thatguygriff
061d09e034
CI / No Debug Code (pull_request) Successful in 3s
CI / Tests (PHP 8.1) (pull_request) Successful in 49s
CI / Coding Standards (pull_request) Successful in 55s
CI / PHPStan (pull_request) Successful in 1m7s
CI / Tests (PHP 8.3) (pull_request) Successful in 1m41s
CI / Tests (PHP 8.2) (pull_request) Successful in 44s
CI / Build Plugin Zip (pull_request) Has been skipped
Security fixes from a pen-test review (issues #31–#37): - #31 Booking no longer trusts a client-supplied offering_id: a slot-tied offering is authoritative and any offering used must belong to the slot's instructor, closing a free/misrouted-payment bypass. - #34 Availability slot creation rejects an offering the instructor does not own (AvailabilityEndpoint now takes OfferingRepository). - #32 Offering/question/policy listing endpoints now require book_lesson instead of being public (no anonymous consumer exists); Offering::toArray also omits etransfer_email from listings as defense-in-depth. - #33 Slots are claimed atomically (UPDATE ... WHERE is_booked = 0) before a lesson is inserted, preventing a double-booking race. - #35 A single weekly booking is capped (MAX_WEEKLY_OCCURRENCES) and only creates lessons for slots it actually claimed. - #36 Stripe secret/webhook keys are write-only in the settings UI and a blank submit keeps the stored value; secrets are never echoed back into HTML. - #37 Pending invites expire after 14 days (Invite::isAcceptable), enforced at registration and surfaced on the admin invites list. Adds BookingEndpointTest plus Invite/Offering/AvailabilityRepository coverage and minimal WP_REST_Request/WP_REST_Response stubs. composer test (200), lint, and cs all green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
60 lines
2.9 KiB
PHP
60 lines
2.9 KiB
PHP
<?php
|
|
declare(strict_types=1);
|
|
|
|
namespace Unsupervised\Schedular;
|
|
|
|
use Unsupervised\Schedular\Availability\AvailabilityEndpoint;
|
|
use Unsupervised\Schedular\Availability\AvailabilityRepository;
|
|
use Unsupervised\Schedular\Booking\BookingEndpoint;
|
|
use Unsupervised\Schedular\Booking\BookingRepository;
|
|
use Unsupervised\Schedular\GroupClass\EnrollmentEndpoint;
|
|
use Unsupervised\Schedular\GroupClass\EnrollmentRepository;
|
|
use Unsupervised\Schedular\Offering\OfferingEndpoint;
|
|
use Unsupervised\Schedular\Offering\OfferingRepository;
|
|
use Unsupervised\Schedular\Payment\PaymentEndpoint;
|
|
use Unsupervised\Schedular\Payment\PaymentService;
|
|
use Unsupervised\Schedular\Policy\PolicyEndpoint;
|
|
use Unsupervised\Schedular\Policy\PolicyRepository;
|
|
use Unsupervised\Schedular\Policy\PolicyService;
|
|
use Unsupervised\Schedular\Policy\PolicyVersionRepository;
|
|
use Unsupervised\Schedular\Registration\QuestionEndpoint;
|
|
use Unsupervised\Schedular\Registration\QuestionRepository;
|
|
use Unsupervised\Schedular\Registration\RegistrationGate;
|
|
|
|
class RestRegistrar {
|
|
|
|
public const NAMESPACE = 'us-scheduler/v1';
|
|
|
|
private AvailabilityEndpoint $availabilityEndpoint;
|
|
private BookingEndpoint $bookingEndpoint;
|
|
private OfferingEndpoint $offeringEndpoint;
|
|
private QuestionEndpoint $questionEndpoint;
|
|
private PolicyEndpoint $policyEndpoint;
|
|
private EnrollmentEndpoint $enrollmentEndpoint;
|
|
private PaymentEndpoint $paymentEndpoint;
|
|
|
|
public function __construct( AvailabilityRepository $availability, BookingRepository $bookings, OfferingRepository $offerings, QuestionRepository $questions, PolicyRepository $policies, PolicyVersionRepository $policyVersions, PolicyService $policyService, RegistrationGate $gate, EnrollmentRepository $enrollments, PaymentService $paymentService ) {
|
|
$this->availabilityEndpoint = new AvailabilityEndpoint( $availability, $offerings );
|
|
$this->bookingEndpoint = new BookingEndpoint( $availability, $bookings, $offerings, $gate, $paymentService );
|
|
$this->offeringEndpoint = new OfferingEndpoint( $offerings );
|
|
$this->questionEndpoint = new QuestionEndpoint( $questions, $offerings );
|
|
$this->policyEndpoint = new PolicyEndpoint( $policies, $policyVersions, $policyService );
|
|
$this->enrollmentEndpoint = new EnrollmentEndpoint( $enrollments, $offerings, $gate, $paymentService );
|
|
$this->paymentEndpoint = new PaymentEndpoint( $paymentService );
|
|
}
|
|
|
|
public function register(): void {
|
|
add_action( 'rest_api_init', [ $this, 'registerRoutes' ] );
|
|
}
|
|
|
|
public function registerRoutes(): void {
|
|
$this->availabilityEndpoint->registerRoutes( self::NAMESPACE );
|
|
$this->bookingEndpoint->registerRoutes( self::NAMESPACE );
|
|
$this->offeringEndpoint->registerRoutes( self::NAMESPACE );
|
|
$this->questionEndpoint->registerRoutes( self::NAMESPACE );
|
|
$this->policyEndpoint->registerRoutes( self::NAMESPACE );
|
|
$this->enrollmentEndpoint->registerRoutes( self::NAMESPACE );
|
|
$this->paymentEndpoint->registerRoutes( self::NAMESPACE );
|
|
}
|
|
}
|