Files
unsupervised-scheduler/tests/Unit/Offering/OfferingTest.php
T
thatguygriff 061d09e034
CI / No Debug Code (pull_request) Successful in 3s
CI / Tests (PHP 8.1) (pull_request) Successful in 49s
CI / Coding Standards (pull_request) Successful in 55s
CI / PHPStan (pull_request) Successful in 1m7s
CI / Tests (PHP 8.3) (pull_request) Successful in 1m41s
CI / Tests (PHP 8.2) (pull_request) Successful in 44s
CI / Build Plugin Zip (pull_request) Has been skipped
Harden booking, offering exposure, payments, and invites
Security fixes from a pen-test review (issues #31–#37):

- #31 Booking no longer trusts a client-supplied offering_id: a slot-tied
  offering is authoritative and any offering used must belong to the slot's
  instructor, closing a free/misrouted-payment bypass.
- #34 Availability slot creation rejects an offering the instructor does not
  own (AvailabilityEndpoint now takes OfferingRepository).
- #32 Offering/question/policy listing endpoints now require book_lesson
  instead of being public (no anonymous consumer exists); Offering::toArray
  also omits etransfer_email from listings as defense-in-depth.
- #33 Slots are claimed atomically (UPDATE ... WHERE is_booked = 0) before a
  lesson is inserted, preventing a double-booking race.
- #35 A single weekly booking is capped (MAX_WEEKLY_OCCURRENCES) and only
  creates lessons for slots it actually claimed.
- #36 Stripe secret/webhook keys are write-only in the settings UI and a blank
  submit keeps the stored value; secrets are never echoed back into HTML.
- #37 Pending invites expire after 14 days (Invite::isAcceptable), enforced at
  registration and surfaced on the admin invites list.

Adds BookingEndpointTest plus Invite/Offering/AvailabilityRepository coverage
and minimal WP_REST_Request/WP_REST_Response stubs. composer test (200),
lint, and cs all green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 17:08:22 -03:00

110 lines
4.2 KiB
PHP

<?php
declare(strict_types=1);
namespace Unsupervised\Schedular\Tests\Unit\Offering;
use Unsupervised\Schedular\Offering\Offering;
use Unsupervised\Schedular\Tests\Unit\TestCase;
class OfferingTest extends TestCase
{
public function testConstructorAndProperties(): void
{
$offering = new Offering(
instructorId: 5,
kind: Offering::KIND_PRIVATE_LESSON,
title: '30-min Piano',
price: 35.00,
billingMode: Offering::BILLING_ONE_TIME,
durationMinutes: 30,
id: 42,
);
self::assertSame(5, $offering->instructorId);
self::assertSame(Offering::KIND_PRIVATE_LESSON, $offering->kind);
self::assertSame('30-min Piano', $offering->title);
self::assertSame(35.00, $offering->price);
self::assertSame(30, $offering->durationMinutes);
self::assertSame(42, $offering->id);
}
public function testDefaults(): void
{
$offering = new Offering(1, Offering::KIND_GROUP_CLASS, 'Choir');
self::assertSame(0.0, $offering->price);
self::assertSame('CAD', $offering->currency);
self::assertSame(Offering::BILLING_ONE_TIME, $offering->billingMode);
self::assertNull($offering->durationMinutes);
self::assertFalse($offering->allowWeekly);
self::assertNull($offering->capacity);
self::assertTrue($offering->isActive);
self::assertNull($offering->id);
}
public function testFromRowMapsCorrectlyAndCastsNullables(): void
{
$row = (object) [
'id' => '7',
'instructor_id' => '3',
'kind' => Offering::KIND_GROUP_CLASS,
'title' => 'Year Choir',
'description' => 'Weekly choir',
'duration_minutes' => null,
'price' => '120.00',
'currency' => 'CAD',
'billing_mode' => Offering::BILLING_FULL_TERM,
'allow_weekly' => '0',
'capacity' => '20',
'term_start' => '2026-09-01',
'term_end' => '2027-06-30',
'schedule_note' => 'Tuesdays 4:00pm',
'etransfer_email' => null,
'is_active' => '1',
];
$offering = Offering::fromRow($row);
self::assertSame(7, $offering->id);
self::assertSame(3, $offering->instructorId);
self::assertNull($offering->durationMinutes);
self::assertSame(120.00, $offering->price);
self::assertSame(20, $offering->capacity);
self::assertSame(Offering::BILLING_FULL_TERM, $offering->billingMode);
self::assertTrue($offering->isActive);
}
public function testToArrayContainsExpectedKeys(): void
{
$offering = new Offering(1, Offering::KIND_PRIVATE_LESSON, 'Lesson', id: 10);
$arr = $offering->toArray();
foreach (['id', 'instructor_id', 'kind', 'title', 'price', 'billing_mode', 'is_active'] as $key) {
self::assertArrayHasKey($key, $arr);
}
}
public function testToArrayIncludesEtransferEmailByDefault(): void
{
$offering = new Offering(1, Offering::KIND_PRIVATE_LESSON, 'Lesson', etransferEmail: 'studio@example.com', id: 10);
self::assertArrayHasKey('etransfer_email', $offering->toArray());
self::assertSame('studio@example.com', $offering->toArray()['etransfer_email']);
}
public function testToArrayOmitsEtransferEmailWhenExcluded(): void
{
$offering = new Offering(1, Offering::KIND_PRIVATE_LESSON, 'Lesson', etransferEmail: 'studio@example.com', id: 10);
self::assertArrayNotHasKey('etransfer_email', $offering->toArray(includeEtransferEmail: false));
}
public function testValidKindAndBillingConstants(): void
{
self::assertContains(Offering::KIND_PRIVATE_LESSON, Offering::VALID_KINDS);
self::assertContains(Offering::KIND_GROUP_CLASS, Offering::VALID_KINDS);
self::assertContains(Offering::BILLING_ONE_TIME, Offering::VALID_BILLING_MODES);
self::assertContains(Offering::BILLING_FULL_TERM, Offering::VALID_BILLING_MODES);
}
}