feat: gated domain signup spaces and migration preflight (LM-16549)

[bradmb]

Adds opt-in signup domain assignment to an existing private space inside the configured default organization. Exact matching domains receive ordinary space membership; other domains retain existing behavior. Invalid/missing/foreign/public targets fail the signup transaction. Routing stays disabled until an operator provides a recorded live space ID.

Includes a generic dry-run-first provisioning/membership migration tool. It validates target identity and private settings, preserves existing roles, serializes apply runs, and removes only explicitly selected ordinary source-space memberships. Customer identifiers, production IDs, and membership details are not embedded.

Tracks LM-16549. This PR is ready for code review. Provisioning, migration, merge, and deployment remain blocked on the rollout decisions below.

Validation:

• 64 scoped Vitest tests passed (signup configuration, adapter, video policy).
• 6 migration unit tests passed; CLI syntax check passed.
• Database and environment package TypeScript checks passed.
• Scoped Biome checks passed; rollout Markdown manually inspected (Biome ignores Markdown).
• Final-head CI passed on 20f390a, including full Typecheck, Biome format/lint, and Cargo format. Socket Security passed. CodeRabbit completed on the same head with no actionable comments and a passing status.
• CodeRabbit's generic docstring-coverage warning remains intentionally unaddressed because AGENTS.md prohibits comments/docstrings that restate function behavior. No inline review findings remain.

Rollout blockers:

• Organization-shared videos and organization-public spaces remain accessible independently of private-space membership. The added characterization matrix demonstrates this behavior; it does not prove isolation.
• Decide the required organization-wide content, public-link, and staff/admin access policy, then implement and verify all relevant dashboard/search/folder/direct-video/media/download/sharing paths before enabling routing.
• Pending invitations preserve existing handling and bypass automatic assignment. Decide/reconcile invitation routing separately.
• Provision only after separate live-change authorization and access verification; retain the live target ID and customer inventory privately. No live database changes were performed.

See deploy/domain-space-rollout.md for configuration, dry-run inputs, acceptance matrix, rollout sequence, and rollback limits.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 1b1e296d-a8bb-483e-8433-26bb8c669432

📥 Commits

Reviewing files that changed from the base of the PR and between 6fd9d8c and 20f390a.

📒 Files selected for processing (10)

• apps/web/__tests__/unit/signup-space.test.ts
• apps/web/__tests__/unit/take3-signup-organization.test.ts
• apps/web/__tests__/unit/videos-policy.test.ts
• deploy/domain-space-rollout.md
• packages/database/auth/drizzle-adapter.ts
• packages/database/auth/signup-space.ts
• packages/env/server.ts
• scripts/domain-space-migration.mjs
• scripts/domain-space-migration.test.mjs
• scripts/migrate-domain-space.mjs

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

---

📝 Walkthrough

Walkthrough

The change adds opt-in exact-domain signup routing to existing private spaces in the default signup organization. It also adds a dry-run and apply migration, a CLI for that migration, and rollout guidance describing configuration, access limits, verification, and rollback.

Changes

Domain-based space assignment

Layer / File(s)	Summary
Resolve and apply signup space assignment packages/env/server.ts, packages/database/auth/signup-space.ts, packages/database/auth/drizzle-adapter.ts, apps/web/__tests__/unit/signup-space.test.ts, apps/web/__tests__/unit/take3-signup-organization.test.ts, apps/web/__tests__/unit/videos-policy.test.ts	The server environment accepts a domain-to-space mapping. Signup resolves exact, normalized domain matches and validates the selected space against the default organization and private-space settings before adding membership. Tests cover mapping, signup outcomes, and video access policy expectations.
Plan and apply domain membership migration scripts/domain-space-migration.mjs, scripts/domain-space-migration.test.mjs	The migration validates its options and database records, then plans membership additions and removals for matching organization members. Dry runs roll back after producing a plan; apply mode creates a missing target and updates memberships. Tests cover dry runs, apply, reruns, collisions, and rejected source memberships.
Invoke migration and document rollout scripts/migrate-domain-space.mjs, deploy/domain-space-rollout.md	The CLI reads migration options, connects to MySQL, selects dry-run or apply mode, prints the plan, and closes the connection. The rollout guide documents configuration, migration safeguards, access limits, verification, and rollback.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant SignupRequest
  participant DrizzleAdapter
  participant getSignupSpaceId
  participant Database
  SignupRequest->>DrizzleAdapter: createUser with email
  DrizzleAdapter->>getSignupSpaceId: resolve configured domain mapping
  getSignupSpaceId-->>DrizzleAdapter: SpaceId or null
  DrizzleAdapter->>Database: validate space and default organization
  DrizzleAdapter->>Database: add user to space as member

Loading

Merge Risk: ⚪ Minimal · up to 20f39

No concrete merge-blocking issue is established. Keep signup routing disabled until provisioning and access verification are complete; private-space membership alone does not provide organization-wide content isolation.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 6 functions across 9 files. (1 skipped: 1 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the two main changes: gated domain-based signup spaces and migration preflight tooling.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 6 functions across 9 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

🔍 Devin Review: 1 flag

Not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)