import { Context, Effect, Layer } from "effect";import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/unstable/http"; import { AuthContext, requestScopedMiddleware, type MemberDirectory,} from "@executor-js/api/server"; import { UserStoreService } from "../auth/context";import { sessionFromSealed } from "../auth/middleware";import { WorkOsMirror } from "../auth/workos-mirror";import { ORG_SELECTOR_HEADER, authorizeOrganizationSelector } from "../auth/organization";import { WorkOSClient } from "../auth/workos";import { DbService } from "../db/db"; const unauthorized = () => HttpServerResponse.jsonUnsafe( { error: "Invalid or expired session", code: "invalid_session", }, { status: 401 }, ); const noOrganization = () => HttpServerResponse.jsonUnsafe( { error: "No organization in session", code: "no_organization", }, { status: 403 }, ); /** * The caller's role in the session org, as `authorizeOrganizationSelector` * read it for THIS request from the membership mirror (`auth/organization.ts`). * Provided beside `AuthContext` — the shared seam, which carries no role — so * the domain handlers' admin gate is this one value, never a second read of * the mirror. */export class OrgMemberRole extends Context.Service< OrgMemberRole, { readonly memberRole: "admin" | "member" }>()("@executor-js/cloud/OrgMemberRole") {} const OrgAuthMiddleware = HttpRouter.middleware<{ provides: AuthContext | OrgMemberRole;}>()( Effect.gen(function* () { const captured = yield* Effect.context<WorkOSClient>(); const workos = yield* WorkOSClient; return (httpEffect) => Effect.gen(function* () { const request = yield* HttpServerRequest.HttpServerRequest; const cookieValue = request.cookies["wos-session"] ?? ""; const result = yield* workos .authenticateSealedSession(cookieValue) .pipe(Effect.orElseSucceed(() => null)); if (!result) return unauthorized(); // FAIL CLOSED: no header, no org — the sealed cookie's org is a // browser-global pinned to whichever org WorkOS last touched, so // falling back to it scopes a multi-org user's request to the WRONG // org (see workos-auth-provider.resolveSessionPrincipal). const selector = request.headers[ORG_SELECTOR_HEADER]; if (!selector) return noOrganization(); const org = yield* authorizeOrganizationSelector(result.userId, selector).pipe( Effect.orElseSucceed(() => null), ); if (!org) return noOrganization(); const session = sessionFromSealed(result, cookieValue); const auth = AuthContext.of({ accountId: session.accountId, organizationId: org.id, email: session.email, name: session.name, avatarUrl: session.avatarUrl, roles: [], }); return yield* Effect.provideContext( httpEffect, Context.make(AuthContext, auth).pipe( Context.add(OrgMemberRole, { memberRole: org.memberRole }), ), ); }).pipe(Effect.provideContext(captured)); }),); export const orgAuthMiddleware = ( rsLive: Layer.Layer<DbService | UserStoreService | MemberDirectory | WorkOsMirror>,) => OrgAuthMiddleware.combine(requestScopedMiddleware(rsLive)).layer;
import { Context, Effect, Layer } from "effect";
import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/unstable/http";
import {
AuthContext,
requestScopedMiddleware,
type MemberDirectory,
} from "@executor-js/api/server";
import { UserStoreService } from "../auth/context";
import { sessionFromSealed } from "../auth/middleware";
import { WorkOsMirror } from "../auth/workos-mirror";
import { ORG_SELECTOR_HEADER, authorizeOrganizationSelector } from "../auth/organization";
import { WorkOSClient } from "../auth/workos";
import { DbService } from "../db/db";
const unauthorized = () =>
HttpServerResponse.jsonUnsafe(
{
error: "Invalid or expired session",
code: "invalid_session",
},
{ status: 401 },
);
const noOrganization = () =>
HttpServerResponse.jsonUnsafe(
{
error: "No organization in session",
code: "no_organization",
},
{ status: 403 },
);
/**
* The caller's role in the session org, as `authorizeOrganizationSelector`
* read it for THIS request from the membership mirror (`auth/organization.ts`).
* Provided beside `AuthContext` — the shared seam, which carries no role — so
* the domain handlers' admin gate is this one value, never a second read of
* the mirror.
*/
export class OrgMemberRole extends Context.Service<
OrgMemberRole,
{ readonly memberRole: "admin" | "member" }
>()("@executor-js/cloud/OrgMemberRole") {}
const OrgAuthMiddleware = HttpRouter.middleware<{
provides: AuthContext | OrgMemberRole;
}>()(
Effect.gen(function* () {
const captured = yield* Effect.context<WorkOSClient>();
const workos = yield* WorkOSClient;
return (httpEffect) =>
Effect.gen(function* () {
const request = yield* HttpServerRequest.HttpServerRequest;
const cookieValue = request.cookies["wos-session"] ?? "";
const result = yield* workos
.authenticateSealedSession(cookieValue)
.pipe(Effect.orElseSucceed(() => null));
if (!result) return unauthorized();
// FAIL CLOSED: no header, no org — the sealed cookie's org is a
// browser-global pinned to whichever org WorkOS last touched, so
// falling back to it scopes a multi-org user's request to the WRONG
// org (see workos-auth-provider.resolveSessionPrincipal).
const selector = request.headers[ORG_SELECTOR_HEADER];
if (!selector) return noOrganization();
const org = yield* authorizeOrganizationSelector(result.userId, selector).pipe(
Effect.orElseSucceed(() => null),
);
if (!org) return noOrganization();
const session = sessionFromSealed(result, cookieValue);
const auth = AuthContext.of({
accountId: session.accountId,
organizationId: org.id,
email: session.email,
name: session.name,
avatarUrl: session.avatarUrl,
roles: [],
});
return yield* Effect.provideContext(
httpEffect,
Context.make(AuthContext, auth).pipe(
Context.add(OrgMemberRole, { memberRole: org.memberRole }),
),
);
}).pipe(Effect.provideContext(captured));
}),
);
export const orgAuthMiddleware = (
rsLive: Layer.Layer<DbService | UserStoreService | MemberDirectory | WorkOsMirror>,
) => OrgAuthMiddleware.combine(requestScopedMiddleware(rsLive)).layer;