feat: organizations decide who sees whom; sharing only by owners

- Server admins manage organizations (one per user); new admin section,
  organization on user creation and invites, setup creates the first one
- Sharing modes private / organizations / open, enforced centrally
  (CanSee, CanShareWith) for directory, all shares and groups; unknown and
  invisible targets give the same error
- Losing visibility (org change, mode change, leaving a group) prunes shares,
  group memberships and task assignments; dry run warns before tightening
- Only owners share; editors can no longer reshare lists or remove others'
  shares; legacy task_lists.team_id and old /organizations endpoints removed
  (FLAW-06, FLAW-10, FLAW-24)
- Schema version: outdated databases are wiped and recreated on start
- Fix setup sample data (createSampleData was ignored); setup and admin
  use a shared ToggleSwitch instead of checkboxes
- Docs: sharing-and-permissions rewritten, ui-patterns, REST, DB, flaws

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/storage/sqlite.go

@@ -6,6 +6,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"log/slog"
 	"os"
 	"path/filepath"
 	"regexp"
@@ -57,7 +58,55 @@ func (s *Store) Close() error {
 	return s.db.Close()
 }
 
+// schemaVersion is stored in PRAGMA user_version. Databases from an older version are wiped and rebuilt
+// on start: MindSift is not in production yet, so breaking changes need no migration path.
+const schemaVersion = 2
+
+func (s *Store) resetOutdatedSchema() error {
+	var version int
+	if err := s.db.QueryRow(`PRAGMA user_version`).Scan(&version); err != nil {
+		return err
+	}
+	if version >= schemaVersion {
+		return nil
+	}
+	conn, err := s.db.Conn(context.Background())
+	if err != nil {
+		return err
+	}
+	defer conn.Close()
+	ctx := context.Background()
+	rows, err := conn.QueryContext(ctx, `SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%'`)
+	if err != nil {
+		return err
+	}
+	var tables []string
+	for rows.Next() {
+		var name string
+		if rows.Scan(&name) == nil {
+			tables = append(tables, name)
+		}
+	}
+	_ = rows.Close()
+	if len(tables) > 0 {
+		slog.Warn("Veraltetes Datenbankschema: alle Daten werden gelöscht und neu angelegt", "version", version, "neu", schemaVersion)
+	}
+	if _, err := conn.ExecContext(ctx, `PRAGMA foreign_keys = OFF`); err != nil {
+		return err
+	}
+	for _, t := range tables {
+		if _, err := conn.ExecContext(ctx, `DROP TABLE IF EXISTS "`+strings.ReplaceAll(t, `"`, `""`)+`"`); err != nil {
+			return err
+		}
+	}
+	_, err = conn.ExecContext(ctx, `PRAGMA foreign_keys = ON`)
+	return err
+}
+
 func (s *Store) migrate() error {
+	if err := s.resetOutdatedSchema(); err != nil {
+		return fmt.Errorf("reset outdated schema: %w", err)
+	}
 	schema := `
 	PRAGMA journal_mode = WAL;
 	PRAGMA synchronous = NORMAL;
@@ -79,15 +128,17 @@ func (s *Store) migrate() error {
 		custom_webhook_url TEXT NOT NULL DEFAULT '',
 		notify_before_minutes INTEGER NOT NULL DEFAULT 30,
 		avatar_url TEXT NOT NULL DEFAULT '',
+		organization_id TEXT NOT NULL DEFAULT '',
 		created_at TEXT NOT NULL
 	);
+	CREATE INDEX IF NOT EXISTS idx_users_org ON users(organization_id);
 
 	CREATE TABLE IF NOT EXISTS user_invites (
 		id TEXT PRIMARY KEY,
 		code TEXT UNIQUE NOT NULL,
 		email TEXT NOT NULL DEFAULT '',
 		role TEXT NOT NULL DEFAULT 'member',
-		team_id TEXT NOT NULL DEFAULT '',
+		organization_id TEXT NOT NULL DEFAULT '',
 		created_by TEXT NOT NULL,
 		expires_at TEXT NOT NULL,
 		used_by TEXT NOT NULL DEFAULT '',
@@ -124,7 +175,6 @@ func (s *Store) migrate() error {
 		id TEXT PRIMARY KEY,
 		user_id TEXT NOT NULL,
 		space_id TEXT DEFAULT '',
-		team_id TEXT DEFAULT '',
 		title TEXT NOT NULL,
 		icon TEXT NOT NULL DEFAULT '📋',
 		color TEXT NOT NULL DEFAULT '#2563eb',
@@ -135,17 +185,17 @@ func (s *Store) migrate() error {
 	);
 	CREATE INDEX IF NOT EXISTS idx_task_lists_user ON task_lists(user_id, updated_at DESC);
 
+	-- Organizations are defined by server admins and decide who can see whom (sharing_mode = organizations)
 	CREATE TABLE IF NOT EXISTS organizations (
 		id TEXT PRIMARY KEY,
 		name TEXT NOT NULL,
-		owner_id TEXT NOT NULL,
-		created_at TEXT NOT NULL,
-		FOREIGN KEY(owner_id) REFERENCES users(id) ON DELETE CASCADE
+		created_at TEXT NOT NULL
 	);
 
+	-- Teams are the user-managed groups ("Gruppen"); org_id is the creator's organization
 	CREATE TABLE IF NOT EXISTS teams (
 		id TEXT PRIMARY KEY,
-		org_id TEXT NOT NULL DEFAULT 'default',
+		org_id TEXT NOT NULL DEFAULT '',
 		name TEXT NOT NULL,
 		description TEXT NOT NULL DEFAULT '',
 		created_at TEXT NOT NULL
@@ -351,7 +401,6 @@ func (s *Store) migrate() error {
 		"CREATE INDEX IF NOT EXISTS idx_doc_shares_user ON doc_shares(user_id);",
 		"CREATE INDEX IF NOT EXISTS idx_doc_shares_doc ON doc_shares(doc_id);",
 
-		"ALTER TABLE task_lists ADD COLUMN team_id TEXT NOT NULL DEFAULT '';",
 		"ALTER TABLE task_lists ADD COLUMN columns TEXT NOT NULL DEFAULT '[]';",
 		"CREATE TABLE IF NOT EXISTS task_list_shares (id TEXT PRIMARY KEY, task_list_id TEXT NOT NULL, target_type TEXT NOT NULL CHECK(target_type IN ('team', 'user')), target_id TEXT NOT NULL, created_at TEXT NOT NULL, created_by TEXT NOT NULL, UNIQUE(task_list_id, target_type, target_id));",
 		"CREATE INDEX IF NOT EXISTS idx_task_list_shares_target ON task_list_shares(target_type, target_id);",
@@ -424,7 +473,7 @@ func (s *Store) migrate() error {
 
 	// Default system settings (public registration disabled by default; invite or admin creation required)
 	_, _ = s.db.Exec(`INSERT OR IGNORE INTO system_settings (key, value) VALUES 
-		('sharing_mode', 'teams_only'),
+		('sharing_mode', 'organizations'),
 		('allow_registration', 'false'),
 		('instance_name', 'MindSift'),
 		('smtp_host', ''),
@@ -434,32 +483,6 @@ func (s *Store) migrate() error {
 		('smtp_from', ''),
 		('smtp_tls', 'true')`)
 
-	// Migrate existing teams table if it still has a legacy FOREIGN KEY to organizations
-	var teamsTableSQL string
-	_ = s.db.QueryRow(`SELECT sql FROM sqlite_master WHERE type='table' AND name='teams'`).Scan(&teamsTableSQL)
-	if strings.Contains(strings.ToUpper(teamsTableSQL), "ORGANIZATIONS") {
-		if conn, err := s.db.Conn(context.Background()); err == nil {
-			_, _ = conn.ExecContext(context.Background(), `PRAGMA foreign_keys = OFF;`)
-			_, _ = conn.ExecContext(context.Background(), `
-				BEGIN TRANSACTION;
-				CREATE TABLE IF NOT EXISTS teams_migrated (
-					id TEXT PRIMARY KEY,
-					org_id TEXT NOT NULL DEFAULT 'default',
-					name TEXT NOT NULL,
-					description TEXT NOT NULL DEFAULT '',
-					created_at TEXT NOT NULL
-				);
-				INSERT OR IGNORE INTO teams_migrated (id, org_id, name, description, created_at)
-				SELECT id, COALESCE(NULLIF(org_id, ''), 'default'), name, COALESCE(description, ''), created_at FROM teams;
-				DROP TABLE teams;
-				ALTER TABLE teams_migrated RENAME TO teams;
-				COMMIT;
-			`)
-			_, _ = conn.ExecContext(context.Background(), `PRAGMA foreign_keys = ON;`)
-			_ = conn.Close()
-		}
-	}
-
 	// Clean up legacy roles in team_members and users
 	_, _ = s.db.Exec(`UPDATE team_members SET role = 'admin' WHERE role IN ('team_admin', 'owner')`)
 	_, _ = s.db.Exec(`UPDATE team_members SET role = 'member' WHERE role NOT IN ('admin', 'member')`)
@@ -479,7 +502,8 @@ func (s *Store) migrate() error {
 	}
 	s.migrateAnchorTags()
 
-	return nil
+	_, err := s.db.Exec(fmt.Sprintf(`PRAGMA user_version = %d`, schemaVersion))
+	return err
 }
 
 // EnsureDefaultUser is retained strictly for unit test convenience
@@ -508,7 +532,7 @@ func (s *Store) EnsureDefaultUser() (*domain.User, error) {
 
 // --- USERS ---
 
-const userSelectCols = `id, email, username, password_hash, display_name, role, is_active, token_version, alarm_channels, alarm_email, discord_webhook_url, custom_webhook_url, notify_before_minutes, avatar_url, created_at`
+const userSelectCols = `id, email, username, password_hash, display_name, role, is_active, token_version, alarm_channels, alarm_email, discord_webhook_url, custom_webhook_url, notify_before_minutes, avatar_url, organization_id, created_at`
 
 func parseAlarmChannels(raw string) []string {
 	parts := strings.Split(raw, ",")
@@ -531,7 +555,7 @@ func scanUser(row interface{ Scan(dest ...any) error }) (*domain.User, error) {
 	err := row.Scan(
 		&u.ID, &u.Email, &u.Username, &u.PasswordHash, &u.DisplayName,
 		&u.Role, &isActiveInt, &u.TokenVersion, &channelsRaw, &u.AlarmEmail,
-		&u.DiscordWebhookURL, &u.CustomWebhookURL, &u.NotifyBeforeMinutes, &u.AvatarURL, &u.CreatedAt,
+		&u.DiscordWebhookURL, &u.CustomWebhookURL, &u.NotifyBeforeMinutes, &u.AvatarURL, &u.OrganizationID, &u.CreatedAt,
 	)
 	if err != nil {
 		return nil, err
@@ -660,8 +684,13 @@ func (s *Store) EnsureDemoAccounts() error {
 		_, _ = s.db.Exec(`UPDATE users SET is_active = 1 WHERE id = ?`, normalUser.ID)
 	}
 
-	// 3. Sample data for the admin, partly shared with the demo user (only on first start)
+	// 3. Sample data for the admin, partly shared with the demo user (only on first start). Both accounts
+	// share an organization so they can see each other in the default sharing mode.
 	if adminCreated {
+		if org, err := s.CreateOrganization("Demo"); err == nil {
+			_ = s.SetUserOrganization(adminUser.ID, org.ID)
+			_ = s.SetUserOrganization(normalUser.ID, org.ID)
+		}
 		_ = s.SeedStarterContent(adminUser)
 		s.seedDemoShares(adminUser, normalUser)
 	}
@@ -701,46 +730,6 @@ func (s *Store) GetAllUsers() ([]domain.User, error) {
 	return users, nil
 }
 
-func (s *Store) GetDiscoverableUsers(viewerID string) ([]domain.User, error) {
-	viewer, err := s.GetUserByID(viewerID)
-	if err != nil {
-		return []domain.User{}, nil
-	}
-	sys, _ := s.GetSystemSettings()
-	mode := "teams_only"
-	if sys != nil && sys.SharingMode != "" {
-		mode = sys.SharingMode
-	}
-
-	if viewer.Role == "admin" || mode == "open" || mode == "teams_only" {
-		return s.GetAllUsers()
-	}
-	if mode == "strict_private" {
-		return []domain.User{*viewer}, nil
-	}
-
-	// users sharing at least one team, organization or space with viewer
-	rows, err := s.db.Query(
-		`SELECT DISTINCT `+userSelectCols+` FROM users WHERE id = ? OR id IN (
-			SELECT tm2.user_id FROM team_members tm1
-			JOIN team_members tm2 ON tm1.team_id = tm2.team_id
-			WHERE tm1.user_id = ?
-		)`,
-		viewerID, viewerID,
-	)
-	if err != nil {
-		return []domain.User{*viewer}, nil
-	}
-	users := make([]domain.User, 0)
-	for rows.Next() {
-		if u, err := scanUser(rows); err == nil {
-			users = append(users, *u)
-		}
-	}
-	_ = rows.Close()
-	return users, nil
-}
-
 func (s *Store) UpdateUser(
 	userID string,
 	displayName, email, role *string,
@@ -821,6 +810,8 @@ func (s *Store) DeleteUser(userID string) error {
 	_, _ = s.db.Exec(`DELETE FROM revoked_tokens WHERE user_id = ?`, userID)
 	_, _ = s.db.Exec(`DELETE FROM task_assignees WHERE user_id = ?`, userID)
 	_, err := s.db.Exec(`DELETE FROM users WHERE id = ?`, userID)
+	// Shares pointing at the deleted account are no longer visible to anyone
+	s.pruneSharingNow()
 	return err
 }
 
@@ -975,7 +966,6 @@ func scanThought(rows interface {
 func (s *Store) accessibleTaskListIDsQuery() string {
 	return `SELECT id FROM task_lists 
 		   WHERE user_id = ? 
-		   OR (team_id != '' AND team_id IN (SELECT team_id FROM team_members WHERE user_id = ?))
 		   OR id IN (
 		       SELECT task_list_id FROM task_list_shares 
 		       WHERE (target_type = 'user' AND target_id = ?) 
@@ -987,7 +977,7 @@ func (s *Store) GetThoughtByID(userID, thoughtID string) (*domain.Thought, error
 	row := s.db.QueryRow(
 		`SELECT id, user_id, content, tags, priority, source, status, is_completed, converted_type, converted_ref_id, due_date, task_list_id, kanban_status, notes, alarm_sent, created_at, triaged_at, subtasks, sort_order
 		 FROM thoughts WHERE id = ? AND (user_id = ? OR task_list_id IN (`+s.accessibleTaskListIDsQuery()+`))`,
-		thoughtID, userID, userID, userID, userID, userID,
+		thoughtID, userID, userID, userID, userID,
 	)
 	t, err := scanThought(row)
 	if err != nil {
@@ -1045,7 +1035,7 @@ func (s *Store) GetTasks(userID string, taskListID string) ([]domain.Thought, er
 			   AND task_list_id = ?
 			   AND (status = 'kept' OR (status = 'converted' AND converted_type = 'task'))
 			 ORDER BY is_completed ASC, sort_order ASC, created_at DESC`,
-			userID, userID, userID, userID, userID, taskListID,
+			userID, userID, userID, userID, taskListID,
 		)
 	} else {
 		rows, err = s.db.Query(
@@ -1054,7 +1044,7 @@ func (s *Store) GetTasks(userID string, taskListID string) ([]domain.Thought, er
 			 WHERE (user_id = ? OR task_list_id IN (`+s.accessibleTaskListIDsQuery()+`))
 			   AND (status = 'kept' OR (status = 'converted' AND converted_type = 'task'))
 			 ORDER BY is_completed ASC, sort_order ASC, created_at DESC`,
-			userID, userID, userID, userID, userID,
+			userID, userID, userID, userID,
 		)
 	}
 	if err != nil {
@@ -3080,7 +3070,7 @@ func (s *Store) CreateFolderShare(currentUserID, folderID, targetType, targetIde
 	if cleanType == "team" {
 		err = s.db.QueryRow(`SELECT id, name FROM teams WHERE id = ?`, cleanTarget).Scan(&targetID, &targetName)
 		if err != nil {
-			return nil, fmt.Errorf("gruppe nicht gefunden")
+			return nil, ErrTargetNotFound
 		}
 	} else {
 		var u *domain.User
@@ -3097,7 +3087,7 @@ func (s *Store) CreateFolderShare(currentUserID, folderID, targetType, targetIde
 			if s.db.QueryRow(`SELECT id, name FROM teams WHERE id = ?`, cleanTarget).Scan(&targetID, &targetName) == nil {
 				cleanType = "team"
 			} else {
-				return nil, fmt.Errorf("benutzer nicht gefunden")
+				return nil, ErrTargetNotFound
 			}
 		} else {
 			if u.ID == f.OwnerID {
@@ -3110,6 +3100,10 @@ func (s *Store) CreateFolderShare(currentUserID, folderID, targetType, targetIde
 		}
 	}
 
+	if !s.CanShareWith(currentUserID, cleanType, targetID) {
+		return nil, ErrTargetNotFound
+	}
+
 	now := domain.NowISO()
 	shareID := domain.NewID("fsh")
 
@@ -3175,7 +3169,8 @@ func (s *Store) DeleteFolderShare(currentUserID, folderID, shareID string) error
 	}
 	cleanID := strings.TrimSpace(shareID)
 
-	if !f.IsOwner && f.Permission != "write" {
+	// Only the owner manages shares; everyone else can only leave the folder
+	if !f.IsOwner {
 		_, err = s.db.Exec(`DELETE FROM workspace_folder_shares WHERE folder_id = ? AND target_type = 'user' AND target_id = ? AND (id = ? OR target_id = ?)`,
 			folderID, currentUserID, cleanID, cleanID)
 		_, _ = s.db.Exec(`DELETE FROM workspace_folder_mounts WHERE folder_id = ? AND user_id = ?`, folderID, currentUserID)
@@ -3295,8 +3290,8 @@ func (s *Store) CreateDocTeamShare(currentUserID, docID, teamID, permission stri
 	cleanTeamID := strings.TrimSpace(teamID)
 	var teamName string
 	err = s.db.QueryRow(`SELECT name FROM teams WHERE id = ?`, cleanTeamID).Scan(&teamName)
-	if err != nil {
-		return nil, fmt.Errorf("team nicht gefunden")
+	if err != nil || !s.CanShareWith(currentUserID, "team", cleanTeamID) {
+		return nil, ErrTargetNotFound
 	}
 
 	permission = normalizeSharePermission(permission)
@@ -3370,12 +3365,15 @@ func (s *Store) CreateDocShare(currentUserID, docID, targetUserIdentifier, permi
 		if s.db.QueryRow(`SELECT name FROM teams WHERE id = ?`, cleanTarget).Scan(&tName) == nil {
 			return s.CreateDocTeamShare(currentUserID, docID, cleanTarget, permission)
 		}
-		return nil, fmt.Errorf("benutzer nicht gefunden")
+		return nil, ErrTargetNotFound
 	}
 
 	if targetUser.ID == doc.UserID {
 		return nil, fmt.Errorf("dokument gehört bereits diesem Benutzer")
 	}
+	if !s.CanShareWith(currentUserID, "user", targetUser.ID) {
+		return nil, ErrTargetNotFound
+	}
 
 	now := domain.NowISO()
 	shareID := domain.NewID("share")
@@ -3409,7 +3407,8 @@ func (s *Store) DeleteDocShare(currentUserID, docID, targetID string) error {
 	if err != nil {
 		return err
 	}
-	if !doc.IsOwner && doc.Permission != "write" && currentUserID != targetID {
+	// Only the owner manages shares; everyone else can only remove their own
+	if !doc.IsOwner && currentUserID != targetID {
 		return fmt.Errorf("keine Berechtigung zum Entfernen der Freigabe")
 	}
 
@@ -3427,22 +3426,15 @@ func (s *Store) DeleteDocShare(currentUserID, docID, targetID string) error {
 	return err
 }
 
+// GetCollaborators returns the active people the user can share with (everyone visible except the user).
 func (s *Store) GetCollaborators(currentUserID string) ([]domain.User, error) {
-	rows, err := s.db.Query(
-		`SELECT id, email, display_name, role, is_active, avatar_url, created_at FROM users WHERE id != ? AND is_active = 1 ORDER BY display_name ASC`,
-		currentUserID,
-	)
+	visible, err := s.GetDiscoverableUsers(currentUserID)
 	if err != nil {
 		return nil, err
 	}
-	defer rows.Close()
-
-	users := make([]domain.User, 0)
-	for rows.Next() {
-		var u domain.User
-		var activeInt int
-		if err := rows.Scan(&u.ID, &u.Email, &u.DisplayName, &u.Role, &activeInt, &u.AvatarURL, &u.CreatedAt); err == nil {
-			u.IsActive = activeInt == 1
+	users := make([]domain.User, 0, len(visible))
+	for _, u := range visible {
+		if u.ID != currentUserID && u.IsActive {
 			users = append(users, u)
 		}
 	}
@@ -3511,23 +3503,22 @@ func (s *Store) AddListShare(currentUserID, listID, targetType, targetID, role s
 			targetUser, _ = s.GetUserByEmail(targetID)
 		}
 		if targetUser == nil {
-			return nil, fmt.Errorf("benutzer nicht gefunden: %s", targetID)
+			return nil, ErrTargetNotFound
 		}
 		targetID = targetUser.ID
 	}
 
-	// Verify current user is owner or editor of the list
+	// Only the owner shares
 	var ownerID string
 	err := s.db.QueryRow(`SELECT user_id FROM lists WHERE id = ?`, listID).Scan(&ownerID)
 	if err != nil {
 		return nil, errors.New("liste nicht gefunden")
 	}
 	if ownerID != currentUserID {
-		var myRole string
-		err = s.db.QueryRow(`SELECT role FROM list_shares WHERE list_id = ? AND target_type = 'user' AND target_id = ?`, listID, currentUserID).Scan(&myRole)
-		if err != nil || myRole != "editor" {
-			return nil, errors.New("keine Berechtigung zum Teilen dieser Liste")
-		}
+		return nil, errors.New("nur der Eigentümer kann die Liste freigeben")
+	}
+	if !s.CanShareWith(currentUserID, targetType, targetID) {
+		return nil, ErrTargetNotFound
 	}
 
 	now := domain.NowISO()
@@ -4206,7 +4197,6 @@ func (s *Store) CreateTaskList(userID, spaceID, teamID, title, icon, color strin
 		ID:        domain.NewID("tkl"),
 		UserID:    userID,
 		SpaceID:   spaceID,
-		TeamID:    teamID,
 		Title:     strings.TrimSpace(title),
 		Icon:      icon,
 		Color:     color,
@@ -4216,13 +4206,13 @@ func (s *Store) CreateTaskList(userID, spaceID, teamID, title, icon, color strin
 		IsOwner:   true,
 	}
 	_, err := s.db.Exec(
-		`INSERT INTO task_lists (id, user_id, space_id, team_id, title, icon, color, columns, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
-		tl.ID, tl.UserID, tl.SpaceID, tl.TeamID, tl.Title, tl.Icon, tl.Color, string(colsJSON), tl.CreatedAt, tl.UpdatedAt,
+		`INSERT INTO task_lists (id, user_id, space_id, title, icon, color, columns, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+		tl.ID, tl.UserID, tl.SpaceID, tl.Title, tl.Icon, tl.Color, string(colsJSON), tl.CreatedAt, tl.UpdatedAt,
 	)
 	if err != nil {
 		return nil, err
 	}
-	if teamID != "" {
+	if teamID != "" && s.CanShareWith(userID, "team", teamID) {
 		_, _ = s.AddTaskListShare(tl.ID, "team", teamID, "editor", userID)
 	}
 	return s.GetTaskListByID(userID, tl.ID)
@@ -4236,8 +4226,8 @@ var ErrAssigneeNoAccess = errors.New("Aufgaben können nur Personen mit Zugriff
 
 // GetTaskListPermission returns "owner", "editor", "viewer" or "" (no access) for the given user.
 func (s *Store) GetTaskListPermission(userID, listID string) string {
-	var ownerID, teamID string
-	if err := s.db.QueryRow(`SELECT user_id, COALESCE(team_id, '') FROM task_lists WHERE id = ?`, listID).Scan(&ownerID, &teamID); err != nil {
+	var ownerID string
+	if err := s.db.QueryRow(`SELECT user_id FROM task_lists WHERE id = ?`, listID).Scan(&ownerID); err != nil {
 		return ""
 	}
 	if ownerID == userID {
@@ -4267,15 +4257,6 @@ func (s *Store) GetTaskListPermission(userID, listID string) string {
 		}
 		_ = rows.Close()
 	}
-	if perm == "" && teamID != "" {
-		// Legacy team assignment without a share row grants edit access
-		var isMember, hasShareRow int
-		_ = s.db.QueryRow(`SELECT COUNT(*) FROM team_members WHERE team_id = ? AND user_id = ?`, teamID, userID).Scan(&isMember)
-		_ = s.db.QueryRow(`SELECT COUNT(*) FROM task_list_shares WHERE task_list_id = ? AND target_type = 'team' AND target_id = ?`, listID, teamID).Scan(&hasShareRow)
-		if isMember > 0 && hasShareRow == 0 {
-			perm = "editor"
-		}
-	}
 	return perm
 }
 
@@ -4303,6 +4284,9 @@ func (s *Store) AddTaskListShare(taskListID, targetType, targetID, permission, c
 	if permission != "viewer" {
 		permission = "editor"
 	}
+	if !s.CanShareWith(createdBy, targetType, targetID) {
+		return nil, ErrTargetNotFound
+	}
 	now := domain.NowISO()
 	share := &domain.TaskListShare{
 		ID:         domain.NewID("tls"),
@@ -4325,7 +4309,6 @@ func (s *Store) AddTaskListShare(taskListID, targetType, targetID, permission, c
 		taskListID, targetType, targetID).Scan(&share.ID, &share.CreatedAt)
 
 	if targetType == "team" {
-		_, _ = s.db.Exec(`UPDATE task_lists SET team_id = ? WHERE id = ? AND (team_id = '' OR team_id IS NULL)`, targetID, taskListID)
 		_ = s.db.QueryRow(`SELECT name FROM teams WHERE id = ?`, targetID).Scan(&share.TargetName)
 	} else {
 		_ = s.db.QueryRow(`SELECT display_name, email FROM users WHERE id = ?`, targetID).Scan(&share.TargetName, &share.Email)
@@ -4334,16 +4317,10 @@ func (s *Store) AddTaskListShare(taskListID, targetType, targetID, permission, c
 }
 
 func (s *Store) RemoveTaskListShare(taskListID, shareIDOrTargetID string) error {
-	var targetType, targetID string
-	_ = s.db.QueryRow(`SELECT target_type, target_id FROM task_list_shares WHERE task_list_id = ? AND (id = ? OR target_id = ?)`, taskListID, shareIDOrTargetID, shareIDOrTargetID).Scan(&targetType, &targetID)
-
 	_, err := s.db.Exec(
 		`DELETE FROM task_list_shares WHERE task_list_id = ? AND (id = ? OR target_id = ?)`,
 		taskListID, shareIDOrTargetID, shareIDOrTargetID,
 	)
-	if targetType == "team" {
-		_, _ = s.db.Exec(`UPDATE task_lists SET team_id = '' WHERE id = ? AND team_id = ?`, taskListID, targetID)
-	}
 	s.PruneTaskAssignees()
 	return err
 }
@@ -4395,13 +4372,12 @@ func (s *Store) queryUserIDs(query string, args ...interface{}) []string {
 	return ids
 }
 
-// taskListAccessSQL selects every user ID with access to the task list given as the single parameter.
-// It mirrors GetTaskListUserIDs and is correlated into PruneTaskAssignees.
+// taskListAccessSQL selects every user ID with access to a task list: owner, direct shares and members of
+// shared groups. %[1]s is the list ID expression ("?" or a correlated column).
 const taskListAccessSQL = `SELECT user_id FROM task_lists WHERE id = %[1]s
 		 UNION SELECT target_id FROM task_list_shares WHERE task_list_id = %[1]s AND target_type = 'user'
 		 UNION SELECT tm.user_id FROM team_members tm
-		       WHERE tm.team_id IN (SELECT target_id FROM task_list_shares WHERE task_list_id = %[1]s AND target_type = 'team')
-		          OR tm.team_id IN (SELECT team_id FROM task_lists WHERE id = %[1]s AND team_id != '')`
+		       WHERE tm.team_id IN (SELECT target_id FROM task_list_shares WHERE task_list_id = %[1]s AND target_type = 'team')`
 
 func (s *Store) getTaskAssignees(taskID string) []string {
 	ids := s.queryUserIDs(`SELECT user_id FROM task_assignees WHERE task_id = ? ORDER BY created_at ASC`, taskID)
@@ -4518,20 +4494,12 @@ func (s *Store) PruneTaskAssignees() {
 	)
 }
 
-// GetTaskListUserIDs returns every user who can see the task list: owner, direct shares, members of shared teams
-// and members of the legacy team_id.
+// GetTaskListUserIDs returns every user who can see the task list: owner, direct shares and members of shared teams.
 func (s *Store) GetTaskListUserIDs(listID string) []string {
 	if listID == "" {
 		return []string{}
 	}
-	return s.queryUserIDs(
-		`SELECT user_id FROM task_lists WHERE id = ?
-		 UNION SELECT target_id FROM task_list_shares WHERE task_list_id = ? AND target_type = 'user'
-		 UNION SELECT tm.user_id FROM team_members tm
-		       WHERE tm.team_id IN (SELECT target_id FROM task_list_shares WHERE task_list_id = ? AND target_type = 'team')
-		          OR tm.team_id IN (SELECT team_id FROM task_lists WHERE id = ? AND team_id != '')`,
-		listID, listID, listID, listID,
-	)
+	return s.queryUserIDs(fmt.Sprintf(taskListAccessSQL, "?"), listID, listID, listID)
 }
 
 // GetSharedFolderUserIDs returns the owner of a shared workspace folder and everyone it is shared with.
@@ -4562,25 +4530,7 @@ func (s *Store) getMembersForTaskList(tl *domain.TaskList) []domain.TaskListMemb
 		Role:        "owner",
 	}
 
-	// 2. Team members if tl.TeamID != ""
-	if tl.TeamID != "" {
-		rows, err := s.db.Query(
-			`SELECT u.id, u.display_name, u.email, u.avatar_url FROM team_members tm JOIN users u ON u.id = tm.user_id WHERE tm.team_id = ?`,
-			tl.TeamID,
-		)
-		if err == nil {
-			for rows.Next() {
-				var m domain.TaskListMember
-				if err := rows.Scan(&m.UserID, &m.DisplayName, &m.Email, &m.AvatarURL); err == nil {
-					m.Role = "member"
-					memberMap[m.UserID] = m
-				}
-			}
-			_ = rows.Close()
-		}
-	}
-
-	// 3. From task_list_shares
+	// 2. From task_list_shares
 	for _, sh := range tl.Shares {
 		if sh.TargetType == "team" {
 			rows, err := s.db.Query(
@@ -4615,17 +4565,16 @@ func (s *Store) getMembersForTaskList(tl *domain.TaskList) []domain.TaskListMemb
 
 func (s *Store) GetTaskLists(userID string) ([]domain.TaskList, error) {
 	rows, err := s.db.Query(
-		`SELECT id, user_id, space_id, COALESCE(team_id, ''), title, icon, color, COALESCE(columns, '[]'), created_at, updated_at
+		`SELECT id, user_id, space_id, title, icon, color, COALESCE(columns, '[]'), created_at, updated_at
 		 FROM task_lists
 		 WHERE user_id = ? 
-		    OR (team_id != '' AND team_id IN (SELECT team_id FROM team_members WHERE user_id = ?))
 		    OR id IN (
 		        SELECT task_list_id FROM task_list_shares 
 		        WHERE (target_type = 'user' AND target_id = ?) 
 		           OR (target_type = 'team' AND target_id IN (SELECT team_id FROM team_members WHERE user_id = ?))
 		    )
 		 ORDER BY updated_at DESC`,
-		userID, userID, userID, userID,
+		userID, userID, userID,
 	)
 	if err != nil {
 		return []domain.TaskList{}, err
@@ -4642,7 +4591,7 @@ func (s *Store) GetTaskLists(userID string) ([]domain.TaskList, error) {
 	for rows.Next() {
 		var tl domain.TaskList
 		var colsJSON string
-		if err := rows.Scan(&tl.ID, &tl.UserID, &tl.SpaceID, &tl.TeamID, &tl.Title, &tl.Icon, &tl.Color, &colsJSON, &tl.CreatedAt, &tl.UpdatedAt); err == nil {
+		if err := rows.Scan(&tl.ID, &tl.UserID, &tl.SpaceID, &tl.Title, &tl.Icon, &tl.Color, &colsJSON, &tl.CreatedAt, &tl.UpdatedAt); err == nil {
 			tl.IsOwner = (tl.UserID == userID)
 			_ = json.Unmarshal([]byte(colsJSON), &tl.Columns)
 			if len(tl.Columns) == 0 {
@@ -4663,10 +4612,6 @@ func (s *Store) GetTaskLists(userID string) ([]domain.TaskList, error) {
 		).Scan(&list[i].TasksCount)
 		_ = s.db.QueryRow(`SELECT display_name FROM users WHERE id = ?`, list[i].UserID).Scan(&list[i].OwnerName)
 
-		if list[i].TeamID != "" {
-			_ = s.db.QueryRow(`SELECT name FROM teams WHERE id = ?`, list[i].TeamID).Scan(&list[i].TeamName)
-		}
-
 		shares, _ := s.GetTaskListShares(list[i].ID)
 		list[i].Shares = shares
 		list[i].Permission = s.GetTaskListPermission(userID, list[i].ID)
@@ -4679,19 +4624,18 @@ func (s *Store) GetTaskListByID(userID, listID string) (*domain.TaskList, error)
 	var tl domain.TaskList
 	var colsJSON string
 	err := s.db.QueryRow(
-		`SELECT id, user_id, space_id, COALESCE(team_id, ''), title, icon, color, COALESCE(columns, '[]'), created_at, updated_at
+		`SELECT id, user_id, space_id, title, icon, color, COALESCE(columns, '[]'), created_at, updated_at
 		 FROM task_lists 
 		 WHERE id = ? AND (
 		    user_id = ? 
-		    OR (team_id != '' AND team_id IN (SELECT team_id FROM team_members WHERE user_id = ?))
 		    OR id IN (
 		        SELECT task_list_id FROM task_list_shares 
 		        WHERE (target_type = 'user' AND target_id = ?) 
 		           OR (target_type = 'team' AND target_id IN (SELECT team_id FROM team_members WHERE user_id = ?))
 		    )
 		 )`,
-		listID, userID, userID, userID, userID,
-	).Scan(&tl.ID, &tl.UserID, &tl.SpaceID, &tl.TeamID, &tl.Title, &tl.Icon, &tl.Color, &colsJSON, &tl.CreatedAt, &tl.UpdatedAt)
+		listID, userID, userID, userID,
+	).Scan(&tl.ID, &tl.UserID, &tl.SpaceID, &tl.Title, &tl.Icon, &tl.Color, &colsJSON, &tl.CreatedAt, &tl.UpdatedAt)
 	if err != nil {
 		return nil, err
 	}
@@ -4707,9 +4651,6 @@ func (s *Store) GetTaskListByID(userID, listID string) (*domain.TaskList, error)
 	}
 	_ = s.db.QueryRow(`SELECT COUNT(*) FROM thoughts WHERE task_list_id = ? AND is_completed = 0 AND (status = 'kept' OR (status = 'converted' AND converted_type = 'task'))`, tl.ID).Scan(&tl.TasksCount)
 	_ = s.db.QueryRow(`SELECT display_name FROM users WHERE id = ?`, tl.UserID).Scan(&tl.OwnerName)
-	if tl.TeamID != "" {
-		_ = s.db.QueryRow(`SELECT name FROM teams WHERE id = ?`, tl.TeamID).Scan(&tl.TeamName)
-	}
 	shares, _ := s.GetTaskListShares(tl.ID)
 	tl.Shares = shares
 	tl.Permission = s.GetTaskListPermission(userID, tl.ID)
@@ -4717,7 +4658,7 @@ func (s *Store) GetTaskListByID(userID, listID string) (*domain.TaskList, error)
 	return &tl, nil
 }
 
-func (s *Store) UpdateTaskList(userID, listID string, title, icon, color, teamID, spaceID *string, columns *[]domain.KanbanColumn) (*domain.TaskList, error) {
+func (s *Store) UpdateTaskList(userID, listID string, title, icon, color, spaceID *string, columns *[]domain.KanbanColumn) (*domain.TaskList, error) {
 	tl, err := s.GetTaskListByID(userID, listID)
 	if err != nil {
 		return nil, err
@@ -4740,28 +4681,15 @@ func (s *Store) UpdateTaskList(userID, listID string, title, icon, color, teamID
 	if columns != nil {
 		tl.Columns = *columns
 	}
-	if teamID != nil {
-		oldTeamID := tl.TeamID
-		tl.TeamID = *teamID
-		if oldTeamID != "" && oldTeamID != *teamID {
-			_ = s.RemoveTaskListShare(listID, oldTeamID)
-		}
-		if *teamID != "" && *teamID != oldTeamID {
-			_, _ = s.AddTaskListShare(listID, "team", *teamID, "editor", userID)
-		}
-	}
 	tl.UpdatedAt = domain.NowISO()
 	colsJSON, _ := json.Marshal(tl.Columns)
 	_, err = s.db.Exec(
-		`UPDATE task_lists SET title = ?, icon = ?, color = ?, space_id = ?, team_id = ?, columns = ?, updated_at = ? WHERE id = ?`,
-		tl.Title, tl.Icon, tl.Color, tl.SpaceID, tl.TeamID, string(colsJSON), tl.UpdatedAt, listID,
+		`UPDATE task_lists SET title = ?, icon = ?, color = ?, space_id = ?, columns = ?, updated_at = ? WHERE id = ?`,
+		tl.Title, tl.Icon, tl.Color, tl.SpaceID, string(colsJSON), tl.UpdatedAt, listID,
 	)
 	if err != nil {
 		return nil, err
 	}
-	if teamID != nil {
-		s.PruneTaskAssignees()
-	}
 	return s.GetTaskListByID(userID, listID)
 }
 
@@ -4775,96 +4703,12 @@ func (s *Store) DeleteTaskList(userID, listID string) error {
 
 // --- ORGANIZATIONS & TEAMS ---
 
-func (s *Store) CreateOrganization(ownerID, name string) (*domain.Organization, error) {
-	name = strings.TrimSpace(name)
-	if name == "" {
-		return nil, errors.New("organization name required")
-	}
-	org := &domain.Organization{
-		ID:        domain.NewID("org"),
-		Name:      name,
-		OwnerID:   ownerID,
-		Teams:     []domain.Team{},
-		CreatedAt: domain.NowISO(),
-	}
-	_, err := s.db.Exec(
-		`INSERT INTO organizations (id, name, owner_id, created_at) VALUES (?, ?, ?, ?)`,
-		org.ID, org.Name, org.OwnerID, org.CreatedAt,
-	)
-	if err != nil {
-		return nil, err
-	}
-	return org, nil
-}
-
-func (s *Store) DeleteOrganization(orgID string) error {
-	_, err := s.db.Exec(`DELETE FROM organizations WHERE id = ?`, orgID)
-	return err
-}
-
-func (s *Store) GetOrganizationsForUser(userID string) ([]domain.Organization, error) {
-	viewer, _ := s.GetUserByID(userID)
-	var rows *sql.Rows
-	var err error
-
-	if viewer != nil && viewer.Role == "admin" {
-		rows, err = s.db.Query(
-			`SELECT id, name, owner_id, created_at FROM organizations ORDER BY created_at ASC`,
-		)
-	} else {
-		rows, err = s.db.Query(
-			`SELECT DISTINCT o.id, o.name, o.owner_id, o.created_at
-			 FROM organizations o
-			 LEFT JOIN teams t ON t.org_id = o.id
-			 LEFT JOIN team_members tm ON tm.team_id = t.id
-			 WHERE o.owner_id = ? OR tm.user_id = ?
-			 ORDER BY o.created_at ASC`,
-			userID, userID,
-		)
-	}
-	if err != nil {
-		return []domain.Organization{}, err
-	}
-
-	orgs := make([]domain.Organization, 0)
-	for rows.Next() {
-		var o domain.Organization
-		if err := rows.Scan(&o.ID, &o.Name, &o.OwnerID, &o.CreatedAt); err == nil {
-			o.Teams = []domain.Team{}
-			orgs = append(orgs, o)
-		}
-	}
-	_ = rows.Close()
-
-	for i := range orgs {
-		teams, _ := s.GetTeamsForOrg(orgs[i].ID)
-		orgs[i].Teams = teams
-	}
-	return orgs, nil
-}
-
 func (s *Store) CreateTeam(orgID, name, description string) (*domain.Team, error) {
 	name = strings.TrimSpace(name)
 	if name == "" {
 		return nil, errors.New("team name required")
 	}
 	orgID = strings.TrimSpace(orgID)
-	if orgID == "" {
-		orgID = "default"
-	}
-
-	var orgExists int
-	_ = s.db.QueryRow(`SELECT COUNT(*) FROM organizations WHERE id = ?`, orgID).Scan(&orgExists)
-	if orgExists == 0 {
-		var ownerID string
-		_ = s.db.QueryRow(`SELECT id FROM users ORDER BY created_at ASC LIMIT 1`).Scan(&ownerID)
-		if ownerID != "" {
-			_, _ = s.db.Exec(
-				`INSERT OR IGNORE INTO organizations (id, name, owner_id, created_at) VALUES (?, ?, ?, ?)`,
-				orgID, "Standard", ownerID, domain.NowISO(),
-			)
-		}
-	}
 
 	team := &domain.Team{
 		ID:          domain.NewID("team"),
@@ -4878,18 +4722,6 @@ func (s *Store) CreateTeam(orgID, name, description string) (*domain.Team, error
 		`INSERT INTO teams (id, org_id, name, description, created_at) VALUES (?, ?, ?, ?, ?)`,
 		team.ID, team.OrgID, team.Name, team.Description, team.CreatedAt,
 	)
-	if err != nil && strings.Contains(strings.ToUpper(err.Error()), "FOREIGN KEY") {
-		if conn, connErr := s.db.Conn(context.Background()); connErr == nil {
-			_, _ = conn.ExecContext(context.Background(), `PRAGMA foreign_keys = OFF;`)
-			_, err = conn.ExecContext(
-				context.Background(),
-				`INSERT INTO teams (id, org_id, name, description, created_at) VALUES (?, ?, ?, ?, ?)`,
-				team.ID, team.OrgID, team.Name, team.Description, team.CreatedAt,
-			)
-			_, _ = conn.ExecContext(context.Background(), `PRAGMA foreign_keys = ON;`)
-			_ = conn.Close()
-		}
-	}
 	if err != nil {
 		return nil, err
 	}
@@ -4898,7 +4730,7 @@ func (s *Store) CreateTeam(orgID, name, description string) (*domain.Team, error
 
 func (s *Store) DeleteTeam(teamID string) error {
 	_, err := s.db.Exec(`DELETE FROM teams WHERE id = ?`, teamID)
-	s.PruneTaskAssignees()
+	s.pruneSharingNow()
 	return err
 }
 
@@ -5078,7 +4910,8 @@ func (s *Store) RemoveTeamMember(teamID, userID string) error {
 		}
 	}
 	_, err = s.db.Exec(`DELETE FROM team_members WHERE team_id = ? AND user_id = ?`, teamID, userID)
-	s.PruneTaskAssignees()
+	// Whoever leaves a group also loses the shares they made with it
+	s.pruneSharingNow()
 	return err
 }
 
@@ -5108,7 +4941,7 @@ func (s *Store) GetTeamMembers(teamID string) ([]domain.TeamMember, error) {
 
 // --- USER INVITES ---
 
-func (s *Store) CreateUserInvite(createdBy, email, role, teamID string, validDays int) (*domain.UserInvite, error) {
+func (s *Store) CreateUserInvite(createdBy, email, role, orgID string, validDays int) (*domain.UserInvite, error) {
 	if role != "admin" && role != "member" {
 		role = "member"
 	}
@@ -5118,19 +4951,19 @@ func (s *Store) CreateUserInvite(createdBy, email, role, teamID string, validDay
 	code := "INV-" + strings.ToUpper(domain.NewID("c")[2:])
 	now := time.Now().UTC()
 	inv := &domain.UserInvite{
-		ID:        domain.NewID("inv"),
-		Code:      code,
-		Email:     strings.ToLower(strings.TrimSpace(email)),
-		Role:      role,
-		TeamID:    strings.TrimSpace(teamID),
-		CreatedBy: createdBy,
-		ExpiresAt: now.AddDate(0, 0, validDays).Format(time.RFC3339),
-		CreatedAt: now.Format(time.RFC3339),
+		ID:             domain.NewID("inv"),
+		Code:           code,
+		Email:          strings.ToLower(strings.TrimSpace(email)),
+		Role:           role,
+		OrganizationID: strings.TrimSpace(orgID),
+		CreatedBy:      createdBy,
+		ExpiresAt:      now.AddDate(0, 0, validDays).Format(time.RFC3339),
+		CreatedAt:      now.Format(time.RFC3339),
 	}
 	_, err := s.db.Exec(
-		`INSERT INTO user_invites (id, code, email, role, team_id, created_by, expires_at, used_by, created_at)
+		`INSERT INTO user_invites (id, code, email, role, organization_id, created_by, expires_at, used_by, created_at)
 		 VALUES (?, ?, ?, ?, ?, ?, ?, '', ?)`,
-		inv.ID, inv.Code, inv.Email, inv.Role, inv.TeamID, inv.CreatedBy, inv.ExpiresAt, inv.CreatedAt,
+		inv.ID, inv.Code, inv.Email, inv.Role, inv.OrganizationID, inv.CreatedBy, inv.ExpiresAt, inv.CreatedAt,
 	)
 	if err != nil {
 		return nil, err
@@ -5140,9 +4973,9 @@ func (s *Store) CreateUserInvite(createdBy, email, role, teamID string, validDay
 
 func (s *Store) GetUserInvites() ([]domain.UserInvite, error) {
 	rows, err := s.db.Query(
-		`SELECT i.id, i.code, i.email, i.role, i.team_id, COALESCE(t.name, ''), i.created_by, i.expires_at, i.used_by, i.created_at
+		`SELECT i.id, i.code, i.email, i.role, i.organization_id, COALESCE(o.name, ''), i.created_by, i.expires_at, i.used_by, i.created_at
 		 FROM user_invites i
-		 LEFT JOIN teams t ON t.id = i.team_id
+		 LEFT JOIN organizations o ON o.id = i.organization_id
 		 ORDER BY i.created_at DESC`,
 	)
 	if err != nil {
@@ -5153,7 +4986,7 @@ func (s *Store) GetUserInvites() ([]domain.UserInvite, error) {
 	invites := make([]domain.UserInvite, 0)
 	for rows.Next() {
 		var inv domain.UserInvite
-		if err := rows.Scan(&inv.ID, &inv.Code, &inv.Email, &inv.Role, &inv.TeamID, &inv.TeamName, &inv.CreatedBy, &inv.ExpiresAt, &inv.UsedBy, &inv.CreatedAt); err == nil {
+		if err := rows.Scan(&inv.ID, &inv.Code, &inv.Email, &inv.Role, &inv.OrganizationID, &inv.OrganizationName, &inv.CreatedBy, &inv.ExpiresAt, &inv.UsedBy, &inv.CreatedAt); err == nil {
 			invites = append(invites, inv)
 		}
 	}
@@ -5164,10 +4997,10 @@ func (s *Store) GetUserInviteByCode(code string) (*domain.UserInvite, error) {
 	code = strings.ToUpper(strings.TrimSpace(code))
 	var inv domain.UserInvite
 	err := s.db.QueryRow(
-		`SELECT id, code, email, role, team_id, created_by, expires_at, used_by, created_at
+		`SELECT id, code, email, role, organization_id, created_by, expires_at, used_by, created_at
 		 FROM user_invites WHERE UPPER(code) = ?`,
 		code,
-	).Scan(&inv.ID, &inv.Code, &inv.Email, &inv.Role, &inv.TeamID, &inv.CreatedBy, &inv.ExpiresAt, &inv.UsedBy, &inv.CreatedAt)
+	).Scan(&inv.ID, &inv.Code, &inv.Email, &inv.Role, &inv.OrganizationID, &inv.CreatedBy, &inv.ExpiresAt, &inv.UsedBy, &inv.CreatedAt)
 	if err != nil {
 		return nil, errors.New("Ungültiger Einladungscode")
 	}
@@ -5213,7 +5046,7 @@ func (s *Store) SeedSMTPDefaultsFromEnv(host, port, user, pass, from string, tls
 
 func (s *Store) GetSystemSettings() (*domain.SystemSettings, error) {
 	settings := &domain.SystemSettings{
-		SharingMode:       "teams_only",
+		SharingMode:       SharingOrganizations,
 		AllowRegistration: false,
 		InstanceName:      "MindSift",
 		SMTPPort:          "587",
@@ -5268,9 +5101,7 @@ func (s *Store) UpdateSystemSettings(settings *domain.SystemSettings) error {
 	if settings.SMTPPort == "" {
 		settings.SMTPPort = "587"
 	}
-	if settings.SharingMode == "" {
-		settings.SharingMode = "teams_only"
-	}
+	settings.SharingMode = NormalizeSharingMode(settings.SharingMode)
 	if settings.InstanceName == "" {
 		settings.InstanceName = "MindSift"
 	}
@@ -5354,4 +5185,3 @@ func (s *Store) MarkTaskAlarmSent(taskID string) error {
 	_, err := s.db.Exec(`UPDATE thoughts SET alarm_sent = 1 WHERE id = ?`, taskID)
 	return err
 }
-