fix: match the menu access and permissions

TaskTrackingSystem.Database/AppDbContextModels/AppDbContext.cs

@@ -23,10 +23,6 @@ public partial class AppDbContext : DbContext
 
     public virtual DbSet<Menu> Menus { get; set; }
 
-    public virtual DbSet<MenuAdmin> MenuAdmins { get; set; }
-
-    public virtual DbSet<MenuAdminDetail> MenuAdminDetails { get; set; }
-
     public virtual DbSet<Permission> Permissions { get; set; }
 
     public virtual DbSet<Project> Projects { get; set; }
@@ -37,8 +33,6 @@ public partial class AppDbContext : DbContext
 
     public virtual DbSet<RoleMenu> RoleMenus { get; set; }
 
-    public virtual DbSet<RoleMenusLegacy> RoleMenusLegacies { get; set; }
-
     public virtual DbSet<RolePermission> RolePermissions { get; set; }
 
     public virtual DbSet<Task> Tasks { get; set; }
@@ -132,31 +126,6 @@ public partial class AppDbContext : DbContext
                 .HasConstraintName("FK_Menus_ParentMenu");
         });
 
-        modelBuilder.Entity<MenuAdmin>(entity =>
-        {
-            entity.HasKey(e => e.AdminMenuId);
-
-            entity.Property(e => e.AdminMenuId).HasMaxLength(50);
-            entity.Property(e => e.CreatedUserId).HasMaxLength(50);
-            entity.Property(e => e.Icon).HasMaxLength(50);
-            entity.Property(e => e.MenuCode).HasMaxLength(50);
-            entity.Property(e => e.MenuName).HasMaxLength(100);
-            entity.Property(e => e.MenuUrl).HasMaxLength(200);
-            entity.Property(e => e.ModifiedUserId).HasMaxLength(50);
-            entity.Property(e => e.ParentCode).HasMaxLength(50);
-        });
-
-        modelBuilder.Entity<MenuAdminDetail>(entity =>
-        {
-            entity.Property(e => e.MenuAdminDetailId).HasMaxLength(50);
-            entity.Property(e => e.ActionName).HasMaxLength(50);
-            entity.Property(e => e.ApiName).HasMaxLength(100);
-            entity.Property(e => e.CreatedUserId).HasMaxLength(50);
-            entity.Property(e => e.MenuDetailCode).HasMaxLength(50);
-            entity.Property(e => e.ModifiedUserId).HasMaxLength(50);
-            entity.Property(e => e.ParentMenuCode).HasMaxLength(50);
-        });
-
         modelBuilder.Entity<Permission>(entity =>
         {
             entity.HasIndex(e => e.MenuId, "IX_Permissions_MenuId");
@@ -252,21 +221,6 @@ public partial class AppDbContext : DbContext
                 .HasConstraintName("FK_RoleMenus_Roles");
         });
 
-        modelBuilder.Entity<RoleMenusLegacy>(entity =>
-        {
-            entity.HasKey(e => e.RoleMenuId).HasName("PK_RoleMenus");
-
-            entity.ToTable("RoleMenus_Legacy");
-
-            entity.HasIndex(e => e.RoleId, "IX_RoleMenus_RoleId");
-
-            entity.Property(e => e.RoleMenuId).HasMaxLength(50);
-            entity.Property(e => e.CreatedUserId).HasMaxLength(50);
-            entity.Property(e => e.MenuCode).HasMaxLength(50);
-            entity.Property(e => e.ModifiedUserId).HasMaxLength(50);
-            entity.Property(e => e.RoleCode).HasMaxLength(50);
-        });
-
         modelBuilder.Entity<RolePermission>(entity =>
         {
             entity.HasIndex(e => e.PermissionId, "IX_RolePermissions_PermissionId");

TaskTrackingSystem.Database/AppDbContextModels/MenuAdmin.cs

@@ -1,33 +0,0 @@
-using System;
-using System.Collections.Generic;
-
-namespace TaskTrackingSystem.Database.AppDbContextModels;
-
-public partial class MenuAdmin
-{
-    public string AdminMenuId { get; set; } = null!;
-
-    public string MenuCode { get; set; } = null!;
-
-    public string ParentCode { get; set; } = null!;
-
-    public string MenuName { get; set; } = null!;
-
-    public string? MenuUrl { get; set; }
-
-    public bool Visible { get; set; }
-
-    public int OrderNo { get; set; }
-
-    public string? Icon { get; set; }
-
-    public int DelFlag { get; set; }
-
-    public string? CreatedUserId { get; set; }
-
-    public DateTime CreatedDateTime { get; set; }
-
-    public string? ModifiedUserId { get; set; }
-
-    public DateTime? ModifiedDateTime { get; set; }
-}

TaskTrackingSystem.Database/AppDbContextModels/MenuAdminDetail.cs

@@ -1,31 +0,0 @@
-using System;
-using System.Collections.Generic;
-
-namespace TaskTrackingSystem.Database.AppDbContextModels;
-
-public partial class MenuAdminDetail
-{
-    public string MenuAdminDetailId { get; set; } = null!;
-
-    public string MenuDetailCode { get; set; } = null!;
-
-    public string ParentMenuCode { get; set; } = null!;
-
-    public string ActionName { get; set; } = null!;
-
-    public string ApiName { get; set; } = null!;
-
-    public bool Visible { get; set; }
-
-    public int OrderNo { get; set; }
-
-    public int DelFlag { get; set; }
-
-    public string? CreatedUserId { get; set; }
-
-    public DateTime CreatedDateTime { get; set; }
-
-    public string? ModifiedUserId { get; set; }
-
-    public DateTime? ModifiedDateTime { get; set; }
-}

TaskTrackingSystem.Database/AppDbContextModels/RoleMenusLegacy.cs

@@ -1,25 +0,0 @@
-using System;
-using System.Collections.Generic;
-
-namespace TaskTrackingSystem.Database.AppDbContextModels;
-
-public partial class RoleMenusLegacy
-{
-    public string RoleMenuId { get; set; } = null!;
-
-    public string RoleCode { get; set; } = null!;
-
-    public string MenuCode { get; set; } = null!;
-
-    public int DelFlag { get; set; }
-
-    public string? CreatedUserId { get; set; }
-
-    public DateTime CreatedDateTime { get; set; }
-
-    public string? ModifiedUserId { get; set; }
-
-    public DateTime? ModifiedDateTime { get; set; }
-
-    public long RoleId { get; set; }
-}

TaskTrackingSystem.Shared/Models/Menu/AccessPermissionDto.cs

@@ -4,8 +4,8 @@ namespace TaskTrackingSystem.Shared.Models.Menu
 {
     public class AccessPermissionDto
     {
-        public string MenuAdminDetailId { get; set; } = string.Empty;
-        public string MenuDetailCode { get; set; } = string.Empty;
+        public string PermissionId { get; set; } = string.Empty;
+        public string PermissionCode { get; set; } = string.Empty;
         public string ParentMenuCode { get; set; } = string.Empty;
         public string ActionName { get; set; } = string.Empty;
         public string ApiName { get; set; } = string.Empty;

TaskTrackingSystem.WebApi/Features/Menu/MenuController.cs

@@ -50,6 +50,15 @@ namespace TaskTrackingSystem.WebApi.Features.Menu
             return Ok(menus);
         }
 
+        [HttpGet("access-codes")]
+        public async Task<ActionResult<IEnumerable<string>>> GetCurrentAccessCodes()
+        {
+            var roleId = User.GetRoleId();
+            var roleName = User.GetRoleName() ?? string.Empty;
+            var codes = await _menuService.GetCurrentAccessCodesAsync(roleId, roleName);
+            return Ok(codes);
+        }
+
         /// <summary>
         /// Returns a lightweight version string for the current user's role permissions.
         /// Clients poll this to detect when an admin has changed permissions without fetching the full menu list.

TaskTrackingSystem.WebApi/Features/Menu/MenuService.cs

@@ -261,8 +261,8 @@ namespace TaskTrackingSystem.WebApi.Features.Menu
                 {
                     dto.Permissions.Add(new AccessPermissionDto
                     {
-                        MenuAdminDetailId = permission.PermissionId.ToString(),
-                        MenuDetailCode = permission.PermissionCode,
+                        PermissionId = permission.PermissionId.ToString(),
+                        PermissionCode = permission.PermissionCode,
                         ParentMenuCode = menuLookup.TryGetValue(permission.MenuId, out var parentMenu) ? parentMenu.MenuCode : string.Empty,
                         ActionName = permission.ActionName,
                         ApiName = permission.ApiName,
@@ -274,6 +274,38 @@ namespace TaskTrackingSystem.WebApi.Features.Menu
 
             return menuDtos;
         }
+
+        public async Task<List<string>> GetCurrentAccessCodesAsync(long roleId, string roleName)
+        {
+            if (roleId <= 0 && !string.IsNullOrWhiteSpace(roleName))
+            {
+                var role = await _db.Roles.FirstOrDefaultAsync(r => r.Name == roleName && r.IsDeleted != true);
+                if (role != null)
+                {
+                    roleId = role.Id;
+                }
+            }
+
+            if (roleId <= 0)
+            {
+                return new List<string>();
+            }
+
+            var menuCodes = await _db.RoleMenus
+                .Where(rm => rm.RoleId == roleId && !rm.IsDeleted)
+                .Select(rm => rm.Menu.MenuCode)
+                .ToListAsync();
+
+            var permissionCodes = await _db.RolePermissions
+                .Where(rp => rp.RoleId == roleId && !rp.IsDeleted)
+                .Select(rp => rp.Permission.PermissionCode)
+                .ToListAsync();
+
+            return menuCodes
+                .Concat(permissionCodes)
+                .Distinct(StringComparer.OrdinalIgnoreCase)
+                .ToList();
+        }
     }
 }
 

TaskTrackingSystem.WebApi/Features/Project/ProjectController.cs

@@ -14,10 +14,12 @@ namespace TaskTrackingSystem.WebApi.Features.Project
     public class ProjectController : ControllerBase
     {
         private readonly ProjectService _projectService;
+        private readonly PermissionAuthorizationService _permissionAuthorizationService;
 
-        public ProjectController(ProjectService projectService)
+        public ProjectController(ProjectService projectService, PermissionAuthorizationService permissionAuthorizationService)
         {
             _projectService = projectService;
+            _permissionAuthorizationService = permissionAuthorizationService;
         }
 
         [HttpGet]
@@ -39,27 +41,39 @@ namespace TaskTrackingSystem.WebApi.Features.Project
         }
 
         [HttpPost]
-        [Authorize(Roles = "Admin")]
         public async Task<ActionResult<Result<ProjectDto>>> CreateProject([FromBody] CreateProjectDto createProjectDto)
         {
+            if (!await _permissionAuthorizationService.CanAccessAsync(User, "api/Project", "Create"))
+            {
+                return Forbid();
+            }
+
             long? currentUserId = User.GetUserId();
             var result = await _projectService.CreateProjectAsync(createProjectDto, currentUserId);
             return StatusCode(result.StatusCode, result);
         }
 
         [HttpPut("{id}")]
-        [Authorize(Roles = "Admin")]
         public async Task<ActionResult<Result>> UpdateProject(long id, [FromBody] UpdateProjectDto updateProjectDto)
         {
+            if (!await _permissionAuthorizationService.CanAccessAsync(User, "api/Project", "Update"))
+            {
+                return Forbid();
+            }
+
             long? currentUserId = User.GetUserId();
             var result = await _projectService.UpdateProjectAsync(id, updateProjectDto, currentUserId);
             return StatusCode(result.StatusCode, result);
         }
 
         [HttpDelete("{id}")]
-        [Authorize(Roles = "Admin")]
         public async Task<ActionResult<Result>> DeleteProject(long id)
         {
+            if (!await _permissionAuthorizationService.CanAccessAsync(User, "api/Project", "Delete"))
+            {
+                return Forbid();
+            }
+
             var result = await _projectService.SoftDeleteProjectAsync(id);
             return StatusCode(result.StatusCode, result);
         }
@@ -72,9 +86,13 @@ namespace TaskTrackingSystem.WebApi.Features.Project
         }
 
         [HttpPost("{id}/members")]
-        [Authorize(Roles = "Admin")]
         public async Task<IActionResult> AssignProjectMembers(long id, [FromBody] AssignMembersDto dto)
         {
+            if (!await _permissionAuthorizationService.CanAccessAsync(User, "api/Project", "Update"))
+            {
+                return Forbid();
+            }
+
             var result = await _projectService.AssignMembersToProjectAsync(id, dto, User.GetUserId());
             if (!result.IsSuccess)
             {
@@ -84,9 +102,13 @@ namespace TaskTrackingSystem.WebApi.Features.Project
         }
 
         [HttpDelete("{id}/members/{userId}")]
-        [Authorize(Roles = "Admin")]
         public async Task<IActionResult> RemoveProjectMember(long id, long userId)
         {
+            if (!await _permissionAuthorizationService.CanAccessAsync(User, "api/Project", "Update"))
+            {
+                return Forbid();
+            }
+
             var result = await _projectService.RemoveMemberFromProjectAsync(id, userId, User.GetUserId());
             if (!result.IsSuccess)
             {

TaskTrackingSystem.WebApi/Features/Role/RoleController.cs

@@ -2,24 +2,32 @@ using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.Authorization;
 using TaskTrackingSystem.Shared;
 using TaskTrackingSystem.Shared.Models.Role;
+using TaskTrackingSystem.WebApi.Infrastructure;
 
 namespace TaskTrackingSystem.WebApi.Features.Role
 {
     [Route("api/[controller]")]
     [ApiController]
-    [Authorize(Roles = "Admin")]
+    [Authorize]
     public class RoleController : ControllerBase
     {
         private readonly RoleService _roleService;
+        private readonly PermissionAuthorizationService _permissionAuthorizationService;
 
-        public RoleController(RoleService roleService)
+        public RoleController(RoleService roleService, PermissionAuthorizationService permissionAuthorizationService)
         {
             _roleService = roleService;
+            _permissionAuthorizationService = permissionAuthorizationService;
         }
 
         [HttpGet]
         public async Task<ActionResult<IEnumerable<RoleDto>>> GetRoles()
         {
+            if (!await _permissionAuthorizationService.CanAccessAsync(User, "api/Role", "List"))
+            {
+                return Forbid();
+            }
+
             var roles = await _roleService.GetAllRolesAsync();
             return Ok(roles);
         }
@@ -27,6 +35,11 @@ namespace TaskTrackingSystem.WebApi.Features.Role
         [HttpGet("{id}")]
         public async Task<ActionResult<RoleDto>> GetRole(long id)
         {
+            if (!await _permissionAuthorizationService.CanAccessAsync(User, "api/Role", "List"))
+            {
+                return Forbid();
+            }
+
             var role = await _roleService.GetRoleByIdAsync(id);
             if (role == null)
             {
@@ -38,6 +51,11 @@ namespace TaskTrackingSystem.WebApi.Features.Role
         [HttpPost]
         public async Task<ActionResult<Result<RoleDto>>> CreateRole([FromBody] CreateRoleDto createRoleDto)
         {
+            if (!await _permissionAuthorizationService.CanAccessAsync(User, "api/Role", "Create"))
+            {
+                return Forbid();
+            }
+
             long? currentUserId = null;
             var result = await _roleService.CreateRoleAsync(createRoleDto, currentUserId);
             return StatusCode(result.StatusCode, result);
@@ -46,6 +64,11 @@ namespace TaskTrackingSystem.WebApi.Features.Role
         [HttpPut("{id}")]
         public async Task<ActionResult<Result>> UpdateRole(long id, [FromBody] UpdateRoleDto updateRoleDto)
         {
+            if (!await _permissionAuthorizationService.CanAccessAsync(User, "api/Role", "Update"))
+            {
+                return Forbid();
+            }
+
             long? currentUserId = null;
             var result = await _roleService.UpdateRoleAsync(id, updateRoleDto, currentUserId);
             return StatusCode(result.StatusCode, result);
@@ -54,6 +77,11 @@ namespace TaskTrackingSystem.WebApi.Features.Role
         [HttpDelete("{id}")]
         public async Task<ActionResult<Result>> DeleteRole(long id)
         {
+            if (!await _permissionAuthorizationService.CanAccessAsync(User, "api/Role", "Delete"))
+            {
+                return Forbid();
+            }
+
             var result = await _roleService.SoftDeleteRoleAsync(id);
             return StatusCode(result.StatusCode, result);
         }
@@ -63,6 +91,11 @@ namespace TaskTrackingSystem.WebApi.Features.Role
         [HttpGet("{id}/access")]
         public async Task<ActionResult<Result<List<string>>>> GetAssignedAccessCodes(long id)
         {
+            if (!await _permissionAuthorizationService.CanAccessAsync(User, "api/Role", "Update"))
+            {
+                return Forbid();
+            }
+
             var result = await _roleService.GetAssignedAccessCodesByRoleIdAsync(id);
             if (!result.IsSuccess)
             {
@@ -75,6 +108,11 @@ namespace TaskTrackingSystem.WebApi.Features.Role
         [HttpPost("{id}/access")]
         public async Task<IActionResult> AssignAccess(long id, [FromBody] AssignAccessDto dto)
         {
+            if (!await _permissionAuthorizationService.CanAccessAsync(User, "api/Role", "Update"))
+            {
+                return Forbid();
+            }
+
             var result = await _roleService.AssignAccessToRoleAsync(id, dto);
             if (!result.IsSuccess)
             {

TaskTrackingSystem.WebApi/Features/Task/TaskController.cs

@@ -14,10 +14,12 @@ namespace TaskTrackingSystem.WebApi.Features.Task
     public class TaskController : ControllerBase
     {
         private readonly TaskService _taskService;
+        private readonly PermissionAuthorizationService _permissionAuthorizationService;
 
-        public TaskController(TaskService taskService)
+        public TaskController(TaskService taskService, PermissionAuthorizationService permissionAuthorizationService)
         {
             _taskService = taskService;
+            _permissionAuthorizationService = permissionAuthorizationService;
         }
 
         [HttpGet]
@@ -41,6 +43,11 @@ namespace TaskTrackingSystem.WebApi.Features.Task
         [HttpPost]
         public async Task<ActionResult<Result<TaskDto>>> CreateTask([FromBody] CreateTaskDto createTaskDto)
         {
+            if (!await _permissionAuthorizationService.CanAccessAsync(User, "api/Task", "Create"))
+            {
+                return Forbid();
+            }
+
             long? currentUserId = User.GetUserId();
             var result = await _taskService.CreateTaskAsync(createTaskDto, currentUserId);
             return StatusCode(result.StatusCode, result);
@@ -49,6 +56,11 @@ namespace TaskTrackingSystem.WebApi.Features.Task
         [HttpPut("{id}")]
         public async Task<ActionResult<Result>> UpdateTask(long id, [FromBody] UpdateTaskDto updateTaskDto)
         {
+            if (!await _permissionAuthorizationService.CanAccessAsync(User, "api/Task", "Update"))
+            {
+                return Forbid();
+            }
+
             long? currentUserId = User.GetUserId();
             var result = await _taskService.UpdateTaskAsync(id, updateTaskDto, User.GetRoleName(), currentUserId);
             return StatusCode(result.StatusCode, result);
@@ -57,6 +69,11 @@ namespace TaskTrackingSystem.WebApi.Features.Task
         [HttpDelete("{id}")]
         public async Task<ActionResult<Result>> DeleteTask(long id)
         {
+            if (!await _permissionAuthorizationService.CanAccessAsync(User, "api/Task", "Delete"))
+            {
+                return Forbid();
+            }
+
             var result = await _taskService.SoftDeleteTaskAsync(id, User.GetRoleName(), User.GetUserId());
             return StatusCode(result.StatusCode, result);
         }
@@ -71,6 +88,11 @@ namespace TaskTrackingSystem.WebApi.Features.Task
         [HttpPatch("{id}/status")]
         public async Task<IActionResult> UpdateTaskStatus(long id, [FromQuery] long statusId)
         {
+            if (!await _permissionAuthorizationService.CanAccessAsync(User, "api/Task", "Update"))
+            {
+                return Forbid();
+            }
+
             var result = await _taskService.UpdateTaskStatusAsync(id, statusId, User.GetRoleName(), User.GetUserId());
             if (!result.IsSuccess)
             {

TaskTrackingSystem.WebApi/Features/User/UserController.cs

@@ -4,6 +4,7 @@ using Microsoft.AspNetCore.Authorization;
 using TaskTrackingSystem.Shared;
 using TaskTrackingSystem.Shared.Models.User;
 using TaskTrackingSystem.WebApi.Features.User;
+using TaskTrackingSystem.WebApi.Infrastructure;
 
 namespace TaskTrackingSystem.WebApi.Features.User
 {
@@ -13,10 +14,12 @@ namespace TaskTrackingSystem.WebApi.Features.User
     public class UserController : ControllerBase
     {
         private readonly UserService _userService;
+        private readonly PermissionAuthorizationService _permissionAuthorizationService;
 
-        public UserController(UserService userService)
+        public UserController(UserService userService, PermissionAuthorizationService permissionAuthorizationService)
         {
             _userService = userService;
+            _permissionAuthorizationService = permissionAuthorizationService;
         }
 
         [HttpGet]
@@ -38,27 +41,39 @@ namespace TaskTrackingSystem.WebApi.Features.User
         }
 
         [HttpPost]
-        [Authorize(Roles = "Admin")]
         public async Task<ActionResult<Result<UserDto>>> CreateUser([FromBody] CreateUserDto createUserDto)
         {
+            if (!await _permissionAuthorizationService.CanAccessAsync(User, "api/User", "Create"))
+            {
+                return Forbid();
+            }
+
             long? currentUserId = null;
             var result = await _userService.CreateUserAsync(createUserDto, currentUserId);
             return StatusCode(result.StatusCode, result);
         }
 
         [HttpPut("{id}")]
-        [Authorize(Roles = "Admin")]
         public async Task<ActionResult<Result>> UpdateUser(long id, [FromBody] UpdateUserDto updateUserDto)
         {
+            if (!await _permissionAuthorizationService.CanAccessAsync(User, "api/User", "Update"))
+            {
+                return Forbid();
+            }
+
             long? currentUserId = null;
             var result = await _userService.UpdateUserAsync(id, updateUserDto, currentUserId);
             return StatusCode(result.StatusCode, result);
         }
 
         [HttpDelete("{id}")]
-        [Authorize(Roles = "Admin")]
         public async Task<ActionResult<Result>> DeleteUser(long id)
         {
+            if (!await _permissionAuthorizationService.CanAccessAsync(User, "api/User", "Delete"))
+            {
+                return Forbid();
+            }
+
             long? loggedInUserId = null;
             var nameIdentifier = User.FindFirst(System.Security.Claims.ClaimTypes.NameIdentifier)?.Value;
             if (nameIdentifier != null && long.TryParse(nameIdentifier, out var parsedId))

TaskTrackingSystem.WebApi/Infrastructure/PermissionAuthorizationService.cs

@@ -0,0 +1,62 @@
+using Microsoft.EntityFrameworkCore;
+using System.Security.Claims;
+using TaskTrackingSystem.Database.AppDbContextModels;
+
+namespace TaskTrackingSystem.WebApi.Infrastructure;
+
+public class PermissionAuthorizationService
+{
+    private readonly AppDbContext _db;
+
+    public PermissionAuthorizationService(AppDbContext db)
+    {
+        _db = db;
+    }
+
+    public async Task<bool> CanAccessAsync(ClaimsPrincipal user, string apiName, string actionName)
+    {
+        if (user.Identity?.IsAuthenticated != true)
+        {
+            return false;
+        }
+
+        if (user.IsInRole("Admin"))
+        {
+            return true;
+        }
+
+        var roleId = await ResolveRoleIdAsync(user);
+        if (roleId <= 0)
+        {
+            return false;
+        }
+
+        return await _db.RolePermissions
+            .AnyAsync(rp =>
+                rp.RoleId == roleId &&
+                !rp.IsDeleted &&
+                !rp.Permission.IsDeleted &&
+                rp.Permission.ApiName == apiName &&
+                rp.Permission.ActionName == actionName);
+    }
+
+    private async Task<long> ResolveRoleIdAsync(ClaimsPrincipal user)
+    {
+        var roleId = user.GetRoleId();
+        if (roleId > 0)
+        {
+            return roleId;
+        }
+
+        var roleName = user.GetRoleName();
+        if (string.IsNullOrWhiteSpace(roleName))
+        {
+            return 0;
+        }
+
+        return await _db.Roles
+            .Where(r => r.Name == roleName && r.IsDeleted != true)
+            .Select(r => r.Id)
+            .FirstOrDefaultAsync();
+    }
+}

TaskTrackingSystem.WebApi/Program.cs

@@ -30,6 +30,7 @@ builder.Services.AddScoped<TaskTrackingSystem.WebApi.Features.Task.TaskService>(
 builder.Services.AddScoped<TaskTrackingSystem.WebApi.Features.Dashboard.DashboardService>();
 builder.Services.AddScoped<TaskTrackingSystem.WebApi.Features.Report.ReportService>();
 builder.Services.AddScoped<TaskTrackingSystem.WebApi.Features.Menu.MenuService>();
+builder.Services.AddScoped<TaskTrackingSystem.WebApi.Infrastructure.PermissionAuthorizationService>();
 builder.Services.AddScoped<IPasswordHasher<TaskTrackingSystem.Database.AppDbContextModels.User>, PasswordHasher<TaskTrackingSystem.Database.AppDbContextModels.User>>();
 // Learn more about configuring Swagger/OpenAPI at https://aka.ms/aspnetcore/swashbuckle
 builder.Services.AddAuthorization();

TaskTrackingSystem.WebApp/Components/CustomAuthenticationStateProvider.cs

@@ -52,14 +52,15 @@ public class CustomAuthenticationStateProvider : AuthenticationStateProvider
         var roleId = user.FindFirst("role_id")?.Value;
         if (!string.IsNullOrWhiteSpace(roleId))
         {
-            _sessionState.CachedMenuRoleId = $"id:{roleId}";
+            _sessionState.CachedAccessRoleId = $"id:{roleId}";
             return;
         }
 
         var roleName = user.FindFirst(System.Security.Claims.ClaimTypes.Role)?.Value;
         if (!string.IsNullOrWhiteSpace(roleName))
         {
-            _sessionState.CachedMenuRoleId = $"name:{roleName}";
+            _sessionState.CachedAccessRoleId = $"name:{roleName}";
         }
     }
 }
+

TaskTrackingSystem.WebApp/Components/Layout/NavMenu.razor

@@ -51,7 +51,7 @@
     else
     {
         <div class="px-4 py-6 text-xs text-slate-400">
-            No menu items are available for this role.
+            No access items are available for this role.
         </div>
     }
 </nav>
@@ -126,7 +126,7 @@
                 }
                 else
                 {
-                    // Menus are the same — just refresh expanded state for the new route.
+                    // Access items are the same — just refresh expanded state for the new route.
                     foreach (var menu in menus)
                     {
                         if (menu.SubMenus != null && menu.SubMenus.Count > 0 && IsMenuExpanded(menu.MenuCode, menu.SubMenus))

TaskTrackingSystem.WebApp/Components/Pages/Home.razor

@@ -13,6 +13,7 @@
 @inject ApiClientService ApiClient
 @inject IJSRuntime JS
 @inject AuthenticationStateProvider AuthStateProvider
+@inject MenuAuthorizationService MenuAuthorization
 @inject NavigationManager Navigation
 
 <PageTitle>Dashboard</PageTitle>
@@ -39,9 +40,12 @@ else
                 <p class="text-slate-500 mt-1">Here's what's happening across your workspace today.</p>
             </div>
             <div class="flex gap-3">
-                <a href="/tasks" class="inline-flex items-center rounded-xl bg-violet-600 text-white px-4 py-2.5 text-sm font-semibold hover:bg-violet-700 transition-colors shadow-sm">
-                    <i data-lucide="plus" class="h-4 w-4 mr-2"></i> New Task
-                </a>
+                @if (canCreateTask)
+                {
+                    <a href="/tasks" class="inline-flex items-center rounded-xl bg-violet-600 text-white px-4 py-2.5 text-sm font-semibold hover:bg-violet-700 transition-colors shadow-sm">
+                        <i data-lucide="plus" class="h-4 w-4 mr-2"></i> New Task
+                    </a>
+                }
                 <a href="/reports/tasks" class="inline-flex items-center rounded-xl bg-violet-600 text-white px-4 py-2.5 text-sm font-semibold hover:bg-violet-700 transition-colors shadow-sm">
                     <i data-lucide="bar-chart-3" class="h-4 w-4 mr-2"></i> Reports
                 </a>
@@ -272,9 +276,12 @@ else
     private string currentUserName = "User";
     private string currentUserRole = "Member";
     private List<DateTime> weekDates = new();
+    private bool canCreateTask = false;
 
     protected override async Task OnInitializedAsync()
     {
+        var authState = await AuthStateProvider.GetAuthenticationStateAsync();
+        canCreateTask = authState.User.IsInRole("Admin") || await MenuAuthorization.HasAccessCodeAsync(authState.User, "Tasks_Create");
         await LoadDashboardData();
     }
 

TaskTrackingSystem.WebApp/Components/Pages/KanbanBoard.razor

@@ -28,10 +28,13 @@
                 <p class="text-slate-500 mt-1">@(ProjectId > 0 ? $"Project #{ProjectId} — " : "Global View — ")Drag tasks between columns.</p>
             </div>
         </div>
-        <button @onclick="OpenCreateTaskModal" class="inline-flex items-center rounded-lg bg-violet-600 px-4 py-2.5 text-sm font-medium text-white hover:bg-violet-700 transition-colors shadow-sm">
-            <i data-lucide="plus" class="h-4 w-4 mr-2"></i>
-            New Task
-        </button>
+        @if (canCreateTask)
+        {
+            <button @onclick="OpenCreateTaskModal" class="inline-flex items-center rounded-lg bg-violet-600 px-4 py-2.5 text-sm font-medium text-white hover:bg-violet-700 transition-colors shadow-sm">
+                <i data-lucide="plus" class="h-4 w-4 mr-2"></i>
+                New Task
+            </button>
+        }
     </div>
 
     @if (isLoading)
@@ -169,6 +172,7 @@
     private bool isLoading = true;
     private bool isAdmin = false;
     private bool isManager = false;
+    private bool canCreateTask = false;
     private long currentUserId = 0;
     private bool showTaskModal = false;
     private bool isSaving = false;
@@ -223,6 +227,11 @@
 
     protected override async Task OnInitializedAsync()
     {
+        var authState = await AuthStateProvider.GetAuthenticationStateAsync();
+        var user = authState.User;
+        isAdmin = user.IsInRole("Admin");
+        isManager = user.IsInRole("Manager");
+        canCreateTask = isAdmin || await MenuAuthorization.HasAccessCodeAsync(user, "Tasks_Create");
         await LoadTasks();
     }
 

TaskTrackingSystem.WebApp/Components/Pages/ProjectAssign.razor

@@ -8,6 +8,8 @@
 @inject ApiClientService ApiClient
 @inject IJSRuntime JS
 @inject NavigationManager Navigation
+@inject AuthenticationStateProvider AuthStateProvider
+@inject MenuAuthorizationService MenuAuthorization
 
 <PageTitle>Project Assignment</PageTitle>
 
@@ -186,11 +188,14 @@
                                 </p>
                             }
                         </div>
-                        <button @onclick="RequestSaveConfirmation" disabled="@(isSaving || isLoadingMembers)"
-                                class="w-full sm:w-auto inline-flex items-center justify-center rounded-lg bg-violet-600 px-5 py-2.5 text-sm font-semibold text-white hover:bg-violet-700 disabled:opacity-50 transition-colors shadow-sm">
-                            <i data-lucide="user-check" class="h-4 w-4 mr-2"></i>
-                            @(isSaving ? "Saving changes..." : "Save Assignment Changes")
-                        </button>
+                        @if (canSaveAssignments)
+                        {
+                            <button @onclick="RequestSaveConfirmation" disabled="@(isSaving || isLoadingMembers)"
+                                    class="w-full sm:w-auto inline-flex items-center justify-center rounded-lg bg-violet-600 px-5 py-2.5 text-sm font-semibold text-white hover:bg-violet-700 disabled:opacity-50 transition-colors shadow-sm">
+                                <i data-lucide="user-check" class="h-4 w-4 mr-2"></i>
+                                @(isSaving ? "Saving changes..." : "Save Assignment Changes")
+                            </button>
+                        }
                     </div>
                 }
             </div>
@@ -210,6 +215,7 @@
     private bool isLoading = true;
     private bool isLoadingMembers = false;
     private bool isSaving = false;
+    private bool canSaveAssignments = false;
     private bool showConfirmDialog = false;
     private string? statusMessage;
     private string? successMessage;
@@ -231,6 +237,8 @@
 
     protected override async Task OnInitializedAsync()
     {
+        var authState = await AuthStateProvider.GetAuthenticationStateAsync();
+        canSaveAssignments = authState.User.IsInRole("Admin") || await MenuAuthorization.HasAccessCodeAsync(authState.User, "Projects_Update");
         var client = ApiClient.CreateClient();
         try
         {

TaskTrackingSystem.WebApp/Components/Pages/Projects.razor

@@ -22,7 +22,7 @@
             <h2 class="text-3xl font-bold tracking-tight text-slate-900">Projects</h2>
             <p class="text-slate-500 mt-1">@(isAdmin ? "Manage all projects." : "Your assigned projects.")</p>
         </div>
-        @if (isAdmin)
+        @if (canCreateProject)
         {
             <button @onclick="OpenCreateModal" class="inline-flex items-center rounded-lg bg-violet-600 px-4 py-2.5 text-sm font-medium text-white hover:bg-violet-700 transition-colors shadow-sm">
                 <i data-lucide="plus" class="h-4 w-4 mr-2"></i>
@@ -90,17 +90,26 @@
                                         <button @onclick="() => NavigateToKanban(project.Id)" class="rounded-lg p-1.5 text-slate-400 hover:bg-violet-50 hover:text-violet-600 transition-all" title="View Board">
                                             <i data-lucide="kanban" class="h-4 w-4"></i>
                                         </button>
-                                        @if (isAdmin)
+                                        @if (canAssignProject || canEditProject || canDeleteProject)
                                         {
-                                            <button @onclick="() => OpenAssignModal(project)" class="rounded-lg p-1.5 text-slate-400 hover:bg-indigo-50 hover:text-indigo-600 transition-all" title="Assign Members">
-                                                <i data-lucide="user-plus" class="h-4 w-4"></i>
-                                            </button>
-                                            <button @onclick="() => OpenEditModal(project)" class="rounded-lg p-1.5 text-slate-400 hover:bg-amber-50 hover:text-amber-600 transition-all" title="Edit">
-                                                <i data-lucide="pencil" class="h-4 w-4"></i>
-                                            </button>
-                                            <button @onclick="() => RequestDeleteConfirmation(project.Id)" class="rounded-lg p-1.5 text-slate-400 hover:bg-rose-50 hover:text-rose-600 transition-all" title="Delete">
-                                                <i data-lucide="trash-2" class="h-4 w-4"></i>
-                                            </button>
+                                            @if (canAssignProject)
+                                            {
+                                                <button @onclick="() => OpenAssignModal(project)" class="rounded-lg p-1.5 text-slate-400 hover:bg-indigo-50 hover:text-indigo-600 transition-all" title="Assign Members">
+                                                    <i data-lucide="user-plus" class="h-4 w-4"></i>
+                                                </button>
+                                            }
+                                            @if (canEditProject)
+                                            {
+                                                <button @onclick="() => OpenEditModal(project)" class="rounded-lg p-1.5 text-slate-400 hover:bg-amber-50 hover:text-amber-600 transition-all" title="Edit">
+                                                    <i data-lucide="pencil" class="h-4 w-4"></i>
+                                                </button>
+                                            }
+                                            @if (canDeleteProject)
+                                            {
+                                                <button @onclick="() => RequestDeleteConfirmation(project.Id)" class="rounded-lg p-1.5 text-slate-400 hover:bg-rose-50 hover:text-rose-600 transition-all" title="Delete">
+                                                    <i data-lucide="trash-2" class="h-4 w-4"></i>
+                                                </button>
+                                            }
                                         }
                                     </div>
                                 </td>
@@ -109,7 +118,7 @@
                     }
                     else
                     {
-                        <EmptyState ColSpan="5" Icon="folder-kanban" Title="No projects yet" Subtitle="@(isAdmin ? "Create your first project to get started." : "You have not been assigned to any projects.")" />
+                        <EmptyState ColSpan="5" Icon="folder-kanban" Title="No projects yet" Subtitle="@(canCreateProject ? "Create your first project to get started." : "You have not been assigned to any projects.")" />
                     }
                 </tbody>
             </table>
@@ -293,6 +302,10 @@
 @code {
     private bool isLoading = true;
     private bool isAdmin = false;
+    private bool canCreateProject = false;
+    private bool canEditProject = false;
+    private bool canDeleteProject = false;
+    private bool canAssignProject = false;
     private long currentUserId = 0;
     private bool showModal = false;
     private bool isEditing = false;
@@ -377,6 +390,7 @@
         isAdmin = user.IsInRole("Admin");
         var idStr = user.FindFirst(System.Security.Claims.ClaimTypes.NameIdentifier)?.Value;
         if (idStr != null) long.TryParse(idStr, out currentUserId);
+        await LoadProjectAccessAsync(user);
         await LoadProjects();
     }
 
@@ -411,6 +425,14 @@
     private void HandlePageChanged(int page) { currentPage = page; }
     private void HandlePageSizeChanged(int size) { pageSize = size; currentPage = 1; }
 
+    private async Task LoadProjectAccessAsync(System.Security.Claims.ClaimsPrincipal user)
+    {
+        canCreateProject = isAdmin || await MenuAuthorization.HasAccessCodeAsync(user, "Projects_Create");
+        canEditProject = isAdmin || await MenuAuthorization.HasAccessCodeAsync(user, "Projects_Update");
+        canDeleteProject = isAdmin || await MenuAuthorization.HasAccessCodeAsync(user, "Projects_Delete");
+        canAssignProject = isAdmin || await MenuAuthorization.HasAccessCodeAsync(user, "Projects_Update");
+    }
+
     private void ClearValidation()
     {
         isNameError = false;

TaskTrackingSystem.WebApp/Components/Pages/Roles.razor

@@ -1,10 +1,13 @@
 @page "/roles"
 @using Microsoft.AspNetCore.Authorization
+@using Microsoft.AspNetCore.Components.Authorization
 @using TaskTrackingSystem.Shared.Models.Menu
 @rendermode @(new InteractiveServerRenderMode(prerender: false))
 @attribute [Microsoft.AspNetCore.Authorization.Authorize]
 @inject ApiClientService ApiClient
 @inject IJSRuntime JS
+@inject AuthenticationStateProvider AuthStateProvider
+@inject MenuAuthorizationService MenuAuthorization
 
 
 
@@ -19,10 +22,13 @@
             <h2 class="text-3xl font-bold tracking-tight text-slate-900">Roles & Access</h2>
             <p class="text-slate-500 mt-1">Manage roles, assign access and permissions, and control visibility.</p>
         </div>
-        <button @onclick="OpenCreateModal" class="inline-flex items-center rounded-lg bg-violet-600 px-4 py-2.5 text-sm font-medium text-white hover:bg-violet-700 transition-colors shadow-sm">
-            <i data-lucide="plus" class="h-4 w-4 mr-2"></i>
-            New Role
-        </button>
+        @if (canCreateRole)
+        {
+            <button @onclick="OpenCreateModal" class="inline-flex items-center rounded-lg bg-violet-600 px-4 py-2.5 text-sm font-medium text-white hover:bg-violet-700 transition-colors shadow-sm">
+                <i data-lucide="plus" class="h-4 w-4 mr-2"></i>
+                New Role
+            </button>
+        }
     </div>
 
     @if (isLoading)
@@ -77,18 +83,27 @@
                                 <td class="px-6 py-4 text-sm text-slate-400">@role.CreatedAt.ToString("dd-MMM-yyyy")</td>
                                 <td class="px-6 py-4 text-right">
                                     <div class="flex items-center justify-end space-x-2">
-                                        <button @onclick="() => OpenAccessModal(role)"
-                                                class="inline-flex items-center gap-1.5 rounded-lg px-2.5 py-1.5 text-xs font-medium text-indigo-700 bg-indigo-50 hover:bg-indigo-100 transition-all"
-                                                title="Manage Access">
-                                            <i data-lucide="shield-check" class="h-3.5 w-3.5"></i>
-                                            Access
-                                        </button>
-                                        <button @onclick="() => OpenEditModal(role)" class="rounded-lg p-1.5 text-slate-400 hover:bg-amber-50 hover:text-amber-600 transition-all" title="Edit">
-                                            <i data-lucide="pencil" class="h-4 w-4"></i>
-                                        </button>
-                                        <button @onclick="() => RequestDeleteConfirmation(role.Id)" class="rounded-lg p-1.5 text-slate-400 hover:bg-rose-50 hover:text-rose-600 transition-all" title="Delete">
-                                            <i data-lucide="trash-2" class="h-4 w-4"></i>
-                                        </button>
+                                        @if (canManageAccess)
+                                        {
+                                            <button @onclick="() => OpenAccessModal(role)"
+                                                    class="inline-flex items-center gap-1.5 rounded-lg px-2.5 py-1.5 text-xs font-medium text-indigo-700 bg-indigo-50 hover:bg-indigo-100 transition-all"
+                                                    title="Manage Access">
+                                                <i data-lucide="shield-check" class="h-3.5 w-3.5"></i>
+                                                Access
+                                            </button>
+                                        }
+                                        @if (canEditRole)
+                                        {
+                                            <button @onclick="() => OpenEditModal(role)" class="rounded-lg p-1.5 text-slate-400 hover:bg-amber-50 hover:text-amber-600 transition-all" title="Edit">
+                                                <i data-lucide="pencil" class="h-4 w-4"></i>
+                                            </button>
+                                        }
+                                        @if (canDeleteRole)
+                                        {
+                                            <button @onclick="() => RequestDeleteConfirmation(role.Id)" class="rounded-lg p-1.5 text-slate-400 hover:bg-rose-50 hover:text-rose-600 transition-all" title="Delete">
+                                                <i data-lucide="trash-2" class="h-4 w-4"></i>
+                                            </button>
+                                        }
                                     </div>
                                 </td>
                             </tr>
@@ -256,13 +271,13 @@
                                                             <div class="flex flex-wrap gap-2 pl-7 mt-1">
                                                                 @foreach (var action in child.Permissions)
                                                                 {
-                                                                    var isActionChecked = formSelectedAccessCodes.Contains(action.MenuDetailCode);
+                                                                    var isActionChecked = formSelectedAccessCodes.Contains(action.PermissionCode);
                                                                     <label class="inline-flex items-center gap-1.5 px-2.5 py-1 rounded-md border cursor-pointer select-none transition-all
                                                                                   @(isActionChecked
                                                                                       ? "bg-violet-50 border-violet-200 text-violet-700"
                                                                                       : "bg-white border-slate-200 text-slate-500 hover:border-violet-200 hover:text-violet-500")">
                                                                         <input type="checkbox" checked="@isActionChecked"
-                                                                               @onchange="(e) => TogglePermissionSelection(action.MenuDetailCode, (bool)(e.Value ?? false), isForm: true)"
+                                                                               @onchange="(e) => TogglePermissionSelection(action.PermissionCode, (bool)(e.Value ?? false), isForm: true)"
                                                                                class="h-3 w-3 rounded accent-violet-600" />
                                                                         <span class="text-xs">@action.ActionName</span>
                                                                     </label>
@@ -279,13 +294,13 @@
                                             <div class="px-5 py-2.5 bg-white flex flex-wrap gap-2">
                                                 @foreach (var action in parent.Permissions)
                                                 {
-                                                    var isActionChecked = formSelectedAccessCodes.Contains(action.MenuDetailCode);
+                                                    var isActionChecked = formSelectedAccessCodes.Contains(action.PermissionCode);
                                                     <label class="inline-flex items-center gap-1.5 px-2.5 py-1 rounded-lg border cursor-pointer select-none transition-all
                                                                   @(isActionChecked
                                                                       ? "bg-violet-50 border-violet-200 text-violet-700 shadow-sm"
                                                                       : "bg-white border-slate-200 text-slate-500 hover:border-violet-200 hover:text-violet-500")">
                                                         <input type="checkbox" checked="@isActionChecked"
-                                                               @onchange="(e) => TogglePermissionSelection(action.MenuDetailCode, (bool)(e.Value ?? false), isForm: true)"
+                                                               @onchange="(e) => TogglePermissionSelection(action.PermissionCode, (bool)(e.Value ?? false), isForm: true)"
                                                                class="h-3.5 w-3.5 rounded accent-violet-600" />
                                                         <span class="text-xs font-medium">@action.ActionName</span>
                                                     </label>
@@ -420,13 +435,13 @@
                                                 <div class="flex flex-wrap gap-2 pl-7 mt-1.5">
                                                     @foreach (var action in child.Permissions)
                                                     {
-                                                        var isActionChecked = selectedAccessCodes.Contains(action.MenuDetailCode);
+                                                        var isActionChecked = selectedAccessCodes.Contains(action.PermissionCode);
                                                         <label class="inline-flex items-center gap-1.5 px-2.5 py-1 rounded-md border cursor-pointer select-none transition-all
                                                                       @(isActionChecked
                                                                           ? "bg-violet-50 border-violet-200 text-violet-700"
                                                                           : "bg-white border-slate-200 text-slate-500 hover:border-violet-200 hover:text-violet-500")">
                                                             <input type="checkbox" checked="@isActionChecked"
-                                                                   @onchange="(e) => TogglePermissionSelection(action.MenuDetailCode, (bool)(e.Value ?? false), isForm: false)"
+                                                                   @onchange="(e) => TogglePermissionSelection(action.PermissionCode, (bool)(e.Value ?? false), isForm: false)"
                                                                    class="h-3 w-3 rounded accent-violet-600" />
                                                             <span class="text-xs">@action.ActionName</span>
                                                         </label>
@@ -443,13 +458,13 @@
                                 <div class="px-6 py-3.5 bg-white flex flex-wrap gap-2.5">
                                     @foreach (var action in parent.Permissions)
                                     {
-                                        var isActionChecked = selectedAccessCodes.Contains(action.MenuDetailCode);
+                                        var isActionChecked = selectedAccessCodes.Contains(action.PermissionCode);
                                         <label class="inline-flex items-center gap-1.5 px-3 py-1.5 rounded-lg border cursor-pointer select-none transition-all
                                                       @(isActionChecked
                                                           ? "bg-violet-50 border-violet-300 text-violet-700 shadow-sm"
                                                           : "bg-white border-slate-200 text-slate-500 hover:border-violet-200 hover:text-violet-500")">
                                             <input type="checkbox" checked="@isActionChecked"
-                                                   @onchange="(e) => TogglePermissionSelection(action.MenuDetailCode, (bool)(e.Value ?? false), isForm: false)"
+                                                   @onchange="(e) => TogglePermissionSelection(action.PermissionCode, (bool)(e.Value ?? false), isForm: false)"
                                                    class="h-3.5 w-3.5 rounded accent-violet-600" />
                                             <span class="text-xs font-medium">@action.ActionName</span>
                                         </label>
@@ -520,6 +535,10 @@
     private bool showAccessModal = false;
     private bool isEditing = false;
     private bool isSaving = false;
+    private bool canCreateRole = false;
+    private bool canEditRole = false;
+    private bool canDeleteRole = false;
+    private bool canManageAccess = false;
     private string? roleError;
     private bool isRoleNameError = false;
     private string roleNameErrorMsg = "";
@@ -597,6 +616,12 @@
 
     protected override async Task OnInitializedAsync()
     {
+        var authState = await AuthStateProvider.GetAuthenticationStateAsync();
+        var user = authState.User;
+        canCreateRole = await MenuAuthorization.HasAccessCodeAsync(user, "Roles_Create");
+        canEditRole = await MenuAuthorization.HasAccessCodeAsync(user, "Roles_Update");
+        canDeleteRole = await MenuAuthorization.HasAccessCodeAsync(user, "Roles_Delete");
+        canManageAccess = canEditRole;
         await LoadRoles();
     }
 
@@ -700,7 +725,7 @@
             // Select direct actions
             foreach (var action in menu.Permissions)
             {
-                targetSet.Add(action.MenuDetailCode);
+                targetSet.Add(action.PermissionCode);
             }
             // Select child menus and their actions
             var children = allMenuSource.Where(c => c.ParentCode == menu.MenuCode).ToList();
@@ -709,7 +734,7 @@
                 targetSet.Add(child.MenuCode);
                 foreach (var action in child.Permissions)
                 {
-                    targetSet.Add(action.MenuDetailCode);
+                    targetSet.Add(action.PermissionCode);
                 }
             }
         }
@@ -719,7 +744,7 @@
             // Unselect direct actions
             foreach (var action in menu.Permissions)
             {
-                targetSet.Remove(action.MenuDetailCode);
+                targetSet.Remove(action.PermissionCode);
             }
             // Unselect child menus and their actions
             var children = allMenuSource.Where(c => c.ParentCode == menu.MenuCode).ToList();
@@ -728,7 +753,7 @@
                 targetSet.Remove(child.MenuCode);
                 foreach (var action in child.Permissions)
                 {
-                    targetSet.Remove(action.MenuDetailCode);
+                    targetSet.Remove(action.PermissionCode);
                 }
             }
         }
@@ -760,7 +785,7 @@
                 formSelectedAccessCodes.Add(menu.MenuCode);
                 foreach (var action in menu.Permissions)
                 {
-                    formSelectedAccessCodes.Add(action.MenuDetailCode);
+                    formSelectedAccessCodes.Add(action.PermissionCode);
                 }
             }
         }
@@ -951,7 +976,7 @@
                 selectedAccessCodes.Add(menu.MenuCode);
                 foreach (var action in menu.Permissions)
                 {
-                    selectedAccessCodes.Add(action.MenuDetailCode);
+                    selectedAccessCodes.Add(action.PermissionCode);
                 }
             }
         }

TaskTrackingSystem.WebApp/Components/Pages/TaskAssign.razor

@@ -9,6 +9,8 @@
 @inject ApiClientService ApiClient
 @inject IJSRuntime JS
 @inject NavigationManager Navigation
+@inject AuthenticationStateProvider AuthStateProvider
+@inject MenuAuthorizationService MenuAuthorization
 
 <PageTitle>Task Assignment</PageTitle>
 
@@ -221,11 +223,14 @@
                                 </p>
                             }
                         </div>
-                        <button @onclick="RequestSaveConfirmation" disabled="@isSaving"
-                                class="w-full sm:w-auto inline-flex items-center justify-center rounded-lg bg-violet-600 px-5 py-2.5 text-sm font-semibold text-white hover:bg-violet-700 disabled:opacity-50 transition-colors shadow-sm">
-                            <i data-lucide="user-check" class="h-4 w-4 mr-2"></i>
-                            @(isSaving ? "Saving..." : "Save Assignment")
-                        </button>
+                        @if (canSaveAssignments)
+                        {
+                            <button @onclick="RequestSaveConfirmation" disabled="@isSaving"
+                                    class="w-full sm:w-auto inline-flex items-center justify-center rounded-lg bg-violet-600 px-5 py-2.5 text-sm font-semibold text-white hover:bg-violet-700 disabled:opacity-50 transition-colors shadow-sm">
+                                <i data-lucide="user-check" class="h-4 w-4 mr-2"></i>
+                                @(isSaving ? "Saving..." : "Save Assignment")
+                            </button>
+                        }
                     </div>
                 }
             </div>
@@ -244,6 +249,7 @@
 @code {
     private bool isLoading = true;
     private bool isSaving = false;
+    private bool canSaveAssignments = false;
     private bool showConfirmDialog = false;
     private string? statusMessage;
     private string? successMessage;
@@ -268,6 +274,8 @@
 
     protected override async Task OnInitializedAsync()
     {
+        var authState = await AuthStateProvider.GetAuthenticationStateAsync();
+        canSaveAssignments = authState.User.IsInRole("Admin") || await MenuAuthorization.HasAccessCodeAsync(authState.User, "Tasks_Update");
         var client = ApiClient.CreateClient();
         try
         {

TaskTrackingSystem.WebApp/Components/Pages/Tasks.razor

@@ -7,6 +7,7 @@
 @inject ApiClientService ApiClient
 @inject IJSRuntime JS
 @inject AuthenticationStateProvider AuthStateProvider
+@inject MenuAuthorizationService MenuAuthorization
 @inject NavigationManager Navigation
 
 <PageTitle>Tasks</PageTitle>
@@ -37,10 +38,13 @@
                 </button>
             </div>
             
-            <button @onclick="OpenCreateModal" class="inline-flex items-center rounded-lg bg-violet-600 px-4 py-2.5 text-sm font-medium text-white hover:bg-violet-700 transition-colors shadow-sm">
-                <i data-lucide="plus" class="h-4 w-4 mr-2"></i>
-                New Task
-            </button>
+            @if (canCreateTask)
+            {
+                <button @onclick="OpenCreateModal" class="inline-flex items-center rounded-lg bg-violet-600 px-4 py-2.5 text-sm font-medium text-white hover:bg-violet-700 transition-colors shadow-sm">
+                    <i data-lucide="plus" class="h-4 w-4 mr-2"></i>
+                    New Task
+                </button>
+            }
         </div>
     </div>
 
@@ -108,9 +112,12 @@
                                     <h3 class="font-bold text-sm text-slate-800">@proj.Name</h3>
                                     <span class="px-2.5 py-0.5 rounded-full bg-slate-200/80 text-[10px] text-slate-500 font-semibold font-sans">@projTasks.Count tasks</span>
                                 </div>
-                                <button @onclick="() => OpenCreateModalForProject(proj.Id)" class="inline-flex items-center text-xs font-semibold text-emerald-600 hover:text-emerald-800 transition-colors">
-                                    <i data-lucide="plus" class="h-3 w-3 mr-1"></i> Add Task
-                                </button>
+                                @if (canCreateTask)
+                                {
+                                    <button @onclick="() => OpenCreateModalForProject(proj.Id)" class="inline-flex items-center text-xs font-semibold text-emerald-600 hover:text-emerald-800 transition-colors">
+                                        <i data-lucide="plus" class="h-3 w-3 mr-1"></i> Add Task
+                                    </button>
+                                }
                             </div>
 
                             <!-- Tasks List (Vertical Backlog rows) -->
@@ -120,7 +127,7 @@
                                     <div class="flex flex-col sm:flex-row sm:items-center justify-between p-4 hover:bg-slate-50/40 transition-colors gap-3">
                                         <!-- Left section -->
                                         <div class="flex items-start space-x-3 flex-1 min-w-0">
-                                            <input type="checkbox" checked="@(task.StatusId == 3)" @onchange="() => ToggleTaskStatus(task)" class="h-4 w-4 rounded border-slate-300 text-violet-600 accent-violet-600 focus:ring-violet-500 mt-1 cursor-pointer shrink-0" />
+                                            <input type="checkbox" checked="@(task.StatusId == 3)" @onchange="() => ToggleTaskStatus(task)" disabled="@(!canUpdateTask)" class="h-4 w-4 rounded border-slate-300 text-violet-600 accent-violet-600 focus:ring-violet-500 mt-1 cursor-pointer shrink-0 disabled:cursor-not-allowed disabled:opacity-50" />
                                             <div class="min-w-0">
                                                 <div class="flex items-center space-x-2">
                                                     <span class="text-[10px] font-bold text-slate-400 font-mono tracking-wider font-semibold">TASK-#@task.Id</span>
@@ -146,12 +153,18 @@
                                             </span>
                                             
                                             <div class="flex items-center space-x-1">
-                                                <button @onclick="() => OpenEditModal(task)" class="rounded-lg p-1.5 text-slate-400 hover:bg-amber-50 hover:text-amber-600 transition-all" title="Edit">
-                                                    <i data-lucide="pencil" class="h-3.5 w-3.5"></i>
-                                                </button>
-                                                <button @onclick="() => RequestDeleteConfirmation(task.Id)" class="rounded-lg p-1.5 text-slate-400 hover:bg-rose-50 hover:text-rose-600 transition-all" title="Delete">
-                                                    <i data-lucide="trash-2" class="h-3.5 w-3.5"></i>
-                                                </button>
+                                                @if (canEditTask)
+                                                {
+                                                    <button @onclick="() => OpenEditModal(task)" class="rounded-lg p-1.5 text-slate-400 hover:bg-amber-50 hover:text-amber-600 transition-all" title="Edit">
+                                                        <i data-lucide="pencil" class="h-3.5 w-3.5"></i>
+                                                    </button>
+                                                }
+                                                @if (canDeleteTask)
+                                                {
+                                                    <button @onclick="() => RequestDeleteConfirmation(task.Id)" class="rounded-lg p-1.5 text-slate-400 hover:bg-rose-50 hover:text-rose-600 transition-all" title="Delete">
+                                                        <i data-lucide="trash-2" class="h-3.5 w-3.5"></i>
+                                                    </button>
+                                                }
                                             </div>
                                         </div>
                                     </div>
@@ -293,12 +306,18 @@
                                     </td>
                                     <td class="px-6 py-4 text-right">
                                         <div class="flex items-center justify-end space-x-2">
-                                            <button @onclick="() => OpenEditModal(task)" class="rounded-lg p-1.5 text-slate-400 hover:bg-amber-50 hover:text-amber-600 transition-all" title="Edit">
-                                                <i data-lucide="pencil" class="h-4 w-4"></i>
-                                            </button>
-                                            <button @onclick="() => RequestDeleteConfirmation(task.Id)" class="rounded-lg p-1.5 text-slate-400 hover:bg-rose-50 hover:text-rose-600 transition-all" title="Delete">
-                                                <i data-lucide="trash-2" class="h-4 w-4"></i>
-                                            </button>
+                                            @if (canEditTask)
+                                            {
+                                                <button @onclick="() => OpenEditModal(task)" class="rounded-lg p-1.5 text-slate-400 hover:bg-amber-50 hover:text-amber-600 transition-all" title="Edit">
+                                                    <i data-lucide="pencil" class="h-4 w-4"></i>
+                                                </button>
+                                            }
+                                            @if (canDeleteTask)
+                                            {
+                                                <button @onclick="() => RequestDeleteConfirmation(task.Id)" class="rounded-lg p-1.5 text-slate-400 hover:bg-rose-50 hover:text-rose-600 transition-all" title="Delete">
+                                                    <i data-lucide="trash-2" class="h-4 w-4"></i>
+                                                </button>
+                                            }
                                         </div>
                                     </td>
                                 </tr>
@@ -448,6 +467,10 @@
     private bool isLoading = true;
     private bool isAdmin = false;
     private bool isManager = false;
+    private bool canCreateTask = false;
+    private bool canEditTask = false;
+    private bool canDeleteTask = false;
+    private bool canUpdateTask = false;
     private long currentUserId = 0;
     private bool showModal = false;
     private bool isEditing = false;
@@ -645,6 +668,7 @@
         isManager = user.IsInRole("Manager");
         var idStr = user.FindFirst(System.Security.Claims.ClaimTypes.NameIdentifier)?.Value;
         if (idStr != null) long.TryParse(idStr, out currentUserId);
+        await LoadTaskAccessAsync(user);
 
         var client = ApiClient.CreateClient();
         try
@@ -708,6 +732,14 @@
         currentPage = 1;
     }
 
+    private async Task LoadTaskAccessAsync(System.Security.Claims.ClaimsPrincipal user)
+    {
+        canCreateTask = isAdmin || await MenuAuthorization.HasAccessCodeAsync(user, "Tasks_Create");
+        canEditTask = isAdmin || await MenuAuthorization.HasAccessCodeAsync(user, "Tasks_Update");
+        canDeleteTask = isAdmin || await MenuAuthorization.HasAccessCodeAsync(user, "Tasks_Delete");
+        canUpdateTask = canEditTask;
+    }
+
     private void OpenCreateModal()
     {
         isEditing = false;

TaskTrackingSystem.WebApp/Components/Pages/Users.razor

@@ -6,6 +6,7 @@
 @inject IJSRuntime JS
 @using Microsoft.AspNetCore.Components.Authorization
 @inject AuthenticationStateProvider AuthStateProvider
+@inject MenuAuthorizationService MenuAuthorization
 
 <PageTitle>Users</PageTitle>
 
@@ -18,10 +19,13 @@
             <h2 class="text-3xl font-bold tracking-tight text-slate-900">Users</h2>
             <p class="text-slate-500 mt-1">Manage system users and their roles.</p>
         </div>
-        <button @onclick="OpenCreateModal" class="inline-flex items-center rounded-lg bg-violet-600 px-4 py-2.5 text-sm font-medium text-white hover:bg-violet-700 transition-colors shadow-sm">
-            <i data-lucide="plus" class="h-4 w-4 mr-2"></i>
-            New User
-        </button>
+        @if (canCreateUser)
+        {
+            <button @onclick="OpenCreateModal" class="inline-flex items-center rounded-lg bg-violet-600 px-4 py-2.5 text-sm font-medium text-white hover:bg-violet-700 transition-colors shadow-sm">
+                <i data-lucide="plus" class="h-4 w-4 mr-2"></i>
+                New User
+            </button>
+        }
     </div>
 
     <!-- Search and Filters -->
@@ -111,12 +115,18 @@
                                 </td>
                                 <td class="px-6 py-4 text-right">
                                     <div class="flex items-center justify-end space-x-2">
-                                        <button @onclick="() => OpenEditModal(user)" class="rounded-lg p-1.5 text-slate-400 hover:bg-amber-50 hover:text-amber-600 transition-all" title="Edit">
-                                            <i data-lucide="pencil" class="h-4 w-4"></i>
-                                        </button>
-                                        <button @onclick="() => RequestDeleteConfirmation(user.Id)" class="rounded-lg p-1.5 text-slate-400 hover:bg-rose-50 hover:text-rose-600 transition-all" title="Delete">
-                                            <i data-lucide="trash-2" class="h-4 w-4"></i>
-                                        </button>
+                                        @if (canEditUser)
+                                        {
+                                            <button @onclick="() => OpenEditModal(user)" class="rounded-lg p-1.5 text-slate-400 hover:bg-amber-50 hover:text-amber-600 transition-all" title="Edit">
+                                                <i data-lucide="pencil" class="h-4 w-4"></i>
+                                            </button>
+                                        }
+                                        @if (canDeleteUser)
+                                        {
+                                            <button @onclick="() => RequestDeleteConfirmation(user.Id)" class="rounded-lg p-1.5 text-slate-400 hover:bg-rose-50 hover:text-rose-600 transition-all" title="Delete">
+                                                <i data-lucide="trash-2" class="h-4 w-4"></i>
+                                            </button>
+                                        }
                                     </div>
                                 </td>
                             </tr>
@@ -264,6 +274,9 @@
     private bool showModal = false;
     private bool isEditing = false;
     private bool isSaving = false;
+    private bool canCreateUser = false;
+    private bool canEditUser = false;
+    private bool canDeleteUser = false;
     private string? errorMessage;
 
     // Per-field validation errors
@@ -368,6 +381,12 @@
 
     protected override async Task OnInitializedAsync()
     {
+        var authState = await AuthStateProvider.GetAuthenticationStateAsync();
+        var user = authState.User;
+        canCreateUser = await MenuAuthorization.HasAccessCodeAsync(user, "Users_Create");
+        canEditUser = await MenuAuthorization.HasAccessCodeAsync(user, "Users_Update");
+        canDeleteUser = await MenuAuthorization.HasAccessCodeAsync(user, "Users_Delete");
+
         var client = ApiClient.CreateClient();
         try
         {

TaskTrackingSystem.WebApp/MenuAuthorizationService.cs

@@ -17,7 +17,8 @@ public class MenuAuthorizationService
 
     private readonly ApiClientService _apiClient;
     private readonly UserSessionState _sessionState;
-    private Task<List<MenuDto>>? _loadingMenus;
+    private Task<List<MenuDto>>? _loadingAccessItems;
+    private Task<HashSet<string>>? _loadingAccessCodes;
 
     public MenuAuthorizationService(ApiClientService apiClient, UserSessionState sessionState)
     {
@@ -65,15 +66,15 @@ public class MenuAuthorizationService
 
         var roleKey = GetRoleCacheKey(user);
 
-        if (_sessionState.CachedMenuRoleId == roleKey && _sessionState.CachedMenus != null)
+        if (_sessionState.CachedAccessRoleId == roleKey && _sessionState.CachedAccessItems != null)
         {
-            return IsRouteAllowed(_sessionState.CachedMenus, relativePath);
+            return IsRouteAllowed(_sessionState.CachedAccessItems, relativePath);
         }
 
         return false;
     }
 
-    public bool IsRouteAllowed(IReadOnlyList<MenuDto> menus, string relativePath)
+    public bool IsRouteAllowed(IReadOnlyList<MenuDto> accessItems, string relativePath)
     {
         var firstSegment = GetFirstSegment(relativePath);
 
@@ -85,10 +86,10 @@ public class MenuAuthorizationService
         if (firstSegment.Equals("dashboard", StringComparison.OrdinalIgnoreCase) ||
             firstSegment.Equals("home", StringComparison.OrdinalIgnoreCase))
         {
-            return MenuCollectionMatchesSegment(menus, "dashboard");
+            return MenuCollectionMatchesSegment(accessItems, "dashboard");
         }
 
-        return MenuCollectionMatchesSegment(menus, firstSegment);
+        return MenuCollectionMatchesSegment(accessItems, firstSegment);
     }
 
     public Task<List<MenuDto>> GetUserMenusAsync(ClaimsPrincipal user)
@@ -100,13 +101,41 @@ public class MenuAuthorizationService
 
         var roleKey = GetRoleCacheKey(user);
 
-        if (_sessionState.CachedMenuRoleId == roleKey && _sessionState.CachedMenus != null)
+        if (_sessionState.CachedAccessRoleId == roleKey && _sessionState.CachedAccessItems != null)
         {
-            // Cache hit — but verify the permissions haven't been changed by an admin.
-            return LoadMenusWithVersionCheckAsync(user, roleKey);
+            // Cache hit, but verify the access has not been changed by an admin.
+            return LoadAccessItemsWithVersionCheckAsync(user, roleKey);
         }
 
-        return LoadMenusAsync(user, roleKey);
+        return LoadAccessItemsAsync(user, roleKey);
+    }
+
+    public async Task<bool> HasAccessCodeAsync(ClaimsPrincipal user, string accessCode)
+    {
+        if (string.IsNullOrWhiteSpace(accessCode))
+        {
+            return false;
+        }
+
+        var codes = await GetCurrentAccessCodesAsync(user);
+        return codes.Contains(accessCode.Trim());
+    }
+
+    public Task<HashSet<string>> GetCurrentAccessCodesAsync(ClaimsPrincipal user)
+    {
+        if (user.Identity?.IsAuthenticated != true)
+        {
+            return Task.FromResult(new HashSet<string>(StringComparer.OrdinalIgnoreCase));
+        }
+
+        var roleKey = GetRoleCacheKey(user);
+
+        if (_sessionState.CachedAccessRoleId == roleKey && _sessionState.CachedAccessCodes != null)
+        {
+            return LoadAccessCodesWithVersionCheckAsync(user, roleKey);
+        }
+
+        return LoadAccessCodesAsync(user, roleKey);
     }
 
     public void PreloadMenus(ClaimsPrincipal user)
@@ -117,20 +146,20 @@ public class MenuAuthorizationService
         }
 
         var roleKey = GetRoleCacheKey(user);
-        if (_sessionState.CachedMenuRoleId == roleKey && _sessionState.CachedMenus != null)
+        if (_sessionState.CachedAccessRoleId == roleKey && _sessionState.CachedAccessItems != null)
         {
             return;
         }
 
-        _ = LoadMenusAsync(user, roleKey);
+        _ = LoadAccessItemsAsync(user, roleKey);
     }
 
     /// <summary>
-    /// When menus are cached, quickly checks the server-side version to see if an admin changed permissions.
+    /// When access items are cached, quickly checks the server-side version to see if an admin changed permissions.
     /// If the version changed, busts the cache and re-fetches the full menu list.
-    /// Falls back to the cached menus if the version check itself fails (e.g. network error).
+    /// Falls back to the cached access items if the version check itself fails (e.g. network error).
     /// </summary>
-    private async Task<List<MenuDto>> LoadMenusWithVersionCheckAsync(ClaimsPrincipal user, string roleKey)
+    private async Task<List<MenuDto>> LoadAccessItemsWithVersionCheckAsync(ClaimsPrincipal user, string roleKey)
     {
         try
         {
@@ -141,95 +170,173 @@ public class MenuAuthorizationService
             if (response.IsSuccessStatusCode)
             {
                 var serverVersion = await response.Content.ReadAsStringAsync(cts.Token);
-                // Strip surrounding quotes that JSON serialisation may add
                 serverVersion = serverVersion.Trim('"');
 
-                if (serverVersion != _sessionState.CachedMenuVersion)
+                if (serverVersion != _sessionState.CachedAccessVersion)
                 {
-                    // Access items have changed — bust cache and reload the menu tree.
-                    Console.WriteLine($"[MenuAuth] Access version changed ({_sessionState.CachedMenuVersion} -> {serverVersion}). Reloading menus.");
-                    _sessionState.ClearMenuCache();
-                    return await LoadMenusAsync(user, roleKey);
+                    Console.WriteLine($"[MenuAuth] Access version changed ({_sessionState.CachedAccessVersion} -> {serverVersion}). Reloading access items.");
+                    _sessionState.ClearAccessCache();
+                    return await LoadAccessItemsAsync(user, roleKey);
                 }
             }
         }
         catch (Exception ex)
         {
-                // If the version check fails, just use the cached menus to avoid breaking the UI.
             Console.WriteLine($"[MenuAuth] Access version check failed (using cache): {ex.Message}");
         }
 
-        return _sessionState.CachedMenus!;
+        return _sessionState.CachedAccessItems!;
+    }
+
+    private Task<List<MenuDto>> LoadAccessItemsAsync(ClaimsPrincipal user, string roleKey)
+    {
+        if (_loadingAccessItems is { IsCompleted: false })
+        {
+            return _loadingAccessItems;
+        }
+
+        _loadingAccessItems = FetchAccessItemsFromApiAsync(user, roleKey);
+        return _loadingAccessItems;
+    }
+
+    private async Task<HashSet<string>> LoadAccessCodesWithVersionCheckAsync(ClaimsPrincipal user, string roleKey)
+    {
+        try
+        {
+            using var cts = new CancellationTokenSource(TimeSpan.FromSeconds(5));
+            var client = _apiClient.CreateClient(user);
+            var response = await client.GetAsync("Menu/version", cts.Token);
+
+            if (response.IsSuccessStatusCode)
+            {
+                var serverVersion = await response.Content.ReadAsStringAsync(cts.Token);
+                serverVersion = serverVersion.Trim('"');
+
+                if (serverVersion != _sessionState.CachedAccessVersion)
+                {
+                    _sessionState.ClearAccessCache();
+                    return await LoadAccessCodesAsync(user, roleKey);
+                }
+            }
+        }
+        catch (Exception ex)
+        {
+            Console.WriteLine($"[MenuAuth] Access code version check failed (using cache): {ex.Message}");
+        }
+
+        return _sessionState.CachedAccessCodes ?? new HashSet<string>(StringComparer.OrdinalIgnoreCase);
     }
 
-    private Task<List<MenuDto>> LoadMenusAsync(ClaimsPrincipal user, string roleKey)
+    private Task<HashSet<string>> LoadAccessCodesAsync(ClaimsPrincipal user, string roleKey)
     {
-        if (_loadingMenus is { IsCompleted: false })
+        if (_loadingAccessCodes is { IsCompleted: false })
         {
-            return _loadingMenus;
+            return _loadingAccessCodes;
         }
 
-        _loadingMenus = FetchMenusFromApiAsync(user, roleKey);
-        return _loadingMenus;
+        _loadingAccessCodes = FetchAccessCodesFromApiAsync(user, roleKey);
+        return _loadingAccessCodes;
     }
 
-    private async Task<List<MenuDto>> FetchMenusFromApiAsync(ClaimsPrincipal user, string roleKey)
+    private async Task<HashSet<string>> FetchAccessCodesFromApiAsync(ClaimsPrincipal user, string roleKey)
     {
         try
         {
             using var cts = new CancellationTokenSource(TimeSpan.FromSeconds(8));
             var client = _apiClient.CreateClient(user);
 
-            // Fetch menus and version in parallel for efficiency.
-            var menuTask = client.GetAsync("Menu", cts.Token);
+            var codesResponse = await client.GetAsync("Menu/access-codes", cts.Token);
+            if (!codesResponse.IsSuccessStatusCode)
+            {
+                Console.WriteLine($"Menu access-codes API failed: {(int)codesResponse.StatusCode} {codesResponse.ReasonPhrase}");
+                return new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+            }
+
+            var codes = await codesResponse.Content.ReadFromJsonAsync<List<string>>(cancellationToken: cts.Token)
+                ?? new List<string>();
+
+            var versionResponse = await client.GetAsync("Menu/version", cts.Token);
+            if (versionResponse.IsSuccessStatusCode)
+            {
+                var version = await versionResponse.Content.ReadAsStringAsync(cts.Token);
+                _sessionState.CachedAccessVersion = version.Trim('"');
+            }
+
+            var codeSet = new HashSet<string>(codes.Where(code => !string.IsNullOrWhiteSpace(code)).Select(code => code.Trim()), StringComparer.OrdinalIgnoreCase);
+            _sessionState.CachedAccessCodes = codeSet;
+            _sessionState.CachedAccessRoleId = roleKey;
+            return codeSet;
+        }
+        catch (Exception ex)
+        {
+            Console.WriteLine($"Menu access-codes API error: {ex.Message}");
+            var fallback = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+            _sessionState.CachedAccessCodes = fallback;
+            _sessionState.CachedAccessRoleId = roleKey;
+            return fallback;
+        }
+        finally
+        {
+            _loadingAccessCodes = null;
+        }
+    }
+
+    private async Task<List<MenuDto>> FetchAccessItemsFromApiAsync(ClaimsPrincipal user, string roleKey)
+    {
+        try
+        {
+            using var cts = new CancellationTokenSource(TimeSpan.FromSeconds(8));
+            var client = _apiClient.CreateClient(user);
+
+            // Fetch access items and version in parallel for efficiency.
+            var accessItemsTask = client.GetAsync("Menu", cts.Token);
             var versionTask = client.GetAsync("Menu/version", cts.Token);
 
-            await Task.WhenAll(menuTask, versionTask);
+            await Task.WhenAll(accessItemsTask, versionTask);
 
-            var menuResponse = await menuTask;
+            var menuResponse = await accessItemsTask;
             if (!menuResponse.IsSuccessStatusCode)
             {
                 Console.WriteLine($"Menu API failed: {(int)menuResponse.StatusCode} {menuResponse.ReasonPhrase}");
                 return new List<MenuDto>();
             }
 
-            var menus = await menuResponse.Content.ReadFromJsonAsync<List<MenuDto>>(cancellationToken: cts.Token)
+            var accessItems = await menuResponse.Content.ReadFromJsonAsync<List<MenuDto>>(cancellationToken: cts.Token)
                 ?? new List<MenuDto>();
 
-            if (menus.Count == 0)
+            if (accessItems.Count == 0)
             {
-                menus = BuildFallbackMenus(user);
+                accessItems = BuildFallbackMenus(user);
             }
 
-            // Store the version so we can detect future access changes.
             var versionResponse = await versionTask;
             if (versionResponse.IsSuccessStatusCode)
             {
                 var version = await versionResponse.Content.ReadAsStringAsync(cts.Token);
-                _sessionState.CachedMenuVersion = version.Trim('"');
+                _sessionState.CachedAccessVersion = version.Trim('"');
             }
 
-            _sessionState.CachedMenus = menus;
-            _sessionState.CachedMenuRoleId = roleKey;
-            return menus;
+            _sessionState.CachedAccessItems = accessItems;
+            _sessionState.CachedAccessRoleId = roleKey;
+            return accessItems;
         }
         catch (Exception ex)
         {
             Console.WriteLine($"Menu API error: {ex.Message}");
-            var fallbackMenus = BuildFallbackMenus(user);
-            _sessionState.CachedMenus = fallbackMenus;
-            _sessionState.CachedMenuRoleId = roleKey;
-            return fallbackMenus;
+            var fallbackAccessItems = BuildFallbackMenus(user);
+            _sessionState.CachedAccessItems = fallbackAccessItems;
+            _sessionState.CachedAccessRoleId = roleKey;
+            return fallbackAccessItems;
         }
         finally
         {
-            _loadingMenus = null;
+            _loadingAccessItems = null;
         }
     }
 
-    private static bool MenuCollectionMatchesSegment(IReadOnlyList<MenuDto> menus, string segment)
+    private static bool MenuCollectionMatchesSegment(IReadOnlyList<MenuDto> accessItems, string segment)
     {
-        foreach (var menu in menus)
+        foreach (var menu in accessItems)
         {
             if (MenuMatchesSegment(menu, segment))
             {
@@ -259,6 +366,11 @@ public class MenuAuthorizationService
         return menuSegment.Equals(segment, StringComparison.OrdinalIgnoreCase);
     }
 
+    private static List<MenuDto> BuildFallbackMenus(ClaimsPrincipal user)
+    {
+        return new List<MenuDto>();
+    }
+
     private static string GetRoleCacheKey(ClaimsPrincipal user)
     {
         var roleId = user.FindFirst("role_id")?.Value;
@@ -273,50 +385,6 @@ public class MenuAuthorizationService
             return $"name:{roleName}";
         }
 
-        return string.Empty;
-    }
-
-    private static List<MenuDto> BuildFallbackMenus(ClaimsPrincipal user)
-    {
-        var roleName = user.FindFirst(ClaimTypes.Role)?.Value ?? string.Empty;
-
-        var menus = new List<MenuDto>
-        {
-            CreateMenu("dashboard", "Dashboard", "/dashboard", 1, "layout-dashboard")
-        };
-
-        if (roleName.Equals("Employee", StringComparison.OrdinalIgnoreCase))
-        {
-            menus.Add(CreateMenu("tasks", "Tasks", "/tasks", 2, "list-checks"));
-            return menus;
-        }
-
-        menus.Add(CreateMenu("tasks", "Tasks", "/tasks", 2, "list-checks"));
-        menus.Add(CreateMenu("projects", "Projects", "/projects", 3, "folder-kanban"));
-        menus.Add(CreateMenu("reports", "Reports", "/reports/tasks", 4, "bar-chart-3"));
-
-        if (roleName.Equals("Manager", StringComparison.OrdinalIgnoreCase) ||
-            roleName.Equals("Admin", StringComparison.OrdinalIgnoreCase))
-        {
-            if (roleName.Equals("Admin", StringComparison.OrdinalIgnoreCase))
-            {
-                menus.Add(CreateMenu("users", "Users", "/users", 5, "users"));
-                menus.Add(CreateMenu("roles", "Roles", "/roles", 6, "shield"));
-            }
-        }
-
-        return menus;
-    }
-
-    private static MenuDto CreateMenu(string code, string name, string url, int orderNo, string icon)
-    {
-        return new MenuDto
-        {
-            MenuCode = code,
-            MenuName = name,
-            MenuUrl = url,
-            OrderNo = orderNo,
-            Icon = icon
-        };
+        return "unknown";
     }
 }

TaskTrackingSystem.WebApp/UserSessionState.cs

@@ -8,26 +8,29 @@ public class UserSessionState
     public string? Token { get; set; }
     public ClaimsPrincipal? CachedUser { get; set; }
 
-    public string? CachedMenuRoleId { get; set; }
-    public List<MenuDto>? CachedMenus { get; set; }
+    public string? CachedAccessRoleId { get; set; }
+    public List<MenuDto>? CachedAccessItems { get; set; }
+    public HashSet<string>? CachedAccessCodes { get; set; }
 
     /// <summary>
-    /// The server-side permissions version (latest role access timestamp) when the menus were last fetched.
+    /// The server-side permissions version (latest role access timestamp) when the access items were last fetched.
     /// Used to detect when an admin has changed a role's permissions so the cache can be busted.
     /// </summary>
-    public string? CachedMenuVersion { get; set; }
+    public string? CachedAccessVersion { get; set; }
 
-    public void ClearMenuCache()
+    public void ClearAccessCache()
     {
-        CachedMenuRoleId = null;
-        CachedMenus = null;
-        CachedMenuVersion = null;
+        CachedAccessRoleId = null;
+        CachedAccessItems = null;
+        CachedAccessCodes = null;
+        CachedAccessVersion = null;
     }
 
     public void ClearSession()
     {
         Token = null;
         CachedUser = null;
-        ClearMenuCache();
+        ClearAccessCache();
     }
 }
+

cleanup-legacy-access-schema.sql

@@ -0,0 +1,41 @@
+/*
+Legacy access-schema cleanup script for SQL Server Management Studio.
+
+Run this only after:
+1. You have a backup of the database.
+2. The new schema is already in place.
+3. You have confirmed that dbo.Menus, dbo.Permissions, dbo.RoleMenus, and dbo.RolePermissions are working.
+
+This script removes the old scaffolded tables:
+- dbo.MenuAdmins
+- dbo.MenuAdminDetails
+- dbo.RoleMenus_Legacy
+*/
+
+SET XACT_ABORT ON;
+BEGIN TRY
+    BEGIN TRANSACTION;
+
+    IF OBJECT_ID('dbo.RoleMenus_Legacy', 'U') IS NOT NULL
+    BEGIN
+        DROP TABLE dbo.RoleMenus_Legacy;
+    END
+
+    IF OBJECT_ID('dbo.MenuAdminDetails', 'U') IS NOT NULL
+    BEGIN
+        DROP TABLE dbo.MenuAdminDetails;
+    END
+
+    IF OBJECT_ID('dbo.MenuAdmins', 'U') IS NOT NULL
+    BEGIN
+        DROP TABLE dbo.MenuAdmins;
+    END
+
+    COMMIT TRANSACTION;
+END TRY
+BEGIN CATCH
+    IF @@TRANCOUNT > 0
+        ROLLBACK TRANSACTION;
+
+    THROW;
+END CATCH;