Changeset 3730683

Timestamp:

10/06/2026 11:38:26 AM (3 weeks ago)

Author:

gturtle108

Message:

Release 1.240.1: a co-parent's card never goes on the household payer's account

Location:

gather-grove-booking/trunk

Files:

• gather-grove-booking.php (modified) (2 diffs)
• languages/gather-grove-booking.pot (modified) (5 diffs)
• readme.txt (modified) (2 diffs)
• src/Services/ClientService.php (modified) (4 diffs)
• vendor/composer/installed.php (modified) (3 diffs)

gather-grove-booking/trunk/gather-grove-booking.php

@@ -4 +4 @@
  * Plugin URI:  https://gathergrove.io/docs/booking
  * Description: Class scheduling and booking for studios, wellness centers, and community programs.
- * Version:     1.240.0
+ * Version:     1.240.1
  * Author:      Rob Hewitt / Gather Grove
  * Author URI:  https://gathergrove.io
@@ -21 +21 @@
 defined( 'ABSPATH' ) || exit;
 
-define( 'GATHER_GROVE_VERSION',          '1.240.0' );
+define( 'GATHER_GROVE_VERSION',          '1.240.1' );
 // Bump this whenever any CPT/taxonomy/rewrite registration changes — every
 // install will flush its rule cache on next admin page load. Existing studios

gather-grove-booking/trunk/languages/gather-grove-booking.pot

@@ -3 +3 @@
 msgid ""
 msgstr ""
-"Project-Id-Version: Gather Grove Booking 1.240.0\n"
+"Project-Id-Version: Gather Grove Booking 1.240.1\n"
 "Report-Msgid-Bugs-To: https://wordpress.org/support/plugin/gather-grove-booking\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
@@ -10 +10 @@
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
-"POT-Creation-Date: 2026-10-06T10:36:37+00:00\n"
+"POT-Creation-Date: 2026-10-06T11:36:08+00:00\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "X-Generator: WP-CLI 2.12.0\n"
@@ -4911 +4911 @@
 #: src/Elementor/Widgets/BookingFormWidget.php:2264
 #: src/Services/AddSeats.php:326
-#: src/Services/ClientService.php:2334
+#: src/Services/ClientService.php:2374
 msgid "Each guest needs a name."
 msgstr ""
@@ -5063 +5063 @@
 #: src/Admin/Pages/ClientsPage.php:279
 #: src/Admin/Pages/ClientsPage.php:4341
-#: src/Services/ClientService.php:3865
+#: src/Services/ClientService.php:3905
 msgid "Family & Household Accounts is not enabled on this site."
 msgstr ""
@@ -26423 +26423 @@
 msgstr ""
 
-#: src/Services/ClientService.php:2217
+#: src/Services/ClientService.php:2257
 msgid "A household member needs a name and a valid payer."
 msgstr ""
 
-#: src/Services/ClientService.php:2226
-#: src/Services/ClientService.php:2442
-#: src/Services/ClientService.php:3437
+#: src/Services/ClientService.php:2266
+#: src/Services/ClientService.php:2482
+#: src/Services/ClientService.php:3477
 msgid "The household payer could not be found."
 msgstr ""
 
-#: src/Services/ClientService.php:2234
+#: src/Services/ClientService.php:2274
 msgid "A household member cannot manage their own members."
 msgstr ""
 
-#: src/Services/ClientService.php:2288
+#: src/Services/ClientService.php:2328
 msgid "The household member could not be created. Please try again."
 msgstr ""
 
-#: src/Services/ClientService.php:2387
+#: src/Services/ClientService.php:2427
 msgid "The guest could not be added. Please try again."
 msgstr ""
 
-#: src/Services/ClientService.php:2433
+#: src/Services/ClientService.php:2473
 msgid "A valid payer and the member’s email are required."
 msgstr ""
 
-#: src/Services/ClientService.php:2449
+#: src/Services/ClientService.php:2489
 msgid "A household member cannot manage other members."
 msgstr ""
 
-#: src/Services/ClientService.php:2459
+#: src/Services/ClientService.php:2499
 msgid "No account exists for that email yet. Send them an invitation instead — they can create an account and join your household from the link in the email."
 msgstr ""
 
-#: src/Services/ClientService.php:2468
+#: src/Services/ClientService.php:2508
 msgid "That account could not be linked. Please try again."
 msgstr ""
 
-#: src/Services/ClientService.php:2496
+#: src/Services/ClientService.php:2536
 msgid "You cannot add yourself as a household member."
 msgstr ""
 
-#: src/Services/ClientService.php:2513
-#: src/Services/ClientService.php:3482
+#: src/Services/ClientService.php:2553
+#: src/Services/ClientService.php:3522
 msgid "That person already belongs to another household."
 msgstr ""
 
-#: src/Services/ClientService.php:2527
+#: src/Services/ClientService.php:2567
 msgid "That person manages their own household and cannot be linked as a member."
 msgstr ""
 
-#: src/Services/ClientService.php:2566
+#: src/Services/ClientService.php:2606
 msgid "Linking the member failed. Please try again."
 msgstr ""
 
-#: src/Services/ClientService.php:2655
+#: src/Services/ClientService.php:2695
 msgid "this person"
 msgstr ""
 
 #. translators: 1: household member's name, 2: the studio with its determiner (e.g. "the studio")
-#: src/Services/ClientService.php:2659
+#: src/Services/ClientService.php:2699
 #, php-format
 msgid "Add %1$s's birthday so you can book and pay for them. Ask %2$s to add it: %1$s has their own login, so only %2$s can change their details."
 msgstr ""
 
-#: src/Services/ClientService.php:2727
-#: src/Services/ClientService.php:2797
-#: src/Services/ClientService.php:2816
-#: src/Services/ClientService.php:2934
-#: src/Services/ClientService.php:3079
-#: src/Services/ClientService.php:3145
-#: src/Services/ClientService.php:3259
+#: src/Services/ClientService.php:2767
+#: src/Services/ClientService.php:2837
+#: src/Services/ClientService.php:2856
+#: src/Services/ClientService.php:2974
+#: src/Services/ClientService.php:3119
+#: src/Services/ClientService.php:3185
+#: src/Services/ClientService.php:3299
 msgid "That person is not a member of this household."
 msgstr ""
 
-#: src/Services/ClientService.php:2755
+#: src/Services/ClientService.php:2795
 msgid "Removing the member failed. Please try again."
 msgstr ""
 
-#: src/Services/ClientService.php:2824
+#: src/Services/ClientService.php:2864
 msgid "Only a household member with their own login can manage others. Invite them to create an account first."
 msgstr ""
 
-#: src/Services/ClientService.php:2839
+#: src/Services/ClientService.php:2879
 msgid "This person is set up as someone the household books for. Turn that off first if they should manage others instead."
 msgstr ""
 
-#: src/Services/ClientService.php:2854
-#: src/Services/ClientService.php:2993
-#: src/Services/ClientService.php:3094
+#: src/Services/ClientService.php:2894
+#: src/Services/ClientService.php:3033
+#: src/Services/ClientService.php:3134
 msgid "That change could not be saved. Please try again."
 msgstr ""
 
 #. translators: %s: the studio with its determiner (e.g. "the studio"), or its name alone when the studio is a name (e.g. "Alana")
-#: src/Services/ClientService.php:2945
+#: src/Services/ClientService.php:2985
 #, php-format
 msgid "Only this person or %s can change who books for them."
 msgstr ""
 
-#: src/Services/ClientService.php:2961
+#: src/Services/ClientService.php:3001
 msgid "You need to be part of a household before someone can book for you."
 msgstr ""
 
-#: src/Services/ClientService.php:2969
+#: src/Services/ClientService.php:3009
 msgid "This person has no login of their own, so the household already books for them."
 msgstr ""
 
-#: src/Services/ClientService.php:2978
+#: src/Services/ClientService.php:3018
 msgid "This person manages others in the household. Remove that first if the household should book for them instead."
 msgstr ""
 
-#: src/Services/ClientService.php:3137
-#: src/Services/ClientService.php:3291
+#: src/Services/ClientService.php:3177
+#: src/Services/ClientService.php:3331
 msgid "A name is required."
 msgstr ""
 
-#: src/Services/ClientService.php:3155
+#: src/Services/ClientService.php:3195
 msgid "This member has their own account and manages their own name."
 msgstr ""
 
-#: src/Services/ClientService.php:3172
+#: src/Services/ClientService.php:3212
 msgid "Renaming the member failed. Please try again."
 msgstr ""
 
-#: src/Services/ClientService.php:3269
+#: src/Services/ClientService.php:3309
 msgid "This member has their own account and manages their own details."
 msgstr ""
 
-#: src/Services/ClientService.php:3309
+#: src/Services/ClientService.php:3349
 msgid "Please enter the date of birth as YYYY-MM-DD."
 msgstr ""
 
-#: src/Services/ClientService.php:3318
+#: src/Services/ClientService.php:3358
 msgid "That date is in the future — please check it."
 msgstr ""
 
-#: src/Services/ClientService.php:3337
+#: src/Services/ClientService.php:3377
 msgid "No details were supplied to change."
 msgstr ""
 
-#: src/Services/ClientService.php:3355
+#: src/Services/ClientService.php:3395
 msgid "Saving those details failed. Please try again."
 msgstr ""
 
-#: src/Services/ClientService.php:3428
+#: src/Services/ClientService.php:3468
 msgid "A valid payer and the adult’s email are required."
 msgstr ""
 
-#: src/Services/ClientService.php:3445
+#: src/Services/ClientService.php:3485
 msgid "A household member cannot invite other members."
 msgstr ""
 
-#: src/Services/ClientService.php:3453
-#: src/Services/ClientService.php:3467
+#: src/Services/ClientService.php:3493
+#: src/Services/ClientService.php:3507
 msgid "You cannot invite yourself to your own household."
 msgstr ""
 
-#: src/Services/ClientService.php:3475
+#: src/Services/ClientService.php:3515
 msgid "That person is already a member of your household."
 msgstr ""
 
-#: src/Services/ClientService.php:3494
+#: src/Services/ClientService.php:3534
 msgid "That person manages their own household and cannot be invited as a member."
 msgstr ""
 
-#: src/Services/ClientService.php:3534
+#: src/Services/ClientService.php:3574
 msgid "The invitation could not be created. Please try again."
 msgstr ""
 
-#: src/Services/ClientService.php:3713
-#: src/Services/ClientService.php:3744
+#: src/Services/ClientService.php:3753
+#: src/Services/ClientService.php:3784
 msgid "That invitation could not be found."
 msgstr ""
 
-#: src/Services/ClientService.php:3720
+#: src/Services/ClientService.php:3760
 msgid "That invitation can no longer be cancelled."
 msgstr ""
 
-#: src/Services/ClientService.php:3751
+#: src/Services/ClientService.php:3791
 msgid "That invitation is no longer active. Send a new one instead."
 msgstr ""

gather-grove-booking/trunk/readme.txt

@@ -5 +5 @@
 Tested up to: 7.1
 Requires PHP: 8.2
-Stable tag: 1.240.0
+Stable tag: 1.240.1
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -147 +147 @@
 == Changelog ==
 
+= 1.240.1 =
+* Security: when a co-parent signed a child up for a membership, their card was saved on the paying parent's account, where the paying parent could use it. A co-parent now pays for a membership they start from their own account, with their own card, and gets its invoices, receipts and reminders. Studios using co-parents should run `wp gather-grove billing cards --list`, then `--tag --yes`.
+* Fix: the person who pays for a household member's membership can now cancel it from their account page (they got "Membership not found").
+* New (developers): `wp gather-grove billing cards` lists memberships a co-parent started before 1.240.1 and tags the co-parent's card as theirs.
+
 = 1.240.0 =
 * New: Settings, Payments, "Bill children with their own login to the household payer", on by default. When a parent starts a membership for a child in their household, it is billed to the parent's account and the invoices come to the parent, whether or not the child has a login. A child who signs up themselves still pays for it. Memberships already running don't move.

gather-grove-booking/trunk/src/Services/ClientService.php

@@ -1490 +1490 @@
          * charge lands on an account whose owner is not there to agree to it.
          * Buying for someone else in your household, the resolver decides.
+         *
+         * 🔑 **A co-parent pays for what they start (1.240.1, Booking rule 192).**
+         * When the resolver names the household payer but the buyer is a
+         * household MANAGER acting for a member they manage, the manager pays,
+         * from their own Stripe customer. Before 1.240.1 the manager's card went
+         * onto the household payer's customer, untagged, as that customer's
+         * default — one person's card on another person's customer, which rule
+         * 192 forbids, and a charge on the account of someone who was not there
+         * to agree to it (spec §4.1). The membership still belongs to the
+         * member (rule 41); only who pays changes.
          */
         public static function checkout_membership_payer( int $buyer_client_id, int $subject_client_id ): int {
@@ -1496 +1506 @@
                 }
 
-                return self::membership_payer_client_id( $subject_client_id );
+                $resolved = self::membership_payer_client_id( $subject_client_id );
+
+                if ( $resolved > 0
+                        && $resolved !== $buyer_client_id
+                        && $resolved !== $subject_client_id
+                        && self::is_coparent_of( $buyer_client_id, $subject_client_id )
+                ) {
+                        return $buyer_client_id;
+                }
+
+                return $resolved;
+        }
+
+        /**
+         * Is `$manager_client_id` a co-parent of `$member_client_id` — a
+         * designated household manager (Co-Parent Flow, 1.121.0) of the member's
+         * household who may act for them (`can_manage()`)? Never true of the
+         * household payer or of the member themselves.
+         */
+        public static function is_coparent_of( int $manager_client_id, int $member_client_id ): bool {
+                if ( $manager_client_id <= 0 || $member_client_id <= 0 || $manager_client_id === $member_client_id ) {
+                        return false;
+                }
+
+                return self::is_household_manager( $manager_client_id )
+                        && self::can_manage( $manager_client_id, $member_client_id );
         }
 
         /**
          * May `$payer_client_id` be recorded as the payer of a membership held by
-         * `$member_client_id`? Only the member themselves or their household
-         * payer (spec §4.1) — the guard `purchase_membership()` applies to an
-         * explicit payer, so no caller can bill a third person's customer.
+         * `$member_client_id`? The member themselves, their household payer
+         * (spec §4.1), or — from 1.240.1 — a co-parent who manages them and is
+         * paying for it from their own account (`is_coparent_of()`). The guard
+         * `purchase_membership()` applies to an explicit payer, so no caller can
+         * bill a third person's customer.
          */
         public static function may_pay_for_membership( int $payer_client_id, int $member_client_id ): bool {
@@ -1511 +1548 @@
 
                 return $payer_client_id === $member_client_id
-                        || $payer_client_id === self::household_payer_client_id( $member_client_id );
+                        || $payer_client_id === self::household_payer_client_id( $member_client_id )
+                        || self::is_coparent_of( $payer_client_id, $member_client_id );
         }
 
@@ -1544 +1582 @@
          * passes, and the member, who is not charged, does not.
          *
-         * A household manager is never the payer, so is never let through
-         * (Co-Parent Flow, Rob 2026-08-16).
+         * A household manager is not the payer of the household's memberships
+         * (Co-Parent Flow, Rob 2026-08-16), so is not let through — except for a
+         * membership they started and pay for from their own account (1.240.1,
+         * rule 192), whose row records them as its payer.
          */
         public static function pays_for_membership( int $actor_client_id, object $cp ): bool {

gather-grove-booking/trunk/vendor/composer/installed.php

@@ -3 +3 @@
   array (
     'name' => 'golden-turtle-sound/gather-grove',
-    'pretty_version' => 'v1.240.0',
-    'version' => '1.240.0.0',
-    'reference' => '70f10cabbfdece5f21604bb63bf5e60f113189d8',
+    'pretty_version' => 'v1.240.1',
+    'version' => '1.240.1.0',
+    'reference' => 'a60014b09efeafaf47fd6dc9b8c595ccd0d20272',
     'type' => 'wordpress-plugin',
-    'install_path' => '/private/var/folders/_z/v6yvnpmx5mz91tk62d72jhyc0000gn/T/tmp.wmxOCeBOzO/gather-grove-booking/vendor/composer/../../',
+    'install_path' => '/private/var/folders/_z/v6yvnpmx5mz91tk62d72jhyc0000gn/T/tmp.H6aDmoqzf7/gather-grove-booking/vendor/composer/../../',
     'aliases' => 
     array (
@@ -17 +17 @@
     'golden-turtle-sound/gather-grove' => 
     array (
-      'pretty_version' => 'v1.240.0',
-      'version' => '1.240.0.0',
-      'reference' => '70f10cabbfdece5f21604bb63bf5e60f113189d8',
+      'pretty_version' => 'v1.240.1',
+      'version' => '1.240.1.0',
+      'reference' => 'a60014b09efeafaf47fd6dc9b8c595ccd0d20272',
       'type' => 'wordpress-plugin',
-      'install_path' => '/private/var/folders/_z/v6yvnpmx5mz91tk62d72jhyc0000gn/T/tmp.wmxOCeBOzO/gather-grove-booking/vendor/composer/../../',
+      'install_path' => '/private/var/folders/_z/v6yvnpmx5mz91tk62d72jhyc0000gn/T/tmp.H6aDmoqzf7/gather-grove-booking/vendor/composer/../../',
       'aliases' => 
       array (
@@ -33 +33 @@
       'reference' => 'fe99159b9ee0a74be3c12c0305e5338e0b9905c3',
       'type' => 'library',
-      'install_path' => '/private/var/folders/_z/v6yvnpmx5mz91tk62d72jhyc0000gn/T/tmp.wmxOCeBOzO/gather-grove-booking/vendor/composer/../stripe/stripe-php',
+      'install_path' => '/private/var/folders/_z/v6yvnpmx5mz91tk62d72jhyc0000gn/T/tmp.H6aDmoqzf7/gather-grove-booking/vendor/composer/../stripe/stripe-php',
       'aliases' => 
       array (