Skip to content

Duplicate partners links - #4153

Open
marcusljf wants to merge 6 commits into
mainfrom
duplicate-links
Open

Duplicate partners links#4153
marcusljf wants to merge 6 commits into
mainfrom
duplicate-links

Conversation

@marcusljf

@marcusljf marcusljf commented Jul 10, 2026

Copy link
Copy Markdown
Collaborator
  • Informs the program if a partner has verified a link that another partner has verified from the same program

Summary by CodeRabbit

  • New Features
    • Added shared-platform matching using partners’ verified websites and identifiers, with program-scoped grouping.
    • Introduced program views for shared-partner panels, including enrollment-status badges and status-specific “View” links.
    • Enhanced partner platform summaries to optionally show shared-platforms in program contexts.
  • Bug Fixes
    • Corrected rejected partner application loading so shared-platform data is included, ensuring social-platform columns render correctly.

@vercel

vercel Bot commented Jul 10, 2026

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
dub Ready Ready Preview Jul 10, 2026 8:11pm

Request Review

@coderabbitai

coderabbitai Bot commented Jul 10, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

Important

Review skipped

No new commits to review since the last review.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: bf1f269c-575d-44de-9062-cbac80dde168

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

Shared-platform matching moved into a reusable helper, with new admin and program API routes and program-specific response types. Partner UI components now fetch and render admin or program matches, including enrollment statuses and program-specific links.

Changes

Shared partner platform flows

Layer / File(s) Summary
Matching helper and program response contract
apps/web/lib/api/partners/get-shared-partner-platforms.ts, apps/web/lib/zod/schemas/partners.ts, apps/web/lib/types.ts
Centralizes verified platform matching and adds program enrollment status to the program response shape.
Admin and program API routes
apps/web/app/(ee)/api/admin/partners/[partnerId]/shared-platforms/route.ts, apps/web/app/(ee)/api/partners/[partnerId]/shared-platforms/route.ts
Reuses the matching helper for admin requests and adds an authenticated, plan-gated program endpoint with enrollment filtering and schema validation.
Program shared-platform data wiring
apps/web/ui/partners/partner-platform-summary.tsx, apps/web/ui/partners/partner-about.tsx, apps/web/ui/partners/partner-application-sheet.tsx, apps/web/app/app.dub.co/.../rejected/page-client.tsx
Adds conditional admin/program fetching, propagates showSharedPlatforms, and corrects the partner-platform query option.
Admin and program shared-partner rendering
apps/web/ui/partners/partner-platform-shared-partners.tsx
Adds variant-specific rendering, program enrollment badges, and status-dependent partner detail URLs.
Ignore rule maintenance
.gitignore
Replaces the existing blob-report/ ignore entry with the same pattern.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant PartnerView
  participant PartnerPlatformSummary
  participant SharedPlatformsAPI
  participant getSharedPartnerPlatforms
  participant Prisma
  PartnerView->>PartnerPlatformSummary: enable shared-platform display
  PartnerPlatformSummary->>SharedPlatformsAPI: request workspace-scoped matches
  SharedPlatformsAPI->>getSharedPartnerPlatforms: pass partnerId and programId
  getSharedPartnerPlatforms->>Prisma: query verified matching platforms
  Prisma-->>getSharedPartnerPlatforms: partners and enrollment statuses
  getSharedPartnerPlatforms-->>SharedPlatformsAPI: grouped shared platforms
  SharedPlatformsAPI-->>PartnerPlatformSummary: validated platform data
  PartnerPlatformSummary-->>PartnerView: render status-aware partner links
Loading

Possibly related PRs

  • dubinc/dub#3921: Both changes affect shared-platform fetching and hook behavior in partner-platform-summary.tsx.
  • dubinc/dub#4017: Both changes modify the admin shared-platform route and its matching logic.

Suggested reviewers: steven-tey, pepeladeira

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 12.50% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title is related to the main change: surfacing duplicate/shared partner links within a program.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch duplicate-links

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@pepeladeira
pepeladeira marked this pull request as ready for review July 10, 2026 18:58

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@apps/web/lib/api/partners/get-shared-partner-platforms.ts`:
- Around line 78-121: Replace the single combined `partnerPlatform.findMany`
query in the shared-platform matching logic with per-platform-type queries, each
restricted to that type and limited to the downstream per-type cap (10), then
combine the results. Preserve the existing partner, verification, program,
ordering, and match-condition filters while ensuring every verified platform
type receives its own result allowance before the per-type slicing logic.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 1868be53-65cc-49c7-8070-d46d5f48b6a0

📥 Commits

Reviewing files that changed from the base of the PR and between 3d9d8a4 and 62671bc.

📒 Files selected for processing (11)
  • .gitignore
  • apps/web/app/(ee)/api/admin/partners/[partnerId]/shared-platforms/route.ts
  • apps/web/app/(ee)/api/partners/[partnerId]/shared-platforms/route.ts
  • apps/web/app/app.dub.co/(dashboard)/[slug]/(ee)/program/partners/applications/rejected/page-client.tsx
  • apps/web/lib/api/partners/get-shared-partner-platforms.ts
  • apps/web/lib/types.ts
  • apps/web/lib/zod/schemas/partners.ts
  • apps/web/ui/partners/partner-about.tsx
  • apps/web/ui/partners/partner-application-sheet.tsx
  • apps/web/ui/partners/partner-platform-shared-partners.tsx
  • apps/web/ui/partners/partner-platform-summary.tsx

Comment thread apps/web/lib/api/partners/get-shared-partner-platforms.ts Outdated
@pepeladeira

Copy link
Copy Markdown
Collaborator

@coderabbitai full review. any breaking changes or security issues?

@coderabbitai

coderabbitai Bot commented Jul 10, 2026

Copy link
Copy Markdown
Contributor
🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

gh pr view 4153 --repo dubinc/dub --json title,body,files,additions,deletions | head -c 3000

echo "---DIFF ROUTE ADMIN---"
gh pr diff 4153 --repo dubinc/dub -- apps/web/app/\(ee\)/api/admin/partners/\[partnerId\]/shared-platforms/route.ts || true

echo "---DIFF ROUTE PARTNER---"
gh pr diff 4153 --repo dubinc/dub -- apps/web/app/\(ee\)/api/partners/\[partnerId\]/shared-platforms/route.ts || true

echo "---DIFF GET-SHARED---"
gh pr diff 4153 --repo dubinc/dub -- apps/web/lib/api/partners/get-shared-partner-platforms.ts || true

Length of output: 3064


🏁 Script executed:

#!/bin/bash
set -euo pipefail

gh pr diff 4153 --repo dubinc/dub > /tmp/pr.diff
wc -l /tmp/pr.diff

echo "---ROUTE ADMIN---"
awk '/diff --git a\/apps\/web\/app\/\(ee\)\/api\/admin\/partners\/\[partnerId\]\/shared-platforms\/route.ts/,/^diff --git/' /tmp/pr.diff | head -160

echo "---ROUTE PARTNER---"
awk '/diff --git a\/apps\/web\/app\/\(ee\)\/api\/partners\/\[partnerId\]\/shared-platforms\/route.ts/,/^diff --git/' /tmp/pr.diff | head -80

echo "---GET-SHARED---"
awk '/diff --git a\/apps\/web\/lib\/api\/partners\/get-shared-partner-platforms.ts/,0' /tmp/pr.diff | head -220

Length of output: 7441


🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'EOF'
import re
with open('/tmp/pr.diff') as f:
    content = f.read()

parts = re.split(r'(?=^diff --git )', content, flags=re.M)
for p in parts:
    if 'admin/partners/[partnerId]/shared-platforms/route.ts' in p.splitlines()[0] if p.strip() else False:
        print(p)
        print('=====END=====')
    if p.strip() and 'app/(ee)/api/partners/[partnerId]/shared-platforms/route.ts' in p.splitlines()[0] and 'admin' not in p.splitlines()[0]:
        print(p)
        print('=====END=====')
EOF

Length of output: 6372


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "---withWorkspace default permission model---"
rg -n "export function withWorkspace|requiredPlan|requiredRole" apps/web/lib/auth/workspace.ts | head -40

echo "---getProgramEnrollmentOrThrow---"
fd get-program-enrollment-or-throw
cat apps/web/lib/api/programs/get-program-enrollment-or-throw.ts 2>/dev/null | head -60

echo "---similar existing partner routes for pattern comparison---"
rg -n "withWorkspace\(" apps/web/app/\(ee\)/api/partners --type=ts -l | head -20

echo "---partner-platform-summary diff---"
python3 - <<'EOF'
import re
with open('/tmp/pr.diff') as f:
    content = f.read()
parts = re.split(r'(?=^diff --git )', content, flags=re.M)
for p in parts:
    if p.strip() and 'partner-platform-summary.tsx' in p.splitlines()[0]:
        print(p)
EOF

Length of output: 7529


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "--- partners/[partnerId]/route.ts ---"
sed -n '1,60p' "apps/web/app/(ee)/api/partners/[partnerId]/route.ts"

echo "--- partners/[partnerId]/comments/route.ts (role check pattern) ---"
sed -n '1,40p' "apps/web/app/(ee)/api/partners/[partnerId]/comments/route.ts"

echo "--- check DubApiError not_found code exposure vs enumeration ---"
rg -n "not_found" apps/web/lib/api/errors.ts | head -5

Length of output: 2800


Good, this confirms consistent patterns with existing partner endpoints (no requiredRoles restriction, matching sibling routes like /api/partners/[partnerId]/route.ts and /comments). I have enough context now.

@pepeladeira I did a full review of PR #4153. Summary of findings:

No breaking changes found:

  • The .gitignore, admin route refactor, and page-client typo fix (includePartnerPlatformPropssincludePartnerPlatforms) are all backward-compatible/bug fixes.
  • The admin route (apps/web/app/(ee)/api/admin/partners/[partnerId]/shared-platforms/route.ts) preserves its response shape (partnerSharedPlatformSchema), just delegates logic to the new getSharedPartnerPlatforms helper — no contract change for existing consumers.
  • PartnerPlatformSharedPartners and PartnerPlatformSummary prop changes are additive (showSharedPlatforms, variant) with sensible defaults, so existing call sites keep working.

Security review — nothing severe, but two things worth a closer look:

  1. PII exposure scope is correctly bounded to the same program. In getSharedPartnerPlatforms (apps/web/lib/api/partners/get-shared-partner-platforms.ts), when programId is passed, the Prisma query filters matched partners with partner: { programs: { some: { programId } } }, and the new partner-facing route (apps/web/app/(ee)/api/partners/[partnerId]/shared-platforms/route.ts) also calls getProgramEnrollmentOrThrow({ partnerId, programId }) before fetching. So a workspace can only see matches for partners enrolled in its own program — cross-program leakage is prevented.

  2. No requiredRoles restriction on the new endpoint, meaning any team member of the workspace (not just owners/admins) can query another partner's email/name/image via this route. This matches the existing pattern for sibling routes (/api/partners/[partnerId]/route.ts, /api/partners/[partnerId]/comments/route.ts) which also lack role restrictions, so it's consistent with current conventions rather than a new issue introduced by this PR — but flagging it in case partner PII exposure to all workspace roles wasn't an intentional decision for this specific feature.

One minor non-security note: getSharedPartnerPlatforms now runs one Prisma query per verified platform type in parallel (Promise.all) instead of a single combined OR query as before. Functionally equivalent, just worth knowing if partners with many platform types could add query overhead — unlikely to matter given the low cardinality of platform types.

Overall the refactor to share logic between admin/program routes is clean, and the enrollment-status scoping for program view is correctly enforced.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@pepeladeira

Copy link
Copy Markdown
Collaborator

@coderabbitai full review. any breaking changes or security issues?

@coderabbitai

coderabbitai Bot commented Jul 10, 2026

Copy link
Copy Markdown
Contributor

@pepeladeira I already ran a full review of this PR above — happy to recap the key points:

Breaking changes: None found. The admin route refactor and partner-platform-summary/partner-platform-shared-partners prop changes are additive and backward-compatible; the typo fix (includePartnerPlatformPropssincludePartnerPlatforms) only corrects a bug, it doesn't change any existing contract.

Security:

  1. PII exposure is correctly scoped — getSharedPartnerPlatforms filters matches to partners enrolled in the same programId when provided, and the new partner-facing route calls getProgramEnrollmentOrThrow before fetching, so there's no cross-program data leakage.
  2. The new partner route (apps/web/app/(ee)/api/partners/[partnerId]/shared-platforms/route.ts) has no requiredRoles restriction, so any workspace team member (not just owners/admins) can query another partner's matched name/email/image via this endpoint. This is consistent with sibling routes like /api/partners/[partnerId]/route.ts and /comments, so it's not a new issue introduced here — just worth confirming it's intentional for this PII-adjacent feature.

If there have been new commits pushed since my last pass, let me know and I'll kick off a fresh full review; otherwise the above still stands as my complete assessment.

✅ Action performed

Full review finished.

@pepeladeira

Copy link
Copy Markdown
Collaborator

@coderabbitai I've pushed new changes. full review. any breaking changes or security issues?

@coderabbitai

coderabbitai Bot commented Jul 10, 2026

Copy link
Copy Markdown
Contributor
🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

gh pr view 4153 --repo dubinc/dub --json commits,updatedAt,additions,deletions | python3 -m json.tool | tail -60

echo "---LATEST DIFF SUMMARY---"
gh pr diff 4153 --repo dubinc/dub --name-only

echo "---FULL DIFF SAVE---"
gh pr diff 4153 --repo dubinc/dub > /tmp/pr_new.diff
wc -l /tmp/pr_new.diff

Length of output: 3267


🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'EOF'
import re
with open('/tmp/pr_new.diff') as f:
    content = f.read()
parts = re.split(r'(?=^diff --git )', content, flags=re.M)
for p in parts:
    if p.strip() and 'get-shared-partner-platforms.ts' in p.splitlines()[0]:
        print(p)
        print("=====END=====")
EOF

Length of output: 5983


🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'EOF'
import re
with open('/tmp/pr_new.diff') as f:
    content = f.read()
parts = re.split(r'(?=^diff --git )', content, flags=re.M)
for p in parts:
    if not p.strip():
        continue
    header = p.splitlines()[0]
    if 'get-shared-partner-platforms.ts' in header:
        continue
    print(p)
    print("=====END=====")
EOF

Length of output: 18278


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "---PartnerStatusBadges---"
fd partner-status-badges
cat apps/web/ui/partners/partner-status-badges.tsx 2>/dev/null | head -40

echo "---ArrowUpRight2 export---"
rg -n "ArrowUpRight2" packages/ui/src/icons -l 2>/dev/null || rg -n "ArrowUpRight2" --type=ts -l | head -5

echo "---useWorkspace slug typing---"
rg -n "export default function useWorkspace" -A 30 apps/web/lib/swr/use-workspace.ts | head -40

echo "---getProgramEnrollmentOrThrow signature---"
sed -n '1,60p' apps/web/lib/api/programs/get-program-enrollment-or-throw.ts

Length of output: 947


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "---PartnerStatusBadges---"
cat apps/web/ui/partners/partner-status-badges.ts

echo "---ArrowUpRight2 export---"
rg -n "ArrowUpRight2" --type=ts --type=tsx -g '!node_modules' | head -10 || true
rg -n "ArrowUpRight2" -g '*.ts' -g '*.tsx' | head -10 || true

echo "---useWorkspace slug typing---"
rg -n "slug" apps/web/lib/swr/use-workspace.ts | head -20

echo "---getProgramEnrollmentOrThrow signature---"
sed -n '1,60p' apps/web/lib/api/programs/get-program-enrollment-or-throw.ts || true

Length of output: 2027


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "---ArrowUpRight2 export---"
rg -n "ArrowUpRight2" -g '*.ts' -g '*.tsx' packages/ui 2>/dev/null | head -10

echo "---useWorkspace slug---"
rg -n "slug" apps/web/lib/swr/use-workspace.ts | head -20

echo "---getProgramEnrollmentOrThrow---"
fd get-program-enrollment-or-throw
sed -n '1,60p' apps/web/lib/api/programs/get-program-enrollment-or-throw.ts

Length of output: 2438


@pepeladeira Reviewed the new commits (the 4 "code improvements" commits + merge from main, latest at 234121c). Here's the updated assessment:

Breaking changes: None. All changes remain additive/backward-compatible — same as before.

Security:

  1. PII/cross-program scoping is unchanged and still correct: getSharedPartnerPlatforms only returns matches from partners enrolled in the same programId when one is provided, and the partner-facing route calls getProgramEnrollmentOrThrow first (which throws a generic not_found DubApiError, no enumeration leak).
  2. The partner-facing route (apps/web/app/(ee)/api/partners/[partnerId]/shared-platforms/route.ts) still has no requiredRoles restriction, so any workspace team member can query it — this remains consistent with sibling routes (/api/partners/[partnerId]/route.ts, /comments), so still not a new issue, just worth confirming it's intentional.

Improvement since last review: The minor "N queries per platform type" overhead I flagged earlier has actually been addressed. getSharedPartnerPlatforms (apps/web/lib/api/partners/get-shared-partner-platforms.ts) now runs at most 2 Prisma queries in parallel — one combined OR query for all exact-match platform types, plus one separate query for the website domain match (since it needs contains instead of exact matching) — instead of one query per platform type. Nice cleanup.

One tiny nit (non-blocking): In the new ProgramSharedPartner component (apps/web/ui/partners/partner-platform-shared-partners.tsx), the link href uses workspaceSlug! (non-null assertion) from useWorkspace(). In practice this should always resolve on partner-scoped pages, but if useWorkspace() slug is ever transiently undefined on first render, the link would briefly point to /undefined/program/.... Not a real risk given where this component is used, just flagging for awareness.

Overall: still no breaking changes or severe security issues, and the query consolidation is a solid improvement over the previous version.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants