harden admin api authorization and add authz regression tests

apps/admin/src/app/api/invitations/[id]/resend/route.ts

@@ -1,5 +1,6 @@
 import { NextRequest, NextResponse } from "next/server";
 import { auth, clerkClient } from "@clerk/nextjs/server";
+import { getAuthContext } from "@/lib/auth/context";
 import log from "@/lib/logger";
 
 /**
@@ -18,6 +19,7 @@ export async function POST(
     }
 
     const { id: invitationId } = await params;
+    const authContext = await getAuthContext();
 
     // Fetch pending invitations to find the one being resent
     const client = await clerkClient();
@@ -38,11 +40,23 @@ export async function POST(
     }
 
     const metadata = invitation.publicMetadata as any;
+    const invitationGymId =
+      (metadata?.gymId as string | null | undefined) ?? null;
+    const createdBy = (metadata?.createdBy as string | undefined) ?? undefined;
+
+    const canManageByRole =
+      authContext.role === "superAdmin" ||
+      (authContext.role === "admin" &&
+        authContext.gymId !== null &&
+        invitationGymId === authContext.gymId);
 
     // Check if current user created this invitation
-    if (metadata?.createdBy !== userId) {
+    if (createdBy !== userId && !canManageByRole) {
       return NextResponse.json(
-        { error: "Forbidden - You can only resend invitations you created" },
+        {
+          error:
+            "Forbidden - You can only resend invitations you created or manage within your scope",
+        },
         { status: 403 },
       );
     }