Fraud Prevention

Copy// we don't support .php links (too much bot traffic)
// hence we redirect to the root domain and add `dub-no-track` header to avoid tracking bot traffic
if (isUnsupportedKey(key)) {
  return NextResponse.redirect(new URL("/?dub-no-track=1", req.url), {
    headers: {
      ...DUB_HEADERS,
      "X-Robots-Tag": "googlebot: noindex",
    },
    status: 302,
  });
}

Copy// if we need to cache the clickId, check if clickId is cached in Redis
if (shouldCacheClickId) {
  const identityHash = await getIdentityHash(req);
  clickId =
    (await recordClickCache
      .get({ domain, key, identityHash })
      .catch(() => undefined)) || undefined;
}

Copyexport async function getProgramApplicationRisks({
  program,
  partner,
}: {
  program: Pick<Program, "id">;
  partner: Pick<PartnerProps, "id" | "email" | "country" | "platforms">;
}) {
  const fraudGroups = await prisma.fraudEventGroup.findMany({
    where: {
      programId: program.id,
      partnerId: partner.id,
      status: "pending",
      type: {
        in: ["partnerCrossProgramBan", "partnerDuplicateAccount"],
      },
    },
  });
 
  const hasCrossProgramBan = fraudGroups.some(
    (group) => group.type === "partnerCrossProgramBan",
  );
 
  const hasDuplicateAccounts = fraudGroups.some(
    (group) => group.type === "partnerDuplicateAccount",
  );
 
  const risksDetected: Partial<Record<ExtendedFraudRuleType, boolean>> = {
    partnerCrossProgramBan: hasCrossProgramBan,
    partnerDuplicateAccount: hasDuplicateAccounts,
    partnerEmailDomainMismatch: checkPartnerEmailDomainMismatch(partner),
    partnerEmailMasked: checkPartnerEmailMasked(partner),
    partnerNoSocialLinks: checkPartnerNoSocialLinks(partner),
    partnerNoVerifiedSocialLinks: checkPartnerNoVerifiedSocialLinks(partner),
  };

Copyexport function useProgramApplicationRisks({
  filters,
  enabled = true,
}: {
  filters: { partnerId: string | null | undefined };
  enabled?: boolean;
}) {
  const { id: workspaceId } = useWorkspace();
  const { partnerId } = filters;
 
  const { data, isLoading, error } = useSWRImmutable<FraudRisksResponse>(
    enabled && partnerId && workspaceId
      ? `/api/partners/${partnerId}/application-risks?workspaceId=${workspaceId}`
      : null,
    fetcher,
  );
 
  const { risksDetected, riskSeverity } = data || {};
 
  const triggeredFraudRules = useMemo(() => {
    if (!risksDetected) return [];
 
    return FRAUD_RULES.filter((rule) => {
      return risksDetected[rule.type] === true;
    });
  }, [risksDetected]);
 
  return {
    risks: risksDetected,
    triggeredFraudRules,
    severity: riskSeverity,
    isLoading,
    error,
  };

Copy  const { canManageFraudEvents } = getPlanCapabilities(plan);
 
  if (isLoading || triggeredFraudRules.length === 0) {
    return null;
  }
 
  if (!canManageFraudEvents) {
    return <ProgramApplicationRiskSummaryUpsell />;
  }
 
  return (
    <>
      <div className="flex flex-col gap-4 p-4">
        <div className="flex items-center justify-between">
          <h3 className="text-content-emphasis text-sm font-semibold">
            Risk analysis
          </h3>
 
          <Button
            type="button"
            text="View"
            variant="secondary"
            onClick={() => setShowModal(true)}
            className="h-6 w-fit px-1.5 py-2"
          />
        </div>
 
        <ProgramApplicationFraudSeverityIndicator severity={severity} />
 
        <ul className="space-y-2">
          {triggeredFraudRules.map((rule) => {
            if (!rule.severity) return null;
 
            return (
              <li key={rule.type} className="flex items-center gap-2">
                <div
                  className={cn(
                    "size-2 shrink-0 rounded-full",
                    FRAUD_SEVERITY_CONFIG[rule.severity].bg,
                  )}
                />
                <span className="text-xs font-medium leading-4 text-neutral-700">
                  {rule.name}
                </span>
              </li>
            );
          })}
        </ul>
      </div>
 
      <ProgramApplicationRiskSummaryModal />
    </>
  );
}

Copylet veriffSessionIds = riskLabels
  .filter(({ label }) => veriffRiskLabels.includes(label as VeriffRiskLabel))
  .map(({ sessionIds }) => sessionIds)
  .flat();
 
// Add the current veriff session id to the list
veriffSessionIds.push(veriffSessionId);
 
// Remove duplicates
veriffSessionIds = [...new Set(veriffSessionIds)];
 
if (veriffSessionIds.length === 0) {
  console.log(
    "[detectDuplicateIdentityFraud] No veriff session ids provided.",
  );
  return;
}

Copylet programEnrollments = await prisma.programEnrollment.findMany({
  where: {
    partner: {
      veriffSessionId: {
        in: veriffSessionIds,
      },
    },
  },
  select: {
    programId: true,
    partnerId: true,
    status: true,
    riskMonitoringDisabledAt: true,
    program: {
      select: {
        fraudRules: true,
      },
    },
  },
});
 
if (programEnrollments.length === 0) {
  console.log("[detectDuplicateIdentityFraud] No program enrollments found.");
  return;
}
 
// Filter out program enrollments where the partnerDuplicateAccount rule is disabled
programEnrollments = programEnrollments.filter((enrollment) =>
  isFraudRuleEnabled({
    fraudRules: enrollment.program.fraudRules,
    ruleType: FraudRuleType.partnerDuplicateAccount,
  }),
);

Copytype DetectDuplicatePayoutMethodFraudOptions =
  | { payoutMethodHash: string; cryptoWalletAddress?: never }
  | { cryptoWalletAddress: string; payoutMethodHash?: never };
 
// Check for duplicate payout methods: if multiple partners share the same payout method hash,
// create fraud events for all their active program enrollments to flag potential fraud
export async function detectDuplicatePayoutMethodFraud({
  payoutMethodHash,
  cryptoWalletAddress,
}: DetectDuplicatePayoutMethodFraudOptions) {
  if (!payoutMethodHash && !cryptoWalletAddress) {
    return;
  }

Copylet programEnrollments = await prisma.programEnrollment.findMany({
  where: {
    partner: {
      OR: [
        ...(payoutMethodHash ? [{ payoutMethodHash }] : []),
        ...(cryptoWalletAddress ? [{ cryptoWalletAddress }] : []),
      ],
    },
  },
  select: {
    programId: true,
    partnerId: true,
    status: true,
    riskMonitoringDisabledAt: true,
    program: {
      select: {
        fraudRules: true,
      },
    },
  },
});
 
if (programEnrollments.length === 0) {
  return;
}
 
// Filter out program enrollments where the partnerDuplicateAccount rule is disabled
programEnrollments = programEnrollments.filter((enrollment) =>
  isFraudRuleEnabled({
    fraudRules: enrollment.program.fraudRules,
    ruleType: FraudRuleType.partnerDuplicateAccount,
  }),
);

Copyfor (const [programId, partners] of partnersByProgram.entries()) {
  for (const sourcePartner of partners) {
    // Skip if the partner is inactive or risk detection is disabled
    if (
      INACTIVE_ENROLLMENT_STATUSES.includes(sourcePartner.status) ||
      sourcePartner.riskMonitoringDisabledAt
    ) {
      continue;
    }
 
    for (const enrolledPartner of partners) {
      fraudEvents.push({
        programId,
        partnerId: sourcePartner.partnerId,
        type: FraudRuleType.partnerDuplicateAccount,
        metadata: {
          duplicatePartnerId: enrolledPartner.partnerId,
          riskLabels,
        },
      });
    }
  }
}

Copyconst { affectedGroups } = await createFraudEvents(fraudEvents);
 
const results = await Promise.allSettled([
  holdPendingCommissions(affectedGroups),
  holdProcessedCommissions(affectedGroups),
]);
results
  .filter((r): r is PromiseRejectedResult => r.status === "rejected")
  .forEach((r) => console.error("Failed to hold commissions:", r.reason));

Copyexport const startIdentityVerificationAction = authPartnerActionClient.action(
  async ({ ctx }) => {
    const { partner, partnerUser } = ctx;
 
    throwIfNoPermission({
      role: partnerUser.role,
      permission: "partner_profile.update",
    });
 
    if (partner.identityVerificationStatus) {
      switch (partner.identityVerificationStatus) {
        case "approved":
          throw new Error(
            "Your identity has already been verified. No further action is required.",
          );
        case "submitted":
        case "review":
          throw new Error(
            "A verification attempt is already in progress. Please wait for it to complete or resubmit.",
          );
      }
    }

Copyconst veriffMetadata = parseVeriffMetadata(partner.veriffMetadata);
 
if (
  veriffMetadata.attemptCount >= MAX_PARTNER_IDENTITY_VERIFICATION_ATTEMPTS
) {
  throw new Error(
    "You've reached the maximum number of identity verification attempts. Please contact support: https://dub.co/support",
  );
}

Copyawait assertRateLimit({
  policy: RATELIMIT_POLICIES.identityVerificationStart,
  identifier: partner.id,
});
 
// Create a new session
const { verification } = await createVeriffSession({
  partner,
});
 
await prisma.partner.update({
  where: {
    id: partner.id,
  },
  data: {
    veriffSessionId: verification.id,
    veriffMetadata: mergeVeriffMetadata(partner.veriffMetadata, {
      sessionUrl: verification.url,
      sessionExpiresAt: addDays(new Date(), 7),
    }),
  },
});
 
return {
  sessionUrl: verification.url,
};

Copyconst { executeAsync, isPending } = useAction(
  startIdentityVerificationAction,
  {
    onError: ({ error }) => {
      toast.error(
        parseActionError(error, "Failed to start identity verification."),
      );
    },
    onSuccess: async ({ data }) => {
      const { createVeriffFrame, MESSAGES } = await import(
        "@veriff/incontext-sdk"
      );
 
      createVeriffFrame({
        url: data.sessionUrl,
        onEvent: (msg) => {
          if (msg === MESSAGES.FINISHED) {
            toast.success(
              "Verification submitted. We'll update your status shortly.",
            );
            mutate();
          }
        },
      });
 
      mutate();
    },
  },
);

Copyconst handleGenerateSession = async () => {
  const requestPartnerId = partner.id;
  setIsGeneratingSession(true);
 
  try {
    const response = await fetch(
      `/api/admin/partners/${requestPartnerId}/generate-veriff-session`,
      {
        method: "POST",
      },
    );
 
    if (!response.ok) {
      throw new Error(
        (await response.text()) || "Failed to generate Veriff session.",
      );
    }
 
    const { sessionUrl: url } = (await response.json()) as {
      sessionUrl: string;
    };
 
    if (partnerIdRef.current !== requestPartnerId) {
      return;
    }
 
    setSessionUrl(url);
    toast.success("Veriff session generated.");
  } catch (error) {
    if (partnerIdRef.current !== requestPartnerId) {
      return;
    }
 
    toast.error(
      error instanceof Error
        ? error.message
        : "Failed to generate Veriff session.",
    );
  } finally {
    if (partnerIdRef.current === requestPartnerId) {
      setIsGeneratingSession(false);
    }
  }
};
 
const handleVerifyIdentity = async () => {
  const requestPartnerId = partner.id;
  setIsVerifyingIdentity(true);
 
  try {
    const response = await fetch(
      `/api/admin/partners/${requestPartnerId}/verify-identity`,
      {
        method: "POST",
      },
    );
 
    if (!response.ok) {
      throw new Error(
        (await response.text()) || "Failed to verify partner identity.",
      );
    }
 
    if (partnerIdRef.current !== requestPartnerId) {
      return;
    }
 
    toast.success("Partner identity verified.");
  } catch (error) {
    if (partnerIdRef.current !== requestPartnerId) {
      return;
    }
 
    toast.error(
      error instanceof Error
        ? error.message
        : "Failed to verify partner identity.",
    );
  } finally {
    if (partnerIdRef.current === requestPartnerId) {
      setIsVerifyingIdentity(false);
    }
  }
};

Copyconst holdEligibleWhere: Prisma.CommissionWhereInput = {
  status: CommissionStatus.pending,
  earnings: {
    gt: 0,
  },
  program: {
    workspace: {
      plan: {
        in: ["enterprise", "advanced"],
      },
    },
  },
};

Copyconst holdEligibleWhere: Prisma.CommissionWhereInput = {
  status: CommissionStatus.processed,
  payout: {
    status: PayoutStatus.pending,
  },
  earnings: {
    gt: 0,
  },
  program: {
    workspace: {
      plan: {
        in: ["enterprise", "advanced"],
      },
    },
  },
};

Copyconst BATCH_SIZE = 50;
 
type PartnerLevelFraudRule = (typeof PARTNER_LEVEL_FRAUD_RULES)[number];
type CustomerLevelFraudRule = (typeof CUSTOMER_LEVEL_FRAUD_RULES)[number];
 
const holdEligibleWhere: Prisma.CommissionWhereInput = {
  status: CommissionStatus.pending,
  earnings: {
    gt: 0,
  },
  program: {
    workspace: {
      plan: {
        in: ["enterprise", "advanced"],
      },
    },
  },
};

Copy// Activity logs are scoped to a workspace + program, so batch by program.
const commissionsByProgram = groupBy(heldCommissions, (c) => c.programId);
 
for (const commissions of Object.values(commissionsByProgram)) {
  const { id: programId, workspaceId } = commissions[0].program;
 
  await trackCommissionStatusUpdate({
    workspaceId,
    programId,
    commissions,
    newStatus: CommissionStatus.hold,
  });
}
 
const affectedPairs = [
  ...new Map(
    heldCommissions.map((c) => [
      `${c.programId}:${c.partnerId}`,
      { programId: c.programId, partnerId: c.partnerId },
    ]),
  ).values(),
];
 
await Promise.all(
  affectedPairs.map(({ programId, partnerId }) =>
    syncTotalCommissions({
      programId,
      partnerId,
    }),
  ),
);

Copyexport default function FraudRiskLayout({ children }: { children: ReactNode }) {
  const { plan, loading } = useWorkspace();
 
  if (loading) {
    return <LayoutLoader />;
  }
 
  const { canManageFraudEvents } = getPlanCapabilities(plan);
 
  if (!canManageFraudEvents) {
    return <RiskCenterUpsell />;
  }
 
  return children;
}

Copyexport function RiskDisclaimerBanner({ className }: { className?: string }) {
  return (
    <Callout variant="warn" size={2} className={className}>
      We recommend reviewing the risk events thoroughly before taking action.
      Unresolved events expire after 30 days, except confirmed network-level
      bans.{" "}
      <a
        href="https://dub.co/help/article/risk-monitoring"
        target="_blank"
        className="font-medium underline underline-offset-2 transition-colors hover:text-neutral-800"
      >
        Learn more
      </a>
    </Callout>
  );
}

Copy// Rules that have dedicated settings components with complex config UI
const RULES_WITH_CUSTOM_UI = new Set([
  "paidTrafficDetected",
  "referralSourceBanned",
]);
 
// Toggle-only rules rendered via the generic RiskRuleToggleSettings component
const TOGGLE_ONLY_RULES = CONFIGURABLE_FRAUD_RULES.filter(
  (rule): rule is FraudRuleInfo & { type: keyof UpdateFraudRuleSettings } =>
    !RULES_WITH_CUSTOM_UI.has(rule.type),
);
 
interface RiskRulesSheetProps {
  setIsOpen: Dispatch<SetStateAction<boolean>>;
}
 
function RiskRulesSheetContent({ setIsOpen }: RiskRulesSheetProps) {
  const { id: workspaceId } = useWorkspace();
  const { isSubmitting, makeRequest } = useApiMutation();
 
  const { data: fraudRules, isLoading } = useSWR<FraudRuleProps[]>(
    workspaceId ? `/api/fraud/rules?workspaceId=${workspaceId}` : null,
    fetcher,
  );
 
  const { setShowDisableModal, DisableRiskRulesModal } =
    useDisableRiskRulesModal({ setIsOpen });
 
  const form = useForm<UpdateFraudRuleSettings>({
    defaultValues: {
      referralSourceBanned: {
        enabled: false,
        config: { domains: [] },
      },
      paidTrafficDetected: {
        enabled: false,
        config: { platforms: [], google: { whitelistedCampaignIds: [] } },
      },
      ...Object.fromEntries(
        TOGGLE_ONLY_RULES.map((rule) => [rule.type, { enabled: true }]),
      ),
    },
  });

Copy  // Handle form submission
  const onSubmit = async (body: UpdateFraudRuleSettings) => {
    if (isLoading) {
      return;
    }
 
    // First submit if no previous data exists
    if (!fraudRules) {
      await submitForm(body);
      return;
    }
 
    // Detect rule disable transitions
    const rulesBeingDisabled = getRulesBeingDisabled({
      previousFraudRules: fraudRules,
      nextFraudRules: body,
    });
 
    // If any rules are being disabled, show confirmation modal
    if (rulesBeingDisabled.length > 0) {
      setShowDisableModal(true);
      return;
    }
 
    // Otherwise, submit directly
    await submitForm(body);
  };