Method provisionWorkspaceForNewUser

backend/api/v1/auth_service.go:368–406

provisionWorkspaceForNewUser returns a workspace ID for a freshly-created user. If the email was pre-invited to existing workspaces (via IAM), returns the first one. Otherwise creates a new workspace (SaaS: per-user; self-hosted: joins the singleton). Called by both the Signup RPC and the email-code

(ctx context.Context, email string)

// Otherwise creates a new workspace (SaaS: per-user; self-hosted: joins the singleton).
// Called by both the Signup RPC and the email-code signup branch of Login.
func (s *AuthService) provisionWorkspaceForNewUser(ctx context.Context, email string) (string, error) {
	// Step 1: Resolve the target workspace. isMember indicates whether the user already has
	// an IAM binding. For pre-invited users we must NOT patch IAM — PatchWorkspaceIamPolicy
	// is a set-replacement that would downgrade an admin to member.
	workspaceID, isMember, err := s.resolveWorkspaceIDByEmail(ctx, email)
	if err != nil {
		return "", err
	}

	if workspaceID != "" {
		if !s.profile.SaaS && !isMember {
			// Self-hosted, new user joining the singleton workspace — add as member.
			if _, err := s.store.PatchWorkspaceIamPolicy(ctx, &store.PatchIamPolicyMessage{
				Workspace: workspaceID,
				Member:    common.FormatUserEmail(email),
				Roles:     []string{common.FormatRole(store.WorkspaceMemberRole)},
			}); err != nil {
				return "", errors.Wrapf(err, "failed to add user to workspace")
			}
		}
		return workspaceID, nil
	}

	// Step 2: No existing workspace — create a new one with the user as admin.
	wsID, err := common.RandomString(16)
	if err != nil {
		return "", errors.Wrap(err, "failed to generate workspace ID")
	}
	ws, err := s.store.CreateWorkspace(ctx, &store.WorkspaceMessage{
		ResourceID:         wsID,
		Payload:            &storepb.WorkspacePayload{Title: "Default workspace"},
		AdditionalSettings: s.getAdditionalWorkspaceSettings(),
	}, email)
	if err != nil {
		return "", errors.Wrapf(err, "failed to create workspace")
	}

	return ws.ResourceID, nil
}

// Logout is the auth logout method.
func (s *AuthService) Logout(ctx context.Context, req *connect.Request[v1pb.LogoutRequest]) (*connect.Response[emptypb.Empty], error) {