Fintech B2B SaaS

Original problem

The Next.js app, the Node.js webhook worker, and a Python reconciliation job all used a service-role credential. Twelve billing tables were readable without a tenant check, and the dashboard ran about 40 queries per page.

Technical environment

Next.js App Router for the product, Node.js for Stripe webhooks, Python for reconciliation, PostgreSQL as the ledger store.

Engineering decisions

Keep the existing UI and billing flow. Put tenant checks in the database, not in a client-supplied organization id. Make the Node.js webhook and the Python job idempotent against the ledger.

Implemented fixes

Row policies now key off membership. The dashboard reads one Postgres function instead of a query waterfall. Stripe events and the reconciliation job both post once. Pooling stopped serverless invocations from exhausting connections.

Verification

Two-tenant SQL tests on every exposed table. A replayed webhook and a rerun of the Python job left the ledger unchanged. Query plans compared before and after on the main dashboard route.

Identified issues

• Service-role key reachable from server actions and from the Python job.
• Row access not enforced, including profiles and billing customers.
• Webhook retries could post the same payout twice.
• Per-page query fan-out with no covering indexes.