Fixex #528

Author: oharsta

client/src/connection/Contract.jsx

@@ -6,7 +6,7 @@ import {updateApplication} from "../api/index.js";
 import {convertClientApplicationToServer, convertServerApplicationToClient} from "../utils/Application.js";
 import {Button, ButtonType, Loader} from "@surfnet/sds";
 import ContractSignedIcon from "../icons/undraw/contract_signed.svg";
-import {authorities, currentUserMembershipAuthority} from "../utils/Permissions.js";
+import {authorities, currentUserMembershipAuthority, isOrganizationAdmin} from "../utils/Permissions.js";
 
 export const Contract = ({
                              application,
@@ -48,7 +48,7 @@ export const Contract = ({
         return <Loader/>
     }
 
-    const maySignContract = currentUserMembershipAuthority(user, currentOrganization) === authorities.ADMIN;
+    const maySignContract = user.superUser || isOrganizationAdmin(user, currentOrganization) ;
 
     return (
         <div className="contract-container">

server/src/main/java/access/api/ApplicationController.java

@@ -178,8 +178,11 @@ public ResponseEntity<Application> update(User user, @Validated @RequestBody App
                 .orElseThrow(() -> new NotFoundException("Application not found"));
 
         user = this.reinitializeUser(user, userRepository);
+
         confirmApplicationWriteAccess(user, application);
-        if (!application.isSignedContract() && applicationData.isSignedContract()) {
+
+        if (!application.isSignedContract() && applicationData.isSignedContract() &&
+                getOrganizationMembership(user, application.getOrganization(), Authority.ADMIN).isEmpty()) {
             throw new UserRestrictionException(
                     String.format("User %s is not allowed to sign contract for application %s",
                             user.getEmail(), application.getName()));