diff --git a/cmd/dashboard/controller/controller.go b/cmd/dashboard/controller/controller.go
index 4b6d832..37b08b9 100644
--- a/cmd/dashboard/controller/controller.go
+++ b/cmd/dashboard/controller/controller.go
@@ -97,7 +97,7 @@ func routers(r *gin.Engine, frontendDist fs.FS) {
 	auth.PATCH("/notification-group/:id", commonHandler(updateNotificationGroup))
 	auth.POST("/batch-delete/notification-group", commonHandler(batchDeleteNotificationGroup))
 
-	auth.GET("/server", listHandler(listServer))
+	auth.GET("/server", commonHandler(listServer))
 	auth.PATCH("/server/:id", commonHandler(updateServer))
 	auth.POST("/batch-delete/server", commonHandler(batchDeleteServer))
 	auth.POST("/force-update/server", commonHandler(forceUpdateServer))
@@ -243,13 +243,13 @@ func listHandler[S ~[]E, E model.CommonInterface](handler handlerFunc[S]) func(*
 			return
 		}
 
-		c.JSON(http.StatusOK, filter(c, data))
+		c.JSON(http.StatusOK, model.CommonResponse[S]{Success: true, Data: filter(c, data)})
 	}
 }
 
 func filter[S ~[]E, E model.CommonInterface](ctx *gin.Context, s S) S {
 	return slices.DeleteFunc(s, func(e E) bool {
-		return e.HasPermission(ctx)
+		return !e.HasPermission(ctx)
 	})
 }
 
diff --git a/cmd/dashboard/controller/cron.go b/cmd/dashboard/controller/cron.go
index ebe8f4e..08ee7f1 100644
--- a/cmd/dashboard/controller/cron.go
+++ b/cmd/dashboard/controller/cron.go
@@ -168,6 +168,10 @@ func manualTriggerCron(c *gin.Context) (any, error) {
 	}
 	singleton.CronLock.RUnlock()
 
+	if !cr.HasPermission(c) {
+		return nil, singleton.Localizer.ErrorT("permission denied")
+	}
+
 	singleton.ManualTrigger(cr)
 	return nil, nil
 }
diff --git a/cmd/dashboard/controller/notification_group.go b/cmd/dashboard/controller/notification_group.go
index 8e6bd97..6b27471 100644
--- a/cmd/dashboard/controller/notification_group.go
+++ b/cmd/dashboard/controller/notification_group.go
@@ -201,7 +201,7 @@ func batchDeleteNotificationGroup(c *gin.Context) (any, error) {
 	}
 
 	var ng []model.NotificationGroup
-	if err := singleton.DB.Where("id in (?)", ng).Find(&ng).Error; err != nil {
+	if err := singleton.DB.Where("id in (?)", ngnr).Find(&ng).Error; err != nil {
 		return nil, err
 	}
 
diff --git a/cmd/dashboard/controller/server.go b/cmd/dashboard/controller/server.go
index b7ffb69..69bf57a 100644
--- a/cmd/dashboard/controller/server.go
+++ b/cmd/dashboard/controller/server.go
@@ -178,6 +178,9 @@ func forceUpdateServer(c *gin.Context) (*model.ForceUpdateResponse, error) {
 		server := singleton.ServerList[sid]
 		singleton.ServerLock.RUnlock()
 		if server != nil && server.TaskStream != nil {
+			if !server.HasPermission(c) {
+				return nil, singleton.Localizer.ErrorT("permission denied")
+			}
 			if err := server.TaskStream.Send(&pb.Task{
 				Type: model.TaskTypeUpgrade,
 			}); err != nil {
diff --git a/model/user_group.go b/model/user_group.go
deleted file mode 100644
index 45b0ecf..0000000
--- a/model/user_group.go
+++ /dev/null
@@ -1,6 +0,0 @@
-package model
-
-type UserGroup struct {
-	Common
-	Name string `json:"name"`
-}
diff --git a/model/user_group_user.go b/model/user_group_user.go
deleted file mode 100644
index 080f35e..0000000
--- a/model/user_group_user.go
+++ /dev/null
@@ -1,7 +0,0 @@
-package model
-
-type UserGroupUser struct {
-	Common
-	UserGroupId uint64 `json:"user_group_id"`
-	UserId      uint64 `json:"user_id"`
-}
diff --git a/service/singleton/singleton.go b/service/singleton/singleton.go
index 0d2bedb..8596bcc 100644
--- a/service/singleton/singleton.go
+++ b/service/singleton/singleton.go
@@ -79,8 +79,8 @@ func InitDBFromPath(path string) {
 	}
 	err = DB.AutoMigrate(model.Server{}, model.User{}, model.ServerGroup{}, model.NotificationGroup{},
 		model.Notification{}, model.AlertRule{}, model.Service{}, model.NotificationGroupNotification{},
-		model.ServiceHistory{}, model.Cron{}, model.Transfer{}, model.ServerGroupServer{}, model.UserGroup{},
-		model.UserGroupUser{}, model.NAT{}, model.DDNSProfile{}, model.NotificationGroupNotification{},
+		model.ServiceHistory{}, model.Cron{}, model.Transfer{}, model.ServerGroupServer{},
+		model.NAT{}, model.DDNSProfile{}, model.NotificationGroupNotification{},
 		model.WAF{})
 	if err != nil {
 		panic(err)