@stacksjs/defaults 0.70.354 → 0.70.356

package/app/Actions/Dashboard/Rbac/PermissionStoreAction.ts

@@ -1,6 +1,8 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { createPermission, findPermission } from '@stacksjs/auth'
 import { response } from '@stacksjs/router'
+import { rbacActionError } from './rbac-response'
 
 interface PermissionInput {
   name?: unknown
@@ -20,8 +22,8 @@ export default new Action({
   description: 'Create a new permission.',
   method: 'POST',
   apiResponse: true,
-  async handle(request) {
-    const body = (request as any).jsonBody as PermissionInput | undefined ?? {}
+  async handle(request: RequestInstance<PermissionInput>) {
+    const body = request.all()
 
     const name = typeof body.name === 'string' ? body.name.trim() : ''
     if (!name || name.length > 100) {
@@ -53,8 +55,7 @@ export default new Action({
       }
     }
     catch (err) {
-      console.error('[dashboard/rbac] PermissionStoreAction failed:', err)
-      return response.json({ error: err instanceof Error ? err.message : 'unknown error' }, 500)
+      return rbacActionError(err, 'The permission could not be created.', 'PermissionStoreAction')
     }
   },
 })

package/app/Actions/Dashboard/Rbac/PermissionsIndexAction.ts

@@ -1,6 +1,6 @@
 import { Action } from '@stacksjs/actions'
 import { getAllPermissions } from '@stacksjs/auth'
-import { response } from '@stacksjs/router'
+import { rbacActionError } from './rbac-response'
 
 /**
  * `GET /api/dashboard/rbac/permissions` (stacksjs/stacks#1845).
@@ -28,8 +28,7 @@ export default new Action({
       }
     }
     catch (err) {
-      console.error('[dashboard/rbac] PermissionsIndexAction failed:', err)
-      return response.json({ permissions: [], error: err instanceof Error ? err.message : 'unknown error' }, 500)
+      return rbacActionError(err, 'Permissions could not be loaded.', 'PermissionsIndexAction')
     }
   },
 })

package/app/Actions/Dashboard/Rbac/RoleDestroyAction.ts

@@ -1,6 +1,8 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { deleteRole } from '@stacksjs/auth'
 import { response } from '@stacksjs/router'
+import { rbacActionError } from './rbac-response'
 
 /**
  * `DELETE /api/dashboard/rbac/roles/:name` (stacksjs/stacks#1845).
@@ -16,13 +18,12 @@ export default new Action({
   description: 'Hard-delete a role + its pivot rows.',
   method: 'DELETE',
   apiResponse: true,
-  async handle(request) {
-    const name = String((request as any)?.params?.name ?? '').trim()
+  async handle(request: RequestInstance) {
+    const name = request.getParam('name').trim()
     if (!name) {
       return response.json({ error: '`name` route param is required.' }, 400)
     }
-    const url = new URL(request.url ?? 'http://localhost/')
-    const guardName = (url.searchParams.get('guard') || 'web').trim()
+    const guardName = String(request.get('guard', 'web')).trim()
     if (!guardName || guardName.length > 60) {
       return response.json({ error: 'Invalid guard name.' }, 400)
     }
@@ -32,8 +33,7 @@ export default new Action({
       return { deleted: true, name, guardName }
     }
     catch (err) {
-      console.error('[dashboard/rbac] RoleDestroyAction failed:', err)
-      return response.json({ error: err instanceof Error ? err.message : 'unknown error' }, 500)
+      return rbacActionError(err, 'The role could not be deleted.', 'RoleDestroyAction')
     }
   },
 })

package/app/Actions/Dashboard/Rbac/RolePermissionsShowAction.ts

@@ -1,6 +1,8 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { findRole, getRolePermissions } from '@stacksjs/auth'
 import { response } from '@stacksjs/router'
+import { rbacActionError } from './rbac-response'
 
 /**
  * `GET /api/dashboard/rbac/roles/:name/permissions` (stacksjs/stacks#1845).
@@ -15,13 +17,12 @@ export default new Action({
   description: 'List permissions attached to one role.',
   method: 'GET',
   apiResponse: true,
-  async handle(request) {
-    const name = String((request as any)?.params?.name ?? '').trim()
+  async handle(request: RequestInstance) {
+    const name = request.getParam('name').trim()
     if (!name) {
       return response.json({ error: '`name` route param is required.' }, 400)
     }
-    const url = new URL(request.url ?? 'http://localhost/')
-    const guardName = (url.searchParams.get('guard') || 'web').trim()
+    const guardName = String(request.get('guard', 'web')).trim()
     if (!guardName || guardName.length > 60) {
       return response.json({ error: 'Invalid guard name.' }, 400)
     }
@@ -42,8 +43,7 @@ export default new Action({
       }
     }
     catch (err) {
-      console.error('[dashboard/rbac] RolePermissionsShowAction failed:', err)
-      return response.json({ permissions: [], error: err instanceof Error ? err.message : 'unknown error' }, 500)
+      return rbacActionError(err, 'Role permissions could not be loaded.', 'RolePermissionsShowAction')
     }
   },
 })

package/app/Actions/Dashboard/Rbac/RolePermissionsSyncAction.ts

@@ -1,6 +1,8 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { getRolePermissions, findRole, syncRolePermissions } from '@stacksjs/auth'
 import { response } from '@stacksjs/router'
+import { rbacActionError } from './rbac-response'
 
 interface SyncInput {
   permissions?: unknown
@@ -19,13 +21,13 @@ export default new Action({
   description: 'Replace the permission set attached to one role.',
   method: 'POST',
   apiResponse: true,
-  async handle(request) {
-    const roleName = String((request as any)?.params?.name ?? '').trim()
+  async handle(request: RequestInstance<SyncInput>) {
+    const roleName = request.getParam('name').trim()
     if (!roleName) {
       return response.json({ error: '`name` route param is required.' }, 400)
     }
 
-    const body = (request as any).jsonBody as SyncInput | undefined ?? {}
+    const body = request.all()
     if (!Array.isArray(body.permissions)) {
       return response.json({ error: '`permissions` must be an array of permission names (possibly empty).' }, 400)
     }
@@ -56,12 +58,7 @@ export default new Action({
       }
     }
     catch (err) {
-      const msg = err instanceof Error ? err.message : 'unknown error'
-      if (msg.includes('not found')) {
-        return response.json({ error: msg }, 400)
-      }
-      console.error('[dashboard/rbac] RolePermissionsSyncAction failed:', err)
-      return response.json({ error: msg }, 500)
+      return rbacActionError(err, 'Role permissions could not be updated.', 'RolePermissionsSyncAction')
     }
   },
 })

package/app/Actions/Dashboard/Rbac/RoleStoreAction.ts

@@ -1,6 +1,8 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { createRole, findRole } from '@stacksjs/auth'
 import { response } from '@stacksjs/router'
+import { rbacActionError } from './rbac-response'
 
 interface RoleInput {
   name?: unknown
@@ -25,8 +27,8 @@ export default new Action({
   description: 'Create a new role.',
   method: 'POST',
   apiResponse: true,
-  async handle(request) {
-    const body = (request as any).jsonBody as RoleInput | undefined ?? {}
+  async handle(request: RequestInstance<RoleInput>) {
+    const body = request.all()
 
     const name = typeof body.name === 'string' ? body.name.trim() : ''
     if (!name || name.length > 60) {
@@ -58,8 +60,7 @@ export default new Action({
       }
     }
     catch (err) {
-      console.error('[dashboard/rbac] RoleStoreAction failed:', err)
-      return response.json({ error: err instanceof Error ? err.message : 'unknown error' }, 500)
+      return rbacActionError(err, 'The role could not be created.', 'RoleStoreAction')
     }
   },
 })

package/app/Actions/Dashboard/Rbac/RolesIndexAction.ts

@@ -1,15 +1,14 @@
 import { Action } from '@stacksjs/actions'
 import { getAllRoles } from '@stacksjs/auth'
-import { response } from '@stacksjs/router'
+import { rbacActionError } from './rbac-response'
 
 /**
  * `GET /api/dashboard/rbac/roles` (stacksjs/stacks#1845).
  *
  * Returns every role in the system. The dashboard's permissions page
  * renders this as a list users can pick from when assigning roles.
- * Soft-errors to an empty list rather than 500 so a broken RBAC store
- * (e.g., migrations not run) renders an empty-state instead of
- * yelling at the user.
+ * Operational store failures use a real 500 response so the client can
+ * distinguish an unavailable RBAC store from a valid empty role list.
  */
 export default new Action({
   name: 'Dashboard RBAC Roles Index',
@@ -30,8 +29,7 @@ export default new Action({
       }
     }
     catch (err) {
-      console.error('[dashboard/rbac] RolesIndexAction failed:', err)
-      return response.json({ roles: [], error: err instanceof Error ? err.message : 'unknown error' }, 500)
+      return rbacActionError(err, 'Roles could not be loaded.', 'RolesIndexAction')
     }
   },
 })

package/app/Actions/Dashboard/Rbac/UserRolesShowAction.ts

@@ -1,7 +1,9 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { getUserRoles } from '@stacksjs/auth'
 import { User } from '@stacksjs/orm'
 import { response } from '@stacksjs/router'
+import { rbacActionError } from './rbac-response'
 
 /**
  * `GET /api/dashboard/rbac/users/:id/roles` (stacksjs/stacks#1845).
@@ -16,14 +18,12 @@ export default new Action({
   description: 'List roles attached to one user.',
   method: 'GET',
   apiResponse: true,
-  async handle(request) {
-    const rawId = (request as any)?.params?.id
-    const userId = Number(rawId)
+  async handle(request: RequestInstance) {
+    const userId = Number(request.getParam('id'))
     if (!Number.isFinite(userId) || userId <= 0) {
       return response.json({ error: 'Invalid user id.' }, 400)
     }
-    const url = new URL(request.url ?? 'http://localhost/')
-    const guardName = (url.searchParams.get('guard') || 'web').trim()
+    const guardName = String(request.get('guard', 'web')).trim()
     if (!guardName || guardName.length > 60) {
       return response.json({ error: 'Invalid guard name.' }, 400)
     }
@@ -44,8 +44,7 @@ export default new Action({
       }
     }
     catch (err) {
-      console.error('[dashboard/rbac] UserRolesShowAction failed:', err)
-      return response.json({ userId, roles: [], error: err instanceof Error ? err.message : 'unknown error' }, 500)
+      return rbacActionError(err, 'User roles could not be loaded.', 'UserRolesShowAction')
     }
   },
 })

package/app/Actions/Dashboard/Rbac/UserRolesSyncAction.ts

@@ -1,7 +1,9 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { getUserRoles, syncRoles } from '@stacksjs/auth'
 import { User } from '@stacksjs/orm'
 import { response } from '@stacksjs/router'
+import { rbacActionError } from './rbac-response'
 
 interface SyncInput {
   roles?: unknown
@@ -24,14 +26,13 @@ export default new Action({
   description: 'Replace the role set attached to one user.',
   method: 'POST',
   apiResponse: true,
-  async handle(request) {
-    const rawId = (request as any)?.params?.id
-    const userId = Number(rawId)
+  async handle(request: RequestInstance<SyncInput>) {
+    const userId = Number(request.getParam('id'))
     if (!Number.isFinite(userId) || userId <= 0) {
       return response.json({ error: 'Invalid user id.' }, 400)
     }
 
-    const body = (request as any).jsonBody as SyncInput | undefined ?? {}
+    const body = request.all()
     if (!Array.isArray(body.roles)) {
       return response.json({ error: '`roles` must be an array of role names (possibly empty).' }, 400)
     }
@@ -60,15 +61,7 @@ export default new Action({
       }
     }
     catch (err) {
-      const msg = err instanceof Error ? err.message : 'unknown error'
-      // The facade throws "Role 'X' not found" — surface as 400 so
-      // the UI can show "this role doesn't exist anymore" rather
-      // than a 500.
-      if (msg.includes('not found')) {
-        return response.json({ error: msg }, 400)
-      }
-      console.error('[dashboard/rbac] UserRolesSyncAction failed:', err)
-      return response.json({ error: msg }, 500)
+      return rbacActionError(err, 'User roles could not be updated.', 'UserRolesSyncAction')
     }
   },
 })

package/app/Actions/Dashboard/Rbac/UsersListAction.ts

@@ -1,7 +1,7 @@
 import { Action } from '@stacksjs/actions'
 import { User } from '@stacksjs/orm'
-import { response } from '@stacksjs/router'
 import { safeGet } from '../../../../resources/functions/dashboard/data'
+import { rbacActionError } from './rbac-response'
 
 /**
  * `GET /api/dashboard/rbac/users` (stacksjs/stacks#1845).
@@ -40,8 +40,7 @@ export default new Action({
       }
     }
     catch (err) {
-      console.error('[dashboard/rbac] UsersListAction failed:', err)
-      return response.json({ users: [], error: err instanceof Error ? err.message : 'unknown error' }, 500)
+      return rbacActionError(err, 'Users could not be loaded.', 'UsersListAction')
     }
   },
 })

package/app/Actions/Dashboard/Rbac/rbac-response.ts

@@ -0,0 +1,10 @@
+import { RbacEntityNotFoundError } from '@stacksjs/auth'
+import { response } from '@stacksjs/router'
+
+export function rbacActionError(error: unknown, fallback: string, action: string): Response {
+  if (error instanceof RbacEntityNotFoundError)
+    return response.json({ error: error.message }, 400)
+
+  console.error(`[dashboard/rbac] ${action} failed:`, error)
+  return response.json({ error: fallback }, 500)
+}

package/app/Actions/Dashboard/Realtime/RealtimeStatsAction.ts

@@ -1,7 +1,7 @@
 import { Action } from '@stacksjs/actions'
 import { config } from '@stacksjs/config'
 import { Websocket } from '@stacksjs/orm'
-import { response } from '@stacksjs/router'
+import { dashboardOperationalError } from '../dashboard-response'
 import { buildRealtimeStats } from './realtime-stats'
 
 export default new Action({
@@ -36,9 +36,7 @@ export default new Action({
       }
     }
     catch (error) {
-      return response.json({
-        message: error instanceof Error ? error.message : 'Realtime events could not be loaded.',
-      }, 503)
+      return dashboardOperationalError(error, 'Realtime events could not be loaded.', 'RealtimeStatsAction')
     }
   },
 })

package/app/Actions/Dashboard/Search/GlobalSearchAction.ts

@@ -1,8 +1,10 @@
+import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { env } from '@stacksjs/env'
 import { readdirSync } from 'node:fs'
 import { basename, extname, join } from 'node:path'
 import process from 'node:process'
+import { dashboardOperationalError } from '../dashboard-response'
 
 interface SearchableModel {
   name: string
@@ -152,8 +154,15 @@ async function loadSearchableModels(): Promise<SearchableModel[]> {
 }
 
 function catalog(): Promise<SearchableModel[]> {
-  modelCatalog.promise ||= loadSearchableModels()
-  return modelCatalog.promise
+  if (modelCatalog.promise)
+    return modelCatalog.promise
+
+  const loading = loadSearchableModels().catch((error) => {
+    modelCatalog.promise = null
+    throw error
+  })
+  modelCatalog.promise = loading
+  return loading
 }
 
 function rowValue(row: Record<string, unknown>, field: string): string {
@@ -184,67 +193,72 @@ export default new Action({
   method: 'GET',
   apiResponse: true,
   async handle(request: RequestInstance) {
-    const q = String(request?.get('q') || '').trim().slice(0, MAX_QUERY_LENGTH)
+    const q = String(request.get('q') || '').trim().slice(0, MAX_QUERY_LENGTH)
     if (!q) return { results: {} }
 
-    const { Database } = await import('bun:sqlite')
-    const db = new Database(env.DB_DATABASE_PATH || 'database/stacks.sqlite', { readonly: true })
-    const results: Record<string, SearchResult[]> = {}
-    const unavailable: SearchUnavailable[] = []
-
     try {
-      for (const model of await catalog()) {
-        if (Object.keys(results).length >= MAX_GROUPS) break
-
-        const columns = db.query(`PRAGMA table_info(${model.table})`).all() as Array<{ name: string }>
-        if (columns.length === 0) {
-          unavailable.push({
-            model: model.name,
-            reason: `Table ${model.table} has not been migrated.`,
-          })
-          continue
-        }
+      const { Database } = await import('bun:sqlite')
+      const db = new Database(env.DB_DATABASE_PATH || 'database/stacks.sqlite', { readonly: true })
+      const results: Record<string, SearchResult[]> = {}
+      const unavailable: SearchUnavailable[] = []
+
+      try {
+        for (const model of await catalog()) {
+          if (Object.keys(results).length >= MAX_GROUPS) break
+
+          const columns = db.query(`PRAGMA table_info(${model.table})`).all() as Array<{ name: string }>
+          if (columns.length === 0) {
+            unavailable.push({
+              model: model.name,
+              reason: `Table ${model.table} has not been migrated.`,
+            })
+            continue
+          }
 
-        const available = new Set(columns.map(column => column.name))
-        const fields = model.fields.filter(field => available.has(field))
-        if (fields.length === 0) {
-          unavailable.push({
-            model: model.name,
-            reason: 'Declared useSearch fields are not present in the migrated table.',
-          })
-          continue
-        }
+          const available = new Set(columns.map(column => column.name))
+          const fields = model.fields.filter(field => available.has(field))
+          if (fields.length === 0) {
+            unavailable.push({
+              model: model.name,
+              reason: 'Declared useSearch fields are not present in the migrated table.',
+            })
+            continue
+          }
 
-        const selected = [...new Set(['id', ...fields])].filter(field => available.has(field))
-        const where = fields.map(field => `${field} LIKE ? COLLATE NOCASE`).join(' OR ')
-        const bindings = fields.map(() => `%${q}%`)
-        let rows: Array<Record<string, unknown>>
-        try {
-          rows = db
-            .query(`SELECT ${selected.join(', ')} FROM ${model.table} WHERE ${where} LIMIT ?`)
-            .all(...bindings, RESULTS_PER_MODEL) as Array<Record<string, unknown>>
-        }
-        catch (error) {
-          throw new Error(`Could not search model ${model.name}: ${error instanceof Error ? error.message : String(error)}`)
-        }
-        if (rows.length === 0) continue
-
-        results[model.name] = rows.map((row, index) => {
-          const title = resultTitle(model, row)
-          return {
-            id: (row.id as string | number | undefined) ?? index,
-            title,
-            subtitle: resultSubtitle(model, row, title),
-            href: `/models/${model.slug}?q=${encodeURIComponent(q)}`,
-            icon: model.icon,
+          const selected = [...new Set(['id', ...fields])].filter(field => available.has(field))
+          const where = fields.map(field => `${field} LIKE ? COLLATE NOCASE`).join(' OR ')
+          const bindings = fields.map(() => `%${q}%`)
+          let rows: Array<Record<string, unknown>>
+          try {
+            rows = db
+              .query(`SELECT ${selected.join(', ')} FROM ${model.table} WHERE ${where} LIMIT ?`)
+              .all(...bindings, RESULTS_PER_MODEL) as Array<Record<string, unknown>>
+          }
+          catch (error) {
+            throw new Error(`Could not search model ${model.name}: ${error instanceof Error ? error.message : String(error)}`)
           }
-        })
+          if (rows.length === 0) continue
+
+          results[model.name] = rows.map((row, index) => {
+            const title = resultTitle(model, row)
+            return {
+              id: (row.id as string | number | undefined) ?? index,
+              title,
+              subtitle: resultSubtitle(model, row, title),
+              href: `/models/${model.slug}?q=${encodeURIComponent(q)}`,
+              icon: model.icon,
+            }
+          })
+        }
       }
+      finally {
+        db.close()
+      }
+
+      return { results, unavailable }
     }
-    finally {
-      db.close()
+    catch (error) {
+      return dashboardOperationalError(error, 'Search results could not be loaded.', 'GlobalSearchAction')
     }
-
-    return { results, unavailable }
   },
 })

package/app/Actions/Dashboard/Teams/TeamInvitationDestroyAction.ts

@@ -2,7 +2,9 @@ import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { db } from '@stacksjs/database'
 import { response } from '@stacksjs/router'
+import { teamOperationalError } from '../../Teams/team-response'
 import {
+  changedRows,
   generateInvitationToken,
   hashInvitationToken,
   parsePositiveId,
@@ -21,27 +23,43 @@ export default new Action({
     if (!teamId || !invitationId)
       return response.json({ message: 'Invalid team or invitation id.' }, 400)
 
-    const invitation = await (db as any)
-      .selectFrom('team_invitations')
-      .where('id', '=', invitationId)
-      .where('team_id', '=', teamId)
-      .select(['id', 'status'])
-      .executeTakeFirst()
+    let invitation
+    try {
+      invitation = await (db as any)
+        .selectFrom('team_invitations')
+        .where('id', '=', invitationId)
+        .where('team_id', '=', teamId)
+        .select(['id', 'status', 'token_hash'])
+        .executeTakeFirst()
+    }
+    catch (error) {
+      return teamOperationalError(error, 'Invitation could not be loaded.', 'TeamInvitationDestroyAction.lookup', 500)
+    }
     if (!invitation)
       return response.json({ message: 'Invitation not found.' }, 404)
     if (invitation.status !== 'pending')
       return response.json({ message: 'Only pending invitations can be revoked.' }, 409)
 
-    await (db as any)
-      .updateTable('team_invitations')
-      .set({
-        status: 'revoked',
-        token_hash: hashInvitationToken(generateInvitationToken()),
-        updated_at: sqlTimestamp(),
-      })
-      .where('id', '=', invitationId)
-      .where('team_id', '=', teamId)
-      .execute()
+    try {
+      const result = await (db as any)
+        .updateTable('team_invitations')
+        .set({
+          status: 'revoked',
+          token_hash: hashInvitationToken(generateInvitationToken()),
+          pending_key: null,
+          updated_at: sqlTimestamp(),
+        })
+        .where('id', '=', invitationId)
+        .where('team_id', '=', teamId)
+        .where('token_hash', '=', String(invitation.token_hash))
+        .where('status', '=', 'pending')
+        .executeTakeFirst()
+      if (changedRows(result) !== 1)
+        return response.json({ message: 'The invitation changed before it could be revoked.' }, 409)
+    }
+    catch (error) {
+      return teamOperationalError(error, 'Invitation could not be revoked.', 'TeamInvitationDestroyAction.update', 500)
+    }
 
     return response.noContent()
   },