apps/web/lib/partners/create-partner-commission.ts (1)

177-183: Propagated fraud/canceled status: also suppress notifications/workflows.

You set status = firstCommission.status, but later notifications and workflows only gate on isClawback. We should avoid notifying or triggering workflows for fraud/canceled commissions.

Outside this hunk, refine these flags:

-        const isClawback = earnings < 0;
-        const shouldTriggerWorkflow = !isClawback && !skipWorkflow;
+        const isClawback = earnings < 0;
+        const isInvalidStatus = status === "fraud" || status === "canceled";
+        const shouldTriggerWorkflow = !isClawback && !isInvalidStatus && !skipWorkflow;

And guard notifications similarly:

-          !isClawback &&
+          !isClawback && !isInvalidStatus &&
             notifyPartnerCommission({ /* ... */ })

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

apps/web/lib/partners/create-partner-commission.ts (1)

89-104: Fix dedupe scope and require customerId for lead/sale

The firstCommission query omits programId and uses a possibly undefined customerId, which Prisma ignores — causing cross-program/cross-customer dedupe and status bleed-through. Add a guard and scope the query.

-    } else {
+    } else {
+      // Require customerId for lead/sale to avoid cross-customer dedupe/status bleed-through
+      if ((event === "lead" || event === "sale") && !customerId) {
+        await log({
+          message: `Missing customerId for ${event} commission (program ${programId}, partner ${partnerId}) — skipping.`,
+          type: "errors",
+          mention: true,
+        });
+        return;
+      }
       const firstCommission = await prisma.commission.findFirst({
         where: {
+          programId,
           partnerId,
-          customerId,
+          customerId: customerId!, // guaranteed by guard above
           type: event,
         },

apps/web/app/app.dub.co/(dashboard)/[slug]/(ee)/program/commissions/commission-popover-buttons.tsx (1)

22-39: Minor a11y: expose popover state to screen readers

Consider passing aria-expanded/aria-haspopup via Button or Popover so assistive tech reflects the open state.

-        <Button
+        <Button
           onClick={() => setOpenPopover(!openPopover)}
           variant="secondary"
           className="h-8 w-auto px-1.5 sm:h-9"
           icon={<ThreeDots className="h-5 w-5 text-neutral-500" />}
+          aria-haspopup="menu"
+          aria-expanded={openPopover}
         />

Also applies to: 42-58, 61-71

apps/web/app/app.dub.co/(dashboard)/[slug]/(ee)/program/partners/import-export-buttons.tsx (1)

32-38: Minor a11y: reflect popover state

Same note as other popover—add aria-expanded/aria-haspopup on the trigger.

-        <Button
+        <Button
           onClick={() => setOpenPopover(!openPopover)}
           variant="secondary"
           className="h-8 w-auto px-1.5 sm:h-9"
           icon={<ThreeDots className="h-5 w-5 text-neutral-500" />}
+          aria-haspopup="menu"
+          aria-expanded={openPopover}
         />

Also applies to: 66-82, 85-95

apps/web/lib/partners/create-partner-commission.ts (1)

58-61: Nit: guard/validation for quantity and currency (non-blocking)

Optionally validate quantity > 0 and default currency for sale/custom to reduce bad writes.

-  let earnings = 0;
+  let earnings = 0;
   let reward: RewardProps | null = null;
   let status: CommissionStatus = "pending";
+  if (quantity <= 0) {
+    await log({ message: `Invalid quantity (${quantity}) for ${event}`, type: "errors" });
+    return;
+  }

Also applies to: 200-221

apps/web/app/app.dub.co/(dashboard)/[slug]/(ee)/program/commissions/create-commission-button.tsx (1)

7-7: Ensure accessible name and avoid mobile ambiguity

On mobile the visible label is just “Create”, which is ambiguous for screen readers and can cause a tiny hydration/layout shift when isMobile flips. Add a stable accessible name (and optional title).

       <Button
         type="button"
         onClick={() => setShowCreateCommissionSheet(true)}
         text={`Create${isMobile ? "" : " commission"}`}
+        aria-label="Create commission"
+        title="Create commission"
         shortcut="C"
         className="h-8 px-3 sm:h-9"
       />

Also applies to: 22-25

apps/web/app/app.dub.co/(dashboard)/[slug]/(ee)/program/commissions/create-commission-sheet.tsx (2)

164-175: Don’t treat 0 as “missing” for numeric fields

Current checks disable submit when amount/saleAmount is 0. If 0 is a valid value per schema (min: 0), compare against null/undefined instead.

   if (commissionType === "custom") {
-    return !amount;
+    return amount == null;
   }
   if (commissionType === "sale") {
-    return !linkId || !customerId || !saleAmount;
+    return !linkId || !customerId || saleAmount == null;
   }
   if (commissionType === "lead") {
     return !linkId || !customerId;
   }

---

616-622: Microcopy: prefer “Invoice ID” / “Product ID” casing

Tiny polish for consistency with labels below.

-                          <span className="rounded-md border border-neutral-200 bg-neutral-100 px-1 py-0.5 text-xs">
-                            invoiceID
-                          </span>
+                          <span className="rounded-md border border-neutral-200 bg-neutral-100 px-1 py-0.5 text-xs">
+                            Invoice ID
+                          </span>

-                          <span className="rounded-md border border-neutral-200 bg-neutral-100 px-1 py-0.5 text-xs">
-                            productID
-                          </span>
+                          <span className="rounded-md border border-neutral-200 bg-neutral-100 px-1 py-0.5 text-xs">
+                            Product ID
+                          </span>

Also applies to: 671-676

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

apps/web/lib/partners/create-partner-commission.ts (2)

98-104: Dedup scope missing programId and customer guard for lead/sale

• Missing programId can dedupe across programs.
• If customerId is undefined, Prisma ignores it, causing cross-customer dedupe/status bleed.

Apply both guard and scoping:

   } else {
+    // Require a customer for lead/sale to avoid cross-customer dedupe/propagation
+    if ((event === "lead" || event === "sale") && !customerId) {
+      await log({
+        message: `Missing customerId for ${event} commission (program ${programId}, partner ${partnerId}) — skipping.`,
+        type: "errors",
+        mention: true,
+      });
+      return;
+    }
     const firstCommission = await prisma.commission.findFirst({
       where: {
+        programId,
         partnerId,
-        customerId,
+        customerId: customerId!, // guarded above
         type: event,
       },

---

163-166: Use event/create timestamp for duration window, not “now”

Backfills/manuals get misclassified when using new Date().

-              const monthsDifference = differenceInMonths(
-                new Date(),
-                firstCommission.createdAt,
-              );
+              const effectiveCreatedAt = createdAt ?? new Date();
+              const monthsDifference = differenceInMonths(
+                effectiveCreatedAt,
+                firstCommission.createdAt,
+              );

apps/web/app/app.dub.co/(dashboard)/[slug]/(ee)/program/partners/import-export-buttons.tsx (2)

89-94: Add accessible name to icon-only trigger

Icon-only buttons need an aria-label for screen readers.

-        <Button
+        <Button
           onClick={() => setOpenPopover(!openPopover))}
           variant="secondary"
           className="h-8 w-auto px-1.5 sm:h-9"
           icon={<ThreeDots className="h-5 w-5 text-neutral-500" />}
+          aria-label="More partner actions"
         />

---

70-76: Explicit button type to avoid unintended form submits

If this popover sits inside a form in the future, default type="submit" can be problematic.

-              <button
+              <button
                 onClick={() => {
                   setOpenPopover(false);
                   setShowExportPartnersModal(true);
                 }}
                 className="w-full rounded-md p-2 hover:bg-neutral-100 active:bg-neutral-200"
+                type="button"
               >

-    <button
+    <button
       onClick={onClick}
       className="w-full rounded-md p-2 hover:bg-neutral-100 active:bg-neutral-200"
+      type="button"
     >

Also applies to: 108-114

apps/web/app/app.dub.co/(dashboard)/[slug]/(ee)/program/commissions/commission-popover-buttons.tsx (2)

65-71: Add accessible name to icon-only trigger

Provide aria-label for better a11y.

-        <Button
+        <Button
           onClick={() => setOpenPopover(!openPopover)}
           variant="secondary"
           className="h-8 w-auto px-1.5 sm:h-9"
           icon={<ThreeDots className="h-5 w-5 text-neutral-500" />}
+          aria-label="More commission actions"
         />

---

26-37: Explicit button type to avoid accidental submits

Harden inner buttons with type="button".

-              <button
+              <button
                 onClick={() => {
                   setOpenPopover(false);
                   setClawbackSheetOpen(true);
                 }}
                 className="w-full rounded-md p-2 hover:bg-neutral-100 active:bg-neutral-200"
+                type="button"
               >

-              <button
+              <button
                 onClick={() => {
                   setOpenPopover(false);
                   setShowExportCommissionsModal(true);
                 }}
                 className="w-full rounded-md p-2 hover:bg-neutral-100 active:bg-neutral-200"
+                type="button"
               >

Also applies to: 46-57

apps/web/app/app.dub.co/(dashboard)/[slug]/(ee)/program/commissions/create-commission-button.tsx (2)

3-7: Avoid hydration flicker from responsive label.

useMediaQuery can change after mount, briefly flipping text between "Create commission" and "Create." Gate on a mounted flag if you want to avoid the flash. Optional, but improves polish.

Example:

+import { useEffect, useState } from "react";
 ...
 export function CreateCommissionButton() {
-  const { isMobile } = useMediaQuery();
+  const { isMobile } = useMediaQuery();
+  const [mounted, setMounted] = useState(false);
+  useEffect(() => setMounted(true), []);

Then use mounted && isMobile where needed.

---

20-25: Preserve descriptive labeling on mobile and hide shortcut badge.

"Create" alone is ambiguous for screen readers. Add an aria-label and suppress the keyboard shortcut hint on mobile.

       <Button
         type="button"
         onClick={() => setShowCreateCommissionSheet(true)}
-        text={`Create${isMobile ? "" : " commission"}`}
-        shortcut="C"
+        text={`Create${isMobile ? "" : " commission"}`}
+        aria-label="Create commission"
+        shortcut={isMobile ? undefined : "C"}
         className="h-8 px-3 sm:h-9"
       />

apps/web/app/app.dub.co/(dashboard)/[slug]/(ee)/program/commissions/create-commission-sheet.tsx (2)

116-126: Harden error handling for next-safe-action.

error.serverError may be undefined. Provide a safe fallback and optionally surface validation errors.

-  const { executeAsync, isPending } = useAction(createManualCommissionAction, {
+  const { executeAsync, isPending } = useAction(createManualCommissionAction, {
     onSuccess: async () => {
       toast.success("A commission has been created for the partner!");
       setIsOpen(false);
       await mutatePrefix(`/api/commissions?workspaceId=${workspaceId}`);
     },
-    onError({ error }) {
-      console.log(error);
-      toast.error(error.serverError);
+    onError({ error }) {
+      console.log(error);
+      const msg =
+        error.serverError ??
+        (error.validationErrors
+          ? "Please check the highlighted fields."
+          : "Something went wrong. Please try again.");
+      toast.error(msg);
     },
   });

---

565-595: Align money input UX with Amount field.

Add onKeyDown={handleMoneyKeyDown} to saleAmount to prevent invalid characters (e/E,+,-), matching the “Amount” field behavior.

                           render={({ field }) => (
                             <input
                               {...field}
                               type="number"
                               onWheel={(e) => e.currentTarget.blur()}
+                              onKeyDown={handleMoneyKeyDown}

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro