fix: remove hardcoding role authorization for more flexibility

TaskTrackingSystem.WebApi/Features/Report/ReportController.cs

@@ -11,7 +11,7 @@ namespace TaskTrackingSystem.WebApi.Features.Report
 {
     [Route("api/[controller]")]
     [ApiController]
-    [Authorize(Roles = "Admin,Manager")]
+    [Authorize]
     public class ReportController : ControllerBase
     {
         private readonly ReportService _reportService;

cleanup-legacy-access-schema.sql

@@ -1,41 +0,0 @@
-/*
-Legacy access-schema cleanup script for SQL Server Management Studio.
-
-Run this only after:
-1. You have a backup of the database.
-2. The new schema is already in place.
-3. You have confirmed that dbo.Menus, dbo.Permissions, dbo.RoleMenus, and dbo.RolePermissions are working.
-
-This script removes the old scaffolded tables:
-- dbo.MenuAdmins
-- dbo.MenuAdminDetails
-- dbo.RoleMenus_Legacy
-*/
-
-SET XACT_ABORT ON;
-BEGIN TRY
-    BEGIN TRANSACTION;
-
-    IF OBJECT_ID('dbo.RoleMenus_Legacy', 'U') IS NOT NULL
-    BEGIN
-        DROP TABLE dbo.RoleMenus_Legacy;
-    END
-
-    IF OBJECT_ID('dbo.MenuAdminDetails', 'U') IS NOT NULL
-    BEGIN
-        DROP TABLE dbo.MenuAdminDetails;
-    END
-
-    IF OBJECT_ID('dbo.MenuAdmins', 'U') IS NOT NULL
-    BEGIN
-        DROP TABLE dbo.MenuAdmins;
-    END
-
-    COMMIT TRANSACTION;
-END TRY
-BEGIN CATCH
-    IF @@TRANCOUNT > 0
-        ROLLBACK TRANSACTION;
-
-    THROW;
-END CATCH;

permission-schema-upgrade.sql

@@ -1,329 +0,0 @@
-/*
-Safe upgrade path for permission tables.
-
-What this script does:
-1. Renames the old dbo.RoleMenus table to dbo.RoleMenus_Legacy if it still uses MenuCode.
-2. Creates the new normalized tables:
-   - dbo.Menus
-   - dbo.Permissions
-   - dbo.RoleMenus
-   - dbo.RolePermissions
-3. Copies data from the old schema into the new schema.
-
-Run this once in SQL Server Management Studio after backing up the database.
-*/
-
-SET XACT_ABORT ON;
-BEGIN TRY
-    BEGIN TRANSACTION;
-
-    -------------------------------------------------------------------------
-    -- Step 1: rename the legacy RoleMenus table if needed
-    -------------------------------------------------------------------------
-    IF OBJECT_ID('dbo.RoleMenus', 'U') IS NOT NULL
-       AND COL_LENGTH('dbo.RoleMenus', 'MenuId') IS NULL
-       AND COL_LENGTH('dbo.RoleMenus', 'MenuCode') IS NOT NULL
-       AND OBJECT_ID('dbo.RoleMenus_Legacy', 'U') IS NULL
-    BEGIN
-        EXEC sp_rename 'dbo.RoleMenus', 'RoleMenus_Legacy';
-    END
-
-    -------------------------------------------------------------------------
-    -- Step 2: create the new tables if they do not already exist
-    -------------------------------------------------------------------------
-    IF OBJECT_ID('dbo.Menus', 'U') IS NULL
-    BEGIN
-        CREATE TABLE dbo.Menus (
-            MenuId        bigint IDENTITY(1,1) NOT NULL CONSTRAINT PK_Menus PRIMARY KEY,
-            MenuCode      nvarchar(50)  NOT NULL,
-            ParentMenuId  bigint        NULL,
-            MenuName      nvarchar(100) NOT NULL,
-            MenuUrl       nvarchar(200) NULL,
-            Icon          nvarchar(50)  NULL,
-            Visible       bit           NOT NULL CONSTRAINT DF_Menus_Visible DEFAULT (1),
-            OrderNo       int           NOT NULL CONSTRAINT DF_Menus_OrderNo DEFAULT (0),
-            IsDeleted     bit           NOT NULL CONSTRAINT DF_Menus_IsDeleted DEFAULT (0),
-            CreatedById   bigint        NULL,
-            CreatedAt     datetime2(0)  NOT NULL CONSTRAINT DF_Menus_CreatedAt DEFAULT (SYSUTCDATETIME()),
-            UpdatedById   bigint        NULL,
-            UpdatedAt     datetime2(0)  NULL,
-            CONSTRAINT UQ_Menus_MenuCode UNIQUE (MenuCode)
-        );
-
-        ALTER TABLE dbo.Menus
-            ADD CONSTRAINT FK_Menus_ParentMenu
-            FOREIGN KEY (ParentMenuId) REFERENCES dbo.Menus(MenuId);
-
-        CREATE INDEX IX_Menus_ParentMenuId ON dbo.Menus(ParentMenuId);
-    END
-
-    IF OBJECT_ID('dbo.Permissions', 'U') IS NULL
-    BEGIN
-        CREATE TABLE dbo.Permissions (
-            PermissionId    bigint IDENTITY(1,1) NOT NULL CONSTRAINT PK_Permissions PRIMARY KEY,
-            PermissionCode  nvarchar(50)  NOT NULL,
-            MenuId          bigint        NOT NULL,
-            ActionName      nvarchar(100) NOT NULL,
-            ApiName         nvarchar(100) NOT NULL,
-            HttpMethod      nvarchar(20)  NULL,
-            Visible         bit           NOT NULL CONSTRAINT DF_Permissions_Visible DEFAULT (1),
-            OrderNo         int           NOT NULL CONSTRAINT DF_Permissions_OrderNo DEFAULT (0),
-            IsDeleted       bit           NOT NULL CONSTRAINT DF_Permissions_IsDeleted DEFAULT (0),
-            CreatedById     bigint        NULL,
-            CreatedAt       datetime2(0)  NOT NULL CONSTRAINT DF_Permissions_CreatedAt DEFAULT (SYSUTCDATETIME()),
-            UpdatedById     bigint        NULL,
-            UpdatedAt       datetime2(0)  NULL,
-            CONSTRAINT UQ_Permissions_PermissionCode UNIQUE (PermissionCode)
-        );
-
-        ALTER TABLE dbo.Permissions
-            ADD CONSTRAINT FK_Permissions_Menu
-            FOREIGN KEY (MenuId) REFERENCES dbo.Menus(MenuId);
-
-        CREATE INDEX IX_Permissions_MenuId ON dbo.Permissions(MenuId);
-    END
-
-    IF OBJECT_ID('dbo.RoleMenus', 'U') IS NULL
-    BEGIN
-        CREATE TABLE dbo.RoleMenus (
-            RoleMenuId   bigint IDENTITY(1,1) NOT NULL CONSTRAINT PK_RoleMenus PRIMARY KEY,
-            RoleId       bigint       NOT NULL,
-            MenuId       bigint       NOT NULL,
-            IsDeleted    bit          NOT NULL CONSTRAINT DF_RoleMenus_IsDeleted DEFAULT (0),
-            CreatedById  bigint       NULL,
-            CreatedAt    datetime2(0) NOT NULL CONSTRAINT DF_RoleMenus_CreatedAt DEFAULT (SYSUTCDATETIME()),
-            UpdatedById  bigint       NULL,
-            UpdatedAt    datetime2(0) NULL,
-            CONSTRAINT UQ_RoleMenus_Role_Menu UNIQUE (RoleId, MenuId)
-        );
-
-        ALTER TABLE dbo.RoleMenus
-            ADD CONSTRAINT FK_RoleMenus_Roles
-            FOREIGN KEY (RoleId) REFERENCES dbo.Roles(Id);
-
-        ALTER TABLE dbo.RoleMenus
-            ADD CONSTRAINT FK_RoleMenus_Menus
-            FOREIGN KEY (MenuId) REFERENCES dbo.Menus(MenuId);
-
-        CREATE INDEX IX_RoleMenus_RoleId ON dbo.RoleMenus(RoleId);
-        CREATE INDEX IX_RoleMenus_MenuId ON dbo.RoleMenus(MenuId);
-    END
-
-    IF OBJECT_ID('dbo.RolePermissions', 'U') IS NULL
-    BEGIN
-        CREATE TABLE dbo.RolePermissions (
-            RolePermissionId bigint IDENTITY(1,1) NOT NULL CONSTRAINT PK_RolePermissions PRIMARY KEY,
-            RoleId           bigint       NOT NULL,
-            PermissionId     bigint       NOT NULL,
-            IsDeleted        bit          NOT NULL CONSTRAINT DF_RolePermissions_IsDeleted DEFAULT (0),
-            CreatedById      bigint       NULL,
-            CreatedAt        datetime2(0) NOT NULL CONSTRAINT DF_RolePermissions_CreatedAt DEFAULT (SYSUTCDATETIME()),
-            UpdatedById      bigint       NULL,
-            UpdatedAt        datetime2(0) NULL,
-            CONSTRAINT UQ_RolePermissions_Role_Permission UNIQUE (RoleId, PermissionId)
-        );
-
-        ALTER TABLE dbo.RolePermissions
-            ADD CONSTRAINT FK_RolePermissions_Roles
-            FOREIGN KEY (RoleId) REFERENCES dbo.Roles(Id);
-
-        ALTER TABLE dbo.RolePermissions
-            ADD CONSTRAINT FK_RolePermissions_Permissions
-            FOREIGN KEY (PermissionId) REFERENCES dbo.Permissions(PermissionId);
-
-        CREATE INDEX IX_RolePermissions_RoleId ON dbo.RolePermissions(RoleId);
-        CREATE INDEX IX_RolePermissions_PermissionId ON dbo.RolePermissions(PermissionId);
-    END
-
-    -------------------------------------------------------------------------
-    -- Step 3: build mapping tables from the old source tables
-    -------------------------------------------------------------------------
-    IF OBJECT_ID('tempdb..#MenuStage') IS NOT NULL DROP TABLE #MenuStage;
-    IF OBJECT_ID('tempdb..#PermissionStage') IS NOT NULL DROP TABLE #PermissionStage;
-
-    CREATE TABLE #MenuStage (
-        OldMenuCode   nvarchar(50) NOT NULL PRIMARY KEY,
-        OldParentCode nvarchar(50) NULL,
-        NewMenuId     bigint NOT NULL
-    );
-
-    CREATE TABLE #PermissionStage (
-        OldPermissionCode nvarchar(50) NOT NULL PRIMARY KEY,
-        OldParentCode     nvarchar(50) NOT NULL,
-        NewPermissionId   bigint NOT NULL
-    );
-
-    -------------------------------------------------------------------------
-    -- Step 4: copy menus
-    -------------------------------------------------------------------------
-    IF OBJECT_ID('dbo.Menus', 'U') IS NOT NULL AND NOT EXISTS (SELECT 1 FROM dbo.Menus)
-    BEGIN
-        INSERT INTO dbo.Menus (
-            MenuCode, ParentMenuId, MenuName, MenuUrl, Icon,
-            Visible, OrderNo, IsDeleted,
-            CreatedById, CreatedAt, UpdatedById, UpdatedAt
-        )
-        OUTPUT
-            inserted.MenuCode,
-            inserted.MenuId
-        INTO #MenuStage (OldMenuCode, NewMenuId)
-        SELECT
-            src.MenuCode,
-            NULL,
-            src.MenuName,
-            src.MenuUrl,
-            src.Icon,
-            src.Visible,
-            src.OrderNo,
-            CASE WHEN src.DelFlag = 0 THEN 0 ELSE 1 END,
-            TRY_CONVERT(bigint, src.CreatedUserId),
-            src.CreatedDateTime,
-            TRY_CONVERT(bigint, src.ModifiedUserId),
-            src.ModifiedDateTime
-        FROM dbo.MenuAdmins src
-        WHERE src.DelFlag = 0;
-
-        UPDATE stage
-        SET stage.OldParentCode = src.ParentCode
-        FROM #MenuStage stage
-        INNER JOIN dbo.MenuAdmins src
-            ON src.MenuCode = stage.OldMenuCode;
-
-        UPDATE m
-        SET ParentMenuId = parent.NewMenuId
-        FROM dbo.Menus m
-        INNER JOIN #MenuStage child
-            ON child.NewMenuId = m.MenuId
-        LEFT JOIN #MenuStage parent
-            ON parent.OldMenuCode = NULLIF(LTRIM(RTRIM(child.OldParentCode)), '')
-        WHERE NULLIF(LTRIM(RTRIM(child.OldParentCode)), '') IS NOT NULL
-          AND LTRIM(RTRIM(child.OldParentCode)) <> '0';
-    END
-
-    -------------------------------------------------------------------------
-    -- Step 5: copy permissions
-    -------------------------------------------------------------------------
-    IF OBJECT_ID('dbo.Permissions', 'U') IS NOT NULL AND NOT EXISTS (SELECT 1 FROM dbo.Permissions)
-    BEGIN
-        INSERT INTO dbo.Permissions (
-            PermissionCode, MenuId, ActionName, ApiName, HttpMethod,
-            Visible, OrderNo, IsDeleted,
-            CreatedById, CreatedAt, UpdatedById, UpdatedAt
-        )
-        OUTPUT
-            inserted.PermissionCode,
-            inserted.PermissionId
-        INTO #PermissionStage (OldPermissionCode, NewPermissionId)
-        SELECT
-            src.MenuDetailCode,
-            m.NewMenuId,
-            src.ActionName,
-            src.ApiName,
-            NULL,
-            src.Visible,
-            src.OrderNo,
-            CASE WHEN src.DelFlag = 0 THEN 0 ELSE 1 END,
-            TRY_CONVERT(bigint, src.CreatedUserId),
-            src.CreatedDateTime,
-            TRY_CONVERT(bigint, src.ModifiedUserId),
-            src.ModifiedDateTime
-        FROM dbo.MenuAdminDetails src
-        INNER JOIN #MenuStage m
-            ON m.OldMenuCode = src.ParentMenuCode
-        WHERE src.DelFlag = 0;
-
-        UPDATE stage
-        SET stage.OldParentCode = src.ParentMenuCode
-        FROM #PermissionStage stage
-        INNER JOIN dbo.MenuAdminDetails src
-            ON src.MenuDetailCode = stage.OldPermissionCode;
-    END
-
-    -------------------------------------------------------------------------
-    -- Step 6: copy role assignments from the legacy table if it exists
-    -------------------------------------------------------------------------
-    IF OBJECT_ID('dbo.RoleMenus_Legacy', 'U') IS NOT NULL
-    BEGIN
-        INSERT INTO dbo.RoleMenus (
-            RoleId, MenuId, IsDeleted,
-            CreatedById, CreatedAt, UpdatedById, UpdatedAt
-        )
-        SELECT DISTINCT
-            COALESCE(roleById.Id, roleByCode.Id) AS RoleId,
-            menuStage.NewMenuId,
-            0,
-            TRY_CONVERT(bigint, src.CreatedUserId),
-            src.CreatedDateTime,
-            TRY_CONVERT(bigint, src.ModifiedUserId),
-            src.ModifiedDateTime
-        FROM dbo.RoleMenus_Legacy src
-        LEFT JOIN dbo.Roles roleById
-            ON roleById.Id = src.RoleId
-           AND roleById.IsDeleted <> 1
-        LEFT JOIN dbo.Roles roleByCode
-            ON roleByCode.Name = src.RoleCode
-           AND roleByCode.IsDeleted <> 1
-        INNER JOIN #MenuStage menuStage
-            ON menuStage.OldMenuCode = src.MenuCode
-        WHERE src.DelFlag = 0
-          AND COALESCE(roleById.Id, roleByCode.Id) IS NOT NULL;
-
-        INSERT INTO dbo.RolePermissions (
-            RoleId, PermissionId, IsDeleted,
-            CreatedById, CreatedAt, UpdatedById, UpdatedAt
-        )
-        SELECT DISTINCT
-            COALESCE(roleById.Id, roleByCode.Id) AS RoleId,
-            permStage.NewPermissionId,
-            0,
-            TRY_CONVERT(bigint, src.CreatedUserId),
-            src.CreatedDateTime,
-            TRY_CONVERT(bigint, src.ModifiedUserId),
-            src.ModifiedDateTime
-        FROM dbo.RoleMenus_Legacy src
-        LEFT JOIN dbo.Roles roleById
-            ON roleById.Id = src.RoleId
-           AND roleById.IsDeleted <> 1
-        LEFT JOIN dbo.Roles roleByCode
-            ON roleByCode.Name = src.RoleCode
-           AND roleByCode.IsDeleted <> 1
-        INNER JOIN #PermissionStage permStage
-            ON permStage.OldPermissionCode = src.MenuCode
-        WHERE src.DelFlag = 0
-          AND COALESCE(roleById.Id, roleByCode.Id) IS NOT NULL;
-
-        INSERT INTO dbo.RoleMenus (
-            RoleId, MenuId, IsDeleted,
-            CreatedById, CreatedAt, UpdatedById, UpdatedAt
-        )
-        SELECT DISTINCT
-            COALESCE(roleById.Id, roleByCode.Id) AS RoleId,
-            parentMenu.NewMenuId,
-            0,
-            TRY_CONVERT(bigint, src.CreatedUserId),
-            src.CreatedDateTime,
-            TRY_CONVERT(bigint, src.ModifiedUserId),
-            src.ModifiedDateTime
-        FROM dbo.RoleMenus_Legacy src
-        LEFT JOIN dbo.Roles roleById
-            ON roleById.Id = src.RoleId
-           AND roleById.IsDeleted <> 1
-        LEFT JOIN dbo.Roles roleByCode
-            ON roleByCode.Name = src.RoleCode
-           AND roleByCode.IsDeleted <> 1
-        INNER JOIN #PermissionStage permStage
-            ON permStage.OldPermissionCode = src.MenuCode
-        INNER JOIN #MenuStage parentMenu
-            ON parentMenu.OldMenuCode = permStage.OldParentCode
-        WHERE src.DelFlag = 0
-          AND COALESCE(roleById.Id, roleByCode.Id) IS NOT NULL;
-    END
-
-    COMMIT TRANSACTION;
-END TRY
-BEGIN CATCH
-    IF @@TRANCOUNT > 0
-        ROLLBACK TRANSACTION;
-
-    THROW;
-END CATCH;

repair-manager-project-scope.sql

@@ -1,287 +0,0 @@
-/*
-Repair script for the current sample data set.
-
-Use this when:
-1. The menu is visible, but Manager/Employee pages do not return data.
-2. Task assignment is empty because the manager is not attached to any project rows.
-3. "Can see page but cannot do anything" happens because the role lost update/list permissions.
-
-What this script does:
-- Rebuilds the Manager and Employee role menu + permission mappings.
-- Adds sample project memberships so TaskAssign and ProjectAssign have real project members.
-
-Assumptions:
-- You already have dbo.Roles, dbo.Users, dbo.Projects, dbo.Menus, dbo.Permissions,
-  dbo.RoleMenus, dbo.RolePermissions, and dbo.ProjectMembers.
-- Your sample usernames follow the patterns mgr01..mgr10 and emp01..emp30.
-- Your projects already exist in dbo.Projects.
-
-This script is safe to run multiple times.
-*/
-
-SET XACT_ABORT ON;
-BEGIN TRY
-    BEGIN TRANSACTION;
-
-    DECLARE @AdminRoleId bigint = (SELECT TOP (1) Id FROM dbo.Roles WHERE Name = N'Admin' AND IsDeleted = 0);
-    DECLARE @ManagerRoleId bigint = (SELECT TOP (1) Id FROM dbo.Roles WHERE Name = N'Manager' AND IsDeleted = 0);
-    DECLARE @EmployeeRoleId bigint = (SELECT TOP (1) Id FROM dbo.Roles WHERE Name = N'Employee' AND IsDeleted = 0);
-
-    IF @ManagerRoleId IS NULL
-        THROW 50001, 'Manager role not found.', 1;
-
-    IF @EmployeeRoleId IS NULL
-        THROW 50002, 'Employee role not found.', 1;
-
-    -------------------------------------------------------------------------
-    -- Permissions and menus used by the role/access UI
-    -------------------------------------------------------------------------
-    DECLARE @MenuProjectsId bigint = (SELECT TOP (1) MenuId FROM dbo.Menus WHERE MenuCode = N'PROJECTS');
-    DECLARE @MenuTasksId bigint    = (SELECT TOP (1) MenuId FROM dbo.Menus WHERE MenuCode = N'TASKS');
-    DECLARE @MenuReportsId bigint  = (SELECT TOP (1) MenuId FROM dbo.Menus WHERE MenuCode = N'REPORTS');
-    DECLARE @MenuUsersId bigint    = (SELECT TOP (1) MenuId FROM dbo.Menus WHERE MenuCode = N'USERS');
-    DECLARE @MenuRolesId bigint    = (SELECT TOP (1) MenuId FROM dbo.Menus WHERE MenuCode = N'ROLES');
-
-    ;WITH PermissionSeed AS
-    (
-        SELECT N'Projects_List'   AS PermissionCode, @MenuProjectsId AS MenuId, N'List'   AS ActionName, N'api/Project' AS ApiName, N'GET'    AS HttpMethod, 1 AS Visible, 10 AS OrderNo
-        UNION ALL SELECT N'Projects_Create', @MenuProjectsId, N'Create', N'api/Project', N'POST', 1, 20
-        UNION ALL SELECT N'Projects_Update', @MenuProjectsId, N'Update', N'api/Project', N'PUT', 1, 30
-        UNION ALL SELECT N'Projects_Delete', @MenuProjectsId, N'Delete', N'api/Project', N'DELETE', 1, 40
-        UNION ALL SELECT N'Tasks_List',      @MenuTasksId,    N'List',   N'api/Task',    N'GET',    1, 10
-        UNION ALL SELECT N'Tasks_Create',    @MenuTasksId,    N'Create', N'api/Task',    N'POST',   1, 20
-        UNION ALL SELECT N'Tasks_Update',    @MenuTasksId,    N'Update', N'api/Task',    N'PUT',    1, 30
-        UNION ALL SELECT N'Tasks_Delete',    @MenuTasksId,    N'Delete', N'api/Task',    N'DELETE', 1, 40
-        UNION ALL SELECT N'Users_List',      @MenuUsersId,    N'List',   N'api/User',    N'GET',    1, 10
-        UNION ALL SELECT N'Users_Create',    @MenuUsersId,    N'Create', N'api/User',    N'POST',   1, 20
-        UNION ALL SELECT N'Users_Update',    @MenuUsersId,    N'Update', N'api/User',    N'PUT',    1, 30
-        UNION ALL SELECT N'Users_Delete',    @MenuUsersId,    N'Delete', N'api/User',    N'DELETE', 1, 40
-        UNION ALL SELECT N'Roles_List',      @MenuRolesId,    N'List',   N'api/Role',    N'GET',    1, 10
-        UNION ALL SELECT N'Roles_Create',    @MenuRolesId,    N'Create', N'api/Role',    N'POST',   1, 20
-        UNION ALL SELECT N'Roles_Update',    @MenuRolesId,    N'Update', N'api/Role',    N'PUT',    1, 30
-        UNION ALL SELECT N'Roles_Delete',    @MenuRolesId,    N'Delete', N'api/Role',    N'DELETE', 1, 40
-    )
-    INSERT INTO dbo.Permissions
-    (
-        PermissionCode,
-        MenuId,
-        ActionName,
-        ApiName,
-        HttpMethod,
-        Visible,
-        OrderNo,
-        IsDeleted,
-        CreatedAt
-    )
-    SELECT
-        p.PermissionCode,
-        p.MenuId,
-        p.ActionName,
-        p.ApiName,
-        p.HttpMethod,
-        p.Visible,
-        p.OrderNo,
-        0,
-        SYSUTCDATETIME()
-    FROM PermissionSeed p
-    WHERE p.MenuId IS NOT NULL
-      AND NOT EXISTS
-      (
-          SELECT 1
-          FROM dbo.Permissions existing
-          WHERE existing.PermissionCode = p.PermissionCode
-      );
-
-    -------------------------------------------------------------------------
-    -- Rebuild role-menu mappings for Manager and Employee
-    -------------------------------------------------------------------------
-    IF @ManagerRoleId IS NOT NULL
-    BEGIN
-        DELETE FROM dbo.RoleMenus WHERE RoleId = @ManagerRoleId;
-    END
-
-    IF @EmployeeRoleId IS NOT NULL
-    BEGIN
-        DELETE FROM dbo.RoleMenus WHERE RoleId = @EmployeeRoleId;
-    END
-
-    ;WITH RoleMenuSeed AS
-    (
-        SELECT @ManagerRoleId AS RoleId, N'DASHBOARD' AS MenuCode
-        UNION ALL SELECT @ManagerRoleId, N'PROJECTS'
-        UNION ALL SELECT @ManagerRoleId, N'TASKS'
-        UNION ALL SELECT @ManagerRoleId, N'REPORTS'
-        UNION ALL SELECT @ManagerRoleId, N'USERS'
-
-        UNION ALL SELECT @EmployeeRoleId, N'DASHBOARD'
-        UNION ALL SELECT @EmployeeRoleId, N'PROJECTS'
-        UNION ALL SELECT @EmployeeRoleId, N'TASKS'
-        UNION ALL SELECT @EmployeeRoleId, N'REPORTS'
-    )
-    INSERT INTO dbo.RoleMenus
-    (
-        RoleId,
-        MenuId,
-        IsDeleted,
-        CreatedAt
-    )
-    SELECT DISTINCT
-        s.RoleId,
-        m.MenuId,
-        0,
-        SYSUTCDATETIME()
-    FROM RoleMenuSeed s
-    INNER JOIN dbo.Menus m
-        ON m.MenuCode = s.MenuCode
-    WHERE s.RoleId IS NOT NULL
-      AND NOT EXISTS
-      (
-          SELECT 1
-          FROM dbo.RoleMenus rm
-          WHERE rm.RoleId = s.RoleId
-            AND rm.MenuId = m.MenuId
-      );
-
-    -------------------------------------------------------------------------
-    -- Rebuild role-permission mappings
-    -------------------------------------------------------------------------
-    IF @ManagerRoleId IS NOT NULL
-    BEGIN
-        DELETE FROM dbo.RolePermissions WHERE RoleId = @ManagerRoleId;
-    END
-
-    IF @EmployeeRoleId IS NOT NULL
-    BEGIN
-        DELETE FROM dbo.RolePermissions WHERE RoleId = @EmployeeRoleId;
-    END
-
-    ;WITH RolePermissionSeed AS
-    (
-        SELECT @ManagerRoleId AS RoleId, N'Projects_List' AS PermissionCode
-        UNION ALL SELECT @ManagerRoleId, N'Projects_Update'
-        UNION ALL SELECT @ManagerRoleId, N'Tasks_List'
-        UNION ALL SELECT @ManagerRoleId, N'Tasks_Create'
-        UNION ALL SELECT @ManagerRoleId, N'Tasks_Update'
-        UNION ALL SELECT @ManagerRoleId, N'Users_List'
-
-        UNION ALL SELECT @EmployeeRoleId, N'Projects_List'
-        UNION ALL SELECT @EmployeeRoleId, N'Tasks_List'
-        UNION ALL SELECT @EmployeeRoleId, N'Tasks_Update'
-    )
-    INSERT INTO dbo.RolePermissions
-    (
-        RoleId,
-        PermissionId,
-        IsDeleted,
-        CreatedAt
-    )
-    SELECT DISTINCT
-        s.RoleId,
-        p.PermissionId,
-        0,
-        SYSUTCDATETIME()
-    FROM RolePermissionSeed s
-    INNER JOIN dbo.Permissions p
-        ON p.PermissionCode = s.PermissionCode
-    WHERE s.RoleId IS NOT NULL
-      AND NOT EXISTS
-      (
-          SELECT 1
-          FROM dbo.RolePermissions rp
-          WHERE rp.RoleId = s.RoleId
-            AND rp.PermissionId = p.PermissionId
-      );
-
-    -------------------------------------------------------------------------
-    -- Sample project membership seed
-    -- This spreads managers and employees across the first 5 projects found.
-    -------------------------------------------------------------------------
-    ;WITH ProjectOrder AS
-    (
-        SELECT
-            p.Id,
-            ROW_NUMBER() OVER (ORDER BY p.Id) AS ProjectSlot
-        FROM dbo.Projects p
-        WHERE p.IsDeleted = 0
-    ),
-    MembershipSeed AS
-    (
-        SELECT N'mgr01' AS Username, 1 AS ProjectSlot UNION ALL
-        SELECT N'mgr06', 1 UNION ALL
-        SELECT N'emp01', 1 UNION ALL
-        SELECT N'emp02', 1 UNION ALL
-        SELECT N'emp03', 1 UNION ALL
-        SELECT N'emp04', 1 UNION ALL
-        SELECT N'emp05', 1 UNION ALL
-        SELECT N'emp06', 1 UNION ALL
-
-        SELECT N'mgr02', 2 UNION ALL
-        SELECT N'mgr07', 2 UNION ALL
-        SELECT N'emp07', 2 UNION ALL
-        SELECT N'emp08', 2 UNION ALL
-        SELECT N'emp09', 2 UNION ALL
-        SELECT N'emp10', 2 UNION ALL
-        SELECT N'emp11', 2 UNION ALL
-        SELECT N'emp12', 2 UNION ALL
-
-        SELECT N'mgr03', 3 UNION ALL
-        SELECT N'mgr08', 3 UNION ALL
-        SELECT N'emp13', 3 UNION ALL
-        SELECT N'emp14', 3 UNION ALL
-        SELECT N'emp15', 3 UNION ALL
-        SELECT N'emp16', 3 UNION ALL
-        SELECT N'emp17', 3 UNION ALL
-        SELECT N'emp18', 3 UNION ALL
-
-        SELECT N'mgr04', 4 UNION ALL
-        SELECT N'mgr09', 4 UNION ALL
-        SELECT N'emp19', 4 UNION ALL
-        SELECT N'emp20', 4 UNION ALL
-        SELECT N'emp21', 4 UNION ALL
-        SELECT N'emp22', 4 UNION ALL
-        SELECT N'emp23', 4 UNION ALL
-        SELECT N'emp24', 4 UNION ALL
-
-        SELECT N'mgr05', 5 UNION ALL
-        SELECT N'mgr10', 5 UNION ALL
-        SELECT N'emp25', 5 UNION ALL
-        SELECT N'emp26', 5 UNION ALL
-        SELECT N'emp27', 5 UNION ALL
-        SELECT N'emp28', 5 UNION ALL
-        SELECT N'emp29', 5 UNION ALL
-        SELECT N'emp30', 5
-    )
-    INSERT INTO dbo.ProjectMembers
-    (
-        ProjectId,
-        UserId,
-        CreatedAt,
-        CreatedBy
-    )
-    SELECT
-        po.Id,
-        u.Id,
-        SYSUTCDATETIME(),
-        NULL
-    FROM MembershipSeed s
-    INNER JOIN dbo.Users u
-        ON u.Username = s.Username
-       AND u.IsDeleted = 0
-    INNER JOIN ProjectOrder po
-        ON po.ProjectSlot = s.ProjectSlot
-    WHERE NOT EXISTS
-    (
-        SELECT 1
-        FROM dbo.ProjectMembers pm
-        WHERE pm.ProjectId = po.Id
-          AND pm.UserId = u.Id
-    );
-
-    COMMIT TRANSACTION;
-END TRY
-BEGIN CATCH
-    IF @@TRANCOUNT > 0
-        ROLLBACK TRANSACTION;
-
-    THROW;
-END CATCH;

reset-sample-role-access.sql

@@ -1,242 +0,0 @@
-/*
-Safe reset for the sample role/menu/permission setup.
-
-What this script fixes:
-- Admin gets the full menu tree.
-- Manager gets project/task/report menus with the correct permissions.
-- Employee gets the smaller scoped menu tree.
-- The page tree stays clickable because both parent menus and leaf pages are assigned.
-
-It also restores a few project memberships so Task Assign / Project Assign can show people.
-
-Run this only after your normalized menu/permission tables already exist.
-*/
-
-SET NOCOUNT ON;
-SET XACT_ABORT ON;
-
-BEGIN TRANSACTION;
-
-DECLARE @AdminRoleId bigint = (SELECT TOP (1) Id FROM dbo.Roles WHERE Name = N'Admin' AND IsDeleted = 0);
-DECLARE @ManagerRoleId bigint = (SELECT TOP (1) Id FROM dbo.Roles WHERE Name = N'Manager' AND IsDeleted = 0);
-DECLARE @EmployeeRoleId bigint = (SELECT TOP (1) Id FROM dbo.Roles WHERE Name = N'Employee' AND IsDeleted = 0);
-
-IF @AdminRoleId IS NULL OR @ManagerRoleId IS NULL OR @EmployeeRoleId IS NULL
-BEGIN
-    RAISERROR('One or more sample roles are missing. Expected Admin, Manager, Employee.', 16, 1);
-    ROLLBACK TRANSACTION;
-    RETURN;
-END
-
-IF COL_LENGTH('dbo.RoleMenus', 'MenuId') IS NULL OR COL_LENGTH('dbo.RolePermissions', 'PermissionId') IS NULL
-BEGIN
-    RAISERROR('dbo.RoleMenus or dbo.RolePermissions does not look like the normalized schema yet.', 16, 1);
-    ROLLBACK TRANSACTION;
-    RETURN;
-END
-
-DECLARE @MenuDashboard bigint = (SELECT TOP (1) MenuId FROM dbo.Menus WHERE IsDeleted = 0 AND (MenuCode = N'DASHBOARD' OR MenuUrl = N'/dashboard'));
-DECLARE @MenuProjects bigint = (SELECT TOP (1) MenuId FROM dbo.Menus WHERE IsDeleted = 0 AND (MenuCode = N'PROJECTS' OR MenuUrl = N'/projects'));
-DECLARE @MenuProjectList bigint = (SELECT TOP (1) MenuId FROM dbo.Menus WHERE IsDeleted = 0 AND (MenuUrl = N'/projects/all' OR MenuName = N'Project List' OR MenuCode = N'PROJECT_LIST'));
-DECLARE @MenuProjectAssign bigint = (SELECT TOP (1) MenuId FROM dbo.Menus WHERE IsDeleted = 0 AND (MenuUrl = N'/projects/assign' OR MenuName = N'Project Assign' OR MenuCode = N'PROJECT_ASSIGN'));
-
-DECLARE @MenuTasks bigint = (SELECT TOP (1) MenuId FROM dbo.Menus WHERE IsDeleted = 0 AND (MenuCode = N'TASKS' OR MenuUrl = N'/tasks'));
-DECLARE @MenuTaskList bigint = (SELECT TOP (1) MenuId FROM dbo.Menus WHERE IsDeleted = 0 AND (MenuUrl = N'/tasks/all' OR MenuName = N'Task List' OR MenuCode = N'TASK_LIST'));
-DECLARE @MenuKanban bigint = (SELECT TOP (1) MenuId FROM dbo.Menus WHERE IsDeleted = 0 AND (MenuUrl = N'/board' OR MenuUrl = N'/projects/{ProjectId:long}/tasks' OR MenuName = N'Kanban Board' OR MenuCode = N'KANBAN_BOARD'));
-DECLARE @MenuTaskAssign bigint = (SELECT TOP (1) MenuId FROM dbo.Menus WHERE IsDeleted = 0 AND (MenuUrl = N'/tasks/assign' OR MenuName = N'Task Assign' OR MenuCode = N'TASK_ASSIGN'));
-
-DECLARE @MenuReports bigint = (SELECT TOP (1) MenuId FROM dbo.Menus WHERE IsDeleted = 0 AND (MenuCode = N'REPORTS' OR MenuUrl = N'/reports'));
-DECLARE @MenuProjectReport bigint = (SELECT TOP (1) MenuId FROM dbo.Menus WHERE IsDeleted = 0 AND (MenuUrl = N'/reports/projects' OR MenuName = N'Project Progress' OR MenuName = N'Project Progress Report' OR MenuCode = N'REPORT_PROJECTS'));
-DECLARE @MenuTaskReport bigint = (SELECT TOP (1) MenuId FROM dbo.Menus WHERE IsDeleted = 0 AND (MenuUrl = N'/reports/tasks' OR MenuName = N'Task Report' OR MenuCode = N'REPORT_TASKS'));
-DECLARE @MenuOverdueReport bigint = (SELECT TOP (1) MenuId FROM dbo.Menus WHERE IsDeleted = 0 AND (MenuUrl = N'/reports/overdue' OR MenuName = N'Overdue Tasks' OR MenuCode = N'REPORT_OVERDUE'));
-DECLARE @MenuTimesheetReport bigint = (SELECT TOP (1) MenuId FROM dbo.Menus WHERE IsDeleted = 0 AND (MenuUrl = N'/reports/timesheet' OR MenuName = N'Time Tracking' OR MenuName = N'Time Tracking Report' OR MenuCode = N'REPORT_TIMESHEET'));
-DECLARE @MenuEmployeeReport bigint = (SELECT TOP (1) MenuId FROM dbo.Menus WHERE IsDeleted = 0 AND (MenuUrl = N'/reports/employees' OR MenuName = N'Employee Report' OR MenuCode = N'REPORT_EMPLOYEES'));
-
-DECLARE @MenuUsers bigint = (SELECT TOP (1) MenuId FROM dbo.Menus WHERE IsDeleted = 0 AND (MenuCode = N'USERS' OR MenuUrl = N'/users'));
-DECLARE @MenuRoles bigint = (SELECT TOP (1) MenuId FROM dbo.Menus WHERE IsDeleted = 0 AND (MenuCode = N'ROLES' OR MenuUrl = N'/roles'));
-
-IF @MenuDashboard IS NULL OR @MenuProjects IS NULL OR @MenuTasks IS NULL OR @MenuReports IS NULL OR @MenuUsers IS NULL OR @MenuRoles IS NULL
-BEGIN
-    RAISERROR('One or more top-level menus were not found. Check the seeded Menus table.', 16, 1);
-    ROLLBACK TRANSACTION;
-    RETURN;
-END
-
-IF @MenuProjectList IS NULL OR @MenuProjectAssign IS NULL OR @MenuTaskList IS NULL OR @MenuKanban IS NULL OR @MenuTaskAssign IS NULL
-   OR @MenuProjectReport IS NULL OR @MenuTaskReport IS NULL OR @MenuOverdueReport IS NULL OR @MenuTimesheetReport IS NULL OR @MenuEmployeeReport IS NULL
-BEGIN
-    RAISERROR('One or more child menus were not found. Check the seeded Menus table.', 16, 1);
-    ROLLBACK TRANSACTION;
-    RETURN;
-END
-
--- Keep the list pages on their alias routes so they do not overlap with assign pages.
-UPDATE dbo.Menus
-SET MenuUrl = N'/projects/all'
-WHERE MenuId = @MenuProjectList
-  AND ISNULL(MenuUrl, N'') <> N'/projects/all';
-
-UPDATE dbo.Menus
-SET MenuUrl = N'/tasks/all'
-WHERE MenuId = @MenuTaskList
-  AND ISNULL(MenuUrl, N'') <> N'/tasks/all';
-
-DECLARE @ProjectsListPermissionId bigint = (SELECT TOP (1) PermissionId FROM dbo.Permissions WHERE IsDeleted = 0 AND PermissionCode = N'Projects_List');
-DECLARE @ProjectsCreatePermissionId bigint = (SELECT TOP (1) PermissionId FROM dbo.Permissions WHERE IsDeleted = 0 AND PermissionCode = N'Projects_Create');
-DECLARE @ProjectsUpdatePermissionId bigint = (SELECT TOP (1) PermissionId FROM dbo.Permissions WHERE IsDeleted = 0 AND PermissionCode = N'Projects_Update');
-DECLARE @ProjectsDeletePermissionId bigint = (SELECT TOP (1) PermissionId FROM dbo.Permissions WHERE IsDeleted = 0 AND PermissionCode = N'Projects_Delete');
-DECLARE @TasksListPermissionId bigint = (SELECT TOP (1) PermissionId FROM dbo.Permissions WHERE IsDeleted = 0 AND PermissionCode = N'Tasks_List');
-DECLARE @TasksCreatePermissionId bigint = (SELECT TOP (1) PermissionId FROM dbo.Permissions WHERE IsDeleted = 0 AND PermissionCode = N'Tasks_Create');
-DECLARE @TasksUpdatePermissionId bigint = (SELECT TOP (1) PermissionId FROM dbo.Permissions WHERE IsDeleted = 0 AND PermissionCode = N'Tasks_Update');
-DECLARE @TasksDeletePermissionId bigint = (SELECT TOP (1) PermissionId FROM dbo.Permissions WHERE IsDeleted = 0 AND PermissionCode = N'Tasks_Delete');
-DECLARE @UsersListPermissionId bigint = (SELECT TOP (1) PermissionId FROM dbo.Permissions WHERE IsDeleted = 0 AND PermissionCode = N'Users_List');
-DECLARE @UsersCreatePermissionId bigint = (SELECT TOP (1) PermissionId FROM dbo.Permissions WHERE IsDeleted = 0 AND PermissionCode = N'Users_Create');
-DECLARE @UsersUpdatePermissionId bigint = (SELECT TOP (1) PermissionId FROM dbo.Permissions WHERE IsDeleted = 0 AND PermissionCode = N'Users_Update');
-DECLARE @UsersDeletePermissionId bigint = (SELECT TOP (1) PermissionId FROM dbo.Permissions WHERE IsDeleted = 0 AND PermissionCode = N'Users_Delete');
-DECLARE @RolesListPermissionId bigint = (SELECT TOP (1) PermissionId FROM dbo.Permissions WHERE IsDeleted = 0 AND PermissionCode = N'Roles_List');
-DECLARE @RolesCreatePermissionId bigint = (SELECT TOP (1) PermissionId FROM dbo.Permissions WHERE IsDeleted = 0 AND PermissionCode = N'Roles_Create');
-DECLARE @RolesUpdatePermissionId bigint = (SELECT TOP (1) PermissionId FROM dbo.Permissions WHERE IsDeleted = 0 AND PermissionCode = N'Roles_Update');
-DECLARE @RolesDeletePermissionId bigint = (SELECT TOP (1) PermissionId FROM dbo.Permissions WHERE IsDeleted = 0 AND PermissionCode = N'Roles_Delete');
-
-IF @ProjectsListPermissionId IS NULL OR @TasksListPermissionId IS NULL OR @TasksUpdatePermissionId IS NULL
-   OR @ProjectsCreatePermissionId IS NULL OR @ProjectsUpdatePermissionId IS NULL OR @ProjectsDeletePermissionId IS NULL
-   OR @TasksCreatePermissionId IS NULL OR @TasksDeletePermissionId IS NULL
-   OR @UsersListPermissionId IS NULL OR @UsersCreatePermissionId IS NULL OR @UsersUpdatePermissionId IS NULL OR @UsersDeletePermissionId IS NULL
-   OR @RolesListPermissionId IS NULL OR @RolesCreatePermissionId IS NULL OR @RolesUpdatePermissionId IS NULL OR @RolesDeletePermissionId IS NULL
-BEGIN
-    RAISERROR('One or more permissions were not found. Check the seeded Permissions table.', 16, 1);
-    ROLLBACK TRANSACTION;
-    RETURN;
-END
-
-DELETE FROM dbo.RoleMenus WHERE RoleId IN (@AdminRoleId, @ManagerRoleId, @EmployeeRoleId);
-DELETE FROM dbo.RolePermissions WHERE RoleId IN (@AdminRoleId, @ManagerRoleId, @EmployeeRoleId);
-
-INSERT INTO dbo.RoleMenus (RoleId, MenuId, IsDeleted, CreatedAt)
-SELECT @AdminRoleId, MenuId, 0, SYSUTCDATETIME()
-FROM (VALUES
-    (@MenuDashboard),
-    (@MenuProjects),
-    (@MenuProjectList),
-    (@MenuProjectAssign),
-    (@MenuTasks),
-    (@MenuTaskList),
-    (@MenuKanban),
-    (@MenuTaskAssign),
-    (@MenuReports),
-    (@MenuProjectReport),
-    (@MenuTaskReport),
-    (@MenuOverdueReport),
-    (@MenuTimesheetReport),
-    (@MenuEmployeeReport),
-    (@MenuUsers),
-    (@MenuRoles)
-) AS V(MenuId);
-
-INSERT INTO dbo.RoleMenus (RoleId, MenuId, IsDeleted, CreatedAt)
-SELECT @ManagerRoleId, MenuId, 0, SYSUTCDATETIME()
-FROM (VALUES
-    (@MenuDashboard),
-    (@MenuProjects),
-    (@MenuProjectList),
-    (@MenuProjectAssign),
-    (@MenuTasks),
-    (@MenuTaskList),
-    (@MenuKanban),
-    (@MenuTaskAssign),
-    (@MenuReports),
-    (@MenuProjectReport),
-    (@MenuTaskReport),
-    (@MenuOverdueReport),
-    (@MenuTimesheetReport)
-) AS V(MenuId);
-
-INSERT INTO dbo.RoleMenus (RoleId, MenuId, IsDeleted, CreatedAt)
-SELECT @EmployeeRoleId, MenuId, 0, SYSUTCDATETIME()
-FROM (VALUES
-    (@MenuDashboard),
-    (@MenuProjects),
-    (@MenuProjectList),
-    (@MenuTasks),
-    (@MenuTaskList),
-    (@MenuKanban),
-    (@MenuReports),
-    (@MenuTaskReport),
-    (@MenuTimesheetReport)
-) AS V(MenuId);
-
-INSERT INTO dbo.RolePermissions (RoleId, PermissionId, IsDeleted, CreatedAt)
-SELECT @AdminRoleId, PermissionId, 0, SYSUTCDATETIME()
-FROM (VALUES
-    (@ProjectsListPermissionId),
-    (@ProjectsCreatePermissionId),
-    (@ProjectsUpdatePermissionId),
-    (@ProjectsDeletePermissionId),
-    (@TasksListPermissionId),
-    (@TasksCreatePermissionId),
-    (@TasksUpdatePermissionId),
-    (@TasksDeletePermissionId),
-    (@UsersListPermissionId),
-    (@UsersCreatePermissionId),
-    (@UsersUpdatePermissionId),
-    (@UsersDeletePermissionId),
-    (@RolesListPermissionId),
-    (@RolesCreatePermissionId),
-    (@RolesUpdatePermissionId),
-    (@RolesDeletePermissionId)
-) AS V(PermissionId);
-
-INSERT INTO dbo.RolePermissions (RoleId, PermissionId, IsDeleted, CreatedAt)
-SELECT @ManagerRoleId, PermissionId, 0, SYSUTCDATETIME()
-FROM (VALUES
-    (@ProjectsListPermissionId),
-    (@ProjectsUpdatePermissionId),
-    (@TasksListPermissionId),
-    (@TasksCreatePermissionId),
-    (@TasksUpdatePermissionId)
-) AS V(PermissionId);
-
-INSERT INTO dbo.RolePermissions (RoleId, PermissionId, IsDeleted, CreatedAt)
-SELECT @EmployeeRoleId, PermissionId, 0, SYSUTCDATETIME()
-FROM (VALUES
-    (@ProjectsListPermissionId),
-    (@TasksListPermissionId),
-    (@TasksUpdatePermissionId)
-) AS V(PermissionId);
-
-DECLARE @ProjectIds TABLE (Slot int IDENTITY(1,1), ProjectId bigint);
-INSERT INTO @ProjectIds (ProjectId)
-SELECT TOP (5) Id
-FROM dbo.Projects
-WHERE IsDeleted = 0
-ORDER BY Id;
-
-IF (SELECT COUNT(*) FROM @ProjectIds) = 0
-BEGIN
-    RAISERROR('No projects were found to attach sample members to.', 16, 1);
-    ROLLBACK TRANSACTION;
-    RETURN;
-END
-
-DELETE FROM dbo.ProjectMembers
-WHERE UserId IN (
-    SELECT Id
-    FROM dbo.Users
-    WHERE IsDeleted = 0
-      AND (Username LIKE N'mgr%' OR Username LIKE N'emp%')
-);
-
-INSERT INTO dbo.ProjectMembers (ProjectId, UserId, CreatedAt, CreatedBy)
-SELECT p.ProjectId, u.Id, SYSUTCDATETIME(), NULL
-FROM @ProjectIds p
-JOIN dbo.Users u
-    ON u.IsDeleted = 0
-   AND (
-        (p.Slot = 1 AND u.Username IN (N'mgr01', N'mgr06', N'emp01', N'emp02', N'emp03', N'emp04', N'emp05', N'emp06'))
-     OR (p.Slot = 2 AND u.Username IN (N'mgr02', N'mgr07', N'emp07', N'emp08', N'emp09', N'emp10', N'emp11', N'emp12'))
-     OR (p.Slot = 3 AND u.Username IN (N'mgr03', N'mgr08', N'emp13', N'emp14', N'emp15', N'emp16', N'emp17', N'emp18'))
-     OR (p.Slot = 4 AND u.Username IN (N'mgr04', N'mgr09', N'emp19', N'emp20', N'emp21', N'emp22', N'emp23', N'emp24'))
-     OR (p.Slot = 5 AND u.Username IN (N'mgr05', N'mgr10', N'emp25', N'emp26', N'emp27', N'emp28', N'emp29', N'emp30'))
-   );
-
-COMMIT TRANSACTION;