dubinc · steven-tey · Dec 5, 2025 · Dec 5, 2025 · Dec 5, 2025 · Dec 5, 2025
diff --git a/apps/web/app/(ee)/api/cron/auto-approve-partner/route.ts b/apps/web/app/(ee)/api/cron/auto-approve-partner/route.ts
@@ -1,7 +1,8 @@
 import { handleAndReturnErrorResponse } from "@/lib/api/errors";
-import { getPartnerHighRiskSignals } from "@/lib/api/fraud/get-partner-high-risk-signals";
+import { getPartnerApplicationRisks } from "@/lib/api/fraud/get-partner-application-risks";
 import { verifyQstashSignature } from "@/lib/cron/verify-qstash";
 import { approvePartnerEnrollment } from "@/lib/partners/approve-partner-enrollment";
+import { getPlanCapabilities } from "@/lib/plan-capabilities";
 import { prisma } from "@dub/prisma";
 import { log } from "@dub/utils";
 import { z } from "zod";
@@ -50,12 +51,7 @@ export async function POST(req: Request) {
             partnerGroup: true,
             groupId: true,
             status: true,
-            partner: {
-              select: {
-                id: true,
-                payoutMethodHash: true,
-              },
-            },
+            partner: true,
           },
         },
       },
@@ -89,15 +85,23 @@ export async function POST(req: Request) {
       );
     }
 
-    const { hasHighRisk } = await getPartnerHighRiskSignals({
-      program,
-      partner: programEnrollment.partner,
-    });
+    // Check if the workspace plan has fraud event management capabilities
+    // If enabled, we'll evaluate risk signals before auto-approving
+    const { canManageFraudEvents } = getPlanCapabilities(
+      program.workspace.plan,
+    );
 
-    if (hasHighRisk) {
-      return logAndRespond(
-        `Partner ${partnerId} has high risk. Skipping auto-approval.`,
-      );
+    if (canManageFraudEvents) {
+      const { riskSeverity } = await getPartnerApplicationRisks({
+        program,
+        partner: programEnrollment.partner,
+      });
+
+      if (riskSeverity === "high") {
+        return logAndRespond(
+          `Partner ${partnerId} has high risk. Skipping auto-approval.`,
+        );
+      }
     }
 
     await approvePartnerEnrollment({

diff --git a/apps/web/app/(ee)/api/fraud/events/count/route.ts b/apps/web/app/(ee)/api/fraud/events/count/route.ts
@@ -0,0 +1,50 @@
+import { DubApiError } from "@/lib/api/errors";
+import { getDefaultProgramIdOrThrow } from "@/lib/api/programs/get-default-program-id-or-throw";
+import { withWorkspace } from "@/lib/auth";
+import { fraudEventCountQuerySchema } from "@/lib/zod/schemas/fraud";
+import { prisma } from "@dub/prisma";
+import { NextResponse } from "next/server";
+
+// GET /api/fraud/events/count - Get the count of fraud events
+export const GET = withWorkspace(
+  async ({ workspace, searchParams }) => {
+    const programId = getDefaultProgramIdOrThrow(workspace);
+    const { groupId } = fraudEventCountQuerySchema.parse(searchParams);
+
+    const fraudGroup = await prisma.fraudEventGroup.findUnique({
+      where: {
+        id: groupId,
+      },
+      select: {
+        programId: true,
+        partnerId: true,
+        type: true,
+      },
+    });
+
+    if (!fraudGroup) {
+      throw new DubApiError({
+        code: "not_found",
+        message: "Fraud event group not found.",
+      });
+    }
+
+    if (fraudGroup.programId !== programId) {
+      throw new DubApiError({
+        code: "not_found",
+        message: "Fraud event group not found in this program.",
+      });
+    }
+
+    const count = await prisma.fraudEvent.count({
+      where: {
+        fraudEventGroupId: groupId,
+      },
+    });
+
+    return NextResponse.json(count);
+  },
+  {
+    requiredPlan: ["advanced", "enterprise"],
+  },
+);
diff --git a/apps/web/app/(ee)/api/fraud/events/route.ts b/apps/web/app/(ee)/api/fraud/events/route.ts
@@ -14,14 +14,15 @@ import { z } from "zod";
 export const GET = withWorkspace(
   async ({ workspace, searchParams }) => {
     const programId = getDefaultProgramIdOrThrow(workspace);
-    const parsedQueryParams = fraudEventQuerySchema.parse(searchParams);
+    const { page, pageSize, ...queryParams } =
+      fraudEventQuerySchema.parse(searchParams);
 
     let where: Prisma.FraudEventWhereInput = {};
     let eventGroupType: FraudRuleType | undefined;
 
     // Filter by group ID
-    if ("groupId" in parsedQueryParams) {
-      const { groupId } = parsedQueryParams;
+    if ("groupId" in queryParams) {
+      const { groupId } = queryParams;
 
       const fraudGroup = await prisma.fraudEventGroup.findUnique({
         where: {
@@ -80,8 +81,9 @@ export const GET = withWorkspace(
     }
 
     // Filter by customer ID and type
-    if ("customerId" in parsedQueryParams && "type" in parsedQueryParams) {
-      const { customerId, type } = parsedQueryParams;
+    // Currently this is only used in E2E tests to fetch raw fraud events for a given customer + type
+    if ("customerId" in queryParams && "type" in queryParams) {
+      const { customerId, type } = queryParams;
 
       where = {
         customerId,
@@ -110,8 +112,10 @@ export const GET = withWorkspace(
         customer: true,
       },
       orderBy: {
-        id: "asc",
+        id: "desc",
       },
+      skip: (page - 1) * pageSize,
+      take: pageSize,
     });
 
     return NextResponse.json(z.array(zodSchema).parse(fraudEvents));

diff --git a/apps/web/app/(ee)/api/partners/[partnerId]/application-risks/route.ts b/apps/web/app/(ee)/api/partners/[partnerId]/application-risks/route.ts
@@ -1,58 +1,34 @@
-import { FRAUD_RULES } from "@/lib/api/fraud/constants";
-import { getPartnerHighRiskSignals } from "@/lib/api/fraud/get-partner-high-risk-signals";
-import { checkPartnerEmailDomainMismatch } from "@/lib/api/fraud/rules/check-partner-email-domain-mismatch";
-import { checkPartnerEmailMasked } from "@/lib/api/fraud/rules/check-partner-email-masked";
-import { checkPartnerNoSocialLinks } from "@/lib/api/fraud/rules/check-partner-no-social-links";
-import { checkPartnerNoVerifiedSocialLinks } from "@/lib/api/fraud/rules/check-partner-no-verified-social-links";
+import { getPartnerApplicationRisks } from "@/lib/api/fraud/get-partner-application-risks";
 import { getDefaultProgramIdOrThrow } from "@/lib/api/programs/get-default-program-id-or-throw";
 import { getProgramEnrollmentOrThrow } from "@/lib/api/programs/get-program-enrollment-or-throw";
 import { withWorkspace } from "@/lib/auth";
-import { getHighestSeverity } from "@/lib/get-highest-severity";
-import { getPlanCapabilities } from "@/lib/plan-capabilities";
-import { ExtendedFraudRuleType } from "@/lib/types";
 import { NextResponse } from "next/server";
 
 // GET /api/partners/:partnerId/application-risks - get application risks for a partner
-export const GET = withWorkspace(async ({ workspace, params }) => {
-  const { partnerId } = params;
-  const programId = getDefaultProgramIdOrThrow(workspace);
-
-  const { partner } = await getProgramEnrollmentOrThrow({
-    partnerId,
-    programId,
-    include: {
-      partner: true,
-    },
-  });
+export const GET = withWorkspace(
+  async ({ workspace, params }) => {
+    const { partnerId } = params;
+    const programId = getDefaultProgramIdOrThrow(workspace);
+
+    const { partner } = await getProgramEnrollmentOrThrow({
+      partnerId,
+      programId,
+      include: {
+        partner: true,
+      },
+    });
 
-  const { hasCrossProgramBan, hasDuplicatePayoutMethod } =
-    await getPartnerHighRiskSignals({
+    const { risksDetected, riskSeverity } = await getPartnerApplicationRisks({
       program: { id: programId },
       partner,
     });
 
-  const risksDetected: Partial<Record<ExtendedFraudRuleType, boolean>> = {
-    partnerCrossProgramBan: hasCrossProgramBan,
-    partnerDuplicatePayoutMethod: hasDuplicatePayoutMethod,
-    partnerEmailDomainMismatch: checkPartnerEmailDomainMismatch(partner),
-    partnerEmailMasked: checkPartnerEmailMasked(partner),
-    partnerNoSocialLinks: checkPartnerNoSocialLinks(partner),
-    partnerNoVerifiedSocialLinks: checkPartnerNoVerifiedSocialLinks(partner),
-  };
-
-  const detectedRisksInfo = FRAUD_RULES.filter((rule) => {
-    return risksDetected[rule.type] === true;
-  });
-
-  const { canManageFraudEvents } = getPlanCapabilities(workspace.plan);
-
-  // Calculate the highest severity level from all detected risks
-  const riskSeverity = getHighestSeverity(detectedRisksInfo);
-
-  // Return the response with risksDetected only if the workspace has fraud management capabilities,
-  // otherwise return an empty object to hide sensitive fraud detection details
-  return NextResponse.json({
-    risksDetected: canManageFraudEvents ? risksDetected : {},
-    riskSeverity,
-  });
-});
+    return NextResponse.json({
+      risksDetected,
+      riskSeverity,
+    });
+  },
+  {
+    requiredPlan: ["advanced", "enterprise"],
+  },
+);
diff --git a/...pp/app.dub.co/(dashboard)/[slug]/(ee)/program/partners/applications/applications-menu.tsx b/...pp/app.dub.co/(dashboard)/[slug]/(ee)/program/partners/applications/applications-menu.tsx
@@ -1,20 +1,15 @@
 "use client";
 
-import { updateAutoApprovePartnersAction } from "@/lib/actions/partners/update-auto-approve-partners";
-import { mutatePrefix } from "@/lib/swr/mutate";
 import useProgram from "@/lib/swr/use-program";
 import useWorkspace from "@/lib/swr/use-workspace";
 import { DEFAULT_PARTNER_GROUP } from "@/lib/zod/schemas/groups";
-import { useConfirmModal } from "@/ui/modals/confirm-modal";
 import { useExportApplicationsModal } from "@/ui/modals/export-applications-modal";
 import { ThreeDots } from "@/ui/shared/icons";
-import { Button, LoadingSpinner, Popover, UserCheck, UserXmark } from "@dub/ui";
+import { Button, Popover, UserCheck, UserXmark } from "@dub/ui";
 import { Download } from "@dub/ui/icons";
-import { useAction } from "next-safe-action/hooks";
 import Link from "next/link";
 import { useRouter } from "next/navigation";
 import { useState } from "react";
-import { toast } from "sonner";
 
 export function ApplicationsMenu() {
   const router = useRouter();
@@ -24,55 +19,11 @@ export function ApplicationsMenu() {
 
   const [isOpen, setIsOpen] = useState(false);
 
-  const { executeAsync: updateAutoApprove, isPending: isUpdatingAutoApprove } =
-    useAction(updateAutoApprovePartnersAction, {
-      onError: ({ error }) => {
-        toast.error(error.serverError);
-      },
-      onSuccess: ({ input }) => {
-        toast.success(
-          `Auto-approve ${input.autoApprovePartners ? "enabled" : "disabled"}`,
-        );
-        mutatePrefix(["/api/partners", "/api/programs"]);
-      },
-    });
-
-  const {
-    confirmModal: confirmEnableAutoApproveModal,
-    setShowConfirmModal: setShowConfirmEnableAutoApproveModal,
-  } = useConfirmModal({
-    title: "Confirm auto-approve",
-    description: "New applications will be automatically approved.",
-    onConfirm: async () => {
-      await updateAutoApprove({
-        workspaceId: workspaceId!,
-        autoApprovePartners: true,
-      });
-    },
-  });
-
-  const {
-    confirmModal: confirmDisableAutoApproveModal,
-    setShowConfirmModal: setShowConfirmDisableAutoApproveModal,
-  } = useConfirmModal({
-    title: "Disable auto-approve",
-    description:
-      "Future applications will no longer be automatically approved.",
-    onConfirm: async () => {
-      await updateAutoApprove({
-        workspaceId: workspaceId!,
-        autoApprovePartners: false,
-      });
-    },
-  });
-
   const { setShowExportApplicationsModal, ExportApplicationsModal } =
     useExportApplicationsModal();
 
   return (
     <>
-      {confirmEnableAutoApproveModal}
-      {confirmDisableAutoApproveModal}
       <ExportApplicationsModal />
       <Popover
         openPopover={isOpen}
@@ -139,14 +90,8 @@ export function ApplicationsMenu() {
           type="button"
           className="h-8 whitespace-nowrap px-2"
           variant="secondary"
-          disabled={isUpdatingAutoApprove || !program}
-          icon={
-            isUpdatingAutoApprove ? (
-              <LoadingSpinner className="size-4 shrink-0" />
-            ) : (
-              <ThreeDots className="size-4 shrink-0" />
-            )
-          }
+          disabled={!program}
+          icon={<ThreeDots className="size-4 shrink-0" />}
         />
       </Popover>
     </>

diff --git a/apps/web/lib/actions/partners/update-auto-approve-partners.ts b/apps/web/lib/actions/partners/update-auto-approve-partners.ts