add: new db tables Permission, RoleMenusLegacy, Menu, Fix RolePerms and Perms, adjust Roleservice so it writes to RoleMenus and RolePermissions separately. Menuservice adjust to read from Menus and Permissions instead of the old menu tables.

TaskTrackingSystem.Database/AppDbContextModels/AppDbContext.cs

@@ -21,10 +21,14 @@ public partial class AppDbContext : DbContext
 
     public virtual DbSet<FileAttachment> FileAttachments { get; set; }
 
+    public virtual DbSet<Menu> Menus { get; set; }
+
     public virtual DbSet<MenuAdmin> MenuAdmins { get; set; }
 
     public virtual DbSet<MenuAdminDetail> MenuAdminDetails { get; set; }
 
+    public virtual DbSet<Permission> Permissions { get; set; }
+
     public virtual DbSet<Project> Projects { get; set; }
 
     public virtual DbSet<ProjectMember> ProjectMembers { get; set; }
@@ -33,6 +37,10 @@ public partial class AppDbContext : DbContext
 
     public virtual DbSet<RoleMenu> RoleMenus { get; set; }
 
+    public virtual DbSet<RoleMenusLegacy> RoleMenusLegacies { get; set; }
+
+    public virtual DbSet<RolePermission> RolePermissions { get; set; }
+
     public virtual DbSet<Task> Tasks { get; set; }
 
     public virtual DbSet<TaskHistory> TaskHistories { get; set; }
@@ -42,8 +50,8 @@ public partial class AppDbContext : DbContext
     public virtual DbSet<User> Users { get; set; }
 
     protected override void OnConfiguring(DbContextOptionsBuilder optionsBuilder)
-    {
-    }
+#warning To protect potentially sensitive information in your connection string, you should move it out of source code. You can avoid scaffolding the connection string by using the Name= syntax to read it from configuration - see https://go.microsoft.com/fwlink/?linkid=2131148. For more guidance on storing connection strings, see https://go.microsoft.com/fwlink/?LinkId=723263.
+        => optionsBuilder.UseSqlServer("Server=.;Database=TTS;User Id=sa;Password=sasa@123;TrustServerCertificate=True;");
 
     protected override void OnModelCreating(ModelBuilder modelBuilder)
     {
@@ -103,6 +111,27 @@ public partial class AppDbContext : DbContext
                 .HasConstraintName("FK_FileAttachments_Tasks");
         });
 
+        modelBuilder.Entity<Menu>(entity =>
+        {
+            entity.HasIndex(e => e.ParentMenuId, "IX_Menus_ParentMenuId");
+
+            entity.HasIndex(e => e.MenuCode, "UQ_Menus_MenuCode").IsUnique();
+
+            entity.Property(e => e.CreatedAt)
+                .HasPrecision(0)
+                .HasDefaultValueSql("(sysutcdatetime())");
+            entity.Property(e => e.Icon).HasMaxLength(50);
+            entity.Property(e => e.MenuCode).HasMaxLength(50);
+            entity.Property(e => e.MenuName).HasMaxLength(100);
+            entity.Property(e => e.MenuUrl).HasMaxLength(200);
+            entity.Property(e => e.UpdatedAt).HasPrecision(0);
+            entity.Property(e => e.Visible).HasDefaultValue(true);
+
+            entity.HasOne(d => d.ParentMenu).WithMany(p => p.InverseParentMenu)
+                .HasForeignKey(d => d.ParentMenuId)
+                .HasConstraintName("FK_Menus_ParentMenu");
+        });
+
         modelBuilder.Entity<MenuAdmin>(entity =>
         {
             entity.HasKey(e => e.AdminMenuId);
@@ -128,6 +157,28 @@ public partial class AppDbContext : DbContext
             entity.Property(e => e.ParentMenuCode).HasMaxLength(50);
         });
 
+        modelBuilder.Entity<Permission>(entity =>
+        {
+            entity.HasIndex(e => e.MenuId, "IX_Permissions_MenuId");
+
+            entity.HasIndex(e => e.PermissionCode, "UQ_Permissions_PermissionCode").IsUnique();
+
+            entity.Property(e => e.ActionName).HasMaxLength(100);
+            entity.Property(e => e.ApiName).HasMaxLength(100);
+            entity.Property(e => e.CreatedAt)
+                .HasPrecision(0)
+                .HasDefaultValueSql("(sysutcdatetime())");
+            entity.Property(e => e.HttpMethod).HasMaxLength(20);
+            entity.Property(e => e.PermissionCode).HasMaxLength(50);
+            entity.Property(e => e.UpdatedAt).HasPrecision(0);
+            entity.Property(e => e.Visible).HasDefaultValue(true);
+
+            entity.HasOne(d => d.Menu).WithMany(p => p.Permissions)
+                .HasForeignKey(d => d.MenuId)
+                .OnDelete(DeleteBehavior.ClientSetNull)
+                .HasConstraintName("FK_Permissions_Menu");
+        });
+
         modelBuilder.Entity<Project>(entity =>
         {
             entity.HasIndex(e => e.CreatedById, "IX_Projects_CreatedById");
@@ -181,12 +232,63 @@ public partial class AppDbContext : DbContext
 
         modelBuilder.Entity<RoleMenu>(entity =>
         {
+            entity.HasKey(e => e.RoleMenuId).HasName("PK_RoleMenus_New");
+
+            entity.HasIndex(e => new { e.RoleId, e.MenuId }, "UQ_RoleMenus_Role_Menu").IsUnique();
+
+            entity.Property(e => e.CreatedAt)
+                .HasPrecision(0)
+                .HasDefaultValueSql("(sysutcdatetime())");
+            entity.Property(e => e.UpdatedAt).HasPrecision(0);
+
+            entity.HasOne(d => d.Menu).WithMany(p => p.RoleMenus)
+                .HasForeignKey(d => d.MenuId)
+                .OnDelete(DeleteBehavior.ClientSetNull)
+                .HasConstraintName("FK_RoleMenus_Menus");
+
+            entity.HasOne(d => d.Role).WithMany(p => p.RoleMenus)
+                .HasForeignKey(d => d.RoleId)
+                .OnDelete(DeleteBehavior.ClientSetNull)
+                .HasConstraintName("FK_RoleMenus_Roles");
+        });
+
+        modelBuilder.Entity<RoleMenusLegacy>(entity =>
+        {
+            entity.HasKey(e => e.RoleMenuId).HasName("PK_RoleMenus");
+
+            entity.ToTable("RoleMenus_Legacy");
+
+            entity.HasIndex(e => e.RoleId, "IX_RoleMenus_RoleId");
+
             entity.Property(e => e.RoleMenuId).HasMaxLength(50);
             entity.Property(e => e.CreatedUserId).HasMaxLength(50);
             entity.Property(e => e.MenuCode).HasMaxLength(50);
-            entity.Property(e => e.RoleCode).HasMaxLength(50);
             entity.Property(e => e.ModifiedUserId).HasMaxLength(50);
-            entity.HasIndex(e => e.RoleId, "IX_RoleMenus_RoleId");
+            entity.Property(e => e.RoleCode).HasMaxLength(50);
+        });
+
+        modelBuilder.Entity<RolePermission>(entity =>
+        {
+            entity.HasIndex(e => e.PermissionId, "IX_RolePermissions_PermissionId");
+
+            entity.HasIndex(e => e.RoleId, "IX_RolePermissions_RoleId");
+
+            entity.HasIndex(e => new { e.RoleId, e.PermissionId }, "UQ_RolePermissions_Role_Permission").IsUnique();
+
+            entity.Property(e => e.CreatedAt)
+                .HasPrecision(0)
+                .HasDefaultValueSql("(sysutcdatetime())");
+            entity.Property(e => e.UpdatedAt).HasPrecision(0);
+
+            entity.HasOne(d => d.Permission).WithMany(p => p.RolePermissions)
+                .HasForeignKey(d => d.PermissionId)
+                .OnDelete(DeleteBehavior.ClientSetNull)
+                .HasConstraintName("FK_RolePermissions_Permissions");
+
+            entity.HasOne(d => d.Role).WithMany(p => p.RolePermissions)
+                .HasForeignKey(d => d.RoleId)
+                .OnDelete(DeleteBehavior.ClientSetNull)
+                .HasConstraintName("FK_RolePermissions_Roles");
         });
 
         modelBuilder.Entity<Task>(entity =>

TaskTrackingSystem.Database/AppDbContextModels/{AdminMenu.cs → Menu.cs}

@@ -3,23 +3,39 @@ using System.Collections.Generic;
 
 namespace TaskTrackingSystem.Database.AppDbContextModels;
 
-public partial class AdminMenu
+public partial class Menu
 {
-    public string AdminMenuId { get; set; } = null!;
+    public long MenuId { get; set; }
 
     public string MenuCode { get; set; } = null!;
 
-    public string ParentCode { get; set; } = null!;
+    public long? ParentMenuId { get; set; }
 
     public string MenuName { get; set; } = null!;
 
     public string? MenuUrl { get; set; }
 
+    public string? Icon { get; set; }
+
     public bool Visible { get; set; }
 
     public int OrderNo { get; set; }
 
-    public string? Icon { get; set; }
+    public bool IsDeleted { get; set; }
+
+    public long? CreatedById { get; set; }
+
+    public DateTime CreatedAt { get; set; }
+
+    public long? UpdatedById { get; set; }
+
+    public DateTime? UpdatedAt { get; set; }
+
+    public virtual ICollection<Menu> InverseParentMenu { get; set; } = new List<Menu>();
+
+    public virtual Menu? ParentMenu { get; set; }
+
+    public virtual ICollection<Permission> Permissions { get; set; } = new List<Permission>();
 
-    public int DelFlag { get; set; }
+    public virtual ICollection<RoleMenu> RoleMenus { get; set; } = new List<RoleMenu>();
 }

TaskTrackingSystem.Database/AppDbContextModels/Permission.cs

@@ -0,0 +1,37 @@
+using System;
+using System.Collections.Generic;
+
+namespace TaskTrackingSystem.Database.AppDbContextModels;
+
+public partial class Permission
+{
+    public long PermissionId { get; set; }
+
+    public string PermissionCode { get; set; } = null!;
+
+    public long MenuId { get; set; }
+
+    public string ActionName { get; set; } = null!;
+
+    public string ApiName { get; set; } = null!;
+
+    public string? HttpMethod { get; set; }
+
+    public bool Visible { get; set; }
+
+    public int OrderNo { get; set; }
+
+    public bool IsDeleted { get; set; }
+
+    public long? CreatedById { get; set; }
+
+    public DateTime CreatedAt { get; set; }
+
+    public long? UpdatedById { get; set; }
+
+    public DateTime? UpdatedAt { get; set; }
+
+    public virtual Menu Menu { get; set; } = null!;
+
+    public virtual ICollection<RolePermission> RolePermissions { get; set; } = new List<RolePermission>();
+}

TaskTrackingSystem.Database/AppDbContextModels/Role.cs

@@ -21,5 +21,9 @@ public partial class Role
 
     public bool IsDeleted { get; set; }
 
+    public virtual ICollection<RoleMenu> RoleMenus { get; set; } = new List<RoleMenu>();
+
+    public virtual ICollection<RolePermission> RolePermissions { get; set; } = new List<RolePermission>();
+
     public virtual ICollection<User> Users { get; set; } = new List<User>();
 }

TaskTrackingSystem.Database/AppDbContextModels/RoleMenu.cs

@@ -5,21 +5,23 @@ namespace TaskTrackingSystem.Database.AppDbContextModels;
 
 public partial class RoleMenu
 {
-    public string RoleMenuId { get; set; } = null!;
+    public long RoleMenuId { get; set; }
 
     public long RoleId { get; set; }
 
-    public string? RoleCode { get; set; }
+    public long MenuId { get; set; }
 
-    public string MenuCode { get; set; } = null!;
+    public bool IsDeleted { get; set; }
 
-    public int DelFlag { get; set; }
+    public long? CreatedById { get; set; }
 
-    public string? CreatedUserId { get; set; }
+    public DateTime CreatedAt { get; set; }
 
-    public DateTime CreatedDateTime { get; set; }
+    public long? UpdatedById { get; set; }
 
-    public string? ModifiedUserId { get; set; }
+    public DateTime? UpdatedAt { get; set; }
 
-    public DateTime? ModifiedDateTime { get; set; }
+    public virtual Menu Menu { get; set; } = null!;
+
+    public virtual Role Role { get; set; } = null!;
 }

TaskTrackingSystem.Database/AppDbContextModels/RoleMenusLegacy.cs

@@ -0,0 +1,25 @@
+using System;
+using System.Collections.Generic;
+
+namespace TaskTrackingSystem.Database.AppDbContextModels;
+
+public partial class RoleMenusLegacy
+{
+    public string RoleMenuId { get; set; } = null!;
+
+    public string RoleCode { get; set; } = null!;
+
+    public string MenuCode { get; set; } = null!;
+
+    public int DelFlag { get; set; }
+
+    public string? CreatedUserId { get; set; }
+
+    public DateTime CreatedDateTime { get; set; }
+
+    public string? ModifiedUserId { get; set; }
+
+    public DateTime? ModifiedDateTime { get; set; }
+
+    public long RoleId { get; set; }
+}

TaskTrackingSystem.Database/AppDbContextModels/RolePermission.cs

@@ -0,0 +1,27 @@
+using System;
+using System.Collections.Generic;
+
+namespace TaskTrackingSystem.Database.AppDbContextModels;
+
+public partial class RolePermission
+{
+    public long RolePermissionId { get; set; }
+
+    public long RoleId { get; set; }
+
+    public long PermissionId { get; set; }
+
+    public bool IsDeleted { get; set; }
+
+    public long? CreatedById { get; set; }
+
+    public DateTime CreatedAt { get; set; }
+
+    public long? UpdatedById { get; set; }
+
+    public DateTime? UpdatedAt { get; set; }
+
+    public virtual Permission Permission { get; set; } = null!;
+
+    public virtual Role Role { get; set; } = null!;
+}

TaskTrackingSystem.WebApi/Features/Menu/MenuController.cs

@@ -47,5 +47,18 @@ namespace TaskTrackingSystem.WebApi.Features.Menu
             var menus = await _menuService.GetAllMenusAsync();
             return Ok(menus);
         }
+
+        /// <summary>
+        /// Returns a lightweight version string for the current user's role permissions.
+        /// Clients poll this to detect when an admin has changed permissions without fetching the full menu list.
+        /// </summary>
+        [HttpGet("version")]
+        public async Task<ActionResult<string>> GetMenuVersion()
+        {
+            var roleId = User.GetRoleId();
+            var roleName = User.GetRoleName() ?? string.Empty;
+            var version = await _menuService.GetMenuVersionAsync(roleId, roleName);
+            return Ok(version);
+        }
     }
 }

TaskTrackingSystem.WebApi/Features/Menu/MenuService.cs

@@ -25,7 +25,7 @@ namespace TaskTrackingSystem.WebApi.Features.Menu
                 return new List<MenuDto>();
             }
 
-            return await GetMenusForRoleAsync(role.Id, role.Name);
+            return await GetMenusForRoleAsync(role.Id);
         }
 
         public async Task<List<MenuDto>> GetMenusByRoleNameAsync(string roleName)
@@ -41,131 +41,120 @@ namespace TaskTrackingSystem.WebApi.Features.Menu
                 return new List<MenuDto>();
             }
 
-            return await GetMenusForRoleAsync(role.Id, role.Name);
+            return await GetMenusForRoleAsync(role.Id);
         }
 
-        private async Task<List<MenuDto>> GetMenusForRoleAsync(long roleId, string roleName)
+        private async Task<List<MenuDto>> GetMenusForRoleAsync(long roleId)
         {
-            var role = await _db.Roles.FirstOrDefaultAsync(r => r.Id == roleId && r.IsDeleted != true);
-            if (role == null)
-            {
-                return new List<MenuDto>();
-            }
-
-            var allVisibleMenus = await _db.MenuAdmins
-                .Where(m => m.Visible && m.DelFlag == 0)
+            var visibleMenus = await _db.Menus
+                .Where(m => !m.IsDeleted && m.Visible)
                 .OrderBy(m => m.OrderNo)
-                .Select(m => new MenuDto
-                {
-                    MenuCode = m.MenuCode,
-                    ParentCode = m.ParentCode,
-                    MenuName = m.MenuName,
-                    MenuUrl = m.MenuUrl,
-                    OrderNo = m.OrderNo,
-                    Icon = m.Icon
-                })
                 .ToListAsync();
 
-            // Keep compatibility with roles stored by either RoleId or the older RoleCode link.
-            var allowedMenuCodes = await GetAllowedMenuCodesAsync(role.Id, role.Name);
+            var assignedMenuIds = await _db.RoleMenus
+                .Where(rm => rm.RoleId == roleId && !rm.IsDeleted)
+                .Select(rm => rm.MenuId)
+                .ToListAsync();
+
+            var assignedPermissionMenuIds = await _db.RolePermissions
+                .Where(rp => rp.RoleId == roleId && !rp.IsDeleted)
+                .Select(rp => rp.Permission.MenuId)
+                .ToListAsync();
+
+            var allowedMenuIds = assignedMenuIds
+                .Concat(assignedPermissionMenuIds)
+                .Distinct()
+                .ToHashSet();
 
-            if (allowedMenuCodes.Count == 0)
+            if (allowedMenuIds.Count == 0)
             {
                 return new List<MenuDto>();
             }
 
-            var visibleMenuLookup = allVisibleMenus
-                .GroupBy(m => m.MenuCode, StringComparer.OrdinalIgnoreCase)
-                .ToDictionary(g => g.Key, g => g.First(), StringComparer.OrdinalIgnoreCase);
+            var visibleMenuLookup = visibleMenus.ToDictionary(m => m.MenuId);
+            var expandedMenuIds = ExpandWithAncestors(allowedMenuIds, visibleMenuLookup);
 
-            var expandedMenuCodes = ExpandWithAncestors(allowedMenuCodes, visibleMenuLookup);
-            var menus = allVisibleMenus
-                .Where(m => expandedMenuCodes.Contains(m.MenuCode))
+            var filteredMenus = visibleMenus
+                .Where(m => expandedMenuIds.Contains(m.MenuId))
                 .OrderBy(m => m.OrderNo)
                 .ToList();
 
-            return BuildHierarchy(menus);
+            return BuildHierarchy(filteredMenus);
         }
 
-        private static List<MenuDto> BuildHierarchy(List<MenuDto> menus)
+        private static List<MenuDto> BuildHierarchy(List<Menu> menus)
         {
             if (menus.Count == 0)
             {
                 return new List<MenuDto>();
             }
 
-            var menuLookup = menus
-                .GroupBy(m => m.MenuCode, StringComparer.OrdinalIgnoreCase)
-                .ToDictionary(g => g.Key, g => g.First(), StringComparer.OrdinalIgnoreCase);
+            var menuLookup = menus.ToDictionary(m => m.MenuId);
+            var dtoLookup = menus.ToDictionary(
+                m => m.MenuId,
+                m => new MenuDto
+                {
+                    MenuCode = m.MenuCode,
+                    ParentCode = GetParentCode(m, menuLookup),
+                    MenuName = m.MenuName,
+                    MenuUrl = m.MenuUrl,
+                    OrderNo = m.OrderNo,
+                    Icon = m.Icon
+                });
 
-            foreach (var menu in menuLookup.Values)
+            foreach (var dto in dtoLookup.Values)
             {
-                menu.SubMenus = new List<MenuDto>();
+                dto.SubMenus = new List<MenuDto>();
             }
 
             var roots = new List<MenuDto>();
 
-            foreach (var menu in menuLookup.Values.OrderBy(m => m.OrderNo).ThenBy(m => m.MenuName))
+            foreach (var menu in menus.OrderBy(m => m.OrderNo).ThenBy(m => m.MenuName, StringComparer.OrdinalIgnoreCase))
             {
-                var parentCode = NormalizeMenuCode(menu.ParentCode);
-                if (string.IsNullOrWhiteSpace(parentCode) ||
-                    parentCode == "0" ||
-                    !menuLookup.TryGetValue(parentCode, out var parent))
+                var dto = dtoLookup[menu.MenuId];
+                var parentId = menu.ParentMenuId;
+
+                if (!parentId.HasValue || !dtoLookup.TryGetValue(parentId.Value, out var parentDto))
                 {
-                    roots.Add(menu);
+                    roots.Add(dto);
                     continue;
                 }
 
-                parent.SubMenus.Add(menu);
+                parentDto.SubMenus.Add(dto);
             }
 
             SortMenuTree(roots);
             return roots;
         }
 
-        private async Task<HashSet<string>> GetAllowedMenuCodesAsync(long roleId, string roleName)
+        private static string GetParentCode(Menu menu, IReadOnlyDictionary<long, Menu> menuLookup)
         {
-            var allowedMenuCodes = await _db.RoleMenus
-                .Where(rm => rm.RoleId == roleId && rm.DelFlag == 0)
-                .Select(rm => rm.MenuCode)
-                .ToListAsync();
-
-            if (allowedMenuCodes.Count > 0)
+            if (!menu.ParentMenuId.HasValue)
             {
-                return allowedMenuCodes.ToHashSet(StringComparer.OrdinalIgnoreCase);
+                return string.Empty;
             }
 
-            if (!string.IsNullOrWhiteSpace(roleName))
-            {
-                allowedMenuCodes = await _db.RoleMenus
-                    .Where(rm => rm.RoleCode == roleName && rm.DelFlag == 0)
-                    .Select(rm => rm.MenuCode)
-                    .ToListAsync();
-            }
-
-            return allowedMenuCodes.ToHashSet(StringComparer.OrdinalIgnoreCase);
+            return menuLookup.TryGetValue(menu.ParentMenuId.Value, out var parent)
+                ? parent.MenuCode
+                : string.Empty;
         }
 
-        private static HashSet<string> ExpandWithAncestors(IEnumerable<string> menuCodes, IReadOnlyDictionary<string, MenuDto> menuLookup)
+        private static HashSet<long> ExpandWithAncestors(IEnumerable<long> menuIds, IReadOnlyDictionary<long, Menu> menuLookup)
         {
-            var expanded = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+            var expanded = new HashSet<long>();
 
-            foreach (var menuCode in menuCodes.Where(code => !string.IsNullOrWhiteSpace(code)))
+            foreach (var menuId in menuIds)
             {
-                var currentCode = menuCode.Trim();
+                var currentId = menuId;
 
-                while (!string.IsNullOrWhiteSpace(currentCode) && expanded.Add(currentCode))
+                while (currentId > 0 && expanded.Add(currentId))
                 {
-                    if (!menuLookup.TryGetValue(currentCode, out var currentMenu))
+                    if (!menuLookup.TryGetValue(currentId, out var currentMenu) || !currentMenu.ParentMenuId.HasValue)
                     {
                         break;
                     }
 
-                    currentCode = NormalizeMenuCode(currentMenu.ParentCode);
-                    if (string.IsNullOrWhiteSpace(currentCode) || currentCode == "0")
-                    {
-                        break;
-                    }
+                    currentId = currentMenu.ParentMenuId.Value;
                 }
             }
 
@@ -174,7 +163,11 @@ namespace TaskTrackingSystem.WebApi.Features.Menu
 
         private static void SortMenuTree(IList<MenuDto> menus)
         {
-            var ordered = menus.OrderBy(m => m.OrderNo).ThenBy(m => m.MenuName, StringComparer.OrdinalIgnoreCase).ToList();
+            var ordered = menus
+                .OrderBy(m => m.OrderNo)
+                .ThenBy(m => m.MenuName, StringComparer.OrdinalIgnoreCase)
+                .ToList();
+
             menus.Clear();
 
             foreach (var menu in ordered)
@@ -188,50 +181,78 @@ namespace TaskTrackingSystem.WebApi.Features.Menu
             }
         }
 
-        private static string NormalizeMenuCode(string? code)
+        public async Task<string> GetMenuVersionAsync(long roleId, string roleName)
         {
-            return string.IsNullOrWhiteSpace(code) ? string.Empty : code.Trim();
+            var latestMenuChange = await _db.RoleMenus
+                .Where(rm => rm.RoleId == roleId && !rm.IsDeleted)
+                .Select(rm => (DateTime?)(rm.UpdatedAt ?? rm.CreatedAt))
+                .MaxAsync();
+
+            var latestPermissionChange = await _db.RolePermissions
+                .Where(rp => rp.RoleId == roleId && !rp.IsDeleted)
+                .Select(rp => (DateTime?)(rp.UpdatedAt ?? rp.CreatedAt))
+                .MaxAsync();
+
+            var latest = latestMenuChange ?? latestPermissionChange;
+            if (latestPermissionChange.HasValue && (!latest.HasValue || latestPermissionChange.Value > latest.Value))
+            {
+                latest = latestPermissionChange;
+            }
+
+            return latest.HasValue ? latest.Value.Ticks.ToString() : "0";
         }
+
         public async Task<List<MenuAdminDto>> GetAllMenusAsync()
         {
-            var menus = await _db.MenuAdmins
-                .Where(m => m.DelFlag == 0)
+            var menus = await _db.Menus
+                .Where(m => !m.IsDeleted)
                 .OrderBy(m => m.OrderNo)
-                .Select(m => new MenuAdminDto
-                {
-                    MenuCode = m.MenuCode,
-                    ParentCode = m.ParentCode,
-                    MenuName = m.MenuName,
-                    MenuUrl = m.MenuUrl,
-                    OrderNo = m.OrderNo,
-                    Icon = m.Icon,
-                    Visible = m.Visible
-                })
                 .ToListAsync();
 
-            var details = await _db.MenuAdminDetails
-                .Where(d => d.DelFlag == 0)
-                .OrderBy(d => d.OrderNo)
-                .Select(d => new MenuAdminDetailDto
+            var permissions = await _db.Permissions
+                .Where(p => !p.IsDeleted)
+                .OrderBy(p => p.OrderNo)
+                .ToListAsync();
+
+            var menuLookup = menus.ToDictionary(m => m.MenuId);
+            var menuDtoLookup = menus
+                .Select(m => new
                 {
-                    MenuAdminDetailId = d.MenuAdminDetailId,
-                    MenuDetailCode = d.MenuDetailCode,
-                    ParentMenuCode = d.ParentMenuCode,
-                    ActionName = d.ActionName,
-                    ApiName = d.ApiName,
-                    Visible = d.Visible,
-                    OrderNo = d.OrderNo
+                    m.MenuId,
+                    Dto = new MenuAdminDto
+                    {
+                        MenuCode = m.MenuCode,
+                        ParentCode = GetParentCode(m, menuLookup),
+                        MenuName = m.MenuName,
+                        MenuUrl = m.MenuUrl,
+                        OrderNo = m.OrderNo,
+                        Icon = m.Icon,
+                        Visible = m.Visible
+                    }
                 })
-                .ToListAsync();
+                .ToList();
+
+            var menuDtos = menuDtoLookup.Select(x => x.Dto).ToList();
+            var dtoLookup = menuDtoLookup.ToDictionary(x => x.MenuId, x => x.Dto);
 
-            foreach (var menu in menus)
+            foreach (var permission in permissions)
             {
-                menu.Actions = details
-                    .Where(d => d.ParentMenuCode.Equals(menu.MenuCode, StringComparison.OrdinalIgnoreCase))
-                    .ToList();
+                if (dtoLookup.TryGetValue(permission.MenuId, out var dto))
+                {
+                    dto.Actions.Add(new MenuAdminDetailDto
+                    {
+                        MenuAdminDetailId = permission.PermissionId.ToString(),
+                        MenuDetailCode = permission.PermissionCode,
+                        ParentMenuCode = menuLookup.TryGetValue(permission.MenuId, out var parentMenu) ? parentMenu.MenuCode : string.Empty,
+                        ActionName = permission.ActionName,
+                        ApiName = permission.ApiName,
+                        Visible = permission.Visible,
+                        OrderNo = permission.OrderNo
+                    });
+                }
             }
 
-            return menus;
+            return menuDtos;
         }
     }
 }

TaskTrackingSystem.WebApi/Features/Role/RoleService.cs

@@ -28,15 +28,17 @@ namespace TaskTrackingSystem.WebApi.Features.Role
                     Name = r.Name,
                     Description = r.Description,
                     CreatedAt = r.CreatedAt ?? DateTime.UtcNow
-                }).ToListAsync();
+                })
+                .ToListAsync();
         }
 
         public async Task<RoleDto?> GetRoleByIdAsync(long id)
         {
-            var role = await _db.Roles
-                .FirstOrDefaultAsync(r => r.Id == id && r.IsDeleted != true);
-
-            if (role == null) return null;
+            var role = await _db.Roles.FirstOrDefaultAsync(r => r.Id == id && r.IsDeleted != true);
+            if (role == null)
+            {
+                return null;
+            }
 
             return new RoleDto
             {
@@ -69,7 +71,7 @@ namespace TaskTrackingSystem.WebApi.Features.Role
                 }
             }
 
-            var role = new TaskTrackingSystem.Database.AppDbContextModels.Role
+            var role = new Role
             {
                 Name = dto.Name,
                 Description = dto.Description,
@@ -86,15 +88,13 @@ namespace TaskTrackingSystem.WebApi.Features.Role
                 return Result<RoleDto>.Failure(assignResult.ErrorMessage ?? ResultMessages.FailedToCreateRole, assignResult.StatusCode);
             }
 
-            var resultDto = new RoleDto
+            return Result<RoleDto>.Success(new RoleDto
             {
                 Id = role.Id,
                 Name = role.Name,
                 Description = role.Description,
                 CreatedAt = role.CreatedAt ?? DateTime.UtcNow
-            };
-
-            return Result<RoleDto>.Success(resultDto, 201);
+            }, 201);
         }
 
         public async Task<Result> UpdateRoleAsync(long id, UpdateRoleDto dto, long? currentUserId = null)
@@ -105,7 +105,10 @@ namespace TaskTrackingSystem.WebApi.Features.Role
             }
 
             var role = await _db.Roles.FirstOrDefaultAsync(r => r.Id == id && r.IsDeleted != true);
-            if (role == null) return Result.Failure(ResultMessages.RoleNotFound(id), 404);
+            if (role == null)
+            {
+                return Result.Failure(ResultMessages.RoleNotFound(id), 404);
+            }
 
             var nameExists = await _db.Roles.AnyAsync(r => r.Name == dto.Name && r.Id != id && r.IsDeleted != true);
             if (nameExists)
@@ -113,21 +116,11 @@ namespace TaskTrackingSystem.WebApi.Features.Role
                 return Result.Failure("Role name is already taken by another role.", 400);
             }
 
-            var oldName = role.Name;
             role.Name = dto.Name;
             role.Description = dto.Description;
             role.UpdatedAt = DateTime.UtcNow;
             role.UpdatedBy = currentUserId;
 
-            var relatedRoleMenus = await _db.RoleMenus
-                .Where(rm => rm.RoleId == role.Id || rm.RoleCode == oldName)
-                .ToListAsync();
-
-            foreach (var roleMenu in relatedRoleMenus)
-            {
-                roleMenu.RoleCode = dto.Name;
-            }
-
             _db.Roles.Update(role);
             await _db.SaveChangesAsync();
             return Result.Success(200);
@@ -136,7 +129,10 @@ namespace TaskTrackingSystem.WebApi.Features.Role
         public async Task<Result> SoftDeleteRoleAsync(long id)
         {
             var role = await _db.Roles.FirstOrDefaultAsync(r => r.Id == id && r.IsDeleted != true);
-            if (role == null) return Result.Failure(ResultMessages.RoleNotFound(id), 404);
+            if (role == null)
+            {
+                return Result.Failure(ResultMessages.RoleNotFound(id), 404);
+            }
 
             role.IsDeleted = true;
             _db.Roles.Update(role);
@@ -144,7 +140,6 @@ namespace TaskTrackingSystem.WebApi.Features.Role
             return Result.Success(200);
         }
 
-
         public async Task<Result<List<string>>> GetAssignedMenusByRoleIdAsync(long roleId)
         {
             var role = await _db.Roles.FirstOrDefaultAsync(r => r.Id == roleId && r.IsDeleted != true);
@@ -154,19 +149,21 @@ namespace TaskTrackingSystem.WebApi.Features.Role
             }
 
             var menuCodes = await _db.RoleMenus
-                .Where(rm => rm.RoleId == role.Id && rm.DelFlag == 0)
-                .Select(rm => rm.MenuCode)
+                .Where(rm => rm.RoleId == role.Id && !rm.IsDeleted)
+                .Select(rm => rm.Menu.MenuCode)
                 .ToListAsync();
 
-            if (!menuCodes.Any())
-            {
-                menuCodes = await _db.RoleMenus
-                    .Where(rm => rm.RoleCode == role.Name && rm.DelFlag == 0)
-                    .Select(rm => rm.MenuCode)
-                    .ToListAsync();
-            }
+            var permissionCodes = await _db.RolePermissions
+                .Where(rp => rp.RoleId == role.Id && !rp.IsDeleted)
+                .Select(rp => rp.Permission.PermissionCode)
+                .ToListAsync();
+
+            var assignedCodes = menuCodes
+                .Concat(permissionCodes)
+                .Distinct(StringComparer.OrdinalIgnoreCase)
+                .ToList();
 
-            return Result<List<string>>.Success(menuCodes);
+            return Result<List<string>>.Success(assignedCodes);
         }
 
         public async Task<Result> AssignMenusToRoleAsync(long roleId, AssignMenusDto dto)
@@ -182,34 +179,83 @@ namespace TaskTrackingSystem.WebApi.Features.Role
                 return Result.Failure("MenuCodes cannot be null", 400);
             }
 
-            var validCodesResult = await ValidatePermissionCodesAsync(dto.MenuCodes);
+            var selectedCodes = dto.MenuCodes
+                .Where(code => !string.IsNullOrWhiteSpace(code))
+                .Select(code => code.Trim())
+                .Distinct(StringComparer.OrdinalIgnoreCase)
+                .ToList();
+
+            var validCodesResult = await ValidatePermissionCodesAsync(selectedCodes);
             if (!validCodesResult.IsSuccess)
             {
                 return Result.Failure(validCodesResult.ErrorMessage ?? ResultMessages.FailedToUpdateRole, validCodesResult.StatusCode);
             }
 
-            // Remove existing role menus matching either the new RoleId link or the old RoleCode link.
-            var existingRoleMenus = await _db.RoleMenus
-                .Where(rm => rm.RoleId == role.Id || rm.RoleCode == role.Name)
+            var selectedMenus = await _db.Menus
+                .Where(m => !m.IsDeleted && selectedCodes.Contains(m.MenuCode))
+                .Select(m => new { m.MenuId, m.MenuCode, m.ParentMenuId })
+                .ToListAsync();
+
+            var selectedPermissions = await _db.Permissions
+                .Where(p => !p.IsDeleted && selectedCodes.Contains(p.PermissionCode))
+                .Select(p => new { p.PermissionId, p.PermissionCode, p.MenuId })
+                .ToListAsync();
+
+            var menuLookup = await _db.Menus
+                .Where(m => !m.IsDeleted)
+                .Select(m => new { m.MenuId, m.ParentMenuId })
                 .ToListAsync();
 
+            var menuIdLookup = menuLookup.ToDictionary(x => x.MenuId, x => x.ParentMenuId);
+            var menuIdsToPersist = new HashSet<long>();
+
+            foreach (var menu in selectedMenus)
+            {
+                AddWithAncestors(menu.MenuId, menuIdLookup, menuIdsToPersist);
+            }
+
+            foreach (var permission in selectedPermissions)
+            {
+                AddWithAncestors(permission.MenuId, menuIdLookup, menuIdsToPersist);
+            }
+
+            var permissionIdsToPersist = selectedPermissions
+                .Select(p => p.PermissionId)
+                .Distinct()
+                .ToList();
+
+            var existingRoleMenus = await _db.RoleMenus.Where(rm => rm.RoleId == role.Id).ToListAsync();
+            var existingRolePermissions = await _db.RolePermissions.Where(rp => rp.RoleId == role.Id).ToListAsync();
+
             if (existingRoleMenus.Any())
             {
                 _db.RoleMenus.RemoveRange(existingRoleMenus);
             }
 
-            // Bulk insert new RoleMenu links
-            int i = 1;
-            foreach (var menuCode in dto.MenuCodes)
+            if (existingRolePermissions.Any())
+            {
+                _db.RolePermissions.RemoveRange(existingRolePermissions);
+            }
+
+            foreach (var menuId in menuIdsToPersist)
             {
                 _db.RoleMenus.Add(new RoleMenu
                 {
-                    RoleMenuId = $"RM_{role.Id}_{i++}_{DateTime.UtcNow.Ticks}",
                     RoleId = role.Id,
-                    RoleCode = role.Name,
-                    MenuCode = menuCode,
-                    DelFlag = 0,
-                    CreatedDateTime = DateTime.UtcNow
+                    MenuId = menuId,
+                    IsDeleted = false,
+                    CreatedAt = DateTime.UtcNow
+                });
+            }
+
+            foreach (var permissionId in permissionIdsToPersist)
+            {
+                _db.RolePermissions.Add(new RolePermission
+                {
+                    RoleId = role.Id,
+                    PermissionId = permissionId,
+                    IsDeleted = false,
+                    CreatedAt = DateTime.UtcNow
                 });
             }
 
@@ -217,24 +263,43 @@ namespace TaskTrackingSystem.WebApi.Features.Role
             return Result.Success(200);
         }
 
-        private async Task<Result> ValidatePermissionCodesAsync(IEnumerable<string> menuCodes)
+        private static void AddWithAncestors(long menuId, IReadOnlyDictionary<long, long?> parentLookup, ISet<long> target)
+        {
+            var current = menuId;
+
+            while (current > 0 && target.Add(current))
+            {
+                if (!parentLookup.TryGetValue(current, out var parentId) || !parentId.HasValue)
+                {
+                    break;
+                }
+
+                current = parentId.Value;
+            }
+        }
+
+        private async Task<Result> ValidatePermissionCodesAsync(IEnumerable<string> codes)
         {
-            var validMenuCodes = await _db.MenuAdmins
-                .Where(m => m.DelFlag == 0)
+            var normalizedCodes = codes
+                .Where(code => !string.IsNullOrWhiteSpace(code))
+                .Select(code => code.Trim())
+                .ToList();
+
+            var validMenuCodes = await _db.Menus
+                .Where(m => !m.IsDeleted)
                 .Select(m => m.MenuCode)
                 .ToListAsync();
 
-            var validActionCodes = await _db.MenuAdminDetails
-                .Where(d => d.DelFlag == 0)
-                .Select(d => d.MenuDetailCode)
+            var validPermissionCodes = await _db.Permissions
+                .Where(p => !p.IsDeleted)
+                .Select(p => p.PermissionCode)
                 .ToListAsync();
 
             var validCodes = validMenuCodes
-                .Concat(validActionCodes)
+                .Concat(validPermissionCodes)
                 .ToHashSet(StringComparer.OrdinalIgnoreCase);
 
-            var invalidCodes = menuCodes
-                .Where(code => !string.IsNullOrWhiteSpace(code))
+            var invalidCodes = normalizedCodes
                 .Where(code => !validCodes.Contains(code))
                 .Distinct(StringComparer.OrdinalIgnoreCase)
                 .ToList();

TaskTrackingSystem.WebApp/Components/Layout/NavMenu.razor

@@ -94,16 +94,55 @@
     private void OnLocationChanged(object? sender, LocationChangedEventArgs e)
     {
         currentPath = Navigation.ToBaseRelativePath(e.Location).Trim('/');
+        InvokeAsync(RefreshMenusAsync);
+    }
 
-        foreach (var menu in menus)
+    private async Task RefreshMenusAsync()
+    {
+        try
         {
-            if (menu.SubMenus != null && menu.SubMenus.Count > 0 && IsMenuExpanded(menu.MenuCode, menu.SubMenus))
+            var authState = await AuthStateProvider.GetAuthenticationStateAsync();
+            var user = authState.User;
+
+            if (user.Identity?.IsAuthenticated == true)
             {
-                expandedMenuGroups.Add(menu.MenuCode);
+                // GetUserMenusAsync will automatically bust the cache if an admin changed permissions.
+                var freshMenus = await MenuAuthorization.GetUserMenusAsync(user);
+
+                // Only update and re-render if the menu list actually changed.
+                if (freshMenus.Count != menus.Count ||
+                    freshMenus.Select(m => m.MenuCode).SequenceEqual(menus.Select(m => m.MenuCode)) == false)
+                {
+                    menus = freshMenus;
+                    BuildUrlHierarchy(menus);
+                    expandedMenuGroups.Clear();
+                    foreach (var menu in menus)
+                    {
+                        if (menu.SubMenus != null && menu.SubMenus.Count > 0 && IsMenuExpanded(menu.MenuCode, menu.SubMenus))
+                        {
+                            expandedMenuGroups.Add(menu.MenuCode);
+                        }
+                    }
+                }
+                else
+                {
+                    // Menus are the same — just refresh expanded state for the new route.
+                    foreach (var menu in menus)
+                    {
+                        if (menu.SubMenus != null && menu.SubMenus.Count > 0 && IsMenuExpanded(menu.MenuCode, menu.SubMenus))
+                        {
+                            expandedMenuGroups.Add(menu.MenuCode);
+                        }
+                    }
+                }
             }
         }
+        catch (Exception ex)
+        {
+            Console.WriteLine($"Error refreshing menus on navigation: {ex.Message}");
+        }
 
-        InvokeAsync(StateHasChanged);
+        StateHasChanged();
     }
 
     private void ToggleMenuGroup(string menuCode)

TaskTrackingSystem.WebApp/MenuAuthorizationService.cs

@@ -102,7 +102,8 @@ public class MenuAuthorizationService
 
         if (_sessionState.CachedMenuRoleId == roleKey && _sessionState.CachedMenus != null)
         {
-            return Task.FromResult(_sessionState.CachedMenus);
+            // Cache hit — but verify the permissions haven't been changed by an admin.
+            return LoadMenusWithVersionCheckAsync(user, roleKey);
         }
 
         return LoadMenusAsync(user, roleKey);
@@ -124,6 +125,43 @@ public class MenuAuthorizationService
         _ = LoadMenusAsync(user, roleKey);
     }
 
+    /// <summary>
+    /// When menus are cached, quickly checks the server-side version to see if an admin changed permissions.
+    /// If the version changed, busts the cache and re-fetches the full menu list.
+    /// Falls back to the cached menus if the version check itself fails (e.g. network error).
+    /// </summary>
+    private async Task<List<MenuDto>> LoadMenusWithVersionCheckAsync(ClaimsPrincipal user, string roleKey)
+    {
+        try
+        {
+            using var cts = new CancellationTokenSource(TimeSpan.FromSeconds(5));
+            var client = _apiClient.CreateClient(user);
+            var response = await client.GetAsync("Menu/version", cts.Token);
+
+            if (response.IsSuccessStatusCode)
+            {
+                var serverVersion = await response.Content.ReadAsStringAsync(cts.Token);
+                // Strip surrounding quotes that JSON serialisation may add
+                serverVersion = serverVersion.Trim('"');
+
+                if (serverVersion != _sessionState.CachedMenuVersion)
+                {
+                    // Permissions have changed — bust cache and reload full menus.
+                    Console.WriteLine($"[MenuAuth] Permission version changed ({_sessionState.CachedMenuVersion} -> {serverVersion}). Reloading menus.");
+                    _sessionState.ClearMenuCache();
+                    return await LoadMenusAsync(user, roleKey);
+                }
+            }
+        }
+        catch (Exception ex)
+        {
+            // If the version check fails, just use the cached menus to avoid breaking the UI.
+            Console.WriteLine($"[MenuAuth] Version check failed (using cache): {ex.Message}");
+        }
+
+        return _sessionState.CachedMenus!;
+    }
+
     private Task<List<MenuDto>> LoadMenusAsync(ClaimsPrincipal user, string roleKey)
     {
         if (_loadingMenus is { IsCompleted: false })
@@ -141,14 +179,21 @@ public class MenuAuthorizationService
         {
             using var cts = new CancellationTokenSource(TimeSpan.FromSeconds(8));
             var client = _apiClient.CreateClient(user);
-            var response = await client.GetAsync("Menu", cts.Token);
-            if (!response.IsSuccessStatusCode)
+
+            // Fetch menus and version in parallel for efficiency.
+            var menuTask = client.GetAsync("Menu", cts.Token);
+            var versionTask = client.GetAsync("Menu/version", cts.Token);
+
+            await Task.WhenAll(menuTask, versionTask);
+
+            var menuResponse = await menuTask;
+            if (!menuResponse.IsSuccessStatusCode)
             {
-                Console.WriteLine($"Menu API failed: {(int)response.StatusCode} {response.ReasonPhrase}");
+                Console.WriteLine($"Menu API failed: {(int)menuResponse.StatusCode} {menuResponse.ReasonPhrase}");
                 return new List<MenuDto>();
             }
 
-            var menus = await response.Content.ReadFromJsonAsync<List<MenuDto>>(cancellationToken: cts.Token)
+            var menus = await menuResponse.Content.ReadFromJsonAsync<List<MenuDto>>(cancellationToken: cts.Token)
                 ?? new List<MenuDto>();
 
             if (menus.Count == 0)
@@ -156,6 +201,14 @@ public class MenuAuthorizationService
                 menus = BuildFallbackMenus(user);
             }
 
+            // Store the version so we can detect future permission changes.
+            var versionResponse = await versionTask;
+            if (versionResponse.IsSuccessStatusCode)
+            {
+                var version = await versionResponse.Content.ReadAsStringAsync(cts.Token);
+                _sessionState.CachedMenuVersion = version.Trim('"');
+            }
+
             _sessionState.CachedMenus = menus;
             _sessionState.CachedMenuRoleId = roleKey;
             return menus;

TaskTrackingSystem.WebApp/UserSessionState.cs

@@ -11,10 +11,17 @@ public class UserSessionState
     public string? CachedMenuRoleId { get; set; }
     public List<MenuDto>? CachedMenus { get; set; }
 
+    /// <summary>
+    /// The server-side permissions version (latest RoleMenu timestamp) when the menus were last fetched.
+    /// Used to detect when an admin has changed a role's permissions so the cache can be busted.
+    /// </summary>
+    public string? CachedMenuVersion { get; set; }
+
     public void ClearMenuCache()
     {
         CachedMenuRoleId = null;
         CachedMenus = null;
+        CachedMenuVersion = null;
     }
 
     public void ClearSession()

permission-schema-upgrade.sql

@@ -0,0 +1,329 @@
+/*
+Safe upgrade path for permission tables.
+
+What this script does:
+1. Renames the old dbo.RoleMenus table to dbo.RoleMenus_Legacy if it still uses MenuCode.
+2. Creates the new normalized tables:
+   - dbo.Menus
+   - dbo.Permissions
+   - dbo.RoleMenus
+   - dbo.RolePermissions
+3. Copies data from the old schema into the new schema.
+
+Run this once in SQL Server Management Studio after backing up the database.
+*/
+
+SET XACT_ABORT ON;
+BEGIN TRY
+    BEGIN TRANSACTION;
+
+    -------------------------------------------------------------------------
+    -- Step 1: rename the legacy RoleMenus table if needed
+    -------------------------------------------------------------------------
+    IF OBJECT_ID('dbo.RoleMenus', 'U') IS NOT NULL
+       AND COL_LENGTH('dbo.RoleMenus', 'MenuId') IS NULL
+       AND COL_LENGTH('dbo.RoleMenus', 'MenuCode') IS NOT NULL
+       AND OBJECT_ID('dbo.RoleMenus_Legacy', 'U') IS NULL
+    BEGIN
+        EXEC sp_rename 'dbo.RoleMenus', 'RoleMenus_Legacy';
+    END
+
+    -------------------------------------------------------------------------
+    -- Step 2: create the new tables if they do not already exist
+    -------------------------------------------------------------------------
+    IF OBJECT_ID('dbo.Menus', 'U') IS NULL
+    BEGIN
+        CREATE TABLE dbo.Menus (
+            MenuId        bigint IDENTITY(1,1) NOT NULL CONSTRAINT PK_Menus PRIMARY KEY,
+            MenuCode      nvarchar(50)  NOT NULL,
+            ParentMenuId  bigint        NULL,
+            MenuName      nvarchar(100) NOT NULL,
+            MenuUrl       nvarchar(200) NULL,
+            Icon          nvarchar(50)  NULL,
+            Visible       bit           NOT NULL CONSTRAINT DF_Menus_Visible DEFAULT (1),
+            OrderNo       int           NOT NULL CONSTRAINT DF_Menus_OrderNo DEFAULT (0),
+            IsDeleted     bit           NOT NULL CONSTRAINT DF_Menus_IsDeleted DEFAULT (0),
+            CreatedById   bigint        NULL,
+            CreatedAt     datetime2(0)  NOT NULL CONSTRAINT DF_Menus_CreatedAt DEFAULT (SYSUTCDATETIME()),
+            UpdatedById   bigint        NULL,
+            UpdatedAt     datetime2(0)  NULL,
+            CONSTRAINT UQ_Menus_MenuCode UNIQUE (MenuCode)
+        );
+
+        ALTER TABLE dbo.Menus
+            ADD CONSTRAINT FK_Menus_ParentMenu
+            FOREIGN KEY (ParentMenuId) REFERENCES dbo.Menus(MenuId);
+
+        CREATE INDEX IX_Menus_ParentMenuId ON dbo.Menus(ParentMenuId);
+    END
+
+    IF OBJECT_ID('dbo.Permissions', 'U') IS NULL
+    BEGIN
+        CREATE TABLE dbo.Permissions (
+            PermissionId    bigint IDENTITY(1,1) NOT NULL CONSTRAINT PK_Permissions PRIMARY KEY,
+            PermissionCode  nvarchar(50)  NOT NULL,
+            MenuId          bigint        NOT NULL,
+            ActionName      nvarchar(100) NOT NULL,
+            ApiName         nvarchar(100) NOT NULL,
+            HttpMethod      nvarchar(20)  NULL,
+            Visible         bit           NOT NULL CONSTRAINT DF_Permissions_Visible DEFAULT (1),
+            OrderNo         int           NOT NULL CONSTRAINT DF_Permissions_OrderNo DEFAULT (0),
+            IsDeleted       bit           NOT NULL CONSTRAINT DF_Permissions_IsDeleted DEFAULT (0),
+            CreatedById     bigint        NULL,
+            CreatedAt       datetime2(0)  NOT NULL CONSTRAINT DF_Permissions_CreatedAt DEFAULT (SYSUTCDATETIME()),
+            UpdatedById     bigint        NULL,
+            UpdatedAt       datetime2(0)  NULL,
+            CONSTRAINT UQ_Permissions_PermissionCode UNIQUE (PermissionCode)
+        );
+
+        ALTER TABLE dbo.Permissions
+            ADD CONSTRAINT FK_Permissions_Menu
+            FOREIGN KEY (MenuId) REFERENCES dbo.Menus(MenuId);
+
+        CREATE INDEX IX_Permissions_MenuId ON dbo.Permissions(MenuId);
+    END
+
+    IF OBJECT_ID('dbo.RoleMenus', 'U') IS NULL
+    BEGIN
+        CREATE TABLE dbo.RoleMenus (
+            RoleMenuId   bigint IDENTITY(1,1) NOT NULL CONSTRAINT PK_RoleMenus PRIMARY KEY,
+            RoleId       bigint       NOT NULL,
+            MenuId       bigint       NOT NULL,
+            IsDeleted    bit          NOT NULL CONSTRAINT DF_RoleMenus_IsDeleted DEFAULT (0),
+            CreatedById  bigint       NULL,
+            CreatedAt    datetime2(0) NOT NULL CONSTRAINT DF_RoleMenus_CreatedAt DEFAULT (SYSUTCDATETIME()),
+            UpdatedById  bigint       NULL,
+            UpdatedAt    datetime2(0) NULL,
+            CONSTRAINT UQ_RoleMenus_Role_Menu UNIQUE (RoleId, MenuId)
+        );
+
+        ALTER TABLE dbo.RoleMenus
+            ADD CONSTRAINT FK_RoleMenus_Roles
+            FOREIGN KEY (RoleId) REFERENCES dbo.Roles(Id);
+
+        ALTER TABLE dbo.RoleMenus
+            ADD CONSTRAINT FK_RoleMenus_Menus
+            FOREIGN KEY (MenuId) REFERENCES dbo.Menus(MenuId);
+
+        CREATE INDEX IX_RoleMenus_RoleId ON dbo.RoleMenus(RoleId);
+        CREATE INDEX IX_RoleMenus_MenuId ON dbo.RoleMenus(MenuId);
+    END
+
+    IF OBJECT_ID('dbo.RolePermissions', 'U') IS NULL
+    BEGIN
+        CREATE TABLE dbo.RolePermissions (
+            RolePermissionId bigint IDENTITY(1,1) NOT NULL CONSTRAINT PK_RolePermissions PRIMARY KEY,
+            RoleId           bigint       NOT NULL,
+            PermissionId     bigint       NOT NULL,
+            IsDeleted        bit          NOT NULL CONSTRAINT DF_RolePermissions_IsDeleted DEFAULT (0),
+            CreatedById      bigint       NULL,
+            CreatedAt        datetime2(0) NOT NULL CONSTRAINT DF_RolePermissions_CreatedAt DEFAULT (SYSUTCDATETIME()),
+            UpdatedById      bigint       NULL,
+            UpdatedAt        datetime2(0) NULL,
+            CONSTRAINT UQ_RolePermissions_Role_Permission UNIQUE (RoleId, PermissionId)
+        );
+
+        ALTER TABLE dbo.RolePermissions
+            ADD CONSTRAINT FK_RolePermissions_Roles
+            FOREIGN KEY (RoleId) REFERENCES dbo.Roles(Id);
+
+        ALTER TABLE dbo.RolePermissions
+            ADD CONSTRAINT FK_RolePermissions_Permissions
+            FOREIGN KEY (PermissionId) REFERENCES dbo.Permissions(PermissionId);
+
+        CREATE INDEX IX_RolePermissions_RoleId ON dbo.RolePermissions(RoleId);
+        CREATE INDEX IX_RolePermissions_PermissionId ON dbo.RolePermissions(PermissionId);
+    END
+
+    -------------------------------------------------------------------------
+    -- Step 3: build mapping tables from the old source tables
+    -------------------------------------------------------------------------
+    IF OBJECT_ID('tempdb..#MenuStage') IS NOT NULL DROP TABLE #MenuStage;
+    IF OBJECT_ID('tempdb..#PermissionStage') IS NOT NULL DROP TABLE #PermissionStage;
+
+    CREATE TABLE #MenuStage (
+        OldMenuCode   nvarchar(50) NOT NULL PRIMARY KEY,
+        OldParentCode nvarchar(50) NULL,
+        NewMenuId     bigint NOT NULL
+    );
+
+    CREATE TABLE #PermissionStage (
+        OldPermissionCode nvarchar(50) NOT NULL PRIMARY KEY,
+        OldParentCode     nvarchar(50) NOT NULL,
+        NewPermissionId   bigint NOT NULL
+    );
+
+    -------------------------------------------------------------------------
+    -- Step 4: copy menus
+    -------------------------------------------------------------------------
+    IF OBJECT_ID('dbo.Menus', 'U') IS NOT NULL AND NOT EXISTS (SELECT 1 FROM dbo.Menus)
+    BEGIN
+        INSERT INTO dbo.Menus (
+            MenuCode, ParentMenuId, MenuName, MenuUrl, Icon,
+            Visible, OrderNo, IsDeleted,
+            CreatedById, CreatedAt, UpdatedById, UpdatedAt
+        )
+        OUTPUT
+            inserted.MenuCode,
+            inserted.MenuId
+        INTO #MenuStage (OldMenuCode, NewMenuId)
+        SELECT
+            src.MenuCode,
+            NULL,
+            src.MenuName,
+            src.MenuUrl,
+            src.Icon,
+            src.Visible,
+            src.OrderNo,
+            CASE WHEN src.DelFlag = 0 THEN 0 ELSE 1 END,
+            TRY_CONVERT(bigint, src.CreatedUserId),
+            src.CreatedDateTime,
+            TRY_CONVERT(bigint, src.ModifiedUserId),
+            src.ModifiedDateTime
+        FROM dbo.MenuAdmins src
+        WHERE src.DelFlag = 0;
+
+        UPDATE stage
+        SET stage.OldParentCode = src.ParentCode
+        FROM #MenuStage stage
+        INNER JOIN dbo.MenuAdmins src
+            ON src.MenuCode = stage.OldMenuCode;
+
+        UPDATE m
+        SET ParentMenuId = parent.NewMenuId
+        FROM dbo.Menus m
+        INNER JOIN #MenuStage child
+            ON child.NewMenuId = m.MenuId
+        LEFT JOIN #MenuStage parent
+            ON parent.OldMenuCode = NULLIF(LTRIM(RTRIM(child.OldParentCode)), '')
+        WHERE NULLIF(LTRIM(RTRIM(child.OldParentCode)), '') IS NOT NULL
+          AND LTRIM(RTRIM(child.OldParentCode)) <> '0';
+    END
+
+    -------------------------------------------------------------------------
+    -- Step 5: copy permissions
+    -------------------------------------------------------------------------
+    IF OBJECT_ID('dbo.Permissions', 'U') IS NOT NULL AND NOT EXISTS (SELECT 1 FROM dbo.Permissions)
+    BEGIN
+        INSERT INTO dbo.Permissions (
+            PermissionCode, MenuId, ActionName, ApiName, HttpMethod,
+            Visible, OrderNo, IsDeleted,
+            CreatedById, CreatedAt, UpdatedById, UpdatedAt
+        )
+        OUTPUT
+            inserted.PermissionCode,
+            inserted.PermissionId
+        INTO #PermissionStage (OldPermissionCode, NewPermissionId)
+        SELECT
+            src.MenuDetailCode,
+            m.NewMenuId,
+            src.ActionName,
+            src.ApiName,
+            NULL,
+            src.Visible,
+            src.OrderNo,
+            CASE WHEN src.DelFlag = 0 THEN 0 ELSE 1 END,
+            TRY_CONVERT(bigint, src.CreatedUserId),
+            src.CreatedDateTime,
+            TRY_CONVERT(bigint, src.ModifiedUserId),
+            src.ModifiedDateTime
+        FROM dbo.MenuAdminDetails src
+        INNER JOIN #MenuStage m
+            ON m.OldMenuCode = src.ParentMenuCode
+        WHERE src.DelFlag = 0;
+
+        UPDATE stage
+        SET stage.OldParentCode = src.ParentMenuCode
+        FROM #PermissionStage stage
+        INNER JOIN dbo.MenuAdminDetails src
+            ON src.MenuDetailCode = stage.OldPermissionCode;
+    END
+
+    -------------------------------------------------------------------------
+    -- Step 6: copy role assignments from the legacy table if it exists
+    -------------------------------------------------------------------------
+    IF OBJECT_ID('dbo.RoleMenus_Legacy', 'U') IS NOT NULL
+    BEGIN
+        INSERT INTO dbo.RoleMenus (
+            RoleId, MenuId, IsDeleted,
+            CreatedById, CreatedAt, UpdatedById, UpdatedAt
+        )
+        SELECT DISTINCT
+            COALESCE(roleById.Id, roleByCode.Id) AS RoleId,
+            menuStage.NewMenuId,
+            0,
+            TRY_CONVERT(bigint, src.CreatedUserId),
+            src.CreatedDateTime,
+            TRY_CONVERT(bigint, src.ModifiedUserId),
+            src.ModifiedDateTime
+        FROM dbo.RoleMenus_Legacy src
+        LEFT JOIN dbo.Roles roleById
+            ON roleById.Id = src.RoleId
+           AND roleById.IsDeleted <> 1
+        LEFT JOIN dbo.Roles roleByCode
+            ON roleByCode.Name = src.RoleCode
+           AND roleByCode.IsDeleted <> 1
+        INNER JOIN #MenuStage menuStage
+            ON menuStage.OldMenuCode = src.MenuCode
+        WHERE src.DelFlag = 0
+          AND COALESCE(roleById.Id, roleByCode.Id) IS NOT NULL;
+
+        INSERT INTO dbo.RolePermissions (
+            RoleId, PermissionId, IsDeleted,
+            CreatedById, CreatedAt, UpdatedById, UpdatedAt
+        )
+        SELECT DISTINCT
+            COALESCE(roleById.Id, roleByCode.Id) AS RoleId,
+            permStage.NewPermissionId,
+            0,
+            TRY_CONVERT(bigint, src.CreatedUserId),
+            src.CreatedDateTime,
+            TRY_CONVERT(bigint, src.ModifiedUserId),
+            src.ModifiedDateTime
+        FROM dbo.RoleMenus_Legacy src
+        LEFT JOIN dbo.Roles roleById
+            ON roleById.Id = src.RoleId
+           AND roleById.IsDeleted <> 1
+        LEFT JOIN dbo.Roles roleByCode
+            ON roleByCode.Name = src.RoleCode
+           AND roleByCode.IsDeleted <> 1
+        INNER JOIN #PermissionStage permStage
+            ON permStage.OldPermissionCode = src.MenuCode
+        WHERE src.DelFlag = 0
+          AND COALESCE(roleById.Id, roleByCode.Id) IS NOT NULL;
+
+        INSERT INTO dbo.RoleMenus (
+            RoleId, MenuId, IsDeleted,
+            CreatedById, CreatedAt, UpdatedById, UpdatedAt
+        )
+        SELECT DISTINCT
+            COALESCE(roleById.Id, roleByCode.Id) AS RoleId,
+            parentMenu.NewMenuId,
+            0,
+            TRY_CONVERT(bigint, src.CreatedUserId),
+            src.CreatedDateTime,
+            TRY_CONVERT(bigint, src.ModifiedUserId),
+            src.ModifiedDateTime
+        FROM dbo.RoleMenus_Legacy src
+        LEFT JOIN dbo.Roles roleById
+            ON roleById.Id = src.RoleId
+           AND roleById.IsDeleted <> 1
+        LEFT JOIN dbo.Roles roleByCode
+            ON roleByCode.Name = src.RoleCode
+           AND roleByCode.IsDeleted <> 1
+        INNER JOIN #PermissionStage permStage
+            ON permStage.OldPermissionCode = src.MenuCode
+        INNER JOIN #MenuStage parentMenu
+            ON parentMenu.OldMenuCode = permStage.OldParentCode
+        WHERE src.DelFlag = 0
+          AND COALESCE(roleById.Id, roleByCode.Id) IS NOT NULL;
+    END
+
+    COMMIT TRANSACTION;
+END TRY
+BEGIN CATCH
+    IF @@TRANCOUNT > 0
+        ROLLBACK TRANSACTION;
+
+    THROW;
+END CATCH;