feat: clean out authentication and authorization, rolemenu database fixed(use role id instead of rolecode now), adjust pages

TaskTrackingSystem.Database/AppDbContextModels/AppDbContext.cs

@@ -42,8 +42,8 @@ public partial class AppDbContext : DbContext
     public virtual DbSet<User> Users { get; set; }
 
     protected override void OnConfiguring(DbContextOptionsBuilder optionsBuilder)
-#warning To protect potentially sensitive information in your connection string, you should move it out of source code. You can avoid scaffolding the connection string by using the Name= syntax to read it from configuration - see https://go.microsoft.com/fwlink/?linkid=2131148. For more guidance on storing connection strings, see https://go.microsoft.com/fwlink/?LinkId=723263.
-        => optionsBuilder.UseSqlServer("Server=.;Database=TTS;User Id=sa;Password=sasa@123;TrustServerCertificate=True;");
+    {
+    }
 
     protected override void OnModelCreating(ModelBuilder modelBuilder)
     {
@@ -184,8 +184,9 @@ public partial class AppDbContext : DbContext
             entity.Property(e => e.RoleMenuId).HasMaxLength(50);
             entity.Property(e => e.CreatedUserId).HasMaxLength(50);
             entity.Property(e => e.MenuCode).HasMaxLength(50);
-            entity.Property(e => e.ModifiedUserId).HasMaxLength(50);
             entity.Property(e => e.RoleCode).HasMaxLength(50);
+            entity.Property(e => e.ModifiedUserId).HasMaxLength(50);
+            entity.HasIndex(e => e.RoleId, "IX_RoleMenus_RoleId");
         });
 
         modelBuilder.Entity<Task>(entity =>

TaskTrackingSystem.Database/AppDbContextModels/RoleMenu.cs

@@ -7,7 +7,9 @@ public partial class RoleMenu
 {
     public string RoleMenuId { get; set; } = null!;
 
-    public string RoleCode { get; set; } = null!;
+    public long RoleId { get; set; }
+
+    public string? RoleCode { get; set; }
 
     public string MenuCode { get; set; } = null!;
 

TaskTrackingSystem.Shared/Models/Auth/AuthResponse.cs

@@ -11,6 +11,7 @@ namespace TaskTrackingSystem.Shared.Models.Auth
         public string Token { get; set; } = string.Empty;
         public string Username { get; set; } = string.Empty;
         public string Email { get; set; } = string.Empty;
+        public long RoleId { get; set; }
         public string RoleName { get; set; } = string.Empty;
     }
-}
+}

TaskTrackingSystem.Shared/Models/Auth/ResetPasswordDto.cs

@@ -0,0 +1,18 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace TaskTrackingSystem.Shared.Models.Auth
+{
+    public class ResetPasswordDto
+    {
+        [Required]
+        public string UsernameOrEmail { get; set; } = string.Empty;
+
+        [Required]
+        public string RecoveryCode { get; set; } = string.Empty;
+
+        [Required]
+        [MinLength(8, ErrorMessage = ResultMessages.PasswordMinLengthRule)]
+        [RegularExpression(@"^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[^a-zA-Z0-9]).+$", ErrorMessage = ResultMessages.PasswordComplexityRule)]
+        public string NewPassword { get; set; } = string.Empty;
+    }
+}

TaskTrackingSystem.WebApi/Features/Auth/AuthController.cs

@@ -52,5 +52,17 @@ namespace TaskTrackingSystem.WebApi.Features.Auth
                 return BadRequest(Result<AuthResponseDto>.Failure(ex.Message, 400));
             }
         }
+
+        [HttpPost("reset-password")]
+        public async Task<IActionResult> ResetPassword([FromBody] ResetPasswordDto resetPasswordDto)
+        {
+            var result = await _authService.ResetPasswordAsync(resetPasswordDto);
+            if (!result.IsSuccess)
+            {
+                return StatusCode(result.StatusCode, result);
+            }
+
+            return Ok(result);
+        }
     }
-}
+}

TaskTrackingSystem.WebApi/Features/Auth/AuthService.cs

@@ -4,8 +4,10 @@ using System.Security.Claims;
 using System.Text;
 using System.Threading.Tasks;
 using Microsoft.EntityFrameworkCore;
+using Microsoft.AspNetCore.Identity;
 using Microsoft.Extensions.Configuration;
 using Microsoft.IdentityModel.Tokens;
+using TaskTrackingSystem.Shared;
 using TaskTrackingSystem.Shared.Models.Auth;
 using TaskTrackingSystem.Database;
 using TaskTrackingSystem.Database.AppDbContextModels;
@@ -16,11 +18,13 @@ namespace TaskTrackingSystem.WebApi.Features.Auth
     {
         private readonly AppDbContext _db;
         private readonly IConfiguration _configuration;
+        private readonly IPasswordHasher<TaskTrackingSystem.Database.AppDbContextModels.User> _passwordHasher;
 
-        public AuthService(AppDbContext db, IConfiguration configuration)
+        public AuthService(AppDbContext db, IConfiguration configuration, IPasswordHasher<TaskTrackingSystem.Database.AppDbContextModels.User> passwordHasher)
         {
             _db = db;
             _configuration = configuration;
+            _passwordHasher = passwordHasher;
         }
 
         public async Task<AuthResponseDto?> LoginAsync(LoginDto loginDto)
@@ -40,21 +44,34 @@ namespace TaskTrackingSystem.WebApi.Features.Auth
             }
 
             
-            string inputHash = "HASHED_" + loginDto.Password;
-            if (user.PasswordHash != inputHash)
+            var passwordCheck = _passwordHasher.VerifyHashedPassword(user, user.PasswordHash, loginDto.Password);
+            if (passwordCheck == PasswordVerificationResult.Failed)
             {
-                return null;
+                if (!IsLegacyPasswordMatch(user.PasswordHash, loginDto.Password))
+                {
+                    return null;
+                }
+
+                user.PasswordHash = _passwordHasher.HashPassword(user, loginDto.Password);
+                await _db.SaveChangesAsync();
             }
 
-            
-            var token = GenerateJwtToken(user.Id.ToString(), user.Username, user.Email, user.Role.Name);
+            var roleId = user.RoleId;
+            if (roleId <= 0 && user.Role != null)
+            {
+                roleId = user.Role.Id;
+            }
+
+            var roleName = user.Role?.Name ?? string.Empty;
+            var token = GenerateJwtToken(user.Id.ToString(), user.Username, user.Email, roleId, roleName);
 
             return new AuthResponseDto
             {
                 Token = token,
                 Username = user.Username,
                 Email = user.Email,
-                RoleName = user.Role.Name
+                RoleId = roleId,
+                RoleName = roleName
             };
         }
 
@@ -80,36 +97,68 @@ namespace TaskTrackingSystem.WebApi.Features.Auth
                 throw new InvalidOperationException("No system roles configured. Registration failed.");
             }
 
-            string fakePasswordHash = "HASHED_" + dto.Password;
-
             var user = new TaskTrackingSystem.Database.AppDbContextModels.User
             {
                 Username = dto.Username,
                 FirstName = dto.FirstName,
                 LastName = dto.LastName,
                 Email = dto.Email,
-                PasswordHash = fakePasswordHash,
+                PasswordHash = string.Empty,
                 Phone = dto.Phone,
                 RoleId = defaultRole.Id,
                 IsActive = true,
                 CreatedAt = DateTime.UtcNow
             };
 
+            user.PasswordHash = _passwordHasher.HashPassword(user, dto.Password);
+
             _db.Users.Add(user);
             await _db.SaveChangesAsync();
 
-            var token = GenerateJwtToken(user.Id.ToString(), user.Username, user.Email, defaultRole.Name);
+            var token = GenerateJwtToken(user.Id.ToString(), user.Username, user.Email, defaultRole.Id, defaultRole.Name);
 
             return new AuthResponseDto
             {
                 Token = token,
                 Username = user.Username,
                 Email = user.Email,
+                RoleId = defaultRole.Id,
                 RoleName = defaultRole.Name
             };
         }
 
-        private string GenerateJwtToken(string userId, string username, string email, string roleName)
+        public async Task<Result> ResetPasswordAsync(ResetPasswordDto dto)
+        {
+            if (string.IsNullOrWhiteSpace(dto.UsernameOrEmail) ||
+                string.IsNullOrWhiteSpace(dto.RecoveryCode) ||
+                string.IsNullOrWhiteSpace(dto.NewPassword))
+            {
+                return Result.Failure(ResultMessages.FillAllFields, 400);
+            }
+
+            var expectedCode = _configuration["PasswordReset:RecoveryCode"] ?? "TASKIFY-RESET-2026";
+            if (!string.Equals(dto.RecoveryCode.Trim(), expectedCode, StringComparison.Ordinal))
+            {
+                return Result.Failure("Invalid recovery code.", 400);
+            }
+
+            var user = await _db.Users
+                .FirstOrDefaultAsync(u => (u.Username == dto.UsernameOrEmail || u.Email == dto.UsernameOrEmail) && !u.IsDeleted);
+
+            if (user == null)
+            {
+                return Result.Failure("Account not found.", 404);
+            }
+
+            user.PasswordHash = _passwordHasher.HashPassword(user, dto.NewPassword);
+            user.UpdatedAt = DateTime.UtcNow;
+            _db.Users.Update(user);
+            await _db.SaveChangesAsync();
+
+            return Result.Success(200);
+        }
+
+        private string GenerateJwtToken(string userId, string username, string email, long roleId, string roleName)
         {
             var jwtSettings = _configuration.GetSection("JwtSettings");
             var keyStr = jwtSettings["Key"] ?? "SUPER_SECRET_KEY_THAT_IS_LONG_ENOUGH_12345";
@@ -121,6 +170,7 @@ namespace TaskTrackingSystem.WebApi.Features.Auth
                 new Claim(ClaimTypes.NameIdentifier, userId),
                 new Claim(ClaimTypes.Name, username),
                 new Claim(ClaimTypes.Email, email),
+                new Claim("role_id", roleId.ToString()),
                 new Claim(ClaimTypes.Role, roleName)
             };
 
@@ -134,5 +184,10 @@ namespace TaskTrackingSystem.WebApi.Features.Auth
 
             return new JwtSecurityTokenHandler().WriteToken(token);
         }
+
+        private static bool IsLegacyPasswordMatch(string passwordHash, string password)
+        {
+            return string.Equals(passwordHash, "HASHED_" + password, StringComparison.Ordinal);
+        }
     }
-}
+}

TaskTrackingSystem.WebApi/Features/Dashboard/DashboardController.cs

@@ -4,6 +4,7 @@ using System.Collections.Generic;
 using System.Threading.Tasks;
 using TaskTrackingSystem.Shared;
 using TaskTrackingSystem.Shared.Models.Dashboard;
+using TaskTrackingSystem.WebApi.Infrastructure;
 
 namespace TaskTrackingSystem.WebApi.Features.Dashboard
 {
@@ -22,21 +23,21 @@ namespace TaskTrackingSystem.WebApi.Features.Dashboard
         [HttpGet("summary")]
         public async Task<ActionResult<Result<DashboardSummaryDto>>> GetSummary()
         {
-            var result = await _dashboardService.GetSummaryAsync(true);
+            var result = await _dashboardService.GetSummaryAsync(User.GetRoleName(), User.GetUserId());
             return StatusCode(result.StatusCode, result);
         }
 
         [HttpGet("tasks-overview")]
         public async Task<ActionResult<Result<IEnumerable<TaskStatusOverviewDto>>>> GetTasksOverview()
         {
-            var result = await _dashboardService.GetTasksOverviewAsync();
+            var result = await _dashboardService.GetTasksOverviewAsync(User.GetRoleName(), User.GetUserId());
             return StatusCode(result.StatusCode, result);
         }
 
         [HttpGet("project-progress")]
         public async Task<ActionResult<Result<IEnumerable<ProjectProgressDto>>>> GetProjectProgress()
         {
-            var result = await _dashboardService.GetProjectProgressAsync();
+            var result = await _dashboardService.GetProjectProgressAsync(User.GetRoleName(), User.GetUserId());
             return StatusCode(result.StatusCode, result);
         }
     }

TaskTrackingSystem.WebApi/Features/Dashboard/DashboardService.cs

@@ -1,4 +1,5 @@
 using Microsoft.EntityFrameworkCore;
+using System;
 using System.Collections.Generic;
 using System.Linq;
 using System.Threading.Tasks;
@@ -17,13 +18,18 @@ namespace TaskTrackingSystem.WebApi.Features.Dashboard
             _db = db;
         }
 
-        public async Task<Result<DashboardSummaryDto>> GetSummaryAsync(bool v)
+        public async Task<Result<DashboardSummaryDto>> GetSummaryAsync(string roleName, long currentUserId)
         {
-            var totalUsers = await _db.Users.CountAsync(u => true);
-            var activeProjectsCount = await _db.Projects.CountAsync(p => p.IsDeleted != true);
-            // Assumed PendingTasksCount = tasks where status is NOT Done (StatusId != 3, or we check common pending status logic)
-            // Let's assume StatusId != 3 represents Pending tasks (e.g. 1 = To Do, 2 = In Progress, 3 = Done)
-            var pendingTasksCount = await _db.Tasks.CountAsync(t => t.IsDeleted != true && t.StatusId != 3);
+            var elevated = IsElevated(roleName);
+            var projects = BuildAccessibleProjectQuery(roleName, currentUserId);
+            var tasks = BuildAccessibleTaskQuery(roleName, currentUserId);
+
+            var totalUsers = elevated
+                ? await _db.Users.CountAsync(u => !u.IsDeleted)
+                : await _db.Users.CountAsync(u => u.Id == currentUserId && !u.IsDeleted);
+
+            var activeProjectsCount = await projects.CountAsync();
+            var pendingTasksCount = await tasks.CountAsync(t => t.StatusId != 3);
 
             var summary = new DashboardSummaryDto
             {
@@ -35,11 +41,9 @@ namespace TaskTrackingSystem.WebApi.Features.Dashboard
             return Result<DashboardSummaryDto>.Success(summary);
         }
 
-        public async Task<Result<IEnumerable<TaskStatusOverviewDto>>> GetTasksOverviewAsync()
+        public async Task<Result<IEnumerable<TaskStatusOverviewDto>>> GetTasksOverviewAsync(string roleName, long currentUserId)
         {
-            // Group by StatusId
-            var groupedTasks = await _db.Tasks
-                .Where(t => t.IsDeleted != true)
+            var groupedTasks = await BuildAccessibleTaskQuery(roleName, currentUserId)
                 .GroupBy(t => t.StatusId)
                 .Select(g => new
                 {
@@ -80,10 +84,9 @@ namespace TaskTrackingSystem.WebApi.Features.Dashboard
             return Result<IEnumerable<TaskStatusOverviewDto>>.Success(overview.OrderBy(o => o.StatusId));
         }
 
-        public async Task<Result<IEnumerable<ProjectProgressDto>>> GetProjectProgressAsync()
+        public async Task<Result<IEnumerable<ProjectProgressDto>>> GetProjectProgressAsync(string roleName, long currentUserId)
         {
-            var activeProjects = await _db.Projects
-                .Where(p => p.IsDeleted != true)
+            var activeProjects = await BuildAccessibleProjectQuery(roleName, currentUserId)
                 .ToListAsync();
 
             var progressList = new List<ProjectProgressDto>();
@@ -112,9 +115,38 @@ namespace TaskTrackingSystem.WebApi.Features.Dashboard
             return Result<IEnumerable<ProjectProgressDto>>.Success(progressList);
         }
 
-        internal async System.Threading.Tasks.Task GetSummaryAsync(object value)
+        private IQueryable<TaskTrackingSystem.Database.AppDbContextModels.Task> BuildAccessibleTaskQuery(string roleName, long currentUserId)
+        {
+            var query = _db.Tasks.Where(t => t.IsDeleted != true);
+
+            if (IsElevated(roleName))
+            {
+                return query;
+            }
+
+            return query.Where(t =>
+                t.AssignedTo == currentUserId ||
+                t.CreatedBy == currentUserId);
+        }
+
+        private IQueryable<TaskTrackingSystem.Database.AppDbContextModels.Project> BuildAccessibleProjectQuery(string roleName, long currentUserId)
+        {
+            var query = _db.Projects.Where(p => p.IsDeleted != true);
+
+            if (IsElevated(roleName))
+            {
+                return query;
+            }
+
+            return query.Where(p =>
+                p.CreatedById == currentUserId ||
+                p.ProjectMembers.Any(pm => pm.UserId == currentUserId));
+        }
+
+        private static bool IsElevated(string roleName)
         {
-            throw new NotImplementedException();
+            return roleName.Equals("Admin", StringComparison.OrdinalIgnoreCase) ||
+                   roleName.Equals("Manager", StringComparison.OrdinalIgnoreCase);
         }
     }
 }

TaskTrackingSystem.WebApi/Features/Menu/MenuController.cs

@@ -4,6 +4,7 @@ using System.Collections.Generic;
 using System.Security.Claims;
 using System.Threading.Tasks;
 using TaskTrackingSystem.Shared.Models.Menu;
+using TaskTrackingSystem.WebApi.Infrastructure;
 
 namespace TaskTrackingSystem.WebApi.Features.Menu
 {
@@ -22,15 +23,24 @@ namespace TaskTrackingSystem.WebApi.Features.Menu
         [HttpGet]
         public async Task<ActionResult<IEnumerable<MenuDto>>> GetMenus()
         {
-            var roleToQuery = User.FindFirst(ClaimTypes.Role)?.Value;
-            if (string.IsNullOrWhiteSpace(roleToQuery))
+            var roleId = User.GetRoleId();
+            if (roleId > 0)
+            {
+                var roleMenus = await _menuService.GetMenusByRoleIdAsync(roleId);
+                return Ok(roleMenus);
+            }
+
+            var roleName = User.GetRoleName();
+            if (string.IsNullOrWhiteSpace(roleName))
             {
                 return Forbid();
             }
 
-            var menus = await _menuService.GetMenusByRoleAsync(roleToQuery);
-            return Ok(menus);
+            var roleMenusByName = await _menuService.GetMenusByRoleNameAsync(roleName);
+            return Ok(roleMenusByName);
         }
+
+        [Authorize(Roles = "Admin")]
         [HttpGet("all")]
         public async Task<ActionResult<IEnumerable<MenuAdminDto>>> GetAllMenus()
         {

TaskTrackingSystem.WebApi/Features/Menu/MenuService.cs

@@ -17,17 +17,43 @@ namespace TaskTrackingSystem.WebApi.Features.Menu
             _db = db;
         }
 
-        public async Task<List<MenuDto>> GetMenusByRoleAsync(string roleName)
+        public async Task<List<MenuDto>> GetMenusByRoleIdAsync(long roleId)
         {
-            // 1. Get the MenuCodes configured for this Role
-            var allowedMenuCodes = await _db.RoleMenus
-                .Where(rm => rm.RoleCode == roleName && rm.DelFlag == 0)
-                .Select(rm => rm.MenuCode)
-                .ToListAsync();
+            var role = await _db.Roles.FirstOrDefaultAsync(r => r.Id == roleId && r.IsDeleted != true);
+            if (role == null)
+            {
+                return new List<MenuDto>();
+            }
 
-            // 2. Retrieve the active menu items matching those codes
-            var menus = await _db.MenuAdmins
-                .Where(m => allowedMenuCodes.Contains(m.MenuCode) && m.Visible && m.DelFlag == 0)
+            return await GetMenusForRoleAsync(role.Id, role.Name);
+        }
+
+        public async Task<List<MenuDto>> GetMenusByRoleNameAsync(string roleName)
+        {
+            if (string.IsNullOrWhiteSpace(roleName))
+            {
+                return new List<MenuDto>();
+            }
+
+            var role = await _db.Roles.FirstOrDefaultAsync(r => r.Name == roleName && r.IsDeleted != true);
+            if (role == null)
+            {
+                return new List<MenuDto>();
+            }
+
+            return await GetMenusForRoleAsync(role.Id, role.Name);
+        }
+
+        private async Task<List<MenuDto>> GetMenusForRoleAsync(long roleId, string roleName)
+        {
+            var role = await _db.Roles.FirstOrDefaultAsync(r => r.Id == roleId && r.IsDeleted != true);
+            if (role == null)
+            {
+                return new List<MenuDto>();
+            }
+
+            var allVisibleMenus = await _db.MenuAdmins
+                .Where(m => m.Visible && m.DelFlag == 0)
                 .OrderBy(m => m.OrderNo)
                 .Select(m => new MenuDto
                 {
@@ -40,19 +66,131 @@ namespace TaskTrackingSystem.WebApi.Features.Menu
                 })
                 .ToListAsync();
 
-            // 3. Construct the menu hierarchy (Parents -> SubMenus)
-            var parentMenus = menus.Where(m => string.IsNullOrEmpty(m.ParentCode) || m.ParentCode == "0").ToList();
-            var childMenus = menus.Where(m => !string.IsNullOrEmpty(m.ParentCode) && m.ParentCode != "0").ToList();
+            // Keep compatibility with roles stored by either RoleId or the older RoleCode link.
+            var allowedMenuCodes = await GetAllowedMenuCodesAsync(role.Id, role.Name);
 
-            foreach (var parent in parentMenus)
+            if (allowedMenuCodes.Count == 0)
             {
-                parent.SubMenus = childMenus
-                    .Where(c => c.ParentCode == parent.MenuCode)
-                    .OrderBy(c => c.OrderNo)
-                    .ToList();
+                return new List<MenuDto>();
             }
 
-            return parentMenus.OrderBy(p => p.OrderNo).ToList();
+            var visibleMenuLookup = allVisibleMenus
+                .GroupBy(m => m.MenuCode, StringComparer.OrdinalIgnoreCase)
+                .ToDictionary(g => g.Key, g => g.First(), StringComparer.OrdinalIgnoreCase);
+
+            var expandedMenuCodes = ExpandWithAncestors(allowedMenuCodes, visibleMenuLookup);
+            var menus = allVisibleMenus
+                .Where(m => expandedMenuCodes.Contains(m.MenuCode))
+                .OrderBy(m => m.OrderNo)
+                .ToList();
+
+            return BuildHierarchy(menus);
+        }
+
+        private static List<MenuDto> BuildHierarchy(List<MenuDto> menus)
+        {
+            if (menus.Count == 0)
+            {
+                return new List<MenuDto>();
+            }
+
+            var menuLookup = menus
+                .GroupBy(m => m.MenuCode, StringComparer.OrdinalIgnoreCase)
+                .ToDictionary(g => g.Key, g => g.First(), StringComparer.OrdinalIgnoreCase);
+
+            foreach (var menu in menuLookup.Values)
+            {
+                menu.SubMenus = new List<MenuDto>();
+            }
+
+            var roots = new List<MenuDto>();
+
+            foreach (var menu in menuLookup.Values.OrderBy(m => m.OrderNo).ThenBy(m => m.MenuName))
+            {
+                var parentCode = NormalizeMenuCode(menu.ParentCode);
+                if (string.IsNullOrWhiteSpace(parentCode) ||
+                    parentCode == "0" ||
+                    !menuLookup.TryGetValue(parentCode, out var parent))
+                {
+                    roots.Add(menu);
+                    continue;
+                }
+
+                parent.SubMenus.Add(menu);
+            }
+
+            SortMenuTree(roots);
+            return roots;
+        }
+
+        private async Task<HashSet<string>> GetAllowedMenuCodesAsync(long roleId, string roleName)
+        {
+            var allowedMenuCodes = await _db.RoleMenus
+                .Where(rm => rm.RoleId == roleId && rm.DelFlag == 0)
+                .Select(rm => rm.MenuCode)
+                .ToListAsync();
+
+            if (allowedMenuCodes.Count > 0)
+            {
+                return allowedMenuCodes.ToHashSet(StringComparer.OrdinalIgnoreCase);
+            }
+
+            if (!string.IsNullOrWhiteSpace(roleName))
+            {
+                allowedMenuCodes = await _db.RoleMenus
+                    .Where(rm => rm.RoleCode == roleName && rm.DelFlag == 0)
+                    .Select(rm => rm.MenuCode)
+                    .ToListAsync();
+            }
+
+            return allowedMenuCodes.ToHashSet(StringComparer.OrdinalIgnoreCase);
+        }
+
+        private static HashSet<string> ExpandWithAncestors(IEnumerable<string> menuCodes, IReadOnlyDictionary<string, MenuDto> menuLookup)
+        {
+            var expanded = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+
+            foreach (var menuCode in menuCodes.Where(code => !string.IsNullOrWhiteSpace(code)))
+            {
+                var currentCode = menuCode.Trim();
+
+                while (!string.IsNullOrWhiteSpace(currentCode) && expanded.Add(currentCode))
+                {
+                    if (!menuLookup.TryGetValue(currentCode, out var currentMenu))
+                    {
+                        break;
+                    }
+
+                    currentCode = NormalizeMenuCode(currentMenu.ParentCode);
+                    if (string.IsNullOrWhiteSpace(currentCode) || currentCode == "0")
+                    {
+                        break;
+                    }
+                }
+            }
+
+            return expanded;
+        }
+
+        private static void SortMenuTree(IList<MenuDto> menus)
+        {
+            var ordered = menus.OrderBy(m => m.OrderNo).ThenBy(m => m.MenuName, StringComparer.OrdinalIgnoreCase).ToList();
+            menus.Clear();
+
+            foreach (var menu in ordered)
+            {
+                if (menu.SubMenus.Count > 0)
+                {
+                    SortMenuTree(menu.SubMenus);
+                }
+
+                menus.Add(menu);
+            }
+        }
+
+        private static string NormalizeMenuCode(string? code)
+        {
+            return string.IsNullOrWhiteSpace(code) ? string.Empty : code.Trim();
         }
         public async Task<List<MenuAdminDto>> GetAllMenusAsync()
         {

TaskTrackingSystem.WebApi/Features/Project/ProjectController.cs

@@ -4,6 +4,7 @@ using TaskTrackingSystem.Shared;
 using TaskTrackingSystem.Shared.Models.User;
 using TaskTrackingSystem.Shared.Models.Task;
 using TaskTrackingSystem.Shared.Models.Project;
+using TaskTrackingSystem.WebApi.Infrastructure;
 
 namespace TaskTrackingSystem.WebApi.Features.Project
 {
@@ -22,14 +23,14 @@ namespace TaskTrackingSystem.WebApi.Features.Project
         [HttpGet]
         public async Task<ActionResult<IEnumerable<ProjectDto>>> GetProjects()
         {
-            var projects = await _projectService.GetAllProjectsAsync();
+            var projects = await _projectService.GetAllProjectsAsync(User.GetRoleName(), User.GetUserId());
             return Ok(projects);
         }
 
         [HttpGet("{id}")]
         public async Task<ActionResult<ProjectDto>> GetProject(long id)
         {
-            var project = await _projectService.GetProjectByIdAsync(id);
+            var project = await _projectService.GetProjectByIdAsync(id, User.GetRoleName(), User.GetUserId());
             if (project == null)
             {
                 return NotFound(new { message = $"Project with ID {id} not found." });
@@ -38,22 +39,25 @@ namespace TaskTrackingSystem.WebApi.Features.Project
         }
 
         [HttpPost]
+        [Authorize(Roles = "Admin")]
         public async Task<ActionResult<Result<ProjectDto>>> CreateProject([FromBody] CreateProjectDto createProjectDto)
         {
-            long? currentUserId = null;
+            long? currentUserId = User.GetUserId();
             var result = await _projectService.CreateProjectAsync(createProjectDto, currentUserId);
             return StatusCode(result.StatusCode, result);
         }
 
         [HttpPut("{id}")]
+        [Authorize(Roles = "Admin")]
         public async Task<ActionResult<Result>> UpdateProject(long id, [FromBody] UpdateProjectDto updateProjectDto)
         {
-            long? currentUserId = null;
+            long? currentUserId = User.GetUserId();
             var result = await _projectService.UpdateProjectAsync(id, updateProjectDto, currentUserId);
             return StatusCode(result.StatusCode, result);
         }
 
         [HttpDelete("{id}")]
+        [Authorize(Roles = "Admin")]
         public async Task<ActionResult<Result>> DeleteProject(long id)
         {
             var result = await _projectService.SoftDeleteProjectAsync(id);
@@ -63,14 +67,15 @@ namespace TaskTrackingSystem.WebApi.Features.Project
         [HttpGet("{id}/members")]
         public async Task<ActionResult<Result<IEnumerable<UserDto>>>> GetProjectMembers(long id)
         {
-            var result = await _projectService.GetProjectMembersAsync(id);
+            var result = await _projectService.GetProjectMembersAsync(id, User.GetRoleName(), User.GetUserId());
             return StatusCode(result.StatusCode, result);
         }
 
         [HttpPost("{id}/members")]
+        [Authorize(Roles = "Admin")]
         public async Task<IActionResult> AssignProjectMembers(long id, [FromBody] AssignMembersDto dto)
         {
-            var result = await _projectService.AssignMembersToProjectAsync(id, dto);
+            var result = await _projectService.AssignMembersToProjectAsync(id, dto, User.GetUserId());
             if (!result.IsSuccess)
             {
                 return StatusCode(result.StatusCode, new { message = result.ErrorMessage });
@@ -79,9 +84,10 @@ namespace TaskTrackingSystem.WebApi.Features.Project
         }
 
         [HttpDelete("{id}/members/{userId}")]
+        [Authorize(Roles = "Admin")]
         public async Task<IActionResult> RemoveProjectMember(long id, long userId)
         {
-            var result = await _projectService.RemoveMemberFromProjectAsync(id, userId);
+            var result = await _projectService.RemoveMemberFromProjectAsync(id, userId, User.GetUserId());
             if (!result.IsSuccess)
             {
                 return StatusCode(result.StatusCode, new { message = result.ErrorMessage });
@@ -92,7 +98,7 @@ namespace TaskTrackingSystem.WebApi.Features.Project
         [HttpGet("{id}/tasks")]
         public async Task<ActionResult<Result<IEnumerable<TaskDto>>>> GetProjectTasks(long id)
         {
-            var result = await _projectService.GetProjectTasksAsync(id);
+            var result = await _projectService.GetProjectTasksAsync(id, User.GetRoleName(), User.GetUserId());
             return StatusCode(result.StatusCode, result);
         }
     }

TaskTrackingSystem.WebApi/Features/Project/ProjectService.cs

@@ -20,10 +20,9 @@ namespace TaskTrackingSystem.WebApi.Features.Project
             _db = db;
         }
 
-        public async Task<IEnumerable<ProjectDto>> GetAllProjectsAsync()
+        public async Task<IEnumerable<ProjectDto>> GetAllProjectsAsync(string roleName, long currentUserId)
         {
-            return await _db.Projects
-                .Where(p => p.IsDeleted != true)
+            return await BuildAccessibleProjectQuery(roleName, currentUserId)
                 .OrderBy(p => p.EndDate)
                 .ThenByDescending(p => p.CreatedAt ?? DateTime.UtcNow)
                 .Select(p => new ProjectDto
@@ -39,10 +38,10 @@ namespace TaskTrackingSystem.WebApi.Features.Project
                 }).ToListAsync();
         }
 
-        public async Task<ProjectDto?> GetProjectByIdAsync(long id)
+        public async Task<ProjectDto?> GetProjectByIdAsync(long id, string roleName, long currentUserId)
         {
-            var project = await _db.Projects
-                .FirstOrDefaultAsync(p => p.Id == id && p.IsDeleted != true);
+            var project = await BuildAccessibleProjectQuery(roleName, currentUserId)
+                .FirstOrDefaultAsync(p => p.Id == id);
 
             if (project == null) return null;
 
@@ -131,12 +130,11 @@ namespace TaskTrackingSystem.WebApi.Features.Project
             return Result.Success(200);
         }
 
-        public async Task<Result<IEnumerable<UserDto>>> GetProjectMembersAsync(long projectId)
+        public async Task<Result<IEnumerable<UserDto>>> GetProjectMembersAsync(long projectId, string roleName, long currentUserId)
         {
-            var projectExists = await _db.Projects.AnyAsync(p => p.Id == projectId && p.IsDeleted != true);
-            if (!projectExists)
+            if (!await IsProjectAccessibleAsync(projectId, roleName, currentUserId))
             {
-                return Result<IEnumerable<UserDto>>.Failure(ResultMessages.ProjectNotFound(projectId), 404);
+                return Result<IEnumerable<UserDto>>.Failure("You do not have access to this project.", 403);
             }
 
             var members = await _db.ProjectMembers
@@ -161,7 +159,7 @@ namespace TaskTrackingSystem.WebApi.Features.Project
             return Result<IEnumerable<UserDto>>.Success(members);
         }
 
-        public async Task<Result> AssignMembersToProjectAsync(long projectId, AssignMembersDto dto)
+        public async Task<Result> AssignMembersToProjectAsync(long projectId, AssignMembersDto dto, long? currentUserId = null)
         {
             var projectExists = await _db.Projects.AnyAsync(p => p.Id == projectId && p.IsDeleted != true);
             if (!projectExists)
@@ -214,7 +212,7 @@ namespace TaskTrackingSystem.WebApi.Features.Project
             return Result.Success(200);
         }
 
-        public async Task<Result> RemoveMemberFromProjectAsync(long projectId, long userId)
+        public async Task<Result> RemoveMemberFromProjectAsync(long projectId, long userId, long? currentUserId = null)
         {
             var projectExists = await _db.Projects.AnyAsync(p => p.Id == projectId && p.IsDeleted != true);
             if (!projectExists)
@@ -236,12 +234,11 @@ namespace TaskTrackingSystem.WebApi.Features.Project
             return Result.Success(204); // No Content success
         }
 
-        public async Task<Result<IEnumerable<TaskDto>>> GetProjectTasksAsync(long projectId)
+        public async Task<Result<IEnumerable<TaskDto>>> GetProjectTasksAsync(long projectId, string roleName, long currentUserId)
         {
-            var projectExists = await _db.Projects.AnyAsync(p => p.Id == projectId && p.IsDeleted != true);
-            if (!projectExists)
+            if (!await IsProjectAccessibleAsync(projectId, roleName, currentUserId))
             {
-                return Result<IEnumerable<TaskDto>>.Failure(ResultMessages.ProjectNotFound(projectId), 404);
+                return Result<IEnumerable<TaskDto>>.Failure("You do not have access to this project.", 403);
             }
 
             var tasks = await _db.Tasks
@@ -269,5 +266,38 @@ namespace TaskTrackingSystem.WebApi.Features.Project
 
             return Result<IEnumerable<TaskDto>>.Success(tasks);
         }
+
+        private IQueryable<TaskTrackingSystem.Database.AppDbContextModels.Project> BuildAccessibleProjectQuery(string roleName, long currentUserId)
+        {
+            var query = _db.Projects.Where(p => p.IsDeleted != true);
+
+            if (IsElevated(roleName))
+            {
+                return query;
+            }
+
+            return query.Where(p =>
+                p.CreatedById == currentUserId ||
+                p.ProjectMembers.Any(pm => pm.UserId == currentUserId));
+        }
+
+        private async Task<bool> IsProjectAccessibleAsync(long projectId, string roleName, long currentUserId)
+        {
+            if (IsElevated(roleName))
+            {
+                return await _db.Projects.AnyAsync(p => p.Id == projectId && p.IsDeleted != true);
+            }
+
+            return await _db.Projects.AnyAsync(p =>
+                p.Id == projectId &&
+                p.IsDeleted != true &&
+                (p.CreatedById == currentUserId || p.ProjectMembers.Any(pm => pm.UserId == currentUserId)));
+        }
+
+        private static bool IsElevated(string roleName)
+        {
+            return roleName.Equals("Admin", StringComparison.OrdinalIgnoreCase) ||
+                   roleName.Equals("Manager", StringComparison.OrdinalIgnoreCase);
+        }
     }
 }

TaskTrackingSystem.WebApi/Features/Role/RoleController.cs

@@ -7,7 +7,7 @@ namespace TaskTrackingSystem.WebApi.Features.Role
 {
     [Route("api/[controller]")]
     [ApiController]
-    [Authorize]
+    [Authorize(Roles = "Admin")]
     public class RoleController : ControllerBase
     {
         private readonly RoleService _roleService;
@@ -36,7 +36,6 @@ namespace TaskTrackingSystem.WebApi.Features.Role
         }
 
         [HttpPost]
-        [Authorize(Roles = "Admin")]
         public async Task<ActionResult<Result<RoleDto>>> CreateRole([FromBody] CreateRoleDto createRoleDto)
         {
             long? currentUserId = null;
@@ -45,7 +44,6 @@ namespace TaskTrackingSystem.WebApi.Features.Role
         }
 
         [HttpPut("{id}")]
-        [Authorize(Roles = "Admin")]
         public async Task<ActionResult<Result>> UpdateRole(long id, [FromBody] UpdateRoleDto updateRoleDto)
         {
             long? currentUserId = null;
@@ -54,7 +52,6 @@ namespace TaskTrackingSystem.WebApi.Features.Role
         }
 
         [HttpDelete("{id}")]
-        [Authorize(Roles = "Admin")]
         public async Task<ActionResult<Result>> DeleteRole(long id)
         {
             var result = await _roleService.SoftDeleteRoleAsync(id);
@@ -63,7 +60,6 @@ namespace TaskTrackingSystem.WebApi.Features.Role
 
 
         [HttpGet("{id}/menus")]
-        [Authorize(Roles = "Admin")]
         public async Task<ActionResult<Result<List<string>>>> GetAssignedMenus(long id)
         {
             var result = await _roleService.GetAssignedMenusByRoleIdAsync(id);

TaskTrackingSystem.WebApi/Features/Role/RoleService.cs

@@ -27,7 +27,7 @@ namespace TaskTrackingSystem.WebApi.Features.Role
                     Id = r.Id,
                     Name = r.Name,
                     Description = r.Description,
-                    CreatedAt = (DateTime)r.CreatedAt
+                    CreatedAt = r.CreatedAt ?? DateTime.UtcNow
                 }).ToListAsync();
         }
 
@@ -43,7 +43,7 @@ namespace TaskTrackingSystem.WebApi.Features.Role
                 Id = role.Id,
                 Name = role.Name,
                 Description = role.Description,
-                CreatedAt = (DateTime)role.CreatedAt
+                CreatedAt = role.CreatedAt ?? DateTime.UtcNow
             };
         }
 
@@ -60,6 +60,15 @@ namespace TaskTrackingSystem.WebApi.Features.Role
                 return Result<RoleDto>.Failure("Role name is already taken.", 400);
             }
 
+            if (dto.MenuCodes != null && dto.MenuCodes.Any())
+            {
+                var validCodesResult = await ValidatePermissionCodesAsync(dto.MenuCodes);
+                if (!validCodesResult.IsSuccess)
+                {
+                    return Result<RoleDto>.Failure(validCodesResult.ErrorMessage ?? ResultMessages.FailedToCreateRole, validCodesResult.StatusCode);
+                }
+            }
+
             var role = new TaskTrackingSystem.Database.AppDbContextModels.Role
             {
                 Name = dto.Name,
@@ -71,22 +80,10 @@ namespace TaskTrackingSystem.WebApi.Features.Role
             _db.Roles.Add(role);
             await _db.SaveChangesAsync();
 
-            // Assign menus and actions if provided
-            if (dto.MenuCodes != null && dto.MenuCodes.Any())
+            var assignResult = await AssignMenusToRoleAsync(role.Id, new AssignMenusDto { MenuCodes = dto.MenuCodes ?? new List<string>() });
+            if (!assignResult.IsSuccess)
             {
-                int i = 1;
-                foreach (var menuCode in dto.MenuCodes)
-                {
-                    _db.RoleMenus.Add(new RoleMenu
-                    {
-                        RoleMenuId = $"RM_{role.Name}_{i++}_{DateTime.UtcNow.Ticks}",
-                        RoleCode = role.Name,
-                        MenuCode = menuCode,
-                        DelFlag = 0,
-                        CreatedDateTime = DateTime.UtcNow
-                    });
-                }
-                await _db.SaveChangesAsync();
+                return Result<RoleDto>.Failure(assignResult.ErrorMessage ?? ResultMessages.FailedToCreateRole, assignResult.StatusCode);
             }
 
             var resultDto = new RoleDto
@@ -116,11 +113,21 @@ namespace TaskTrackingSystem.WebApi.Features.Role
                 return Result.Failure("Role name is already taken by another role.", 400);
             }
 
+            var oldName = role.Name;
             role.Name = dto.Name;
             role.Description = dto.Description;
             role.UpdatedAt = DateTime.UtcNow;
             role.UpdatedBy = currentUserId;
 
+            var relatedRoleMenus = await _db.RoleMenus
+                .Where(rm => rm.RoleId == role.Id || rm.RoleCode == oldName)
+                .ToListAsync();
+
+            foreach (var roleMenu in relatedRoleMenus)
+            {
+                roleMenu.RoleCode = dto.Name;
+            }
+
             _db.Roles.Update(role);
             await _db.SaveChangesAsync();
             return Result.Success(200);
@@ -147,10 +154,18 @@ namespace TaskTrackingSystem.WebApi.Features.Role
             }
 
             var menuCodes = await _db.RoleMenus
-                .Where(rm => rm.RoleCode == role.Name && rm.DelFlag == 0)
+                .Where(rm => rm.RoleId == role.Id && rm.DelFlag == 0)
                 .Select(rm => rm.MenuCode)
                 .ToListAsync();
 
+            if (!menuCodes.Any())
+            {
+                menuCodes = await _db.RoleMenus
+                    .Where(rm => rm.RoleCode == role.Name && rm.DelFlag == 0)
+                    .Select(rm => rm.MenuCode)
+                    .ToListAsync();
+            }
+
             return Result<List<string>>.Success(menuCodes);
         }
 
@@ -167,9 +182,15 @@ namespace TaskTrackingSystem.WebApi.Features.Role
                 return Result.Failure("MenuCodes cannot be null", 400);
             }
 
-            // Remove existing role menus matching RoleCode
+            var validCodesResult = await ValidatePermissionCodesAsync(dto.MenuCodes);
+            if (!validCodesResult.IsSuccess)
+            {
+                return Result.Failure(validCodesResult.ErrorMessage ?? ResultMessages.FailedToUpdateRole, validCodesResult.StatusCode);
+            }
+
+            // Remove existing role menus matching either the new RoleId link or the old RoleCode link.
             var existingRoleMenus = await _db.RoleMenus
-                .Where(rm => rm.RoleCode == role.Name)
+                .Where(rm => rm.RoleId == role.Id || rm.RoleCode == role.Name)
                 .ToListAsync();
 
             if (existingRoleMenus.Any())
@@ -183,7 +204,8 @@ namespace TaskTrackingSystem.WebApi.Features.Role
             {
                 _db.RoleMenus.Add(new RoleMenu
                 {
-                    RoleMenuId = $"RM_{role.Name}_{i++}_{DateTime.UtcNow.Ticks}",
+                    RoleMenuId = $"RM_{role.Id}_{i++}_{DateTime.UtcNow.Ticks}",
+                    RoleId = role.Id,
                     RoleCode = role.Name,
                     MenuCode = menuCode,
                     DelFlag = 0,
@@ -194,5 +216,35 @@ namespace TaskTrackingSystem.WebApi.Features.Role
             await _db.SaveChangesAsync();
             return Result.Success(200);
         }
+
+        private async Task<Result> ValidatePermissionCodesAsync(IEnumerable<string> menuCodes)
+        {
+            var validMenuCodes = await _db.MenuAdmins
+                .Where(m => m.DelFlag == 0)
+                .Select(m => m.MenuCode)
+                .ToListAsync();
+
+            var validActionCodes = await _db.MenuAdminDetails
+                .Where(d => d.DelFlag == 0)
+                .Select(d => d.MenuDetailCode)
+                .ToListAsync();
+
+            var validCodes = validMenuCodes
+                .Concat(validActionCodes)
+                .ToHashSet(StringComparer.OrdinalIgnoreCase);
+
+            var invalidCodes = menuCodes
+                .Where(code => !string.IsNullOrWhiteSpace(code))
+                .Where(code => !validCodes.Contains(code))
+                .Distinct(StringComparer.OrdinalIgnoreCase)
+                .ToList();
+
+            if (invalidCodes.Any())
+            {
+                return Result.Failure(ResultMessages.InvalidPermissionIds(string.Join(", ", invalidCodes)), 400);
+            }
+
+            return Result.Success(200);
+        }
     }
 }

TaskTrackingSystem.WebApi/Features/Task/TaskController.cs

@@ -4,6 +4,7 @@ using Microsoft.AspNetCore.Authorization;
 using TaskTrackingSystem.Shared;
 using TaskTrackingSystem.Shared.Models.Task;
 using TaskTrackingSystem.WebApi.Features.Task;
+using TaskTrackingSystem.WebApi.Infrastructure;
 
 namespace TaskTrackingSystem.WebApi.Features.Task
 {
@@ -22,14 +23,14 @@ namespace TaskTrackingSystem.WebApi.Features.Task
         [HttpGet]
         public async Task<ActionResult<IEnumerable<TaskDto>>> GetTasks()
         {
-            var tasks = await _taskService.GetAllTasksAsync();
+            var tasks = await _taskService.GetAllTasksAsync(User.GetRoleName(), User.GetUserId());
             return Ok(tasks);
         }
 
         [HttpGet("{id}")]
         public async Task<ActionResult<TaskDto>> GetTask(long id)
         {
-            var task = await _taskService.GetTaskByIdAsync(id);
+            var task = await _taskService.GetTaskByIdAsync(id, User.GetRoleName(), User.GetUserId());
             if (task == null)
             {
                 return NotFound(new { message = $"Task with ID {id} not found." });
@@ -40,7 +41,7 @@ namespace TaskTrackingSystem.WebApi.Features.Task
         [HttpPost]
         public async Task<ActionResult<Result<TaskDto>>> CreateTask([FromBody] CreateTaskDto createTaskDto)
         {
-            long? currentUserId = null;
+            long? currentUserId = User.GetUserId();
             var result = await _taskService.CreateTaskAsync(createTaskDto, currentUserId);
             return StatusCode(result.StatusCode, result);
         }
@@ -48,29 +49,29 @@ namespace TaskTrackingSystem.WebApi.Features.Task
         [HttpPut("{id}")]
         public async Task<ActionResult<Result>> UpdateTask(long id, [FromBody] UpdateTaskDto updateTaskDto)
         {
-            long? currentUserId = null;
-            var result = await _taskService.UpdateTaskAsync(id, updateTaskDto, currentUserId);
+            long? currentUserId = User.GetUserId();
+            var result = await _taskService.UpdateTaskAsync(id, updateTaskDto, User.GetRoleName(), currentUserId);
             return StatusCode(result.StatusCode, result);
         }
 
         [HttpDelete("{id}")]
         public async Task<ActionResult<Result>> DeleteTask(long id)
         {
-            var result = await _taskService.SoftDeleteTaskAsync(id);
+            var result = await _taskService.SoftDeleteTaskAsync(id, User.GetRoleName(), User.GetUserId());
             return StatusCode(result.StatusCode, result);
         }
 
         [HttpGet("/api/User/{userId}/tasks")]
         public async Task<ActionResult<Result<IEnumerable<TaskDto>>>> GetUserTasks(long userId)
         {
-            var result = await _taskService.GetTasksByUserIdAsync(userId);
+            var result = await _taskService.GetTasksByUserIdAsync(userId, User.GetRoleName(), User.GetUserId());
             return StatusCode(result.StatusCode, result);
         }
 
         [HttpPatch("{id}/status")]
         public async Task<IActionResult> UpdateTaskStatus(long id, [FromQuery] long statusId)
         {
-            var result = await _taskService.UpdateTaskStatusAsync(id, statusId);
+            var result = await _taskService.UpdateTaskStatusAsync(id, statusId, User.GetRoleName(), User.GetUserId());
             if (!result.IsSuccess)
             {
                 return StatusCode(result.StatusCode, new { message = result.ErrorMessage });

TaskTrackingSystem.WebApi/Features/Task/TaskService.cs

@@ -20,10 +20,9 @@ namespace TaskTrackingSystem.WebApi.Features.Task
             _db = db;
         }
 
-        public async Task<IEnumerable<TaskDto>> GetAllTasksAsync()
+        public async Task<IEnumerable<TaskDto>> GetAllTasksAsync(string roleName, long currentUserId)
         {
-            return await _db.Tasks
-                .Where(t => t.IsDeleted != true)
+            return await BuildAccessibleTaskQuery(roleName, currentUserId)
                 .OrderBy(t => t.DueDate)
                 .ThenByDescending(t => t.CreatedAt ?? DateTime.UtcNow)
                 .Select(t => new TaskDto
@@ -47,11 +46,11 @@ namespace TaskTrackingSystem.WebApi.Features.Task
                 }).ToListAsync();
         }
 
-        public async Task<TaskDto?> GetTaskByIdAsync(long id)
+        public async Task<TaskDto?> GetTaskByIdAsync(long id, string roleName, long currentUserId)
         {
-            var task = await _db.Tasks
+            var task = await BuildAccessibleTaskQuery(roleName, currentUserId)
                 .Include(t => t.TaskHistories)
-                .FirstOrDefaultAsync(t => t.Id == id && t.IsDeleted != true);
+                .FirstOrDefaultAsync(t => t.Id == id);
 
             if (task == null) return null;
 
@@ -131,7 +130,7 @@ namespace TaskTrackingSystem.WebApi.Features.Task
             return Result<TaskDto>.Success(resultDto, 201);
         }
 
-        public async Task<Result> UpdateTaskAsync(long id, UpdateTaskDto dto, long? currentUserId = null)
+        public async Task<Result> UpdateTaskAsync(long id, UpdateTaskDto dto, string roleName, long? currentUserId = null)
         {
             if (string.IsNullOrWhiteSpace(dto.Title))
             {
@@ -141,6 +140,11 @@ namespace TaskTrackingSystem.WebApi.Features.Task
             var task = await _db.Tasks.FirstOrDefaultAsync(t => t.Id == id && t.IsDeleted != true);
             if (task == null) return Result.Failure(ResultMessages.TaskNotFound(id), 404);
 
+            if (!IsElevated(roleName) && currentUserId.HasValue && !await CanEditTaskAsync(task, currentUserId.Value))
+            {
+                return Result.Failure("You do not have access to update this task.", 403);
+            }
+
             task.Title = dto.Title;
             task.Description = dto.Description;
             task.StatusId = dto.StatusId;
@@ -157,19 +161,29 @@ namespace TaskTrackingSystem.WebApi.Features.Task
             return Result.Success(200);
         }
 
-        public async Task<Result> SoftDeleteTaskAsync(long id)
+        public async Task<Result> SoftDeleteTaskAsync(long id, string roleName, long currentUserId)
         {
             var task = await _db.Tasks.FirstOrDefaultAsync(t => t.Id == id && t.IsDeleted != true);
             if (task == null) return Result.Failure(ResultMessages.TaskNotFound(id), 404);
 
+            if (!IsElevated(roleName) && task.CreatedBy != currentUserId && task.AssignedTo != currentUserId)
+            {
+                return Result.Failure("You do not have access to delete this task.", 403);
+            }
+
             task.IsDeleted = true;
             _db.Tasks.Update(task);
             await _db.SaveChangesAsync();
             return Result.Success(200);
         }
 
-        public async Task<Result<IEnumerable<TaskDto>>> GetTasksByUserIdAsync(long userId)
+        public async Task<Result<IEnumerable<TaskDto>>> GetTasksByUserIdAsync(long userId, string roleName, long currentUserId)
         {
+            if (!IsElevated(roleName) && userId != currentUserId)
+            {
+                return Result<IEnumerable<TaskDto>>.Failure("You do not have access to view these tasks.", 403);
+            }
+
             var userExists = await _db.Users.AnyAsync(u => u.Id == userId && !u.IsDeleted);
             if (!userExists)
             {
@@ -202,7 +216,7 @@ namespace TaskTrackingSystem.WebApi.Features.Task
             return Result<IEnumerable<TaskDto>>.Success(tasks);
         }
 
-        public async Task<Result> UpdateTaskStatusAsync(long id, long statusId, long? currentUserId = null)
+        public async Task<Result> UpdateTaskStatusAsync(long id, long statusId, string roleName, long currentUserId)
         {
             var task = await _db.Tasks.FirstOrDefaultAsync(t => t.Id == id && t.IsDeleted != true);
             if (task == null)
@@ -210,6 +224,11 @@ namespace TaskTrackingSystem.WebApi.Features.Task
                 return Result.Failure(ResultMessages.TaskNotFound(id), 404);
             }
 
+            if (!IsElevated(roleName) && task.AssignedTo != currentUserId && task.CreatedBy != currentUserId)
+            {
+                return Result.Failure("You do not have access to update this task.", 403);
+            }
+
             task.StatusId = statusId;
             task.UpdatedAt = DateTime.UtcNow;
             task.UpdatedBy = currentUserId;
@@ -219,5 +238,35 @@ namespace TaskTrackingSystem.WebApi.Features.Task
 
             return Result.Success(200);
         }
+
+        private IQueryable<TaskTrackingSystem.Database.AppDbContextModels.Task> BuildAccessibleTaskQuery(string roleName, long currentUserId)
+        {
+            var query = _db.Tasks.Where(t => t.IsDeleted != true);
+
+            if (IsElevated(roleName))
+            {
+                return query;
+            }
+
+            return query.Where(t =>
+                t.AssignedTo == currentUserId ||
+                t.CreatedBy == currentUserId);
+        }
+
+        private async Task<bool> CanEditTaskAsync(TaskTrackingSystem.Database.AppDbContextModels.Task task, long currentUserId)
+        {
+            if (task.CreatedBy == currentUserId || task.AssignedTo == currentUserId)
+            {
+                return true;
+            }
+
+            return await _db.ProjectMembers.AnyAsync(pm => pm.ProjectId == task.ProjectId && pm.UserId == currentUserId);
+        }
+
+        private static bool IsElevated(string roleName)
+        {
+            return roleName.Equals("Admin", StringComparison.OrdinalIgnoreCase) ||
+                   roleName.Equals("Manager", StringComparison.OrdinalIgnoreCase);
+        }
     }
 }

TaskTrackingSystem.WebApi/Features/User/UserService.cs

@@ -1,4 +1,5 @@
 using Microsoft.EntityFrameworkCore;
+using Microsoft.AspNetCore.Identity;
 using System;
 using System.Collections.Generic;
 using System.Linq;
@@ -13,10 +14,12 @@ namespace TaskTrackingSystem.WebApi.Features.User
     public class UserService
     {
         private readonly AppDbContext _db;
+        private readonly IPasswordHasher<TaskTrackingSystem.Database.AppDbContextModels.User> _passwordHasher;
 
-        public UserService(AppDbContext db)
+        public UserService(AppDbContext db, IPasswordHasher<TaskTrackingSystem.Database.AppDbContextModels.User> passwordHasher)
         {
             _db = db;
+            _passwordHasher = passwordHasher;
         }
 
         public async Task<IEnumerable<UserDto>> GetAllUsersAsync()
@@ -33,7 +36,7 @@ namespace TaskTrackingSystem.WebApi.Features.User
                     Phone = u.Phone,
                     RoleId = u.RoleId,
                     IsActive = u.IsActive,
-                    CreatedAt = (DateTime)u.CreatedAt
+                    CreatedAt = u.CreatedAt ?? DateTime.UtcNow
                 }).ToListAsync();
         }
 
@@ -54,7 +57,7 @@ namespace TaskTrackingSystem.WebApi.Features.User
                 Phone = user.Phone,
                 RoleId = user.RoleId,
                 IsActive = user.IsActive,
-                CreatedAt = (DateTime)user.CreatedAt
+                CreatedAt = user.CreatedAt ?? DateTime.UtcNow
             };
         }
 
@@ -77,15 +80,13 @@ namespace TaskTrackingSystem.WebApi.Features.User
                 return Result<UserDto>.Failure("Email is already registered.", 400);
             }
 
-            string fakePasswordHash = "HASHED_" + dto.Password;
-
             var user = new TaskTrackingSystem.Database.AppDbContextModels.User
             {
                 Username = dto.Username, 
                 FirstName = dto.FirstName,
                 LastName = dto.LastName,
                 Email = dto.Email,
-                PasswordHash = fakePasswordHash,
+                PasswordHash = string.Empty,
                 Phone = dto.Phone,
                 RoleId = dto.RoleId,
                 IsActive = true,
@@ -93,6 +94,8 @@ namespace TaskTrackingSystem.WebApi.Features.User
                 CreatedBy = currentUserId
             };
 
+            user.PasswordHash = _passwordHasher.HashPassword(user, dto.Password);
+
 
             _db.Users.Add(user);
             await _db.SaveChangesAsync();
@@ -159,4 +162,4 @@ namespace TaskTrackingSystem.WebApi.Features.User
             return Result.Success(200);
         }
     }
-}
+}

TaskTrackingSystem.WebApi/Infrastructure/ClaimsPrincipalExtensions.cs

@@ -0,0 +1,33 @@
+using System.Security.Claims;
+
+namespace TaskTrackingSystem.WebApi.Infrastructure;
+
+public static class ClaimsPrincipalExtensions
+{
+    public static long GetUserId(this ClaimsPrincipal user)
+    {
+        var value = user.FindFirstValue(ClaimTypes.NameIdentifier);
+        return long.TryParse(value, out var id) ? id : 0;
+    }
+
+    public static long GetRoleId(this ClaimsPrincipal user)
+    {
+        var value = user.FindFirstValue("role_id");
+        return long.TryParse(value, out var id) ? id : 0;
+    }
+
+    public static string GetRoleName(this ClaimsPrincipal user)
+    {
+        return user.FindFirstValue(ClaimTypes.Role) ?? string.Empty;
+    }
+
+    public static bool IsAdmin(this ClaimsPrincipal user)
+    {
+        return user.IsInRole("Admin");
+    }
+
+    public static bool IsManager(this ClaimsPrincipal user)
+    {
+        return user.IsInRole("Manager");
+    }
+}

TaskTrackingSystem.WebApi/Program.cs

@@ -1,5 +1,6 @@
 using Microsoft.EntityFrameworkCore;
 using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Identity;
 using TaskTrackingSystem.Database.AppDbContextModels;
 using Microsoft.AspNetCore.Authentication.JwtBearer;
 using System.Text;
@@ -29,6 +30,7 @@ builder.Services.AddScoped<TaskTrackingSystem.WebApi.Features.Task.TaskService>(
 builder.Services.AddScoped<TaskTrackingSystem.WebApi.Features.Dashboard.DashboardService>();
 builder.Services.AddScoped<TaskTrackingSystem.WebApi.Features.Report.ReportService>();
 builder.Services.AddScoped<TaskTrackingSystem.WebApi.Features.Menu.MenuService>();
+builder.Services.AddScoped<IPasswordHasher<TaskTrackingSystem.Database.AppDbContextModels.User>, PasswordHasher<TaskTrackingSystem.Database.AppDbContextModels.User>>();
 // Learn more about configuring Swagger/OpenAPI at https://aka.ms/aspnetcore/swashbuckle
 builder.Services.AddAuthorization();
 builder.Services.AddEndpointsApiExplorer();
@@ -40,7 +42,7 @@ builder.Services.AddAuthentication(options =>
 }).AddJwtBearer(options =>
 {
     var jwtSettings = builder.Configuration.GetSection("JwtSettings");
-    var key = jwtSettings["Key"];
+    var key = jwtSettings["Key"] ?? "SUPER_SECRET_KEY_THAT_IS_LONG_ENOUGH_12345";
     options.TokenValidationParameters = new TokenValidationParameters
     {
         ValidateIssuer = true,

TaskTrackingSystem.WebApi/appsettings.json

@@ -11,7 +11,10 @@
     "Issuer": "TaskTrackingSystem",
     "Audience": "Users"
   },
+  "PasswordReset": {
+    "RecoveryCode": "TASKIFY-RESET-2026"
+  },
   "ConnectionStrings": {
     "DefaultConnection": "Server=.;Database=TTS;Trusted_Connection=True;TrustServerCertificate=True;Connect Timeout=5;"
   }
-}
+}

TaskTrackingSystem.WebApp/AccountEndpoints.cs

@@ -15,8 +15,9 @@ public static class AccountEndpoints
     {
         app.MapPost("/account/login", LoginAsync);
         app.MapPost("/account/register", RegisterAsync);
-        app.MapGet("/account/logout", (Delegate)LogoutAsync);
-        app.MapPost("/account/logout", (Delegate)LogoutAsync);
+        app.MapPost("/account/reset-password", ResetPasswordAsync);
+        app.MapGet("/account/logout", LogoutAsync);
+        app.MapPost("/account/logout", LogoutAsync);
     }
 
     private static async Task<IResult> LoginAsync(
@@ -155,10 +156,57 @@ public static class AccountEndpoints
         return Results.Redirect($"/register?error={Uri.EscapeDataString(errorMessage)}");
     }
 
-    private static async Task<IResult> LogoutAsync(HttpContext context)
+    private static async Task<IResult> ResetPasswordAsync(
+        HttpContext context,
+        IHttpClientFactory httpClientFactory,
+        [FromForm] ResetPasswordDto resetPasswordDto)
+    {
+        HttpResponseMessage response;
+        try
+        {
+            var client = httpClientFactory.CreateClient("WebApi");
+            response = await client.PostAsJsonAsync("Auth/reset-password", resetPasswordDto);
+        }
+        catch (Exception ex) when (ex is HttpRequestException or TaskCanceledException or TimeoutException)
+        {
+            return Results.Redirect($"/reset-password?error={Uri.EscapeDataString("Unable to reach the API server. Please ensure TaskTrackingSystem.WebApi is running.")}");
+        }
+
+        if (response.IsSuccessStatusCode)
+        {
+            var result = await response.Content.ReadFromJsonAsync<Result>(Serialization.CaseInsensitive);
+            if (result?.IsSuccess == true)
+            {
+                return Results.Redirect("/login?reset=true");
+            }
+        }
+
+        var errorMessage = "Failed to reset password.";
+        if (response.Content != null)
+        {
+            try
+            {
+                var contentString = await response.Content.ReadAsStringAsync();
+                var result = JsonSerializer.Deserialize<Result>(contentString, Serialization.CaseInsensitive);
+                if (result != null && !string.IsNullOrWhiteSpace(result.ErrorMessage))
+                {
+                    errorMessage = result.ErrorMessage;
+                }
+            }
+            catch
+            {
+                // Keep default error message.
+            }
+        }
+
+        return Results.Redirect($"/reset-password?error={Uri.EscapeDataString(errorMessage)}");
+    }
+
+    private static async Task<IResult> LogoutAsync(HttpContext context, UserSessionState sessionState)
     {
         await context.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
         context.Response.Cookies.Delete(CookieAuthenticationDefaults.AuthenticationScheme);
+        sessionState.ClearSession();
         return Results.Redirect("/login?loggedOut=true");
     }
 
@@ -175,6 +223,11 @@ public static class AccountEndpoints
             claims.Add(new Claim(ClaimTypes.Role, authResult.RoleName));
         }
 
+        if (authResult.RoleId > 0)
+        {
+            claims.Add(new Claim("role_id", authResult.RoleId.ToString()));
+        }
+
         var userId = TryGetUserIdFromJwt(authResult.Token);
         if (!string.IsNullOrWhiteSpace(userId))
         {

TaskTrackingSystem.WebApp/Components/CustomAuthenticationStateProvider.cs

@@ -48,5 +48,18 @@ public class CustomAuthenticationStateProvider : AuthenticationStateProvider
         {
             _sessionState.Token = token;
         }
+
+        var roleId = user.FindFirst("role_id")?.Value;
+        if (!string.IsNullOrWhiteSpace(roleId))
+        {
+            _sessionState.CachedMenuRoleId = $"id:{roleId}";
+            return;
+        }
+
+        var roleName = user.FindFirst(System.Security.Claims.ClaimTypes.Role)?.Value;
+        if (!string.IsNullOrWhiteSpace(roleName))
+        {
+            _sessionState.CachedMenuRoleId = $"name:{roleName}";
+        }
     }
 }

TaskTrackingSystem.WebApp/Components/Layout/MainLayout.razor

@@ -135,8 +135,8 @@
             return;
         }
 
-        await MenuAuthorization.GetUserMenusAsync(user);
-        isAuthorizedPage = MenuAuthorization.IsRouteAllowed(user, relativePath);
+        var menus = await MenuAuthorization.GetUserMenusAsync(user);
+        isAuthorizedPage = MenuAuthorization.IsRouteAllowed(menus, relativePath);
         await InvokeAsync(StateHasChanged);
     }
 

TaskTrackingSystem.WebApp/Components/Layout/NavMenu.razor

@@ -1,4 +1,6 @@
+@using Microsoft.AspNetCore.Components
 @using Microsoft.AspNetCore.Components.Authorization
+@using Microsoft.AspNetCore.Components.Routing
 @using TaskTrackingSystem.Shared.Models.Menu
 @using Microsoft.JSInterop
 @implements IDisposable
@@ -7,25 +9,16 @@
 @inject NavigationManager Navigation
 @inject IJSRuntime JS
 
-
 <nav class="flex-1 space-y-1 px-4 py-6 overflow-y-auto">
     @if (menus.Any())
     {
         @foreach (var menu in menus)
         {
-            @if (menu.SubMenus != null && menu.SubMenus.Count > 0)
+            if (menu.SubMenus != null && menu.SubMenus.Count > 0)
             {
-                <!-- Parent with sub-menus: collapsible dropdown -->
                 <button class="nav-dropdown-toggle @(IsMenuGroupExpanded(menu.MenuCode) ? "expanded" : "")"
                         @onclick="() => ToggleMenuGroup(menu.MenuCode)">
-                    @if (!string.IsNullOrEmpty(menu.Icon))
-                    {
-                        <i data-lucide="@menu.Icon" class="h-4 w-4 mr-3 text-slate-400 shrink-0"></i>
-                    }
-                    else
-                    {
-                        <i data-lucide="circle" class="h-4 w-4 mr-3 text-slate-400 shrink-0"></i>
-                    }
+                    @RenderIcon(menu.Icon)
                     <span class="flex-1 text-left">@menu.MenuName</span>
                     <i data-lucide="chevron-down" class="nav-chevron h-4 w-4 text-slate-400 shrink-0"></i>
                 </button>
@@ -37,14 +30,7 @@
                             <NavLink class="nav-link-item nav-child-item"
                                      href="@MenuAuthorizationService.NormalizeMenuHref(sub.MenuUrl)"
                                      Match="@GetNavLinkMatch(sub.MenuUrl)">
-                                @if (!string.IsNullOrEmpty(sub.Icon))
-                                {
-                                    <i data-lucide="@sub.Icon" class="h-3.5 w-3.5 mr-3 text-slate-400 shrink-0"></i>
-                                }
-                                else
-                                {
-                                    <i data-lucide="circle" class="h-3.5 w-3.5 mr-3 text-slate-400 shrink-0"></i>
-                                }
+                                @RenderSmallIcon(sub.Icon)
                                 <span>@sub.MenuName</span>
                             </NavLink>
                         }
@@ -53,70 +39,27 @@
             }
             else
             {
-                <!-- Simple nav link -->
                 <NavLink class="nav-link-item"
                          href="@MenuAuthorizationService.NormalizeMenuHref(menu.MenuUrl)"
                          Match="@(string.IsNullOrWhiteSpace(menu.MenuUrl) || menu.MenuUrl.Trim('/') is "dashboard" or "" ? NavLinkMatch.All : NavLinkMatch.Prefix)">
-                    @if (!string.IsNullOrEmpty(menu.Icon))
-                    {
-                        <i data-lucide="@menu.Icon" class="h-4 w-4 mr-3 text-slate-400 shrink-0"></i>
-                    }
-                    else
-                    {
-                        <i data-lucide="circle" class="h-4 w-4 mr-3 text-slate-400 shrink-0"></i>
-                    }
+                    @RenderIcon(menu.Icon)
                     <span>@menu.MenuName</span>
                 </NavLink>
             }
         }
     }
-    else if (showRoleFallback)
+    else
     {
-        @foreach (var link in fallbackLinks)
-        {
-            @if (link.Children != null && link.Children.Count > 0)
-            {
-                <!-- Fallback parent with children: collapsible dropdown -->
-                <button class="nav-dropdown-toggle @(IsFallbackGroupExpanded(link.Label) ? "expanded" : "")"
-                        @onclick="() => ToggleFallbackGroup(link.Label)">
-                    <i data-lucide="@link.Icon" class="h-4 w-4 mr-3 text-slate-400 shrink-0"></i>
-                    <span class="flex-1 text-left">@link.Label</span>
-                    <i data-lucide="chevron-down" class="nav-chevron h-4 w-4 text-slate-400 shrink-0"></i>
-                </button>
-                @if (IsFallbackGroupExpanded(link.Label))
-                {
-                    <div class="nav-dropdown-children">
-                        @foreach (var child in link.Children)
-                        {
-                            <NavLink class="nav-link-item nav-child-item"
-                                     href="@child.Href" Match="@child.Match">
-                                <i data-lucide="@child.Icon" class="h-3.5 w-3.5 mr-3 text-slate-400 shrink-0"></i>
-                                <span>@child.Label</span>
-                            </NavLink>
-                        }
-                    </div>
-                }
-            }
-            else
-            {
-                <!-- Simple fallback link -->
-                <NavLink class="nav-link-item"
-                         href="@link.Href" Match="@link.Match">
-                    <i data-lucide="@link.Icon" class="h-4 w-4 mr-3 text-slate-400 shrink-0"></i>
-                    <span>@link.Label</span>
-                </NavLink>
-            }
-        }
+        <div class="px-4 py-6 text-xs text-slate-400">
+            No menu items are available for this role.
+        </div>
     }
 </nav>
 
 @code {
     private List<MenuDto> menus = new();
-    private bool showRoleFallback;
-    private List<FallbackLink> fallbackLinks = new();
     private string currentPath = string.Empty;
     private HashSet<string> expandedMenuGroups = new();
-    private HashSet<string> expandedFallbackGroups = new();
 
     protected override async Task OnInitializedAsync()
     {
@@ -130,33 +73,14 @@
 
             if (user.Identity?.IsAuthenticated == true)
             {
-                fallbackLinks = BuildFallbackLinks(user);
-                showRoleFallback = fallbackLinks.Count > 0;
-
-                // Auto-expand fallback groups whose children match the current route
-                foreach (var link in fallbackLinks)
-                {
-                    if (link.Children != null && IsFallbackExpanded(link.Children))
-                    {
-                        expandedFallbackGroups.Add(link.Label);
-                    }
-                }
-
                 menus = await MenuAuthorization.GetUserMenusAsync(user);
-                if (menus.Count > 0)
-                {
-                    showRoleFallback = false;
-
-                    // Build URL-based hierarchy for menus that have no SubMenus from the API
-                    BuildUrlHierarchy(menus);
+                BuildUrlHierarchy(menus);
 
-                    // Auto-expand dynamic menu groups whose sub-menus match the current route
-                    foreach (var menu in menus)
+                foreach (var menu in menus)
+                {
+                    if (menu.SubMenus != null && menu.SubMenus.Count > 0 && IsMenuExpanded(menu.MenuCode, menu.SubMenus))
                     {
-                        if (menu.SubMenus != null && menu.SubMenus.Count > 0 && IsMenuExpanded(menu.MenuCode, menu.SubMenus))
-                        {
-                            expandedMenuGroups.Add(menu.MenuCode);
-                        }
+                        expandedMenuGroups.Add(menu.MenuCode);
                     }
                 }
             }
@@ -171,14 +95,6 @@
     {
         currentPath = Navigation.ToBaseRelativePath(e.Location).Trim('/');
 
-        // Auto-expand groups on navigation
-        foreach (var link in fallbackLinks)
-        {
-            if (link.Children != null && IsFallbackExpanded(link.Children))
-            {
-                expandedFallbackGroups.Add(link.Label);
-            }
-        }
         foreach (var menu in menus)
         {
             if (menu.SubMenus != null && menu.SubMenus.Count > 0 && IsMenuExpanded(menu.MenuCode, menu.SubMenus))
@@ -190,21 +106,15 @@
         InvokeAsync(StateHasChanged);
     }
 
-    // Toggle helpers
     private void ToggleMenuGroup(string menuCode)
     {
         if (!expandedMenuGroups.Remove(menuCode))
+        {
             expandedMenuGroups.Add(menuCode);
-    }
-
-    private void ToggleFallbackGroup(string label)
-    {
-        if (!expandedFallbackGroups.Remove(label))
-            expandedFallbackGroups.Add(label);
+        }
     }
 
     private bool IsMenuGroupExpanded(string menuCode) => expandedMenuGroups.Contains(menuCode);
-    private bool IsFallbackGroupExpanded(string label) => expandedFallbackGroups.Contains(label);
 
     private bool IsMenuExpanded(string menuCode, IEnumerable<MenuDto> subMenus)
     {
@@ -213,12 +123,6 @@
             currentPath.StartsWith(s.MenuUrl.Trim('/'), StringComparison.OrdinalIgnoreCase));
     }
 
-    private bool IsFallbackExpanded(IEnumerable<FallbackLink> children)
-    {
-        return children.Any(c =>
-            currentPath.StartsWith(c.Href.TrimStart('/'), StringComparison.OrdinalIgnoreCase));
-    }
-
     private static NavLinkMatch GetNavLinkMatch(string? menuUrl)
     {
         return string.IsNullOrWhiteSpace(menuUrl) || menuUrl.Trim('/') is "dashboard" or ""
@@ -226,12 +130,6 @@
             : NavLinkMatch.Prefix;
     }
 
-    /// <summary>
-    /// Post-processes a flat menu list: if a parent menu (e.g. /reports) has no SubMenus
-    /// but other top-level items share that URL prefix (e.g. /reports/employees),
-    /// nest them as SubMenus and remove from the top-level list.
-    /// Also injects known report sub-pages if the Reports menu has no children.
-    /// </summary>
     private static void BuildUrlHierarchy(List<MenuDto> menuList)
     {
         var toRemove = new List<MenuDto>();
@@ -239,17 +137,21 @@
         foreach (var parent in menuList)
         {
             if (string.IsNullOrWhiteSpace(parent.MenuUrl))
+            {
                 continue;
+            }
 
-            // Only process parents that don't already have SubMenus from the API
             if (parent.SubMenus != null && parent.SubMenus.Count > 0)
+            {
                 continue;
+            }
 
             var parentPath = parent.MenuUrl.Trim('/');
             if (string.IsNullOrEmpty(parentPath))
+            {
                 continue;
+            }
 
-            // Find other top-level items whose URL starts with this parent's URL + "/"
             var children = menuList
                 .Where(m => m != parent
                     && !string.IsNullOrWhiteSpace(m.MenuUrl)
@@ -268,99 +170,23 @@
         {
             menuList.Remove(item);
         }
-
-        // Inject known report sub-pages if the Reports menu exists but still has no children
-        var reportsMenu = menuList.FirstOrDefault(m =>
-            !string.IsNullOrWhiteSpace(m.MenuUrl) &&
-            m.MenuUrl.Trim('/').Equals("reports", StringComparison.OrdinalIgnoreCase));
-
-        if (reportsMenu != null && (reportsMenu.SubMenus == null || reportsMenu.SubMenus.Count == 0))
-        {
-            reportsMenu.SubMenus = new List<MenuDto>
-            {
-                new() { MenuCode = "RPT_EMP", MenuName = "Employee Report",   MenuUrl = "/reports/employees",  Icon = "users",        OrderNo = 1 },
-                new() { MenuCode = "RPT_PRJ", MenuName = "Project Progress",   MenuUrl = "/reports/projects",   Icon = "folder-kanban", OrderNo = 2 },
-                new() { MenuCode = "RPT_TSK", MenuName = "Task Report",         MenuUrl = "/reports/tasks",      Icon = "check-square",  OrderNo = 3 },
-                new() { MenuCode = "RPT_OVD", MenuName = "Overdue Tasks",       MenuUrl = "/reports/overdue",    Icon = "alert-circle",  OrderNo = 4 },
-                new() { MenuCode = "RPT_TMS", MenuName = "Time Tracking",       MenuUrl = "/reports/timesheet",  Icon = "clock",         OrderNo = 5 }
-            };
-        }
-
-        // Inject known project sub-pages if the Projects menu exists but still has no children
-        var projectsMenu = menuList.FirstOrDefault(m =>
-            !string.IsNullOrWhiteSpace(m.MenuUrl) &&
-            m.MenuUrl.Trim('/').Equals("projects", StringComparison.OrdinalIgnoreCase));
-
-        if (projectsMenu != null && (projectsMenu.SubMenus == null || projectsMenu.SubMenus.Count == 0))
-        {
-            projectsMenu.SubMenus = new List<MenuDto>
-            {
-                new() { MenuCode = "PRJ_ALL", MenuName = "All Projects", MenuUrl = "/projects/all", Icon = "folder-kanban", OrderNo = 1 },
-                new() { MenuCode = "PRJ_ASN", MenuName = "Project Assign", MenuUrl = "/projects/assign", Icon = "user-plus", OrderNo = 2 }
-            };
-        }
-
-        // Inject known task sub-pages if the Tasks menu exists but still has no children
-        var tasksMenu = menuList.FirstOrDefault(m =>
-            !string.IsNullOrWhiteSpace(m.MenuUrl) &&
-            m.MenuUrl.Trim('/').Equals("tasks", StringComparison.OrdinalIgnoreCase));
-
-        if (tasksMenu != null && (tasksMenu.SubMenus == null || tasksMenu.SubMenus.Count == 0))
-        {
-            tasksMenu.SubMenus = new List<MenuDto>
-            {
-                new() { MenuCode = "TSK_ALL", MenuName = "All Tasks", MenuUrl = "/tasks/all", Icon = "check-square", OrderNo = 1 },
-                new() { MenuCode = "TSK_ASN", MenuName = "Task Assign", MenuUrl = "/tasks/assign", Icon = "user-check", OrderNo = 2 }
-            };
-        }
     }
 
-    private static List<FallbackLink> BuildFallbackLinks(System.Security.Claims.ClaimsPrincipal user)
+    private static RenderFragment RenderIcon(string? icon) => builder =>
     {
-        var role = user.FindFirst(System.Security.Claims.ClaimTypes.Role)?.Value ?? "Member";
-        var projectChildren = new List<FallbackLink>
-        {
-            new("/projects/all", "All Projects", "folder-kanban", NavLinkMatch.Prefix)
-        };
-        var taskChildren = new List<FallbackLink>
-        {
-            new("/tasks/all", "All Tasks", "check-square", NavLinkMatch.Prefix)
-        };
+        builder.OpenElement(0, "i");
+        builder.AddAttribute(1, "data-lucide", string.IsNullOrWhiteSpace(icon) ? "circle" : icon);
+        builder.AddAttribute(2, "class", "h-4 w-4 mr-3 text-slate-400 shrink-0");
+        builder.CloseElement();
+    };
 
-        if (role.Equals("Admin", StringComparison.OrdinalIgnoreCase))
-        {
-            projectChildren.Add(new("/projects/assign", "Project Assign", "user-plus", NavLinkMatch.Prefix));
-            taskChildren.Add(new("/tasks/assign", "Task Assign", "user-check", NavLinkMatch.Prefix));
-        }
-
-        var links = new List<FallbackLink>
-        {
-            new("/dashboard", "Dashboard", "layout-dashboard", NavLinkMatch.All),
-            new FallbackLink("/projects", "Projects", "folder-kanban", NavLinkMatch.Prefix, projectChildren),
-            new FallbackLink("/tasks", "Tasks", "check-square", NavLinkMatch.Prefix, taskChildren)
-        };
-
-        if (role.Equals("Admin", StringComparison.OrdinalIgnoreCase))
-        {
-            links.Add(new FallbackLink(
-                "/reports",
-                "Reports",
-                "bar-chart-3",
-                NavLinkMatch.Prefix,
-                new List<FallbackLink>
-                {
-                    new("/reports/employees", "Employee Report",  "users",         NavLinkMatch.Prefix),
-                    new("/reports/projects",  "Project Progress",  "folder-kanban", NavLinkMatch.Prefix),
-                    new("/reports/tasks",     "Task Report",       "check-square",  NavLinkMatch.Prefix),
-                    new("/reports/overdue",   "Overdue Tasks",     "alert-circle",  NavLinkMatch.Prefix),
-                    new("/reports/timesheet", "Time Tracking",     "clock",         NavLinkMatch.Prefix)
-                }));
-            links.Add(new("/roles", "Roles", "shield-check", NavLinkMatch.Prefix));
-            links.Add(new("/users", "Users", "users", NavLinkMatch.Prefix));
-        }
-
-        return links;
-    }
+    private static RenderFragment RenderSmallIcon(string? icon) => builder =>
+    {
+        builder.OpenElement(0, "i");
+        builder.AddAttribute(1, "data-lucide", string.IsNullOrWhiteSpace(icon) ? "circle" : icon);
+        builder.AddAttribute(2, "class", "h-3.5 w-3.5 mr-3 text-slate-400 shrink-0");
+        builder.CloseElement();
+    };
 
     protected override async Task OnAfterRenderAsync(bool firstRender)
     {
@@ -370,7 +196,6 @@
         }
         catch
         {
-            // Ignore JS errors during prerendering or if JS is not available yet
         }
     }
 
@@ -378,11 +203,4 @@
     {
         Navigation.LocationChanged -= OnLocationChanged;
     }
-
-    private sealed record FallbackLink(
-        string Href,
-        string Label,
-        string Icon,
-        NavLinkMatch Match,
-        List<FallbackLink>? Children = null);
 }

TaskTrackingSystem.WebApp/Components/Pages/Login.razor

@@ -19,6 +19,9 @@
                 Or
                 <a href="/register" class="font-medium text-slate-900 hover:underline">register a new account</a>
             </p>
+            <p class="mt-2 text-center text-sm text-slate-600">
+                <a href="/reset-password" class="font-medium text-violet-600 hover:underline">reset your password</a>
+            </p>
         </div>
 
         <form method="post" action="/account/login" class="mt-8 space-y-6">
@@ -68,6 +71,12 @@
                     <p class="text-sm text-emerald-700 text-center">You have been signed out successfully.</p>
                 </div>
             }
+            else if (ShowResetMessage)
+            {
+                <div class="p-3 rounded-lg bg-emerald-50 border border-emerald-100">
+                    <p class="text-sm text-emerald-700 text-center">Password updated successfully. Please sign in with your new password.</p>
+                </div>
+            }
 
             <div>
                 <button type="submit" class="group relative flex w-full justify-center rounded-lg bg-violet-600 px-4 py-2.5 text-sm font-medium text-white hover:bg-violet-700 transition-colors shadow-sm">
@@ -88,9 +97,13 @@
     [SupplyParameterFromQuery(Name = "loggedOut")]
     private string? LoggedOut { get; set; }
 
+    [SupplyParameterFromQuery(Name = "reset")]
+    private string? Reset { get; set; }
+
     private bool ShowError => string.Equals(Error, "invalid", StringComparison.OrdinalIgnoreCase);
     private bool ShowUnavailableError => string.Equals(Error, "unavailable", StringComparison.OrdinalIgnoreCase);
     private bool ShowLoggedOutMessage => string.Equals(LoggedOut, "true", StringComparison.OrdinalIgnoreCase);
+    private bool ShowResetMessage => string.Equals(Reset, "true", StringComparison.OrdinalIgnoreCase);
 
     protected override async Task OnAfterRenderAsync(bool firstRender)
     {

TaskTrackingSystem.WebApp/Components/Pages/Projects.razor

@@ -391,23 +391,7 @@
         var client = ApiClient.CreateClient();
         try
         {
-            var all = await client.GetFromJsonAsync<List<ProjectDto>>("Project", Serialization.CaseInsensitive) ?? new();
-            if (!isAdmin && currentUserId > 0)
-            {
-                // Non-admin: only show projects they're a member of
-                var memberProjectIds = new HashSet<long>();
-                foreach (var p in all)
-                {
-                    var membersResult = await client.GetFromJsonAsync<Result<IEnumerable<UserDto>>>($"Project/{p.Id}/members", Serialization.CaseInsensitive);
-                    if (membersResult?.Value?.Any(m => m.Id == currentUserId) == true)
-                        memberProjectIds.Add(p.Id);
-                }
-                projects = all.Where(p => memberProjectIds.Contains(p.Id)).ToList();
-            }
-            else
-            {
-                projects = all;
-            }
+            projects = await client.GetFromJsonAsync<List<ProjectDto>>("Project", Serialization.CaseInsensitive) ?? new();
         }
         catch (Exception ex)
         {

TaskTrackingSystem.WebApp/Components/Pages/Reports.razor

@@ -1,292 +0,0 @@
-@page "/reports"
-@using Microsoft.AspNetCore.Authorization
-@rendermode @(new InteractiveServerRenderMode(prerender: false))
-@attribute [Microsoft.AspNetCore.Authorization.Authorize]
-@inject ApiClientService ApiClient
-@inject IJSRuntime JS
-@inject AuthenticationStateProvider AuthStateProvider
-@inject MenuAuthorizationService MenuAuthorization
-@inject NavigationManager Navigation
-
-<PageTitle>Reports</PageTitle>
-
-<div class="space-y-8">
-    <!-- Page Header -->
-    <div>
-        <h2 class="text-3xl font-bold tracking-tight text-slate-900">Reports</h2>
-        <p class="text-slate-500 mt-1">Analytics, task reports, and user productivity.</p>
-    </div>
-
-    <!-- Task Report Section -->
-    <div class="rounded-xl border border-slate-200 bg-white shadow-sm overflow-hidden">
-        <div class="px-6 py-4 border-b border-slate-100">
-            <h3 class="font-semibold text-lg text-slate-900">Task Report</h3>
-        </div>
-
-        <!-- Filters -->
-        <div class="px-6 py-4 bg-slate-50/50 border-b border-slate-100">
-            <div class="flex flex-wrap items-end gap-4">
-                <div>
-                    <label class="block text-xs font-medium text-slate-500 mb-1">Start Date</label>
-                    <input @bind="filterStartDate" type="date" class="rounded-lg border border-slate-200 px-3 py-1.5 text-sm text-slate-900 focus:outline-none focus:ring-2 focus:ring-slate-900 focus:border-transparent transition-all" />
-                </div>
-                <div>
-                    <label class="block text-xs font-medium text-slate-500 mb-1">End Date</label>
-                    <input @bind="filterEndDate" type="date" class="rounded-lg border border-slate-200 px-3 py-1.5 text-sm text-slate-900 focus:outline-none focus:ring-2 focus:ring-slate-900 focus:border-transparent transition-all" />
-                </div>
-                <div>
-                    <label class="block text-xs font-medium text-slate-500 mb-1">Status</label>
-                    <select @bind="filterStatus" class="rounded-lg border border-slate-200 px-3 py-1.5 text-sm text-slate-900 focus:outline-none focus:ring-2 focus:ring-slate-900 focus:border-transparent transition-all">
-                        <option value="">All</option>
-                        <option value="1">To Do</option>
-                        <option value="2">In Progress</option>
-                        <option value="3">Done</option>
-                    </select>
-                </div>
-                <div>
-                    <label class="block text-xs font-medium text-slate-500 mb-1">Project</label>
-                    <select @bind="filterProjectId" class="rounded-lg border border-slate-200 px-3 py-1.5 text-sm text-slate-900 focus:outline-none focus:ring-2 focus:ring-slate-900 focus:border-transparent transition-all">
-                        <option value="0">All Projects</option>
-                        @foreach (var p in projects)
-                        {
-                            <option value="@p.Id">@p.Name</option>
-                        }
-                    </select>
-                </div>
-                <button @onclick="LoadTaskReport" class="inline-flex items-center rounded-lg bg-violet-600 px-4 py-1.5 text-sm font-medium text-white hover:bg-violet-700 transition-colors">
-                    <i data-lucide="search" class="h-3.5 w-3.5 mr-1.5"></i>
-                    Search
-                </button>
-                <button @onclick="ResetFilters" class="inline-flex items-center rounded-lg border border-slate-200 bg-white px-4 py-1.5 text-sm font-medium text-slate-700 hover:bg-slate-50 transition-colors">
-                    <i data-lucide="rotate-ccw" class="h-3.5 w-3.5 mr-1.5 text-slate-500"></i>
-                    Reset
-                </button>
-            </div>
-        </div>
-
-        <!-- Task Report Table -->
-        <div class="overflow-x-auto">
-            @if (isLoadingTasks)
-            {
-                <div class="flex items-center justify-center py-12">
-                    <svg class="animate-spin h-5 w-5 text-slate-400" viewBox="0 0 24 24"><circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4" fill="none"></circle><path class="opacity-75" fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4z"></path></svg>
-                </div>
-            }
-            else
-            {
-                <table class="w-full">
-                    <thead>
-                        <tr class="border-b border-slate-100 bg-slate-50/60">
-                            <th class="px-6 py-3 text-left text-xs font-semibold text-slate-500 uppercase tracking-wider">Task</th>
-                            <th class="px-6 py-3 text-left text-xs font-semibold text-slate-500 uppercase tracking-wider">Project</th>
-                            <th class="px-6 py-3 text-left text-xs font-semibold text-slate-500 uppercase tracking-wider">Status</th>
-                            <th class="px-6 py-3 text-left text-xs font-semibold text-slate-500 uppercase tracking-wider">Priority</th>
-                            <th class="px-6 py-3 text-left text-xs font-semibold text-slate-500 uppercase tracking-wider">Assigned To</th>
-                            <th class="px-6 py-3 text-left text-xs font-semibold text-slate-500 uppercase tracking-wider">Due Date</th>
-                        </tr>
-                    </thead>
-                    <tbody class="divide-y divide-slate-100">
-                        @if (taskReports.Any())
-                        {
-                            @foreach (var t in taskReports)
-                            {
-                                <tr class="hover:bg-slate-50/50 transition-colors">
-                                    <td class="px-6 py-3 text-sm font-medium text-slate-900">@t.Title</td>
-                                    <td class="px-6 py-3 text-sm text-slate-500">@t.ProjectName</td>
-                                    <td class="px-6 py-3">
-                                        <span class="inline-flex items-center px-2 py-0.5 rounded-full text-xs font-medium @GetStatusBadge(t.StatusId)">@t.StatusName</span>
-                                    </td>
-                                    <td class="px-6 py-3">
-                                        <span class="inline-flex items-center px-2 py-0.5 rounded-full text-xs font-medium @GetPriorityBadge(t.PriorityId)">@t.PriorityName</span>
-                                    </td>
-                                    <td class="px-6 py-3 text-sm text-slate-500">@(t.AssignedToUser ?? "Unassigned")</td>
-                                    <td class="px-6 py-3 text-sm text-slate-500">@t.DueDate.ToString("dd-MMM-yyyy")</td>
-                                </tr>
-                            }
-                        }
-                        else
-                        {
-                            <tr>
-                                <td colspan="6" class="px-6 py-12 text-center">
-                                    <i data-lucide="file-search" class="h-10 w-10 mx-auto text-slate-300 mb-3"></i>
-                                    <p class="text-sm text-slate-400">No tasks found. Adjust filters and try again.</p>
-                                </td>
-                            </tr>
-                        }
-                    </tbody>
-                </table>
-            }
-        </div>
-    </div>
-
-    <!-- User Productivity Section -->
-    <div class="rounded-xl border border-slate-200 bg-white shadow-sm overflow-hidden">
-        <div class="px-6 py-4 border-b border-slate-100">
-            <h3 class="font-semibold text-lg text-slate-900">User Productivity</h3>
-        </div>
-
-        @if (isLoadingProductivity)
-        {
-            <div class="flex items-center justify-center py-12">
-                <svg class="animate-spin h-5 w-5 text-slate-400" viewBox="0 0 24 24"><circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4" fill="none"></circle><path class="opacity-75" fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4z"></path></svg>
-            </div>
-        }
-        else
-        {
-            <table class="w-full">
-                <thead>
-                    <tr class="border-b border-slate-100 bg-slate-50/60">
-                        <th class="px-6 py-3 text-left text-xs font-semibold text-slate-500 uppercase tracking-wider">User</th>
-                        <th class="px-6 py-3 text-left text-xs font-semibold text-slate-500 uppercase tracking-wider">Total Assigned</th>
-                        <th class="px-6 py-3 text-left text-xs font-semibold text-slate-500 uppercase tracking-wider">Completed</th>
-                        <th class="px-6 py-3 text-left text-xs font-semibold text-slate-500 uppercase tracking-wider">Efficiency</th>
-                    </tr>
-                </thead>
-                <tbody class="divide-y divide-slate-100">
-                    @if (productivityList.Any())
-                    {
-                        @foreach (var u in productivityList)
-                        {
-                            <tr class="hover:bg-slate-50/50 transition-colors">
-                                <td class="px-6 py-4">
-                                    <div class="flex items-center space-x-3">
-                                        <span class="flex h-8 w-8 items-center justify-center rounded-full bg-slate-100 text-slate-700 font-semibold text-xs">
-                                            @(u.FullName.Length > 0 ? u.FullName[0].ToString().ToUpper() : "U")
-                                        </span>
-                                        <div>
-                                            <p class="text-sm font-semibold text-slate-900">@u.FullName</p>
-                                            <p class="text-xs text-slate-400">@@@u.Username</p>
-                                        </div>
-                                    </div>
-                                </td>
-                                <td class="px-6 py-4 text-sm font-medium text-slate-900">@u.TotalAssignedTasks</td>
-                                <td class="px-6 py-4 text-sm font-medium text-emerald-600">@u.CompletedTasksCount</td>
-                                <td class="px-6 py-4">
-                                    <div class="flex items-center space-x-3">
-                                        <div class="flex-1 h-2 rounded-full bg-slate-100 overflow-hidden max-w-[120px]">
-                                            <div class="h-full rounded-full bg-slate-900 transition-all" style="width: @(Math.Min(u.EfficiencyRatio, 100))%"></div>
-                                        </div>
-                                        <span class="text-sm font-medium text-slate-700">@u.EfficiencyRatio.ToString("F0")%</span>
-                                    </div>
-                                </td>
-                            </tr>
-                        }
-                    }
-                    else
-                    {
-                        <tr>
-                            <td colspan="4" class="px-6 py-12 text-center">
-                                <p class="text-sm text-slate-400">No productivity data available.</p>
-                            </td>
-                        </tr>
-                    }
-                </tbody>
-            </table>
-        }
-    </div>
-</div>
-
-@code {
-    private bool isLoadingTasks = true;
-    private bool isLoadingProductivity = true;
-    private List<TaskReportDto> taskReports = new();
-    private List<UserProductivityDto> productivityList = new();
-    private List<ProjectDto> projects = new();
-
-    // Filters
-    private DateTime? filterStartDate;
-    private DateTime? filterEndDate;
-    private string? filterStatus;
-    private int filterProjectId;
-
-    protected override async Task OnInitializedAsync()
-    {
-        var client = ApiClient.CreateClient();
-        try
-        {
-            projects = await client.GetFromJsonAsync<List<ProjectDto>>("Project", Serialization.CaseInsensitive) ?? new();
-        }
-        catch { }
-
-        await System.Threading.Tasks.Task.WhenAll(LoadTaskReport(), LoadProductivity());
-    }
-
-    protected override async Task OnAfterRenderAsync(bool firstRender)
-    {
-        await JS.InvokeVoidAsync("initIcons");
-    }
-
-    private async Task LoadTaskReport()
-    {
-        isLoadingTasks = true;
-        StateHasChanged();
-
-        var client = ApiClient.CreateClient();
-        try
-        {
-            var query = "Report/tasks?";
-            if (filterStartDate.HasValue) query += $"startDate={filterStartDate:yyyy-MM-dd}&";
-            if (filterEndDate.HasValue) query += $"endDate={filterEndDate:yyyy-MM-dd}&";
-            if (!string.IsNullOrEmpty(filterStatus)) query += $"status={filterStatus}&";
-            if (filterProjectId > 0) query += $"projectId={filterProjectId}&";
-
-            var result = await client.GetFromJsonAsync<Result<List<TaskReportDto>>>(query.TrimEnd('&', '?'), Serialization.CaseInsensitive);
-            if (result?.IsSuccess == true && result.Value != null)
-                taskReports = result.Value;
-        }
-        catch (Exception ex)
-        {
-            Console.WriteLine($"Task report error: {ex.Message}");
-        }
-        finally
-        {
-            isLoadingTasks = false;
-            StateHasChanged();
-        }
-    }
-
-    private async Task LoadProductivity()
-    {
-        isLoadingProductivity = true;
-        var client = ApiClient.CreateClient();
-        try
-        {
-            var result = await client.GetFromJsonAsync<Result<List<UserProductivityDto>>>("Report/user-productivity", Serialization.CaseInsensitive);
-            if (result?.IsSuccess == true && result.Value != null)
-                productivityList = result.Value;
-        }
-        catch (Exception ex)
-        {
-            Console.WriteLine($"Productivity error: {ex.Message}");
-        }
-        finally
-        {
-            isLoadingProductivity = false;
-        }
-    }
-
-    private async Task ResetFilters()
-    {
-        filterStartDate = null;
-        filterEndDate = null;
-        filterStatus = null;
-        filterProjectId = 0;
-        await LoadTaskReport();
-    }
-
-    private string GetStatusBadge(long statusId) => statusId switch
-    {
-        1 => "bg-slate-100 text-slate-700",
-        2 => "bg-blue-100 text-blue-700",
-        3 => "bg-emerald-100 text-emerald-700",
-        _ => "bg-slate-100 text-slate-600"
-    };
-
-    private string GetPriorityBadge(long priorityId) => priorityId switch
-    {
-        1 => "bg-slate-100 text-slate-600",
-        2 => "bg-amber-100 text-amber-700",
-        3 => "bg-red-100 text-red-700",
-        _ => "bg-slate-100 text-slate-600"
-    };
-}

TaskTrackingSystem.WebApp/Components/Pages/ResetPassword.razor

@@ -0,0 +1,65 @@
+@page "/reset-password"
+@layout Layout.EmptyLayout
+@rendermode @(new InteractiveServerRenderMode(prerender: false))
+@attribute [Microsoft.AspNetCore.Authorization.AllowAnonymous]
+@inject NavigationManager Navigation
+
+<PageTitle>Reset Password - TaskFlow</PageTitle>
+
+<div class="flex min-h-screen items-center justify-center bg-slate-50 py-12 px-4 sm:px-6 lg:px-8">
+    <div class="w-full max-w-md space-y-8 bg-white p-8 rounded-2xl border border-slate-200 shadow-xl">
+        <div>
+            <div class="flex justify-center">
+                <span class="flex h-12 w-12 items-center justify-center rounded-xl bg-violet-600 text-white font-bold text-xl">T</span>
+            </div>
+            <h2 class="mt-6 text-center text-3xl font-extrabold text-slate-900">Reset your password</h2>
+            <p class="mt-2 text-center text-sm text-slate-600">
+                Use the recovery code configured in the API to set a new password.
+            </p>
+        </div>
+
+        <form method="post" action="/account/reset-password" class="mt-8 space-y-6">
+            <AntiforgeryToken />
+
+            <div class="space-y-4 rounded-md shadow-sm">
+                <div>
+                    <label for="usernameOrEmail" class="block text-sm font-medium text-slate-700 mb-1">Username or Email</label>
+                    <input id="usernameOrEmail" name="UsernameOrEmail" required placeholder="Enter username or email"
+                           class="w-full rounded-lg border border-slate-200 px-3 py-2 text-sm text-slate-900 placeholder:text-slate-400 focus:outline-none focus:ring-2 focus:ring-slate-900 focus:border-transparent transition-all" />
+                </div>
+                <div>
+                    <label for="recoveryCode" class="block text-sm font-medium text-slate-700 mb-1">Recovery Code</label>
+                    <input id="recoveryCode" name="RecoveryCode" required placeholder="Enter recovery code"
+                           class="w-full rounded-lg border border-slate-200 px-3 py-2 text-sm text-slate-900 placeholder:text-slate-400 focus:outline-none focus:ring-2 focus:ring-slate-900 focus:border-transparent transition-all" />
+                </div>
+                <div>
+                    <label for="newPassword" class="block text-sm font-medium text-slate-700 mb-1">New Password</label>
+                    <input id="newPassword" name="NewPassword" type="password" required placeholder="Min 8 characters"
+                           class="w-full rounded-lg border border-slate-200 px-3 py-2 text-sm text-slate-900 placeholder:text-slate-400 focus:outline-none focus:ring-2 focus:ring-slate-900 focus:border-transparent transition-all" />
+                </div>
+            </div>
+
+            @if (ShowError)
+            {
+                <div class="p-3 rounded-lg bg-red-50 border border-red-100">
+                    <p class="text-sm text-red-600 text-center">@ErrorMessage</p>
+                </div>
+            }
+
+            <div class="flex items-center justify-between">
+                <a href="/login" class="text-sm font-medium text-violet-600 hover:underline">Back to sign in</a>
+                <button type="submit" class="group relative flex justify-center rounded-lg bg-violet-600 px-4 py-2.5 text-sm font-medium text-white hover:bg-violet-700 transition-colors shadow-sm">
+                    Reset Password
+                </button>
+            </div>
+        </form>
+    </div>
+</div>
+
+@code {
+    [SupplyParameterFromQuery(Name = "error")]
+    private string? Error { get; set; }
+
+    private bool ShowError => !string.IsNullOrWhiteSpace(Error);
+    private string ErrorMessage => string.IsNullOrWhiteSpace(Error) ? "Unable to reset password." : Error;
+}

TaskTrackingSystem.WebApp/MenuAuthorizationService.cs

@@ -11,16 +11,8 @@ public class MenuAuthorizationService
         string.Empty,
         "login",
         "register",
-        "error"
-    };
-
-    private static readonly HashSet<string> MemberRouteSegments = new(StringComparer.OrdinalIgnoreCase)
-    {
-        string.Empty,
-        "dashboard",
-        "home",
-        "projects",
-        "tasks"
+        "error",
+        "reset-password"
     };
 
     private readonly ApiClientService _apiClient;
@@ -71,14 +63,14 @@ public class MenuAuthorizationService
             return true;
         }
 
-        var role = user.FindFirst(ClaimTypes.Role)?.Value ?? "Member";
+        var roleKey = GetRoleCacheKey(user);
 
-        if (_sessionState.CachedMenuRole == role && _sessionState.CachedMenus != null)
+        if (_sessionState.CachedMenuRoleId == roleKey && _sessionState.CachedMenus != null)
         {
             return IsRouteAllowed(_sessionState.CachedMenus, relativePath);
         }
 
-        return IsRouteAllowedByRole(role, relativePath);
+        return false;
     }
 
     public bool IsRouteAllowed(IReadOnlyList<MenuDto> menus, string relativePath)
@@ -106,14 +98,14 @@ public class MenuAuthorizationService
             return Task.FromResult(new List<MenuDto>());
         }
 
-        var role = user.FindFirst(ClaimTypes.Role)?.Value ?? "Member";
+        var roleKey = GetRoleCacheKey(user);
 
-        if (_sessionState.CachedMenuRole == role && _sessionState.CachedMenus != null)
+        if (_sessionState.CachedMenuRoleId == roleKey && _sessionState.CachedMenus != null)
         {
             return Task.FromResult(_sessionState.CachedMenus);
         }
 
-        return LoadMenusAsync(user, role);
+        return LoadMenusAsync(user, roleKey);
     }
 
     public void PreloadMenus(ClaimsPrincipal user)
@@ -123,27 +115,27 @@ public class MenuAuthorizationService
             return;
         }
 
-        var role = user.FindFirst(ClaimTypes.Role)?.Value ?? "Member";
-        if (_sessionState.CachedMenuRole == role && _sessionState.CachedMenus != null)
+        var roleKey = GetRoleCacheKey(user);
+        if (_sessionState.CachedMenuRoleId == roleKey && _sessionState.CachedMenus != null)
         {
             return;
         }
 
-        _ = LoadMenusAsync(user, role);
+        _ = LoadMenusAsync(user, roleKey);
     }
 
-    private Task<List<MenuDto>> LoadMenusAsync(ClaimsPrincipal user, string role)
+    private Task<List<MenuDto>> LoadMenusAsync(ClaimsPrincipal user, string roleKey)
     {
         if (_loadingMenus is { IsCompleted: false })
         {
             return _loadingMenus;
         }
 
-        _loadingMenus = FetchMenusFromApiAsync(user, role);
+        _loadingMenus = FetchMenusFromApiAsync(user, roleKey);
         return _loadingMenus;
     }
 
-    private async Task<List<MenuDto>> FetchMenusFromApiAsync(ClaimsPrincipal user, string role)
+    private async Task<List<MenuDto>> FetchMenusFromApiAsync(ClaimsPrincipal user, string roleKey)
     {
         try
         {
@@ -159,14 +151,22 @@ public class MenuAuthorizationService
             var menus = await response.Content.ReadFromJsonAsync<List<MenuDto>>(cancellationToken: cts.Token)
                 ?? new List<MenuDto>();
 
+            if (menus.Count == 0)
+            {
+                menus = BuildFallbackMenus(user);
+            }
+
             _sessionState.CachedMenus = menus;
-            _sessionState.CachedMenuRole = role;
+            _sessionState.CachedMenuRoleId = roleKey;
             return menus;
         }
         catch (Exception ex)
         {
             Console.WriteLine($"Menu API error: {ex.Message}");
-            return new List<MenuDto>();
+            var fallbackMenus = BuildFallbackMenus(user);
+            _sessionState.CachedMenus = fallbackMenus;
+            _sessionState.CachedMenuRoleId = roleKey;
+            return fallbackMenus;
         }
         finally
         {
@@ -174,28 +174,6 @@ public class MenuAuthorizationService
         }
     }
 
-    private static bool IsRouteAllowedByRole(string role, string relativePath)
-    {
-        var segment = GetFirstSegment(relativePath);
-
-        if (PublicRouteSegments.Contains(segment))
-        {
-            return true;
-        }
-
-        if (role.Equals("Admin", StringComparison.OrdinalIgnoreCase))
-        {
-            return true;
-        }
-
-        if (role.Equals("Member", StringComparison.OrdinalIgnoreCase))
-        {
-            return MemberRouteSegments.Contains(segment);
-        }
-
-        return MemberRouteSegments.Contains(segment);
-    }
-
     private static bool MenuCollectionMatchesSegment(IReadOnlyList<MenuDto> menus, string segment)
     {
         foreach (var menu in menus)
@@ -227,4 +205,65 @@ public class MenuAuthorizationService
         var menuSegment = menu.MenuUrl.Split('?')[0].Trim('/').Split('/')[0];
         return menuSegment.Equals(segment, StringComparison.OrdinalIgnoreCase);
     }
+
+    private static string GetRoleCacheKey(ClaimsPrincipal user)
+    {
+        var roleId = user.FindFirst("role_id")?.Value;
+        if (!string.IsNullOrWhiteSpace(roleId))
+        {
+            return $"id:{roleId}";
+        }
+
+        var roleName = user.FindFirst(ClaimTypes.Role)?.Value;
+        if (!string.IsNullOrWhiteSpace(roleName))
+        {
+            return $"name:{roleName}";
+        }
+
+        return string.Empty;
+    }
+
+    private static List<MenuDto> BuildFallbackMenus(ClaimsPrincipal user)
+    {
+        var roleName = user.FindFirst(ClaimTypes.Role)?.Value ?? string.Empty;
+
+        var menus = new List<MenuDto>
+        {
+            CreateMenu("dashboard", "Dashboard", "/dashboard", 1, "layout-dashboard")
+        };
+
+        if (roleName.Equals("Employee", StringComparison.OrdinalIgnoreCase))
+        {
+            menus.Add(CreateMenu("tasks", "Tasks", "/tasks", 2, "list-checks"));
+            return menus;
+        }
+
+        menus.Add(CreateMenu("tasks", "Tasks", "/tasks", 2, "list-checks"));
+        menus.Add(CreateMenu("projects", "Projects", "/projects", 3, "folder-kanban"));
+        menus.Add(CreateMenu("reports", "Reports", "/reports/tasks", 4, "bar-chart-3"));
+
+        if (roleName.Equals("Manager", StringComparison.OrdinalIgnoreCase) ||
+            roleName.Equals("Admin", StringComparison.OrdinalIgnoreCase))
+        {
+            if (roleName.Equals("Admin", StringComparison.OrdinalIgnoreCase))
+            {
+                menus.Add(CreateMenu("users", "Users", "/users", 5, "users"));
+                menus.Add(CreateMenu("roles", "Roles", "/roles", 6, "shield"));
+            }
+        }
+
+        return menus;
+    }
+
+    private static MenuDto CreateMenu(string code, string name, string url, int orderNo, string icon)
+    {
+        return new MenuDto
+        {
+            MenuCode = code,
+            MenuName = name,
+            MenuUrl = url,
+            OrderNo = orderNo,
+            Icon = icon
+        };
+    }
 }

TaskTrackingSystem.WebApp/UserSessionState.cs

@@ -8,12 +8,12 @@ public class UserSessionState
     public string? Token { get; set; }
     public ClaimsPrincipal? CachedUser { get; set; }
 
-    public string? CachedMenuRole { get; set; }
+    public string? CachedMenuRoleId { get; set; }
     public List<MenuDto>? CachedMenus { get; set; }
 
     public void ClearMenuCache()
     {
-        CachedMenuRole = null;
+        CachedMenuRoleId = null;
         CachedMenus = null;
     }