Bufdir Export

The export step is what transforms the internal report into an artifact organizations can actually submit to Bufdir. Without it, the report generation feature delivers no external value. All four organizations cited one-click Bufdir submission as the top-level goal for the reporting module, making this feature the completion of a critical user journey. The audit log of each export event also satisfies compliance requirements: organizations need to demonstrate to Bufdir that specific reports were submitted on specific dates, and the export log provides that paper trail automatically, replacing manual record-keeping.

Implement as a Next.js API route that reads from the bufdir_report_snapshots table (never re-querying live data) and streams the formatted file to the client. Use ExportFileGenerator as a server-side utility that accepts a snapshot record and emits the required format. The format should be configurable per organization once Bufdir finalizes the specification (the source doc notes Norse Digital Products will negotiate with Bufdir). Log every export to accounting_export_logs (or a dedicated bufdir_export_logs table if the schema requires separation) with timestamp, org_id, snapshot_id, and exporting user_id. Apply Org Admin role guard at the API layer.