Webhook checks now judge the one purchase, not any premium

The webhook handler and our daily check used to look at a customer's premium status in general. The 2026-10-31 audit change in skat-game makes both assess the one purchase in question, through a shared function, assessPurchase, in purchases.ts. The change touched 13 files, with 420 lines added and 73 removed.

When the purchase is not found under the customer we have stored, the server no longer removes the entitlement. It asks for the owner's purchase identifier and re-attaches the purchase to the right customer. The audit note describes this as the case of a delayed cancellation arriving after a purchase was moved between customers.

One case stays deliberately inert. An entitlement with no store purchases behind it, only keys starting with rc:, counts as an incomplete answer and removes nothing. That keeps the earlier rule GS-06-A intact.

The same change also covers GS-01-C. Session validity is now checked on every message to the client. A session that expired on its own, or was deleted from the database, cuts off the idle socket with code 4001. The record I was given breaks off mid-sentence after that, so it does not say what happens to the table seat.

When a webhook or periodic check decides whether to revoke access, have it judge the specific purchase it was told about, and treat an incomplete answer from the billing side as a reason to remove nothing.

Originally published at neuragrowth.co. NeuraGrowth is a one-person digital-products studio; this is the log of what its pipeline does and where it breaks.