Fix scouthub-home-be

scouthub-home-be/tests/integration/inviti.endpoint.test.ts

@@ -61,6 +61,14 @@ function utenteToken(email: string): string {
   return signToken({ sub: 'user-invitato', email, realm_access: { roles: [] } });
 }
 
+function adminCentraleToken(): string {
+  return signToken({
+    sub: 'user-admin',
+    email: 'admin@example.com',
+    realm_access: { roles: ['admin'] },
+  });
+}
+
 const ORA = Date.now();
 function invitoFixture(overrides: Partial<Record<string, unknown>> = {}) {
   return {
@@ -133,6 +141,25 @@ describe('POST /gruppi/:orgId/inviti', () => {
     expect(response.status).toBe(403);
     expect(invitoCreate).not.toHaveBeenCalled();
   });
+
+  test("admin può creare un invito anche in un'organizzazione che non è la propria", async () => {
+    invitoCreate.mockResolvedValueOnce({ id: 'invito-nuovo', scadenza: new Date(ORA + 7 * 24 * 60 * 60 * 1000) });
+    const consoleLogSpy = jest.spyOn(console, 'log').mockImplementation(() => undefined);
+
+    const response = await request(app)
+      .post('/gruppi/org-altrui/inviti')
+      .set('Authorization', `Bearer ${adminCentraleToken()}`)
+      .send({ email: 'nuovo@example.com', ruolo: 'Capi' });
+
+    expect(response.status).toBe(201);
+    expect(invitoCreate).toHaveBeenCalledWith(
+      expect.objectContaining({
+        data: expect.objectContaining({ orgId: 'org-altrui' }),
+      }),
+    );
+
+    consoleLogSpy.mockRestore();
+  });
 });
 
 describe('GET /inviti/:token', () => {