Admin Dashboard

Copyexport const getDubAdminRole = async (userId: string) => {
  const response = await prisma.projectUsers.findUnique({
    where: {
      userId_projectId: {
        userId,
        projectId: DUB_WORKSPACE_ID,
      },
    },
    select: {
      role: true,
    },
  });
 
  if (!response) {
    return null;
  }
  return response.role;
};

Copyexport const withAdmin =
  (
    handler: WithAdminHandler,
    { requiredRoles = [] }: { requiredRoles?: WorkspaceRole[] } = {},
  ) =>
  async (
    req: Request,
    { params: initialParams }: { params: Promise<Record<string, string>> },
  ) => {
    const params = (await initialParams) || {};
    const session = await getSession();
    if (!session?.user) {
      return new Response("Unauthorized: Login required.", { status: 401 });
    }
 
    const adminRole = await getDubAdminRole(session.user.id);
    if (!adminRole) {
      return new Response("Unauthorized: Not an admin.", { status: 401 });
    }
 
    if (requiredRoles.length > 0 && !requiredRoles.includes(adminRole)) {
      return new Response(
        `Unauthorized: Missing required admin role(s): ${requiredRoles.join(", ")}.`,
        { status: 403 },
      );
    }
 
    if (
      !canAccessAdminApiPath({
        userId: session.user.id,
        pathname: new URL(req.url).pathname,
      })
    ) {
      return new Response("Unauthorized: You don't have access to this page.", {
        status: 403,
      });
    }
 

Copyexport async function AdminMiddleware(req: NextRequest) {
  const { path } = parse(req);
 
  const user = await getUserViaToken(req);
 
  if (!user && path !== "/login") {
    return NextResponse.redirect(new URL("/login", req.url));
  } else if (user) {
    const isAdminUser = await prismaEdge.projectUsers.findUnique({
      where: {
        userId_projectId: {
          userId: user.id,
          projectId: DUB_WORKSPACE_ID,
        },
      },
    });
 
    if (!isAdminUser) {
      return NextResponse.next(); // throw 404 page
    } else if (
      path === "/login" ||
      !canAccessAdminPath({ userId: user.id, pathname: path })
    ) {
      return NextResponse.redirect(new URL("/", req.url));
    }
  }
 
  return NextResponse.rewrite(
    new URL(`/admin.dub.co${path === "/" ? "" : path}`, req.url),
  );

Copyconst matchesPath = (pathname: string, paths: string[]) =>
  paths.some((p) => pathname === p || pathname.startsWith(`${p}/`));
 
export const isAdminAccessRestricted = (userId?: string | null): boolean =>
  !!userId && ADMIN_ACCESS_BLOCKLIST.includes(userId);
 
export const canAccessAdminPath = ({
  userId,
  pathname,
}: {
  userId?: string | null;
  pathname: string;
}): boolean =>
  !isAdminAccessRestricted(userId) ||
  !matchesPath(pathname, ADMIN_RESTRICTED_PATHS);
 
export const canAccessAdminApiPath = ({
  userId,
  pathname,
}: {
  userId?: string | null;
  pathname: string;
}): boolean =>
  !isAdminAccessRestricted(userId) ||
  !matchesPath(pathname, ADMIN_RESTRICTED_API_PATHS);

Copyconst visibleTabs = useMemo(
  () =>
    status === "loading"
      ? []
      : tabs.filter((tab) =>
          canAccessAdminPath({
            userId: session?.user?.id,
            pathname: tab.href,
          }),
        ),
  [status, session?.user?.id],
);

Copyexport function ImpersonateUser() {
  const [data, setData] = useState<UserInfoProps | null>(null);
  const [blockEmailDomain, setBlockEmailDomain] = useState(false);
 
  return (
    <div className="flex flex-col space-y-5">
      <form
        action={async (formData) => {
          await fetch("/api/admin/impersonate", {
            method: "POST",
            body: JSON.stringify({
              query: formData.get("query"),
            }),
          }).then(async (res) => {
            if (res.ok) {
              setBlockEmailDomain(false);
              setData(await res.json());
            } else {
              const error = await res.text();
              toast.error(error);
            }
          });
        }}
      >
        <Form />
      </form>
      {data ? (
        <form
          action={async () => {
            const emailDomain = data.email.split("@")[1];
            const blockDomainMessage = blockEmailDomain
              ? ` and block signups from @${emailDomain}`
              : "";
 
            if (
              !confirm(
                `This will ban the user ${data.email} and delete all their workspaces and links${blockDomainMessage}. Are you sure?`,
              )
            ) {
              return;
            }
            await fetch("/api/admin/ban", {
              method: "POST",
              body: JSON.stringify({
                email: data.email,
                blockEmailDomain,
              }),
            }).then(async (res) => {
              if (res.ok) {
                toast.success("User has been banned");
              } else {
                const error = await res.text();
                toast.error(error);
              }
            });
          }}
        >
          <UserInfo data={data} />
          <label className="mt-4 flex cursor-pointer items-center gap-2 text-sm text-neutral-600">
            <input
              type="checkbox"
              checked={blockEmailDomain}
              onChange={(e) => setBlockEmailDomain(e.target.checked)}
              className="rounded border-neutral-300 text-neutral-900 focus:ring-neutral-500"
            />
            Also block signups from @{data.email.split("@")[1]}
          </label>
          <div className="mt-4">
            <BanButton />
          </div>
        </form>
      ) : (
        <UserInfoSkeleton />
      )}
    </div>
  );
}

Copyconst userSelect = {
  email: true,
  projects: {
    select: {
      project: {
        select: {
          id: true,
          name: true,
          slug: true,
          plan: true,
          planPeriod: true,
          trialEndsAt: true,
          defaultProgramId: true,
          partnersUsage: true,
          totalClicks: true,
          totalLinks: true,
          programs: {
            select: {
              id: true,
              slug: true,
              url: true,
            },
          },
        },
      },
    },
    orderBy: {
      project: {
        totalClicks: "desc",
      },
    },
  },
  partners: {
    select: {
      partner: {
        select: {
          programs: {
            select: {
              program: {
                select: {
                  id: true,
                  name: true,
                  slug: true,
                },
              },
              status: true,
              totalClicks: true,
              totalLeads: true,
              totalConversions: true,
              totalSaleAmount: true,
              totalCommissions: true,
            },
            orderBy: {
              totalCommissions: "desc",
            },
          },
        },
      },
    },
  },
} satisfies Prisma.UserSelect;

Copy// Tracks emails signing in via admin impersonation links. Populated in
// CustomPrismaAdapter.useVerificationToken before the token is deleted.
const pendingAdminImpersonations = new Set<string>();
 
export const markAdminImpersonation = (email: string) => {
  pendingAdminImpersonations.add(email.toLowerCase());
};
 
export const consumeAdminImpersonation = (email: string) => {
  const isAdminImpersonation = pendingAdminImpersonations.has(
    email.toLowerCase(),
  );
 
  if (isAdminImpersonation) {
    pendingAdminImpersonations.delete(email.toLowerCase());
  }
 
  return isAdminImpersonation;
};

Copy// GET /api/admin/links
export const GET = withAdmin(async ({ searchParams }) => {
  const {
    domain,
    search,
    sort = "createdAt",
    page,
  } = searchParams as {
    domain?: string;
    search?: string;
    sort?: "createdAt" | "clicks" | "lastClicked";
    page?: string;
  };
 

Copyconst handleAction = async (action: "disable" | "restore", slug: string) => {
  const message =
    action === "disable"
      ? `Are you sure you want to disable all links for workspace "${slug}"? This will also downgrade owners to billing and members to viewer, and notify workspace owners by email.`
      : `Are you sure you want to restore all links for workspace "${slug}"? This will also revert billing users to owner and viewers to member.`;
 
  if (!window.confirm(message)) return;
 
  setPending(action);
  try {
    const res = await fetch(`/api/admin/workspaces/${action}`, {
      method: "POST",
      body: JSON.stringify({ slug }),
    });
 
    if (res.ok) {
      toast.success(
        action === "disable"
          ? "Workspace links disabled"
          : "Workspace links restored",
      );
    } else {
      const error = await res.text();
      toast.error(error || "Something went wrong. Please try again.");
    }
  } catch {
    toast.error("Network error. Please check your connection and try again.");
  } finally {
    setPending(null);
  }
};

Copyreturn (
  <div>
    <h3 className="text-content-emphasis text-sm font-semibold">
      Duplicate partner accounts
    </h3>
    <p className="mt-1 text-sm text-neutral-500">
      These accounts likely match this applicant by email or profile details.
    </p>

Copy// POST /api/admin/partners/trusted
export const POST = withAdmin(
  async ({ req }) => {
    const { partnerIdOrEmail } = z
      .object({
        partnerIdOrEmail: z.string().trim().min(1),
      })
      .parse(await req.json());
 
    if (
      !partnerIdOrEmail.startsWith("pn_") &&
      !partnerIdOrEmail.includes("@")
    ) {
      return new Response("Invalid partner ID or email.", { status: 400 });
    }
 

Copy<AddProgramModal
  showModal={showAddProgramModal}
  setShowModal={setShowAddProgramModal}
  programSlug={newProgramSlug}
  setProgramSlug={setNewProgramSlug}
  isLoading={isAddingProgram}
  onAdd={async () => {
    if (!newProgramSlug.trim()) return;
 
    setIsAddingProgram(true);
    const res = await fetch("/api/admin/programs", {
      method: "POST",
      headers: {
        "Content-Type": "application/json",
      },
      body: JSON.stringify({
        programSlug: newProgramSlug.trim(),
      }),
    });
 
    if (!res.ok) {
      setIsAddingProgram(false);
      toast.error((await res.text()) || "Failed to add program.");
      return;
    }
 
    await mutate();
    setIsAddingProgram(false);
    setShowAddProgramModal(false);
    setNewProgramSlug("");
    toast.success("Program added to marketplace.");
  }}
/>

Copy  <h2 className="text-xl font-semibold">Reset Login Attempts</h2>
  <p className="text-sm text-neutral-500">
    Reset a user's invalidLoginAttempts and lockedAt fields
  </p>
  <ResetLoginAttempts />
</div>
<div className="flex flex-col space-y-4 px-5 py-10">
  <h2 className="text-xl font-semibold">Slack Support Invite</h2>
  <p className="text-sm text-neutral-500">
    Manually send a priority Slack Connect invite to a user for a given
    workspace (bypasses the plan check).
  </p>
  <SlackSupportInvite />
</div>

Copyexport const withAdmin =
  (
    handler: WithAdminHandler,
    { requiredRoles = [] }: { requiredRoles?: WorkspaceRole[] } = {},
  ) =>
  async (
    req: Request,
    { params: initialParams }: { params: Promise<Record<string, string>> },
  ) => {
    const params = (await initialParams) || {};
    const session = await getSession();
    if (!session?.user) {
      return new Response("Unauthorized: Login required.", { status: 401 });
    }
 
    const adminRole = await getDubAdminRole(session.user.id);
    if (!adminRole) {
      return new Response("Unauthorized: Not an admin.", { status: 401 });
    }
 
    if (requiredRoles.length > 0 && !requiredRoles.includes(adminRole)) {
      return new Response(
        `Unauthorized: Missing required admin role(s): ${requiredRoles.join(", ")}.`,
        { status: 403 },
      );
    }

Copy{isDubProvisioned && (
  <Button
    text={
      !autoRenew ? "Enable Auto-Renew" : "Disable Auto-Renew"
    }
    variant="outline"
    onClick={() => {
      setOpenPopover(false);
      openDomainRenewalModal(!autoRenew);
    }}
    icon={
      <Repeat
        className={cn(
          "h-4 w-4",
          !autoRenew ? "text-green-600" : "text-red-600",
        )}
      />
    }
    className="h-9 justify-start px-2 font-medium"
  />
)}
 
{!primary && (
  <Button
    text="Set as Primary"
    variant="outline"
    onClick={() => {
      setOpenPopover(false);
      setShowPrimaryDomainModal(true);
    }}
    icon={<Flag2 className="h-4 w-4" />}
    className="h-9 justify-start px-2 font-medium"
  />
)}
{canSetAsProgramDomain && (
  <Button
    text="Set Program Domain"
    variant="outline"
    onClick={() => {
      setOpenPopover(false);
      setShowChangeDomainModal(true);
    }}
    icon={<ConnectedDots4 className="h-4 w-4" />}
    className="h-9 justify-start px-2 font-medium"
  />
)}
{!isDubProvisioned && (
  <Button
    text="Transfer"
    variant="outline"
    onClick={() => {
      setOpenPopover(false);
      setShowTransferDomainModal(true);
    }}
    icon={<FolderInput className="h-4 w-4" />}
    className="h-9 justify-start px-2 font-medium"
    disabledTooltip={
      primary && activeDomainsCount > 1
        ? "You cannot transfer your workspace's primary domain. Set another domain as primary to transfer this domain."
        : undefined
    }
  />
)}
<Button
  text={archived ? "Unarchive" : "Archive"}
  variant="outline"
  onClick={() => {
    setOpenPopover(false);
    setShowArchiveDomainModal(true);
  }}
  icon={<Archive className="h-4 w-4" />}
  className="h-9 justify-start px-2 font-medium"
  disabledTooltip={permissionsError || undefined}
/>
{!isDubProvisioned && (
  <Button
    text="Delete"
    variant="danger-outline"
    onClick={() => {
      setOpenPopover(false);

Copyfetch(`/api/domains/default?workspaceId=${id}`, {
  method: "PATCH",
  body: JSON.stringify({
    defaultDomains: newDefaultDomains.filter(
      (d) => d !== null,
    ),
  }),
})
  .then(async (res) => {

Copyexport default function AdminAnalytics() {
  return (
    <Suspense fallback={<LayoutLoader />}>
      <div className="w-full">
        <Analytics adminPage />
      </div>
    </Suspense>
  );