| 224 | // check; an unknown slug authorizes nothing. Ids pass straight through — |
| 225 | // `authorizeOrganization` verifies membership against the mirror either way. |
| 226 | const resolveOrgSelector = (selector: string) => |
| 227 | selector.startsWith("org_") |
| 228 | ? Effect.succeed(selector) |
| 229 | : Effect.gen(function* () { |
| 230 | const users = yield* UserStoreService; |
| 231 | const org = yield* users.use("getOrganizationBySlug", (s) => |
| 232 | s.getOrganizationBySlug(selector), |
| 233 | ); |
| 234 | return org?.id ?? null; |
| 235 | }); |
| 236 | |
| 237 | export const McpOrganizationAuthLive = Layer.succeed(McpOrganizationAuth)({ |
| 238 | authorize: (accountId, organizationSelector) => |