diff --git a/src/app/api/admin/roles/route.ts b/src/app/api/admin/roles/route.ts
index f1afee1..c74ed51 100644
--- a/src/app/api/admin/roles/route.ts
+++ b/src/app/api/admin/roles/route.ts
@@ -17,15 +17,17 @@ export async function GET(request: NextRequest) {
   // 返回所有权限定义 + 各角色的权限映射
   const rolePermissions = dbQuery<{ role: string; permission_key: string }>('SELECT role, permission_key FROM role_permissions')
   const roles = ['admin', 'editor', 'viewer']
+  const permKeys = PERMISSIONS.map(p => p.key)
+
   const result = roles.map(role => ({
     role,
     permissions: PERMISSIONS.map(p => ({
-      key: p,
-      enabled: role === 'admin' || rolePermissions.some(rp => rp.role === role && rp.permission_key === p),
+      key: p.key,
+      enabled: role === 'admin' || rolePermissions.some(rp => rp.role === role && rp.permission_key === p.key),
     })),
   }))
 
-  return NextResponse.json({ roles: result, allPermissions: PERMISSIONS })
+  return NextResponse.json({ roles: result, allPermissions: permKeys })
 }
 
 export async function PUT(request: NextRequest) {