@stacksjs/defaults 0.70.354 → 0.70.356

package/app/Actions/Dashboard/Models/model-write.ts

@@ -7,6 +7,8 @@
  * bypass every guarantee the ORM makes. Those rows stay read-only.
  */
 import { loadModelIfExists } from '../../../../resources/functions/dashboard/data'
+import { dashboardOperationalIssue } from '../dashboard-response'
+import { modelApiConfiguration } from './model-api'
 
 /** Never writable from a generic admin table, whatever the model declares. */
 export const PROTECTED_COLUMNS: ReadonlySet<string> = new Set([
@@ -41,6 +43,11 @@ export interface ResolvedModel {
   modelName: string
 }
 
+export interface ModelResolutionError {
+  error: string
+  status: 400 | 404 | 405 | 500
+}
+
 export type ModelWriteOperation = 'store' | 'update' | 'destroy'
 
 export interface ModelWriteCapabilities {
@@ -121,17 +128,8 @@ function isProtectedField(name: string): boolean {
   return PROTECTED_COLUMNS.has(name) || PROTECTED_COLUMNS.has(column)
 }
 
-function useApiRoutes(Model: any): string[] {
-  const useApi = Model?.traits?.useApi
-  if (!useApi)
-    return []
-  if (typeof useApi === 'object' && Array.isArray(useApi.routes))
-    return useApi.routes.map(String)
-  return ['index', 'store', 'show', 'update', 'destroy']
-}
-
 export function modelWriteCapabilities(Model: any): ModelWriteCapabilities {
-  const routes = useApiRoutes(Model)
+  const routes = modelApiConfiguration(Model).routes
   return {
     create: routes.includes('store'),
     update: routes.includes('update'),
@@ -293,19 +291,28 @@ export function prepareModelFields(
  * injects (the same object the rest of the dashboard queries, so scopes,
  * casts and observers all apply) over the path-map lookup.
  */
-export async function resolveWritableModel(slug: string, operation?: ModelWriteOperation): Promise<ResolvedModel | { error: string }> {
+export async function resolveWritableModel(slug: string, operation?: ModelWriteOperation): Promise<ResolvedModel | ModelResolutionError> {
   if (!isValidModelSlug(slug))
-    return { error: 'Model slug must be lowercase kebab-case.' }
+    return { error: 'Model slug must be lowercase kebab-case.', status: 400 }
 
   const modelName = slugToPascal(slug)
   const injected = (globalThis as Record<string, any>)[modelName]
-  const Model = (injected && typeof injected.where === 'function') ? injected : await loadModelIfExists(modelName)
+  let Model: any
+  try {
+    Model = (injected && typeof injected.where === 'function') ? injected : await loadModelIfExists(modelName)
+  }
+  catch (error) {
+    return {
+      error: dashboardOperationalIssue(error, `${modelName} could not be loaded.`, `resolveWritableModel.${operation || 'read'}`),
+      status: 500,
+    }
+  }
   if (!Model || typeof Model.find !== 'function')
-    return { error: `No ORM model named ${modelName}. Rows from tables without a model are read-only.` }
+    return { error: `No ORM model named ${modelName}. Rows from tables without a model are read-only.`, status: 404 }
   if (operation) {
     const capability = operation === 'store' ? 'create' : operation
     if (!modelWriteCapabilities(Model)[capability])
-      return { error: `${modelName} does not declare the ${operation} route in its useApi trait.` }
+      return { error: `${modelName} does not declare the ${operation} route in its useApi trait.`, status: 405 }
   }
   return { Model, modelName }
 }

package/app/Actions/Dashboard/Notifications/NotificationDeliveryHistoryAction.ts

@@ -1,7 +1,9 @@
 import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { db } from '@stacksjs/database'
-import { request as routerRequest, response } from '@stacksjs/router'
+import { response } from '@stacksjs/router'
+import { dashboardOperationalError } from '../dashboard-response'
+import { dashboardRequestValue } from '../dashboard-request'
 import {
   type NotificationDeliveryRow,
   serializeNotificationDelivery,
@@ -16,9 +18,7 @@ type DeliveryStatus = typeof STATUSES[number]
 type DeliverySort = typeof SORTS[number]
 
 function queryValue(request: RequestInstance, key: string): string {
-  const query = ((routerRequest as any).query || {}) as Record<string, string | string[] | undefined>
-  const value = query[key]
-  return String((Array.isArray(value) ? value[0] : value) || request.get(key) || '').trim()
+  return dashboardRequestValue(request, key)
 }
 
 function allowedValue<T extends string>(value: string, values: readonly T[]): T | null {
@@ -31,13 +31,15 @@ export default new Action({
   method: 'GET',
   apiResponse: true,
   async handle(request: RequestInstance) {
-    const page = Math.max(1, Number.parseInt(queryValue(request, 'page') || '1', 10) || 1)
+    const page = Math.min(1_000_000, Math.max(1, Number.parseInt(queryValue(request, 'page') || '1', 10) || 1))
     const perPage = Math.min(100, Math.max(1, Number.parseInt(queryValue(request, 'per_page') || '20', 10) || 20))
     const channel = allowedValue(queryValue(request, 'channel').toLowerCase(), CHANNELS)
     const status = allowedValue(queryValue(request, 'status').toLowerCase(), STATUSES)
     const sort = allowedValue(queryValue(request, 'sort').toLowerCase(), SORTS) || 'sent_at'
     const direction = queryValue(request, 'direction').toLowerCase() === 'asc' ? 'asc' : 'desc'
     const search = queryValue(request, 'search')
+    if (search.length > 200)
+      return response.json({ message: 'Notification delivery search must be 200 characters or fewer.' }, 422)
     const searchPattern = `%${search}%`
 
     const applyFilters = <T extends {
@@ -59,42 +61,49 @@ export default new Action({
       return filtered
     }
 
-    const countQuery = applyFilters(
-      db
-        .selectFrom('notification_deliveries')
-        .select(db.fn.count('id').as('count')),
-    )
-    const rowsQuery = applyFilters(
-      db
-        .selectFrom('notification_deliveries')
-        .selectAll(),
-    )
+    try {
+      const countQuery = applyFilters(
+        db
+          .selectFrom('notification_deliveries')
+          .select(db.fn.count('id').as('count')),
+      )
+      const rowsQuery = applyFilters(
+        db
+          .selectFrom('notification_deliveries')
+          .selectAll(),
+      )
 
-    const [countRow, rows] = await Promise.all([
-      countQuery.executeTakeFirst() as Promise<{ count: number | string } | undefined>,
-      rowsQuery
-        .orderBy(sort as DeliverySort, direction)
-        .limit(perPage)
-        .offset((page - 1) * perPage)
-        .execute() as Promise<NotificationDeliveryRow[]>,
-    ])
+      const [countRow, rows] = await Promise.all([
+        countQuery.executeTakeFirst() as Promise<{ count: number | string } | undefined>,
+        rowsQuery
+          .orderBy(sort as DeliverySort, direction)
+          .limit(perPage)
+          .offset((page - 1) * perPage)
+          .execute() as Promise<NotificationDeliveryRow[]>,
+      ])
 
-    const total = Number(countRow?.count || 0)
-    return response.json({
-      deliveries: rows.map(serializeNotificationDelivery),
-      pagination: {
-        page,
-        per_page: perPage,
-        total,
-        total_pages: Math.max(1, Math.ceil(total / perPage)),
-      },
-      filters: {
-        channel: channel as DeliveryChannel | null,
-        status: status as DeliveryStatus | null,
-        search,
-        sort,
-        direction,
-      },
-    })
+      const total = Number(countRow?.count || 0)
+      if (!Number.isSafeInteger(total) || total < 0)
+        throw new TypeError('Notification delivery count must be a non-negative integer.')
+      return response.json({
+        deliveries: rows.map(serializeNotificationDelivery),
+        pagination: {
+          page,
+          per_page: perPage,
+          total,
+          total_pages: Math.max(1, Math.ceil(total / perPage)),
+        },
+        filters: {
+          channel: channel as DeliveryChannel | null,
+          status: status as DeliveryStatus | null,
+          search,
+          sort,
+          direction,
+        },
+      })
+    }
+    catch (error) {
+      return dashboardOperationalError(error, 'Notification delivery history could not be loaded.', 'NotificationDeliveryHistoryAction')
+    }
   },
 })

package/app/Actions/Dashboard/Notifications/NotificationDeliveryIndexAction.ts

@@ -1,7 +1,9 @@
 import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { NotificationDelivery } from '@stacksjs/orm'
-import { request as routerRequest, response } from '@stacksjs/router'
+import { response } from '@stacksjs/router'
+import { dashboardOperationalError } from '../dashboard-response'
+import { dashboardRequestValue } from '../dashboard-request'
 import { parseDeliveryMetadata } from './notification-delivery'
 
 type DashboardDeliveryChannel = 'email' | 'sms'
@@ -29,15 +31,21 @@ export default new Action({
   method: 'GET',
   apiResponse: true,
   async handle(request: RequestInstance) {
-    const query = ((routerRequest as any).query || {}) as Record<string, string | string[] | undefined>
-    const queryChannel = Array.isArray(query.channel) ? query.channel[0] : query.channel
-    const channel = resolveDashboardDeliveryChannel(request.url, queryChannel, request.get('channel'))
+    const channel = resolveDashboardDeliveryChannel(
+      request.url,
+      dashboardRequestValue(request, 'channel'),
+    )
     if (!channel)
       return response.json({ message: 'Channel must be email or sms.' }, 422)
 
-    const records = await NotificationDelivery.where('channel', '=', channel).get()
-    const deliveries = records
-      .map(record => ({
+    try {
+      const records = await NotificationDelivery
+        .where('channel', '=', channel)
+        .orderByDesc('sent_at')
+        .orderByDesc('created_at')
+        .limit(500)
+        .get()
+      const deliveries = records.map(record => ({
         id: Number(record.get('id')),
         user_id: record.get('user_id') ? Number(record.get('user_id')) : null,
         channel,
@@ -53,9 +61,11 @@ export default new Action({
         sent_at: String(record.get('sent_at') || record.get('created_at') || ''),
         created_at: String(record.get('created_at') || ''),
       }))
-      .sort((a, b) => new Date(b.sent_at).getTime() - new Date(a.sent_at).getTime())
-      .slice(0, 500)
 
-    return response.json(deliveries)
+      return response.json(deliveries)
+    }
+    catch (error) {
+      return dashboardOperationalError(error, 'Notification deliveries could not be loaded.', 'NotificationDeliveryIndexAction')
+    }
   },
 })

package/app/Actions/Dashboard/Notifications/NotificationDeliveryOverviewAction.ts

@@ -1,6 +1,7 @@
 import { Action } from '@stacksjs/actions'
 import { db } from '@stacksjs/database'
 import { response } from '@stacksjs/router'
+import { dashboardOperationalError } from '../dashboard-response'
 import {
   type NotificationDeliveryRow,
   serializeNotificationDelivery,
@@ -22,99 +23,110 @@ const DELIVERY_STATUSES = ['sent', 'delivered', 'failed', 'pending'] as const
 
 function numericCount(value: number | string | undefined): number {
   const count = Number(value || 0)
-  return Number.isFinite(count) ? count : 0
+  if (!Number.isSafeInteger(count) || count < 0)
+    throw new TypeError('Notification delivery count must be a non-negative integer.')
+  return count
 }
 
-export default new Action({
-  name: 'Notification Delivery Overview',
-  description: 'Returns aggregate transport health and recent notification delivery attempts.',
-  method: 'GET',
-  apiResponse: true,
-  async handle() {
-    const [totalRow, statusRows, channelRows, recentRows] = await Promise.all([
-      db
-        .selectFrom('notification_deliveries')
-        .select(db.fn.count('id').as('count'))
-        .executeTakeFirst() as Promise<CountRow | undefined>,
-      db
-        .selectFrom('notification_deliveries')
-        .select(['status', db.fn.count('id').as('count')])
-        .groupBy('status')
-        .execute() as Promise<StatusCountRow[]>,
-      db
-        .selectFrom('notification_deliveries')
-        .select(['channel', 'status', db.fn.count('id').as('count')])
-        .groupBy(['channel', 'status'])
-        .execute() as Promise<ChannelStatusCountRow[]>,
-      db
-        .selectFrom('notification_deliveries')
-        .selectAll()
-        .orderBy('sent_at', 'desc')
-        .limit(8)
-        .execute() as Promise<NotificationDeliveryRow[]>,
-    ])
+async function notificationDeliveryOverview() {
+  const [totalRow, statusRows, channelRows, recentRows] = await Promise.all([
+    db
+      .selectFrom('notification_deliveries')
+      .select(db.fn.count('id').as('count'))
+      .executeTakeFirst() as Promise<CountRow | undefined>,
+    db
+      .selectFrom('notification_deliveries')
+      .select(['status', db.fn.count('id').as('count')])
+      .groupBy('status')
+      .execute() as Promise<StatusCountRow[]>,
+    db
+      .selectFrom('notification_deliveries')
+      .select(['channel', 'status', db.fn.count('id').as('count')])
+      .groupBy(['channel', 'status'])
+      .execute() as Promise<ChannelStatusCountRow[]>,
+    db
+      .selectFrom('notification_deliveries')
+      .selectAll()
+      .orderBy('sent_at', 'desc')
+      .limit(8)
+      .execute() as Promise<NotificationDeliveryRow[]>,
+  ])
 
-    const statuses = Object.fromEntries(
-      DELIVERY_STATUSES.map(status => [status, 0]),
-    ) as Record<typeof DELIVERY_STATUSES[number], number>
+  const statuses = Object.fromEntries(
+    DELIVERY_STATUSES.map(status => [status, 0]),
+  ) as Record<typeof DELIVERY_STATUSES[number], number>
 
-    for (const row of statusRows) {
-      if (DELIVERY_STATUSES.includes(row.status as typeof DELIVERY_STATUSES[number]))
-        statuses[row.status as typeof DELIVERY_STATUSES[number]] = numericCount(row.count)
-    }
+  for (const row of statusRows) {
+    if (DELIVERY_STATUSES.includes(row.status as typeof DELIVERY_STATUSES[number]))
+      statuses[row.status as typeof DELIVERY_STATUSES[number]] = numericCount(row.count)
+  }
 
-    const channelMap = new Map<string, {
-      channel: string
-      total: number
-      sent: number
-      delivered: number
-      failed: number
-      pending: number
-    }>()
+  const channelMap = new Map<string, {
+    channel: string
+    total: number
+    sent: number
+    delivered: number
+    failed: number
+    pending: number
+  }>()
 
-    for (const row of channelRows) {
-      const channel = String(row.channel || 'unknown')
-      const entry = channelMap.get(channel) || {
-        channel,
-        total: 0,
-        sent: 0,
-        delivered: 0,
-        failed: 0,
-        pending: 0,
-      }
-      const count = numericCount(row.count)
-      entry.total += count
-      if (DELIVERY_STATUSES.includes(row.status as typeof DELIVERY_STATUSES[number]))
-        entry[row.status as typeof DELIVERY_STATUSES[number]] += count
-      channelMap.set(channel, entry)
+  for (const row of channelRows) {
+    const channel = String(row.channel || 'unknown')
+    const entry = channelMap.get(channel) || {
+      channel,
+      total: 0,
+      sent: 0,
+      delivered: 0,
+      failed: 0,
+      pending: 0,
     }
+    const count = numericCount(row.count)
+    entry.total += count
+    if (DELIVERY_STATUSES.includes(row.status as typeof DELIVERY_STATUSES[number]))
+      entry[row.status as typeof DELIVERY_STATUSES[number]] += count
+    channelMap.set(channel, entry)
+  }
 
-    const channels = [...channelMap.values()]
-      .map(channel => ({
-        ...channel,
-        success_rate: channel.total > 0
-          ? Number((((channel.sent + channel.delivered) / channel.total) * 100).toFixed(1))
-          : 0,
-      }))
-      .sort((a, b) => b.total - a.total || a.channel.localeCompare(b.channel))
+  const channels = [...channelMap.values()]
+    .map(channel => ({
+      ...channel,
+      success_rate: channel.total > 0
+        ? Number((((channel.sent + channel.delivered) / channel.total) * 100).toFixed(1))
+        : 0,
+    }))
+    .sort((a, b) => b.total - a.total || a.channel.localeCompare(b.channel))
 
-    const total = numericCount(totalRow?.count)
-    const successful = statuses.sent + statuses.delivered
+  const total = numericCount(totalRow?.count)
+  const successful = statuses.sent + statuses.delivered
+
+  return {
+    stats: {
+      total,
+      successful,
+      failed: statuses.failed,
+      pending: statuses.pending,
+      success_rate: total > 0
+        ? Number(((successful / total) * 100).toFixed(1))
+        : 0,
+      active_channels: channels.length,
+    },
+    statuses,
+    channels,
+    recent: recentRows.map(serializeNotificationDelivery),
+  }
+}
 
-    return response.json({
-      stats: {
-        total,
-        successful,
-        failed: statuses.failed,
-        pending: statuses.pending,
-        success_rate: total > 0
-          ? Number(((successful / total) * 100).toFixed(1))
-          : 0,
-        active_channels: channels.length,
-      },
-      statuses,
-      channels,
-      recent: recentRows.map(serializeNotificationDelivery),
-    })
+export default new Action({
+  name: 'Notification Delivery Overview',
+  description: 'Returns aggregate transport health and recent notification delivery attempts.',
+  method: 'GET',
+  apiResponse: true,
+  async handle() {
+    try {
+      return response.json(await notificationDeliveryOverview())
+    }
+    catch (error) {
+      return dashboardOperationalError(error, 'Notification delivery overview could not be loaded.', 'NotificationDeliveryOverviewAction')
+    }
   },
 })

package/app/Actions/Dashboard/Notifications/NotificationDeliveryRetryAction.ts

@@ -4,6 +4,7 @@ import { Action } from '@stacksjs/actions'
 import { notify } from '@stacksjs/notifications'
 import { NotificationDelivery } from '@stacksjs/orm'
 import { response } from '@stacksjs/router'
+import { dashboardOperationalError } from '../dashboard-response'
 import { parseDeliveryMetadata } from './notification-delivery'
 
 type RetryChannel = 'email' | 'sms'
@@ -19,10 +20,16 @@ export default new Action({
   apiResponse: true,
   async handle(request: RequestInstance) {
     const id = Number(request.getParam('id'))
-    if (!Number.isFinite(id) || id <= 0)
-      return response.json({ message: 'A valid delivery ID is required.' }, 422)
+    if (!Number.isSafeInteger(id) || id <= 0)
+      return response.json({ message: 'A valid delivery ID is required.' }, 400)
 
-    const delivery = await NotificationDelivery.find(id)
+    let delivery: Awaited<ReturnType<typeof NotificationDelivery.find>>
+    try {
+      delivery = await NotificationDelivery.find(id)
+    }
+    catch (error) {
+      return dashboardOperationalError(error, 'Notification delivery could not be loaded.', 'NotificationDeliveryRetryAction.lookup')
+    }
     if (!delivery)
       return response.json({ message: 'Notification delivery not found.' }, 404)
 
@@ -34,27 +41,33 @@ export default new Action({
     if (!recipientValue)
       return response.json({ message: 'The original delivery has no recipient.' }, 422)
 
-    const channels: NotificationChannel[] = [channel]
-    const results = await notify(
-      {
-        userId: delivery.get('user_id') ? Number(delivery.get('user_id')) : undefined,
-        ...(channel === 'email' ? { email: recipientValue } : { phone: recipientValue }),
-      },
-      {
-        subject: String(delivery.get('subject') || ''),
-        body: String(delivery.get('body') || ''),
-        data: parseDeliveryMetadata(
-          delivery.get('metadata'),
-          `notification delivery ${id} metadata`,
-        ),
-      },
-      channels,
-      { ignorePreferences: true },
-    )
+    let results: Awaited<ReturnType<typeof notify>>
+    try {
+      const channels: NotificationChannel[] = [channel]
+      results = await notify(
+        {
+          userId: delivery.get('user_id') ? Number(delivery.get('user_id')) : undefined,
+          ...(channel === 'email' ? { email: recipientValue } : { phone: recipientValue }),
+        },
+        {
+          subject: String(delivery.get('subject') || ''),
+          body: String(delivery.get('body') || ''),
+          data: parseDeliveryMetadata(
+            delivery.get('metadata'),
+            `notification delivery ${id} metadata`,
+          ),
+        },
+        channels,
+        { ignorePreferences: true },
+      )
+    }
+    catch (error) {
+      return dashboardOperationalError(error, 'The notification retry could not be completed.', 'NotificationDeliveryRetryAction.provider', 502)
+    }
 
     const result = results[0]
     if (!result?.success)
-      return response.json({ message: result?.error?.message || 'The retry failed.' }, 502)
+      return dashboardOperationalError(result?.error, 'The notification retry failed.', 'NotificationDeliveryRetryAction.result', 502)
 
     return response.json({ success: true })
   },

package/app/Actions/Dashboard/Queries/QueryDashboardAction.ts

@@ -1,7 +1,7 @@
 import { Action } from '@stacksjs/actions'
 import { config } from '@stacksjs/config'
 import { db } from '@stacksjs/database'
-import { response } from '@stacksjs/router'
+import { dashboardOperationalError } from '../dashboard-response'
 import { dashboardQueryColumns, mapDashboardQueryLog, type QueryLogSourceRow } from './query-dashboard'
 
 export default new Action({
@@ -27,9 +27,7 @@ export default new Action({
       }
     }
     catch (error) {
-      return response.json({
-        message: error instanceof Error ? error.message : 'Query logs could not be loaded.',
-      }, 503)
+      return dashboardOperationalError(error, 'Query logs could not be loaded.', 'QueryDashboardAction')
     }
   },
 })

package/app/Actions/Dashboard/Queries/QueryShowAction.ts

@@ -1,6 +1,8 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { db } from '@stacksjs/database'
 import { response } from '@stacksjs/router'
+import { dashboardOperationalError } from '../dashboard-response'
 import { dashboardQueryColumns, mapDashboardQueryLog, type QueryLogSourceRow } from './query-dashboard'
 
 export default new Action({
@@ -27,9 +29,7 @@ export default new Action({
       return { query: mapDashboardQueryLog(row as QueryLogSourceRow) }
     }
     catch (error) {
-      return response.json({
-        message: error instanceof Error ? error.message : 'Query log could not be loaded.',
-      }, 503)
+      return dashboardOperationalError(error, 'Query log could not be loaded.', 'QueryShowAction')
     }
   },
 })

package/app/Actions/Dashboard/Queue/QueueStatsAction.ts

@@ -1,7 +1,7 @@
 import { Action } from '@stacksjs/actions'
 import { FailedJob, Job } from '@stacksjs/orm'
 import { getGlobalMetrics } from '@stacksjs/queue'
-import { response } from '@stacksjs/router'
+import { dashboardOperationalError } from '../dashboard-response'
 
 interface QueueBucket {
   pending: number
@@ -81,9 +81,7 @@ export default new Action({
       return { queues, stats, queueConnected: true }
     }
     catch (error) {
-      return response.json({
-        message: error instanceof Error ? error.message : 'Queue statistics could not be loaded.',
-      }, 503)
+      return dashboardOperationalError(error, 'Queue statistics could not be loaded.', 'QueueStatsAction')
     }
   },
 })

package/app/Actions/Dashboard/Queue/QueueWorkersAction.ts

@@ -1,6 +1,6 @@
 import { Action } from '@stacksjs/actions'
 import { getActiveJobCount, getWorkerTracker, isWorkerRunning } from '@stacksjs/queue'
-import { response } from '@stacksjs/router'
+import { dashboardOperationalError } from '../dashboard-response'
 
 export default new Action({
   name: 'QueueWorkersAction',
@@ -41,9 +41,7 @@ export default new Action({
       }
     }
     catch (error) {
-      return response.json({
-        message: error instanceof Error ? error.message : 'Queue workers could not be loaded.',
-      }, 503)
+      return dashboardOperationalError(error, 'Queue workers could not be loaded.', 'QueueWorkersAction')
     }
   },
 })

package/app/Actions/Dashboard/Rbac/PermissionDestroyAction.ts

@@ -1,6 +1,8 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { deletePermission } from '@stacksjs/auth'
 import { response } from '@stacksjs/router'
+import { rbacActionError } from './rbac-response'
 
 /**
  * `DELETE /api/dashboard/rbac/permissions/:name` (stacksjs/stacks#1845).
@@ -14,13 +16,12 @@ export default new Action({
   description: 'Hard-delete a permission + its pivot rows.',
   method: 'DELETE',
   apiResponse: true,
-  async handle(request) {
-    const name = String((request as any)?.params?.name ?? '').trim()
+  async handle(request: RequestInstance) {
+    const name = request.getParam('name').trim()
     if (!name) {
       return response.json({ error: '`name` route param is required.' }, 400)
     }
-    const url = new URL(request.url ?? 'http://localhost/')
-    const guardName = (url.searchParams.get('guard') || 'web').trim()
+    const guardName = String(request.get('guard', 'web')).trim()
     if (!guardName || guardName.length > 60) {
       return response.json({ error: 'Invalid guard name.' }, 400)
     }
@@ -30,8 +31,7 @@ export default new Action({
       return { deleted: true, name, guardName }
     }
     catch (err) {
-      console.error('[dashboard/rbac] PermissionDestroyAction failed:', err)
-      return response.json({ error: err instanceof Error ? err.message : 'unknown error' }, 500)
+      return rbacActionError(err, 'The permission could not be deleted.', 'PermissionDestroyAction')
     }
   },
 })