feat(mindspace): enforce PostgreSQL user data delivery

user-auth.mjs

@@ -138,6 +138,9 @@ export function createUserAuth(pool, options = {}) {
   let rechargeNotifier =
     typeof options.onRechargeNotification === 'function' ? options.onRechargeNotification : null;
   const subscriptionService = options.subscriptionService ?? null;
+  const provisionUserDataSpace = typeof options.provisionUserDataSpace === 'function'
+    ? options.provisionUserDataSpace
+    : null;
   const sessions = new Map();
   const loginFailures = new Map();
 
@@ -277,6 +280,14 @@ export function createUserAuth(pool, options = {}) {
     };
   };
 
+  const ensureUserDataSpaceForUser = async (user, workspaceRoot = null) => {
+    if (!provisionUserDataSpace || !user?.id || user.role === 'admin') return null;
+    return provisionUserDataSpace({
+      userId: user.id,
+      workspaceRoot: workspaceRoot ?? user.workspaceRoot ?? user.workspace_root,
+    });
+  };
+
   const listSkillGrants = async (subjectType, subjectId) => {
     const [rows] = await pool.query(
       `SELECT skill_name, enabled
@@ -463,6 +474,7 @@ export function createUserAuth(pool, options = {}) {
         quotaBytes: Number(process.env.MINDSPACE_FREE_QUOTA_BYTES ?? 5 * 1024 * 1024),
         now,
       });
+      await ensureUserDataSpaceForUser({ id: userId, role: 'user' }, workspaceRoot);
       await conn.commit();
       ensureWorkspace(workspaceRoot);
       ensureUserMemoryProfile(workspaceRoot, {
@@ -697,6 +709,28 @@ export function createUserAuth(pool, options = {}) {
     }
   };
 
+  const ensureAllUserDataSpaces = async () => {
+    if (!provisionUserDataSpace) return { provisioned: 0, errors: [] };
+    const [rows] = await pool.query(
+      `SELECT id, workspace_root FROM h5_users WHERE role = 'user' AND status = 'active'`,
+    );
+    let provisioned = 0;
+    const errors = [];
+    for (const row of rows) {
+      try {
+        await ensureUserDataSpaceForUser({ id: row.id, role: 'user' }, row.workspace_root);
+        provisioned += 1;
+      } catch (error) {
+        errors.push({
+          userId: row.id,
+          code: error?.code ?? null,
+          message: error instanceof Error ? error.message : String(error),
+        });
+      }
+    }
+    return { provisioned, errors };
+  };
+
   const seedRoleSkillDefaults = async () => {
     const now = Date.now();
     for (const [name, enabled] of Object.entries(DEFAULT_USER_SKILLS)) {
@@ -941,6 +975,7 @@ export function createUserAuth(pool, options = {}) {
           quotaBytes: Number(process.env.MINDSPACE_FREE_QUOTA_BYTES ?? 5 * 1024 * 1024),
           now,
         });
+        await ensureUserDataSpaceForUser({ id: userId, role: 'user' }, root);
       }
       await conn.commit();
       ensureWorkspace(root);
@@ -2634,6 +2669,7 @@ export function createUserAuth(pool, options = {}) {
         quotaBytes: Number(process.env.MINDSPACE_FREE_QUOTA_BYTES ?? 5 * 1024 * 1024),
         now,
       });
+      await ensureUserDataSpaceForUser({ id: userId, role: 'user' }, workspaceRoot);
       await conn.commit();
       ensureWorkspace(workspaceRoot);
       ensureUserMemoryProfile(workspaceRoot, {
@@ -2940,6 +2976,7 @@ export function createUserAuth(pool, options = {}) {
     getUserPublishLayout,
     isPathAllowed,
     repairAllUserPublishDirs,
+    ensureAllUserDataSpaces,
     registerAgentSession,
     getSessionNode,
     getSessionTarget,