Introduce project provisioning on user registration

Author: gmelikov

exordos/manifests/ecosystem_realm.yaml.j2

@@ -63,3 +63,12 @@ resources:
       setter:
         kind: selector
         selector_strategy: latest
+
+    # Enable auto-provisioning of personal workspace (org + project) on email confirmation
+    registration_auto_provision:
+      uuid: "9eeb513b-9314-40a0-b599-32295a967400"
+      name: "registration_auto_provision"
+      project_id: "12345678-c625-4fee-81d5-f691897b8142"
+      setter:
+        kind: selector
+        selector_strategy: latest

exordos_core/bootstrap/defaults.py

@@ -476,6 +476,31 @@ def set_disable_telemetry_var(spec: dict[str, tp.Any]) -> bool:
     return True
 
 
+def set_registration_auto_provision_var(spec: dict[str, tp.Any]) -> bool:
+    val_uuid = sys_uuid.UUID("5e0b40b7-9a12-41e4-9d98-0d39e60a76b2")
+    existing_value = vs_models.Value.objects.get_one_or_none(
+        filters={"uuid": dm_filters.EQ(val_uuid)}
+    )
+    if existing_value:
+        LOG.info("Registration auto provision variable already exists")
+        return True
+
+    LOG.info("Set registration_auto_provision variable")
+    reg_auto_provision_var = vs_models.Variable.objects.get_one_or_none(
+        filters={"uuid": dm_filters.EQ(c.VAR_REGISTRATION_AUTO_PROVISION_UUID)}
+    )
+    if not reg_auto_provision_var:
+        return False
+
+    vs_models.Value(
+        uuid=val_uuid,
+        variable=reg_auto_provision_var,
+        value=spec.get("registration_auto_provision", False),
+        project_id=c.EM_HIDDEN_PROJECT_ID,
+    ).insert()
+    return True
+
+
 def set_realm_uuid_var(spec: dict[str, tp.Any]) -> bool:
     val_uuid = sys_uuid.UUID("f134c97f-bb4d-4d67-9527-8c90e2f04f8c")
     existing_value = vs_models.Value.objects.get_one_or_none(

exordos_core/cmd/bootstrap.py

@@ -323,6 +323,10 @@ def _set_defaults_vs(spec: dict[str, tp.Any]):
         {"func": bootstrap_defaults.set_core_data_disk_size_var, "args": [spec]},
         {"func": bootstrap_defaults.set_ecosystem_endpoint_var, "args": [spec]},
         {"func": bootstrap_defaults.set_disable_telemetry_var, "args": [spec]},
+        {
+            "func": bootstrap_defaults.set_registration_auto_provision_var,
+            "args": [spec],
+        },
         {"func": bootstrap_defaults.set_realm_uuid_var, "args": [spec]},
         {"func": bootstrap_defaults.set_realm_secret_var, "args": [spec]},
         {"func": bootstrap_defaults.set_realm_access_token_var, "args": [spec]},

exordos_core/common/constants.py

@@ -91,6 +91,9 @@
 VAR_HS256_JWKS_ENCRYPTION_KEY_UUID = sys_uuid.UUID(
     "c371a647-e1a6-4bec-bef2-a50041bc5af2"
 )
+VAR_REGISTRATION_AUTO_PROVISION_UUID = sys_uuid.UUID(
+    "9eeb513b-9314-40a0-b599-32295a967400"
+)
 
 REPOSITORY_URL = "https://repo.exordos.com"
 ELEMENTS_PATH = "exordos-elements"

exordos_core/tests/functional/restapi/iam/test_users.py

@@ -15,6 +15,7 @@
 #    under the License.
 import contextlib
 import datetime
+from unittest import mock
 
 from bazooka import exceptions as bazooka_exc
 from gcl_iam.tests.functional import clients as iam_clients
@@ -416,6 +417,59 @@ def test_confirm_email_expired_code_400_error(
                 code=str(user.confirmation_code),
             )
 
+    def test_confirm_email_provisions_workspace_when_enabled(
+        self,
+        user_api_noauth_client,
+        auth_test1_user,
+    ):
+        user = iam_models.User.objects.get_one(filters={"uuid": auth_test1_user.uuid})
+        user.email_verified = False
+        user.create_confirmation_code()
+        user.save()
+
+        with mock.patch(
+            "exordos_core.user_api.iam.api.controllers.UserController"
+            "._is_auto_provision_enabled",
+            return_value=True,
+        ):
+            client = user_api_noauth_client()
+            client.confirm_email(
+                user_uuid=auth_test1_user.uuid,
+                code=str(user.confirmation_code),
+            )
+
+        org = iam_models.Organization.get_default(user=user)
+        assert org is not None
+        assert org.name == user.name
+
+        project = iam_models.Project.get_default(user=user, organization=org)
+        assert project is not None
+        assert project.name == "default"
+
+    def test_confirm_email_no_provisioning_by_default(
+        self,
+        user_api_noauth_client,
+        auth_test1_user,
+    ):
+        user = iam_models.User.objects.get_one(filters={"uuid": auth_test1_user.uuid})
+        user.email_verified = False
+        user.create_confirmation_code()
+        user.save()
+
+        with mock.patch(
+            "exordos_core.user_api.iam.api.controllers.UserController"
+            "._is_auto_provision_enabled",
+            return_value=False,
+        ):
+            client = user_api_noauth_client()
+            client.confirm_email(
+                user_uuid=auth_test1_user.uuid,
+                code=str(user.confirmation_code),
+            )
+
+        org = iam_models.Organization.get_default(user=user)
+        assert org is None
+
     def test_delete_my_user_test1_auth_success(self, user_api_client, auth_test1_user):
         client = user_api_client(
             auth_test1_user,

exordos_core/tests/unit/user_api/iam/test_provisioning.py

@@ -0,0 +1,110 @@
+#    Copyright 2025-2026 Genesis Corporation.
+#
+#    All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+from unittest import mock
+import uuid
+
+import pytest
+
+from exordos_core.user_api.iam import constants as iam_c
+from exordos_core.user_api.iam.dm import models
+
+
+class TestProvisionPersonalWorkspace:
+    @pytest.fixture
+    def user(self):
+        u = models.User.__new__(models.User)
+        u.name = "testuser"
+        u.uuid = uuid.uuid4()
+        return u
+
+    @pytest.fixture
+    def org(self):
+        o = mock.MagicMock()
+        o.uuid = uuid.uuid4()
+        return o
+
+    @pytest.fixture
+    def project(self):
+        p = mock.MagicMock()
+        p.uuid = uuid.uuid4()
+        return p
+
+    def test_creates_org_with_username_as_name(self, user, org, project):
+        with (
+            mock.patch.object(models, "Organization") as MockOrg,
+            mock.patch.object(models, "OrganizationMember"),
+            mock.patch.object(models, "Project") as MockProject,
+        ):
+            MockOrg.return_value = org
+            MockProject.return_value = project
+
+            user.provision_personal_workspace()
+
+            MockOrg.assert_called_once_with(
+                name=user.name,
+                description="Personal workspace",
+            )
+            org.insert.assert_called_once()
+
+    def test_assigns_user_as_org_owner(self, user, org, project):
+        with (
+            mock.patch.object(models, "Organization") as MockOrg,
+            mock.patch.object(models, "OrganizationMember") as MockMember,
+            mock.patch.object(models, "Project") as MockProject,
+        ):
+            MockOrg.return_value = org
+            MockProject.return_value = project
+
+            user.provision_personal_workspace()
+
+            MockMember.assert_called_once_with(
+                organization=org,
+                user=user,
+                role=iam_c.OrganizationRole.OWNER.value,
+            )
+            MockMember.return_value.insert.assert_called_once()
+
+    def test_creates_default_project_in_org(self, user, org, project):
+        with (
+            mock.patch.object(models, "Organization") as MockOrg,
+            mock.patch.object(models, "OrganizationMember"),
+            mock.patch.object(models, "Project") as MockProject,
+        ):
+            MockOrg.return_value = org
+            MockProject.return_value = project
+
+            user.provision_personal_workspace()
+
+            MockProject.assert_called_once_with(
+                name="default",
+                description="Default project",
+                organization=org,
+            )
+            project.insert.assert_called_once()
+
+    def test_calls_add_owner_with_self(self, user, org, project):
+        with (
+            mock.patch.object(models, "Organization") as MockOrg,
+            mock.patch.object(models, "OrganizationMember"),
+            mock.patch.object(models, "Project") as MockProject,
+        ):
+            MockOrg.return_value = org
+            MockProject.return_value = project
+
+            user.provision_personal_workspace()
+
+            project.add_owner.assert_called_once_with(user)

exordos_core/user_api/iam/api/controllers.py

@@ -40,11 +40,13 @@
 from restalchemy.dm import filters as ra_filters
 from restalchemy.openapi import utils as oa_utils
 
+from exordos_core.common import constants as common_c
 from exordos_core.user_api.iam import constants as c
 from exordos_core.user_api.iam import exceptions as iam_e
 from exordos_core.user_api.iam.api import openapi_specs as oa_specs
 from exordos_core.user_api.iam.clients import idp
 from exordos_core.user_api.iam.dm import models
+from exordos_core.vs.dm import models as vs_models
 
 LOG = logging.getLogger(__name__)
 
@@ -294,19 +296,46 @@ def resend_email_confirmation(self, resource):
         # Don't leak user data
         return None
 
+    def _is_auto_provision_enabled(self) -> bool:
+        var = vs_models.Variable.objects.get_one_or_none(
+            filters={
+                "uuid": ra_filters.EQ(common_c.VAR_REGISTRATION_AUTO_PROVISION_UUID)
+            }
+        )
+        if not var or not var.value:
+            return False
+        return str(var.value).lower() in ("true", "1", "yes")
+
+    def _maybe_provision_workspace(self, user: models.User) -> None:
+        if not self._is_auto_provision_enabled():
+            return
+
+        # Lock the user row for the rest of the transaction so concurrent
+        # confirmation requests can't race past the get_default() check
+        # below and each provision a separate personal workspace.
+        locked_user = models.User.objects.get_one(
+            filters={"uuid": ra_filters.EQ(user.uuid)},
+            locked=True,
+        )
+        if models.Organization.get_default(user=locked_user) is not None:
+            return
+        locked_user.provision_personal_workspace()
+
     @actions.post
     def force_confirm_email(self, resource):
         rule = c.PERMISSION_USER_WRITE_ALL
         if not self.enforce(rule):
             raise iam_e.CanNotUpdateUser(uuid=resource.uuid, rule=rule)
 
         resource.confirm_email()
+        self._maybe_provision_workspace(resource)
         return None
 
     @actions.post
     def confirm_email(self, resource, code=None):
         code = code or self._req.params.get("code", "")
         resource.confirm_email_by_code(code)
+        self._maybe_provision_workspace(resource)
         return resource
 
     @oa_utils.extend_schema(**oa_specs.OA_SPEC_RESET_PASSWORD_USER)

exordos_core/user_api/iam/dm/models.py

@@ -439,6 +439,22 @@ def make_newcomer(self):
         role_binding.save()
         return role_binding
 
+    def provision_personal_workspace(self):
+        org = Organization(name=self.name, description="Personal workspace")
+        org.insert()
+        OrganizationMember(
+            organization=org,
+            user=self,
+            role=iam_c.OrganizationRole.OWNER.value,
+        ).insert()
+        project = Project(
+            name="default",
+            description="Default project",
+            organization=org,
+        )
+        project.insert()
+        project.add_owner(self)
+
     def get_my_roles(self):
         return RolesInfo(
             [