apps/web/lib/zod/schemas/analytics.ts (3)

349-353: Drop optional() when using default() for sortBy

default() already makes the key optional-with-default in Zod. Small cleanup for clarity.

-    sortBy: z
-      .enum(["timestamp"])
-      .optional()
-      .default("timestamp")
+    sortBy: z.enum(["timestamp"]).default("timestamp")

---

331-335: Same cleanup for sortOrder: default() is enough

Removes redundant optional() for consistency with the sortBy change.

-const sortOrder = z
-  .enum(["asc", "desc"])
-  .default("desc")
-  .optional()
+const sortOrder = z.enum(["asc", "desc"]).default("desc")

---

337-357: Optional: enforce precedence between deprecated order and sortOrder

Today both exist; ambiguity can leak downstream. Consider normalizing in schema so sortOrder always wins, then fallback to order, then default.

 export const eventsQuerySchema = analyticsQuerySchema
   .omit({ groupBy: true })
   .extend({
@@
     order: sortOrder
       .describe("DEPRECATED. Use `sortOrder` instead.")
       .openapi({ deprecated: true }),
-  });
+  })
+  .transform((v) => ({
+    ...v,
+    sortOrder: v.sortOrder ?? v.order ?? "desc",
+  }));

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

apps/web/app/api/resend/webhook/route.ts (4)

10-11: Parse svix-signature robustly (support “v1,” and “v1=”).

The current split is brittle and fails if multiple versions are sent. Extract the first v1 signature via regex.

-  const svix_signature = req.headers.get("svix-signature")?.split("v1,")[1];
+  const rawSig = req.headers.get("svix-signature") || "";
+  const svix_signature = rawSig.match(/(?:^|,)\s*v1[=,]([^,]+)/)?.[1];

---

34-35: Guard JSON parsing to avoid 500s on bad payloads.

JSON.parse will throw on malformed JSON.

-  const {
-    data: { email, unsubscribed },
-  } = JSON.parse(rawBody) || {};
+  let email: string | undefined, unsubscribed: boolean | undefined;
+  try {
+    const parsed = JSON.parse(rawBody) || {};
+    ({ data: { email, unsubscribed } = {} } = parsed);
+  } catch {
+    return NextResponse.json({ message: "Invalid JSON" }, { status: 400 });
+  }

---

41-49: Avoid 500 on missing user record.

prisma.user.update throws if no row matches. Use updateMany or handle P2025.

-    await prisma.user.update({
+    await prisma.user.updateMany({
       where: {
         email,
       },
       data: {
         subscribed: !unsubscribed,
       },
     });

---

36-38: Reduce PII in logs.

Consider structured logs without raw emails, or gate behind an env flag.

apps/web/app/api/analytics/route.ts (3)

29-33: Eliminate ts-expect-error with a type guard.

Narrow oldEvent to a valid endpoint before reassignment; no suppression needed.

-    // @ts-expect-error FIXME zod transform error
-    if (!oldType && oldEvent && VALID_ANALYTICS_ENDPOINTS.includes(oldEvent)) {
+    const isAnalyticsEndpoint = (
+      s: unknown,
+    ): s is (typeof VALID_ANALYTICS_ENDPOINTS)[number] =>
+      typeof s === "string" &&
+      (VALID_ANALYTICS_ENDPOINTS as readonly string[]).includes(s as any);
+
+    if (!oldType && isAnalyticsEndpoint(oldEvent)) {
       oldType = oldEvent;
       oldEvent = undefined;
     }

---

53-57: Avoid reassignment with casts; derive effective params instead.

This sidesteps Zod-transform typing friction and keeps types intact without suppressions.

-    // @ts-expect-error FIXME
-    event = oldEvent || event;
-    // @ts-expect-error FIXME
-    groupBy = oldType || groupBy;
+    const effectiveEvent = (oldEvent ?? event);
+    const effectiveGroupBy = (oldType ?? groupBy);

---

120-133: Thread effective params through the call and timeseries check.

Use the derived variables to keep type consistency throughout.

-    const response = await getAnalytics({
-      ...parsedParams,
-      event,
-      groupBy,
+    const response = await getAnalytics({
+      ...parsedParams,
+      event: effectiveEvent,
+      groupBy: effectiveGroupBy,
       ...(link && { linkId: link.id }),
       folderIds,
       workspaceId: workspace.id,
       isMegaFolder: workspace.totalLinks > 1_000_000,
       isDeprecatedClicksEndpoint,
       // dataAvailableFrom is only relevant for timeseries groupBy
-      ...(groupBy === "timeseries" && {
+      ...(effectiveGroupBy === "timeseries" && {
         dataAvailableFrom: workspace.createdAt,
       }),
     });

Also applies to: 130-133

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro