Function emailResolver

apps/cloud/src/admin/admin-users-api.ts:208–232

(organizationId: string, context: Context.Context<WorkOSClient>)

 */
export const emailResolver =
  (organizationId: string, context: Context.Context<WorkOSClient>): AdminEmailResolver =>
  (email) =>
    Effect.gen(function* () {
      const workos = yield* WorkOSClient;

      if (!env.WORKOS_API_URL) {
        const users = yield* workos.listUsers({ email, organizationId });
        return users.data[0]?.id ?? null;
      }

      const memberships = yield* workos.listOrgMembers(organizationId);
      const userIds = memberships.data.map((membership) => membership.userId);

      // Emulator compatibility only. Short-circuit once the normalized email
      // matches so the fallback makes as few unsupported-detail reads as it can.
      const match = yield* Effect.findFirst(userIds, (userId) =>
        workos.getUser(userId).pipe(
          Effect.map((user) => normalizeAdminUserEmail(user.email ?? "") === email),
          // One unreadable user must not fail the whole lookup — it simply
          // cannot be the match.
          Effect.catchCause(() => Effect.succeed(false)),
        ),
      );
      return Option.getOrNull(match);
    }).pipe(Effect.provideContext(context));

/** Both directions of cloud's directory, built once per authorized request. */
const userDirectory = (