apps/web/app/(ee)/api/cron/bounties/notify-partners/route.ts (1)

94-96: Stop logging partner emails (PII).

Do not print raw email addresses to logs.

-      console.log(
-        `Sending emails to ${programEnrollmentChunk.length} partners: ${programEnrollmentChunk.map(({ partner }) => partner.email).join(", ")}`
-      );
+      console.info(
+        `Sending ${programEnrollmentChunk.length} bounty emails (page ${page}, bounty ${bountyId}).`,
+      );

apps/web/app/(ee)/api/cron/bounties/notify-partners/route.ts (5)

20-21: Define a named batch size constant.

Improves readability and keeps batch size consistent.

 const MAX_PAGE_SIZE = 5000;
+
+const BATCH_SIZE = 100;

---

138-140: Report actual recipients, not enrollments, in completion log.

Aligns logs with real sends.

-    return logAndRespond(
-      `Finished sending emails to ${programEnrollments.length} partners for bounty ${bountyId}.`,
-    );
+    return logAndRespond(
+      `Finished sending emails to ${typeof recipients !== "undefined" ? recipients.length : programEnrollments.filter(({ partner }) => Boolean(partner.email)).length} partners for bounty ${bountyId}.`,
+    );

---

46-50: Return 404 for missing bounty.

Better semantics and easier to monitor.

-    if (!bounty) {
-      return logAndRespond(`Bounty ${bountyId} not found.`, {
-        logLevel: "error",
-      });
-    }
+    if (!bounty) {
+      return logAndRespond(`Bounty ${bountyId} not found.`, {
+        logLevel: "error",
+        status: 404,
+      });
+    }

---

141-145: Type-safe error logging in catch.

Avoids potential TS errors when useUnknownInCatchVariables is enabled.

-    await log({
-      message: "New bounties published cron failed. Error: " + error.message,
-      type: "errors",
-    });
+    const msg =
+      error instanceof Error ? error.message : JSON.stringify(error);
+    await log({
+      message: `New bounties published cron failed. Error: ${msg}`,
+      type: "errors",
+    });

---

97-121: Fail fast if email provider is not configured.

Optional, but avoids silently dropping emails when resend is undefined.

Consider adding a guard before sending:

+    if (!resend) {
+      return logAndRespond(
+        "Email provider not configured; cannot send bounty notifications.",
+        { status: 500, logLevel: "error" },
+      );
+    }

Would you like me to add this guard?

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

Learnt from: TWilson023
PR: dubinc/dub#2736
File: apps/web/app/api/workspaces/[idOrSlug]/notification-preferences/route.ts:13-14
Timestamp: 2025-08-26T14:20:23.943Z
Learning: The updateNotificationPreference action in apps/web/lib/actions/update-notification-preference.ts already handles all notification preference types dynamically, including newBountySubmitted, through its schema validation using the notificationTypes enum and Prisma's dynamic field update pattern.

apps/web/ui/partners/bounties/bounty-logic.tsx (2)

55-62: Reset value when attribute changes to avoid stale/invalid state.

Clears the numeric value when switching between count/currency attributes to prevent mixed units.

-  const { control, watch } = useAddEditBountyForm();
+  const { control, watch, setValue, clearErrors } = useAddEditBountyForm();

-              <InlineBadgePopoverMenu
-                selectedValue={field.value}
-                onSelect={field.onChange}
+              <InlineBadgePopoverMenu
+                selectedValue={field.value}
+                onSelect={(newAttr) => {
+                  field.onChange(newAttr);
+                  setValue("performanceCondition.value", undefined, {
+                    shouldDirty: true,
+                    shouldValidate: true,
+                  });
+                  clearErrors?.("performanceCondition.value");
+                }}
                 items={WORKFLOW_ATTRIBUTES.map((attribute) => ({
                   text: WORKFLOW_ATTRIBUTE_LABELS[attribute],
                   value: attribute,
                 }))}
               />

Also applies to: 24-24

---

72-79: “0” is valid but currently marked invalid (falsy check).

Don’t treat 0 as invalid.

               text={
                 value
                   ? isCurrencyAttribute(attribute)
                     ? currencyFormatter(value)
-                    : value
+                    : value
                   : "amount"
               }
-              invalid={!value}
+              invalid={value === undefined || value === null}

apps/web/app/app.dub.co/(dashboard)/[slug]/(ee)/program/bounties/add-edit-bounty-sheet.tsx (5)

220-221: Round dollars→cents to avoid float precision errors.

Prevent off-by-one cents (e.g., 12.34*100 → 1233.999…).

-    data.rewardAmount = data.rewardAmount * 100;
+    data.rewardAmount = Math.round(data.rewardAmount * 100);

-        value: isCurrency ? condition.value * 100 : condition.value,
+        value: isCurrency ? Math.round(condition.value * 100) : condition.value,

Also applies to: 241-242

---

245-247: Use submitted data.type instead of potentially stale watched value.

Prevents mis-routing if type changed just before submit.

-    } else if (type === "submission") {
+    } else if (data.type === "submission") {
       data.performanceCondition = null;
     }

---

332-389: “Add end date” toggle is hidden when unchecked → impossible to enable.

Render the Switch always; only collapse the picker.

-                    <AnimatedSizeContainer
-                      height
-                      transition={{ ease: "easeInOut", duration: 0.2 }}
-                      className={!hasEndDate ? "hidden" : ""}
-                      style={{ display: !hasEndDate ? "none" : "block" }}
-                    >
-                      <div className="flex items-center gap-4">
-                        <Switch
-                          fn={setHasEndDate}
-                          checked={hasEndDate}
-                          trackDimensions="w-8 h-4"
-                          thumbDimensions="w-3 h-3"
-                          thumbTranslate="translate-x-4"
-                        />
-                        <div className="flex flex-col gap-1">
-                          <h3 className="text-sm font-medium text-neutral-700">
-                            Add end date
-                          </h3>
-                        </div>
-                      </div>
-
-                      {hasEndDate && (
+                    <div className="mt-2 flex items-center gap-4">
+                      <Switch
+                        fn={setHasEndDate}
+                        checked={hasEndDate}
+                        trackDimensions="w-8 h-4"
+                        thumbDimensions="w-3 h-3"
+                        thumbTranslate="translate-x-4"
+                      />
+                      <div className="flex flex-col gap-1">
+                        <h3 className="text-sm font-medium text-neutral-700">
+                          Add end date
+                        </h3>
+                      </div>
+                    </div>
+
+                    <AnimatedSizeContainer
+                      height
+                      transition={{ ease: "easeInOut", duration: 0.2 }}
+                    >
+                      {hasEndDate && (
                         <div className="mt-6 p-px">
                           <SmartDateTimePicker
                             value={watch("endsAt")}
                             onChange={(date) => {
                               setValue("endsAt", date, {
                                 shouldDirty: true,
                               });
                             }}
                             label="End date"
                             placeholder='E.g. "in 3 months"'
                           />
                         </div>
                       )}
-                    </AnimatedSizeContainer>
+                    </AnimatedSizeContainer>

---

347-347: Remove stray “test” text from error slot.

-                      {errors.startsAt && "test"}
+                      {/* Optional: render a proper message if rules/resolver provide one */}
+                      {errors.startsAt && null}

---

402-406: Align client-side rules with Zod schema (min 1).

Server requires rewardAmount >= 1.

-                          rules={{
-                            required: true,
-                            min: 0,
-                          }}
+                          rules={{
+                            required: "Reward amount is required",
+                            min: { value: 1, message: "Reward amount must be greater than 1" },
+                          }}

apps/web/app/app.dub.co/(dashboard)/[slug]/(ee)/program/bounties/[bountyId]/bounty-submission-details-sheet.tsx (2)

143-151: Show $0.00 instead of “-” for zero earnings.

Truthiness check hides valid zero values. Use null/undefined check.

-                  value: commission?.earnings
+                  value: commission?.earnings != null
                     ? currencyFormatter(commission.earnings / 100, {
                       minimumFractionDigits: 2,
                       maximumFractionDigits: 2,
                     })
                     : "-",

---

203-221: Add missing key prop to mapped URL items.

Fix Biome’s useJsxKeyInIterable and React reconciliation.

-                      {submission.urls?.map((url) => (
-                        <div className="relative">
+                      {submission.urls?.map((url, idx) => (
+                        <div className="relative" key={`${idx}-${url}`}>

apps/web/app/(ee)/api/bounties/[bountyId]/submissions/route.ts (1)

105-113: Don’t spread ProgramEnrollment onto partner; preserve partner.id and fill required metrics.

Spreading risks id clobbering and missing metrics (leads, conversions, saleAmount). Build partner explicitly and default metrics to 0 to satisfy BountySubmissionExtendedSchema.

-  return submissions.map((submission) => {
-    return {
-      partner: {
-        ...submission.programEnrollment?.partner,
-        ...submission.programEnrollment,
-        // here's we're making sure the programEnrollment ID doesn't override the actual partner ID
-        // TODO: this is a bit messy, we should refactor this
-        id: submission.programEnrollment?.partnerId,
-      },
-      submission,
-      commission: submission.commission,
-      user: submission.user,
-    };
-  });
+  return submissions.map((s) => {
+    const pe = s.programEnrollment!;
+    return {
+      partner: {
+        // core partner fields
+        id: pe.partnerId,
+        name: pe.partner?.name ?? null,
+        email: pe.partner?.email ?? null,
+        image: pe.partner?.image ?? null,
+        country: pe.partner?.country ?? null,
+        payoutsEnabledAt: pe.partner?.payoutsEnabledAt ?? null,
+        bannedAt: pe.partner?.bannedAt ?? null,
+        bannedReason: pe.partner?.bannedReason ?? null,
+        // enrollment
+        groupId: pe.groupId ?? null,
+        status: pe.status ?? null,
+        totalCommissions: pe.totalCommissions ?? 0,
+        // metrics not joined in this path
+        leads: 0,
+        conversions: 0,
+        saleAmount: 0,
+      },
+      submission: s,
+      commission: s.commission,
+      user: s.user,
+    };
+  });

apps/web/lib/actions/partners/approve-bounty-submission.ts (4)

23-27: Enforce role-based authorization before approval.

Restrict to owner/admin (or your chosen roles) to prevent unauthorized payouts.

   .action(async ({ parsedInput, ctx }) => {
     const { workspace, user } = ctx;
+    if (!["owner", "admin"].includes(workspace.role)) {
+      throw new Error("Forbidden: insufficient permissions to approve bounties.");
+    }

---

44-46: Idempotency: also guard on existing commissionId.

Prevents duplicate approvals via alternative code paths.

-    if (bountySubmission.status === "approved") {
+    if (bountySubmission.status === "approved" || bountySubmission.commissionId) {
       throw new Error("Bounty submission already approved.");
     }

---

48-57: Validate reward amount > 0.

Avoid zero/invalid payouts.

     if (bounty.type === "performance") {
       throw new Error("Performance based bounties cannot be approved.");
     }
 
+    if (!bounty.rewardAmount || bounty.rewardAmount <= 0) {
+      throw new Error("Bounty reward amount is missing or invalid.");
+    }

---

52-78: Race-safe, idempotent approval to prevent duplicate commissions.

Use a conditional status flip before commission creation; roll back on failure. Optionally pass eventId=submissionId for dedupe.

-    const commission = await createPartnerCommission({
+    // Optimistic guard to avoid double-approval
+    const updated = await prisma.bountySubmission.updateMany({
+      where: { id: submissionId, status: { not: "approved" }, commissionId: null },
+      data: {
+        status: "approved",
+        reviewedAt: new Date(),
+        userId: user.id,
+        rejectionNote: null,
+        rejectionReason: null,
+      },
+    });
+    if (updated.count === 0) {
+      throw new Error("Bounty submission already approved.");
+    }
+
+    const commission = await createPartnerCommission({
       event: "custom",
       partnerId: bountySubmission.partnerId,
       programId: bountySubmission.programId,
       amount: bounty.rewardAmount,
       quantity: 1,
       user,
-      description: `Commission for successfully completed "${bounty.name}" bounty.`,
+      eventId: submissionId,
+      description: `Commission for successfully completed "${bounty.name || "Untitled Bounty"}" bounty.`,
     });
 
     if (!commission) {
-      throw new Error("Failed to create commission for the bounty submission.");
+      // rollback status flip
+      await prisma.bountySubmission.update({
+        where: { id: submissionId },
+        data: { status: "pending", reviewedAt: null, userId: null },
+      });
+      throw new Error("Failed to create commission for the bounty submission.");
     }
 
-    await prisma.bountySubmission.update({
-      where: {
-        id: submissionId,
-      },
-      data: {
-        status: "approved",
-        reviewedAt: new Date(),
-        userId: user.id,
-        rejectionNote: null,
-        rejectionReason: null,
-        commissionId: commission.id,
-      },
-    });
+    await prisma.bountySubmission.update({
+      where: { id: submissionId },
+      data: { commissionId: commission.id },
+    });

packages/prisma/schema/bounty.prisma (2)

38-39: Avoid cascading delete of Bounty when Workflow is removed.

Prefer onDelete: SetNull to prevent accidental bounty loss.

-  workflow    Workflow?          @relation(fields: [workflowId], references: [id], onDelete: Cascade)
+  workflow    Workflow?          @relation(fields: [workflowId], references: [id], onDelete: SetNull)

---

75-76: Avoid deleting submissions when a Commission is removed.

Use SetNull so submission history remains.

-  commission        Commission?        @relation(fields: [commissionId], references: [id], onDelete: Cascade)
+  commission        Commission?        @relation(fields: [commissionId], references: [id], onDelete: SetNull)

apps/web/lib/api/bounties/generate-bounty-name.ts (4)

6-12: Add explicit return type and document money units.

Make intent and units unambiguous for callers and reviewers.

-export const generateBountyName = ({
+/**
+ * rewardAmount is in cents. If condition.attribute is currency-based,
+ * condition.value is also expected in cents.
+ */
+export const generateBountyName = ({
   rewardAmount,
   condition,
 }: {
   rewardAmount: number;
   condition?: WorkflowCondition | null;
-}) => {
+}): string => {

---

3-3: Support non-USD workspaces and avoid silently rounding cents.

Today we always format in USD and with 0 decimals (per currencyFormatter defaults), which can misrepresent values (e.g., $12.50 → $13) and breaks for non-USD workspaces. Accept an optional currency and format up to 2 fraction digits.

-import { currencyFormatter, nFormatter } from "@dub/utils";
+import { currencyFormatter, nFormatter } from "@dub/utils";
@@
-export const generateBountyName = ({
-  rewardAmount,
-  condition,
-}: {
-  rewardAmount: number;
-  condition?: WorkflowCondition | null;
-}) => {
+export const generateBountyName = ({
+  rewardAmount,
+  condition,
+  currency,
+}: {
+  rewardAmount: number;
+  condition?: WorkflowCondition | null;
+  currency?: string; // ISO 4217, e.g. "USD"
+}): string => {
+  const cf = (v: number) =>
+    currencyFormatter(v, { maximumFractionDigits: 2 }, currency);
@@
-  if (!condition) {
-    return `Earn ${currencyFormatter(rewardAmount / 100)}`;
-  }
+  if (!condition) {
+    return `Earn ${cf(rewardAmount / 100)}`;
+  }
@@
-  const rewardAmountFormatted = currencyFormatter(rewardAmount / 100);
+  const rewardAmountFormatted = cf(rewardAmount / 100);
@@
-  const valueFormatted = isCurrency
-    ? `${currencyFormatter(condition.value / 100)} in`
+  const valueFormatted = isCurrency
+    ? `${cf(condition.value / 100)} in`
     : `${nFormatter(condition.value, { full: true })}`;

Also applies to: 6-12, 14-14, 18-18, 21-21

---

19-24: Fix grammar for singular metrics and add a safe fallback label.

“1 Conversions” reads awkwardly. Singularize non-currency labels when value === 1 and guard against unmapped attributes to avoid “undefined”.

-  const attributeLabel = WORKFLOW_ATTRIBUTE_LABELS[condition.attribute];
-  const valueFormatted = isCurrency
+  const attributeLabelRaw =
+    WORKFLOW_ATTRIBUTE_LABELS[condition.attribute] ?? "Metric";
+  const attributeLabel =
+    !isCurrency &&
+    condition.value === 1 &&
+    attributeLabelRaw.endsWith("s")
+      ? attributeLabelRaw.slice(0, -1)
+      : attributeLabelRaw;
+  const valueFormatted = isCurrency
     ? `${currencyFormatter(condition.value / 100)} in`
     : `${nFormatter(condition.value, { full: true })}`;
 
-  return `Earn ${rewardAmountFormatted} after generating ${valueFormatted} ${attributeLabel}`;
+  return `Earn ${rewardAmountFormatted} after generating ${valueFormatted} ${attributeLabel}`;

---

6-25: Add unit tests for name generation edge cases.

Cover: (a) no condition, (b) currency attrs (Revenue/Commissions) with non-integer dollars, (c) non-currency attrs with 1 vs >1, (d) unknown attribute fallback.

I can scaffold tests for these cases—want me to open a follow-up PR?

apps/web/ui/partners/bounties/bounty-logic.tsx (2)

72-76: Improve readability of non-currency amounts (thousands separators).

Format counts for easier scanning.

-                    : value
+                    : Intl.NumberFormat("en-US").format(value as number)

---

103-113: Use number input with appropriate step for better UX/validation.

Enables numeric keypad on mobile and native constraints.

       <input
+        type="number"
+        inputMode={isCurrency ? "decimal" : "numeric"}
         className={cn(
           "block w-full rounded-md border-neutral-300 px-1.5 py-1 text-neutral-900 placeholder-neutral-400 focus:border-neutral-500 focus:outline-none focus:ring-neutral-500 sm:w-32 sm:text-sm",
           isCurrency ? "pl-4 pr-12" : "pr-7",
         )}
         {...register("performanceCondition.value", {
           required: true,
           setValueAs: (value: string) => (value === "" ? undefined : +value),
-          min: 0,
+          min: 0,
           onChange: handleMoneyInputChange,
         })}
+        step={isCurrency ? "0.01" : "1"}
       />

apps/web/app/app.dub.co/(dashboard)/[slug]/(ee)/program/bounties/[bountyId]/bounty-submission-details-sheet.tsx (2)

177-191: Improve file item accessibility and key stability.

Use a stable key and avoid redundant/meaningless img alt.

-                      {submission.files!.map((file, idx) => (
+                      {submission.files!.map((file, idx) => (
                         <a
-                          key={idx}
+                          key={file.url ?? idx}
                           className="border-border-subtle hover:border-border-default group relative flex size-14 items-center justify-center rounded-md border bg-white"
                           target="_blank"
                           href={file.url}
                           rel="noopener noreferrer"
                         >
                           <div className="relative size-full overflow-hidden rounded-md">
-                            <img src={file.url} alt="object-cover" />
+                            <img src={file.url} alt="" />
                           </div>

---

264-270: Use type="button" (no form).

This isn’t inside a form; avoid accidental submits if nesting changes.

-              <Button
-                type="submit"
+              <Button
+                type="button"
                 variant="primary"
                 text="Approve"
                 loading={isApprovingBountySubmission}
                 onClick={() => setShowApproveBountySubmissionModal(true)}
               />

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

Learnt from: TWilson023
PR: dubinc/dub#2736
File: apps/web/app/api/workspaces/[idOrSlug]/notification-preferences/route.ts:13-14
Timestamp: 2025-08-26T14:20:23.943Z
Learning: The updateNotificationPreference action in apps/web/lib/actions/update-notification-preference.ts already handles all notification preference types dynamically, including newBountySubmitted, through its schema validation using the notificationTypes enum and Prisma's dynamic field update pattern.

Learnt from: TWilson023
PR: dubinc/dub#2736
File: apps/web/lib/actions/partners/create-bounty-submission.ts:105-112
Timestamp: 2025-08-26T14:32:33.851Z
Learning: Non-performance bounties are required to have submissionRequirements. In create-bounty-submission.ts, it's appropriate to let the parsing fail if submissionRequirements is null for non-performance bounties, as this indicates a data integrity issue that should be caught.

Learnt from: TWilson023
PR: dubinc/dub#2673
File: apps/web/ui/partners/rewards/add-edit-reward-sheet.tsx:56-66
Timestamp: 2025-07-30T15:25:13.936Z
Learning: In apps/web/ui/partners/rewards/add-edit-reward-sheet.tsx, the form schema uses partial condition objects to allow users to add empty/unconfigured condition fields without type errors, while submission validation uses strict schemas to ensure data integrity. This two-stage validation pattern improves UX by allowing progressive completion of complex forms.

Learnt from: TWilson023
PR: dubinc/dub#2673
File: apps/web/ui/partners/rewards/rewards-logic.tsx:268-275
Timestamp: 2025-07-30T15:29:54.131Z
Learning: In apps/web/ui/partners/rewards/rewards-logic.tsx, when setting the entity field in a reward condition, dependent fields (attribute, operator, value) should be reset rather than preserved because different entities (customer vs sale) have different available attributes. Maintaining existing fields when the entity changes would create invalid state combinations and confusing UX.

Learnt from: TWilson023
PR: dubinc/dub#2736
File: apps/web/ui/partners/bounties/bounty-logic.tsx:88-96
Timestamp: 2025-08-26T15:03:05.381Z
Learning: In bounty forms, currency values are stored in cents in the backend but converted to dollars when loaded into forms, and converted back to cents when saved. The form logic works entirely with dollar amounts. Functions like generateBountyName that run during save logic receive cent values and need to divide by 100, but display logic within the form should format dollar values directly.