From 2a3a1d79a132ed6356d4238104913328c82ab64b Mon Sep 17 00:00:00 2001 From: glass beadian Date: Mon, 12 Oct 2026 16:19:08 +0000 Subject: [PATCH] P1 flow fix: register makes a solo user by default, collective creation is an opt-in flag, post-login menu for collective-less accounts --- .../migrations/031_personal_workspaces.sql | 39 ++++ apps/api/src/auth/auth.controller.ts | 3 +- apps/api/src/auth/auth.service.ts | 48 +++-- .../src/collectives/collectives.controller.ts | 12 ++ .../src/collectives/collectives.service.ts | 18 ++ .../solo-registration.integration.test.ts | 166 ++++++++++++++++++ apps/api/src/team/invite-link.service.ts | 4 +- apps/web/package.json | 3 +- .../src/app/(main)/collectives/new/page.tsx | 91 ++++++++++ apps/web/src/app/(main)/onboarding/page.tsx | 50 +++++- apps/web/src/app/(main)/streams/page.tsx | 14 ++ .../collectives/no-collectives-home.tsx | 121 +++++++++++++ apps/web/src/lib/api-types.ts | 2 +- apps/web/src/lib/auth-store.ts | 3 +- apps/web/src/lib/register-form.test.ts | 64 +++++++ 15 files changed, 614 insertions(+), 24 deletions(-) create mode 100644 apps/api/migrations/031_personal_workspaces.sql create mode 100644 apps/api/src/collectives/solo-registration.integration.test.ts create mode 100644 apps/web/src/app/(main)/collectives/new/page.tsx create mode 100644 apps/web/src/components/collectives/no-collectives-home.tsx create mode 100644 apps/web/src/lib/register-form.test.ts diff --git a/apps/api/migrations/031_personal_workspaces.sql b/apps/api/migrations/031_personal_workspaces.sql new file mode 100644 index 0000000..3c2a5ae --- /dev/null +++ b/apps/api/migrations/031_personal_workspaces.sql @@ -0,0 +1,39 @@ +-- 031: personal workspaces — solo accounts (operator flow reorder, follow-up to 030). +-- +-- The register form no longer forces "Name your workspace": registration +-- defaults to a SOLO ACCOUNT with a minimal auto-created personal workspace, and +-- creating a collective becomes an explicit opt-in flag on the form. +-- +-- WHY A WORKSPACE AT ALL, when the user asked for none: +-- The workspace is the tenancy spine of the whole Hub — memberships, +-- connections, drafts, approvals, the group tree, group_rooms, chat_media_ +-- archive, storage/PeerTube quotas and the audit chain are all keyed +-- workspace_id, and RLS fail-closes on app.workspace_id. A user without a +-- workspace would have no readable rows anywhere; giving them one keeps every +-- existing machine (including the group-files and PeerTube paths) working +-- unchanged, with zero new code paths to audit. +-- +-- The flag makes that hidden scaffolding honest: kind='personal' says "this +-- tenant exists to hold ONE user's own stuff". It is deliberately NOT one of +-- the groups kinds from 030: groups.kind distinguishes participation units in +-- the collective tree; workspaces.kind distinguishes tenancy origins. A +-- personal workspace CONTAINS no collective, so it can never appear in the +-- collective tree/listing APIs (collectives are groups rows; 030 already +-- filters them by kind IN ('collective','subcollective') and a personal +-- workspace never creates such rows). +-- +-- kind is workspace-scoped metadata, not a secret: it is returned by /auth/me +-- and used by the web app to pick the post-login home. Nothing authorizes on it. + +BEGIN; + +ALTER TABLE workspaces ADD COLUMN kind text NOT NULL DEFAULT 'shared' + CHECK (kind IN ('shared','personal')); + +-- Existing workspaces were all created by the named-workspace flow => shared. +-- The DEFAULT covers new rows; the explicit UPDATE is documentation, and it +-- keeps the backfill honest if the default ever changes. + +UPDATE workspaces SET kind = 'shared' WHERE kind IS NULL; + +COMMIT; diff --git a/apps/api/src/auth/auth.controller.ts b/apps/api/src/auth/auth.controller.ts index 0c28e89..5e16035 100644 --- a/apps/api/src/auth/auth.controller.ts +++ b/apps/api/src/auth/auth.controller.ts @@ -51,7 +51,8 @@ function parseRegister(value: unknown): RegisterInput { const username = requireUsername(body.username); const email = optionalEmail(body.email); return { - workspaceName: requireString(body.workspaceName, "workspaceName").trim().slice(0, 100), + // Collectives opt-in: no name => solo account (personal workspace). + workspaceName: optionalString(body.workspaceName, "workspaceName")?.trim().slice(0, 100), username, password: requireString(body.password, "password"), displayName: (optionalString(body.displayName, "displayName") ?? username).trim().slice(0, 100), diff --git a/apps/api/src/auth/auth.service.ts b/apps/api/src/auth/auth.service.ts index 217bcd1..fb75724 100644 --- a/apps/api/src/auth/auth.service.ts +++ b/apps/api/src/auth/auth.service.ts @@ -15,7 +15,7 @@ import { MIN_PASSWORD_LENGTH, burnPasswordCheck, hashPassword, verifyPassword } export interface MeResponse { user: { id: string; username: string; email: string | null; displayName: string }; - workspace: { id: string; name: string; slug: string }; + workspace: { id: string; name: string; slug: string; kind: "shared" | "personal" }; role: string; permissions: string[]; expiresAt: number; @@ -27,7 +27,14 @@ export interface AuthResult { } export interface RegisterInput { - workspaceName: string; + /** + * Collectives opt-in (operator flow reorder): when omitted/empty the account + * is SOLO — a minimal kind='personal' workspace is auto-created so the whole + * tenancy spine (memberships, storage, PeerTube, RLS) keeps working, and it + * never appears in the collective tree/listing APIs. When set, the classic + * named-workspace registration runs unchanged. + */ + workspaceName?: string; username: string; password: string; displayName: string; @@ -59,6 +66,12 @@ export function localExternalId(handle: string): string { return `local:${handle.trim().toLowerCase()}`; } +/** Personal workspaces get a stable, human-readable name: the display name if given, else the handle. */ +function personalWorkspaceName(displayName: string, username: string): string { + const clean = displayName.trim(); + return clean === "" ? username : clean.slice(0, 100); +} + function slugify(name: string): string { const base = name .toLowerCase() @@ -103,6 +116,10 @@ export class AuthService { const passwordHash = await hashPassword(input.password); const username = normalizeUsername(input.username); const externalId = localExternalId(username); + // Collectives opt-in: empty/missing name => solo account with a personal + // (invisible-to-collectives) workspace. The name is what opted IN. + const collectiveName = input.workspaceName?.trim() ?? ""; + const solo = collectiveName === ""; const created = await withSystem(async (client) => { // Existing identities (including invited, password-less users) cannot be @@ -118,10 +135,19 @@ export class AuthService { if (userId === undefined) throw new ConflictException("an account with this username already exists — sign in instead"); await client.query("INSERT INTO user_passwords (user_id, password_hash) VALUES ($1, $2)", [userId, passwordHash]); - const ws = await client.query("INSERT INTO workspaces (name, slug) VALUES ($1, $2) RETURNING id, slug", [ - input.workspaceName, - slugify(input.workspaceName), - ]); + // A solo account still gets a REAL workspace: every tenancy surface + // (memberships, connections, drafts, storage, PeerTube, RLS) is keyed + // workspace_id and fail-closes without one. kind='personal' marks it as + // scaffolding for one user, never a collective. + const ws = solo + ? await client.query( + "INSERT INTO workspaces (name, slug, kind) VALUES ($1, $2, 'personal') RETURNING id, slug", + [personalWorkspaceName(input.displayName, username), slugify(username)], + ) + : await client.query("INSERT INTO workspaces (name, slug) VALUES ($1, $2) RETURNING id, slug", [ + collectiveName, + slugify(collectiveName), + ]); const workspaceId = ws.rows[0]?.id as string; // Enter the new tenant's context for the RLS-protected membership insert. await client.query("SELECT set_config('app.workspace_id', $1, true)", [workspaceId]); @@ -140,7 +166,7 @@ export class AuthService { action: "workspace.created", targetType: "workspace", targetId: created.workspaceId, - diff: { name: input.workspaceName, slug: created.slug }, + diff: solo ? { kind: "personal", slug: created.slug } : { name: collectiveName, slug: created.slug }, }); return { token: created.token, me: await this.meFor(created.workspaceId, created.userId, created.token) }; } @@ -206,19 +232,21 @@ export class AuthService { private async meFor(workspaceId: string, userId: string, token: string | null, expiresAt?: number): Promise { return withTenant(workspaceId, async (client) => { const res = await client.query( - `SELECT m.role, u.username, u.email, u.display_name, w.name, w.slug + `SELECT m.role, u.username, u.email, u.display_name, w.name, w.slug, w.kind FROM memberships m JOIN users u ON u.id = m.user_id JOIN workspaces w ON w.id = m.workspace_id WHERE m.workspace_id = $1 AND m.user_id = $2 AND m.status = 'active'`, [workspaceId, userId], ); - const row = res.rows[0] as { role: string; username: string; email: string | null; display_name: string; name: string; slug: string } | undefined; + const row = res.rows[0] as + | { role: string; username: string; email: string | null; display_name: string; name: string; slug: string; kind: "shared" | "personal" } + | undefined; if (row === undefined) throw new UnauthorizedException("membership no longer active"); const perms = await client.query("SELECT permission FROM role_permissions WHERE role = $1 ORDER BY permission", [row.role]); return { user: { id: userId, username: row.username, email: row.email, displayName: row.display_name }, - workspace: { id: workspaceId, name: row.name, slug: row.slug }, + workspace: { id: workspaceId, name: row.name, slug: row.slug, kind: row.kind }, role: row.role, permissions: (perms.rows as Array<{ permission: string }>).map((p) => p.permission), expiresAt: expiresAt ?? expiryOf(token), diff --git a/apps/api/src/collectives/collectives.controller.ts b/apps/api/src/collectives/collectives.controller.ts index a940971..25472cd 100644 --- a/apps/api/src/collectives/collectives.controller.ts +++ b/apps/api/src/collectives/collectives.controller.ts @@ -53,6 +53,18 @@ export class CollectivesController { ); } + /** + * Count of collectives in MY workspace (roots only) — the post-login router: + * zero => the app shows the "no collectives yet" home menu (create / join / + * solo tools) instead of the streams wall. Cheaper and more stable than the + * full tree for a boolean decision; same permission as the tree read. + */ + @Get("mine/count") + @RequirePermission("workspace.view") + async myCount(@Req() request: AuthedRequest): Promise<{ collectives: number; workspaceKind: "shared" | "personal" }> { + return this.collectives.myCollectiveCount(requireSession(request).workspaceId); + } + /** The workspace's collective tree: collectives as roots, subcollectives nested. */ @Get("tree") @RequirePermission("workspace.view") diff --git a/apps/api/src/collectives/collectives.service.ts b/apps/api/src/collectives/collectives.service.ts index 1080a0b..ecd6a9b 100644 --- a/apps/api/src/collectives/collectives.service.ts +++ b/apps/api/src/collectives/collectives.service.ts @@ -265,6 +265,24 @@ export class CollectivesService { return node; } + /** + * Root-collective count + the workspace's tenancy kind, for the post-login + * home decision (operator flow reorder #3). A personal workspace reports zero + * by construction — it never contains collective rows — but the kind is + * returned anyway so the client can label the menu honestly ("solo account") + * without a second round-trip. + */ + async myCollectiveCount(workspaceId: string): Promise<{ collectives: number; workspaceKind: "shared" | "personal" }> { + return withTenant(workspaceId, async (client) => { + const rows = await client.query<{ n: string }>( + "SELECT count(*)::text AS n FROM groups WHERE workspace_id = $1 AND kind = 'collective'", + [workspaceId], + ); + const kind = await client.query<{ kind: "shared" | "personal" }>("SELECT kind FROM workspaces WHERE id = $1", [workspaceId]); + return { collectives: Number(rows.rows[0]?.n ?? 0), workspaceKind: kind.rows[0]?.kind ?? "shared" }; + }); + } + /** * The collective tree for the workspace: collectives as roots, subcollectives * nested, every node carrying its room set. 'plain' groups are sharing diff --git a/apps/api/src/collectives/solo-registration.integration.test.ts b/apps/api/src/collectives/solo-registration.integration.test.ts new file mode 100644 index 0000000..8687240 --- /dev/null +++ b/apps/api/src/collectives/solo-registration.integration.test.ts @@ -0,0 +1,166 @@ +import { afterAll, beforeAll, describe, expect, it } from "vitest"; +import { join } from "node:path"; +import { Pool, type PoolClient } from "pg"; + +/** + * Solo registration + the personal-workspace flag (operator flow reorder #1/#2) + * against a live PostgreSQL. Own database (the shared tenancy suite wipes every + * workspace and vitest runs files in parallel): COLLECTIVES_IT_DATABASE_URL + + * COLLECTIVES_IT_SUPER_DATABASE_URL, the same convention as the collectives + * integration suite. Skipped when unset. + * + * What these tests pin: + * - register() with NO workspaceName creates a kind='personal' workspace, + * one Owner membership, and /me reports the kind; + * - the personal workspace is invisible to the collective surface (zero rows + * in groups; myCollectiveCount => 0); + * - the classic named registration still produces kind='shared'; + * - migration 031's CHECK rejects any third kind at the DB level. + */ +const appUrl = process.env.COLLECTIVES_IT_DATABASE_URL; +const ownerUrl = process.env.COLLECTIVES_IT_SUPER_DATABASE_URL; + +type Modules = { + auth: typeof import("../auth/auth.service.js"); + collectives: typeof import("./collectives.service.js"); + db: typeof import("../db/client.js"); +}; + +describe.skipIf(appUrl === undefined || ownerUrl === undefined)("solo registration (live DB)", () => { + let m: Modules; + let ownerPool: Pool; + const suffix = `${Date.now()}${Math.floor(Math.random() * 1e6)}`; + const solo = `solo${suffix}`; + const named = `named${suffix}`; + let soloAccount: Awaited>; + let namedAccount: typeof soloAccount; + + /** The swap-fake provisioner: none of these tests talk to Matrix. */ + const fakeProvisioner = { + botUserId: "@unused:example.com", + // Room ids must satisfy 030's format CHECK (!localpart:domain) — the fake + // honours the same contract as the real provisioner. + provisionCollective: async () => ({ + open: { roomId: `!open-${suffix}:chat.example.com` }, + closed: { roomId: `!closed-${suffix}:chat.example.com` }, + onboarding: { roomId: `!onboarding-${suffix}:chat.example.com` }, + }), + }; + + function service(): InstanceType { + return new m.collectives.CollectivesService(fakeProvisioner); + } + + async function asOwner(fn: (client: PoolClient) => Promise): Promise { + const client = await ownerPool.connect(); + try { + return await fn(client); + } finally { + await client.query("ROLLBACK").catch(() => undefined); + client.release(); + } + } + + beforeAll(async () => { + process.env.DATABASE_URL = appUrl; + process.env.SUPER_DATABASE_URL = ownerUrl; + const { runMigrations } = await import("../db/migrate.js"); + await runMigrations(join(process.cwd(), "migrations")); + m = { + auth: await import("../auth/auth.service.js"), + collectives: await import("./collectives.service.js"), + db: await import("../db/client.js"), + }; + ownerPool = new Pool({ connectionString: ownerUrl }); + + // Register both account shapes ONCE: usernames are globally unique, and + // re-registering would 409 (which is itself covered by the auth suite). + const auth = new m.auth.AuthService(); + soloAccount = await auth.register({ username: solo, password: "correct-horse-1", displayName: "Solita Pérez" }); + namedAccount = await auth.register({ workspaceName: "Colectivo Nombrado", username: named, password: "correct-horse-1", displayName: "Nombrada" }); + }); + + afterAll(async () => { + if (ownerPool !== undefined) { + // Solo accounts are their own workspace: cascading the workspace removes + // the membership + user in one sweep. + await asOwner(async (c) => { + const ws = await c.query("SELECT id FROM workspaces WHERE slug LIKE $1", [`%${suffix}%`]); + const ids = ws.rows.map((row) => row.id as string); + if (ids.length > 0) { + await c.query("DELETE FROM users WHERE external_id = ANY($1)", [[`local:${solo}`, `local:${named}`]]); + await c.query("DELETE FROM workspaces WHERE id = ANY($1::uuid[])", [ids]); + } + }); + await ownerPool.end(); + } + await m?.db.pool.end(); + }); + + it("register with NO workspaceName creates a personal workspace with one Owner and kind in /me", async () => { + const reg = soloAccount; + expect(reg.me.role).toBe("Owner"); + expect(reg.me.workspace.kind).toBe("personal"); + expect(reg.me.workspace.name).toBe("Solita Pérez"); // display name when given + expect(reg.me.workspace.slug).toContain(solo); + + const rows = await asOwner(async (c) => + c.query<{ kind: string; n: string }>( + `SELECT w.kind, (SELECT count(*)::text FROM memberships m WHERE m.workspace_id = w.id AND m.status = 'active') AS n + FROM workspaces w WHERE w.id = $1`, + [reg.me.workspace.id], + ), + ); + expect(rows.rows[0]).toMatchObject({ kind: "personal", n: "1" }); + }); + + it("a personal workspace holds no collective rows and reports zero in myCollectiveCount", async () => { + const count = await service().myCollectiveCount(soloAccount.me.workspace.id); + expect(count).toEqual({ collectives: 0, workspaceKind: "personal" }); + const tree = await service().collectiveTree(soloAccount.me.workspace.id); + expect(tree).toHaveLength(0); + }); + + it("register WITH a workspaceName still creates a shared workspace (classic flow unchanged)", async () => { + expect(namedAccount.me.workspace.kind).toBe("shared"); + expect(namedAccount.me.workspace.name).toBe("Colectivo Nombrado"); + expect(await service().myCollectiveCount(namedAccount.me.workspace.id)).toEqual({ collectives: 0, workspaceKind: "shared" }); + }); + + it("login surfaces the kind for both account shapes", async () => { + const auth = new m.auth.AuthService(); + const soloLogin = await auth.login({ username: solo, password: "correct-horse-1" }); + expect(soloLogin.me.workspace.kind).toBe("personal"); + const namedLogin = await auth.login({ username: named, password: "correct-horse-1" }); + expect(namedLogin.me.workspace.kind).toBe("shared"); + }); + + it("a personal workspace can later hold a collective: the kinds are orthogonal", async () => { + // The workspace KIND is orthogonal: a personal workspace that later gains a + // real collective (via the in-app door) is a member of the collective + // surface like any other. What never happens is the workspace ITSELF + // appearing as a collective — it has no groups row. + const created = await service().createCollective( + soloAccount.me.workspace.id, + { name: "Su Colectivo", language: "es" }, + { userId: soloAccount.me.user.id, role: soloAccount.me.role }, + ); + expect(created.kind).toBe("collective"); + expect(await service().myCollectiveCount(soloAccount.me.workspace.id)).toEqual({ collectives: 1, workspaceKind: "personal" }); + }); + + it("migration 031 CHECK: only 'shared' and 'personal' are storable kinds", async () => { + await expect( + asOwner(async (c) => c.query("INSERT INTO workspaces (name, slug, kind) VALUES ('Bad', 'bad-kind', 'cooperative')")), + ).rejects.toThrow(/kind/); + }); + + it("existing workspaces were backfilled to 'shared'", async () => { + // Any workspace created before 031 keeps working: the column is NOT NULL + // with a default, so old rows read as shared. + const rows = await asOwner(async (c) => + c.query<{ kind: string }>("SELECT kind FROM workspaces WHERE slug NOT LIKE $1 LIMIT 5", [`%${suffix}%`]), + ); + for (const row of rows.rows) expect(["shared", "personal"]).toContain(row.kind); + }); +}); diff --git a/apps/api/src/team/invite-link.service.ts b/apps/api/src/team/invite-link.service.ts index 41be9ad..1ce3fb3 100644 --- a/apps/api/src/team/invite-link.service.ts +++ b/apps/api/src/team/invite-link.service.ts @@ -380,13 +380,13 @@ export class InviteLinkService { [workspaceId, userId], ); const row = res.rows[0] as - | { role: string; username: string; email: string | null; display_name: string; name: string; slug: string } + | { role: string; username: string; email: string | null; display_name: string; name: string; slug: string; kind: "shared" | "personal" } | undefined; if (row === undefined) throw new UnauthorizedException("membership no longer active"); const perms = await client.query("SELECT permission FROM role_permissions WHERE role = $1 ORDER BY permission", [row.role]); return { user: { id: userId, username: row.username, email: row.email, displayName: row.display_name }, - workspace: { id: workspaceId, name: row.name, slug: row.slug }, + workspace: { id: workspaceId, name: row.name, slug: row.slug, kind: row.kind }, role: row.role, permissions: (perms.rows as Array<{ permission: string }>).map((p) => p.permission), expiresAt: verifySession(token)?.expiresAt ?? 0, diff --git a/apps/web/package.json b/apps/web/package.json index 10c61f0..950a9ec 100644 --- a/apps/web/package.json +++ b/apps/web/package.json @@ -7,7 +7,8 @@ "build": "next build", "lint": "eslint src", "typecheck": "tsc --noEmit", - "test:manual": "node --require ./scripts/control-room-register.cjs --test src/lib/participation-manual.test.ts" + "test:manual": "node --require ./scripts/control-room-register.cjs --test src/lib/participation-manual.test.ts", + "test:register": "node --require ./scripts/control-room-register.cjs --test src/lib/register-form.test.ts" }, "dependencies": { "@tactical-media-broadcast-hub/connector-sdk": "workspace:^", diff --git a/apps/web/src/app/(main)/collectives/new/page.tsx b/apps/web/src/app/(main)/collectives/new/page.tsx new file mode 100644 index 0000000..9a57ebc --- /dev/null +++ b/apps/web/src/app/(main)/collectives/new/page.tsx @@ -0,0 +1,91 @@ +"use client"; + +import { useState } from "react"; +import { useRouter } from "next/navigation"; +import { MANUAL_LANGUAGES, DEFAULT_MANUAL_LANGUAGE, type ManualLanguage } from "@tactical-media-broadcast-hub/core"; +import { Button, Card, Input } from "../../../../components/ui/primitives"; +import { api, errorMessage } from "../../../../lib/api-client"; +import type { CollectiveNode } from "../../../../lib/api-types"; + +/** + * Create a collective (operator reorder #3: the door from the no-collectives + * home). Posts /collectives — the provisioner mints the room set, the founder + * membership and the onboarding manual land in one transaction, then the user + * is dropped on the tree. Bilingual by the same Spanish-first rule as the rest + * of the product. + */ +export default function NewCollectivePage(): React.ReactElement { + const router = useRouter(); + const [name, setName] = useState(""); + const [language, setLanguage] = useState(DEFAULT_MANUAL_LANGUAGE); + const [description, setDescription] = useState(""); + const [busy, setBusy] = useState(false); + const [error, setError] = useState(null); + + const ready = name.trim().length >= 2; + + async function create(): Promise { + setBusy(true); + setError(null); + try { + const collective = await api.post("/collectives", { + name: name.trim(), + language, + ...(description.trim() === "" ? {} : { description: description.trim() }), + }); + // Full navigation so the tree mounts with the new collective in place. + router.push(`/streams?created=${encodeURIComponent(collective.name)}`); + } catch (err) { + setError(errorMessage(err)); + setBusy(false); + } + } + + return ( +
+ +

Crear un colectivo

+

+ Se crean tres salas — abierta (pública, nunca cifrada), cerrada (cifrada desde su creación) y de acogida + (con el manual de participación) — y quedas como fundador/a. +

+
+ setName(e.target.value)} + placeholder="Nombre del colectivo" + autoFocus + /> + +