fix: retain import actor attribution

Persist record and actor identities through job completion.\nWrite one bounded transactional completion audit per job.

src/app/api/medications/[id]/intake/import/[jobId]/status/__tests__/route.test.ts

@@ -61,7 +61,11 @@ describe("GET medication intake import status", () => {
 
     expect(response.status).toBe(404);
     expect(prisma.medicationIntakeImportJob.findFirst).toHaveBeenCalledWith({
-      where: { id: "job-1", medicationId: "med-1", userId: "user-1" },
+      where: {
+        id: "job-1",
+        medicationId: "med-1",
+        recordUserId: "user-1",
+      },
     });
   });
 

src/app/api/medications/[id]/intake/import/[jobId]/status/route.ts

@@ -1,6 +1,6 @@
 import type { NextRequest } from "next/server";
 
-import { apiHandler, requireAuth } from "@/lib/api-handler";
+import { apiHandler, requireRecordAuth } from "@/lib/api-handler";
 import { apiError, apiSuccess } from "@/lib/api-response";
 import { annotate } from "@/lib/logging/context";
 import { readMedicationIntakeImportJob } from "@/lib/medications/intake-import-job-status";
@@ -13,7 +13,7 @@ export const dynamic = "force-dynamic";
 
 export const GET = apiHandler(
   async (_request: NextRequest, { params }: RouteContext) => {
-    const { user } = await requireAuth();
+    const { user } = await requireRecordAuth("manage", "medications");
     const { id: medicationId, jobId } = await params;
     annotate({
       action: { name: "medication.intake.import.status" },

src/app/api/medications/[id]/intake/import/__tests__/route.test.ts

@@ -237,7 +237,8 @@ describe("POST /api/medications/[id]/intake/import — durable kickoff", () => {
 
     expect(prisma.medicationIntakeImportJob.create).toHaveBeenCalledWith({
       data: expect.objectContaining({
-        userId: "user-1",
+        recordUserId: "user-1",
+        actorUserId: "user-1",
         medicationId: "m1",
         status: "queued",
         // A legacy `zaehler` on the first row rides along and decides nothing:
@@ -303,7 +304,7 @@ describe("POST /api/medications/[id]/intake/import — durable kickoff", () => {
       expect(prisma.medicationIntakeImportJob.updateMany).toHaveBeenCalledWith({
         where: expect.objectContaining({
           medicationId: "m1",
-          userId: "user-1",
+          recordUserId: "user-1",
           status: { in: ["queued", "running"] },
           OR: expect.arrayContaining([
             {

src/app/api/medications/[id]/intake/import/route.ts

@@ -187,7 +187,8 @@ export const POST = apiHandler(
       rollupProcessed: 0,
     };
     const admission = await admitIntakeImportJob({
-      userId: user.id,
+      recordUserId: user.id,
+      actorUserId: actor.id,
       medicationId: id,
       payload: normalized,
       progress,

src/app/api/medications/intake/dose-history-import/[jobId]/status/route.ts

@@ -1,6 +1,6 @@
 import type { NextRequest } from "next/server";
 
-import { apiHandler, requireAuth } from "@/lib/api-handler";
+import { apiHandler, requireRecordAuth } from "@/lib/api-handler";
 import { apiError, apiSuccess } from "@/lib/api-response";
 import { annotate } from "@/lib/logging/context";
 import { readMedicationIntakeImportJob } from "@/lib/medications/intake-import-job-status";
@@ -13,7 +13,7 @@ export const dynamic = "force-dynamic";
 
 export const GET = apiHandler(
   async (_request: NextRequest, { params }: RouteContext) => {
-    const { user } = await requireAuth();
+    const { user } = await requireRecordAuth("manage", "medications");
     const { jobId } = await params;
     annotate({
       action: { name: "medication.intake.history.import.status" },

src/app/api/medications/intake/dose-history-import/__tests__/route.test.ts

@@ -148,7 +148,8 @@ describe("POST /api/medications/intake/dose-history-import", () => {
     await POST(postReq(CSV));
     expect(prisma.medicationIntakeImportJob.create).toHaveBeenCalledWith({
       data: {
-        userId: "user-1",
+        recordUserId: "user-1",
+        actorUserId: "user-1",
         // No medication owns a file covering a regimen; each entry names its own.
         medicationId: null,
         status: "queued",
@@ -258,7 +259,7 @@ describe("POST /api/medications/intake/dose-history-import", () => {
     // reach across and fail it.
     expect(prisma.medicationIntakeImportJob.findFirst).toHaveBeenCalledWith({
       where: {
-        userId: "user-1",
+        recordUserId: "user-1",
         medicationId: null,
         status: { in: ["queued", "running"] },
       },
@@ -267,7 +268,7 @@ describe("POST /api/medications/intake/dose-history-import", () => {
     expect(prisma.medicationIntakeImportJob.updateMany).toHaveBeenCalledWith(
       expect.objectContaining({
         where: expect.objectContaining({
-          userId: "user-1",
+          recordUserId: "user-1",
           medicationId: null,
         }),
       }),

src/app/api/medications/intake/dose-history-import/route.ts

@@ -197,7 +197,8 @@ export const POST = apiHandler(async (request: NextRequest) => {
   };
 
   const admission = await admitIntakeImportJob({
-    userId: user.id,
+    recordUserId: user.id,
+    actorUserId: actor.id,
     medicationId: null,
     payload,
     progress,