Function resolveSelfHostOrgRole

apps/host-selfhost/src/auth/identity.ts:38–51

(
  betterAuth: BetterAuthHandle,
  headers: Headers | Record<string, string>,
  organizationId: string,
)

 * Lookup failures fail closed to member authority.
 */
export const resolveSelfHostOrgRole = (
  betterAuth: BetterAuthHandle,
  headers: Headers | Record<string, string>,
  organizationId: string,
): Effect.Effect<"admin" | "member"> =>
  Effect.tryPromise(() =>
    betterAuth.auth.api.getActiveMemberRole({
      headers,
      query: { organizationId },
    }),
  ).pipe(
    Effect.orElseSucceed(() => null),
    Effect.map((membership) => (membership && isPrivileged(membership.role) ? "admin" : "member")),
  );

// ---------------------------------------------------------------------------
// The production IdentityProvider: resolve a request to a Better Auth session