Reports/Export builder (CSV/XLSX), plus a security fix pass

Adds the Berichte export pipeline (/api/export/{report,events,employees})
with shared CSV/XLSX writers in lib/export.ts and lib/reports-data.ts.

Security pass alongside it: sanitize .or() search terms against PostgREST
filter injection, sanitize spreadsheet cells against CSV/Excel formula
injection, stop leaking raw DB error messages to clients, harden the
service-role client with server-only, add baseline security headers, and
bump the vulnerable nested postcss via an override.

tests/unit/reports.test.ts

@@ -1,12 +1,14 @@
 import { describe, expect, it } from "vitest";
 import {
+  aggregateEvents,
   aggregateReport,
+  deriveStatusAsOf,
   groupKeyFor,
   measureValue,
   MEASURE_LABELS,
-  type Measure,
   type OrgLookups,
   type ReportEmployee,
+  type ReportEvent,
 } from "@/lib/reports";
 
 function emp(overrides: Partial<ReportEmployee> = {}): ReportEmployee {
@@ -76,9 +78,9 @@ describe("measureValue", () => {
     expect(measureValue([], "headcount")).toBe(0);
   });
 
-  it("counts headcount/hires/exits as row length", () => {
+  it("counts headcount as row length", () => {
     const rows = [emp(), emp({ id: "2" }), emp({ id: "3" })];
-    (["headcount", "hires", "exits"] as Measure[]).forEach((m) => expect(measureValue(rows, m)).toBe(3));
+    expect(measureValue(rows, "headcount")).toBe(3);
   });
 
   it("sums FTE as weekly_hours / 38.5", () => {
@@ -161,4 +163,74 @@ describe("aggregateReport", () => {
       ])
     );
   });
+
+  it("reconstructs headcount/avg_age/avg_tenure as of a past Stichtag, not today", () => {
+    // Entered 2019, exited 2021 — gone by today, but was active on 2020-06-01.
+    const employees = [emp({ id: "1", entry_date: "2019-01-01", exit_date: "2021-01-01", birth_date: "1990-01-01" })];
+    const asOf = "2020-06-01";
+    const rows = aggregateReport(employees, "headcount", "division", null, lookups, asOf);
+    expect(rows[0]).toMatchObject({ key: "Produktion", value: 1, count: 1 });
+    expect(measureValue(employees, "avg_age", asOf)).toBe(30);
+    expect(measureValue(employees, "avg_tenure", asOf)).toBeCloseTo(1.42, 1);
+  });
+});
+
+describe("deriveStatusAsOf", () => {
+  const base = { entry_date: "2020-01-01", exit_date: null as string | null, karenz_start_date: null as string | null, karenz_return_date: null as string | null };
+
+  it("is Geplant before the entry date", () => {
+    expect(deriveStatusAsOf({ ...base, entry_date: "2025-01-01" }, "2024-12-31")).toBe("Geplant");
+  });
+
+  it("is Ausgetreten on/after the exit date", () => {
+    expect(deriveStatusAsOf({ ...base, exit_date: "2022-06-01" }, "2022-06-01")).toBe("Ausgetreten");
+    expect(deriveStatusAsOf({ ...base, exit_date: "2022-06-01" }, "2022-05-31")).toBe("Aktiv");
+  });
+
+  it("is Karenz within the Karenz window, Aktiv once returned", () => {
+    const onKarenz = { ...base, karenz_start_date: "2023-01-01", karenz_return_date: "2023-07-01" };
+    expect(deriveStatusAsOf(onKarenz, "2023-03-01")).toBe("Karenz");
+    expect(deriveStatusAsOf(onKarenz, "2023-07-01")).toBe("Aktiv");
+    expect(deriveStatusAsOf(onKarenz, "2022-12-31")).toBe("Aktiv");
+  });
+});
+
+describe("aggregateEvents", () => {
+  const eventLookups: OrgLookups = {
+    ...lookups,
+    divisionName: new Map([
+      ["div-1", "Produktion"],
+      ["div-2", "IT"],
+    ]),
+  };
+
+  function ev(overrides: Partial<ReportEvent> = {}): ReportEvent {
+    return {
+      employee_id: "1",
+      first_name: "Maria",
+      last_name: "Gruber",
+      job_title: "Maschinenbediener:in",
+      division_id: "div-1",
+      team_id: "team-1",
+      location_id: "loc-1",
+      event_date: "2026-03-01",
+      event_type: "Eintritt",
+      description: "Eintritt als Maschinenbediener:in",
+      ...overrides,
+    };
+  }
+
+  it("counts every event, unlike a Bestand headcount which only sees the current entry_date", () => {
+    const events = [ev({ employee_id: "1" }), ev({ employee_id: "1", event_date: "2026-05-01", event_type: "Beförderung" }), ev({ employee_id: "2", division_id: "div-2" })];
+    const rows = aggregateEvents(events, "event_type", null, eventLookups);
+    expect(rows.find((r) => r.key === "Eintritt")).toMatchObject({ value: 2, count: 2 });
+    expect(rows.find((r) => r.key === "Beförderung")).toMatchObject({ value: 1, count: 1 });
+  });
+
+  it("groups by the affected employee's org unit and preserves the event description on drill-down", () => {
+    const events = [ev({ division_id: "div-1" }), ev({ division_id: "div-2", employee_id: "2" })];
+    const rows = aggregateEvents(events, "division", null, eventLookups);
+    const produktion = rows.find((r) => r.key === "Produktion")!;
+    expect(produktion.people[0]).toMatchObject({ id: "1", title: "Eintritt als Maschinenbediener:in", entry_date: "2026-03-01" });
+  });
 });

tests/unit/security.test.ts

@@ -0,0 +1,95 @@
+import { NextRequest } from "next/server";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { sanitizeForSpreadsheetCell, toCsv } from "@/lib/export";
+import { sanitizeIlikeTerm } from "@/lib/supabase/query";
+
+// The route under test imports lib/supabase/admin.ts, which is guarded by
+// `import "server-only"` — that throws when loaded outside Next's own
+// server compilation (e.g. here, under plain Vitest/Node). Mock it out:
+// these tests only exercise the auth guard, which returns before the real
+// admin client is ever created.
+vi.mock("@/lib/supabase/admin", () => ({ createAdminClient: vi.fn() }));
+
+describe("sanitizeForSpreadsheetCell", () => {
+  it("prefixes values that would be read as a formula by Excel/Sheets", () => {
+    expect(sanitizeForSpreadsheetCell("=SUM(A1:A2)")).toBe("'=SUM(A1:A2)");
+    expect(sanitizeForSpreadsheetCell("+1234")).toBe("'+1234");
+    expect(sanitizeForSpreadsheetCell("-1234")).toBe("'-1234");
+    expect(sanitizeForSpreadsheetCell("@cmd")).toBe("'@cmd");
+  });
+
+  it("leaves ordinary text untouched", () => {
+    expect(sanitizeForSpreadsheetCell("Gruber")).toBe("Gruber");
+    expect(sanitizeForSpreadsheetCell("Hauptstraße 1, 1200 Wien")).toBe("Hauptstraße 1, 1200 Wien");
+  });
+
+  it("toCsv escapes a formula-injection payload in a row value", () => {
+    const csv = toCsv([{ name: "=cmd|'/c calc'!A1" }], [{ header: "Name", get: (r: { name: string }) => r.name }]);
+    expect(csv).toContain("'=cmd");
+  });
+});
+
+describe("sanitizeIlikeTerm", () => {
+  it("strips PostgREST or-filter delimiter characters", () => {
+    expect(sanitizeIlikeTerm("a,b")).toBe("ab");
+    expect(sanitizeIlikeTerm("a(b)c")).toBe("abc");
+    // An attempt to close the current ilike condition and append another
+    // column filter is neutralized by removing the delimiters, not escaped
+    // into a differently-structured (but still injected) query.
+    expect(sanitizeIlikeTerm("x),sv_nummer.ilike.%")).toBe("xsv_nummer.ilike.%");
+  });
+
+  it("leaves a normal search term untouched", () => {
+    expect(sanitizeIlikeTerm("Gruber")).toBe("Gruber");
+  });
+});
+
+describe("cron auth guard (/api/cron/apply-pending-changes)", () => {
+  afterEach(() => {
+    vi.unstubAllEnvs();
+  });
+
+  async function callCronRoute(authorization?: string) {
+    // The route reads process.env.CRON_SECRET inside the handler on every
+    // request (not at module load time), so importing it once and reusing
+    // it across the stubbed-env cases below is safe.
+    const { GET } = await import("@/app/api/cron/apply-pending-changes/route");
+    const headers = new Headers();
+    if (authorization !== undefined) headers.set("authorization", authorization);
+    const request = new NextRequest("http://localhost/api/cron/apply-pending-changes", { headers });
+    return GET(request);
+  }
+
+  it("rejects the request when CRON_SECRET is not configured, even with a matching-looking header", async () => {
+    vi.stubEnv("CRON_SECRET", "");
+    const res = await callCronRoute("Bearer ");
+    expect(res.status).toBe(401);
+  });
+
+  it("rejects a request with no Authorization header", async () => {
+    vi.stubEnv("CRON_SECRET", "test-secret");
+    const res = await callCronRoute(undefined);
+    expect(res.status).toBe(401);
+  });
+
+  it("rejects a request with the wrong bearer token", async () => {
+    vi.stubEnv("CRON_SECRET", "test-secret");
+    const res = await callCronRoute("Bearer wrong-value");
+    expect(res.status).toBe(401);
+  });
+});
+
+describe("protected export route without a session (/api/export/employees)", () => {
+  it("returns 401 instead of running the query when there is no authenticated user", async () => {
+    vi.doMock("@/lib/supabase/server", () => ({
+      createClient: async () => ({
+        auth: { getUser: async () => ({ data: { user: null } }) },
+      }),
+    }));
+    const { GET } = await import("@/app/api/export/employees/route");
+    const request = new NextRequest("http://localhost/api/export/employees");
+    const res = await GET(request);
+    expect(res.status).toBe(401);
+    vi.doUnmock("@/lib/supabase/server");
+  });
+});