fix: allow super admin customer platform apps

backend/workflows/app_registry.py

@@ -212,13 +212,13 @@ DEFAULT_ROLE_VISIBILITY = {
         ROLE_STAFF: False,
     },
     'branding': {
-        ROLE_SUPER_ADMIN: False,
+        ROLE_SUPER_ADMIN: True,
         ROLE_ADMIN: False,
         ROLE_IT_STAFF: False,
         ROLE_STAFF: False,
     },
     'company_config': {
-        ROLE_SUPER_ADMIN: False,
+        ROLE_SUPER_ADMIN: True,
         ROLE_ADMIN: False,
         ROLE_IT_STAFF: False,
         ROLE_STAFF: False,

backend/workflows/branding.py

@@ -268,8 +268,8 @@ def get_default_notification_templates() -> dict[str, dict[str, str]]:
     support_email = company_contact['it_contact_email'] or branding_copy['support_email'] or f"it@{branding_copy['company_domain']}"
     welcome = templates.get('onboarding_welcome')
     if welcome:
-        welcome['subject'] = f'Willkommen bei {company_name}, {{ VORNAME }}'
+        welcome['subject'] = f'Willkommen bei {company_name}, {{{{ VORNAME }}}}'
-        welcome['subject_en'] = f'Welcome to {company_name}, {{ VORNAME }}'
+        welcome['subject_en'] = f'Welcome to {company_name}, {{{{ VORNAME }}}}'
         welcome['body'] = (
             'Hallo {{ FULL_NAME }},\n\n'
             f'herzlich willkommen bei {company_name}.\n'

backend/workflows/roles.py

@@ -33,8 +33,8 @@ ROLE_LABELS = {
 CAPABILITIES = {
     # Platform-only capabilities stay above any customer-company admin role.
     'manage_users': {ROLE_PLATFORM_OWNER, ROLE_SUPER_ADMIN},
-    'manage_product_branding': {ROLE_PLATFORM_OWNER},
+    'manage_product_branding': {ROLE_PLATFORM_OWNER, ROLE_SUPER_ADMIN},
-    'manage_company_config': {ROLE_PLATFORM_OWNER},
+    'manage_company_config': {ROLE_PLATFORM_OWNER, ROLE_SUPER_ADMIN},
     'manage_trial_lifecycle': {ROLE_PLATFORM_OWNER},
     'manage_app_registry': {ROLE_PLATFORM_OWNER},
     'access_requests_dashboard': {ROLE_PLATFORM_OWNER, ROLE_SUPER_ADMIN, ROLE_ADMIN, ROLE_IT_STAFF, ROLE_STAFF},

backend/workflows/tests/test_app_registry_permissions.py

@@ -41,6 +41,13 @@ class AppRegistryPermissionTests(TestCase):
         self.assertNotIn('trial_management', self._visible_keys(self.super_admin))
         self.assertNotIn('trial_management', self._visible_keys(self.admin))
 
+    def test_super_admin_sees_branding_and_company_config_but_not_app_registry(self):
+        keys = self._visible_keys(self.super_admin)
+
+        self.assertIn('branding', keys)
+        self.assertIn('company_config', keys)
+        self.assertNotIn('app_registry', keys)
+
     def test_requests_dashboard_can_be_hidden_from_staff_via_registry(self):
         config = PortalAppConfig.objects.get(key='requests_dashboard')
         config.visible_to_staff = False
@@ -63,3 +70,12 @@ class AppRegistryPermissionTests(TestCase):
         response = self.client.get(reverse('portal_app_registry_page'))
 
         self.assertEqual(response.status_code, 200)
+
+    def test_super_admin_can_open_branding_and_company_config_pages(self):
+        self.client.force_login(self.super_admin)
+
+        branding_response = self.client.get(reverse('portal_branding_page'))
+        company_response = self.client.get(reverse('portal_company_config_page'))
+
+        self.assertEqual(branding_response.status_code, 200)
+        self.assertEqual(company_response.status_code, 200)

backend/workflows/tests/test_welcome_email_schedule.py

@@ -6,6 +6,8 @@ from django.contrib.auth import get_user_model
 from django.test import TestCase, override_settings
 from django.utils import timezone
 
+from workflows.branding import get_default_notification_templates
+from workflows.email_workflows import render_notification_template
 from workflows.models import NotificationTemplate, OnboardingRequest, ScheduledWelcomeEmail, WorkflowConfig
 from workflows.tasks import process_onboarding_request, send_scheduled_welcome_email
 
@@ -160,3 +162,32 @@ class WelcomeEmailScheduleTests(TestCase):
         kwargs = mock_send_templated.call_args.kwargs
         self.assertEqual(kwargs.get('attachments'), [])
         self.assertEqual(kwargs.get('from_email'), 'admin.sender@tub.co')
+
+    def test_branded_default_welcome_subject_renders_first_name(self):
+        default_templates = get_default_notification_templates()
+
+        self.assertIn('{{ VORNAME }}', default_templates['onboarding_welcome']['subject'])
+        self.assertIn('{{ VORNAME }}', default_templates['onboarding_welcome']['subject_en'])
+
+        context = {
+            'VORNAME': 'Anika',
+            'FULL_NAME': 'Anika Anan',
+            'DEPARTMENT': 'IT',
+            'CONTRACT_START': '2026-04-01',
+            'EMAIL': 'anika@tub.co',
+        }
+        subject_de, _body_de = render_notification_template(
+            'onboarding_welcome',
+            context,
+            language_code='de',
+        )
+        subject_en, _body_en = render_notification_template(
+            'onboarding_welcome',
+            context,
+            language_code='en',
+        )
+
+        self.assertIn('Anika', subject_de)
+        self.assertNotIn('{ VORNAME }', subject_de)
+        self.assertIn('Anika', subject_en)
+        self.assertNotIn('{ VORNAME }', subject_en)