accountsConfig:
  db: myapp
  tenant-claim-name: org          # JWT carries "org" instead of "tenant"
  member-role-name: user          # keep existing ACL rules
  membership-endpoints-enabled: false   # /orgs-mgmt/* handles invitations

package com.example;

import org.restheart.accounts.spi.Membership;
import org.restheart.accounts.spi.MembershipProvider;
import org.restheart.accounts.spi.TenantRef;

import java.util.List;
import java.util.Optional;

public class OrgMembershipProvider implements MembershipProvider {

    // Receive your own DB client, config, etc. via constructor (from the Initializer below)

    @Override
    public TenantRef createInitialTeam(String userId, String orgName) {
        // Create the org document, add userId as owner, update the user document
        var orgId = myOrgCollection.insertOrg(orgName, userId);
        myUserCollection.setActiveOrg(userId, orgId);
        return new TenantRef(orgId, orgName);
    }

    @Override
    public boolean isMember(String userId, String orgId) {
        return myOrgCollection.hasMember(orgId, userId);
    }

    @Override
    public void addMember(String userId, String orgId, String role) {
        myOrgCollection.addMember(orgId, userId, role);
        // Set orgId as active if the user has no active org yet
        myUserCollection.setActiveOrgIfAbsent(userId, orgId);
    }

    @Override
    public Optional<Membership> activeMembership(String userId) {
        var user = myUserCollection.find(userId);
        if (user == null || user.org() == null) return Optional.empty();
        var org  = myOrgCollection.find(user.org());
        var role = org.memberRole(userId);
        return Optional.of(new Membership(user.org(), org.name(), role, true));
    }

    @Override
    public List<Membership> listMemberships(String userId) {
        var user      = myUserCollection.find(userId);
        if (user == null) return List.of();
        var activeOrg = user.org();
        return user.orgs().stream()
                .map(orgId -> {
                    var org  = myOrgCollection.find(orgId);
                    var role = org.memberRole(userId);
                    return new Membership(orgId, org.name(), role, orgId.equals(activeOrg));
                })
                .toList();
    }

    @Override
    public void setActiveMembership(String userId, String orgId) {
        if (!isMember(userId, orgId))
            throw new IllegalArgumentException("User is not a member of org " + orgId);
        myUserCollection.setActiveOrg(userId, orgId);
    }
}

package com.example;

import org.restheart.accounts.AccountsService;
import org.restheart.plugins.Initializer;
import org.restheart.plugins.Inject;
import org.restheart.plugins.RegisterPlugin;

@RegisterPlugin(name = "orgMembershipProvider", description = "Custom org membership provider")
public class OrgMembershipInitializer implements Initializer {

    @Inject("accountsService")
    private AccountsService accountsService;

    @Override
    public void init() {
        accountsService.registerMembershipProvider(new OrgMembershipProvider(/* ... */));
    }
}