apps/web/lib/zod/schemas/sales.ts (4)

16-23: Normalize customerName by trimming.

Helps avoid storing accidental leading/trailing spaces.

-  customerName: z
-    .string()
+  customerName: z
+    .string()
+    .trim()
     .max(100)
     .nullish()
     .default(null)

---

24-30: Trim and lowercase customerEmail.

Emails are case-insensitive; normalizing reduces duplicates.

-  customerEmail: z
-    .string()
-    .email()
-    .max(100)
+  customerEmail: z
+    .string()
+    .trim()
+    .email()
+    .max(100)
+    .transform((s) => s.toLowerCase())
     .nullish()
     .default(null)

---

36-42: Constrain clickId when present.

Add a minimal length (or a tighter pattern if you have one) to catch obvious bad inputs.

-  clickId: z
-    .string()
-    .trim()
-    .nullish()
+  clickId: z
+    .string()
+    .trim()
+    .min(1, "clickId cannot be empty")
+    .nullish()

---

51-56: Validate currency format.

Ensure ISO-like shape locally; conversion errors then become less likely downstream.

-  currency: z
-    .string()
+  currency: z
+    .string()
+    .length(3, "currency must be a 3-letter ISO code")
     .default("usd")
     .transform((val) => val.toLowerCase())

apps/web/app/(ee)/api/track/sale/route.ts (1)

40-45: Guard against whitespace-only IDs.

Use .trim() before the check so " " is rejected.

-    if (!customerExternalId) {
+    if (!customerExternalId?.trim()) {
       throw new DubApiError({
         code: "bad_request",
         message: "customerExternalId is required",
       });
     }

apps/web/lib/api/conversions/track-sale.ts (3)

60-74: Invoice idempotency TTL is short; consider configurability.

Seven days may be insufficient for retries/backfills. Make TTL configurable or longer to reduce accidental duplicates outside the window.

-    const ok = await redis.set(`dub_sale_events:invoiceId:${invoiceId}`, 1, {
-      ex: 60 * 60 * 24 * 7,
+    const ttl = Number(process.env.SALES_IDEMPOTENCY_TTL_SECONDS ?? 60 * 60 * 24 * 30);
+    const ok = await redis.set(`dub_sale_events:invoiceId:${invoiceId}`, 1, {
+      ex: ttl,
       nx: true,
     });

---

98-104: Slug building for leadEventName: use a shared util.

Manual .toLowerCase().replaceAll(" ", "-") misses non-ASCII and punctuation cases. Prefer a shared slugify helper if available.

-        `leadCache:${existingCustomer.id}${leadEventName ? `:${leadEventName.toLowerCase().replaceAll(" ", "-")}` : ""}`,
+        `leadCache:${existingCustomer.id}${leadEventName ? `:${slugify(leadEventName)}` : ""}`,

If no slugifier exists, consider adding one under a common utils module.

---

248-271: Optional: reduce latency by backgrounding lead recording.

You can return the sale response faster by awaiting only _trackSale and moving _trackLead into waitUntil.

-  const [_, trackedSale] = await Promise.all([
-    newCustomer &&
-      _trackLead({
-        workspace,
-        leadEventData,
-        customer: newCustomer,
-      }),
-
-    _trackSale({
+  const trackedSale = await _trackSale({
       amount,
       currency,
       eventName,
       paymentProcessor,
       invoiceId,
       metadata,
       rawBody,
       workspace,
       leadEventData,
       customer,
-    }),
-  ]);
+  });
+
+  if (newCustomer) {
+    waitUntil(
+      _trackLead({
+        workspace,
+        leadEventData,
+        customer: newCustomer,
+      }),
+    );
+  }

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

apps/web/tests/tracks/track-sale.test.ts (5)

230-238: Match referer header to the short link to reduce brittleness

Align the referer with the domain/key under test so future referer-dependent logic doesn’t break this test.

-    const clickResponse = await http.post<{ clickId: string }>({
+    const clickResponse = await http.post<{ clickId: string }>({
       path: "/track/click",
-      headers: E2E_TRACK_CLICK_HEADERS,
+      headers: { ...E2E_TRACK_CLICK_HEADERS, referer: "https://getacme.link/derek" },
       body: {
         domain: "getacme.link",
         key: "derek",
       },
     });

---

230-230: Clarify test intent in title

Make the behavior explicit: auto-creating a lead from a clickId.

-  test("track a sale without a pre-existing lead event", async () => {
+  test("auto-creates lead from clickId when none exists", async () => {

---

262-276: Relax equality to allow additive fields without breaking the test

Use objectContaining to keep the assertion resilient to new response fields while still being strict about what matters.

-    expect(response.status).toEqual(200);
-    expect(response.data).toStrictEqual({
-      eventName: salePayload.eventName,
-      customer: {
-        id: expect.any(String),
-        ...saleCustomer,
-      },
-      sale: {
-        amount: salePayload.amount,
-        currency: salePayload.currency,
-        paymentProcessor: salePayload.paymentProcessor,
-        invoiceId: salePayload.invoiceId,
-        metadata: null,
-      },
-    });
+    expect(response.status).toEqual(200);
+    expect(response.data).toEqual(
+      expect.objectContaining({
+        eventName: salePayload.eventName,
+        customer: expect.objectContaining({
+          id: expect.any(String),
+          ...saleCustomer,
+        }),
+        sale: expect.objectContaining({
+          amount: salePayload.amount,
+          currency: salePayload.currency,
+          paymentProcessor: salePayload.paymentProcessor,
+          invoiceId: salePayload.invoiceId,
+          metadata: null,
+        }),
+      }),
+    );

---

250-259: Consider adding a companion test: clickId-only path

Optional follow-up: exercise creation using only clickId (omit customerExternalId, name, email, avatar) to assert pure auto-lead creation works.

I can draft that test if helpful.

---

231-233: Use shared trackClickResponseSchema for the response type
Instead of the inline { clickId: string }, import and infer the Zod schema’s type:

import { trackClickResponseSchema } from 'app/(ee)/api/track/click/route';

type TrackClickResponse = z.infer<typeof trackClickResponseSchema>;

const clickResponse = await http.post<TrackClickResponse>({
  path: "/track/click",
  headers: E2E_TRACK_CLICK_HEADERS,
  // …
});

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

apps/web/lib/zod/schemas/sales.ts (1)

93-99: Validate customerAvatar as an http(s) URL to mitigate SSRF.

Current string() allows file://, data:, and internal URLs that storage.upload might fetch. Enforce URL + http(s) scheme and cap length.

-  customerAvatar: z
-    .string()
+  customerAvatar: z
+    .string()
+    .trim()
+    .url({ message: "customerAvatar must be a valid URL" })
+    .refine((u) => /^https?:\/\//.test(u), {
+      message: "customerAvatar must be http(s)",
+    })
+    .max(2048)
     .nullish()
     .default(null)

apps/web/lib/zod/schemas/sales.ts (4)

50-59: Make metadata validation resilient to non-serializable objects.

JSON.stringify in .refine can throw on circular structures. Catch it to surface a clean error.

Apply:

-  metadata: z
-    .record(z.unknown())
-    .nullish()
-    .default(null)
-    .refine((val) => !val || JSON.stringify(val).length <= 10000, {
-      message: "Metadata must be less than 10,000 characters when stringified",
-    })
+  metadata: z
+    .record(z.unknown())
+    .nullish()
+    .default(null)
+    .refine((val) => {
+      if (!val) return true;
+      try {
+        return JSON.stringify(val).length <= 10_000;
+      } catch {
+        return false;
+      }
+    }, {
+      message:
+        "Metadata must be JSON-serializable and <= 10,000 characters when stringified",
+    })

---

69-76: Prevent empty clickId strings.

Whitespace-only values currently pass and become empty after .trim(). Enforce non-empty when provided.

-  clickId: z
-    .string()
-    .trim()
-    .nullish()
+  clickId: z
+    .string()
+    .trim()
+    .min(1, "clickId cannot be empty")
+    .nullish()

---

77-83: Normalize customerName.

Trim and disallow empty names when provided.

-  customerName: z
-    .string()
-    .max(100)
+  customerName: z
+    .string()
+    .trim()
+    .min(1, "customerName cannot be empty")
+    .max(100)

---

85-92: Normalize customerEmail.

Trim and lowercase for canonicalization. Keeps comparisons/idempotency consistent.

-  customerEmail: z
-    .string()
-    .email()
-    .max(100)
+  customerEmail: z
+    .string()
+    .trim()
+    .toLowerCase()
+    .email()
+    .max(100)

apps/web/lib/api/conversions/track-sale.ts (2)

228-240: Harden avatar upload scheduling.

Wrap in a try/catch to avoid unhandled rejections in the background task and add minimal context to logs.

-    if (customerAvatar && !isStored(customerAvatar) && finalCustomerAvatar) {
-      // persist customer avatar to R2 if it's not already stored
-      waitUntil(
-        storage.upload(
-          finalCustomerAvatar.replace(`${R2_URL}/`, ""),
-          customerAvatar,
-          {
-            width: 128,
-            height: 128,
-          },
-        ),
-      );
-    }
+    if (customerAvatar && !isStored(customerAvatar) && finalCustomerAvatar) {
+      // persist customer avatar to R2 if it's not already stored
+      waitUntil(
+        (async () => {
+          try {
+            await storage.upload(
+              finalCustomerAvatar.replace(`${R2_URL}/`, ""),
+              customerAvatar,
+              { width: 128, height: 128 },
+            );
+          } catch (err) {
+            console.error("avatar upload failed", {
+              customerId: finalCustomerId,
+              clickId: clickData.click_id,
+              err,
+            });
+          }
+        })(),
+      );
+    }

---

39-54: Add runtime input validation and defaults in trackSale
trackSale is called directly from apps/web/lib/integrations/singular/track-sale.ts (and other non-route layers), so runtime defaults (e.g. eventName = "Purchase") won’t be applied if callers omit them. Define defaults in the function signature or parse/validate inputs inside trackSale (for example via a Zod schema) to guarantee required fields.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro