( request: Request, )
| 73 | * the return value means no admin read can accidentally become subject-scoped. |
| 74 | */ |
| 75 | const authorizeTenant = ( |
| 76 | request: Request, |
| 77 | ): Effect.Effect< |
| 78 | string, |
| 79 | AdminUsersUnauthorized | AdminUsersForbidden, |
| 80 | WorkOSClient | ApiKeyService | UserStoreService |
| 81 | > => |
| 82 | Effect.gen(function* () { |
| 83 | // (1) The bearer path. `resolveBearerAuth` (not `resolveApiKeyPrincipal`, |
| 84 | // which rejects org keys for the product plane) is what distinguishes an |
| 85 | // org key from a user key. |
| 86 | const bearer = yield* resolveBearerAuth(request).pipe( |
| 87 | // Every rejected-credential and infra failure collapses to one refusal: |
| 88 | // this plane must not report whether a key exists, belongs to another |
| 89 | // org, or merely lacks privilege. |
| 90 | Effect.catchCause(() => Effect.succeed(null)), |
| 91 | ); |
| 92 | if (bearer !== null) { |
| 93 | if (isPlatformAuth(bearer)) return bearer.organizationId; |
| 94 | // A user-scoped key authenticated fine but names one member; the platform |
| 95 | // plane has no honest way to serve it. |
| 96 | return yield* new AdminUsersForbidden(); |
| 97 | } |
| 98 | |
| 99 | // (2) The session path: a live admin membership in the selected org. |
| 100 | const workos = yield* WorkOSClient; |
| 101 | const session = yield* workos |
| 102 | .authenticateRequest(request) |
| 103 | .pipe(Effect.catchCause(() => Effect.succeed(null))); |
| 104 | if (!session) return yield* new AdminUsersUnauthorized(); |
| 105 | |
| 106 | const selector = orgSelectorFromRequest(request) ?? session.organizationId; |
| 107 | if (!selector) return yield* new AdminUsersForbidden(); |
| 108 | // Re-checks live membership, so the org selector header can only ever name |
| 109 | // an org the caller already belongs to. |
| 110 | const org = yield* authorizeOrganizationSelector(session.userId, selector).pipe( |
| 111 | Effect.catchCause(() => Effect.succeed(null)), |
| 112 | ); |
| 113 | if (!org) return yield* new AdminUsersForbidden(); |
| 114 | |
| 115 | const membership = yield* workos |
| 116 | .getUserOrgMembership(org.id, session.userId) |
| 117 | .pipe(Effect.catchCause(() => Effect.succeed(null))); |
| 118 | // A pending admin invite is not an active admin — require both. |
| 119 | if (!membership || membership.status !== "active" || membership.role?.slug !== "admin") { |
| 120 | return yield* new AdminUsersForbidden(); |
| 121 | } |
| 122 | return org.id; |
| 123 | }); |
| 124 | |
| 125 | /** |
| 126 | * How many user-detail reads run at once. Matches the account plane's own |
no test coverage detected