dubinc · steven-tey · Dec 5, 2025 · Nov 29, 2025 · Dec 1, 2025 · Dec 1, 2025
diff --git a/apps/web/app/(ee)/api/cron/fraud/summary/route.ts b/apps/web/app/(ee)/api/cron/fraud/summary/route.ts
@@ -1,6 +1,5 @@
 import { handleAndReturnErrorResponse } from "@/lib/api/errors";
 import { FRAUD_RULES_BY_TYPE } from "@/lib/api/fraud/constants";
-import { getGroupedFraudEvents } from "@/lib/api/fraud/get-grouped-fraud-events";
 import { getWorkspaceUsers } from "@/lib/api/get-workspace-users";
 import { qstash } from "@/lib/cron";
 import { verifyQstashSignature } from "@/lib/cron/verify-qstash";
@@ -40,11 +39,10 @@ async function handler(req: Request) {
     // Get batch of programs with unresolved fraud events
     const programs = await prisma.program.findMany({
       where: {
-        fraudEvents: {
+        fraudEventGroups: {
           some: {
             status: "pending",
-            // Only include programs with fraud events created today so daily summaries
-            createdAt: {
+            lastEventAt: {
               gte: startOfDay(new Date()),
             },
           },
@@ -82,28 +80,36 @@ async function handler(req: Request) {
 
     for (const program of programs) {
       try {
-        const fraudEvents = await getGroupedFraudEvents({
-          programId: program.id,
-          status: "pending",
-          page: 1,
-          pageSize: 6,
-          sortBy: "createdAt",
-          sortOrder: "asc",
+        const fraudGroups = await prisma.fraudEventGroup.findMany({
+          where: {
+            programId: program.id,
+            status: "pending",
+            lastEventAt: {
+              gte: startOfDay(new Date()),
+            },
+          },
+          select: {
+            id: true,
+            type: true,
+            eventCount: true,
+            partner: {
+              select: {
+                id: true,
+                name: true,
+                image: true,
+              },
+            },
+          },
+          orderBy: {
+            lastEventAt: "desc",
+          },
+          take: 6,
         });
 
-        if (fraudEvents.length === 0) {
+        if (fraudGroups.length === 0) {
           continue;
         }
 
-        const transformedFraudEvents = fraudEvents.map(
-          ({ type, count, groupKey, partner }) => ({
-            name: FRAUD_RULES_BY_TYPE[type].name,
-            count,
-            groupKey,
-            partner,
-          }),
-        );
-
         // Get workspace users to send the email to
         const { users } = await getWorkspaceUsers({
           role: "owner",
@@ -115,6 +121,15 @@ async function handler(req: Request) {
           continue;
         }
 
+        const transformedFraudGroups = fraudGroups.map(
+          ({ id, type, eventCount, partner }) => ({
+            id,
+            name: FRAUD_RULES_BY_TYPE[type].name,
+            count: eventCount,
+            partner,
+          }),
+        );
+
         await queueBatchEmail<typeof UnresolvedFraudEventsSummary>(
           users.map((user) => ({
             to: user.email,
@@ -125,7 +140,7 @@ async function handler(req: Request) {
               email: user.email,
               workspace: program.workspace,
               program,
-              fraudEvents: transformedFraudEvents,
+              fraudGroups: transformedFraudGroups,
             },
           })),
           {

diff --git a/apps/web/app/(ee)/api/cron/merge-partner-accounts/route.ts b/apps/web/app/(ee)/api/cron/merge-partner-accounts/route.ts
@@ -1,4 +1,5 @@
 import { handleAndReturnErrorResponse } from "@/lib/api/errors";
+import { resolveFraudGroups } from "@/lib/api/fraud/resolve-fraud-groups";
 import { linkCache } from "@/lib/api/links/cache";
 import { includeProgramEnrollment } from "@/lib/api/links/include-program-enrollment";
 import { includeTags } from "@/lib/api/links/include-tags";
@@ -59,6 +60,7 @@ export async function POST(req: Request) {
       select: {
         id: true,
         email: true,
+        payoutMethodHash: true,
         programs: {
           select: {
             programId: true,
@@ -269,6 +271,28 @@ export async function POST(req: Request) {
       );
     }
 
+    // After merging, check if the fraud condition has been resolved.
+    // If no other partners share the same payout method hash, we can
+    // automatically resolve any pending fraud groups for this partner.
+    if (targetAccount.payoutMethodHash) {
+      const duplicatePartners = await prisma.partner.count({
+        where: {
+          payoutMethodHash: targetAccount.payoutMethodHash,
+        },
+      });
+
+      if (duplicatePartners <= 1) {
+        await resolveFraudGroups({
+          where: {
+            partnerId: targetPartnerId,
+            type: "partnerDuplicatePayoutMethod",
+          },
+          resolutionReason:
+            "Automatically resolved because partners with duplicate payout methods were merged. No other partners share this payout method.",
+        });
+      }
+    }
+
     // Make sure the cache is cleared
     await redis.del(`${CACHE_KEY_PREFIX}:${userId}`);
 

diff --git a/apps/web/app/(ee)/api/cron/partners/ban/process/route.ts b/apps/web/app/(ee)/api/cron/partners/ban/process/route.ts
@@ -11,6 +11,7 @@ import { BAN_PARTNER_REASONS } from "@/lib/zod/schemas/partners";
 import { sendEmail } from "@dub/email";
 import PartnerBanned from "@dub/email/templates/partner-banned";
 import { prisma } from "@dub/prisma";
+import { FraudRuleType } from "@dub/prisma/client";
 import { log } from "@dub/utils";
 import { z } from "zod";
 import { logAndRespond } from "../../../utils";
@@ -151,6 +152,9 @@ export async function POST(req: Request) {
         },
         status: "approved",
       },
+      select: {
+        programId: true,
+      },
     });
 
     // Create partnerCrossProgramBan fraud events for other programs where this partner
@@ -159,7 +163,7 @@ export async function POST(req: Request) {
       programEnrollments.map(({ programId }) => ({
         programId,
         partnerId,
-        type: "partnerCrossProgramBan",
+        type: FraudRuleType.partnerCrossProgramBan,
       })),
     );
 

diff --git a/apps/web/app/(ee)/api/fraud/events/count/route.ts b/apps/web/app/(ee)/api/fraud/events/count/route.ts
diff --git a/apps/web/app/(ee)/api/fraud/events/raw/route.ts b/apps/web/app/(ee)/api/fraud/events/raw/route.ts
diff --git a/apps/web/app/(ee)/api/fraud/events/route.ts b/apps/web/app/(ee)/api/fraud/events/route.ts
@@ -1,23 +1,120 @@
-import { getGroupedFraudEvents } from "@/lib/api/fraud/get-grouped-fraud-events";
+import { DubApiError } from "@/lib/api/errors";
 import { getDefaultProgramIdOrThrow } from "@/lib/api/programs/get-default-program-id-or-throw";
 import { withWorkspace } from "@/lib/auth";
-import { groupedFraudEventsQuerySchema } from "@/lib/zod/schemas/fraud";
+import {
+  fraudEventQuerySchema,
+  fraudEventSchemas,
+} from "@/lib/zod/schemas/fraud";
+import { prisma } from "@dub/prisma";
+import { FraudRuleType, Prisma } from "@dub/prisma/client";
 import { NextResponse } from "next/server";
+import { z } from "zod";
 
-// GET /api/fraud/events - Get the fraud events for a program grouped by rule type
+// GET /api/fraud/events - Get the fraud events for a group
 export const GET = withWorkspace(
   async ({ workspace, searchParams }) => {
     const programId = getDefaultProgramIdOrThrow(workspace);
-    const parsedParams = groupedFraudEventsQuerySchema.parse(searchParams);
+    const parsedQueryParams = fraudEventQuerySchema.parse(searchParams);
 
-    console.time("getGroupedFraudEvents");
-    const fraudEvents = await getGroupedFraudEvents({
-      ...parsedParams,
-      programId,
+    let where: Prisma.FraudEventWhereInput = {};
+    let eventGroupType: FraudRuleType | undefined;
+
+    // Filter by group ID
+    if ("groupId" in parsedQueryParams) {
+      const { groupId } = parsedQueryParams;
+
+      const fraudGroup = await prisma.fraudEventGroup.findUnique({
+        where: {
+          id: groupId,
+        },
+        select: {
+          programId: true,
+          partnerId: true,
+          type: true,
+        },
+      });
+
+      if (!fraudGroup) {
+        throw new DubApiError({
+          code: "not_found",
+          message: "Fraud event group not found.",
+        });
+      }
+
+      if (fraudGroup.programId !== programId) {
+        throw new DubApiError({
+          code: "not_found",
+          message: "Fraud event group not found in this program.",
+        });
+      }
+
+      where = {
+        fraudEventGroupId: groupId,
+      };
+
+      eventGroupType = fraudGroup.type;
+
+      // Special case for partnerCrossProgramBan rule type
+      if (eventGroupType === FraudRuleType.partnerCrossProgramBan) {
+        const bannedProgramEnrollments =
+          await prisma.programEnrollment.findMany({
+            where: {
+              partnerId: fraudGroup.partnerId,
+              programId: {
+                not: programId,
+              },
+              status: "banned",
+            },
+            select: {
+              bannedAt: true,
+              bannedReason: true,
+            },
+          });
+
+        return NextResponse.json(
+          z
+            .array(fraudEventSchemas["partnerCrossProgramBan"])
+            .parse(bannedProgramEnrollments),
+        );
+      }
+    }
+
+    // Filter by customer ID and type
+    if ("customerId" in parsedQueryParams && "type" in parsedQueryParams) {
+      const { customerId, type } = parsedQueryParams;
+
+      where = {
+        customerId,
+        fraudEventGroup: {
+          programId,
+          type,
+        },
+      };
+
+      eventGroupType = type;
+    }
+
+    if (!eventGroupType) {
+      throw new DubApiError({
+        code: "not_found",
+        message: "Fraud event group type not found.",
+      });
+    }
+
+    const zodSchema = fraudEventSchemas[eventGroupType];
+
+    const fraudEvents = await prisma.fraudEvent.findMany({
+      where,
+      include: {
+        partner: true,
+        customer: true,
+      },
+      orderBy: {
+        id: "asc",
+      },
     });
-    console.timeEnd("getGroupedFraudEvents");
 
-    return NextResponse.json(fraudEvents);
+    return NextResponse.json(z.array(zodSchema).parse(fraudEvents));
   },
   {
     requiredPlan: ["advanced", "enterprise"],