Fix workspace selection and secret modal layout

crates/crank-registry/tests/integration/workspace_access.rs

@@ -24,7 +24,8 @@ use crank_registry::{
     DescriptorMetadata, OperationSampleMetadata, PlatformApiKeyRecord, PostgresRegistry,
     PublishAgentRequest, PublishRequest, RegistryError, RegistryOperation, SampleKind,
     SaveAuthProfileRequest, SaveDescriptorMetadataRequest, SaveSampleMetadataRequest,
-    WorkspaceRecord, YamlImportJobCompletion, YamlImportJobId, YamlImportJobStatus,
+    UpdateWorkspaceRequest, WorkspaceRecord, YamlImportJobCompletion, YamlImportJobId,
+    YamlImportJobStatus,
 };
 
 fn test_workspace_id() -> WorkspaceId {
@@ -151,6 +152,85 @@ async fn manages_workspace_read_paths() {
     database.cleanup().await;
 }
 
+#[tokio::test]
+async fn lists_default_workspace_first_for_community_sessions() {
+    let database = TestDatabase::new().await;
+    let registry = database.registry().await;
+    let default_workspace = Workspace {
+        id: WorkspaceId::new("ws_default"),
+        slug: "solo".to_owned(),
+        display_name: "Solo".to_owned(),
+        status: crank_core::WorkspaceStatus::Active,
+        settings: json!({}),
+        created_at: timestamp("2026-03-25T12:00:00Z"),
+        updated_at: timestamp("2026-03-25T12:00:00Z"),
+    };
+    let legacy_workspace = Workspace {
+        id: WorkspaceId::new("ws_growth_lab"),
+        slug: "growth-lab".to_owned(),
+        display_name: "Growth Lab".to_owned(),
+        status: crank_core::WorkspaceStatus::Active,
+        settings: json!({}),
+        created_at: timestamp("2026-03-25T12:01:00Z"),
+        updated_at: timestamp("2026-03-25T12:01:00Z"),
+    };
+    let user_id = registry
+        .upsert_bootstrap_user("community-owner@example.com", "Owner", "hashed-password")
+        .await
+        .unwrap();
+
+    registry
+        .create_workspace(CreateWorkspaceRequest {
+            workspace: &legacy_workspace,
+        })
+        .await
+        .unwrap();
+    registry
+        .update_workspace(UpdateWorkspaceRequest {
+            workspace: &default_workspace,
+        })
+        .await
+        .unwrap();
+    registry
+        .ensure_membership(&legacy_workspace.id, &user_id, MembershipRole::Owner)
+        .await
+        .unwrap();
+    registry
+        .ensure_membership(&default_workspace.id, &user_id, MembershipRole::Owner)
+        .await
+        .unwrap();
+
+    let workspaces = registry.list_workspaces_for_user(&user_id).await.unwrap();
+
+    assert_eq!(workspaces[0].workspace.id, WorkspaceId::new("ws_default"));
+    assert_eq!(workspaces[0].workspace.slug, "solo");
+
+    let session_id = UserSessionId::new("sess_workspace_default_first");
+    let secret_hash = "test-secret-hash";
+    registry
+        .create_user_session(
+            &session_id,
+            &user_id,
+            Some(&legacy_workspace.id),
+            secret_hash,
+            &timestamp("2027-03-25T13:00:00Z"),
+        )
+        .await
+        .unwrap();
+
+    let session = registry
+        .get_user_session(&session_id, secret_hash)
+        .await
+        .unwrap()
+        .unwrap();
+    assert_eq!(
+        session.current_workspace_id,
+        Some(WorkspaceId::new("ws_default"))
+    );
+
+    database.cleanup().await;
+}
+
 #[tokio::test]
 async fn manages_user_profile_and_workspace_access_reads() {
     let database = TestDatabase::new().await;