refactor(dotcom): remove the groups_backend flag from production (tldraw#9418)

This is the next step in retiring the workspaces feature flags. It
removes `groups_backend` from production entirely — the logic that read
it, the value written to new users, and the now-dead migration tooling.
`groups_backend` is fully rolled out (every user is migrated and born
with a home workspace), so the legacy (`file_state`/`ownerId`-based)
branches it gated are dead, and new users no longer need it. Follows
tldraw#9405 and tldraw#9411 (the `groups_frontend` removal), both merged. Relates to
tldraw#8859.

**Preview deploy:** https://pr-9418-preview-deploy.tldraw.com/ — sign in
and exercise file/workspace flows (create, pin, open, remove, move,
accept invite) and the admin page. No flag setup needed; every account
is migrated.

### What changed

- Removed `isWorkspacesMigrated()` and collapsed every branch on it to
the migrated path: `mutators.ts` (`createFile`, `pinFile`/`unpinFile`,
`removeFileFromWorkspace`, `onEnterFile`) and `TldrawApp.ts`
(`getMyFiles`, `canCreateNewFile`, `isPinned`, `getFile`).
- Dropped the `assertUserHasFlag('groups_backend')` gates on the
workspace mutators.
- Removed the admin migrate-to-groups tooling (`/app/admin/user/migrate`
route + the `admin_migrateToGroups` durable-object method) and the
`acceptInvite` migration check.
- Stopped writing `groups_backend` at the three user-creation sites; new
users get `flags: ''`.
- Removed the redundant e2e groups-migration helpers (`migrateUser*`,
`isUserMigrated*`, `ensureGroupsReadyByEmail`) and their call sites.
Test users are born migrated via signup, so these were no-ops; the
`ensureGroupsReady` scenario helper keeps its navigation/sidebar setup,
only its migration call was dropped.
- Demoted `TlaFlags` to a `string` stub, keeping
`parseFlags`/`userHasFlag`/`hasFlag` so the next feature flag has
scaffolding.

### What's kept (deliberately)

- The `flags` column, the `TlaFlags` string stub, and
`parseFlags`/`userHasFlag`/`hasFlag` — retained so the next feature flag
has scaffolding (no schema migration needed).
- The `migrate_user_to_groups` SQL function. It lives in an applied
(immutable) migration and is now uncalled, so it stays as frozen
history.
- Dropping the `flags` column itself (a Postgres + Zero schema change)
is intentionally out of scope — we're keeping the column for future
flags.

### Decisions worth a reviewer's eye

- **Access control is intentionally untouched.**
`assertUserCanAccessFile` / `canUpdateFile` branch on the *file's* shape
(`ownerId` vs `owningGroupId`), not on the flag, so they're kept as
defensive fallbacks for any legacy `ownerId` files. We stop *producing*
legacy files but keep *tolerating* them.
- **New users get `flags: ''`.** Existing users' stored `groups_backend`
value is harmless — nothing reads it after this PR.
- **`assertNotMaxFiles` removed.** This server-side `createFile` limit
only ran on the legacy path and was already inert for migrated users;
the client-side limit in `canCreateNewFile` remains. If a
server-enforced per-workspace cap is wanted, that's a separate feature.

### Change type

- [x] `other` (internal refactor, no user-facing change)

### Test plan

1. On the preview deploy, sign in and confirm normal file/workspace
flows work: create, pin/unpin, open, remove, move between workspaces,
accept an invite.
2. Confirm the admin page loads with the "migrate user" action gone
(other sections intact).

- [x] Unit tests
- [x] End to end tests

### Code changes

| Section   | LOC change |
| --------- | ---------- |
| Core code | +45 / -171 |
| Tests     | +6 / -81   |
| Apps      | +22 / -174 |

Author: jsscclr

apps/dotcom/client/e2e/fixtures/Database.ts

@@ -1,6 +1,6 @@
 import fs from 'fs'
 import { Page } from '@playwright/test'
-import { DB, userHasFlag } from '@tldraw/dotcom-shared'
+import { DB } from '@tldraw/dotcom-shared'
 import { Kysely, PostgresDialect, sql } from 'kysely'
 import pg from 'pg'
 import { OTHER_USERS, USERS } from '../consts'
@@ -45,46 +45,6 @@ export class Database {
 		return dbUser.rows[0].id
 	}
 
-	/**
-	 * Check if a user is migrated to the groups model
-	 */
-	async isUserMigrated(isOther: boolean = false): Promise<boolean> {
-		return await this.isUserMigratedByEmail(this.getEmail(isOther))
-	}
-
-	async isUserMigratedByEmail(email: string): Promise<boolean> {
-		const id = await this.getUserIdByEmail(email)
-		if (!id) return false
-
-		const result = await sql<{
-			flags: string | null
-		}>`SELECT flags FROM public.user WHERE id = ${id}`.execute(db)
-
-		return userHasFlag(result.rows[0]?.flags, 'groups_backend')
-	}
-
-	/**
-	 * Migrate a user to the groups model
-	 */
-	async migrateUser(isOther: boolean = false): Promise<void> {
-		await this.migrateUserByEmail(this.getEmail(isOther))
-	}
-
-	async migrateUserByEmail(email: string): Promise<void> {
-		const id = await this.getUserIdByEmail(email)
-		if (!id) throw new Error(`User not found: ${email}`)
-		if (await this.isUserMigratedByEmail(email)) return
-
-		const inviteSecret = 'test' + Math.random().toString(36).substring(2, 15)
-
-		// Call the migration function
-		await sql`SELECT * FROM migrate_user_to_groups(${id}, ${inviteSecret})`.execute(db)
-	}
-
-	async ensureGroupsReadyByEmail(email: string): Promise<void> {
-		await this.migrateUserByEmail(email)
-	}
-
 	private async cleanUpUser(isOther: boolean) {
 		const fileName = getStorageStateFileName(this.parallelIndex, isOther ? 'suppy' : 'huppy')
 		if (!fs.existsSync(fileName)) return

apps/dotcom/client/e2e/fixtures/scenario-test.ts

@@ -508,8 +508,8 @@ class DotcomScenario {
 			.slice(0, MAX_WORKSPACE_NAME_LENGTH)
 		const fileName = opts.fileName ?? this.name('workspace file')
 
-		await this.ensureGroupsReady(opts.owner)
-		await this.ensureGroupsReady(opts.member)
+		await this.goToAndOpenSidebar(opts.owner)
+		await this.goToAndOpenSidebar(opts.member)
 
 		if (!opts.member.email) throw new Error('Workspace member actor is not signed in')
 		const memberUserId = await this.database.getUserIdByEmail(opts.member.email)
@@ -596,10 +596,9 @@ class DotcomScenario {
 		)
 	}
 
-	async ensureGroupsReady(actor: DotcomActor) {
+	async goToAndOpenSidebar(actor: DotcomActor) {
 		if (!actor.email) throw new Error(`Actor ${actor.name} is not signed in`)
 
-		await this.database.ensureGroupsReadyByEmail(actor.email)
 		await actor.goto()
 		await actor.editor.ensureSidebarOpen()
 	}

apps/dotcom/client/e2e/tests/smoke/workspaces.spec.ts

@@ -10,8 +10,7 @@ import { expect, test } from '../../fixtures/tla-test'
 // otherwise most recent (creating one if it's empty) — and creating a
 // workspace switches to it.
 test.describe('workspaces', () => {
-	test.beforeEach(async ({ database, editor }) => {
-		await database.migrateUser()
+	test.beforeEach(async ({ editor }) => {
 		await editor.isLoaded()
 		await editor.ensureSidebarOpen()
 	})
@@ -423,7 +422,7 @@ test.describe('workspaces', () => {
 			await context.grantPermissions(['clipboard-read', 'clipboard-write'])
 		})
 
-		test('invite already member user to workspace', async ({ sidebar, browser, database }) => {
+		test('invite already member user to workspace', async ({ sidebar, browser }) => {
 			const workspaceName = getRandomName()
 			const fileName = getRandomName()
 			const homeFileName = getRandomName()
@@ -436,9 +435,6 @@ test.describe('workspaces', () => {
 
 			const inviteUrl = await sidebar.copyWorkspaceInviteLink(workspaceName)
 
-			// Migrate invitee to groups backend but not frontend (tests auto-enable)
-			await database.migrateUser(true)
-
 			const parallelIndex = test.info().parallelIndex
 			const { newSidebar, newEditor, newWorkspaceInviteDialog, newContext } = await openNewTab(
 				browser,
@@ -475,7 +471,6 @@ test.describe('workspaces', () => {
 		test('signing in through the invite dialog completes the workspace join', async ({
 			sidebar,
 			browser,
-			database,
 		}) => {
 			const workspaceName = getRandomName()
 			const fileName = getRandomName()
@@ -489,9 +484,6 @@ test.describe('workspaces', () => {
 
 			const inviteUrl = await sidebar.copyWorkspaceInviteLink(workspaceName)
 
-			// Migrate invitee to groups backend but not frontend (tests auto-enable)
-			await database.migrateUser(true)
-
 			const parallelIndex = test.info().parallelIndex
 			const { newPage, newSidebar, newEditor, newWorkspaceInviteDialog, newContext } =
 				await openNewTab(browser, {

apps/dotcom/client/e2e/tests/ui.scenario.spec.ts

@@ -128,7 +128,7 @@ test.describe('UI scenarios', () => {
 		const workspaceName = scenario.name('workspace nav')
 		const fileName = scenario.name('workspace movable file')
 
-		await scenario.ensureGroupsReady(owner)
+		await scenario.goToAndOpenSidebar(owner)
 		await scenario.createPersonalFile(owner, fileName)
 
 		await owner.sidebar.createWorkspace(workspaceName)
@@ -304,7 +304,7 @@ test.describe('UI scenarios', () => {
 		// Regression: the home workspace ("My workspace") used to render an empty dialog — the
 		// component returned null for it while the sidebar still opened the dialog, so the page
 		// just dimmed with no content. It's private: it can be renamed, but not shared or managed.
-		await scenario.ensureGroupsReady(owner)
+		await scenario.goToAndOpenSidebar(owner)
 		await owner.sidebar.switchToHomeWorkspace()
 		await owner.page.getByTestId('tla-sidebar-workspace-settings').click()
 
@@ -332,7 +332,7 @@ test.describe('UI scenarios', () => {
 		// Regression: the home workspace is renameable (the reason its settings dialog exists at
 		// all), so the rename must apply. Restore the name afterwards so later serial tests still
 		// see the original.
-		await scenario.ensureGroupsReady(owner)
+		await scenario.goToAndOpenSidebar(owner)
 		await owner.sidebar.switchToHomeWorkspace()
 		const originalName = await owner.page.getByTestId('tla-active-workspace-name').innerText()
 		const newName = scenario.name('home renamed')
@@ -356,7 +356,7 @@ test.describe('UI scenarios', () => {
 		const workspaceName = scenario.name('settings rename old')
 		const newWorkspaceName = scenario.name('settings rename new')
 
-		await scenario.ensureGroupsReady(owner)
+		await scenario.goToAndOpenSidebar(owner)
 		await owner.sidebar.createWorkspace(workspaceName)
 		await owner.sidebar.renameWorkspace(workspaceName, newWorkspaceName)
 

apps/dotcom/client/src/tla/app/TldrawApp.ts

@@ -58,8 +58,6 @@ import {
 	dataUrlToFile,
 	defaultUserPreferences,
 	getUserPreferences,
-	objectMapFromEntries,
-	objectMapKeys,
 	parseTldrawJsonFile,
 	react,
 	transact,
@@ -413,18 +411,9 @@ export class TldrawApp {
 		return this.getUserFlags().has(flag)
 	}
 
-	/**
-	 * Check if the user has been migrated to the new workspaces-based data model.
-	 * Users with the 'groups_backend' flag use group_file for access control and pinning.
-	 * Users without the flag use the legacy file_state-based approach.
-	 */
-	isWorkspacesMigrated() {
-		return this.hasFlag('groups_backend')
-	}
-
 	/**
 	 * Get the user's home workspace ID.
-	 * For migrated users, this is used to store shared files and pinned files.
+	 * Used to store shared files and pinned files.
 	 * The home workspace ID is the same as the user ID.
 	 */
 	getHomeWorkspaceId() {
@@ -543,12 +532,6 @@ export class TldrawApp {
 		return this.fileStates$.get()
 	}
 
-	lastRecentFileOrdering = null as null | Array<{
-		fileId: TlaFile['id']
-		isPinned: boolean
-		date: number
-	}>
-
 	// Store stable workspace file ordering for each workspace to prevent jumping when files are edited
 	lastWorkspaceFileOrderings = new Map<
 		string,
@@ -560,86 +543,7 @@ export class TldrawApp {
 
 	@computed({ isEqual })
 	getMyFiles() {
-		if (this.isWorkspacesMigrated()) {
-			return this.getWorkspaceFilesSorted(this.getHomeWorkspaceId())
-		}
-		const myFiles = objectMapFromEntries(this.getUserOwnFiles().map((f) => [f.id, f]))
-		const myStates = objectMapFromEntries(this.getUserFileStates().map((f) => [f.fileId, f]))
-
-		const myFileIds = new Set<string>([...objectMapKeys(myFiles), ...objectMapKeys(myStates)])
-		const myWorkspaceMemberships = this.getWorkspaceMemberships()
-
-		const nextRecentFileOrdering: {
-			fileId: TlaFile['id']
-			isPinned: boolean
-			date: number
-		}[] = []
-
-		for (const fileId of myFileIds) {
-			const file = myFiles[fileId]
-			let state: (typeof myStates)[string] | undefined = myStates[fileId]
-			if (!file) continue
-			if (file.isDeleted) continue
-
-			if (!state && !file.isDeleted && file.ownerId === this.userId) {
-				state = this.fileStates$.get().find((fs) => fs.fileId === fileId)
-			}
-			if (!state) {
-				// if the file is deleted, we don't want to show it in the recent files
-				continue
-			}
-
-			// if the file is in a workspace we have access to, we don't want to show it in my workspace
-			if (myWorkspaceMemberships.some((g) => g.groupFiles.some((gf) => gf.fileId === fileId))) {
-				continue
-			}
-
-			const existing = this.lastRecentFileOrdering?.find((f) => f.fileId === fileId)
-			const isPinned = state.isPinned ?? false
-
-			if (existing && existing.isPinned === isPinned) {
-				// Preserve existing entry to maintain ordering
-				nextRecentFileOrdering.push(existing)
-				continue
-			}
-
-			// For new entries or pinned status changes
-			const newEntry = {
-				fileId,
-				isPinned,
-				date: getFileRecencyDate(state, file),
-			}
-
-			// If this was previously unpinned and we have existing ordering,
-			// preserve its position in the unpinned section to avoid real-time reordering
-			if (!isPinned && existing && !existing.isPinned) {
-				// Keep the old date to preserve ordering in "My workspace"
-				newEntry.date = existing.date
-			}
-
-			nextRecentFileOrdering.push(newEntry)
-		}
-
-		// separate pinned and unpinned files
-		const pinnedFiles = nextRecentFileOrdering.filter((f) => f.isPinned)
-		const unpinnedFiles = nextRecentFileOrdering.filter((f) => !f.isPinned)
-
-		// sort pinned files by their pinnedIndex
-		pinnedFiles.sort((a, b) => {
-			// If neither has an index, sort by date (fallback)
-			return b.date - a.date
-		})
-
-		// sort unpinned files by date with most recent first
-		unpinnedFiles.sort((a, b) => b.date - a.date)
-
-		// combine: pinned files first, then unpinned
-		const sortedFiles = [...pinnedFiles, ...unpinnedFiles]
-
-		// stash the ordering for next time
-		this.lastRecentFileOrdering = sortedFiles
-
-		return sortedFiles
+		return this.getWorkspaceFilesSorted(this.getHomeWorkspaceId())
 	}
 
 	/**
@@ -672,23 +576,17 @@ export class TldrawApp {
 	}
 
 	private canCreateNewFile(workspaceId: string) {
-		if (this.isWorkspacesMigrated()) {
-			// Count only files the workspace actually owns — not guest files (shared files the
-			// user opened) or mislinked rows that getWorkspaceFilesSorted hides. Counting those
-			// would let the limit fire on files the user can neither see nor remove. For migrated
-			// users createFile runs no server-side file-limit check, so this is the only gate;
-			// scoping it to owned files keeps it to what the user can actually manage.
-			const membership = this.getWorkspaceMembership(workspaceId)
-			if (!membership) return true
-			const nonDeletedCount = membership.groupFiles.filter(
-				(gf) => gf.file && !gf.file.isDeleted && gf.file.owningGroupId === workspaceId
-			).length
-			return nonDeletedCount < this.config.maxNumberOfFiles
-		} else {
-			// For unmigrated users, count non-deleted files owned by the user
-			const nonDeletedCount = this.getUserOwnFiles().filter((f) => !f.isDeleted).length
-			return nonDeletedCount < this.config.maxNumberOfFiles
-		}
+		// Count only files the workspace actually owns — not guest files (shared files the
+		// user opened) or mislinked rows that getWorkspaceFilesSorted hides. Counting those
+		// would let the limit fire on files the user can neither see nor remove. createFile
+		// runs no server-side file-limit check, so this is the only gate; scoping it to owned
+		// files keeps it to what the user can actually manage.
+		const membership = this.getWorkspaceMembership(workspaceId)
+		if (!membership) return true
+		const nonDeletedCount = membership.groupFiles.filter(
+			(gf) => gf.file && !gf.file.isDeleted && gf.file.owningGroupId === workspaceId
+		).length
+		return nonDeletedCount < this.config.maxNumberOfFiles
 	}
 
 	private showMaxFilesToast() {
@@ -701,12 +599,7 @@ export class TldrawApp {
 	}
 
 	isPinned(fileId: string, workspaceId: string) {
-		if (this.isWorkspacesMigrated()) {
-			return this.getWorkspaceFilesSorted(workspaceId).some(
-				(f) => f.fileId === fileId && f.isPinned
-			)
-		}
-		return this.getFileState(fileId)?.isPinned ?? false
+		return this.getWorkspaceFilesSorted(workspaceId).some((f) => f.fileId === fileId && f.isPinned)
 	}
 
 	// A workspace's welcome file is seeded once, when the workspace is created. Its
@@ -902,14 +795,11 @@ export class TldrawApp {
 
 	getFile(fileId?: string): TlaFile | null {
 		if (!fileId) return null
-		if (this.isWorkspacesMigrated()) {
-			return (
-				this.getWorkspaceMemberships()
-					.find((g) => g.groupFiles.some((gf) => gf.fileId === fileId))
-					?.groupFiles.find((gf) => gf.fileId === fileId)?.file ?? null
-			)
-		}
-		return this.getUserOwnFiles().find((f) => f.id === fileId) ?? null
+		return (
+			this.getWorkspaceMemberships()
+				.find((g) => g.groupFiles.some((gf) => gf.fileId === fileId))
+				?.groupFiles.find((gf) => gf.fileId === fileId)?.file ?? null
+		)
 	}
 
 	canUpdateFile(fileId: string): boolean {