| 214 | // check; an unknown slug authorizes nothing. Ids pass straight through — |
| 215 | // `authorizeOrganization` verifies live WorkOS membership either way. |
| 216 | const resolveOrgSelector = (selector: string) => |
| 217 | selector.startsWith("org_") |
| 218 | ? Effect.succeed(selector) |
| 219 | : Effect.gen(function* () { |
| 220 | const users = yield* UserStoreService; |
| 221 | const org = yield* users.use("getOrganizationBySlug", (s) => |
| 222 | s.getOrganizationBySlug(selector), |
| 223 | ); |
| 224 | return org?.id ?? null; |
| 225 | }); |
| 226 | |
| 227 | export const McpOrganizationAuthLive = Layer.succeed(McpOrganizationAuth)({ |
| 228 | authorize: (accountId, organizationSelector) => |