Maximilian Stubhan
f96773da0f
Adds the Berichte export pipeline (/api/export/{report,events,employees})
with shared CSV/XLSX writers in lib/export.ts and lib/reports-data.ts.
Security pass alongside it: sanitize .or() search terms against PostgREST
filter injection, sanitize spreadsheet cells against CSV/Excel formula
injection, stop leaking raw DB error messages to clients, harden the
service-role client with server-only, add baseline security headers, and
bump the vulnerable nested postcss via an override.
16 lines
635 B
TypeScript
16 lines
635 B
TypeScript
import "server-only";
|
|
import { createClient as createSupabaseClient } from "@supabase/supabase-js";
|
|
import type { Database } from "./types";
|
|
|
|
// Service-role client: bypasses RLS entirely. Server-only — never import this
|
|
// from a Client Component or anything bundled for the browser. The
|
|
// "server-only" import makes an accidental client-side import a build error
|
|
// instead of a runtime one.
|
|
export function createAdminClient() {
|
|
return createSupabaseClient<Database>(
|
|
process.env.NEXT_PUBLIC_SUPABASE_URL!,
|
|
process.env.SUPABASE_SERVICE_ROLE_KEY!,
|
|
{ auth: { autoRefreshToken: false, persistSession: false } }
|
|
);
|
|
}
|