dubinc · steven-tey · Nov 20, 2025 · Nov 18, 2025 · Nov 19, 2025 · Nov 19, 2025
diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml
@@ -35,6 +35,7 @@ jobs:
         env:
           E2E_BASE_URL: ${{ github.event.deployment_status.environment_url }}
           E2E_TOKEN: ${{ secrets.E2E_TOKEN }}
+          E2E_TOKEN_MEMBER: ${{ secrets.E2E_TOKEN_MEMBER }}
           E2E_TOKEN_OLD: ${{ secrets.E2E_TOKEN_OLD }}
           E2E_PUBLISHABLE_KEY: ${{ secrets.E2E_PUBLISHABLE_KEY }}
           QSTASH_TOKEN: ${{ secrets.QSTASH_TOKEN }}

diff --git a/apps/web/app/(ee)/api/cron/import/csv/route.ts b/apps/web/app/(ee)/api/cron/import/csv/route.ts
@@ -4,7 +4,7 @@ import { handleAndReturnErrorResponse } from "@/lib/api/errors";
 import { bulkCreateLinks, createLink, processLink } from "@/lib/api/links";
 import { qstash } from "@/lib/cron";
 import { verifyQstashSignature } from "@/lib/cron/verify-qstash";
-import { ProcessedLinkProps, WorkspaceProps } from "@/lib/types";
+import { ProcessedLinkProps } from "@/lib/types";
 import { redis } from "@/lib/upstash";
 import { linkMappingSchema } from "@/lib/zod/schemas/import-csv";
 import { createLinkBodySchema } from "@/lib/zod/schemas/links";
@@ -384,6 +384,11 @@ const processMappedLinks = async ({
     select: {
       id: true,
       plan: true,
+      users: {
+        where: {
+          userId,
+        },
+      },
     },
   });
 
@@ -397,10 +402,7 @@ const processMappedLinks = async ({
             folderId,
           }),
         },
-        workspace: {
-          id: workspaceId,
-          plan: workspace.plan as WorkspaceProps["plan"],
-        },
+        workspace,
         userId,
         bulk: true,
       }),

diff --git a/apps/web/app/(ee)/api/cron/links/export/route.ts b/apps/web/app/(ee)/api/cron/links/export/route.ts
@@ -6,6 +6,7 @@ import { formatLinksForExport } from "@/lib/api/links/format-links-for-export";
 import { validateLinksQueryFilters } from "@/lib/api/links/validate-links-query-filters";
 import { generateExportFilename } from "@/lib/api/utils/generate-export-filename";
 import { generateRandomString } from "@/lib/api/utils/generate-random-string";
+import { MEGA_WORKSPACE_LINKS_LIMIT } from "@/lib/constants/misc";
 import { verifyQstashSignature } from "@/lib/cron/verify-qstash";
 import { WorkspaceProps } from "@/lib/types";
 import { linksExportQuerySchema } from "@/lib/zod/schemas/links";
@@ -62,6 +63,7 @@ export async function POST(req: Request) {
         id: true,
         name: true,
         plan: true,
+        totalLinks: true,
       },
     });
 
@@ -71,7 +73,7 @@ export async function POST(req: Request) {
       );
     }
 
-    const { selectedFolder, folderIds } = await validateLinksQueryFilters({
+    const { folderIds } = await validateLinksQueryFilters({
       ...filters,
       userId,
       workspace: workspace as WorkspaceProps,
@@ -87,16 +89,16 @@ export async function POST(req: Request) {
 
     // Fetch links in batches and build CSV
     const allLinks: Record<string, any>[] = [];
-    const searchMode: "fuzzy" | "exact" =
-      selectedFolder?.type === "mega" ? "exact" : "fuzzy";
 
     const linksFilters = {
       ...filters,
       ...(interval !== "all" && {
         startDate,
         endDate,
       }),
-      searchMode,
+      searchMode: (workspace.totalLinks > MEGA_WORKSPACE_LINKS_LIMIT
+        ? "exact"
+        : "fuzzy") as "exact" | "fuzzy",
       includeDashboard: false,
       includeUser: false,
       includeWebhooks: false,

diff --git a/apps/web/app/(ee)/api/embed/referrals/links/[linkId]/route.ts b/apps/web/app/(ee)/api/embed/referrals/links/[linkId]/route.ts
@@ -76,6 +76,7 @@ export const PATCH = withReferralsEmbedToken(
       workspace: {
         id: program.workspaceId,
         plan: "business",
+        users: [{ role: "owner" }],
       },
       userId: link.userId!,
       skipKeyChecks,

diff --git a/apps/web/app/(ee)/api/embed/referrals/links/route.ts b/apps/web/app/(ee)/api/embed/referrals/links/route.ts
@@ -107,6 +107,7 @@ export const POST = withReferralsEmbedToken(
       workspace: {
         id: program.workspaceId,
         plan: "business",
+        users: [{ role: "owner" }],
       },
       userId: workspaceOwner?.userId,
       skipFolderChecks: true, // can't be changed by the partner

diff --git a/apps/web/app/(ee)/api/events/route.ts b/apps/web/app/(ee)/api/events/route.ts
@@ -7,7 +7,7 @@ import { assertValidDateRangeForPlan } from "@/lib/api/utils/assert-valid-date-r
 import { withWorkspace } from "@/lib/auth";
 import { verifyFolderAccess } from "@/lib/folder/permissions";
 import { eventsQuerySchema } from "@/lib/zod/schemas/analytics";
-import { Folder, Link } from "@dub/prisma/client";
+import { Link } from "@dub/prisma/client";
 import { NextResponse } from "next/server";
 
 // GET /api/events
@@ -47,9 +47,8 @@ export const GET = withWorkspace(
 
     const folderIdToVerify = link?.folderId || folderId;
 
-    let selectedFolder: Pick<Folder, "id" | "type"> | null = null;
     if (folderIdToVerify) {
-      selectedFolder = await verifyFolderAccess({
+      await verifyFolderAccess({
         workspace,
         userId: session.user.id,
         folderId: folderIdToVerify,

diff --git a/apps/web/app/(ee)/api/partner-profile/programs/[programId]/links/[linkId]/route.ts b/apps/web/app/(ee)/api/partner-profile/programs/[programId]/links/[linkId]/route.ts
@@ -126,6 +126,7 @@ export const PATCH = withPartnerProfile(
       workspace: {
         id: program.workspaceId,
         plan: "business",
+        users: [{ role: "owner" }],
       },
       userId: session.user.id,
       skipKeyChecks,

diff --git a/apps/web/app/(ee)/api/partner-profile/programs/[programId]/links/route.ts b/apps/web/app/(ee)/api/partner-profile/programs/[programId]/links/route.ts
@@ -119,6 +119,7 @@ export const POST = withPartnerProfile(
       workspace: {
         id: program.workspaceId,
         plan: "business",
+        users: [{ role: "owner" }],
       },
       userId: session.user.id, // TODO: Hm, this is the partner user, not the workspace user?
       skipFolderChecks: true, // can't be changed by the partner

diff --git a/apps/web/app/api/analytics/export/route.ts b/apps/web/app/api/analytics/export/route.ts
@@ -92,7 +92,7 @@ export const GET = withWorkspace(
 
     const zipData = await zip.generateAsync({ type: "nodebuffer" });
 
-    return new Response(zipData, {
+    return new Response(zipData as unknown as BodyInit, {
       headers: {
         "Content-Type": "application/zip",
         "Content-Disposition": "attachment; filename=analytics_export.zip",

diff --git a/apps/web/app/api/folders/[folderId]/users/route.ts b/apps/web/app/api/folders/[folderId]/users/route.ts
@@ -1,6 +1,6 @@
 import { withWorkspace } from "@/lib/auth";
 import {
-  findUserFolderRole,
+  findFolderUserRole,
   verifyFolderAccess,
 } from "@/lib/folder/permissions";
 import { prisma } from "@dub/prisma";
@@ -52,13 +52,15 @@ export const GET = withWorkspace(
       }),
     ]);
 
-    const users = workspaceUsers.map(({ user }) => {
-      const folderUser =
-        folderUsers.find((folderUser) => folderUser.userId === user.id) || null;
+    const users = workspaceUsers.map(({ user, role: workspaceRole }) => {
+      const folderUser = folderUsers.find(
+        (folderUser) => folderUser.userId === user.id,
+      );
 
-      const role = findUserFolderRole({
+      const role = findFolderUserRole({
         folder,
-        user: folderUser,
+        user: folderUser || null,
+        workspaceRole,
       });
 
       return {
@@ -67,6 +69,7 @@ export const GET = withWorkspace(
         email: user.email,
         image: user.image,
         role,
+        workspaceRole,
       };
     });
 

diff --git a/apps/web/app/api/folders/count/route.ts b/apps/web/app/api/folders/count/route.ts
@@ -1,6 +1,7 @@
 import { withWorkspace } from "@/lib/auth";
 import { listFoldersQuerySchema } from "@/lib/zod/schemas/folders";
 import { prisma } from "@dub/prisma";
+import { WorkspaceRole } from "@dub/prisma/client";
 import { NextResponse } from "next/server";
 
 // GET /api/folders/count - get count of folders
@@ -10,26 +11,32 @@ export const GET = withWorkspace(
       .omit({ page: true, pageSize: true })
       .parse(searchParams);
 
+    const workspaceRole = workspace.users[0]?.role;
+
     const count = await prisma.folder.count({
       where: {
         projectId: workspace.id,
-        OR: [
-          { accessLevel: { not: null } },
-          {
-            users: {
-              some: {
-                userId: session.user.id,
-                role: { not: null },
+        ...(workspaceRole !== WorkspaceRole.owner
+          ? {
+              OR: [
+                { accessLevel: { not: null } },
+                {
+                  users: {
+                    some: {
+                      userId: session.user.id,
+                      role: { not: null },
+                    },
+                  },
+                },
+              ],
+              users: {
+                none: {
+                  userId: session.user.id,
+                  role: null,
+                },
               },
-            },
-          },
-        ],
-        users: {
-          none: {
-            userId: session.user.id,
-            role: null,
-          },
-        },
+            }
+          : {}),
         ...(search && {
           name: {
             contains: search,

diff --git a/apps/web/app/api/folders/permissions/route.ts b/apps/web/app/api/folders/permissions/route.ts
@@ -1,7 +1,7 @@
 import { withWorkspace } from "@/lib/auth";
 import { getFolders } from "@/lib/folder/get-folders";
 import {
-  findUserFolderRole,
+  findFolderUserRole,
   getFolderPermissions,
 } from "@/lib/folder/permissions";
 import { prisma } from "@dub/prisma";
@@ -30,15 +30,16 @@ export const GET = withWorkspace(
         folderUsers.find((folderUser) => folderUser.folderId === folder.id) ||
         null;
 
-      const role = findUserFolderRole({
+      const userFolderRole = findFolderUserRole({
         folder,
         user: folderUser,
+        workspaceRole: workspace.users[0]?.role,
       });
 
       return {
         id: folder.id,
         name: folder.name,
-        permissions: getFolderPermissions(role),
+        permissions: getFolderPermissions(userFolderRole),
       };
     });
 

diff --git a/apps/web/app/api/links/bulk/route.ts b/apps/web/app/api/links/bulk/route.ts
@@ -16,8 +16,8 @@ import { parseRequestBody } from "@/lib/api/utils";
 import { withWorkspace } from "@/lib/auth";
 import { exceededLimitError } from "@/lib/exceeded-limit-error";
 import {
-  checkFolderPermissions,
   verifyFolderAccess,
+  verifyFolderAccessBulk,
 } from "@/lib/folder/permissions";
 import { storage } from "@/lib/storage";
 import { NewLinkProps, ProcessedLinkProps } from "@/lib/types";
@@ -173,8 +173,8 @@ export const POST = withWorkspace(
         ),
       ];
 
-      const folderPermissions = await checkFolderPermissions({
-        workspaceId: workspace.id,
+      const folderPermissions = await verifyFolderAccessBulk({
+        workspace,
         userId: session.user.id,
         folderIds,
         requiredPermission: "folders.links.write",
@@ -350,8 +350,8 @@ export const PATCH = withWorkspace(
         new Set(links.map((link) => link.folderId).filter(Boolean) as string[]),
       );
 
-      const folderPermissions = await checkFolderPermissions({
-        workspaceId: workspace.id,
+      const folderPermissions = await verifyFolderAccessBulk({
+        workspace,
         userId: session.user.id,
         folderIds,
         requiredPermission: "folders.links.write",
@@ -368,7 +368,7 @@ export const PATCH = withWorkspace(
 
         if (!validFolder?.hasPermission) {
           errorLinks.push({
-            error: `You don't have permission to move this link to the folder: ${link.folderId}`,
+            error: `You don't have permission to update links in this folder: ${link.folderId}`,
             code: "forbidden",
             link,
           });
@@ -522,8 +522,8 @@ export const DELETE = withWorkspace(
         ),
       ];
 
-      const folderPermissions = await checkFolderPermissions({
-        workspaceId: workspace.id,
+      const folderPermissions = await verifyFolderAccessBulk({
+        workspace,
         userId: session.user.id,
         folderIds,
         requiredPermission: "folders.links.write",

diff --git a/apps/web/app/api/links/export/route.ts b/apps/web/app/api/links/export/route.ts
@@ -6,6 +6,7 @@ import { getLinksForWorkspace } from "@/lib/api/links/get-links-for-workspace";
 import { throwIfClicksUsageExceeded } from "@/lib/api/links/usage-checks";
 import { validateLinksQueryFilters } from "@/lib/api/links/validate-links-query-filters";
 import { withWorkspace } from "@/lib/auth";
+import { MEGA_WORKSPACE_LINKS_LIMIT } from "@/lib/constants/misc";
 import { qstash } from "@/lib/cron";
 import { linksExportQuerySchema } from "@/lib/zod/schemas/links";
 import { APP_DOMAIN_WITH_NGROK } from "@dub/utils";
@@ -21,7 +22,7 @@ export const GET = withWorkspace(
 
     const { columns, ...filters } = linksExportQuerySchema.parse(searchParams);
 
-    const { selectedFolder, folderIds } = await validateLinksQueryFilters({
+    const { folderIds } = await validateLinksQueryFilters({
       ...filters,
       workspace,
       userId: session.user.id,
@@ -61,7 +62,8 @@ export const GET = withWorkspace(
         startDate,
         endDate,
       }),
-      searchMode: selectedFolder?.type === "mega" ? "exact" : "fuzzy",
+      searchMode:
+        workspace.totalLinks > MEGA_WORKSPACE_LINKS_LIMIT ? "exact" : "fuzzy",
       includeDashboard: false,
       includeUser: false,
       includeWebhooks: false,

diff --git a/apps/web/app/api/links/route.ts b/apps/web/app/api/links/route.ts
@@ -4,6 +4,7 @@ import { throwIfLinksUsageExceeded } from "@/lib/api/links/usage-checks";
 import { validateLinksQueryFilters } from "@/lib/api/links/validate-links-query-filters";
 import { parseRequestBody } from "@/lib/api/utils";
 import { withWorkspace } from "@/lib/auth";
+import { MEGA_WORKSPACE_LINKS_LIMIT } from "@/lib/constants/misc";
 import { ratelimit } from "@/lib/upstash";
 import { sendWorkspaceWebhook } from "@/lib/webhook/publish";
 import {
@@ -20,7 +21,7 @@ export const GET = withWorkspace(
   async ({ headers, searchParams, workspace, session }) => {
     const filters = getLinksQuerySchemaExtended.parse(searchParams);
 
-    const { selectedFolder, folderIds } = await validateLinksQueryFilters({
+    const { folderIds } = await validateLinksQueryFilters({
       ...filters,
       workspace,
       userId: session.user.id,
@@ -30,7 +31,8 @@ export const GET = withWorkspace(
       ...filters,
       workspaceId: workspace.id,
       folderIds,
-      searchMode: selectedFolder?.type === "mega" ? "exact" : "fuzzy",
+      searchMode:
+        workspace.totalLinks > MEGA_WORKSPACE_LINKS_LIMIT ? "exact" : "fuzzy",
     });
 
     return NextResponse.json(response, {

diff --git a/apps/web/app/app.dub.co/(dashboard)/[slug]/(ee)/program/campaigns/campaigns-table.tsx b/apps/web/app/app.dub.co/(dashboard)/[slug]/(ee)/program/campaigns/campaigns-table.tsx
@@ -197,7 +197,9 @@ export function CampaignsTable() {
           )}
           addButton={!isFiltered ? <CreateCampaignButton /> : undefined}
           learnMoreHref={
-            !isFiltered ? "https://dub.co/docs/email-campaigns" : undefined
+            !isFiltered
+              ? "https://dub.co/help/article/email-campaigns"
+              : undefined
           }
         />
       )}