CI / No Debug Code (pull_request) Successful in 3s
CI / Tests (PHP 8.1) (pull_request) Successful in 43s
CI / Tests (PHP 8.3) (pull_request) Successful in 49s
CI / Tests (PHP 8.2) (pull_request) Successful in 59s
CI / Coding Standards (pull_request) Successful in 1m11s
CI / PHPStan (pull_request) Successful in 1m20s
CI / Build Plugin Zip (pull_request) Has been skipped
Four fixes from a security review pass: - Neutralise CSV formula injection in the payments export: fields with a leading =, +, -, @, tab, or CR (e.g. a hostile student display name) are apostrophe-prefixed in PaymentReport::csvLine() so they open as text in Excel/Google Sheets. Fixes #39. - Sanitise policy bodies with wp_kses_post at output in PolicyEndpoint::index() (the booking JS renders that HTML raw), so a future write path that forgets kses can never become stored XSS. Fixes #40. - Store invite tokens hashed (SHA-256) at rest: a database leak can no longer redeem pending invites. The registration link is shown once, at creation; the pending list shows email/invited date; lookups hash the submitted token. Existing plaintext pending invites must be re-issued. Fixes #41. - Validate availability slot datetimes on both creation paths (REST and admin form) via AvailabilitySlot::normalizeDateTime(): canonical and datetime-local forms normalise to Y-m-d H:i:s, garbage and end <= start are rejected (REST 400) instead of reaching the DATETIME column or throwing inside the weekly-series date arithmetic. Fixes #42. composer test (204 tests, 594 assertions), PHPStan L6, and PHPCS all green. Co-Authored-By: Claude Fable 5 <[email protected]>
115 lines
3.0 KiB
PHP
115 lines
3.0 KiB
PHP
<?php
|
|
declare(strict_types=1);
|
|
|
|
namespace Unsupervised\Schedular\Payment;
|
|
|
|
/**
|
|
* Pure aggregator over a set of paid-payment display rows: produces the column
|
|
* totals (subtotal, HST collected, grand total) and a CSV rendering. Building
|
|
* the rows (name lookups, filtering) is the controller's job — this class does
|
|
* no I/O so it stays trivially testable.
|
|
*/
|
|
class PaymentReport {
|
|
|
|
/**
|
|
* Build a report over already-resolved display rows.
|
|
*
|
|
* @param list<array{date: string, student: string, instructor: string, method: string, status: string, amount: float, tax_rate: float, tax_amount: float, total: float}> $rows
|
|
*/
|
|
public function __construct( private array $rows ) {}
|
|
|
|
/**
|
|
* The report's display rows.
|
|
*
|
|
* @return list<array{date: string, student: string, instructor: string, method: string, status: string, amount: float, tax_rate: float, tax_amount: float, total: float}>
|
|
*/
|
|
public function rows(): array {
|
|
return $this->rows;
|
|
}
|
|
|
|
public function count(): int {
|
|
return count( $this->rows );
|
|
}
|
|
|
|
public function totalAmount(): float {
|
|
return round( array_sum( array_column( $this->rows, 'amount' ) ), 2 );
|
|
}
|
|
|
|
/**
|
|
* Total HST collected across all rows — the figure the studio remits.
|
|
*/
|
|
public function totalTax(): float {
|
|
return round( array_sum( array_column( $this->rows, 'tax_amount' ) ), 2 );
|
|
}
|
|
|
|
public function grandTotal(): float {
|
|
return round( array_sum( array_column( $this->rows, 'total' ) ), 2 );
|
|
}
|
|
|
|
/**
|
|
* Render the report as CSV, including a trailing totals row.
|
|
*/
|
|
public function toCsv(): string {
|
|
$lines = [];
|
|
|
|
$lines[] = $this->csvLine(
|
|
[ 'Date', 'Student', 'Instructor', 'Method', 'Status', 'Subtotal', 'HST Rate', 'HST', 'Total' ]
|
|
);
|
|
|
|
foreach ( $this->rows as $row ) {
|
|
$lines[] = $this->csvLine(
|
|
[
|
|
$row['date'],
|
|
$row['student'],
|
|
$row['instructor'],
|
|
$row['method'],
|
|
$row['status'],
|
|
number_format( $row['amount'], 2, '.', '' ),
|
|
number_format( $row['tax_rate'], 2, '.', '' ),
|
|
number_format( $row['tax_amount'], 2, '.', '' ),
|
|
number_format( $row['total'], 2, '.', '' ),
|
|
]
|
|
);
|
|
}
|
|
|
|
$lines[] = $this->csvLine(
|
|
[
|
|
'Totals',
|
|
'',
|
|
'',
|
|
'',
|
|
'',
|
|
number_format( $this->totalAmount(), 2, '.', '' ),
|
|
'',
|
|
number_format( $this->totalTax(), 2, '.', '' ),
|
|
number_format( $this->grandTotal(), 2, '.', '' ),
|
|
]
|
|
);
|
|
|
|
return implode( "\n", $lines ) . "\n";
|
|
}
|
|
|
|
/**
|
|
* Format one CSV record, quoting fields and escaping embedded quotes. Fields
|
|
* that a spreadsheet would interpret as a formula (leading =, +, -, @, tab, or
|
|
* CR — e.g. a hostile student display name) are prefixed with an apostrophe so
|
|
* they open as text, never as executable formulas.
|
|
*
|
|
* @param list<string> $fields
|
|
*/
|
|
private function csvLine( array $fields ): string {
|
|
$escaped = array_map(
|
|
static function ( string $field ): string {
|
|
if ( 1 === preg_match( '/^[=+\-@\t\r]/', $field ) ) {
|
|
$field = "'" . $field;
|
|
}
|
|
|
|
return '"' . str_replace( '"', '""', $field ) . '"';
|
|
},
|
|
$fields
|
|
);
|
|
|
|
return implode( ',', $escaped );
|
|
}
|
|
}
|