Replaces the in-progress stub (RPC + brandId params) with Drizzle + the
shared SECURITY DEFINER wrappers in db/client.
- field.ts: cookie session, scrypt PIN, clock-in/out, getOpenClockIn,
getWorkerPayPeriodHours. Cookie payload now 7 fields; parseSessionCookie
re-resolves name/role/lang/brand_id from DB on every read so a stale or
tampered cookie cannot impersonate a different brand.
- index.ts: admin CRUD for workers / tasks / settings / logs / notifications
+ getWorkerPeriodTotals. All admin actions drop the brandId param; the
helpers pull it from the admin session via getAdminUser().
- notifications.ts: overtime check inserts with status='pending' (not
optimistic 'sent') since email/SMS dispatch is out of scope until the
notification_targets columns land in a follow-up migration.
- export/route: cast fix for the changed TimeLog shape.
DB:
- 0094 partial unique index on time_tracking_logs (worker_id)
WHERE clock_out IS NULL — enforces one open clock-in per worker
against concurrent / retried requests (READ COMMITTED cannot).
Nora
tyler