feat(db): phase 4 group 4 — CAPA routes to Drizzle

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/api/capa/[id]/verify/route.ts

@@ -1,8 +1,11 @@
 export const dynamic = 'force-dynamic'
 
 import { NextRequest, NextResponse } from 'next/server'
-import { createClient } from '@/lib/supabase/server'
 import { getSession } from '@/lib/auth/get-session'
+import { withUser } from '@/lib/db/with-user'
+import { writeAuditLog } from '@/lib/db/audit'
+import { capaActions, incidents } from '@/lib/db/schema'
+import { eq, and, not, inArray } from 'drizzle-orm'
 import { createInAppNotifications } from '@/lib/notifications/in-app'
 
 export async function POST(
@@ -15,10 +18,10 @@ export async function POST(
   if (!['hse', 'admin'].includes(session.role))
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
 
-  const supabase = await createClient()
-
-  const { data: capa } = await supabase
-    .from('capa_actions').select('status, incident_id, owner_user_id').eq('id', id).single()
+  const [capa] = await withUser(session.sub, async tx =>
+    tx.select({ status: capaActions.status, incidentId: capaActions.incidentId, ownerUserId: capaActions.ownerUserId })
+      .from(capaActions).where(eq(capaActions.id, id)).limit(1)
+  )
   if (!capa) return NextResponse.json({ error: 'Not found' }, { status: 404 })
   if (capa.status !== 'pending_verification')
     return NextResponse.json({ error: 'CAPA must be pending_verification' }, { status: 409 })
@@ -31,54 +34,47 @@ export async function POST(
   const recheckDate = new Date(verifiedAt)
   recheckDate.setUTCDate(recheckDate.getUTCDate() + 30)
 
-  const update: Record<string, unknown> = {
-    status: body.verdict,
-    verified_by: session.sub,
-    verified_at: verifiedAt.toISOString(),
-    ...(body.verdict === 'verified'
-      ? {
-          effectiveness_recheck_date: recheckDate.toISOString().split('T')[0],
-          effectiveness_recheck_round: 0,
-        }
-      : {}),
-  }
+  await withUser(session.sub, async tx => {
+    await tx.update(capaActions).set({
+      status: body.verdict,
+      verifiedBy: session.sub,
+      verifiedAt,
+      ...(body.verdict === 'verified' ? {
+        effectivenessRecheckDate: recheckDate.toISOString().split('T')[0],
+        effectivenessRecheckRound: 0,
+      } : {}),
+    }).where(eq(capaActions.id, id))
 
-  const { error } = await supabase
-    .from('capa_actions').update(update).eq('id', id)
-
-  if (error) return NextResponse.json({ error: 'Update failed' }, { status: 500 })
-
-  await supabase.rpc('write_audit_log', {
-    p_table_name: 'capa_actions',
-    p_record_id: id,
-    p_action: body.verdict === 'verified' ? 'verified' : 'reopened',
-    p_new_value: { ...update, reopen_reason: body.reopen_reason ?? null },
+    await writeAuditLog(tx, 'capa_actions', id, body.verdict === 'verified' ? 'verified' : 'reopened', {
+      status: body.verdict, reopen_reason: body.reopen_reason ?? null,
+    })
   })
 
-  if (capa.owner_user_id) {
+  if (capa.ownerUserId) {
     await createInAppNotifications([{
-      userId: capa.owner_user_id,
+      userId: capa.ownerUserId,
       title: body.verdict === 'verified'
         ? 'Your CAPA action was verified'
         : `Your CAPA action was reopened${body.reopen_reason ? `: ${body.reopen_reason}` : ''}`,
       link: `/hse/capa/${id}`,
-      incidentId: capa.incident_id,
+      incidentId: capa.incidentId,
       capaId: id,
     }])
   }
 
-  // Check if all CAPAs for this incident are verified — if so, transition incident to verification
-  const { data: openCapas } = await supabase
-    .from('capa_actions')
-    .select('id')
-    .eq('incident_id', capa.incident_id)
-    .not('status', 'in', '(verified,closed)')
+  const openCapas = await withUser(session.sub, async tx =>
+    tx.select({ id: capaActions.id }).from(capaActions)
+      .where(and(
+        eq(capaActions.incidentId, capa.incidentId),
+        not(inArray(capaActions.status, ['verified', 'closed'])),
+      ))
+  )
 
-  if (!openCapas || openCapas.length === 0) {
-    await supabase
-      .from('incidents')
-      .update({ status: 'verification' })
-      .eq('id', capa.incident_id)
+  if (openCapas.length === 0) {
+    await withUser(session.sub, async tx => {
+      await tx.update(incidents).set({ status: 'verification' }).where(eq(incidents.id, capa.incidentId))
+      await writeAuditLog(tx, 'incidents', capa.incidentId, 'status_changed', { status: 'verification' })
+    })
   }
 
   return NextResponse.json({ ok: true })