• pnpm-lock.yaml: Language not supported

apps/dashboard/src/components/export-users-dialog.tsx (1)

366-376: Type assertion used for CSV generation.

Line 374 uses as any to bypass type checking. This suggests a potential type mismatch between the data structure and what generateCsv expects.

Consider investigating the correct types for the export-to-csv library or adding a type guard to ensure data compatibility:

function exportToCsv(data: Record<string, unknown>[]) {
  const csvConfig = mkConfig({
    fieldSeparator: ",",
    filename: `stack-users-export-${new Date().toISOString().split("T")[0]}`,
    decimalSeparator: ".",
    useKeysAsHeaders: true,
  });

  // Ensure data conforms to expected type
  const csvData = data as Array<Record<string, string | number | boolean>>;
  const csv = generateCsv(csvConfig)(csvData);
  download(csvConfig)(csv);
}

apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/users/page-client.tsx (1)

36-36: Type casting indicates missing type definitions.

Line 36 uses (stackAdminApp as any).useUsers({ limit: 1 }), which suggests the useUsers method is not properly typed on the admin app interface. While this works, it bypasses type safety.

Consider adding proper type definitions for the admin app methods to avoid type casting. If useUsers is an internal method, consider adding it to the public API or using an alternative approach to check for first user.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Learnt from: N2D4
Repo: stack-auth/stack-auth PR: 943
File: examples/convex/app/action/page.tsx:23-28
Timestamp: 2025-10-11T04:13:19.308Z
Learning: In the stack-auth codebase, use `runAsynchronouslyWithAlert` from `stackframe/stack-shared/dist/utils/promises` for async button click handlers and form submissions instead of manual try/catch blocks. This utility automatically handles errors and shows alerts to users.

apps/dashboard/src/components/export-users-dialog.tsx (3)

370-379: Avoid as any when generating CSV rows

Casting data to any weakens type safety around what is passed into generateCsv:

const csv = generateCsv(csvConfig)(data as any);

It would be better to define a concrete row type (e.g. Record<string, string | number | boolean | null>) and have both transformUserData and exportToCsv use that type so you can call generateCsv(csvConfig)(data) without an any cast. Please cross-check the export-to-csv typings for the expected row shape and adjust accordingly.

---

149-153: Fix non-semantic clickable wrapper for accessibility

Using a bare <div onClick> makes the trigger non-focusable and not keyboard-activatable. Wrap the trigger in a real <button> so keyboard and screen-reader users can open the dialog.

You can apply something like:

-      <div onClick={() => setOpen(true)}>
-        {trigger}
-      </div>
+      <button
+        type="button"
+        onClick={() => setOpen(true)}
+        className="contents"
+        aria-label="Open export dialog"
+      >
+        {trigger}
+      </button>

---

263-283: Align includeAnonymous default with filter behavior

fetchAllUsers currently defaults includeAnonymous to true:

includeAnonymous: options?.includeAnonymous ?? true,

When scope === "filtered" and exportOptions is undefined or omits this flag, this changes semantics compared to the users page, where anonymous users are excluded by default.

To keep behavior consistent with the filter UI:

-      includeAnonymous: options?.includeAnonymous ?? true,
+      includeAnonymous: options?.includeAnonymous ?? false,

apps/dashboard/src/components/export-users-dialog.tsx (2)

31-40: Tighten ExportField.key typing to avoid drift

Right now ExportField.key is just string, while DEFAULT_FIELDS and transformUserData assume a fixed set of keys in the big switch. A typo or future refactor could silently create fields that are never handled.

Consider introducing a union for the allowed keys and reusing it:

type ExportFieldKey =
  | "id"
  | "displayName"
  | "primaryEmail"
  | "primaryEmailVerified"
  | "signedUpAt"
  | "lastActiveAt"
  | "isAnonymous"
  | "hasPassword"
  | "otpAuthEnabled"
  | "passkeyAuthEnabled"
  | "isMultiFactorRequired"
  | "oauthProviders"
  | "profileImageUrl"
  | "clientMetadata"
  | "clientReadOnlyMetadata"
  | "serverMetadata";

type ExportField = {
  key: ExportFieldKey;
  label: string;
  enabled: boolean;
};

This will give you exhaustiveness checking in transformUserData if a new key is added.

Also applies to: 42-59, 288-365

---

288-365: Safe date handling looks good; optionally guard oauthProviders

The updated handling of signedUpAt and lastActiveAt correctly copes with null/undefined and pre-constructed Date instances, returning ISO strings or an empty string, which should prevent previous runtime issues.

One small extra hardening you might consider is guarding oauthProviders in case it can ever be undefined:

data["OAuth Providers"] = (user.oauthProviders ?? []).map(p => p.id).join(", ");

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro