Add functionality to delete all leave requests for a worker with permission checks

djangorota/rota/views.py

@@ -1062,6 +1062,52 @@ def leave_delete(request, leave_id):
 	return response
 
 
+@require_POST
+def leave_delete_all(request, worker_id):
+	"""Delete all Leave records for a worker. Permissions same as `leave_delete`.
+
+	Returns an OOB swap updating `#leave-list` and triggers `leaveUpdated`.
+	"""
+	worker = get_object_or_404(Worker, pk=worker_id)
+
+	# permission checks (same as leave_delete)
+	allowed = False
+	token = request.POST.get('token') or request.GET.get('token')
+	try:
+		if request.user and request.user.is_authenticated and request.user.is_staff:
+			allowed = True
+		elif request.user and request.user.is_authenticated and getattr(request.user, 'email', None) and request.user.email == (worker.email or ''):
+			allowed = True
+		elif token:
+			try:
+				import uuid
+
+				token_uuid = uuid.UUID(token)
+				if worker.request_token == token_uuid:
+					allowed = True
+			except Exception:
+				allowed = False
+	except Exception:
+		allowed = False
+
+	if not allowed:
+		return HttpResponseBadRequest('Permission denied')
+
+	# delete all leaves for this worker
+	worker.leaves.all().delete()
+
+	# render updated leave list for the worker
+	leave_list_html = render_to_string(
+		"rota/partials/leave_list.html",
+		{"leaves": worker.leaves.all(), "token": token},
+		request=request,
+	)
+	resp = f'<div id="leave-list" hx-swap-oob="true">{leave_list_html}</div>'
+	response = HttpResponse(resp)
+	response["HX-Trigger"] = "leaveUpdated"
+	return response
+
+
 @require_POST
 def rota_run_export_regenerate(request, run_id):
 	"""Regenerate the HTML export for a completed run and persist it on the RotaRun.