Link folders

apps/web/app/api/analytics/export/route.ts

@@ -5,18 +5,19 @@ import { getDomainOrThrow } from "@/lib/api/domains/get-domain-or-throw";
 import { getLinkOrThrow } from "@/lib/api/links/get-link-or-throw";
 import { throwIfClicksUsageExceeded } from "@/lib/api/links/usage-checks";
 import { withWorkspace } from "@/lib/auth";
+import { verifyFolderAccess } from "@/lib/folder/permissions";
 import { analyticsQuerySchema } from "@/lib/zod/schemas/analytics";
 import { Link } from "@dub/prisma/client";
 import JSZip from "jszip";
 
 // GET /api/analytics/export – get export data for analytics
 export const GET = withWorkspace(
-  async ({ searchParams, workspace }) => {
+  async ({ searchParams, workspace, session }) => {
     throwIfClicksUsageExceeded(workspace);
 
     const parsedParams = analyticsQuerySchema.parse(searchParams);
 
-    const { interval, start, end, linkId, externalId, domain, key } =
+    const { interval, start, end, linkId, externalId, domain, key, folderId } =
       parsedParams;
 
     let link: Link | null = null;
@@ -35,6 +36,30 @@ export const GET = withWorkspace(
       });
     }
 
+    await Promise.all([
+      ...(link && link.folderId
+        ? [
+            verifyFolderAccess({
+              workspaceId: workspace.id,
+              userId: session.user.id,
+              folderId: link.folderId,
+              requiredPermission: "folders.read",
+            }),
+          ]
+        : []),
+
+      ...(folderId
+        ? [
+            verifyFolderAccess({
+              workspaceId: workspace.id,
+              userId: session.user.id,
+              folderId,
+              requiredPermission: "folders.read",
+            }),
+          ]
+        : []),
+    ]);
+
     validDateRangeForPlan({
       plan: workspace.plan,
       interval,
@@ -60,6 +85,7 @@ export const GET = withWorkspace(
           event: "clicks",
           groupBy: endpoint,
         });
+
         if (!response || response.length === 0) return;
 
         const csvData = convertToCSV(response);

apps/web/app/api/analytics/route.ts

@@ -5,6 +5,7 @@ import { getDomainOrThrow } from "@/lib/api/domains/get-domain-or-throw";
 import { getLinkOrThrow } from "@/lib/api/links/get-link-or-throw";
 import { throwIfClicksUsageExceeded } from "@/lib/api/links/usage-checks";
 import { withWorkspace } from "@/lib/auth";
+import { verifyFolderAccess } from "@/lib/folder/permissions";
 import {
   analyticsPathParamsSchema,
   analyticsQuerySchema,
@@ -14,7 +15,7 @@ import { NextResponse } from "next/server";
 
 // GET /api/analytics – get analytics
 export const GET = withWorkspace(
-  async ({ params, searchParams, workspace }) => {
+  async ({ params, searchParams, workspace, session }) => {
     throwIfClicksUsageExceeded(workspace);
 
     let { eventType: oldEvent, endpoint: oldType } =
@@ -38,9 +39,14 @@ export const GET = withWorkspace(
       externalId,
       domain,
       key,
+      folderId,
     } = parsedParams;
+
     let link: Link | null = null;
 
+    event = oldEvent || event;
+    groupBy = oldType || groupBy;
+
     if (domain) {
       await getDomainOrThrow({ workspace, domain });
     }
@@ -55,8 +61,29 @@ export const GET = withWorkspace(
       });
     }
 
-    event = oldEvent || event;
-    groupBy = oldType || groupBy;
+    await Promise.all([
+      ...(link && link.folderId
+        ? [
+            verifyFolderAccess({
+              workspaceId: workspace.id,
+              userId: session.user.id,
+              folderId: link.folderId,
+              requiredPermission: "folders.read",
+            }),
+          ]
+        : []),
+
+      ...(folderId
+        ? [
+            verifyFolderAccess({
+              workspaceId: workspace.id,
+              userId: session.user.id,
+              folderId,
+              requiredPermission: "folders.read",
+            }),
+          ]
+        : []),
+    ]);
 
     validDateRangeForPlan({
       plan: workspace.plan,

apps/web/app/api/cron/domains/transfer/route.ts

@@ -53,9 +53,14 @@ export async function POST(req: Request) {
           where: {
             domain,
             projectId: currentWorkspaceId,
-            id: { in: linkIds },
+            id: {
+              in: linkIds,
+            },
+          },
+          data: {
+            projectId: newWorkspaceId,
+            folderId: null,
           },
-          data: { projectId: newWorkspaceId },
         }),
 
         prisma.linkTag.deleteMany({
@@ -73,7 +78,11 @@ export async function POST(req: Request) {
         }),
 
         recordLink(
-          links.map((link) => ({ ...link, projectId: newWorkspaceId })),
+          links.map((link) => ({
+            ...link,
+            projectId: newWorkspaceId,
+            folderId: null,
+          })),
         ),
       ]);
 

apps/web/app/api/dashboards/route.ts

@@ -1,6 +1,7 @@
 import { getLinkOrThrow } from "@/lib/api/links/get-link-or-throw";
 import { createId } from "@/lib/api/utils";
 import { withWorkspace } from "@/lib/auth";
+import { verifyFolderAccess } from "@/lib/folder/permissions";
 import { dashboardSchema } from "@/lib/zod/schemas/dashboard";
 import { domainKeySchema } from "@/lib/zod/schemas/links";
 import { prisma } from "@dub/prisma";
@@ -24,7 +25,7 @@ export const GET = withWorkspace(
 
 // POST /api/dashboards – create a new dashboard
 export const POST = withWorkspace(
-  async ({ searchParams, workspace }) => {
+  async ({ searchParams, workspace, session }) => {
     const { domain, key } = domainKeySchema.parse(searchParams);
 
     const link = await getLinkOrThrow({
@@ -33,6 +34,15 @@ export const POST = withWorkspace(
       key,
     });
 
+    if (link.folderId) {
+      await verifyFolderAccess({
+        workspaceId: workspace.id,
+        userId: session.user.id,
+        folderId: link.folderId,
+        requiredPermission: "folders.links.write",
+      });
+    }
+
     const dashboard = await prisma.dashboard.create({
       data: {
         id: createId({ prefix: "dash_" }),

apps/web/app/api/events/export/route.ts

@@ -4,6 +4,7 @@ import { getDomainOrThrow } from "@/lib/api/domains/get-domain-or-throw";
 import { getLinkOrThrow } from "@/lib/api/links/get-link-or-throw";
 import { throwIfClicksUsageExceeded } from "@/lib/api/links/usage-checks";
 import { withWorkspace } from "@/lib/auth";
+import { verifyFolderAccess } from "@/lib/folder/permissions";
 import { ClickEvent, LeadEvent, SaleEvent } from "@/lib/types";
 import { eventsQuerySchema } from "@/lib/zod/schemas/analytics";
 import { COUNTRIES, capitalize } from "@dub/utils";
@@ -33,7 +34,7 @@ const columnAccessors = {
 
 // GET /api/events/export – get export data for analytics
 export const GET = withWorkspace(
-  async ({ searchParams, workspace }) => {
+  async ({ searchParams, workspace, session }) => {
     throwIfClicksUsageExceeded(workspace);
 
     const parsedParams = eventsQuerySchema
@@ -47,7 +48,8 @@ export const GET = withWorkspace(
       )
       .parse(searchParams);
 
-    const { event, domain, interval, start, end, columns, key } = parsedParams;
+    const { event, domain, interval, start, end, columns, key, folderId } =
+      parsedParams;
 
     if (domain) {
       await getDomainOrThrow({ workspace, domain });
@@ -58,6 +60,30 @@ export const GET = withWorkspace(
         ? await getLinkOrThrow({ workspaceId: workspace.id, domain, key })
         : null;
 
+    await Promise.all([
+      ...(link && link.folderId
+        ? [
+            verifyFolderAccess({
+              workspaceId: workspace.id,
+              userId: session.user.id,
+              folderId: link.folderId,
+              requiredPermission: "folders.read",
+            }),
+          ]
+        : []),
+
+      ...(folderId
+        ? [
+            verifyFolderAccess({
+              workspaceId: workspace.id,
+              userId: session.user.id,
+              folderId,
+              requiredPermission: "folders.read",
+            }),
+          ]
+        : []),
+    ]);
+
     validDateRangeForPlan({
       plan: workspace.plan,
       interval,

apps/web/app/api/events/route.ts

@@ -4,18 +4,29 @@ import { getDomainOrThrow } from "@/lib/api/domains/get-domain-or-throw";
 import { getLinkOrThrow } from "@/lib/api/links/get-link-or-throw";
 import { throwIfClicksUsageExceeded } from "@/lib/api/links/usage-checks";
 import { withWorkspace } from "@/lib/auth";
+import { verifyFolderAccess } from "@/lib/folder/permissions";
 import { eventsQuerySchema } from "@/lib/zod/schemas/analytics";
 import { Link } from "@dub/prisma/client";
 import { NextResponse } from "next/server";
 
 export const GET = withWorkspace(
-  async ({ searchParams, workspace }) => {
+  async ({ searchParams, workspace, session }) => {
     throwIfClicksUsageExceeded(workspace);
 
     const parsedParams = eventsQuerySchema.parse(searchParams);
 
-    let { event, interval, start, end, linkId, externalId, domain, key } =
-      parsedParams;
+    let {
+      event,
+      interval,
+      start,
+      end,
+      linkId,
+      externalId,
+      domain,
+      key,
+      folderId,
+    } = parsedParams;
+
     let link: Link | null = null;
 
     if (domain) {
@@ -32,6 +43,30 @@ export const GET = withWorkspace(
       });
     }
 
+    await Promise.all([
+      ...(link && link.folderId
+        ? [
+            verifyFolderAccess({
+              workspaceId: workspace.id,
+              userId: session.user.id,
+              folderId: link.folderId,
+              requiredPermission: "folders.read",
+            }),
+          ]
+        : []),
+
+      ...(folderId
+        ? [
+            verifyFolderAccess({
+              workspaceId: workspace.id,
+              userId: session.user.id,
+              folderId,
+              requiredPermission: "folders.read",
+            }),
+          ]
+        : []),
+    ]);
+
     validDateRangeForPlan({
       plan: workspace.plan,
       interval,