# Phase 14 — Reporting and executive analytics

Phase 14 adds a centralized airline-scoped reporting engine with reusable filters, 47 operational reports, protected exports, print-friendly output, a modular PDF renderer contract, and cacheable executive analytics snapshots.

## Files created

- `database/migrations/2026_07_19_000015_create_reporting_analytics_tables.php`
- `app/Modules/Reporting/Repositories/ReportingRepository.php`
- `app/Modules/Reporting/Services/ReportingService.php`
- `app/Modules/Reporting/Controllers/ReportingController.php`
- `app/Shared/Reporting/PdfReportRenderer.php`
- `app/Shared/Reporting/DeferredPdfReportRenderer.php`
- `resources/views/reports/index.php`
- `resources/views/reports/show.php`
- `resources/views/reports/print.php`
- `resources/views/reports/executive.php`
- `docs/PHASE_14_IMPLEMENTATION.md`

## Files modified

- `routes/web.php`
- `database/seeders/RolesAndPermissionsSeeder.php`
- `resources/views/layouts/app.php`
- `public/assets/css/app.css`
- `public/assets/js/app.js`
- `tests/run.php`
- `README.md`

## Database migrations added

Migration `2026_07_19_000015` creates `executive_analytics_snapshots`. Each snapshot is airline- and period-scoped and stores flight performance, fleet availability, utilization, maintenance risk, financial KPIs, trends, critical alerts, top routes, and highest-cost aircraft as generated summary data without replacing source operational records.

## Security controls added

- Separate server-side permissions for report access, exports, executive analytics, and snapshot refresh.
- Airline scoping on every report, master-data option, executive query, and cached snapshot.
- Backend validation for dates, maximum report period, numeric master-data filters, statuses, and department filters.
- PDO prepared statements for every user-selected filter; filter values are never interpolated into SQL.
- CSV and spreadsheet exports neutralize formula-leading values and remove tab and line-break control characters.
- Export filenames are server generated; responses set explicit MIME types, attachment disposition, and `nosniff`.
- Report exports and executive snapshot refreshes are written to the audit log.
- Executive refresh is CSRF protected. Report and executive permissions are enforced in middleware and services.
- A 5,000-row execution ceiling limits accidental oversized responses and exports.

## Tests performed

- PHP syntax validation for all Phase 14 PHP files.
- Tailwind CSS and Alpine.js asset bundles rebuilt successfully with the bundled Node.js runtime.
- `php tests/run.php`: **53 passed, 0 failed**.
- Executed all 47 reports with every supported filter populated to validate aliases, parameters, airline scoping, and cross-module joins.
- Verified date-range rejection, filter normalization, CSV output, Excel-compatible output, print-friendly HTML, PDF abstraction status, audit records, executive refresh, snapshot upsert/load, protected routes, and required executive dashboard sections.
- Attempted `php cli migrate:status`; the workspace has no reachable configured MySQL connection.

## Remaining known limitations

- Native PDF generation is intentionally not bundled. The replaceable renderer contract is ready, and print-friendly HTML supports browser print-to-PDF.
- Excel-compatible export is UTF-8 tabular `.xls` output rather than a native `.xlsx` workbook, avoiding a new spreadsheet dependency.
- Executive snapshots refresh through the protected action. Deployments may call that action through an authorized scheduler if periodic refresh is required.
- Reports are capped at 5,000 rows per execution. Very large historical extracts should later use a queued export worker.
- Actual turnaround depends on complete actual off-block and on-block records.
- Profitability and contribution remain clearly labelled operational estimates where allocated costs are used; this is not a general ledger.
- MySQL migration execution remains pending until a reachable MySQL 8 database is configured.