Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Learnt from: devkiran
PR: dubinc/dub#2635
File: packages/prisma/schema/payout.prisma:24-25
Timestamp: 2025-07-11T16:28:55.693Z
Learning: In the Dub codebase, multiple payout records can now share the same stripeTransferId because payouts are grouped by partner and processed as single Stripe transfers. This is why the unique constraint was removed from the stripeTransferId field in the Payout model - a single transfer can include multiple payouts for the same partner.

apps/web/app/(ee)/api/stripe/connect/webhook/account-updated.ts (1)

42-48: Handle pagination when locating the default external account

As noted in the previous review, listExternalAccounts only returns the first page (default 10 entries). If a partner has >10 external accounts, the default one may be on a later page and will be missed, causing the function to log an error and skip updating payoutMethodHash. Please implement pagination (loop while has_more, passing starting_after) or directly fetch account.default_external_account by ID.

Based on learnings

apps/web/scripts/migrations/backfill-payout-method-hash.ts (1)

21-21: Consider making the batch size configurable or implementing automatic batching.

The hardcoded take: 500 limit requires manual re-runs for repositories with more partners. For a one-time migration this may be acceptable, but consider either:

1. Adding a command-line argument for batch size
2. Implementing a loop to process all partners automatically

Example loop implementation:

 async function main() {
   const partnerIdsToSkip: string[] = [];
+  let processed = 0;
+  let hasMore = true;

+  while (hasMore) {
     const partners = await prisma.partner.findMany({
       where: {
         stripeConnectId: {
           not: null,
         },
         payoutsEnabledAt: {
           not: null,
         },
         payoutMethodHash: null,
       },
       orderBy: {
         payoutsEnabledAt: "asc",
       },
       take: 500,
     });

+    hasMore = partners.length === 500;
+    console.log(`Processing batch of ${partners.length} partners (total processed: ${processed})`);

     for (const partner of partners) {
       // ... existing processing logic ...
     }
+    processed += partners.length;
+  }

   console.log(`Partner IDs to skip: "${partnerIdsToSkip.join('", "')}"`);
+  console.log(`Total partners processed: ${processed}`);
 }

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Learnt from: steven-tey
PR: dubinc/dub#2758
File: apps/web/app/(ee)/api/cron/payouts/balance-available/route.ts:43-45
Timestamp: 2025-08-25T21:41:06.073Z
Learning: For Stripe API calls on connected accounts, the stripeAccount parameter should be passed in the first parameter object (e.g., stripe.balance.retrieve({ stripeAccount })), not as request options in the second parameter.

packages/prisma/schema/partner.prisma (1)

38-38: Migration still required for payoutMethodHash field.

As noted in a previous review, this schema change requires a Prisma migration to be generated and committed. The optional unique constraint on payoutMethodHash enables duplicate payout method detection, but without the migration, this field cannot be used in production.

Please refer to the earlier review comment that provided detailed instructions for generating the migration using npx prisma migrate dev --name add-payoutMethodHash.

apps/web/app/(ee)/api/stripe/connect/webhook/balance-available.ts (1)

12-14: Clarify the missing-account message.

-  if (!stripeAccount) {
-    return `Stripe connect account ${stripeAccount} not found. Skipping...`;
-  }
+  if (!stripeAccount) {
+    return "Stripe connect account ID missing from event. Skipping...";
+  }

apps/web/app/(ee)/api/stripe/connect/webhook/payout-paid.ts (1)

9-11: Clarify the missing-account message.

-  if (!stripeAccount) {
-    return `Stripe connect account ${stripeAccount} not found. Skipping...`;
-  }
+  if (!stripeAccount) {
+    return "Stripe connect account ID missing from event. Skipping...";
+  }

apps/web/scripts/migrations/backfill-payout-method-hash.ts (1)

25-28: Handle pagination when listing external accounts.

-    const { data: externalAccounts } =
-      await stripeConnectClient.accounts.listExternalAccounts(
-        partner.stripeConnectId!,
-      );
+    let externalAccounts: any[] = [];
+    let hasMore = true;
+    let startingAfter: string | undefined = undefined;
+    while (hasMore) {
+      const res =
+        await stripeConnectClient.accounts.listExternalAccounts(
+          partner.stripeConnectId!,
+          { limit: 100, starting_after: startingAfter },
+        );
+      externalAccounts.push(...res.data);
+      hasMore = res.has_more;
+      startingAfter = hasMore
+        ? res.data[res.data.length - 1]?.id
+        : undefined;
+    }

apps/web/app/(ee)/api/stripe/connect/webhook/account-updated.ts (3)

42-49: Paginate external accounts to reliably find the default.

-  const { data: externalAccounts } = await stripe.accounts.listExternalAccounts(
-    partner.stripeConnectId!,
-  );
+  let externalAccounts: any[] = [];
+  let hasMore = true;
+  let startingAfter: string | undefined = undefined;
+  while (hasMore) {
+    const res = await stripe.accounts.listExternalAccounts(
+      partner.stripeConnectId!,
+      { limit: 100, starting_after: startingAfter },
+    );
+    externalAccounts.push(...res.data);
+    hasMore = res.has_more;
+    startingAfter = hasMore
+      ? res.data[res.data.length - 1]?.id
+      : undefined;
+  }

---

74-77: Remove the bank_account-only restriction for duplicate detection.

-    if (
-      error.code === "P2002" &&
-      defaultExternalAccount.object === "bank_account"
-    ) {
+    if (error.code === "P2002") {

---

92-92: Use structured logging instead of console.log.

-      console.log(res);
+      await log({
+        message: `Sent duplicate payout method email to ${partner.email}: ${JSON.stringify(
+          res,
+        )}`,
+        type: "info",
+      });

apps/web/app/(ee)/api/stripe/connect/webhook/payout-paid.ts (1)

54-56: Replace console.log with structured logging for consistency.

-    console.log(
-      `Sent email to partner ${partner.email} (${stripeAccount}): ${JSON.stringify(sentEmail, null, 2)}`,
-    );
+    await log({
+      message: `Sent payout-paid email to partner ${partner.email} (${stripeAccount}): ${JSON.stringify(
+        sentEmail,
+      )}`,
+      type: "info",
+    });

Add the missing import at the top of the file:

import { log } from "@dub/utils";

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Learnt from: devkiran
PR: dubinc/dub#2635
File: packages/prisma/schema/payout.prisma:24-25
Timestamp: 2025-07-11T16:28:55.693Z
Learning: In the Dub codebase, multiple payout records can now share the same stripeTransferId because payouts are grouped by partner and processed as single Stripe transfers. This is why the unique constraint was removed from the stripeTransferId field in the Payout model - a single transfer can include multiple payouts for the same partner.

Learnt from: steven-tey
PR: dubinc/dub#2758
File: apps/web/app/(ee)/api/cron/payouts/balance-available/route.ts:43-45
Timestamp: 2025-08-25T21:41:06.073Z
Learning: For Stripe API calls on connected accounts, the stripeAccount parameter should be passed in the first parameter object (e.g., stripe.balance.retrieve({ stripeAccount })), not as request options in the second parameter.

apps/web/app/(ee)/api/stripe/connect/webhook/account-updated.ts (4)

87-111: Extend notifications beyond bank accounts or explicitly decide to scope; replace console.log with structured logging.

• Optional: Also notify on duplicate/connected card payout methods (or document bank-only scope).
• Use the shared log utility instead of console.log.

-  if (defaultExternalAccount.object === "bank_account") {
+  if (
+    defaultExternalAccount.object === "bank_account" ||
+    defaultExternalAccount.object === "card"
+  ) {
     const EmailTemplate = duplicatePayoutMethod
       ? DuplicatePayoutMethod
       : ConnectedPayoutMethod;
 
     const res = await sendEmail({
       variant: "notifications",
       subject: duplicatePayoutMethod
         ? "Duplicate payout method detected"
         : "Successfully connected payout method",
       to: partner.email!,
       react: EmailTemplate({
         email: partner.email!,
         payoutMethod: {
           account_holder_name: defaultExternalAccount.account_holder_name,
           bank_name: defaultExternalAccount.bank_name,
           last4: defaultExternalAccount.last4,
           routing_number: defaultExternalAccount.routing_number,
         },
       }),
     });
-    console.log(res);
+    await log({
+      message: `Sent ${duplicatePayoutMethod ? "duplicate" : "connected"} payout method email to ${partner.email}`,
+      type: "info",
+    });
 
     return `Notified partner ${partner.email} (${partner.stripeConnectId}) about ${duplicatePayoutMethod ? "duplicate" : "connected"} payout method`;
   }

Note: If you include cards, ensure the email copy is generic (“payout method”) and optional fields are safely undefined (templates already guard conditionally).

---

43-49: Default external account lookup can miss the default; handle pagination or fetch by ID.

Single-page list risks missing the default method. Iterate pages or fetch the default by ID.

-  const { data: externalAccounts } = await stripe.accounts.listExternalAccounts(
-    partner.stripeConnectId!,
-  );
-
-  const defaultExternalAccount = externalAccounts.find(
-    (account) => account.default_for_currency,
-  );
+  let defaultExternalAccount: Stripe.ExternalAccount | undefined;
+  let starting_after: string | undefined;
+  while (!defaultExternalAccount) {
+    const page = await stripe.accounts.listExternalAccounts(
+      partner.stripeConnectId!,
+      { limit: 100, ...(starting_after ? { starting_after } : {}) },
+    );
+    defaultExternalAccount = page.data.find(
+      // default_for_currency is present on bank accounts; treat loosely for union type
+      (ea: any) => ea?.default_for_currency,
+    );
+    if (defaultExternalAccount || !page.has_more) break;
+    starting_after = page.data[page.data.length - 1]?.id;
+  }

---

60-75: Guard when fingerprint is missing, and avoid leaking it in the return string.

• Add a guard before updating to avoid writing undefined/empty hashes.
• Do not include the fingerprint in responses/logs.

-  let duplicatePayoutMethod = false;
+  let duplicatePayoutMethod = false;
+  if (!("fingerprint" in defaultExternalAccount) || !defaultExternalAccount.fingerprint) {
+    await log({
+      message: `External account ${defaultExternalAccount.id} for ${partner.email} (${partner.stripeConnectId}) has no fingerprint`,
+      type: "errors",
+    });
+    return `External account ${defaultExternalAccount.id} has no fingerprint`;
+  }
   try {
     await prisma.partner.update({
       where: {
         stripeConnectId: account.id,
       },
       data: {
         country,
         payoutsEnabledAt: partner.payoutsEnabledAt
           ? undefined // Don't update if already set
           : new Date(),
         payoutMethodHash: defaultExternalAccount.fingerprint,
       },
     });
-    return `Updated partner ${partner.email} (${partner.stripeConnectId}) with country ${country}, payoutsEnabledAt set, payoutMethodHash ${defaultExternalAccount.fingerprint}`;
+    return `Updated partner ${partner.email} (${partner.stripeConnectId}) with country ${country} and payoutsEnabledAt set`;

---

75-85: Type-safe error handling and safer logging for unknown errors.

Narrow the error and avoid accessing .code on unknown, and stringify safely.

-  } catch (error) {
-    if (error.code === "P2002") {
+  } catch (error: any) {
+    if (error?.code === "P2002") {
       duplicatePayoutMethod = true;
     } else {
+      const msg = error instanceof Error ? error.message : String(error);
       await log({
-        message: `Error updating partner ${partner.email} (${partner.stripeConnectId}): ${error}`,
+        message: `Error updating partner ${partner.email} (${partner.stripeConnectId}): ${msg}`,
         type: "errors",
       });
-      return `Error updating partner ${partner.email} (${partner.stripeConnectId}): ${error}`;
+      return `Error updating partner ${partner.email} (${partner.stripeConnectId}): ${msg}`;
     }
   }

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

packages/email/src/templates/duplicate-payout-method.tsx (1)

95-104: Mask the routing number to last 4 digits.

As noted in a previous review, displaying the full routing number in emails is unnecessary and increases privacy risk. Only the last 4 digits should be shown, consistent with the account number masking on line 91.

apps/web/lib/actions/partners/generate-stripe-account-link.ts (1)

64-65: Ensure /payouts handles Stripe onboarding responses.

As noted in a previous review, the /payouts page must handle Stripe onboarding return parameters (e.g., query params for success/failure states). Verify that the page extracts these parameters and displays appropriate UI for completed or incomplete onboarding.

packages/prisma/schema/partner.prisma (1)

38-38: Verify database migration exists for payoutMethodHash.

As noted in a previous review, ensure a Prisma migration has been generated and committed for this new optional unique field. The migration should create the nullable unique column in the partners table.

apps/web/scripts/migrations/backfill-payout-method-hash.ts (2)

25-28: Handle pagination when fetching external accounts.

As noted in a previous review, listExternalAccounts only returns the first page (default limit of 10). For partners with more than 10 external accounts, the default account may be missed. Consider implementing pagination or documenting this limitation.

---

67-86: Type-safe error handling needed.

As noted in a previous review, directly accessing error.code is unsafe in TypeScript. The error should be narrowed to PrismaClientKnownRequestError before accessing the .code property.

apps/web/app/(ee)/api/stripe/connect/webhook/account-updated.ts (4)

97-114: Replace console.log with structured logging (and avoid dumping full response).

Use the shared log utility; log minimal context.

     const res = await sendEmail({
       variant: "notifications",
       subject: duplicatePayoutMethod
         ? "Duplicate payout method detected"
         : "Successfully connected payout method",
       to: partner.email,
       react: EmailTemplate({
         email: partner.email,
         payoutMethod: {
           account_holder_name: defaultExternalAccount.account_holder_name,
           bank_name: defaultExternalAccount.bank_name,
           last4: defaultExternalAccount.last4,
           routing_number: defaultExternalAccount.routing_number,
         },
       }),
     });
-    console.log(`Resend response: ${JSON.stringify(res, null, 2)}`);
+    await log({
+      message: `Sent ${duplicatePayoutMethod ? "duplicate" : "connected"} payout method email to partner ${partner.id} (${partner.stripeConnectId})`,
+      type: "info",
+    });

---

43-50: Find the default external account robustly (handle pagination or fetch by ID).

Current code only inspects the first page and may miss the default account.

-  const { data: externalAccounts } = await stripe.accounts.listExternalAccounts(
-    partner.stripeConnectId!,
-  );
-
-  const defaultExternalAccount = externalAccounts.find(
-    (account) => account.default_for_currency,
-  );
+  // Prefer direct fetch by default_external_account if present, otherwise paginate.
+  const defaultExternalAccountId = account.default_external_account as string | null;
+  let defaultExternalAccount: any = null;
+  if (defaultExternalAccountId) {
+    defaultExternalAccount = await stripe.accounts.retrieveExternalAccount(
+      partner.stripeConnectId!,
+      defaultExternalAccountId,
+    );
+  } else {
+    let starting_after: string | undefined;
+    while (true) {
+      const page = await stripe.accounts.listExternalAccounts(partner.stripeConnectId!, {
+        limit: 100,
+        ...(starting_after ? { starting_after } : {}),
+      });
+      defaultExternalAccount = page.data.find((ea) => (ea as any).default_for_currency);
+      if (defaultExternalAccount || !page.has_more) break;
+      starting_after = page.data[page.data.length - 1]?.id;
+    }
+  }

---

60-74: Guard when fingerprint is missing before updating payoutMethodHash.

Avoid writing undefined/empty hash; log and return.

   let duplicatePayoutMethod = false;
-  try {
+  // Ensure fingerprint exists (for bank_account/card).
+  // @ts-ignore: runtime check for Stripe external account variants
+  const fingerprint = (defaultExternalAccount as any)?.fingerprint;
+  if (!fingerprint) {
+    await log({
+      message: `External account ${defaultExternalAccount.id} for ${partner.stripeConnectId} has no fingerprint`,
+      type: "errors",
+    });
+    return `External account ${defaultExternalAccount.id} has no fingerprint`;
+  }
+
+  try {
     await prisma.partner.update({
       where: {
         stripeConnectId: account.id,
       },
       data: {
         country,
         payoutsEnabledAt: partner.payoutsEnabledAt
           ? undefined // Don't update if already set
           : new Date(),
-        payoutMethodHash: defaultExternalAccount.fingerprint,
+        payoutMethodHash: fingerprint,
       },
     });

---

74-83: Type-safe error handling and safe logging in catch.

Narrow error before accessing .code; stringify safely for logs/returns.

-  } catch (error) {
-    if (error.code === "P2002") {
+  } catch (error: any) {
+    if (error?.code === "P2002") {
       duplicatePayoutMethod = true;
     } else {
-      await log({
-        message: `Error updating partner ${partner.email} (${partner.stripeConnectId}): ${error}`,
-        type: "errors",
-      });
-      return `Error updating partner ${partner.email} (${partner.stripeConnectId}): ${error}`;
+      const msg = error instanceof Error ? error.message : String(error);
+      await log({
+        message: `Error updating partner ${partner.id} (${partner.stripeConnectId}): ${msg}`,
+        type: "errors",
+      });
+      return `Error updating partner ${partner.id} (${partner.stripeConnectId}): ${msg}`;
     }
   }

packages/email/src/templates/connected-payout-method.tsx (1)

93-102: Mask routing number in the email (privacy).

Don’t render the full routing number. Show only the last 4.

-              {payoutMethod.routing_number && (
+              {payoutMethod.routing_number && (
                 <Row>
                   <Column className="text-sm text-neutral-600">
                     Routing Number
                   </Column>
-                  <Column className="text-right text-sm font-medium text-neutral-800">
-                    {payoutMethod.routing_number}
-                  </Column>
+                  <Column className="text-right text-sm font-medium text-neutral-800">
+                    •••• {payoutMethod.routing_number?.slice(-4)}
+                  </Column>
                 </Row>
               )}

apps/web/app/(ee)/api/stripe/connect/webhook/account-updated.ts (1)

62-66: Consider updating by partner.id (already loaded).

Minor: since you fetched partner, updating by primary id avoids relying on stripeConnectId uniqueness.

-      where: {
-        stripeConnectId: account.id,
-      },
+      where: { id: partner.id },

apps/web/app/(ee)/api/stripe/connect/webhook/account-application-deauthorized.ts (1)

21-32: Add structured logging and avoid PII in messages.

Emit an info log after updating; prefer ids over emails in messages.

-import { prisma } from "@dub/prisma";
+import { prisma } from "@dub/prisma";
+import { log } from "@dub/utils";
@@
   await prisma.partner.update({
@@
   });
 
-  return `Connected account deauthorized, updated partner ${partner.email} (${partner.stripeConnectId}) with payoutsEnabledAt and payoutMethodHash null`;
+  await log({
+    message: `Connected account deauthorized: updated partner ${partner.id} (${partner.stripeConnectId})`,
+    type: "info",
+  });
+  return `Connected account deauthorized: updated partner ${partner.id} (${partner.stripeConnectId})`;

apps/web/app/(ee)/api/stripe/connect/webhook/route.ts (2)

3-3: Extract logAndRespond into shared utilities
logAndRespond is used by both cron and webhook handlers but is defined under app/(ee)/api/cron/utils. Move it into a generic app/(ee)/api/utils module (e.g. app/(ee)/api/utils/logAndRespond.ts) and update all imports in cron and webhook routes accordingly.

---

57-68: Use logAndRespond for error responses
Replace the plain new Response in the catch block with:

return logAndRespond(
  `Stripe webhook failed (${event.type}). Error: ${error.message}`, 
  { status: 400, logLevel: "error" }
);

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Learnt from: devkiran
PR: dubinc/dub#2635
File: packages/prisma/schema/payout.prisma:24-25
Timestamp: 2025-07-11T16:28:55.693Z
Learning: In the Dub codebase, multiple payout records can now share the same stripeTransferId because payouts are grouped by partner and processed as single Stripe transfers. This is why the unique constraint was removed from the stripeTransferId field in the Payout model - a single transfer can include multiple payouts for the same partner.

Learnt from: steven-tey
PR: dubinc/dub#2758
File: apps/web/app/(ee)/api/cron/payouts/balance-available/route.ts:43-45
Timestamp: 2025-08-25T21:41:06.073Z
Learning: For Stripe API calls on connected accounts, the stripeAccount parameter should be passed in the first parameter object (e.g., stripe.balance.retrieve({ stripeAccount })), not as request options in the second parameter.