apps/web/app/app.dub.co/(dashboard)/[slug]/(ee)/program/partners/[partnerId]/partner-nav.tsx (1)

134-145: Add rel="noopener noreferrer" to target=_blank Commissions link; confirm final route.

Missing rel is a security gap (reverse‑tabnabbing). Also please re‑confirm that this is the intended canonical route for Commissions in this PR.

Apply:

-        <Link
-          href={`/${workspaceSlug}/program/commissions?partnerId=${partnerId}`}
-          target="_blank"
+        <Link
+          href={`/${workspaceSlug}/program/commissions?partnerId=${partnerId}`}
+          target="_blank"
+          rel="noopener noreferrer"

Optionally verify the route shape used elsewhere:

#!/bin/bash
# Inspect commissions routes/usages
rg -nP -C2 '/program/(partners/[^/]+/commissions|commissions\?partnerId=)' apps/web | sed -n '1,200p'
fd -H 'commissions' apps/web/app | sed -n '1,200p'

apps/web/app/app.dub.co/(dashboard)/[slug]/(ee)/program/partners/[partnerId]/partner-nav.tsx (4)

32-49: Wheel listener should be non‑passive to allow preventDefault.

Chrome may ignore preventDefault on passive listeners; set passive: false and mirror options in removeEventListener.

   useEffect(() => {
     if (!containerRef.current) return;

-    const handleWheel = (event: WheelEvent) => {
+    const handleWheel = (event: WheelEvent) => {
       if (Math.abs(event.deltaX) > Math.abs(event.deltaY)) return;
       event.preventDefault();
 
       containerRef.current?.scrollBy({
         left: event.deltaY,
         behavior: "smooth",
       });
     };
 
-    containerRef.current.addEventListener("wheel", handleWheel);
+    const wheelOptions: AddEventListenerOptions = { passive: false };
+    containerRef.current.addEventListener("wheel", handleWheel, wheelOptions);
 
-    return () =>
-      containerRef.current?.removeEventListener("wheel", handleWheel);
+    return () =>
+      containerRef.current?.removeEventListener("wheel", handleWheel, wheelOptions);
   }, []);

---

51-55: Initialize scroll progress on mount to avoid a stale gradient until first scroll/resize.

Call update once after mount.

   const { scrollProgress, updateScrollProgress } = useScrollProgress(
     containerRef,
     { direction: "horizontal" },
   );
+
+  useEffect(() => {
+    updateScrollProgress();
+  }, [updateScrollProgress]);

---

99-106: Make active‑tab detection robust for nested routes; add aria‑current for a11y.

endsWith fails if viewing a nested child (e.g., /comments/123). Use last segment and expose aria-current.

-            {tabs.map(({ id, label, icon: Icon, badge }) => {
-              const isSelected = pathname.endsWith(`/${id}`);
+            {tabs.map(({ id, label, icon: Icon, badge }) => {
+              const lastSeg = pathname.replace(/\/$/, "").split("/").pop();
+              const isSelected = lastSeg === id || pathname.includes(`/${id}/`);
               return (
                 <Link
                   key={id}
                   href={`/${workspaceSlug}/program/partners/${partnerId}/${id}`}
                   data-selected={isSelected}
+                  aria-current={isSelected ? "page" : undefined}
                   className={cn(

Also applies to: 120-129

---

103-105: Optional: centralize partner URL generation

There's already a getPartnerUrl helper in apps/web/app/app.dub.co/(dashboard)/[slug]/(ee)/program/partners/partners-table.tsx (around line 91). Import and use it here instead of the inline template — or extract it to a shared util — to avoid string-template drift across files.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

apps/web/lib/actions/partners/update-partner-enrollment.ts (1)

13-17: Validate or drop workspaceId to match the schema.

workspaceId is required by the schema but ignored at runtime. Either validate it against ctx.workspace.id or remove it from the schema.

Option A — validate:

-  .action(async ({ parsedInput, ctx }) => {
+  .action(async ({ parsedInput, ctx }) => {
     const { workspace, user } = ctx;
-    const { partnerId, tenantId } = parsedInput;
+    const { partnerId, tenantId, workspaceId } = parsedInput;
+    if (workspaceId !== workspace.id) {
+      throw new Error("workspaceId mismatch");
+    }

Option B — drop from schema:

-const updatePartnerEnrollmentSchema = z.object({
-  workspaceId: z.string(),
+const updatePartnerEnrollmentSchema = z.object({
   partnerId: z.string(),
   tenantId: z.string().nullable(),
});

Also applies to: 23-25

apps/web/lib/actions/partners/update-partner-enrollment.ts (4)

26-31: Ensure programId is the canonical ID (not a slug) before write queries.

getProgramEnrollmentOrThrow accepts slugs or IDs, but Prisma writes below require the ID. Guard by resolving the ID from the fetched enrollment.

-    const programId = getDefaultProgramIdOrThrow(workspace);
-
-    const { partner } = await getProgramEnrollmentOrThrow({
-      partnerId,
-      programId,
-      includePartner: true,
-    });
+    const programIdentifier = getDefaultProgramIdOrThrow(workspace);
+    const enrollment = await getProgramEnrollmentOrThrow({
+      partnerId,
+      programId: programIdentifier,
+      includePartner: true,
+      includeProgram: true,
+    });
+    const { partner } = enrollment;
+    const programId = enrollment.program.id; // canonical ID

Also applies to: 34-38, 46-49

---

64-77: Limit PII/noise in audit metadata.

Logging the full partner object may capture PII and bloat logs. Prefer a minimal, stable subset.

Example:

-          targets: [
-            {
-              type: "partner",
-              id: partnerId,
-              metadata: partner,
-            },
-          ],
+          targets: [
+            {
+              type: "partner",
+              id: partnerId,
+              metadata: {
+                id: partner.id,
+                name: partner.name,
+                handle: partner.handle,
+                companyName: partner.companyName,
+              },
+            },
+          ],

---

39-59: Short-circuit no-op writes when tenantId is unchanged.

Avoid unnecessary writes and downstream logging when the value doesn’t change.

-    const programEnrollment = await prisma.$transaction(async (tx) => {
+    if (enrollment.tenantId === tenantId) {
+      return; // nothing to do
+    }
+    const programEnrollment = await prisma.$transaction(async (tx) => {

---

61-63: Scale recordLink for large link sets.

If programEnrollment.links can be large, chunk or stream to avoid timeouts/limits in the background task. Also confirm recordLink accepts an array.

Example (conceptual):

-    waitUntil(
-      Promise.allSettled([
-        recordLink(programEnrollment.links),
+    const batches = [];
+    for (let i = 0; i < programEnrollment.links.length; i += 500) {
+      batches.push(programEnrollment.links.slice(i, i + 500));
+    }
+    waitUntil(
+      Promise.allSettled([
+        ...batches.map((batch) => recordLink(batch)),
         recordAuditLog({ /* ... */ }),
       ]),
     );

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

apps/web/lib/actions/partners/update-partner-comment.ts (1)

13-17: Validate or drop workspaceId from schema

updatePartnerCommentSchema includes workspaceId but the action ignores it. Either assert equality with ctx.workspace.id here or remove it from the schema to avoid cross-tenant confusion.

apps/web/lib/actions/partners/delete-partner-comment.ts (2)

10-13: Validate or drop workspaceId

Schema includes workspaceId but action doesn’t verify it against ctx.workspace.id. Validate here or remove from schema.

---

9-22: Enforce ownership and fix Prisma delete selector

delete needs a unique selector; { id, programId } isn’t unique. Also enforce userId to prevent deleting others’ comments. Use deleteMany + count check, and return a result.

 export const deletePartnerCommentAction = authActionClient
   .schema(deletePartnerCommentSchema)
   .action(async ({ parsedInput, ctx }) => {
-    const { workspace } = ctx;
+    const { workspace, user } = ctx;
     const { commentId } = parsedInput;
 
     const programId = getDefaultProgramIdOrThrow(workspace);
 
-    await prisma.partnerComment.delete({
-      where: {
-        id: commentId,
-        programId,
-      },
-    });
+    const { count } = await prisma.partnerComment.deleteMany({
+      where: { id: commentId, programId, userId: user.id },
+    });
+    if (count === 0) {
+      throw new Error("Comment not found or not owned by you.");
+    }
+    return { success: true };
   });

apps/web/lib/actions/partners/create-partner-comment.ts (1)

17-18: Don’t accept client-supplied createdAt; set on server

Client timestamps are spoofable and race-prone. Set createdAt server-side (or rely on DB default) and remove it from input.

-    const { partnerId, text, createdAt } = parsedInput;
+    const { partnerId, text, workspaceId } = parsedInput;
+    if (workspaceId !== workspace.id) {
+      throw new Error("workspaceId mismatch");
+    }
...
-    const comment = await prisma.partnerComment.create({
+    const comment = await prisma.partnerComment.create({
       data: {
         programId,
         partnerId,
         userId: user.id,
         text,
-        createdAt,
       },

apps/web/lib/actions/partners/create-partner-comment.ts (1)

13-15: Schema alignment required

After dropping createdAt from input, update createPartnerCommentSchema accordingly and trim text to prevent whitespace-only comments.

apps/web/lib/zod/schemas/programs.ts (3)

188-191: Align date handling with JSON transport

These are serialized to ISO strings over HTTP. Use z.coerce.date() to accept strings and Dates seamlessly.

-  createdAt: z.date(),
-  updatedAt: z.date(),
+  createdAt: z.coerce.date(),
+  updatedAt: z.coerce.date(),

---

195-209: Remove client createdAt; trim comment text

Let the server/DB set timestamps. Also trim text to disallow whitespace-only.

-export const createPartnerCommentSchema = z.object({
-  workspaceId: z.string(),
-  partnerId: z.string(),
-  text: z.string().min(1).max(MAX_PROGRAM_PARTNER_COMMENT_LENGTH),
-  createdAt: z.coerce
-    .date()
-    .refine(
-      (date) =>
-        date.getTime() <= Date.now() &&
-        date.getTime() >= Date.now() - 1000 * 60,
-      {
-        message: "Comment timestamp must be within the last 60 seconds",
-      },
-    ),
-});
+export const createPartnerCommentSchema = z.object({
+  workspaceId: z.string(),
+  partnerId: z.string(),
+  text: z.string().trim().min(1).max(MAX_PROGRAM_PARTNER_COMMENT_LENGTH),
+});

---

211-215: Trim on update as well

Add .trim() to ensure updates can’t set whitespace-only text.

-export const updatePartnerCommentSchema = z.object({
+export const updatePartnerCommentSchema = z.object({
   workspaceId: z.string(),
   id: z.string(),
-  text: z.string().min(1).max(MAX_PROGRAM_PARTNER_COMMENT_LENGTH),
+  text: z.string().trim().min(1).max(MAX_PROGRAM_PARTNER_COMMENT_LENGTH),
 });

apps/web/app/(ee)/api/partners/[partnerId]/comments/route.ts (2)

27-28: Date schema vs JSON: prefer z.coerce.date() in schema

NextResponse.json returns strings; downstream code re-parses with new Date(...). Update PartnerCommentSchema to z.coerce.date() (see schema comment) so server- and client-side validation are consistent. No code change needed here if schema is updated.

---

14-25: Consider pagination to avoid unbounded result sets

If comment volumes grow, add take/skip (or cursor) with query params.

apps/web/app/app.dub.co/(dashboard)/[slug]/(ee)/program/partners/[partnerId]/comments/page-client.tsx (4)

61-66: Stop sending client createdAt

After moving timestamping server-side, remove createdAt from the action call.

-              const result = await createPartnerComment({
-                workspaceId: workspaceId!,
-                partnerId,
-                text,
-                createdAt,
-              });
+              const result = await createPartnerComment({
+                workspaceId: workspaceId!,
+                partnerId,
+                text,
+              });

---

73-81: Replace optimistic entry to avoid duplicates; don’t revalidate immediately

Filter out the optimistic item when inserting the real one; also set revalidate: false to avoid double-fetch churn.

-              return data
-                ? [result.data.comment, ...data]
-                : [result.data.comment];
+              const real = result.data.comment;
+              return data
+                ? [real, ...data.filter((c) => c.id !== optimisticComment.id)]
+                : [real];
             },
             {
               optimisticData: (data) =>
                 data ? [optimisticComment, ...data] : [optimisticComment],
               rollbackOnError: true,
+              revalidate: false,
             },

---

191-239: Hide delete action for undelivered optimistic comments

Avoid sending delete mutations for temporary tmp_* comments.

-        {comment ? (
+        {comment && comment.delivered !== false ? (
           <Popover
             content={
               <div className="grid w-full grid-cols-1 gap-px p-2 sm:w-48">
                 <Button
                   text="Delete comment"
                   variant="danger-outline"
                   onClick={async () => {
                     setOpenPopover(false);
 
                     if (
                       !confirm("Are you sure you want to delete this comment?")
                     )
                       return;
 
                     await deleteComment({
                       workspaceId: workspaceId!,
                       commentId: comment.id,
                     });
                   }}
                   icon={<Trash className="size-4" />}
                   className="h-9 justify-start px-2 font-medium"
                 />
               </div>
             }
             align="end"
             openPopover={openPopover}
             setOpenPopover={setOpenPopover}
           >
             <Button

---

155-157: Avatar/name fallback robustness

Handle null names and URL-encode to prevent broken avatars.

-              src={comment.user.image || `${OG_AVATAR_URL}${comment.user.name}`}
-              alt={`${comment.user.name} avatar`}
+              src={
+                comment.user.image ||
+                `${OG_AVATAR_URL}${encodeURIComponent(comment.user.name || "User")}`
+              }
+              alt={`${comment.user.name || "User"} avatar`}

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro