- cloud: resolves userId from the authenticated session and builds a [userOrgScope, orgScope] stack via createScopedExecutor(userId, orgId, orgName). userId threaded through execution-stack, mcp-session, and MCP dispatch init. - cloud env refactor: deletes the lazy Proxy apps/cloud/src/env.ts in favor of cloudflare:workers env imported at call sites; adds env-augment.d.ts to type secrets not present in generated wrangler types. - cloud/server.ts: env-guarded OTEL wiring (skips instrument() when AXIOM_TOKEN absent); captures rawFetch before instrument() mutates it so dev requests still land on the Hono app. - cloud/services/db.ts: prefers DATABASE_URL over the hyperdrive proxy so local dev works without the tunnel. - vite.config.ts: devCrashGuard plugin that prints uncaught Worker errors with a stable exit. - hosts/mcp: optional debug flag surfaces verbose session logging, wired up from cloud mcp-session. - local/examples/marketing: migrated to scopes: [scope].
Showing the changes to apps/cloud/src/api/protected.ts (1 of 25 files). Show all
Unified · Split
| @@ -27,12 +27,18 @@ const lookupOrgForRequest = (request: HttpServerRequest.HttpServerRequest) => · 26 unmodified lines | ||
| 27 | 27 | const session = yield* workos.authenticateRequest(webRequest); |
| 28 | 28 | if (!session || !session.organizationId) return null; |
| 29 | 29 | |
| 30 | − return yield* authorizeOrganization(session.userId, session.organizationId); | |
| 30 | + const org = yield* authorizeOrganization(session.userId, session.organizationId); | |
| 31 | + if (!org) return null; | |
| 32 | + return { org, userId: session.userId }; | |
| 31 | 33 | }); |
| 32 | 34 | |
| 33 | −const createProtectedApp = (organizationId: string, organizationName: string) => | |
| 35 | +const createProtectedApp = (userId: string, organizationId: string, organizationName: string) => | |
| 34 | 36 | Effect.gen(function* () { |
| 35 | − const { executor, engine } = yield* makeExecutionStack(organizationId, organizationName); | |
| 37 | + const { executor, engine } = yield* makeExecutionStack( | |
| 38 | + userId, | |
| 39 | + organizationId, | |
| 40 | + organizationName, | |
| 41 | + ); | |
| 36 | 42 | |
| 37 | 43 | const requestServices = Layer.mergeAll( |
| 38 | 44 | Layer.succeed(ExecutorService, executor), |
| @@ -58,8 +64,8 @@ const createProtectedApp = (organizationId: string, organizationName: string) => · 19 unmodified lines | ||
| 58 | 64 | |
| 59 | 65 | export const ProtectedApiApp = Effect.gen(function* () { |
| 60 | 66 | const request = yield* HttpServerRequest.HttpServerRequest; |
| 61 | − const org = yield* lookupOrgForRequest(request); | |
| 62 | − if (!org) { | |
| 67 | + const session = yield* lookupOrgForRequest(request); | |
| 68 | + if (!session) { | |
| 63 | 69 | return yield* Effect.fail( |
| 64 | 70 | new HttpResponseError({ |
| 65 | 71 | status: 403, |
| @@ -69,7 +75,7 @@ export const ProtectedApiApp = Effect.gen(function* () { · 3 unmodified lines | ||
| 69 | 75 | ); |
| 70 | 76 | } |
| 71 | 77 | |
| 72 | − const app = yield* createProtectedApp(org.id, org.name); | |
| 78 | + const app = yield* createProtectedApp(session.userId, session.org.id, session.org.name); | |
| 73 | 79 | return yield* app; |
| 74 | 80 | }).pipe( |
| 75 | 81 | Effect.provide(SharedServices), |