From 770f5beaf3bc8601ca6df8ac30f390c9b50f5ff6 Mon Sep 17 00:00:00 2001
From: Edoardo Spadoni <edoardo.spadoni@nethesis.it>
Date: Wed, 7 Oct 2026 09:38:12 +0200
Subject: [PATCH] fix(frontend): limit system creation to the Owner
 organization

Partners keep creating systems on the legacy my until the updated
NS8 and NethSecurity images are out.
---
 frontend/e2e/fullstack/controls.spec.ts | 5 ++++-
 frontend/src/lib/permissions.ts         | 5 +++++
 frontend/src/views/SystemsView.vue      | 4 ++--
 3 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/frontend/e2e/fullstack/controls.spec.ts b/frontend/e2e/fullstack/controls.spec.ts
index e17ed0a73..5723798f9 100644
--- a/frontend/e2e/fullstack/controls.spec.ts
+++ b/frontend/e2e/fullstack/controls.spec.ts
@@ -107,8 +107,11 @@ const SURFACES: Surface[] = [
     always: { what: 'the page heading', locate: heading('systems.title') },
     controls: [
       {
+        // TODO: back to 'manage:systems' when canCreateSystems drops its
+        // owner-level gate. Until the updated images are out, partners
+        // create systems on the legacy my.
         what: 'the create-system button',
-        requires: 'manage:systems',
+        requires: OWNER_LEVEL,
         locate: button('systems.create_system'),
       },
     ],
diff --git a/frontend/src/lib/permissions.ts b/frontend/src/lib/permissions.ts
index 8ebc2b5cc..2b250cb9e 100644
--- a/frontend/src/lib/permissions.ts
+++ b/frontend/src/lib/permissions.ts
@@ -97,6 +97,11 @@ export const canManageSystems = () => {
   return loginStore.permissions.includes(MANAGE_SYSTEMS)
 }
 
+// TODO: drop the owner-level gate once the NS8 and NethSecurity images that
+// register against the new my are released. Until then partners create
+// systems on the legacy my, and only the Owner organization creates them here.
+export const canCreateSystems = () => hasOwnerLevelAuthority() && canManageSystems()
+
 export const canReadApplications = () => {
   const loginStore = useLoginStore()
   return loginStore.permissions.includes(READ_APPLICATIONS)
diff --git a/frontend/src/views/SystemsView.vue b/frontend/src/views/SystemsView.vue
index 5c32e4948..09b79d54d 100644
--- a/frontend/src/views/SystemsView.vue
+++ b/frontend/src/views/SystemsView.vue
@@ -13,7 +13,7 @@ import {
   faFilePdf,
 } from '@fortawesome/free-solid-svg-icons'
 import { FontAwesomeIcon } from '@fortawesome/vue-fontawesome'
-import { canManageSystems } from '@/lib/permissions'
+import { canCreateSystems } from '@/lib/permissions'
 import SystemsTable from '@/components/systems/SystemsTable.vue'
 import { useSystems } from '@/queries/systems/systems'
 import { useNotificationsStore } from '@/stores/notifications'
@@ -165,7 +165,7 @@ async function exportSystems(format: 'pdf' | 'csv') {
         </NeDropdown>
         <!-- create system -->
         <NeButton
-          v-if="canManageSystems()"
+          v-if="canCreateSystems()"
           kind="primary"
           size="lg"
           class="shrink-0"