apps/web/app/(ee)/api/partners/export/route.ts (1)

79-84: Include filename and charset in CSV response headers

Improve download UX and cross-browser compatibility by adding a filename and explicit charset.

     return new Response(convertToCSV(formattedPartners), {
       headers: {
-        "Content-Type": "text/csv",
-        "Content-Disposition": "attachment",
+        "Content-Type": "text/csv; charset=utf-8",
+        "Content-Disposition": `attachment; filename="partners.csv"; filename*=UTF-8''partners.csv`,
       },
     });

apps/web/lib/zod/schemas/partners.ts (2)

76-91: Co-locate “default” flags with column metadata and tighten typing

This keeps defaults DRY and enables safer reuse by routes and UI.

-export const exportApplicationColumns = [
-  { id: "id", label: "ID" },
-  { id: "name", label: "Name" },
-  { id: "email", label: "Email" },
-  { id: "country", label: "Country" },
-  { id: "createdAt", label: "Applied at" },
-  { id: "description", label: "Description" },
-  { id: "website", label: "Website" },
-  { id: "youtube", label: "YouTube" },
-  { id: "twitter", label: "Twitter" },
-  { id: "linkedin", label: "LinkedIn" },
-  { id: "instagram", label: "Instagram" },
-  { id: "tiktok", label: "TikTok" },
-  { id: "proposal", label: "Proposal" },
-  { id: "comments", label: "Comments" },
-];
+export const exportApplicationColumns = [
+  { id: "id", label: "ID", default: true },
+  { id: "name", label: "Name", default: true },
+  { id: "email", label: "Email", default: true },
+  { id: "country", label: "Country", default: true },
+  { id: "createdAt", label: "Applied at", default: true },
+  { id: "description", label: "Description" },
+  { id: "website", label: "Website", default: true },
+  { id: "youtube", label: "YouTube", default: true },
+  { id: "twitter", label: "Twitter" },
+  { id: "linkedin", label: "LinkedIn", default: true },
+  { id: "instagram", label: "Instagram" },
+  { id: "tiktok", label: "TikTok" },
+  { id: "proposal", label: "Proposal" },
+  { id: "comments", label: "Comments" },
+] as const;

Optionally also export:

export type ApplicationExportColumnId =
  (typeof exportApplicationColumns)[number]["id"];

---

93-102: Derive defaults from the source list

Avoids drift between the columns list and defaults.

-export const exportApplicationsColumnsDefault = [
-  "id",
-  "name",
-  "email",
-  "country",
-  "createdAt",
-  "website",
-  "youtube",
-  "linkedin",
-];
+export const exportApplicationsColumnsDefault = exportApplicationColumns
+  .filter((c) => c.default)
+  .map((c) => c.id);

apps/web/ui/modals/export-partners-modal.tsx (4)

112-151: Columns section UX: prevent exporting with zero columns

If users unselect all, the API falls back to defaults, which can surprise. Either disable Export when none selected or show a helper/error.

---

74-79: Prefer Accept header over Content-Type on GET

Advertise expected response type.

-      const response = await fetch(`/api/partners/export${searchParams}`, {
-        method: "GET",
-        headers: {
-          "Content-Type": "application/json",
-        },
-      });
+      const response = await fetch(`/api/partners/export${searchParams}`, {
+        method: "GET",
+        headers: { Accept: "text/csv" },
+      });

---

86-93: Revoke object URL after download

Avoids small memory leaks in long-lived sessions.

       const a = document.createElement("a");

       a.href = url;
       a.download = `Dub Partners Export - ${new Date().toISOString()}.csv`;
       a.click();
+      a.remove();
+      window.URL.revokeObjectURL(url);

---

96-99: Surface error messages cleanly in toast

Ensure string is shown, not an Error object.

-    } catch (error) {
-      toast.error(error);
+    } catch (error) {
+      const message =
+        error instanceof Error ? error.message : "Failed to export partners.";
+      toast.error(message);

apps/web/app/(ee)/api/programs/[programId]/applications/export/route.ts (2)

84-89: Add filename and charset to response headers

Aligns with partners export and improves UX.

-    return new Response(convertToCSV(formattedApplications), {
+    return new Response(convertToCSV(formattedApplications), {
       headers: {
-        "Content-Type": "text/csv",
-        "Content-Disposition": "attachment",
+        "Content-Type": "text/csv; charset=utf-8",
+        "Content-Disposition": `attachment; filename="applications.csv"; filename*=UTF-8''applications.csv`,
       },
     });

---

29-38: Consider paging/upper bound for very large exports

Unbounded findMany on pending can be heavy. Either cap (e.g., 10k), stream, or batch.

apps/web/app/app.dub.co/(dashboard)/[slug]/(ee)/program/partners/applications/applications-menu.tsx (3)

85-99: Use a “disable” icon for disabling auto-approve (UX clarity).

Swap the red UserCheck for UserXmark to better match the action semantics.

-                    <UserCheck className="size-4 shrink-0 text-red-600" />
+                    <UserXmark className="size-4 shrink-0 text-red-600" />

---

115-123: Guard against missing workspaceSlug before navigation.

Prevents pushing an /undefined/... route if slug hasn’t resolved yet.

-                  router.push(
-                    `/${workspaceSlug}/program/partners/applications/rejected`,
-                  );
+                  if (!workspaceSlug) {
+                    toast.error("Workspace not loaded yet.");
+                    return;
+                  }
+                  router.push(`/${workspaceSlug}/program/partners/applications/rejected`);

---

156-161: Disable menu trigger until workspace context is ready.

Avoids confirm actions that rely on workspaceId! when it’s not yet available.

-          disabled={isUpdatingAutoApprove || !program}
+          disabled={
+            isUpdatingAutoApprove || !program || !workspaceId || !workspaceSlug
+          }

apps/web/ui/modals/export-applications-modal.tsx (5)

7-7: Remove unused router helper.

useRouterStuff/getQueryString is imported but unused; will trip lint.

-import { Button, Checkbox, Modal, useRouterStuff } from "@dub/ui";
+import { Button, Checkbox, Modal } from "@dub/ui";
@@
-  const { getQueryString } = useRouterStuff();

Also applies to: 33-34

---

45-49: Surface missing context to the user.

Early return is silent; show a toast so users know what happened.

-    if (!workspaceId || !program?.id) {
-      return;
-    }
+    if (!workspaceId || !program?.id) {
+      toast.error("Workspace or program not loaded. Please try again.");
+      return;
+    }

---

53-66: Avoid setting Content-Type on GET; add small hardening.

Unnecessary header can cause preflight; drop it.

-      const response = await fetch(
+      const response = await fetch(
         `/api/programs/${program.id}/applications/export?${new URLSearchParams({
           workspaceId: workspaceId,
           ...(data.columns.length
             ? { columns: data.columns.join(",") }
             : undefined),
         })}`,
-        {
-          method: "GET",
-          headers: {
-            "Content-Type": "application/json",
-          },
-        },
+        { method: "GET" },
       );

---

113-126: Checkbox tri-state and dedup guard.

Ensure boolean handling and prevent accidental duplicates.

-                          onCheckedChange={(checked) => {
-                            field.onChange(
-                              checked
-                                ? [...field.value, id]
-                                : field.value.filter((value) => value !== id),
-                            );
-                          }}
+                          onCheckedChange={(checked) => {
+                            field.onChange(
+                              checked === true
+                                ? Array.from(new Set([...field.value, id]))
+                                : field.value.filter((value) => value !== id),
+                            );
+                          }}

---

151-155: Optionally disable Export when no columns selected.

Prevents empty submissions and clarifies state.

-          <Button
+          <Button
             type="submit"
             loading={isSubmitting}
             text="Export applications"
             className="h-8 w-fit px-3"
+            disabled={isSubmitting /* plus: watch length if desired */}
           />

If you want full UX, I can wire up useWatch to disable when columns.length === 0.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

apps/web/app/(ee)/api/programs/[programId]/applications/export/route.ts (2)

16-22: Sanitize and allow‑list “columns” to avoid undefined CSV headers

Current split can yield empty/unknown ids → “undefined” header cells. Trim, dedupe, and filter against known ids; require at least one valid column.

@@
-const applicationsExportQuerySchema = z.object({
-  columns: z
-    .string()
-    .optional()
-    .transform((v) => v?.split(",") || exportApplicationsColumnsDefault)
-    .default(exportApplicationsColumnsDefault.join(",")),
-});
+const allowedApplicationColumnIds = new Set(
+  exportApplicationColumns.map((c) => c.id),
+);
+
+const applicationsExportQuerySchema = z.object({
+  columns: z
+    .string()
+    .optional()
+    .default(exportApplicationsColumnsDefault.join(","))
+    .transform((v) =>
+      v.split(",").map((s) => s.trim()).filter(Boolean),
+    )
+    .transform((arr) =>
+      Array.from(new Set(arr.filter((id) => allowedApplicationColumnIds.has(id)))),
+    )
+    .refine((arr) => arr.length > 0, { message: "No valid columns specified" }),
+});

---

25-29: Honor [programId] path param and enforce workspace scoping

Route ignores the path param and always uses the default program. Validate the param belongs to the current workspace and query by it to avoid exporting the wrong program’s data.

-export const GET = withWorkspace(
-  async ({ searchParams, workspace }) => {
-    const programId = getDefaultProgramIdOrThrow(workspace);
+export const GET = withWorkspace(
+  async ({ searchParams, params, workspace }) => {
+    const { programId } = params as { programId: string };
+    const program = await prisma.program.findFirst({
+      where: { id: programId, workspaceId: workspace.id },
+      select: { id: true },
+    });
+    if (!program) {
+      return new Response("Program not found", { status: 404 });
+    }
@@
-    const programEnrollments = await prisma.programEnrollment.findMany({
+    const programEnrollments = await prisma.programEnrollment.findMany({
       where: {
-        programId,
+        programId: program.id,
         status: "pending",
       },
       include: {
         partner: true,
         application: true,
       },
+      orderBy: { createdAt: "desc" },
+      take: 5000,
     });

Additional (outside this hunk): remove the now-unused import if present.

-import { getDefaultProgramIdOrThrow } from "@/lib/api/programs/get-default-program-id-or-throw";

Also applies to: 31-35

apps/web/lib/tolt/schemas.ts (1)

65-71: Clarify revenue unit and confirm null handling

• Update description in apps/web/lib/tolt/schemas.ts:

-    .describe("Revenue of the transaction in cents."),
+    .describe("Revenue of the transaction in the smallest currency unit (e.g., cents for USD)."),

• Downstream usage: sale.revenue is null-coalesced to 0 in apps/web/lib/tolt/import-commissions.ts:214; no other numeric conversions of .revenue and no external uses of charge_id.

apps/web/lib/tolt/import-commissions.ts (3)

213-215: Harden parsing of nullable revenue strings

Guard against NaN/non-numeric values to avoid propagating NaN into writes and comparisons.

-  // Sale amount (can potentially be null)
-  let saleAmount = Number(sale.revenue ?? 0);
+  // Sale amount (nullable string from Tolt) -> integer smallest unit
+  const rawRevenue = sale.revenue;
+  let saleAmount =
+    typeof rawRevenue === "string" ? Number.parseInt(rawRevenue, 10) : 0;
+  if (!Number.isFinite(saleAmount)) saleAmount = 0;

---

253-254: Avoid false-positive dedupe when saleAmount is 0

Zero-amount imports within the ±1h window may collide. Consider applying the amount match only when saleAmount > 0.

-      amount: saleAmount,
+      ...(saleAmount > 0 ? { amount: saleAmount } : {}),

---

324-324: Confirm business rule: create 0-amount “sale” commissions?

You still insert a commission when saleAmount is 0. If these shouldn’t be persisted, gate the create by saleAmount > 0; otherwise, all good.

apps/web/app/(ee)/api/programs/[programId]/applications/export/route.ts (2)

65-69: Avoid rebuilding Zod schema per row; add typing

Hoist the row schema to reduce per-item allocations and add a concrete type for schemaFields.

-    const schemaFields = {};
+    const schemaFields: Record<string, z.ZodTypeAny> = {};
     columns.forEach((column) => {
       schemaFields[columnIdToLabel[column]] = z.string().optional().default("");
     });
 
-    const formattedApplications = applications.map((application) => {
+    const rowSchema = z.object(schemaFields);
+
+    const formattedApplications = applications.map((application) => {
@@
-      return z.object(schemaFields).parse(result);
+      return rowSchema.parse(result);
     });

Also applies to: 83-84

---

86-91: Set a download filename in Content‑Disposition

Minor UX win and aligns with common CSV routes.

   return new Response(convertToCSV(formattedApplications), {
     headers: {
       "Content-Type": "text/csv",
-      "Content-Disposition": "attachment",
+      "Content-Disposition": 'attachment; filename="applications.csv"',
     },
   });

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

Learnt from: TWilson023
PR: dubinc/dub#2538
File: apps/web/ui/partners/overview/blocks/commissions-block.tsx:16-27
Timestamp: 2025-06-18T20:26:25.177Z
Learning: In the Dub codebase, components that use workspace data (workspaceId, defaultProgramId) are wrapped in `WorkspaceAuth` which ensures these values are always available, making non-null assertions safe. This is acknowledged as a common pattern in their codebase, though not ideal.