Let offering managers read the offerings catalogue #122

2026-07-28T15:55:36Z

thatguygriff commented

2026-07-28 15:55:36 +00:00

Fixes the empty group-class dropdown in the page editor.

Problem

GET /wp-json/us-scheduler/v1/offerings guarded its listing with book_lesson, which is granted only to the us_student role. The editor's group-class picker (assets/js/blocks.js) calls that endpoint, so an administrator or instructor editing a page got a rest_forbidden 403 and the JS .catch fell back to an empty array — a blank picker with no visible error.

Change

OfferingEndpoint::canBook() becomes canRead() and accepts book_lesson or manage_offerings. Still login-only; there is no anonymous consumer.
The listing itself is untouched: active offerings only, public ones plus the invite-only classes the caller has been granted, with the e-transfer email omitted.
Corrected the GET /offerings row in docs/features/offerings.md, which claimed the endpoint was public.

Instructors now see every studio group class in the picker rather than just their own, which matches what the block actually renders.

Tests

Four permission tests added to tests/Unit/Offering/OfferingEndpointTest.php: student with book_lesson, manager with manage_offerings and no book_lesson, logged-in user with neither, and a logged-out visitor.

composer test — 633 tests, 1812 assertions, all passing
composer lint — no errors
composer cs — clean

Closes #121

🤖 Generated with Claude Code

Fixes the empty group-class dropdown in the page editor. ## Problem `GET /wp-json/us-scheduler/v1/offerings` guarded its listing with `book_lesson`, which is granted only to the `us_student` role. The editor's group-class picker (`assets/js/blocks.js`) calls that endpoint, so an administrator or instructor editing a page got a `rest_forbidden` 403 and the JS `.catch` fell back to an empty array — a blank picker with no visible error. ## Change - `OfferingEndpoint::canBook()` becomes `canRead()` and accepts `book_lesson` **or** `manage_offerings`. Still login-only; there is no anonymous consumer. - The listing itself is untouched: active offerings only, public ones plus the invite-only classes the caller has been granted, with the e-transfer email omitted. - Corrected the `GET /offerings` row in `docs/features/offerings.md`, which claimed the endpoint was public. Instructors now see every studio group class in the picker rather than just their own, which matches what the block actually renders. ## Tests Four permission tests added to `tests/Unit/Offering/OfferingEndpointTest.php`: student with `book_lesson`, manager with `manage_offerings` and no `book_lesson`, logged-in user with neither, and a logged-out visitor. - `composer test` — 633 tests, 1812 assertions, all passing - `composer lint` — no errors - `composer cs` — clean Closes #121 🤖 Generated with [Claude Code](https://claude.com/claude-code)

thatguygriff added 1 commit 2026-07-28 15:55:36 +00:00

Let offering managers read the offerings catalogue

CI / Tests (PHP 8.1) (pull_request) Successful in 46s

Details

CI / No Debug Code (pull_request) Successful in 2s

Details

CI / Tests (PHP 8.2) (pull_request) Successful in 56s

Details

CI / PHPStan (pull_request) Successful in 2m56s

Details

CI / Coding Standards (pull_request) Successful in 2m58s

Details

CI / Tests (PHP 8.3) (pull_request) Successful in 2m41s

Details

CI / Build Plugin Zip (pull_request) Skipped

Details

0f30f28e92

The block editor's group-class picker fetches GET /offerings, whose
permission callback only accepted book_lesson — a capability held by
students alone. Administrators and instructors editing a page were
rejected with a 403 and the picker silently rendered an empty list.

Read access now accepts book_lesson or manage_offerings. The listing is
unchanged: active offerings only, public ones plus the invite-only
classes the caller has been granted, without the e-transfer email.

Closes #121

Co-Authored-By: Claude Opus 5 <[email protected]>

thatguygriff merged commit 689ec833f3 into main

2026-07-28 16:07:09 +00:00

thatguygriff deleted branch fix/offerings-read-permission

2026-07-28 16:07:09 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Unsupervised/unsupervised-scheduler#122