Files
thatguygriff 171b655bb8
CI / Tests (PHP 8.1) (pull_request) Successful in 56s
CI / Tests (PHP 8.2) (pull_request) Successful in 46s
CI / No Debug Code (pull_request) Successful in 2s
CI / Coding Standards (pull_request) Successful in 3m3s
CI / PHPStan (pull_request) Successful in 2m51s
CI / Tests (PHP 8.3) (pull_request) Successful in 2m50s
CI / Build Plugin Zip (pull_request) Skipped
Stop the availability form failing in silence
Adding availability for 5:30-6:00 PM with the lesson length left on its
60-minute default saved nothing and said nothing. A window is stored as
consecutive lesson-length slots, so one that fits no lesson splits into
none: splitByDuration() returned [], createFromWindow() inserted
nothing, and addSlot() discarded the result and re-rendered the page
unchanged.

The REST endpoint already rejected that window with a 400. The admin
form checked the same rules separately, and its copy was both laxer and
mute — an unreadable date, an end before the start, and a two-day window
were bare `return`s, and it never checked offering ownership at all, so
a crafted POST could tie a slot to another instructor's offering and
inherit their price and payment routing.

Both callers now go through WindowValidator, which returns the window or
a WP_Error explaining the refusal. The endpoint returns that error as
is; the page renders its message as a notice. handleFormAction returns
a [notice, error] pair so deletes report themselves too, and a
successful add says how many slots it created.

Two failures could also go unnoticed underneath: wpdb::insert's result
was ignored, and insert_id still holds the previous statement's id after
a failed write, so a failure looked like a success — and could become
the recurrence group of a weekly series, orphaning every later
occurrence. weeks was unbounded server-side despite the form's max=52.

availability-admin.js narrows the lesson-length choices to those that
fit the window and blocks submission when none do, which is what makes
the original mistake hard to repeat. It is a convenience: the server
validates regardless.

Closes #130
2026-07-28 23:19:49 -03:00

144 lines
5.8 KiB
PHP
Raw Permalink Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
<?php
declare(strict_types=1);
namespace Unsupervised\Schedular\Tests\Unit\Availability;
use Mockery;
use Unsupervised\Schedular\Availability\AvailabilitySlot;
use Unsupervised\Schedular\Availability\WindowValidator;
use Unsupervised\Schedular\Offering\Offering;
use Unsupervised\Schedular\Offering\OfferingRepository;
use Unsupervised\Schedular\Tests\Unit\TestCase;
class WindowValidatorTest extends TestCase
{
private OfferingRepository&Mockery\MockInterface $offerings;
private WindowValidator $validator;
protected function setUp(): void
{
parent::setUp();
$this->offerings = Mockery::mock(OfferingRepository::class);
$this->validator = new WindowValidator($this->offerings);
}
/**
* The reported bug: 5:306:00 PM submitted with the length select left on
* its 60-minute default. The window fits no lesson, so it used to persist
* nothing at all and say nothing.
*/
public function testRejectsAWindowShorterThanTheLessonLength(): void
{
$result = $this->validator->validate(3, '2026-09-10 17:30', '2026-09-10 18:00', 60, 0);
self::assertInstanceOf(\WP_Error::class, $result);
self::assertSame('invalid_window', $result->get_error_code());
// The message names the length actually chosen, so the fix is obvious.
self::assertStringContainsString('60-minute', $result->get_error_message());
}
public function testAcceptsThatSameWindowAtAFittingLessonLength(): void
{
$result = $this->validator->validate(3, '2026-09-10 17:30', '2026-09-10 18:00', 30, 0);
self::assertInstanceOf(AvailabilitySlot::class, $result);
self::assertSame('2026-09-10 17:30:00', $result->startDt);
self::assertSame('2026-09-10 18:00:00', $result->endDt);
self::assertSame(30, $result->durationMinutes);
self::assertNull($result->offeringId);
self::assertCount(1, $result->splitByDuration());
}
/** @return array<string, array{string, string}> */
public static function badDateTimes(): array
{
return [
'empty start' => ['', '2026-09-10 18:00'],
'empty end' => ['2026-09-10 17:00', ''],
'unparseable start' => ['tomorrow', '2026-09-10 18:00'],
'unparseable end' => ['2026-09-10 17:00', 'not a date'],
];
}
/** @dataProvider badDateTimes */
public function testRejectsUnusableDateTimes(string $start, string $end): void
{
$result = $this->validator->validate(3, $start, $end, 30, 0);
self::assertInstanceOf(\WP_Error::class, $result);
self::assertSame('invalid_datetime', $result->get_error_code());
}
public function testRejectsAnEndAtOrBeforeTheStart(): void
{
$backwards = $this->validator->validate(3, '2026-09-10 18:00', '2026-09-10 17:00', 30, 0);
$identical = $this->validator->validate(3, '2026-09-10 18:00', '2026-09-10 18:00', 30, 0);
self::assertInstanceOf(\WP_Error::class, $backwards);
self::assertInstanceOf(\WP_Error::class, $identical);
self::assertSame('invalid_datetime', $backwards->get_error_code());
self::assertSame('invalid_datetime', $identical->get_error_code());
}
public function testRejectsAWindowSpanningTwoDays(): void
{
$result = $this->validator->validate(3, '2026-09-10 23:00', '2026-09-11 01:00', 30, 0);
self::assertInstanceOf(\WP_Error::class, $result);
self::assertSame('invalid_window', $result->get_error_code());
self::assertStringContainsString('same day', $result->get_error_message());
}
public function testRejectsAnOfferingOwnedBySomeoneElse(): void
{
// Instructor 3 posting instructor 9's offering: accepting it would let a
// slot inherit another instructor's price and payment routing.
$this->offerings->shouldReceive('findById')->once()->with(8)
->andReturn(new Offering(instructorId: 9, title: 'Theirs', kind: Offering::KIND_PRIVATE_LESSON, id: 8));
$result = $this->validator->validate(3, '2026-09-10 17:00', '2026-09-10 18:00', 60, 8);
self::assertInstanceOf(\WP_Error::class, $result);
self::assertSame('invalid_offering', $result->get_error_code());
}
public function testRejectsAnOfferingThatDoesNotExist(): void
{
$this->offerings->shouldReceive('findById')->once()->with(8)->andReturn(null);
$result = $this->validator->validate(3, '2026-09-10 17:00', '2026-09-10 18:00', 60, 8);
self::assertInstanceOf(\WP_Error::class, $result);
self::assertSame('invalid_offering', $result->get_error_code());
}
public function testKeepsAnOfferingTheInstructorOwns(): void
{
$this->offerings->shouldReceive('findById')->once()->with(8)
->andReturn(new Offering(instructorId: 3, title: 'Mine', kind: Offering::KIND_PRIVATE_LESSON, id: 8));
$result = $this->validator->validate(3, '2026-09-10 17:00', '2026-09-10 18:00', 60, 8);
self::assertInstanceOf(AvailabilitySlot::class, $result);
self::assertSame(8, $result->offeringId);
}
public function testFallsBackToTheDefaultLessonLength(): void
{
$result = $this->validator->validate(3, '2026-09-10 09:00', '2026-09-10 10:00', 0, 0);
self::assertInstanceOf(AvailabilitySlot::class, $result);
self::assertSame(AvailabilitySlot::DEFAULT_DURATION_MINUTES, $result->durationMinutes);
}
public function testAcceptsTheDatetimeLocalFormTheFormActuallySubmits(): void
{
// The browser posts `Y-m-d\TH:i`, not the canonical space-separated form.
$result = $this->validator->validate(3, '2026-09-10T17:00', '2026-09-10T18:00', 60, 0);
self::assertInstanceOf(AvailabilitySlot::class, $result);
self::assertSame('2026-09-10 17:00:00', $result->startDt);
}
}