fix(database): separate user lifecycle ownership from team membership (#287)

<!-- CURSOR_AGENT_PR_BODY_BEGIN -->
## Summary

Fixes #267

Align user/team storage with [ADR
024](docs/adrs/024-user-team-lifecycle-ownership.md):

- Replace `users.team_id` with nullable `lifecycle_owner_team_id` (NULL
= self-owned, set = team-owned)
- Add `users.status` (active/suspended/deactivated/pending_purge)
- Add `team_memberships` N:N table with membership status
- Add `teams.status` and lifecycle `Deactivate` methods on team/user
repositories
- Remove `ON DELETE CASCADE` on the user/team graph; lifecycle deletes
via repository policy
- Backfill existing `team_id` data in migration
`000011_user_team_lifecycle.sql` (Postgres + Spanner)

## Validation

- `go test -tags=postgres_integration
./internal/storage/database/repository/... -count=1`
- `corepack pnpm run check -- --only go`

## Release notes / changeset

`.changeset/user-team-lifecycle-storage.md` — `@zitadel/server` patch:
align user/team lifecycle storage with ADR 024.

## Notes

Closes #267

Branch merged with `main` before review fixes. Harness mutex fix landed
via #289.

Migration backfill maps legacy `users.team_id` to
`lifecycle_owner_team_id` as a conservative alpha default (old schema
required a team context, so self-serve vs enterprise provenance cannot
be distinguished retroactively). New creates stay self-owned unless
`LifecycleOwnerTeamID` is set.

Acceptance checklist:
- [x] Self-owned user survives team deletion
- [x] Team-owned user deactivated when owning team deleted
- [x] Deleting a user does not cascade-delete teams they created
- [x] No ON DELETE CASCADE on user/team graph
- [x] Team-owned users lose all memberships when owning team is
deactivated

<!-- CURSOR_AGENT_PR_BODY_END -->

<div><a
href="https://cursor.com/agents/bc-f52f2c82-7c40-4962-bf78-39a8915c3d00"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source
media="(prefers-color-scheme: light)"
srcset="https://cursor.com/assets/images/open-in-web-light.png"><img
alt="Open in Web" width="114" height="28"
src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a>&nbsp;<a
href="https://cursor.com/background-agent?bcId=bc-f52f2c82-7c40-4962-bf78-39a8915c3d00"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source
media="(prefers-color-scheme: light)"
srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img
alt="Open in Cursor" width="131" height="28"
src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a>&nbsp;</div>

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Silvan <adlerhurst@users.noreply.github.com>
Co-authored-by: Florian Forster <florian@zitadel.com>

Author: 3 people

.changeset/user-team-lifecycle-storage.md

@@ -0,0 +1,5 @@
+---
+"@zitadel/server": patch
+---
+
+Align user/team lifecycle storage with ADR 024: separate lifecycle ownership from team membership.

internal/api/integration_test/passkey_flow_test.go

@@ -89,11 +89,11 @@ func TestPasskeyFlowLogin(t *testing.T) {
 	decoyEmailAttr, err := domain.NewCreateAttribute("email", "pk-flow-test@example.com", domain.AttributeUniquenessUnspecified)
 	require.NoError(t, err)
 	require.NoError(t, userRepo.Create(t.Context(), db, &domain.CreateUser{
-		ProjectID:  decoyProject.ID,
-		SchemaURL:  userSchemaURL,
-		ID:         userID,
-		TeamID:     &decoyTeam.ID,
-		Attributes: []*domain.CreateAttribute{decoyEmailAttr},
+		ProjectID:               decoyProject.ID,
+		SchemaURL:               userSchemaURL,
+		ID:                      userID,
+		InitialMembershipTeamID: &decoyTeam.ID,
+		Attributes:              []*domain.CreateAttribute{decoyEmailAttr},
 	}))
 	decoyCred := virtualwebauthn.NewCredential(virtualwebauthn.KeyTypeEC2)
 	require.NoError(t, passkeyRepo.Create(t.Context(), db, &domain.CreateUserPasskey{
@@ -110,11 +110,11 @@ func TestPasskeyFlowLogin(t *testing.T) {
 	require.NoError(t, err)
 
 	require.NoError(t, userRepo.Create(t.Context(), db, &domain.CreateUser{
-		ProjectID:  project.ID,
-		SchemaURL:  userSchemaURL,
-		ID:         userID,
-		TeamID:     &team.ID,
-		Attributes: []*domain.CreateAttribute{emailAttr},
+		ProjectID:               project.ID,
+		SchemaURL:               userSchemaURL,
+		ID:                      userID,
+		InitialMembershipTeamID: &team.ID,
+		Attributes:              []*domain.CreateAttribute{emailAttr},
 	}))
 
 	require.NoError(t, passkeyRepo.Create(t.Context(), db, &domain.CreateUserPasskey{

internal/api/integration_test/password_flow_test.go

@@ -46,11 +46,11 @@ func TestPasswordLoginFlow(t *testing.T) {
 
 	userRepo := harness.EnsureUserRepo(t)
 	require.NoError(t, userRepo.Create(t.Context(), db, &domain.CreateUser{
-		ProjectID:  project.ID,
-		SchemaURL:  schemaURL,
-		ID:         userID,
-		TeamID:     &team.ID,
-		Attributes: []*domain.CreateAttribute{emailAttr},
+		ProjectID:               project.ID,
+		SchemaURL:               schemaURL,
+		ID:                      userID,
+		InitialMembershipTeamID: &team.ID,
+		Attributes:              []*domain.CreateAttribute{emailAttr},
 	}))
 
 	hasher := harness.EnsureHasher(t)
@@ -270,11 +270,11 @@ func TestPasswordRegisterFlow_DuplicateEmail(t *testing.T) {
 	emailAttr, err := domain.NewCreateAttribute("email", conflictEmail, domain.AttributeUniquenessProject)
 	require.NoError(t, err)
 	require.NoError(t, harness.EnsureUserRepo(t).Create(t.Context(), harness.EnsureDBPool(t), &domain.CreateUser{
-		ProjectID:  project.ID,
-		SchemaURL:  schemaURL,
-		ID:         "pwregister-conflict-seed",
-		TeamID:     &team.ID,
-		Attributes: []*domain.CreateAttribute{emailAttr},
+		ProjectID:               project.ID,
+		SchemaURL:               schemaURL,
+		ID:                      "pwregister-conflict-seed",
+		InitialMembershipTeamID: &team.ID,
+		Attributes:              []*domain.CreateAttribute{emailAttr},
 	}))
 
 	server := harness.EnsureTestServer(t)

internal/api/integration_test/registration_flow_test.go

@@ -78,11 +78,11 @@ func TestPasskeyRegistrationFlow(t *testing.T) {
 
 	userRepo := harness.EnsureUserRepo(t)
 	require.NoError(t, userRepo.Create(t.Context(), db, &domain.CreateUser{
-		ProjectID:  project.ID,
-		SchemaURL:  userSchemaURL,
-		ID:         userID,
-		TeamID:     &team.ID,
-		Attributes: []*domain.CreateAttribute{emailAttr},
+		ProjectID:               project.ID,
+		SchemaURL:               userSchemaURL,
+		ID:                      userID,
+		InitialMembershipTeamID: &team.ID,
+		Attributes:              []*domain.CreateAttribute{emailAttr},
 	}))
 
 	passkeyRepo := harness.EnsureUserPasskeyRepo(t)

internal/api/integration_test/user_list_test.go

@@ -64,11 +64,11 @@ func TestListUsers(t *testing.T) {
 			"email", fmt.Sprintf("list-%d@example.com", i), domain.AttributeUniquenessProject)
 		require.NoError(t, err)
 		require.NoError(t, userRepo.Create(t.Context(), db, &domain.CreateUser{
-			ProjectID:  project.ID,
-			SchemaURL:  schemaURL,
-			ID:         id,
-			TeamID:     &team.ID,
-			Attributes: []*domain.CreateAttribute{emailAttr},
+			ProjectID:               project.ID,
+			SchemaURL:               schemaURL,
+			ID:                      id,
+			InitialMembershipTeamID: &team.ID,
+			Attributes:              []*domain.CreateAttribute{emailAttr},
 		}))
 	}
 

internal/bootstrap/users/import.go

@@ -74,18 +74,18 @@ func importFile(
 		return err
 	}
 
-	var teamID *string
+	var participationTeamID *string
 	if doc.Header.TeamID != "" {
 		tid := doc.Header.TeamID
-		teamID = &tid
+		participationTeamID = &tid
 	}
 
 	if err := userRepo.Create(ctx, pool, &domain.CreateUser{
-		ProjectID:  doc.Header.ProjectID,
-		SchemaURL:  doc.Header.SchemaURL,
-		ID:         doc.Header.ID,
-		TeamID:     teamID,
-		Attributes: attrs,
+		ProjectID:               doc.Header.ProjectID,
+		SchemaURL:               doc.Header.SchemaURL,
+		ID:                      doc.Header.ID,
+		InitialMembershipTeamID: participationTeamID,
+		Attributes:              attrs,
 	}); err != nil {
 		return fmt.Errorf("create user: %w", err)
 	}