feat(db): phase 4 group 5 — dashboard/reports/settings/notifications/users routes to Drizzle

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/api/dashboard/export/route.ts

@@ -1,8 +1,11 @@
 export const dynamic = 'force-dynamic'
 
 import { NextRequest, NextResponse } from 'next/server'
-import { createClient } from '@/lib/supabase/server'
 import { getSession } from '@/lib/auth/get-session'
+import { withUser } from '@/lib/db/with-user'
+import { writeAuditLog } from '@/lib/db/audit'
+import { incidents, sites, zones } from '@/lib/db/schema'
+import { eq, desc } from 'drizzle-orm'
 import { rowsToCsv } from '@/lib/csv'
 
 export async function GET(request: NextRequest) {
@@ -20,53 +23,53 @@ export async function GET(request: NextRequest) {
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
   }
 
-  const supabase = await createClient()
-
-  const { data: incidents } = await supabase
-    .from('incidents')
-    .select(`
-      reference_no, incident_type, status, severity, reported_at, closed_at,
-      injury_involved, medical_status, lost_days,
-      sites (name), zones (name)
-    `)
-    .order('reported_at', { ascending: false })
+  const rows = await withUser(session.sub, async tx =>
+    tx.select({
+      referenceNo: incidents.referenceNo,
+      incidentType: incidents.incidentType,
+      status: incidents.status,
+      severity: incidents.severity,
+      reportedAt: incidents.reportedAt,
+      closedAt: incidents.closedAt,
+      injuryInvolved: incidents.injuryInvolved,
+      medicalStatus: incidents.medicalStatus,
+      lostDays: incidents.lostDays,
+      siteName: sites.name,
+      zoneName: zones.name,
+    })
+    .from(incidents)
+    .leftJoin(sites, eq(incidents.siteId, sites.id))
+    .leftJoin(zones, eq(incidents.zoneId, zones.id))
+    .orderBy(desc(incidents.reportedAt))
     .limit(10000)
-
-  const rows = incidents ?? []
+  )
 
   const headers = [
     'Reference', 'Type', 'Status', 'Severity', 'Site', 'Zone',
     'Reported At', 'Closed At', 'Injury Involved', 'Medical Status', 'Lost Days',
   ]
 
-  const csvRows = rows.map(inc => {
-    const siteName = (inc.sites as unknown as { name: string } | null)?.name ?? ''
-    const zoneName = (inc.zones as unknown as { name: string } | null)?.name ?? ''
-    return [
-      inc.reference_no ?? '',
-      inc.incident_type,
-      inc.status,
-      String(inc.severity ?? ''),
-      siteName,
-      zoneName,
-      inc.reported_at ? new Date(inc.reported_at as string).toISOString().split('T')[0] : '',
-      inc.closed_at ? new Date(inc.closed_at as string).toISOString().split('T')[0] : '',
-      inc.injury_involved ? 'Yes' : 'No',
-      inc.medical_status ?? '',
-      String(inc.lost_days ?? ''),
-    ]
-  })
+  const csvRows = rows.map(inc => [
+    inc.referenceNo ?? '',
+    inc.incidentType,
+    inc.status,
+    String(inc.severity ?? ''),
+    inc.siteName ?? '',
+    inc.zoneName ?? '',
+    inc.reportedAt ? new Date(inc.reportedAt).toISOString().split('T')[0] : '',
+    inc.closedAt ? new Date(inc.closedAt).toISOString().split('T')[0] : '',
+    inc.injuryInvolved ? 'Yes' : 'No',
+    inc.medicalStatus ?? '',
+    String(inc.lostDays ?? ''),
+  ])
 
   const csv = rowsToCsv(headers, csvRows)
   const safeRole = role.replace(/[^a-z0-9]/gi, '')
   const filename = `incidents-${safeRole}-${new Date().toISOString().split('T')[0]}.csv`
 
-  await supabase.rpc('write_audit_log', {
-    p_table_name: 'incidents',
-    p_record_id: session.sub,
-    p_action: 'export_csv',
-    p_new_value: { role, row_count: rows.length } as never,
-  })
+  await withUser(session.sub, async tx =>
+    writeAuditLog(tx, 'incidents', session.sub, 'export_csv', { role, row_count: rows.length })
+  )
 
   return new NextResponse(csv, {
     status: 200,