MCM-02 — Customer Self-Signup

← Back to MCM Nexus overview

As a prospective Customer User,
I want to sign up for MCM Nexus — whether I start on the public marketing site or directly on the Nexus portal — with my own company email,
so that I can start exploring MCM, either as the first person from my organization or by joining teammates who already signed up.

Acceptance Criteria

• Signup is available from two entry points: the public marketing site (mcm-website, mcm.revdau.ai) and Nexus's own /signup page.
• The mcm-website form collects: Name, Email, Company Name, Phone Number, and optionally Use-Case and "When can we connect next".
• Nexus's own /signup form collects the same fields except "When can we connect next" — a visitor already on the Nexus portal doesn't need a sales-callback prompt.
• Neither form collects a password — the customer no longer chooses their own password at signup time.
• Public/free email providers (e.g. Gmail, Outlook/Hotmail/Live, Yahoo, iCloud, AOL, ProtonMail) are rejected at signup with a clear "please use your company email address" error, on both entry points — see Technical Design for the exact list.
• The organization is identified by the signup email's domain, not by the freeform Company Name text typed into the form — this domain must be unique across Nexus.
• If no organization exists yet for that domain: one is created immediately (status CUSTOMER, source WEBSITE_LEAD or SELF_SIGNUP depending on entry point) and this user becomes its Owner — same instant Keycloak-identity-plus-temporary-password-email flow as before, unchanged.
• If an organization already exists for that domain: no account is created yet. Instead a join request is recorded and the organization's Owner is notified to approve or reject it — see MCM-29 — Organization Join Requests for that flow.
• The Owner logs in with the temporary password and is forced to set a new password before reaching the dashboard, which shows "No active subscription" and a clear call-to-action to raise a request.
• The temporary password expires 24 hours after issuance; if the Owner hasn't logged in by then, it no longer works.
• If the Keycloak identity is created but the subsequent database write fails, the Keycloak identity is rolled back so the two systems never drift out of sync.

Technical Design

mcm-nexus/backend's SignupController/SignupService first rejects the request if the email's domain matches a fixed blocklist (gmail.com, googlemail.com, outlook.com, hotmail.com, live.com, yahoo.com and regional variants, icloud.com, aol.com, protonmail.com), then looks up Organization by its new unique domain column (derived from the email, not the freeform company name). No match creates the Keycloak identity, Organization, Owner User (OrgRole.OWNER), and NOT_ACTIVATED License in one @Transactional call exactly as before — temporary password generated, Keycloak credential temporary=true, welcome email (see Email Template below) sent through the same capability MCM-11 centralizes. A match instead creates an OrgJoinRequest and notifies the Owner — no Keycloak/User/License is created at signup time in that case; see MCM-29 for that path. The mcm-website form still calls POST /api/signup cross-origin, so Nexus's CORS policy stays scoped to the mcm.revdau.ai origin for this endpoint.

Email Template

Sent immediately after a new-organization signup (Owner path only — the existing-organization/join-request path sends no email to the requester at signup time; see MCM-29):

Subject: Welcome to MCM Nexus — Set Your Password

Dear <Customer>,

Greetings from the MCM Team!

You've successfully signed up for MCM Nexus as the Owner for <Company Name>. Use the temporary password below to log in and set your own password.

## Your Login Details

Portal: https://nexus.mcm.revdau.ai/login
Email: <Customer Email>
Temporary Password: <generated password>

This temporary password expires in 24 hours — please log in and set your new password before then.

You'll be asked to set a new password the first time you log in.

## Next Steps

Once you're in, your dashboard will show "No active subscription" — from there you can request a trial or purchase to get your MCM instance running.

If you have any questions, our support team is available to help.

Support Email: mcm@revdau.ai
Documentation Portal: https://mcm.revdau.ai/docs/

Thank you for choosing MCM.

Best Regards,
MCM Team

UI / Frontend Changes

• New signup page on mcm-website (mcm.revdau.ai): public form collecting Name, Email, Company Name, Phone Number, and optionally Use-Case and "When can we connect next", submitting directly to Nexus's POST /api/signup.
• Nexus's own /signup page: remove the Password field and the "When can we connect next" field; keep Name, Email, Company Name, Phone Number, and optional Use-Case.
• Inline validation on the Email field for both the public-provider block and the "please use your company email" case, rather than a generic failure banner.
• New-organization path: "Check your email" confirmation screen after submit, then a forced "Set a new password" screen on first login before reaching the dashboard (which shows "No active subscription" and a call-to-action to raise a request).
• Existing-organization path: a distinct "Your request has been sent to your organization's Nexus owner for approval" confirmation screen — no email is sent to this requester at signup time (see MCM-29).
• Submit button shows a loading state while the domain check and Keycloak/database writes complete.
• Form-level error state if the Keycloak identity write succeeds but the follow-up database write fails and rollback occurs (new-organization path only).

Out of Scope

• An admin-editable blocklist — the public-provider list is a fixed set for this iteration.