feat(db): phase 4 group 5 — dashboard/reports/settings/notifications/users routes to Drizzle

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/api/settings/route.ts

@@ -1,8 +1,10 @@
 export const dynamic = 'force-dynamic'
 
 import { NextRequest, NextResponse } from 'next/server'
-import { createClient } from '@/lib/supabase/server'
 import { getSession } from '@/lib/auth/get-session'
+import { asAdmin, withUser } from '@/lib/db/with-user'
+import { writeAuditLog } from '@/lib/db/audit'
+import { appSettings } from '@/lib/db/schema'
 
 const ALLOWED_KEYS = [
   'DEEPSEEK_API_KEY',
@@ -16,14 +18,15 @@ export async function GET() {
   const session = await getSession()
   if (!session || session.role !== 'admin') return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
 
-  const supabase = await createClient()
-
-  const { data } = await supabase.from('app_settings').select('key, value, updated_at')
-  const masked = (data ?? []).map(row => ({
+  const data = await asAdmin(db =>
+    db.select({ key: appSettings.key, value: appSettings.value, updatedAt: appSettings.updatedAt })
+      .from(appSettings)
+  )
+  const masked = data.map(row => ({
     key: row.key,
     set: Boolean(row.value),
     masked_value: row.value ? `${row.value.slice(0, 8)}${'•'.repeat(12)}` : '',
-    updated_at: row.updated_at,
+    updated_at: row.updatedAt,
   }))
   return NextResponse.json(masked)
 }
@@ -32,8 +35,6 @@ export async function POST(request: NextRequest) {
   const session = await getSession()
   if (!session || session.role !== 'admin') return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
 
-  const supabase = await createClient()
-
   let body: { key?: string; value?: string }
   try { body = await request.json() } catch {
     return NextResponse.json({ error: 'Invalid JSON' }, { status: 400 })
@@ -46,20 +47,21 @@ export async function POST(request: NextRequest) {
     return NextResponse.json({ error: 'value must be a non-empty string' }, { status: 422 })
   }
 
-  const { error } = await supabase.from('app_settings').upsert({
-    key: body.key,
-    value: body.value,
-    updated_at: new Date().toISOString(),
-    updated_by: session.sub,
-  })
-  if (error) return NextResponse.json({ error: 'Save failed' }, { status: 500 })
+  await asAdmin(db =>
+    db.insert(appSettings).values({
+      key: body.key!,
+      value: body.value!,
+      updatedAt: new Date(),
+      updatedBy: session.sub,
+    }).onConflictDoUpdate({
+      target: appSettings.key,
+      set: { value: body.value!, updatedAt: new Date(), updatedBy: session.sub },
+    })
+  )
 
-  await supabase.rpc('write_audit_log', {
-    p_table_name: 'app_settings',
-    p_record_id: session.sub,
-    p_action: 'UPDATE',
-    p_new_value: { key: body.key, set: Boolean(body.value) } as never,
-  })
+  await withUser(session.sub, async tx =>
+    writeAuditLog(tx, 'app_settings', session.sub, 'UPDATE', { key: body.key, set: Boolean(body.value) })
+  )
 
   return NextResponse.json({ ok: true })
 }