feat(auth): phase 3 — replace Supabase GoTrue with bcryptjs+jose

Custom auth stack: bcryptjs password hashing (cost 10, GoTrue-compatible),
jose JWT session cookies (edge-safe, 8hr TTL), new API routes for
login/logout/reset/change-password, middleware rewritten to JWT-only
verification with no DB access. All 38 protected pages and API routes
migrated from supabase.auth.getUser() to getSession(). Supabase .from()
queries retained for Phase 4. lib/db/index.ts refactored to lazy Proxy
singleton to avoid module-level throw during Next.js build.

tsc: clean, build: clean, tests: 4/4 passed

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/api/admin/sites/route.ts

@@ -2,10 +2,12 @@ export const dynamic = 'force-dynamic'
 
 import { NextRequest, NextResponse } from 'next/server'
 import { requireAdmin } from '@/lib/auth/require-admin'
+import { createClient } from '@/lib/supabase/server'
 
 export async function POST(request: NextRequest) {
-  const { supabase, user } = await requireAdmin()
-  if (!user) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+  const { session } = await requireAdmin()
+  if (!session) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+  const supabase = await createClient()
 
   const body: { kind?: 'site' | 'zone'; name?: string; address?: string; site_id?: string } =
     await request.json().catch(() => ({}))
@@ -47,8 +49,9 @@ export async function POST(request: NextRequest) {
 }
 
 export async function PATCH(request: NextRequest) {
-  const { supabase, user } = await requireAdmin()
-  if (!user) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+  const { session } = await requireAdmin()
+  if (!session) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+  const supabase = await createClient()
 
   const body: { kind?: 'site' | 'zone'; id?: string; active?: boolean } =
     await request.json().catch(() => ({}))
@@ -70,8 +73,9 @@ export async function PATCH(request: NextRequest) {
 }
 
 export async function DELETE(request: NextRequest) {
-  const { supabase, user } = await requireAdmin()
-  if (!user) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+  const { session } = await requireAdmin()
+  if (!session) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+  const supabase = await createClient()
 
   const body: { kind?: 'site' | 'zone'; id?: string } = await request.json().catch(() => ({}))
   if (!body.id) return NextResponse.json({ error: 'id required' }, { status: 422 })

app/api/admin/trucks/route.ts

@@ -2,10 +2,12 @@ export const dynamic = 'force-dynamic'
 
 import { NextRequest, NextResponse } from 'next/server'
 import { requireAdmin } from '@/lib/auth/require-admin'
+import { createClient } from '@/lib/supabase/server'
 
 export async function POST(request: NextRequest) {
-  const { supabase, user } = await requireAdmin()
-  if (!user) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+  const { session } = await requireAdmin()
+  if (!session) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+  const supabase = await createClient()
 
   const body: { truck_no?: string; carrier?: string } = await request.json().catch(() => ({}))
   const truck_no = (body.truck_no ?? '').trim()
@@ -34,8 +36,9 @@ export async function POST(request: NextRequest) {
 }
 
 export async function PATCH(request: NextRequest) {
-  const { supabase, user } = await requireAdmin()
-  if (!user) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+  const { session } = await requireAdmin()
+  if (!session) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+  const supabase = await createClient()
 
   const body: { id?: string; active?: boolean } = await request.json().catch(() => ({}))
   if (!body.id) return NextResponse.json({ error: 'id required' }, { status: 422 })
@@ -55,8 +58,9 @@ export async function PATCH(request: NextRequest) {
 }
 
 export async function DELETE(request: NextRequest) {
-  const { supabase, user } = await requireAdmin()
-  if (!user) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+  const { session } = await requireAdmin()
+  if (!session) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+  const supabase = await createClient()
 
   const body: { id?: string } = await request.json().catch(() => ({}))
   if (!body.id) return NextResponse.json({ error: 'id required' }, { status: 422 })

app/api/admin/users/route.ts

@@ -1,14 +1,19 @@
 export const dynamic = 'force-dynamic'
 
 import { NextRequest, NextResponse } from 'next/server'
-import { createAdminClient } from '@/lib/supabase/admin'
+import { createClient } from '@/lib/supabase/server'
 import { isValidRole } from '@/lib/auth/roles'
 import { requireAdmin } from '@/lib/auth/require-admin'
+import { hashPassword } from '@/lib/auth/password'
+import { asAdmin } from '@/lib/db/with-user'
+import { users } from '@/lib/db/schema'
+import { eq } from 'drizzle-orm'
 
 export async function GET() {
-  const { supabase, user } = await requireAdmin()
-  if (!user) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+  const { session } = await requireAdmin()
+  if (!session) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
 
+  const supabase = await createClient()
   const { data, error } = await supabase
     .from('users')
     .select('id, name, email, phone, role, department, site_id, active, created_at')
@@ -19,10 +24,10 @@ export async function GET() {
 }
 
 export async function POST(request: NextRequest) {
-  const { supabase, user } = await requireAdmin()
-  if (!user) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+  const { session } = await requireAdmin()
+  if (!session) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
 
-  const body: { email?: string; name?: string; phone?: string; role?: string; site_id?: string; password?: string } =
+  const body: { email?: string; name?: string; phone?: string; role?: string; site_id?: string; department?: string; password?: string } =
     await request.json().catch(() => ({}))
   const email = (body.email ?? '').trim().toLowerCase()
   if (!email || !email.includes('@'))
@@ -35,59 +40,39 @@ export async function POST(request: NextRequest) {
   if (password.length < 8)
     return NextResponse.json({ error: 'Password must be at least 8 characters' }, { status: 422 })
 
-  let admin
-  try {
-    admin = createAdminClient()
-  } catch {
-    return NextResponse.json(
-      { error: 'User creation unavailable: SUPABASE_SERVICE_ROLE_KEY not configured' },
-      { status: 503 },
-    )
-  }
+  const passwordHash = await hashPassword(password)
 
-  const { data: created, error: createError } = await admin.auth.admin.createUser({
+  const [created] = await asAdmin(db => db.insert(users).values({
+    name: body.name ?? '',
     email,
-    password,
-    email_confirm: true,
-    user_metadata: { full_name: body.name ?? '' },
-  })
-  if (createError || !created?.user)
-    return NextResponse.json(
-      { error: createError?.message ?? 'User creation failed' },
-      { status: (createError as { status?: number } | null)?.status ?? 500 },
-    )
-  const newUserId = created.user.id
+    phone: (body.phone ?? '').trim() || null,
+    role: (body.role as typeof users.$inferInsert['role']) ?? 'reporter',
+    siteId: body.site_id ?? null,
+    department: body.department ?? null,
+    passwordHash,
+    emailVerifiedAt: new Date(),
+  }).returning({ id: users.id }))
 
-  const { error: profileError } = await admin
-    .from('users')
-    .update({
-      name: body.name ?? '',
-      phone: (body.phone ?? '').trim() || null,
-      role: body.role ?? 'reporter',
-      site_id: body.site_id ?? null,
-    })
-    .eq('id', newUserId)
-  if (profileError) {
-    await admin.auth.admin.deleteUser(newUserId)
-    return NextResponse.json(
-      { error: 'User created but profile update failed' },
-      { status: 500 },
-    )
+  if (!created) {
+    return NextResponse.json({ error: 'User creation failed' }, { status: 500 })
   }
 
+  const supabase = await createClient()
   await supabase.rpc('write_audit_log', {
     p_table_name: 'users',
-    p_record_id: newUserId,
+    p_record_id: created.id,
     p_action: 'created',
     p_new_value: { email, role: body.role ?? 'reporter', site_id: body.site_id ?? null },
   })
 
-  return NextResponse.json({ id: newUserId }, { status: 201 })
+  return NextResponse.json({ id: created.id }, { status: 201 })
 }
 
 export async function PATCH(request: NextRequest) {
-  const { supabase, user } = await requireAdmin()
-  if (!user) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+  const { session } = await requireAdmin()
+  if (!session) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+
+  const supabase = await createClient()
 
   const body: {
     id?: string
@@ -100,9 +85,9 @@ export async function PATCH(request: NextRequest) {
   if (!body.id) return NextResponse.json({ error: 'id required' }, { status: 422 })
   if (body.role !== undefined && !isValidRole(body.role))
     return NextResponse.json({ error: 'Invalid role' }, { status: 422 })
-  if (body.id === user.id && body.active === false)
+  if (body.id === session.sub && body.active === false)
     return NextResponse.json({ error: 'Cannot deactivate your own account' }, { status: 422 })
-  if (body.id === user.id && body.role !== undefined && body.role !== 'admin')
+  if (body.id === session.sub && body.role !== undefined && body.role !== 'admin')
     return NextResponse.json({ error: 'Cannot demote your own account' }, { status: 422 })
 
   const update: Record<string, unknown> = {}
@@ -132,32 +117,29 @@ export async function PATCH(request: NextRequest) {
 }
 
 export async function DELETE(request: NextRequest) {
-  const { supabase, user } = await requireAdmin()
-  if (!user) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+  const { session } = await requireAdmin()
+  if (!session) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
 
   const { searchParams } = new URL(request.url)
   const id = searchParams.get('id')
   if (!id) return NextResponse.json({ error: 'id required' }, { status: 422 })
-  if (id === user.id)
+  if (id === session.sub)
     return NextResponse.json({ error: 'Cannot delete your own account' }, { status: 422 })
 
+  const supabase = await createClient()
+
   // fetch user info for audit before deletion
   const { data: target } = await supabase
     .from('users').select('email, name, role').eq('id', id).single()
 
-  let admin
-  try {
-    admin = createAdminClient()
-  } catch {
-    return NextResponse.json(
-      { error: 'SUPABASE_SERVICE_ROLE_KEY not configured' },
-      { status: 503 },
-    )
-  }
+  // Delete user directly from DB
+  const [deleted] = await asAdmin(db =>
+    db.delete(users).where(eq(users.id, id)).returning({ id: users.id })
+  )
 
-  const { error } = await admin.auth.admin.deleteUser(id)
-  if (error)
-    return NextResponse.json({ error: error.message ?? 'Deletion failed' }, { status: 500 })
+  if (!deleted) {
+    return NextResponse.json({ error: 'User not found or deletion failed' }, { status: 500 })
+  }
 
   if (target) {
     await supabase.rpc('write_audit_log', {

app/api/auth/callback/route.ts

@@ -1,25 +0,0 @@
-import { createClient } from '@/lib/supabase/server'
-import { NextResponse } from 'next/server'
-import type { EmailOtpType } from '@supabase/supabase-js'
-
-export async function GET(request: Request) {
-  const { searchParams } = new URL(request.url)
-  const code = searchParams.get('code')
-  const token_hash = searchParams.get('token_hash')
-  const type = searchParams.get('type') as EmailOtpType | null
-  const nextRaw = searchParams.get('next') ?? '/'
-  const next = nextRaw.startsWith('/') && !nextRaw.startsWith('//') ? nextRaw : '/'
-  const appUrl = (process.env.NEXT_PUBLIC_APP_URL ?? '').replace(/\/$/, '')
-
-  const supabase = await createClient()
-
-  if (code) {
-    const { error } = await supabase.auth.exchangeCodeForSession(code)
-    if (!error) return NextResponse.redirect(`${appUrl}${next}`)
-  } else if (token_hash && type) {
-    const { error } = await supabase.auth.verifyOtp({ token_hash, type })
-    if (!error) return NextResponse.redirect(`${appUrl}${next}`)
-  }
-
-  return NextResponse.redirect(`${appUrl}/login?error=auth_callback_failed`)
-}

app/api/auth/change-password/route.ts

@@ -0,0 +1,32 @@
+export const dynamic = 'force-dynamic'
+
+import { NextRequest, NextResponse } from 'next/server'
+import { getSession } from '@/lib/auth/get-session'
+import { asAdmin } from '@/lib/db/with-user'
+import { users } from '@/lib/db/schema'
+import { eq } from 'drizzle-orm'
+import { verifyPassword, hashPassword } from '@/lib/auth/password'
+
+export async function POST(req: NextRequest) {
+  const session = await getSession()
+  if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+  const { currentPassword, newPassword } = await req.json()
+  if (!currentPassword || !newPassword || newPassword.length < 8) {
+    return NextResponse.json({ error: 'Invalid request' }, { status: 400 })
+  }
+
+  const [user] = await asAdmin(db =>
+    db.select({ passwordHash: users.passwordHash })
+      .from(users).where(eq(users.id, session.sub)).limit(1)
+  )
+
+  if (!user || !await verifyPassword(currentPassword, user.passwordHash)) {
+    return NextResponse.json({ error: 'Current password is incorrect' }, { status: 400 })
+  }
+
+  const newHash = await hashPassword(newPassword)
+  await asAdmin(db => db.update(users).set({ passwordHash: newHash }).where(eq(users.id, session.sub)))
+
+  return NextResponse.json({ ok: true })
+}

app/api/auth/login/route.ts

@@ -0,0 +1,61 @@
+export const dynamic = 'force-dynamic'
+
+import { NextRequest, NextResponse } from 'next/server'
+import { asAdmin } from '@/lib/db/with-user'
+import { users } from '@/lib/db/schema'
+import { eq } from 'drizzle-orm'
+import { verifyPassword } from '@/lib/auth/password'
+import { createSession } from '@/lib/auth/session'
+
+export async function POST(req: NextRequest) {
+  const { email, password } = await req.json()
+  if (!email || !password) {
+    return NextResponse.json({ error: 'Email and password required' }, { status: 400 })
+  }
+
+  const [user] = await asAdmin(db =>
+    db.select({
+      id: users.id,
+      email: users.email,
+      name: users.name,
+      role: users.role,
+      siteId: users.siteId,
+      passwordHash: users.passwordHash,
+      active: users.active,
+    }).from(users).where(eq(users.email, email.toLowerCase())).limit(1)
+  )
+
+  if (!user || !user.active) {
+    return NextResponse.json({ error: 'Invalid credentials' }, { status: 401 })
+  }
+
+  if (!user.passwordHash) {
+    return NextResponse.json({ error: 'Account not configured — contact admin' }, { status: 401 })
+  }
+
+  const valid = await verifyPassword(password, user.passwordHash)
+  if (!valid) {
+    return NextResponse.json({ error: 'Invalid credentials' }, { status: 401 })
+  }
+
+  // Update last_login_at
+  await asAdmin(db => db.update(users).set({ lastLoginAt: new Date() }).where(eq(users.id, user.id)))
+
+  const token = await createSession({
+    sub: user.id,
+    role: user.role,
+    siteId: user.siteId ?? null,
+    name: user.name,
+  })
+
+  const appUrl = process.env.APP_URL ?? ''
+  const res = NextResponse.json({ ok: true })
+  res.cookies.set('ims_session', token, {
+    httpOnly: true,
+    secure: appUrl.startsWith('https'),
+    sameSite: 'lax',
+    maxAge: 8 * 60 * 60,
+    path: '/',
+  })
+  return res
+}

app/api/auth/logout/route.ts

@@ -0,0 +1,13 @@
+export const dynamic = 'force-dynamic'
+
+import { NextResponse } from 'next/server'
+
+export async function POST() {
+  const res = NextResponse.json({ ok: true })
+  res.cookies.set('ims_session', '', {
+    httpOnly: true,
+    maxAge: 0,
+    path: '/',
+  })
+  return res
+}

app/api/auth/reset-confirm/route.ts

@@ -0,0 +1,41 @@
+export const dynamic = 'force-dynamic'
+
+import { NextRequest, NextResponse } from 'next/server'
+import { asAdmin } from '@/lib/db/with-user'
+import { users, passwordResetTokens } from '@/lib/db/schema'
+import { eq, and, gt, isNull } from 'drizzle-orm'
+import { createHash } from 'crypto'
+import { hashPassword } from '@/lib/auth/password'
+
+export async function POST(req: NextRequest) {
+  const { token, password } = await req.json()
+  if (!token || !password || password.length < 8) {
+    return NextResponse.json({ error: 'Invalid request' }, { status: 400 })
+  }
+
+  const tokenHash = createHash('sha256').update(token).digest('hex')
+  const now = new Date()
+
+  const [row] = await asAdmin(db =>
+    db.select({ id: passwordResetTokens.id, userId: passwordResetTokens.userId })
+      .from(passwordResetTokens)
+      .where(and(
+        eq(passwordResetTokens.tokenHash, tokenHash),
+        gt(passwordResetTokens.expiresAt, now),
+        isNull(passwordResetTokens.usedAt),
+      )).limit(1)
+  )
+
+  if (!row) {
+    return NextResponse.json({ error: 'Invalid or expired token' }, { status: 400 })
+  }
+
+  const newHash = await hashPassword(password)
+
+  await asAdmin(async db => {
+    await db.update(users).set({ passwordHash: newHash }).where(eq(users.id, row.userId))
+    await db.update(passwordResetTokens).set({ usedAt: now }).where(eq(passwordResetTokens.id, row.id))
+  })
+
+  return NextResponse.json({ ok: true })
+}

app/api/auth/reset-request/route.ts

@@ -0,0 +1,37 @@
+export const dynamic = 'force-dynamic'
+
+import { NextRequest, NextResponse } from 'next/server'
+import { asAdmin } from '@/lib/db/with-user'
+import { users, passwordResetTokens } from '@/lib/db/schema'
+import { eq } from 'drizzle-orm'
+import { createHash, randomBytes } from 'crypto'
+import { sendPasswordResetEmail } from '@/lib/notifications/mailer'
+
+export async function POST(req: NextRequest) {
+  const { email } = await req.json()
+  if (!email) return NextResponse.json({ ok: true })  // don't reveal user existence
+
+  const [user] = await asAdmin(db =>
+    db.select({ id: users.id, name: users.name }).from(users)
+      .where(eq(users.email, email.toLowerCase())).limit(1)
+  )
+
+  if (!user) return NextResponse.json({ ok: true })  // silent
+
+  const rawToken = randomBytes(32).toString('hex')
+  const tokenHash = createHash('sha256').update(rawToken).digest('hex')
+  const expiresAt = new Date(Date.now() + 60 * 60 * 1000)  // 1 hour
+
+  await asAdmin(db => db.insert(passwordResetTokens).values({
+    userId: user.id,
+    tokenHash,
+    expiresAt,
+  }))
+
+  const appUrl = process.env.APP_URL ?? ''
+  const resetLink = `${appUrl}/reset-password?token=${rawToken}`
+
+  await sendPasswordResetEmail({ to: email, name: user.name, resetLink })
+
+  return NextResponse.json({ ok: true })
+}

app/api/capa/[id]/route.ts

@@ -3,15 +3,17 @@ export const dynamic = 'force-dynamic'
 import { NextRequest, NextResponse } from 'next/server'
 import { createClient } from '@/lib/supabase/server'
 import { createAdminClient } from '@/lib/supabase/admin'
+import { getSession } from '@/lib/auth/get-session'
 
 export async function GET(
   _: NextRequest,
   { params }: { params: Promise<{ id: string }> }
 ) {
   const { id } = await params
+  const session = await getSession()
+  if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
   const supabase = await createClient()
-  const { data: { user }, error: authError } = await supabase.auth.getUser()
-  if (authError || !user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
 
   const { data, error } = await supabase
     .from('capa_actions')
@@ -27,9 +29,8 @@ export async function GET(
 
   if (error || !data) return NextResponse.json({ error: 'Not found' }, { status: 404 })
 
-  const { data: profile } = await supabase.from('users').select('role').eq('id', user.id).single()
-  const role = profile?.role ?? ''
-  const isOwner = data.owner_user_id === user.id
+  const role = session.role
+  const isOwner = data.owner_user_id === session.sub
   const canRead = ['hse', 'admin', 'supervisor'].includes(role) || isOwner
   if (!canRead) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
 
@@ -46,15 +47,14 @@ export async function PATCH(
   { params }: { params: Promise<{ id: string }> }
 ) {
   const { id } = await params
-  const supabase = await createClient()
-  const { data: { user }, error: authError } = await supabase.auth.getUser()
-  if (authError || !user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const session = await getSession()
+  if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
 
-  const { data: profile } = await supabase.from('users').select('role').eq('id', user.id).single()
-  const role = profile?.role ?? ''
+  const supabase = await createClient()
+  const role = session.role
 
   const { data: capa } = await supabase.from('capa_actions').select('owner_user_id, status').eq('id', id).single()
-  const isOwner = capa?.owner_user_id === user.id
+  const isOwner = capa?.owner_user_id === session.sub
   const canEdit = ['hse', 'admin'].includes(role) || isOwner
   if (!canEdit) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
 

app/api/capa/[id]/verify/route.ts

@@ -2,6 +2,7 @@ export const dynamic = 'force-dynamic'
 
 import { NextRequest, NextResponse } from 'next/server'
 import { createClient } from '@/lib/supabase/server'
+import { getSession } from '@/lib/auth/get-session'
 import { createInAppNotifications } from '@/lib/notifications/in-app'
 
 export async function POST(
@@ -9,16 +10,13 @@ export async function POST(
   { params }: { params: Promise<{ id: string }> }
 ) {
   const { id } = await params
-  const supabase = await createClient()
-
-  const { data: { user }, error: authError } = await supabase.auth.getUser()
-  if (authError || !user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-
-  const { data: profile } = await supabase
-    .from('users').select('role').eq('id', user.id).single()
-  if (!profile || !['hse', 'admin'].includes(profile.role))
+  const session = await getSession()
+  if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  if (!['hse', 'admin'].includes(session.role))
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
 
+  const supabase = await createClient()
+
   const { data: capa } = await supabase
     .from('capa_actions').select('status, incident_id, owner_user_id').eq('id', id).single()
   if (!capa) return NextResponse.json({ error: 'Not found' }, { status: 404 })
@@ -35,7 +33,7 @@ export async function POST(
 
   const update: Record<string, unknown> = {
     status: body.verdict,
-    verified_by: user.id,
+    verified_by: session.sub,
     verified_at: verifiedAt.toISOString(),
     ...(body.verdict === 'verified'
       ? {

app/api/capa/route.ts

@@ -2,16 +2,14 @@ export const dynamic = 'force-dynamic'
 
 import { NextRequest, NextResponse } from 'next/server'
 import { createClient } from '@/lib/supabase/server'
+import { getSession } from '@/lib/auth/get-session'
 import { createInAppNotifications } from '@/lib/notifications/in-app'
 
 export async function GET() {
-  const supabase = await createClient()
-  const { data: { user }, error: authError } = await supabase.auth.getUser()
-  if (authError || !user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const session = await getSession()
+  if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
 
-  const { data: profile } = await supabase
-    .from('users').select('role').eq('id', user.id).single()
-  if (!profile) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const supabase = await createClient()
 
   let query = supabase
     .from('capa_actions')
@@ -23,8 +21,8 @@ export async function GET() {
     `)
     .order('due_date', { ascending: true })
 
-  if (profile.role === 'supervisor' || profile.role === 'worker') {
-    query = query.eq('owner_user_id', user.id)
+  if (session.role === 'supervisor' || session.role === 'worker') {
+    query = query.eq('owner_user_id', session.sub)
   }
 
   const { data, error } = await query
@@ -33,15 +31,13 @@ export async function GET() {
 }
 
 export async function POST(request: NextRequest) {
-  const supabase = await createClient()
-  const { data: { user }, error: authError } = await supabase.auth.getUser()
-  if (authError || !user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-
-  const { data: profile } = await supabase
-    .from('users').select('role').eq('id', user.id).single()
-  if (!profile || !['hse', 'admin'].includes(profile.role))
+  const session = await getSession()
+  if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  if (!['hse', 'admin'].includes(session.role))
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
 
+  const supabase = await createClient()
+
   const body = await request.json()
   const { incident_id, description, owner_user_id, department, due_date, priority, root_cause_ref } = body
 

app/api/dashboard/ai/risk-flags/route.ts

@@ -2,6 +2,7 @@ export const dynamic = 'force-dynamic'
 
 import { NextResponse } from 'next/server'
 import { createClient } from '@/lib/supabase/server'
+import { getSession } from '@/lib/auth/get-session'
 import { createDeepSeekClient } from '@/lib/claude/client'
 import { getApiKey } from '@/lib/settings'
 
@@ -18,14 +19,13 @@ type ZoneAggregate = {
 }
 
 export async function POST() {
-  const supabase = await createClient()
-  const { data: { user }, error: authError } = await supabase.auth.getUser()
-  if (authError || !user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-
-  const { data: profile } = await supabase.from('users').select('role').eq('id', user.id).single()
-  if (!profile || !['hse', 'admin', 'management'].includes(profile.role))
+  const session = await getSession()
+  if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  if (!['hse', 'admin', 'management'].includes(session.role))
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
 
+  const supabase = await createClient()
+
   const now = new Date()
   const ninetyDaysAgo = new Date(now)
   ninetyDaysAgo.setDate(now.getDate() - 90)
@@ -82,7 +82,7 @@ export async function POST() {
   const { data: lastCall } = await supabase
     .from('audit_log')
     .select('changed_at')
-    .eq('changed_by', user.id)
+    .eq('changed_by', session.sub)
     .eq('action', 'ai_risk_flags')
     .order('changed_at', { ascending: false })
     .limit(1)
@@ -166,7 +166,7 @@ ${JSON.stringify(aggregates, null, 2)}
 
   await supabase.rpc('write_audit_log', {
     p_table_name: 'incidents',
-    p_record_id: user.id,
+    p_record_id: session.sub,
     p_action: 'ai_risk_flags',
     p_new_value: { flags, summary: input.summary, model: 'deepseek-chat' } as never,
   })

app/api/dashboard/export/route.ts

@@ -2,15 +2,12 @@ export const dynamic = 'force-dynamic'
 
 import { NextRequest, NextResponse } from 'next/server'
 import { createClient } from '@/lib/supabase/server'
+import { getSession } from '@/lib/auth/get-session'
 import { rowsToCsv } from '@/lib/csv'
 
 export async function GET(request: NextRequest) {
-  const supabase = await createClient()
-  const { data: { user }, error: authError } = await supabase.auth.getUser()
-  if (authError || !user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-
-  const { data: profile } = await supabase.from('users').select('role').eq('id', user.id).single()
-  if (!profile) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+  const session = await getSession()
+  if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
 
   const role = request.nextUrl.searchParams.get('role') ?? 'hse'
 
@@ -19,10 +16,12 @@ export async function GET(request: NextRequest) {
     management: ['management', 'admin'],
   }
 
-  if (!allowedRoles[role] || !allowedRoles[role].includes(profile.role)) {
+  if (!allowedRoles[role] || !allowedRoles[role].includes(session.role)) {
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
   }
 
+  const supabase = await createClient()
+
   const { data: incidents } = await supabase
     .from('incidents')
     .select(`
@@ -64,7 +63,7 @@ export async function GET(request: NextRequest) {
 
   await supabase.rpc('write_audit_log', {
     p_table_name: 'incidents',
-    p_record_id: user.id,
+    p_record_id: session.sub,
     p_action: 'export_csv',
     p_new_value: { role, row_count: rows.length } as never,
   })

app/api/dashboard/stats/route.ts

@@ -2,16 +2,16 @@ export const dynamic = 'force-dynamic'
 
 import { NextResponse } from 'next/server'
 import { createClient } from '@/lib/supabase/server'
+import { getSession } from '@/lib/auth/get-session'
 
 export async function GET() {
-  const supabase = await createClient()
-  const { data: { user } } = await supabase.auth.getUser()
-  if (!user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-
-  const { data: profile } = await supabase.from('users').select('role').eq('id', user.id).single()
-  if (!profile || !['hse', 'admin', 'management'].includes(profile.role))
+  const session = await getSession()
+  if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  if (!['hse', 'admin', 'management'].includes(session.role))
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
 
+  const supabase = await createClient()
+
   const { data: incidents, error } = await supabase
     .from('incidents')
     .select('id, status, incident_type, sites (name)')

app/api/incidents/[id]/addenda/route.ts

@@ -2,21 +2,20 @@ export const dynamic = 'force-dynamic'
 
 import { NextRequest, NextResponse } from 'next/server'
 import { createClient } from '@/lib/supabase/server'
+import { getSession } from '@/lib/auth/get-session'
 
 export async function GET(
   _request: NextRequest,
   { params }: { params: Promise<{ id: string }> }
 ) {
   const { id } = await params
-  const supabase = await createClient()
-
-  const { data: { user }, error: authError } = await supabase.auth.getUser()
-  if (authError || !user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-
-  const { data: profile } = await supabase.from('users').select('role').eq('id', user.id).single()
-  if (!profile || !['hse', 'admin', 'supervisor'].includes(profile.role))
+  const session = await getSession()
+  if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  if (!['hse', 'admin', 'supervisor'].includes(session.role))
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
 
+  const supabase = await createClient()
+
   const { data, error } = await supabase
     .from('incident_addenda')
     .select('id, body, created_at, author:users!author (name)')
@@ -32,16 +31,13 @@ export async function POST(
   { params }: { params: Promise<{ id: string }> }
 ) {
   const { id } = await params
-  const supabase = await createClient()
-
-  const { data: { user }, error: authError } = await supabase.auth.getUser()
-  if (authError || !user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-
-  const { data: profile } = await supabase
-    .from('users').select('role').eq('id', user.id).single()
-  if (!profile || !['hse', 'admin', 'supervisor'].includes(profile.role))
+  const session = await getSession()
+  if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  if (!['hse', 'admin', 'supervisor'].includes(session.role))
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
 
+  const supabase = await createClient()
+
   const body: { body?: string } = await request.json().catch(() => ({}))
   const text = (body.body ?? '').trim()
   if (!text) return NextResponse.json({ error: 'body required' }, { status: 422 })
@@ -50,7 +46,7 @@ export async function POST(
 
   const { data: addendum, error } = await supabase
     .from('incident_addenda')
-    .insert({ incident_id: id, author: user.id, body: text })
+    .insert({ incident_id: id, author: session.sub, body: text })
     .select('id')
     .single()
 
@@ -60,7 +56,7 @@ export async function POST(
     p_table_name: 'incident_addenda',
     p_record_id: addendum.id,
     p_action: 'INSERT',
-    p_new_value: { incident_id: id, author: user.id, body: text },
+    p_new_value: { incident_id: id, author: session.sub, body: text },
   })
 
   return NextResponse.json({ id: addendum.id }, { status: 201 })

app/api/incidents/[id]/ai/rca-draft/route.ts

@@ -2,6 +2,7 @@ export const dynamic = 'force-dynamic'
 
 import { NextRequest, NextResponse } from 'next/server'
 import { createClient } from '@/lib/supabase/server'
+import { getSession } from '@/lib/auth/get-session'
 import { createDeepSeekClient } from '@/lib/claude/client'
 import { getApiKey } from '@/lib/settings'
 
@@ -10,19 +11,18 @@ export async function POST(
   { params }: { params: Promise<{ id: string }> }
 ) {
   const { id } = await params
-  const supabase = await createClient()
-  const { data: { user }, error: authError } = await supabase.auth.getUser()
-  if (authError || !user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-
-  const { data: profile } = await supabase.from('users').select('role').eq('id', user.id).single()
-  if (!profile || !['hse', 'admin'].includes(profile.role))
+  const session = await getSession()
+  if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  if (!['hse', 'admin'].includes(session.role))
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
 
+  const supabase = await createClient()
+
   const since = new Date(Date.now() - 60_000).toISOString()
   const { count: recentCount } = await supabase
     .from('audit_log')
     .select('id', { count: 'exact', head: true })
-    .eq('changed_by', user.id)
+    .eq('changed_by', session.sub)
     .eq('action', 'ai_rca_draft')
     .gte('changed_at', since)
   if ((recentCount ?? 0) > 0)

app/api/incidents/[id]/ai/triage-suggest/route.ts

@@ -2,6 +2,7 @@ export const dynamic = 'force-dynamic'
 
 import { NextRequest, NextResponse } from 'next/server'
 import { createClient } from '@/lib/supabase/server'
+import { getSession } from '@/lib/auth/get-session'
 import { createDeepSeekClient } from '@/lib/claude/client'
 import { getApiKey } from '@/lib/settings'
 
@@ -10,19 +11,18 @@ export async function POST(
   { params }: { params: Promise<{ id: string }> }
 ) {
   const { id } = await params
-  const supabase = await createClient()
-  const { data: { user }, error: authError } = await supabase.auth.getUser()
-  if (authError || !user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-
-  const { data: profile } = await supabase.from('users').select('role').eq('id', user.id).single()
-  if (!profile || !['hse', 'admin'].includes(profile.role))
+  const session = await getSession()
+  if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  if (!['hse', 'admin'].includes(session.role))
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
 
+  const supabase = await createClient()
+
   const since = new Date(Date.now() - 60_000).toISOString()
   const { count: recentCount } = await supabase
     .from('audit_log')
     .select('id', { count: 'exact', head: true })
-    .eq('changed_by', user.id)
+    .eq('changed_by', session.sub)
     .eq('action', 'ai_triage_suggest')
     .gte('changed_at', since)
   if ((recentCount ?? 0) > 0)

app/api/incidents/[id]/close/route.ts

@@ -2,6 +2,7 @@ export const dynamic = 'force-dynamic'
 
 import { NextRequest, NextResponse } from 'next/server'
 import { createClient } from '@/lib/supabase/server'
+import { getSession } from '@/lib/auth/get-session'
 import { createInAppNotifications } from '@/lib/notifications/in-app'
 
 export async function POST(
@@ -9,16 +10,13 @@ export async function POST(
   { params }: { params: Promise<{ id: string }> }
 ) {
   const { id } = await params
-  const supabase = await createClient()
-
-  const { data: { user }, error: authError } = await supabase.auth.getUser()
-  if (authError || !user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-
-  const { data: profile } = await supabase
-    .from('users').select('role').eq('id', user.id).single()
-  if (!profile || !['hse', 'admin'].includes(profile.role))
+  const session = await getSession()
+  if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  if (!['hse', 'admin'].includes(session.role))
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
 
+  const supabase = await createClient()
+
   const { data: incident } = await supabase
     .from('incidents')
     .select('status, reference_no, reported_by')
@@ -49,7 +47,7 @@ export async function POST(
     p_table_name: 'incidents',
     p_record_id: id,
     p_action: 'closed',
-    p_new_value: { status: 'closed', closed_at: closedAt, closed_by: user.id },
+    p_new_value: { status: 'closed', closed_at: closedAt, closed_by: session.sub },
   })
 
   if (incident.reported_by) {

app/api/incidents/[id]/investigation/route.ts

@@ -2,22 +2,20 @@ export const dynamic = 'force-dynamic'
 
 import { NextRequest, NextResponse } from 'next/server'
 import { createClient } from '@/lib/supabase/server'
+import { getSession } from '@/lib/auth/get-session'
 
 export async function POST(
   request: NextRequest,
   { params }: { params: Promise<{ id: string }> }
 ) {
   const { id } = await params
-  const supabase = await createClient()
-
-  const { data: { user }, error: authError } = await supabase.auth.getUser()
-  if (authError || !user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-
-  const { data: profile } = await supabase
-    .from('users').select('role').eq('id', user.id).single()
-  if (!profile || !['hse', 'admin'].includes(profile.role))
+  const session = await getSession()
+  if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  if (!['hse', 'admin'].includes(session.role))
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
 
+  const supabase = await createClient()
+
   const { data: incident } = await supabase
     .from('incidents').select('status').eq('id', id).single()
   if (!incident) return NextResponse.json({ error: 'Not found' }, { status: 404 })
@@ -38,7 +36,7 @@ export async function POST(
     .from('investigations')
     .insert({
       incident_id: id,
-      investigator_id: user.id,
+      investigator_id: session.sub,
       method,
       findings_text: body.findings_text ?? null,
       root_cause_summary: body.root_cause_summary ?? null,
@@ -73,16 +71,13 @@ export async function PATCH(
   { params }: { params: Promise<{ id: string }> }
 ) {
   const { id } = await params
-  const supabase = await createClient()
-
-  const { data: { user }, error: authError } = await supabase.auth.getUser()
-  if (authError || !user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-
-  const { data: profile } = await supabase
-    .from('users').select('role').eq('id', user.id).single()
-  if (!profile || !['hse', 'admin'].includes(profile.role))
+  const session = await getSession()
+  if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  if (!['hse', 'admin'].includes(session.role))
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
 
+  const supabase = await createClient()
+
   const body = await request.json()
   const { investigation_id, complete, ...fields } = body
 

app/api/incidents/[id]/jkkp-pdf/route.ts

@@ -2,6 +2,7 @@ export const dynamic = 'force-dynamic'
 
 import { NextRequest, NextResponse } from 'next/server'
 import { createClient } from '@/lib/supabase/server'
+import { getSession } from '@/lib/auth/get-session'
 import { buildJkkp6Pdf, buildJkkp7Pdf, type JkkpIncident } from '@/lib/pdf/jkkp'
 import { computeDoshObligation } from '@/lib/incidents/dosh'
 
@@ -14,15 +15,13 @@ export async function GET(
   if (form !== 'jkkp6' && form !== 'jkkp7')
     return NextResponse.json({ error: 'form must be jkkp6 or jkkp7' }, { status: 422 })
 
-  const supabase = await createClient()
-  const { data: { user }, error: authError } = await supabase.auth.getUser()
-  if (authError || !user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-
-  const { data: profile } = await supabase
-    .from('users').select('role').eq('id', user.id).single()
-  if (!profile || !['hse', 'admin'].includes(profile.role))
+  const session = await getSession()
+  if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  if (!['hse', 'admin'].includes(session.role))
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
 
+  const supabase = await createClient()
+
   const { data: incident } = await supabase
     .from('incidents')
     .select(`

app/api/incidents/[id]/route.ts

@@ -1,17 +1,16 @@
 import { NextResponse } from 'next/server'
 import { createClient } from '@/lib/supabase/server'
+import { getSession } from '@/lib/auth/get-session'
 
 export const dynamic = 'force-dynamic'
 
 export async function GET(_req: Request, { params }: { params: Promise<{ id: string }> }) {
   const { id } = await params
-  const supabase = await createClient()
-  const { data, error: authError } = await supabase.auth.getUser()
-  if (authError || !data?.user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-  const user = data.user
+  const session = await getSession()
+  if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
 
-  const { data: profile } = await supabase.from('users').select('role, site_id').eq('id', user.id).single()
-  const role = profile?.role ?? ''
+  const supabase = await createClient()
+  const role = session.role
 
   const { data: incident, error } = await supabase
     .from('incidents')
@@ -33,7 +32,7 @@ export async function GET(_req: Request, { params }: { params: Promise<{ id: str
   }
 
   const reporter = incident.reporter as unknown as { id: string } | null
-  const isOwner = reporter?.id === user.id
+  const isOwner = reporter?.id === session.sub
   const isSiteStaff = ['hse', 'supervisor', 'admin'].includes(role)
   if (!isOwner && !isSiteStaff) {
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })

app/api/incidents/[id]/similar/route.ts

@@ -2,6 +2,7 @@ export const dynamic = 'force-dynamic'
 
 import { NextRequest, NextResponse } from 'next/server'
 import { createClient } from '@/lib/supabase/server'
+import { getSession } from '@/lib/auth/get-session'
 import { embedText } from '@/lib/claude/embed'
 import { getApiKey } from '@/lib/settings'
 
@@ -10,14 +11,13 @@ export async function GET(
   { params }: { params: Promise<{ id: string }> }
 ) {
   const { id } = await params
-  const supabase = await createClient()
-  const { data: { user }, error: authError } = await supabase.auth.getUser()
-  if (authError || !user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-
-  const { data: profile } = await supabase.from('users').select('role').eq('id', user.id).single()
-  if (!profile || !['hse', 'admin'].includes(profile.role))
+  const session = await getSession()
+  if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  if (!['hse', 'admin'].includes(session.role))
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
 
+  const supabase = await createClient()
+
   const googleAiKey = await getApiKey(supabase, 'GOOGLE_AI_API_KEY')
 
   const { data: incident } = await supabase

app/api/incidents/[id]/triage/route.ts

@@ -2,6 +2,7 @@ export const dynamic = 'force-dynamic'
 
 import { NextRequest, NextResponse } from 'next/server'
 import { createClient } from '@/lib/supabase/server'
+import { getSession } from '@/lib/auth/get-session'
 
 interface TriageBody {
   severity: number
@@ -17,16 +18,13 @@ export async function PATCH(
   { params }: { params: Promise<{ id: string }> }
 ) {
   const { id } = await params
-  const supabase = await createClient()
-
-  const { data: { user }, error: authError } = await supabase.auth.getUser()
-  if (authError || !user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-
-  const { data: profile } = await supabase
-    .from('users').select('role').eq('id', user.id).single()
-  if (!profile || !['hse', 'admin'].includes(profile.role))
+  const session = await getSession()
+  if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  if (!['hse', 'admin'].includes(session.role))
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
 
+  const supabase = await createClient()
+
   const body: TriageBody = await request.json()
   if (body.severity < 1 || body.severity > 5)
     return NextResponse.json({ error: 'severity must be 1–5' }, { status: 422 })
@@ -46,7 +44,7 @@ export async function PATCH(
       is_dangerous_occurrence: body.is_dangerous_occurrence,
       is_occupational_disease: body.is_occupational_disease,
       triage_notes: body.triage_notes ?? null,
-      triaged_by: user.id,
+      triaged_by: session.sub,
       triaged_at: new Date().toISOString(),
       status: 'triaged',
     })
@@ -58,7 +56,7 @@ export async function PATCH(
     p_table_name: 'incidents',
     p_record_id: id,
     p_action: 'triage',
-    p_new_value: { severity: body.severity, status: 'triaged', triaged_by: user.id },
+    p_new_value: { severity: body.severity, status: 'triaged', triaged_by: session.sub },
   })
 
   return NextResponse.json({ ok: true })

app/api/incidents/ai/quality-check/route.ts

@@ -2,19 +2,21 @@ export const dynamic = 'force-dynamic'
 
 import { NextRequest, NextResponse } from 'next/server'
 import { createClient } from '@/lib/supabase/server'
+import { getSession } from '@/lib/auth/get-session'
 import { createDeepSeekClient } from '@/lib/claude/client'
 import { getApiKey } from '@/lib/settings'
 
 export async function POST(request: NextRequest) {
+  const session = await getSession()
+  if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
   const supabase = await createClient()
-  const { data: { user }, error: authError } = await supabase.auth.getUser()
-  if (authError || !user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
 
   const since = new Date(Date.now() - 60_000).toISOString()
   const { count: recentCount } = await supabase
     .from('audit_log')
     .select('id', { count: 'exact', head: true })
-    .eq('changed_by', user.id)
+    .eq('changed_by', session.sub)
     .eq('action', 'ai_quality_check')
     .gte('changed_at', since)
   if ((recentCount ?? 0) > 0)
@@ -92,7 +94,7 @@ Score 1–10 based on: specificity (location, time, persons involved), completen
 
   await supabase.rpc('write_audit_log', {
     p_table_name: 'incidents',
-    p_record_id: user.id,
+    p_record_id: session.sub,
     p_action: 'ai_quality_check',
     p_new_value: { score: input.score, passes: input.passes, model: 'deepseek-chat' } as never,
   })

app/api/incidents/route.ts

@@ -1,5 +1,6 @@
 import { NextResponse } from 'next/server'
 import { createClient } from '@/lib/supabase/server'
+import { getSession } from '@/lib/auth/get-session'
 import { validateIncidentInput, validateTypeDetails, type IncidentType, type MedicalStatus } from '@/lib/incidents/validate'
 import { uploadEvidenceFile, type EvidenceStage } from '@/lib/supabase/storage'
 import { sendNewIncidentEmail } from '@/lib/notifications/email'
@@ -19,16 +20,16 @@ export async function POST(request: Request) {
 }
 
 async function handlePost(request: Request) {
+  const session = await getSession()
+  if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
   const supabase = await createClient()
-  const { data, error: authError } = await supabase.auth.getUser()
-  if (authError || !data?.user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-  const user = data.user
 
   const since = new Date(Date.now() - 60_000).toISOString()
   const { count: recentIncidents } = await supabase
     .from('audit_log')
     .select('id', { count: 'exact', head: true })
-    .eq('changed_by', user.id)
+    .eq('changed_by', session.sub)
     .eq('table_name', 'incidents')
     .eq('action', 'INSERT')
     .gte('changed_at', since)
@@ -106,7 +107,7 @@ async function handlePost(request: Request) {
       incident_type: input.incident_type,
       site_id: zone.site_id,
       zone_id: zone.id,
-      reported_by: user.id,
+      reported_by: session.sub,
       description: input.description.trim(),
       injury_involved: input.injury_involved,
       asset_involved: input.asset_involved,
@@ -133,14 +134,14 @@ async function handlePost(request: Request) {
 
   for (const file of files) {
     try {
-      const { publicUrl, hash } = await uploadEvidenceFile(supabase, file, incident.id, 'report')
+      const { publicUrl, hash } = await uploadEvidenceFile(supabase, file, incident.id, 'report', session.sub)
       evidenceRows.push({
         incident_id: incident.id,
         stage: 'report',
         file_url: publicUrl,
         file_type: file.type,
         file_hash: hash,
-        uploaded_by: user.id,
+        uploaded_by: session.sub,
       })
     } catch (err) {
       console.error('file upload error:', err)
@@ -155,7 +156,7 @@ async function handlePost(request: Request) {
     p_table_name: 'incidents',
     p_record_id: incident.id,
     p_action: 'INSERT',
-    p_new_value: { incident_type: input.incident_type, reported_by: user.id },
+    p_new_value: { incident_type: input.incident_type, reported_by: session.sub },
   })
 
   sendNewIncidentEmail(incident.id, zone.site_id, incident.reference_no ?? '', input.incident_type)

app/api/notifications/route.ts

@@ -2,17 +2,19 @@ export const dynamic = 'force-dynamic'
 
 import { NextRequest, NextResponse } from 'next/server'
 import { createClient } from '@/lib/supabase/server'
+import { getSession } from '@/lib/auth/get-session'
 
 export async function GET() {
+  const session = await getSession()
+  if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
   const supabase = await createClient()
-  const { data: { user }, error: authError } = await supabase.auth.getUser()
-  if (authError || !user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
 
   const { data: notifications, error } = await supabase
     .from('notifications_log')
     .select('id, title, link, incident_id, capa_id, sent_at, read_at')
     .eq('channel', 'in_app')
-    .eq('recipient_user_id', user.id)
+    .eq('recipient_user_id', session.sub)
     .order('sent_at', { ascending: false })
     .limit(20)
 
@@ -22,23 +24,24 @@ export async function GET() {
     .from('notifications_log')
     .select('id', { count: 'exact', head: true })
     .eq('channel', 'in_app')
-    .eq('recipient_user_id', user.id)
+    .eq('recipient_user_id', session.sub)
     .is('read_at', null)
 
   return NextResponse.json({ notifications: notifications ?? [], unread: count ?? 0 })
 }
 
 export async function POST(request: NextRequest) {
+  const session = await getSession()
+  if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
   const supabase = await createClient()
-  const { data: { user }, error: authError } = await supabase.auth.getUser()
-  if (authError || !user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
 
   const body: { ids?: string[]; all?: boolean } = await request.json().catch(() => ({}))
 
   let query = supabase
     .from('notifications_log')
     .update({ read_at: new Date().toISOString() })
-    .eq('recipient_user_id', user.id)
+    .eq('recipient_user_id', session.sub)
     .is('read_at', null)
 
   if (!body.all) {

app/api/reports/jkkp8/route.ts

@@ -2,18 +2,17 @@ export const dynamic = 'force-dynamic'
 
 import { NextRequest, NextResponse } from 'next/server'
 import { createClient } from '@/lib/supabase/server'
+import { getSession } from '@/lib/auth/get-session'
 import { buildJkkp8Rows, jkkp8Csv, type Jkkp8Incident } from '@/lib/reports/jkkp8'
 
 export async function GET(request: NextRequest) {
-  const supabase = await createClient()
-  const { data: { user }, error: authError } = await supabase.auth.getUser()
-  if (authError || !user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-
-  const { data: profile } = await supabase
-    .from('users').select('role').eq('id', user.id).single()
-  if (!profile || !['hse', 'admin'].includes(profile.role))
+  const session = await getSession()
+  if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  if (!['hse', 'admin'].includes(session.role))
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
 
+  const supabase = await createClient()
+
   const yearParam = request.nextUrl.searchParams.get('year')
   const year = Number.parseInt(yearParam ?? '', 10) || new Date().getFullYear()
 
@@ -39,7 +38,7 @@ export async function GET(request: NextRequest) {
 
   await supabase.rpc('write_audit_log', {
     p_table_name: 'incidents',
-    p_record_id: user.id,
+    p_record_id: session.sub,
     p_action: 'jkkp8_register_export',
     p_new_value: { year, row_count: rows.length },
   })

app/api/settings/route.ts

@@ -2,6 +2,7 @@ export const dynamic = 'force-dynamic'
 
 import { NextRequest, NextResponse } from 'next/server'
 import { createClient } from '@/lib/supabase/server'
+import { getSession } from '@/lib/auth/get-session'
 
 const ALLOWED_KEYS = [
   'DEEPSEEK_API_KEY',
@@ -11,18 +12,11 @@ const ALLOWED_KEYS = [
 ] as const
 type SettingKey = typeof ALLOWED_KEYS[number]
 
-async function requireAdmin(supabase: Awaited<ReturnType<typeof createClient>>) {
-  const { data: { user }, error } = await supabase.auth.getUser()
-  if (error || !user) return null
-  const { data: profile } = await supabase.from('users').select('role').eq('id', user.id).single()
-  if (!profile || profile.role !== 'admin') return null
-  return user
-}
-
 export async function GET() {
+  const session = await getSession()
+  if (!session || session.role !== 'admin') return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+
   const supabase = await createClient()
-  const user = await requireAdmin(supabase)
-  if (!user) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
 
   const { data } = await supabase.from('app_settings').select('key, value, updated_at')
   const masked = (data ?? []).map(row => ({
@@ -35,9 +29,10 @@ export async function GET() {
 }
 
 export async function POST(request: NextRequest) {
+  const session = await getSession()
+  if (!session || session.role !== 'admin') return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+
   const supabase = await createClient()
-  const user = await requireAdmin(supabase)
-  if (!user) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
 
   let body: { key?: string; value?: string }
   try { body = await request.json() } catch {
@@ -55,13 +50,13 @@ export async function POST(request: NextRequest) {
     key: body.key,
     value: body.value,
     updated_at: new Date().toISOString(),
-    updated_by: user.id,
+    updated_by: session.sub,
   })
   if (error) return NextResponse.json({ error: 'Save failed' }, { status: 500 })
 
   await supabase.rpc('write_audit_log', {
     p_table_name: 'app_settings',
-    p_record_id: user.id,
+    p_record_id: session.sub,
     p_action: 'UPDATE',
     p_new_value: { key: body.key, set: Boolean(body.value) } as never,
   })