| 200 | // check; an unknown slug authorizes nothing. Ids pass straight through — |
| 201 | // `authorizeOrganization` verifies live WorkOS membership either way. |
| 202 | const resolveOrgSelector = (selector: string) => |
| 203 | selector.startsWith("org_") |
| 204 | ? Effect.succeed(selector) |
| 205 | : Effect.gen(function* () { |
| 206 | const users = yield* UserStoreService; |
| 207 | const org = yield* users.use("getOrganizationBySlug", (s) => |
| 208 | s.getOrganizationBySlug(selector), |
| 209 | ); |
| 210 | return org?.id ?? null; |
| 211 | }); |
| 212 | |
| 213 | export const McpOrganizationAuthLive = Layer.succeed(McpOrganizationAuth)({ |
| 214 | authorize: (accountId, organizationSelector) => |