Personal accounts

src/app/api/onboarding/route.ts

@@ -10,6 +10,7 @@ import {
 import { getTenant, listTenants } from "@/lib/k8s";
 import { sendAdminNotificationEmail } from "@/lib/email";
 import { encryptSecrets } from "@/lib/crypto";
+import { isPersonalOrgName } from "@/lib/personal-org";
 import type { OnboardingInput, PiecedTenant, TenantRequest } from "@/types";
 import { z } from "zod";
 
@@ -176,6 +177,16 @@ export async function POST(request: Request) {
   // company line in favour of the recorded company name.
   const prior = await getMostRecentApprovedRequestForOrg(user.orgId);
 
+  // Slice 4: detect personal-account orgs by the canonical " (Personal)"
+  // suffix on the ZITADEL org name. Set at registration, stable for the
+  // lifetime of the org. Persisted on the row so admin views and the
+  // approve handler don't have to re-derive it.
+  //
+  // If any prior row has is_personal set, prefer that — it's the same
+  // org and the value can't change. (The prior-row check is defensive;
+  // the org-name check should agree.)
+  const isPersonal = prior?.isPersonal ?? isPersonalOrgName(user.orgName);
+
   // Encrypt package secrets if provided
   let encryptedSecrets: Buffer | undefined;
   if (input.packageSecrets && Object.keys(input.packageSecrets).length > 0) {
@@ -212,6 +223,7 @@ export async function POST(request: Request) {
     billingAddress,
     billingNotes,
     encryptedSecrets,
+    isPersonal,
   });
 
   // Notify admin about the new request. For follow-up instances, include