update rooms.py and main.py

backend/main.py

@@ -48,6 +48,8 @@ from events import (
     get_event,
     get_event_room_id,
     get_event_creator,
+    confirm_event,
+    cancel_event,
 )
 
 from event_signups import (
@@ -701,6 +703,83 @@ def api_get_event(
 
     return dict(event)
 
+@app.post(
+    "/events/{event_id}/confirm",
+    summary="Confirm an event",
+    description="Manually confirms an event. Only the event creator or a room admin can perform this action.",
+)
+def api_confirm_event(
+    event_id: int,
+    user_id: int = Depends(get_current_user),
+):
+    room_id = get_event_room_id(event_id)
+    creator_id = get_event_creator(event_id)
+
+    if room_id is None or creator_id is None:
+        raise HTTPException(
+            status_code=404,
+            detail="event not found",
+        )
+
+    is_creator = creator_id == user_id
+    is_admin = has_role(
+        room_id,
+        user_id,
+        "admin",
+    )
+
+    if not is_creator and not is_admin:
+        raise HTTPException(
+            status_code=403,
+            detail="event creator or admin permission required",
+        )
+
+    confirm_event(event_id)
+
+    return {
+        "status": "confirmed",
+        "event_id": event_id,
+    }
+
+
+@app.post(
+    "/events/{event_id}/cancel",
+    summary="Cancel an event",
+    description="Cancels an event. Only the event creator or a room admin can perform this action.",
+)
+def api_cancel_event(
+    event_id: int,
+    user_id: int = Depends(get_current_user),
+):
+    room_id = get_event_room_id(event_id)
+    creator_id = get_event_creator(event_id)
+
+    if room_id is None or creator_id is None:
+        raise HTTPException(
+            status_code=404,
+            detail="event not found",
+        )
+
+    is_creator = creator_id == user_id
+    is_admin = has_role(
+        room_id,
+        user_id,
+        "admin",
+    )
+
+    if not is_creator and not is_admin:
+        raise HTTPException(
+            status_code=403,
+            detail="event creator or admin permission required",
+        )
+
+    cancel_event(event_id)
+
+    return {
+        "status": "cancelled",
+        "event_id": event_id,
+    }
+
 
 @app.post(
     "/events/{event_id}/respond",