Scope superuser subuser invite resends

services/nginx/app/routes/subusersRoute.php

@@ -1234,9 +1234,11 @@ class subusersRoute
             global $response;
 
             $this->requirePermission('edit_subusers');
-            self::requireParameters(['id']);
+            self::requireParameters(['id', 'customer_number']);
             $subuserId = (int)self::getParameter('id');
             self::requireType($subuserId, self::type_int());
+            $customerNumber = (int)self::getParameter('customer_number');
+            self::requireType($customerNumber, self::type_int());
 
             $subuser = (new subusers_o())->select($subuserId);
             if (!$subuser->exists()) {
@@ -1244,21 +1246,23 @@ class subusersRoute
             }
             $subuser->getObjectProperties();
 
+            $grant = (new subuser_grants_o())->getGrantForSubuserAndCustomer($subuserId, $customerNumber, true);
+            if ($grant === null) {
+                $response->error('Subuser grant not found for selected customer', 404);
+            }
+
             if (!$subuser->requiresSetup()) {
                 $response->error('Driver account already accepted the invitation.', 409);
             }
 
             $invite = $this->issueSetupInvite($subuser);
             $response->success([
-                'subuser' => [
+                'subuser' => $this->buildSubuserManagementPayload($subuser, $customerNumber),
-                    'id' => (int)$subuser->id,
+                'grant' => $grant->asArray(),
-                    'setup_required' => true,
-                    'can_resend_invite' => true,
-                ],
                 'invite' => $invite,
             ]);
         }, [
-            'edit_subusers' => 'Resend chauffeur invites for any customer (superuser).',
+            'edit_subusers' => 'Resend chauffeur invites for a selected customer (superuser).',
         ]);
 
         $this->post('/subusers/invite/resend', function () {

services/nginx/app/tests/Unit/Subusers/SubusersRouteManagementContractTest.php

@@ -69,6 +69,22 @@ it('prevents own-customer managers from editing driver-owned account profiles',
     expect($normalized)->toContain("Customers can only manage subuser grants. Drivers own their account profile.");
 });
 
+it('scopes superuser invite resend to a selected customer grant', function (): void {
+    $routeFile = app_path('routes/subusersRoute.php');
+    expect(is_file($routeFile))->toBeTrue();
+
+    $code = (string)file_get_contents($routeFile);
+    $normalized = preg_replace('/\s+/', ' ', $code);
+
+    expect($normalized)->toContain("\$this->post('/superuser/subusers/invite/resend', function () {");
+    expect($normalized)->toContain("self::requireParameters(['id', 'customer_number']);");
+    expect($normalized)->toContain("\$customerNumber = (int)self::getParameter('customer_number');");
+    expect($normalized)->toContain("getGrantForSubuserAndCustomer(\$subuserId, \$customerNumber, true)");
+    expect($normalized)->toContain("Subuser grant not found for selected customer");
+    expect($normalized)->toContain("'subuser' => \$this->buildSubuserManagementPayload(\$subuser, \$customerNumber)");
+    expect($normalized)->toContain("'grant' => \$grant->asArray()");
+});
+
 it('only allows invite resend while setup is still pending', function (): void {
     $routeFile = app_path('routes/subusersRoute.php');
     expect(is_file($routeFile))->toBeTrue();