apps/web/app/(ee)/api/bounties/[bountyId]/route.ts (3)

66-71: Validate endsAt against the effective startsAt (existing or updated)

With partial updates, startsAt may be omitted. Compare endsAt to startsAt ?? bounty.startsAt after fetching the bounty to avoid accepting invalid ranges.

Apply:

-    if (startsAt && endsAt && endsAt < startsAt) {
-      throw new DubApiError({
-        message: "endsAt must be on or after startsAt.",
-        code: "bad_request",
-      });
-    }
+    // ...fetch bounty first...
+    const effectiveStartsAt = startsAt ?? bounty.startsAt;
+    if (endsAt && effectiveStartsAt && endsAt < effectiveStartsAt) {
+      throw new DubApiError({
+        message: "endsAt must be on or after startsAt.",
+        code: "bad_request",
+      });
+    }

---

94-115: Make PATCH data fields conditional; don’t pass undefined to Prisma

After making the schema partial, always include fields only when provided. Also only touch groups when groupIds is provided; current logic resets groups to empty on omitted groupIds.

Apply:

-      const updatedBounty = await tx.bounty.update({
+      const updatedBounty = await tx.bounty.update({
         where: {
-          id: bounty.id,
+          id: bounty.id,
+          programId, // defense-in-depth
         },
         data: {
-          name,
-          description,
-          startsAt: startsAt!, // Can remove the ! when we're on a newer TS version (currently 5.4.4)
-          endsAt,
-          rewardAmount,
+          ...(name !== undefined && { name }),
+          ...(description !== undefined && { description }),
+          ...(startsAt !== undefined && { startsAt }),
+          ...(endsAt !== undefined && { endsAt }),
+          ...(rewardAmount !== undefined && { rewardAmount }),
           ...(bounty.type === "submission" &&
             submissionRequirements !== undefined && {
               submissionRequirements: submissionRequirements ?? Prisma.JsonNull,
             }),
-          groups: {
-            deleteMany: {},
-            create: groups.map((group) => ({
-              groupId: group.id,
-            })),
-          },
+          ...(groupIds !== undefined && {
+            groups: {
+              deleteMany: {},
+              create: groups.map((group) => ({ groupId: group.id })),
+            },
+          }),
         },
       });

Notes:

• Remove the ! on startsAt and gate the assignment instead.
• Keep groupIds untouched when omitted.

---

184-201: Scope DELETE by programId and consider transactional check

For multi-tenant safety, include programId in the delete where. Also, the submissions count check happens outside the transaction; a submission could arrive between the check and delete.

Apply:

-    await prisma.$transaction(async (tx) => {
-      const bounty = await tx.bounty.delete({
-        where: {
-          id: bountyId,
-        },
-      });
+    await prisma.$transaction(async (tx) => {
+      // Re-check inside the transaction
+      const current = await tx.bounty.findUniqueOrThrow({
+        where: { id: bountyId, programId },
+        include: { _count: { select: { submissions: true } } },
+      });
+      if (current._count.submissions > 0) {
+        throw new DubApiError({
+          message:
+            "Bounties with submissions cannot be deleted. You can archive them instead.",
+          code: "bad_request",
+        });
+      }
+      const bounty = await tx.bounty.delete({
+        where: { id: bountyId, programId },
+      });

apps/web/app/app.dub.co/(dashboard)/[slug]/(ee)/program/bounties/add-edit-bounty-sheet.tsx (3)

329-369: Fix “Add end date” toggle being hidden when hasEndDate is false

The toggle lives inside a container that’s hidden when !hasEndDate, making it impossible to enable. Show the toggle always; only hide/animate the date picker.

Apply:

-                    <AnimatedSizeContainer
-                      height
-                      transition={{ ease: "easeInOut", duration: 0.2 }}
-                      className={!hasEndDate ? "hidden" : ""}
-                      style={{ display: !hasEndDate ? "none" : "block" }}
-                    >
-                      <div className="flex items-center gap-4">
+                    <div className="flex items-center gap-4">
                         <Switch
                           fn={setHasEndDate}
                           checked={hasEndDate}
                           trackDimensions="w-8 h-4"
                           thumbDimensions="w-3 h-3"
                           thumbTranslate="translate-x-4"
                         />
                         <div className="flex flex-col gap-1">
                           <h3 className="text-sm font-medium text-neutral-700">
                             Add end date
                           </h3>
                         </div>
-                      </div>
-
-                      {hasEndDate && (
-                        <div className="mt-6 p-px">
-                          <Controller
-                            control={control}
-                            name="endsAt"
-                            render={({ field }) => (
-                              <SmartDateTimePicker
-                                value={field.value}
-                                onChange={(date) =>
-                                  field.onChange(date ?? undefined)
-                                }
-                                label="End date"
-                                placeholder='E.g. "in 3 months"'
-                              />
-                            )}
-                          />
-                        </div>
-                      )}
-                    </AnimatedSizeContainer>
+                    </div>
+                    <AnimatedSizeContainer
+                      height
+                      transition={{ ease: "easeInOut", duration: 0.2 }}
+                      className={hasEndDate ? "" : "hidden"}
+                      style={{ display: hasEndDate ? "block" : "none" }}
+                    >
+                      <div className="mt-6 p-px">
+                        <Controller
+                          control={control}
+                          name="endsAt"
+                          render={({ field }) => (
+                            <SmartDateTimePicker
+                              value={field.value}
+                              onChange={(date) =>
+                                field.onChange(date ?? undefined)
+                              }
+                              label="End date"
+                              placeholder='E.g. "in 3 months"'
+                            />
+                          )}
+                        />
+                      </div>
+                    </AnimatedSizeContainer>

---

326-326: Remove stray debug text for startsAt error

{errors.startsAt && "test"} leaks to UI. Replace with a proper error message or remove.

Apply:

-                      {errors.startsAt && "test"}
+                      {errors.startsAt && (
+                        <p className="mt-1 text-xs text-red-600">
+                          {errors.startsAt.message ?? "Start date is required"}
+                        </p>
+                      )}

---

382-384: Align client-side validation with schema (min 1)

Server schema enforces rewardAmount >= 1. Client rules allow 0, causing avoidable round-trips.

Apply:

-                          rules={{
-                            required: true,
-                            min: 0,
-                          }}
+                          rules={{
+                            required: true,
+                            min: 1,
+                          }}

apps/web/app/(ee)/api/partner-profile/programs/[programId]/bounties/route.ts (2)

64-69: Fetch only the latest submission (or enforce uniqueness).

If uniqueness isn’t guaranteed, explicitly take: 1 with an order to make the selected submission deterministic and reduce payload.

Apply:

       submissions: {
         where: {
           partnerId: partner.id,
         },
+        take: 1,
+        orderBy: { createdAt: "desc" },
       },

If (bountyId, partnerId) is unique, keep this for payload minimization anyway.

---

20-37: Exclude archived bounties.

Add archivedAt: null to the where clause so partners don’t see archived items.

Apply:

   const bounties = await prisma.bounty.findMany({
     where: {
       programId: program.id,
+      archivedAt: null,
       startsAt: {
         lte: now,
       },