$ show dubinc/dub
Dub is a commercial open-core link attribution, short-link, and affiliate/partner marketing platform. In production it runs as a multi-tenant Next.js application with three separate front-ends: a customer dashboard (app.dub.co), a partner portal (partners.dub.co), and an admin console (admin.dub.co). The core operational surface includes short-link creation and redirection, link and QR management, click/lead/sale tracking, webhooks, API tokens, domain management, and the full partner-program lifecycle: partner onboarding, applications, commissions, rewards, discount codes, payouts, bounties, groups, campaigns, fraud/risk rules, and identity verification. Analytics are product telemetry consumed through Tinybird, not a research/data-science pipeline, so the repository is best classified as an application despite its high data-event volume. The architecture is a pnpm/Turborepo monorepo centered on apps/web and shared packages such as @dub/ui, @dub/utils, @dub/email, @dub/embed-core, @dub/embed-react, a CLI, and HubSpot/Stripe app integrations. The backend uses Next.js App Router API routes and server actions, Prisma on MySQL/PlanetScale for transactional state, Upstash Redis/QStash for caching, rate limiting, and background job orchestration, and Tinybird for real-time analytics. Authentication combines NextAuth sessions, BoxyHQ SAML, workspace-scoped API tokens, and dedicated auth wrappers for workspace, partner, admin, and cron contexts. External systems—Stripe, PayPal, Shopify, HubSpot, Slack, Google Ads, Veriff, and many importers—are connected through webhooks, OAuth callbacks, and QStash-driven cron jobs. Primary entry points are the REST API routes under /api and /(ee)/api, attribution endpoints like /api/track/click and /api/track/sale, roughly one hundred scheduled /api/cron jobs, and a large server-action layer for dashboard mutations. Data flows from link redirects and conversion events into Tinybird, while workspace, program, partner, commission, and payout state persists in the relational database. Payout aggregation, commission generation, CSV/API exports, and fraud detection are executed as batched background jobs. The codebase is actively maintained but has grown organically. It is generally well-structured and typed, with strong use of Zod schemas, safe server actions, and reusable auth wrappers. However, it also carries legacy `(old)/projects` routes, deprecated API fields, duplicated importers and postback adapters, one-off migration scripts, and several hardcoded environment/program IDs, producing a medium level of technical drift.
The LLM identified 5 files worth highlighting for reuse:
A type-safe background job framework built on Upstash QStash. Jobs are declared with Zod input schemas, automatic retries, deduplication keys, and workflow dispatch. It abstracts queueing and execution concerns so business logic stays declarative, and the core could be extracted as a generic QStash job layer for other projects.
A reusable cursor and offset pagination builder used across list endpoints. It encodes next cursors, computes hasMore, enforces maximum limits, and normalizes pagination semantics. This is a self-contained utility that can be dropped into any TypeScript API to provide consistent pagination.
A typed client layer over Tinybird's HTTP ingest and query APIs, exposing helpers like buildPipe and buildIngestEndpoint and Zod-validated event records. It converts a raw HTTP analytics backend into a schema-checked data access layer and is portable to any Tinybird deployment.
The core engine for Dub's embeddable referral widgets, handling token-based authentication, iframe postMessage sizing, and dynamic content updates independently of the framework-specific wrapper. It demonstrates a clean separation between embed core logic and React bindings, making the core conceptually reusable for other embeddable products.
An abstract postback adapter base class that converts internal partner events into external webhook payloads. It supports per-integration transforms such as Slack and custom receivers while centralizing event normalization and signature generation. The adapter pattern is cleanly isolated and can be lifted into any postback or webhook notification system.