diff --git a/apps/api/src/__tests__/rbac.test.ts b/apps/api/src/__tests__/rbac.test.ts
index 4b870e5..f548fc8 100644
--- a/apps/api/src/__tests__/rbac.test.ts
+++ b/apps/api/src/__tests__/rbac.test.ts
@@ -65,13 +65,17 @@ vi.mock("../db", () => {
   const user = makeTableProxy("user");
 
   const buildQuery = (result: unknown, fallback: unknown) => ({
-    limit: () => ({
-      [Symbol.iterator]: function* () {
-        if (result) yield result;
-      },
-      0: result,
-      length: result ? 1 : 0,
-    }),
+    [Symbol.iterator]: function* () {
+      if (result) yield result;
+    },
+    limit: (_n: number) => {
+      const item = result ?? fallback;
+      return {
+        [Symbol.iterator]: function* () { if (item) yield item; },
+        0: item,
+        length: item ? 1 : 0,
+      };
+    },
   });
 
   return {
diff --git a/apps/api/src/middleware/rbac.ts b/apps/api/src/middleware/rbac.ts
index 1d63fbe..1d315ac 100644
--- a/apps/api/src/middleware/rbac.ts
+++ b/apps/api/src/middleware/rbac.ts
@@ -130,6 +130,9 @@ export const resolveStaffMiddleware: MiddlewareHandler<AppEnv> = async (
         active: true,
       })
       .returning();
+    if (!newStaff) {
+      return c.json({ error: "Internal error: staff record creation failed" }, 500);
+    }
     c.set("staff", newStaff);
     await next();
     return;