Add session auth views and enforce permission-based update/delete booking operations

[Copilot]

This issue required explicit login/logout views and general app authentication for reservation update/delete flows. This PR adds session-auth endpoints and wires frontend auth-aware routing/UI so edit and delete actions are only available to authenticated users with proper permissions.

• Backend: auth surface + enforcement

  • Added auth endpoints under /api/auth/*:
    • GET /api/auth/status
    • POST /api/auth/login
    • POST /api/auth/logout
  • Added permission-based auth checks in bookings_by_id:
    • PUT now requires authentication and change_reservation permission, returns 401 when unauthenticated or 403 when lacking permission.
    • DELETE now requires authentication and delete_reservation permission, returns 401 when unauthenticated or 403 when lacking permission.
  • Kept GET /bookingsById/<id> behavior unchanged.
  • Uses _require_api_permission helper that validates both authentication and specific Django model permissions.

• Frontend: login/logout flows

  • Added LoginPage and LogoutPage.
  • Added auth.ts client helpers for status/login/logout API calls with cookie credentials.
  • Added routes:
    • /login
    • /logout
  • Added route guard for /reservations/edit/:id to redirect unauthenticated users to /login (preserving intended destination).

• Frontend: auth-aware booking operations

  • ReservationsPage now reads auth status and gates mutation actions:
    • Edit link visually/semantically disabled when unauthenticated.
    • Delete button disabled when unauthenticated with CSRF token and credentials included.
    • Inline "Login required" affordance added per row.
  • Navbar now renders Login vs Logout based on current auth status.

• Tests updated for new auth contract

  • Backend API tests expanded for:
    • auth status/login/logout handlers
    • unauthenticated PUT/DELETE rejection (401)
    • permission-denied PUT/DELETE rejection (403)
  • Frontend tests expanded for:
    • login page submit/error behavior
    • logout page redirect/error behavior
    • navbar login/logout state
    • reservations unauthenticated action gating

# backend/hr/views.py (bookings_by_id)
elif request.method == "PUT":
    permission_error = cls._require_api_permission(request, "change_reservation")
    if permission_error:
        return permission_error
    ...

elif request.method == "DELETE":
    permission_error = cls._require_api_permission(request, "delete_reservation")
    if permission_error:
        return permission_error
    ...

The _require_api_permission helper validates both authentication (returns 401 if not authenticated) and specific model permissions (returns 403 if authenticated but lacking the required permission).

[Copilot]

Pull request overview

This PR introduces session-based authentication endpoints on the Django backend and updates the React frontend to support login/logout flows and to restrict booking mutation actions (edit/delete) to authenticated users.

Changes:

• Backend: adds /api/auth/status, /api/auth/login, /api/auth/logout, and enforces authentication on PUT/DELETE for bookings_by_id.
• Frontend: adds LoginPage/LogoutPage, route-guards edit routes, and gates edit/delete UI based on auth status.
• Tests: expands backend API tests for the new auth contract and adds frontend tests for login/logout and auth-aware UI.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
frontend/src/pages/ReservationsPage.tsx	Fetches auth status and gates edit/delete actions in the reservations list UI.
frontend/src/pages/LoginPage.tsx	Adds login form that calls session-auth login endpoint and redirects after success.
frontend/src/pages/LogoutPage.tsx	Adds logout flow that calls session-auth logout endpoint and redirects home.
frontend/src/pages/tests/Reservationspage.test.tsx	Adds/updates reservations page tests to cover unauthenticated gating behavior.
frontend/src/pages/tests/LoginPage.test.tsx	Adds login page tests for success navigation and error rendering.
frontend/src/pages/tests/LogoutPage.test.tsx	Adds logout page tests for logout call + redirect and error display.
frontend/src/main.tsx	Adds /login and /logout routes and a RequireAuth guard for edit route.
frontend/src/components/Navbar.tsx	Displays Login/Logout link based on auth status.
frontend/src/components/auth.ts	Adds frontend API helpers for auth status/login/logout using cookie credentials.
frontend/src/components/tests/Navbar.test.tsx	Updates navbar tests to validate Login vs Logout rendering.
backend/hr/views.py	Implements auth status/login/logout handlers and requires auth for update/delete booking operations.
backend/hr/urls.py	Registers the new /api/auth/* endpoints.
backend/hr/test_apis.py	Updates API tests for authenticated mutations and adds tests for the auth endpoints.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[conorheffron]

@copilot resolve the merge conflicts in this pull request

[Copilot]

@copilot resolve the merge conflicts in this pull request

Merge conflicts resolved. The conflicts were in 4 files:

• backend/hr/views.py: Replaced basic auth checks with permission-based checks from main
• backend/hr/test_apis.py: Merged auth tests with OpenAPI tests and helper methods
• frontend/src/pages/ReservationsPage.tsx: Merged imports and DELETE headers
• frontend/src/pages/__tests__/Reservationspage.test.tsx: Merged test mocks

The resolution adopts main's more robust permission system (_require_api_permission) which checks both authentication and specific model permissions.

[conorheffron]

@copilot resolve the merge conflicts in this pull request

[conorheffron]

@copilot resolve the merge conflicts in this pull request

[Copilot]

@copilot resolve the merge conflicts in this pull request

Merge conflicts resolved. The conflicts were in 4 files:

• backend/hr/views.py: Kept both auth methods (auth_status, login, logout) and main's current_user method
• backend/hr/test_apis.py: Kept both auth tests and current_user tests
• frontend/src/components/Navbar.tsx: Combined auth-aware login/logout toggle with main's user dropdown
• frontend/src/components/__tests__/Navbar.test.tsx: Combined all tests (auth + user display)

Also fixed ReservationsPage test that needed a MemoryRouter wrapper for the Link component rendered in unauthenticated state. All 44 backend and 74 frontend tests pass.

[conorheffron]

@copilot resolve the merge conflicts in this pull request

[Copilot]

@copilot resolve the merge conflicts in this pull request

Merge conflicts resolved in commit 48a4668. Conflicts were in 2 files:

• backend/hr/test_apis.py: Merged clear-all user fixtures (auth_user, staff_user, superuser) alongside the existing auth test user
• frontend/src/pages/ReservationsPage.tsx: Combined isAuthenticated and clearingAll state, removed duplicate getCSRFToken import, and auth-gated the "Clear all" button

All 48 backend and 76 frontend tests pass.