Method Signup

backend/api/v1/auth_service.go:211–333

Signup registers a new user account (self-service). Creates a principal and assigns a workspace: - If the user's email was pre-invited to a workspace, joins that workspace. - Otherwise, creates a new workspace with the user as admin.

(ctx context.Context, req *connect.Request[v1pb.SignupRequest])

// - If the user's email was pre-invited to a workspace, joins that workspace.
// - Otherwise, creates a new workspace with the user as admin.
func (s *AuthService) Signup(ctx context.Context, req *connect.Request[v1pb.SignupRequest]) (*connect.Response[v1pb.LoginResponse], error) {
	request := req.Msg
	if request.Email == "" {
		return nil, connect.NewError(connect.CodeInvalidArgument, errors.Errorf("email must be set"))
	}
	if request.Title == "" {
		return nil, connect.NewError(connect.CodeInvalidArgument, errors.Errorf("title must be set"))
	}
	if request.Password == "" {
		return nil, connect.NewError(connect.CodeInvalidArgument, errors.Errorf("password must be set"))
	}
	if err := validateEndUserEmail(request.Email); err != nil {
		return nil, err
	}

	// Check if principal already exists.
	existingUser, err := s.store.GetUserByEmail(ctx, request.Email)
	if err != nil {
		return nil, connect.NewError(connect.CodeInternal, errors.Wrapf(err, "failed to find user by email"))
	}
	if existingUser != nil {
		return nil, connect.NewError(connect.CodeAlreadyExists, errors.Errorf("email %s is already registered", request.Email))
	}

	// Resolve the target workspace (read-only) so we can check restrictions BEFORE
	// any write — otherwise a rejected signup would leave an orphan user/workspace behind.
	targetWorkspaceID, _, err := s.resolveWorkspaceIDByEmail(ctx, request.Email)
	if err != nil {
		return nil, connect.NewError(connect.CodeInternal, errors.Wrapf(err, "failed to resolve target workspace"))
	}
	// Announce the workspace on every exit path so denied signups (DisallowSignup,
	// password restriction) still produce audit entries. Uses targetWorkspaceID (resolved
	// before any writes) rather than the provisioned workspaceID.
	defer func() { common.SetAuditWorkspaceID(ctx, targetWorkspaceID) }()

	restriction, err := getAccountRestriction(
		ctx,
		s.store,
		s.licenseService,
		s.profile.SaaS,
		targetWorkspaceID,
	)
	if err != nil {
		return nil, err
	}
	if restriction.DisallowSignup {
		return nil, connect.NewError(connect.CodePermissionDenied, errors.Errorf("sign up is disallowed for this workspace %v", targetWorkspaceID))
	}
	if err := validatePasswordWithRestriction(request.Password, convertToStorePasswordRestriction(restriction.PasswordRestriction)); err != nil {
		return nil, err
	}

	workspaceID, err := s.provisionWorkspaceForNewUser(ctx, request.Email)
	if err != nil {
		return nil, connect.NewError(connect.CodeInternal, errors.Wrapf(err, "failed to provision workspace"))
	}

	passwordHash, err := bcrypt.GenerateFromPassword([]byte(request.Password), bcrypt.DefaultCost)