feat: add email confirmation and QR generation

backend/bookings/test_api.py

@@ -1,5 +1,6 @@
 from datetime import timedelta
 
+from django.core import mail
 from django.urls import reverse
 from django.utils import timezone
 from rest_framework import status
@@ -78,6 +79,8 @@ class BookingApiTests(APITestCase):
         self.assertNotIn("token", response.data)
         self.assertNotIn("email", response.data)
         self.assertEqual(Reservation.objects.count(), 1)
+        self.assertEqual(len(mail.outbox), 1)
+        self.assertIn("/api/reservations/confirm/?token=", mail.outbox[0].body)
 
     def test_reservation_creation_with_insufficient_seats(self):
         response = self.client.post(
@@ -109,8 +112,23 @@ class BookingApiTests(APITestCase):
         self.assertEqual(response.data["reservation_id"], reservation.id)
         self.assertEqual(response.data["status"], Reservation.Status.CONFIRMED)
         self.assertEqual(response.data["party_size"], reservation.party_size)
-        self.assertEqual(response.data["qr_code_url"], f"/api/reservations/{reservation.id}/qr-code/")
+        self.assertTrue(response.data["qr_code_url"].startswith("/api/check-ins/preview/?token="))
         self.assertNotIn("token", response.data)
+        self.assertTrue(response.data["qr_code_image"].startswith("data:image/png;base64,"))
+        self.assertEqual(reservation.status, Reservation.Status.CONFIRMED)
+
+    def test_confirmation_success_via_email_link_get_request(self):
+        reservation = self.create_reservation(email="get@example.com")
+        _, raw_token = generate_confirmation_token(reservation)
+
+        response = self.client.get(
+            reverse("api-reservation-confirm"),
+            {"token": raw_token},
+        )
+
+        reservation.refresh_from_db()
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+        self.assertEqual(response.data["reservation_id"], reservation.id)
         self.assertEqual(reservation.status, Reservation.Status.CONFIRMED)
 
     def test_confirmation_with_invalid_token(self):