apps/web/ui/messages/messages-panel.tsx (2)

1-1: Ensure this is a Client Component

This file uses React hooks and navigator; add "use client" if not already declared elsewhere.

Apply if needed:

+"use client";

---

251-255: Guard navigator for SSR safety

Avoid ReferenceError during server render.

Apply this diff:

-                      {navigator.platform.startsWith("Mac") ? "⌘" : "^"}
+                      {(typeof navigator !== "undefined" &&
+                        navigator.platform.startsWith("Mac"))
+                        ? "⌘"
+                        : "Ctrl"}

apps/web/lib/actions/partners/reject-bounty-submission.ts (1)

51-77: Make status transition atomic to avoid races

Update can clobber a concurrent approve/reject. Gate by prior status.

Apply pattern:

-      await tx.bountySubmission.update({
-        where: { id: submissionId },
-        data: { status: "rejected", reviewedAt: new Date(), userId: user.id, rejectionReason, rejectionNote, commissionId: null },
-      });
+      const { count } = await tx.bountySubmission.updateMany({
+        where: { id: submissionId, status: { in: ["pending"] } },
+        data: {
+          status: "rejected",
+          reviewedAt: new Date(),
+          userId: user.id,
+          rejectionReason,
+          rejectionNote,
+          commissionId: null,
+        },
+      });
+      if (count === 0) throw new Error("Submission status changed; retry.");

apps/web/lib/actions/partners/approve-bounty-submission.ts (1)

68-95: Reduce inconsistency risk: transaction + atomic update

Commission creation and status update are not atomic; consider wrapping with a transaction and gating by prior status to prevent orphans/races.

Example shape:

await prisma.$transaction(async (tx) => {
  const commission = await createPartnerCommission(/* pass tx if supported */);
  if (!commission) throw new Error("Failed to create commission.");

  const { count } = await tx.bountySubmission.updateMany({
    where: { id: submissionId, status: { in: ["pending"] } },
    data: {
      status: "approved",
      reviewedAt: new Date(),
      userId: user.id,
      rejectionNote: null,
      rejectionReason: null,
      commissionId: commission.id,
    },
  });
  if (count === 0) throw new Error("Submission status changed; retry.");
});

If createPartnerCommission doesn’t accept a tx, consider adding an overload.

apps/web/app/app.dub.co/(dashboard)/[slug]/(ee)/program/bounties/[bountyId]/bounty-submission-details-sheet.tsx (1)

329-338: Disable Reject when already rejected

Tooltip says “already rejected” but the button is still enabled; clicking will just error.

Apply this diff:

-                    disabled={
-                      isApprovingBountySubmission ||
-                      submission.status === "draft"
-                    }
+                    disabled={
+                      isApprovingBountySubmission ||
+                      submission.status === "draft" ||
+                      submission.status === "rejected"
+                    }

apps/web/app/(ee)/partners.dub.co/(dashboard)/programs/[programSlug]/(enrolled)/bounties/partner-bounty-card.tsx (1)

87-154: Avoid double click handlers / event bubbling

Top‑level card is clickable; inner “Claim bounty”/“Continue submission” also have onClick. This can double‑fire analytics and is unnecessary.

Apply either:

• Remove the inner onClick, relying on the card click; or
• Stop propagation inside the inner handler.

Example:

-        onClick={() => setShowClaimBountyModal(true)}
+        onClick={(e) => {
+          e.stopPropagation();
+          setShowClaimBountyModal(true);
+        }}

apps/web/ui/partners/bounties/claim-bounty-modal.tsx (5)

66-67: Tri‑state isDraft is adequate, but consider deriving intent earlier

Holding null | boolean is fine. See below for setting it via button onClick to simplify submit logic and loading/disabled states.

---

71-79: Preserve file metadata (name/size) when editing an existing draft

When mapping existing files you drop fileName and size, then send "File" and 0 on submit, overwriting real metadata. Carry metadata through state and reuse it when re‑submitting.

Apply this diff:

 interface FileInput {
   id: string;
   file?: File;
   url?: string;
   uploading: boolean;
+  fileName?: string;
+  size?: number;
 }

-  if (submission?.files && submission.files.length > 0) {
-    return submission.files.map((file) => ({
+  if (submission?.files && submission.files.length > 0) {
+    return submission.files.map((file) => ({
       id: uuid(),
-      url: file.url,
+      url: file.url,
+      fileName: file.fileName,
+      size: file.size,
       uploading: false,
       file: undefined,
     }));
   }

-  const finalFiles = files
-    .filter(({ url }) => url)
-    .map(({ file, url }) => ({
-      url: url!,
-      fileName: file?.name || "File",
-      size: file?.size || 0,
-    }));
+  const finalFiles = files
+    .filter(({ url }) => url)
+    .map(({ file, url, fileName, size }) => ({
+      url: url!,
+      fileName: file?.name ?? fileName ?? "File",
+      size: file?.size ?? size ?? 0,
+    }));

Also applies to: 159-165

---

151-159: Set draft/final intent via button onClick, not e.nativeEvent.submitter

Using SubmitEvent.submitter is brittle and complicates button states. Set the intent on click, consume it in onSubmit, and don’t disable the opposite button based on stale intent (which can trap users after a failed attempt).

Apply this diff:

-        // Determine which button was clicked
-        const submitter = (e.nativeEvent as SubmitEvent)
-          .submitter as HTMLButtonElement;
-
-        const isDraft = submitter?.name === "draft";
-
-        setIsDraft(isDraft);
+        const draft = isDraft === true; // set by button onClick below

-          if (!isDraft) {
+          if (!draft) {

-          const result = await createSubmission({
+          const result = await createSubmission({
             programId: programEnrollment.programId,
             bountyId: bounty.id,
             files: finalFiles,
             urls: finalUrls,
             description,
-            ...(isDraft && { isDraft }),
+            ...(draft && { isDraft: true }),
           });

-          if (!result?.data?.success) {
+          if (!result?.data?.success) {
             throw new Error(
-              isDraft
+              draft
                 ? "Failed to save progress."
                 : "Failed to create submission.",
             );
           }

-          toast.success(
-            isDraft ? "Bounty progress saved." : "Bounty submitted.",
-          );
+          toast.success(draft ? "Bounty progress saved." : "Bounty submitted.");

-                        <Button
+                        <Button
                           variant="secondary"
                           text="Save progress"
                           className="rounded-lg"
                           type="submit"
-                          name="draft"
+                          name="draft"
+                          onClick={() => setIsDraft(true)}
                           loading={isDraft === true}
-                          disabled={fileUploading || isDraft === false}
+                          disabled={fileUploading}
                         />

-                        <Button
+                        <Button
                           variant="primary"
                           text="Submit"
                           className="rounded-lg"
                           type="submit"
-                          name="submit"
+                          name="submit"
+                          onClick={() => setIsDraft(false)}
                           loading={isDraft === false}
-                          disabled={fileUploading || isDraft === true}
+                          disabled={fileUploading}
                         />

Also applies to: 565-581

---

167-168: Trim URLs before filtering empties

Avoid keeping whitespace‑only entries.

Apply this diff:

-        const finalUrls = urls.map(({ url }) => url).filter(Boolean);
+        const finalUrls = urls
+          .map(({ url }) => url.trim())
+          .filter((u) => u.length > 0);

---

552-594: Action bar gating and labels look right; small UX tweak

“Continue submission” vs “Claim bounty” is intuitive. After adopting the onClick intent approach above, removing isDraft‑based disabled states (as suggested) will also let users switch actions after failures without closing the modal.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Learnt from: TWilson023
PR: dubinc/dub#2736
File: apps/web/lib/actions/partners/create-bounty-submission.ts:105-112
Timestamp: 2025-08-26T14:32:33.851Z
Learning: Non-performance bounties are required to have submissionRequirements. In create-bounty-submission.ts, it's appropriate to let the parsing fail if submissionRequirements is null for non-performance bounties, as this indicates a data integrity issue that should be caught.

Learnt from: devkiran
PR: dubinc/dub#2833
File: apps/web/lib/actions/partners/approve-bounty-submission.ts:53-61
Timestamp: 2025-09-12T17:31:10.509Z
Learning: In approve-bounty-submission.ts, the logic `bounty.rewardAmount ?? rewardAmount` is intentional. Bounties with preset reward amounts should use those fixed amounts, and the rewardAmount override parameter is only used when bounty.rewardAmount is null/undefined (for custom reward bounties). This follows the design pattern where bounties are either "flat rate" (fixed amount) or "custom" (variable amount set during approval).

Learnt from: TWilson023
PR: dubinc/dub#2736
File: apps/web/app/api/workspaces/[idOrSlug]/notification-preferences/route.ts:13-14
Timestamp: 2025-08-26T14:20:23.943Z
Learning: The updateNotificationPreference action in apps/web/lib/actions/update-notification-preference.ts already handles all notification preference types dynamically, including newBountySubmitted, through its schema validation using the notificationTypes enum and Prisma's dynamic field update pattern.

apps/web/app/app.dub.co/(dashboard)/[slug]/(ee)/program/bounties/[bountyId]/bounty-submission-status-badges.ts (1)

4-9: Verify StatusBadge supports variant: "new"; use a known variant if not.

If @dub/ui’s StatusBadge variant union doesn’t include "new", this will type-check or render incorrectly. Consider "info"/"neutral" if available.

apps/web/app/app.dub.co/(dashboard)/[slug]/(ee)/program/bounties/[bountyId]/bounty-submission-details-sheet.tsx (3)

329-338: Disable Reject when already rejected to match tooltip.

Right now the tooltip says “already rejected” but the button isn’t disabled. Add the condition.

-                    disabled={
-                      isApprovingBountySubmission ||
-                      submission.status === "draft"
-                    }
+                    disabled={
+                      isApprovingBountySubmission ||
+                      submission.status === "draft" ||
+                      submission.status === "rejected"
+                    }

---

250-272: Add React keys to mapped URL list items.

Prevents list reconciliation warnings.

-                      {submission.urls?.map((url) => (
-                        <div className="relative">
+                      {submission.urls?.map((url, idx) => (
+                        <div key={idx} className="relative">

---

233-234: Improve image alt text for a11y.

Use filename or a meaningful label; current "object-cover" is unhelpful.

-                            <img src={file.url} alt="object-cover" />
+                            <img
+                              src={file.url}
+                              alt={file.fileName || `File ${idx + 1}`}
+                            />

apps/web/lib/actions/partners/create-bounty-submission.ts (2)

136-164: Use upsert on the composite unique to avoid duplicate-creation races.

Prevents TOCTOU between read-then-create under concurrent requests.

-    // If there is an existing submission, update it
-    if (submission) {
-      submission = await prisma.bountySubmission.update({
-        where: {
-          id: submission.id,
-        },
-        data: {
-          description,
-          ...(requireImage && { files }),
-          ...(requireUrl && { urls }),
-          status: isDraft ? "draft" : "pending",
-        },
-      });
-    }
-    // If there is no existing submission, create a new one
-    else {
-      submission = await prisma.bountySubmission.create({
-        data: {
-          id: createId({ prefix: "bnty_sub_" }),
-          programId: bounty.programId,
-          bountyId: bounty.id,
-          partnerId: partner.id,
-          description,
-          ...(requireImage && { files }),
-          ...(requireUrl && { urls }),
-          ...(isDraft && { status: "draft" }),
-        },
-      });
-    }
+    submission = await prisma.bountySubmission.upsert({
+      where: {
+        bountyId_partnerId: {
+          bountyId: bounty.id,
+          partnerId: partner.id,
+        },
+      },
+      update: {
+        description,
+        ...(requireImage && { files }),
+        ...(requireUrl && { urls }),
+        status: isDraft ? "draft" : "pending",
+      },
+      create: {
+        id: createId({ prefix: "bnty_sub_" }),
+        programId: bounty.programId,
+        bountyId: bounty.id,
+        partnerId: partner.id,
+        description,
+        ...(requireImage && { files }),
+        ...(requireUrl && { urls }),
+        ...(isDraft && { status: "draft" }),
+      },
+    });

---

227-229: Return the submission id for client flows.

Saves a round-trip when the UI needs to reference the submission.

-    return {
-      success: true,
-    };
+    return { success: true, submissionId: submission.id };

apps/web/ui/partners/bounties/claim-bounty-modal.tsx (8)

67-93: Draft prefill is one-shot; state won’t update if submission arrives/changes later.

When submission is fetched after mount (SWR) or updated, form state stays stale.

Apply a guarded sync on submission changes:

+import { Dispatch, SetStateAction, useEffect, useState } from "react";
@@
-// Initialize form state with existing draft submission data
+// Initialize form state with existing draft submission data
 const [description, setDescription] = useState(submission?.description || "");
@@
 const [files, setFiles] = useState<FileInput[]>(() => {
@@
 });
@@
 const [urls, setUrls] = useState<Url[]>(() => {
@@
 });
+
+// Sync when a draft submission becomes available/changes, without clobbering user edits
+useEffect(() => {
+  if (!submission || submission.status !== "draft") return;
+  setDescription((d) => (d ? d : submission.description || ""));
+  setFiles((prev) =>
+    prev.length || !submission.files?.length
+      ? prev
+      : submission.files.map((file) => ({
+          id: uuid(),
+          url: file.url,
+          uploading: false,
+        })),
+  );
+  setUrls((prev) =>
+    (prev.length > 1 || (prev[0]?.url ?? "") !== "" || !submission.urls?.length)
+      ? prev
+      : submission.urls.map((u) => ({ id: uuid(), url: u })),
+  );
+}, [submission?.id]); // draft identity as dep

---

98-103: Enforce client-side file constraints before uploading.

The UI promises “JPG/PNG, max 5MB” but doesn’t enforce it.

Apply:

-const handleUpload = async (file: File) => {
+const handleUpload = async (file: File) => {
   if (!programEnrollment) return;
+  if (!file.type.startsWith("image/")) {
+    toast.error("Only image files are allowed.");
+    return;
+  }
+  if (file.size > 5 * 1024 * 1024) {
+    toast.error("Max file size is 5MB.");
+    return;
+  }

---

150-154: e.nativeEvent.submitter can be flaky; confirm cross‑browser or add a fallback.

Safari support has historically lagged. If undefined (e.g., Enter key submission), defaulting to “submit” is fine, but consider a stateful fallback set by buttons’ onClick.

---

155-164: Trim and de‑dupe URLs before sending.

Prevents empty/whitespace entries and duplicates.

-const finalUrls = urls.map(({ url }) => url).filter(Boolean);
+const finalUrls = Array.from(
+  new Set(
+    urls
+      .map(({ url }) => url.trim())
+      .filter((u) => u.length > 0),
+  ),
+);

---

180-184: Send normalized description and explicit draft flag.

Trimming avoids accidental whitespace-only descriptions; sending isDraft explicitly makes intent unambiguous.

-            files: finalFiles,
-            urls: finalUrls,
-            description,
-            ...(isDraft && { isDraft }),
+            files: finalFiles,
+            urls: finalUrls,
+            description: description.trim(),
+            isDraft,

---

186-193: Surface server error when available.

If the action returns an error message/code, expose it in the thrown Error to aid debugging.

- if (!result?.data?.success) {
-   throw new Error(
-     isDraft ? "Failed to save progress." : "Failed to create submission.",
-   );
- }
+ if (!result?.data?.success) {
+   const msg =
+     (result?.data as any)?.message ||
+     (result as any)?.serverError ||
+     (isDraft ? "Failed to save progress." : "Failed to create submission.");
+   throw new Error(msg);
+ }

---

271-308: Approved badge date can render blank if reviewedAt is null.

Fallback to createdAt to avoid empty content.

-  Confirmed{" "}
-  {submission.reviewedAt &&
-    formatDate(submission.reviewedAt, { month: "short" })}
+  Confirmed{" "}
+  {formatDate(
+    submission.reviewedAt ?? submission.createdAt,
+    { month: "short" },
+  )}

---

405-407: Image alt text is not descriptive.

Use the filename or a generic “Uploaded image preview” for a11y.

-<img src={file.url} alt="object-cover" />
+<img src={file.url} alt={file.file?.name || "Uploaded image preview"} />

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Learnt from: TWilson023
PR: dubinc/dub#2736
File: apps/web/lib/actions/partners/create-bounty-submission.ts:105-112
Timestamp: 2025-08-26T14:32:33.851Z
Learning: Non-performance bounties are required to have submissionRequirements. In create-bounty-submission.ts, it's appropriate to let the parsing fail if submissionRequirements is null for non-performance bounties, as this indicates a data integrity issue that should be caught.

Learnt from: devkiran
PR: dubinc/dub#2833
File: apps/web/lib/actions/partners/approve-bounty-submission.ts:53-61
Timestamp: 2025-09-12T17:31:10.509Z
Learning: In approve-bounty-submission.ts, the logic `bounty.rewardAmount ?? rewardAmount` is intentional. Bounties with preset reward amounts should use those fixed amounts, and the rewardAmount override parameter is only used when bounty.rewardAmount is null/undefined (for custom reward bounties). This follows the design pattern where bounties are either "flat rate" (fixed amount) or "custom" (variable amount set during approval).

Learnt from: TWilson023
PR: dubinc/dub#2736
File: apps/web/app/api/workspaces/[idOrSlug]/notification-preferences/route.ts:13-14
Timestamp: 2025-08-26T14:20:23.943Z
Learning: The updateNotificationPreference action in apps/web/lib/actions/update-notification-preference.ts already handles all notification preference types dynamically, including newBountySubmitted, through its schema validation using the notificationTypes enum and Prisma's dynamic field update pattern.

apps/web/ui/partners/bounties/claim-bounty-modal.tsx (2)

198-206: Showing “submitted” success screen after saving a draft is still misleading; keep the form open for drafts.

Calling setSuccess(true) for drafts hides the form. Prefer to only set success for final submissions and keep the draft form open for continued editing.

Apply this diff:

-          toast.success(
-            isDraft ? "Bounty progress saved." : "Bounty submitted.",
-          );
-
-          setSuccess(true);
+          toast.success(draftClicked ? "Bounty progress saved." : "Bounty submitted.");
+          if (!draftClicked) {
+            setSuccess(true);
+          } else {
+            setIsFormOpen(true);
+          }

---

557-563: “Cancel” currently submits the form; set type="button".

Inside a form, buttons default to submit. Add an explicit type to prevent accidental form submission.

Apply this diff:

 <Button
   variant="outline"
   text="Cancel"
   className="w-fit rounded-lg"
+  type="button"
   onClick={() => setIsFormOpen(false)}
 />

apps/web/ui/partners/partner-advanced-settings-modal.tsx (2)

85-89: Use semantic code markup for the field name in the label.

Since this is an internal field identifier, prefer a semantic element for accessibility/readability while keeping the current styling.

Apply this diff:

-                <span className="rounded-md bg-neutral-200 px-1 py-0.5">
-                  tenantId
-                </span>
+                <code className="rounded-md bg-neutral-200 px-1 py-0.5">
+                  tenantId
+                </code>

---

105-107: Also use semantic code markup in the helper text.

Mirror the label change so the field name is consistently represented as code.

Apply this diff:

-              <span className="rounded-md bg-orange-100 px-1 py-px">
-                tenantId
-              </span>{" "}
+              <code className="rounded-md bg-orange-100 px-1 py-px">
+                tenantId
+              </code>{" "}

apps/web/lib/actions/partners/approve-bounty-submission.ts (1)

45-50: Good: blocking approvals for drafts. Add a state precondition to prevent concurrent double-approvals/duplicate commissions.

The guard aligns with the new “draft” lifecycle. However, the approval path still has a TOCTOU race: two reviewers could pass status checks and both create commissions before the update, leading to duplicate payouts. Gate the state transition atomically by updating only when status is still "pending" and rolling back the commission if you lose the race.

Apply this diff to make the update idempotent without introducing new statuses:

-    const commission = await createPartnerCommission({
+    const commission = await createPartnerCommission({
       event: "custom",
       partnerId: bountySubmission.partnerId,
       programId: bountySubmission.programId,
       amount: finalRewardAmount,
       quantity: 1,
       user,
       description: `Commission for successfully completed "${bounty.name}" bounty.`,
     });
 
     if (!commission) {
       throw new Error("Failed to create commission for the bounty submission.");
     }
 
-    await prisma.bountySubmission.update({
-      where: {
-        id: submissionId,
-      },
-      data: {
-        status: "approved",
-        reviewedAt: new Date(),
-        userId: user.id,
-        rejectionNote: null,
-        rejectionReason: null,
-        commissionId: commission.id,
-      },
-    });
+    // Only approve if still pending; otherwise cancel the created commission to avoid dupes
+    const updated = await prisma.bountySubmission.updateMany({
+      where: { id: submissionId, status: "pending" },
+      data: {
+        status: "approved",
+        reviewedAt: new Date(),
+        userId: user.id,
+        rejectionNote: null,
+        rejectionReason: null,
+        commissionId: commission.id,
+      },
+    });
+    if (updated.count !== 1) {
+      await prisma.commission.update({
+        where: { id: commission.id },
+        data: { status: "canceled", payoutId: null },
+      });
+      throw new Error("Bounty submission was already processed.");
+    }

Also confirm this remains consistent with the preset vs. custom reward precedence (bounty.rewardAmount ?? rewardAmount), which looks correct per prior decision.

apps/web/lib/actions/partners/reject-bounty-submission.ts (1)

41-45: Good: blocking rejections for drafts. Consider adding a state precondition to avoid races with approval.

The guard is consistent with the approval flow. To prevent simultaneous approve/reject actions from different reviewers, add a conditional update that only transitions from allowed states.

If rejecting can apply to both "pending" and "approved" (with commission cancellation), update conditionally inside the existing transaction:

-      await tx.bountySubmission.update({
-        where: {
-          id: submissionId,
-        },
-        data: {
-          status: "rejected",
-          reviewedAt: new Date(),
-          userId: user.id,
-          rejectionReason,
-          rejectionNote,
-          commissionId: null,
-        },
-      });
+      const updated = await tx.bountySubmission.updateMany({
+        where: {
+          id: submissionId,
+          status: { in: ["pending", "approved"] },
+        },
+        data: {
+          status: "rejected",
+          reviewedAt: new Date(),
+          userId: user.id,
+          rejectionReason,
+          rejectionNote,
+          commissionId: null,
+        },
+      });
+      if (updated.count !== 1) {
+        throw new Error("Bounty submission was already processed.");
+      }

If business rules should prevent rejecting “approved,” restrict the allowed statuses to ["pending"] instead. Please confirm intended policy.

apps/web/ui/partners/bounties/claim-bounty-modal.tsx (3)

151-158: Avoid shadowing state, fix TS spread, and clarify draft intent in submit handler.

• Local const name isDraft shadows the state isDraft; rename to avoid confusion.
• ...(isDraft && { isDraft }) can trip TS (“Spread types may only be created from object types”). Prefer a ternary.
• Keep validation, payload, and toasts keyed off the local flag.

Apply this diff:

-        const submitter = (e.nativeEvent as SubmitEvent)
-          .submitter as HTMLButtonElement;
-
-        const isDraft = submitter?.name === "draft";
-        setIsDraft(isDraft);
+        const submitter = (e.nativeEvent as SubmitEvent | any)
+          ?.submitter as HTMLButtonElement | null;
+        const draftClicked = submitter?.name === "draft";
+        setIsDraft(draftClicked);
...
-          if (!isDraft) {
+          if (!draftClicked) {
             if (imageRequired && finalFiles.length === 0) {
               throw new Error("You must upload at least one image.");
             }
             if (urlRequired && finalUrls.length === 0) {
               throw new Error("You must provide at least one URL.");
             }
           }
...
-            description,
-            ...(isDraft && { isDraft }),
+            description,
+            ...(draftClicked ? { isDraft: true } : {}),
           });
...
-          if (!result?.data?.success) {
-            throw new Error(
-              isDraft
-                ? "Failed to save progress."
-                : "Failed to create submission.",
-            );
-          }
+          if (!result?.data?.success) {
+            throw new Error(
+              draftClicked ? "Failed to save progress." : "Failed to create submission.",
+            );
+          }
-          toast.success(
-            isDraft ? "Bounty progress saved." : "Bounty submitted.",
-          );
+          toast.success(draftClicked ? "Bounty progress saved." : "Bounty submitted.");

Also applies to: 170-180, 184-188, 190-201

---

169-214: Re-enable buttons after submit by resetting draft state.

isDraft state is used for loading/disabled on the two buttons. On error (or after success), it remains latched, leaving one button disabled. Reset it in a finally block.

Apply this diff:

-      onSubmit={async (e) => {
+      onSubmit={async (e) => {
         e.preventDefault();
         if (!programEnrollment) return;
         ...
-        } catch (error) {
+        } catch (error) {
           toast.error(
             error instanceof Error
               ? error.message
               : "Failed to create submission. Please try again.",
           );
-        }
+        } finally {
+          setIsDraft(null);
+        }
       }}

---

501-509: Non-submit buttons inside the form should also set type="button".

The remove-URL and “Add URL” buttons live inside the form; make their intent explicit to avoid accidental submits in some browsers/components.

Apply this diff:

 <Button
   variant="outline"
   icon={<Trash className="size-4" />}
   className="w-10 shrink-0 bg-red-50 p-0 text-red-700 hover:bg-red-100"
+  type="button"
   onClick={() =>
     setUrls((prev) => prev.filter((s) => s.id !== id))
   }
 />
...
 <Button
   variant="secondary"
   text="Add URL"
   className="h-8 rounded-lg"
+  type="button"
   onClick={() =>
     setUrls((prev) => [...prev, { id: uuid(), url: "" }])
   }
 />

Also applies to: 515-524

apps/web/app/app.dub.co/(dashboard)/[slug]/(ee)/program/bounties/[bountyId]/bounty-submission-status-badges.ts (1)

1-6: Sweep for residual 'pending' status usage

Ensure no UI or logic still references the removed "pending" value.

Run:

#!/bin/bash
# Scan for literal 'pending' usages in bounty contexts
rg -nP -C2 -S --glob '!**/dist/**' --glob '!**/.next/**' "(bounty|submission)[^\\n]{0,120}['\"]pending['\"]|['\"]pending['\"][^\\n]{0,120}(bounty|submission)" -g '**/*.{ts,tsx,js,jsx,prisma}'

apps/web/app/(ee)/partners.dub.co/(dashboard)/programs/[programSlug]/(enrolled)/bounties/partner-bounty-card.tsx (1)

100-106: Don’t nest interactive elements inside a button (a11y + bubbling)

Remove inner onClick handlers; rely on the outer <button> click.

-      <div
-        className="group-hover:ring-border-subtle flex h-7 w-fit items-center rounded-lg bg-black px-2.5 text-sm text-white transition-all group-hover:ring-2"
-        onClick={() => setShowClaimBountyModal(true)}
-      >
+      <div className="group-hover:ring-border-subtle flex h-7 w-fit items-center rounded-lg bg-black px-2.5 text-sm text-white transition-all group-hover:ring-2">
         Claim bounty
       </div>
@@
-        <div
-          className="group-hover:ring-border-subtle flex h-7 w-fit items-center rounded-lg bg-black px-2.5 text-sm text-white transition-all group-hover:ring-2"
-          onClick={() => setShowClaimBountyModal(true)}
-        >
+        <div className="group-hover:ring-border-subtle flex h-7 w-fit items-center rounded-lg bg-black px-2.5 text-sm text-white transition-all group-hover:ring-2">
           Continue submission
         </div>

Also applies to: 112-117

apps/web/ui/partners/bounties/claim-bounty-modal.tsx (1)

207-213: Don’t show “submitted” success UI after saving a draft

Only set success for final submissions; keep the form open for drafts.

-      toast.success(isDraft ? "Bounty progress saved." : "Bounty submitted.");
-
-      setSuccess(true);
+      toast.success(isDraft ? "Bounty progress saved." : "Bounty submitted.");
+      if (!isDraft) {
+        setSuccess(true);
+      } else {
+        setIsFormOpen(true);
+      }

apps/web/lib/actions/partners/create-bounty-submission.ts (4)

136-149: Avoid passing undefined to Prisma

Only include optional fields when defined.

-      submission = await prisma.bountySubmission.update({
+      submission = await prisma.bountySubmission.update({
         where: {
           id: submission.id,
         },
         data: {
-          description,
+          ...(description !== undefined && { description }),
           ...(requireImage && { files }),
           ...(requireUrl && { urls }),
           status: isDraft ? "draft" : "submitted",
         },
       });

---

76-87: Pick the draft explicitly; avoid nondeterminism

bounty.submissions[0] depends on DB return order. Find the draft and, if none, use the latest non-draft for the error.

-    let submission: BountySubmission | null = null;
+    let submission: BountySubmission | null = null;
@@
-    if (bounty.submissions.length > 0) {
-      submission = bounty.submissions[0];
-
-      if (submission.status !== "draft") {
-        throw new Error(
-          `You already have a ${submission.status} submission for this bounty.`,
-        );
-      }
-    }
+    if (bounty.submissions.length > 0) {
+      const existingDraft = bounty.submissions.find((s) => s.status === "draft");
+      if (!existingDraft) {
+        const latest = [...bounty.submissions].sort(
+          (a, b) => b.createdAt.getTime() - a.createdAt.getTime(),
+        )[0];
+        throw new Error(
+          `You already have a ${latest.status} submission for this bounty.`,
+        );
+      }
+      submission = existingDraft;
+    }

---

51-63: Order submissions on read to reduce surprises

Add orderBy: { createdAt: "desc" } to the relation include to make behavior deterministic.

       prisma.bounty.findUniqueOrThrow({
         where: {
           id: bountyId,
         },
         include: {
           groups: true,
           submissions: {
             where: {
               partnerId: partner.id,
             },
+            orderBy: { createdAt: "desc" },
           },
         },
       }),

---

151-164: Bug: final submissions created with draft status

On create, you don’t set status when isDraft is false; Prisma default is draft, so finals remain drafts and no emails are sent. Set status explicitly.

-      submission = await prisma.bountySubmission.create({
-        data: {
-          id: createId({ prefix: "bnty_sub_" }),
-          programId: bounty.programId,
-          bountyId: bounty.id,
-          partnerId: partner.id,
-          description,
-          ...(requireImage && { files }),
-          ...(requireUrl && { urls }),
-          ...(isDraft && { status: "draft" }),
-        },
-      });
+      submission = await prisma.bountySubmission.create({
+        data: {
+          id: createId({ prefix: "bnty_sub_" }),
+          programId: bounty.programId,
+          bountyId: bounty.id,
+          partnerId: partner.id,
+          ...(description !== undefined && { description }),
+          ...(requireImage && { files }),
+          ...(requireUrl && { urls }),
+          status: isDraft ? "draft" : "submitted",
+        },
+      });

apps/web/app/app.dub.co/(dashboard)/[slug]/(ee)/settings/billing/plan-usage.tsx (1)

203-225: Avoid double bottom rounding on stacked grids

The previous grid above (Lines 170-172) still has rounded-b-lg, and this new grid also uses rounded-b-lg, causing a visual double-rounded seam between sections. Make only the last grid have the bottom rounding.

packages/email/src/templates/bounty-new-submission.tsx (1)

56-71: Email preview: include bounty name for better inbox scanning

Consider including the bounty name in the Preview/Heading for higher relevance in inbox previews (e.g., “New bounty submission: {bounty.name}”).

-      <Preview>New bounty submission</Preview>
+      <Preview>New bounty submission: {bounty.name}</Preview>
@@
-              New bounty submission
+              New bounty submission: {bounty.name}

packages/prisma/schema/bounty.prisma (1)

65-65: Defaulting to draft is fine; consider query patterns

Since drafts are now common, consider adding a composite index to speed frequent lookups (e.g., @@index([bountyId, partnerId, status])) if you routinely fetch by these three.

apps/web/ui/partners/bounties/claim-bounty-modal.tsx (3)

179-220: Reset isDraft loading state after request

Ensure buttons aren’t stuck disabled after the action completes.

-    try {
+    try {
       // ...
-    } catch (error) {
+    } catch (error) {
       toast.error(
         error instanceof Error
           ? error.message
           : "Failed to create submission. Please try again.",
       );
-    }
+    } finally {
+      setIsDraft(null);
+    }

---

113-119: Drop Content-Length header on browser PUT

Browsers forbid setting Content-Length; also triggers extra preflight.

-      headers: {
-        "Content-Type": file.type,
-        "Content-Length": file.size.toString(),
-      },
+      headers: {
+        "Content-Type": file.type,
+      },

---

122-126: Handle non-JSON upload errors robustly

S3/GCS signed PUT errors are often XML/text; don’t assume JSON.

-    if (!uploadResponse.ok) {
-      const result = await uploadResponse.json();
-      toast.error(result.error.message || "Failed to upload screenshot.");
-      return;
-    }
+    if (!uploadResponse.ok) {
+      const errText = await uploadResponse.text().catch(() => "");
+      toast.error(errText || "Failed to upload screenshot.");
+      return;
+    }

apps/web/lib/actions/partners/create-bounty-submission.ts (1)

136-164: Guard against create-vs-create races

Two near-simultaneous “first submissions” can hit the unique (bountyId, partnerId) and throw. Wrap the find/update/create in a single prisma.$transaction and handle unique constraint gracefully (retry read or return existing).

// Pseudocode sketch (transactional)
await prisma.$transaction(async (tx) => {
  const existing = await tx.bountySubmission.findFirst({
    where: { bountyId, partnerId: partner.id },
    orderBy: { createdAt: "desc" },
  });
  if (existing) {
    if (existing.status !== "draft") {
      throw new Error(`You already have a ${existing.status} submission for this bounty.`);
    }
    await tx.bountySubmission.update({ /* ... */ });
  } else {
    await tx.bountySubmission.create({ /* ... */ });
  }
});

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Learnt from: devkiran
PR: dubinc/dub#2833
File: apps/web/lib/actions/partners/approve-bounty-submission.ts:53-61
Timestamp: 2025-09-12T17:31:10.509Z
Learning: In approve-bounty-submission.ts, the logic `bounty.rewardAmount ?? rewardAmount` is intentional. Bounties with preset reward amounts should use those fixed amounts, and the rewardAmount override parameter is only used when bounty.rewardAmount is null/undefined (for custom reward bounties). This follows the design pattern where bounties are either "flat rate" (fixed amount) or "custom" (variable amount set during approval).

Learnt from: TWilson023
PR: dubinc/dub#2736
File: apps/web/app/api/workspaces/[idOrSlug]/notification-preferences/route.ts:13-14
Timestamp: 2025-08-26T14:20:23.943Z
Learning: The updateNotificationPreference action in apps/web/lib/actions/update-notification-preference.ts already handles all notification preference types dynamically, including newBountySubmitted, through its schema validation using the notificationTypes enum and Prisma's dynamic field update pattern.

Learnt from: TWilson023
PR: dubinc/dub#2736
File: apps/web/lib/actions/partners/create-bounty-submission.ts:105-112
Timestamp: 2025-08-26T14:32:33.851Z
Learning: Non-performance bounties are required to have submissionRequirements. In create-bounty-submission.ts, it's appropriate to let the parsing fail if submissionRequirements is null for non-performance bounties, as this indicates a data integrity issue that should be caught.

apps/web/ui/layout/sidebar/app-sidebar-nav.tsx (1)

293-297: Badge behavior when count is 0 shows “New” — confirm intent.
Current logic shows “New” when there are 0 submitted items. If that’s for feature discovery, keep it. If not, prefer no badge when zero.

Apply this diff if you want to hide the badge at zero:

-            badge: submittedBountiesCount
+            badge: submittedBountiesCount
               ? submittedBountiesCount > 99
                 ? "99+"
-                : submittedBountiesCount
-              : "New",
+                : submittedBountiesCount
+              : undefined,

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Learnt from: devkiran
PR: dubinc/dub#2448
File: packages/email/src/templates/partner-program-summary.tsx:0-0
Timestamp: 2025-05-29T04:45:18.504Z
Learning: In the PartnerProgramSummary email template (packages/email/src/templates/partner-program-summary.tsx), the stat titles are hardcoded constants ("Clicks", "Leads", "Sales", "Earnings") that will always match the ICONS object keys after toLowerCase() conversion, so icon lookup failures are not possible.

Learnt from: devkiran
PR: dubinc/dub#2736
File: apps/web/app/app.dub.co/(dashboard)/[slug]/(ee)/program/bounties/[bountyId]/bounty-info.tsx:45-56
Timestamp: 2025-08-25T17:39:38.965Z
Learning: In the bounty system, each partner can only submit to the same bounty once. This means totalSubmissions (pending + approved + rejected) equals the number of unique partners who have submitted, making UI text like "X of Y partners completed" accurate when using totalSubmissions.

apps/web/lib/actions/partners/create-bounty-submission.ts (3)

55-63: Don’t assume submissions[0]; explicitly select the draft and order deterministically.

Current logic is nondeterministic and can block editing the real draft.

       prisma.bounty.findUniqueOrThrow({
@@
-        include: {
+        include: {
           groups: true,
           submissions: {
             where: {
               partnerId: partner.id,
             },
+            orderBy: { createdAt: "desc" },
           },
         },
@@
-    if (bounty.submissions.length > 0) {
-      submission = bounty.submissions[0];
-
-      if (submission.status !== "draft") {
-        throw new Error(
-          `You already have a ${submission.status} submission for this bounty.`,
-        );
-      }
-    }
+    const existingDraft = bounty.submissions.find((s) => s.status === "draft");
+    if (!existingDraft && bounty.submissions.length > 0) {
+      const latest = bounty.submissions[0];
+      throw new Error(
+        `You already have a ${latest.status} submission for this bounty.`,
+      );
+    }
+    submission = existingDraft ?? null;

Also applies to: 78-87

---

142-161: Always persist provided files/urls (don’t gate on requirement flags).

Users can attach optional proofs even when not required; current logic discards them.

-          ...(requireImage && { files }),
-          ...(requireUrl && { urls }),
+          files,
+          urls,

(Same change applies to the create path.)

---

136-164: Race condition can create duplicate submissions; upsert within a transaction and avoid data loss.

• Find‑then‑create is racy under double‑click/multi‑tab.
• Conditional spreads for files/urls drop user data when not required.
• Passing description when undefined can crash Prisma; include it conditionally.

-    // If there is an existing submission, update it
-    if (submission) {
-      submission = await prisma.bountySubmission.update({
-        where: {
-          id: submission.id,
-        },
-        data: {
-          description,
-          ...(requireImage && { files }),
-          ...(requireUrl && { urls }),
-          status: isDraft ? "draft" : "submitted",
-        },
-      });
-    }
-    // If there is no existing submission, create a new one
-    else {
-      submission = await prisma.bountySubmission.create({
-        data: {
-          id: createId({ prefix: "bnty_sub_" }),
-          programId: bounty.programId,
-          bountyId: bounty.id,
-          partnerId: partner.id,
-          description,
-          ...(requireImage && { files }),
-          ...(requireUrl && { urls }),
-          status: isDraft ? "draft" : "submitted",
-        },
-      });
-    }
+    // Upsert within a transaction for consistency and to prevent duplicates
+    submission = await prisma.$transaction(async (tx) => {
+      // Block duplicates if a non-draft already exists
+      const existingNonDraft = await tx.bountySubmission.findFirst({
+        where: { bountyId: bounty.id, partnerId: partner.id, NOT: { status: "draft" } },
+        orderBy: { createdAt: "desc" },
+      });
+      if (existingNonDraft) {
+        throw new Error(`You already have a ${existingNonDraft.status} submission for this bounty.`);
+      }
+
+      // Prefer updating the latest draft if present
+      const latestDraft = await tx.bountySubmission.findFirst({
+        where: { bountyId: bounty.id, partnerId: partner.id, status: "draft" },
+        orderBy: { createdAt: "desc" },
+      });
+
+      if (latestDraft) {
+        return tx.bountySubmission.update({
+          where: { id: latestDraft.id },
+          data: {
+            ...(description !== undefined && { description }),
+            files,
+            urls,
+            status: isDraft ? "draft" : "submitted",
+          },
+        });
+      }
+
+      return tx.bountySubmission.create({
+        data: {
+          id: createId({ prefix: "bnty_sub_" }),
+          programId: bounty.programId,
+          bountyId: bounty.id,
+          partnerId: partner.id,
+          ...(description !== undefined && { description }),
+          files,
+          urls,
+          status: isDraft ? "draft" : "submitted",
+        },
+      });
+    });

apps/web/ui/partners/bounties/claim-bounty-modal.tsx (5)

98-127: On upload failure, the “uploading” tile remains forever. Remove or reset it.

When uploadResponse.ok is false, the optimistic tile stays with uploading: true. Remove the failed entry so the user can retry.

     if (!uploadResponse.ok) {
       const result = await uploadResponse.json();
       toast.error(result.error.message || "Failed to upload screenshot.");
-      return;
+      setFiles((prev) => prev.filter((f) => f.file !== file));
+      return;
     }

---

45-55: Preserve filename and size for existing files to prevent metadata loss.

Drafts seeded from prior submissions drop fileName and size, later sending "File" and 0. Keep original metadata.

 interface FileInput {
   id: string;
   file?: File;
   url?: string;
+  fileName?: string;
+  size?: number;
   uploading: boolean;
 }

-    if (submission?.files && submission.files.length > 0) {
-      return submission.files.map((file) => ({
+    if (submission?.files && submission.files.length > 0) {
+      return submission.files.map((f) => ({
         id: uuid(),
-        url: file.url,
+        url: f.url,
+        fileName: f.fileName,
+        size: f.size,
         uploading: false,
         file: undefined,
       }));
     }

-    const finalFiles = files
+    const finalFiles = files
       .filter(({ url }) => url)
-      .map(({ file, url }) => ({
+      .map(({ file, url, fileName, size }) => ({
         url: url!,
-        fileName: file?.name || "File",
-        size: file?.size || 0,
+        fileName: file?.name ?? fileName ?? "File",
+        size: file?.size ?? size ?? 0,
       }));

Also applies to: 70-80, 169-176

---

309-321: Guard “View earnings” link when slug is unavailable.

Avoid /programs/undefined/... if programEnrollment hasn’t loaded.

-                        {submission.status === "approved" && (
+                        {submission.status === "approved" &&
+                          programEnrollment?.program.slug && (
                           <Link
                             href={`/programs/${programEnrollment?.program.slug}/earnings?type=custom`}

---

457-463: Improve image alt text for accessibility.

alt="object-cover" is a CSS artifact. Use a meaningful label.

-  <img src={file.url} alt="object-cover" />
+  <img src={file.url} alt={file.file?.name ?? "Uploaded proof image"} />

---

231-236: Harden submitter detection.

Some environments may not populate e.nativeEvent.submitter. Add a safe fallback.

-          const submitter = (e.nativeEvent as SubmitEvent)
-            .submitter as HTMLButtonElement;
+          const submitter = (e.nativeEvent as any)?.submitter as
+            | HTMLButtonElement
+            | undefined;
+          if (!submitter) {
+            // Default to confirmation for safety
+            setShowConfirmModal(true);
+            return;
+          }

apps/web/lib/actions/partners/create-bounty-submission.ts (2)

118-121: Let bad submissionRequirements fail fast (don’t default to []).

Defaulting to [] hides data integrity issues for non‑performance bounties.

-    const submissionRequirements = submissionRequirementsSchema.parse(
-      bounty.submissionRequirements || [],
-    );
+    const submissionRequirements = submissionRequirementsSchema.parse(
+      bounty.submissionRequirements,
+    );

---

166-205: Enforce uniqueness at the DB layer to eliminate remaining duplication risk.

Add a DB constraint (preferred: partial unique index on drafts) to guarantee one draft per (bountyId, partnerId) and/or a single submission per pair overall. Prisma doesn’t support partial uniques—add via a SQL migration.

Example (Postgres):

-- One draft per partner+bounty
CREATE UNIQUE INDEX CONCURRENTLY IF NOT EXISTS
  ub_draft_unique ON "BountySubmission" ("bountyId","partnerId")
  WHERE status = 'draft';

-- (Optional) If business rule is "only one submission ever" per partner+bounty:
-- CREATE UNIQUE INDEX CONCURRENTLY IF NOT EXISTS
--   ub_any_unique ON "BountySubmission" ("bountyId","partnerId");

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Learnt from: TWilson023
PR: dubinc/dub#2736
File: apps/web/app/api/workspaces/[idOrSlug]/notification-preferences/route.ts:13-14
Timestamp: 2025-08-26T14:20:23.943Z
Learning: The updateNotificationPreference action in apps/web/lib/actions/update-notification-preference.ts already handles all notification preference types dynamically, including newBountySubmitted, through its schema validation using the notificationTypes enum and Prisma's dynamic field update pattern.

Learnt from: TWilson023
PR: dubinc/dub#2736
File: apps/web/lib/actions/partners/create-bounty-submission.ts:105-112
Timestamp: 2025-08-26T14:32:33.851Z
Learning: Non-performance bounties are required to have submissionRequirements. In create-bounty-submission.ts, it's appropriate to let the parsing fail if submissionRequirements is null for non-performance bounties, as this indicates a data integrity issue that should be caught.

Learnt from: devkiran
PR: dubinc/dub#2833
File: apps/web/lib/actions/partners/approve-bounty-submission.ts:53-61
Timestamp: 2025-09-12T17:31:10.509Z
Learning: In approve-bounty-submission.ts, the logic `bounty.rewardAmount ?? rewardAmount` is intentional. Bounties with preset reward amounts should use those fixed amounts, and the rewardAmount override parameter is only used when bounty.rewardAmount is null/undefined (for custom reward bounties). This follows the design pattern where bounties are either "flat rate" (fixed amount) or "custom" (variable amount set during approval).