feat(sdp-web): add csv export to dashboard

[enochakinbode]

Summary

Adds CSV export support for the dashboard Payments transactions view. Issue: #716

This PR is expected to include both sides of the feature: a dashboard action that lets users download the currently filtered transaction list, and a dashboard API route that generates the CSV from SDP API transfer data. The export preserves the same filters used by the transactions table, fetches paginated results server-side, and returns a downloadable CSV file for reconciliation and audit workflows.

Changes

• Add a transactions CSV download action to the dashboard
• Add /api/dashboard/payments/transactions/export as the dashboard-owned CSV export route
• Preserve transaction filters when exporting
• Generate CSV with stable transaction columns
• Escape CSV values containing commas, quotes, or newlines
• Fetch additional pages using meta.total and meta.hasMore
• Add unit coverage for filtering, pagination, CSV escaping, and upstream API errors

Testing

pnpm --filter sdp-web test:unit -- src/app/api/dashboard/payments/transactions/export/route.unit.test.ts

[vercel]

@enochakinbode is attempting to deploy a commit to the Solana Foundation Team on Vercel.

A member of the Team first needs to authorize it.

[greptile-apps]

Greptile Summary

Adds CSV export support for filtered payment transactions.

• Adds a dashboard API route that paginates transfer data and generates escaped CSV output.
• Adds download actions and error/loading states to transaction and counterparty views.
• Adds shared browser download handling, English UI copy, and route-level unit coverage.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/sdp-web/src/app/api/dashboard/payments/transactions/export/route.ts	Adds filtered, paginated CSV generation and neutralizes formula-leading values, including those preceded by whitespace or control characters.
apps/sdp-web/src/app/api/dashboard/payments/transactions/export/route.unit.test.ts	Covers filter forwarding, pagination boundaries, CSV escaping, formula neutralization, and upstream errors.
apps/sdp-web/src/app/dashboard/payments/transactions/transactions-workspace.tsx	Adds CSV download behavior using the currently displayed transaction filters.
apps/sdp-web/src/app/dashboard/payments/counterparty/counterparty-detail-workspace.tsx	Adds counterparty-scoped CSV export with active type and provider filters.
apps/sdp-web/src/lib/download.ts	Adds a shared browser helper for downloading response blobs using server-provided filenames.

Sequence Diagram

sequenceDiagram
  participant U as Dashboard user
  participant W as Payments workspace
  participant E as CSV export route
  participant A as SDP API
  U->>W: Download filtered transactions
  W->>E: GET export with active filters
  loop Until total reached or hasMore is false
    E->>A: Request transfer page
    A-->>E: Transfers and pagination metadata
  end
  E-->>W: CSV attachment
  W-->>U: Browser download

Loading

_{Reviews (13): Last reviewed commit: "Merge branch 'main' into feat/dashboard-..." | Re-trigger Greptile}

[GuiBibeau]

@enochakinbode thanks for this! can you fix CI/CD?

[enochakinbode]

@GuiBibeau done.

[resourcefulmind]

@enochakinbode apologies for the runaround on CI. As a first-time contributor from a fork, GitHub holds every workflow run until a maintainer approves it, so nothing had actually executed. I've approved the runs and CI is going now. Pushing more commits was never going to change it, so that's on us, not you.

Three things left, and only two of them are yours:

1. Sign your commits. This is the real merge blocker.
2. Merge main into your branch. It's behind. Please do this on your side rather than using the "Update branch" button here: if I press it, I become the last pusher and branch protection then blocks me from being the approving reviewer.
3. Ignore the two Vercel checks. "Authorization required to deploy" needs a Foundation team member to authorize a fork deploy in the Vercel dashboard. Nothing you can do, and they're not required checks, so they don't block the merge.

I'd like you to also consider this optional fix to toughen things up:

1. The formula-injection guard in route.ts:84-98 skips characters <= 0x20 before testing the prefix, so invisible Unicode slips through and a memo like ​=cmd still reaches Excel as a formula. Extending the skip set to cover zero-width and non-breaking spaces would close it. Happy to merge without it if you'd rather keep the diff tight.

Once it's green I'll review. @multipletwigs you're the assignee on #716 and you already agreed the CSV-only scope, so a second pair of eyes from you would be ideal.

[greptile-apps]

Want your agent to iterate on Greptile's feedback? Try greploops.

[enochakinbode]

@resourcefulmind please review.

[resourcefulmind]

Reviewed all six files. This is good work and the CSV hardening is genuinely solid now: the formula guard
strips control, format and separator characters before testing the prefix, which closes the leading
whitespace and zero-width bypasses Greptile flagged on the earlier commits. I checked those against the
current head rather than taking the replies on trust, and both are properly closed.

Approving. One optional thing if you want it in, otherwise it can wait: the response is UTF-8 with no
BOM, so Excel renders accented characters as mojibake. Memo and counterparty fields can carry them, and
we're adding Spanish and Portuguese this week. Prefixing  is one line. Happy either way.

I'll file the 10k row cap separately, the export stops at MAX_EXPORT_ROWS without telling anyone, which
matters for reconciliation, but that's a follow-up rather than something to hold this on.

Sorry about the CI runaround. Signing the commits required a force-push, which reset the fork approval
gate, so the runs needed approving again. That's on our side, not yours, and it'll happen on any future
force-push here.

[resourcefulmind]

@enochakinbode the original commit c0c312c is still unsigned, and branch protection needs every commit signed, not just the recent ones.

[enochakinbode]

@resourcefulmind i am away from my computer, i will rectify asap

[multipletwigs]

@enochakinbode could i get some screenshots on the ui 🙏 appreciate it!

[enochakinbode]

@multipletwigs

DESKTOP:

MOBILE:

[enochakinbode]

@resourcefulmind all should be good now