Function makeProtectedApiLive

apps/cloud/src/api/protected.ts:98–128

(
  rsLive: Layer.Layer<DbService | UserStoreService | MemberDirectory | WorkOsMirror>,
)

// account seat-gate, and the createOrganization free-limit gate each provide it
// where they run.)
export const makeProtectedApiLive = (
  rsLive: Layer.Layer<DbService | UserStoreService | MemberDirectory | WorkOsMirror>,
) => {
  // The neutral `IdentityProvider`, built per request: it reads `UserStoreService`
  // + `MemberDirectory` from `rsLive` and the WorkOS control plane (`WorkOSClient` + `ApiKeyService`,
  // stateless config — no per-request I/O socket) for the org-resolution path.
  // `orDie` because a WorkOS config error is unrecoverable.
  const identityLive = workosIdentityLayer.pipe(
    Layer.provide(rsLive),
    Layer.provide(ApiKeyService.WorkOS.pipe(Layer.provide(CoreSharedServices))),
    Layer.provide(CoreSharedServices),
    // oxlint-disable-next-line executor/no-effect-escape-hatch -- boundary: a boot-time WorkOS misconfiguration is unrecoverable
    Layer.orDie,
  );
  // The per-request layer the combine rebuilds in the request fiber's scope: the
  // postgres socket (`rsLive`) PLUS the identity layer that reads it. Combining it
  // into the auth middleware collapses `requires: IdentityProvider | DbService |
  // UserStoreService` to `never` (so `.layer` is a real Layer instead of the "Need
  // to combine" sentinel) AND keeps the socket request-scoped. Exposed as a
  // factory so tests can swap in a counting fake — see
  // `apps/cloud/src/api.request-scope.node.test.ts`.
  const requestScopedLive = rsLive.pipe(Layer.provideMerge(identityLive));
  const protectedMiddleware = ExecutionStackMiddleware.combine(
    requestScopedMiddleware(requestScopedLive),
  ).layer;
  return ProtectedCloudApiLive.pipe(
    Layer.provide(protectedMiddleware),
    Layer.provideMerge(AutumnService.Default),
    Layer.provideMerge(RouterConfigLive),
  );
};

export const ProtectedApiLive = makeProtectedApiLive(RequestScopedServicesLive);