dubinc · steven-tey · Nov 28, 2025 · Nov 27, 2025 · Nov 27, 2025 · Nov 27, 2025
diff --git a/apps/web/app/(ee)/api/fraud/events/raw/route.ts b/apps/web/app/(ee)/api/fraud/events/raw/route.ts
@@ -62,34 +62,6 @@ export const GET = withWorkspace(
       );
     }
 
-    if (type === "partnerDuplicatePayoutMethod") {
-      if (!partner.payoutMethodHash) {
-        return NextResponse.json([]);
-      }
-
-      const duplicatePartners = await prisma.programEnrollment.findMany({
-        where: {
-          programId,
-          partner: {
-            payoutMethodHash: partner.payoutMethodHash,
-          },
-        },
-        select: {
-          createdAt: true,
-          partner: {
-            select: {
-              id: true,
-              name: true,
-              email: true,
-              image: true,
-            },
-          },
-        },
-      });
-
-      return NextResponse.json(z.array(zodSchema).parse(duplicatePartners));
-    }
-
     return NextResponse.json(z.array(zodSchema).parse(fraudEvents));
   },
   {

diff --git a/apps/web/app/(ee)/api/stripe/connect/webhook/account-updated.ts b/apps/web/app/(ee)/api/stripe/connect/webhook/account-updated.ts
@@ -2,7 +2,7 @@ import { createFraudEvents } from "@/lib/api/fraud/create-fraud-events";
 import { qstash } from "@/lib/cron";
 import { stripe } from "@/lib/stripe";
 import { prisma } from "@dub/prisma";
-import { APP_DOMAIN_WITH_NGROK, log } from "@dub/utils";
+import { APP_DOMAIN_WITH_NGROK, log, nanoid } from "@dub/utils";
 import Stripe from "stripe";
 
 const queue = qstash.queue({
@@ -105,11 +105,14 @@ export async function accountUpdated(event: Stripe.Event) {
         ({ programs }) => programs,
       );
 
+      const groupingKey = nanoid(10);
+
       await createFraudEvents(
         programEnrollments.map(({ partnerId, programId }) => ({
           programId,
           partnerId,
           type: "partnerDuplicatePayoutMethod",
+          groupingKey,
         })),
       );
     }

diff --git a/apps/web/lib/api/fraud/create-fraud-events.ts b/apps/web/lib/api/fraud/create-fraud-events.ts
@@ -1,26 +1,28 @@
 import { prisma } from "@dub/prisma";
-import { Prisma } from "@prisma/client";
+import { FraudRuleType } from "@prisma/client";
 import { createId } from "../create-id";
 import { createFraudEventGroupKey } from "./utils";
 
-export async function createFraudEvents(
-  fraudEvents: Pick<
-    Prisma.FraudEventCreateManyInput,
-    "programId" | "partnerId" | "type"
-  >[],
-) {
+interface CreateFraudEventsInput {
+  programId: string;
+  partnerId: string;
+  type: FraudRuleType;
+  groupingKey?: string; // if not provided, partnerId will be used
+}
+
+export async function createFraudEvents(fraudEvents: CreateFraudEventsInput[]) {
   if (fraudEvents.length === 0) {
     return;
   }
 
   await prisma.fraudEvent.createMany({
-    data: fraudEvents.map((evt) => {
-      const { programId, partnerId, type } = evt;
+    data: fraudEvents.map((event) => {
+      const { programId, partnerId, type, groupingKey } = event;
 
       const groupKey = createFraudEventGroupKey({
         programId,
-        partnerId,
         type,
+        groupingKey: groupingKey ?? partnerId,
       });
 
       return {

diff --git a/apps/web/lib/api/fraud/detect-record-fraud-event.ts b/apps/web/lib/api/fraud/detect-record-fraud-event.ts
@@ -101,7 +101,7 @@ export async function detectAndRecordFraudEvent(context: FraudEventContext) {
         metadata: event.metadata as Prisma.InputJsonValue,
         groupKey: createFraudEventGroupKey({
           programId: validatedContext.program.id,
-          partnerId: validatedContext.partner.id,
+          groupingKey: validatedContext.partner.id,
           type: event.type,
         }),
       })),

diff --git a/apps/web/lib/api/fraud/resolve-fraud-events.ts b/apps/web/lib/api/fraud/resolve-fraud-events.ts
@@ -49,9 +49,8 @@ export async function resolveFraudEvents({
     const firstEvent = events[0];
     const newGroupKey = createFraudEventGroupKey({
       programId: firstEvent.programId,
-      partnerId: firstEvent.partnerId,
       type: firstEvent.type,
-      batchId: nanoid(10),
+      groupingKey: nanoid(10),
     });
 
     await prisma.fraudEvent.updateMany({

diff --git a/apps/web/lib/api/fraud/utils.ts b/apps/web/lib/api/fraud/utils.ts
@@ -26,28 +26,28 @@ export function normalizeEmail(email: string): string {
   return `${username}@${domain}`;
 }
 
-// Create a unique group key to identify and deduplicate fraud events of the same type
-// for the same partner-program combination.
-// batchId is used when resolving fraud events to create a new unique group key,
-// breaking the grouping so resolved events are no longer grouped with
-// pending events that share the same programId, partnerId, and type
-export function createFraudEventGroupKey({
-  programId,
-  partnerId,
-  type,
-  batchId,
-}: {
-  programId: string;
-  partnerId: string;
+function createHashKey(value: string): string {
+  return createHash("sha256").update(value).digest("base64url").slice(0, 24);
+}
+
+interface CreateGroupKeyInput {
   type: FraudRuleType;
-  batchId?: string;
-}): string {
-  const parts = [programId, partnerId, type, batchId].map((part) =>
-    part?.toLowerCase(),
+  programId: string;
+
+  /**
+   * The grouping key used to group fraud events. It can be:
+   * - partnerId: for partner-specific grouping
+   * - Any other identifier relevant to the fraud rule type
+   */
+  groupingKey: string;
+}
+
+// Create a unique group key to identify and deduplicate fraud events of the same type
+// based on programId and groupingKey
+export function createFraudEventGroupKey(input: CreateGroupKeyInput): string {
+  const parts = [input.programId, input.type, input.groupingKey].map((p) =>
+    p!.toLowerCase(),
   );
 
-  return createHash("sha256")
-    .update(parts.join("|"))
-    .digest("base64url")
-    .slice(0, 24);
+  return createHashKey(parts.join("|"));
 }