Function makeMcpOrganizationAuthServices

apps/cloud/src/mcp/auth.ts:209–221

()

// MemberDirectory + WorkOsMirror layer per call gives each request its own
// request-scoped socket. `CoreSharedServices` (WorkOS, no per-request socket) stays shared.
const makeMcpOrganizationAuthServices = () => {
  const dbLive = makeDbLayer();
  const userStoreLive = makeUserStoreLayer().pipe(Layer.provide(dbLive));
  const memberDirectoryLive = makeMemberDirectoryLayer().pipe(Layer.provide(dbLive));
  const workOsMirrorLive = makeWorkOsMirrorLayer().pipe(Layer.provide(dbLive));
  return Layer.mergeAll(
    dbLive,
    userStoreLive,
    memberDirectoryLive,
    workOsMirrorLive,
    CoreSharedServices,
  );
};

// A URL slug resolves through the mirror to its org id before the membership
// check; an unknown slug authorizes nothing. Ids pass straight through —