Reports/Export builder (CSV/XLSX), plus a security fix pass

Adds the Berichte export pipeline (/api/export/{report,events,employees})
with shared CSV/XLSX writers in lib/export.ts and lib/reports-data.ts.

Security pass alongside it: sanitize .or() search terms against PostgREST
filter injection, sanitize spreadsheet cells against CSV/Excel formula
injection, stop leaking raw DB error messages to clients, harden the
service-role client with server-only, add baseline security headers, and
bump the vulnerable nested postcss via an override.

app/(app)/audit/page.tsx

@@ -2,6 +2,7 @@ import Link from "next/link";
 import { Suspense } from "react";
 import { AuditFilters } from "@/components/audit/AuditFilters";
 import { actionBadgeStyle } from "@/lib/colors";
+import { sanitizeIlikeTerm } from "@/lib/supabase/query";
 import { createClient } from "@/lib/supabase/server";
 
 const PAGE_SIZE = 25;
@@ -38,7 +39,7 @@ export default async function AuditPage({ searchParams }: { searchParams: Promis
 
   if (params.action) query = query.eq("action", params.action);
   if (params.q) {
-    const q = params.q.trim();
+    const q = sanitizeIlikeTerm(params.q.trim());
     query = query.or(`target_label.ilike.%${q}%,details.ilike.%${q}%,actor_name.ilike.%${q}%`);
   }
 

app/(app)/employees/page.tsx

@@ -5,6 +5,7 @@ import { Avatar } from "@/components/ui/Avatar";
 import { StatusChip } from "@/components/ui/StatusChip";
 import { fmtDate } from "@/lib/format";
 import { breadcrumbFor, loadOrgMaps } from "@/lib/org";
+import { sanitizeIlikeTerm } from "@/lib/supabase/query";
 import { createClient } from "@/lib/supabase/server";
 import type { EmploymentStatus } from "@/lib/supabase/types";
 
@@ -49,7 +50,8 @@ export default async function EmployeesPage({ searchParams }: EmployeesPageProps
     if (/^\d+$/.test(q)) {
       query = query.eq("personnel_number", Number(q));
     } else {
-      query = query.or(`first_name.ilike.%${q}%,last_name.ilike.%${q}%,job_title.ilike.%${q}%`);
+      const term = sanitizeIlikeTerm(q);
+      query = query.or(`first_name.ilike.%${term}%,last_name.ilike.%${term}%,job_title.ilike.%${term}%`);
     }
   }
   if (params.division) query = query.eq("division_id", params.division);

app/(app)/reports/page.tsx

@@ -1,17 +1,12 @@
 import { Suspense } from "react";
 import { ReportsPageClient } from "@/components/reports/ReportsPageClient";
-import {
-  aggregateReport,
-  DATE_SCOPED_MEASURES,
-  type GroupDimension,
-  type Measure,
-  type OrgLookups,
-  type ReportEmployee,
-} from "@/lib/reports";
+import { aggregateEvents, aggregateReport, sumValues, totalForRows, type EventGroupDimension, type GroupDimension, type Measure } from "@/lib/reports";
+import { loadEventHistory, loadOrgLookups, loadSnapshotEmployees } from "@/lib/reports-data";
 import { createClient } from "@/lib/supabase/server";
-import type { EmploymentStatus, EmploymentType } from "@/lib/supabase/types";
+import type { HistoryEventType } from "@/lib/supabase/types";
 
 type SearchParams = {
+  mode?: string;
   measure?: string;
   group?: string;
   split?: string;
@@ -19,6 +14,8 @@ type SearchParams = {
   location?: string;
   status?: string;
   employment?: string;
+  asOf?: string;
+  eventType?: string;
   from?: string;
   to?: string;
 };
@@ -26,92 +23,78 @@ type SearchParams = {
 export default async function ReportsPage({ searchParams }: { searchParams: Promise<SearchParams> }) {
   const params = await searchParams;
   const supabase = await createClient();
+  const mode = params.mode === "events" ? "events" : "snapshot";
 
-  const measure = (params.measure as Measure) || "headcount";
-  const group = (params.group as GroupDimension) || "division";
-  const split = (params.split as GroupDimension) || undefined;
-
-  const [{ data: divisions }, { data: departments }, { data: teams }, { data: locations }] = await Promise.all([
-    supabase.from("divisions").select("id, name").order("name"),
-    supabase.from("departments").select("id, name"),
-    supabase.from("teams").select("id, name, department_id"),
-    supabase.from("locations").select("id, name").order("name"),
-  ]);
-
-  const departmentNameById = new Map((departments ?? []).map((d) => [d.id, d.name]));
-  const lookups: OrgLookups = {
-    divisionName: new Map((divisions ?? []).map((d) => [d.id, d.name])),
-    departmentNameByTeam: new Map((teams ?? []).map((t) => [t.id, departmentNameById.get(t.department_id) ?? "Unbekannt"])),
-    teamName: new Map((teams ?? []).map((t) => [t.id, t.name])),
-    locationName: new Map((locations ?? []).map((l) => [l.id, l.name])),
-  };
-
-  let query = supabase
-    .from("employees")
-    .select(
-      "id, first_name, last_name, job_title, division_id, team_id, location_id, status, employment_type, contract_type, entry_date, exit_date, weekly_hours, source, paygrade, birth_date, gender"
-    );
-
-  if (params.division) query = query.eq("division_id", params.division);
-  if (params.location) query = query.eq("location_id", params.location);
-  if (params.status) query = query.eq("status", params.status as EmploymentStatus);
-  if (params.employment) query = query.eq("employment_type", params.employment as EmploymentType);
-
-  const isDateScoped = DATE_SCOPED_MEASURES.includes(measure);
-  const currentYear = new Date().getFullYear();
-  const from = params.from || `${currentYear}-01-01`;
-  const to = params.to || `${currentYear}-12-31`;
-  if (isDateScoped) {
-    if (measure === "hires") query = query.gte("entry_date", from).lte("entry_date", to);
-    else query = query.gte("exit_date", from).lte("exit_date", to).not("exit_date", "is", null);
-  } else if (!params.status) {
-    query = query.in("status", ["Aktiv", "Karenz"]);
-  }
-
-  const { data: employeesData } = await query;
-  const employees = (employeesData ?? []) as ReportEmployee[];
-
-  const rows = aggregateReport(employees, measure, group, split ?? null, lookups);
-  const total = measureValueForTotal(rows, measure);
-
-  const {
-    data: { user },
-  } = await supabase.auth.getUser();
+  const [{ lookups, divisions, locations }, { data: userRes }] = await Promise.all([loadOrgLookups(supabase), supabase.auth.getUser()]);
+  const user = userRes.user;
   const { data: savedReports } = user
     ? await supabase.from("saved_reports").select("id, name, config").eq("created_by", user.id).order("created_at", { ascending: false })
     : { data: [] };
 
+  if (mode === "events") {
+    const group = (params.group as EventGroupDimension) || "event_type";
+    const split = (params.split as EventGroupDimension) || undefined;
+    const eventType = (params.eventType as HistoryEventType) || undefined;
+
+    const events = await loadEventHistory(supabase, { eventType, division: params.division, location: params.location, from: params.from, to: params.to });
+    const rows = aggregateEvents(events, group, split ?? null, lookups);
+    const total = sumValues(rows);
+
+    return (
+      <Suspense>
+        <ReportsPageClient
+          mode="events"
+          eventGroup={group}
+          eventSplit={split ?? ""}
+          eventType={eventType ?? ""}
+          eventFilters={{ division: params.division ?? "", location: params.location ?? "", from: params.from ?? "", to: params.to ?? "" }}
+          rows={rows}
+          total={total}
+          recordCount={events.length}
+          divisions={divisions}
+          locations={locations}
+          savedReports={savedReports ?? []}
+        />
+      </Suspense>
+    );
+  }
+
+  const measure = (params.measure as Measure) || "headcount";
+  const group = (params.group as GroupDimension) || "division";
+  const split = (params.split as GroupDimension) || undefined;
+  const asOf = params.asOf || undefined;
+
+  const employees = await loadSnapshotEmployees(supabase, {
+    division: params.division,
+    location: params.location,
+    status: params.status,
+    employment: params.employment,
+    asOf,
+  });
+  const rows = aggregateReport(employees, measure, group, split ?? null, lookups, asOf);
+  const total = totalForRows(rows, measure);
+
   return (
     <Suspense>
       <ReportsPageClient
+        mode="snapshot"
         measure={measure}
         group={group}
         split={split ?? ""}
+        asOf={asOf ?? ""}
         filters={{
           division: params.division ?? "",
           location: params.location ?? "",
           status: params.status ?? "",
           employment: params.employment ?? "",
-          from: params.from ?? "",
-          to: params.to ?? "",
         }}
         rows={rows}
         total={total}
         recordCount={employees.length}
-        divisions={divisions ?? []}
-        locations={locations ?? []}
+        divisions={divisions}
+        locations={locations}
         savedReports={savedReports ?? []}
       />
     </Suspense>
   );
 }
-
-function measureValueForTotal(rows: { value: number; count: number }[], measure: Measure): number {
-  if (["headcount", "fte", "hires", "exits"].includes(measure)) {
-    return rows.reduce((s, r) => s + r.value, 0);
-  }
-  // averages/ratios: weight by underlying count for a sensible overall figure
-  const totalCount = rows.reduce((s, r) => s + r.count, 0);
-  if (totalCount === 0) return 0;
-  return rows.reduce((s, r) => s + r.value * r.count, 0) / totalCount;
-}