chore: auto enroll, custom domain improvement, course pricing style improv.

apps/api/src/routes/organization/organization.ts

@@ -48,6 +48,7 @@ import { Hono } from '@api/utils/hono';
 import { ROLE } from '@cio/utils/constants';
 import { TOrganization } from '@db/types';
 import { assetsRouter } from '@api/routes/organization/assets';
+import { autoEnrollStudent } from '@api/services/organization/auto-enroll';
 import { organizationAiTutorRouter } from '@api/routes/organization/ai-tutor';
 import { authMiddleware } from '@api/middlewares/auth';
 import { authOrApiKeyMiddleware } from '@api/middlewares/auth-or-api-key';
@@ -115,6 +116,28 @@ export const organizationRouter = new Hono()
    * Gets organization team members (non-students)
    * Requires authentication
    */
+  /**
+   * POST /organization/auto-enroll-student
+   * Idempotently enrolls the authenticated user as a STUDENT in the org
+   * identified by the `cio-org-id` header. Called by the dashboard's
+   * `setupApp` after a user authenticates on a tenant site they aren't a
+   * member of yet. Respects `disableSignup` and `inviteOnly` policies.
+   */
+  .post('/auto-enroll-student', authMiddleware, async (c) => {
+    try {
+      const user = c.get('user')!;
+      const orgId = c.req.header('cio-org-id');
+
+      if (!orgId) {
+        return c.json({ success: false, error: 'Organization ID is required', code: 'ORG_ID_REQUIRED' }, 400);
+      }
+
+      const result = await autoEnrollStudent(user.id, orgId);
+      return c.json({ success: true, data: result }, 200);
+    } catch (error) {
+      return handleError(c, error, 'Failed to auto-enroll student');
+    }
+  })
   .get('/team', authMiddleware, orgTeamMemberMiddleware, async (c) => {
     try {
       const orgId = c.req.header('cio-org-id')!;

apps/api/src/services/organization/auto-enroll.ts

@@ -0,0 +1,68 @@
+import { AppError, ErrorCodes } from '@api/utils/errors';
+import {
+  createOrganizationMember,
+  getOrganizationById,
+  getOrganizationMemberIdByOrgAndProfile
+} from '@cio/db/queries/organization';
+
+import { ROLE } from '@cio/utils/constants';
+import { getProfileById } from '@cio/db/queries/auth';
+
+interface OrgSignupSettings {
+  signup?: {
+    inviteOnly?: boolean;
+  };
+}
+
+export interface AutoEnrollResult {
+  alreadyMember: boolean;
+}
+
+/**
+ * Auto-enroll the authenticated user as a STUDENT in the given org. Used by
+ * the dashboard when a newly-signed-in user lands on a tenant site they
+ * aren't yet a member of (free-tier `<org>.classroomio.school` or a verified
+ * BYOD domain).
+ *
+ * Idempotent: existing members get an `alreadyMember: true` no-op so invited
+ * admins/tutors don't get downgraded.
+ *
+ * Respects the same org policies as `signupGuard` does for email/password
+ * signups: `disableSignup` and `settings.signup.inviteOnly` both block the
+ * insert.
+ */
+export async function autoEnrollStudent(userId: string, orgId: string): Promise<AutoEnrollResult> {
+  const existingMemberId = await getOrganizationMemberIdByOrgAndProfile(orgId, userId);
+  if (existingMemberId) {
+    return { alreadyMember: true };
+  }
+
+  const organization = await getOrganizationById(orgId);
+  if (!organization) {
+    throw new AppError('Organization not found', ErrorCodes.NOT_FOUND, 404);
+  }
+
+  if (organization.disableSignup) {
+    throw new AppError('Signup is disabled for this organization', ErrorCodes.FORBIDDEN, 403);
+  }
+
+  const settings = organization.settings as OrgSignupSettings | null;
+  if (settings?.signup?.inviteOnly) {
+    throw new AppError('This organization requires an invitation to join', ErrorCodes.FORBIDDEN, 403);
+  }
+
+  const profile = await getProfileById(userId);
+  if (!profile?.email) {
+    throw new AppError('Profile email not found', ErrorCodes.NOT_FOUND, 404);
+  }
+
+  await createOrganizationMember({
+    organizationId: orgId,
+    profileId: userId,
+    email: profile.email,
+    roleId: ROLE.STUDENT,
+    verified: true
+  });
+
+  return { alreadyMember: false };
+}