apps/web/app/app.dub.co/(dashboard)/[slug]/(ee)/program/commissions/commission-popover-buttons.tsx (1)

43-45: Align title casing with surrounding UI (nit)

Elsewhere (e.g., the modal header at Line 111 in export-commissions-modal.tsx), “Export commissions” uses sentence case. Consider matching here for consistency.

-                Export Commissions
+                Export commissions

apps/web/app/(ee)/api/commissions/export/route.ts (5)

70-110: Prefer Date objects over ISO strings for temporal filters

Passing toISOString is unnecessary and can introduce subtle timezone edge cases. Prisma accepts Date objects directly.

-          createdAt: {
-            gte: startDate.toISOString(),
-            lte: endDate.toISOString(),
-          },
+          createdAt: {
+            gte: startDate,
+            lte: endDate,
+          },

---

27-40: Simplify and harden type transforms for CSV shaping

• number: using value || 0 conflates 0 and NaN/null; prefer nullish coalescing.
• date: since inputs are Date, coercion isn’t needed; ?. is redundant.
• string: fine, but you can avoid extra default by using nullish coalescing.

 const COLUMN_TYPE_SCHEMAS = {
-  number: z.coerce
-    .number()
-    .nullable()
-    .default(0)
-    .transform((value) => value || 0),
-  date: z.date().transform((date) => date?.toISOString() || ""),
-  string: z
-    .string()
-    .nullable()
-    .default("")
-    .transform((value) => value || ""),
+  number: z.number().nullable().transform((value) => value ?? 0),
+  date: z.date().transform((date) => date.toISOString()),
+  string: z.string().nullable().transform((value) => value ?? ""),
 };

---

141-144: Use human-friendly column labels and preserve header order even for empty datasets

Currently headers will be column IDs. If you want labels in the CSV, map keys to labels in the selected order before conversion. This also ensures headers are present even when no rows match.

-  const data = z.array(z.object(columnSchemas)).parse(formattedCommissions);
-  const csvData = convertToCSV(data);
+  const data = z.array(z.object(columnSchemas)).parse(formattedCommissions);
+  const labeledData = data.map((row) => {
+    const out: Record<string, unknown> = {};
+    for (const id of columns) {
+      const label = COLUMN_LOOKUP.get(id)?.label ?? id;
+      // @ts-expect-error index access at runtime
+      out[label] = row[id];
+    }
+    return out;
+  });
+  const csvData = convertToCSV(labeledData);

If convertToCSV already supports a header mapping argument, prefer using that instead of re-keying objects.

---

43-43: Confirm permissions/plan gating for export endpoint

If CSV export should be restricted (e.g., to specific roles or plans), pass options to withWorkspace to enforce it. Otherwise, this endpoint inherits only the base workspace checks.

Example (adjust for your permission constants):

export const GET = withWorkspace(
  async ({ searchParams, workspace }) => { /* ... */ },
  { requiredPermissions: ["commissions:read"] /*, requiredPlan: ["pro","enterprise"]*/ },
);

---

106-109: Hard cap of 1000 rows—verify product intent

The API silently truncates to 1000 rows. If that’s intentional, consider reflecting it in the UI copy or providing pagination/chunked exporting later.

apps/web/lib/zod/schemas/commissions.ts (1)

255-279: Trim and dedupe incoming columns for resilience

Users or clients could send space-delimited/duplicate IDs. Normalize the array before validation.

 export const commissionsExportQuerySchema = getCommissionsQuerySchema
   .omit({ page: true, pageSize: true })
   .merge(
     z.object({
       columns: z
         .string()
-        .default(DEFAULT_COMMISSION_EXPORT_COLUMNS.join(","))
-        .transform((v) => v.split(","))
+        .default(DEFAULT_COMMISSION_EXPORT_COLUMNS.join(","))
+        .transform((v) =>
+          Array.from(
+            new Set(
+              v
+                .split(",")
+                .map((s) => s.trim())
+                .filter(Boolean),
+            ),
+          ),
+        )
         .refine(
           (columns): columns is CommissionExportColumnId[] => {
             const validColumnIds = COMMISSION_EXPORT_COLUMNS.map(
               (col) => col.id,
             );

apps/web/ui/modals/export-commissions-modal.tsx (4)

55-59: Provide user feedback when context is missing

If workspace or program isn’t resolved, return with a toast so users know why nothing happened.

   const onSubmit = handleSubmit(async (data) => {
     if (!workspaceId || !program?.id) {
-      return;
+      toast.error("Unable to export: missing workspace or program context.");
+      return;
     }

---

74-80: Avoid unnecessary headers on GET

Content-Type isn’t needed for GET and may trigger CORS preflight in some setups.

-      const response = await fetch(`/api/commissions/export${searchParams}`, {
-        method: "GET",
-        headers: {
-          "Content-Type": "application/json",
-        },
-      });
+      const response = await fetch(`/api/commissions/export${searchParams}`, {
+        method: "GET",
+      });

---

81-85: Surface clean error messages in toasts

Passing an Error object to sonner will render “[object Object]”. Use the message string.

-      if (!response.ok) {
-        const { error } = await response.json();
-        throw new Error(error.message);
-      }
+      if (!response.ok) {
+        const { error } = await response.json().catch(() => ({}));
+        throw new Error(error?.message || "Failed to export commissions.");
+      }
@@
-    } catch (error) {
-      toast.error(error);
+    } catch (error) {
+      toast.error(error instanceof Error ? error.message : String(error));

Also applies to: 96-101

---

86-93: Use server-suggested filename and make it filesystem-safe; revoke object URL

• Parse Content-Disposition for a server-suggested filename (keeps API/UI in sync).
• Sanitize timestamp fallback to avoid colons.
• Revoke the URL to free memory.

-      const blob = await response.blob();
-      const url = window.URL.createObjectURL(blob);
-      const a = document.createElement("a");
-
-      a.href = url;
-      a.download = `Dub Commissions Export - ${new Date().toISOString()}.csv`;
-      a.click();
+      const blob = await response.blob();
+      const url = window.URL.createObjectURL(blob);
+      const a = document.createElement("a");
+      const disposition = response.headers.get("content-disposition");
+      const suggestedFilename = disposition?.match(/filename="(.+?)"/)?.[1];
+      const timestamp = new Date().toISOString().replace(/:/g, "-");
+      const filename =
+        suggestedFilename || `Dub Commissions Export - ${timestamp}.csv`;
+      a.href = url;
+      a.download = filename;
+      a.click();
+      setTimeout(() => URL.revokeObjectURL(url), 0);

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

apps/web/app/(ee)/api/commissions/export/route.ts (2)

92-101: Group filter is now applied in the export query (resolved)

The conditional partner group filter is included via partner.programs.some({ programId, groupId }). This addresses the earlier omission.

---

156-163: Filesystem-safe filename handled (resolved)

Replacing colons in the ISO timestamp fixes Windows filename issues. Thanks for addressing this.

apps/web/lib/zod/schemas/commissions.ts (2)

259-277: Harden columns parsing: trim, dedupe, and return precise validation errors

Current parsing accepts whitespace and duplicates and returns a generic error. Tighten it to:

• trim each id
• drop empties
• dedupe
• surface invalid ids in the error message

Apply this diff:

-      columns: z
-        .string()
-        .default(DEFAULT_COMMISSION_EXPORT_COLUMNS.join(","))
-        .transform((v) => v.split(","))
-        .refine(
-          (columns): columns is CommissionExportColumnId[] => {
-            const validColumnIds = COMMISSION_EXPORT_COLUMNS.map(
-              (col) => col.id,
-            );
-
-            return columns.every((column): column is CommissionExportColumnId =>
-              validColumnIds.includes(column as CommissionExportColumnId),
-            );
-          },
-          {
-            message:
-              "Invalid column IDs provided. Please check the available columns.",
-          },
-        ),
+      columns: z
+        .string()
+        .default(DEFAULT_COMMISSION_EXPORT_COLUMNS.join(","))
+        .transform((v) =>
+          Array.from(
+            new Set(
+              v
+                .split(",")
+                .map((s) => s.trim())
+                .filter(Boolean),
+            ),
+          ),
+        )
+        .superRefine((columns, ctx) => {
+          const validIds = new Set(
+            COMMISSION_EXPORT_COLUMNS.map((col) => col.id),
+          );
+          const invalid = columns.filter((c) => !validIds.has(c));
+          if (invalid.length) {
+            ctx.addIssue({
+              code: z.ZodIssueCode.custom,
+              message: `Invalid column IDs: ${invalid.join(", ")}`,
+            });
+          }
+        }),

---

247-253: Export the column id type and type the defaults

Exporting the id type improves type-safety in consumers (UI, route) and typing the defaults prevents accidental drift.

-type CommissionExportColumnId =
+export type CommissionExportColumnId =
   (typeof COMMISSION_EXPORT_COLUMNS)[number]["id"];
 
-export const DEFAULT_COMMISSION_EXPORT_COLUMNS =
+export const DEFAULT_COMMISSION_EXPORT_COLUMNS: CommissionExportColumnId[] =
   COMMISSION_EXPORT_COLUMNS.filter((column) => column.default).map(
     (column) => column.id,
   );

apps/web/app/(ee)/api/commissions/export/route.ts (2)

89-91: Prefer passing Date objects to Prisma instead of ISO strings

Prisma accepts Date objects directly. Avoiding toISOString keeps types consistent and eliminates needless string conversion.

-          createdAt: {
-            gte: startDate.toISOString(),
-            lte: endDate.toISOString(),
-          },
+          createdAt: {
+            gte: startDate,
+            lte: endDate,
+          },

---

13-25: Tighten typing for column types to prevent mismatches

Map value currently uses type: string, which weakens type-safety when indexing COLUMN_TYPE_SCHEMAS. Constrain it to the known keys.

-const COLUMN_LOOKUP: Map<
-  string,
-  { label: string; type: string; order: number }
-> = new Map(
+type ColumnType = keyof typeof COLUMN_TYPE_SCHEMAS;
+const COLUMN_LOOKUP: Map<
+  string,
+  { label: string; type: ColumnType; order: number }
+> = new Map(

apps/web/ui/modals/export-commissions-modal.tsx (5)

91-93: Sanitize the download filename and revoke the blob URL

Colons break Windows filenames and the blob URL should be revoked to avoid leaks. The server already sets a safe filename; keep it consistent client-side.

-      a.download = `Dub Commissions Export - ${new Date().toISOString()}.csv`;
-      a.click();
+      a.download = `Dub Commissions Export - ${new Date()
+        .toISOString()
+        .replace(/:/g, "-")}.csv`;
+      a.click();
+      a.remove();
+      // Revoke on next tick to avoid interfering with download
+      setTimeout(() => URL.revokeObjectURL(url), 0);

---

76-79: Drop the Content-Type header on GET

Unnecessary for a GET and can be omitted.

-      const response = await fetch(`/api/commissions/export${searchParams}`, {
-        method: "GET",
-        headers: {
-          "Content-Type": "application/json",
-        },
-      });
+      const response = await fetch(`/api/commissions/export${searchParams}`, {
+        method: "GET",
+      });

---

63-69: Guard against exporting with zero columns (better UX)

If no columns are selected, the server will 400. Short-circuit with a clear message.

       const params = {
         workspaceId,
         ...(data.columns.length
           ? { columns: data.columns.join(",") }
           : undefined),
       };
 
+      if (data.columns.length === 0) {
+        throw new Error("Select at least one column to export.");
+      }

---

96-100: Ensure toast displays a useful message for unknown errors

toast.error(error) may render [object Object]. Use a string message fallback.

-    } catch (error) {
-      toast.error(error);
+    } catch (error) {
+      const message =
+        error instanceof Error
+          ? error.message
+          : "Failed to export commissions. Please try again.";
+      toast.error(message);
     } finally {
       toast.dismiss(lid);
     }

---

55-58: Handle missing context explicitly

If context is missing, surface a user-facing error instead of silently returning.

-    if (!workspaceId || !program?.id) {
-      return;
-    }
+    if (!workspaceId || !program?.id) {
+      toast.error("Missing workspace or program context.");
+      return;
+    }

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

apps/web/app/(ee)/api/commissions/export/route.ts (2)

92-101: Resolved: groupId filter now applied in the query

The conditional partner.programs some { programId, groupId } fixes the earlier omission.

---

167-175: Filename now sanitized for Windows compatibility

Good fix replacing colons in the ISO timestamp before using it in Content-Disposition.

apps/web/lib/zod/schemas/commissions.ts (1)

267-291: Deduplicate and sanitize column IDs at parse-time

Avoid duplicates and empty IDs from malformed queries (e.g., trailing commas) by filtering empties and deduping after split.

Apply this diff:

   export const commissionsExportQuerySchema = getCommissionsQuerySchema
     .omit({ page: true, pageSize: true })
     .merge(
       z.object({
         columns: z
           .string()
           .default(DEFAULT_COMMISSION_EXPORT_COLUMNS.join(","))
-          .transform((v) => v.split(","))
+          .transform((v) => v.split(",").filter(Boolean))
+          .transform((arr) => Array.from(new Set(arr)))
           .refine(
             (columns): columns is CommissionExportColumnId[] => {
               const validColumnIds = COMMISSION_EXPORT_COLUMNS.map(
                 (col) => col.id,
               );

               return columns.every((column): column is CommissionExportColumnId =>
                 validColumnIds.includes(column as CommissionExportColumnId),
               );
             },
             {
               message:
                 "Invalid column IDs provided. Please check the available columns.",
             },
           ),
       }),
     );

apps/web/app/(ee)/api/commissions/export/route.ts (2)

88-91: Prefer Date objects over ISO strings in Prisma filters

Prisma accepts Date objects directly; passing Dates avoids any potential timezone/string parsing edge cases.

Apply this diff:

           createdAt: {
-            gte: startDate.toISOString(),
-            lte: endDate.toISOString(),
+            gte: startDate,
+            lte: endDate,
           },

---

144-148: Guard against duplicate columns before sorting

If duplicates sneak in, the CSV would repeat columns. Dedup here as a final safeguard.

Apply this diff:

-  columns = columns.sort(
+  columns = [...new Set(columns)].sort(
     (a, b) =>
       (COLUMN_LOOKUP.get(a)?.order || 999) -
       (COLUMN_LOOKUP.get(b)?.order || 999),
   );

apps/web/ui/modals/export-commissions-modal.tsx (3)

74-79: Remove unnecessary Content-Type header on GET

No body is sent; some intermediaries treat GET+Content-Type oddly.

Apply this diff:

-      const response = await fetch(`/api/commissions/export${searchParams}`, {
-        method: "GET",
-        headers: {
-          "Content-Type": "application/json",
-        },
-      });
+      const response = await fetch(`/api/commissions/export${searchParams}`);

---

97-100: Surface the actual error message in toast

Passing the Error object directly can render as [object Object].

Apply this diff:

-    } catch (error) {
-      toast.error(error);
+    } catch (error) {
+      toast.error(error instanceof Error ? error.message : String(error));

---

123-155: Optional: prevent submitting with zero columns selected

If a user unchecks everything, the backend falls back to defaults, which might be surprising. Consider disabling submit or showing a validation error when no columns are selected.

I can add a small client-side guard to disable the submit button when columns.length === 0, if desired.

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.