feat(auth): allow multiple orgs to claim the same email domain

[viktormarinho]

What is this contribution about?

Drops the UNIQUE constraint on organization_domains.domain so several orgs can opt into auto-join from the same corporate domain — useful when different teams at the same company set up independent orgs. The onboarding flow now renders an org picker when the domain matches more than one org, and POST /api/auth/custom/domain-join takes an explicit organizationSlug to disambiguate (returns 409 requiresSelection when omitted with >1 eligible match). /domain-setup no longer rejects when another org has the same domain; the storage-layer 23505 unique-violation handler and the dead "domain race" cleanup in setup are removed.

How to Test

1. Run migrations (bun run --cwd=apps/mesh migrate).
2. As user A (a@acme.test), onboard and create org "Acme" with auto-join enabled — claims acme.test.
3. As user B (b@acme.test), onboard and create a second org "Acme Labs" with auto-join enabled (previously blocked) — should succeed and claim acme.test alongside Acme.
4. As user C (c@acme.test), hit /onboarding: should see the picker listing both orgs, and joining either one redirects to that org.

Migration Notes

091-organization-domains-allow-multi drops organization_domains_domain_key and adds a non-unique organization_domains_domain_idx for the by-domain lookup path. Reversible.

Review Checklist

• PR title is clear and descriptive
• Changes are tested and working (auth route tests pass; UI flow not exercised in a browser)
• Documentation is updated (if needed)
• No breaking changes (existing single-claim orgs continue to work)

---

Summary by cubic

Allow multiple organizations to claim the same email domain. Onboarding now shows a picker when more than one org matches, and auto-join requires a chosen org in that case.

• New Features

  • Dropped UNIQUE on organization_domains.domain; added non-unique organization_domains_domain_idx.
  • GET /api/auth/custom/domain-lookup returns organizations: [] with all matches (id, name, slug, logo, autoJoinEnabled), including auto-join-disabled rows.
  • POST /api/auth/custom/domain-join accepts optional { organizationSlug }; joins the only eligible match when omitted, else returns 409 requiresSelection; rejects unverified/generic domains and disabled claims.
  • /api/auth/custom/domain-setup permits duplicate claims and redirects existing members to an org that already claims the domain.
  • Onboarding shows a multi-org picker and posts the slug; request now sets Content-Type: application/json.

• Bug Fixes

  • Added Playwright e2e coverage for the multi-org picker; DB fixture honors DATABASE_URL in CI and falls back to local embedded Postgres (walks up CWD for .deco/services/postgres/state.json); teardown removes only membership rows to avoid FK errors.
  • Updated agent-model-popover test to use the "Haiku 4.5" label to fix CI.

^{Written for commit cf39ef0. Summary will update on new commits. Review in cubic}

[github-actions]

🧪 Benchmark

Should we run the Virtual MCP strategy benchmark for this PR?

React with 👍 to run the benchmark.

Reaction	Action
👍	Run quick benchmark (10 & 128 tools)

Benchmark will run on the next push after you react.

[github-actions]

Release Options

Suggested: Minor (2.344.0) — based on feat: prefix

React with an emoji to override the release type:

Reaction	Type	Next Version
👍	Prerelease	2.343.6-alpha.1
🎉	Patch	2.343.6
❤️	Minor	2.344.0
🚀	Major	3.0.0

Current version: 2.343.5

Note: If multiple reactions exist, the smallest bump wins. If no reactions, the suggested bump is used (default: patch).

[cubic-dev-ai]

1 issue found across 7 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/mesh/migrations/091-organization-domains-allow-multi.ts">

<violation number="1" location="apps/mesh/migrations/091-organization-domains-allow-multi.ts:30">
P2: `down()` is not safely reversible after this migration is used: re-adding `UNIQUE (domain)` will fail when duplicate domains exist.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P2: down() is not safely reversible after this migration is used: re-adding UNIQUE (domain) will fail when duplicate domains exist.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/mesh/migrations/091-organization-domains-allow-multi.ts, line 30:

<comment>`down()` is not safely reversible after this migration is used: re-adding `UNIQUE (domain)` will fail when duplicate domains exist.</comment>

<file context>
@@ -0,0 +1,32 @@
+    .execute();
+  await sql`
+    ALTER TABLE organization_domains
+    ADD CONSTRAINT organization_domains_domain_key UNIQUE (domain)
+  `.execute(db);
+}
</file context>

[cubic-dev-ai]

1 issue found across 3 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/mesh/migrations/091-organization-domains-allow-multi.ts">

<violation number="1" location="apps/mesh/migrations/091-organization-domains-allow-multi.ts:30">
P2: `down()` is not safely reversible after this migration is used: re-adding `UNIQUE (domain)` will fail when duplicate domains exist.</violation>
</file>

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>