apps/web/package.json (1)

50-50: Add a guardrail for reproducible builds.

Consider pinning @upstash/workflow to an exact version or using a Renovate/Dependabot rule to auto‑PR updates. This reduces surprise upgrades in critical infra code.

apps/web/lib/cron/qstash-workflow-logger.ts (1)

12-36: Include error stacks and structured fields in logs.

Capture error.stack and add workflowId into the object payload for easier querying.

Apply this diff:

 export function createWorkflowLogger({
   workflowId,
   workflowRunId,
 }: {
   workflowId: string;
   workflowRunId: string;
 }) {
   return {
     info: ({ message, data }: LogData) => {
-      console.info(`[Upstash Workflow:${workflowId}] ${message}`, {
+      console.info(`[Upstash Workflow:${workflowId}] ${message}`, {
         workflowRunId,
+        workflowId,
         ...data,
       });
     },
 
     error: ({ message, error, data }: ErrorData) => {
-      console.error(`[Upstash Workflow:${workflowId}] ${message}`, {
+      console.error(`[Upstash Workflow:${workflowId}] ${message}`, {
         workflowRunId,
-        error: error?.message || error,
+        workflowId,
+        error: error?.message || error,
+        stack: error?.stack,
         ...data,
       });
     },
   };
 }

apps/web/lib/cron/qstash-workflow.ts (1)

31-33: Flow control key is too coarse; may throttle unrelated runs and allow same‑entity concurrency.

Key only uses workflowId. Use a composite key to serialize per partner/program and prevent duplicates racing.

Apply this diff:

-        flowControl: {
-          key: workflow.workflowId,
-          parallelism: WORKFLOW_PARALLELISM,
-        },
+        flowControl: {
+          key: [
+            workflow.workflowId,
+            (workflow.body as any)?.programId,
+            (workflow.body as any)?.partnerId,
+          ]
+            .filter(Boolean)
+            .join(":"),
+          parallelism: WORKFLOW_PARALLELISM,
+        },

apps/web/lib/partners/approve-partner-enrollment.ts (1)

91-99: Idempotency: safe, but consider per‑entity flowControl.

Trigger body is good; with the refactor to composite flowControl.key, concurrent approvals for the same partner will serialize.

apps/web/app/(ee)/api/workflows/partner-approved/route.ts (4)

92-99: Minor: avoid O(n*m) filtering when skipping existing default links.

Use a Set of existing partnerGroupDefaultLinkIds for O(n) filtering.

Apply this diff:

-      // Skip existing default links
-      for (const link of links) {
-        if (link.partnerGroupDefaultLinkId) {
-          partnerGroupDefaultLinks = partnerGroupDefaultLinks.filter(
-            (defaultLink) => defaultLink.id !== link.partnerGroupDefaultLinkId,
-          );
-        }
-      }
+      // Skip existing default links
+      const existing = new Set(
+        links
+          .map((l) => l.partnerGroupDefaultLinkId)
+          .filter(Boolean) as string[],
+      );
+      partnerGroupDefaultLinks = partnerGroupDefaultLinks.filter(
+        (d) => !existing.has(d.id),
+      );

---

203-206: Log only non‑PII identifiers.

Current log prints recipient emails. Prefer ids/counts to avoid PII in logs.

Apply this diff:

-      logger.info({
-        message: `Sending email notification to ${partnerUsers.length} partner users.`,
-        data: partnerUsers,
-      });
+      logger.info({
+        message: `Sending email notification to ${partnerUsers.length} partner users.`,
+        data: { userIds: partnerUsers.map(({ user }) => user.id) },
+      });

---

208-238: Idempotency per recipient and better error logging for resend batch.

Use a per‑recipient key to avoid dedup across different users, and include provider error in logs before throwing.

Apply this diff:

-      const { data, error } = await resend.batch.send(
-        partnerUsers.map(({ user }) => ({
+      const { data, error } = await resend.batch.send(
+        partnerUsers.map(({ user }) => ({
           subject: `Your application to join ${program.name} partner program has been approved!`,
           from: VARIANT_TO_FROM_MAP.notifications,
           to: user.email!,
           react: PartnerApplicationApproved({
@@
           }),
           headers: {
-            "Idempotency-Key": `application-approved-${programEnrollment.id}`,
+            "Idempotency-Key": `application-approved-${programEnrollment.id}-${user.id}`,
           },
-        })),
+        })),
       );
 
       if (data) {
         logger.info({
           message: `Sent emails to ${partnerUsers.length} partner users.`,
           data: data,
         });
       }
 
       if (error) {
-        throw new Error(`Failed to send email notification to partner users.`);
+        logger.error({
+          message: "Failed to send email notification to partner users.",
+          error,
+          data: { programEnrollmentId: programEnrollment.id },
+        });
+        throw new Error("Resend batch.send error");
       }

---

289-292: Harden payload parsing.

Guard against empty/non‑JSON payloads to return a 400 instead of throwing.

Apply this diff:

   {
-    initialPayloadParser: (requestPayload) => {
-      return payloadSchema.parse(JSON.parse(requestPayload));
-    },
+    initialPayloadParser: (requestPayload) => {
+      if (!requestPayload) {
+        throw new Error("Missing request payload");
+      }
+      return payloadSchema.parse(JSON.parse(requestPayload));
+    },
   },

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Learnt from: TWilson023
PR: dubinc/dub#2857
File: apps/web/lib/actions/partners/update-program.ts:96-0
Timestamp: 2025-09-17T17:44:03.921Z
Learning: In apps/web/lib/actions/partners/update-program.ts, the team prefers to keep the messagingEnabledAt update logic simple by allowing client-provided timestamps rather than implementing server-controlled timestamp logic to avoid added complexity.

Learnt from: TWilson023
PR: dubinc/dub#2736
File: apps/web/lib/api/bounties/get-bounty-or-throw.ts:53-63
Timestamp: 2025-08-26T15:38:48.173Z
Learning: In bounty-related code, getBountyOrThrow returns group objects with { id } field (transformed from BountyGroup.groupId), while other routes working directly with BountyGroup Prisma records use the actual groupId field. This is intentional - getBountyOrThrow abstracts the join table details.