feat: remove default personal orgs from custom sso (#2741)

packages/prisma/migrations/20260504000000_add_allow_personal_organisations_to_auth_portal/migration.sql

@@ -0,0 +1,10 @@
+-- AlterTable
+-- Add the column with a temporary default of `true` so that all existing rows
+-- (representing organisations created before this feature) are backfilled to
+-- `true` — preserving the historical behaviour of creating personal
+-- organisations for SSO-provisioned users.
+ALTER TABLE "OrganisationAuthenticationPortal" ADD COLUMN "allowPersonalOrganisations" BOOLEAN NOT NULL DEFAULT true;
+
+-- Switch the column default to `false` so that any organisations created from
+-- now on opt out of personal-organisation creation by default.
+ALTER TABLE "OrganisationAuthenticationPortal" ALTER COLUMN "allowPersonalOrganisations" SET DEFAULT false;

packages/prisma/schema.prisma

@@ -1100,9 +1100,10 @@ model OrganisationAuthenticationPortal {
   clientSecret String @default("")
   wellKnownUrl String @default("")
 
-  defaultOrganisationRole OrganisationMemberRole @default(MEMBER)
-  autoProvisionUsers      Boolean                @default(true)
-  allowedDomains          String[]               @default([])
+  defaultOrganisationRole    OrganisationMemberRole @default(MEMBER)
+  autoProvisionUsers         Boolean                @default(true)
+  allowedDomains             String[]               @default([])
+  allowPersonalOrganisations Boolean                @default(false)
 }
 
 model Counter {