// ---------------------------------------------------------------------------// Organization authorization — live membership check against WorkOS.// ---------------------------------------------------------------------------//// The sealed session cookie carries an organizationId that WorkOS signed at// login / refresh time. WorkOS does NOT invalidate existing sessions when a// membership is revoked, and `session.authenticate()` validates the JWT// locally without hitting the API — so a removed user keeps full access// until their access token naturally expires (~10 min).//// To close that gap we verify membership live on every protected request.// `listUserMemberships` is one WorkOS call per request. If this becomes a// hot path we can layer a short per-(user, org) TTL cache underneath, or// swap it for a local memberships table fed by the WorkOS Events API.//// Returns the resolved organization (via resolveOrganization) if the user// currently holds an *active* membership in it, otherwise null. Callers// should treat null as "no access" and route accordingly (onboarding page /// 403). import { Effect } from "effect"; import { resolveOrganization } from "./resolve-organization";import { WorkOSAuth } from "./workos"; export const authorizeOrganization = (userId: string, organizationId: string) =>  Effect.gen(function* () {    const workos = yield* WorkOSAuth;    const memberships = yield* workos.listUserMemberships(userId);    const active = memberships.data.find(      (m: { readonly organizationId: string; readonly status: string }) =>        m.organizationId === organizationId && m.status === "active",    );    if (!active) return null;     return yield* resolveOrganization(organizationId);  });