From c4bb7bbb8b0d455418ac051ca4d4fbfe888ec512 Mon Sep 17 00:00:00 2001
From: Jeppe B <2jepp9350@gmail.com>
Date: Mon, 1 Jun 2026 20:52:08 +0200
Subject: [PATCH] Scope superuser subuser invite resends

---
 services/nginx/app/routes/subusersRoute.php    | 18 +++++++++++-------
 .../SubusersRouteManagementContractTest.php    | 16 ++++++++++++++++
 2 files changed, 27 insertions(+), 7 deletions(-)

diff --git a/services/nginx/app/routes/subusersRoute.php b/services/nginx/app/routes/subusersRoute.php
index 8db0c6ae..b0b36e6e 100644
--- a/services/nginx/app/routes/subusersRoute.php
+++ b/services/nginx/app/routes/subusersRoute.php
@@ -1234,9 +1234,11 @@ class subusersRoute
             global $response;
 
             $this->requirePermission('edit_subusers');
-            self::requireParameters(['id']);
+            self::requireParameters(['id', 'customer_number']);
             $subuserId = (int)self::getParameter('id');
             self::requireType($subuserId, self::type_int());
+            $customerNumber = (int)self::getParameter('customer_number');
+            self::requireType($customerNumber, self::type_int());
 
             $subuser = (new subusers_o())->select($subuserId);
             if (!$subuser->exists()) {
@@ -1244,21 +1246,23 @@ class subusersRoute
             }
             $subuser->getObjectProperties();
 
+            $grant = (new subuser_grants_o())->getGrantForSubuserAndCustomer($subuserId, $customerNumber, true);
+            if ($grant === null) {
+                $response->error('Subuser grant not found for selected customer', 404);
+            }
+
             if (!$subuser->requiresSetup()) {
                 $response->error('Driver account already accepted the invitation.', 409);
             }
 
             $invite = $this->issueSetupInvite($subuser);
             $response->success([
-                'subuser' => [
-                    'id' => (int)$subuser->id,
-                    'setup_required' => true,
-                    'can_resend_invite' => true,
-                ],
+                'subuser' => $this->buildSubuserManagementPayload($subuser, $customerNumber),
+                'grant' => $grant->asArray(),
                 'invite' => $invite,
             ]);
         }, [
-            'edit_subusers' => 'Resend chauffeur invites for any customer (superuser).',
+            'edit_subusers' => 'Resend chauffeur invites for a selected customer (superuser).',
         ]);
 
         $this->post('/subusers/invite/resend', function () {
diff --git a/services/nginx/app/tests/Unit/Subusers/SubusersRouteManagementContractTest.php b/services/nginx/app/tests/Unit/Subusers/SubusersRouteManagementContractTest.php
index bae72fe4..21fd974f 100644
--- a/services/nginx/app/tests/Unit/Subusers/SubusersRouteManagementContractTest.php
+++ b/services/nginx/app/tests/Unit/Subusers/SubusersRouteManagementContractTest.php
@@ -69,6 +69,22 @@ it('prevents own-customer managers from editing driver-owned account profiles',
     expect($normalized)->toContain("Customers can only manage subuser grants. Drivers own their account profile.");
 });
 
+it('scopes superuser invite resend to a selected customer grant', function (): void {
+    $routeFile = app_path('routes/subusersRoute.php');
+    expect(is_file($routeFile))->toBeTrue();
+
+    $code = (string)file_get_contents($routeFile);
+    $normalized = preg_replace('/\s+/', ' ', $code);
+
+    expect($normalized)->toContain("\$this->post('/superuser/subusers/invite/resend', function () {");
+    expect($normalized)->toContain("self::requireParameters(['id', 'customer_number']);");
+    expect($normalized)->toContain("\$customerNumber = (int)self::getParameter('customer_number');");
+    expect($normalized)->toContain("getGrantForSubuserAndCustomer(\$subuserId, \$customerNumber, true)");
+    expect($normalized)->toContain("Subuser grant not found for selected customer");
+    expect($normalized)->toContain("'subuser' => \$this->buildSubuserManagementPayload(\$subuser, \$customerNumber)");
+    expect($normalized)->toContain("'grant' => \$grant->asArray()");
+});
+
 it('only allows invite resend while setup is still pending', function (): void {
     $routeFile = app_path('routes/subusersRoute.php');
     expect(is_file($routeFile))->toBeTrue();