Function heldOrResolvedForMember

apps/cloud/src/auth/organization.ts:202–215

(userId: string, organizationId: string)

// does not hold it — only for a caller WorkOS confirms as its member (see
// above). `null` when the mirror has no row and WorkOS lists no membership.
const heldOrResolvedForMember = (userId: string, organizationId: string) =>
  Effect.gen(function* () {
    const users = yield* UserStoreService;
    const held = yield* users.use("getOrganization", (s) => s.getOrganization(organizationId));
    if (held) return held;
    const workos = yield* WorkOSClient;
    const membership = yield* workos.getUserOrgMembership(organizationId, userId);
    if (!membership) return null;
    yield* Effect.logInfo(
      "authorizeOrganization: organization not mirrored; resolving it from WorkOS for its member",
      { organizationId },
    );
    return yield* resolveOrganization(organizationId);
  });

/** The span every membership authorization runs under. */
export const AUTHORIZE_ORGANIZATION_SPAN = "auth.authorize_organization";