feat(db): phase 4 group 2 — admin routes to Drizzle

Convert app/api/admin/sites, trucks, users from Supabase PostgREST to
Drizzle ORM. All data ops use asAdmin(); all audit writes use
withUser(session.sub, tx => writeAuditLog(tx, ...)). Zero supabase
imports remain in the three files.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/api/admin/sites/route.ts

@@ -2,12 +2,14 @@ export const dynamic = 'force-dynamic'
 
 import { NextRequest, NextResponse } from 'next/server'
 import { requireAdmin } from '@/lib/auth/require-admin'
-import { createClient } from '@/lib/supabase/server'
+import { asAdmin, withUser } from '@/lib/db/with-user'
+import { sites, zones, incidents } from '@/lib/db/schema'
+import { writeAuditLog } from '@/lib/db/audit'
+import { eq, sql } from 'drizzle-orm'
 
 export async function POST(request: NextRequest) {
   const { session } = await requireAdmin()
   if (!session) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
-  const supabase = await createClient()
 
   const body: { kind?: 'site' | 'zone'; name?: string; address?: string; site_id?: string } =
     await request.json().catch(() => ({}))
@@ -16,58 +18,57 @@ export async function POST(request: NextRequest) {
 
   if (body.kind === 'zone') {
     if (!body.site_id) return NextResponse.json({ error: 'site_id required for zone' }, { status: 422 })
-    const { data: zone, error } = await supabase
-      .from('zones')
-      .insert({ site_id: body.site_id, name })
-      .select('id, qr_code_token')
-      .single()
-    if (error || !zone) return NextResponse.json({ error: 'Insert failed' }, { status: 500 })
-
-    await supabase.rpc('write_audit_log', {
-      p_table_name: 'zones',
-      p_record_id: zone.id,
-      p_action: 'INSERT',
-      p_new_value: { name, site_id: body.site_id },
-    })
-    return NextResponse.json({ id: zone.id, qr_code_token: zone.qr_code_token }, { status: 201 })
+    const qrCodeToken = crypto.randomUUID()
+    try {
+      const [zone] = await asAdmin(db =>
+        db.insert(zones).values({ siteId: body.site_id!, name, qrCodeToken }).returning({ id: zones.id, qrCodeToken: zones.qrCodeToken })
+      )
+      if (!zone) return NextResponse.json({ error: 'Insert failed' }, { status: 500 })
+      await withUser(session.sub, async tx => {
+        await writeAuditLog(tx, 'zones', zone.id, 'INSERT', { name, site_id: body.site_id })
+      })
+      return NextResponse.json({ id: zone.id, qr_code_token: zone.qrCodeToken }, { status: 201 })
+    } catch {
+      return NextResponse.json({ error: 'Insert failed' }, { status: 500 })
+    }
   }
 
-  const { data: site, error } = await supabase
-    .from('sites')
-    .insert({ name, address: body.address ?? null })
-    .select('id')
-    .single()
-  if (error || !site) return NextResponse.json({ error: 'Insert failed' }, { status: 500 })
-
-  await supabase.rpc('write_audit_log', {
-    p_table_name: 'sites',
-    p_record_id: site.id,
-    p_action: 'INSERT',
-    p_new_value: { name, address: body.address ?? null },
-  })
-  return NextResponse.json({ id: site.id }, { status: 201 })
+  try {
+    const [site] = await asAdmin(db =>
+      db.insert(sites).values({ name, address: body.address ?? null }).returning({ id: sites.id })
+    )
+    if (!site) return NextResponse.json({ error: 'Insert failed' }, { status: 500 })
+    await withUser(session.sub, async tx => {
+      await writeAuditLog(tx, 'sites', site.id, 'INSERT', { name, address: body.address ?? null })
+    })
+    return NextResponse.json({ id: site.id }, { status: 201 })
+  } catch {
+    return NextResponse.json({ error: 'Insert failed' }, { status: 500 })
+  }
 }
 
 export async function PATCH(request: NextRequest) {
   const { session } = await requireAdmin()
   if (!session) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
-  const supabase = await createClient()
 
   const body: { kind?: 'site' | 'zone'; id?: string; active?: boolean } =
     await request.json().catch(() => ({}))
   if (!body.id) return NextResponse.json({ error: 'id required' }, { status: 422 })
-  const table = body.kind === 'zone' ? 'zones' : 'sites'
 
-  const { data: before } = await supabase.from(table).select('*').eq('id', body.id).single()
-  const { error } = await supabase.from(table).update({ active: body.active }).eq('id', body.id)
-  if (error) return NextResponse.json({ error: 'Update failed' }, { status: 500 })
-
-  await supabase.rpc('write_audit_log', {
-    p_table_name: table,
-    p_record_id: body.id,
-    p_action: 'admin_update',
-    p_old_value: before,
-    p_new_value: { active: body.active },
+  const table = body.kind === 'zone' ? zones : sites
+  const [before] = await asAdmin(db =>
+    db.select().from(table).where(eq(table.id, body.id!)).limit(1)
+  )
+  try {
+    await asAdmin(db =>
+      db.update(table).set({ active: body.active }).where(eq(table.id, body.id!))
+    )
+  } catch {
+    return NextResponse.json({ error: 'Update failed' }, { status: 500 })
+  }
+  const tableName = body.kind === 'zone' ? 'zones' : 'sites'
+  await withUser(session.sub, async tx => {
+    await writeAuditLog(tx, tableName, body.id!, 'admin_update', { active: body.active }, before ?? null)
   })
   return NextResponse.json({ ok: true })
 }
@@ -75,42 +76,39 @@ export async function PATCH(request: NextRequest) {
 export async function DELETE(request: NextRequest) {
   const { session } = await requireAdmin()
   if (!session) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
-  const supabase = await createClient()
 
   const body: { kind?: 'site' | 'zone'; id?: string } = await request.json().catch(() => ({}))
   if (!body.id) return NextResponse.json({ error: 'id required' }, { status: 422 })
-  const table = body.kind === 'zone' ? 'zones' : 'sites'
-  const col = body.kind === 'zone' ? 'zone_id' : 'site_id'
 
-  // Count referencing incidents for a clear, actionable error message
-  const { count } = await supabase
-    .from('incidents')
-    .select('id', { count: 'exact', head: true })
-    .eq(col, body.id)
-  if ((count ?? 0) > 0)
+  const tableName = body.kind === 'zone' ? 'zones' : 'sites'
+  const [countRow] = await asAdmin(db =>
+    db.select({ cnt: sql<number>`count(*)` })
+      .from(incidents)
+      .where(body.kind === 'zone' ? eq(incidents.zoneId, body.id!) : eq(incidents.siteId, body.id!))
+  )
+  const incidentCount = Number(countRow?.cnt ?? 0)
+  if (incidentCount > 0)
     return NextResponse.json(
-      { error: `Cannot delete — ${count} incident(s) reference this. Deactivate it instead.` },
+      { error: `Cannot delete — ${incidentCount} incident(s) reference this. Deactivate it instead.` },
       { status: 409 },
     )
 
-  const { data: before } = await supabase.from(table).select('*').eq('id', body.id).single()
-  const { error } = await supabase.from(table).delete().eq('id', body.id)
-  if (error)
-    return NextResponse.json(
-      {
-        error:
-          error.code === '23503'
-            ? 'Cannot delete — this is still referenced elsewhere. Deactivate it instead.'
-            : 'Delete failed',
-      },
-      { status: error.code === '23503' ? 409 : 500 },
+  const [before] = await asAdmin(db =>
+    db.select().from(body.kind === 'zone' ? zones : sites).where(eq((body.kind === 'zone' ? zones : sites).id, body.id!)).limit(1)
+  )
+  try {
+    await asAdmin(db =>
+      db.delete(body.kind === 'zone' ? zones : sites).where(eq((body.kind === 'zone' ? zones : sites).id, body.id!))
     )
-
-  await supabase.rpc('write_audit_log', {
-    p_table_name: table,
-    p_record_id: body.id,
-    p_action: 'DELETE',
-    p_old_value: before,
+  } catch (e) {
+    const code = (e as { code?: string }).code
+    return NextResponse.json(
+      { error: code === '23503' ? 'Cannot delete — still referenced elsewhere. Deactivate instead.' : 'Delete failed' },
+      { status: code === '23503' ? 409 : 500 },
+    )
+  }
+  await withUser(session.sub, async tx => {
+    await writeAuditLog(tx, tableName, body.id!, 'DELETE', null, before ?? null)
   })
   return NextResponse.json({ ok: true })
 }