[aggieben]

Implements tenant-scoped CSV export endpoints with streaming for bounded memory usage.

Changes

• GET /api/exports/transactions.csv?from=&to=&accountId= — streamed transaction history with category paths
• GET /api/exports/accounts.csv — account list with computed balances
• GET /api/exports/budgets/{id}/period/{periodId}.csv — per-category budget report
• RFC 4180 CSV escaping, UTF-8 encoding, minor-unit money columns
• Documentation in docs/exports.md with sample file
• 7 integration tests

Closes STE-50

[aggieben]

CTO Review — REQUEST CHANGES

Six issues must be fixed before merge. Two are critical.

---

[CRITICAL] Syntax error in accounts export SQL

src/BitThicket.Steward.Api/ExportEndpoints.fs:429

Mismatched parenthesis in COALESCE — PostgreSQL will reject the query at runtime, the accounts export endpoint is entirely broken.

-- BROKEN
COALESCE(SUM(t.amount_minor) FILTER (WHERE t.status = 'pending')), 0) AS pending_balance_minor
-- FIX
COALESCE(SUM(t.amount_minor) FILTER (WHERE t.status = 'pending'), 0) AS pending_balance_minor

---

[CRITICAL] Budget export: double-conversion produces 100× inflated amounts

src/BitThicket.Steward.Api/ExportEndpoints.fs:541–557

GetPeriodSpendAsync and mapAllocation return Money with Amount already in major units. The export sums those and passes through toMinorUnits again — every budget amount is 100× too large. Fix: expose minor-unit int64 fields from the allocation type and sum those directly, same as transactions and accounts do.

---

[HIGH] Budget export missing auth check — unhandled 500 instead of 401

src/BitThicket.Steward.Api/ExportEndpoints.fs:487–570

exportBudgetPeriodCsv never checks accessor.Context. If no tenant context is present, requireCtx() in the repository throws an unhandled exception, producing a 500 that leaks the internal message "No tenant context available...". Add the same explicit match accessor.Context with | None -> Results.Unauthorized() guard that transactions and accounts use.

---

[MEDIUM] Category query in transaction export has no explicit tenant filter

src/BitThicket.Steward.Api/ExportEndpoints.fs:252–274

SELECT ... FROM categories WHERE deleted_at IS NULL has no tenant_id = clause. Every other query filters explicitly. Add AND tenant_id = @tenantId for defence in depth rather than relying solely on RLS.

---

[MEDIUM] No CancellationToken passed to streaming reads

src/BitThicket.Steward.Api/ExportEndpoints.fs:345, 454

ReadAsync() is called without ctx.RequestAborted. On client disconnect, the loop keeps reading from the DB. Thread ctx.RequestAborted through all ReadAsync() and FlushAsync() calls.

---

[LOW] No error handling once streaming starts

src/BitThicket.Steward.Api/ExportEndpoints.fs:345–398, 454–481

A DB failure mid-stream produces a truncated CSV with no error indication. Wrap the row-streaming loop in a try/with, log the exception, and allow the connection to abort cleanly.

---

All six issues must be fixed. The two critical ones (SQL syntax crash + 100× budget amounts) are blocking correctness bugs.