thatguygriffandClaude Opus 4.8
7370755951
CI / Tests (PHP 8.1) (pull_request) Successful in 1m18s
CI / Tests (PHP 8.2) (pull_request) Successful in 1m18s
CI / No Debug Code (pull_request) Successful in 2s
CI / PHPStan (pull_request) Successful in 3m20s
CI / Coding Standards (pull_request) Successful in 3m25s
CI / Tests (PHP 8.3) (pull_request) Successful in 2m33s
CI / Build Plugin Zip (pull_request) Skipped
Students could previously join by invite only. Add an optional self-approval mode, toggled from Studio Settings → Registration: anyone may sign up on the existing [us_student_register] page, confirm their email via a tokenised link, and then be approved by a studio admin before the account is usable. - Enabling the toggle mirrors WordPress's own membership settings (users_can_register + default_role = us_student) and snapshots their previous values so disabling restores them. - WordPress's native registration form is blocked while open registration is on (login_init redirect + registration_errors fail-safe + register_url) so it cannot bypass signup policy acceptance. - Pending accounts: unconfirmed email cannot log in; confirmed but unapproved can log in but the booking capability is withheld and the booking page shows an "awaiting approval" screen. - Approve/reject from Students → Pending Students; reject hard-deletes the account so the email is freed to re-apply. - Invite registration is unchanged; both modes coexist. Account lifecycle lives in user meta (RegistrationStatus); no new tables. Closes #63 Co-Authored-By: Claude Opus 4.8 <[email protected]>
107 lines
3.8 KiB
PHP
107 lines
3.8 KiB
PHP
<?php
|
|
declare(strict_types=1);
|
|
|
|
namespace Unsupervised\Schedular\Tests\Unit\Auth;
|
|
|
|
use Brain\Monkey\Functions;
|
|
use Unsupervised\Schedular\Auth\RegistrationStatus;
|
|
use Unsupervised\Schedular\Tests\Unit\TestCase;
|
|
|
|
class RegistrationStatusTest extends TestCase
|
|
{
|
|
public function testMarkPendingIssuesHashedTokenAndSetsFlags(): void
|
|
{
|
|
Functions\when('wp_generate_password')->justReturn('rawtoken');
|
|
|
|
Functions\expect('update_user_meta')
|
|
->once()
|
|
->with(7, RegistrationStatus::META_AWAITING_APPROVAL, '1');
|
|
Functions\expect('update_user_meta')
|
|
->once()
|
|
->with(7, RegistrationStatus::META_CONFIRM_TOKEN, hash('sha256', 'rawtoken'));
|
|
Functions\expect('update_user_meta')
|
|
->once()
|
|
->with(7, RegistrationStatus::META_CONFIRM_EXPIRES, \Mockery::type('string'));
|
|
|
|
self::assertSame('rawtoken', RegistrationStatus::markPending(7));
|
|
}
|
|
|
|
public function testConfirmEmailSetsFlagAndClearsToken(): void
|
|
{
|
|
Functions\expect('update_user_meta')
|
|
->once()
|
|
->with(7, RegistrationStatus::META_EMAIL_CONFIRMED, '1');
|
|
Functions\expect('delete_user_meta')->once()->with(7, RegistrationStatus::META_CONFIRM_TOKEN);
|
|
Functions\expect('delete_user_meta')->once()->with(7, RegistrationStatus::META_CONFIRM_EXPIRES);
|
|
|
|
RegistrationStatus::confirmEmail(7);
|
|
}
|
|
|
|
public function testApproveClearsPendingFlags(): void
|
|
{
|
|
Functions\expect('delete_user_meta')->once()->with(7, RegistrationStatus::META_AWAITING_APPROVAL);
|
|
Functions\expect('delete_user_meta')->once()->with(7, RegistrationStatus::META_CONFIRM_TOKEN);
|
|
Functions\expect('delete_user_meta')->once()->with(7, RegistrationStatus::META_CONFIRM_EXPIRES);
|
|
|
|
RegistrationStatus::approve(7);
|
|
}
|
|
|
|
public function testAwaitingApprovalAndEmailConfirmedReadMeta(): void
|
|
{
|
|
Functions\when('get_user_meta')->alias(static function (int $id, string $key) {
|
|
return $key === RegistrationStatus::META_AWAITING_APPROVAL ? '1' : '';
|
|
});
|
|
|
|
self::assertTrue(RegistrationStatus::isAwaitingApproval(7));
|
|
self::assertFalse(RegistrationStatus::emailConfirmed(7));
|
|
}
|
|
|
|
public function testUserIdForTokenLooksUpByHashOnly(): void
|
|
{
|
|
Functions\expect('get_users')
|
|
->once()
|
|
->with(\Mockery::on(static fn (array $args): bool =>
|
|
$args['meta_key'] === RegistrationStatus::META_CONFIRM_TOKEN
|
|
&& $args['meta_value'] === hash('sha256', 'rawtoken')))
|
|
->andReturn([9]);
|
|
|
|
self::assertSame(9, RegistrationStatus::userIdForToken('rawtoken'));
|
|
}
|
|
|
|
public function testUserIdForTokenReturnsNullWhenNoMatch(): void
|
|
{
|
|
Functions\when('get_users')->justReturn([]);
|
|
|
|
self::assertNull(RegistrationStatus::userIdForToken('rawtoken'));
|
|
}
|
|
|
|
public function testEmptyTokenShortCircuits(): void
|
|
{
|
|
// get_users must never be called for an empty token.
|
|
Functions\expect('get_users')->never();
|
|
|
|
self::assertNull(RegistrationStatus::userIdForToken(''));
|
|
}
|
|
|
|
public function testTokenExpiredWhenExpiryPassed(): void
|
|
{
|
|
Functions\when('get_user_meta')->justReturn('2020-01-01 00:00:00');
|
|
|
|
self::assertTrue(RegistrationStatus::isTokenExpired(7, '2020-01-02 00:00:00'));
|
|
}
|
|
|
|
public function testTokenNotExpiredWhenExpiryInFuture(): void
|
|
{
|
|
Functions\when('get_user_meta')->justReturn('2020-01-03 00:00:00');
|
|
|
|
self::assertFalse(RegistrationStatus::isTokenExpired(7, '2020-01-02 00:00:00'));
|
|
}
|
|
|
|
public function testMissingExpiryTreatedAsExpired(): void
|
|
{
|
|
Functions\when('get_user_meta')->justReturn('');
|
|
|
|
self::assertTrue(RegistrationStatus::isTokenExpired(7, '2020-01-02 00:00:00'));
|
|
}
|
|
}
|