Stop old Stripe events overwriting subscription access
Stripe doesn't guarantee that webhook events arrive in the order they happened. If a user upgrades and then cancels, your endpoint can receive the cancel first and the upgrade second. Apply them as they arrive and the older event wins, so the user keeps access they shouldn't have, or loses access they paid for.
The fix is a timestamp check. Store the created time of the last event you applied for each subscription. When a customer.subscription.* event comes in, drop it if its event.created is older than that value. Otherwise apply the full subscription object it carries and save the new timestamp.
For invoice.* and checkout.session.completed, don't trust the payload's state at all: re-fetch the subscription with stripe.subscriptions.retrieve and write what Stripe returns.
Subscription Billing Kit (for Stripe) (US$19) teaches Claude Code and Cursor this guard, with a unit test for it.