From 4074885abb83978a38b63a98b14acdd702e7d476 Mon Sep 17 00:00:00 2001
From: Aditya Valsangkar <adidev2550@gmail.com>
Date: Fri, 7 Aug 2026 23:48:40 +0530
Subject: [PATCH 1/3] feat(auth): add logout API call to authService

---
 frontend/src/api/authService.js | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/frontend/src/api/authService.js b/frontend/src/api/authService.js
index 0a03486..15d8fae 100644
--- a/frontend/src/api/authService.js
+++ b/frontend/src/api/authService.js
@@ -1,16 +1,21 @@
 import api from "./axios";
 
 export async function login(payload) {
-    const { data } = await api.post("/auth/login", payload);
-    return data;
+  const { data } = await api.post("/auth/login", payload);
+  return data;
 }
 
 export async function signup(payload) {
-    const { data } = await api.post("/auth/register", payload);
-    return data;
+  const { data } = await api.post("/auth/register", payload);
+  return data;
+}
+
+export async function logout() {
+  const { data } = await api.post("/auth/logout");
+  return data;
 }
 
 export async function getMe() {
-    const { data } = await api.get("/auth/me");
-    return data;
+  const { data } = await api.get("/auth/me");
+  return data;
 }

From c641a6486429d853188fdc903e0ffbdfe26ef7d5 Mon Sep 17 00:00:00 2001
From: Aditya Valsangkar <adidev2550@gmail.com>
Date: Fri, 7 Aug 2026 23:49:23 +0530
Subject: [PATCH 2/3] fix(routes): grant finance/director access to approvals
 and manager routes

---
 frontend/src/app/router.jsx | 28 ++++++++++++----------------
 1 file changed, 12 insertions(+), 16 deletions(-)

diff --git a/frontend/src/app/router.jsx b/frontend/src/app/router.jsx
index 7c05760..bdde82f 100644
--- a/frontend/src/app/router.jsx
+++ b/frontend/src/app/router.jsx
@@ -47,7 +47,7 @@ export function AppRouter() {
         <Route
           path="/manager"
           element={
-            <ProtectedRoute allowedRoles={["manager", "admin"]}>
+            <ProtectedRoute allowedRoles={["manager", "finance", "director", "admin"]}>
               <ApprovalQueuePage />
             </ProtectedRoute>
           }
@@ -60,22 +60,18 @@ export function AppRouter() {
             </ProtectedRoute>
           }
         />
+        <Route path="/dashboard" element={<DashboardPage />} />
+        <Route path="/expenses" element={<ExpensePage />} />
         <Route
-  path="/dashboard"
-  element={<DashboardPage />}
-/>
-        <Route
-  path="/expenses"
-  element={<ExpensePage />}
-/>
-        <Route
-  path="/approvals"
-  element={
-    <ProtectedRoute allowedRoles={["manager", "admin"]}>
-      <ApprovalQueuePage />
-    </ProtectedRoute>
-  }
-/>
+          path="/approvals"
+          element={
+            <ProtectedRoute
+              allowedRoles={["manager", "finance", "director", "admin"]}
+            >
+              <ApprovalQueuePage />
+            </ProtectedRoute>
+          }
+        />
         <Route
           path="/analytics"
           element={

From e39b3615bb6c604073cff865d8f4e281d8fb0eb4 Mon Sep 17 00:00:00 2001
From: Aditya Valsangkar <adidev2550@gmail.com>
Date: Fri, 7 Aug 2026 23:50:21 +0530
Subject: [PATCH 3/3] fix(auth): call backend logout endpoint to blacklist JWT
 on sign out

---
 frontend/src/context/AuthContext.jsx | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/frontend/src/context/AuthContext.jsx b/frontend/src/context/AuthContext.jsx
index 937b9bd..f1858f0 100644
--- a/frontend/src/context/AuthContext.jsx
+++ b/frontend/src/context/AuthContext.jsx
@@ -10,6 +10,7 @@ import { jwtDecode } from "jwt-decode";
 import {
   login as loginRequest,
   signup as signupRequest,
+  logout as logoutRequest,
 } from "../api/authService";
 
 const AuthContext = createContext(null);
@@ -93,12 +94,18 @@ export function AuthProvider({ children }) {
     [persistAuth],
   );
 
-  const logout = useCallback(() => {
-    setUser(null);
-    setToken(null);
-    localStorage.removeItem("token");
-    localStorage.removeItem("auth_user");
-    window.location.href = "/login";
+  const logout = useCallback(async () => {
+    try {
+      await logoutRequest();
+    } catch {
+      // proceed with client-side cleanup even if server call fails
+    } finally {
+      setUser(null);
+      setToken(null);
+      localStorage.removeItem("token");
+      localStorage.removeItem("auth_user");
+      window.location.href = "/login";
+    }
   }, []);
 
   const switchRole = useCallback((role) => {