@stacksjs/defaults 0.70.355 → 0.70.356

package/app/Actions/Dashboard/Rbac/RolesIndexAction.ts

@@ -1,15 +1,14 @@
 import { Action } from '@stacksjs/actions'
 import { getAllRoles } from '@stacksjs/auth'
-import { response } from '@stacksjs/router'
+import { rbacActionError } from './rbac-response'
 
 /**
  * `GET /api/dashboard/rbac/roles` (stacksjs/stacks#1845).
  *
  * Returns every role in the system. The dashboard's permissions page
  * renders this as a list users can pick from when assigning roles.
- * Soft-errors to an empty list rather than 500 so a broken RBAC store
- * (e.g., migrations not run) renders an empty-state instead of
- * yelling at the user.
+ * Operational store failures use a real 500 response so the client can
+ * distinguish an unavailable RBAC store from a valid empty role list.
  */
 export default new Action({
   name: 'Dashboard RBAC Roles Index',
@@ -30,8 +29,7 @@ export default new Action({
       }
     }
     catch (err) {
-      console.error('[dashboard/rbac] RolesIndexAction failed:', err)
-      return response.json({ roles: [], error: err instanceof Error ? err.message : 'unknown error' }, 500)
+      return rbacActionError(err, 'Roles could not be loaded.', 'RolesIndexAction')
     }
   },
 })

package/app/Actions/Dashboard/Rbac/UserRolesShowAction.ts

@@ -3,6 +3,7 @@ import { Action } from '@stacksjs/actions'
 import { getUserRoles } from '@stacksjs/auth'
 import { User } from '@stacksjs/orm'
 import { response } from '@stacksjs/router'
+import { rbacActionError } from './rbac-response'
 
 /**
  * `GET /api/dashboard/rbac/users/:id/roles` (stacksjs/stacks#1845).
@@ -43,8 +44,7 @@ export default new Action({
       }
     }
     catch (err) {
-      console.error('[dashboard/rbac] UserRolesShowAction failed:', err)
-      return response.json({ userId, roles: [], error: err instanceof Error ? err.message : 'unknown error' }, 500)
+      return rbacActionError(err, 'User roles could not be loaded.', 'UserRolesShowAction')
     }
   },
 })

package/app/Actions/Dashboard/Rbac/UserRolesSyncAction.ts

@@ -3,6 +3,7 @@ import { Action } from '@stacksjs/actions'
 import { getUserRoles, syncRoles } from '@stacksjs/auth'
 import { User } from '@stacksjs/orm'
 import { response } from '@stacksjs/router'
+import { rbacActionError } from './rbac-response'
 
 interface SyncInput {
   roles?: unknown
@@ -60,15 +61,7 @@ export default new Action({
       }
     }
     catch (err) {
-      const msg = err instanceof Error ? err.message : 'unknown error'
-      // The facade throws "Role 'X' not found" — surface as 400 so
-      // the UI can show "this role doesn't exist anymore" rather
-      // than a 500.
-      if (msg.includes('not found')) {
-        return response.json({ error: msg }, 400)
-      }
-      console.error('[dashboard/rbac] UserRolesSyncAction failed:', err)
-      return response.json({ error: msg }, 500)
+      return rbacActionError(err, 'User roles could not be updated.', 'UserRolesSyncAction')
     }
   },
 })

package/app/Actions/Dashboard/Rbac/UsersListAction.ts

@@ -1,7 +1,7 @@
 import { Action } from '@stacksjs/actions'
 import { User } from '@stacksjs/orm'
-import { response } from '@stacksjs/router'
 import { safeGet } from '../../../../resources/functions/dashboard/data'
+import { rbacActionError } from './rbac-response'
 
 /**
  * `GET /api/dashboard/rbac/users` (stacksjs/stacks#1845).
@@ -40,8 +40,7 @@ export default new Action({
       }
     }
     catch (err) {
-      console.error('[dashboard/rbac] UsersListAction failed:', err)
-      return response.json({ users: [], error: err instanceof Error ? err.message : 'unknown error' }, 500)
+      return rbacActionError(err, 'Users could not be loaded.', 'UsersListAction')
     }
   },
 })

package/app/Actions/Dashboard/Rbac/rbac-response.ts

@@ -0,0 +1,10 @@
+import { RbacEntityNotFoundError } from '@stacksjs/auth'
+import { response } from '@stacksjs/router'
+
+export function rbacActionError(error: unknown, fallback: string, action: string): Response {
+  if (error instanceof RbacEntityNotFoundError)
+    return response.json({ error: error.message }, 400)
+
+  console.error(`[dashboard/rbac] ${action} failed:`, error)
+  return response.json({ error: fallback }, 500)
+}

package/app/Actions/Dashboard/Realtime/RealtimeStatsAction.ts

@@ -1,7 +1,7 @@
 import { Action } from '@stacksjs/actions'
 import { config } from '@stacksjs/config'
 import { Websocket } from '@stacksjs/orm'
-import { response } from '@stacksjs/router'
+import { dashboardOperationalError } from '../dashboard-response'
 import { buildRealtimeStats } from './realtime-stats'
 
 export default new Action({
@@ -36,9 +36,7 @@ export default new Action({
       }
     }
     catch (error) {
-      return response.json({
-        message: error instanceof Error ? error.message : 'Realtime events could not be loaded.',
-      }, 503)
+      return dashboardOperationalError(error, 'Realtime events could not be loaded.', 'RealtimeStatsAction')
     }
   },
 })

package/app/Actions/Dashboard/Search/GlobalSearchAction.ts

@@ -4,6 +4,7 @@ import { env } from '@stacksjs/env'
 import { readdirSync } from 'node:fs'
 import { basename, extname, join } from 'node:path'
 import process from 'node:process'
+import { dashboardOperationalError } from '../dashboard-response'
 
 interface SearchableModel {
   name: string
@@ -153,8 +154,15 @@ async function loadSearchableModels(): Promise<SearchableModel[]> {
 }
 
 function catalog(): Promise<SearchableModel[]> {
-  modelCatalog.promise ||= loadSearchableModels()
-  return modelCatalog.promise
+  if (modelCatalog.promise)
+    return modelCatalog.promise
+
+  const loading = loadSearchableModels().catch((error) => {
+    modelCatalog.promise = null
+    throw error
+  })
+  modelCatalog.promise = loading
+  return loading
 }
 
 function rowValue(row: Record<string, unknown>, field: string): string {
@@ -185,67 +193,72 @@ export default new Action({
   method: 'GET',
   apiResponse: true,
   async handle(request: RequestInstance) {
-    const q = String(request?.get('q') || '').trim().slice(0, MAX_QUERY_LENGTH)
+    const q = String(request.get('q') || '').trim().slice(0, MAX_QUERY_LENGTH)
     if (!q) return { results: {} }
 
-    const { Database } = await import('bun:sqlite')
-    const db = new Database(env.DB_DATABASE_PATH || 'database/stacks.sqlite', { readonly: true })
-    const results: Record<string, SearchResult[]> = {}
-    const unavailable: SearchUnavailable[] = []
-
     try {
-      for (const model of await catalog()) {
-        if (Object.keys(results).length >= MAX_GROUPS) break
-
-        const columns = db.query(`PRAGMA table_info(${model.table})`).all() as Array<{ name: string }>
-        if (columns.length === 0) {
-          unavailable.push({
-            model: model.name,
-            reason: `Table ${model.table} has not been migrated.`,
-          })
-          continue
-        }
+      const { Database } = await import('bun:sqlite')
+      const db = new Database(env.DB_DATABASE_PATH || 'database/stacks.sqlite', { readonly: true })
+      const results: Record<string, SearchResult[]> = {}
+      const unavailable: SearchUnavailable[] = []
+
+      try {
+        for (const model of await catalog()) {
+          if (Object.keys(results).length >= MAX_GROUPS) break
+
+          const columns = db.query(`PRAGMA table_info(${model.table})`).all() as Array<{ name: string }>
+          if (columns.length === 0) {
+            unavailable.push({
+              model: model.name,
+              reason: `Table ${model.table} has not been migrated.`,
+            })
+            continue
+          }
 
-        const available = new Set(columns.map(column => column.name))
-        const fields = model.fields.filter(field => available.has(field))
-        if (fields.length === 0) {
-          unavailable.push({
-            model: model.name,
-            reason: 'Declared useSearch fields are not present in the migrated table.',
-          })
-          continue
-        }
+          const available = new Set(columns.map(column => column.name))
+          const fields = model.fields.filter(field => available.has(field))
+          if (fields.length === 0) {
+            unavailable.push({
+              model: model.name,
+              reason: 'Declared useSearch fields are not present in the migrated table.',
+            })
+            continue
+          }
 
-        const selected = [...new Set(['id', ...fields])].filter(field => available.has(field))
-        const where = fields.map(field => `${field} LIKE ? COLLATE NOCASE`).join(' OR ')
-        const bindings = fields.map(() => `%${q}%`)
-        let rows: Array<Record<string, unknown>>
-        try {
-          rows = db
-            .query(`SELECT ${selected.join(', ')} FROM ${model.table} WHERE ${where} LIMIT ?`)
-            .all(...bindings, RESULTS_PER_MODEL) as Array<Record<string, unknown>>
-        }
-        catch (error) {
-          throw new Error(`Could not search model ${model.name}: ${error instanceof Error ? error.message : String(error)}`)
-        }
-        if (rows.length === 0) continue
-
-        results[model.name] = rows.map((row, index) => {
-          const title = resultTitle(model, row)
-          return {
-            id: (row.id as string | number | undefined) ?? index,
-            title,
-            subtitle: resultSubtitle(model, row, title),
-            href: `/models/${model.slug}?q=${encodeURIComponent(q)}`,
-            icon: model.icon,
+          const selected = [...new Set(['id', ...fields])].filter(field => available.has(field))
+          const where = fields.map(field => `${field} LIKE ? COLLATE NOCASE`).join(' OR ')
+          const bindings = fields.map(() => `%${q}%`)
+          let rows: Array<Record<string, unknown>>
+          try {
+            rows = db
+              .query(`SELECT ${selected.join(', ')} FROM ${model.table} WHERE ${where} LIMIT ?`)
+              .all(...bindings, RESULTS_PER_MODEL) as Array<Record<string, unknown>>
+          }
+          catch (error) {
+            throw new Error(`Could not search model ${model.name}: ${error instanceof Error ? error.message : String(error)}`)
           }
-        })
+          if (rows.length === 0) continue
+
+          results[model.name] = rows.map((row, index) => {
+            const title = resultTitle(model, row)
+            return {
+              id: (row.id as string | number | undefined) ?? index,
+              title,
+              subtitle: resultSubtitle(model, row, title),
+              href: `/models/${model.slug}?q=${encodeURIComponent(q)}`,
+              icon: model.icon,
+            }
+          })
+        }
       }
+      finally {
+        db.close()
+      }
+
+      return { results, unavailable }
     }
-    finally {
-      db.close()
+    catch (error) {
+      return dashboardOperationalError(error, 'Search results could not be loaded.', 'GlobalSearchAction')
     }
-
-    return { results, unavailable }
   },
 })

package/app/Actions/Dashboard/Teams/TeamInvitationDestroyAction.ts

@@ -2,7 +2,9 @@ import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { db } from '@stacksjs/database'
 import { response } from '@stacksjs/router'
+import { teamOperationalError } from '../../Teams/team-response'
 import {
+  changedRows,
   generateInvitationToken,
   hashInvitationToken,
   parsePositiveId,
@@ -21,27 +23,43 @@ export default new Action({
     if (!teamId || !invitationId)
       return response.json({ message: 'Invalid team or invitation id.' }, 400)
 
-    const invitation = await (db as any)
-      .selectFrom('team_invitations')
-      .where('id', '=', invitationId)
-      .where('team_id', '=', teamId)
-      .select(['id', 'status'])
-      .executeTakeFirst()
+    let invitation
+    try {
+      invitation = await (db as any)
+        .selectFrom('team_invitations')
+        .where('id', '=', invitationId)
+        .where('team_id', '=', teamId)
+        .select(['id', 'status', 'token_hash'])
+        .executeTakeFirst()
+    }
+    catch (error) {
+      return teamOperationalError(error, 'Invitation could not be loaded.', 'TeamInvitationDestroyAction.lookup', 500)
+    }
     if (!invitation)
       return response.json({ message: 'Invitation not found.' }, 404)
     if (invitation.status !== 'pending')
       return response.json({ message: 'Only pending invitations can be revoked.' }, 409)
 
-    await (db as any)
-      .updateTable('team_invitations')
-      .set({
-        status: 'revoked',
-        token_hash: hashInvitationToken(generateInvitationToken()),
-        updated_at: sqlTimestamp(),
-      })
-      .where('id', '=', invitationId)
-      .where('team_id', '=', teamId)
-      .execute()
+    try {
+      const result = await (db as any)
+        .updateTable('team_invitations')
+        .set({
+          status: 'revoked',
+          token_hash: hashInvitationToken(generateInvitationToken()),
+          pending_key: null,
+          updated_at: sqlTimestamp(),
+        })
+        .where('id', '=', invitationId)
+        .where('team_id', '=', teamId)
+        .where('token_hash', '=', String(invitation.token_hash))
+        .where('status', '=', 'pending')
+        .executeTakeFirst()
+      if (changedRows(result) !== 1)
+        return response.json({ message: 'The invitation changed before it could be revoked.' }, 409)
+    }
+    catch (error) {
+      return teamOperationalError(error, 'Invitation could not be revoked.', 'TeamInvitationDestroyAction.update', 500)
+    }
 
     return response.noContent()
   },

package/app/Actions/Dashboard/Teams/TeamInvitationResendAction.ts

@@ -1,9 +1,12 @@
 import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { db } from '@stacksjs/database'
+import { isUniqueViolation } from '@stacksjs/orm'
 import { response } from '@stacksjs/router'
+import { teamOperationalError } from '../../Teams/team-response'
 import { deliverTeamInvitation } from './team-invitation-delivery'
 import {
+  changedRows,
   generateInvitationToken,
   hashInvitationToken,
   invitationExpiresAt,
@@ -23,40 +26,59 @@ export default new Action({
     if (!teamId || !invitationId)
       return response.json({ message: 'Invalid team or invitation id.' }, 400)
 
-    const invitation = await (db as any)
-      .selectFrom('team_invitations')
-      .innerJoin('teams', 'teams.id', '=', 'team_invitations.team_id')
-      .where('team_invitations.id', '=', invitationId)
-      .where('team_invitations.team_id', '=', teamId)
-      .select([
-        'team_invitations.id as id',
-        'team_invitations.email as email',
-        'team_invitations.role as role',
-        'team_invitations.status as status',
-        'teams.name as team_name',
-      ])
-      .executeTakeFirst()
+    let invitation
+    try {
+      invitation = await (db as any)
+        .selectFrom('team_invitations')
+        .innerJoin('teams', 'teams.id', '=', 'team_invitations.team_id')
+        .where('team_invitations.id', '=', invitationId)
+        .where('team_invitations.team_id', '=', teamId)
+        .select([
+          'team_invitations.id as id',
+          'team_invitations.email as email',
+          'team_invitations.role as role',
+          'team_invitations.status as status',
+          'team_invitations.token_hash as token_hash',
+          'teams.name as team_name',
+        ])
+        .executeTakeFirst()
+    }
+    catch (error) {
+      return teamOperationalError(error, 'Invitation could not be loaded.', 'TeamInvitationResendAction.lookup', 500)
+    }
     if (!invitation)
       return response.json({ message: 'Invitation not found.' }, 404)
     if (!['pending', 'expired'].includes(String(invitation.status)))
       return response.json({ message: 'Only pending or expired invitations can be resent.' }, 409)
 
     const token = generateInvitationToken()
+    const tokenHash = hashInvitationToken(token)
     const expiresAt = invitationExpiresAt()
-    await (db as any)
-      .updateTable('team_invitations')
-      .set({
-        token_hash: hashInvitationToken(token),
-        status: 'pending',
-        delivery_status: 'pending',
-        delivery_error: null,
-        expires_at: expiresAt,
-        delivered_at: null,
-        updated_at: sqlTimestamp(),
-      })
-      .where('id', '=', invitationId)
-      .where('team_id', '=', teamId)
-      .execute()
+    try {
+      const result = await (db as any)
+        .updateTable('team_invitations')
+        .set({
+          token_hash: tokenHash,
+          pending_key: `${teamId}:${String(invitation.email).trim().toLowerCase()}`,
+          status: 'pending',
+          delivery_status: 'pending',
+          delivery_error: null,
+          expires_at: expiresAt,
+          delivered_at: null,
+          updated_at: sqlTimestamp(),
+        })
+        .where('id', '=', invitationId)
+        .where('team_id', '=', teamId)
+        .where('token_hash', '=', String(invitation.token_hash))
+        .executeTakeFirst()
+      if (changedRows(result) !== 1)
+        return response.json({ message: 'The invitation changed before it could be resent.' }, 409)
+    }
+    catch (error) {
+      if (isUniqueViolation(error))
+        return response.json({ message: 'Another pending invitation already exists for this email.' }, 409)
+      return teamOperationalError(error, 'Invitation could not be refreshed.', 'TeamInvitationResendAction.update', 500)
+    }
 
     try {
       await deliverTeamInvitation({
@@ -65,10 +87,11 @@ export default new Action({
         teamName: String(invitation.team_name),
         role: String(invitation.role),
         token,
+        tokenHash,
       })
     }
-    catch {
-      return response.json({ message: 'The invitation was refreshed, but email delivery failed.' }, 502)
+    catch (error) {
+      return teamOperationalError(error, 'The invitation was refreshed, but email delivery failed.', 'TeamInvitationResendAction.delivery', 502)
     }
 
     return {