apps/web/lib/integrations/hubspot/track-lead.ts (1)

84-90: Avoid "undefined undefined" names and use dub_id as clickId when available.

Template-literal concatenation can emit "undefined undefined". Also, we’re losing attribution by hardcoding clickId: "" when the contact may have dub_id.

Apply:

-    return await trackLead({
-      clickId: "",
-      eventName: `Deal ${properties.dealstage}`,
-      customerExternalId: contactInfo.properties.email,
-      customerName: `${contactInfo.properties.firstname} ${contactInfo.properties.lastname}`,
-      customerEmail: contactInfo.properties.email,
-      mode: "async",
-      workspace,
-      rawBody: payload,
-    });
+    const c = contactInfo.properties;
+    const customerName =
+      [c.firstname, c.lastname].filter(Boolean).join(" ") || null;
+    return await trackLead({
+      clickId: c.dub_id ?? "",
+      eventName: `Deal ${properties.dealstage}`,
+      customerExternalId: c.email,
+      customerName,
+      customerEmail: c.email,
+      mode: "async",
+      workspace,
+      rawBody: payload,
+    });

apps/web/lib/integrations/hubspot/schema.ts (1)

14-20: Trim and validate the optional deal-stage ID to reduce user input errors.

Consider:

-export const hubSpotSettingsSchema = z.object({
-  closedWonDealStageId: z
-    .string()
-    .nullish()
-    .describe("The ID of the deal stage that represents a closed won deal."),
-});
+export const hubSpotSettingsSchema = z.object({
+  closedWonDealStageId: z
+    .string()
+    .trim()
+    .min(1)
+    .nullish()
+    .describe("The ID of the deal stage that represents a closed won deal."),
+});

apps/web/lib/types.ts (1)

382-382: Exposing settings?: Prisma.JsonValue — LGTM; consider narrowing at use sites.

Where you consume settings (e.g., HubSpot UI/action), prefer a narrow type (e.g., { closedWonDealStageId?: string | null }) to avoid any casts and catch typos at compile time.

apps/web/app/app.dub.co/(dashboard)/[slug]/settings/(basic-layout)/integrations/[integrationSlug]/page-client.tsx (2)

277-281: Brand capitalization nit: “HubSpot”.

-                      title="Hubspot integration is only available on Advanced plans and above. Upgrade to get started."
+                      title="HubSpot integration is only available on Advanced plans and above. Upgrade to get started."

---

50-50: Use barrel export from @dub/utils
HUBSPOT_INTEGRATION_ID is re-exported by packages/utils/src/index.ts (export * from './constants'), so replace the deep import:

Replace
import { HUBSPOT_INTEGRATION_ID } from "@dub/utils/src/constants/integrations";

with
import { HUBSPOT_INTEGRATION_ID } from "@dub/utils";

apps/web/app/(ee)/api/hubspot/webhook/route.ts (1)

20-50: Consider adding support for X-HubSpot-Signature-v3.

HubSpot’s newer v3 signature uses HMAC with additional components; accepting both headers improves robustness during/after HS migrations.

apps/web/lib/integrations/hubspot/update-hubspot-settings.ts (1)

10-15: Remove unused workspaceId input to avoid trusting client-provided tenant IDs.

You already have ctx.workspace; drop workspaceId from the schema and the z import.

-import { z } from "zod";
-import { hubSpotSettingsSchema } from "./schema";
+import { hubSpotSettingsSchema } from "./schema";
 
-const schema = hubSpotSettingsSchema
-  .pick({ closedWonDealStageId: true })
-  .extend({
-    workspaceId: z.string(),
-  });
+const schema = hubSpotSettingsSchema.pick({ closedWonDealStageId: true });

apps/web/app/app.dub.co/(dashboard)/[slug]/settings/(basic-layout)/integrations/[integrationSlug]/page.tsx (1)

60-62: Extract settings logic for consistency.

The pattern mirrors the existing credentials extraction. The logic is correct but could benefit from consolidation.

Consider extracting the installation data once to reduce duplication:

  const installed = integration.installations.length > 0;
+ const installation = installed ? integration.installations[0] : undefined;

  const credentials = installed
-    ? integration.installations[0]?.credentials
+    ? installation?.credentials
    : undefined;

  const settings = installed
-    ? integration.installations[0]?.settings
+    ? installation?.settings
    : undefined;

  // TODO:
  // Fix this, we only displaying the first webhook only
  const webhookId = installed
-    ? integration.installations[0]?.webhooks[0]?.id
+    ? installation?.webhooks[0]?.id
    : undefined;

apps/web/lib/integrations/hubspot/ui/settings.tsx (2)

17-19: Consider safer type casting and input validation.

The type casting (settings as any)?.closedWonDealStageId bypasses TypeScript's type safety. While functional, this could be improved with proper typing.

Consider one of these approaches for better type safety:

Option 1: Define a settings type interface:

interface HubSpotSettingsType {
  closedWonDealStageId?: string;
}

const [closedWonDealStageId, setClosedWonDealStageId] = useState(
  (settings as HubSpotSettingsType)?.closedWonDealStageId || DEFAULT_CLOSED_WON_DEAL_STAGE_ID,
);

Option 2: Use safe property access:

const [closedWonDealStageId, setClosedWonDealStageId] = useState(() => {
  if (settings && typeof settings === 'object' && 'closedWonDealStageId' in settings) {
    return (settings as { closedWonDealStageId?: string }).closedWonDealStageId || DEFAULT_CLOSED_WON_DEAL_STAGE_ID;
  }
  return DEFAULT_CLOSED_WON_DEAL_STAGE_ID;
});

---

64-72: Add input validation for HubSpot deal stage format.

Based on the HubSpot API documentation, deal stage IDs can be descriptive strings like "closedwon" for default pipelines or numeric strings for custom pipelines. Consider adding client-side validation to guide users.

Add basic input validation and helper text:

          <div className="relative mt-4 rounded-md shadow-sm">
            <input
              className="w-full rounded-md border-neutral-300 text-neutral-900 placeholder-neutral-400 focus:border-neutral-500 focus:outline-none focus:ring-neutral-500 sm:text-sm"
-              placeholder={`Enter deal stage ID (e.g., ${DEFAULT_CLOSED_WON_DEAL_STAGE_ID})`}
+              placeholder={`Enter deal stage ID (e.g., ${DEFAULT_CLOSED_WON_DEAL_STAGE_ID} or 139921)`}
              type="text"
              autoComplete="off"
              name="closedWonDealStageId"
              value={closedWonDealStageId}
              onChange={(e) => setClosedWonDealStageId(e.target.value)}
            />
          </div>
+          <p className="mt-2 text-xs text-neutral-500">
+            Use descriptive names like "closedwon" for default pipelines, or numeric IDs for custom pipelines. 
+            Find your deal stage ID in HubSpot's pipeline settings.
+          </p>

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Learnt from: CR
PR: dubinc/dub#0
File: packages/hubspot-app/CLAUDE.md:0-0
Timestamp: 2025-09-19T18:46:43.787Z
Learning: Applies to packages/hubspot-app/app/settings/**/*.{js,jsx,ts,tsx} : Only use components exported by hubspot/ui-extensions in settings components

Learnt from: CR
PR: dubinc/dub#0
File: packages/hubspot-app/CLAUDE.md:0-0
Timestamp: 2025-09-19T18:46:43.787Z
Learning: Applies to packages/hubspot-app/app/settings/**/*.{js,jsx,ts,tsx} : Do not use React components from hubspot/ui-extensions/crm in settings components

Learnt from: CR
PR: dubinc/dub#0
File: packages/hubspot-app/CLAUDE.md:0-0
Timestamp: 2025-09-19T18:46:43.787Z
Learning: Applies to packages/hubspot-app/app/settings/**/*.{js,jsx,ts,tsx} : Do not use window.fetch in settings components; use hubspot.fetch from hubspot/ui-extensions

Learnt from: CR
PR: dubinc/dub#0
File: packages/hubspot-app/CLAUDE.md:0-0
Timestamp: 2025-09-19T18:46:43.787Z
Learning: Applies to packages/hubspot-app/app/settings/**/*.{js,jsx,ts,tsx} : Settings components must not access the global window object

apps/web/lib/integrations/hubspot/get-contact.ts (2)

12-19: Harden the request URL: encode contactId, use URLSearchParams, and set Accept header

Prevents path issues with non-numeric IDs and improves readability. Also explicitly request JSON.

Apply this diff:

-    const response = await fetch(
-      `${HUBSPOT_API_HOST}/crm/v3/objects/contacts/${contactId}?properties=email,firstname,lastname,dub_id,dub_link,dub_partner_email`,
-      {
-        method: "GET",
-        headers: {
-          Authorization: `Bearer ${accessToken}`,
-        },
-      },
-    );
+    const params = new URLSearchParams({
+      properties: [
+        "email",
+        "firstname",
+        "lastname",
+        "dub_id",
+        "dub_link",
+        "dub_partner_email",
+      ].join(","),
+    });
+    const response = await fetch(
+      `${HUBSPOT_API_HOST}/crm/v3/objects/contacts/${encodeURIComponent(String(contactId))}?${params.toString()}`,
+      {
+        method: "GET",
+        headers: {
+          Authorization: `Bearer ${accessToken}`,
+          Accept: "application/json",
+        },
+      },
+    );

---

28-30: More robust error surface on non-OK responses

Fall back to the raw response payload if message is absent.

-    if (!response.ok) {
-      throw new Error(result.message);
-    }
+    if (!response.ok) {
+      throw new Error(result.message || JSON.stringify(result));
+    }

apps/web/lib/integrations/hubspot/track-lead.ts (1)

137-148: Don’t throw in background task if partner missing

Use findUnique and guard email to avoid unhandled rejections in waitUntil.

-  if (trackLeadResult.link?.partnerId) {
-    const partner = await prisma.partner.findUniqueOrThrow({
+  if (trackLeadResult.link?.partnerId) {
+    const partner = await prisma.partner.findUnique({
       where: {
         id: trackLeadResult.link.partnerId,
       },
       select: {
         email: true,
       },
     });
-
-    partnerEmail = partner.email ?? "";
+    if (partner?.email) {
+      partnerEmail = partner.email;
+    }
   }

apps/web/lib/integrations/hubspot/update-contact.ts (2)

15-17: Filter out empty-string values before PATCH to avoid wiping fields

Only send keys with non-empty values.

-  if (Object.keys(properties).length === 0) {
-    return null;
-  }
+  const filteredProperties = Object.fromEntries(
+    Object.entries(properties).filter(
+      ([, v]) => typeof v === "string" && v.length > 0,
+    ),
+  ) as { dub_link?: string; dub_partner_email?: string };
+  if (Object.keys(filteredProperties).length === 0) {
+    return null;
+  }
...
-        body: JSON.stringify({
-          properties,
-        }),
+        body: JSON.stringify({
+          properties: filteredProperties,
+        }),

Also applies to: 35-37

---

27-34: Harden request: encode contactId path segment and set Accept header

Prevents path issues and explicitly negotiates JSON.

-    const response = await fetch(
-      `${HUBSPOT_API_HOST}/crm/v3/objects/contacts/${contactId}`,
+    const response = await fetch(
+      `${HUBSPOT_API_HOST}/crm/v3/objects/contacts/${encodeURIComponent(String(contactId))}`,
       {
         method: "PATCH",
         headers: {
           Authorization: `Bearer ${accessToken}`,
           "Content-Type": "application/json",
+          Accept: "application/json",
         },

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

apps/web/lib/integrations/hubspot/get-contact.ts (1)

28-30: Harden error message fallback to avoid “undefined” errors.

HubSpot errors aren’t always in result.message. Prefer a richer fallback.

-    if (!response.ok) {
-      throw new Error(result.message);
-    }
+    if (!response.ok) {
+      const msg =
+        result?.message ??
+        result?.reason ??
+        result?.errors?.[0]?.message ??
+        response.statusText ??
+        "Failed to retrieve contact";
+      throw new Error(`HubSpot ${response.status}: ${msg}`);
+    }

apps/web/lib/integrations/hubspot/update-contact.ts (1)

43-45: Improve error detail on non‑2xx responses.

HubSpot error payloads vary; include robust fallbacks for clearer diagnostics.

-    if (!response.ok) {
-      throw new Error(result.message || "Failed to update contact");
-    }
+    if (!response.ok) {
+      const msg =
+        result?.message ??
+        result?.reason ??
+        result?.errors?.[0]?.message ??
+        response.statusText ??
+        "Failed to update contact";
+      throw new Error(`HubSpot ${response.status}: ${msg}`);
+    }

apps/web/lib/integrations/hubspot/track-lead.ts (3)

55-63: Ensure background task doesn’t raise unhandled rejection.

Attach a catch to the promise passed to waitUntil to avoid noisy unhandled rejections.

-    if (trackLeadResult) {
-      waitUntil(
-        _updateHubSpotContact({
-          contact: contactInfo,
-          trackLeadResult,
-          accessToken: authToken.access_token,
-        }),
-      );
-    }
+    if (trackLeadResult) {
+      waitUntil(
+        _updateHubSpotContact({
+          contact: contactInfo,
+          trackLeadResult,
+          accessToken: authToken.access_token,
+        }).catch((e) => {
+          console.error(
+            `[HubSpot] _updateHubSpotContact failed for contact ${contactInfo.id}:`,
+            e,
+          );
+        }),
+      );
+    }

---

99-105: Avoid “null null” customer names in 0‑3 flow.

Mirror the safer join used in the 0‑1 branch.

-      customerName: `${contactInfo.properties.firstname} ${contactInfo.properties.lastname}`,
+      customerName:
+        [contactInfo.properties.firstname, contactInfo.properties.lastname]
+          .filter(Boolean)
+          .join(" ") || null,

---

110-118: Also guard the second background task with a catch.

-    if (trackLeadResult) {
-      waitUntil(
-        _updateHubSpotContact({
-          contact: contactInfo,
-          trackLeadResult,
-          accessToken: authToken.access_token,
-        }),
-      );
-    }
+    if (trackLeadResult) {
+      waitUntil(
+        _updateHubSpotContact({
+          contact: contactInfo,
+          trackLeadResult,
+          accessToken: authToken.access_token,
+        }).catch((e) => {
+          console.error(
+            `[HubSpot] _updateHubSpotContact failed for contact ${contactInfo.id}:`,
+            e,
+          );
+        }),
+      );
+    }

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Learnt from: devkiran
PR: dubinc/dub#2839
File: apps/web/lib/integrations/hubspot/schema.ts:5-12
Timestamp: 2025-09-17T02:53:28.359Z
Learning: HubSpot's OAuth token response returns `scopes` as an array of strings, not as a space-delimited string. The schema `scopes: z.array(z.string())` in hubSpotAuthTokenSchema is correct for HubSpot's actual API response format.

apps/web/lib/integrations/hubspot/update-hubspot-settings.ts (2)

18-21: Validate input workspaceId against ctx.workspace.id.

You accept workspaceId in the schema but don’t verify it matches the authenticated workspace. Add a guard to prevent accidental/misleading cross‑tenant updates.

-    const { closedWonDealStageId } = parsedInput;
+    const { workspaceId, closedWonDealStageId } = parsedInput;
+    if (workspaceId !== workspace.id) {
+      throw new Error("Invalid workspaceId for this session.");
+    }

---

35-35: Avoid any for settings; use a safer shape.

Minor type hygiene to reduce foot‑guns when extending settings.

-    const current = (installedIntegration.settings as any) ?? {};
+    const current =
+      ((installedIntegration.settings ?? {}) as Record<string, unknown>);

apps/web/lib/integrations/hubspot/track-lead.ts (1)

44-66: Ensure robust background processing with error handling.

The deferred contact update using waitUntil is appropriate for non-blocking operations. However, consider adding error handling to prevent silent failures in the background task.

Apply this diff to add error handling:

   if (trackLeadResult) {
     waitUntil(
-      _updateHubSpotContact({
-        contact: contactInfo,
-        trackLeadResult,
-        accessToken: authToken.access_token,
-      }),
+      _updateHubSpotContact({
+        contact: contactInfo,
+        trackLeadResult,
+        accessToken: authToken.access_token,
+      }).catch((error) => {
+        console.error(
+          `[HubSpot] Failed to update contact ${contactInfo.id} in background:`,
+          error,
+        );
+      }),
     );
   }

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

apps/web/lib/integrations/hubspot/update-hubspot-settings.ts (1)

10-15: WorkspaceId input appears unused; remove to reduce confusion

ctx.workspace.id is used for scoping; workspaceId in the schema isn’t referenced.

Apply this diff:

-const schema = hubSpotSettingsSchema
-  .pick({ closedWonDealStageId: true })
-  .extend({
-    workspaceId: z.string(),
-  });
+const schema = hubSpotSettingsSchema.pick({ closedWonDealStageId: true });

apps/web/app/(ee)/api/hubspot/webhook/route.ts (1)

128-135: Parse settings defensively to avoid rejecting the whole event on malformed JSON.

Use safeParse and fallback; log parse errors without throwing.

Apply:

-      const settings = hubSpotSettingsSchema.parse(installation.settings ?? {});
+      const parsed = hubSpotSettingsSchema.safeParse(installation.settings ?? {});
+      const closedWonDealStageId =
+        parsed.success ? parsed.data.closedWonDealStageId ?? undefined : undefined;
+      if (!parsed.success) {
+        console.warn(
+          "[HubSpot] Invalid installation.settings shape for portalId",
+          portalId,
+          parsed.error?.message,
+        );
+      }
@@
-        closedWonDealStageId: settings?.closedWonDealStageId,
+        closedWonDealStageId,

apps/web/lib/integrations/hubspot/schema.ts (1)

14-21: Normalize closedWonDealStageId to avoid case/whitespace mismatches.

Helps prevent false negatives when comparing to hubspot dealstage.

Apply:

 export const hubSpotSettingsSchema = z.object({
-  closedWonDealStageId: z
-    .string()
-    .nullish()
-    .describe("The ID of the deal stage that represents a closed won deal."),
+  closedWonDealStageId: z
+    .string()
+    .transform((s) => s.trim().toLowerCase())
+    .nullish()
+    .describe("The ID of the deal stage that represents a closed won deal."),
 });

apps/web/lib/integrations/hubspot/update-contact.ts (2)

1-1: Mark server-only to prevent accidental client bundling of HubSpot access tokens.

Apply:

+import "server-only";
 import { HUBSPOT_API_HOST } from "./constants";

---

37-45: Harden error handling (non‑JSON responses) and include status in errors.

HubSpot may return text/HTML on errors; response.json() will throw.

Apply:

-    const result = await response.json();
+    const text = await response.text();
+    const result = (() => {
+      try {
+        return JSON.parse(text);
+      } catch {
+        return text;
+      }
+    })();
@@
-    if (!response.ok) {
-      throw new Error(result.message || "Failed to update contact");
-    }
+    if (!response.ok) {
+      const msg =
+        typeof result === "string" ? result : result?.message || "Failed to update contact";
+      throw new Error(`[HubSpot] ${response.status} ${response.statusText}: ${msg}`);
+    }

apps/web/lib/integrations/hubspot/ui/settings.tsx (4)

17-19: Prefer blank initial value; use placeholder for the default.

Pre-filling with the default risks saving it unintentionally.

Apply:

-  const [closedWonDealStageId, setClosedWonDealStageId] = useState(
-    (settings as any)?.closedWonDealStageId || DEFAULT_CLOSED_WON_DEAL_STAGE_ID,
-  );
+  const [closedWonDealStageId, setClosedWonDealStageId] = useState(
+    (settings as any)?.closedWonDealStageId ?? "",
+  );

---

33-41: Normalize input and surface missing workspace feedback.

Apply:

-    if (!workspaceId) {
-      return;
-    }
+    if (!workspaceId) {
+      toast.error("No workspace selected.");
+      return;
+    }
 
-    await executeAsync({
+    const normalized = closedWonDealStageId.trim();
+    await executeAsync({
       workspaceId,
-      closedWonDealStageId: closedWonDealStageId || null,
+      closedWonDealStageId: normalized || null,
     });

---

51-53: Add a label for accessibility.

Apply:

-          <p className="text-sm font-medium text-neutral-700">
-            Closed Won Deal Stage ID
-          </p>
+          <label
+            htmlFor="closedWonDealStageId"
+            className="text-sm font-medium text-neutral-700"
+          >
+            Closed Won Deal Stage ID
+          </label>

---

63-73: Wire input to the label via id.

Apply:

-            <input
+            <input
+              id="closedWonDealStageId"
               className="w-full rounded-md border-neutral-300 text-neutral-900 placeholder-neutral-400 focus:border-neutral-500 focus:outline-none focus:ring-neutral-500 sm:text-sm"
               placeholder={`Enter deal stage ID (e.g., ${DEFAULT_CLOSED_WON_DEAL_STAGE_ID})`}
               type="text"
               autoComplete="off"
               name="closedWonDealStageId"
               value={closedWonDealStageId}
               onChange={(e) => setClosedWonDealStageId(e.target.value)}
             />

apps/web/lib/integrations/hubspot/track-sale.ts (4)

20-22: Avoid parameter reassignment and normalize expected stage once.

Apply:

-  closedWonDealStageId =
-    closedWonDealStageId ?? DEFAULT_CLOSED_WON_DEAL_STAGE_ID;
+  const expectedClosedWonDealStageId = (
+    closedWonDealStageId ?? DEFAULT_CLOSED_WON_DEAL_STAGE_ID
+  ).trim().toLowerCase();

---

38-41: Compare normalized dealstage values.

Apply:

-  if (propertyValue !== closedWonDealStageId) {
-    console.error(
-      `[HubSpot] Unknown propertyValue ${propertyValue}. Expected ${closedWonDealStageId}.`,
-    );
+  const actualDealstage = String(propertyValue).trim().toLowerCase();
+  if (actualDealstage !== expectedClosedWonDealStageId) {
+    console.error(
+      `[HubSpot] Unknown propertyValue ${propertyValue}. Expected ${expectedClosedWonDealStageId}.`,
+    );

---

56-60: Validate numeric amount before proceeding.

Apply:

   if (!properties.amount) {
     console.error(`[HubSpot] Amount is not set for deal ${dealId}`);
     return;
   }
+  const cents = Math.round(parseFloat(properties.amount) * 100);
+  if (Number.isNaN(cents)) {
+    console.error(`[HubSpot] Invalid amount for deal ${dealId}: ${properties.amount}`);
+    return;
+  }

---

80-83: Pass integer cents to trackSale.

Apply:

-    amount: Number(properties.amount) * 100,
+    amount: cents,

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Learnt from: CR
PR: dubinc/dub#0
File: packages/hubspot-app/CLAUDE.md:0-0
Timestamp: 2025-09-19T18:46:43.787Z
Learning: Applies to packages/hubspot-app/app/settings/**/*.{js,jsx,ts,tsx} : Only use components exported by hubspot/ui-extensions in settings components

Learnt from: CR
PR: dubinc/dub#0
File: packages/hubspot-app/CLAUDE.md:0-0
Timestamp: 2025-09-19T18:46:43.787Z
Learning: Applies to packages/hubspot-app/app/settings/**/*.{js,jsx,ts,tsx} : Do not use React components from hubspot/ui-extensions/crm in settings components

Learnt from: CR
PR: dubinc/dub#0
File: packages/hubspot-app/CLAUDE.md:0-0
Timestamp: 2025-09-19T18:46:43.787Z
Learning: Applies to packages/hubspot-app/app/settings/**/*.{js,jsx,ts,tsx} : Do not use window.fetch in settings components; use hubspot.fetch from hubspot/ui-extensions

Learnt from: CR
PR: dubinc/dub#0
File: packages/hubspot-app/CLAUDE.md:0-0
Timestamp: 2025-09-19T18:46:43.787Z
Learning: Applies to packages/hubspot-app/app/settings/**/*.{js,jsx,ts,tsx} : Settings components must not access the global window object

Learnt from: devkiran
PR: dubinc/dub#2839
File: apps/web/lib/integrations/hubspot/schema.ts:5-12
Timestamp: 2025-09-17T02:53:28.359Z
Learning: HubSpot's OAuth token response returns `scopes` as an array of strings, not as a space-delimited string. The schema `scopes: z.array(z.string())` in hubSpotAuthTokenSchema is correct for HubSpot's actual API response format.