FIX_CORS_ERRO

app/Controllers/EmployeeRestController.php

@@ -986,13 +986,20 @@ class EmployeeRestController extends AdminController
             $policyName = $empData[0]['policy_name'] ?? 'Employee';
             $filename = preg_replace('/[^A-Za-z0-9_\-]/', '_', $policyName) . '-Employee-List.xlsx';
 
-            header('Content-Type: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet');
-            header('Content-Disposition: attachment;filename="' . $filename . '"');
-            header('Cache-Control: max-age=0');
-
+            // Write to memory and return via CI Response so CORS after() filters still run.
+            // Raw header() + exit skips filters and causes CORS errors for cross-origin fetch.
+            $tempFile = tempnam(sys_get_temp_dir(), 'emp_list_');
             $writer = new Xlsx($spreadsheet);
-            $writer->save('php://output');
-            exit;
+            $writer->save($tempFile);
+            $excelData = file_get_contents($tempFile);
+            @unlink($tempFile);
+
+            return $this->response
+                ->setStatusCode(200)
+                ->setHeader('Content-Type', 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet')
+                ->setHeader('Content-Disposition', 'attachment;filename="' . $filename . '"')
+                ->setHeader('Cache-Control', 'max-age=0')
+                ->setBody($excelData);
         } catch (\Exception $e) {
             return $this->respond(['status' => 'failed', 'code' => 500, 'data' => $e->getMessage()], 500);
         }