Function authorizeOrganization

apps/cloud/src/auth/organization.ts:81–92

(userId: string, organizationId: string)

// 403).

export const authorizeOrganization = (userId: string, organizationId: string) =>
  Effect.gen(function* () {
    const workos = yield* WorkOSClient;
    const memberships = yield* workos.listUserMemberships(userId);
    const active = memberships.data.find(
      (m: { readonly organizationId: string; readonly status: string }) =>
        m.organizationId === organizationId && m.status === "active",
    );
    if (!active) return null;

    return yield* resolveOrganization(organizationId);
  });

// ---------------------------------------------------------------------------
// Org SELECTOR — the URL is the scope authority, not the session.