import { HttpApi, HttpApiBuilder } from "effect/unstable/httpapi";import { HttpServerRequest, HttpServerResponse } from "effect/unstable/http";import { Duration, Effect, Predicate } from "effect";import { isValidOrgSlug } from "@executor-js/api"; import { AUTH_PATHS, CloudAuthApi, CloudAuthPublicApi, McpExecutionNotFoundError, McpSessionForbiddenError, OrganizationDeletionForbidden,} from "./api";import { NoOrganization } from "@executor-js/api/server";// Pure constants/codec module (no React) — safe in the backend graph.import { AUTH_HINT_COOKIE } from "@executor-js/react/multiplayer/auth-hint";import { SessionContext, SessionCookies } from "./middleware";import { encodeLoginState, decodeLoginState } from "./login-state";import { safeReturnTo } from "./return-to";import { UserStoreService } from "./context";import { env } from "cloudflare:workers";import { WorkOSError } from "./errors";import { WorkOSClient } from "./workos";import { AutumnService } from "../extensions/billing/service";import { hasPaidOrganizationSubscription, isOverFreeOrganizationLimit, shouldApplyFreeOrganizationLimit,} from "../extensions/billing/plans";import { LAST_ORG_COOKIE } from "./last-org-cookie";import { ORG_SELECTOR_HEADER, authorizeOrganization, authorizeOrganizationSelector, resolveOrganization,} from "./organization";import { mcpSessionStub } from "@executor-js/cloudflare/mcp/session-stub"; const COOKIE_OPTIONS = { path: "/", httpOnly: true, sameSite: "lax" as const, maxAge: 60 * 60 * 24 * 7, secure: true,}; const STATE_COOKIE = "wos-login-state";const STATE_COOKIE_OPTIONS = { path: "/", httpOnly: true, sameSite: "lax" as const, maxAge: 10 * 60, secure: true,}; const RESPONSE_COOKIE_OPTIONS = { ...COOKIE_OPTIONS, maxAge: Duration.days(7),}; const RESPONSE_STATE_COOKIE_OPTIONS = { ...STATE_COOKIE_OPTIONS, maxAge: Duration.minutes(10),}; const DELETE_COOKIE_OPTIONS = { path: "/", httpOnly: true, sameSite: "lax" as const, maxAge: 0, expires: new Date(0), secure: true,}; const randomNonce = (): string => { const bytes = new Uint8Array(32); crypto.getRandomValues(bytes); return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");}; const timingSafeEqual = (a: string, b: string): boolean => { if (a.length !== b.length) return false; let diff = 0; for (let i = 0; i < a.length; i++) { diff |= a.charCodeAt(i) ^ b.charCodeAt(i); } return diff === 0;}; const requestHeaders = Effect.map(HttpServerRequest.HttpServerRequest.asEffect(), (req) => ({ ...req.headers,})); const firstPathSegment = (path: string): string | null => { const pathname = path.split(/[?#]/, 1)[0] ?? ""; const segment = pathname.split("/")[1]; return segment && isValidOrgSlug(segment) ? segment : null;}; const requestedOrgSelectorFromReturnTo = (returnTo: string): string | null => firstPathSegment(returnTo); const requireSelectedOrganization = Effect.gen(function* () { const session = yield* SessionContext; const headers = yield* requestHeaders; const selector = headers[ORG_SELECTOR_HEADER] ?? session.organizationId; if (!selector) { return yield* new NoOrganization(); } const org = yield* authorizeOrganizationSelector(session.accountId, selector).pipe( Effect.catch(() => Effect.fail(new NoOrganization())), ); if (!org) { return yield* new NoOrganization(); } return { ...session, organizationId: org.id, };}); const getMcpSessionStub = (mcpSessionId: string) => mcpSessionStub(env.MCP_SESSION, mcpSessionId); const failMcpApprovalResult = ( result: { readonly status: "not_found" | "forbidden" }, params: { readonly mcpSessionId: string; readonly executionId: string },) => { if (result.status === "forbidden") { return Effect.fail(new McpSessionForbiddenError({ mcpSessionId: params.mcpSessionId })); } return Effect.fail(new McpExecutionNotFoundError({ executionId: params.executionId }));}; const setResponseCookie = ( response: HttpServerResponse.HttpServerResponse, name: string, value: string, options: typeof RESPONSE_COOKIE_OPTIONS,) => HttpServerResponse.setCookieUnsafe(response, name, value, options); const deleteResponseCookie = (response: HttpServerResponse.HttpServerResponse, name: string) => HttpServerResponse.setCookieUnsafe(response, name, "", DELETE_COOKIE_OPTIONS); // ---------------------------------------------------------------------------// Single non-protected API surface — public (login/callback) + session// (me/logout/organizations/switch-organization). The session group has SessionAuth on it.// --------------------------------------------------------------------------- export const NonProtectedApi = HttpApi.make("cloudWeb").add(CloudAuthPublicApi).add(CloudAuthApi); // ---------------------------------------------------------------------------// Public auth handlers (no authentication required)// --------------------------------------------------------------------------- export const CloudAuthPublicHandlers = HttpApiBuilder.group( NonProtectedApi, "cloudAuthPublic", (handlers) => handlers .handleRaw("login", ({ query }) => Effect.gen(function* () { const workos = yield* WorkOSClient; // Use the explicit public site URL — in dev, the request's Host // header points at the internal proxy target, not the public URL // WorkOS needs to redirect back to. const origin = env.VITE_PUBLIC_SITE_URL ?? ""; // OAuth round-trips `state` verbatim, so the validated returnTo // rides inside it next to the CSRF nonce — no extra cookie. const state = encodeLoginState({ nonce: randomNonce(), returnTo: safeReturnTo(query.returnTo) ?? undefined, }); const url = workos.getAuthorizationUrl(`${origin}${AUTH_PATHS.callback}`, state); return setResponseCookie( HttpServerResponse.redirect(url, { status: 302 }), STATE_COOKIE, state, RESPONSE_STATE_COOKIE_OPTIONS, ); }), ) .handleRaw("callback", ({ request, query }) => Effect.gen(function* () { const workos = yield* WorkOSClient; const users = yield* UserStoreService; const cookieState = request.cookies[STATE_COOKIE] ?? null; // CSRF check is only enforced when the redirect carries a state // value — some WorkOS-initiated redirects don't include one. // When state is present, it MUST match the cookie we set on // /login. if (query.state !== undefined) { if (!cookieState || !timingSafeEqual(cookieState, query.state)) { return deleteResponseCookie( HttpServerResponse.text("Invalid login state", { status: 400 }), STATE_COOKIE, ); } } const result = yield* workos.authenticateWithCode(query.code); // Mirror the account locally yield* users.use((s) => s.ensureAccount(result.user.id)); let sealedSession = result.sealedSession; // Resume where the SSR gate interrupted them. The state passed the // CSRF check above whenever it's present, but it's still a // round-tripped value, so the returnTo inside it is re-validated like // any other untrusted path. const returnTo = safeReturnTo(decodeLoginState(query.state)?.returnTo) ?? "/"; const requestedOrgSelector = requestedOrgSelectorFromReturnTo(returnTo); const requestedOrg = requestedOrgSelector ? yield* authorizeOrganizationSelector(result.user.id, requestedOrgSelector).pipe( Effect.orElseSucceed(() => null), ) : null; // Prefer the org in the URL that sent the user to login. If the URL // is bare, or not an org route, prefer the org this browser last // worked in (the last-org cookie — it outlives the session precisely // so a fresh login lands where the user left off), then WorkOS's // org, then the first active membership for org-less sessions. // Pending memberships are skipped because refreshing into one 400s // and would bypass invite consent. The cookie is membership-checked // like any selector, so a stale one just falls through. let targetOrganizationId = requestedOrg?.id ?? null; if (!targetOrganizationId && !requestedOrgSelector) { const lastOrgSlug = request.cookies[LAST_ORG_COOKIE]; const lastOrg = lastOrgSlug && isValidOrgSlug(lastOrgSlug) ? yield* authorizeOrganizationSelector(result.user.id, lastOrgSlug).pipe( Effect.orElseSucceed(() => null), ) : null; targetOrganizationId = lastOrg?.id ?? null; } targetOrganizationId ??= result.organizationId ?? null; if (!targetOrganizationId && !requestedOrgSelector) { const memberships = yield* workos.listUserMemberships(result.user.id); const existingActive = memberships.data.find((m) => m.status === "active"); targetOrganizationId = existingActive?.organizationId ?? null; } if ( targetOrganizationId && targetOrganizationId !== result.organizationId && sealedSession ) { // Best-effort refresh: if WorkOS rejects, fall through with the // original session instead of 500ing the entire callback. const refreshed = yield* workos .refreshSession(sealedSession, targetOrganizationId) .pipe(Effect.orElseSucceed(() => null)); if (refreshed) sealedSession = refreshed; } if (!sealedSession) { return HttpServerResponse.text("Failed to create session", { status: 500, }); } return deleteResponseCookie( setResponseCookie( HttpServerResponse.redirect(returnTo, { status: 302 }), "wos-session", sealedSession, RESPONSE_COOKIE_OPTIONS, ), STATE_COOKIE, ); }), ) // CLI device-login discovery. The WorkOS device endpoints live on the // WorkOS API host (`WORKOS_API_URL`, or api.workos.com in production, // the SAME base the SDK uses, so e2e points the CLI at the emulator with // zero extra wiring). The CLI runs RFC 8628 against them as a public // client (no secret) and gets a WorkOS access-token JWT back. .handle("cliLogin", () => Effect.sync(() => { const base = (env.WORKOS_API_URL ?? "https://api.workos.com").replace(/\/+$/, ""); return { provider: "workos" as const, deviceAuthorizationEndpoint: `${base}/user_management/authorize/device`, tokenEndpoint: `${base}/user_management/authenticate`, clientId: env.WORKOS_CLIENT_ID, }; }), ),); // ---------------------------------------------------------------------------// Session auth handlers (require session, may or may not have an org)// --------------------------------------------------------------------------- export const CloudSessionAuthHandlers = HttpApiBuilder.group( NonProtectedApi, "cloudAuth", (handlers) => handlers .handle("me", () => Effect.gen(function* () { const session = yield* SessionContext; const org = session.organizationId ? yield* authorizeOrganization(session.accountId, session.organizationId) : null; return { user: { id: session.accountId, email: session.email, name: session.name, avatarUrl: session.avatarUrl, }, organization: org ? { id: org.id, name: org.name, slug: org.slug } : null, }; }), ) .handleRaw("logout", () => Effect.gen(function* () { const workos = yield* WorkOSClient; const session = yield* SessionContext; // WorkOS's documented sign-out: send the browser through the WorkOS // logout endpoint, which ends the AuthKit session upstream and then // redirects to the registered sign-out URL. Without this hop, the // hosted session survives and the next "Sign in" silently // re-authenticates (issue #1445). Fail-open when the cookie won't // unseal: local sign-out must still complete, so fall back to "/". const origin = env.VITE_PUBLIC_SITE_URL ?? ""; const logoutUrl = yield* workos.logoutUrl( session.sealedSession, origin ? `${origin}/` : undefined, ); // The auth-hint travels with the session: leaving it behind would // make the next page load optimistically paint the app shell for a // signed-out browser. return deleteResponseCookie( deleteResponseCookie( HttpServerResponse.redirect(logoutUrl ?? "/", { status: 302 }), "wos-session", ), AUTH_HINT_COOKIE, ); }), ) .handle("organizations", () => Effect.gen(function* () { const workos = yield* WorkOSClient; const session = yield* SessionContext; const memberships = yield* workos.listUserMemberships(session.accountId); // Resolve through the mirror (not WorkOS directly) so each org's // URL slug is minted/read — the switcher navigates to `/<slug>`. const organizations = yield* Effect.all( memberships.data.map((m) => resolveOrganization(m.organizationId).pipe( Effect.map((org) => ({ id: org.id, name: org.name, slug: org.slug, })), Effect.orElseSucceed(() => null), ), ), { concurrency: "unbounded" }, ); return { organizations: organizations.filter(Predicate.isNotNull), activeOrganizationId: session.organizationId, }; }), ) .handle("createOrganization", ({ payload }) => Effect.gen(function* () { const workos = yield* WorkOSClient; const users = yield* UserStoreService; const session = yield* SessionContext; const autumn = yield* AutumnService; const name = payload.name.trim(); const memberships = yield* workos.listUserMemberships(session.accountId); const activeMemberships = memberships.data.filter( (membership) => membership.status === "active", ); if (isOverFreeOrganizationLimit(activeMemberships)) { const paidOrganizationIds = yield* Effect.all( activeMemberships.map((membership) => autumn .use((client) => client.customers.getOrCreate({ customerId: membership.organizationId, }), ) .pipe( Effect.map((customer) => hasPaidOrganizationSubscription(customer.subscriptions) ? membership.organizationId : null, ), ), ), { concurrency: 3 }, ).pipe( Effect.catchTag("AutumnError", () => Effect.fail(new WorkOSError())), Effect.map((ids) => new Set(ids.filter(Predicate.isNotNull))), ); if (shouldApplyFreeOrganizationLimit(activeMemberships, paidOrganizationIds)) { return yield* new WorkOSError(); } } const org = yield* workos.createOrganization(name); yield* workos.createMembership(org.id, session.accountId, "admin"); // `upsertOrganization` mints the slug at insert — no separate heal step. const mirrored = yield* users.use((s) => s.upsertOrganization({ id: org.id, name: org.name }), ); // Try to attach the new org to the current session. This can fail // (or silently return a session still scoped to the old org) when // the caller's current session is stale — most commonly after the // user was removed from the org their cookie is pinned to. In that // case we can't repair the session in-place, so we clear the // cookie and fail loudly; the frontend will bounce to login and // the callback's rehydrate path will pick up the new membership. const refreshed = yield* workos.refreshSession(session.sealedSession, org.id); const verified = refreshed ? yield* workos.authenticateSealedSession(refreshed) : null; if (!refreshed || !verified || verified.organizationId !== org.id) { yield* Effect.logWarning( "createOrganization: unable to attach new org to current session", { userId: session.accountId, newOrgId: org.id, refreshReturnedSession: refreshed != null, verifiedOrgId: verified?.organizationId ?? null, }, ); (yield* SessionCookies).set("wos-session", "", DELETE_COOKIE_OPTIONS); return yield* new WorkOSError(); } (yield* SessionCookies).set("wos-session", refreshed, RESPONSE_COOKIE_OPTIONS); return { id: org.id, name: org.name, slug: mirrored.slug }; }), ) .handle("deleteOrganization", ({ payload }) => Effect.gen(function* () { const workos = yield* WorkOSClient; const users = yield* UserStoreService; const autumn = yield* AutumnService; // Target the caller's currently-selected org (honors the org-selector // header, same as the other org-scoped auth handlers). NoOrganization // when the session has no org to act on. const session = yield* requireSelectedOrganization; const organizationId = session.organizationId; // Admin-only. Live WorkOS check so a member removed/demoted moments // ago can't delete the workspace. A pending admin invite is not an // active admin, so require active status too. const membership = yield* workos.getUserOrgMembership(organizationId, session.accountId); if (!membership || membership.status !== "active" || membership.role?.slug !== "admin") { return yield* new OrganizationDeletionForbidden(); } // The typed confirmation must match the org's current name — the same // label the settings page shows. Trimmed on both sides. const org = yield* users.use((s) => s.getOrganization(organizationId)); if (!org || payload.confirmName.trim() !== org.name.trim()) { return yield* new OrganizationDeletionForbidden(); } // WorkOS FIRST. Once the org is gone there, membership authorization // fails for every member, so the workspace is truly deleted even if a // later local step lags (leftover local rows become unreachable, not // user-visible). The reverse order risks the org resurrecting as an // empty workspace when a later request re-mirrors it with a new slug. yield* workos.deleteOrganization(organizationId); // Purge all local tenant data, secrets, and the identity mirror // (cascades local memberships) in one transaction. If this fails // after the WorkOS delete already succeeded, the org is gone for // everyone (unreachable) but its secrets/tenant rows linger orphaned — // alert loudly so that window gets swept, then surface the failure. yield* users .use((s) => s.deleteOrganizationCascade(organizationId)) .pipe( Effect.tapError((error) => Effect.logError( "deleteOrganization: WorkOS org deleted but local purge failed, tenant data and secrets orphaned", { organizationId, error },Lines 1–500 of 682. Load more
import { HttpApi, HttpApiBuilder } from "effect/unstable/httpapi"; import { HttpServerRequest, HttpServerResponse } from "effect/unstable/http"; import { Duration, Effect, Predicate } from "effect"; import { isValidOrgSlug } from "@executor-js/api"; import { AUTH_PATHS, CloudAuthApi, CloudAuthPublicApi, McpExecutionNotFoundError, McpSessionForbiddenError, OrganizationDeletionForbidden, } from "./api"; import { NoOrganization } from "@executor-js/api/server"; // Pure constants/codec module (no React) — safe in the backend graph. import { AUTH_HINT_COOKIE } from "@executor-js/react/multiplayer/auth-hint"; import { SessionContext, SessionCookies } from "./middleware"; import { encodeLoginState, decodeLoginState } from "./login-state"; import { safeReturnTo } from "./return-to"; import { UserStoreService } from "./context"; import { env } from "cloudflare:workers"; import { WorkOSError } from "./errors"; import { WorkOSClient } from "./workos"; import { AutumnService } from "../extensions/billing/service"; import { hasPaidOrganizationSubscription, isOverFreeOrganizationLimit, shouldApplyFreeOrganizationLimit, } from "../extensions/billing/plans"; import { LAST_ORG_COOKIE } from "./last-org-cookie"; import { ORG_SELECTOR_HEADER, authorizeOrganization, authorizeOrganizationSelector, resolveOrganization, } from "./organization"; import { mcpSessionStub } from "@executor-js/cloudflare/mcp/session-stub"; const COOKIE_OPTIONS = { path: "/", httpOnly: true, sameSite: "lax" as const, maxAge: 60 * 60 * 24 * 7, secure: true, }; const STATE_COOKIE = "wos-login-state"; const STATE_COOKIE_OPTIONS = { path: "/", httpOnly: true, sameSite: "lax" as const, maxAge: 10 * 60, secure: true, }; const RESPONSE_COOKIE_OPTIONS = { ...COOKIE_OPTIONS, maxAge: Duration.days(7), }; const RESPONSE_STATE_COOKIE_OPTIONS = { ...STATE_COOKIE_OPTIONS, maxAge: Duration.minutes(10), }; const DELETE_COOKIE_OPTIONS = { path: "/", httpOnly: true, sameSite: "lax" as const, maxAge: 0, expires: new Date(0), secure: true, }; const randomNonce = (): string => { const bytes = new Uint8Array(32); crypto.getRandomValues(bytes); return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join(""); }; const timingSafeEqual = (a: string, b: string): boolean => { if (a.length !== b.length) return false; let diff = 0; for (let i = 0; i < a.length; i++) { diff |= a.charCodeAt(i) ^ b.charCodeAt(i); } return diff === 0; }; const requestHeaders = Effect.map(HttpServerRequest.HttpServerRequest.asEffect(), (req) => ({ ...req.headers, })); const firstPathSegment = (path: string): string | null => { const pathname = path.split(/[?#]/, 1)[0] ?? ""; const segment = pathname.split("/")[1]; return segment && isValidOrgSlug(segment) ? segment : null; }; const requestedOrgSelectorFromReturnTo = (returnTo: string): string | null => firstPathSegment(returnTo); const requireSelectedOrganization = Effect.gen(function* () { const session = yield* SessionContext; const headers = yield* requestHeaders; const selector = headers[ORG_SELECTOR_HEADER] ?? session.organizationId; if (!selector) { return yield* new NoOrganization(); } const org = yield* authorizeOrganizationSelector(session.accountId, selector).pipe( Effect.catch(() => Effect.fail(new NoOrganization())), ); if (!org) { return yield* new NoOrganization(); } return { ...session, organizationId: org.id, }; }); const getMcpSessionStub = (mcpSessionId: string) => mcpSessionStub(env.MCP_SESSION, mcpSessionId); const failMcpApprovalResult = ( result: { readonly status: "not_found" | "forbidden" }, params: { readonly mcpSessionId: string; readonly executionId: string }, ) => { if (result.status === "forbidden") { return Effect.fail(new McpSessionForbiddenError({ mcpSessionId: params.mcpSessionId })); } return Effect.fail(new McpExecutionNotFoundError({ executionId: params.executionId })); }; const setResponseCookie = ( response: HttpServerResponse.HttpServerResponse, name: string, value: string, options: typeof RESPONSE_COOKIE_OPTIONS, ) => HttpServerResponse.setCookieUnsafe(response, name, value, options); const deleteResponseCookie = (response: HttpServerResponse.HttpServerResponse, name: string) => HttpServerResponse.setCookieUnsafe(response, name, "", DELETE_COOKIE_OPTIONS); // --------------------------------------------------------------------------- // Single non-protected API surface — public (login/callback) + session // (me/logout/organizations/switch-organization). The session group has SessionAuth on it. // --------------------------------------------------------------------------- export const NonProtectedApi = HttpApi.make("cloudWeb").add(CloudAuthPublicApi).add(CloudAuthApi); // --------------------------------------------------------------------------- // Public auth handlers (no authentication required) // --------------------------------------------------------------------------- export const CloudAuthPublicHandlers = HttpApiBuilder.group( NonProtectedApi, "cloudAuthPublic", (handlers) => handlers .handleRaw("login", ({ query }) => Effect.gen(function* () { const workos = yield* WorkOSClient; // Use the explicit public site URL — in dev, the request's Host // header points at the internal proxy target, not the public URL // WorkOS needs to redirect back to. const origin = env.VITE_PUBLIC_SITE_URL ?? ""; // OAuth round-trips `state` verbatim, so the validated returnTo // rides inside it next to the CSRF nonce — no extra cookie. const state = encodeLoginState({ nonce: randomNonce(), returnTo: safeReturnTo(query.returnTo) ?? undefined, }); const url = workos.getAuthorizationUrl(`${origin}${AUTH_PATHS.callback}`, state); return setResponseCookie( HttpServerResponse.redirect(url, { status: 302 }), STATE_COOKIE, state, RESPONSE_STATE_COOKIE_OPTIONS, ); }), ) .handleRaw("callback", ({ request, query }) => Effect.gen(function* () { const workos = yield* WorkOSClient; const users = yield* UserStoreService; const cookieState = request.cookies[STATE_COOKIE] ?? null; // CSRF check is only enforced when the redirect carries a state // value — some WorkOS-initiated redirects don't include one. // When state is present, it MUST match the cookie we set on // /login. if (query.state !== undefined) { if (!cookieState || !timingSafeEqual(cookieState, query.state)) { return deleteResponseCookie( HttpServerResponse.text("Invalid login state", { status: 400 }), STATE_COOKIE, ); } } const result = yield* workos.authenticateWithCode(query.code); // Mirror the account locally yield* users.use((s) => s.ensureAccount(result.user.id)); let sealedSession = result.sealedSession; // Resume where the SSR gate interrupted them. The state passed the // CSRF check above whenever it's present, but it's still a // round-tripped value, so the returnTo inside it is re-validated like // any other untrusted path. const returnTo = safeReturnTo(decodeLoginState(query.state)?.returnTo) ?? "/"; const requestedOrgSelector = requestedOrgSelectorFromReturnTo(returnTo); const requestedOrg = requestedOrgSelector ? yield* authorizeOrganizationSelector(result.user.id, requestedOrgSelector).pipe( Effect.orElseSucceed(() => null), ) : null; // Prefer the org in the URL that sent the user to login. If the URL // is bare, or not an org route, prefer the org this browser last // worked in (the last-org cookie — it outlives the session precisely // so a fresh login lands where the user left off), then WorkOS's // org, then the first active membership for org-less sessions. // Pending memberships are skipped because refreshing into one 400s // and would bypass invite consent. The cookie is membership-checked // like any selector, so a stale one just falls through. let targetOrganizationId = requestedOrg?.id ?? null; if (!targetOrganizationId && !requestedOrgSelector) { const lastOrgSlug = request.cookies[LAST_ORG_COOKIE]; const lastOrg = lastOrgSlug && isValidOrgSlug(lastOrgSlug) ? yield* authorizeOrganizationSelector(result.user.id, lastOrgSlug).pipe( Effect.orElseSucceed(() => null), ) : null; targetOrganizationId = lastOrg?.id ?? null; } targetOrganizationId ??= result.organizationId ?? null; if (!targetOrganizationId && !requestedOrgSelector) { const memberships = yield* workos.listUserMemberships(result.user.id); const existingActive = memberships.data.find((m) => m.status === "active"); targetOrganizationId = existingActive?.organizationId ?? null; } if ( targetOrganizationId && targetOrganizationId !== result.organizationId && sealedSession ) { // Best-effort refresh: if WorkOS rejects, fall through with the // original session instead of 500ing the entire callback. const refreshed = yield* workos .refreshSession(sealedSession, targetOrganizationId) .pipe(Effect.orElseSucceed(() => null)); if (refreshed) sealedSession = refreshed; } if (!sealedSession) { return HttpServerResponse.text("Failed to create session", { status: 500, }); } return deleteResponseCookie( setResponseCookie( HttpServerResponse.redirect(returnTo, { status: 302 }), "wos-session", sealedSession, RESPONSE_COOKIE_OPTIONS, ), STATE_COOKIE, ); }), ) // CLI device-login discovery. The WorkOS device endpoints live on the // WorkOS API host (`WORKOS_API_URL`, or api.workos.com in production, // the SAME base the SDK uses, so e2e points the CLI at the emulator with // zero extra wiring). The CLI runs RFC 8628 against them as a public // client (no secret) and gets a WorkOS access-token JWT back. .handle("cliLogin", () => Effect.sync(() => { const base = (env.WORKOS_API_URL ?? "https://api.workos.com").replace(/\/+$/, ""); return { provider: "workos" as const, deviceAuthorizationEndpoint: `${base}/user_management/authorize/device`, tokenEndpoint: `${base}/user_management/authenticate`, clientId: env.WORKOS_CLIENT_ID, }; }), ), ); // --------------------------------------------------------------------------- // Session auth handlers (require session, may or may not have an org) // --------------------------------------------------------------------------- export const CloudSessionAuthHandlers = HttpApiBuilder.group( NonProtectedApi, "cloudAuth", (handlers) => handlers .handle("me", () => Effect.gen(function* () { const session = yield* SessionContext; const org = session.organizationId ? yield* authorizeOrganization(session.accountId, session.organizationId) : null; return { user: { id: session.accountId, email: session.email, name: session.name, avatarUrl: session.avatarUrl, }, organization: org ? { id: org.id, name: org.name, slug: org.slug } : null, }; }), ) .handleRaw("logout", () => Effect.gen(function* () { const workos = yield* WorkOSClient; const session = yield* SessionContext; // WorkOS's documented sign-out: send the browser through the WorkOS // logout endpoint, which ends the AuthKit session upstream and then // redirects to the registered sign-out URL. Without this hop, the // hosted session survives and the next "Sign in" silently // re-authenticates (issue #1445). Fail-open when the cookie won't // unseal: local sign-out must still complete, so fall back to "/". const origin = env.VITE_PUBLIC_SITE_URL ?? ""; const logoutUrl = yield* workos.logoutUrl( session.sealedSession, origin ? `${origin}/` : undefined, ); // The auth-hint travels with the session: leaving it behind would // make the next page load optimistically paint the app shell for a // signed-out browser. return deleteResponseCookie( deleteResponseCookie( HttpServerResponse.redirect(logoutUrl ?? "/", { status: 302 }), "wos-session", ), AUTH_HINT_COOKIE, ); }), ) .handle("organizations", () => Effect.gen(function* () { const workos = yield* WorkOSClient; const session = yield* SessionContext; const memberships = yield* workos.listUserMemberships(session.accountId); // Resolve through the mirror (not WorkOS directly) so each org's // URL slug is minted/read — the switcher navigates to `/<slug>`. const organizations = yield* Effect.all( memberships.data.map((m) => resolveOrganization(m.organizationId).pipe( Effect.map((org) => ({ id: org.id, name: org.name, slug: org.slug, })), Effect.orElseSucceed(() => null), ), ), { concurrency: "unbounded" }, ); return { organizations: organizations.filter(Predicate.isNotNull), activeOrganizationId: session.organizationId, }; }), ) .handle("createOrganization", ({ payload }) => Effect.gen(function* () { const workos = yield* WorkOSClient; const users = yield* UserStoreService; const session = yield* SessionContext; const autumn = yield* AutumnService; const name = payload.name.trim(); const memberships = yield* workos.listUserMemberships(session.accountId); const activeMemberships = memberships.data.filter( (membership) => membership.status === "active", ); if (isOverFreeOrganizationLimit(activeMemberships)) { const paidOrganizationIds = yield* Effect.all( activeMemberships.map((membership) => autumn .use((client) => client.customers.getOrCreate({ customerId: membership.organizationId, }), ) .pipe( Effect.map((customer) => hasPaidOrganizationSubscription(customer.subscriptions) ? membership.organizationId : null, ), ), ), { concurrency: 3 }, ).pipe( Effect.catchTag("AutumnError", () => Effect.fail(new WorkOSError())), Effect.map((ids) => new Set(ids.filter(Predicate.isNotNull))), ); if (shouldApplyFreeOrganizationLimit(activeMemberships, paidOrganizationIds)) { return yield* new WorkOSError(); } } const org = yield* workos.createOrganization(name); yield* workos.createMembership(org.id, session.accountId, "admin"); // `upsertOrganization` mints the slug at insert — no separate heal step. const mirrored = yield* users.use((s) => s.upsertOrganization({ id: org.id, name: org.name }), ); // Try to attach the new org to the current session. This can fail // (or silently return a session still scoped to the old org) when // the caller's current session is stale — most commonly after the // user was removed from the org their cookie is pinned to. In that // case we can't repair the session in-place, so we clear the // cookie and fail loudly; the frontend will bounce to login and // the callback's rehydrate path will pick up the new membership. const refreshed = yield* workos.refreshSession(session.sealedSession, org.id); const verified = refreshed ? yield* workos.authenticateSealedSession(refreshed) : null; if (!refreshed || !verified || verified.organizationId !== org.id) { yield* Effect.logWarning( "createOrganization: unable to attach new org to current session", { userId: session.accountId, newOrgId: org.id, refreshReturnedSession: refreshed != null, verifiedOrgId: verified?.organizationId ?? null, }, ); (yield* SessionCookies).set("wos-session", "", DELETE_COOKIE_OPTIONS); return yield* new WorkOSError(); } (yield* SessionCookies).set("wos-session", refreshed, RESPONSE_COOKIE_OPTIONS); return { id: org.id, name: org.name, slug: mirrored.slug }; }), ) .handle("deleteOrganization", ({ payload }) => Effect.gen(function* () { const workos = yield* WorkOSClient; const users = yield* UserStoreService; const autumn = yield* AutumnService; // Target the caller's currently-selected org (honors the org-selector // header, same as the other org-scoped auth handlers). NoOrganization // when the session has no org to act on. const session = yield* requireSelectedOrganization; const organizationId = session.organizationId; // Admin-only. Live WorkOS check so a member removed/demoted moments // ago can't delete the workspace. A pending admin invite is not an // active admin, so require active status too. const membership = yield* workos.getUserOrgMembership(organizationId, session.accountId); if (!membership || membership.status !== "active" || membership.role?.slug !== "admin") { return yield* new OrganizationDeletionForbidden(); } // The typed confirmation must match the org's current name — the same // label the settings page shows. Trimmed on both sides. const org = yield* users.use((s) => s.getOrganization(organizationId)); if (!org || payload.confirmName.trim() !== org.name.trim()) { return yield* new OrganizationDeletionForbidden(); } // WorkOS FIRST. Once the org is gone there, membership authorization // fails for every member, so the workspace is truly deleted even if a // later local step lags (leftover local rows become unreachable, not // user-visible). The reverse order risks the org resurrecting as an // empty workspace when a later request re-mirrors it with a new slug. yield* workos.deleteOrganization(organizationId); // Purge all local tenant data, secrets, and the identity mirror // (cascades local memberships) in one transaction. If this fails // after the WorkOS delete already succeeded, the org is gone for // everyone (unreachable) but its secrets/tenant rows linger orphaned — // alert loudly so that window gets swept, then surface the failure. yield* users .use((s) => s.deleteOrganizationCascade(organizationId)) .pipe( Effect.tapError((error) => Effect.logError( "deleteOrganization: WorkOS org deleted but local purge failed, tenant data and secrets orphaned", { organizationId, error },