apps/web/lib/api/workflows/execute-award-bounty-workflow.ts (2)

147-153: Evaluate condition against the locked, up-to-date count

If you apply the lock-and-refetch, ensure you evaluate with the latest performanceCount:

-const shouldExecute = evaluateWorkflowCondition({
-  condition,
-  attributes: {
-    [condition.attribute]: bountySubmission.performanceCount,
-  },
-});
+const shouldExecute = evaluateWorkflowCondition({
+  condition,
+  attributes: {
+    [condition.attribute]: lockedSubmission.performanceCount,
+  },
+});

---

107-107: Use Serializable isolation to strengthen correctness under concurrency

Add isolationLevel: Serializable to the interactive transaction to reduce write skew and phantom reads:

// Add at top of file:
import { Prisma } from "@dub/prisma/client";

// Change the transaction invocation:
const updatedSubmission = await prisma.$transaction(
  async (tx) => {
    // ...
  },
  { isolationLevel: Prisma.TransactionIsolationLevel.Serializable },
);

This complements the row-level lock and atomic increment.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

apps/web/lib/api/workflows/execute-award-bounty-workflow.ts (1)

167-175: Commission creation is outside the DB transaction; risk of orphan/duplicate commissions on rollback/failure

If createPartnerCommission succeeds but the subsequent bountySubmission.update fails/rolls back, you’ll orphan a commission. Under retries, you can create duplicates. Make the helper transaction‑aware and pass db: tx so “create commission + link + approve” is atomic.

Apply in this file:

-    const { commission } = await createPartnerCommission({
+    const { commission } = await createPartnerCommission({
       event: "custom",
       partnerId,
       programId: bounty.programId,
       amount: bounty.rewardAmount ?? 0,
       quantity: 1,
       description: `Commission for successfully completed "${bounty.name}" bounty.`,
       skipWorkflow: true,
+      db: tx,
     });

And update the helper (apps/web/lib/partners/create-partner-commission.ts):

// imports
import { prisma } from "@dub/prisma";
import type { Prisma, PrismaClient } from "@dub/prisma";

// signature
export const createPartnerCommission = async (
  props: CreatePartnerCommissionProps & { db?: Prisma.TransactionClient | PrismaClient },
) => {
  const db = props.db ?? prisma;

  // use `db` for all DB writes
  // e.g.,
  // const commission = await db.commission.create({ data: { ... }, include: { customer: true } });

  // keep side effects (webhooks/notifications) out of the tx if possible,
  // or gate them to run after commit from the caller.
};

Optional hardening: add an idempotency guard (e.g., unique key on commission metadata by bountySubmissionId) to prevent duplicate commissions even if retried post‑failure.

apps/web/lib/api/workflows/execute-award-bounty-workflow.ts (1)

107-116: Remove redundant pre-read; rely on the upsert result under lock

findUnique here doesn’t lock and is immediately followed by an upsert that does lock/update. Drop the pre-read and re-check status/commissionId using the bountySubmission returned by upsert.

-    const existingSubmission = await tx.bountySubmission.findUnique({
-      where: {
-        bountyId_partnerId: {
-          bountyId,
-          partnerId,
-        },
-      },
-    });
-
-    if (existingSubmission?.status === "approved") {
-      console.log(
-        `Partner ${partnerId} has already been awarded this bounty (bountyId: ${bounty.id}, submissionId: ${existingSubmission.id}).`,
-      );
-      return;
-    }

Then right after the upsert:

     const bountySubmission = await tx.bountySubmission.upsert({ /* ... */ });

+    if (bountySubmission.status === "approved" || bountySubmission.commissionId) {
+      console.log(
+        `Bounty submission ${bountySubmission.id} already approved or has commission ${bountySubmission.commissionId}.`,
+      );
+      return;
+    }

Also applies to: 117-123

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro