User can download transaction history CSV/PDF

GDPR Article 20 (Right to Data Portability) and CCPA Section 1798.110 both require that users can receive their personal data, including transaction history, in a machine-readable format. CFPB Rule 1033 (Personal Financial Data Rights) additionally requires that financial institutions make consumer financial data available for download upon request. The failure to provide user-facing transaction export is simultaneously a privacy compliance gap, a regulatory compliance gap, and a usability failure — users who want to reconcile their own records or switch financial providers cannot do so without this feature. An export scoped only to admin or compliance roles does not satisfy these requirements; the user must be able to retrieve their own data directly.

Add a user-scoped export endpoint at src/app/api/user/transactions/export/route.ts that is strictly limited to the authenticated user's own records:

export async function GET(req: Request) {
  const session = await getServerSession();
  if (!session) return new Response('Unauthorized', { status: 401 });

  const { startDate, endDate, format = 'csv' } =
    Object.fromEntries(new URL(req.url).searchParams);

  const rows = await db('transaction_logs')
    .where({ user_id: session.user.id }) // never accept userId from query params
    .whereBetween('timestamp', [startDate, endDate])
    .orderBy('timestamp');

  if (format === 'csv') {
    const csv = [Object.keys(rows[0]).join(','),
      ...rows.map(r => Object.values(r).join(','))].join('\n');
    return new Response(csv, {
      headers: {
        'Content-Type': 'text/csv',
        'Content-Disposition': 'attachment; filename=transactions.csv'
      }
    });
  }
  return Response.json(rows);
}

Use the session to derive user_id server-side — never read it from request parameters, which can be tampered with to access other users' records.