diff --git a/json/users.json b/json/users.json
index 987f277..a650f30 100644
--- a/json/users.json
+++ b/json/users.json
@@ -14,6 +14,7 @@
         "editexclouded": ["id", "nick_name", "orgid", "last_login_fail", "last_login", "sync_from", "login_fail_count", "created_at"],
         "record_toolbar": [
             {
+                "name": "enable_user",
                 "label": "启用",
                 "actiontype": "dspy",
                 "url": "/rbac/users/enable_user.dspy",
@@ -24,6 +25,7 @@
                 }
             },
             {
+                "name": "disable_user",
                 "label": "禁用",
                 "actiontype": "dspy",
                 "url": "/rbac/users/disable_user.dspy",
@@ -34,6 +36,22 @@
                 }
             }
         ],
+		"binds": [
+			{
+				"wid": "self",
+				"event": "enable_user",
+				"actiontype": "script",
+				"target": "self",
+				"script": "var tid=bricks.getWidgetById('users_tbl');var d=tid.select_row.user_data;fetch('/rbac/users/enable_user.dspy?id='+d.id,{method:'POST'}).then(function(r){return r.json()}).then(function(r){if(r.widgettype==='Message'){tid.render({})}else{bricks.show_error(r.options)}})"
+			},
+			{
+				"wid": "self",
+				"event": "disable_user",
+				"actiontype": "script",
+				"target": "self",
+				"script": "var tid=bricks.getWidgetById('users_tbl');var d=tid.select_row.user_data;fetch('/rbac/users/disable_user.dspy?id='+d.id,{method:'POST'}).then(function(r){return r.json()}).then(function(r){if(r.widgettype==='Message'){tid.render({})}else{bricks.show_error(r.options)}})"
+			}
+		],
         "subtables": [
 			{
 				"field":"userid",
diff --git a/wwwroot/api/add_user.dspy b/wwwroot/api/add_user.dspy
index 27e91e5..ce156d7 100644
--- a/wwwroot/api/add_user.dspy
+++ b/wwwroot/api/add_user.dspy
@@ -3,7 +3,6 @@ ns = params_kw.copy()
 for k,v in ns.items():
 	if v == 'NaN' or v == 'null':
 		ns[k] = None
-# remove _text suffix fields sent by Tabular (not real DB columns)
 for k in list(ns.keys()):
 	if k.endswith('_text'):
 		ns.pop(k, None)
@@ -19,40 +18,15 @@ ns['created_at'] = curDateString()
 
 userorgid = await get_userorgid()
 if not userorgid:
-	return {
-		"widgettype":"Error",
-		"options":{
-			"title":"Authorization Error",
-			"timeout":3,
-			"cwidth":16,
-			"cheight":9,
-			"message":"Please login"
-		}
-	}
+	return {"widgettype":"Error","options":{"title":"Authorization Error","timeout":3,"cwidth":16,"cheight":9,"message":"Please login"}}
 ns['orgid'] = userorgid
 
-db = DBPools()
-dbname = get_module_dbname('rbac')
-async with db.sqlorContext(dbname) as sor:
-	r = await sor.C('users', ns.copy())
-	return {
-		"widgettype":"Message",
-		"options":{
-			"cwidth":16,
-			"cheight":9,
-			"title":"Add Success",
-			"timeout":3,
-			"message":"ok"
-		}
-	}
-
-return {
-	"widgettype":"Error",
-	"options":{
-		"title":"Add Error",
-		"cwidth":16,
-		"cheight":9,
-		"timeout":3,
-		"message":"failed"
-	}
-}
+try:
+	db = DBPools()
+	dbname = get_module_dbname('rbac')
+	async with db.sqlorContext(dbname) as sor:
+		r = await sor.C('users', ns.copy())
+		return {"widgettype":"Message","options":{"cwidth":16,"cheight":9,"title":"Add Success","timeout":3,"message":"ok"}}
+except Exception as e:
+	debug(f'add_user error: {format_exc()}')
+	return {"widgettype":"Error","options":{"title":"Add Error","cwidth":16,"cheight":9,"timeout":5,"message":str(e)}}
diff --git a/wwwroot/api/update_user.dspy b/wwwroot/api/update_user.dspy
index 51e49e5..da3149f 100644
--- a/wwwroot/api/update_user.dspy
+++ b/wwwroot/api/update_user.dspy
@@ -3,76 +3,31 @@ ns = params_kw.copy()
 for k,v in ns.items():
 	if v == 'NaN' or v == 'null':
 		ns[k] = None
-# remove _text suffix fields sent by Tabular (not real DB columns)
 for k in list(ns.keys()):
 	if k.endswith('_text'):
 		ns.pop(k, None)
 
 userorgid = await get_userorgid()
 if not userorgid:
-	return {
-		"widgettype":"Error",
-		"options":{
-			"title":"Authorization Error",
-			"timeout":3,
-			"cwidth":16,
-			"cheight":9,
-			"message":"Please login"
-		}
-	}
+	return {"widgettype":"Error","options":{"title":"Authorization Error","timeout":3,"cwidth":16,"cheight":9,"message":"Please login"}}
 ns['orgid'] = userorgid
 
-
 if params_kw.get('password'):
 	ns['password'] = password_encode(params_kw.get('password'))
 else:
 	ns.pop('password', None)
 
-
-db = DBPools()
-dbname = get_module_dbname('rbac')
-async with db.sqlorContext(dbname) as sor:
-
-	ns1 = {
-
-		"orgid": userorgid,
-
-
-		"id": params_kw.id
-	}
-	recs = await sor.R('users', ns1)
-	if len(recs) < 1:
-		return {
-			"widgettype":"Error",
-			"options":{
-				"title":"Update Error",
-				"cwidth":16,
-				"cheight":9,
-				"timeout":3,
-				"message":"Record no exist or with wrong ownership"
-			}
-		}
-
-	r = await sor.U('users', ns)
-	debug('update success');
-	return {
-		"widgettype":"Message",
-		"options":{
-			"title":"Update Success",
-			"cwidth":16,
-			"cheight":9,
-			"timeout":3,
-			"message":"ok"
-		} 
-	}
-		
-return {
-	"widgettype":"Error",
-	"options":{
-		"title":"Update Error",
-		"cwidth":16,
-		"cheight":9,
-		"timeout":3,
-		"message":"failed"
-	}
-}
+try:
+	db = DBPools()
+	dbname = get_module_dbname('rbac')
+	async with db.sqlorContext(dbname) as sor:
+		ns1 = {"orgid": userorgid, "id": params_kw.id}
+		recs = await sor.R('users', ns1)
+		if len(recs) < 1:
+			return {"widgettype":"Error","options":{"title":"Update Error","cwidth":16,"cheight":9,"timeout":3,"message":"Record no exist or with wrong ownership"}}
+		r = await sor.U('users', ns)
+		debug('update success')
+		return {"widgettype":"Message","options":{"title":"Update Success","cwidth":16,"cheight":9,"timeout":3,"message":"ok"}}
+except Exception as e:
+	debug(f'update_user error: {format_exc()}')
+	return {"widgettype":"Error","options":{"title":"Update Error","cwidth":16,"cheight":9,"timeout":5,"message":str(e)}}