@stacksjs/defaults 0.70.229 → 0.70.231

package/app/Actions/Dashboard/Notifications/notification-delivery.ts

@@ -0,0 +1,71 @@
+export interface NotificationDeliveryRow {
+  id: number
+  user_id: number | null
+  channel: string
+  recipient: string
+  subject: string | null
+  body: string
+  status: string
+  error: string | null
+  metadata: string | null
+  sent_at: string | null
+  created_at: string
+  updated_at: string | null
+}
+
+export interface DashboardNotificationDelivery {
+  id: number
+  user_id: number | null
+  channel: string
+  recipient: string
+  subject: string
+  body: string
+  status: string
+  error: string
+  metadata: Record<string, unknown>
+  sent_at: string
+  created_at: string
+}
+
+export function parseDeliveryMetadata(
+  value: unknown,
+  label = 'notification delivery metadata',
+): Record<string, unknown> {
+  if (value === null || value === undefined || value === '')
+    return {}
+
+  if (typeof value === 'object' && !Array.isArray(value))
+    return value as Record<string, unknown>
+
+  if (typeof value !== 'string')
+    throw new TypeError(`${label} must be a JSON object`)
+
+  let parsed: unknown
+  try {
+    parsed = JSON.parse(value)
+  }
+  catch (error) {
+    throw new Error(`Could not parse ${label}: ${error instanceof Error ? error.message : String(error)}`)
+  }
+
+  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+    throw new TypeError(`${label} must be a JSON object`)
+
+  return parsed as Record<string, unknown>
+}
+
+export function serializeNotificationDelivery(row: NotificationDeliveryRow): DashboardNotificationDelivery {
+  return {
+    id: Number(row.id),
+    user_id: row.user_id === null ? null : Number(row.user_id),
+    channel: String(row.channel || ''),
+    recipient: String(row.recipient || ''),
+    subject: String(row.subject || ''),
+    body: String(row.body || ''),
+    status: String(row.status || 'pending'),
+    error: String(row.error || ''),
+    metadata: parseDeliveryMetadata(row.metadata, `notification delivery ${row.id} metadata`),
+    sent_at: String(row.sent_at || row.created_at || ''),
+    created_at: String(row.created_at || ''),
+  }
+}

package/app/Actions/Dashboard/Queries/QueryDashboardAction.ts

@@ -0,0 +1,35 @@
+import { Action } from '@stacksjs/actions'
+import { config } from '@stacksjs/config'
+import { db } from '@stacksjs/database'
+import { response } from '@stacksjs/router'
+import { dashboardQueryColumns, mapDashboardQueryLog, type QueryLogSourceRow } from './query-dashboard'
+
+export default new Action({
+  name: 'Query Dashboard',
+  description: 'Returns safe, native query log records for the operator dashboard.',
+  method: 'GET',
+  apiResponse: true,
+
+  async handle() {
+    const queryLogging = config.database?.queryLogging
+    try {
+      const rows = await db
+        .selectFrom('query_logs')
+        .select(dashboardQueryColumns)
+        .orderBy('executed_at', 'desc')
+        .limit(2000)
+        .execute()
+
+      return {
+        enabled: queryLogging?.enabled === true,
+        slowThreshold: queryLogging?.slowThreshold || 100,
+        queries: rows.map(row => mapDashboardQueryLog(row as QueryLogSourceRow)),
+      }
+    }
+    catch (error) {
+      return response.json({
+        message: error instanceof Error ? error.message : 'Query logs could not be loaded.',
+      }, 503)
+    }
+  },
+})

package/app/Actions/Dashboard/Queries/QueryIndexAction.ts

@@ -1,22 +1,2 @@
-import { Action } from '@stacksjs/actions'
-
-export default new Action({
-  name: 'QueryIndexAction',
-  description: 'Returns recent database queries and stats for the dashboard.',
-  method: 'GET',
-  async handle() {
-    return {
-      queries: [
-        { query: 'SELECT * FROM users WHERE...', time: '12ms', rows: 150, timestamp: '10:45:32' },
-        { query: 'INSERT INTO orders VALUES...', time: '8ms', rows: 1, timestamp: '10:45:28' },
-        { query: 'UPDATE posts SET status...', time: '15ms', rows: 5, timestamp: '10:45:25' },
-        { query: 'SELECT * FROM products JOIN...', time: '234ms', rows: 1500, timestamp: '10:45:20' },
-      ],
-      stats: [
-        { label: 'Total Queries', value: '45.2K' },
-        { label: 'Avg Time', value: '8ms' },
-        { label: 'Slow Queries', value: '12' },
-      ],
-    }
-  },
-})
+// Preserve the legacy route while keeping one canonical persisted query-log contract.
+export { default } from './QueryDashboardAction'

package/app/Actions/Dashboard/Queries/QueryShowAction.ts

@@ -0,0 +1,35 @@
+import { Action } from '@stacksjs/actions'
+import { db } from '@stacksjs/database'
+import { response } from '@stacksjs/router'
+import { dashboardQueryColumns, mapDashboardQueryLog, type QueryLogSourceRow } from './query-dashboard'
+
+export default new Action({
+  name: 'Query Details',
+  description: 'Returns one safe query-log projection for the operator dashboard.',
+  method: 'GET',
+  apiResponse: true,
+
+  async handle(request: RequestInstance) {
+    const id = Number(request.getParam('id'))
+    if (!Number.isInteger(id) || id <= 0)
+      return response.json({ message: 'Query id must be a positive integer.' }, 422)
+
+    try {
+      const row = await db
+        .selectFrom('query_logs')
+        .select(dashboardQueryColumns)
+        .where('id', '=', id)
+        .executeTakeFirst()
+
+      if (!row)
+        return response.json({ message: 'Query log not found.' }, 404)
+
+      return { query: mapDashboardQueryLog(row as QueryLogSourceRow) }
+    }
+    catch (error) {
+      return response.json({
+        message: error instanceof Error ? error.message : 'Query log could not be loaded.',
+      }, 503)
+    }
+  },
+})

package/app/Actions/Dashboard/Queries/query-dashboard.test.ts

@@ -0,0 +1,56 @@
+import { describe, expect, it } from 'bun:test'
+import { dashboardQueryColumns, mapDashboardQueryLog, parseQueryLogList, queryType } from './query-dashboard'
+
+describe('query dashboard projection', () => {
+  it('classifies supported query types', () => {
+    expect(queryType(' select * from users')).toBe('SELECT')
+    expect(queryType('UPDATE users SET name = ?')).toBe('UPDATE')
+    expect(queryType('PRAGMA table_info(users)')).toBe('OTHER')
+  })
+
+  it('parses persisted JSON lists and reports malformed values', () => {
+    expect(parseQueryLogList('["SELECT","table:users"]')).toEqual(['SELECT', 'table:users'])
+    expect(() => parseQueryLogList('invalid')).toThrow('Could not parse query log list')
+    expect(() => parseQueryLogList('{"tag":"SELECT"}')).toThrow('must be a JSON array of strings')
+  })
+
+  it('excludes bindings, traces, and file paths from the dashboard shape', () => {
+    const result = mapDashboardQueryLog({
+      id: 4,
+      query: 'SELECT * FROM users WHERE id = ?',
+      normalized_query: 'SELECT * FROM users WHERE id = ?',
+      duration: 8.4,
+      connection: 'sqlite',
+      status: 'slow',
+      error: null,
+      executed_at: '2026-07-29T14:00:00.000Z',
+      tags: '["SELECT","table:users"]',
+      affected_tables: '["users"]',
+    })
+
+    expect(result.type).toBe('SELECT')
+    expect(result.tags).toEqual(['SELECT', 'table:users'])
+    expect(result.affectedTables).toEqual(['users'])
+    expect(result).not.toHaveProperty('bindings')
+    expect(result).not.toHaveProperty('trace')
+    expect(result).not.toHaveProperty('file')
+    expect(dashboardQueryColumns).not.toContain('bindings')
+    expect(dashboardQueryColumns).not.toContain('trace')
+    expect(dashboardQueryColumns).not.toContain('file')
+  })
+
+  it('reports invalid persisted metrics and statuses', () => {
+    const base = {
+      id: 7,
+      query: 'SELECT 1',
+      duration: 1,
+      status: 'completed',
+      executed_at: '2026-07-29T14:00:00.000Z',
+    }
+
+    expect(() => mapDashboardQueryLog({ ...base, duration: 'not-a-number' as unknown as number }))
+      .toThrow('query log 7 duration must be a finite number')
+    expect(() => mapDashboardQueryLog({ ...base, status: 'pending' }))
+      .toThrow('query log 7 status must be completed, failed, or slow')
+  })
+})

package/app/Actions/Dashboard/Queries/query-dashboard.ts

@@ -0,0 +1,136 @@
+export interface QueryLogSourceRow {
+  id: number | string
+  query: string
+  normalized_query?: string | null
+  duration?: number | null
+  connection?: string | null
+  status?: string | null
+  error?: string | null
+  executed_at: string
+  model?: string | null
+  method?: string | null
+  rows_affected?: number | null
+  memory_usage?: number | null
+  tags?: string | null
+  affected_tables?: string | null
+  indexes_used?: string | null
+  missing_indexes?: string | null
+  optimization_suggestions?: string | null
+}
+
+export const dashboardQueryColumns = [
+  'id',
+  'query',
+  'normalized_query',
+  'duration',
+  'connection',
+  'status',
+  'error',
+  'executed_at',
+  'model',
+  'method',
+  'rows_affected',
+  'memory_usage',
+  'tags',
+  'affected_tables',
+  'indexes_used',
+  'missing_indexes',
+  'optimization_suggestions',
+] as const
+
+export interface DashboardQueryLog {
+  id: number | string
+  query: string
+  normalizedQuery: string
+  type: 'SELECT' | 'INSERT' | 'UPDATE' | 'DELETE' | 'OTHER'
+  duration: number
+  connection: string
+  status: 'completed' | 'failed' | 'slow'
+  error: string
+  executedAt: string
+  model: string
+  method: string
+  rowsAffected: number | null
+  memoryUsage: number | null
+  tags: string[]
+  affectedTables: string[]
+  indexesUsed: string[]
+  missingIndexes: string[]
+  suggestions: string[]
+}
+
+export function queryType(query: string): DashboardQueryLog['type'] {
+  const type = query.trim().match(/^([a-z]+)/i)?.[1]?.toUpperCase()
+  return type === 'SELECT' || type === 'INSERT' || type === 'UPDATE' || type === 'DELETE'
+    ? type
+    : 'OTHER'
+}
+
+export function parseQueryLogList(value?: string | null, label = 'query log list'): string[] {
+  if (!value)
+    return []
+
+  let parsed: unknown
+  try {
+    parsed = JSON.parse(value)
+  }
+  catch (error) {
+    throw new Error(`Could not parse ${label}: ${error instanceof Error ? error.message : String(error)}`)
+  }
+
+  if (!Array.isArray(parsed) || !parsed.every(item => typeof item === 'string'))
+    throw new TypeError(`${label} must be a JSON array of strings`)
+
+  return parsed
+}
+
+export function mapDashboardQueryLog(row: QueryLogSourceRow): DashboardQueryLog {
+  const label = `query log ${row.id}`
+  const status = queryStatus(row.status, label)
+  if (typeof row.query !== 'string' || !row.query.trim())
+    throw new TypeError(`${label} query must be a non-empty string`)
+  if (typeof row.executed_at !== 'string' || !row.executed_at.trim())
+    throw new TypeError(`${label} executed_at must be a non-empty string`)
+
+  return {
+    id: row.id,
+    query: row.query,
+    normalizedQuery: row.normalized_query || row.query,
+    type: queryType(row.query),
+    duration: finiteNumber(row.duration, `${label} duration`),
+    connection: row.connection || 'unknown',
+    status,
+    error: row.error || '',
+    executedAt: row.executed_at,
+    model: row.model || '',
+    method: row.method || '',
+    rowsAffected: nullableFiniteNumber(row.rows_affected, `${label} rows_affected`),
+    memoryUsage: nullableFiniteNumber(row.memory_usage, `${label} memory_usage`),
+    tags: parseQueryLogList(row.tags, `${label} tags`),
+    affectedTables: parseQueryLogList(row.affected_tables, `${label} affected_tables`),
+    indexesUsed: parseQueryLogList(row.indexes_used, `${label} indexes_used`),
+    missingIndexes: parseQueryLogList(row.missing_indexes, `${label} missing_indexes`),
+    suggestions: parseQueryLogList(row.optimization_suggestions, `${label} optimization_suggestions`),
+  }
+}
+
+function queryStatus(value: unknown, label: string): DashboardQueryLog['status'] {
+  if (value === 'completed' || value === 'failed' || value === 'slow')
+    return value
+  throw new TypeError(`${label} status must be completed, failed, or slow`)
+}
+
+function finiteNumber(value: unknown, label: string): number {
+  const parsed = typeof value === 'number'
+    ? value
+    : typeof value === 'string' && value.trim()
+      ? Number(value)
+      : Number.NaN
+  if (!Number.isFinite(parsed))
+    throw new TypeError(`${label} must be a finite number`)
+  return parsed
+}
+
+function nullableFiniteNumber(value: unknown, label: string): number | null {
+  return value === null || value === undefined ? null : finiteNumber(value, label)
+}

package/app/Actions/Dashboard/Queue/QueueRetryFailedAction.ts

@@ -1,6 +1,7 @@
 import { Action } from '@stacksjs/actions'
 import { executeFailedJobs } from '@stacksjs/queue'
 import { FailedJob } from '@stacksjs/orm'
+import { response } from '@stacksjs/router'
 
 export default new Action({
   name: 'QueueRetryFailedAction',
@@ -16,7 +17,9 @@ export default new Action({
       return { success: true, message: `Re-queued ${requeued} failed job${requeued === 1 ? '' : 's'}`, count: requeued }
     }
     catch (e) {
-      return { success: false, message: (e as Error).message || 'Failed to retry failed jobs', count: 0 }
+      return response.json({
+        message: (e as Error).message || 'Failed jobs could not be retried.',
+      }, 500)
     }
   },
 })

package/app/Actions/Dashboard/Queue/QueueStatsAction.ts

@@ -1,6 +1,7 @@
 import { Action } from '@stacksjs/actions'
 import { FailedJob, Job } from '@stacksjs/orm'
 import { getGlobalMetrics } from '@stacksjs/queue'
+import { response } from '@stacksjs/router'
 
 interface QueueBucket {
   pending: number
@@ -79,20 +80,10 @@ export default new Action({
 
       return { queues, stats, queueConnected: true }
     }
-    catch {
-      return {
-        queues: [],
-        stats: {
-          totalQueues: 0,
-          totalJobs: 0,
-          activeJobs: 0,
-          completedJobs: 0,
-          failedJobs: 0,
-          throughputPerMinute: 0,
-          averageProcessingTimeMs: 0,
-        },
-        queueConnected: false,
-      }
+    catch (error) {
+      return response.json({
+        message: error instanceof Error ? error.message : 'Queue statistics could not be loaded.',
+      }, 503)
     }
   },
 })

package/app/Actions/Dashboard/Queue/QueueWorkersAction.ts

@@ -1,5 +1,6 @@
 import { Action } from '@stacksjs/actions'
 import { getActiveJobCount, getWorkerTracker, isWorkerRunning } from '@stacksjs/queue'
+import { response } from '@stacksjs/router'
 
 export default new Action({
   name: 'QueueWorkersAction',
@@ -29,7 +30,7 @@ export default new Action({
           failed_jobs: w.failedCount,
           uptime,
           last_heartbeat: w.lastActivityAt,
-          memory: '—',
+          memory: '-',
         }
       })
 
@@ -39,8 +40,10 @@ export default new Action({
         active_jobs: getActiveJobCount(),
       }
     }
-    catch {
-      return { data: [], worker_running: false, active_jobs: 0 }
+    catch (error) {
+      return response.json({
+        message: error instanceof Error ? error.message : 'Queue workers could not be loaded.',
+      }, 503)
     }
   },
 })

package/app/Actions/Dashboard/Rbac/PermissionDestroyAction.ts

@@ -1,5 +1,6 @@
 import { Action } from '@stacksjs/actions'
 import { deletePermission } from '@stacksjs/auth'
+import { response } from '@stacksjs/router'
 
 /**
  * `DELETE /api/dashboard/rbac/permissions/:name` (stacksjs/stacks#1845).
@@ -16,10 +17,13 @@ export default new Action({
   async handle(request) {
     const name = String((request as any)?.params?.name ?? '').trim()
     if (!name) {
-      return { error: '`name` route param is required.', status: 400 }
+      return response.json({ error: '`name` route param is required.' }, 400)
     }
     const url = new URL(request.url ?? 'http://localhost/')
-    const guardName = url.searchParams.get('guard') || 'web'
+    const guardName = (url.searchParams.get('guard') || 'web').trim()
+    if (!guardName || guardName.length > 60) {
+      return response.json({ error: 'Invalid guard name.' }, 400)
+    }
 
     try {
       await deletePermission(name, guardName)
@@ -27,7 +31,7 @@ export default new Action({
     }
     catch (err) {
       console.error('[dashboard/rbac] PermissionDestroyAction failed:', err)
-      return { error: err instanceof Error ? err.message : 'unknown error', status: 500 }
+      return response.json({ error: err instanceof Error ? err.message : 'unknown error' }, 500)
     }
   },
 })

package/app/Actions/Dashboard/Rbac/PermissionStoreAction.ts

@@ -1,5 +1,6 @@
 import { Action } from '@stacksjs/actions'
 import { createPermission, findPermission } from '@stacksjs/auth'
+import { response } from '@stacksjs/router'
 
 interface PermissionInput {
   name?: unknown
@@ -24,15 +25,21 @@ export default new Action({
 
     const name = typeof body.name === 'string' ? body.name.trim() : ''
     if (!name || name.length > 100) {
-      return { error: '`name` is required and must be 1-100 characters.', status: 400 }
+      return response.json({ error: '`name` is required and must be 1-100 characters.' }, 400)
     }
     const guardName = typeof body.guardName === 'string' && body.guardName ? body.guardName.trim() : 'web'
     const description = typeof body.description === 'string' ? body.description.trim() : undefined
+    if (!guardName || guardName.length > 60) {
+      return response.json({ error: '`guardName` must be 1-60 characters.' }, 400)
+    }
+    if (description && description.length > 255) {
+      return response.json({ error: '`description` must be at most 255 characters.' }, 400)
+    }
 
     try {
       const existing = await findPermission(name, guardName)
       if (existing) {
-        return { error: 'A permission with that name and guard already exists.', status: 409 }
+        return response.json({ error: 'A permission with that name and guard already exists.' }, 409)
       }
       const permission = await createPermission(name, guardName, description)
       return {
@@ -47,7 +54,7 @@ export default new Action({
     }
     catch (err) {
       console.error('[dashboard/rbac] PermissionStoreAction failed:', err)
-      return { error: err instanceof Error ? err.message : 'unknown error', status: 500 }
+      return response.json({ error: err instanceof Error ? err.message : 'unknown error' }, 500)
     }
   },
 })

package/app/Actions/Dashboard/Rbac/PermissionsIndexAction.ts

@@ -1,5 +1,6 @@
 import { Action } from '@stacksjs/actions'
 import { getAllPermissions } from '@stacksjs/auth'
+import { response } from '@stacksjs/router'
 
 /**
  * `GET /api/dashboard/rbac/permissions` (stacksjs/stacks#1845).
@@ -28,7 +29,7 @@ export default new Action({
     }
     catch (err) {
       console.error('[dashboard/rbac] PermissionsIndexAction failed:', err)
-      return { permissions: [], error: err instanceof Error ? err.message : 'unknown error' }
+      return response.json({ permissions: [], error: err instanceof Error ? err.message : 'unknown error' }, 500)
     }
   },
 })

package/app/Actions/Dashboard/Rbac/RoleDestroyAction.ts

@@ -1,5 +1,6 @@
 import { Action } from '@stacksjs/actions'
 import { deleteRole } from '@stacksjs/auth'
+import { response } from '@stacksjs/router'
 
 /**
  * `DELETE /api/dashboard/rbac/roles/:name` (stacksjs/stacks#1845).
@@ -18,10 +19,13 @@ export default new Action({
   async handle(request) {
     const name = String((request as any)?.params?.name ?? '').trim()
     if (!name) {
-      return { error: '`name` route param is required.', status: 400 }
+      return response.json({ error: '`name` route param is required.' }, 400)
     }
     const url = new URL(request.url ?? 'http://localhost/')
-    const guardName = url.searchParams.get('guard') || 'web'
+    const guardName = (url.searchParams.get('guard') || 'web').trim()
+    if (!guardName || guardName.length > 60) {
+      return response.json({ error: 'Invalid guard name.' }, 400)
+    }
 
     try {
       await deleteRole(name, guardName)
@@ -29,7 +33,7 @@ export default new Action({
     }
     catch (err) {
       console.error('[dashboard/rbac] RoleDestroyAction failed:', err)
-      return { error: err instanceof Error ? err.message : 'unknown error', status: 500 }
+      return response.json({ error: err instanceof Error ? err.message : 'unknown error' }, 500)
     }
   },
 })

package/app/Actions/Dashboard/Rbac/RolePermissionsShowAction.ts

@@ -1,5 +1,6 @@
 import { Action } from '@stacksjs/actions'
 import { findRole, getRolePermissions } from '@stacksjs/auth'
+import { response } from '@stacksjs/router'
 
 /**
  * `GET /api/dashboard/rbac/roles/:name/permissions` (stacksjs/stacks#1845).
@@ -17,17 +18,20 @@ export default new Action({
   async handle(request) {
     const name = String((request as any)?.params?.name ?? '').trim()
     if (!name) {
-      return { error: '`name` route param is required.', status: 400 }
+      return response.json({ error: '`name` route param is required.' }, 400)
     }
     const url = new URL(request.url ?? 'http://localhost/')
-    const guardName = url.searchParams.get('guard') || 'web'
+    const guardName = (url.searchParams.get('guard') || 'web').trim()
+    if (!guardName || guardName.length > 60) {
+      return response.json({ error: 'Invalid guard name.' }, 400)
+    }
 
     try {
       const role = await findRole(name, guardName)
       if (!role) {
-        return { error: 'Role not found.', status: 404 }
+        return response.json({ error: 'Role not found.' }, 404)
       }
-      const permissions = await getRolePermissions(role.id)
+      const permissions = (await getRolePermissions(role.id)).filter(permission => permission.guard_name === guardName)
       return {
         role: { id: role.id, name: role.name, guardName: role.guard_name },
         permissions: permissions.map(p => ({
@@ -39,7 +43,7 @@ export default new Action({
     }
     catch (err) {
       console.error('[dashboard/rbac] RolePermissionsShowAction failed:', err)
-      return { permissions: [], error: err instanceof Error ? err.message : 'unknown error' }
+      return response.json({ permissions: [], error: err instanceof Error ? err.message : 'unknown error' }, 500)
     }
   },
 })

package/app/Actions/Dashboard/Rbac/RolePermissionsSyncAction.ts

@@ -1,5 +1,6 @@
 import { Action } from '@stacksjs/actions'
 import { getRolePermissions, findRole, syncRolePermissions } from '@stacksjs/auth'
+import { response } from '@stacksjs/router'
 
 interface SyncInput {
   permissions?: unknown
@@ -21,21 +22,24 @@ export default new Action({
   async handle(request) {
     const roleName = String((request as any)?.params?.name ?? '').trim()
     if (!roleName) {
-      return { error: '`name` route param is required.', status: 400 }
+      return response.json({ error: '`name` route param is required.' }, 400)
     }
 
     const body = (request as any).jsonBody as SyncInput | undefined ?? {}
     if (!Array.isArray(body.permissions)) {
-      return { error: '`permissions` must be an array of permission names (possibly empty).', status: 400 }
+      return response.json({ error: '`permissions` must be an array of permission names (possibly empty).' }, 400)
     }
     const names: string[] = []
     for (const v of body.permissions) {
-      if (typeof v !== 'string' || !v.trim()) {
-        return { error: '`permissions` must contain non-empty strings.', status: 400 }
+      if (typeof v !== 'string' || !v.trim() || v.trim().length > 100) {
+        return response.json({ error: '`permissions` must contain non-empty strings.' }, 400)
       }
       names.push(v.trim())
     }
     const guardName = typeof body.guardName === 'string' && body.guardName ? body.guardName.trim() : 'web'
+    if (!guardName || guardName.length > 60) {
+      return response.json({ error: '`guardName` must be 1-60 characters.' }, 400)
+    }
 
     try {
       await syncRolePermissions(roleName, Array.from(new Set(names)), guardName)
@@ -43,9 +47,9 @@ export default new Action({
       // UI can reconcile against canonical state.
       const role = await findRole(roleName, guardName)
       if (!role) {
-        return { error: 'Role not found after sync.', status: 404 }
+        return response.json({ error: 'Role not found after sync.' }, 404)
       }
-      const after = await getRolePermissions(role.id)
+      const after = (await getRolePermissions(role.id)).filter(permission => permission.guard_name === guardName)
       return {
         role: { id: role.id, name: role.name, guardName: role.guard_name },
         permissions: after.map(p => ({ id: p.id, name: p.name, guardName: p.guard_name })),
@@ -54,10 +58,10 @@ export default new Action({
     catch (err) {
       const msg = err instanceof Error ? err.message : 'unknown error'
       if (msg.includes('not found')) {
-        return { error: msg, status: 400 }
+        return response.json({ error: msg }, 400)
       }
       console.error('[dashboard/rbac] RolePermissionsSyncAction failed:', err)
-      return { error: msg, status: 500 }
+      return response.json({ error: msg }, 500)
     }
   },
 })