| 200 | // check; an unknown slug authorizes nothing. Ids pass straight through — |
| 201 | // `authorizeOrganization` verifies live WorkOS membership either way. |
| 202 | const resolveOrgSelector = (selector: string) => |
| 203 | selector.startsWith("org_") |
| 204 | ? Effect.succeed(selector) |
| 205 | : Effect.gen(function* () { |
| 206 | const users = yield* UserStoreService; |
| 207 | const org = yield* users.use((s) => s.getOrganizationBySlug(selector)); |
| 208 | return org?.id ?? null; |
| 209 | }); |
| 210 | |
| 211 | export const McpOrganizationAuthLive = Layer.succeed(McpOrganizationAuth)({ |
| 212 | authorize: (accountId, organizationSelector) => |