refactor(db): migrate app pages and APIs from Prisma facade to Drizzle (5)

Co-authored-by: Cursor <[email protected]>

src/lib/auth.ts

@@ -1,4 +1,4 @@
-import { sql } from "drizzle-orm";
+import { eq, sql } from "drizzle-orm";
 import NextAuth from "next-auth";
 import Credentials from "next-auth/providers/credentials";
 import { env } from "@/env";
@@ -7,9 +7,8 @@ import { LaravelEncrypter } from "@/lib/auth/laravel-encrypter";
 import { checkLogin } from "@/lib/auth/password";
 import { verifyTotp } from "@/lib/auth/totp";
 import { cachedQuery, invalidateKey } from "@/lib/cached-db";
-import { db } from "@/lib/db";
+import { db, User, WebsiteLoginLogs } from "@/lib/db";
 import { logger } from "@/lib/logger";
-import { prisma } from "@/lib/prisma";
 import { clientIp, rateLimit } from "@/lib/rate-limit";
 import { siteSettings } from "@/lib/services/site-settings";
 
@@ -88,10 +87,14 @@ export async function invalidateLoginCache(username: string): Promise<void> {
 }
 
 async function verify2faCode(userId: number, code: string): Promise<boolean> {
-	const user = await prisma.user.findUnique({
-		where: { id: userId },
-		select: { twoFactorSecret: true, twoFactorRecoveryCodes: true },
-	});
+	const [user] = await db
+		.select({
+			twoFactorSecret: User.twoFactorSecret,
+			twoFactorRecoveryCodes: User.twoFactorRecoveryCodes,
+		})
+		.from(User)
+		.where(eq(User.id, userId))
+		.limit(1);
 	if (!user?.twoFactorSecret) return false;
 
 	// Try TOTP first
@@ -119,10 +122,10 @@ async function verify2faCode(userId: number, code: string): Promise<boolean> {
 		if (idx !== -1) {
 			codes.splice(idx, 1);
 			const remaining = codes.length > 0 ? JSON.stringify(codes) : null;
-			await prisma.user.update({
-				where: { id: userId },
-				data: { twoFactorRecoveryCodes: remaining },
-			});
+			await db
+				.update(User)
+				.set({ twoFactorRecoveryCodes: remaining })
+				.where(eq(User.id, userId));
 			return true;
 		}
 	}
@@ -189,10 +192,10 @@ export const { handlers, signOut, auth } = NextAuth({
 				}
 
 				if (res.upgradedHash) {
-					await prisma.user.update({
-						where: { id: user.id },
-						data: { password: res.upgradedHash },
-					});
+					await db
+						.update(User)
+						.set({ password: res.upgradedHash })
+						.where(eq(User.id, user.id));
 					invalidateLoginCache(username);
 				}
 
@@ -213,13 +216,11 @@ export const { handlers, signOut, auth } = NextAuth({
 				try {
 					const { headers } = await import("next/headers");
 					const ua = (await headers()).get("user-agent")?.slice(0, 512) ?? null;
-					await prisma.websiteLoginLogs.create({
-						data: {
-							userId: user.id,
-							ip,
-							userAgent: ua,
-							createdAt: new Date(),
-						},
+					await db.insert(WebsiteLoginLogs).values({
+						userId: user.id,
+						ip,
+						userAgent: ua,
+						createdAt: new Date(),
 					});
 				} catch {
 					logger.warn("Failed to record login log for user", {