(userId: string)
| 202 | |
| 203 | /** Enrich a bare OAuth `userId` into the full provider-neutral principal. */ |
| 204 | const principalFromUserId = (userId: string): Effect.Effect<Principal | null> => |
| 205 | Effect.gen(function* () { |
| 206 | const user = yield* Effect.promise(() => context.internalAdapter.findUserById(userId)); |
| 207 | if (!user) return null; |
| 208 | return { |
| 209 | accountId: user.id, |
| 210 | // Single-org self-host: OAuth tokens carry no active org, so pin to |
| 211 | // the seeded org (same default as the cookie/api-key path). |
| 212 | organizationId, |
| 213 | organizationName, |
| 214 | organizationSlug, |
| 215 | email: user.email ?? "", |
| 216 | name: user.name ?? null, |
| 217 | avatarUrl: user.image ?? null, |
| 218 | roles: parseRoles(userRole(user)), |
| 219 | } satisfies Principal; |
| 220 | }); |
| 221 | |
| 222 | /** (a) The mcp() OAuth opaque bearer, with self-enforced expiry. */ |
| 223 | const authenticateOAuthBearer = (request: Request): Effect.Effect<Principal | null> => |
no test coverage detected