packages/email/src/templates/partner-invite.tsx (1)

66-70: Encode the next param (or build query with URLSearchParams) to avoid malformed links

next contains slashes; encode it or use URLSearchParams for safety.

Apply minimal fix:

-                href={`https://partners.dub.co/${program.slug}/register?email=${encodeURIComponent(email)}&next=/programs/${program.slug}`}
+                href={`https://partners.dub.co/${program.slug}/register?email=${encodeURIComponent(email)}&next=${encodeURIComponent(`/programs/${program.slug}`)}`}

Optionally:

-                href={`https://partners.dub.co/${program.slug}/register?email=${encodeURIComponent(email)}&next=/programs/${program.slug}`}
+                href={`https://partners.dub.co/${program.slug}/register?${new URLSearchParams({
+                  email,
+                  next: `/programs/${program.slug}`,
+                }).toString()}`}

Please confirm the partners app consumes next as a URL-encoded value.

apps/web/lib/stripe/coupon-discount-converter.ts (3)

2-2: Use a type-only import to avoid bundling Stripe runtime into this module

Stripe is only used for types here; make it a type import.

-import { Stripe } from "stripe";
+import type { Stripe } from "stripe";

---

76-81: Ensure unit symmetry when converting Stripe coupon back to Dub discount

Stripe amount_off is in cents. If your Dub flat amount is in dollars, convert back to dollars; otherwise keep as-is.

-  return {
-    amount,
-    type,
-    maxDuration,
-    description: stripeCoupon.name || null,
-  };
+  return {
+    amount:
+      type === "flat"
+        ? Math.round((amount || 0) as number) / 100 // convert cents → dollars
+        : (amount as number),
+    type,
+    maxDuration,
+    description: stripeCoupon.name || null,
+  };

Please confirm the expected unit for Discount.amount in your schema to finalize this.

---

92-105: Strengthen validation: percent range, positive amounts, repeating duration months

Add basic guards to catch invalid coupons early.

   // Check if coupon has either percent_off or amount_off
   if (!stripeCoupon.percent_off && !stripeCoupon.amount_off) {
     errors.push("Coupon must have either percent_off or amount_off");
   }
 
   // Check if coupon has both percent_off and amount_off (invalid)
   if (stripeCoupon.percent_off && stripeCoupon.amount_off) {
     errors.push("Coupon cannot have both percent_off and amount_off");
   }
 
+  // Validate ranges
+  if (stripeCoupon.percent_off !== null && stripeCoupon.percent_off !== undefined) {
+    if (!(stripeCoupon.percent_off > 0 && stripeCoupon.percent_off <= 100)) {
+      errors.push("percent_off must be > 0 and <= 100");
+    }
+  }
+  if (stripeCoupon.amount_off !== null && stripeCoupon.amount_off !== undefined) {
+    if (!(stripeCoupon.amount_off > 0)) {
+      errors.push("amount_off must be a positive integer (in cents)");
+    }
+  }
+
   // Check currency for amount_off coupons
   if (stripeCoupon.amount_off && stripeCoupon.currency !== "usd") {
     errors.push("Amount-based coupons must use USD currency");
   }
 
+  // If repeating, ensure duration_in_months is present and > 0
+  if (stripeCoupon.duration === "repeating") {
+    if (!stripeCoupon.duration_in_months || stripeCoupon.duration_in_months <= 0) {
+      errors.push("Repeating coupons must include duration_in_months > 0");
+    }
+  }

Also applies to: 108-115

apps/web/lib/actions/partners/create-discount.ts (2)

18-18: Use a type-only import for Stripe types

Avoid pulling Stripe into the bundle from this file when only using its types.

-import { Stripe } from "stripe";
+import type { Stripe } from "stripe";

---

85-92: Narrow error type in catch; avoid accessing possibly-undefined fields

Accessing error.code/message on unknown is unsafe. Extract safely first.

-    } catch (error) {
-      throw new Error(
-        error.code === "more_permissions_required_for_application"
-          ? "STRIPE_APP_UPGRADE_REQUIRED: Your connected Stripe account doesn't have the permissions needed to create discount codes. Please upgrade your Stripe integration in settings or reach out to our support team for help."
-          : error.code === "resource_missing"
-            ? `The coupon ID you provided (${couponId}) was not found in your Stripe account. Please check the coupon ID and try again.`
-            : error.message,
-      );
+    } catch (err) {
+      const e = err as { code?: string; message?: string };
+      const code = e?.code;
+      const message = e?.message ?? "An unexpected error occurred";
+      throw new Error(
+        code === "more_permissions_required_for_application"
+          ? "STRIPE_APP_UPGRADE_REQUIRED: Your connected Stripe account doesn't have the permissions needed to create discount codes. Please upgrade your Stripe integration in settings or reach out to our support team for help."
+          : code === "resource_missing"
+            ? `The coupon ID you provided (${couponId}) was not found in your Stripe account. Please check the coupon ID and try again.`
+            : message,
+      );
     }

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro