admin felület különválasztva

backend/app/api/v1/endpoints/organizations.py

@@ -778,13 +778,13 @@ async def assign_organization_subscription(
     body: SubscriptionAssignIn,
     db: AsyncSession = Depends(get_db),
     current_user: User = Depends(get_current_user),
-    _: bool = Depends(RequireSystemCapability(Capability.CAN_MANAGE_SUBSCRIPTIONS))
 ):
     """
     Szervezet előfizetési csomagjának beállítása (Subscription & Package Assignment Bridge).
     
     P0 Feature: This endpoint assigns a subscription_tier to an organization.
-    It requires the 'can_manage_subscriptions' system capability (SUPERADMIN or ADMIN).
+    It requires org-level ADMIN or OWNER access (checked via _check_org_admin_access).
+    System-level SUPERADMIN capability is also accepted via the org admin check.
     
     The endpoint:
     1. Validates the tier exists in system.subscription_tiers
@@ -792,6 +792,8 @@ async def assign_organization_subscription(
     3. Updates subscription_plan and base_asset_limit from tier rules
     4. Creates/updates a finance.org_subscriptions audit record
     """
+    # Allow org ADMIN/OWNER to manage their own subscription
+    await _check_org_admin_access(org_id, current_user.id, db)
     try:
         result = await upgrade_org_subscription(
             db=db,