Function authorized

apps/cloud/src/auth/organization.ts:189–197

(
  org: Organization,
  membership: ActiveMembership,
  options: AuthorizeOrganizationOptions,
)

// workspace write permission without a second read. WorkOS issues `admin` /
// `member`; anything unrecognized stays a plain member.
const authorized = (
  org: Organization,
  membership: ActiveMembership,
  options: AuthorizeOrganizationOptions,
) => {
  if (org.deletedAt !== null && options.deleted !== "allow") return null;
  const memberRole: "admin" | "member" = membership.role === "admin" ? "admin" : "member";
  return { ...org, memberRole };
};

// The organization row for a caller, minted from WorkOS when the mirror
// does not hold it — only for a caller WorkOS confirms as its member (see