Flag partner through the rejected application modal (dubinc#3866)

Co-authored-by: Steven Tey <stevensteel97@gmail.com>

Author: pepeladeira

apps/web/app/(ee)/api/partners/applications/reject/route.ts

@@ -7,15 +7,23 @@ import { NextResponse } from "next/server";
 // POST /api/partners/applications/reject – Reject a pending partner application
 export const POST = withWorkspace(
   async ({ workspace, req, session }) => {
-    const { partnerId, rejectionReason, rejectionNote, allowImmediateReapply } =
-      rejectPartnerSchema.parse(await parseRequestBody(req));
+    const {
+      partnerId,
+      rejectionReason,
+      rejectionNote,
+      allowImmediateReapply,
+      flagForFraud,
+      flagForFraudReason,
+    } = rejectPartnerSchema.parse(await parseRequestBody(req));
 
     await rejectPartner({
       workspace,
       partnerId,
       rejectionReason,
       rejectionNote,
       allowImmediateReapply,
+      flagForFraud,
+      flagForFraudReason,
       userId: session.user.id,
     });
 

apps/web/lib/actions/partners/reject-partner-application.ts

@@ -15,8 +15,14 @@ export const rejectPartnerApplicationAction = authActionClient
   .inputSchema(inputSchema)
   .action(async ({ parsedInput, ctx }) => {
     const { workspace, user } = ctx;
-    const { partnerId, rejectionReason, rejectionNote, allowImmediateReapply } =
-      parsedInput;
+    const {
+      partnerId,
+      rejectionReason,
+      rejectionNote,
+      allowImmediateReapply,
+      flagForFraud,
+      flagForFraudReason,
+    } = parsedInput;
 
     throwIfNoPermission({
       role: workspace.role,
@@ -29,6 +35,8 @@ export const rejectPartnerApplicationAction = authActionClient
       rejectionReason,
       rejectionNote,
       allowImmediateReapply,
+      flagForFraud,
+      flagForFraudReason,
       userId: user.id,
     });
   });

apps/web/lib/api/partners/applications/reject-partner.ts

@@ -24,10 +24,27 @@ export async function rejectPartner({
   rejectionReason,
   rejectionNote,
   allowImmediateReapply,
+  flagForFraud,
+  flagForFraudReason,
   userId,
 }: RejectPartnerInput) {
   const programId = getDefaultProgramIdOrThrow(workspace);
 
+  if (flagForFraud && allowImmediateReapply) {
+    throw new DubApiError({
+      code: "bad_request",
+      message:
+        "Cannot flag for fraud when allowing the partner to reapply immediately.",
+    });
+  }
+
+  if (flagForFraud && (!flagForFraudReason || !flagForFraudReason.trim())) {
+    throw new DubApiError({
+      code: "bad_request",
+      message: "Fraud reason is required when flagging for fraud.",
+    });
+  }
+
   const programEnrollment = await prisma.programEnrollment.findUnique({
     where: {
       partnerId_programId: {
@@ -111,6 +128,16 @@ export async function rejectPartner({
         discountId: null,
       },
     });
+
+    if (flagForFraud && flagForFraudReason) {
+      await tx.fraudAlert.create({
+        data: {
+          partnerId,
+          programId,
+          reason: flagForFraudReason,
+        },
+      });
+    }
   });
 
   const { partner, program } = programEnrollment;

apps/web/lib/zod/schemas/partners.ts

@@ -904,33 +904,71 @@ export const PROGRAM_APPLICATION_REJECTION_NOTE_MAX_LENGTH = 500;
 // Max length for optional `flagForFraudReason` on `FraudAlert`
 export const MAX_FRAUD_REASON_LENGTH = 2000;
 
-export const rejectPartnerSchema = z.object({
-  partnerId: z.string().describe("The ID of the partner to reject."),
-  rejectionReason: z
-    .enum(ProgramApplicationRejectionReason)
-    .optional()
-    .describe(
-      "The reason for rejecting the partner application. This will be shared with the partner via email.",
-    ),
-  rejectionNote: z
-    .string()
-    .max(PROGRAM_APPLICATION_REJECTION_NOTE_MAX_LENGTH)
-    .optional()
-    .transform((s) => {
-      const t = s?.trim();
-      return t === "" ? undefined : t;
-    })
-    .describe(
-      "Additional details about the rejection. This will be shared with the partner via email.",
-    ),
-  allowImmediateReapply: z
-    .boolean()
-    .optional()
-    .default(false)
-    .describe(
-      "When true, pending enrollment is removed so the partner can submit a new application immediately.",
-    ),
-});
+export const rejectPartnerSchema = z
+  .object({
+    partnerId: z.string().describe("The ID of the partner to reject."),
+    rejectionReason: z
+      .enum(ProgramApplicationRejectionReason)
+      .optional()
+      .describe(
+        "The reason for rejecting the partner application. This will be shared with the partner via email.",
+      ),
+    rejectionNote: z
+      .string()
+      .max(PROGRAM_APPLICATION_REJECTION_NOTE_MAX_LENGTH)
+      .optional()
+      .transform((s) => {
+        const t = s?.trim();
+        return t === "" ? undefined : t;
+      })
+      .describe(
+        "Additional details about the rejection. This will be shared with the partner via email.",
+      ),
+    allowImmediateReapply: z
+      .boolean()
+      .optional()
+      .default(false)
+      .describe(
+        "When true, pending enrollment is removed so the partner can submit a new application immediately.",
+      ),
+    flagForFraud: z
+      .boolean()
+      .optional()
+      .describe(
+        "Whether to flag the partner for fraud review by the Dub team. Cannot be combined with allowImmediateReapply.",
+      ),
+    flagForFraudReason: z
+      .string()
+      .max(MAX_FRAUD_REASON_LENGTH)
+      .optional()
+      .transform((s) => {
+        const t = s?.trim();
+        return t === "" ? undefined : t;
+      })
+      .describe(
+        "The reason for flagging the partner for fraud. Required when flagForFraud is true.",
+      ),
+  })
+  .superRefine((data, ctx) => {
+    if (data.allowImmediateReapply && data.flagForFraud) {
+      ctx.addIssue({
+        code: "custom",
+        message:
+          "Cannot flag for fraud when allowing the partner to reapply immediately.",
+        path: ["flagForFraud"],
+      });
+    }
+    if (
+      data.flagForFraud &&
+      (!data.flagForFraudReason || !data.flagForFraudReason.trim())
+    ) {
+      ctx.addIssue({
+        code: "custom",
+        message: "Fraud reason is required when flagging for fraud.",
+        path: ["flagForFraudReason"],
+      });
+    }
+  });
 
 export const bulkRejectPartnersSchema = z.object({
   workspaceId: z.string(),