P1 flow fix: register makes a solo user by default, collective creation is an opt-in flag, post-login menu for collective-less accounts

apps/api/migrations/031_personal_workspaces.sql

@@ -0,0 +1,39 @@
+-- 031: personal workspaces — solo accounts (operator flow reorder, follow-up to 030).
+--
+-- The register form no longer forces "Name your workspace": registration
+-- defaults to a SOLO ACCOUNT with a minimal auto-created personal workspace, and
+-- creating a collective becomes an explicit opt-in flag on the form.
+--
+-- WHY A WORKSPACE AT ALL, when the user asked for none:
+--   The workspace is the tenancy spine of the whole Hub — memberships,
+--   connections, drafts, approvals, the group tree, group_rooms, chat_media_
+--   archive, storage/PeerTube quotas and the audit chain are all keyed
+--   workspace_id, and RLS fail-closes on app.workspace_id. A user without a
+--   workspace would have no readable rows anywhere; giving them one keeps every
+--   existing machine (including the group-files and PeerTube paths) working
+--   unchanged, with zero new code paths to audit.
+--
+--   The flag makes that hidden scaffolding honest: kind='personal' says "this
+--   tenant exists to hold ONE user's own stuff". It is deliberately NOT one of
+--   the groups kinds from 030: groups.kind distinguishes participation units in
+--   the collective tree; workspaces.kind distinguishes tenancy origins. A
+--   personal workspace CONTAINS no collective, so it can never appear in the
+--   collective tree/listing APIs (collectives are groups rows; 030 already
+--   filters them by kind IN ('collective','subcollective') and a personal
+--   workspace never creates such rows).
+--
+-- kind is workspace-scoped metadata, not a secret: it is returned by /auth/me
+-- and used by the web app to pick the post-login home. Nothing authorizes on it.
+
+BEGIN;
+
+ALTER TABLE workspaces ADD COLUMN kind text NOT NULL DEFAULT 'shared'
+  CHECK (kind IN ('shared','personal'));
+
+-- Existing workspaces were all created by the named-workspace flow => shared.
+-- The DEFAULT covers new rows; the explicit UPDATE is documentation, and it
+-- keeps the backfill honest if the default ever changes.
+
+UPDATE workspaces SET kind = 'shared' WHERE kind IS NULL;
+
+COMMIT;

apps/api/src/auth/auth.controller.ts

@@ -51,7 +51,8 @@ function parseRegister(value: unknown): RegisterInput {
   const username = requireUsername(body.username);
   const email = optionalEmail(body.email);
   return {
-    workspaceName: requireString(body.workspaceName, "workspaceName").trim().slice(0, 100),
+    // Collectives opt-in: no name => solo account (personal workspace).
+    workspaceName: optionalString(body.workspaceName, "workspaceName")?.trim().slice(0, 100),
     username,
     password: requireString(body.password, "password"),
     displayName: (optionalString(body.displayName, "displayName") ?? username).trim().slice(0, 100),

apps/api/src/auth/auth.service.ts

@@ -15,7 +15,7 @@ import { MIN_PASSWORD_LENGTH, burnPasswordCheck, hashPassword, verifyPassword }
 
 export interface MeResponse {
   user: { id: string; username: string; email: string | null; displayName: string };
-  workspace: { id: string; name: string; slug: string };
+  workspace: { id: string; name: string; slug: string; kind: "shared" | "personal" };
   role: string;
   permissions: string[];
   expiresAt: number;
@@ -27,7 +27,14 @@ export interface AuthResult {
 }
 
 export interface RegisterInput {
-  workspaceName: string;
+  /**
+   * Collectives opt-in (operator flow reorder): when omitted/empty the account
+   * is SOLO — a minimal kind='personal' workspace is auto-created so the whole
+   * tenancy spine (memberships, storage, PeerTube, RLS) keeps working, and it
+   * never appears in the collective tree/listing APIs. When set, the classic
+   * named-workspace registration runs unchanged.
+   */
+  workspaceName?: string;
   username: string;
   password: string;
   displayName: string;
@@ -59,6 +66,12 @@ export function localExternalId(handle: string): string {
   return `local:${handle.trim().toLowerCase()}`;
 }
 
+/** Personal workspaces get a stable, human-readable name: the display name if given, else the handle. */
+function personalWorkspaceName(displayName: string, username: string): string {
+  const clean = displayName.trim();
+  return clean === "" ? username : clean.slice(0, 100);
+}
+
 function slugify(name: string): string {
   const base = name
     .toLowerCase()
@@ -103,6 +116,10 @@ export class AuthService {
     const passwordHash = await hashPassword(input.password);
     const username = normalizeUsername(input.username);
     const externalId = localExternalId(username);
+    // Collectives opt-in: empty/missing name => solo account with a personal
+    // (invisible-to-collectives) workspace. The name is what opted IN.
+    const collectiveName = input.workspaceName?.trim() ?? "";
+    const solo = collectiveName === "";
 
     const created = await withSystem(async (client) => {
       // Existing identities (including invited, password-less users) cannot be
@@ -118,10 +135,19 @@ export class AuthService {
       if (userId === undefined) throw new ConflictException("an account with this username already exists — sign in instead");
       await client.query("INSERT INTO user_passwords (user_id, password_hash) VALUES ($1, $2)", [userId, passwordHash]);
 
-      const ws = await client.query("INSERT INTO workspaces (name, slug) VALUES ($1, $2) RETURNING id, slug", [
-        input.workspaceName,
-        slugify(input.workspaceName),
-      ]);
+      // A solo account still gets a REAL workspace: every tenancy surface
+      // (memberships, connections, drafts, storage, PeerTube, RLS) is keyed
+      // workspace_id and fail-closes without one. kind='personal' marks it as
+      // scaffolding for one user, never a collective.
+      const ws = solo
+        ? await client.query(
+            "INSERT INTO workspaces (name, slug, kind) VALUES ($1, $2, 'personal') RETURNING id, slug",
+            [personalWorkspaceName(input.displayName, username), slugify(username)],
+          )
+        : await client.query("INSERT INTO workspaces (name, slug) VALUES ($1, $2) RETURNING id, slug", [
+            collectiveName,
+            slugify(collectiveName),
+          ]);
       const workspaceId = ws.rows[0]?.id as string;
       // Enter the new tenant's context for the RLS-protected membership insert.
       await client.query("SELECT set_config('app.workspace_id', $1, true)", [workspaceId]);
@@ -140,7 +166,7 @@ export class AuthService {
       action: "workspace.created",
       targetType: "workspace",
       targetId: created.workspaceId,
-      diff: { name: input.workspaceName, slug: created.slug },
+      diff: solo ? { kind: "personal", slug: created.slug } : { name: collectiveName, slug: created.slug },
     });
     return { token: created.token, me: await this.meFor(created.workspaceId, created.userId, created.token) };
   }
@@ -206,19 +232,21 @@ export class AuthService {
   private async meFor(workspaceId: string, userId: string, token: string | null, expiresAt?: number): Promise<MeResponse> {
     return withTenant(workspaceId, async (client) => {
       const res = await client.query(
-        `SELECT m.role, u.username, u.email, u.display_name, w.name, w.slug
+        `SELECT m.role, u.username, u.email, u.display_name, w.name, w.slug, w.kind
          FROM memberships m
          JOIN users u ON u.id = m.user_id
          JOIN workspaces w ON w.id = m.workspace_id
          WHERE m.workspace_id = $1 AND m.user_id = $2 AND m.status = 'active'`,
         [workspaceId, userId],
       );
-      const row = res.rows[0] as { role: string; username: string; email: string | null; display_name: string; name: string; slug: string } | undefined;
+      const row = res.rows[0] as
+        | { role: string; username: string; email: string | null; display_name: string; name: string; slug: string; kind: "shared" | "personal" }
+        | undefined;
       if (row === undefined) throw new UnauthorizedException("membership no longer active");
       const perms = await client.query("SELECT permission FROM role_permissions WHERE role = $1 ORDER BY permission", [row.role]);
       return {
         user: { id: userId, username: row.username, email: row.email, displayName: row.display_name },
-        workspace: { id: workspaceId, name: row.name, slug: row.slug },
+        workspace: { id: workspaceId, name: row.name, slug: row.slug, kind: row.kind },
         role: row.role,
         permissions: (perms.rows as Array<{ permission: string }>).map((p) => p.permission),
         expiresAt: expiresAt ?? expiryOf(token),

apps/api/src/collectives/collectives.controller.ts

@@ -53,6 +53,18 @@ export class CollectivesController {
     );
   }
 
+  /**
+   * Count of collectives in MY workspace (roots only) — the post-login router:
+   * zero => the app shows the "no collectives yet" home menu (create / join /
+   * solo tools) instead of the streams wall. Cheaper and more stable than the
+   * full tree for a boolean decision; same permission as the tree read.
+   */
+  @Get("mine/count")
+  @RequirePermission("workspace.view")
+  async myCount(@Req() request: AuthedRequest): Promise<{ collectives: number; workspaceKind: "shared" | "personal" }> {
+    return this.collectives.myCollectiveCount(requireSession(request).workspaceId);
+  }
+
   /** The workspace's collective tree: collectives as roots, subcollectives nested. */
   @Get("tree")
   @RequirePermission("workspace.view")

apps/api/src/collectives/collectives.service.ts

@@ -265,6 +265,24 @@ export class CollectivesService {
     return node;
   }
 
+  /**
+   * Root-collective count + the workspace's tenancy kind, for the post-login
+   * home decision (operator flow reorder #3). A personal workspace reports zero
+   * by construction — it never contains collective rows — but the kind is
+   * returned anyway so the client can label the menu honestly ("solo account")
+   * without a second round-trip.
+   */
+  async myCollectiveCount(workspaceId: string): Promise<{ collectives: number; workspaceKind: "shared" | "personal" }> {
+    return withTenant(workspaceId, async (client) => {
+      const rows = await client.query<{ n: string }>(
+        "SELECT count(*)::text AS n FROM groups WHERE workspace_id = $1 AND kind = 'collective'",
+        [workspaceId],
+      );
+      const kind = await client.query<{ kind: "shared" | "personal" }>("SELECT kind FROM workspaces WHERE id = $1", [workspaceId]);
+      return { collectives: Number(rows.rows[0]?.n ?? 0), workspaceKind: kind.rows[0]?.kind ?? "shared" };
+    });
+  }
+
   /**
    * The collective tree for the workspace: collectives as roots, subcollectives
    * nested, every node carrying its room set. 'plain' groups are sharing

apps/api/src/collectives/solo-registration.integration.test.ts

@@ -0,0 +1,166 @@
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import { join } from "node:path";
+import { Pool, type PoolClient } from "pg";
+
+/**
+ * Solo registration + the personal-workspace flag (operator flow reorder #1/#2)
+ * against a live PostgreSQL. Own database (the shared tenancy suite wipes every
+ * workspace and vitest runs files in parallel): COLLECTIVES_IT_DATABASE_URL +
+ * COLLECTIVES_IT_SUPER_DATABASE_URL, the same convention as the collectives
+ * integration suite. Skipped when unset.
+ *
+ * What these tests pin:
+ *   - register() with NO workspaceName creates a kind='personal' workspace,
+ *     one Owner membership, and /me reports the kind;
+ *   - the personal workspace is invisible to the collective surface (zero rows
+ *     in groups; myCollectiveCount => 0);
+ *   - the classic named registration still produces kind='shared';
+ *   - migration 031's CHECK rejects any third kind at the DB level.
+ */
+const appUrl = process.env.COLLECTIVES_IT_DATABASE_URL;
+const ownerUrl = process.env.COLLECTIVES_IT_SUPER_DATABASE_URL;
+
+type Modules = {
+  auth: typeof import("../auth/auth.service.js");
+  collectives: typeof import("./collectives.service.js");
+  db: typeof import("../db/client.js");
+};
+
+describe.skipIf(appUrl === undefined || ownerUrl === undefined)("solo registration (live DB)", () => {
+  let m: Modules;
+  let ownerPool: Pool;
+  const suffix = `${Date.now()}${Math.floor(Math.random() * 1e6)}`;
+  const solo = `solo${suffix}`;
+  const named = `named${suffix}`;
+  let soloAccount: Awaited<ReturnType<Modules["auth"]["AuthService"]["prototype"]["register"]>>;
+  let namedAccount: typeof soloAccount;
+
+  /** The swap-fake provisioner: none of these tests talk to Matrix. */
+  const fakeProvisioner = {
+    botUserId: "@unused:example.com",
+    // Room ids must satisfy 030's format CHECK (!localpart:domain) — the fake
+    // honours the same contract as the real provisioner.
+    provisionCollective: async () => ({
+      open: { roomId: `!open-${suffix}:chat.example.com` },
+      closed: { roomId: `!closed-${suffix}:chat.example.com` },
+      onboarding: { roomId: `!onboarding-${suffix}:chat.example.com` },
+    }),
+  };
+
+  function service(): InstanceType<typeof m.collectives.CollectivesService> {
+    return new m.collectives.CollectivesService(fakeProvisioner);
+  }
+
+  async function asOwner<T>(fn: (client: PoolClient) => Promise<T>): Promise<T> {
+    const client = await ownerPool.connect();
+    try {
+      return await fn(client);
+    } finally {
+      await client.query("ROLLBACK").catch(() => undefined);
+      client.release();
+    }
+  }
+
+  beforeAll(async () => {
+    process.env.DATABASE_URL = appUrl;
+    process.env.SUPER_DATABASE_URL = ownerUrl;
+    const { runMigrations } = await import("../db/migrate.js");
+    await runMigrations(join(process.cwd(), "migrations"));
+    m = {
+      auth: await import("../auth/auth.service.js"),
+      collectives: await import("./collectives.service.js"),
+      db: await import("../db/client.js"),
+    };
+    ownerPool = new Pool({ connectionString: ownerUrl });
+
+    // Register both account shapes ONCE: usernames are globally unique, and
+    // re-registering would 409 (which is itself covered by the auth suite).
+    const auth = new m.auth.AuthService();
+    soloAccount = await auth.register({ username: solo, password: "correct-horse-1", displayName: "Solita Pérez" });
+    namedAccount = await auth.register({ workspaceName: "Colectivo Nombrado", username: named, password: "correct-horse-1", displayName: "Nombrada" });
+  });
+
+  afterAll(async () => {
+    if (ownerPool !== undefined) {
+      // Solo accounts are their own workspace: cascading the workspace removes
+      // the membership + user in one sweep.
+      await asOwner(async (c) => {
+        const ws = await c.query("SELECT id FROM workspaces WHERE slug LIKE $1", [`%${suffix}%`]);
+        const ids = ws.rows.map((row) => row.id as string);
+        if (ids.length > 0) {
+          await c.query("DELETE FROM users WHERE external_id = ANY($1)", [[`local:${solo}`, `local:${named}`]]);
+          await c.query("DELETE FROM workspaces WHERE id = ANY($1::uuid[])", [ids]);
+        }
+      });
+      await ownerPool.end();
+    }
+    await m?.db.pool.end();
+  });
+
+  it("register with NO workspaceName creates a personal workspace with one Owner and kind in /me", async () => {
+    const reg = soloAccount;
+    expect(reg.me.role).toBe("Owner");
+    expect(reg.me.workspace.kind).toBe("personal");
+    expect(reg.me.workspace.name).toBe("Solita Pérez"); // display name when given
+    expect(reg.me.workspace.slug).toContain(solo);
+
+    const rows = await asOwner(async (c) =>
+      c.query<{ kind: string; n: string }>(
+        `SELECT w.kind, (SELECT count(*)::text FROM memberships m WHERE m.workspace_id = w.id AND m.status = 'active') AS n
+         FROM workspaces w WHERE w.id = $1`,
+        [reg.me.workspace.id],
+      ),
+    );
+    expect(rows.rows[0]).toMatchObject({ kind: "personal", n: "1" });
+  });
+
+  it("a personal workspace holds no collective rows and reports zero in myCollectiveCount", async () => {
+    const count = await service().myCollectiveCount(soloAccount.me.workspace.id);
+    expect(count).toEqual({ collectives: 0, workspaceKind: "personal" });
+    const tree = await service().collectiveTree(soloAccount.me.workspace.id);
+    expect(tree).toHaveLength(0);
+  });
+
+  it("register WITH a workspaceName still creates a shared workspace (classic flow unchanged)", async () => {
+    expect(namedAccount.me.workspace.kind).toBe("shared");
+    expect(namedAccount.me.workspace.name).toBe("Colectivo Nombrado");
+    expect(await service().myCollectiveCount(namedAccount.me.workspace.id)).toEqual({ collectives: 0, workspaceKind: "shared" });
+  });
+
+  it("login surfaces the kind for both account shapes", async () => {
+    const auth = new m.auth.AuthService();
+    const soloLogin = await auth.login({ username: solo, password: "correct-horse-1" });
+    expect(soloLogin.me.workspace.kind).toBe("personal");
+    const namedLogin = await auth.login({ username: named, password: "correct-horse-1" });
+    expect(namedLogin.me.workspace.kind).toBe("shared");
+  });
+
+  it("a personal workspace can later hold a collective: the kinds are orthogonal", async () => {
+    // The workspace KIND is orthogonal: a personal workspace that later gains a
+    // real collective (via the in-app door) is a member of the collective
+    // surface like any other. What never happens is the workspace ITSELF
+    // appearing as a collective — it has no groups row.
+    const created = await service().createCollective(
+      soloAccount.me.workspace.id,
+      { name: "Su Colectivo", language: "es" },
+      { userId: soloAccount.me.user.id, role: soloAccount.me.role },
+    );
+    expect(created.kind).toBe("collective");
+    expect(await service().myCollectiveCount(soloAccount.me.workspace.id)).toEqual({ collectives: 1, workspaceKind: "personal" });
+  });
+
+  it("migration 031 CHECK: only 'shared' and 'personal' are storable kinds", async () => {
+    await expect(
+      asOwner(async (c) => c.query("INSERT INTO workspaces (name, slug, kind) VALUES ('Bad', 'bad-kind', 'cooperative')")),
+    ).rejects.toThrow(/kind/);
+  });
+
+  it("existing workspaces were backfilled to 'shared'", async () => {
+    // Any workspace created before 031 keeps working: the column is NOT NULL
+    // with a default, so old rows read as shared.
+    const rows = await asOwner(async (c) =>
+      c.query<{ kind: string }>("SELECT kind FROM workspaces WHERE slug NOT LIKE $1 LIMIT 5", [`%${suffix}%`]),
+    );
+    for (const row of rows.rows) expect(["shared", "personal"]).toContain(row.kind);
+  });
+});

apps/api/src/team/invite-link.service.ts

@@ -380,13 +380,13 @@ export class InviteLinkService {
         [workspaceId, userId],
       );
       const row = res.rows[0] as
-        | { role: string; username: string; email: string | null; display_name: string; name: string; slug: string }
+        | { role: string; username: string; email: string | null; display_name: string; name: string; slug: string; kind: "shared" | "personal" }
         | undefined;
       if (row === undefined) throw new UnauthorizedException("membership no longer active");
       const perms = await client.query("SELECT permission FROM role_permissions WHERE role = $1 ORDER BY permission", [row.role]);
       return {
         user: { id: userId, username: row.username, email: row.email, displayName: row.display_name },
-        workspace: { id: workspaceId, name: row.name, slug: row.slug },
+        workspace: { id: workspaceId, name: row.name, slug: row.slug, kind: row.kind },
         role: row.role,
         permissions: (perms.rows as Array<{ permission: string }>).map((p) => p.permission),
         expiresAt: verifySession(token)?.expiresAt ?? 0,