feat(db): phase 4 group 2 — admin routes to Drizzle

Convert app/api/admin/sites, trucks, users from Supabase PostgREST to
Drizzle ORM. All data ops use asAdmin(); all audit writes use
withUser(session.sub, tx => writeAuditLog(tx, ...)). Zero supabase
imports remain in the three files.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/api/admin/users/route.ts

@@ -1,26 +1,45 @@
 export const dynamic = 'force-dynamic'
 
 import { NextRequest, NextResponse } from 'next/server'
-import { createClient } from '@/lib/supabase/server'
 import { isValidRole } from '@/lib/auth/roles'
 import { requireAdmin } from '@/lib/auth/require-admin'
 import { hashPassword } from '@/lib/auth/password'
-import { asAdmin } from '@/lib/db/with-user'
+import { asAdmin, withUser } from '@/lib/db/with-user'
 import { users } from '@/lib/db/schema'
-import { eq } from 'drizzle-orm'
+import { writeAuditLog } from '@/lib/db/audit'
+import { desc, eq } from 'drizzle-orm'
 
 export async function GET() {
   const { session } = await requireAdmin()
   if (!session) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
 
-  const supabase = await createClient()
-  const { data, error } = await supabase
-    .from('users')
-    .select('id, name, email, phone, role, department, site_id, active, created_at')
-    .order('created_at', { ascending: false })
-
-  if (error) return NextResponse.json({ error: 'Fetch failed' }, { status: 500 })
-  return NextResponse.json(data ?? [])
+  const data = await asAdmin(db =>
+    db.select({
+      id: users.id,
+      name: users.name,
+      email: users.email,
+      phone: users.phone,
+      role: users.role,
+      department: users.department,
+      siteId: users.siteId,
+      active: users.active,
+      createdAt: users.createdAt,
+    })
+    .from(users)
+    .orderBy(desc(users.createdAt))
+  )
+  // Return snake_case to preserve existing frontend contract
+  return NextResponse.json(data.map(u => ({
+    id: u.id,
+    name: u.name,
+    email: u.email,
+    phone: u.phone,
+    role: u.role,
+    department: u.department,
+    site_id: u.siteId,
+    active: u.active,
+    created_at: u.createdAt,
+  })))
 }
 
 export async function POST(request: NextRequest) {
@@ -57,12 +76,10 @@ export async function POST(request: NextRequest) {
     return NextResponse.json({ error: 'User creation failed' }, { status: 500 })
   }
 
-  const supabase = await createClient()
-  await supabase.rpc('write_audit_log', {
-    p_table_name: 'users',
-    p_record_id: created.id,
-    p_action: 'created',
-    p_new_value: { email, role: body.role ?? 'reporter', site_id: body.site_id ?? null },
+  await withUser(session.sub, async tx => {
+    await writeAuditLog(tx, 'users', created.id, 'created', {
+      email, role: body.role ?? 'reporter', site_id: body.site_id ?? null,
+    })
   })
 
   return NextResponse.json({ id: created.id }, { status: 201 })
@@ -72,8 +89,6 @@ export async function PATCH(request: NextRequest) {
   const { session } = await requireAdmin()
   if (!session) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
 
-  const supabase = await createClient()
-
   const body: {
     id?: string
     role?: string
@@ -90,29 +105,34 @@ export async function PATCH(request: NextRequest) {
   if (body.id === session.sub && body.role !== undefined && body.role !== 'admin')
     return NextResponse.json({ error: 'Cannot demote your own account' }, { status: 422 })
 
-  const update: Record<string, unknown> = {}
-  if (body.role !== undefined) update.role = body.role
-  if (body.site_id !== undefined) update.site_id = body.site_id
-  if (body.active !== undefined) update.active = body.active
-  if (body.department !== undefined) update.department = body.department
-  if (Object.keys(update).length === 0)
+  const drizzleUpdate: Partial<{ role: typeof users.$inferInsert['role']; siteId: string | null; active: boolean; department: string | null }> = {}
+  if (body.role !== undefined) drizzleUpdate.role = body.role as typeof users.$inferInsert['role']
+  if (body.site_id !== undefined) drizzleUpdate.siteId = body.site_id
+  if (body.active !== undefined) drizzleUpdate.active = body.active
+  if (body.department !== undefined) drizzleUpdate.department = body.department
+  if (Object.keys(drizzleUpdate).length === 0)
     return NextResponse.json({ error: 'Nothing to update' }, { status: 422 })
 
-  const { data: before } = await supabase
-    .from('users').select('role, site_id, active, department').eq('id', body.id).single()
+  const [before] = await asAdmin(db =>
+    db.select({ role: users.role, siteId: users.siteId, active: users.active, department: users.department })
+      .from(users)
+      .where(eq(users.id, body.id!))
+      .limit(1)
+  )
   if (!before) return NextResponse.json({ error: 'User not found' }, { status: 404 })
 
-  const { error } = await supabase.from('users').update(update).eq('id', body.id)
-  if (error) return NextResponse.json({ error: 'Update failed' }, { status: 500 })
-
-  await supabase.rpc('write_audit_log', {
-    p_table_name: 'users',
-    p_record_id: body.id,
-    p_action: 'admin_update',
-    p_old_value: before ?? null,
-    p_new_value: update,
+  try {
+    await asAdmin(db => db.update(users).set(drizzleUpdate).where(eq(users.id, body.id!)))
+  } catch {
+    return NextResponse.json({ error: 'Update failed' }, { status: 500 })
+  }
+  await withUser(session.sub, async tx => {
+    await writeAuditLog(
+      tx, 'users', body.id!, 'admin_update',
+      drizzleUpdate,
+      { role: before.role, site_id: before.siteId, active: before.active, department: before.department },
+    )
   })
-
   return NextResponse.json({ ok: true })
 }
 
@@ -126,11 +146,11 @@ export async function DELETE(request: NextRequest) {
   if (id === session.sub)
     return NextResponse.json({ error: 'Cannot delete your own account' }, { status: 422 })
 
-  const supabase = await createClient()
-
   // fetch user info for audit before deletion
-  const { data: target } = await supabase
-    .from('users').select('email, name, role').eq('id', id).single()
+  const [target] = await asAdmin(db =>
+    db.select({ email: users.email, name: users.name, role: users.role })
+      .from(users).where(eq(users.id, id)).limit(1)
+  )
 
   // Delete user directly from DB
   const [deleted] = await asAdmin(db =>
@@ -142,11 +162,10 @@ export async function DELETE(request: NextRequest) {
   }
 
   if (target) {
-    await supabase.rpc('write_audit_log', {
-      p_table_name: 'users',
-      p_record_id: id,
-      p_action: 'deleted',
-      p_new_value: { email: target.email, name: target.name, role: target.role },
+    await withUser(session.sub, async tx => {
+      await writeAuditLog(tx, 'users', id, 'deleted', {
+        email: target.email, name: target.name, role: target.role,
+      })
     })
   }