From 171b655bb8a26177f2e15f2c2c0318b7b66ec69d Mon Sep 17 00:00:00 2001 From: James Griffin Date: Tue, 28 Jul 2026 23:19:31 -0300 Subject: [PATCH] Stop the availability form failing in silence MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adding availability for 5:30-6:00 PM with the lesson length left on its 60-minute default saved nothing and said nothing. A window is stored as consecutive lesson-length slots, so one that fits no lesson splits into none: splitByDuration() returned [], createFromWindow() inserted nothing, and addSlot() discarded the result and re-rendered the page unchanged. The REST endpoint already rejected that window with a 400. The admin form checked the same rules separately, and its copy was both laxer and mute — an unreadable date, an end before the start, and a two-day window were bare `return`s, and it never checked offering ownership at all, so a crafted POST could tie a slot to another instructor's offering and inherit their price and payment routing. Both callers now go through WindowValidator, which returns the window or a WP_Error explaining the refusal. The endpoint returns that error as is; the page renders its message as a notice. handleFormAction returns a [notice, error] pair so deletes report themselves too, and a successful add says how many slots it created. Two failures could also go unnoticed underneath: wpdb::insert's result was ignored, and insert_id still holds the previous statement's id after a failed write, so a failure looked like a success — and could become the recurrence group of a weekly series, orphaning every later occurrence. weeks was unbounded server-side despite the form's max=52. availability-admin.js narrows the lesson-length choices to those that fit the window and blocks submission when none do, which is what makes the original mistake hard to repeat. It is a convenience: the server validates regardless. Closes #130 --- CHANGELOG.md | 1 + assets/js/availability-admin.js | 98 +++++++++++ docs/features/availability-management.md | 56 ++++++- src/AdminMenu.php | 31 +++- src/Availability/AvailabilityController.php | 139 ++++++++++++---- src/Availability/AvailabilityEndpoint.php | 51 ++---- src/Availability/AvailabilityRepository.php | 37 ++++- src/Availability/AvailabilitySlot.php | 17 ++ src/Availability/WindowValidator.php | 105 ++++++++++++ src/RestRegistrar.php | 3 +- templates/admin/availability.php | 30 +++- .../AvailabilityControllerTest.php | 157 +++++++++++++++++- .../Availability/AvailabilityEndpointTest.php | 3 +- .../AvailabilityRepositoryTest.php | 95 +++++++++++ .../Unit/Availability/WindowValidatorTest.php | 143 ++++++++++++++++ 15 files changed, 878 insertions(+), 88 deletions(-) create mode 100644 assets/js/availability-admin.js create mode 100644 src/Availability/WindowValidator.php create mode 100644 tests/Unit/Availability/WindowValidatorTest.php diff --git a/CHANGELOG.md b/CHANGELOG.md index 515e7fa..5443fa6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -14,6 +14,7 @@ each change under the current top section as you work. ## [1.2.4] ### Fixed +- **Adding availability no longer fails in silence.** Entering a window shorter than the chosen lesson length — 5:30–6:00 PM with the lesson length left on its default of 60 minutes, say — saved nothing and said nothing: the page just reloaded, whether the window was one-off or set to repeat for 41 weeks. The **Lesson length** menu now offers only the lengths that actually fit the window you have entered, and the form refuses to submit when none of them do. Every other way the form could quietly do nothing now explains itself too — an unreadable date, an end time before the start, a window running past midnight into the next day — and a successful save says how many bookable slots it created. Deleting says whether the slot went, and tells you when one is refused because it is already booked. Availability added through the API is checked against exactly the same rules, which it previously enforced slightly differently. - A student's **upcoming lessons no longer pile on top of each other**. On the booking page, the lesson name, its date and time, the status badge and the **Cancel** button could render over one another instead of sitting in a tidy row — worst with a long lesson-type name, and on narrow screens, where the row had no phone layout at all. The panel now keeps its shape whatever the theme around it does, long names wrap instead of shoving the Cancel button out of the row, and on a phone the lesson details stack above the buttons. - The registration page **no longer dead-ends a visitor who is already signed in**. It used to greet them with "You already have an account and are logged in." and nothing else, leaving them to find their own way to the studio. They now get a link onward to the page chosen under the block's **After registration** panel, and the link names it — "Continue to Book a Lesson" rather than the vaguer wording an invited student used to see. With no page chosen, the message appears on its own as before, because sending someone who is already signed in to the sign-in screen helps nobody. diff --git a/assets/js/availability-admin.js b/assets/js/availability-admin.js new file mode 100644 index 0000000..2272d72 --- /dev/null +++ b/assets/js/availability-admin.js @@ -0,0 +1,98 @@ +/** + * Availability form: keep the lesson-length choices honest. + * + * A window is stored as consecutive lesson-length slots, so one shorter than the + * chosen lesson length holds no slots at all and saves nothing. Picking 5:30–6:00 + * PM while the length select sat on its default of 60 minutes used to do exactly + * that, silently. The server now rejects it with a message; this narrows the + * choices first so the mistake is hard to make. + * + * This is a convenience only — AvailabilityController and the REST endpoint both + * validate the same window server-side regardless of what happens here. + */ +(function () { + 'use strict'; + + const form = document.getElementById('usc-add-availability'); + if (!form) return; + + const startEl = document.getElementById('start_dt'); + const endEl = document.getElementById('end_dt'); + const durationEl = document.getElementById('duration_minutes'); + const warningEl = document.getElementById('usc-duration-warning'); + const submitEl = form.querySelector('input[type="submit"], button[type="submit"]'); + + if (!startEl || !endEl || !durationEl) return; + + /** + * Minutes between the two datetime-local inputs, or 0 when the pair is not a + * usable window yet — empty, unparseable, backwards, or spanning two days + * (which the server rejects on its own terms, with its own message). + */ + function windowMinutes() { + const start = new Date(startEl.value); + const end = new Date(endEl.value); + + if (!startEl.value || !endEl.value || isNaN(start) || isNaN(end)) return 0; + if (end <= start) return 0; + if (startEl.value.slice(0, 10) !== endEl.value.slice(0, 10)) return 0; + + return Math.round((end - start) / 60000); + } + + function refresh() { + const minutes = windowMinutes(); + const options = Array.from(durationEl.options); + + // No usable window yet: leave every choice alone rather than fighting + // someone part-way through typing a date. + if (minutes === 0) { + options.forEach((option) => { + option.hidden = false; + option.disabled = false; + }); + setBlocked(false); + return; + } + + let fits = []; + + options.forEach((option) => { + const tooLong = Number(option.value) > minutes; + + option.hidden = tooLong; + option.disabled = tooLong; + + if (!tooLong) fits.push(option); + }); + + if (fits.length === 0) { + // Nothing bookable fits, so the form cannot produce a single slot. + setBlocked(true); + return; + } + + setBlocked(false); + + // The selection may have just been hidden — fall back to the longest + // length that still fits, which is what the instructor most likely wants. + if (durationEl.selectedOptions[0] && durationEl.selectedOptions[0].disabled) { + durationEl.value = fits.reduce( + (longest, option) => (Number(option.value) > Number(longest.value) ? option : longest), + fits[0] + ).value; + } + } + + function setBlocked(blocked) { + if (warningEl) warningEl.hidden = !blocked; + if (submitEl) submitEl.disabled = blocked; + } + + startEl.addEventListener('change', refresh); + startEl.addEventListener('input', refresh); + endEl.addEventListener('change', refresh); + endEl.addEventListener('input', refresh); + + refresh(); +}()); diff --git a/docs/features/availability-management.md b/docs/features/availability-management.md index 2d1faed..764ee8a 100644 --- a/docs/features/availability-management.md +++ b/docs/features/availability-management.md @@ -25,8 +25,9 @@ A slot's `duration_minutes` is matched against the offering a student picks: a `AvailabilitySlot::splitByDuration()` chunks a submitted window into consecutive `duration_minutes` slots; `AvailabilityRepository::createFromWindow()` persists one row per chunk. A trailing remainder shorter than the lesson length is -dropped. Windows must start and end on the same day and fit at least one lesson -(REST responds `400 invalid_window` otherwise; the admin form is a no-op). +dropped. Windows must start and end on the same day and fit at least one lesson; +both the REST endpoint and the admin form reject one that does not, with a +message saying so (see **REST API** below). `AvailabilityRepository::splitOversizedWindows()` is a data migration (run by `Installer` on activation or version change) that rewrites pre-split rows. @@ -44,6 +45,27 @@ Instructors access **My Availability** in wp-admin (`?page=us-availability`). - Bulk delete: the list view has a checkbox per unbooked slot (with a select-all header checkbox) and a **Delete selected** button (`usc_action=bulk_delete`, `slot_ids[]`); each id is ownership-checked, and booked slots are refused at the repository level - Current slots can be shown as a **weekly calendar** (the default, navigated with `usc_week=Y-m-d`) or a **list** (`usc_view=list`); the grid honours the site's `start_of_week` option via `Availability\WeekCalendar` +### Feedback +Every submitted action reports its outcome as a wp-admin notice — a success +notice naming the number of slots created or deleted, or an error explaining the +refusal. `AvailabilityController::handleFormAction()` returns a +`[$notice, $error]` pair that `templates/admin/availability.php` renders. + +This matters because the form used to fail **silently**: a window shorter than +the chosen lesson length splits into no slots, so nothing was written, nothing +was said, and the page simply reloaded. Submitting 5:30–6:00 PM with the length +select on its 60-minute default was the reported case. Invalid datetimes, an end +before the start, a window spanning two days, and an offering belonging to +another instructor were all silent in the same way. + +### Lesson-length choices +`assets/js/availability-admin.js` (enqueued by `AdminMenu::enqueueAssets()` on +this screen only) hides any lesson length longer than the entered window, falls +back to the longest one that still fits when the current pick is hidden, and +disables the submit button when nothing fits. It is a convenience, not a +guarantee — the server validates the same window regardless. The choices come +from `AvailabilitySlot::DURATION_CHOICES`. + ## Public Calendar The front-end booking shortcode renders open slots from `GET /availability` either as an agenda-style list grouped by day or as a **weekly calendar** with @@ -62,12 +84,29 @@ with the **Show Only** lesson-type filter — see `lesson-booking.md`. `GET` supports query params: `instructor_id`, `offering_id`, `duration_minutes`, `from` (datetime), `to` (datetime). Slots whose start has already passed are never returned. -`POST` validates `start_dt`/`end_dt` (admin form and REST alike) via -`AvailabilitySlot::normalizeDateTime()`: the canonical `Y-m-d H:i[:s]` and HTML -`datetime-local` (`Y-m-d\TH:i[:s]`) forms are normalised to `Y-m-d H:i:s`; -anything else — or an end not after the start — is rejected (REST responds -`400 invalid_datetime`; the admin form is a no-op). A valid window is stored as +`POST` runs every submitted window — admin form and REST alike — through +`Availability\WindowValidator`, which returns either the window ready to persist +or a `WP_Error`. The REST endpoint returns that error directly (its `status` +data makes it a 400); the admin screen shows `get_error_message()` in a notice. +Sharing one validator is deliberate: the two paths previously checked the same +rules separately, and the admin copy was both laxer (no offering-ownership +check) and mute (a bare `return` on every rejection). + +| Rejection | Code | +|---|---| +| Start or end not a real datetime | `invalid_datetime` | +| End at or before the start | `invalid_datetime` | +| Window spans two days | `invalid_window` | +| Window shorter than the lesson length (so it holds no slots) | `invalid_window` | +| Offering missing, or owned by another instructor | `invalid_offering` | + +`start_dt`/`end_dt` are normalised by `AvailabilitySlot::normalizeDateTime()`: +the canonical `Y-m-d H:i[:s]` and HTML `datetime-local` (`Y-m-d\TH:i[:s]`) forms +become `Y-m-d H:i:s`; anything else is rejected. A valid window is stored as lesson-length slots and `201` returns `{ "ids": [...] }` for every row created. +`weeks` is clamped to `AvailabilitySlot::MAX_WEEKLY_OCCURRENCES` in the +repository, so the form's `max` cannot be bypassed by posting directly. A write +that fails entirely returns `500 not_saved` rather than a `201` listing no ids. Times are displayed in 12-hour AM/PM form in the booking calendar and wp-admin lists. @@ -78,6 +117,8 @@ lists. - Week bucketing: `Unsupervised\Schedular\Availability\WeekCalendar` - Admin controller: `Unsupervised\Schedular\Availability\AvailabilityController` - REST endpoint: `Unsupervised\Schedular\Availability\AvailabilityEndpoint` +- Shared window validation: `Unsupervised\Schedular\Availability\WindowValidator` +- Admin form script: `assets/js/availability-admin.js`, enqueued by `AdminMenu::enqueueAssets()` ## Tests - `tests/Unit/Availability/AvailabilityControllerTest.php` @@ -85,3 +126,4 @@ lists. - `tests/Unit/Availability/AvailabilitySlotTest.php` - `tests/Unit/Availability/AvailabilityEndpointTest.php` - `tests/Unit/Availability/WeekCalendarTest.php` +- `tests/Unit/Availability/WindowValidatorTest.php` diff --git a/src/AdminMenu.php b/src/AdminMenu.php index 83046ae..73a7661 100644 --- a/src/AdminMenu.php +++ b/src/AdminMenu.php @@ -5,6 +5,7 @@ namespace Unsupervised\Schedular; use Unsupervised\Schedular\Availability\AvailabilityController; use Unsupervised\Schedular\Availability\AvailabilityRepository; +use Unsupervised\Schedular\Availability\WindowValidator; use Unsupervised\Schedular\Auth\AccessSettings; use Unsupervised\Schedular\Auth\InstructorController; use Unsupervised\Schedular\Auth\InviteRepository; @@ -42,6 +43,12 @@ use Unsupervised\Schedular\Registration\QuestionRepository; class AdminMenu { + /** + * Hook suffix of the availability screen, captured when the page is added so + * its script loads on that screen only. + */ + private string $availabilityHook = ''; + private AvailabilityController $availabilityController; private LessonController $lessonController; private OfferingController $offeringController; @@ -58,7 +65,7 @@ class AdminMenu { private PaymentReportController $paymentReportController; public function __construct( AvailabilityRepository $availability, BookingRepository $bookings, OfferingRepository $offerings, QuestionRepository $questions, AnswerRepository $answers, PolicyRepository $policies, PolicyVersionRepository $policyVersions, PolicyService $policyService, AcceptanceRepository $acceptances, InviteRepository $invites, EnrollmentRepository $enrollments, GroupAccessRepository $groupAccess, StudioSettings $settings, PaymentRepository $payments, PaymentService $paymentService, BillingMethodResolver $resolver, RegistrationMailer $registrationMailer, CreditRepository $credits ) { - $this->availabilityController = new AvailabilityController( $availability, $offerings ); + $this->availabilityController = new AvailabilityController( $availability, $offerings, new WindowValidator( $offerings ) ); $this->lessonController = new LessonController( $bookings, $payments, $availability, $offerings, new LessonDetail( $answers, $questions, $acceptances, $policies, $policyVersions ) ); $this->offeringController = new OfferingController( $offerings, new ClassSlotReconciler( $availability ) ); $this->questionController = new QuestionController( $questions, $offerings ); @@ -76,9 +83,29 @@ class AdminMenu { public function register(): void { add_action( 'admin_menu', [ $this, 'addPages' ] ); + add_action( 'admin_enqueue_scripts', [ $this, 'enqueueAssets' ] ); add_action( 'admin_post_' . PaymentReportController::EXPORT_ACTION, [ $this->paymentReportController, 'export' ] ); } + /** + * Load a screen's script on that screen only. + * + * @param string $hookSuffix Screen the enqueue is running for. + */ + public function enqueueAssets( string $hookSuffix ): void { + if ( '' === $this->availabilityHook || $hookSuffix !== $this->availabilityHook ) { + return; + } + + wp_enqueue_script( + 'us-scheduler-availability-admin', + USC_PLUGIN_URL . 'assets/js/availability-admin.js', + [], + USC_VERSION, + true + ); + } + public function addPages(): void { $this->addStudioSeparators(); @@ -94,7 +121,7 @@ class AdminMenu { ); // Instructor: manage their own availability. - add_menu_page( + $this->availabilityHook = (string) add_menu_page( __( 'My Availability', 'unsupervised-schedular' ), __( 'My Availability', 'unsupervised-schedular' ), RoleManager::CAP_MANAGE_AVAILABILITY, diff --git a/src/Availability/AvailabilityController.php b/src/Availability/AvailabilityController.php index b6036de..0a9c3bf 100644 --- a/src/Availability/AvailabilityController.php +++ b/src/Availability/AvailabilityController.php @@ -13,6 +13,7 @@ class AvailabilityController { public function __construct( private AvailabilityRepository $repository, private OfferingRepository $offerings, + private WindowValidator $validator, ) {} public function renderPage(): void { @@ -21,9 +22,11 @@ class AvailabilityController { } $instructorId = get_current_user_id(); + $notice = ''; + $error = ''; if ( isset( $_POST['usc_action'] ) && check_admin_referer( 'usc_availability_action' ) ) { - $this->handleFormAction( $instructorId ); + [ $notice, $error ] = $this->handleFormAction( $instructorId ); } $slots = $this->repository->findByInstructor( $instructorId ); @@ -44,72 +47,144 @@ class AvailabilityController { include USC_PLUGIN_DIR . 'templates/admin/availability.php'; } - private function handleFormAction( int $instructorId ): void { + /** + * Run the submitted action and report what happened. Every branch returns a + * message: a form that silently reloads leaves the instructor unable to tell + * "saved 41 slots" from "saved nothing". + * + * @return array{string, string} Success notice and error message; each is + * empty when it does not apply. + */ + private function handleFormAction( int $instructorId ): array { // Nonce is verified by the caller (renderPage) before this method runs. // phpcs:disable WordPress.Security.NonceVerification.Missing $action = sanitize_key( Val::string( wp_unslash( $_POST['usc_action'] ?? '' ) ) ); if ( 'add' === $action ) { - $this->addSlot( $instructorId ); + return $this->addSlot( $instructorId ); } if ( 'delete' === $action ) { - $this->deleteOwnSlot( absint( Val::int( $_POST['slot_id'] ?? 0 ) ), $instructorId ); + return $this->deleteOwnSlot( absint( Val::int( $_POST['slot_id'] ?? 0 ) ), $instructorId ) + ? [ __( 'Availability slot deleted.', 'unsupervised-schedular' ), '' ] + : [ '', __( 'That slot could not be deleted. It may already be booked, or belong to someone else.', 'unsupervised-schedular' ) ]; } if ( 'bulk_delete' === $action ) { // The array itself carries no data; each element is coerced and // absint-sanitized individually below. // phpcs:ignore WordPress.Security.ValidatedSanitizedInput - $rawIds = $_POST['slot_ids'] ?? []; + $rawIds = $_POST['slot_ids'] ?? []; + $deleted = 0; + $failed = 0; + foreach ( is_array( $rawIds ) ? $rawIds : [] as $rawId ) { - $this->deleteOwnSlot( absint( Val::int( $rawId ) ), $instructorId ); + if ( $this->deleteOwnSlot( absint( Val::int( $rawId ) ), $instructorId ) ) { + ++$deleted; + continue; + } + + ++$failed; } + + return $this->bulkDeleteResult( $deleted, $failed ); } // phpcs:enable WordPress.Security.NonceVerification.Missing + + return [ '', '' ]; + } + + /** + * Wording for a bulk delete, which can partly succeed. + * + * @return array{string, string} + */ + private function bulkDeleteResult( int $deleted, int $failed ): array { + $notice = $deleted > 0 + ? sprintf( + /* translators: %d: number of availability slots deleted. */ + _n( '%d slot deleted.', '%d slots deleted.', $deleted, 'unsupervised-schedular' ), + $deleted + ) + : ''; + + $error = $failed > 0 + ? sprintf( + /* translators: %d: number of slots that could not be deleted. */ + _n( + '%d slot could not be deleted — it may already be booked.', + '%d slots could not be deleted — they may already be booked.', + $failed, + 'unsupervised-schedular' + ), + $failed + ) + : ''; + + if ( 0 === $deleted && 0 === $failed ) { + $error = __( 'No slots were selected.', 'unsupervised-schedular' ); + } + + return [ $notice, $error ]; } /** * Delete a slot only when it exists and belongs to the given instructor. - * The repository additionally refuses to delete booked slots. + * The repository additionally refuses to delete booked slots. Returns whether + * the row actually went away. */ - private function deleteOwnSlot( int $slotId, int $instructorId ): void { + private function deleteOwnSlot( int $slotId, int $instructorId ): bool { if ( $slotId <= 0 ) { - return; + return false; } $slot = $this->repository->findById( $slotId ); - if ( $slot && $slot->instructorId === $instructorId ) { - $this->repository->delete( $slotId ); + + if ( null === $slot || $slot->instructorId !== $instructorId ) { + return false; } + + return $this->repository->delete( $slotId ); } - private function addSlot( int $instructorId ): void { + /** + * Validate and persist a submitted window. + * + * @return array{string, string} + */ + private function addSlot( int $instructorId ): array { // phpcs:disable WordPress.Security.NonceVerification.Missing - $startDt = AvailabilitySlot::normalizeDateTime( sanitize_text_field( Val::string( wp_unslash( $_POST['start_dt'] ?? '' ) ) ) ); - $endDt = AvailabilitySlot::normalizeDateTime( sanitize_text_field( Val::string( wp_unslash( $_POST['end_dt'] ?? '' ) ) ) ); - - // A window must start and end on the same day (weekly repeat covers longer - // ranges) and fit at least one lesson; it is stored as lesson-length slots. - if ( null === $startDt || null === $endDt || $endDt <= $startDt || substr( $startDt, 0, 10 ) !== substr( $endDt, 0, 10 ) ) { - return; - } - - $offeringId = absint( Val::int( $_POST['offering_id'] ?? 0 ) ); - $duration = absint( Val::int( $_POST['duration_minutes'] ?? 0 ) ); - - $window = new AvailabilitySlot( - instructorId: $instructorId, - startDt: $startDt, - endDt: $endDt, - durationMinutes: $duration > 0 ? $duration : 60, - offeringId: $offeringId > 0 ? $offeringId : null, + $window = $this->validator->validate( + $instructorId, + sanitize_text_field( Val::string( wp_unslash( $_POST['start_dt'] ?? '' ) ) ), + sanitize_text_field( Val::string( wp_unslash( $_POST['end_dt'] ?? '' ) ) ), + absint( Val::int( $_POST['duration_minutes'] ?? 0 ) ), + absint( Val::int( $_POST['offering_id'] ?? 0 ) ), ); + if ( $window instanceof \WP_Error ) { + return [ '', $window->get_error_message() ]; + } + $recurrence = sanitize_key( Val::string( wp_unslash( $_POST['recurrence'] ?? 'single' ) ) ); $weeks = absint( Val::int( $_POST['weeks'] ?? 1 ) ); - - $this->repository->createFromWindow( $window, 'weekly' === $recurrence, $weeks ); // phpcs:enable WordPress.Security.NonceVerification.Missing + + $ids = $this->repository->createFromWindow( $window, 'weekly' === $recurrence, $weeks ); + + // The window was valid, so it split into at least one slot — an empty + // result means every insert failed. + if ( [] === $ids ) { + return [ '', __( 'The availability could not be saved. Please try again.', 'unsupervised-schedular' ) ]; + } + + return [ + sprintf( + /* translators: %d: number of bookable slots created. */ + _n( 'Added %d bookable slot.', 'Added %d bookable slots.', count( $ids ), 'unsupervised-schedular' ), + count( $ids ) + ), + '', + ]; } } diff --git a/src/Availability/AvailabilityEndpoint.php b/src/Availability/AvailabilityEndpoint.php index cc596bc..9c588c5 100644 --- a/src/Availability/AvailabilityEndpoint.php +++ b/src/Availability/AvailabilityEndpoint.php @@ -4,14 +4,13 @@ declare(strict_types=1); namespace Unsupervised\Schedular\Availability; use Unsupervised\Schedular\Auth\RoleManager; -use Unsupervised\Schedular\Offering\OfferingRepository; use Unsupervised\Schedular\Val; class AvailabilityEndpoint { public function __construct( private AvailabilityRepository $repository, - private OfferingRepository $offerings, + private WindowValidator $validator, ) {} /** @@ -113,40 +112,18 @@ class AvailabilityEndpoint { } public function create( \WP_REST_Request $request ): \WP_REST_Response|\WP_Error { - $instructorId = get_current_user_id(); - $offeringId = absint( Val::int( $request->get_param( 'offering_id' ) ) ); - $duration = absint( Val::int( $request->get_param( 'duration_minutes' ) ) ); - - // A slot may only be tied to an offering the instructor owns, so it can - // never inherit another instructor's price or payment routing at booking. - if ( $offeringId > 0 ) { - $offering = $this->offerings->findById( $offeringId ); - if ( null === $offering || $offering->instructorId !== $instructorId ) { - return new \WP_Error( 'invalid_offering', __( 'That offering is not available.', 'unsupervised-schedular' ), [ 'status' => 400 ] ); - } - } - - $startDt = AvailabilitySlot::normalizeDateTime( Val::string( $request->get_param( 'start_dt' ) ) ); - $endDt = AvailabilitySlot::normalizeDateTime( Val::string( $request->get_param( 'end_dt' ) ) ); - - if ( null === $startDt || null === $endDt || $endDt <= $startDt ) { - return new \WP_Error( 'invalid_datetime', __( 'Provide a valid start and end, with the end after the start.', 'unsupervised-schedular' ), [ 'status' => 400 ] ); - } - - if ( substr( $startDt, 0, 10 ) !== substr( $endDt, 0, 10 ) ) { - return new \WP_Error( 'invalid_window', __( 'Availability must start and end on the same day. Use the weekly repeat to cover multiple weeks.', 'unsupervised-schedular' ), [ 'status' => 400 ] ); - } - - $window = new AvailabilitySlot( - instructorId: $instructorId, - startDt: $startDt, - endDt: $endDt, - durationMinutes: $duration > 0 ? $duration : 60, - offeringId: $offeringId > 0 ? $offeringId : null, + // Validation lives in WindowValidator so this endpoint and the admin form + // enforce exactly the same rules. + $window = $this->validator->validate( + get_current_user_id(), + Val::string( $request->get_param( 'start_dt' ) ), + Val::string( $request->get_param( 'end_dt' ) ), + absint( Val::int( $request->get_param( 'duration_minutes' ) ) ), + absint( Val::int( $request->get_param( 'offering_id' ) ) ), ); - if ( [] === $window->splitByDuration() ) { - return new \WP_Error( 'invalid_window', __( 'The availability window is shorter than the lesson length.', 'unsupervised-schedular' ), [ 'status' => 400 ] ); + if ( $window instanceof \WP_Error ) { + return $window; } $ids = $this->repository->createFromWindow( @@ -155,6 +132,12 @@ class AvailabilityEndpoint { absint( Val::int( $request->get_param( 'weeks' ) ) ) ); + // A valid window splits into at least one slot, so nothing written means + // every insert failed. + if ( [] === $ids ) { + return new \WP_Error( 'not_saved', __( 'The availability could not be saved.', 'unsupervised-schedular' ), [ 'status' => 500 ] ); + } + return new \WP_REST_Response( [ 'ids' => $ids ], 201 ); } diff --git a/src/Availability/AvailabilityRepository.php b/src/Availability/AvailabilityRepository.php index ea94b91..6eacc21 100644 --- a/src/Availability/AvailabilityRepository.php +++ b/src/Availability/AvailabilityRepository.php @@ -11,8 +11,14 @@ class AvailabilityRepository { $this->table = $db->prefix . 'us_availability'; } + /** + * Insert one slot row. Returns its id, or 0 when the write failed — + * `insert_id` still holds the *previous* statement's id after a failed + * insert, so returning it unconditionally made a failed write look like a + * successful one. + */ public function insert( AvailabilitySlot $slot ): int { - $this->db->insert( + $written = $this->db->insert( $this->table, [ 'instructor_id' => $slot->instructorId, @@ -27,7 +33,7 @@ class AvailabilityRepository { [ '%d', '%d', '%s', '%s', '%d', '%d', '%d', '%s' ] ); - return $this->db->insert_id; + return false === $written ? 0 : $this->db->insert_id; } /** @@ -42,9 +48,17 @@ class AvailabilityRepository { $ids = []; foreach ( $window->splitByDuration() as $slot ) { - $ids = $weekly - ? array_merge( $ids, $this->createWeeklySeries( $slot, $weeks ) ) - : [ ...$ids, $this->insert( $slot ) ]; + if ( $weekly ) { + $ids = array_merge( $ids, $this->createWeeklySeries( $slot, $weeks ) ); + continue; + } + + $id = $this->insert( $slot ); + + // A failed insert returns 0; it must not reach the caller as an id. + if ( $id > 0 ) { + $ids[] = $id; + } } return $ids; @@ -55,10 +69,14 @@ class AvailabilityRepository { * separate row one week apart, all sharing a `recurrence_group` (the id of the * first row). * + * The count is clamped to `AvailabilitySlot::MAX_WEEKLY_OCCURRENCES`. The + * form's `max` attribute says the same, but only this is binding — a + * hand-crafted POST used to be able to ask for an unbounded number of rows. + * * @return list Inserted slot IDs. */ public function createWeeklySeries( AvailabilitySlot $first, int $occurrences ): array { - $occurrences = max( 1, $occurrences ); + $occurrences = max( 1, min( AvailabilitySlot::MAX_WEEKLY_OCCURRENCES, $occurrences ) ); $start = new \DateTimeImmutable( $first->startDt ); $end = new \DateTimeImmutable( $first->endDt ); @@ -79,6 +97,13 @@ class AvailabilityRepository { ) ); + // A failed insert returns 0. Skipping it keeps a bogus id out of the + // returned list and, more importantly, stops 0 becoming the series' + // recurrence group — which would orphan every later occurrence. + if ( $id <= 0 ) { + continue; + } + if ( 0 === $groupId ) { $groupId = $id; $this->setRecurrenceGroup( $id, $groupId ); diff --git a/src/Availability/AvailabilitySlot.php b/src/Availability/AvailabilitySlot.php index 999127d..bf7864c 100644 --- a/src/Availability/AvailabilitySlot.php +++ b/src/Availability/AvailabilitySlot.php @@ -7,6 +7,23 @@ use Unsupervised\Schedular\Val; class AvailabilitySlot { + /** Lesson length used when none was submitted. */ + public const DEFAULT_DURATION_MINUTES = 60; + + /** + * Lesson lengths a window can be split into, offered by the availability + * form. The form hides the ones a given window is too short for. + * + * @var list + */ + public const DURATION_CHOICES = [ 30, 60 ]; + + /** + * Ceiling on a weekly series, matching the form's `max`. Enforced in the + * repository too, so a hand-crafted POST cannot ask for ten thousand rows. + */ + public const MAX_WEEKLY_OCCURRENCES = 52; + public function __construct( public readonly int $instructorId, public readonly string $startDt, diff --git a/src/Availability/WindowValidator.php b/src/Availability/WindowValidator.php new file mode 100644 index 0000000..263d271 --- /dev/null +++ b/src/Availability/WindowValidator.php @@ -0,0 +1,105 @@ + 400 ] + ); + } + + if ( $endDt <= $startDt ) { + return new \WP_Error( + 'invalid_datetime', + __( 'The end time must be after the start time.', 'unsupervised-schedular' ), + [ 'status' => 400 ] + ); + } + + if ( substr( $startDt, 0, 10 ) !== substr( $endDt, 0, 10 ) ) { + return new \WP_Error( + 'invalid_window', + __( 'Availability must start and end on the same day. Use the weekly repeat to cover multiple weeks.', 'unsupervised-schedular' ), + [ 'status' => 400 ] + ); + } + + // A slot may only be tied to an offering the instructor owns, so it can + // never inherit another instructor's price or payment routing at booking. + if ( $offeringId > 0 ) { + $offering = $this->offerings->findById( $offeringId ); + + if ( null === $offering || $offering->instructorId !== $instructorId ) { + return new \WP_Error( + 'invalid_offering', + __( 'That offering is not available.', 'unsupervised-schedular' ), + [ 'status' => 400 ] + ); + } + } + + $duration = $durationMinutes > 0 ? $durationMinutes : AvailabilitySlot::DEFAULT_DURATION_MINUTES; + + $window = new AvailabilitySlot( + instructorId: $instructorId, + startDt: $startDt, + endDt: $endDt, + durationMinutes: $duration, + offeringId: $offeringId > 0 ? $offeringId : null, + ); + + // The window is stored as lesson-length slots, so one that cannot fit a + // single lesson would persist nothing at all. + if ( [] === $window->splitByDuration() ) { + return new \WP_Error( + 'invalid_window', + sprintf( + /* translators: %d: the selected lesson length, in minutes. */ + __( 'This window is shorter than the %d-minute lesson length, so it holds no bookable slots. Choose a shorter lesson length or a longer window.', 'unsupervised-schedular' ), + $duration + ), + [ 'status' => 400 ] + ); + } + + return $window; + } +} diff --git a/src/RestRegistrar.php b/src/RestRegistrar.php index 7d98ef8..38a84cc 100644 --- a/src/RestRegistrar.php +++ b/src/RestRegistrar.php @@ -5,6 +5,7 @@ namespace Unsupervised\Schedular; use Unsupervised\Schedular\Availability\AvailabilityEndpoint; use Unsupervised\Schedular\Availability\AvailabilityRepository; +use Unsupervised\Schedular\Availability\WindowValidator; use Unsupervised\Schedular\Booking\BookingEndpoint; use Unsupervised\Schedular\Booking\BookingRepository; use Unsupervised\Schedular\Booking\CancellationPolicy; @@ -37,7 +38,7 @@ class RestRegistrar { private PaymentEndpoint $paymentEndpoint; public function __construct( AvailabilityRepository $availability, BookingRepository $bookings, OfferingRepository $offerings, QuestionRepository $questions, PolicyRepository $policies, PolicyVersionRepository $policyVersions, PolicyService $policyService, RegistrationGate $gate, EnrollmentRepository $enrollments, GroupAccessRepository $groupAccess, PaymentService $paymentService ) { - $this->availabilityEndpoint = new AvailabilityEndpoint( $availability, $offerings ); + $this->availabilityEndpoint = new AvailabilityEndpoint( $availability, new WindowValidator( $offerings ) ); $this->bookingEndpoint = new BookingEndpoint( $availability, $bookings, $offerings, $gate, $paymentService, new CancellationPolicy( new StudioSettings() ) ); $this->offeringEndpoint = new OfferingEndpoint( $offerings, $groupAccess ); $this->questionEndpoint = new QuestionEndpoint( $questions, $offerings ); diff --git a/templates/admin/availability.php b/templates/admin/availability.php index 7f65adc..c6fa63d 100644 --- a/templates/admin/availability.php +++ b/templates/admin/availability.php @@ -13,8 +13,12 @@ if (! defined('ABSPATH')) { * @var list}> $weekDays * @var string $prevWeek * @var string $nextWeek + * @var string $notice Success message from the submitted action; empty when none. + * @var string $error Failure message from the submitted action; empty when none. */ +use Unsupervised\Schedular\Availability\AvailabilitySlot; + $baseUrl = admin_url('admin.php?page=us-availability'); $deleteForm = static function (\Unsupervised\Schedular\Availability\AvailabilitySlot $slot): void { @@ -33,9 +37,16 @@ $deleteForm = static function (\Unsupervised\Schedular\Availability\Availability

+ +

+ + +

+ +

-
+ @@ -51,9 +62,20 @@ $deleteForm = static function (\Unsupervised\Schedular\Availability\Availability @@ -73,7 +95,7 @@ $deleteForm = static function (\Unsupervised\Schedular\Availability\Availability   - +
+ +
diff --git a/tests/Unit/Availability/AvailabilityControllerTest.php b/tests/Unit/Availability/AvailabilityControllerTest.php index 87f3f2a..971263f 100644 --- a/tests/Unit/Availability/AvailabilityControllerTest.php +++ b/tests/Unit/Availability/AvailabilityControllerTest.php @@ -8,6 +8,7 @@ use Mockery; use Unsupervised\Schedular\Availability\AvailabilityController; use Unsupervised\Schedular\Availability\AvailabilityRepository; use Unsupervised\Schedular\Availability\AvailabilitySlot; +use Unsupervised\Schedular\Availability\WindowValidator; use Unsupervised\Schedular\Offering\OfferingRepository; use Unsupervised\Schedular\Tests\Unit\TestCase; @@ -23,7 +24,7 @@ class AvailabilityControllerTest extends TestCase $this->repository = Mockery::mock(AvailabilityRepository::class); $this->offerings = Mockery::mock(OfferingRepository::class); - $this->controller = new AvailabilityController($this->repository, $this->offerings); + $this->controller = new AvailabilityController($this->repository, $this->offerings, new WindowValidator($this->offerings)); $_POST = []; $_GET = []; @@ -39,6 +40,7 @@ class AvailabilityControllerTest extends TestCase Functions\when('absint')->alias(static fn ($value) => abs((int) $value)); Functions\when('get_option')->justReturn(1); Functions\when('current_time')->justReturn('2026-07-06'); + Functions\when('selected')->justReturn(''); Functions\when('admin_url')->justReturn('admin.php?page=us-availability'); Functions\when('add_query_arg')->justReturn('admin.php?page=us-availability&usc_view=week'); Functions\when('wp_nonce_field')->justReturn(''); @@ -131,6 +133,159 @@ class AvailabilityControllerTest extends TestCase self::assertStringNotContainsString('name="slot_ids[]" form="usc-bulk-delete-form" value="6"', $html); } + /** + * The reported bug: a 30-minute window submitted with the lesson length left + * on 60 saved nothing and said nothing. It must now say why. + */ + public function testAddShowsAnErrorWhenTheWindowIsShorterThanTheLessonLength(): void + { + $_POST = [ + 'usc_action' => 'add', + 'start_dt' => '2026-09-10T17:30', + 'end_dt' => '2026-09-10T18:00', + 'duration_minutes' => '60', + ]; + + $this->repository->shouldNotReceive('createFromWindow'); + $this->repository->shouldReceive('findByInstructor')->once()->with(3)->andReturn([]); + + $html = $this->render(); + + self::assertStringContainsString('notice-error', $html); + self::assertStringContainsString('60-minute lesson length', $html); + self::assertStringNotContainsString('notice-success', $html); + } + + /** @return array, string}> */ + public static function invalidWindows(): array + { + return [ + 'unparseable start' => [['start_dt' => 'whenever', 'end_dt' => '2026-09-10T18:00'], 'valid start and end'], + 'end before start' => [['start_dt' => '2026-09-10T18:00', 'end_dt' => '2026-09-10T17:00'], 'after the start time'], + 'spans two days' => [['start_dt' => '2026-09-10T23:00', 'end_dt' => '2026-09-11T01:00'], 'same day'], + ]; + } + + /** + * Each of these used to be a bare `return` — the page reloaded unchanged and + * the instructor had no way to tell the save had failed. + * + * @dataProvider invalidWindows + * + * @param array $fields + */ + public function testAddReportsEveryRejectedWindow(array $fields, string $expected): void + { + $_POST = array_merge([ 'usc_action' => 'add', 'duration_minutes' => '30' ], $fields); + + $this->repository->shouldNotReceive('createFromWindow'); + $this->repository->shouldReceive('findByInstructor')->once()->with(3)->andReturn([]); + + $html = $this->render(); + + self::assertStringContainsString('notice-error', $html); + self::assertStringContainsString($expected, $html); + } + + public function testAddRejectsAnOfferingTheInstructorDoesNotOwn(): void + { + // The REST endpoint always checked this; the admin form never did, so a + // crafted POST could tie a slot to another instructor's offering. + $_POST = [ + 'usc_action' => 'add', + 'start_dt' => '2026-09-10T17:00', + 'end_dt' => '2026-09-10T18:00', + 'duration_minutes' => '60', + 'offering_id' => '8', + ]; + + $this->offerings->shouldReceive('findById')->once()->with(8)->andReturn(null); + $this->repository->shouldNotReceive('createFromWindow'); + $this->repository->shouldReceive('findByInstructor')->once()->with(3)->andReturn([]); + + $html = $this->render(); + + self::assertStringContainsString('notice-error', $html); + self::assertStringContainsString('not available', $html); + } + + public function testAddReportsHowManySlotsWereCreated(): void + { + $_POST = [ + 'usc_action' => 'add', + 'start_dt' => '2026-09-10T17:00', + 'end_dt' => '2026-09-10T19:00', + 'duration_minutes' => '60', + 'recurrence' => 'weekly', + 'weeks' => '41', + ]; + + $this->repository->shouldReceive('createFromWindow')->once() + ->with(Mockery::type(AvailabilitySlot::class), true, 41) + ->andReturn(range(1, 82)); + $this->repository->shouldReceive('findByInstructor')->once()->with(3)->andReturn([]); + + $html = $this->render(); + + self::assertStringContainsString('notice-success', $html); + self::assertStringContainsString('Added 82 bookable slots.', $html); + } + + public function testAddReportsAFailedWrite(): void + { + // A valid window always splits into at least one slot, so an empty result + // means the inserts themselves failed. + $_POST = [ + 'usc_action' => 'add', + 'start_dt' => '2026-09-10T17:00', + 'end_dt' => '2026-09-10T18:00', + 'duration_minutes' => '60', + ]; + + $this->repository->shouldReceive('createFromWindow')->once()->andReturn([]); + $this->repository->shouldReceive('findByInstructor')->once()->with(3)->andReturn([]); + + $html = $this->render(); + + self::assertStringContainsString('notice-error', $html); + self::assertStringContainsString('could not be saved', $html); + } + + public function testSingleDeleteReportsAFailureToDelete(): void + { + $_POST = [ 'usc_action' => 'delete', 'slot_id' => '7' ]; + + $other = new AvailabilitySlot(instructorId: 4, startDt: '2026-07-08 09:00:00', endDt: '2026-07-08 10:00:00', id: 7); + + $this->repository->shouldReceive('findById')->once()->with(7)->andReturn($other); + $this->repository->shouldReceive('findByInstructor')->once()->with(3)->andReturn([]); + + $html = $this->render(); + + self::assertStringContainsString('notice-error', $html); + self::assertStringContainsString('could not be deleted', $html); + } + + public function testBulkDeleteReportsBothHalvesOfAPartialResult(): void + { + $_POST = [ 'usc_action' => 'bulk_delete', 'slot_ids' => ['5', '7'] ]; + + $owned = new AvailabilitySlot(instructorId: 3, startDt: '2026-07-08 09:00:00', endDt: '2026-07-08 10:00:00', id: 5); + $booked = new AvailabilitySlot(instructorId: 3, startDt: '2026-07-08 10:00:00', endDt: '2026-07-08 11:00:00', isBooked: true, id: 7); + + $this->repository->shouldReceive('findById')->once()->with(5)->andReturn($owned); + $this->repository->shouldReceive('findById')->once()->with(7)->andReturn($booked); + $this->repository->shouldReceive('delete')->once()->with(5)->andReturn(true); + // The repository refuses a booked row, reporting it by returning false. + $this->repository->shouldReceive('delete')->once()->with(7)->andReturn(false); + $this->repository->shouldReceive('findByInstructor')->once()->with(3)->andReturn([]); + + $html = $this->render(); + + self::assertStringContainsString('1 slot deleted.', $html); + self::assertStringContainsString('1 slot could not be deleted', $html); + } + private function render(): string { ob_start(); diff --git a/tests/Unit/Availability/AvailabilityEndpointTest.php b/tests/Unit/Availability/AvailabilityEndpointTest.php index a00438b..16a771c 100644 --- a/tests/Unit/Availability/AvailabilityEndpointTest.php +++ b/tests/Unit/Availability/AvailabilityEndpointTest.php @@ -8,6 +8,7 @@ use Mockery; use Unsupervised\Schedular\Availability\AvailabilityEndpoint; use Unsupervised\Schedular\Availability\AvailabilityRepository; use Unsupervised\Schedular\Availability\AvailabilitySlot; +use Unsupervised\Schedular\Availability\WindowValidator; use Unsupervised\Schedular\Offering\OfferingRepository; use Unsupervised\Schedular\Tests\Unit\TestCase; @@ -26,7 +27,7 @@ class AvailabilityEndpointTest extends TestCase $this->repository = Mockery::mock(AvailabilityRepository::class); $this->offerings = Mockery::mock(OfferingRepository::class); - $this->endpoint = new AvailabilityEndpoint($this->repository, $this->offerings); + $this->endpoint = new AvailabilityEndpoint($this->repository, new WindowValidator($this->offerings)); } public function testCreateRejectsWindowSpanningMultipleDays(): void diff --git a/tests/Unit/Availability/AvailabilityRepositoryTest.php b/tests/Unit/Availability/AvailabilityRepositoryTest.php index 72c4ff1..c832a44 100644 --- a/tests/Unit/Availability/AvailabilityRepositoryTest.php +++ b/tests/Unit/Availability/AvailabilityRepositoryTest.php @@ -49,6 +49,101 @@ class AvailabilityRepositoryTest extends TestCase self::assertSame(42, $result); } + public function testInsertReturnsZeroWhenTheWriteFails(): void + { + Functions\expect('current_time')->with('mysql')->andReturn('2026-04-01 12:00:00'); + + // wpdb::insert returns false on error, but insert_id still holds the + // previous statement's id — returning it made a failed write look like a + // successful one. + $this->db->shouldReceive('insert')->once()->andReturn(false); + $this->db->insert_id = 42; + + $slot = new AvailabilitySlot(5, '2026-04-01 09:00:00', '2026-04-01 10:00:00', 30); + + self::assertSame(0, $this->repo->insert($slot)); + } + + public function testCreateFromWindowOmitsChunksThatFailedToInsert(): void + { + Functions\when('current_time')->justReturn('2026-04-01 12:00:00'); + + // Three chunks; the middle write fails. + $results = [null, false, null]; + $ids = [11, 13]; + + $this->db->shouldReceive('insert') + ->times(3) + ->andReturnUsing(function () use (&$results, &$ids) { + $outcome = array_shift($results); + + if (false !== $outcome) { + $this->db->insert_id = array_shift($ids); + } + + return $outcome; + }); + + $window = new AvailabilitySlot(5, '2026-04-01 09:00:00', '2026-04-01 10:30:00', 30); + + self::assertSame([11, 13], $this->repo->createFromWindow($window)); + } + + public function testWeeklySeriesIsClampedToTheMaximum(): void + { + Functions\when('current_time')->justReturn('2026-04-01 12:00:00'); + + // The form's max is advisory; a hand-crafted POST could ask for any + // number, so the ceiling is enforced here. + $next = 1; + $this->db->shouldReceive('insert') + ->times(AvailabilitySlot::MAX_WEEKLY_OCCURRENCES) + ->andReturnUsing(function () use (&$next) { + $this->db->insert_id = $next++; + + return null; + }); + $this->db->shouldReceive('update')->once(); + + $first = new AvailabilitySlot(5, '2026-04-01 09:00:00', '2026-04-01 10:00:00', 60); + + self::assertCount( + AvailabilitySlot::MAX_WEEKLY_OCCURRENCES, + $this->repo->createWeeklySeries($first, 10000) + ); + } + + public function testWeeklySeriesGroupsOnTheFirstRowThatActuallyWrote(): void + { + Functions\when('current_time')->justReturn('2026-04-01 12:00:00'); + + // The first insert fails. A failed row must not become the recurrence + // group (its id is 0), which would orphan every later occurrence. + $results = [false, null, null]; + $ids = [21, 22]; + + $this->db->shouldReceive('insert') + ->times(3) + ->andReturnUsing(function () use (&$results, &$ids) { + $outcome = array_shift($results); + + if (false !== $outcome) { + $this->db->insert_id = array_shift($ids); + } + + return $outcome; + }); + + // The group is set from row 21 — the first that survived. + $this->db->shouldReceive('update') + ->once() + ->with('wp_us_availability', ['recurrence_group' => 21], ['id' => 21], ['%d'], ['%d']); + + $first = new AvailabilitySlot(5, '2026-04-01 09:00:00', '2026-04-01 10:00:00', 60); + + self::assertSame([21, 22], $this->repo->createWeeklySeries($first, 3)); + } + public function testCreateWeeklySeriesInsertsWeeklyAndSharesGroup(): void { Functions\when('current_time')->justReturn('2026-04-07 12:00:00'); diff --git a/tests/Unit/Availability/WindowValidatorTest.php b/tests/Unit/Availability/WindowValidatorTest.php new file mode 100644 index 0000000..b761d0b --- /dev/null +++ b/tests/Unit/Availability/WindowValidatorTest.php @@ -0,0 +1,143 @@ +offerings = Mockery::mock(OfferingRepository::class); + $this->validator = new WindowValidator($this->offerings); + } + + /** + * The reported bug: 5:30–6:00 PM submitted with the length select left on + * its 60-minute default. The window fits no lesson, so it used to persist + * nothing at all and say nothing. + */ + public function testRejectsAWindowShorterThanTheLessonLength(): void + { + $result = $this->validator->validate(3, '2026-09-10 17:30', '2026-09-10 18:00', 60, 0); + + self::assertInstanceOf(\WP_Error::class, $result); + self::assertSame('invalid_window', $result->get_error_code()); + // The message names the length actually chosen, so the fix is obvious. + self::assertStringContainsString('60-minute', $result->get_error_message()); + } + + public function testAcceptsThatSameWindowAtAFittingLessonLength(): void + { + $result = $this->validator->validate(3, '2026-09-10 17:30', '2026-09-10 18:00', 30, 0); + + self::assertInstanceOf(AvailabilitySlot::class, $result); + self::assertSame('2026-09-10 17:30:00', $result->startDt); + self::assertSame('2026-09-10 18:00:00', $result->endDt); + self::assertSame(30, $result->durationMinutes); + self::assertNull($result->offeringId); + self::assertCount(1, $result->splitByDuration()); + } + + /** @return array */ + public static function badDateTimes(): array + { + return [ + 'empty start' => ['', '2026-09-10 18:00'], + 'empty end' => ['2026-09-10 17:00', ''], + 'unparseable start' => ['tomorrow', '2026-09-10 18:00'], + 'unparseable end' => ['2026-09-10 17:00', 'not a date'], + ]; + } + + /** @dataProvider badDateTimes */ + public function testRejectsUnusableDateTimes(string $start, string $end): void + { + $result = $this->validator->validate(3, $start, $end, 30, 0); + + self::assertInstanceOf(\WP_Error::class, $result); + self::assertSame('invalid_datetime', $result->get_error_code()); + } + + public function testRejectsAnEndAtOrBeforeTheStart(): void + { + $backwards = $this->validator->validate(3, '2026-09-10 18:00', '2026-09-10 17:00', 30, 0); + $identical = $this->validator->validate(3, '2026-09-10 18:00', '2026-09-10 18:00', 30, 0); + + self::assertInstanceOf(\WP_Error::class, $backwards); + self::assertInstanceOf(\WP_Error::class, $identical); + self::assertSame('invalid_datetime', $backwards->get_error_code()); + self::assertSame('invalid_datetime', $identical->get_error_code()); + } + + public function testRejectsAWindowSpanningTwoDays(): void + { + $result = $this->validator->validate(3, '2026-09-10 23:00', '2026-09-11 01:00', 30, 0); + + self::assertInstanceOf(\WP_Error::class, $result); + self::assertSame('invalid_window', $result->get_error_code()); + self::assertStringContainsString('same day', $result->get_error_message()); + } + + public function testRejectsAnOfferingOwnedBySomeoneElse(): void + { + // Instructor 3 posting instructor 9's offering: accepting it would let a + // slot inherit another instructor's price and payment routing. + $this->offerings->shouldReceive('findById')->once()->with(8) + ->andReturn(new Offering(instructorId: 9, title: 'Theirs', kind: Offering::KIND_PRIVATE_LESSON, id: 8)); + + $result = $this->validator->validate(3, '2026-09-10 17:00', '2026-09-10 18:00', 60, 8); + + self::assertInstanceOf(\WP_Error::class, $result); + self::assertSame('invalid_offering', $result->get_error_code()); + } + + public function testRejectsAnOfferingThatDoesNotExist(): void + { + $this->offerings->shouldReceive('findById')->once()->with(8)->andReturn(null); + + $result = $this->validator->validate(3, '2026-09-10 17:00', '2026-09-10 18:00', 60, 8); + + self::assertInstanceOf(\WP_Error::class, $result); + self::assertSame('invalid_offering', $result->get_error_code()); + } + + public function testKeepsAnOfferingTheInstructorOwns(): void + { + $this->offerings->shouldReceive('findById')->once()->with(8) + ->andReturn(new Offering(instructorId: 3, title: 'Mine', kind: Offering::KIND_PRIVATE_LESSON, id: 8)); + + $result = $this->validator->validate(3, '2026-09-10 17:00', '2026-09-10 18:00', 60, 8); + + self::assertInstanceOf(AvailabilitySlot::class, $result); + self::assertSame(8, $result->offeringId); + } + + public function testFallsBackToTheDefaultLessonLength(): void + { + $result = $this->validator->validate(3, '2026-09-10 09:00', '2026-09-10 10:00', 0, 0); + + self::assertInstanceOf(AvailabilitySlot::class, $result); + self::assertSame(AvailabilitySlot::DEFAULT_DURATION_MINUTES, $result->durationMinutes); + } + + public function testAcceptsTheDatetimeLocalFormTheFormActuallySubmits(): void + { + // The browser posts `Y-m-d\TH:i`, not the canonical space-separated form. + $result = $this->validator->validate(3, '2026-09-10T17:00', '2026-09-10T18:00', 60, 0); + + self::assertInstanceOf(AvailabilitySlot::class, $result); + self::assertSame('2026-09-10 17:00:00', $result->startDt); + } +} -- 2.54.0