the session knows who they are, but every handler re-checks what they can do and i've already missed two
about 30 routes, three roles (owner, admin, member), and the permission check is a copy pasted block at the top of each handler. last week i shipped two endpoints without the block and a member deleted another team's…