Fix field-length saves, student wp-admin access, and empty instructor picker #111

2026-07-24T23:22:29Z

thatguygriff commented

2026-07-24 23:22:29 +00:00

Three bug fixes recorded under the 1.2.1 changelog section (no schema change, so no version bump).

1. Over-length fixed-size fields silently discarded

Typing a value past a fixed-size column's limit reported success but saved nothing — the DB quietly rejected the over-long row while the code returned 200/201. Added length guards for every free-text fixed-size field (enum columns are already whitelist-guarded):

Questions label (VARCHAR 255), Offerings title/schedule_note/etransfer_email (191), Policies title/slug (191).
REST endpoints reject over-long values with a 400; admin controllers refuse the insert; form inputs carry maxlength.
Limits are MAX_* constants on the value objects, kept in lockstep with the schema.

2. Students reaching the WordPress dashboard

New Auth\StudentAdminGuard redirects front-end-only users away from wp-admin and hides the admin toolbar for them. Access is decided by capability — administrators, studio admins, and instructors keep full wp-admin; anyone with only student capabilities is bounced. AJAX passes through. (The optional wp-login.php redirect was intentionally left out.)

3. Empty instructor picker for a solo studio owner

OfferingController::instructorOptions() queried only the us_instructor role, so a studio owner who teaches from a WordPress administrator account (the default single-account setup) never appeared. It now also queries administrator when adminsAreInstructors() is enabled, and excludes admins when that toggle is off.

Tests

New: QuestionEndpointTest, PolicyEndpointTest, StudentAdminGuardTest; additions to OfferingEndpointTest and OfferingControllerTest.
composer test (618 tests), composer lint (PHPStan L10), composer cs all pass.

🤖 Generated with Claude Code

Three bug fixes recorded under the **1.2.1** changelog section (no schema change, so no version bump). ### 1. Over-length fixed-size fields silently discarded Typing a value past a fixed-size column's limit reported success but saved nothing — the DB quietly rejected the over-long row while the code returned 200/201. Added length guards for every free-text fixed-size field (enum columns are already whitelist-guarded): - **Questions** `label` (VARCHAR 255), **Offerings** `title`/`schedule_note`/`etransfer_email` (191), **Policies** `title`/`slug` (191). - REST endpoints reject over-long values with a 400; admin controllers refuse the insert; form inputs carry `maxlength`. - Limits are `MAX_*` constants on the value objects, kept in lockstep with the schema. ### 2. Students reaching the WordPress dashboard New `Auth\StudentAdminGuard` redirects front-end-only users away from `wp-admin` and hides the admin toolbar for them. Access is decided by capability — administrators, studio admins, and instructors keep full `wp-admin`; anyone with only student capabilities is bounced. AJAX passes through. (The optional `wp-login.php` redirect was intentionally left out.) ### 3. Empty instructor picker for a solo studio owner `OfferingController::instructorOptions()` queried only the `us_instructor` role, so a studio owner who teaches from a WordPress administrator account (the default single-account setup) never appeared. It now also queries `administrator` when `adminsAreInstructors()` is enabled, and excludes admins when that toggle is off. ### Tests - New: `QuestionEndpointTest`, `PolicyEndpointTest`, `StudentAdminGuardTest`; additions to `OfferingEndpointTest` and `OfferingControllerTest`. - `composer test` (618 tests), `composer lint` (PHPStan L10), `composer cs` all pass. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

thatguygriff added 1 commit 2026-07-24 23:22:30 +00:00

Fix field-length saves, student wp-admin access, and empty instructor picker

CI / Tests (PHP 8.1) (pull_request) Successful in 49s

Details

CI / Tests (PHP 8.2) (pull_request) Successful in 49s

Details

CI / No Debug Code (pull_request) Successful in 2s

Details

CI / Coding Standards (pull_request) Successful in 2m47s

Details

CI / PHPStan (pull_request) Successful in 3m16s

Details

CI / Tests (PHP 8.3) (pull_request) Successful in 2m41s

Details

CI / Build Plugin Zip (pull_request) Skipped

Details

721c4be1d6

Three bug fixes for the 1.2.1 section:

- Fixed-size fields (question labels, offering titles/notes/e-transfer
  email, policy titles/slugs) no longer silently fail to save when the
  value exceeds its column length. The REST endpoints reject over-long
  values with a 400, the admin controllers refuse to insert them, and the
  form inputs carry a maxlength so the browser blocks over-long entry.
  Limits are MAX_* constants on the value objects, kept in lockstep with
  the schema columns.

- Students are kept out of wp-admin entirely. New StudentAdminGuard
  redirects front-end-only users (no back-office capability) away from the
  dashboard and hides the admin bar for them, while administrators, studio
  admins, and instructors keep full access.

- The Add/Edit Offering instructor picker now includes WordPress
  administrators when they act as instructors (the default single-account
  setup), so a solo studio owner is selectable instead of the dropdown
  being empty.

composer test (618), composer lint, composer cs all pass.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

thatguygriff merged commit c611268bdb into main

2026-07-24 23:27:30 +00:00

thatguygriff deleted branch fix/field-length-student-admin-instructor-picker

2026-07-24 23:27:31 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Unsupervised/unsupervised-scheduler#111