feat(core): generic CSV export primitive + helpdesk domains consumer

Add a reusable CSV-export building block to the core so any Grid.js list page can gain a filter/sort-aware download with two clicks of glue. Core primitive: - core/Service/Export/CsvExportService: flavor-aware writer (plain CSV or Excel-compatible UTF-8+BOM+semicolon), with OWASP-aligned formula- injection escape (=, @, +, -, TAB, CR) applied to both rows *and* headers. Value objects for columns (ExportColumn) carry an extractor closure and an allowSignedNumeric flag for phone-number-shaped cells. - core/Support/helpers/export.php: thin HTTP layer (exportSendCsv, exportCapLimit, exportResolveFlavor, exportRequireGetRequest) reusing the requestInput() contract for GR-CORE-003 consistency. Filename is sanitized and length-clamped; callers must still enforce auth. - templates/partials/app-list-export-dropdown.phtml: zero-config <details class="dropdown"> with CSV + Excel triggers. - web/js/core/app-list-export.js: initListExport({ gridConfig, exportUrl }) mirrors the current grid filters + sort onto the export URL and navigates, preserving session cookies for download. First consumer — Helpdesk domains: - DomainListService extracts the shared filter/enrich/sort logic from domains-data so the grid endpoint and the new domains/export endpoint cannot drift. - domains/export endpoint delegates to DomainListService, declares ExportColumns (with translated level labels), and exits via exportSendCsv. - domains-data now ~20 lines, delegating to DomainListService. Tests: - CsvExportServiceTest (10 cases): both flavors, BOM/no-BOM, formula escapes incl. TAB/CR, header escape, signed-numeric allowlist, quoting, multiline, empty columns, generator-compatible iterable. - ExportHelpersTest (5 cases): exportCapLimit bounds. - DomainListServiceTest (8 cases): filter, search, "all" sentinel, sort, paging, enrichment, BC failure, tenant-scoped security filter. Gates: PHPUnit green, PHPStan clean on touched files, module:sync ok. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-21 21:57:19 +02:00
parent fb86c02427
commit 12356e2266
18 changed files with 997 additions and 180 deletions
--- a/modules/helpdesk/lib/Module/Helpdesk/HelpdeskContainerRegistrar.php
+++ b/modules/helpdesk/lib/Module/Helpdesk/HelpdeskContainerRegistrar.php
@@ -10,6 +10,7 @@ use MintyPHP\Module\Helpdesk\Service\BcSoapGateway;
 use MintyPHP\Module\Helpdesk\Service\DebitorDetailService;
 use MintyPHP\Module\Helpdesk\Service\DebitorSearchService;
 use MintyPHP\Module\Helpdesk\Service\DomainDetailService;
+use MintyPHP\Module\Helpdesk\Service\DomainListService;
 use MintyPHP\Module\Helpdesk\Service\EffectiveHelpdeskSettingsService;
 use MintyPHP\Module\Helpdesk\Service\HelpdeskOAuthTokenService;
 use MintyPHP\Module\Helpdesk\Service\HelpdeskSettingsGateway;
@@ -127,6 +128,11 @@ final class HelpdeskContainerRegistrar implements ContainerRegistrar
            $c->get(DomainSecurityLevelRepository::class)
        ));

+        $container->set(DomainListService::class, static fn (AppContainer $c): DomainListService => new DomainListService(
+            $c->get(BcODataGateway::class),
+            $c->get(DomainSecurityLevelService::class)
+        ));
+
        $container->set(HandoverRepository::class, static fn (): HandoverRepository => new HandoverRepository());

        $container->set(HandoverRevisionRepository::class, static fn (): HandoverRevisionRepository => new HandoverRevisionRepository());
--- a/modules/helpdesk/lib/Module/Helpdesk/Service/DomainListService.php
+++ b/modules/helpdesk/lib/Module/Helpdesk/Service/DomainListService.php
@@ -0,0 +1,244 @@
+<?php
+
+namespace MintyPHP\Module\Helpdesk\Service;
+
+/**
+ * Domain list orchestrator.
+ *
+ * Owns the shared filter + enrichment flow used by both the Grid.js
+ * data endpoint (`domains-data()`) and the export endpoint
+ * (`domains/export()`). Keeps the two in lockstep — same filters
+ * visible in the grid, same rows produced by the export.
+ *
+ * Input: parsed filter values (from gridParseFiltersFromSchemaFile).
+ * Output: `rows` enriched with security-level + state variant,
+ *         `total` matching the filtered set *before* paging.
+ */
+final class DomainListService
+{
+    private const STATE_VARIANT_MAP = [
+        'Aktiv' => 'success',
+        'In Vorbereitung' => 'warning',
+    ];
+
+    public function __construct(
+        private readonly BcODataGateway $bc,
+        private readonly DomainSecurityLevelService $securityLevels,
+    ) {
+    }
+
+    /**
+     * @api Called from domains-data and domains/export endpoints
+     * @param array{
+     *     search?: string,
+     *     customer?: string,
+     *     contract_type?: string,
+     *     state?: string,
+     *     administration?: string,
+     *     security_level?: string,
+     *     order?: string,
+     *     dir?: string,
+     *     limit?: int,
+     *     offset?: int
+     * } $filters
+     *
+     * @return array{rows: list<array<string,mixed>>, total: int}
+     */
+    public function query(int $tenantId, array $filters): array
+    {
+        $search = trim((string) ($filters['search'] ?? ''));
+        $customer = trim((string) ($filters['customer'] ?? ''));
+        $contractType = trim((string) ($filters['contract_type'] ?? ''));
+        $state = $this->normalizeAll((string) ($filters['state'] ?? ''));
+        $administration = $this->normalizeAll((string) ($filters['administration'] ?? ''));
+        $securityLevel = $this->normalizeAll((string) ($filters['security_level'] ?? ''));
+        $order = (string) ($filters['order'] ?? 'Customer_Name');
+        $dir = strtolower((string) ($filters['dir'] ?? 'asc')) === 'desc' ? 'desc' : 'asc';
+        $limit = max(0, (int) ($filters['limit'] ?? 0));
+        $offset = max(0, (int) ($filters['offset'] ?? 0));
+
+        try {
+            $allDomains = $this->bc->listDomains();
+        } catch (\Throwable) {
+            return ['rows' => [], 'total' => 0];
+        }
+
+        $enriched = $this->enrichContracts($allDomains);
+
+        $filtered = $this->applyFilters($enriched, $tenantId, [
+            'search' => $search,
+            'customer' => $customer,
+            'contract_type' => $contractType,
+            'state' => $state,
+            'administration' => $administration,
+            'security_level' => $securityLevel,
+        ]);
+
+        $total = count($filtered);
+
+        usort($filtered, static function (array $a, array $b) use ($order, $dir): int {
+            $va = (string) ($a[$order] ?? '');
+            $vb = (string) ($b[$order] ?? '');
+            $cmp = strnatcasecmp($va, $vb);
+            return $dir === 'desc' ? -$cmp : $cmp;
+        });
+
+        if ($limit > 0) {
+            $filtered = array_slice($filtered, $offset, $limit);
+        } elseif ($offset > 0) {
+            $filtered = array_slice($filtered, $offset);
+        }
+
+        $rows = $this->prepareRows($filtered, $tenantId);
+
+        return ['rows' => $rows, 'total' => $total];
+    }
+
+    private function normalizeAll(string $value): string
+    {
+        $trimmed = trim($value);
+        return $trimmed === 'all' ? '' : $trimmed;
+    }
+
+    /**
+     * @param list<array<string,mixed>> $domains
+     * @return list<array<string,mixed>>
+     */
+    private function enrichContracts(array $domains): array
+    {
+        $lookup = [];
+        try {
+            foreach ($this->bc->listDomainContractLines() as $line) {
+                $dnsNo = trim((string) ($line['No'] ?? ''));
+                if ($dnsNo !== '' && !isset($lookup[$dnsNo])) {
+                    $lookup[$dnsNo] = [
+                        'contract_type' => trim((string) ($line['PI_Header_Type'] ?? '')),
+                        'contract_no' => trim((string) ($line['Header_No'] ?? '')),
+                        'contract_description' => trim((string) ($line['PI_Header_Description'] ?? '')),
+                    ];
+                }
+            }
+        } catch (\Throwable) {
+            // best-effort: proceed without contract enrichment
+        }
+
+        foreach ($domains as &$domain) {
+            $dnsNo = trim((string) ($domain['No'] ?? ''));
+            $contract = $lookup[$dnsNo] ?? null;
+            $domain['contract_type'] = $contract['contract_type'] ?? '';
+            $domain['contract_no'] = $contract['contract_no'] ?? '';
+            $domain['contract_description'] = $contract['contract_description'] ?? '';
+        }
+        unset($domain);
+
+        return $domains;
+    }
+
+    /**
+     * @param list<array<string,mixed>> $domains
+     * @param array{search: string, customer: string, contract_type: string, state: string, administration: string, security_level: string} $f
+     * @return list<array<string,mixed>>
+     */
+    private function applyFilters(array $domains, int $tenantId, array $f): array
+    {
+        if ($f['search'] !== '') {
+            $needle = mb_strtolower($f['search']);
+            $domains = array_values(array_filter($domains, static function (array $d) use ($needle): bool {
+                $hay = mb_strtolower(
+                    ($d['Customer_No'] ?? '') . ' '
+                    . ($d['Customer_Name'] ?? '') . ' '
+                    . ($d['URL'] ?? '') . ' '
+                    . ($d['No'] ?? '') . ' '
+                    . ($d['contract_type'] ?? '')
+                );
+                return str_contains($hay, $needle);
+            }));
+        }
+
+        if ($f['customer'] !== '') {
+            $needle = mb_strtolower($f['customer']);
+            $domains = array_values(array_filter($domains, static function (array $d) use ($needle): bool {
+                $hay = mb_strtolower(($d['Customer_No'] ?? '') . ' ' . ($d['Customer_Name'] ?? ''));
+                return str_contains($hay, $needle);
+            }));
+        }
+
+        if ($f['contract_type'] !== '') {
+            $needle = mb_strtolower($f['contract_type']);
+            $domains = array_values(array_filter($domains, static fn (array $d): bool => str_contains(mb_strtolower((string) ($d['contract_type'] ?? '')), $needle)));
+        }
+
+        if ($f['state'] !== '') {
+            $value = $f['state'];
+            $domains = array_values(array_filter($domains, static fn (array $d): bool => trim((string) ($d['State'] ?? '')) === $value));
+        }
+
+        if ($f['administration'] !== '') {
+            $value = $f['administration'];
+            $domains = array_values(array_filter($domains, static fn (array $d): bool => trim((string) ($d['Administration'] ?? '')) === $value));
+        }
+
+        if ($f['security_level'] !== '' && $tenantId > 0) {
+            $domainNos = array_values(array_filter(
+                array_map(static fn (array $d): string => trim((string) ($d['No'] ?? '')), $domains),
+                static fn (string $n): bool => $n !== ''
+            ));
+            $lookup = $domainNos !== [] ? $this->securityLevels->getAllLevelsForDomains($tenantId, $domainNos) : [];
+            $value = $f['security_level'];
+            $domains = array_values(array_filter($domains, static function (array $d) use ($value, $lookup): bool {
+                $no = trim((string) ($d['No'] ?? ''));
+                return ($lookup[$no] ?? 'normal') === $value;
+            }));
+        }
+
+        return $domains;
+    }
+
+    /**
+     * @param list<array<string,mixed>> $domains
+     * @return list<array<string,mixed>>
+     */
+    private function prepareRows(array $domains, int $tenantId): array
+    {
+        $lookup = [];
+        if ($tenantId > 0) {
+            $domainNos = array_values(array_filter(
+                array_map(static fn (array $d): string => trim((string) ($d['No'] ?? '')), $domains),
+                static fn (string $n): bool => $n !== ''
+            ));
+            if ($domainNos !== []) {
+                $lookup = $this->securityLevels->getAllDetailsForDomains($tenantId, $domainNos);
+            }
+        }
+
+        $debitorBaseUrl = lurl('helpdesk/debitor/');
+
+        $rows = [];
+        foreach ($domains as $domain) {
+            $customerNo = trim((string) ($domain['Customer_No'] ?? ''));
+            $domainState = (string) ($domain['State'] ?? '');
+            $domainNo = (string) ($domain['No'] ?? '');
+            $details = $lookup[$domainNo] ?? null;
+            $level = $details['level'] ?? 'normal';
+            $note = $details['note'] ?? '';
+
+            $rows[] = [
+                'No' => $domainNo,
+                'Customer_No' => $customerNo,
+                'Customer_Name' => (string) ($domain['Customer_Name'] ?? ''),
+                'URL' => (string) ($domain['URL'] ?? ''),
+                'State' => $domainState,
+                'state_variant' => self::STATE_VARIANT_MAP[$domainState] ?? 'neutral',
+                'Administration' => (string) ($domain['Administration'] ?? ''),
+                'contract_type' => (string) ($domain['contract_type'] ?? ''),
+                'contract_no' => (string) ($domain['contract_no'] ?? ''),
+                'debitor_url' => $customerNo !== '' ? $debitorBaseUrl . rawurlencode($customerNo) : '',
+                'security_level' => $level,
+                'security_level_variant' => DomainSecurityLevelService::getBadgeVariant($level),
+                'security_level_note' => $note,
+            ];
+        }
+
+        return $rows;
+    }
+}
--- a/modules/helpdesk/module.php
+++ b/modules/helpdesk/module.php
@@ -18,6 +18,7 @@ return [
        ['path' => 'helpdesk/domains', 'target' => 'helpdesk/domains'],
        ['path' => 'helpdesk/domains-data', 'target' => 'helpdesk/domains-data'],
        ['path' => 'helpdesk/domains/security-level-data', 'target' => 'helpdesk/domains/security-level-data'],
+        ['path' => 'helpdesk/domains/export', 'target' => 'helpdesk/domains/export'],
        ['path' => 'helpdesk/domain/{id}', 'target' => 'helpdesk/domain'],
        ['path' => 'helpdesk/domain-detail-data', 'target' => 'helpdesk/domain-detail-data'],
        ['path' => 'helpdesk/debitor/{id}', 'target' => 'helpdesk/debitor'],
--- a/modules/helpdesk/pages/helpdesk/domains-data().php
+++ b/modules/helpdesk/pages/helpdesk/domains-data().php
@@ -2,8 +2,7 @@

 use MintyPHP\Http\SessionStoreInterface;
 use MintyPHP\Module\Helpdesk\HelpdeskAuthorizationPolicy;
-use MintyPHP\Module\Helpdesk\Service\BcODataGateway;
-use MintyPHP\Module\Helpdesk\Service\DomainSecurityLevelService;
+use MintyPHP\Module\Helpdesk\Service\DomainListService;
 use MintyPHP\Support\Guard;

 Guard::requireLogin();
@@ -14,183 +13,9 @@ $session = app(SessionStoreInterface::class)->all();
 $tenantId = (int) ($session['current_tenant']['id'] ?? 0);

 $filters = gridParseFiltersFromSchemaFile(__DIR__ . '/domains/filter-schema.php');
+$filters['limit'] = (int) ($filters['limit'] ?? 10);
+$filters['offset'] = (int) ($filters['offset'] ?? 0);

-$search = trim((string) ($filters['search'] ?? ''));
-$customer = trim((string) ($filters['customer'] ?? ''));
-$contractType = trim((string) ($filters['contract_type'] ?? ''));
-$state = trim((string) ($filters['state'] ?? ''));
-$state = $state === 'all' ? '' : $state;
-$administration = trim((string) ($filters['administration'] ?? ''));
-$administration = $administration === 'all' ? '' : $administration;
-$securityLevel = trim((string) ($filters['security_level'] ?? ''));
-$securityLevel = $securityLevel === 'all' ? '' : $securityLevel;
-$order = (string) ($filters['order'] ?? 'Customer_Name');
-$dir = (string) ($filters['dir'] ?? 'asc');
-$limit = (int) ($filters['limit'] ?? 10);
-$offset = (int) ($filters['offset'] ?? 0);
+$result = app(DomainListService::class)->query($tenantId, $filters);

-$gateway = app(BcODataGateway::class);
-
-try {
-    $allDomains = $gateway->listDomains();
-} catch (\Throwable) {
-    gridJsonDataResult([], 0);
-
-    return;
-}
-
-// Build contract type lookup: DNS number → {contract_type, contract_no, contract_description}
-$contractLookup = [];
-try {
-    $contractLines = $gateway->listDomainContractLines();
-    foreach ($contractLines as $line) {
-        $dnsNo = trim((string) ($line['No'] ?? ''));
-        if ($dnsNo !== '' && !isset($contractLookup[$dnsNo])) {
-            $contractLookup[$dnsNo] = [
-                'contract_type' => trim((string) ($line['PI_Header_Type'] ?? '')),
-                'contract_no' => trim((string) ($line['Header_No'] ?? '')),
-                'contract_description' => trim((string) ($line['PI_Header_Description'] ?? '')),
-            ];
-        }
-    }
-} catch (\Throwable) {
-    // Contract enrichment is best-effort — continue without it
-}
-
-// Enrich domains with contract type before filtering (so search/sort can use it)
-foreach ($allDomains as &$domain) {
-    $domainNo = trim((string) ($domain['No'] ?? ''));
-    $contract = $contractLookup[$domainNo] ?? null;
-    $domain['contract_type'] = $contract['contract_type'] ?? '';
-    $domain['contract_no'] = $contract['contract_no'] ?? '';
-    $domain['contract_description'] = $contract['contract_description'] ?? '';
-}
-unset($domain);
-
-$filtered = $allDomains;
-
-// Text search across Customer_No, Customer_Name, URL, No, contract_type
-if ($search !== '') {
-    $searchLower = mb_strtolower($search);
-    $filtered = array_values(array_filter($filtered, static function (array $domain) use ($searchLower): bool {
-        $haystack = mb_strtolower(
-            ($domain['Customer_No'] ?? '') . ' '
-            . ($domain['Customer_Name'] ?? '') . ' '
-            . ($domain['URL'] ?? '') . ' '
-            . ($domain['No'] ?? '') . ' '
-            . ($domain['contract_type'] ?? '')
-        );
-
-        return str_contains($haystack, $searchLower);
-    }));
-}
-
-// Customer filter (partial match on Customer_No + Customer_Name)
-if ($customer !== '') {
-    $customerLower = mb_strtolower($customer);
-    $filtered = array_values(array_filter($filtered, static function (array $domain) use ($customerLower): bool {
-        $haystack = mb_strtolower(
-            ($domain['Customer_No'] ?? '') . ' '
-            . ($domain['Customer_Name'] ?? '')
-        );
-
-        return str_contains($haystack, $customerLower);
-    }));
-}
-
-// Contract type filter (partial match)
-if ($contractType !== '') {
-    $contractTypeLower = mb_strtolower($contractType);
-    $filtered = array_values(array_filter($filtered, static function (array $domain) use ($contractTypeLower): bool {
-        return str_contains(mb_strtolower((string) ($domain['contract_type'] ?? '')), $contractTypeLower);
-    }));
-}
-
-// State filter (exact match)
-if ($state !== '') {
-    $filtered = array_values(array_filter($filtered, static function (array $domain) use ($state): bool {
-        return trim((string) ($domain['State'] ?? '')) === $state;
-    }));
-}
-
-// Administration filter (exact match)
-if ($administration !== '') {
-    $filtered = array_values(array_filter($filtered, static function (array $domain) use ($administration): bool {
-        return trim((string) ($domain['Administration'] ?? '')) === $administration;
-    }));
-}
-
-// Security level filter
-if ($securityLevel !== '' && $tenantId > 0) {
-    $securityLevelService = app(DomainSecurityLevelService::class);
-    $allDomainNos = array_map(static fn (array $d): string => trim((string) ($d['No'] ?? '')), $filtered);
-    $allDomainNos = array_values(array_filter($allDomainNos, static fn (string $n): bool => $n !== ''));
-    $filterLookup = $allDomainNos !== [] ? $securityLevelService->getAllLevelsForDomains($tenantId, $allDomainNos) : [];
-    $filtered = array_values(array_filter($filtered, static function (array $domain) use ($securityLevel, $filterLookup): bool {
-        $domainNo = trim((string) ($domain['No'] ?? ''));
-        $currentLevel = $filterLookup[$domainNo] ?? 'normal';
-
-        return $currentLevel === $securityLevel;
-    }));
-}
-
-// Sorting
-$total = count($filtered);
-
-usort($filtered, static function (array $a, array $b) use ($order, $dir): int {
-    $va = (string) ($a[$order] ?? '');
-    $vb = (string) ($b[$order] ?? '');
-    $cmp = strnatcasecmp($va, $vb);
-
-    return $dir === 'desc' ? -$cmp : $cmp;
-});
-
-// Pagination
-$rows = array_slice($filtered, $offset, $limit);
-
-// Security level enrichment for displayed rows
-$securityLevelLookup = [];
-if ($tenantId > 0) {
-    $securityLevelService = app(DomainSecurityLevelService::class);
-    $pagedDomainNos = array_map(static fn (array $d): string => trim((string) ($d['No'] ?? '')), $rows);
-    $pagedDomainNos = array_values(array_filter($pagedDomainNos, static fn (string $n): bool => $n !== ''));
-    if ($pagedDomainNos !== []) {
-        $securityLevelLookup = $securityLevelService->getAllDetailsForDomains($tenantId, $pagedDomainNos);
-    }
-}
-
-// Row preparation
-$stateVariantMap = [
-    'Aktiv' => 'success',
-    'In Vorbereitung' => 'warning',
-];
-
-$debitorBaseUrl = lurl('helpdesk/debitor/');
-
-$preparedRows = [];
-foreach ($rows as $domain) {
-    $customerNo = trim((string) ($domain['Customer_No'] ?? ''));
-    $domainState = (string) ($domain['State'] ?? '');
-    $domainNo = (string) ($domain['No'] ?? '');
-    $details = $securityLevelLookup[$domainNo] ?? null;
-    $level = $details['level'] ?? 'normal';
-    $note = $details['note'] ?? '';
-
-    $preparedRows[] = [
-        'No' => $domainNo,
-        'Customer_No' => $customerNo,
-        'Customer_Name' => (string) ($domain['Customer_Name'] ?? ''),
-        'URL' => (string) ($domain['URL'] ?? ''),
-        'State' => $domainState,
-        'state_variant' => $stateVariantMap[$domainState] ?? 'neutral',
-        'Administration' => (string) ($domain['Administration'] ?? ''),
-        'contract_type' => (string) ($domain['contract_type'] ?? ''),
-        'contract_no' => (string) ($domain['contract_no'] ?? ''),
-        'debitor_url' => $customerNo !== '' ? $debitorBaseUrl . rawurlencode($customerNo) : '',
-        'security_level' => $level,
-        'security_level_variant' => DomainSecurityLevelService::getBadgeVariant($level),
-        'security_level_note' => $note,
-    ];
-}
-
-gridJsonDataResult($preparedRows, $total);
+gridJsonDataResult($result['rows'], $result['total']);
--- a/modules/helpdesk/pages/helpdesk/domains/export().php
+++ b/modules/helpdesk/pages/helpdesk/domains/export().php
@@ -0,0 +1,48 @@
+<?php
+
+use MintyPHP\Http\SessionStoreInterface;
+use MintyPHP\Module\Helpdesk\HelpdeskAuthorizationPolicy;
+use MintyPHP\Module\Helpdesk\Service\DomainListService;
+use MintyPHP\Service\Export\ExportColumn;
+use MintyPHP\Support\Guard;
+
+Guard::requireLogin();
+Guard::requireAbilityOrForbidden(HelpdeskAuthorizationPolicy::ABILITY_ACCESS);
+exportRequireGetRequest();
+
+$request = requestInput();
+$session = app(SessionStoreInterface::class)->all();
+$tenantId = (int) ($session['current_tenant']['id'] ?? 0);
+
+$filters = gridParseFiltersFromSchemaFile(__DIR__ . '/filter-schema.php');
+$filters['limit'] = exportCapLimit($request->query('limit'), 5000);
+$filters['offset'] = 0;
+
+$result = app(DomainListService::class)->query($tenantId, $filters);
+
+$levelLabels = [
+    'niedrig' => t('Low'),
+    'normal' => t('Normal'),
+    'hoch' => t('High'),
+    'kritisch' => t('Critical'),
+];
+
+$columns = [
+    new ExportColumn(t('No.'), static fn (array $row): string => (string) ($row['No'] ?? '')),
+    new ExportColumn(t('Customer No.'), static fn (array $row): string => (string) ($row['Customer_No'] ?? '')),
+    new ExportColumn(t('Customer Name'), static fn (array $row): string => (string) ($row['Customer_Name'] ?? '')),
+    new ExportColumn(t('URL'), static fn (array $row): string => (string) ($row['URL'] ?? '')),
+    new ExportColumn(t('Contract type'), static fn (array $row): string => (string) ($row['contract_type'] ?? '')),
+    new ExportColumn(t('Contract No.'), static fn (array $row): string => (string) ($row['contract_no'] ?? '')),
+    new ExportColumn(t('State'), static fn (array $row): string => (string) ($row['State'] ?? '')),
+    new ExportColumn(t('Administration'), static fn (array $row): string => (string) ($row['Administration'] ?? '')),
+    new ExportColumn(t('Security level'), static function (array $row) use ($levelLabels): string {
+        $level = (string) ($row['security_level'] ?? 'normal');
+        return (string) ($levelLabels[$level] ?? $level);
+    }),
+    new ExportColumn(t('Note'), static fn (array $row): string => (string) ($row['security_level_note'] ?? '')),
+];
+
+$filename = 'helpdesk-domains-' . date('Ymd-His') . '.csv';
+
+exportSendCsv($filename, $result['rows'], $columns, exportResolveFlavor($request));
--- a/modules/helpdesk/pages/helpdesk/domains/index(default).phtml
+++ b/modules/helpdesk/pages/helpdesk/domains/index(default).phtml
@@ -21,6 +21,9 @@ $isConfigured = $isConfigured ?? false;
 <?php endif; ?>

 <?php
+ob_start();
+require templatePath('partials/app-list-export-dropdown.phtml');
+$listTitleActionsHtml = ob_get_clean();
 $listTitle = t('Domains');
 require templatePath('partials/app-list-titlebar.phtml');
 ?>
@@ -72,6 +75,7 @@ require templatePath('partials/app-list-filters.phtml');
    'dataUrl' => lurl('helpdesk/domains-data'),
    'domainBaseUrl' => lurl('helpdesk/domain/'),
    'securityLevelDataUrl' => lurl('helpdesk/domains/security-level-data'),
+    'exportUrl' => lurl('helpdesk/domains/export'),
    'gridLang' => gridLang(),
    'gridSearch' => $searchConfig,
    'filterSchema' => $clientFilterSchema,
--- a/modules/helpdesk/tests/Module/Helpdesk/Service/DomainListServiceTest.php
+++ b/modules/helpdesk/tests/Module/Helpdesk/Service/DomainListServiceTest.php
@@ -0,0 +1,150 @@
+<?php
+
+namespace MintyPHP\Tests\Module\Helpdesk\Service;
+
+use MintyPHP\Module\Helpdesk\Service\BcODataGateway;
+use MintyPHP\Module\Helpdesk\Service\DomainListService;
+use MintyPHP\Module\Helpdesk\Service\DomainSecurityLevelService;
+use PHPUnit\Framework\TestCase;
+
+class DomainListServiceTest extends TestCase
+{
+    private const TENANT_ID = 7;
+
+    public function testFiltersByState(): void
+    {
+        $service = $this->buildService($this->sampleDomains());
+        $result = $service->query(self::TENANT_ID, ['state' => 'Aktiv']);
+
+        $this->assertSame(2, $result['total']);
+        $this->assertEqualsCanonicalizing(
+            ['DNS001', 'DNS002'],
+            array_column($result['rows'], 'No')
+        );
+    }
+
+    public function testFiltersBySearchAcrossMultipleColumns(): void
+    {
+        $service = $this->buildService($this->sampleDomains());
+        $result = $service->query(self::TENANT_ID, ['search' => 'example.com']);
+
+        $this->assertSame(1, $result['total']);
+        $this->assertSame('DNS001', $result['rows'][0]['No']);
+    }
+
+    public function testAllValueDisablesFilter(): void
+    {
+        $service = $this->buildService($this->sampleDomains());
+        $result = $service->query(self::TENANT_ID, ['state' => 'all']);
+
+        $this->assertSame(3, $result['total']);
+    }
+
+    public function testSortingAscAndDesc(): void
+    {
+        $domains = $this->sampleDomains();
+        $service = $this->buildService($domains);
+
+        $asc = $service->query(self::TENANT_ID, ['order' => 'No', 'dir' => 'asc']);
+        $desc = $service->query(self::TENANT_ID, ['order' => 'No', 'dir' => 'desc']);
+
+        $this->assertSame(['DNS001', 'DNS002', 'DNS003'], array_column($asc['rows'], 'No'));
+        $this->assertSame(['DNS003', 'DNS002', 'DNS001'], array_column($desc['rows'], 'No'));
+    }
+
+    public function testLimitAndOffsetPaging(): void
+    {
+        $service = $this->buildService($this->sampleDomains());
+        $result = $service->query(self::TENANT_ID, [
+            'order' => 'No',
+            'dir' => 'asc',
+            'limit' => 1,
+            'offset' => 1,
+        ]);
+
+        $this->assertSame(3, $result['total'], 'total counts the filtered set before paging');
+        $this->assertCount(1, $result['rows']);
+        $this->assertSame('DNS002', $result['rows'][0]['No']);
+    }
+
+    public function testEnrichesRowsWithSecurityLevelVariantAndNote(): void
+    {
+        $levels = $this->createMock(DomainSecurityLevelService::class);
+        $levels->method('getAllDetailsForDomains')->willReturn([
+            'DNS001' => ['level' => 'hoch', 'note' => 'important'],
+        ]);
+
+        $gateway = $this->createMock(BcODataGateway::class);
+        $gateway->method('listDomains')->willReturn($this->sampleDomains());
+        $gateway->method('listDomainContractLines')->willReturn([]);
+
+        $service = new DomainListService($gateway, $levels);
+        $result = $service->query(self::TENANT_ID, ['order' => 'No', 'dir' => 'asc']);
+
+        $first = $result['rows'][0];
+        $this->assertSame('hoch', $first['security_level']);
+        $this->assertSame('important', $first['security_level_note']);
+        $this->assertSame(DomainSecurityLevelService::getBadgeVariant('hoch'), $first['security_level_variant']);
+    }
+
+    public function testBcFailureReturnsEmptyResult(): void
+    {
+        $gateway = $this->createMock(BcODataGateway::class);
+        $gateway->method('listDomains')->willThrowException(new \RuntimeException('upstream down'));
+
+        $levels = $this->createMock(DomainSecurityLevelService::class);
+
+        $service = new DomainListService($gateway, $levels);
+        $result = $service->query(self::TENANT_ID, []);
+
+        $this->assertSame(['rows' => [], 'total' => 0], $result);
+    }
+
+    public function testSecurityLevelFilterRestrictsTenantScoped(): void
+    {
+        $gateway = $this->createMock(BcODataGateway::class);
+        $gateway->method('listDomains')->willReturn($this->sampleDomains());
+        $gateway->method('listDomainContractLines')->willReturn([]);
+
+        $levels = $this->createMock(DomainSecurityLevelService::class);
+        $levels->expects($this->once())
+            ->method('getAllLevelsForDomains')
+            ->with(self::TENANT_ID, $this->callback(static fn (array $nos): bool => $nos === ['DNS001', 'DNS002', 'DNS003']))
+            ->willReturn(['DNS002' => 'hoch']);
+        $levels->method('getAllDetailsForDomains')->willReturn([]);
+
+        $service = new DomainListService($gateway, $levels);
+        $result = $service->query(self::TENANT_ID, ['security_level' => 'hoch']);
+
+        $this->assertSame(1, $result['total']);
+        $this->assertSame('DNS002', $result['rows'][0]['No']);
+    }
+
+    /**
+     * @param list<array<string,mixed>> $domains
+     */
+    private function buildService(array $domains): DomainListService
+    {
+        $gateway = $this->createMock(BcODataGateway::class);
+        $gateway->method('listDomains')->willReturn($domains);
+        $gateway->method('listDomainContractLines')->willReturn([]);
+
+        $levels = $this->createMock(DomainSecurityLevelService::class);
+        $levels->method('getAllDetailsForDomains')->willReturn([]);
+        $levels->method('getAllLevelsForDomains')->willReturn([]);
+
+        return new DomainListService($gateway, $levels);
+    }
+
+    /**
+     * @return list<array<string,mixed>>
+     */
+    private function sampleDomains(): array
+    {
+        return [
+            ['No' => 'DNS001', 'Customer_No' => 'C-1', 'Customer_Name' => 'Acme GmbH',   'URL' => 'example.com', 'State' => 'Aktiv',            'Administration' => 'A'],
+            ['No' => 'DNS002', 'Customer_No' => 'C-2', 'Customer_Name' => 'Beta AG',     'URL' => 'beta.de',     'State' => 'Aktiv',            'Administration' => 'A'],
+            ['No' => 'DNS003', 'Customer_No' => 'C-3', 'Customer_Name' => 'Gamma KG',    'URL' => 'gamma.io',    'State' => 'In Vorbereitung', 'Administration' => 'B'],
+        ];
+    }
+}
--- a/modules/helpdesk/web/js/pages/helpdesk-domains-index.js
+++ b/modules/helpdesk/web/js/pages/helpdesk-domains-index.js
@@ -2,6 +2,7 @@ import { createListPageModule } from '/js/core/app-list-page-module.js';
 import { escapeHtml, withCurrentListReturn } from '/js/pages/app-list-utils.js';
 import { postForm } from '/js/core/app-http.js';
 import { showAsyncFlash } from '/js/components/app-async-flash.js';
+import { initListExport } from '/js/core/app-list-export.js';

 const LEVEL_LABELS = {
  niedrig: 'Low',
@@ -314,6 +315,10 @@ createListPageModule({

    gridRef.grid = gridConfig?.grid || null;

+    if (gridConfig && config.exportUrl) {
+      initListExport({ gridConfig, exportUrl: config.exportUrl });
+    }
+
    return gridConfig;
  },
 });