setia/ims
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(audit): wrap admin + capa mutations with their audit writes in single transactions

Browse Source 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
admin
2026-07-24 06:44:05 +08:00
co-authored by Claude Sonnet 4.6
parent 8acca41ca1
commit 9c67014bb9
5 changed files with 145 additions and 114 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/api/admin/sites/route.ts
+37 -27
View File
@@ -2,7 +2,7 @@ export const dynamic = 'force-dynamic'
import { NextRequest, NextResponse } from 'next/server'
import { requireAdmin } from '@/lib/auth/require-admin'
import { asAdmin, withUser } from '@/lib/db/with-user'
import { asAdmin } from '@/lib/db/with-user'
import { sites, zones, incidents } from '@/lib/db/schema'
import { writeAuditLog } from '@/lib/db/audit'
import { eq, sql } from 'drizzle-orm'
@@ -20,13 +20,17 @@ export async function POST(request: NextRequest) {
if (!body.site_id) return NextResponse.json({ error: 'site_id required for zone' }, { status: 422 })
const qrCodeToken = crypto.randomUUID()
try {
const [zone] = await asAdmin(db =>
db.insert(zones).values({ siteId: body.site_id!, name, qrCodeToken }).returning({ id: zones.id, qrCodeToken: zones.qrCodeToken })
)
if (!zone) return NextResponse.json({ error: 'Insert failed' }, { status: 500 })
await withUser(session.sub, async tx => {
await writeAuditLog(tx, 'zones', zone.id, 'INSERT', { name, site_id: body.site_id })
let zone: { id: string; qrCodeToken: string } | undefined
await asAdmin(async db => {
await db.transaction(async tx => {
await tx.execute(sql`SELECT set_config('app.user_id', ${session.sub}, true)`)
const [result] = await tx.insert(zones).values({ siteId: body.site_id!, name, qrCodeToken }).returning({ id: zones.id, qrCodeToken: zones.qrCodeToken })
if (!result) throw new Error('Insert failed')
zone = result
await writeAuditLog(tx, 'zones', result.id, 'INSERT', { name, site_id: body.site_id })
})
})
if (!zone) return NextResponse.json({ error: 'Insert failed' }, { status: 500 })
return NextResponse.json({ id: zone.id, qr_code_token: zone.qrCodeToken }, { status: 201 })
} catch {
return NextResponse.json({ error: 'Insert failed' }, { status: 500 })
@@ -34,14 +38,18 @@ export async function POST(request: NextRequest) {
}
try {
const [site] = await asAdmin(db =>
db.insert(sites).values({ name, address: body.address ?? null }).returning({ id: sites.id })
)
if (!site) return NextResponse.json({ error: 'Insert failed' }, { status: 500 })
await withUser(session.sub, async tx => {
await writeAuditLog(tx, 'sites', site.id, 'INSERT', { name, address: body.address ?? null })
let siteId: string | undefined
await asAdmin(async db => {
await db.transaction(async tx => {
await tx.execute(sql`SELECT set_config('app.user_id', ${session.sub}, true)`)
const [site] = await tx.insert(sites).values({ name, address: body.address ?? null }).returning({ id: sites.id })
if (!site) throw new Error('Insert failed')
siteId = site.id
await writeAuditLog(tx, 'sites', site.id, 'INSERT', { name, address: body.address ?? null })
})
})
return NextResponse.json({ id: site.id }, { status: 201 })
if (!siteId) return NextResponse.json({ error: 'Insert failed' }, { status: 500 })
return NextResponse.json({ id: siteId }, { status: 201 })
} catch {
return NextResponse.json({ error: 'Insert failed' }, { status: 500 })
}
@@ -59,17 +67,18 @@ export async function PATCH(request: NextRequest) {
const [before] = await asAdmin(db =>
db.select().from(table).where(eq(table.id, body.id!)).limit(1)
)
const tableName = body.kind === 'zone' ? 'zones' : 'sites'
try {
await asAdmin(db =>
db.update(table).set({ active: body.active }).where(eq(table.id, body.id!))
)
await asAdmin(async db => {
await db.transaction(async tx => {
await tx.execute(sql`SELECT set_config('app.user_id', ${session.sub}, true)`)
await tx.update(table).set({ active: body.active }).where(eq(table.id, body.id!))
await writeAuditLog(tx, tableName, body.id!, 'admin_update', { active: body.active }, before ?? null)
})
})
} catch {
return NextResponse.json({ error: 'Update failed' }, { status: 500 })
}
const tableName = body.kind === 'zone' ? 'zones' : 'sites'
await withUser(session.sub, async tx => {
await writeAuditLog(tx, tableName, body.id!, 'admin_update', { active: body.active }, before ?? null)
})
return NextResponse.json({ ok: true })
}
@@ -97,9 +106,13 @@ export async function DELETE(request: NextRequest) {
db.select().from(body.kind === 'zone' ? zones : sites).where(eq((body.kind === 'zone' ? zones : sites).id, body.id!)).limit(1)
)
try {
await asAdmin(db =>
db.delete(body.kind === 'zone' ? zones : sites).where(eq((body.kind === 'zone' ? zones : sites).id, body.id!))
)
await asAdmin(async db => {
await db.transaction(async tx => {
await tx.execute(sql`SELECT set_config('app.user_id', ${session.sub}, true)`)
await tx.delete(body.kind === 'zone' ? zones : sites).where(eq((body.kind === 'zone' ? zones : sites).id, body.id!))
await writeAuditLog(tx, tableName, body.id!, 'DELETE', null, before ?? null)
})
})
} catch (e) {
const code = (e as { code?: string }).code
return NextResponse.json(
@@ -107,8 +120,5 @@ export async function DELETE(request: NextRequest) {
{ status: code === '23503' ? 409 : 500 },
)
}
await withUser(session.sub, async tx => {
await writeAuditLog(tx, tableName, body.id!, 'DELETE', null, before ?? null)
})
return NextResponse.json({ ok: true })
}
app/api/admin/trucks/route.ts
+26 -18
View File
@@ -2,7 +2,7 @@ export const dynamic = 'force-dynamic'
import { NextRequest, NextResponse } from 'next/server'
import { requireAdmin } from '@/lib/auth/require-admin'
import { asAdmin, withUser } from '@/lib/db/with-user'
import { asAdmin } from '@/lib/db/with-user'
import { trucks, incidents } from '@/lib/db/schema'
import { writeAuditLog } from '@/lib/db/audit'
import { eq, sql } from 'drizzle-orm'
@@ -16,14 +16,18 @@ export async function POST(request: NextRequest) {
if (!truck_no) return NextResponse.json({ error: 'truck_no required' }, { status: 422 })
try {
const [truck] = await asAdmin(db =>
db.insert(trucks).values({ truckNo: truck_no, carrier: (body.carrier ?? '').trim() || null }).returning({ id: trucks.id })
)
if (!truck) return NextResponse.json({ error: 'Insert failed' }, { status: 400 })
await withUser(session.sub, async tx => {
await writeAuditLog(tx, 'trucks', truck.id, 'INSERT', { truck_no, carrier: (body.carrier ?? '').trim() || null })
let truckId: string | undefined
await asAdmin(async db => {
await db.transaction(async tx => {
await tx.execute(sql`SELECT set_config('app.user_id', ${session.sub}, true)`)
const [truck] = await tx.insert(trucks).values({ truckNo: truck_no, carrier: (body.carrier ?? '').trim() || null }).returning({ id: trucks.id })
if (!truck) throw new Error('Insert failed')
truckId = truck.id
await writeAuditLog(tx, 'trucks', truck.id, 'INSERT', { truck_no, carrier: (body.carrier ?? '').trim() || null })
})
})
return NextResponse.json({ id: truck.id }, { status: 201 })
if (!truckId) return NextResponse.json({ error: 'Insert failed' }, { status: 400 })
return NextResponse.json({ id: truckId }, { status: 201 })
} catch (e) {
const code = (e as { code?: string }).code
return NextResponse.json(
@@ -44,15 +48,16 @@ export async function PATCH(request: NextRequest) {
db.select().from(trucks).where(eq(trucks.id, body.id!)).limit(1)
)
try {
await asAdmin(db =>
db.update(trucks).set({ active: body.active }).where(eq(trucks.id, body.id!))
)
await asAdmin(async db => {
await db.transaction(async tx => {
await tx.execute(sql`SELECT set_config('app.user_id', ${session.sub}, true)`)
await tx.update(trucks).set({ active: body.active }).where(eq(trucks.id, body.id!))
await writeAuditLog(tx, 'trucks', body.id!, 'admin_update', { active: body.active }, before ?? null)
})
})
} catch {
return NextResponse.json({ error: 'Update failed' }, { status: 500 })
}
await withUser(session.sub, async tx => {
await writeAuditLog(tx, 'trucks', body.id!, 'admin_update', { active: body.active }, before ?? null)
})
return NextResponse.json({ ok: true })
}
@@ -77,7 +82,13 @@ export async function DELETE(request: NextRequest) {
db.select().from(trucks).where(eq(trucks.id, body.id!)).limit(1)
)
try {
await asAdmin(db => db.delete(trucks).where(eq(trucks.id, body.id!)))
await asAdmin(async db => {
await db.transaction(async tx => {
await tx.execute(sql`SELECT set_config('app.user_id', ${session.sub}, true)`)
await tx.delete(trucks).where(eq(trucks.id, body.id!))
await writeAuditLog(tx, 'trucks', body.id!, 'DELETE', null, before ?? null)
})
})
} catch (e) {
const code = (e as { code?: string }).code
return NextResponse.json(
@@ -85,8 +96,5 @@ export async function DELETE(request: NextRequest) {
{ status: code === '23503' ? 409 : 500 },
)
}
await withUser(session.sub, async tx => {
await writeAuditLog(tx, 'trucks', body.id!, 'DELETE', null, before ?? null)
})
return NextResponse.json({ ok: true })
}
app/api/admin/users/route.ts
+50 -40
View File
@@ -4,10 +4,10 @@ import { NextRequest, NextResponse } from 'next/server'
import { isValidRole } from '@/lib/auth/roles'
import { requireAdmin } from '@/lib/auth/require-admin'
import { hashPassword } from '@/lib/auth/password'
import { asAdmin, withUser } from '@/lib/db/with-user'
import { asAdmin } from '@/lib/db/with-user'
import { users } from '@/lib/db/schema'
import { writeAuditLog } from '@/lib/db/audit'
import { desc, eq } from 'drizzle-orm'
import { desc, eq, sql } from 'drizzle-orm'
export async function GET() {
const { session } = await requireAdmin()
@@ -61,28 +61,33 @@ export async function POST(request: NextRequest) {
const passwordHash = await hashPassword(password)
const [created] = await asAdmin(db => db.insert(users).values({
name: body.name ?? '',
email,
phone: (body.phone ?? '').trim() || null,
role: (body.role as typeof users.$inferInsert['role']) ?? 'reporter',
siteId: body.site_id ?? null,
department: body.department ?? null,
passwordHash,
emailVerifiedAt: new Date(),
}).returning({ id: users.id }))
if (!created) {
return NextResponse.json({ error: 'User creation failed' }, { status: 500 })
}
await withUser(session.sub, async tx => {
await writeAuditLog(tx, 'users', created.id, 'created', {
email, role: body.role ?? 'reporter', site_id: body.site_id ?? null,
let createdId: string | undefined
await asAdmin(async db => {
await db.transaction(async tx => {
await tx.execute(sql`SELECT set_config('app.user_id', ${session.sub}, true)`)
const [created] = await tx.insert(users).values({
name: body.name ?? '',
email,
phone: (body.phone ?? '').trim() || null,
role: (body.role as typeof users.$inferInsert['role']) ?? 'reporter',
siteId: body.site_id ?? null,
department: body.department ?? null,
passwordHash,
emailVerifiedAt: new Date(),
}).returning({ id: users.id })
if (!created) throw new Error('User creation failed')
createdId = created.id
await writeAuditLog(tx, 'users', created.id, 'created', {
email, role: body.role ?? 'reporter', site_id: body.site_id ?? null,
})
})
})
return NextResponse.json({ id: created.id }, { status: 201 })
if (!createdId) {
return NextResponse.json({ error: 'User creation failed' }, { status: 500 })
}
return NextResponse.json({ id: createdId }, { status: 201 })
}
export async function PATCH(request: NextRequest) {
@@ -122,17 +127,20 @@ export async function PATCH(request: NextRequest) {
if (!before) return NextResponse.json({ error: 'User not found' }, { status: 404 })
try {
await asAdmin(db => db.update(users).set(drizzleUpdate).where(eq(users.id, body.id!)))
await asAdmin(async db => {
await db.transaction(async tx => {
await tx.execute(sql`SELECT set_config('app.user_id', ${session.sub}, true)`)
await tx.update(users).set(drizzleUpdate).where(eq(users.id, body.id!))
await writeAuditLog(
tx, 'users', body.id!, 'admin_update',
drizzleUpdate,
{ role: before.role, site_id: before.siteId, active: before.active, department: before.department },
)
})
})
} catch {
return NextResponse.json({ error: 'Update failed' }, { status: 500 })
}
await withUser(session.sub, async tx => {
await writeAuditLog(
tx, 'users', body.id!, 'admin_update',
drizzleUpdate,
{ role: before.role, site_id: before.siteId, active: before.active, department: before.department },
)
})
return NextResponse.json({ ok: true })
}
@@ -153,21 +161,23 @@ export async function DELETE(request: NextRequest) {
)
// Delete user directly from DB
const [deleted] = await asAdmin(db =>
db.delete(users).where(eq(users.id, id)).returning({ id: users.id })
)
let deleted: { id: string } | undefined
await asAdmin(async db => {
await db.transaction(async tx => {
await tx.execute(sql`SELECT set_config('app.user_id', ${session.sub}, true)`)
const [result] = await tx.delete(users).where(eq(users.id, id)).returning({ id: users.id })
deleted = result
if (result && target) {
await writeAuditLog(tx, 'users', id, 'deleted', {
email: target.email, name: target.name, role: target.role,
})
}
})
})
if (!deleted) {
return NextResponse.json({ error: 'User not found or deletion failed' }, { status: 500 })
}
if (target) {
await withUser(session.sub, async tx => {
await writeAuditLog(tx, 'users', id, 'deleted', {
email: target.email, name: target.name, role: target.role,
})
})
}
return NextResponse.json({ ok: true })
}