Maximilian Stubhan
f96773da0f
Adds the Berichte export pipeline (/api/export/{report,events,employees})
with shared CSV/XLSX writers in lib/export.ts and lib/reports-data.ts.
Security pass alongside it: sanitize .or() search terms against PostgREST
filter injection, sanitize spreadsheet cells against CSV/Excel formula
injection, stop leaking raw DB error messages to clients, harden the
service-role client with server-only, add baseline security headers, and
bump the vulnerable nested postcss via an override.
63 lines
3.1 KiB
TypeScript
63 lines
3.1 KiB
TypeScript
import { NextResponse, type NextRequest } from "next/server";
|
|
import { exportFilename, exportResponseHeaders, toCsv, toXlsx, type ExportColumn } from "@/lib/export";
|
|
import { EVENT_TYPE_LABELS, type OrgLookups, type ReportEvent } from "@/lib/reports";
|
|
import { loadEventHistory, loadOrgLookups } from "@/lib/reports-data";
|
|
import { createClient } from "@/lib/supabase/server";
|
|
import type { HistoryEventType } from "@/lib/supabase/types";
|
|
|
|
// Full raw event-log dump — one row per employee_history entry in the
|
|
// selected period (default: current year), every event type unless one is
|
|
// picked, org columns resolved from each affected employee's current
|
|
// placement (see loadEventHistory).
|
|
export async function GET(request: NextRequest) {
|
|
const supabase = await createClient();
|
|
const {
|
|
data: { user },
|
|
} = await supabase.auth.getUser();
|
|
if (!user) return NextResponse.json({ error: "Nicht angemeldet." }, { status: 401 });
|
|
|
|
const { data: profile } = await supabase.from("profiles").select("role, is_active").eq("id", user.id).maybeSingle();
|
|
if (profile?.role !== "hr" || profile?.is_active !== true) {
|
|
return NextResponse.json({ error: "Nicht berechtigt." }, { status: 403 });
|
|
}
|
|
|
|
const params = request.nextUrl.searchParams;
|
|
const format = params.get("format") === "xlsx" ? "xlsx" : "csv";
|
|
const eventType = (params.get("eventType") as HistoryEventType) || undefined;
|
|
const from = params.get("from") ?? undefined;
|
|
const to = params.get("to") ?? undefined;
|
|
|
|
const [{ lookups }, events] = await Promise.all([
|
|
loadOrgLookups(supabase),
|
|
loadEventHistory(supabase, {
|
|
eventType,
|
|
division: params.get("division") ?? undefined,
|
|
location: params.get("location") ?? undefined,
|
|
from,
|
|
to,
|
|
}),
|
|
]);
|
|
|
|
const columns = eventExportColumns(lookups);
|
|
const filename = exportFilename(`ereignisse-${eventType ?? "alle"}`, format);
|
|
const body = format === "xlsx" ? await toXlsx(events, columns, "Ereignisse") : toCsv(events, columns);
|
|
// TS 5.9's Uint8Array<ArrayBufferLike> vs DOM's BlobPart/ArrayBuffer<> generic
|
|
// mismatch (microsoft/TypeScript#59417) — a real Uint8Array works fine here.
|
|
return new NextResponse(new Blob([body as BlobPart]), { headers: exportResponseHeaders(filename, format) });
|
|
}
|
|
|
|
function eventExportColumns(lookups: OrgLookups): ExportColumn<ReportEvent>[] {
|
|
return [
|
|
{ header: "Datum", get: (e) => e.event_date, kind: "date" },
|
|
{ header: "Ereignistyp", get: (e) => EVENT_TYPE_LABELS[e.event_type] ?? e.event_type },
|
|
{ header: "Vorname", get: (e) => e.first_name },
|
|
{ header: "Nachname", get: (e) => e.last_name },
|
|
{ header: "Position", get: (e) => e.job_title },
|
|
{ header: "Bereich", get: (e) => lookups.divisionName.get(e.division_id) ?? "" },
|
|
{ header: "Abteilung", get: (e) => (e.team_id ? (lookups.departmentNameByTeam.get(e.team_id) ?? "") : "") },
|
|
{ header: "Team", get: (e) => (e.team_id ? (lookups.teamName.get(e.team_id) ?? "") : "") },
|
|
{ header: "Standort", get: (e) => lookups.locationName.get(e.location_id) ?? "" },
|
|
{ header: "Beschreibung", get: (e) => e.description },
|
|
];
|
|
}
|