// ---------------------------------------------------------------------------// Organization resolution + authorization.//// One module for the cloud org auth-resolution path://   - `resolveOrganization`  — local mirror with lazy WorkOS fallback.//   - `authorizeOrganization` — membership check against the local membership//     mirror, returns the resolved org.//// Deliberately billing-FREE: this module is reached by the MCP session DO bundle// (via `mcp/auth.ts`), which must not transitively import any billing config// (`autumn.config` / `atmn`). The free-organizations-per-user limit predicates —// which DO depend on the Autumn plan config — live in `extensions/billing/plans.ts`.// --------------------------------------------------------------------------- import { Clock, Effect } from "effect";import { MemberDirectory } from "@executor-js/api/server";import { EXECUTOR_ORG_SELECTOR_HEADER } from "@executor-js/sdk/shared"; import { UserStoreService } from "./context";import { ensureOrganizationBackfilled } from "./mirror-feeders";import type { Organization } from "./user-store";import { WorkOSClient } from "./workos"; // ---------------------------------------------------------------------------// Resolution — local mirror with lazy WorkOS fallback.// ---------------------------------------------------------------------------//// We keep a minimal local mirror of organizations so domain tables can// foreign-key against them and so we don't hit WorkOS on every request.// But the mirror can drift: a user's session can reference an org that was// created outside this app (or before the mirror existed). Rather than// proactively mirroring on every login — which was the source of the messy// callback flow we just untangled — we mirror lazily the first time an// unknown org is read. All other callers just do `getOrganization` and get// a self-healing lookup for free.//// URL slugs are OURS (WorkOS orgs have none) and are minted at the moment a// row is inserted — `upsertOrganization` is the single mint point, so the// mirror-on-first-read below produces a slugged, routable org without any// read-path healing. export const resolveOrganization = (organizationId: string) =>  Effect.gen(function* () {    const users = yield* UserStoreService;    const existing = yield* users.use("getOrganization", (s) => s.getOrganization(organizationId));    if (existing) return existing;     const workos = yield* WorkOSClient;    const fresh = yield* workos.getOrganization(organizationId);    return yield* users.use("upsertOrganization", (s) =>      s.upsertOrganization({        id: fresh.id,        name: fresh.name,        updatedAt: new Date(fresh.updatedAt),      }),    );  }); // ---------------------------------------------------------------------------// Deletion mark — the local step that revokes an organization.// ---------------------------------------------------------------------------//// Membership is authorized from the local mirror (below), so deleting the// WorkOS organization revokes nothing here by itself: the local membership// rows keep authorizing sessions until the local purge removes them, and a// purge that fails leaves them live. This mark is what revokes access, and it// is the FIRST step of cloud's deletion flow (`auth/handlers.ts`// deleteOrganization) — before the WorkOS delete and the purge, both of which// can fail — and what the `organization.deleted` event applies// (`workos-events-sync.ts`) when the org was deleted in the WorkOS dashboard// instead. Membership rows are left as they are; the mark alone refuses them.// Idempotent: a retry keeps the first mark. An org the mirror does not hold// is not marked (nothing to revoke), and `false` says so. export const markOrganizationDeleted = (organizationId: string) =>  Effect.gen(function* () {    const users = yield* UserStoreService;    const at = new Date(yield* Clock.currentTimeMillis);    const marked = yield* users.use("markOrganizationDeleted", (s) =>      s.markOrganizationDeleted(organizationId, at),    );    return marked !== null;  }); // ---------------------------------------------------------------------------// Authorization — membership check against the local membership mirror.// ---------------------------------------------------------------------------//// The sealed session cookie carries an organizationId that WorkOS signed at// login / refresh time. WorkOS does NOT invalidate existing sessions when a// membership is revoked, and `session.authenticate()` validates the JWT// locally without hitting the API — so a removed user would keep full access// until their access token naturally expired (~10 min) if the session were// trusted on its own.//// To close that gap, membership is verified on every protected request// against the LOCAL mirror of WorkOS memberships (`memberships` join// `accounts`, read through the shared `MemberDirectory`) — never against// WorkOS itself, and unconditionally: there is no readiness gate and no// per-request WorkOS fallback. The mirror is not a cache with a TTL; it is a// replica whose freshness is defined by its feeders://   - login (`auth/handlers.ts` callback): the user and every membership WorkOS//     lists for them, from the list the callback already fetches;//   - write-through: every membership change Executor makes (create org,//     invite, accept, remove, change role) lands in the mirror in the same//     request, so a revocation through Executor is denied on the NEXT request;//   - the WorkOS Events API reconciler (`workos-events-sync.ts`, every minute//     by cron plus a signed webhook poke): changes made in the WorkOS//     dashboard land within seconds.// The membership row must be `active`: a pending invitee is not a member, and a// deactivated member keeps their row but not their access. And the// organization must not be marked deleted (`organizations.deleted_at`): cloud's// deletion flow (`auth/handlers.ts` deleteOrganization) sets that mark FIRST,// before the WorkOS delete and the local purge, so an org whose deletion did// not finish refuses every session at once — its membership rows are still// there, live, until the purge removes them, and must not authorize anyone.//// The one-off backfill is complete and permanent, and an organization that// predates it is covered on demand (below), so there is nothing left for a// per-request readiness check to gate. What can still go wrong is the events// reconciler falling behind — a member revoked in the WorkOS dashboard would// keep a stale active row until it catches up. That is now an OPERATIONAL// concern, not a request-path fallback: the reconciler itself// (`workos-events-runner.ts`) checks its own drain lag after every run and// raises a Sentry error when it has stalled, so it is fixed by paging someone,// not by asking WorkOS on every request. The deploy gate// (`scripts/ensure-workos-mirror-ready.ts`) separately refuses to ship a build// that trusts the mirror while it is unready, using the same rule// (`mirror-readiness-store.ts`).//// Completeness is PER ORGANIZATION. An organization whose row was minted// after the backfill ran — lazily by a request (`resolveOrganization`), or by// a first login — carries no `backfilled_at`, and the mirror holds only the// memberships login and write-through happened to record for it: a member// who has not signed in since would be refused on a row that was never// written. So the org row is read FIRST, and an unmarked live organization is// scanned from WorkOS (`ensureOrganizationBackfilled`: one membership listing// plus one `getUser` per member, then the mark) BEFORE its mirror is read —// the same on-demand scan the seat gates run. One-time per organization: the// scan marks the row, and this branch is never taken for it again. An// organization the mirror does not hold at all — one that predates the// mirror and that nobody has signed in to since (a CLI or MCP token names it,// and the JWT path has no login feeder), or one created in the WorkOS// dashboard — is reachable by neither the backfill (which lists the mirror's// organizations) nor the reconciler (which starts at the replay boundary), so// it is resolved on demand HERE: WorkOS is asked for the caller's own// membership in it first (`getUserOrgMembership`, a read scoped to this// caller — never a listing of the org), and only a member's answer mints the// row (`resolveOrganization`) and scans it as above. A non-member mints// nothing: a signed-in caller cannot create the row of an arbitrary WorkOS// organization by naming its id. An organization marked deleted is never// scanned: WorkOS no longer has it, and its rows are the purge's to remove,// not a listing's to refresh.//// Returns the resolved organization if the user currently holds an *active*// membership in it, otherwise null. Callers should treat null as "no access"// and route accordingly (onboarding page / 403).//// The ONE caller that may see a marked org is the deletion flow itself// (`deleted: "allow"`): an admin whose deletion failed after the mark must be// able to send it again to finish the purge, and their membership row is// still there to authorize exactly that. export interface AuthorizeOrganizationOptions {  /** Whether an organization marked deleted resolves (`"allow"`) or is refused (default). */  readonly deleted?: "refuse" | "allow";} /** The caller's active membership in the org, however it was read: only the role matters past this point. */interface ActiveMembership {  readonly role: string;} // The mirror read: the caller's row, active or nothing.const activeMembershipFromMirror = (userId: string, organizationId: string) =>  Effect.gen(function* () {    const directory = yield* MemberDirectory;    const membership = yield* directory.membership(userId, organizationId);    if (!membership || membership.status !== "active") return null;    const active: ActiveMembership = { role: membership.role };    return active;  }); // The authorized organization, or null for one marked deleted (unless the// caller is the deletion flow). The membership already names the caller's// role — surfaced normalized so identity resolution can bind the executor's// workspace write permission without a second read. WorkOS issues `admin` /// `member`; anything unrecognized stays a plain member.const authorized = (  org: Organization,  membership: ActiveMembership,  options: AuthorizeOrganizationOptions,) => {  if (org.deletedAt !== null && options.deleted !== "allow") return null;  const memberRole: "admin" | "member" = membership.role === "admin" ? "admin" : "member";  return { ...org, memberRole };}; // The organization row for a caller, minted from WorkOS when the mirror// does not hold it — only for a caller WorkOS confirms as its member (see// above). `null` when the mirror has no row and WorkOS lists no membership.const heldOrResolvedForMember = (userId: string, organizationId: string) =>  Effect.gen(function* () {    const users = yield* UserStoreService;    const held = yield* users.use("getOrganization", (s) => s.getOrganization(organizationId));    if (held) return held;    const workos = yield* WorkOSClient;    const membership = yield* workos.getUserOrgMembership(organizationId, userId);    if (!membership) return null;    yield* Effect.logInfo(      "authorizeOrganization: organization not mirrored; resolving it from WorkOS for its member",      { organizationId },    );    return yield* resolveOrganization(organizationId);  }); /** The span every membership authorization runs under. */export const AUTHORIZE_ORGANIZATION_SPAN = "auth.authorize_organization"; export const authorizeOrganization = (  userId: string,  organizationId: string,  options: AuthorizeOrganizationOptions = {},) =>  Effect.gen(function* () {    const org = yield* heldOrResolvedForMember(userId, organizationId);    if (!org) return null;    // An unmarked live organization is scanned before its mirror is read    // (see above). The row returned below still shows the mark as it was    // read; nothing past this point reads it. A marked-deleted organization    // is never scanned, so the deletion retry (`deleted: "allow"`) reaches    // `authorized()` below with the membership row the purge has not removed    // yet.    if (org.deletedAt === null && org.backfilledAt === null) {      yield* ensureOrganizationBackfilled(organizationId);    }    const membership = yield* activeMembershipFromMirror(userId, organizationId);    if (!membership) return null;    return authorized(org, membership, options);  }).pipe(Effect.withSpan(AUTHORIZE_ORGANIZATION_SPAN)); // ---------------------------------------------------------------------------// Org SELECTOR — the URL is the scope authority, not the session.// ---------------------------------------------------------------------------//// Org-scoped requests carry the active org in this header, set by the web// client from the console URL's slug (the MCP plane carries the same idea in// its own `x-executor-mcp-organization`). The selector is a slug (`acme`, the// readable URL form) or a WorkOS id (`org_…`, the legacy/token form). It is a// SELECTOR, not a trust boundary: `authorizeOrganizationSelector` re-checks// membership against the mirror, so the worst a forged header does is name an// org the caller already belongs to.//// Why a header and not the session's `org_id`: a browser shares ONE cookie jar// across tabs, so a single session-pinned org makes "active org" a// browser-global — two tabs can't be in two orgs at once, and switching in one// silently re-scopes the other. Scoping per-request from the URL makes each// tab independent. export const ORG_SELECTOR_HEADER = EXECUTOR_ORG_SELECTOR_HEADER; /** The URL-pinned org selector for a request, or `null` to fall back to the session. */export const orgSelectorFromRequest = (request: Request): string | null =>  request.headers.get(ORG_SELECTOR_HEADER); /** * Resolve an org SELECTOR (URL slug or `org_…` id) to the organization the * caller actively belongs to, or `null`. A slug resolves through the local * mirror to its id first; ids pass straight through. Either way membership is * verified against the mirror via {@link authorizeOrganization}. */export const authorizeOrganizationSelector = (  userId: string,  selector: string,  options: AuthorizeOrganizationOptions = {},) =>  Effect.gen(function* () {    if (selector.startsWith("org_")) {      return yield* authorizeOrganization(userId, selector, options);    }    const users = yield* UserStoreService;    const org = yield* users.use("getOrganizationBySlug", (s) => s.getOrganizationBySlug(selector));    if (!org) return null;    return yield* authorizeOrganization(userId, org.id, options);  });