test: tighten clear-all role coverage and forbidden assertions

Agent-Logs-Url: https://github.com/conorheffron/booking-sys/sessions/7e55bdd1-1b0d-4689-84ca-2cf7a1be16f0

Co-authored-by: conorheffron <8218626+conorheffron@users.noreply.github.com>

Author: Copilot

backend/hr/test_apis.py

@@ -31,6 +31,11 @@ def setUp(self):
             password="booking-pass-123",
             is_staff=True
         )
+        self.superuser = User.objects.create_superuser(
+            username="booking-admin",
+            password="booking-pass-123",
+            email="booking-admin@example.com"
+        )
         self.reservation = Reservation.objects.create(
             first_name="Taylor",
             reservation_date=date.today() + timedelta(days=1),
@@ -159,6 +164,7 @@ def test_bookings_by_id_delete_forbidden_when_anonymous(self):
         response = self.views.bookings_by_id(request, self.reservation.id)
         assert response.status_code == 403
         assert "signed in" in json.loads(response.content.decode())["error"]
+        assert Reservation.objects.filter(id=self.reservation.id).exists()
 
     def test_bookings_by_id_delete_404(self):
         """HR Test case test_bookings_by_id_delete_404"""
@@ -326,39 +332,63 @@ def test_table_view_without_query_date_returns_future(self):
 
     def test_table_view_delete_clear_all_for_staff(self):
         """HR Test case test_table_view_delete_clear_all_for_staff"""
+        Reservation.objects.create(
+            first_name="TodayA",
+            reservation_date=date.today(),
+            reservation_slot="09:30:00"
+        )
         Reservation.objects.create(
             first_name="FutureA",
-            reservation_date=str(date.today() + timedelta(days=3)),
+            reservation_date=date.today() + timedelta(days=3),
             reservation_slot="10:00:00"
         )
         Reservation.objects.create(
             first_name="FutureB",
-            reservation_date=str(date.today() + timedelta(days=4)),
+            reservation_date=date.today() + timedelta(days=4),
             reservation_slot="11:00:00"
         )
         Reservation.objects.create(
             first_name="PastA",
-            reservation_date=str(date.today() - timedelta(days=2)),
+            reservation_date=date.today() - timedelta(days=2),
             reservation_slot="09:00:00"
         )
+        upcoming_count = Reservation.objects.filter(
+            reservation_date__gte=date.today()
+        ).count()
         request = self.factory.delete('/api/bookings')
         request.user = self.staff_user
         response = Views.table_view(request)
         data = json.loads(response.content.decode())
         assert response.status_code == 200
         assert data["success"] is True
-        assert data["deleted_count"] == 3
-        assert Reservation.objects.filter(reservation_date__gt=date.today()).count() == 0
+        assert data["deleted_count"] == upcoming_count
+        assert Reservation.objects.filter(reservation_date__gte=date.today()).count() == 0
         assert Reservation.objects.filter(first_name="PastA").exists()
 
     def test_table_view_delete_clear_all_forbidden_for_non_staff(self):
         """HR Test case test_table_view_delete_clear_all_forbidden_for_non_staff"""
+        initial_count = Reservation.objects.count()
         request = self.factory.delete('/api/bookings')
         request.user = self.auth_user
         response = Views.table_view(request)
         data = json.loads(response.content.decode())
         assert response.status_code == 403
         assert "staff or superuser" in data["error"]
+        assert Reservation.objects.count() == initial_count
+
+    def test_table_view_delete_clear_all_for_superuser(self):
+        """HR Test case test_table_view_delete_clear_all_for_superuser"""
+        Reservation.objects.create(
+            first_name="FutureSuper",
+            reservation_date=date.today() + timedelta(days=5),
+            reservation_slot="11:30:00"
+        )
+        request = self.factory.delete('/api/bookings')
+        request.user = self.superuser
+        response = Views.table_view(request)
+        data = json.loads(response.content.decode())
+        assert response.status_code == 200
+        assert data["success"] is True
 
     def test_bookings_by_id_put_invalid_reservation_date(self):
         """HR Test case test_bookings_by_id_put_invalid_reservation_date"""

backend/hr/views.py

@@ -40,7 +40,10 @@ def version(cls, request:WSGIRequest):
 
     @classmethod
     def table_view(cls, request):
-        """GET bookings by date request parameter or DELETE all upcoming bookings"""
+        """GET bookings by date request parameter.
+
+        DELETE clears all bookings from today onward and requires a staff/superuser account.
+        """
         if request.method == "DELETE":
             user = getattr(request, "user", None)
             if not (user and user.is_authenticated and (user.is_staff or user.is_superuser)):
@@ -50,7 +53,7 @@ def table_view(cls, request):
                 )
             today = dt_date.today()
             deleted_count, _ = Reservation.objects.filter(
-                reservation_date__gt=today
+                reservation_date__gte=today
             ).delete()
             return JsonResponse(
                 {"success": True, "deleted_count": deleted_count},

frontend/src/pages/__tests__/Reservationspage.test.tsx

@@ -177,6 +177,12 @@ describe("ReservationsPage", () => {
     render(<ReservationsPage />);
     await waitFor(() => expect(screen.getByText("ClearMe")).toBeInTheDocument());
     fireEvent.click(screen.getByRole("button", { name: /Clear all/i }));
+    await waitFor(() =>
+      expect((global.fetch as jest.Mock)).toHaveBeenCalledWith(
+        "/api/bookings",
+        expect.objectContaining({ method: "DELETE" })
+      )
+    );
     await waitFor(() => expect(screen.queryByText("ClearMe")).not.toBeInTheDocument());
   });