||
* through this, so a family shares one balance and one billing setting.
|
||||
*/
|
||||
public function payerFor( int $studentId ): int {
|
||||
$link = $this->guardians->findByStudent( $studentId );
|
||||
|
||||
return null !== $link ? $link->guardianId : $studentId;
|
||||
}
|
||||
|
||||
/**
|
||||
* The student ids whose lessons `$userId` may see: their own plus every child
|
||||
* they are guardian for.
|
||||
*
|
||||
* @return list<int>
|
||||
*/
|
||||
public function householdIds( int $userId ): array {
|
||||
$ids = [ $userId ];
|
||||
|
||||
foreach ( $this->guardians->findByGuardian( $userId ) as $link ) {
|
||||
$ids[] = $link->studentId;
|
||||
}
|
||||
|
||||
return array_values( array_unique( $ids ) );
|
||||
}
|
||||
|
||||
/**
|
||||
* The people a user may book or enrol for: **children first**, then
|
||||
* themselves. The order is the point — a guardian's normal case is booking for
|
||||
* a child, so the first option (and hence the default selection) is a child,
|
||||
* never the parent. Booking for a child by mistake is a correctable
|
||||
* inconvenience; silently billing a parent's account for a lesson meant for
|
||||
* their kid is the error worth designing out.
|
||||
*
|
||||
* The guardian is still offered, last, so a parent taking lessons alongside
|
||||
* their children can book for themselves from the same account — unless they
|
||||
* said at signup that they are not a student, in which case offering them is
|
||||
* an invitation to book a lesson nobody meant to buy.
|
||||
*
|
||||
* @return list<array{id: int, name: string, is_self: bool}>
|
||||
*/
|
||||
public function bookableStudents( int $userId ): array {
|
||||
$out = [];
|
||||
|
||||
foreach ( $this->children( $userId ) as $child ) {
|
||||
$out[] = [
|
||||
'id' => $child['id'],
|
||||
'name' => $child['name'],
|
||||
'is_self' => false,
|
||||
];
|
||||
}
|
||||
|
||||
// A guardian-only account with nobody linked to it would otherwise get an
|
||||
// empty list and no way to book at all. Offering them themselves is the
|
||||
// lesser wrong: they can still correct the account from the profile page.
|
||||
if ( self::isGuardianOnly( $userId ) && [] !== $out ) {
|
||||
return $out;
|
||||
}
|
||||
|
||||
$self = get_userdata( $userId );
|
||||
|
||||
$out[] = [
|
||||
'id' => $userId,
|
||||
'name' => UserName::format( $self instanceof \WP_User ? $self : null, $userId ),
|
||||
'is_self' => true,
|
||||
];
|
||||
|
||||
return $out;
|
||||
}
|
||||
|
||||
/**
|
||||
* Whether this account books only for other people. False for every account
|
||||
* that predates the choice — see {@see META_GUARDIAN_ONLY}.
|
||||
*/
|
||||
public static function isGuardianOnly( int $userId ): bool {
|
||||
return '1' === Val::string( get_user_meta( $userId, self::META_GUARDIAN_ONLY, true ) );
|
||||
}
|
||||
|
||||
/**
|
||||
* Record whether this account is a student in its own right. Clears the flag
|
||||
* rather than storing a `0`, so "not set" stays the single meaning of "yes,
|
||||
* they are a student".
|
||||
*/
|
||||
public function setGuardianOnly( int $userId, bool $guardianOnly ): void {
|
||||
if ( $guardianOnly ) {
|
||||
update_user_meta( $userId, self::META_GUARDIAN_ONLY, '1' );
|
||||
return;
|
||||
}
|
||||
|
||||
delete_user_meta( $userId, self::META_GUARDIAN_ONLY );
|
||||
}
|
||||
|
||||
/**
|
||||
* A guardian's children, in link order, with the details the family and admin
|
||||
* screens display.
|
||||
*
|
||||
* @return list<array{id: int, name: string, birth_year: string, relationship: string}>
|
||||
*/
|
||||
public function children( int $guardianId ): array {
|
||||
$out = [];
|
||||
|
||||
foreach ( $this->guardians->findByGuardian( $guardianId ) as $link ) {
|
||||
$user = get_userdata( $link->studentId );
|
||||
|
||||
$out[] = [
|
||||
'id' => $link->studentId,
|
||||
'name' => UserName::format( $user instanceof \WP_User ? $user : null, $link->studentId ),
|
||||
'birth_year' => $this->birthYear( $link->studentId ),
|
||||
'relationship' => $link->relationship,
|
||||
];
|
||||
}
|
||||
|
||||
return $out;
|
||||
}
|
||||
|
||||
/**
|
||||
* The guardian behind a child, or null when the student books for themselves.
|
||||
*
|
||||
* @return array{id: int, name: string, email: string}|null
|
||||
*/
|
||||
public function guardianOf( int $studentId ): ?array {
|
||||
$link = $this->guardians->findByStudent( $studentId );
|
||||
if ( null === $link ) {
|
||||
return null;
|
||||
}
|
||||
|
||||
$user = get_userdata( $link->guardianId );
|
||||
|
||||
return [
|
||||
'id' => $link->guardianId,
|
||||
'name' => UserName::format( $user instanceof \WP_User ? $user : null, $link->guardianId ),
|
||||
'email' => $user instanceof \WP_User ? $user->user_email : '',
|
||||
];
|
||||
}
|
||||
|
||||
/**
|
||||
* Who to contact about a student: their guardian when they have one, otherwise
|
||||
* the student. What an instructor looking at a child's lesson actually needs —
|
||||
* a child's own address is an undeliverable placeholder.
|
||||
*
|
||||
* @return array{id: int, name: string, email: string}
|
||||
*/
|
||||
public function contactFor( int $studentId ): array {
|
||||
$guardian = $this->guardianOf( $studentId );
|
||||
if ( null !== $guardian ) {
|
||||
return $guardian;
|
||||
}
|
||||
|
||||
$user = get_userdata( $studentId );
|
||||
|
||||
return [
|
||||
'id' => $studentId,
|
||||
'name' => UserName::format( $user instanceof \WP_User ? $user : null, $studentId ),
|
||||
'email' => $user instanceof \WP_User ? $user->user_email : '',
|
||||
];
|
||||
}
|
||||
|
||||
/**
|
||||
* A student's display name, or an empty string when the user is gone. Used
|
||||
* wherever a charge or lesson has to say whose it is.
|
||||
*/
|
||||
public function studentName( int $studentId ): string {
|
||||
$user = get_userdata( $studentId );
|
||||
|
||||
return UserName::format( $user instanceof \WP_User ? $user : null );
|
||||
}
|
||||
|
||||
/**
|
||||
* Whether a user is a child account (created by a guardian, cannot sign in).
|
||||
*/
|
||||
public static function isChild( int $userId ): bool {
|
||||
return '1' === Val::string( get_user_meta( $userId, self::META_CHILD, true ) );
|
||||
}
|
||||
|
||||
/**
|
||||
* Delete a child's user account. Split out so the front-end paths pull in the
|
||||
* admin user functions `wp_delete_user()` lives in — it is not loaded on the
|
||||
* front end, where the family screen runs.
|
||||
*/
|
||||
public function deleteUser( int $userId ): void {
|
||||
if ( ! function_exists( 'wp_delete_user' ) ) {
|
||||
require_once ABSPATH . 'wp-admin/includes/user.php';
|
||||
}
|
||||
|
||||
wp_delete_user( $userId );
|
||||
}
|
||||
|
||||
/**
|
||||
* Store a student's birth year, or clear it when blank or out of range. Used
|
||||
* for a child added by their guardian and for an account holder who is a
|
||||
* student in their own right — the same fact about the same kind of person,
|
||||
* so the same meta key holds both.
|
||||
*
|
||||
* Either way the legacy full date of birth goes with it. That is what makes
|
||||
* the read fallback in {@see birthYear()} safe: without it, clearing the year
|
||||
* on a child who predates this change would leave the old date behind for the
|
||||
* fallback to resurrect on the very next read.
|
||||
*/
|
||||
public function setBirthYear( int $userId, string $birthYear ): void {
|
||||
delete_user_meta( $userId, self::META_DOB );
|
||||
|
||||
$year = self::normaliseBirthYear( $birthYear );
|
||||
|
||||
if ( 0 === $year ) {
|
||||
delete_user_meta( $userId, self::META_BIRTH_YEAR );
|
||||
return;
|
||||
}
|
||||
|
||||
update_user_meta( $userId, self::META_BIRTH_YEAR, (string) $year );
|
||||
}
|
||||
|
||||
/**
|
||||
* A submitted birth year as an integer, or 0 when it is blank, not a number,
|
||||
* or outside {@see MIN_BIRTH_YEAR}..this year. A year in the future is a typo
|
||||
* every time, so it is refused rather than stored.
|
||||
*
|
||||
* Public and static so the signup form can reject a bad year up front, before
|
||||
* it creates any users, without a second copy of the rule to keep in step.
|
||||
*/
|
||||
public static function normaliseBirthYear( string $birthYear ): int {
|
||||
$birthYear = trim( $birthYear );
|
||||
|
||||
if ( '' === $birthYear || 1 !== preg_match( '/^\d{4}$/', $birthYear ) ) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
$year = (int) $birthYear;
|
||||
|
||||
if ( $year < self::MIN_BIRTH_YEAR || $year > (int) current_time( 'Y' ) ) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
return $year;
|
||||
}
|
||||
|
||||
/**
|
||||
* The message shown when a birth year is missing or unusable. One phrasing,
|
||||
* shared by the signup form and the profile screen, so a guardian is told the
|
||||
* same thing whichever way they got there.
|
||||
*/
|
||||
public static function birthYearError(): string {
|
||||
return sprintf(
|
||||
/* translators: %d: the earliest birth year the form accepts. */
|
||||
__( 'Please give each student a birth year, as four digits from %d onwards.', 'unsupervised-schedular' ),
|
||||
self::MIN_BIRTH_YEAR
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* The same message for the account holder's own birth year. Separate wording
|
||||
* because "each student" is nobody when the student in question is the person
|
||||
* reading it.
|
||||
*/
|
||||
public static function ownBirthYearError(): string {
|
||||
return sprintf(
|
||||
/* translators: %d: the earliest birth year the form accepts. */
|
||||
__( 'Please give your birth year, as four digits from %d onwards.', 'unsupervised-schedular' ),
|
||||
self::MIN_BIRTH_YEAR
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* A child's birth year, or an empty string when none is recorded.
|
||||
*
|
||||
* Falls back to the year of the full date of birth this feature used to
|
||||
* collect, so a child added before the change still shows one. The fallback
|
||||
* is read-only and one-way: {@see setBirthYear()} drops the old date as soon
|
||||
* as the record is saved again.
|
||||
*/
|
||||
private function birthYear( int $userId ): string {
|
||||
$year = Val::string( get_user_meta( $userId, self::META_BIRTH_YEAR, true ) );
|
||||
if ( '' !== $year ) {
|
||||
return $year;
|
||||
}
|
||||
|
||||
$legacy = Val::string( get_user_meta( $userId, self::META_DOB, true ) );
|
||||
|
||||
return 1 === preg_match( '/^(\d{4})-/', $legacy, $m ) ? $m[1] : '';
|
||||
}
|
||||
|
||||
/**
|
||||
* An unused placeholder address for a child's account. WordPress requires a
|
||||
* unique email per user, so the random suffix is retried against
|
||||
* `email_exists()` rather than assumed unique.
|
||||
*/
|
||||
private function childEmail(): string {
|
||||
do {
|
||||
$email = 'us-child-' . wp_generate_password( 12, false, false ) . '@' . self::CHILD_EMAIL_DOMAIN;
|
||||
} while ( false !== email_exists( $email ) );
|
||||
|
||||
return strtolower( $email );
|
||||
}
|
||||
}
|
||||
@@ -4,39 +4,18 @@ declare(strict_types=1);
|
||||
namespace Unsupervised\Schedular;
|
||||
|
||||
use Unsupervised\Schedular\Auth\RoleManager;
|
||||
use Unsupervised\Schedular\Availability\AvailabilityRepository;
|
||||
use Unsupervised\Schedular\Payment\CreditRepository;
|
||||
use Unsupervised\Schedular\Payment\PaymentRepository;
|
||||
use Unsupervised\Schedular\Payment\ScheduledBillingRunner;
|
||||
use Unsupervised\Schedular\Policy\AcceptanceRepository;
|
||||
|
||||
class Installer {
|
||||
|
||||
public function run(): void {
|
||||
$this->createTables();
|
||||
$this->migrateData();
|
||||
( new RoleManager() )->createRoles();
|
||||
$this->scheduleBilling();
|
||||
flush_rewrite_rules();
|
||||
update_option( 'us_schedular_version', USC_VERSION );
|
||||
}
|
||||
|
||||
/**
|
||||
* Ensure the daily scheduled-billing scan is registered with WP-Cron. Runs on
|
||||
* activation and on every version-bump re-install, so an existing site that
|
||||
* predates the feature picks the event up on its next deploy.
|
||||
*/
|
||||
private function scheduleBilling(): void {
|
||||
if ( false === wp_next_scheduled( ScheduledBillingRunner::HOOK ) ) {
|
||||
wp_schedule_event( time(), 'daily', ScheduledBillingRunner::HOOK );
|
||||
}
|
||||
}
|
||||
|
||||
private function createTables(): void {
|
||||
global $wpdb;
|
||||
if ( ! $wpdb instanceof \wpdb ) {
|
||||
return;
|
||||
}
|
||||
$charset = $wpdb->get_charset_collate();
|
||||
|
||||
require_once ABSPATH . 'wp-admin/includes/upgrade.php';
|
||||
@@ -45,21 +24,4 @@ class Installer {
|
||||
dbDelta( $sql );
|
||||
}
|
||||
}
|
||||
|
||||
private function migrateData(): void {
|
||||
global $wpdb;
|
||||
if ( ! $wpdb instanceof \wpdb ) {
|
||||
return;
|
||||
}
|
||||
|
||||
( new AvailabilityRepository( $wpdb ) )->splitOversizedWindows();
|
||||
|
||||
// Guardian accounts introduced "who pays" / "who agreed" alongside "who the
|
||||
// student is". Every row written before then had them one and the same, so
|
||||
// point the new columns at the student rather than leaving them 0 — the
|
||||
// balance and acceptance lookups key on them directly.
|
||||
( new PaymentRepository( $wpdb ) )->backfillPayerIds();
|
||||
( new CreditRepository( $wpdb ) )->backfillPayerIds();
|
||||
( new AcceptanceRepository( $wpdb ) )->backfillAcceptedBy();
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,57 +0,0 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace Unsupervised\Schedular\Offering;
|
||||
|
||||
use Unsupervised\Schedular\Availability\AvailabilityRepository;
|
||||
|
||||
/**
|
||||
* Keeps an instructor's open availability out of the way of the group classes
|
||||
* they teach. When a group class is scheduled (an assigned instructor plus a
|
||||
* date, time, and duration), each session occupies the instructor: any open
|
||||
* private-booking slot that overlaps a session is removed so students cannot
|
||||
* book the instructor at the class time, and any already-booked slot that
|
||||
* overlaps is reported as a conflict for the studio to resolve by hand — a
|
||||
* booked lesson is never silently deleted.
|
||||
*/
|
||||
class ClassSlotReconciler {
|
||||
|
||||
public function __construct( private AvailabilityRepository $availability ) {}
|
||||
|
||||
/**
|
||||
* Reconcile the assigned instructor's availability with the class schedule.
|
||||
*
|
||||
* @return array{removed: int, conflicts: list<string>} The number of open
|
||||
* slots cleared, and the start datetime (`Y-m-d H:i:s`) of each booked
|
||||
* slot that still clashes with a session.
|
||||
*/
|
||||
public function reconcile( Offering $offering ): array {
|
||||
if ( Offering::KIND_GROUP_CLASS !== $offering->kind || $offering->instructorId <= 0 ) {
|
||||
return [
|
||||
'removed' => 0,
|
||||
'conflicts' => [],
|
||||
];
|
||||
}
|
||||
|
||||
$removed = 0;
|
||||
$conflicts = [];
|
||||
|
||||
foreach ( $offering->sessionWindows() as $window ) {
|
||||
foreach ( $this->availability->findOverlapping( $offering->instructorId, $window['start'], $window['end'] ) as $slot ) {
|
||||
if ( $slot->isBooked ) {
|
||||
$conflicts[] = $slot->startDt;
|
||||
continue;
|
||||
}
|
||||
|
||||
if ( null !== $slot->id && $this->availability->delete( $slot->id ) ) {
|
||||
++$removed;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return [
|
||||
'removed' => $removed,
|
||||
'conflicts' => $conflicts,
|
||||
];
|
||||
}
|
||||
}
|
||||
+33
-277
@@ -3,8 +3,6 @@ declare(strict_types=1);
|
||||
|
||||
namespace Unsupervised\Schedular\Offering;
|
||||
|
||||
use Unsupervised\Schedular\Val;
|
||||
|
||||
class Offering {
|
||||
|
||||
public const KIND_PRIVATE_LESSON = 'private_lesson';
|
||||
@@ -20,48 +18,12 @@ class Offering {
|
||||
public const BILLING_ONE_TIME = 'one_time';
|
||||
public const BILLING_FULL_TERM = 'full_term';
|
||||
|
||||
/** Billed 24 hours before each lesson, on a recurring schedule (see scheduled-billing.md). */
|
||||
public const BILLING_WEEKLY = 'weekly';
|
||||
|
||||
/** Billed on the first of each month for every lesson that falls in the month. */
|
||||
public const BILLING_MONTHLY = 'monthly';
|
||||
|
||||
/**
|
||||
* All valid billing modes.
|
||||
*
|
||||
* @var list<string>
|
||||
*/
|
||||
public const VALID_BILLING_MODES = [ self::BILLING_ONE_TIME, self::BILLING_FULL_TERM, self::BILLING_WEEKLY, self::BILLING_MONTHLY ];
|
||||
|
||||
/**
|
||||
* Billing modes whose payment is generated later by the daily billing scan
|
||||
* rather than taken at registration.
|
||||
*
|
||||
* @var list<string>
|
||||
*/
|
||||
public const SCHEDULED_BILLING_MODES = [ self::BILLING_WEEKLY, self::BILLING_MONTHLY ];
|
||||
|
||||
/** Listed in the public catalogue; anyone with `book_lesson` may enrol. */
|
||||
public const ACCESS_PUBLIC = 'public';
|
||||
|
||||
/** Hidden from the catalogue; only invited/added students may enrol (group classes). */
|
||||
public const ACCESS_INVITE_ONLY = 'invite_only';
|
||||
|
||||
/**
|
||||
* All valid access modes.
|
||||
*
|
||||
* @var list<string>
|
||||
*/
|
||||
public const VALID_ACCESS_MODES = [ self::ACCESS_PUBLIC, self::ACCESS_INVITE_ONLY ];
|
||||
|
||||
/** Maximum length of the title, matching the `title` VARCHAR(191) column. */
|
||||
public const MAX_TITLE_LENGTH = 191;
|
||||
|
||||
/** Maximum length of the schedule note, matching the `schedule_note` VARCHAR(191) column. */
|
||||
public const MAX_SCHEDULE_NOTE_LENGTH = 191;
|
||||
|
||||
/** Maximum length of the e-transfer email, matching the `etransfer_email` VARCHAR(191) column. */
|
||||
public const MAX_ETRANSFER_EMAIL_LENGTH = 191;
|
||||
public const VALID_BILLING_MODES = [ self::BILLING_ONE_TIME, self::BILLING_FULL_TERM ];
|
||||
|
||||
public function __construct(
|
||||
public readonly int $instructorId,
|
||||
@@ -76,231 +38,30 @@ class Offering {
|
||||
public readonly ?int $capacity = null,
|
||||
public readonly ?string $termStart = null,
|
||||
public readonly ?string $termEnd = null,
|
||||
public readonly ?string $classTime = null,
|
||||
public readonly ?string $enrollmentDeadline = null,
|
||||
public readonly ?string $withdrawalDeadline = null,
|
||||
public readonly ?string $scheduleNote = null,
|
||||
public readonly ?string $etransferEmail = null,
|
||||
public readonly ?int $cancellationCutoffHours = null,
|
||||
public readonly string $accessMode = self::ACCESS_PUBLIC,
|
||||
public readonly bool $isActive = true,
|
||||
public readonly ?int $id = null,
|
||||
) {}
|
||||
|
||||
/**
|
||||
* Whether the offering is hidden from the public catalogue and reachable
|
||||
* only by invited or directly-added students.
|
||||
*/
|
||||
public function isInviteOnly(): bool {
|
||||
return self::ACCESS_INVITE_ONLY === $this->accessMode;
|
||||
}
|
||||
|
||||
/**
|
||||
* Whether this offering's payment is deferred to the daily billing scan
|
||||
* (weekly / monthly) instead of being taken at registration.
|
||||
*/
|
||||
public function isScheduledBilling(): bool {
|
||||
return in_array( $this->billingMode, self::SCHEDULED_BILLING_MODES, true );
|
||||
}
|
||||
|
||||
/**
|
||||
* The last day on which a student may enrol in this group class. Defaults to
|
||||
* the first day of the class (`term_start`) when the instructor has not set an
|
||||
* explicit deadline; null only when the class has no dates at all.
|
||||
*/
|
||||
public function effectiveEnrollmentDeadline(): ?string {
|
||||
return $this->enrollmentDeadline ?? $this->termStart;
|
||||
}
|
||||
|
||||
/**
|
||||
* Whether enrolment is still open on `$today` (a `Y-m-d` date). Enrolment stays
|
||||
* open through the end of the deadline day, so the first class is still
|
||||
* enrollable under the default deadline. A class with no deadline at all (no
|
||||
* dates configured) is always open.
|
||||
*/
|
||||
public function isEnrollmentOpen( string $today ): bool {
|
||||
$deadline = $this->effectiveEnrollmentDeadline();
|
||||
|
||||
return null === $deadline || $today <= $deadline;
|
||||
}
|
||||
|
||||
/**
|
||||
* Whether a student may still withdraw themselves from this group class on
|
||||
* `$today` (a `Y-m-d` date). Withdrawal stays open through the end of the
|
||||
* deadline day. Unlike the enrolment deadline there is no implicit default: a
|
||||
* class with no withdrawal deadline set stays open to withdrawal for its whole
|
||||
* life, so the instructor must set a date to lock students in. A withdrawal
|
||||
* made while open never issues an account credit — it only frees the seat and
|
||||
* voids any still-pending payment.
|
||||
*/
|
||||
public function isWithdrawalOpen( string $today ): bool {
|
||||
return null === $this->withdrawalDeadline || $today <= $this->withdrawalDeadline;
|
||||
}
|
||||
|
||||
/**
|
||||
* Normalise a submitted term date to canonical `Y-m-d`, or null when it is
|
||||
* not a real calendar date. Round-trips through DateTimeImmutable so
|
||||
* strings PHP would silently coerce (e.g. `2026-02-30`) are rejected.
|
||||
*/
|
||||
public static function normalizeDate( string $value ): ?string {
|
||||
$date = \DateTimeImmutable::createFromFormat( '!Y-m-d', $value );
|
||||
|
||||
return false !== $date && $date->format( 'Y-m-d' ) === $value ? $date->format( 'Y-m-d' ) : null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Last class date of a weekly term: the start date plus `$occurrences - 1`
|
||||
* weeks. A one-off class (one occurrence) ends the day it starts.
|
||||
*/
|
||||
public static function weeklyTermEnd( string $termStart, int $occurrences ): string {
|
||||
$weeks = max( 1, $occurrences ) - 1;
|
||||
|
||||
return ( new \DateTimeImmutable( $termStart ) )->modify( '+' . ( 7 * $weeks ) . ' days' )->format( 'Y-m-d' );
|
||||
}
|
||||
|
||||
/**
|
||||
* Normalise a submitted time-of-day to canonical `H:i:s`, or null when it is
|
||||
* not a real time. Accepts the HTML `time` form (`H:i`, optionally with
|
||||
* seconds); anything else is rejected so garbage never reaches the TIME column.
|
||||
*/
|
||||
public static function normalizeTime( string $value ): ?string {
|
||||
foreach ( [ 'H:i:s', 'H:i' ] as $format ) {
|
||||
$time = \DateTimeImmutable::createFromFormat( '!' . $format, $value );
|
||||
if ( false !== $time && $time->format( $format ) === $value ) {
|
||||
return $time->format( 'H:i:s' );
|
||||
}
|
||||
}
|
||||
|
||||
return null;
|
||||
}
|
||||
|
||||
/**
|
||||
* The datetime each session of this group class starts, derived from the class
|
||||
* date(s) and the class time. A weekly class yields one per week from
|
||||
* `term_start` through `term_end`; a one-off class yields a single one.
|
||||
*
|
||||
* Deliberately does **not** need a duration: knowing *when* a class meets is a
|
||||
* separate question from knowing how long it runs, and a studio can quite
|
||||
* reasonably set the first without the second. Returns an empty list when
|
||||
* there is no date or no time, since neither can be invented.
|
||||
*
|
||||
* @return list<string> `Y-m-d H:i:s` starts, earliest first.
|
||||
*/
|
||||
public function sessionStarts(): array {
|
||||
if ( null === $this->termStart || null === $this->classTime ) {
|
||||
return [];
|
||||
}
|
||||
|
||||
$first = \DateTimeImmutable::createFromFormat( '!Y-m-d H:i:s', $this->termStart . ' ' . $this->classTime );
|
||||
if ( false === $first ) {
|
||||
return [];
|
||||
}
|
||||
|
||||
$lastDay = null !== $this->termEnd ? $this->termEnd : $this->termStart;
|
||||
|
||||
$starts = [];
|
||||
$cursor = $first;
|
||||
$cursorDay = $cursor->format( 'Y-m-d' );
|
||||
|
||||
// Cap the walk at ten years of weeks so a term_end before term_start (or a
|
||||
// bad value) can never spin into an unbounded loop.
|
||||
for ( $i = 0; $i < 520 && $cursorDay <= $lastDay; $i++ ) {
|
||||
$starts[] = $cursor->format( 'Y-m-d H:i:s' );
|
||||
|
||||
$cursor = $cursor->modify( '+7 days' );
|
||||
$cursorDay = $cursor->format( 'Y-m-d' );
|
||||
}
|
||||
|
||||
return $starts;
|
||||
}
|
||||
|
||||
/**
|
||||
* The concrete start/end datetimes of every session of this group class:
|
||||
* {@see sessionStarts()} closed off with the class duration. Returns an empty
|
||||
* list unless the schedule is fully specified (date, time, *and* a positive
|
||||
* duration), so it can never fabricate a session window from partial data —
|
||||
* callers that block availability or bill per session need both ends.
|
||||
*
|
||||
* @return list<array{start: string, end: string}>
|
||||
*/
|
||||
public function sessionWindows(): array {
|
||||
if ( null === $this->durationMinutes || $this->durationMinutes <= 0 ) {
|
||||
return [];
|
||||
}
|
||||
|
||||
$step = new \DateInterval( 'PT' . $this->durationMinutes . 'M' );
|
||||
|
||||
return array_map(
|
||||
static fn( string $start ): array => [
|
||||
'start' => $start,
|
||||
'end' => ( new \DateTimeImmutable( $start ) )->add( $step )->format( 'Y-m-d H:i:s' ),
|
||||
],
|
||||
$this->sessionStarts()
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* The last day this class meets, or null when it has no dates at all.
|
||||
*/
|
||||
public function lastClassDay(): ?string {
|
||||
return $this->termEnd ?? $this->termStart;
|
||||
}
|
||||
|
||||
/**
|
||||
* Plain-language wording for when this class meets, for the places that have
|
||||
* to say something about a class whose schedule cannot be resolved to dates.
|
||||
* Prefers the studio's own note ("Tuesdays 4:00pm") — that field exists
|
||||
* precisely so a class can describe its schedule without pinning it to a
|
||||
* time — then the term dates, and finally an honest admission that nothing
|
||||
* has been set.
|
||||
*/
|
||||
public function scheduleLabel(): string {
|
||||
$note = null !== $this->scheduleNote ? trim( $this->scheduleNote ) : '';
|
||||
if ( '' !== $note ) {
|
||||
return $note;
|
||||
}
|
||||
|
||||
if ( null === $this->termStart ) {
|
||||
return __( 'Schedule to be confirmed', 'unsupervised-schedular' );
|
||||
}
|
||||
|
||||
$start = (string) mysql2date( 'M j, Y', $this->termStart );
|
||||
|
||||
if ( null === $this->termEnd || $this->termEnd === $this->termStart ) {
|
||||
return $start;
|
||||
}
|
||||
|
||||
return sprintf(
|
||||
/* translators: 1: first class date, 2: last class date. */
|
||||
__( '%1$s – %2$s', 'unsupervised-schedular' ),
|
||||
$start,
|
||||
(string) mysql2date( 'M j, Y', $this->termEnd )
|
||||
);
|
||||
}
|
||||
|
||||
public static function fromRow( \stdClass $row ): self {
|
||||
public static function fromRow( object $row ): self {
|
||||
return new self(
|
||||
instructorId: Val::int( $row->instructor_id ),
|
||||
kind: Val::string( $row->kind ),
|
||||
title: Val::string( $row->title ),
|
||||
price: Val::float( $row->price ),
|
||||
currency: Val::string( $row->currency ),
|
||||
billingMode: Val::string( $row->billing_mode ),
|
||||
description: Val::stringOrNull( $row->description ),
|
||||
durationMinutes: Val::intOrNull( $row->duration_minutes ),
|
||||
allowWeekly: Val::bool( $row->allow_weekly ),
|
||||
capacity: Val::intOrNull( $row->capacity ),
|
||||
termStart: Val::stringOrNull( $row->term_start ),
|
||||
termEnd: Val::stringOrNull( $row->term_end ),
|
||||
classTime: Val::stringOrNull( $row->class_time ?? null ),
|
||||
enrollmentDeadline: Val::stringOrNull( $row->enrollment_deadline ?? null ),
|
||||
withdrawalDeadline: Val::stringOrNull( $row->withdrawal_deadline ?? null ),
|
||||
scheduleNote: Val::stringOrNull( $row->schedule_note ),
|
||||
etransferEmail: Val::stringOrNull( $row->etransfer_email ),
|
||||
cancellationCutoffHours: Val::intOrNull( $row->cancellation_cutoff_hours ),
|
||||
accessMode: '' !== Val::string( $row->access_mode ?? '' ) ? Val::string( $row->access_mode ) : self::ACCESS_PUBLIC,
|
||||
isActive: Val::bool( $row->is_active ),
|
||||
id: Val::int( $row->id ),
|
||||
instructorId: (int) $row->instructor_id,
|
||||
kind: $row->kind,
|
||||
title: $row->title,
|
||||
price: (float) $row->price,
|
||||
currency: $row->currency,
|
||||
billingMode: $row->billing_mode,
|
||||
description: $row->description,
|
||||
durationMinutes: null !== $row->duration_minutes ? (int) $row->duration_minutes : null,
|
||||
allowWeekly: (bool) $row->allow_weekly,
|
||||
capacity: null !== $row->capacity ? (int) $row->capacity : null,
|
||||
termStart: $row->term_start,
|
||||
termEnd: $row->term_end,
|
||||
scheduleNote: $row->schedule_note,
|
||||
etransferEmail: $row->etransfer_email,
|
||||
isActive: (bool) $row->is_active,
|
||||
id: (int) $row->id,
|
||||
);
|
||||
}
|
||||
|
||||
@@ -315,26 +76,21 @@ class Offering {
|
||||
*/
|
||||
public function toArray( bool $includeEtransferEmail = true ): array {
|
||||
$out = [
|
||||
'id' => $this->id,
|
||||
'instructor_id' => $this->instructorId,
|
||||
'kind' => $this->kind,
|
||||
'title' => $this->title,
|
||||
'description' => $this->description,
|
||||
'duration_minutes' => $this->durationMinutes,
|
||||
'price' => $this->price,
|
||||
'currency' => $this->currency,
|
||||
'billing_mode' => $this->billingMode,
|
||||
'allow_weekly' => $this->allowWeekly,
|
||||
'capacity' => $this->capacity,
|
||||
'term_start' => $this->termStart,
|
||||
'term_end' => $this->termEnd,
|
||||
'class_time' => $this->classTime,
|
||||
'enrollment_deadline' => $this->enrollmentDeadline,
|
||||
'withdrawal_deadline' => $this->withdrawalDeadline,
|
||||
'schedule_note' => $this->scheduleNote,
|
||||
'cancellation_cutoff_hours' => $this->cancellationCutoffHours,
|
||||
'access_mode' => $this->accessMode,
|
||||
'is_active' => $this->isActive,
|
||||
'id' => $this->id,
|
||||
'instructor_id' => $this->instructorId,
|
||||
'kind' => $this->kind,
|
||||
'title' => $this->title,
|
||||
'description' => $this->description,
|
||||
'duration_minutes' => $this->durationMinutes,
|
||||
'price' => $this->price,
|
||||
'currency' => $this->currency,
|
||||
'billing_mode' => $this->billingMode,
|
||||
'allow_weekly' => $this->allowWeekly,
|
||||
'capacity' => $this->capacity,
|
||||
'term_start' => $this->termStart,
|
||||
'term_end' => $this->termEnd,
|
||||
'schedule_note' => $this->scheduleNote,
|
||||
'is_active' => $this->isActive,
|
||||
];
|
||||
|
||||
if ( $includeEtransferEmail ) {
|
||||
|
||||
@@ -3,17 +3,11 @@ declare(strict_types=1);
|
||||
|
||||
namespace Unsupervised\Schedular\Offering;
|
||||
|
||||
use Unsupervised\Schedular\Auth\AccessSettings;
|
||||
use Unsupervised\Schedular\Auth\RoleManager;
|
||||
use Unsupervised\Schedular\Val;
|
||||
|
||||
class OfferingController {
|
||||
|
||||
public function __construct(
|
||||
private OfferingRepository $repository,
|
||||
private ClassSlotReconciler $reconciler,
|
||||
private AccessSettings $access = new AccessSettings(),
|
||||
) {}
|
||||
public function __construct( private OfferingRepository $repository ) {}
|
||||
|
||||
public function renderPage(): void {
|
||||
if ( ! current_user_can( RoleManager::CAP_MANAGE_OFFERINGS ) ) {
|
||||
@@ -23,27 +17,8 @@ class OfferingController {
|
||||
$instructorId = get_current_user_id();
|
||||
$manageAll = current_user_can( RoleManager::CAP_MANAGE_INSTRUCTORS );
|
||||
|
||||
$notice = '';
|
||||
if ( isset( $_POST['usc_action'] ) && check_admin_referer( 'usc_offering_action' ) ) {
|
||||
$notice = $this->handleFormAction( $instructorId, $manageAll );
|
||||
}
|
||||
|
||||
// Studio admins may assign any instructor to a class; a plain instructor
|
||||
// only ever creates classes for themselves, so the picker is theirs alone.
|
||||
$instructors = $manageAll ? $this->instructorOptions() : [];
|
||||
|
||||
// View-state query param only (which offering the form is editing) —
|
||||
// nothing is mutated from it, so no nonce applies.
|
||||
// phpcs:disable WordPress.Security.NonceVerification.Recommended
|
||||
$editId = absint( Val::int( $_GET['usc_edit'] ?? 0 ) );
|
||||
// phpcs:enable WordPress.Security.NonceVerification.Recommended
|
||||
|
||||
$editing = null;
|
||||
if ( $editId > 0 ) {
|
||||
$candidate = $this->repository->findById( $editId );
|
||||
if ( $candidate && ( $manageAll || $candidate->instructorId === $instructorId ) ) {
|
||||
$editing = $candidate;
|
||||
}
|
||||
$this->handleFormAction( $instructorId, $manageAll );
|
||||
}
|
||||
|
||||
$offerings = $manageAll
|
||||
@@ -53,42 +28,17 @@ class OfferingController {
|
||||
include USC_PLUGIN_DIR . 'templates/admin/offerings.php';
|
||||
}
|
||||
|
||||
/**
|
||||
* Process the posted add/update/delete action, returning a status notice for
|
||||
* display (e.g. how many booking slots a scheduled class cleared, or that a
|
||||
* booked lesson clashes with it). An empty string means nothing to report.
|
||||
*/
|
||||
private function handleFormAction( int $instructorId, bool $manageAll ): string {
|
||||
private function handleFormAction( int $instructorId, bool $manageAll ): void {
|
||||
// Nonce is verified by the caller (renderPage) before this method runs.
|
||||
// phpcs:disable WordPress.Security.NonceVerification.Missing
|
||||
$action = sanitize_key( Val::string( wp_unslash( $_POST['usc_action'] ?? '' ) ) );
|
||||
$action = sanitize_key( wp_unslash( $_POST['usc_action'] ?? '' ) );
|
||||
|
||||
if ( 'add' === $action ) {
|
||||
$offering = $this->offeringFromPost( $instructorId, $manageAll );
|
||||
if ( null !== $offering ) {
|
||||
$this->repository->insert( $offering );
|
||||
|
||||
return $this->reconcileNotice( $offering );
|
||||
}
|
||||
}
|
||||
|
||||
if ( 'update' === $action ) {
|
||||
$offeringId = absint( Val::int( $_POST['offering_id'] ?? 0 ) );
|
||||
if ( $offeringId > 0 ) {
|
||||
$existing = $this->repository->findById( $offeringId );
|
||||
if ( $existing && ( $manageAll || $existing->instructorId === $instructorId ) ) {
|
||||
$offering = $this->offeringFromPost( $instructorId, $manageAll, $existing );
|
||||
if ( null !== $offering ) {
|
||||
$this->repository->update( $offeringId, $offering );
|
||||
|
||||
return $this->reconcileNotice( $offering );
|
||||
}
|
||||
}
|
||||
}
|
||||
$this->addOffering( $instructorId );
|
||||
}
|
||||
|
||||
if ( 'delete' === $action ) {
|
||||
$offeringId = absint( Val::int( $_POST['offering_id'] ?? 0 ) );
|
||||
$offeringId = absint( $_POST['offering_id'] ?? 0 );
|
||||
if ( $offeringId > 0 ) {
|
||||
$offering = $this->repository->findById( $offeringId );
|
||||
if ( $offering && ( $manageAll || $offering->instructorId === $instructorId ) ) {
|
||||
@@ -97,197 +47,42 @@ class OfferingController {
|
||||
}
|
||||
}
|
||||
// phpcs:enable WordPress.Security.NonceVerification.Missing
|
||||
|
||||
return '';
|
||||
}
|
||||
|
||||
/**
|
||||
* Clear the assigned instructor's open booking slots that collide with a
|
||||
* scheduled group class and describe the result, warning about any booked
|
||||
* lesson that clashes (which the studio must resolve by hand).
|
||||
*/
|
||||
private function reconcileNotice( Offering $offering ): string {
|
||||
if ( Offering::KIND_GROUP_CLASS !== $offering->kind ) {
|
||||
return '';
|
||||
}
|
||||
|
||||
$result = $this->reconciler->reconcile( $offering );
|
||||
$parts = [];
|
||||
|
||||
if ( $result['removed'] > 0 ) {
|
||||
$parts[] = sprintf(
|
||||
/* translators: %d: number of open booking slots removed. */
|
||||
_n(
|
||||
'%d open booking slot was removed to hold the class time.',
|
||||
'%d open booking slots were removed to hold the class time.',
|
||||
$result['removed'],
|
||||
'unsupervised-schedular'
|
||||
),
|
||||
$result['removed']
|
||||
);
|
||||
}
|
||||
|
||||
foreach ( $result['conflicts'] as $startDt ) {
|
||||
$parts[] = sprintf(
|
||||
/* translators: %s: date and time of the already-booked lesson that clashes. */
|
||||
esc_html__( 'Conflict: a lesson is already booked at %s during this class.', 'unsupervised-schedular' ),
|
||||
(string) mysql2date( 'M j, Y g:i a', $startDt )
|
||||
);
|
||||
}
|
||||
|
||||
return implode( ' ', $parts );
|
||||
}
|
||||
|
||||
/**
|
||||
* Instructors offered in the assignment select, by display name.
|
||||
*
|
||||
* Includes everyone holding the `us_instructor` role plus, when the site owner
|
||||
* has left administrators acting as instructors (the default single-account
|
||||
* setup), WordPress administrators — who teach through the dynamic capability
|
||||
* grant rather than the role. Without them a solo studio owner running the
|
||||
* business from an admin account would find no one to assign a class to.
|
||||
*
|
||||
* @return list<array{id: int, name: string}>
|
||||
*/
|
||||
private function instructorOptions(): array {
|
||||
$roles = [ RoleManager::INSTRUCTOR ];
|
||||
if ( $this->access->adminsAreInstructors() ) {
|
||||
$roles[] = 'administrator';
|
||||
}
|
||||
|
||||
$users = array_filter(
|
||||
get_users(
|
||||
[
|
||||
'role__in' => $roles,
|
||||
'orderby' => 'display_name',
|
||||
'order' => 'ASC',
|
||||
]
|
||||
),
|
||||
static fn( mixed $u ): bool => $u instanceof \WP_User
|
||||
);
|
||||
|
||||
return array_values(
|
||||
array_map(
|
||||
static fn( \WP_User $u ): array => [
|
||||
'id' => (int) $u->ID,
|
||||
'name' => '' !== (string) $u->display_name ? (string) $u->display_name : (string) $u->user_email,
|
||||
],
|
||||
$users
|
||||
)
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Build an offering from the submitted add/edit form, or null when the
|
||||
* submission is invalid. When `$existing` is given the result is an edit:
|
||||
* it keeps the existing id and currency so an update can never rewrite those
|
||||
* from whoever submits the form.
|
||||
*
|
||||
* The owning instructor normally stays fixed (the creator on add, the existing
|
||||
* owner on edit). A studio admin (`$manageAll`) may instead assign the class to
|
||||
* any instructor via the picker; a blank or absent choice keeps the default.
|
||||
*/
|
||||
private function offeringFromPost( int $instructorId, bool $manageAll, ?Offering $existing = null ): ?Offering {
|
||||
// Nonce is verified by the caller (renderPage) before this method runs.
|
||||
private function addOffering( int $instructorId ): void {
|
||||
// phpcs:disable WordPress.Security.NonceVerification.Missing
|
||||
$title = sanitize_text_field( Val::string( wp_unslash( $_POST['title'] ?? '' ) ) );
|
||||
$kind = sanitize_key( Val::string( wp_unslash( $_POST['kind'] ?? '' ) ) );
|
||||
$title = sanitize_text_field( wp_unslash( $_POST['title'] ?? '' ) );
|
||||
$kind = sanitize_key( wp_unslash( $_POST['kind'] ?? '' ) );
|
||||
|
||||
if ( '' === $title || ! in_array( $kind, Offering::VALID_KINDS, true ) ) {
|
||||
return null;
|
||||
return;
|
||||
}
|
||||
|
||||
$scheduleNote = $this->nullableText( sanitize_text_field( Val::string( wp_unslash( $_POST['schedule_note'] ?? '' ) ) ) );
|
||||
$etransferEmail = $this->nullableText( sanitize_email( Val::string( wp_unslash( $_POST['etransfer_email'] ?? '' ) ) ) );
|
||||
|
||||
// Reject over-long fixed-size fields rather than let the DB silently drop them.
|
||||
if ( mb_strlen( $title ) > Offering::MAX_TITLE_LENGTH
|
||||
|| ( null !== $scheduleNote && mb_strlen( $scheduleNote ) > Offering::MAX_SCHEDULE_NOTE_LENGTH )
|
||||
|| ( null !== $etransferEmail && mb_strlen( $etransferEmail ) > Offering::MAX_ETRANSFER_EMAIL_LENGTH )
|
||||
) {
|
||||
return null;
|
||||
}
|
||||
|
||||
$billingMode = sanitize_key( Val::string( wp_unslash( $_POST['billing_mode'] ?? Offering::BILLING_ONE_TIME ) ) );
|
||||
$billingMode = sanitize_key( wp_unslash( $_POST['billing_mode'] ?? Offering::BILLING_ONE_TIME ) );
|
||||
if ( ! in_array( $billingMode, Offering::VALID_BILLING_MODES, true ) ) {
|
||||
$billingMode = Offering::BILLING_ONE_TIME;
|
||||
}
|
||||
|
||||
$duration = absint( Val::int( $_POST['duration_minutes'] ?? 0 ) );
|
||||
$capacity = absint( Val::int( $_POST['capacity'] ?? 0 ) );
|
||||
$duration = absint( $_POST['duration_minutes'] ?? 0 );
|
||||
$capacity = absint( $_POST['capacity'] ?? 0 );
|
||||
|
||||
// A blank cutoff means "use the studio default" (null); any entered value
|
||||
// (including 0 — cancel any time) is a per-offering override.
|
||||
$cutoffRaw = trim( sanitize_text_field( Val::string( wp_unslash( $_POST['cancellation_cutoff_hours'] ?? '' ) ) ) );
|
||||
$cutoffHours = '' === $cutoffRaw ? null : absint( Val::int( $cutoffRaw ) );
|
||||
|
||||
// Term dates: a class either meets once (term ends the day it starts)
|
||||
// or repeats weekly for a set number of sessions.
|
||||
$termStart = Offering::normalizeDate( sanitize_text_field( Val::string( wp_unslash( $_POST['term_start'] ?? '' ) ) ) );
|
||||
$termEnd = null;
|
||||
if ( null !== $termStart ) {
|
||||
$recurrence = sanitize_key( Val::string( wp_unslash( $_POST['term_recurrence'] ?? 'single' ) ) );
|
||||
$sessions = absint( Val::int( $_POST['term_sessions'] ?? 1 ) );
|
||||
$termEnd = 'weekly' === $recurrence ? Offering::weeklyTermEnd( $termStart, $sessions ) : $termStart;
|
||||
}
|
||||
|
||||
$classTime = Offering::normalizeTime( sanitize_text_field( Val::string( wp_unslash( $_POST['class_time'] ?? '' ) ) ) );
|
||||
|
||||
// A blank (or invalid) deadline means "use the default" — the first class
|
||||
// day (term_start), applied by Offering::effectiveEnrollmentDeadline().
|
||||
$enrollmentDeadline = Offering::normalizeDate( sanitize_text_field( Val::string( wp_unslash( $_POST['enrollment_deadline'] ?? '' ) ) ) );
|
||||
|
||||
// A blank (or invalid) withdrawal deadline leaves the column NULL, which
|
||||
// keeps self-withdrawal open for the class's whole life
|
||||
// (Offering::isWithdrawalOpen()). A set date closes it after that day.
|
||||
$withdrawalDeadline = Offering::normalizeDate( sanitize_text_field( Val::string( wp_unslash( $_POST['withdrawal_deadline'] ?? '' ) ) ) );
|
||||
|
||||
return new Offering(
|
||||
instructorId: $this->resolveInstructorId( $instructorId, $manageAll, $existing ),
|
||||
kind: $kind,
|
||||
title: $title,
|
||||
price: max( 0.0, (float) sanitize_text_field( Val::string( wp_unslash( $_POST['price'] ?? '0' ) ) ) ),
|
||||
currency: null !== $existing ? $existing->currency : 'CAD',
|
||||
billingMode: $billingMode,
|
||||
description: $this->nullableText( sanitize_textarea_field( Val::string( wp_unslash( $_POST['description'] ?? '' ) ) ) ),
|
||||
durationMinutes: $duration > 0 ? $duration : null,
|
||||
allowWeekly: isset( $_POST['allow_weekly'] ),
|
||||
capacity: $capacity > 0 ? $capacity : null,
|
||||
termStart: $termStart,
|
||||
termEnd: $termEnd,
|
||||
classTime: $classTime,
|
||||
enrollmentDeadline: $enrollmentDeadline,
|
||||
withdrawalDeadline: $withdrawalDeadline,
|
||||
scheduleNote: $scheduleNote,
|
||||
etransferEmail: $etransferEmail,
|
||||
cancellationCutoffHours: $cutoffHours,
|
||||
accessMode: isset( $_POST['invite_only'] ) ? Offering::ACCESS_INVITE_ONLY : Offering::ACCESS_PUBLIC,
|
||||
isActive: isset( $_POST['is_active'] ),
|
||||
id: $existing?->id,
|
||||
$this->repository->insert(
|
||||
new Offering(
|
||||
instructorId: $instructorId,
|
||||
kind: $kind,
|
||||
title: $title,
|
||||
price: max( 0.0, (float) sanitize_text_field( wp_unslash( $_POST['price'] ?? '0' ) ) ),
|
||||
billingMode: $billingMode,
|
||||
durationMinutes: $duration > 0 ? $duration : null,
|
||||
allowWeekly: isset( $_POST['allow_weekly'] ),
|
||||
capacity: $capacity > 0 ? $capacity : null,
|
||||
scheduleNote: $this->nullableText( sanitize_text_field( wp_unslash( $_POST['schedule_note'] ?? '' ) ) ),
|
||||
etransferEmail: $this->nullableText( sanitize_email( wp_unslash( $_POST['etransfer_email'] ?? '' ) ) ),
|
||||
)
|
||||
);
|
||||
// phpcs:enable WordPress.Security.NonceVerification.Missing
|
||||
}
|
||||
|
||||
/**
|
||||
* The instructor the offering should belong to. A studio admin may reassign it
|
||||
* via the posted `class_instructor_id`; otherwise it stays with the existing
|
||||
* owner (edit) or the current user (add). A plain instructor can never change
|
||||
* the owner, so the posted value is ignored unless `$manageAll` is set.
|
||||
*/
|
||||
private function resolveInstructorId( int $instructorId, bool $manageAll, ?Offering $existing ): int {
|
||||
$fallback = null !== $existing ? $existing->instructorId : $instructorId;
|
||||
|
||||
if ( ! $manageAll ) {
|
||||
return $fallback;
|
||||
}
|
||||
|
||||
// Nonce is verified by the caller (renderPage) before this method runs.
|
||||
// phpcs:ignore WordPress.Security.NonceVerification.Missing
|
||||
$posted = absint( Val::int( $_POST['class_instructor_id'] ?? 0 ) );
|
||||
|
||||
return $posted > 0 ? $posted : $fallback;
|
||||
}
|
||||
|
||||
private function nullableText( string $value ): ?string {
|
||||
return '' === $value ? null : $value;
|
||||
}
|
||||
|
||||
@@ -4,22 +4,11 @@ declare(strict_types=1);
|
||||
namespace Unsupervised\Schedular\Offering;
|
||||
|
||||
use Unsupervised\Schedular\Auth\RoleManager;
|
||||
use Unsupervised\Schedular\Auth\UserName;
|
||||
use Unsupervised\Schedular\GroupClass\GroupAccessRepository;
|
||||
use Unsupervised\Schedular\Val;
|
||||
|
||||
class OfferingEndpoint {
|
||||
|
||||
public function __construct(
|
||||
private OfferingRepository $repository,
|
||||
private GroupAccessRepository $access,
|
||||
) {}
|
||||
public function __construct( private OfferingRepository $repository ) {}
|
||||
|
||||
/**
|
||||
* Registers this endpoint's REST routes.
|
||||
*
|
||||
* @param non-falsy-string $route_namespace REST namespace the routes are registered under (e.g. `us-scheduler/v1`).
|
||||
*/
|
||||
public function registerRoutes( string $route_namespace ): void {
|
||||
register_rest_route(
|
||||
$route_namespace,
|
||||
@@ -28,7 +17,7 @@ class OfferingEndpoint {
|
||||
[
|
||||
'methods' => \WP_REST_Server::READABLE,
|
||||
'callback' => [ $this, 'index' ],
|
||||
'permission_callback' => [ $this, 'canRead' ],
|
||||
'permission_callback' => [ $this, 'canBook' ],
|
||||
'args' => [
|
||||
'instructor_id' => [
|
||||
'type' => 'integer',
|
||||
@@ -67,101 +56,38 @@ class OfferingEndpoint {
|
||||
}
|
||||
|
||||
public function index( \WP_REST_Request $request ): \WP_REST_Response {
|
||||
$instructorId = Val::int( $request->get_param( 'instructor_id' ) );
|
||||
$kind = Val::string( $request->get_param( 'kind' ) );
|
||||
$offerings = $this->repository->findAll(
|
||||
(int) $request->get_param( 'instructor_id' ),
|
||||
(string) $request->get_param( 'kind' ),
|
||||
activeOnly: true,
|
||||
);
|
||||
|
||||
// The public catalogue is public offerings only; invite-only classes are
|
||||
// hidden from it and surfaced separately to the students granted access.
|
||||
$offerings = $this->repository->findAll( $instructorId, $kind, activeOnly: true, accessMode: Offering::ACCESS_PUBLIC );
|
||||
|
||||
foreach ( $this->grantedInviteOnly( $instructorId, $kind ) as $granted ) {
|
||||
$offerings[] = $granted;
|
||||
}
|
||||
|
||||
// Public listing: omit the private e-transfer destination email, and
|
||||
// attach the assigned instructor's display name so the front end can show
|
||||
// students who teaches each class.
|
||||
return new \WP_REST_Response( array_map( [ $this, 'present' ], $offerings ), 200 );
|
||||
}
|
||||
|
||||
/**
|
||||
* A public-facing offering array with the assigned instructor's name added —
|
||||
* their real name or nickname, never the login (empty when the instructor
|
||||
* account no longer exists). See {@see UserName::format()}.
|
||||
*
|
||||
* @return array<string, mixed>
|
||||
*/
|
||||
private function present( Offering $offering ): array {
|
||||
$out = $offering->toArray( includeEtransferEmail: false );
|
||||
$user = get_userdata( $offering->instructorId );
|
||||
|
||||
$out['instructor_name'] = UserName::format( $user instanceof \WP_User ? $user : null );
|
||||
|
||||
return $out;
|
||||
}
|
||||
|
||||
/**
|
||||
* The active invite-only offerings the caller has been granted access to,
|
||||
* matching the same instructor/kind filters as the public catalogue.
|
||||
*
|
||||
* @return list<Offering>
|
||||
*/
|
||||
private function grantedInviteOnly( int $instructorId, string $kind ): array {
|
||||
$grantedIds = $this->access->findGrantedOfferingIds( get_current_user_id() );
|
||||
if ( [] === $grantedIds ) {
|
||||
return [];
|
||||
}
|
||||
|
||||
$out = [];
|
||||
foreach ( $grantedIds as $offeringId ) {
|
||||
$offering = $this->repository->findById( $offeringId );
|
||||
|
||||
if (
|
||||
null === $offering
|
||||
|| ! $offering->isActive
|
||||
|| ! $offering->isInviteOnly()
|
||||
|| ( $instructorId > 0 && $offering->instructorId !== $instructorId )
|
||||
|| ( '' !== $kind && $offering->kind !== $kind )
|
||||
) {
|
||||
continue;
|
||||
}
|
||||
|
||||
$out[] = $offering;
|
||||
}
|
||||
|
||||
return $out;
|
||||
// Public listing: omit the private e-transfer destination email.
|
||||
return new \WP_REST_Response( array_map( fn( Offering $o ) => $o->toArray( includeEtransferEmail: false ), $offerings ), 200 );
|
||||
}
|
||||
|
||||
public function create( \WP_REST_Request $request ): \WP_REST_Response|\WP_Error {
|
||||
$title = sanitize_text_field( Val::string( $request->get_param( 'title' ) ) );
|
||||
$title = sanitize_text_field( (string) $request->get_param( 'title' ) );
|
||||
if ( '' === $title ) {
|
||||
return $this->invalid( __( 'A title is required.', 'unsupervised-schedular' ) );
|
||||
}
|
||||
|
||||
$kind = Val::string( $request->get_param( 'kind' ) );
|
||||
$kind = (string) $request->get_param( 'kind' );
|
||||
if ( ! in_array( $kind, Offering::VALID_KINDS, true ) ) {
|
||||
return $this->invalid( __( 'Invalid offering kind.', 'unsupervised-schedular' ) );
|
||||
}
|
||||
|
||||
$billingMode = Val::string( $request->get_param( 'billing_mode' ) ?? Offering::BILLING_ONE_TIME );
|
||||
$billingMode = (string) ( $request->get_param( 'billing_mode' ) ?? Offering::BILLING_ONE_TIME );
|
||||
if ( ! in_array( $billingMode, Offering::VALID_BILLING_MODES, true ) ) {
|
||||
return $this->invalid( __( 'Invalid billing mode.', 'unsupervised-schedular' ) );
|
||||
}
|
||||
|
||||
$scheduleNote = $this->nullableText( $request->get_param( 'schedule_note' ) );
|
||||
$etransferEmail = $this->nullableEmail( $request->get_param( 'etransfer_email' ) );
|
||||
|
||||
$lengthError = $this->checkLengths( $title, $scheduleNote, $etransferEmail );
|
||||
if ( $lengthError instanceof \WP_Error ) {
|
||||
return $lengthError;
|
||||
}
|
||||
|
||||
$offering = new Offering(
|
||||
instructorId: get_current_user_id(),
|
||||
kind: $kind,
|
||||
title: $title,
|
||||
price: $this->price( $request->get_param( 'price' ) ),
|
||||
currency: sanitize_text_field( Val::string( $request->get_param( 'currency' ) ?? 'CAD' ) ),
|
||||
currency: sanitize_text_field( (string) ( $request->get_param( 'currency' ) ?? 'CAD' ) ),
|
||||
billingMode: $billingMode,
|
||||
description: $this->nullableText( $request->get_param( 'description' ) ),
|
||||
durationMinutes: $this->nullableInt( $request->get_param( 'duration_minutes' ) ),
|
||||
@@ -169,11 +95,8 @@ class OfferingEndpoint {
|
||||
capacity: $this->nullableInt( $request->get_param( 'capacity' ) ),
|
||||
termStart: $this->nullableText( $request->get_param( 'term_start' ) ),
|
||||
termEnd: $this->nullableText( $request->get_param( 'term_end' ) ),
|
||||
enrollmentDeadline: $this->nullableText( $request->get_param( 'enrollment_deadline' ) ),
|
||||
scheduleNote: $scheduleNote,
|
||||
etransferEmail: $etransferEmail,
|
||||
cancellationCutoffHours: $this->nullableInt( $request->get_param( 'cancellation_cutoff_hours' ) ),
|
||||
accessMode: $this->accessMode( $request->get_param( 'access_mode' ), Offering::ACCESS_PUBLIC ),
|
||||
scheduleNote: $this->nullableText( $request->get_param( 'schedule_note' ) ),
|
||||
etransferEmail: $this->nullableEmail( $request->get_param( 'etransfer_email' ) ),
|
||||
isActive: null === $request->get_param( 'is_active' ) ? true : (bool) $request->get_param( 'is_active' ),
|
||||
);
|
||||
|
||||
@@ -183,7 +106,7 @@ class OfferingEndpoint {
|
||||
}
|
||||
|
||||
public function update( \WP_REST_Request $request ): \WP_REST_Response|\WP_Error {
|
||||
$id = absint( Val::int( $request->get_param( 'id' ) ) );
|
||||
$id = absint( $request->get_param( 'id' ) );
|
||||
$existing = $this->repository->findById( $id );
|
||||
|
||||
if ( null === $existing ) {
|
||||
@@ -194,31 +117,22 @@ class OfferingEndpoint {
|
||||
return new \WP_Error( 'forbidden', __( 'You cannot edit this offering.', 'unsupervised-schedular' ), [ 'status' => 403 ] );
|
||||
}
|
||||
|
||||
$kind = $request->has_param( 'kind' ) ? Val::string( $request->get_param( 'kind' ) ) : $existing->kind;
|
||||
$kind = $request->has_param( 'kind' ) ? (string) $request->get_param( 'kind' ) : $existing->kind;
|
||||
if ( ! in_array( $kind, Offering::VALID_KINDS, true ) ) {
|
||||
return $this->invalid( __( 'Invalid offering kind.', 'unsupervised-schedular' ) );
|
||||
}
|
||||
|
||||
$billingMode = $request->has_param( 'billing_mode' ) ? Val::string( $request->get_param( 'billing_mode' ) ) : $existing->billingMode;
|
||||
$billingMode = $request->has_param( 'billing_mode' ) ? (string) $request->get_param( 'billing_mode' ) : $existing->billingMode;
|
||||
if ( ! in_array( $billingMode, Offering::VALID_BILLING_MODES, true ) ) {
|
||||
return $this->invalid( __( 'Invalid billing mode.', 'unsupervised-schedular' ) );
|
||||
}
|
||||
|
||||
$title = $request->has_param( 'title' ) ? sanitize_text_field( Val::string( $request->get_param( 'title' ) ) ) : $existing->title;
|
||||
$scheduleNote = $request->has_param( 'schedule_note' ) ? $this->nullableText( $request->get_param( 'schedule_note' ) ) : $existing->scheduleNote;
|
||||
$etransferEmail = $request->has_param( 'etransfer_email' ) ? $this->nullableEmail( $request->get_param( 'etransfer_email' ) ) : $existing->etransferEmail;
|
||||
|
||||
$lengthError = $this->checkLengths( $title, $scheduleNote, $etransferEmail );
|
||||
if ( $lengthError instanceof \WP_Error ) {
|
||||
return $lengthError;
|
||||
}
|
||||
|
||||
$offering = new Offering(
|
||||
instructorId: $existing->instructorId,
|
||||
kind: $kind,
|
||||
title: $title,
|
||||
title: $request->has_param( 'title' ) ? sanitize_text_field( (string) $request->get_param( 'title' ) ) : $existing->title,
|
||||
price: $request->has_param( 'price' ) ? $this->price( $request->get_param( 'price' ) ) : $existing->price,
|
||||
currency: $request->has_param( 'currency' ) ? sanitize_text_field( Val::string( $request->get_param( 'currency' ) ) ) : $existing->currency,
|
||||
currency: $request->has_param( 'currency' ) ? sanitize_text_field( (string) $request->get_param( 'currency' ) ) : $existing->currency,
|
||||
billingMode: $billingMode,
|
||||
description: $request->has_param( 'description' ) ? $this->nullableText( $request->get_param( 'description' ) ) : $existing->description,
|
||||
durationMinutes: $request->has_param( 'duration_minutes' ) ? $this->nullableInt( $request->get_param( 'duration_minutes' ) ) : $existing->durationMinutes,
|
||||
@@ -226,11 +140,8 @@ class OfferingEndpoint {
|
||||
capacity: $request->has_param( 'capacity' ) ? $this->nullableInt( $request->get_param( 'capacity' ) ) : $existing->capacity,
|
||||
termStart: $request->has_param( 'term_start' ) ? $this->nullableText( $request->get_param( 'term_start' ) ) : $existing->termStart,
|
||||
termEnd: $request->has_param( 'term_end' ) ? $this->nullableText( $request->get_param( 'term_end' ) ) : $existing->termEnd,
|
||||
enrollmentDeadline: $request->has_param( 'enrollment_deadline' ) ? $this->nullableText( $request->get_param( 'enrollment_deadline' ) ) : $existing->enrollmentDeadline,
|
||||
scheduleNote: $scheduleNote,
|
||||
etransferEmail: $etransferEmail,
|
||||
cancellationCutoffHours: $request->has_param( 'cancellation_cutoff_hours' ) ? $this->nullableInt( $request->get_param( 'cancellation_cutoff_hours' ) ) : $existing->cancellationCutoffHours,
|
||||
accessMode: $request->has_param( 'access_mode' ) ? $this->accessMode( $request->get_param( 'access_mode' ), $existing->accessMode ) : $existing->accessMode,
|
||||
scheduleNote: $request->has_param( 'schedule_note' ) ? $this->nullableText( $request->get_param( 'schedule_note' ) ) : $existing->scheduleNote,
|
||||
etransferEmail: $request->has_param( 'etransfer_email' ) ? $this->nullableEmail( $request->get_param( 'etransfer_email' ) ) : $existing->etransferEmail,
|
||||
isActive: $request->has_param( 'is_active' ) ? (bool) $request->get_param( 'is_active' ) : $existing->isActive,
|
||||
id: $id,
|
||||
);
|
||||
@@ -241,7 +152,7 @@ class OfferingEndpoint {
|
||||
}
|
||||
|
||||
public function delete( \WP_REST_Request $request ): \WP_REST_Response|\WP_Error {
|
||||
$id = absint( Val::int( $request->get_param( 'id' ) ) );
|
||||
$id = absint( $request->get_param( 'id' ) );
|
||||
$existing = $this->repository->findById( $id );
|
||||
|
||||
if ( null === $existing ) {
|
||||
@@ -262,16 +173,12 @@ class OfferingEndpoint {
|
||||
}
|
||||
|
||||
/**
|
||||
* Reading the offerings catalogue has no anonymous consumer, so it stays
|
||||
* behind a login. Students reach it through the booking flow, and studio
|
||||
* admins and instructors reach it from the block editor's group-class
|
||||
* pickers — an administrator holds `manage_offerings` but not
|
||||
* `book_lesson`, so both capabilities open the listing.
|
||||
* Reading the offerings catalogue is only needed by the logged-in student
|
||||
* booking flow, so it requires the same capability as booking — there is no
|
||||
* anonymous consumer.
|
||||
*/
|
||||
public function canRead(): bool {
|
||||
return is_user_logged_in()
|
||||
&& ( current_user_can( RoleManager::CAP_BOOK_LESSON )
|
||||
|| current_user_can( RoleManager::CAP_MANAGE_OFFERINGS ) );
|
||||
public function canBook(): bool {
|
||||
return is_user_logged_in() && current_user_can( RoleManager::CAP_BOOK_LESSON );
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -287,52 +194,18 @@ class OfferingEndpoint {
|
||||
return new \WP_Error( 'invalid_offering', $message, [ 'status' => 400 ] );
|
||||
}
|
||||
|
||||
/**
|
||||
* Reject any fixed-size field whose value exceeds its column length, so an
|
||||
* over-long value is refused with a clear 400 rather than silently dropped
|
||||
* by the database.
|
||||
*/
|
||||
private function checkLengths( string $title, ?string $scheduleNote, ?string $etransferEmail ): ?\WP_Error {
|
||||
$fields = [
|
||||
[ __( 'title', 'unsupervised-schedular' ), $title, Offering::MAX_TITLE_LENGTH ],
|
||||
[ __( 'schedule note', 'unsupervised-schedular' ), $scheduleNote, Offering::MAX_SCHEDULE_NOTE_LENGTH ],
|
||||
[ __( 'e-transfer email', 'unsupervised-schedular' ), $etransferEmail, Offering::MAX_ETRANSFER_EMAIL_LENGTH ],
|
||||
];
|
||||
|
||||
foreach ( $fields as [ $name, $value, $max ] ) {
|
||||
if ( null !== $value && mb_strlen( $value ) > $max ) {
|
||||
return $this->invalid(
|
||||
sprintf(
|
||||
/* translators: 1: field name, 2: maximum character count. */
|
||||
__( 'The %1$s must be %2$d characters or fewer.', 'unsupervised-schedular' ),
|
||||
$name,
|
||||
$max
|
||||
)
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
return null;
|
||||
}
|
||||
|
||||
private function price( mixed $value ): float {
|
||||
return max( 0.0, Val::float( $value ) );
|
||||
return max( 0.0, (float) $value );
|
||||
}
|
||||
|
||||
private function nullableEmail( mixed $value ): ?string {
|
||||
$email = sanitize_email( Val::string( $value ) );
|
||||
$email = sanitize_email( (string) $value );
|
||||
|
||||
return '' !== $email ? $email : null;
|
||||
}
|
||||
|
||||
private function accessMode( mixed $value, string $fallback ): string {
|
||||
$mode = Val::string( $value );
|
||||
|
||||
return in_array( $mode, Offering::VALID_ACCESS_MODES, true ) ? $mode : $fallback;
|
||||
}
|
||||
|
||||
private function nullableInt( mixed $value ): ?int {
|
||||
return ( null === $value || '' === $value ) ? null : Val::int( $value );
|
||||
return ( null === $value || '' === $value ) ? null : (int) $value;
|
||||
}
|
||||
|
||||
private function nullableText( mixed $value ): ?string {
|
||||
@@ -340,6 +213,6 @@ class OfferingEndpoint {
|
||||
return null;
|
||||
}
|
||||
|
||||
return sanitize_text_field( Val::string( $value ) );
|
||||
return sanitize_text_field( (string) $value );
|
||||
}
|
||||
}
|
||||
|
||||
@@ -14,13 +14,11 @@ class OfferingRepository {
|
||||
/**
|
||||
* Column formats aligned to {@see columns()} (instructor_id, kind, title,
|
||||
* description, duration_minutes, price, currency, billing_mode, allow_weekly,
|
||||
* capacity, term_start, term_end, class_time, enrollment_deadline,
|
||||
* withdrawal_deadline, schedule_note, etransfer_email,
|
||||
* cancellation_cutoff_hours, access_mode, is_active).
|
||||
* capacity, term_start, term_end, schedule_note, etransfer_email, is_active).
|
||||
*
|
||||
* @var list<string>
|
||||
*/
|
||||
private const COLUMN_FORMATS = [ '%d', '%s', '%s', '%s', '%d', '%f', '%s', '%s', '%d', '%d', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%d', '%s', '%d' ];
|
||||
private const COLUMN_FORMATS = [ '%d', '%s', '%s', '%s', '%d', '%f', '%s', '%s', '%d', '%d', '%s', '%s', '%s', '%s', '%d' ];
|
||||
|
||||
public function insert( Offering $offering ): int {
|
||||
$this->db->insert(
|
||||
@@ -49,37 +47,30 @@ class OfferingRepository {
|
||||
*/
|
||||
private function columns( Offering $offering ): array {
|
||||
return [
|
||||
'instructor_id' => $offering->instructorId,
|
||||
'kind' => $offering->kind,
|
||||
'title' => $offering->title,
|
||||
'description' => $offering->description,
|
||||
'duration_minutes' => $offering->durationMinutes,
|
||||
'price' => $offering->price,
|
||||
'currency' => $offering->currency,
|
||||
'billing_mode' => $offering->billingMode,
|
||||
'allow_weekly' => $offering->allowWeekly ? 1 : 0,
|
||||
'capacity' => $offering->capacity,
|
||||
'term_start' => $offering->termStart,
|
||||
'term_end' => $offering->termEnd,
|
||||
'class_time' => $offering->classTime,
|
||||
'enrollment_deadline' => $offering->enrollmentDeadline,
|
||||
'withdrawal_deadline' => $offering->withdrawalDeadline,
|
||||
'schedule_note' => $offering->scheduleNote,
|
||||
'etransfer_email' => $offering->etransferEmail,
|
||||
'cancellation_cutoff_hours' => $offering->cancellationCutoffHours,
|
||||
'access_mode' => $offering->accessMode,
|
||||
'is_active' => $offering->isActive ? 1 : 0,
|
||||
'instructor_id' => $offering->instructorId,
|
||||
'kind' => $offering->kind,
|
||||
'title' => $offering->title,
|
||||
'description' => $offering->description,
|
||||
'duration_minutes' => $offering->durationMinutes,
|
||||
'price' => $offering->price,
|
||||
'currency' => $offering->currency,
|
||||
'billing_mode' => $offering->billingMode,
|
||||
'allow_weekly' => $offering->allowWeekly ? 1 : 0,
|
||||
'capacity' => $offering->capacity,
|
||||
'term_start' => $offering->termStart,
|
||||
'term_end' => $offering->termEnd,
|
||||
'schedule_note' => $offering->scheduleNote,
|
||||
'etransfer_email' => $offering->etransferEmail,
|
||||
'is_active' => $offering->isActive ? 1 : 0,
|
||||
];
|
||||
}
|
||||
|
||||
/**
|
||||
* Find offerings, optionally filtered by instructor, kind, active state, and
|
||||
* access mode (e.g. `Offering::ACCESS_PUBLIC` to exclude invite-only classes
|
||||
* from the public catalogue).
|
||||
* Find offerings, optionally filtered by instructor, kind, and active state.
|
||||
*
|
||||
* @return list<Offering>
|
||||
*/
|
||||
public function findAll( int $instructorId = 0, string $kind = '', ?bool $activeOnly = null, ?string $accessMode = null ): array {
|
||||
public function findAll( int $instructorId = 0, string $kind = '', ?bool $activeOnly = null ): array {
|
||||
$where = [ '1 = 1' ];
|
||||
$params = [];
|
||||
|
||||
@@ -98,24 +89,19 @@ class OfferingRepository {
|
||||
$params[] = $activeOnly ? 1 : 0;
|
||||
}
|
||||
|
||||
if ( null !== $accessMode ) {
|
||||
$where[] = 'access_mode = %s';
|
||||
$params[] = $accessMode;
|
||||
}
|
||||
|
||||
$whereClause = implode( ' AND ', $where );
|
||||
$sql = "SELECT * FROM %i WHERE {$whereClause} ORDER BY title ASC";
|
||||
$sql = "SELECT * FROM {$this->table} WHERE {$whereClause} ORDER BY title ASC";
|
||||
|
||||
$rows = $this->db->get_results(
|
||||
$this->db->prepare( $sql, array_merge( [ $this->table ], $params ) )
|
||||
);
|
||||
$rows = $params
|
||||
? $this->db->get_results( $this->db->prepare( $sql, $params ) )
|
||||
: $this->db->get_results( $sql );
|
||||
|
||||
return array_map( Offering::fromRow( ... ), $rows ?? [] );
|
||||
}
|
||||
|
||||
public function findById( int $id ): ?Offering {
|
||||
$row = $this->db->get_row(
|
||||
$this->db->prepare( 'SELECT * FROM %i WHERE id = %d', $this->table, $id )
|
||||
$this->db->prepare( "SELECT * FROM {$this->table} WHERE id = %d", $id )
|
||||
);
|
||||
|
||||
return $row ? Offering::fromRow( $row ) : null;
|
||||
|
||||
@@ -3,8 +3,6 @@ declare(strict_types=1);
|
||||
|
||||
namespace Unsupervised\Schedular\Payment;
|
||||
|
||||
use Unsupervised\Schedular\Val;
|
||||
|
||||
/**
|
||||
* Resolves the billing method for a student: a per-student override if set,
|
||||
* otherwise the studio default — card when Stripe is configured, e-transfer when
|
||||
@@ -17,7 +15,7 @@ class BillingMethodResolver {
|
||||
public function __construct( private StudioSettings $settings ) {}
|
||||
|
||||
public function resolve( int $studentId ): string {
|
||||
$override = Val::string( get_user_meta( $studentId, self::META_METHOD, true ) );
|
||||
$override = (string) get_user_meta( $studentId, self::META_METHOD, true );
|
||||
if ( in_array( $override, Payment::VALID_METHODS, true ) ) {
|
||||
return $override;
|
||||
}
|
||||
|
||||
@@ -1,96 +0,0 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace Unsupervised\Schedular\Payment;
|
||||
|
||||
use Unsupervised\Schedular\Val;
|
||||
|
||||
/**
|
||||
* A studio credit held on a student's account — money already paid for a lesson
|
||||
* that was later cancelled. Credits are consumed against future scheduled-billing
|
||||
* charges (weekly / monthly) before the student is asked to pay, oldest first.
|
||||
*/
|
||||
class Credit {
|
||||
|
||||
public const STATUS_AVAILABLE = 'available';
|
||||
public const STATUS_CONSUMED = 'consumed';
|
||||
|
||||
/**
|
||||
* All valid credit statuses.
|
||||
*
|
||||
* @var list<string>
|
||||
*/
|
||||
public const VALID_STATUSES = [ self::STATUS_AVAILABLE, self::STATUS_CONSUMED ];
|
||||
|
||||
public function __construct(
|
||||
public readonly int $studentId,
|
||||
public readonly float $amount,
|
||||
public readonly float $remaining,
|
||||
/**
|
||||
* The account holding this balance — a child's guardian, or 0 meaning
|
||||
* "the student themselves". A family's credits all sit on the guardian,
|
||||
* so one child's cancellation can settle a sibling's charge.
|
||||
*/
|
||||
public readonly int $payerId = 0,
|
||||
public readonly string $currency = 'CAD',
|
||||
public readonly ?int $sourcePaymentId = null,
|
||||
public readonly ?int $sourceLessonId = null,
|
||||
public readonly ?string $reason = null,
|
||||
public readonly string $status = self::STATUS_AVAILABLE,
|
||||
public readonly ?string $createdAt = null,
|
||||
public readonly ?string $updatedAt = null,
|
||||
public readonly ?int $id = null,
|
||||
) {}
|
||||
|
||||
public static function fromRow( \stdClass $row ): self {
|
||||
return new self(
|
||||
studentId: Val::int( $row->student_id ),
|
||||
amount: Val::float( $row->amount ),
|
||||
remaining: Val::float( $row->remaining ),
|
||||
payerId: Val::int( $row->payer_id ?? 0 ),
|
||||
currency: Val::string( $row->currency ),
|
||||
sourcePaymentId: Val::intOrNull( $row->source_payment_id ?? null ),
|
||||
sourceLessonId: Val::intOrNull( $row->source_lesson_id ?? null ),
|
||||
reason: Val::stringOrNull( $row->reason ?? null ),
|
||||
status: Val::string( $row->status ),
|
||||
createdAt: Val::stringOrNull( $row->created_at ?? null ),
|
||||
updatedAt: Val::stringOrNull( $row->updated_at ?? null ),
|
||||
id: Val::int( $row->id ),
|
||||
);
|
||||
}
|
||||
|
||||
public function isAvailable(): bool {
|
||||
return self::STATUS_AVAILABLE === $this->status && $this->remaining > 0.0;
|
||||
}
|
||||
|
||||
/**
|
||||
* Whose balance this credit sits in: the recorded payer, falling back to the
|
||||
* student. Callers go through here rather than reading `payerId`, so the `0`
|
||||
* default of a pre-guardian credit never leaks out as a user id.
|
||||
*/
|
||||
public function payerOrStudent(): int {
|
||||
return $this->payerId > 0 ? $this->payerId : $this->studentId;
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns a plain array representation of the credit.
|
||||
*
|
||||
* @return array<string, mixed>
|
||||
*/
|
||||
public function toArray(): array {
|
||||
return [
|
||||
'id' => $this->id,
|
||||
'student_id' => $this->studentId,
|
||||
'payer_id' => $this->payerOrStudent(),
|
||||
'amount' => $this->amount,
|
||||
'remaining' => $this->remaining,
|
||||
'currency' => $this->currency,
|
||||
'source_payment_id' => $this->sourcePaymentId,
|
||||
'source_lesson_id' => $this->sourceLessonId,
|
||||
'reason' => $this->reason,
|
||||
'status' => $this->status,
|
||||
'created_at' => $this->createdAt,
|
||||
'updated_at' => $this->updatedAt,
|
||||
];
|
||||
}
|
||||
}
|
||||
@@ -1,167 +0,0 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace Unsupervised\Schedular\Payment;
|
||||
|
||||
class CreditRepository {
|
||||
|
||||
private string $table;
|
||||
|
||||
public function __construct( private \wpdb $db ) {
|
||||
$this->table = $db->prefix . 'us_credits';
|
||||
}
|
||||
|
||||
public function insert( Credit $credit ): int {
|
||||
$this->db->insert(
|
||||
$this->table,
|
||||
[
|
||||
'student_id' => $credit->studentId,
|
||||
'payer_id' => $credit->payerOrStudent(),
|
||||
'amount' => $credit->amount,
|
||||
'remaining' => $credit->remaining,
|
||||
'currency' => $credit->currency,
|
||||
'source_payment_id' => $credit->sourcePaymentId,
|
||||
'source_lesson_id' => $credit->sourceLessonId,
|
||||
'reason' => $credit->reason,
|
||||
'status' => $credit->status,
|
||||
'created_at' => current_time( 'mysql' ),
|
||||
],
|
||||
[ '%d', '%d', '%f', '%f', '%s', '%d', '%d', '%s', '%s', '%s' ]
|
||||
);
|
||||
|
||||
return $this->db->insert_id;
|
||||
}
|
||||
|
||||
public function findById( int $id ): ?Credit {
|
||||
$row = $this->db->get_row(
|
||||
$this->db->prepare( 'SELECT * FROM %i WHERE id = %d', $this->table, $id )
|
||||
);
|
||||
|
||||
return $row ? Credit::fromRow( $row ) : null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Whether a credit has already been issued for a cancelled lesson, so cancelling
|
||||
* (or re-cancelling) the same lesson never grants a second credit.
|
||||
*/
|
||||
public function existsForLesson( int $lessonId ): bool {
|
||||
$found = $this->db->get_var(
|
||||
$this->db->prepare(
|
||||
'SELECT id FROM %i WHERE source_lesson_id = %d LIMIT 1',
|
||||
$this->table,
|
||||
$lessonId
|
||||
)
|
||||
);
|
||||
|
||||
return null !== $found;
|
||||
}
|
||||
|
||||
/**
|
||||
* A payer's total unused credit balance (sum of the remaining amounts of every
|
||||
* still-available credit). Keyed on the payer, so a guardian's balance covers
|
||||
* credits earned by any of their children — one family, one balance.
|
||||
*/
|
||||
public function availableBalance( int $payerId ): float {
|
||||
$total = $this->db->get_var(
|
||||
$this->db->prepare(
|
||||
'SELECT COALESCE( SUM( remaining ), 0 ) FROM %i WHERE payer_id = %d AND status = %s',
|
||||
$this->table,
|
||||
$payerId,
|
||||
Credit::STATUS_AVAILABLE
|
||||
)
|
||||
);
|
||||
|
||||
return round( (float) $total, 2 );
|
||||
}
|
||||
|
||||
/**
|
||||
* A payer's still-available credits, oldest first — the FIFO order they are
|
||||
* consumed in.
|
||||
*
|
||||
* @return list<Credit>
|
||||
*/
|
||||
public function findAvailableByPayer( int $payerId ): array {
|
||||
$rows = $this->db->get_results(
|
||||
$this->db->prepare(
|
||||
'SELECT * FROM %i WHERE payer_id = %d AND status = %s AND remaining > 0 ORDER BY created_at ASC, id ASC',
|
||||
$this->table,
|
||||
$payerId,
|
||||
Credit::STATUS_AVAILABLE
|
||||
)
|
||||
);
|
||||
|
||||
return array_map( Credit::fromRow( ... ), $rows ?? [] );
|
||||
}
|
||||
|
||||
/**
|
||||
* Every credit earned by a student, newest first — the admin history on their
|
||||
* own screen. Unlike the balance this is keyed on the student, so a child's
|
||||
* screen shows the credits their cancellations produced even though the
|
||||
* balance itself sits with their guardian.
|
||||
*
|
||||
* @return list<Credit>
|
||||
*/
|
||||
public function findByStudent( int $studentId ): array {
|
||||
$rows = $this->db->get_results(
|
||||
$this->db->prepare(
|
||||
'SELECT * FROM %i WHERE student_id = %d ORDER BY created_at DESC, id DESC',
|
||||
$this->table,
|
||||
$studentId
|
||||
)
|
||||
);
|
||||
|
||||
return array_map( Credit::fromRow( ... ), $rows ?? [] );
|
||||
}
|
||||
|
||||
/**
|
||||
* Backfill `payer_id` on credits written before guardian accounts existed,
|
||||
* where the student was always the payer. Run once from the installer so the
|
||||
* payer-keyed balance queries see those rows.
|
||||
*/
|
||||
public function backfillPayerIds(): void {
|
||||
$sql = $this->db->prepare( 'UPDATE %i SET payer_id = student_id WHERE payer_id = 0', $this->table );
|
||||
|
||||
if ( null !== $sql ) {
|
||||
$this->db->query( $sql );
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Draw down a payer's credit balance by $amount, consuming their available
|
||||
* credits oldest first and marking each fully-spent credit `consumed`. Stops once
|
||||
* the amount is exhausted; a balance shorter than $amount simply drains to zero.
|
||||
*/
|
||||
public function consume( int $payerId, float $amount ): void {
|
||||
$remaining = round( $amount, 2 );
|
||||
if ( $remaining <= 0.0 ) {
|
||||
return;
|
||||
}
|
||||
|
||||
foreach ( $this->findAvailableByPayer( $payerId ) as $credit ) {
|
||||
if ( $remaining <= 0.0 ) {
|
||||
break;
|
||||
}
|
||||
if ( null === $credit->id ) {
|
||||
continue;
|
||||
}
|
||||
|
||||
$take = min( $credit->remaining, $remaining );
|
||||
$newRemaining = round( $credit->remaining - $take, 2 );
|
||||
$status = $newRemaining <= 0.0 ? Credit::STATUS_CONSUMED : Credit::STATUS_AVAILABLE;
|
||||
|
||||
$this->db->update(
|
||||
$this->table,
|
||||
[
|
||||
'remaining' => $newRemaining,
|
||||
'status' => $status,
|
||||
'updated_at' => current_time( 'mysql' ),
|
||||
],
|
||||
[ 'id' => $credit->id ],
|
||||
[ '%f', '%s', '%s' ],
|
||||
[ '%d' ]
|
||||
);
|
||||
|
||||
$remaining = round( $remaining - $take, 2 );
|
||||
}
|
||||
}
|
||||
}
|
||||
+17
-94
@@ -3,8 +3,6 @@ declare(strict_types=1);
|
||||
|
||||
namespace Unsupervised\Schedular\Payment;
|
||||
|
||||
use Unsupervised\Schedular\Val;
|
||||
|
||||
class Payment {
|
||||
|
||||
public const METHOD_CARD = 'card';
|
||||
@@ -39,55 +37,37 @@ class Payment {
|
||||
public readonly string $registrationType,
|
||||
public readonly int $registrationId,
|
||||
public readonly float $amount,
|
||||
/**
|
||||
* The account that owes this charge — a child's guardian, or 0 meaning
|
||||
* "the student themselves". Zero rather than a copy of `studentId` so
|
||||
* every payment written before guardian accounts existed reads back with
|
||||
* its original meaning without a data migration.
|
||||
*/
|
||||
public readonly int $payerId = 0,
|
||||
public readonly string $currency = 'CAD',
|
||||
public readonly string $method = self::METHOD_ETRANSFER,
|
||||
public readonly string $status = self::STATUS_PENDING,
|
||||
public readonly float $taxRate = 0.0,
|
||||
public readonly float $taxAmount = 0.0,
|
||||
public readonly float $creditApplied = 0.0,
|
||||
public readonly ?string $dueDate = null,
|
||||
public readonly ?string $periodKey = null,
|
||||
public readonly ?string $noticeBatch = null,
|
||||
public readonly ?string $etransferEmail = null,
|
||||
public readonly ?string $stripePaymentIntentId = null,
|
||||
public readonly ?string $receiptNumber = null,
|
||||
public readonly ?string $receiptSentAt = null,
|
||||
public readonly ?string $paidAt = null,
|
||||
public readonly ?string $createdAt = null,
|
||||
public readonly ?int $id = null,
|
||||
) {}
|
||||
|
||||
public static function fromRow( \stdClass $row ): self {
|
||||
public static function fromRow( object $row ): self {
|
||||
return new self(
|
||||
studentId: Val::int( $row->student_id ),
|
||||
instructorId: Val::int( $row->instructor_id ),
|
||||
registrationType: Val::string( $row->registration_type ),
|
||||
registrationId: Val::int( $row->registration_id ),
|
||||
amount: Val::float( $row->amount ),
|
||||
payerId: Val::int( $row->payer_id ?? 0 ),
|
||||
currency: Val::string( $row->currency ),
|
||||
method: Val::string( $row->method ),
|
||||
status: Val::string( $row->status ),
|
||||
taxRate: Val::float( $row->tax_rate ),
|
||||
taxAmount: Val::float( $row->tax_amount ),
|
||||
creditApplied: Val::float( $row->credit_applied ?? 0 ),
|
||||
dueDate: Val::stringOrNull( $row->due_date ?? null ),
|
||||
periodKey: Val::stringOrNull( $row->period_key ?? null ),
|
||||
noticeBatch: Val::stringOrNull( $row->notice_batch ?? null ),
|
||||
etransferEmail: Val::stringOrNull( $row->etransfer_email ),
|
||||
stripePaymentIntentId: Val::stringOrNull( $row->stripe_payment_intent_id ),
|
||||
receiptNumber: Val::stringOrNull( $row->receipt_number ),
|
||||
receiptSentAt: Val::stringOrNull( $row->receipt_sent_at ),
|
||||
paidAt: Val::stringOrNull( $row->paid_at ),
|
||||
createdAt: Val::stringOrNull( $row->created_at ),
|
||||
id: Val::int( $row->id ),
|
||||
studentId: (int) $row->student_id,
|
||||
instructorId: (int) $row->instructor_id,
|
||||
registrationType: $row->registration_type,
|
||||
registrationId: (int) $row->registration_id,
|
||||
amount: (float) $row->amount,
|
||||
currency: $row->currency,
|
||||
method: $row->method,
|
||||
status: $row->status,
|
||||
taxRate: (float) $row->tax_rate,
|
||||
taxAmount: (float) $row->tax_amount,
|
||||
etransferEmail: $row->etransfer_email,
|
||||
stripePaymentIntentId: $row->stripe_payment_intent_id,
|
||||
receiptNumber: $row->receipt_number,
|
||||
receiptSentAt: $row->receipt_sent_at,
|
||||
paidAt: $row->paid_at,
|
||||
id: (int) $row->id,
|
||||
);
|
||||
}
|
||||
|
||||
@@ -95,34 +75,6 @@ class Payment {
|
||||
return self::STATUS_PAID === $this->status;
|
||||
}
|
||||
|
||||
/**
|
||||
* Who actually owes this charge: the recorded payer, falling back to the
|
||||
* student. Every caller that needs a person to bill, receipt or credit goes
|
||||
* through here rather than reading `payerId` directly, so the `0` default
|
||||
* never leaks out as a user id.
|
||||
*/
|
||||
public function payerOrStudent(): int {
|
||||
return $this->payerId > 0 ? $this->payerId : $this->studentId;
|
||||
}
|
||||
|
||||
/**
|
||||
* Whether someone other than the student is paying — a guardian. Drives the
|
||||
* "paid by" line on admin screens, which is noise when they are the same
|
||||
* person.
|
||||
*/
|
||||
public function hasSeparatePayer(): bool {
|
||||
return $this->payerId > 0 && $this->payerId !== $this->studentId;
|
||||
}
|
||||
|
||||
/**
|
||||
* Whether this payment was generated by the daily billing scan (weekly /
|
||||
* monthly) rather than taken at registration. Scheduled payments carry a due
|
||||
* date, can cover several lessons, and are never auto-voided on cancellation.
|
||||
*/
|
||||
public function isScheduled(): bool {
|
||||
return null !== $this->dueDate;
|
||||
}
|
||||
|
||||
/**
|
||||
* Amount billed including tax.
|
||||
*/
|
||||
@@ -130,28 +82,6 @@ class Payment {
|
||||
return round( $this->amount + $this->taxAmount, 2 );
|
||||
}
|
||||
|
||||
/**
|
||||
* What the student still owes after any account credit applied to this payment.
|
||||
* The full `total()` less `creditApplied`, floored at zero.
|
||||
*/
|
||||
public function netDue(): float {
|
||||
return round( max( 0.0, $this->total() - $this->creditApplied ), 2 );
|
||||
}
|
||||
|
||||
/**
|
||||
* Minimal payment info embedded in registration-creation responses: enough
|
||||
* for the front end to decide whether (and how) to run the payment step.
|
||||
*
|
||||
* @return array<string, mixed>
|
||||
*/
|
||||
public function toSummaryArray(): array {
|
||||
return [
|
||||
'id' => $this->id,
|
||||
'method' => $this->method,
|
||||
'status' => $this->status,
|
||||
];
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns a plain array representation of the payment.
|
||||
*
|
||||
@@ -161,7 +91,6 @@ class Payment {
|
||||
return [
|
||||
'id' => $this->id,
|
||||
'student_id' => $this->studentId,
|
||||
'payer_id' => $this->payerOrStudent(),
|
||||
'instructor_id' => $this->instructorId,
|
||||
'registration_type' => $this->registrationType,
|
||||
'etransfer_email' => $this->etransferEmail,
|
||||
@@ -170,17 +99,11 @@ class Payment {
|
||||
'tax_rate' => $this->taxRate,
|
||||
'tax_amount' => $this->taxAmount,
|
||||
'total' => $this->total(),
|
||||
'credit_applied' => $this->creditApplied,
|
||||
'net_due' => $this->netDue(),
|
||||
'currency' => $this->currency,
|
||||
'method' => $this->method,
|
||||
'status' => $this->status,
|
||||
'due_date' => $this->dueDate,
|
||||
'period_key' => $this->periodKey,
|
||||
'notice_batch' => $this->noticeBatch,
|
||||
'receipt_number' => $this->receiptNumber,
|
||||
'paid_at' => $this->paidAt,
|
||||
'created_at' => $this->createdAt,
|
||||
];
|
||||
}
|
||||
}
|
||||
|
||||
@@ -4,7 +4,6 @@ declare(strict_types=1);
|
||||
namespace Unsupervised\Schedular\Payment;
|
||||
|
||||
use Unsupervised\Schedular\Auth\RoleManager;
|
||||
use Unsupervised\Schedular\Val;
|
||||
|
||||
class PaymentController {
|
||||
|
||||
@@ -20,10 +19,10 @@ class PaymentController {
|
||||
|
||||
if ( isset( $_POST['usc_action'] ) && check_admin_referer( 'usc_payment_action' ) ) {
|
||||
// phpcs:ignore WordPress.Security.NonceVerification.Missing -- nonce checked above.
|
||||
if ( 'mark_paid' === sanitize_key( Val::string( wp_unslash( $_POST['usc_action'] ) ) ) ) {
|
||||
if ( 'mark_paid' === sanitize_key( wp_unslash( $_POST['usc_action'] ?? '' ) ) ) {
|
||||
// phpcs:disable WordPress.Security.NonceVerification.Missing
|
||||
$paymentId = absint( Val::int( $_POST['payment_id'] ?? 0 ) );
|
||||
$email = sanitize_email( Val::string( wp_unslash( $_POST['etransfer_email'] ?? '' ) ) );
|
||||
$paymentId = absint( $_POST['payment_id'] ?? 0 );
|
||||
$email = sanitize_email( wp_unslash( $_POST['etransfer_email'] ?? '' ) );
|
||||
// phpcs:enable WordPress.Security.NonceVerification.Missing
|
||||
if ( $paymentId > 0 ) {
|
||||
// Record the destination it was actually sent to before confirming.
|
||||
@@ -33,61 +32,22 @@ class PaymentController {
|
||||
}
|
||||
}
|
||||
|
||||
$groups = $this->groupPending( $this->payments->findPending() );
|
||||
$rows = array_map(
|
||||
static function ( Payment $payment ): array {
|
||||
$student = get_userdata( $payment->studentId );
|
||||
|
||||
return [
|
||||
'id' => (int) $payment->id,
|
||||
'student' => $student ? $student->display_name : (string) $payment->studentId,
|
||||
'amount' => number_format( $payment->amount, 2 ) . ' ' . $payment->currency,
|
||||
'method' => $payment->method,
|
||||
'for' => $payment->registrationType . ' #' . $payment->registrationId,
|
||||
'etransfer_email' => (string) $payment->etransferEmail,
|
||||
];
|
||||
},
|
||||
$this->payments->findPending()
|
||||
);
|
||||
|
||||
include USC_PLUGIN_DIR . 'templates/admin/payments.php';
|
||||
}
|
||||
|
||||
/**
|
||||
* Group pending payments by their shared notice batch, so payments the daily
|
||||
* scan emailed a student together (and which a single lump-sum e-transfer
|
||||
* covers) are shown as one group with a combined total. Payments with no batch
|
||||
* — legacy at-registration e-transfers — are each their own single-item group.
|
||||
*
|
||||
* @param list<Payment> $pending
|
||||
* @return list<array{reference: string, is_group: bool, total: string, rows: list<array{id: int, student: string, amount: string, method: string, for: string, etransfer_email: string}>}>
|
||||
*/
|
||||
private function groupPending( array $pending ): array {
|
||||
$groups = [];
|
||||
|
||||
foreach ( $pending as $payment ) {
|
||||
$batch = (string) $payment->noticeBatch;
|
||||
$key = '' !== $batch ? 'b:' . $batch : 's:' . (string) $payment->id;
|
||||
|
||||
if ( ! isset( $groups[ $key ] ) ) {
|
||||
$groups[ $key ] = [
|
||||
'reference' => $batch,
|
||||
'currency' => $payment->currency,
|
||||
'total_raw' => 0.0,
|
||||
'rows' => [],
|
||||
];
|
||||
}
|
||||
|
||||
$student = get_userdata( $payment->studentId );
|
||||
|
||||
// Show what the student still owes — the amount less any account credit
|
||||
// already applied to this payment.
|
||||
$groups[ $key ]['total_raw'] += $payment->netDue();
|
||||
$groups[ $key ]['rows'][] = [
|
||||
'id' => (int) $payment->id,
|
||||
'student' => $student ? $student->display_name : (string) $payment->studentId,
|
||||
'amount' => number_format( $payment->netDue(), 2 ) . ' ' . $payment->currency,
|
||||
'method' => $payment->method,
|
||||
'for' => $payment->registrationType . ' #' . $payment->registrationId,
|
||||
'etransfer_email' => (string) $payment->etransferEmail,
|
||||
];
|
||||
}
|
||||
|
||||
return array_values(
|
||||
array_map(
|
||||
static fn( array $group ): array => [
|
||||
'reference' => $group['reference'],
|
||||
'is_group' => count( $group['rows'] ) > 1,
|
||||
'total' => number_format( $group['total_raw'], 2 ) . ' ' . $group['currency'],
|
||||
'rows' => $group['rows'],
|
||||
],
|
||||
$groups
|
||||
)
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,107 +0,0 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace Unsupervised\Schedular\Payment;
|
||||
|
||||
/**
|
||||
* Emails a student a single itemised notice for every payment the daily billing
|
||||
* scan generated for them in one run, so a student billed for several lessons on
|
||||
* the same day receives one email with a line per item and a grand total — never
|
||||
* one email per lesson.
|
||||
*/
|
||||
class PaymentDueMailer {
|
||||
|
||||
/**
|
||||
* Send one student their consolidated due-payment notice for the current scan.
|
||||
* The optional `$reference` is the shared notice-batch code the student can quote
|
||||
* on a lump-sum e-transfer so the studio can reconcile it to these payments.
|
||||
*
|
||||
* @param list<array{label: string, amount: float, currency: string, due_date: ?string, etransfer_email: ?string}> $items
|
||||
* @param float $creditApplied Account credit deducted from the total this notice covers.
|
||||
* @return bool False when there is no recipient or nothing to bill.
|
||||
*/
|
||||
public function send( \WP_User $student, array $items, string $reference = '', float $creditApplied = 0.0 ): bool {
|
||||
if ( '' === (string) $student->user_email || [] === $items ) {
|
||||
return false;
|
||||
}
|
||||
|
||||
$currency = (string) $items[0]['currency'];
|
||||
$total = 0.0;
|
||||
$lines = [];
|
||||
$emails = [];
|
||||
|
||||
foreach ( $items as $item ) {
|
||||
$amount = (float) $item['amount'];
|
||||
$total += $amount;
|
||||
|
||||
$lines[] = sprintf(
|
||||
/* translators: 1: item description, 2: due date, 3: currency, 4: amount */
|
||||
__( '- %1$s (due %2$s): %3$s %4$s', 'unsupervised-schedular' ),
|
||||
(string) $item['label'],
|
||||
$this->formatDate( $item['due_date'] ?? null ),
|
||||
$currency,
|
||||
number_format( $amount, 2 )
|
||||
);
|
||||
|
||||
$etransfer = (string) ( $item['etransfer_email'] ?? '' );
|
||||
if ( '' !== $etransfer ) {
|
||||
$emails[ $etransfer ] = true;
|
||||
}
|
||||
}
|
||||
|
||||
// Account credit (from an earlier cancelled paid lesson) offsets the total.
|
||||
$creditApplied = round( min( $creditApplied, $total ), 2 );
|
||||
$dueTotal = round( $total - $creditApplied, 2 );
|
||||
|
||||
$body = __( 'You have upcoming payments due:', 'unsupervised-schedular' ) . "\n\n"
|
||||
. implode( "\n", $lines );
|
||||
|
||||
if ( $creditApplied > 0.0 ) {
|
||||
$body .= "\n\n" . sprintf(
|
||||
/* translators: 1: currency, 2: credit amount */
|
||||
__( 'Account credit applied: -%1$s %2$s', 'unsupervised-schedular' ),
|
||||
$currency,
|
||||
number_format( $creditApplied, 2 )
|
||||
);
|
||||
}
|
||||
|
||||
$body .= "\n\n" . sprintf(
|
||||
/* translators: 1: currency, 2: total amount */
|
||||
__( 'Total due: %1$s %2$s', 'unsupervised-schedular' ),
|
||||
$currency,
|
||||
number_format( $dueTotal, 2 )
|
||||
);
|
||||
|
||||
if ( $dueTotal > 0.0 && [] !== $emails ) {
|
||||
$body .= "\n\n" . sprintf(
|
||||
/* translators: %s: e-transfer destination email address(es) */
|
||||
__( 'Please send your e-transfer to: %s', 'unsupervised-schedular' ),
|
||||
implode( ', ', array_keys( $emails ) )
|
||||
);
|
||||
}
|
||||
|
||||
if ( '' !== $reference ) {
|
||||
$body .= "\n\n" . sprintf(
|
||||
/* translators: %s: payment reference code */
|
||||
__( 'Please include this reference with your payment: %s', 'unsupervised-schedular' ),
|
||||
$reference
|
||||
);
|
||||
}
|
||||
|
||||
return (bool) wp_mail( $student->user_email, __( 'Payment due', 'unsupervised-schedular' ), $body );
|
||||
}
|
||||
|
||||
/**
|
||||
* Present a stored `Y-m-d` due date in a friendlier form; falls back to the
|
||||
* raw value (or an empty string) when it is not a parseable date.
|
||||
*/
|
||||
private function formatDate( ?string $date ): string {
|
||||
if ( null === $date || '' === $date ) {
|
||||
return '';
|
||||
}
|
||||
|
||||
$parsed = \DateTimeImmutable::createFromFormat( '!Y-m-d', $date );
|
||||
|
||||
return false !== $parsed ? $parsed->format( 'M j, Y' ) : $date;
|
||||
}
|
||||
}
|
||||
@@ -4,17 +4,11 @@ declare(strict_types=1);
|
||||
namespace Unsupervised\Schedular\Payment;
|
||||
|
||||
use Unsupervised\Schedular\Auth\RoleManager;
|
||||
use Unsupervised\Schedular\Val;
|
||||
|
||||
class PaymentEndpoint {
|
||||
|
||||
public function __construct( private PaymentService $service ) {}
|
||||
|
||||
/**
|
||||
* Registers this endpoint's REST routes.
|
||||
*
|
||||
* @param non-falsy-string $route_namespace REST namespace the routes are registered under (e.g. `us-scheduler/v1`).
|
||||
*/
|
||||
public function registerRoutes( string $route_namespace ): void {
|
||||
register_rest_route(
|
||||
$route_namespace,
|
||||
@@ -70,8 +64,8 @@ class PaymentEndpoint {
|
||||
* (Stripe client secret for card; display data for e-transfer/comp).
|
||||
*/
|
||||
public function createIntent( \WP_REST_Request $request ): \WP_REST_Response|\WP_Error {
|
||||
$type = Val::string( $request->get_param( 'registration_type' ) );
|
||||
$registrationId = absint( Val::int( $request->get_param( 'registration_id' ) ) );
|
||||
$type = (string) $request->get_param( 'registration_type' );
|
||||
$registrationId = absint( $request->get_param( 'registration_id' ) );
|
||||
|
||||
$result = $this->service->createIntent( $type, $registrationId, get_current_user_id() );
|
||||
if ( null === $result ) {
|
||||
@@ -105,7 +99,7 @@ class PaymentEndpoint {
|
||||
* Studio admin marks a pending payment (e-transfer) received.
|
||||
*/
|
||||
public function markPaid( \WP_REST_Request $request ): \WP_REST_Response|\WP_Error {
|
||||
$id = absint( Val::int( $request->get_param( 'id' ) ) );
|
||||
$id = absint( $request->get_param( 'id' ) );
|
||||
|
||||
if ( ! $this->service->markPaid( $id ) ) {
|
||||
return new \WP_Error( 'not_found', __( 'Payment not found.', 'unsupervised-schedular' ), [ 'status' => 404 ] );
|
||||
|
||||
@@ -90,22 +90,13 @@ class PaymentReport {
|
||||
}
|
||||
|
||||
/**
|
||||
* Format one CSV record, quoting fields and escaping embedded quotes. Fields
|
||||
* that a spreadsheet would interpret as a formula (leading =, +, -, @, tab, or
|
||||
* CR — e.g. a hostile student display name) are prefixed with an apostrophe so
|
||||
* they open as text, never as executable formulas.
|
||||
* Format one CSV record, quoting fields and escaping embedded quotes.
|
||||
*
|
||||
* @param list<string> $fields
|
||||
*/
|
||||
private function csvLine( array $fields ): string {
|
||||
$escaped = array_map(
|
||||
static function ( string $field ): string {
|
||||
if ( 1 === preg_match( '/^[=+\-@\t\r]/', $field ) ) {
|
||||
$field = "'" . $field;
|
||||
}
|
||||
|
||||
return '"' . str_replace( '"', '""', $field ) . '"';
|
||||
},
|
||||
static fn( string $field ): string => '"' . str_replace( '"', '""', $field ) . '"',
|
||||
$fields
|
||||
);
|
||||
|
||||
|
||||
@@ -4,7 +4,6 @@ declare(strict_types=1);
|
||||
namespace Unsupervised\Schedular\Payment;
|
||||
|
||||
use Unsupervised\Schedular\Auth\RoleManager;
|
||||
use Unsupervised\Schedular\Val;
|
||||
|
||||
class PaymentReportController {
|
||||
|
||||
@@ -22,8 +21,8 @@ class PaymentReportController {
|
||||
}
|
||||
|
||||
// phpcs:disable WordPress.Security.NonceVerification.Recommended -- read-only report filters, no state change.
|
||||
$month = $this->sanitizeMonth( isset( $_GET['month'] ) ? sanitize_text_field( Val::string( wp_unslash( $_GET['month'] ) ) ) : '' );
|
||||
$instructorId = isset( $_GET['instructor_id'] ) ? absint( Val::int( $_GET['instructor_id'] ) ) : 0;
|
||||
$month = $this->sanitizeMonth( isset( $_GET['month'] ) ? sanitize_text_field( wp_unslash( $_GET['month'] ) ) : '' );
|
||||
$instructorId = isset( $_GET['instructor_id'] ) ? absint( $_GET['instructor_id'] ) : 0;
|
||||
// phpcs:enable WordPress.Security.NonceVerification.Recommended
|
||||
|
||||
$instructorId = $this->scopeInstructor( $instructorId );
|
||||
@@ -59,8 +58,8 @@ class PaymentReportController {
|
||||
check_admin_referer( self::EXPORT_ACTION );
|
||||
|
||||
// phpcs:disable WordPress.Security.NonceVerification.Recommended -- nonce checked above.
|
||||
$month = $this->sanitizeMonth( isset( $_GET['month'] ) ? sanitize_text_field( Val::string( wp_unslash( $_GET['month'] ) ) ) : '' );
|
||||
$instructorId = isset( $_GET['instructor_id'] ) ? absint( Val::int( $_GET['instructor_id'] ) ) : 0;
|
||||
$month = $this->sanitizeMonth( isset( $_GET['month'] ) ? sanitize_text_field( wp_unslash( $_GET['month'] ) ) : '' );
|
||||
$instructorId = isset( $_GET['instructor_id'] ) ? absint( $_GET['instructor_id'] ) : 0;
|
||||
// phpcs:enable WordPress.Security.NonceVerification.Recommended
|
||||
|
||||
$instructorId = $this->scopeInstructor( $instructorId );
|
||||
@@ -93,8 +92,7 @@ class PaymentReportController {
|
||||
*/
|
||||
private function buildReport( string $month, int $instructorId ): PaymentReport {
|
||||
$start = $month . '-01 00:00:00';
|
||||
$endTs = strtotime( $month . '-01 00:00:00 +1 month' );
|
||||
$end = false === $endTs ? $start : gmdate( 'Y-m-d H:i:s', $endTs );
|
||||
$end = gmdate( 'Y-m-d H:i:s', strtotime( $month . '-01 00:00:00 +1 month' ) );
|
||||
|
||||
$rows = array_map(
|
||||
static function ( Payment $payment ): array {
|
||||
|
||||
@@ -16,7 +16,6 @@ class PaymentRepository {
|
||||
$this->table,
|
||||
[
|
||||
'student_id' => $payment->studentId,
|
||||
'payer_id' => $payment->payerOrStudent(),
|
||||
'instructor_id' => $payment->instructorId,
|
||||
'registration_type' => $payment->registrationType,
|
||||
'registration_id' => $payment->registrationId,
|
||||
@@ -26,10 +25,6 @@ class PaymentRepository {
|
||||
'status' => $payment->status,
|
||||
'tax_rate' => $payment->taxRate,
|
||||
'tax_amount' => $payment->taxAmount,
|
||||
'credit_applied' => $payment->creditApplied,
|
||||
'due_date' => $payment->dueDate,
|
||||
'period_key' => $payment->periodKey,
|
||||
'notice_batch' => $payment->noticeBatch,
|
||||
'etransfer_email' => $payment->etransferEmail,
|
||||
'stripe_payment_intent_id' => $payment->stripePaymentIntentId,
|
||||
'receipt_number' => $payment->receiptNumber,
|
||||
@@ -37,24 +32,12 @@ class PaymentRepository {
|
||||
'paid_at' => $payment->paidAt,
|
||||
'created_at' => current_time( 'mysql' ),
|
||||
],
|
||||
[ '%d', '%d', '%d', '%s', '%d', '%f', '%s', '%s', '%s', '%f', '%f', '%f', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s' ]
|
||||
[ '%d', '%d', '%s', '%d', '%f', '%s', '%s', '%s', '%f', '%f', '%s', '%s', '%s', '%s', '%s', '%s' ]
|
||||
);
|
||||
|
||||
return $this->db->insert_id;
|
||||
}
|
||||
|
||||
/**
|
||||
* Backfill `payer_id` on payments written before guardian accounts existed,
|
||||
* where the student was always the payer. Run once from the installer.
|
||||
*/
|
||||
public function backfillPayerIds(): void {
|
||||
$sql = $this->db->prepare( 'UPDATE %i SET payer_id = student_id WHERE payer_id = 0', $this->table );
|
||||
|
||||
if ( null !== $sql ) {
|
||||
$this->db->query( $sql );
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Attach the Stripe PaymentIntent id created for a card payment so the webhook
|
||||
* can later reconcile the charge back to this row.
|
||||
@@ -72,8 +55,7 @@ class PaymentRepository {
|
||||
public function findByStripeIntentId( string $intentId ): ?Payment {
|
||||
$row = $this->db->get_row(
|
||||
$this->db->prepare(
|
||||
'SELECT * FROM %i WHERE stripe_payment_intent_id = %s ORDER BY id DESC LIMIT 1',
|
||||
$this->table,
|
||||
"SELECT * FROM {$this->table} WHERE stripe_payment_intent_id = %s ORDER BY id DESC LIMIT 1",
|
||||
$intentId
|
||||
)
|
||||
);
|
||||
@@ -91,35 +73,18 @@ class PaymentRepository {
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Add to the account credit applied against a payment, reducing what the student
|
||||
* still owes on it (`Payment::netDue()`). Accumulates, so a second application
|
||||
* adds to the first.
|
||||
*/
|
||||
public function addCreditApplied( int $id, float $amount ): bool {
|
||||
$sql = $this->db->prepare(
|
||||
'UPDATE %i SET credit_applied = credit_applied + %f WHERE id = %d',
|
||||
$this->table,
|
||||
$amount,
|
||||
$id
|
||||
);
|
||||
|
||||
return null !== $sql && false !== $this->db->query( $sql );
|
||||
}
|
||||
|
||||
/**
|
||||
* Set a payment's tax rate and recompute the tax amount from its subtotal.
|
||||
*/
|
||||
public function updateTax( int $id, float $rate ): bool {
|
||||
$sql = $this->db->prepare(
|
||||
'UPDATE %i SET tax_rate = %f, tax_amount = ROUND( amount * %f / 100, 2 ) WHERE id = %d',
|
||||
$this->table,
|
||||
$rate,
|
||||
$rate,
|
||||
$id
|
||||
return false !== $this->db->query(
|
||||
$this->db->prepare(
|
||||
"UPDATE {$this->table} SET tax_rate = %f, tax_amount = ROUND( amount * %f / 100, 2 ) WHERE id = %d",
|
||||
$rate,
|
||||
$rate,
|
||||
$id
|
||||
)
|
||||
);
|
||||
|
||||
return null !== $sql && false !== $this->db->query( $sql );
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -129,8 +94,8 @@ class PaymentRepository {
|
||||
* @return list<Payment>
|
||||
*/
|
||||
public function findPaidBetween( string $from, string $to, int $instructorId = 0 ): array {
|
||||
$sql = 'SELECT * FROM %i WHERE status = %s AND paid_at >= %s AND paid_at < %s';
|
||||
$params = [ $this->table, Payment::STATUS_PAID, $from, $to ];
|
||||
$sql = "SELECT * FROM {$this->table} WHERE status = %s AND paid_at >= %s AND paid_at < %s";
|
||||
$params = [ Payment::STATUS_PAID, $from, $to ];
|
||||
|
||||
if ( $instructorId > 0 ) {
|
||||
$sql .= ' AND instructor_id = %d';
|
||||
@@ -146,62 +111,16 @@ class PaymentRepository {
|
||||
|
||||
public function findById( int $id ): ?Payment {
|
||||
$row = $this->db->get_row(
|
||||
$this->db->prepare( 'SELECT * FROM %i WHERE id = %d', $this->table, $id )
|
||||
$this->db->prepare( "SELECT * FROM {$this->table} WHERE id = %d", $id )
|
||||
);
|
||||
|
||||
return $row ? Payment::fromRow( $row ) : null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Tag a set of payments with a shared notice-batch reference — the payments the
|
||||
* daily scan emailed a student together, so the admin can see which pending
|
||||
* payments a single lump-sum e-transfer covers. No-op for an empty id list.
|
||||
*
|
||||
* @param list<int> $ids
|
||||
*/
|
||||
public function assignNoticeBatch( array $ids, string $batch ): void {
|
||||
if ( [] === $ids ) {
|
||||
return;
|
||||
}
|
||||
|
||||
$placeholders = implode( ', ', array_fill( 0, count( $ids ), '%d' ) );
|
||||
$sql = $this->db->prepare(
|
||||
"UPDATE %i SET notice_batch = %s WHERE id IN ( {$placeholders} )",
|
||||
$this->table,
|
||||
$batch,
|
||||
...$ids
|
||||
);
|
||||
|
||||
if ( null !== $sql ) {
|
||||
$this->db->query( $sql );
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Whether a scheduled payment already exists for a registration and billing
|
||||
* period. The daily billing scan uses this to avoid double-billing an
|
||||
* enrolment for the same session (weekly) or month (monthly). A voided
|
||||
* (`failed`) row still counts so a cancelled charge is not silently re-created.
|
||||
*/
|
||||
public function existsForPeriod( string $registrationType, int $registrationId, string $periodKey ): bool {
|
||||
$found = $this->db->get_var(
|
||||
$this->db->prepare(
|
||||
'SELECT id FROM %i WHERE registration_type = %s AND registration_id = %d AND period_key = %s LIMIT 1',
|
||||
$this->table,
|
||||
$registrationType,
|
||||
$registrationId,
|
||||
$periodKey
|
||||
)
|
||||
);
|
||||
|
||||
return null !== $found;
|
||||
}
|
||||
|
||||
public function findByRegistration( string $registrationType, int $registrationId ): ?Payment {
|
||||
$row = $this->db->get_row(
|
||||
$this->db->prepare(
|
||||
'SELECT * FROM %i WHERE registration_type = %s AND registration_id = %d ORDER BY id DESC LIMIT 1',
|
||||
$this->table,
|
||||
"SELECT * FROM {$this->table} WHERE registration_type = %s AND registration_id = %d ORDER BY id DESC LIMIT 1",
|
||||
$registrationType,
|
||||
$registrationId
|
||||
)
|
||||
@@ -210,23 +129,6 @@ class PaymentRepository {
|
||||
return $row ? Payment::fromRow( $row ) : null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Every payment for a student, newest first (admin payment history).
|
||||
*
|
||||
* @return list<Payment>
|
||||
*/
|
||||
public function findByStudent( int $studentId ): array {
|
||||
$rows = $this->db->get_results(
|
||||
$this->db->prepare(
|
||||
'SELECT * FROM %i WHERE student_id = %d ORDER BY created_at DESC, id DESC',
|
||||
$this->table,
|
||||
$studentId
|
||||
)
|
||||
);
|
||||
|
||||
return array_map( Payment::fromRow( ... ), $rows ?? [] );
|
||||
}
|
||||
|
||||
/**
|
||||
* Pending payments, newest first (studio-admin confirmation queue).
|
||||
*
|
||||
@@ -235,8 +137,7 @@ class PaymentRepository {
|
||||
public function findPending(): array {
|
||||
$rows = $this->db->get_results(
|
||||
$this->db->prepare(
|
||||
'SELECT * FROM %i WHERE status = %s ORDER BY created_at DESC',
|
||||
$this->table,
|
||||
"SELECT * FROM {$this->table} WHERE status = %s ORDER BY created_at DESC",
|
||||
Payment::STATUS_PENDING
|
||||
)
|
||||
);
|
||||
|
||||
+13
-221
@@ -21,7 +21,6 @@ class PaymentService {
|
||||
private EnrollmentRepository $enrollments,
|
||||
private StudioSettings $settings,
|
||||
private StripeGateway $stripe,
|
||||
private CreditRepository $credits,
|
||||
) {}
|
||||
|
||||
/**
|
||||
@@ -30,23 +29,14 @@ class PaymentService {
|
||||
* (card via Stripe — coming soon; e-transfer confirmed manually). The
|
||||
* e-transfer destination is frozen now from the offering override or the studio
|
||||
* default. Returns null when the registration has no price to charge.
|
||||
*
|
||||
* A `$dueDate`/`$periodKey` mark a payment generated later by the daily billing
|
||||
* scan (weekly / monthly) rather than taken at registration; both stay null for
|
||||
* the pay-now flow.
|
||||
*
|
||||
* `$payerId` is who owes it — a child's guardian, or 0 (the default) when the
|
||||
* student pays for themselves. The billing method resolves against the payer,
|
||||
* so comping or card-billing a family is one setting on the guardian.
|
||||
*/
|
||||
public function createForRegistration( string $type, int $registrationId, int $studentId, int $instructorId, float $amount, string $currency, ?string $offeringEtransferEmail = null, ?string $dueDate = null, ?string $periodKey = null, int $payerId = 0 ): ?Payment {
|
||||
public function createForRegistration( string $type, int $registrationId, int $studentId, int $instructorId, float $amount, string $currency, ?string $offeringEtransferEmail = null ): ?Payment {
|
||||
if ( $amount <= 0.0 ) {
|
||||
return null;
|
||||
}
|
||||
|
||||
$payerId = $payerId > 0 ? $payerId : $studentId;
|
||||
$method = $this->resolver->resolve( $payerId );
|
||||
$status = Payment::METHOD_COMP === $method ? Payment::STATUS_PAID : Payment::STATUS_PENDING;
|
||||
$method = $this->resolver->resolve( $studentId );
|
||||
$status = Payment::METHOD_COMP === $method ? Payment::STATUS_PAID : Payment::STATUS_PENDING;
|
||||
|
||||
$etransferEmail = null !== $offeringEtransferEmail && '' !== $offeringEtransferEmail
|
||||
? $offeringEtransferEmail
|
||||
@@ -63,14 +53,11 @@ class PaymentService {
|
||||
registrationType: $type,
|
||||
registrationId: $registrationId,
|
||||
amount: $amount,
|
||||
payerId: $payerId,
|
||||
currency: $currency,
|
||||
method: $method,
|
||||
status: $status,
|
||||
taxRate: $taxRate,
|
||||
taxAmount: $taxAmount,
|
||||
dueDate: $dueDate,
|
||||
periodKey: $periodKey,
|
||||
etransferEmail: $etransferEmail,
|
||||
)
|
||||
);
|
||||
@@ -78,34 +65,12 @@ class PaymentService {
|
||||
$this->linkPayment( $type, $registrationId, $id );
|
||||
|
||||
if ( Payment::STATUS_PAID === $status ) {
|
||||
// The receipt goes to whoever paid, which for a child's lesson is the
|
||||
// guardian — a child's own address is an undeliverable placeholder.
|
||||
$this->finalizePaid( $id, $type, $registrationId, $payerId );
|
||||
$this->finalizePaid( $id, $type, $registrationId, $studentId );
|
||||
}
|
||||
|
||||
return $this->payments->findById( $id );
|
||||
}
|
||||
|
||||
/**
|
||||
* Whether a scheduled payment already exists for a registration and billing
|
||||
* period — the daily billing scan's dedup check for group enrolments (whose one
|
||||
* row maps to many periodic charges). Delegates to the ledger.
|
||||
*/
|
||||
public function scheduledPaymentExists( string $type, int $registrationId, string $periodKey ): bool {
|
||||
return $this->payments->existsForPeriod( $type, $registrationId, $periodKey );
|
||||
}
|
||||
|
||||
/**
|
||||
* Tag the payments the daily scan emailed a student together with a shared
|
||||
* notice-batch reference, so a lump-sum e-transfer can be reconciled to the
|
||||
* pending payments it covers. Delegates to the ledger.
|
||||
*
|
||||
* @param list<int> $ids
|
||||
*/
|
||||
public function assignNoticeBatch( array $ids, string $batch ): void {
|
||||
$this->payments->assignNoticeBatch( $ids, $batch );
|
||||
}
|
||||
|
||||
/**
|
||||
* Studio-admin confirmation that a pending payment (e-transfer) was received.
|
||||
* Marks it paid, confirms the registration, and emails the receipt.
|
||||
@@ -119,166 +84,11 @@ class PaymentService {
|
||||
return true;
|
||||
}
|
||||
|
||||
$this->finalizePaid( $paymentId, $payment->registrationType, $payment->registrationId, $payment->payerOrStudent() );
|
||||
$this->finalizePaid( $paymentId, $payment->registrationType, $payment->registrationId, $payment->studentId );
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* Void the still-pending payment of a cancelled registration so it drops
|
||||
* out of the confirmation queue. Paid payments are left alone — refunds
|
||||
* are a manual, admin-side decision. Scheduled payments (weekly / monthly)
|
||||
* are also left alone: a monthly charge can cover several lessons and may
|
||||
* already be collected, so cancelling one lesson must never void it or
|
||||
* trigger a rebill.
|
||||
*/
|
||||
public function voidPending( ?int $paymentId ): void {
|
||||
if ( null === $paymentId ) {
|
||||
return;
|
||||
}
|
||||
|
||||
$payment = $this->payments->findById( $paymentId );
|
||||
if ( null !== $payment && ! $payment->isScheduled() && Payment::STATUS_PENDING === $payment->status ) {
|
||||
$this->payments->updateStatus( $paymentId, Payment::STATUS_FAILED );
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Credit a student for a cancelled lesson they had already paid for. The credit
|
||||
* is one lesson's share of the covering payment's total (including tax) — the
|
||||
* whole total for a single-lesson payment, or `total ÷ lessons covered` for a
|
||||
* payment that spans several (a monthly scheduled charge, or a weekly series paid
|
||||
* upfront). The original payment is left untouched; the credit is applied to the
|
||||
* student's future scheduled-billing charges. Returns null when the lesson was
|
||||
* never paid, has no covering payment, or was already credited.
|
||||
*/
|
||||
public function creditForCancelledLesson( Lesson $lesson ): ?Credit {
|
||||
if ( null === $lesson->id ) {
|
||||
return null;
|
||||
}
|
||||
|
||||
$paymentId = $lesson->paymentId;
|
||||
if ( null === $paymentId && null !== $lesson->seriesId ) {
|
||||
// Series lessons other than the anchor carry no payment_id of their own;
|
||||
// the whole reservation is paid through the anchor's payment.
|
||||
$anchor = $this->payments->findByRegistration( Payment::REG_LESSON, $lesson->seriesId );
|
||||
$paymentId = $anchor?->id;
|
||||
}
|
||||
if ( null === $paymentId ) {
|
||||
return null;
|
||||
}
|
||||
|
||||
$payment = $this->payments->findById( $paymentId );
|
||||
if ( null === $payment || ! $payment->isPaid() ) {
|
||||
return null;
|
||||
}
|
||||
|
||||
if ( $this->credits->existsForLesson( $lesson->id ) ) {
|
||||
return null;
|
||||
}
|
||||
|
||||
$share = round( $payment->total() / $this->coveredLessonCount( $lesson, $payment ), 2 );
|
||||
if ( $share <= 0.0 ) {
|
||||
return null;
|
||||
}
|
||||
|
||||
// The credit records the child it was earned for, but the balance itself
|
||||
// lands on whoever paid — so a family's credits pool on the guardian and
|
||||
// one child's cancellation can settle a sibling's next charge.
|
||||
$id = $this->credits->insert(
|
||||
new Credit(
|
||||
studentId: $payment->studentId,
|
||||
amount: $share,
|
||||
remaining: $share,
|
||||
payerId: $payment->payerOrStudent(),
|
||||
currency: $payment->currency,
|
||||
sourcePaymentId: $payment->id,
|
||||
sourceLessonId: $lesson->id,
|
||||
reason: sprintf(
|
||||
/* translators: %d: cancelled lesson id */
|
||||
__( 'Credit for cancelled lesson #%d', 'unsupervised-schedular' ),
|
||||
$lesson->id
|
||||
),
|
||||
)
|
||||
);
|
||||
|
||||
return $this->credits->findById( $id );
|
||||
}
|
||||
|
||||
/**
|
||||
* How many lessons the covering payment was billed for, so its total can be split
|
||||
* into a per-lesson credit. A weekly series paid upfront (unscheduled) covers the
|
||||
* whole series; every other case — a single booking, a weekly scheduled lesson
|
||||
* (one payment each), or a monthly scheduled charge (payment linked to each
|
||||
* lesson) — is answered by how many lessons point at the payment. Never below one.
|
||||
*/
|
||||
private function coveredLessonCount( Lesson $lesson, Payment $payment ): int {
|
||||
if ( ! $payment->isScheduled() && null !== $lesson->seriesId ) {
|
||||
return max( 1, $this->bookings->countBySeries( $lesson->seriesId ) );
|
||||
}
|
||||
|
||||
return max( 1, $this->bookings->countByPaymentId( (int) $payment->id ) );
|
||||
}
|
||||
|
||||
/**
|
||||
* Apply a payer's available credit balance against a set of freshly-created
|
||||
* pending payments (the ones a billing scan just generated for them), oldest
|
||||
* charge first. Each payment's `credit_applied` is raised by the amount covered;
|
||||
* a payment fully covered is marked paid-by-credit and its registration confirmed
|
||||
* so it leaves the confirmation queue. The credit ledger is drawn down by the
|
||||
* total applied. Returns a map of payment id to the credit applied to it, so the
|
||||
* caller can reflect the reduction on the payer's notice.
|
||||
*
|
||||
* Keyed on the payer, so a guardian's balance settles charges raised against
|
||||
* any of their children — the payments passed in may name several students.
|
||||
*
|
||||
* @param list<Payment> $payments
|
||||
* @return array<int, float>
|
||||
*/
|
||||
public function applyCredits( int $payerId, array $payments ): array {
|
||||
$balance = $this->credits->availableBalance( $payerId );
|
||||
if ( $balance <= 0.0 ) {
|
||||
return [];
|
||||
}
|
||||
|
||||
$applied = [];
|
||||
$consumed = 0.0;
|
||||
|
||||
foreach ( $payments as $payment ) {
|
||||
if ( null === $payment->id || $balance <= 0.0 ) {
|
||||
continue;
|
||||
}
|
||||
|
||||
$owing = $payment->netDue();
|
||||
if ( $owing <= 0.0 ) {
|
||||
continue;
|
||||
}
|
||||
|
||||
$amount = round( min( $balance, $owing ), 2 );
|
||||
if ( $amount <= 0.0 ) {
|
||||
continue;
|
||||
}
|
||||
|
||||
$this->payments->addCreditApplied( $payment->id, $amount );
|
||||
|
||||
// Fully covered by credit: settle it so it drops out of the pending queue.
|
||||
if ( $amount >= $owing ) {
|
||||
$this->payments->markPaid( $payment->id, 'USC-' . $payment->id );
|
||||
$this->confirmRegistration( $payment->registrationType, $payment->registrationId );
|
||||
}
|
||||
|
||||
$applied[ $payment->id ] = $amount;
|
||||
$balance = round( $balance - $amount, 2 );
|
||||
$consumed = round( $consumed + $amount, 2 );
|
||||
}
|
||||
|
||||
if ( $consumed > 0.0 ) {
|
||||
$this->credits->consume( $payerId, $consumed );
|
||||
}
|
||||
|
||||
return $applied;
|
||||
}
|
||||
|
||||
/**
|
||||
* Resolve the client-side payment step for a freshly created registration.
|
||||
* For a card payment a Stripe PaymentIntent is created (or replayed
|
||||
@@ -287,19 +97,11 @@ class PaymentService {
|
||||
* needs no further action. Returns null when the registration has no payment,
|
||||
* the caller does not own it, or Stripe could not create the intent.
|
||||
*
|
||||
* `$userId` is the caller: either the student the registration is for, or the
|
||||
* guardian who owes it — anyone else gets null rather than a payment step for
|
||||
* a charge that is not theirs.
|
||||
*
|
||||
* @return array<string, mixed>|null
|
||||
*/
|
||||
public function createIntent( string $type, int $registrationId, int $userId ): ?array {
|
||||
public function createIntent( string $type, int $registrationId, int $studentId ): ?array {
|
||||
$payment = $this->payments->findByRegistration( $type, $registrationId );
|
||||
if ( null === $payment || null === $payment->id ) {
|
||||
return null;
|
||||
}
|
||||
|
||||
if ( $payment->studentId !== $userId && $payment->payerOrStudent() !== $userId ) {
|
||||
if ( null === $payment || null === $payment->id || $payment->studentId !== $studentId ) {
|
||||
return null;
|
||||
}
|
||||
|
||||
@@ -357,7 +159,7 @@ class PaymentService {
|
||||
}
|
||||
|
||||
if ( 'payment_intent.succeeded' === $event->type && ! $payment->isPaid() ) {
|
||||
$this->finalizePaid( $payment->id, $payment->registrationType, $payment->registrationId, $payment->payerOrStudent() );
|
||||
$this->finalizePaid( $payment->id, $payment->registrationType, $payment->registrationId, $payment->studentId );
|
||||
} elseif ( 'payment_intent.payment_failed' === $event->type && ! $payment->isPaid() ) {
|
||||
$this->payments->updateStatus( $payment->id, Payment::STATUS_FAILED );
|
||||
}
|
||||
@@ -365,32 +167,22 @@ class PaymentService {
|
||||
return true;
|
||||
}
|
||||
|
||||
private function finalizePaid( int $paymentId, string $type, int $registrationId, int $payerId ): void {
|
||||
private function finalizePaid( int $paymentId, string $type, int $registrationId, int $studentId ): void {
|
||||
$this->payments->markPaid( $paymentId, 'USC-' . $paymentId );
|
||||
$this->confirmRegistration( $type, $registrationId );
|
||||
|
||||
$paid = $this->payments->findById( $paymentId );
|
||||
$user = get_userdata( $payerId );
|
||||
$user = get_userdata( $studentId );
|
||||
if ( null !== $paid && $this->mailer->send( $paid, $user instanceof \WP_User ? $user : null ) ) {
|
||||
$this->payments->markReceiptSent( $paymentId );
|
||||
}
|
||||
}
|
||||
|
||||
private function confirmRegistration( string $type, int $registrationId ): void {
|
||||
if ( Payment::REG_LESSON !== $type ) {
|
||||
// Group enrolments are already `active`; no status change on payment.
|
||||
return;
|
||||
if ( Payment::REG_LESSON === $type ) {
|
||||
$this->bookings->updateStatus( $registrationId, Lesson::STATUS_CONFIRMED );
|
||||
}
|
||||
|
||||
// A weekly reservation's payment is linked to its anchor lesson but pays
|
||||
// for the whole series, so settling it confirms every lesson in the series.
|
||||
$lesson = $this->bookings->findById( $registrationId );
|
||||
if ( null !== $lesson && null !== $lesson->seriesId ) {
|
||||
$this->bookings->updateStatusForSeries( $lesson->seriesId, Lesson::STATUS_CONFIRMED );
|
||||
return;
|
||||
}
|
||||
|
||||
$this->bookings->updateStatus( $registrationId, Lesson::STATUS_CONFIRMED );
|
||||
// Group enrolments are already `active`; no status change on payment.
|
||||
}
|
||||
|
||||
private function linkPayment( string $type, int $registrationId, int $paymentId ): void {
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user