The hard decisions, already made.

export function requirePermission(
  role: MemberRole,
  action: OrgAction,
): void {
  if (!ROLE_PERMISSIONS[role]?.has(action)) {
    throw new PermissionDeniedError(role, action);
  }
}

// In every server action:
const membership = await getMembership(session.user.id, orgId);
requirePermission(membership.role, "billing.manage");

return db.$transaction(async (tx) => {
  await tx.$executeRaw`
    SELECT pg_advisory_xact_lock(${ns}::int, ${orgHash}::int)
  `;

  const count = await tx.project.count({
    where: { orgId, deletedAt: null },
  });

  if (count >= maxProjects) {
    throw new LimitExceededError("project", maxProjects);
  }

  return tx.project.create({ data: { orgId, name, ... } });
});

const existing = await db.webhookEvent.findUnique({
  where: { stripeEventId: event.id },
});

if (existing?.status === "PROCESSED") return;
if (existing?.status === "PROCESSING") return;

await db.webhookEvent.upsert({
  where: { stripeEventId: event.id },
  create: { stripeEventId: event.id, status: "PROCESSING", ... },
  update: { status: "PROCESSING", attempts: { increment: 1 } },
});