fix: small fixes on project assign, task assign

TaskTrackingSystem.WebApi/Features/Dashboard/DashboardService.cs

@@ -20,13 +20,17 @@ namespace TaskTrackingSystem.WebApi.Features.Dashboard
 
         public async Task<Result<DashboardSummaryDto>> GetSummaryAsync(string roleName, long currentUserId)
         {
-            var elevated = IsElevated(roleName);
             var projects = BuildAccessibleProjectQuery(roleName, currentUserId);
             var tasks = BuildAccessibleTaskQuery(roleName, currentUserId);
 
-            var totalUsers = elevated
+            var totalUsers = IsAdmin(roleName)
                 ? await _db.Users.CountAsync(u => !u.IsDeleted)
-                : await _db.Users.CountAsync(u => u.Id == currentUserId && !u.IsDeleted);
+                : await _db.Users
+                    .Where(u => !u.IsDeleted &&
+                                projects.SelectMany(p => p.ProjectMembers.Select(pm => pm.UserId))
+                                    .Distinct()
+                                    .Contains(u.Id))
+                    .CountAsync();
 
             var activeProjectsCount = await projects.CountAsync();
             var pendingTasksCount = await tasks.CountAsync(t => t.StatusId != 3);
@@ -119,11 +123,19 @@ namespace TaskTrackingSystem.WebApi.Features.Dashboard
         {
             var query = _db.Tasks.Where(t => t.IsDeleted != true);
 
-            if (IsElevated(roleName))
+            if (IsAdmin(roleName))
             {
                 return query;
             }
 
+            if (roleName.Equals("Manager", StringComparison.OrdinalIgnoreCase))
+            {
+                return query.Where(t =>
+                    t.AssignedTo == currentUserId ||
+                    t.CreatedBy == currentUserId ||
+                    t.Project.ProjectMembers.Any(pm => pm.UserId == currentUserId));
+            }
+
             return query.Where(t =>
                 t.AssignedTo == currentUserId ||
                 t.CreatedBy == currentUserId);
@@ -133,7 +145,7 @@ namespace TaskTrackingSystem.WebApi.Features.Dashboard
         {
             var query = _db.Projects.Where(p => p.IsDeleted != true);
 
-            if (IsElevated(roleName))
+            if (IsAdmin(roleName))
             {
                 return query;
             }
@@ -143,10 +155,9 @@ namespace TaskTrackingSystem.WebApi.Features.Dashboard
                 p.ProjectMembers.Any(pm => pm.UserId == currentUserId));
         }
 
-        private static bool IsElevated(string roleName)
+        private static bool IsAdmin(string roleName)
         {
-            return roleName.Equals("Admin", StringComparison.OrdinalIgnoreCase) ||
-                   roleName.Equals("Manager", StringComparison.OrdinalIgnoreCase);
+            return roleName.Equals("Admin", StringComparison.OrdinalIgnoreCase);
         }
     }
 }

TaskTrackingSystem.WebApi/Features/Project/ProjectController.cs

@@ -61,8 +61,8 @@ namespace TaskTrackingSystem.WebApi.Features.Project
                 return Forbid();
             }
 
-            long? currentUserId = User.GetUserId();
-            var result = await _projectService.UpdateProjectAsync(id, updateProjectDto, currentUserId);
+            var currentUserId = User.GetUserId();
+            var result = await _projectService.UpdateProjectAsync(id, updateProjectDto, User.GetRoleName(), currentUserId);
             return StatusCode(result.StatusCode, result);
         }
 
@@ -74,7 +74,7 @@ namespace TaskTrackingSystem.WebApi.Features.Project
                 return Forbid();
             }
 
-            var result = await _projectService.SoftDeleteProjectAsync(id);
+            var result = await _projectService.SoftDeleteProjectAsync(id, User.GetRoleName(), User.GetUserId());
             return StatusCode(result.StatusCode, result);
         }
 
@@ -93,7 +93,7 @@ namespace TaskTrackingSystem.WebApi.Features.Project
                 return Forbid();
             }
 
-            var result = await _projectService.AssignMembersToProjectAsync(id, dto, User.GetUserId());
+            var result = await _projectService.AssignMembersToProjectAsync(id, dto, User.GetRoleName(), User.GetUserId());
             if (!result.IsSuccess)
             {
                 return StatusCode(result.StatusCode, new { message = result.ErrorMessage });
@@ -109,7 +109,7 @@ namespace TaskTrackingSystem.WebApi.Features.Project
                 return Forbid();
             }
 
-            var result = await _projectService.RemoveMemberFromProjectAsync(id, userId, User.GetUserId());
+            var result = await _projectService.RemoveMemberFromProjectAsync(id, userId, User.GetRoleName(), User.GetUserId());
             if (!result.IsSuccess)
             {
                 return StatusCode(result.StatusCode, new { message = result.ErrorMessage });

TaskTrackingSystem.WebApi/Features/Project/ProjectService.cs

@@ -96,7 +96,7 @@ namespace TaskTrackingSystem.WebApi.Features.Project
             return Result<ProjectDto>.Success(resultDto, 201);
         }
 
-        public async Task<Result> UpdateProjectAsync(long id, UpdateProjectDto dto, long? currentUserId = null)
+        public async Task<Result> UpdateProjectAsync(long id, UpdateProjectDto dto, string roleName, long currentUserId)
         {
             if (string.IsNullOrWhiteSpace(dto.Name))
             {
@@ -106,6 +106,11 @@ namespace TaskTrackingSystem.WebApi.Features.Project
             var project = await _db.Projects.FirstOrDefaultAsync(p => p.Id == id && p.IsDeleted != true);
             if (project == null) return Result.Failure(ResultMessages.ProjectNotFound(id), 404);
 
+            if (!await IsProjectAccessibleAsync(id, roleName, currentUserId))
+            {
+                return Result.Failure("You do not have access to this project.", 403);
+            }
+
             project.Name = dto.Name;
             project.Description = dto.Description;
             project.StartDate = dto.StartDate;
@@ -119,11 +124,16 @@ namespace TaskTrackingSystem.WebApi.Features.Project
             return Result.Success(200);
         }
 
-        public async Task<Result> SoftDeleteProjectAsync(long id)
+        public async Task<Result> SoftDeleteProjectAsync(long id, string roleName, long currentUserId)
         {
             var project = await _db.Projects.FirstOrDefaultAsync(p => p.Id == id && p.IsDeleted != true);
             if (project == null) return Result.Failure(ResultMessages.ProjectNotFound(id), 404);
 
+            if (!await IsProjectAccessibleAsync(id, roleName, currentUserId))
+            {
+                return Result.Failure("You do not have access to this project.", 403);
+            }
+
             project.IsDeleted = true;
             _db.Projects.Update(project);
             await _db.SaveChangesAsync();
@@ -159,7 +169,7 @@ namespace TaskTrackingSystem.WebApi.Features.Project
             return Result<IEnumerable<UserDto>>.Success(members);
         }
 
-        public async Task<Result> AssignMembersToProjectAsync(long projectId, AssignMembersDto dto, long? currentUserId = null)
+        public async Task<Result> AssignMembersToProjectAsync(long projectId, AssignMembersDto dto, string roleName, long currentUserId)
         {
             var projectExists = await _db.Projects.AnyAsync(p => p.Id == projectId && p.IsDeleted != true);
             if (!projectExists)
@@ -167,6 +177,11 @@ namespace TaskTrackingSystem.WebApi.Features.Project
                 return Result.Failure(ResultMessages.ProjectNotFound(projectId), 404);
             }
 
+            if (!await IsProjectAccessibleAsync(projectId, roleName, currentUserId))
+            {
+                return Result.Failure("You do not have access to this project.", 403);
+            }
+
             if (dto.UserIds == null)
             {
                 return Result.Failure(ResultMessages.UserIdsCannotBeNull, 400);
@@ -212,7 +227,7 @@ namespace TaskTrackingSystem.WebApi.Features.Project
             return Result.Success(200);
         }
 
-        public async Task<Result> RemoveMemberFromProjectAsync(long projectId, long userId, long? currentUserId = null)
+        public async Task<Result> RemoveMemberFromProjectAsync(long projectId, long userId, string roleName, long currentUserId)
         {
             var projectExists = await _db.Projects.AnyAsync(p => p.Id == projectId && p.IsDeleted != true);
             if (!projectExists)
@@ -220,6 +235,11 @@ namespace TaskTrackingSystem.WebApi.Features.Project
                 return Result.Failure(ResultMessages.ProjectNotFound(projectId), 404);
             }
 
+            if (!await IsProjectAccessibleAsync(projectId, roleName, currentUserId))
+            {
+                return Result.Failure("You do not have access to this project.", 403);
+            }
+
             var member = await _db.ProjectMembers
                 .FirstOrDefaultAsync(pm => pm.ProjectId == projectId && pm.UserId == userId);
 
@@ -271,7 +291,7 @@ namespace TaskTrackingSystem.WebApi.Features.Project
         {
             var query = _db.Projects.Where(p => p.IsDeleted != true);
 
-            if (IsElevated(roleName))
+            if (IsAdmin(roleName))
             {
                 return query;
             }
@@ -283,7 +303,7 @@ namespace TaskTrackingSystem.WebApi.Features.Project
 
         private async Task<bool> IsProjectAccessibleAsync(long projectId, string roleName, long currentUserId)
         {
-            if (IsElevated(roleName))
+            if (IsAdmin(roleName))
             {
                 return await _db.Projects.AnyAsync(p => p.Id == projectId && p.IsDeleted != true);
             }
@@ -294,10 +314,9 @@ namespace TaskTrackingSystem.WebApi.Features.Project
                 (p.CreatedById == currentUserId || p.ProjectMembers.Any(pm => pm.UserId == currentUserId)));
         }
 
-        private static bool IsElevated(string roleName)
+        private static bool IsAdmin(string roleName)
         {
-            return roleName.Equals("Admin", StringComparison.OrdinalIgnoreCase) ||
-                   roleName.Equals("Manager", StringComparison.OrdinalIgnoreCase);
+            return roleName.Equals("Admin", StringComparison.OrdinalIgnoreCase);
         }
     }
 }

TaskTrackingSystem.WebApi/Features/Report/ReportController.cs

@@ -5,6 +5,7 @@ using System.Collections.Generic;
 using System.Threading.Tasks;
 using TaskTrackingSystem.Shared;
 using TaskTrackingSystem.Shared.Models.Report;
+using TaskTrackingSystem.WebApi.Infrastructure;
 
 namespace TaskTrackingSystem.WebApi.Features.Report
 {
@@ -29,14 +30,14 @@ namespace TaskTrackingSystem.WebApi.Features.Report
             [FromQuery] string? status,
             [FromQuery] int? projectId)
         {
-            var result = await _reportService.GetTasksReportAsync(startDate, endDate, status, projectId);
+            var result = await _reportService.GetTasksReportAsync(startDate, endDate, status, projectId, User.GetRoleName(), User.GetUserId());
             return StatusCode(result.StatusCode, result);
         }
 
         [HttpGet("user-productivity")]
         public async Task<ActionResult<Result<IEnumerable<UserProductivityDto>>>> GetUserProductivityReport()
         {
-            var result = await _reportService.GetUserProductivityReportAsync();
+            var result = await _reportService.GetUserProductivityReportAsync(User.GetRoleName(), User.GetUserId());
             return StatusCode(result.StatusCode, result);
         }
 
@@ -48,7 +49,7 @@ namespace TaskTrackingSystem.WebApi.Features.Report
             [FromQuery] long? statusId,
             [FromQuery] long? projectId)
         {
-            var result = await _reportService.GetTaskStatusSummaryAsync(search, statusId, projectId);
+            var result = await _reportService.GetTaskStatusSummaryAsync(search, statusId, projectId, User.GetRoleName(), User.GetUserId());
             return StatusCode(result.StatusCode, result);
         }
 
@@ -58,7 +59,7 @@ namespace TaskTrackingSystem.WebApi.Features.Report
             [FromQuery] long? statusId,
             [FromQuery] long? projectId)
         {
-            var result = await _reportService.GetTaskStatusSummaryAsync(search, statusId, projectId);
+            var result = await _reportService.GetTaskStatusSummaryAsync(search, statusId, projectId, User.GetRoleName(), User.GetUserId());
             if (!result.IsSuccess || result.Value == null)
                 return BadRequest(new { message = result.ErrorMessage });
             var bytes = _reportService.ExportTaskStatusSummaryToExcel(result.Value);
@@ -72,14 +73,14 @@ namespace TaskTrackingSystem.WebApi.Features.Report
         public async Task<ActionResult<Result<IEnumerable<TeamProductivityReportDto>>>> GetTeamProductivity(
             [FromQuery] string? search)
         {
-            var result = await _reportService.GetTeamProductivityAsync(search);
+            var result = await _reportService.GetTeamProductivityAsync(search, User.GetRoleName(), User.GetUserId());
             return StatusCode(result.StatusCode, result);
         }
 
         [HttpGet("team-productivity/excel")]
         public async Task<IActionResult> DownloadTeamProductivityExcel([FromQuery] string? search)
         {
-            var result = await _reportService.GetTeamProductivityAsync(search);
+            var result = await _reportService.GetTeamProductivityAsync(search, User.GetRoleName(), User.GetUserId());
             if (!result.IsSuccess || result.Value == null)
                 return BadRequest(new { message = result.ErrorMessage });
             var bytes = _reportService.ExportTeamProductivityToExcel(result.Value);
@@ -94,7 +95,7 @@ namespace TaskTrackingSystem.WebApi.Features.Report
             [FromQuery] string? search,
             [FromQuery] long? projectId)
         {
-            var result = await _reportService.GetOverdueCriticalTasksAsync(search, projectId);
+            var result = await _reportService.GetOverdueCriticalTasksAsync(search, projectId, User.GetRoleName(), User.GetUserId());
             return StatusCode(result.StatusCode, result);
         }
 
@@ -103,7 +104,7 @@ namespace TaskTrackingSystem.WebApi.Features.Report
             [FromQuery] string? search,
             [FromQuery] long? projectId)
         {
-            var result = await _reportService.GetOverdueCriticalTasksAsync(search, projectId);
+            var result = await _reportService.GetOverdueCriticalTasksAsync(search, projectId, User.GetRoleName(), User.GetUserId());
             if (!result.IsSuccess || result.Value == null)
                 return BadRequest(new { message = result.ErrorMessage });
             var bytes = _reportService.ExportOverdueCriticalToExcel(result.Value);
@@ -119,7 +120,7 @@ namespace TaskTrackingSystem.WebApi.Features.Report
             [FromQuery] long? projectId,
             [FromQuery] long? statusId)
         {
-            var result = await _reportService.GetTimeTrackingReportAsync(search, projectId, statusId);
+            var result = await _reportService.GetTimeTrackingReportAsync(search, projectId, statusId, User.GetRoleName(), User.GetUserId());
             return StatusCode(result.StatusCode, result);
         }
     }

TaskTrackingSystem.WebApi/Features/Report/ReportService.cs

@@ -22,12 +22,68 @@ namespace TaskTrackingSystem.WebApi.Features.Report
             _db = db;
         }
 
+        private static bool IsAdmin(string roleName)
+        {
+            return roleName.Equals("Admin", StringComparison.OrdinalIgnoreCase);
+        }
+
+        private IQueryable<TaskTrackingSystem.Database.AppDbContextModels.Task> BuildAccessibleTaskQuery(string roleName, long currentUserId)
+        {
+            var query = _db.Tasks.Where(t => t.IsDeleted != true);
+
+            if (IsAdmin(roleName))
+            {
+                return query;
+            }
+
+            if (roleName.Equals("Manager", StringComparison.OrdinalIgnoreCase))
+            {
+                return query.Where(t =>
+                    t.AssignedTo == currentUserId ||
+                    t.CreatedBy == currentUserId ||
+                    t.Project.ProjectMembers.Any(pm => pm.UserId == currentUserId));
+            }
+
+            return query.Where(t =>
+                t.AssignedTo == currentUserId ||
+                t.CreatedBy == currentUserId);
+        }
+
+        private IQueryable<TaskTrackingSystem.Database.AppDbContextModels.Project> BuildAccessibleProjectQuery(string roleName, long currentUserId)
+        {
+            var query = _db.Projects.Where(p => p.IsDeleted != true);
+
+            if (IsAdmin(roleName))
+            {
+                return query;
+            }
+
+            return query.Where(p =>
+                p.CreatedById == currentUserId ||
+                p.ProjectMembers.Any(pm => pm.UserId == currentUserId));
+        }
+
+        private IQueryable<TaskTrackingSystem.Database.AppDbContextModels.User> BuildAccessibleUserQuery(string roleName, long currentUserId)
+        {
+            var users = _db.Users.Where(u => !u.IsDeleted);
+
+            if (IsAdmin(roleName))
+            {
+                return users;
+            }
+
+            var accessibleUserIds = BuildAccessibleProjectQuery(roleName, currentUserId)
+                .SelectMany(p => p.ProjectMembers.Select(pm => pm.UserId))
+                .Distinct();
+
+            return users.Where(u => u.Id == currentUserId || accessibleUserIds.Contains(u.Id));
+        }
         // ─── Legacy endpoints (kept for backward compatibility) ───────────────────
 
         public async Task<Result<IEnumerable<TaskReportDto>>> GetTasksReportAsync(
-            DateTime? startDate, DateTime? endDate, string? status, int? projectId)
+            DateTime? startDate, DateTime? endDate, string? status, int? projectId, string roleName, long currentUserId)
         {
-            var query = _db.Tasks
+            var query = BuildAccessibleTaskQuery(roleName, currentUserId)
                 .Include(t => t.Project)
                 .Include(t => t.AssignedToNavigation)
                 .Include(t => t.AssignedByNavigation)
@@ -76,19 +132,19 @@ namespace TaskTrackingSystem.WebApi.Features.Report
             return Result<IEnumerable<TaskReportDto>>.Success(list);
         }
 
-        public async Task<Result<IEnumerable<UserProductivityDto>>> GetUserProductivityReportAsync()
+        public async Task<Result<IEnumerable<UserProductivityDto>>> GetUserProductivityReportAsync(string roleName, long currentUserId)
         {
-            var users = await _db.Users.Where(u => !u.IsDeleted).ToListAsync();
+            var users = await BuildAccessibleUserQuery(roleName, currentUserId).ToListAsync();
+            var tasks = await BuildAccessibleTaskQuery(roleName, currentUserId)
+                .Include(t => t.TaskHistories)
+                .ToListAsync();
             var list = new List<UserProductivityDto>();
             foreach (var user in users)
             {
-                var tasks = await _db.Tasks
-                    .Include(t => t.TaskHistories)
-                    .Where(t => t.AssignedTo == user.Id && t.IsDeleted != true)
-                    .ToListAsync();
+                var userTasks = tasks.Where(t => t.AssignedTo == user.Id).ToList();
                 
-                int total = tasks.Count;
-                var completedTasks = tasks.Where(t => t.StatusId == 3).ToList();
+                int total = userTasks.Count;
+                var completedTasks = userTasks.Where(t => t.StatusId == 3).ToList();
                 int done = completedTasks.Count;
                 
                 int onTimeCount = completedTasks.Count(t => 
@@ -114,9 +170,9 @@ namespace TaskTrackingSystem.WebApi.Features.Report
         // ─── Report 1: Task Status Summary ────────────────────────────────────────
 
         public async Task<Result<IEnumerable<TaskStatusSummaryDto>>> GetTaskStatusSummaryAsync(
-            string? search, long? statusId, long? projectId)
+            string? search, long? statusId, long? projectId, string roleName, long currentUserId)
         {
-            var query = _db.Tasks
+            var query = BuildAccessibleTaskQuery(roleName, currentUserId)
                 .Include(t => t.Project)
                 .Include(t => t.AssignedToNavigation)
                 .Where(t => t.IsDeleted != true);
@@ -189,10 +245,12 @@ namespace TaskTrackingSystem.WebApi.Features.Report
 
         // ─── Report 2: Team Productivity ──────────────────────────────────────────
 
-        public async Task<Result<IEnumerable<TeamProductivityReportDto>>> GetTeamProductivityAsync(string? search)
+        public async Task<Result<IEnumerable<TeamProductivityReportDto>>> GetTeamProductivityAsync(string? search, string roleName, long currentUserId)
         {
-            var users = await _db.Users.Where(u => !u.IsDeleted).ToListAsync();
-            var allTasks = await _db.Tasks.Where(t => t.IsDeleted != true && t.AssignedTo != null).ToListAsync();
+            var users = await BuildAccessibleUserQuery(roleName, currentUserId).ToListAsync();
+            var allTasks = await BuildAccessibleTaskQuery(roleName, currentUserId)
+                .Where(t => t.AssignedTo != null)
+                .ToListAsync();
             var now = DateTime.UtcNow;
 
             var list = users.Select(u =>
@@ -256,10 +314,10 @@ namespace TaskTrackingSystem.WebApi.Features.Report
 
         // ─── Report 3: Overdue & Critical Tasks ───────────────────────────────────
 
-        public async Task<Result<IEnumerable<OverdueCriticalTaskDto>>> GetOverdueCriticalTasksAsync(string? search, long? projectId)
+        public async Task<Result<IEnumerable<OverdueCriticalTaskDto>>> GetOverdueCriticalTasksAsync(string? search, long? projectId, string roleName, long currentUserId)
         {
             var now = DateTime.UtcNow;
-            var query = _db.Tasks
+            var query = BuildAccessibleTaskQuery(roleName, currentUserId)
                 .Include(t => t.Project)
                 .Include(t => t.AssignedToNavigation)
                 .Where(t => t.IsDeleted != true && t.StatusId != 3 &&
@@ -330,9 +388,9 @@ namespace TaskTrackingSystem.WebApi.Features.Report
         }
 
         public async Task<Result<TimeTrackingReportDto>> GetTimeTrackingReportAsync(
-            string? search, long? projectId, long? statusId)
+            string? search, long? projectId, long? statusId, string roleName, long currentUserId)
         {
-            var query = _db.Tasks
+            var query = BuildAccessibleTaskQuery(roleName, currentUserId)
                 .Include(t => t.Project)
                 .Include(t => t.AssignedToNavigation)
                 .Include(t => t.TimeLogs.Where(tl => !tl.IsDeleted))
@@ -463,3 +521,4 @@ namespace TaskTrackingSystem.WebApi.Features.Report
         }
     }
 }
+

TaskTrackingSystem.WebApi/Features/Task/TaskController.cs

@@ -48,8 +48,8 @@ namespace TaskTrackingSystem.WebApi.Features.Task
                 return Forbid();
             }
 
-            long? currentUserId = User.GetUserId();
-            var result = await _taskService.CreateTaskAsync(createTaskDto, currentUserId);
+            var currentUserId = User.GetUserId();
+            var result = await _taskService.CreateTaskAsync(createTaskDto, User.GetRoleName(), currentUserId);
             return StatusCode(result.StatusCode, result);
         }
 

TaskTrackingSystem.WebApi/Features/Task/TaskService.cs

@@ -75,7 +75,7 @@ namespace TaskTrackingSystem.WebApi.Features.Task
             };
         }
 
-        public async Task<Result<TaskDto>> CreateTaskAsync(CreateTaskDto dto, long? currentUserId = null)
+        public async Task<Result<TaskDto>> CreateTaskAsync(CreateTaskDto dto, string roleName, long currentUserId)
         {
             if (string.IsNullOrWhiteSpace(dto.Title))
             {
@@ -92,6 +92,16 @@ namespace TaskTrackingSystem.WebApi.Features.Task
                 return Result<TaskDto>.Failure(ResultMessages.ProjectNotFound(dto.ProjectId), 404);
             }
 
+            if (!await CanAccessProjectAsync(dto.ProjectId, roleName, currentUserId))
+            {
+                return Result<TaskDto>.Failure("You do not have access to this project.", 403);
+            }
+
+            if (dto.AssignedTo.HasValue && !await IsProjectMemberAsync(dto.ProjectId, dto.AssignedTo.Value))
+            {
+                return Result<TaskDto>.Failure("Task assignee must belong to the selected project.", 400);
+            }
+
             var task = new TaskTrackingSystem.Database.AppDbContextModels.Task
             {
                 Title = dto.Title,
@@ -140,11 +150,16 @@ namespace TaskTrackingSystem.WebApi.Features.Task
             var task = await _db.Tasks.FirstOrDefaultAsync(t => t.Id == id && t.IsDeleted != true);
             if (task == null) return Result.Failure(ResultMessages.TaskNotFound(id), 404);
 
-            if (!IsElevated(roleName) && currentUserId.HasValue && !await CanEditTaskAsync(task, currentUserId.Value))
+            if (!currentUserId.HasValue || !await CanEditTaskAsync(task, roleName, currentUserId.Value))
             {
                 return Result.Failure("You do not have access to update this task.", 403);
             }
 
+            if (dto.AssignedTo.HasValue && !await IsProjectMemberAsync(task.ProjectId, dto.AssignedTo.Value))
+            {
+                return Result.Failure("Task assignee must belong to the selected project.", 400);
+            }
+
             task.Title = dto.Title;
             task.Description = dto.Description;
             task.StatusId = dto.StatusId;
@@ -166,7 +181,7 @@ namespace TaskTrackingSystem.WebApi.Features.Task
             var task = await _db.Tasks.FirstOrDefaultAsync(t => t.Id == id && t.IsDeleted != true);
             if (task == null) return Result.Failure(ResultMessages.TaskNotFound(id), 404);
 
-            if (!IsElevated(roleName) && task.CreatedBy != currentUserId && task.AssignedTo != currentUserId)
+            if (!await CanEditTaskAsync(task, roleName, currentUserId))
             {
                 return Result.Failure("You do not have access to delete this task.", 403);
             }
@@ -179,19 +194,14 @@ namespace TaskTrackingSystem.WebApi.Features.Task
 
         public async Task<Result<IEnumerable<TaskDto>>> GetTasksByUserIdAsync(long userId, string roleName, long currentUserId)
         {
-            if (!IsElevated(roleName) && userId != currentUserId)
-            {
-                return Result<IEnumerable<TaskDto>>.Failure("You do not have access to view these tasks.", 403);
-            }
-
             var userExists = await _db.Users.AnyAsync(u => u.Id == userId && !u.IsDeleted);
             if (!userExists)
             {
                 return Result<IEnumerable<TaskDto>>.Failure(ResultMessages.UserNotFound(userId), 404);
             }
 
-            var tasks = await _db.Tasks
-                .Where(t => t.AssignedTo == userId && t.IsDeleted != true)
+            var tasks = await BuildAccessibleTaskQuery(roleName, currentUserId)
+                .Where(t => t.AssignedTo == userId)
                 .Select(t => new TaskDto
                 {
                     Id = t.Id,
@@ -224,7 +234,7 @@ namespace TaskTrackingSystem.WebApi.Features.Task
                 return Result.Failure(ResultMessages.TaskNotFound(id), 404);
             }
 
-            if (!IsElevated(roleName) && task.AssignedTo != currentUserId && task.CreatedBy != currentUserId)
+            if (!await CanEditTaskAsync(task, roleName, currentUserId))
             {
                 return Result.Failure("You do not have access to update this task.", 403);
             }
@@ -243,30 +253,70 @@ namespace TaskTrackingSystem.WebApi.Features.Task
         {
             var query = _db.Tasks.Where(t => t.IsDeleted != true);
 
-            if (IsElevated(roleName))
+            if (IsAdmin(roleName))
             {
                 return query;
             }
 
+            if (IsManager(roleName))
+            {
+                return query.Where(t =>
+                    t.AssignedTo == currentUserId ||
+                    t.CreatedBy == currentUserId ||
+                    t.Project.ProjectMembers.Any(pm => pm.UserId == currentUserId));
+            }
+
             return query.Where(t =>
                 t.AssignedTo == currentUserId ||
                 t.CreatedBy == currentUserId);
         }
 
-        private async Task<bool> CanEditTaskAsync(TaskTrackingSystem.Database.AppDbContextModels.Task task, long currentUserId)
+        private async Task<bool> CanEditTaskAsync(TaskTrackingSystem.Database.AppDbContextModels.Task task, string roleName, long currentUserId)
         {
+            if (IsAdmin(roleName))
+            {
+                return true;
+            }
+
             if (task.CreatedBy == currentUserId || task.AssignedTo == currentUserId)
             {
                 return true;
             }
 
-            return await _db.ProjectMembers.AnyAsync(pm => pm.ProjectId == task.ProjectId && pm.UserId == currentUserId);
+            if (IsManager(roleName))
+            {
+                return await _db.ProjectMembers.AnyAsync(pm => pm.ProjectId == task.ProjectId && pm.UserId == currentUserId);
+            }
+
+            return false;
+        }
+
+        private async Task<bool> CanAccessProjectAsync(long projectId, string roleName, long currentUserId)
+        {
+            if (IsAdmin(roleName))
+            {
+                return await _db.Projects.AnyAsync(p => p.Id == projectId && p.IsDeleted != true);
+            }
+
+            return await _db.Projects.AnyAsync(p =>
+                p.Id == projectId &&
+                p.IsDeleted != true &&
+                (p.CreatedById == currentUserId || p.ProjectMembers.Any(pm => pm.UserId == currentUserId)));
+        }
+
+        private async Task<bool> IsProjectMemberAsync(long projectId, long userId)
+        {
+            return await _db.ProjectMembers.AnyAsync(pm => pm.ProjectId == projectId && pm.UserId == userId);
+        }
+
+        private static bool IsAdmin(string roleName)
+        {
+            return roleName.Equals("Admin", StringComparison.OrdinalIgnoreCase);
         }
 
-        private static bool IsElevated(string roleName)
+        private static bool IsManager(string roleName)
         {
-            return roleName.Equals("Admin", StringComparison.OrdinalIgnoreCase) ||
-                   roleName.Equals("Manager", StringComparison.OrdinalIgnoreCase);
+            return roleName.Equals("Manager", StringComparison.OrdinalIgnoreCase);
         }
     }
 }

TaskTrackingSystem.WebApp/Components/Pages/ProjectAssign.razor

@@ -121,15 +121,24 @@
                                 <i data-lucide="rotate-ccw" class="h-3.5 w-3.5 mr-1.5 text-slate-500"></i> Reset
                             </button>
                         </div>
-                        <div class="w-40 shrink-0">
-                            <select @bind="selectedRoleId" class="w-full rounded-lg border border-slate-200 px-3 py-1.5 text-xs text-slate-900 focus:outline-none focus:ring-2 focus:ring-violet-600 focus:border-transparent transition-all">
-                                <option value="0">All Roles</option>
-                                @foreach (var r in roles)
-                                {
-                                    <option value="@r.Id">@r.Name</option>
-                                }
-                            </select>
-                        </div>
+                        @if (isAdminUser)
+                        {
+                            <div class="w-40 shrink-0">
+                                <select @bind="selectedRoleId" class="w-full rounded-lg border border-slate-200 px-3 py-1.5 text-xs text-slate-900 focus:outline-none focus:ring-2 focus:ring-violet-600 focus:border-transparent transition-all">
+                                    <option value="0">All Roles</option>
+                                    @foreach (var r in roles)
+                                    {
+                                        <option value="@r.Id">@r.Name</option>
+                                    }
+                                </select>
+                            </div>
+                        }
+                        else
+                        {
+                            <div class="text-xs font-semibold text-violet-700 bg-violet-50 border border-violet-100 px-3 py-1.5 rounded-lg shrink-0">
+                                Employees only
+                            </div>
+                        }
                         <div class="flex items-center gap-3 shrink-0">
                             <button @onclick="SelectAllUsers" class="text-xs font-semibold text-violet-600 hover:text-violet-800 transition-colors">Select All</button>
                             <span class="text-slate-300">|</span>
@@ -225,6 +234,8 @@
     private List<UserDto> allUsers = new();
     private List<RoleDto> roles = new();
     private long? adminRoleId;
+    private long? employeeRoleId;
+    private bool isAdminUser;
     
     private ProjectDto? SelectedProject { get; set; }
     private HashSet<long> SelectedUserIds { get; set; } = new();
@@ -238,6 +249,7 @@
     protected override async Task OnInitializedAsync()
     {
         var authState = await AuthStateProvider.GetAuthenticationStateAsync();
+        isAdminUser = authState.User.IsInRole("Admin");
         canSaveAssignments = authState.User.IsInRole("Admin") || await MenuAuthorization.HasAccessCodeAsync(authState.User, "Projects_Update");
         var client = ApiClient.CreateClient();
         try
@@ -252,8 +264,14 @@
             
             var allLoadedRoles = rolesTask.Result ?? new();
             var adminRole = allLoadedRoles.FirstOrDefault(r => string.Equals(r.Name, "Admin", StringComparison.OrdinalIgnoreCase));
+            var employeeRole = allLoadedRoles.FirstOrDefault(r => string.Equals(r.Name, "Employee", StringComparison.OrdinalIgnoreCase));
             adminRoleId = adminRole?.Id;
+            employeeRoleId = employeeRole?.Id;
             roles = allLoadedRoles.Where(r => !string.Equals(r.Name, "Admin", StringComparison.OrdinalIgnoreCase)).ToList();
+            if (!isAdminUser && employeeRoleId.HasValue)
+            {
+                selectedRoleId = employeeRoleId.Value;
+            }
         }
         catch (Exception ex)
         {
@@ -284,10 +302,14 @@
             {
                 result = result.Where(u => u.RoleId != adminRoleId.Value);
             }
-            if (selectedRoleId > 0)
+            if (isAdminUser && selectedRoleId > 0)
             {
                 result = result.Where(u => u.RoleId == selectedRoleId);
             }
+            else if (!isAdminUser && employeeRoleId.HasValue)
+            {
+                result = result.Where(u => u.RoleId == employeeRoleId.Value);
+            }
             if (!string.IsNullOrWhiteSpace(userSearch))
             {
                 result = result.Where(u => $"{u.FirstName} {u.LastName}".Contains(userSearch, StringComparison.OrdinalIgnoreCase)
@@ -317,7 +339,7 @@
     {
         userSearchInput = "";
         userSearch = "";
-        selectedRoleId = 0;
+        selectedRoleId = isAdminUser ? 0 : employeeRoleId ?? 0;
     }
 
     private async Task SelectProject(ProjectDto project)

TaskTrackingSystem.WebApp/Components/Pages/TaskAssign.razor

@@ -148,11 +148,11 @@
                     </div>
 
                     <!-- Filter & User Selection -->
-                    <div class="px-6 py-3 border-b border-slate-100 bg-slate-50/30 flex flex-col sm:flex-row sm:items-center justify-between gap-3">
-                        <div class="relative max-w-xs flex-1 flex gap-2">
-                            <div class="relative flex-1">
-                                <input @bind="userSearchInput" type="text" placeholder="Search team members..."
-                                       class="w-full rounded-lg border border-slate-200 pl-9 pr-3 py-1.5 text-xs text-slate-900 placeholder:text-slate-400 focus:outline-none focus:ring-2 focus:ring-violet-600 focus:border-transparent transition-all" />
+                <div class="px-6 py-3 border-b border-slate-100 bg-slate-50/30 flex flex-col sm:flex-row sm:items-center justify-between gap-3">
+                    <div class="relative max-w-xs flex-1 flex gap-2">
+                        <div class="relative flex-1">
+                            <input @bind="userSearchInput" type="text" placeholder="Search team members..."
+                                   class="w-full rounded-lg border border-slate-200 pl-9 pr-3 py-1.5 text-xs text-slate-900 placeholder:text-slate-400 focus:outline-none focus:ring-2 focus:ring-violet-600 focus:border-transparent transition-all" />
                                 <i data-lucide="search" class="absolute left-3 top-2.5 h-3.5 w-3.5 text-slate-400"></i>
                             </div>
                             <button @onclick="ApplyUserSearch" class="inline-flex items-center rounded-lg bg-violet-600 px-3 py-1.5 text-xs font-medium text-white hover:bg-violet-700 transition-colors shrink-0">
@@ -162,15 +162,24 @@
                                 <i data-lucide="rotate-ccw" class="h-3.5 w-3.5 mr-1.5 text-slate-500"></i> Reset
                             </button>
                         </div>
-                        <div class="w-40 shrink-0">
-                            <select @bind="selectedRoleId" class="w-full rounded-lg border border-slate-200 px-3 py-1.5 text-xs text-slate-900 focus:outline-none focus:ring-2 focus:ring-violet-600 focus:border-transparent transition-all">
-                                <option value="0">All Roles</option>
-                                @foreach (var r in roles)
-                                {
-                                    <option value="@r.Id">@r.Name</option>
-                                }
-                            </select>
-                        </div>
+                        @if (isAdminUser)
+                        {
+                            <div class="w-40 shrink-0">
+                                <select @bind="selectedRoleId" class="w-full rounded-lg border border-slate-200 px-3 py-1.5 text-xs text-slate-900 focus:outline-none focus:ring-2 focus:ring-violet-600 focus:border-transparent transition-all">
+                                    <option value="0">All Roles</option>
+                                    @foreach (var r in roles)
+                                    {
+                                        <option value="@r.Id">@r.Name</option>
+                                    }
+                                </select>
+                            </div>
+                        }
+                        else
+                        {
+                            <div class="text-xs font-semibold text-violet-700 bg-violet-50 border border-violet-100 px-3 py-1.5 rounded-lg shrink-0">
+                                Employees in this project
+                            </div>
+                        }
                         <div class="text-xs font-semibold text-slate-600 shrink-0">
                             Selected: <span class="text-violet-700 font-bold">@(TargetAssigneeId.HasValue ? allUsers.FirstOrDefault(u => u.Id == TargetAssigneeId)?.Username ?? "Selected" : "Unassigned")</span>
                         </div>
@@ -258,8 +267,11 @@
     private List<TaskDto> tasks = new();
     private List<ProjectDto> projects = new();
     private List<UserDto> allUsers = new();
+    private List<UserDto> projectMembers = new();
     private List<RoleDto> roles = new();
     private long? adminRoleId;
+    private long? employeeRoleId;
+    private bool isAdminUser;
 
     private long selectedProjectId = 0;
     private long selectedProjectIdInput = 0;
@@ -275,6 +287,7 @@
     protected override async Task OnInitializedAsync()
     {
         var authState = await AuthStateProvider.GetAuthenticationStateAsync();
+        isAdminUser = authState.User.IsInRole("Admin");
         canSaveAssignments = authState.User.IsInRole("Admin") || await MenuAuthorization.HasAccessCodeAsync(authState.User, "Tasks_Update");
         var client = ApiClient.CreateClient();
         try
@@ -291,8 +304,14 @@
             
             var allLoadedRoles = rolesTask.Result ?? new();
             var adminRole = allLoadedRoles.FirstOrDefault(r => string.Equals(r.Name, "Admin", StringComparison.OrdinalIgnoreCase));
+            var employeeRole = allLoadedRoles.FirstOrDefault(r => string.Equals(r.Name, "Employee", StringComparison.OrdinalIgnoreCase));
             adminRoleId = adminRole?.Id;
+            employeeRoleId = employeeRole?.Id;
             roles = allLoadedRoles.Where(r => !string.Equals(r.Name, "Admin", StringComparison.OrdinalIgnoreCase)).ToList();
+            if (!isAdminUser && employeeRoleId.HasValue)
+            {
+                selectedRoleId = employeeRoleId.Value;
+            }
         }
         catch (Exception ex)
         {
@@ -331,15 +350,19 @@
     {
         get
         {
-            var result = allUsers.Where(u => u.IsActive);
+            var result = projectMembers.Where(u => u.IsActive);
             if (adminRoleId.HasValue)
             {
                 result = result.Where(u => u.RoleId != adminRoleId.Value);
             }
-            if (selectedRoleId > 0)
+            if (isAdminUser && selectedRoleId > 0)
             {
                 result = result.Where(u => u.RoleId == selectedRoleId);
             }
+            else if (!isAdminUser && employeeRoleId.HasValue)
+            {
+                result = result.Where(u => u.RoleId == employeeRoleId.Value);
+            }
             if (!string.IsNullOrWhiteSpace(userSearch))
             {
                 result = result.Where(u => $"{u.FirstName} {u.LastName}".Contains(userSearch, StringComparison.OrdinalIgnoreCase)
@@ -364,6 +387,7 @@
         selectedProjectId = selectedProjectIdInput;
         SelectedTask = null;
         TargetAssigneeId = null;
+        projectMembers.Clear();
         statusMessage = null;
     }
 
@@ -373,6 +397,7 @@
         selectedProjectId = 0;
         SelectedTask = null;
         TargetAssigneeId = null;
+        projectMembers.Clear();
         statusMessage = null;
     }
 
@@ -389,11 +414,12 @@
         selectedRoleId = 0;
     }
 
-    private void SelectTask(TaskDto task)
+    private async Task SelectTask(TaskDto task)
     {
         SelectedTask = task;
         TargetAssigneeId = task.AssignedTo;
         statusMessage = null;
+        await LoadProjectMembersAsync(task.ProjectId);
     }
 
     private void SetTargetAssignee(long? userId)
@@ -419,6 +445,37 @@
         await SaveAssignment();
     }
 
+    private async Task LoadProjectMembersAsync(long projectId)
+    {
+        projectMembers.Clear();
+
+        if (projectId <= 0)
+        {
+            return;
+        }
+
+        var client = ApiClient.CreateClient();
+        try
+        {
+            var membersResult = await client.GetFromJsonAsync<Result<IEnumerable<UserDto>>>($"Project/{projectId}/members", Serialization.CaseInsensitive);
+            if (membersResult?.IsSuccess == true && membersResult.Value != null)
+            {
+                projectMembers = membersResult.Value.ToList();
+            }
+        }
+        catch (Exception ex)
+        {
+            Console.WriteLine($"Error loading project members: {ex.Message}");
+            statusMessage = "Failed to load project members.";
+            isError = true;
+        }
+        finally
+        {
+            await InvokeAsync(StateHasChanged);
+            await JS.InvokeVoidAsync("initIcons");
+        }
+    }
+
     private async Task SaveAssignment()
     {
         if (SelectedTask == null) return;