Function authorizeOrganization

apps/cloud/src/auth/organization.ts:81–99

(userId: string, organizationId: string)

// 403).

export const authorizeOrganization = (userId: string, organizationId: string) =>
  Effect.gen(function* () {
    const workos = yield* WorkOSClient;
    const memberships = yield* workos.listUserMemberships(userId);
    const active = memberships.data.find(
      (m: { readonly organizationId: string; readonly status: string }) =>
        m.organizationId === organizationId && m.status === "active",
    );
    if (!active) return null;

    const org = yield* resolveOrganization(organizationId);
    // The membership row already names the caller's role — surface it
    // normalized so identity resolution can bind the executor's workspace
    // write permission without a second WorkOS call. WorkOS issues
    // `admin` / `member`; anything unrecognized stays a plain member.
    const roleSlug = (active as { readonly role?: { readonly slug?: string } }).role?.slug;
    const memberRole: "admin" | "member" = roleSlug === "admin" ? "admin" : "member";
    return { ...org, memberRole };
  });

// ---------------------------------------------------------------------------
// Org SELECTOR — the URL is the scope authority, not the session.