5140e76347
CI / No Debug Code (pull_request) Successful in 11s
CI / Tests (PHP 8.2) (pull_request) Successful in 1m42s
CI / Tests (PHP 8.3) (pull_request) Successful in 2m17s
CI / Tests (PHP 8.1) (pull_request) Successful in 2m17s
CI / Coding Standards (pull_request) Successful in 2m26s
CI / PHPStan (pull_request) Successful in 2m38s
CI / Build Plugin Zip (pull_request) Has been skipped
Security fixes from a pen-test review (issues #31–#37): - #31 Booking no longer trusts a client-supplied offering_id: a slot-tied offering is authoritative and any offering used must belong to the slot's instructor, closing a free/misrouted-payment bypass. - #34 Availability slot creation rejects an offering the instructor does not own (AvailabilityEndpoint now takes OfferingRepository). - #32 Offering/question/policy listing endpoints now require book_lesson instead of being public (no anonymous consumer exists); Offering::toArray also omits etransfer_email from listings as defense-in-depth. - #33 Slots are claimed atomically (UPDATE ... WHERE is_booked = 0) before a lesson is inserted, preventing a double-booking race. - #35 A single weekly booking is capped (MAX_WEEKLY_OCCURRENCES) and only creates lessons for slots it actually claimed. - #36 Stripe secret/webhook keys are write-only in the settings UI and a blank submit keeps the stored value; secrets are never echoed back into HTML. - #37 Pending invites expire after 14 days (Invite::isAcceptable), enforced at registration and surfaced on the admin invites list. Adds BookingEndpointTest plus Invite/Offering/AvailabilityRepository coverage and minimal WP_REST_Request/WP_REST_Response stubs. composer test (200), lint, and cs all green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
107 lines
3.7 KiB
PHP
107 lines
3.7 KiB
PHP
<?php
|
|
declare(strict_types=1);
|
|
|
|
namespace Unsupervised\Schedular\Tests\Unit\Auth;
|
|
|
|
use Unsupervised\Schedular\Auth\Invite;
|
|
use Unsupervised\Schedular\Auth\RoleManager;
|
|
use Unsupervised\Schedular\Tests\Unit\TestCase;
|
|
|
|
class InviteTest extends TestCase
|
|
{
|
|
public function testDefaults(): void
|
|
{
|
|
$invite = new Invite('a@b.test', 'tok123');
|
|
|
|
self::assertSame('a@b.test', $invite->email);
|
|
self::assertSame('tok123', $invite->token);
|
|
self::assertSame(RoleManager::STUDENT, $invite->role);
|
|
self::assertSame(Invite::STATUS_PENDING, $invite->status);
|
|
self::assertTrue($invite->isPending());
|
|
self::assertNull($invite->invitedBy);
|
|
self::assertNull($invite->acceptedUserId);
|
|
self::assertNull($invite->id);
|
|
}
|
|
|
|
public function testFromRowMapsCorrectly(): void
|
|
{
|
|
$invite = Invite::fromRow((object) [
|
|
'id' => '5',
|
|
'email' => 'a@b.test',
|
|
'token' => 'tok123',
|
|
'role' => RoleManager::STUDENT,
|
|
'status' => Invite::STATUS_ACCEPTED,
|
|
'invited_by' => '2',
|
|
'accepted_user_id' => '9',
|
|
'accepted_at' => '2026-06-02 09:00:00',
|
|
]);
|
|
|
|
self::assertSame(5, $invite->id);
|
|
self::assertSame(2, $invite->invitedBy);
|
|
self::assertSame(9, $invite->acceptedUserId);
|
|
self::assertFalse($invite->isPending());
|
|
}
|
|
|
|
public function testFromRowHandlesNullableIds(): void
|
|
{
|
|
$invite = Invite::fromRow((object) [
|
|
'id' => '5',
|
|
'email' => 'a@b.test',
|
|
'token' => 'tok123',
|
|
'role' => RoleManager::STUDENT,
|
|
'status' => Invite::STATUS_PENDING,
|
|
'invited_by' => null,
|
|
'accepted_user_id' => null,
|
|
'accepted_at' => null,
|
|
]);
|
|
|
|
self::assertNull($invite->invitedBy);
|
|
self::assertNull($invite->acceptedUserId);
|
|
self::assertTrue($invite->isPending());
|
|
}
|
|
|
|
public function testIsExpiredWhenOlderThanExpiryWindow(): void
|
|
{
|
|
$created = gmdate('Y-m-d H:i:s', strtotime('2026-06-01 09:00:00'));
|
|
$now = '2026-06-20 09:00:00'; // 19 days later, beyond the 14-day window.
|
|
|
|
$invite = new Invite('a@b.test', 'tok', createdAt: $created);
|
|
|
|
self::assertTrue($invite->isExpired($now));
|
|
self::assertFalse($invite->isAcceptable($now));
|
|
}
|
|
|
|
public function testIsNotExpiredWithinExpiryWindow(): void
|
|
{
|
|
$invite = new Invite('a@b.test', 'tok', createdAt: '2026-06-01 09:00:00');
|
|
$now = '2026-06-10 09:00:00'; // 9 days later, inside the window.
|
|
|
|
self::assertFalse($invite->isExpired($now));
|
|
self::assertTrue($invite->isAcceptable($now));
|
|
}
|
|
|
|
public function testIsNotExpiredWhenCreatedAtUnknown(): void
|
|
{
|
|
$invite = new Invite('a@b.test', 'tok');
|
|
|
|
self::assertFalse($invite->isExpired('2030-01-01 00:00:00'));
|
|
self::assertTrue($invite->isAcceptable('2030-01-01 00:00:00'));
|
|
}
|
|
|
|
public function testAcceptedInviteIsNotAcceptableEvenWhenFresh(): void
|
|
{
|
|
$invite = new Invite('a@b.test', 'tok', status: Invite::STATUS_ACCEPTED, createdAt: '2026-06-01 09:00:00');
|
|
|
|
self::assertFalse($invite->isAcceptable('2026-06-02 09:00:00'));
|
|
}
|
|
|
|
public function testToArrayContainsExpectedKeys(): void
|
|
{
|
|
$arr = (new Invite('a@b.test', 'tok', id: 1))->toArray();
|
|
|
|
foreach (['id', 'email', 'token', 'role', 'status', 'invited_by', 'accepted_user_id', 'accepted_at'] as $key) {
|
|
self::assertArrayHasKey($key, $arr);
|
|
}
|
|
}
|
|
}
|