feat: CSV export endpoint for HSE and management dashboards

app/(protected)/hse/dashboard/page.tsx

@@ -109,9 +109,17 @@ export default async function HseDashboardPage() {
     <main className="max-w-4xl mx-auto px-4 py-6">
       <div className="flex items-center justify-between mb-6">
         <h1 className="text-2xl font-bold text-gray-900">Dashboard</h1>
-        <Link href="/hse/incidents" className="text-sm text-blue-600 hover:underline">
+        <div className="flex gap-3">
-          View all incidents →
+          <a
-        </Link>
+            href="/api/dashboard/export?role=hse"
+            className="text-sm text-gray-500 hover:text-gray-700 border border-gray-200 rounded-lg px-3 py-1.5"
+          >
+            Export CSV
+          </a>
+          <Link href="/hse/incidents" className="text-sm text-blue-600 hover:underline">
+            View all incidents →
+          </Link>
+        </div>
       </div>
 
       {/* Summary stats */}

app/(protected)/management/page.tsx

@@ -68,7 +68,15 @@ export default async function ManagementPage() {
 
   return (
     <main className="max-w-4xl mx-auto px-4 py-6">
-      <h1 className="text-2xl font-bold text-gray-900 mb-6">Management Dashboard</h1>
+      <div className="flex items-center justify-between mb-6">
+        <h1 className="text-2xl font-bold text-gray-900">Management Dashboard</h1>
+        <a
+          href="/api/dashboard/export?role=management"
+          className="text-sm text-gray-500 hover:text-gray-700 border border-gray-200 rounded-lg px-3 py-1.5"
+        >
+          Export CSV
+        </a>
+      </div>
 
       {/* Summary stats */}
       <div className="grid grid-cols-2 gap-4 sm:grid-cols-4 mb-6">

app/api/dashboard/export/route.ts

@@ -0,0 +1,84 @@
+export const dynamic = 'force-dynamic'
+
+import { NextRequest, NextResponse } from 'next/server'
+import { createClient } from '@/lib/supabase/server'
+
+function escapeCsv(value: string | number | null | undefined): string {
+  if (value === null || value === undefined) return ''
+  const str = String(value)
+  if (str.includes(',') || str.includes('"') || str.includes('\n')) {
+    return `"${str.replace(/"/g, '""')}"`
+  }
+  return str
+}
+
+function rowsToCsv(headers: string[], rows: string[][]): string {
+  const lines = [headers.map(escapeCsv).join(',')]
+  for (const row of rows) lines.push(row.map(escapeCsv).join(','))
+  return lines.join('\r\n')
+}
+
+export async function GET(request: NextRequest) {
+  const supabase = await createClient()
+  const { data: { user }, error: authError } = await supabase.auth.getUser()
+  if (authError || !user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+  const { data: profile } = await supabase.from('users').select('role').eq('id', user.id).single()
+  if (!profile) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+
+  const role = request.nextUrl.searchParams.get('role') ?? 'hse'
+
+  const allowedRoles: Record<string, string[]> = {
+    hse: ['hse', 'admin'],
+    management: ['management', 'admin'],
+  }
+
+  if (!allowedRoles[role] || !allowedRoles[role].includes(profile.role)) {
+    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+  }
+
+  const { data: incidents } = await supabase
+    .from('incidents')
+    .select(`
+      reference_no, incident_type, status, severity, reported_at, closed_at,
+      injury_involved, medical_status, lost_days,
+      sites (name), zones (name)
+    `)
+    .order('reported_at', { ascending: false })
+
+  const rows = incidents ?? []
+
+  const headers = [
+    'Reference', 'Type', 'Status', 'Severity', 'Site', 'Zone',
+    'Reported At', 'Closed At', 'Injury Involved', 'Medical Status', 'Lost Days',
+  ]
+
+  const csvRows = rows.map(inc => {
+    const siteName = (inc.sites as unknown as { name: string } | null)?.name ?? ''
+    const zoneName = (inc.zones as unknown as { name: string } | null)?.name ?? ''
+    return [
+      inc.reference_no ?? '',
+      inc.incident_type,
+      inc.status,
+      String(inc.severity ?? ''),
+      siteName,
+      zoneName,
+      inc.reported_at ? new Date(inc.reported_at as string).toISOString().split('T')[0] : '',
+      inc.closed_at ? new Date(inc.closed_at as string).toISOString().split('T')[0] : '',
+      inc.injury_involved ? 'Yes' : 'No',
+      inc.medical_status ?? '',
+      String(inc.lost_days ?? ''),
+    ]
+  })
+
+  const csv = rowsToCsv(headers, csvRows)
+  const filename = `incidents-${role}-${new Date().toISOString().split('T')[0]}.csv`
+
+  return new NextResponse(csv, {
+    status: 200,
+    headers: {
+      'Content-Type': 'text/csv; charset=utf-8',
+      'Content-Disposition': `attachment; filename="${filename}"`,
+    },
+  })
+}