diff --git a/internal/handler/file.go b/internal/handler/file.go
index 97d1193..d058ab3 100644
--- a/internal/handler/file.go
+++ b/internal/handler/file.go
@@ -61,7 +61,6 @@ type fileInfoResponse struct {
 	Size      int64     `json:"size"`
 	MimeType  string    `json:"mime_type"`
 	IsDir     bool      `json:"is_dir"`
-	Hash      string    `json:"hash,omitempty"`
 	CreatedAt time.Time `json:"created_at"`
 	UpdatedAt time.Time `json:"updated_at"`
 }
@@ -343,7 +342,6 @@ func toFileInfoResponse(info *service.FileInfo) fileInfoResponse {
 		Size:      info.Size,
 		MimeType:  info.MimeType,
 		IsDir:     info.IsDir,
-		Hash:      info.Hash,
 		CreatedAt: info.CreatedAt,
 		UpdatedAt: info.UpdatedAt,
 	}
diff --git a/internal/service/auth.go b/internal/service/auth.go
index d55340d..6ab7d3c 100644
--- a/internal/service/auth.go
+++ b/internal/service/auth.go
@@ -162,7 +162,10 @@ func (s *AuthService) Logout(ctx context.Context, refreshTokenStr string) error
 		return model.NewInternalError("find session", err)
 	}
 
-	return s.sessionRepo.Delete(ctx, session.ID)
+	if err := s.sessionRepo.Delete(ctx, session.ID); err != nil {
+		return model.NewInternalError("delete session", err)
+	}
+	return nil
 }
 
 // CreatePasskey creates a new app passkey for the authenticated user.
@@ -227,7 +230,11 @@ func (s *AuthService) LoginWithPasskey(ctx context.Context, tokenStr string) (*T
 
 // ListPasskeys returns all app passkeys for a user.
 func (s *AuthService) ListPasskeys(ctx context.Context, userID string) ([]model.Credential, error) {
-	return s.credentialRepo.FindByUserIDAndType(ctx, userID, "app_passkey")
+	creds, err := s.credentialRepo.FindByUserIDAndType(ctx, userID, "app_passkey")
+	if err != nil {
+		return nil, model.NewInternalError("list passkeys", err)
+	}
+	return creds, nil
 }
 
 // RevokePasskey deletes an app passkey owned by the user.
@@ -244,7 +251,10 @@ func (s *AuthService) RevokePasskey(ctx context.Context, userID, credID string)
 		return model.NewPermissionDeniedError("access denied", model.ErrForbidden)
 	}
 
-	return s.credentialRepo.Delete(ctx, credID)
+	if err := s.credentialRepo.Delete(ctx, credID); err != nil {
+		return model.NewInternalError("delete credential", err)
+	}
+	return nil
 }
 
 // AuthenticateAccessToken validates an access token and returns the active user principal.