M12: complete daily operations cycle

backend/tests/test_bookings.py

@@ -133,6 +133,33 @@ def test_concurrent_bookings_only_reserve_vehicle_once():
     assert results.count(409) == 1
 
 
+def test_checkout_records_inspection_and_activates_safe_booking(ops_client):
+    window = {"starts_at": "2050-09-01T10:00:00Z", "ends_at": "2050-09-02T12:00:00Z"}
+    available = ops_client.get("/api/v1/bookings/availability", params=window).json()
+    vehicle_option = next(item for item in available if item["operational_status"] == "available")
+    vehicle = ops_client.get(f"/api/v1/vehicles/{vehicle_option['public_ref']}").json()
+    booking = ops_client.post(
+        "/api/v1/bookings",
+        json={"customer_ref": "CUS-0001", "vehicle_ref": vehicle["public_ref"], **window},
+    ).json()
+    response = ops_client.post(
+        f"/api/v1/bookings/{booking['public_ref']}/checkout",
+        json={
+            "start_odometer_km": vehicle["odometer_km"],
+            "fuel_level_percent": 95,
+            "cleanliness_ok": True,
+            "damage_reported": False,
+            "technical_warning": False,
+        },
+    )
+    assert response.status_code == 200
+    assert response.json()["activated"] is True
+    assert response.json()["booking_status"] == "active"
+    updated_vehicle = ops_client.get(f"/api/v1/vehicles/{vehicle['public_ref']}").json()
+    assert updated_vehicle["operational_status"] == "rented"
+    assert any(item["type"] == "checkout" for item in updated_vehicle["inspections"])
+
+
 def test_get_booking_detail(ops_client):
     response = ops_client.get("/api/v1/bookings/BK-DEMO-RETURN")
     assert response.status_code == 200

backend/tests/test_users.py

@@ -0,0 +1,25 @@
+def test_manager_can_create_and_update_user(ops_client):
+    created = ops_client.post(
+        "/api/v1/users",
+        json={
+            "email": "planner@example.test",
+            "display_name": "Fleet Planner",
+            "role": "rental_employee",
+            "password": "a-secure-demo-password",
+        },
+    )
+    assert created.status_code == 201
+    public_ref = created.json()["public_ref"]
+    assert created.json()["active"] is True
+    updated = ops_client.patch(
+        f"/api/v1/users/{public_ref}",
+        json={"display_name": "Senior Fleet Planner", "active": False},
+    )
+    assert updated.status_code == 200
+    assert updated.json()["display_name"] == "Senior Fleet Planner"
+    assert updated.json()["active"] is False
+    assert any(user["public_ref"] == public_ref for user in ops_client.get("/api/v1/users").json())
+
+
+def test_employee_cannot_manage_users(employee_client):
+    assert employee_client.get("/api/v1/users").status_code == 403

backend/tests/test_vehicles.py

@@ -37,3 +37,44 @@ def test_vehicle_detail_includes_related_records(ops_client):
 def test_vehicle_detail_404_for_unknown_ref(ops_client):
     response = ops_client.get("/api/v1/vehicles/MO-999")
     assert response.status_code == 404
+
+
+def test_manager_can_record_maintenance_and_release_vehicle(ops_client):
+    vehicle = ops_client.get("/api/v1/vehicles", params={"status": "available"}).json()[0]
+    response = ops_client.post(
+        f"/api/v1/vehicles/{vehicle['public_ref']}/maintenance",
+        json={
+            "occurred_at": "2051-01-15T09:00:00Z",
+            "odometer_km": vehicle["odometer_km"] + 100,
+            "category": "periodic_service",
+            "summary": "Periodic service completed and safety checks passed.",
+            "next_service_km": vehicle["odometer_km"] + 20100,
+            "mark_maintenance": True,
+        },
+    )
+    assert response.status_code == 201
+    detail = ops_client.get(f"/api/v1/vehicles/{vehicle['public_ref']}").json()
+    assert detail["operational_status"] == "maintenance"
+    assert any(
+        item["public_ref"] == response.json()["public_ref"]
+        for item in detail["maintenance"]
+    )
+    released = ops_client.post(
+        f"/api/v1/vehicles/{vehicle['public_ref']}/release",
+        json={"reason": "Service completed and vehicle inspected"},
+    )
+    assert released.status_code == 200
+    assert released.json()["operational_status"] == "available"
+
+
+def test_employee_cannot_record_maintenance(employee_client):
+    response = employee_client.post(
+        "/api/v1/vehicles/MO-001/maintenance",
+        json={
+            "occurred_at": "2051-01-15T09:00:00Z",
+            "odometer_km": 100,
+            "category": "repair",
+            "summary": "Unauthorised attempt",
+        },
+    )
+    assert response.status_code == 403