Introduce project provisioning on user registration

A personal workspace (organization + default project) is provisioned
when a user confirms their email, controlled per IAM client:

- IamClient gets a registration_auto_provision flag (enabled by
  default for new clients).
- The client the user registered through is recorded in
  users.registration_client. Anonymous (street) registrations are
  attributed to the default client.
- On (force_)confirm_email the workspace is provisioned if the
  recorded client has the flag enabled. Existing users have no
  registration client recorded and are not affected.

Migration 0003 downgrade is made tolerant to organizations that lost
their owner member (e.g. the user was deleted): fall back to any
member, then to the oldest user, instead of failing on SET NOT NULL.

Author: gmelikov

exordos_core/tests/functional/conftest.py

@@ -191,6 +191,15 @@ def user_api(user_api_service: test_utils.RestServiceTestCase):
     # TODO(slashburygin): setup_method(apply_migrations) should be called once, not every test. Should be fixed after squash migrations
     user_api_service.setup_method()
 
+    # Keep the legacy baseline for tests: no implicit personal workspace
+    # provisioning on email confirmation. Feature tests enable the flag
+    # explicitly.
+    default_client = iam_models.IamClient.objects.get_one(
+        filters={"uuid": dm_filters.EQ(sys_uuid.UUID(c.DEFAULT_CLIENT_UUID))}
+    )
+    default_client.registration_auto_provision = False
+    default_client.save()
+
     yield user_api_service
 
     # user_api_service.teardown_method()

exordos_core/tests/functional/restapi/iam/test_users.py

@@ -15,6 +15,7 @@
 #    under the License.
 import contextlib
 import datetime
+import uuid as sys_uuid
 
 from bazooka import exceptions as bazooka_exc
 from gcl_iam.tests.functional import clients as iam_clients
@@ -425,6 +426,109 @@ def test_confirm_email_expired_code_400_error(
                 code=str(user.confirmation_code),
             )
 
+    def _create_unconfirmed_user(self, user_api_client, auth_user_admin, username):
+        client = user_api_client(
+            auth_user_admin,
+            permissions=[
+                iam_c.PERMISSION_USER_CREATE,
+            ],
+        )
+        created = client.create_user(username=username, password="testtest")
+        user = iam_models.User.objects.get_one(filters={"uuid": created["uuid"]})
+        user.create_confirmation_code()
+        user.save()
+        return user
+
+    def test_create_user_records_registration_client(
+        self, user_api_client, auth_user_admin
+    ):
+        client = user_api_client(
+            auth_user_admin,
+            permissions=[
+                iam_c.PERMISSION_USER_CREATE,
+            ],
+        )
+
+        user = client.create_user(username="reg_client_user", password="testtest")
+
+        user_obj = iam_models.User.objects.get_one(filters={"uuid": user["uuid"]})
+        assert user_obj.registration_client == sys_uuid.UUID(
+            common_c.DEFAULT_CLIENT_UUID
+        )
+
+    def _set_default_client_auto_provision(self, enabled):
+        iam_client = iam_models.IamClient.objects.get_one(
+            filters={"uuid": sys_uuid.UUID(common_c.DEFAULT_CLIENT_UUID)}
+        )
+        iam_client.registration_auto_provision = enabled
+        iam_client.save()
+
+    def test_confirm_email_provisions_workspace_when_enabled_on_client(
+        self,
+        user_api_client,
+        user_api_noauth_client,
+        auth_user_admin,
+    ):
+        self._set_default_client_auto_provision(True)
+        user = self._create_unconfirmed_user(
+            user_api_client, auth_user_admin, "provision_user"
+        )
+
+        client = user_api_noauth_client()
+        client.confirm_email(
+            user_uuid=user.uuid,
+            code=str(user.confirmation_code),
+        )
+
+        org = iam_models.Organization.get_default(user=user)
+        assert org is not None
+        assert org.name == user.name
+
+        project = iam_models.Project.get_default(user=user, organization=org)
+        assert project is not None
+        assert project.name == "default"
+
+    def test_confirm_email_no_provisioning_without_registration_client(
+        self,
+        user_api_client,
+        user_api_noauth_client,
+        auth_user_admin,
+    ):
+        self._set_default_client_auto_provision(True)
+        user = self._create_unconfirmed_user(
+            user_api_client, auth_user_admin, "no_reg_client_user"
+        )
+        user.registration_client = None
+        user.save()
+
+        client = user_api_noauth_client()
+        client.confirm_email(
+            user_uuid=user.uuid,
+            code=str(user.confirmation_code),
+        )
+
+        org = iam_models.Organization.get_default(user=user)
+        assert org is None
+
+    def test_confirm_email_no_provisioning_when_disabled_on_client(
+        self,
+        user_api_client,
+        user_api_noauth_client,
+        auth_user_admin,
+    ):
+        user = self._create_unconfirmed_user(
+            user_api_client, auth_user_admin, "disabled_client_user"
+        )
+
+        client = user_api_noauth_client()
+        client.confirm_email(
+            user_uuid=user.uuid,
+            code=str(user.confirmation_code),
+        )
+
+        org = iam_models.Organization.get_default(user=user)
+        assert org is None
+
     def test_delete_my_user_test1_auth_success(self, user_api_client, auth_test1_user):
         client = user_api_client(
             auth_test1_user,
@@ -485,6 +589,7 @@ def test_fields_in_me_info_success(
             "email",
             "otp_enabled",
             "email_verified",
+            "registration_client",
             "type",
         ]
 

exordos_core/tests/unit/user_api/iam/test_provisioning.py

@@ -0,0 +1,110 @@
+#    Copyright 2025-2026 Genesis Corporation.
+#
+#    All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+from unittest import mock
+import uuid
+
+import pytest
+
+from exordos_core.user_api.iam import constants as iam_c
+from exordos_core.user_api.iam.dm import models
+
+
+class TestProvisionPersonalWorkspace:
+    @pytest.fixture
+    def user(self):
+        u = models.User.__new__(models.User)
+        u.name = "testuser"
+        u.uuid = uuid.uuid4()
+        return u
+
+    @pytest.fixture
+    def org(self):
+        o = mock.MagicMock()
+        o.uuid = uuid.uuid4()
+        return o
+
+    @pytest.fixture
+    def project(self):
+        p = mock.MagicMock()
+        p.uuid = uuid.uuid4()
+        return p
+
+    def test_creates_org_with_username_as_name(self, user, org, project):
+        with (
+            mock.patch.object(models, "Organization") as MockOrg,
+            mock.patch.object(models, "OrganizationMember"),
+            mock.patch.object(models, "Project") as MockProject,
+        ):
+            MockOrg.return_value = org
+            MockProject.return_value = project
+
+            user.provision_personal_workspace()
+
+            MockOrg.assert_called_once_with(
+                name=user.name,
+                description="Personal workspace",
+            )
+            org.insert.assert_called_once()
+
+    def test_assigns_user_as_org_owner(self, user, org, project):
+        with (
+            mock.patch.object(models, "Organization") as MockOrg,
+            mock.patch.object(models, "OrganizationMember") as MockMember,
+            mock.patch.object(models, "Project") as MockProject,
+        ):
+            MockOrg.return_value = org
+            MockProject.return_value = project
+
+            user.provision_personal_workspace()
+
+            MockMember.assert_called_once_with(
+                organization=org,
+                user=user,
+                role=iam_c.OrganizationRole.OWNER.value,
+            )
+            MockMember.return_value.insert.assert_called_once()
+
+    def test_creates_default_project_in_org(self, user, org, project):
+        with (
+            mock.patch.object(models, "Organization") as MockOrg,
+            mock.patch.object(models, "OrganizationMember"),
+            mock.patch.object(models, "Project") as MockProject,
+        ):
+            MockOrg.return_value = org
+            MockProject.return_value = project
+
+            user.provision_personal_workspace()
+
+            MockProject.assert_called_once_with(
+                name="default",
+                description="Default project",
+                organization=org,
+            )
+            project.insert.assert_called_once()
+
+    def test_calls_add_owner_with_self(self, user, org, project):
+        with (
+            mock.patch.object(models, "Organization") as MockOrg,
+            mock.patch.object(models, "OrganizationMember"),
+            mock.patch.object(models, "Project") as MockProject,
+        ):
+            MockOrg.return_value = org
+            MockProject.return_value = project
+
+            user.provision_personal_workspace()
+
+            project.add_owner.assert_called_once_with(user)

exordos_core/user_api/iam/api/controllers.py

@@ -17,6 +17,7 @@
 import errno
 import logging
 import mimetypes
+import uuid as sys_uuid
 from os import path as os_path
 import re
 import string
@@ -27,6 +28,7 @@
 from gcl_iam import rules
 from gcl_iam.api import controllers as iam_controllers
 from gcl_iam.api import field_perms as iam_fp
+from gcl_iam import exceptions as gcl_iam_e
 import jinja2
 import pyotp
 from restalchemy.api import actions
@@ -40,6 +42,7 @@
 from restalchemy.dm import filters as ra_filters
 from restalchemy.openapi import utils as oa_utils
 
+from exordos_core.common import constants as common_c
 from exordos_core.user_api.iam import constants as c
 from exordos_core.user_api.iam import exceptions as iam_e
 from exordos_core.user_api.iam.api import openapi_specs as oa_specs
@@ -190,6 +193,10 @@ def create(self, **kwargs):
         )
         self.validate_secret(kwargs)
         kwargs.pop("email_verified", None)
+        kwargs.pop("registration_client", None)
+        iam_client = self._get_request_iam_client()
+        if iam_client is not None:
+            kwargs["registration_client"] = iam_client.uuid
         user = super().create(**kwargs)
         app_endpoint = _get_app_endpoint(req=self._req)
         user.resend_confirmation_event(app_endpoint=app_endpoint)
@@ -211,6 +218,7 @@ def filter(self, filters, **kwargs):
     def update(self, uuid, **kwargs):
         self.validate_secret(kwargs)
         kwargs.pop("email_verified", None)
+        kwargs.pop("registration_client", None)
         is_me = models.User.me().uuid == uuid
         if is_me or self.enforce(c.PERMISSION_USER_WRITE_ALL):
             return super().update(uuid, **kwargs)
@@ -294,19 +302,58 @@ def resend_email_confirmation(self, resource):
         # Don't leak user data
         return None
 
+    def _get_request_iam_client(self) -> models.IamClient | None:
+        try:
+            return models.Token.my().iam_client
+        except gcl_iam_e.InvalidAuthTokenError:
+            # Anonymous registration (e.g. street sign-up) is not bound to
+            # a client token; attribute it to the default client.
+            return models.IamClient.objects.get_one_or_none(
+                filters={
+                    "uuid": ra_filters.EQ(
+                        sys_uuid.UUID(common_c.DEFAULT_CLIENT_UUID)
+                    )
+                }
+            )
+
+    def _is_auto_provision_enabled(self, user: models.User) -> bool:
+        if user.registration_client is None:
+            return False
+        client = models.IamClient.objects.get_one_or_none(
+            filters={"uuid": ra_filters.EQ(user.registration_client)}
+        )
+        return client is not None and client.registration_auto_provision
+
+    def _maybe_provision_workspace(self, user: models.User) -> None:
+        if not self._is_auto_provision_enabled(user):
+            return
+
+        # Lock the user row for the rest of the transaction so concurrent
+        # confirmation requests can't race past the get_default() check
+        # below and each provision a separate personal workspace.
+        locked_user = models.User.objects.get_one(
+            filters={"uuid": ra_filters.EQ(user.uuid)},
+            locked=True,
+        )
+        if models.Organization.get_default(user=locked_user) is not None:
+            return
+        locked_user.provision_personal_workspace()
+
     @actions.post
     def force_confirm_email(self, resource):
         rule = c.PERMISSION_USER_WRITE_ALL
         if not self.enforce(rule):
             raise iam_e.CanNotUpdateUser(uuid=resource.uuid, rule=rule)
 
         resource.confirm_email()
+        self._maybe_provision_workspace(resource)
         return None
 
     @actions.post
     def confirm_email(self, resource, code=None):
         code = code or self._req.params.get("code", "")
         resource.confirm_email_by_code(code)
+        self._maybe_provision_workspace(resource)
         return resource
 
     @oa_utils.extend_schema(**oa_specs.OA_SPEC_RESET_PASSWORD_USER)