Function verifyWorkosUserManagementToken

apps/cloud/src/mcp/jwt.ts:147–155

(token: string, jwks: JWTVerifyGetKey)

// and live org-membership is re-checked downstream. Signature + expiry are
// enforced by jose.
export const verifyWorkosUserManagementToken = (token: string, jwks: JWTVerifyGetKey) =>
  Effect.gen(function* () {
    const { payload } = yield* Effect.tryPromise({
      try: () => jwtVerify(token, jwks, workosAccessTokenOptions),
      catch: classifyJwtVerificationError,
    }).pipe(withJwtVerificationSpan);

    return identityFromClaims(payload);
  });