5140e76347
CI / No Debug Code (pull_request) Successful in 11s
CI / Tests (PHP 8.2) (pull_request) Successful in 1m42s
CI / Tests (PHP 8.3) (pull_request) Successful in 2m17s
CI / Tests (PHP 8.1) (pull_request) Successful in 2m17s
CI / Coding Standards (pull_request) Successful in 2m26s
CI / PHPStan (pull_request) Successful in 2m38s
CI / Build Plugin Zip (pull_request) Has been skipped
Security fixes from a pen-test review (issues #31–#37): - #31 Booking no longer trusts a client-supplied offering_id: a slot-tied offering is authoritative and any offering used must belong to the slot's instructor, closing a free/misrouted-payment bypass. - #34 Availability slot creation rejects an offering the instructor does not own (AvailabilityEndpoint now takes OfferingRepository). - #32 Offering/question/policy listing endpoints now require book_lesson instead of being public (no anonymous consumer exists); Offering::toArray also omits etransfer_email from listings as defense-in-depth. - #33 Slots are claimed atomically (UPDATE ... WHERE is_booked = 0) before a lesson is inserted, preventing a double-booking race. - #35 A single weekly booking is capped (MAX_WEEKLY_OCCURRENCES) and only creates lessons for slots it actually claimed. - #36 Stripe secret/webhook keys are write-only in the settings UI and a blank submit keeps the stored value; secrets are never echoed back into HTML. - #37 Pending invites expire after 14 days (Invite::isAcceptable), enforced at registration and surfaced on the admin invites list. Adds BookingEndpointTest plus Invite/Offering/AvailabilityRepository coverage and minimal WP_REST_Request/WP_REST_Response stubs. composer test (200), lint, and cs all green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
110 lines
4.2 KiB
PHP
110 lines
4.2 KiB
PHP
<?php
|
|
declare(strict_types=1);
|
|
|
|
namespace Unsupervised\Schedular\Tests\Unit\Offering;
|
|
|
|
use Unsupervised\Schedular\Offering\Offering;
|
|
use Unsupervised\Schedular\Tests\Unit\TestCase;
|
|
|
|
class OfferingTest extends TestCase
|
|
{
|
|
public function testConstructorAndProperties(): void
|
|
{
|
|
$offering = new Offering(
|
|
instructorId: 5,
|
|
kind: Offering::KIND_PRIVATE_LESSON,
|
|
title: '30-min Piano',
|
|
price: 35.00,
|
|
billingMode: Offering::BILLING_ONE_TIME,
|
|
durationMinutes: 30,
|
|
id: 42,
|
|
);
|
|
|
|
self::assertSame(5, $offering->instructorId);
|
|
self::assertSame(Offering::KIND_PRIVATE_LESSON, $offering->kind);
|
|
self::assertSame('30-min Piano', $offering->title);
|
|
self::assertSame(35.00, $offering->price);
|
|
self::assertSame(30, $offering->durationMinutes);
|
|
self::assertSame(42, $offering->id);
|
|
}
|
|
|
|
public function testDefaults(): void
|
|
{
|
|
$offering = new Offering(1, Offering::KIND_GROUP_CLASS, 'Choir');
|
|
|
|
self::assertSame(0.0, $offering->price);
|
|
self::assertSame('CAD', $offering->currency);
|
|
self::assertSame(Offering::BILLING_ONE_TIME, $offering->billingMode);
|
|
self::assertNull($offering->durationMinutes);
|
|
self::assertFalse($offering->allowWeekly);
|
|
self::assertNull($offering->capacity);
|
|
self::assertTrue($offering->isActive);
|
|
self::assertNull($offering->id);
|
|
}
|
|
|
|
public function testFromRowMapsCorrectlyAndCastsNullables(): void
|
|
{
|
|
$row = (object) [
|
|
'id' => '7',
|
|
'instructor_id' => '3',
|
|
'kind' => Offering::KIND_GROUP_CLASS,
|
|
'title' => 'Year Choir',
|
|
'description' => 'Weekly choir',
|
|
'duration_minutes' => null,
|
|
'price' => '120.00',
|
|
'currency' => 'CAD',
|
|
'billing_mode' => Offering::BILLING_FULL_TERM,
|
|
'allow_weekly' => '0',
|
|
'capacity' => '20',
|
|
'term_start' => '2026-09-01',
|
|
'term_end' => '2027-06-30',
|
|
'schedule_note' => 'Tuesdays 4:00pm',
|
|
'etransfer_email' => null,
|
|
'is_active' => '1',
|
|
];
|
|
|
|
$offering = Offering::fromRow($row);
|
|
|
|
self::assertSame(7, $offering->id);
|
|
self::assertSame(3, $offering->instructorId);
|
|
self::assertNull($offering->durationMinutes);
|
|
self::assertSame(120.00, $offering->price);
|
|
self::assertSame(20, $offering->capacity);
|
|
self::assertSame(Offering::BILLING_FULL_TERM, $offering->billingMode);
|
|
self::assertTrue($offering->isActive);
|
|
}
|
|
|
|
public function testToArrayContainsExpectedKeys(): void
|
|
{
|
|
$offering = new Offering(1, Offering::KIND_PRIVATE_LESSON, 'Lesson', id: 10);
|
|
$arr = $offering->toArray();
|
|
|
|
foreach (['id', 'instructor_id', 'kind', 'title', 'price', 'billing_mode', 'is_active'] as $key) {
|
|
self::assertArrayHasKey($key, $arr);
|
|
}
|
|
}
|
|
|
|
public function testToArrayIncludesEtransferEmailByDefault(): void
|
|
{
|
|
$offering = new Offering(1, Offering::KIND_PRIVATE_LESSON, 'Lesson', etransferEmail: 'studio@example.com', id: 10);
|
|
|
|
self::assertArrayHasKey('etransfer_email', $offering->toArray());
|
|
self::assertSame('studio@example.com', $offering->toArray()['etransfer_email']);
|
|
}
|
|
|
|
public function testToArrayOmitsEtransferEmailWhenExcluded(): void
|
|
{
|
|
$offering = new Offering(1, Offering::KIND_PRIVATE_LESSON, 'Lesson', etransferEmail: 'studio@example.com', id: 10);
|
|
|
|
self::assertArrayNotHasKey('etransfer_email', $offering->toArray(includeEtransferEmail: false));
|
|
}
|
|
|
|
public function testValidKindAndBillingConstants(): void
|
|
{
|
|
self::assertContains(Offering::KIND_PRIVATE_LESSON, Offering::VALID_KINDS);
|
|
self::assertContains(Offering::KIND_GROUP_CLASS, Offering::VALID_KINDS);
|
|
self::assertContains(Offering::BILLING_ONE_TIME, Offering::VALID_BILLING_MODES);
|
|
self::assertContains(Offering::BILLING_FULL_TERM, Offering::VALID_BILLING_MODES);
|
|
}
|
|
}
|