Files
unsupervised-scheduler/tests/Unit/Auth/InviteTest.php
T
thatguygriff 061d09e034
CI / No Debug Code (pull_request) Successful in 3s
CI / Tests (PHP 8.1) (pull_request) Successful in 49s
CI / Coding Standards (pull_request) Successful in 55s
CI / PHPStan (pull_request) Successful in 1m7s
CI / Tests (PHP 8.3) (pull_request) Successful in 1m41s
CI / Tests (PHP 8.2) (pull_request) Successful in 44s
CI / Build Plugin Zip (pull_request) Has been skipped
Harden booking, offering exposure, payments, and invites
Security fixes from a pen-test review (issues #31–#37):

- #31 Booking no longer trusts a client-supplied offering_id: a slot-tied
  offering is authoritative and any offering used must belong to the slot's
  instructor, closing a free/misrouted-payment bypass.
- #34 Availability slot creation rejects an offering the instructor does not
  own (AvailabilityEndpoint now takes OfferingRepository).
- #32 Offering/question/policy listing endpoints now require book_lesson
  instead of being public (no anonymous consumer exists); Offering::toArray
  also omits etransfer_email from listings as defense-in-depth.
- #33 Slots are claimed atomically (UPDATE ... WHERE is_booked = 0) before a
  lesson is inserted, preventing a double-booking race.
- #35 A single weekly booking is capped (MAX_WEEKLY_OCCURRENCES) and only
  creates lessons for slots it actually claimed.
- #36 Stripe secret/webhook keys are write-only in the settings UI and a blank
  submit keeps the stored value; secrets are never echoed back into HTML.
- #37 Pending invites expire after 14 days (Invite::isAcceptable), enforced at
  registration and surfaced on the admin invites list.

Adds BookingEndpointTest plus Invite/Offering/AvailabilityRepository coverage
and minimal WP_REST_Request/WP_REST_Response stubs. composer test (200),
lint, and cs all green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 17:08:22 -03:00

107 lines
3.7 KiB
PHP

<?php
declare(strict_types=1);
namespace Unsupervised\Schedular\Tests\Unit\Auth;
use Unsupervised\Schedular\Auth\Invite;
use Unsupervised\Schedular\Auth\RoleManager;
use Unsupervised\Schedular\Tests\Unit\TestCase;
class InviteTest extends TestCase
{
public function testDefaults(): void
{
$invite = new Invite('a@b.test', 'tok123');
self::assertSame('a@b.test', $invite->email);
self::assertSame('tok123', $invite->token);
self::assertSame(RoleManager::STUDENT, $invite->role);
self::assertSame(Invite::STATUS_PENDING, $invite->status);
self::assertTrue($invite->isPending());
self::assertNull($invite->invitedBy);
self::assertNull($invite->acceptedUserId);
self::assertNull($invite->id);
}
public function testFromRowMapsCorrectly(): void
{
$invite = Invite::fromRow((object) [
'id' => '5',
'email' => 'a@b.test',
'token' => 'tok123',
'role' => RoleManager::STUDENT,
'status' => Invite::STATUS_ACCEPTED,
'invited_by' => '2',
'accepted_user_id' => '9',
'accepted_at' => '2026-06-02 09:00:00',
]);
self::assertSame(5, $invite->id);
self::assertSame(2, $invite->invitedBy);
self::assertSame(9, $invite->acceptedUserId);
self::assertFalse($invite->isPending());
}
public function testFromRowHandlesNullableIds(): void
{
$invite = Invite::fromRow((object) [
'id' => '5',
'email' => 'a@b.test',
'token' => 'tok123',
'role' => RoleManager::STUDENT,
'status' => Invite::STATUS_PENDING,
'invited_by' => null,
'accepted_user_id' => null,
'accepted_at' => null,
]);
self::assertNull($invite->invitedBy);
self::assertNull($invite->acceptedUserId);
self::assertTrue($invite->isPending());
}
public function testIsExpiredWhenOlderThanExpiryWindow(): void
{
$created = gmdate('Y-m-d H:i:s', strtotime('2026-06-01 09:00:00'));
$now = '2026-06-20 09:00:00'; // 19 days later, beyond the 14-day window.
$invite = new Invite('a@b.test', 'tok', createdAt: $created);
self::assertTrue($invite->isExpired($now));
self::assertFalse($invite->isAcceptable($now));
}
public function testIsNotExpiredWithinExpiryWindow(): void
{
$invite = new Invite('a@b.test', 'tok', createdAt: '2026-06-01 09:00:00');
$now = '2026-06-10 09:00:00'; // 9 days later, inside the window.
self::assertFalse($invite->isExpired($now));
self::assertTrue($invite->isAcceptable($now));
}
public function testIsNotExpiredWhenCreatedAtUnknown(): void
{
$invite = new Invite('a@b.test', 'tok');
self::assertFalse($invite->isExpired('2030-01-01 00:00:00'));
self::assertTrue($invite->isAcceptable('2030-01-01 00:00:00'));
}
public function testAcceptedInviteIsNotAcceptableEvenWhenFresh(): void
{
$invite = new Invite('a@b.test', 'tok', status: Invite::STATUS_ACCEPTED, createdAt: '2026-06-01 09:00:00');
self::assertFalse($invite->isAcceptable('2026-06-02 09:00:00'));
}
public function testToArrayContainsExpectedKeys(): void
{
$arr = (new Invite('a@b.test', 'tok', id: 1))->toArray();
foreach (['id', 'email', 'token', 'role', 'status', 'invited_by', 'accepted_user_id', 'accepted_at'] as $key) {
self::assertArrayHasKey($key, $arr);
}
}
}