adminandClaude Sonnet 4.6
98f5c4e421
Convert all 11 incident API routes from Supabase PostgREST to Drizzle ORM with withUser/asAdmin/writeAuditLog patterns and RLS enforcement. Only uploadEvidenceFile retains supabase client (Phase 5 storage work). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
85 lines
3.2 KiB
TypeScript
85 lines
3.2 KiB
TypeScript
import { NextResponse } from 'next/server'
|
|
import { aliasedTable } from 'drizzle-orm'
|
|
import { getSession } from '@/lib/auth/get-session'
|
|
import { withUser } from '@/lib/db/with-user'
|
|
import { incidents, evidenceFiles, sites, zones, users } from '@/lib/db/schema'
|
|
import { eq, and } from 'drizzle-orm'
|
|
|
|
export const dynamic = 'force-dynamic'
|
|
|
|
export async function GET(_req: Request, { params }: { params: Promise<{ id: string }> }) {
|
|
const { id } = await params
|
|
const session = await getSession()
|
|
if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
|
|
|
|
const reporterAlias = aliasedTable(users, 'reporter')
|
|
|
|
const [incident] = await withUser(session.sub, async tx =>
|
|
tx.select({
|
|
id: incidents.id,
|
|
referenceNo: incidents.referenceNo,
|
|
incidentType: incidents.incidentType,
|
|
description: incidents.description,
|
|
severity: incidents.severity,
|
|
status: incidents.status,
|
|
injuryInvolved: incidents.injuryInvolved,
|
|
assetInvolved: incidents.assetInvolved,
|
|
medicalStatus: incidents.medicalStatus,
|
|
lostDays: incidents.lostDays,
|
|
reportedAt: incidents.reportedAt,
|
|
closedAt: incidents.closedAt,
|
|
siteId: sites.id,
|
|
siteName: sites.name,
|
|
zoneId: zones.id,
|
|
zoneName: zones.name,
|
|
reporterId: reporterAlias.id,
|
|
reporterName: reporterAlias.name,
|
|
reporterEmail: reporterAlias.email,
|
|
})
|
|
.from(incidents)
|
|
.leftJoin(sites, eq(incidents.siteId, sites.id))
|
|
.leftJoin(zones, eq(incidents.zoneId, zones.id))
|
|
.leftJoin(reporterAlias, eq(incidents.reportedBy, reporterAlias.id))
|
|
.where(eq(incidents.id, id))
|
|
.limit(1)
|
|
)
|
|
if (!incident) return NextResponse.json({ error: 'Not found' }, { status: 404 })
|
|
|
|
const isOwner = incident.reporterId === session.sub
|
|
const isSiteStaff = ['hse', 'supervisor', 'admin'].includes(session.role)
|
|
if (!isOwner && !isSiteStaff) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
|
|
|
|
const evidenceFileRows = await withUser(session.sub, async tx =>
|
|
tx.select({
|
|
id: evidenceFiles.id,
|
|
stage: evidenceFiles.stage,
|
|
fileUrl: evidenceFiles.fileUrl,
|
|
fileType: evidenceFiles.fileType,
|
|
uploadedAt: evidenceFiles.uploadedAt,
|
|
})
|
|
.from(evidenceFiles)
|
|
.where(and(eq(evidenceFiles.incidentId, id), eq(evidenceFiles.deleted, false)))
|
|
)
|
|
|
|
return NextResponse.json({
|
|
id: incident.id,
|
|
reference_no: incident.referenceNo,
|
|
incident_type: incident.incidentType,
|
|
description: incident.description,
|
|
severity: incident.severity,
|
|
status: incident.status,
|
|
injury_involved: incident.injuryInvolved,
|
|
asset_involved: incident.assetInvolved,
|
|
medical_status: incident.medicalStatus,
|
|
lost_days: incident.lostDays,
|
|
reported_at: incident.reportedAt,
|
|
closed_at: incident.closedAt,
|
|
sites: incident.siteId ? { id: incident.siteId, name: incident.siteName } : null,
|
|
zones: incident.zoneId ? { id: incident.zoneId, name: incident.zoneName } : null,
|
|
reporter: incident.reporterId ? { id: incident.reporterId, name: incident.reporterName, email: incident.reporterEmail } : null,
|
|
evidence_files: evidenceFileRows.map(ef => ({
|
|
id: ef.id, stage: ef.stage, file_url: ef.fileUrl, file_type: ef.fileType, uploaded_at: ef.uploadedAt,
|
|
})),
|
|
})
|
|
}
|