feat: add user and role view sheets with detailed information display

- Created UserViewSheet component to display user details including username, full name, role, status, and timestamps.
- Created RoleViewSheet component to display role details including name, level, status, creation date, and associated permissions.
- Introduced permissions configuration in a new permissions.ts file, defining categories and permission codes for better management.
- Implemented middleware for authentication, ensuring access control for protected routes.

Distribution/Data/AppDBContext.cs

@@ -600,5 +600,6 @@ public class AppDBContext(DbContextOptions<AppDBContext> options) : DbContext(op
         Seed.ProcurementSeed.Apply(modelBuilder);
         Seed.CommerceSeed.Apply(modelBuilder);
         Seed.OperationsExtrasSeed.Apply(modelBuilder);
+        Seed.AdminSeed.Apply(modelBuilder);
     }
 }

Distribution/Data/Seed/AdminSeed.cs

@@ -0,0 +1,25 @@
+using Distribution.Models;
+using Microsoft.EntityFrameworkCore;
+
+namespace Distribution.Data.Seed;
+
+public static class AdminSeed
+{
+    private static readonly DateTime SeedDate = new(2026, 10, 13);
+
+    // Same GUID as the AuthHex user — the sub claim from the JWT maps to this Id
+    internal static readonly Guid SuperAdminUserId = new("00000001-0000-0000-0000-000000000001");
+
+    public static void Apply(ModelBuilder modelBuilder)
+    {
+        modelBuilder.Entity<User>().HasData(new User
+        {
+            Id = SuperAdminUserId,
+            Username = "superadmin",
+            FullName = "Super Admin",
+            FK_RoleId = RoleAndPermissionSeed.SuperAdminRoleId,
+            IsActive = true,
+            CreatedAt = SeedDate
+        });
+    }
+}

Distribution/Data/Seed/MasterDataSeed.cs

@@ -7,10 +7,6 @@ public static class MasterDataSeed
 {
     private static readonly DateTime SeedDate = new(2026, 8, 20);
 
-    // Precomputed via PasswordHasher<User>().HashPassword(new User(), "Passw0rd!123") — see
-    // Implementation Notes in the plan; not derivable from HasData at migration time.
-    internal const string SeedPasswordHash = "AQAAAAIAAYagAAAAEKGnq/U4j6uM9g5mFkxbUE8WU/AhnSNiwrKCiPAqGnzNcaMgZAF5Zal/rJUUYPZPpg==";
-
     // Role ids match Data/Seed/RoleAndPermissionSeed.cs (private there, so re-declared here by value).
     internal static readonly Guid SalesRepRoleId = new("10000000-0000-0000-0000-000000000001");
     internal static readonly Guid SupervisorRoleId = new("10000000-0000-0000-0000-000000000002");
@@ -115,12 +111,12 @@ public static class MasterDataSeed
         );
 
         modelBuilder.Entity<User>().HasData(
-            new User { Id = Supervisor1UserId, Username = "sunil.fernando", PasswordHash = SeedPasswordHash, FullName = "Sunil Fernando", FK_RoleId = SupervisorRoleId, FK_ReportsToUserId = null, CreatedAt = SeedDate, IsActive = true },
-            new User { Id = SalesRep1UserId, Username = "nimal.perera", PasswordHash = SeedPasswordHash, FullName = "Nimal Perera", FK_RoleId = SalesRepRoleId, FK_ReportsToUserId = Supervisor1UserId, CreatedAt = SeedDate, IsActive = true },
-            new User { Id = SalesRep2UserId, Username = "kamal.silva", PasswordHash = SeedPasswordHash, FullName = "Kamal Silva", FK_RoleId = SalesRepRoleId, FK_ReportsToUserId = Supervisor1UserId, CreatedAt = SeedDate, IsActive = true },
-            new User { Id = Driver1UserId, Username = "ruwan.jayasuriya", PasswordHash = SeedPasswordHash, FullName = "Ruwan Jayasuriya", FK_RoleId = SalesRepRoleId, FK_ReportsToUserId = Supervisor1UserId, CreatedAt = SeedDate, IsActive = true },
-            new User { Id = Driver2UserId, Username = "priyantha.kumara", PasswordHash = SeedPasswordHash, FullName = "Priyantha Kumara", FK_RoleId = SalesRepRoleId, FK_ReportsToUserId = Supervisor1UserId, CreatedAt = SeedDate, IsActive = true },
-            new User { Id = RegionalManager1UserId, Username = "priya.rajapaksa", PasswordHash = SeedPasswordHash, FullName = "Priya Rajapaksa", FK_RoleId = RegionalManagerRoleId, FK_ReportsToUserId = null, CreatedAt = SeedDate, IsActive = true }
+            new User { Id = Supervisor1UserId, Username = "sunil.fernando",FullName = "Sunil Fernando", FK_RoleId = SupervisorRoleId, FK_ReportsToUserId = null, CreatedAt = SeedDate, IsActive = true },
+            new User { Id = SalesRep1UserId, Username = "nimal.perera",FullName = "Nimal Perera", FK_RoleId = SalesRepRoleId, FK_ReportsToUserId = Supervisor1UserId, CreatedAt = SeedDate, IsActive = true },
+            new User { Id = SalesRep2UserId, Username = "kamal.silva",FullName = "Kamal Silva", FK_RoleId = SalesRepRoleId, FK_ReportsToUserId = Supervisor1UserId, CreatedAt = SeedDate, IsActive = true },
+            new User { Id = Driver1UserId, Username = "ruwan.jayasuriya",FullName = "Ruwan Jayasuriya", FK_RoleId = SalesRepRoleId, FK_ReportsToUserId = Supervisor1UserId, CreatedAt = SeedDate, IsActive = true },
+            new User { Id = Driver2UserId, Username = "priyantha.kumara",FullName = "Priyantha Kumara", FK_RoleId = SalesRepRoleId, FK_ReportsToUserId = Supervisor1UserId, CreatedAt = SeedDate, IsActive = true },
+            new User { Id = RegionalManager1UserId, Username = "priya.rajapaksa",FullName = "Priya Rajapaksa", FK_RoleId = RegionalManagerRoleId, FK_ReportsToUserId = null, CreatedAt = SeedDate, IsActive = true }
         );
 
         modelBuilder.Entity<DriverProfile>().HasData(

Distribution/Data/Seed/OperationsExtrasSeed.cs

@@ -43,7 +43,7 @@ public static class OperationsExtrasSeed
     public static void Apply(ModelBuilder modelBuilder)
     {
         modelBuilder.Entity<User>().HasData(
-            new User { Id = RegionalAgency1UserId, Username = "channa.desilva", PasswordHash = MasterDataSeed.SeedPasswordHash, FullName = "Channa De Silva", FK_RoleId = RegionalAgencyRoleId, FK_ReportsToUserId = null, CreatedAt = new DateTime(2026, 8, 20), IsActive = true }
+            new User { Id = RegionalAgency1UserId, Username = "channa.desilva", FullName = "Channa De Silva", FK_RoleId = RegionalAgencyRoleId, FK_ReportsToUserId = null, CreatedAt = new DateTime(2026, 8, 20), IsActive = true }
         );
 
         modelBuilder.Entity<Uom>().HasData(

Distribution/Data/Seed/RoleAndPermissionSeed.cs

@@ -7,22 +7,191 @@ public static class RoleAndPermissionSeed
 {
     private static readonly DateTime SeedDate = new(2026, 8, 18);
 
-    private static readonly Guid SalesRepId = new("10000000-0000-0000-0000-000000000001");
-    private static readonly Guid SupervisorId = new("10000000-0000-0000-0000-000000000002");
-    private static readonly Guid AreaManagerId = new("10000000-0000-0000-0000-000000000003");
-    private static readonly Guid AreaSupervisorId = new("10000000-0000-0000-0000-000000000004");
-    private static readonly Guid RegionalManagerId = new("10000000-0000-0000-0000-000000000005");
-    private static readonly Guid RegionalAgencyId = new("10000000-0000-0000-0000-000000000006");
+    private static readonly Guid SalesRepId        = new("10000000-0000-0000-0000-000000000001");
+    private static readonly Guid SupervisorId       = new("10000000-0000-0000-0000-000000000002");
+    private static readonly Guid AreaManagerId      = new("10000000-0000-0000-0000-000000000003");
+    private static readonly Guid AreaSupervisorId   = new("10000000-0000-0000-0000-000000000004");
+    private static readonly Guid RegionalManagerId  = new("10000000-0000-0000-0000-000000000005");
+    private static readonly Guid RegionalAgencyId   = new("10000000-0000-0000-0000-000000000006");
+    internal static readonly Guid SuperAdminRoleId  = new("10000000-0000-0000-0000-000000000007");
+
+    // ── Legacy broad permissions (nav.ts uses these for sidebar visibility) ────
+    private static readonly Guid PermOrdersView         = new("20000000-0000-0000-0000-000000000001");
+    private static readonly Guid PermRidesView          = new("20000000-0000-0000-0000-000000000002");
+    private static readonly Guid PermLoadingView        = new("20000000-0000-0000-0000-000000000003");
+    private static readonly Guid PermStoresView         = new("20000000-0000-0000-0000-000000000004");
+    private static readonly Guid PermSalesVisitsCheckin = new("20000000-0000-0000-0000-000000000005");
+    private static readonly Guid PermItemsView          = new("20000000-0000-0000-0000-000000000006");
+    private static readonly Guid PermCategoriesView     = new("20000000-0000-0000-0000-000000000007");
+    private static readonly Guid PermWarehousesView     = new("20000000-0000-0000-0000-000000000008");
+    private static readonly Guid PermPurchaseOrdersView = new("20000000-0000-0000-0000-000000000009");
+    private static readonly Guid PermPricelistsView     = new("20000000-0000-0000-0000-000000000010");
+    private static readonly Guid PermSchemesView        = new("20000000-0000-0000-0000-000000000011");
+    private static readonly Guid PermSuppliersView      = new("20000000-0000-0000-0000-000000000012");
+    private static readonly Guid PermDriverProfilesView = new("20000000-0000-0000-0000-000000000013");
+    private static readonly Guid PermComplianceManage   = new("20000000-0000-0000-0000-000000000014");
+    private static readonly Guid PermUsersView          = new("20000000-0000-0000-0000-000000000015");
+    private static readonly Guid PermRolesView          = new("20000000-0000-0000-0000-000000000016");
+    private static readonly Guid PermRegionsView        = new("20000000-0000-0000-0000-000000000017");
+    private static readonly Guid PermRoutesView         = new("20000000-0000-0000-0000-000000000018");
+    private static readonly Guid PermVehiclesView       = new("20000000-0000-0000-0000-000000000019");
+
+    // ── Granular API permissions (used in [Authorize("...")] on controller actions) ─
+    private static readonly Guid PermClaimView          = new("20000000-0000-0000-0000-000000000020");
+    private static readonly Guid PermClaimManage        = new("20000000-0000-0000-0000-000000000021");
+    private static readonly Guid PermDeliveryTaskView   = new("20000000-0000-0000-0000-000000000022");
+    private static readonly Guid PermDeliveryTaskManage = new("20000000-0000-0000-0000-000000000023");
+    private static readonly Guid PermDriverView         = new("20000000-0000-0000-0000-000000000024");
+    private static readonly Guid PermDriverManage       = new("20000000-0000-0000-0000-000000000025");
+    private static readonly Guid PermGrnView            = new("20000000-0000-0000-0000-000000000026");
+    private static readonly Guid PermGrnManage          = new("20000000-0000-0000-0000-000000000027");
+    private static readonly Guid PermLoadingSheetView   = new("20000000-0000-0000-0000-000000000028");
+    private static readonly Guid PermLoadingSheetManage = new("20000000-0000-0000-0000-000000000029");
+    private static readonly Guid PermPriceListView      = new("20000000-0000-0000-0000-000000000030");
+    private static readonly Guid PermPriceListManage    = new("20000000-0000-0000-0000-000000000031");
+    private static readonly Guid PermPurchaseOrderView  = new("20000000-0000-0000-0000-000000000032");
+    private static readonly Guid PermPurchaseOrderManage= new("20000000-0000-0000-0000-000000000033");
+    private static readonly Guid PermPurchaseReturnManage=new("20000000-0000-0000-0000-000000000034");
+    private static readonly Guid PermRegionView         = new("20000000-0000-0000-0000-000000000035");
+    private static readonly Guid PermRegionManage       = new("20000000-0000-0000-0000-000000000036");
+    private static readonly Guid PermReturnView         = new("20000000-0000-0000-0000-000000000037");
+    private static readonly Guid PermReturnManage       = new("20000000-0000-0000-0000-000000000038");
+    private static readonly Guid PermRouteView          = new("20000000-0000-0000-0000-000000000039");
+    private static readonly Guid PermRouteManage        = new("20000000-0000-0000-0000-000000000040");
+    private static readonly Guid PermSchemeView         = new("20000000-0000-0000-0000-000000000041");
+    private static readonly Guid PermSchemeManage       = new("20000000-0000-0000-0000-000000000042");
+    private static readonly Guid PermStockView          = new("20000000-0000-0000-0000-000000000043");
+    private static readonly Guid PermStockManage        = new("20000000-0000-0000-0000-000000000044");
+    private static readonly Guid PermStoreView          = new("20000000-0000-0000-0000-000000000045");
+    private static readonly Guid PermStoreManage        = new("20000000-0000-0000-0000-000000000046");
+    private static readonly Guid PermSupplierClaimView  = new("20000000-0000-0000-0000-000000000047");
+    private static readonly Guid PermSupplierClaimManage= new("20000000-0000-0000-0000-000000000048");
+    private static readonly Guid PermSysConfigView      = new("20000000-0000-0000-0000-000000000049");
+    private static readonly Guid PermSysConfigManage    = new("20000000-0000-0000-0000-000000000050");
 
     public static void Apply(ModelBuilder modelBuilder)
     {
         modelBuilder.Entity<Role>().HasData(
-            new Role { Id = SalesRepId, Name = "SalesRep", Level = 10, CreatedAt = SeedDate, IsActive = true },
-            new Role { Id = SupervisorId, Name = "Supervisor", Level = 20, CreatedAt = SeedDate, IsActive = true },
-            new Role { Id = AreaManagerId, Name = "AreaManager", Level = 30, CreatedAt = SeedDate, IsActive = true },
-            new Role { Id = AreaSupervisorId, Name = "AreaSupervisor", Level = 40, CreatedAt = SeedDate, IsActive = true },
-            new Role { Id = RegionalManagerId, Name = "RegionalManager", Level = 50, CreatedAt = SeedDate, IsActive = true },
-            new Role { Id = RegionalAgencyId, Name = "RegionalAgency", Level = 60, CreatedAt = SeedDate, IsActive = true }
+            new Role { Id = SalesRepId,       Name = "SalesRep",       Level = 10,  CreatedAt = SeedDate, IsActive = true },
+            new Role { Id = SupervisorId,     Name = "Supervisor",     Level = 20,  CreatedAt = SeedDate, IsActive = true },
+            new Role { Id = AreaManagerId,    Name = "AreaManager",    Level = 30,  CreatedAt = SeedDate, IsActive = true },
+            new Role { Id = AreaSupervisorId, Name = "AreaSupervisor", Level = 40,  CreatedAt = SeedDate, IsActive = true },
+            new Role { Id = RegionalManagerId,Name = "RegionalManager",Level = 50,  CreatedAt = SeedDate, IsActive = true },
+            new Role { Id = RegionalAgencyId, Name = "RegionalAgency", Level = 60,  CreatedAt = SeedDate, IsActive = true },
+            new Role { Id = SuperAdminRoleId, Name = "SuperAdmin",     Level = 100, CreatedAt = SeedDate, IsActive = true }
+        );
+
+        modelBuilder.Entity<Permission>().HasData(
+            // ── Legacy broad permissions ──────────────────────────────────────────
+            new Permission { Id = PermOrdersView,         Code = "orders.view",           Description = "View shop POs, invoices, payments and returns",                     CreatedAt = SeedDate, IsActive = true },
+            new Permission { Id = PermRidesView,          Code = "rides.view",            Description = "View and manage delivery rides and delivery tasks",                  CreatedAt = SeedDate, IsActive = true },
+            new Permission { Id = PermLoadingView,        Code = "loading.view",          Description = "View and manage loading sheets",                                     CreatedAt = SeedDate, IsActive = true },
+            new Permission { Id = PermStoresView,         Code = "stores.view",           Description = "View store accounts, credit limits and balances",                    CreatedAt = SeedDate, IsActive = true },
+            new Permission { Id = PermSalesVisitsCheckin, Code = "sales_visits.checkin",  Description = "Check in and out of scheduled store visits",                         CreatedAt = SeedDate, IsActive = true },
+            new Permission { Id = PermItemsView,          Code = "items.view",            Description = "View and manage catalogue products",                                 CreatedAt = SeedDate, IsActive = true },
+            new Permission { Id = PermCategoriesView,     Code = "categories.view",       Description = "View and manage product categories and brands",                      CreatedAt = SeedDate, IsActive = true },
+            new Permission { Id = PermWarehousesView,     Code = "warehouses.view",       Description = "View stock balances, movements, warehouses and reports",             CreatedAt = SeedDate, IsActive = true },
+            new Permission { Id = PermPurchaseOrdersView, Code = "purchase_orders.view",  Description = "View and manage purchase orders, GRNs and supplier claims",          CreatedAt = SeedDate, IsActive = true },
+            new Permission { Id = PermPricelistsView,     Code = "pricelists.view",       Description = "View and manage regional price lists",                               CreatedAt = SeedDate, IsActive = true },
+            new Permission { Id = PermSchemesView,        Code = "schemes.view",          Description = "View and manage pricing schemes and promotions",                     CreatedAt = SeedDate, IsActive = true },
+            new Permission { Id = PermSuppliersView,      Code = "suppliers.view",        Description = "View and manage supplier accounts",                                  CreatedAt = SeedDate, IsActive = true },
+            new Permission { Id = PermDriverProfilesView, Code = "driver_profiles.view",  Description = "View and manage driver profiles and licensing",                      CreatedAt = SeedDate, IsActive = true },
+            new Permission { Id = PermComplianceManage,   Code = "compliance.manage",     Description = "Manage driver compliance rules",                                     CreatedAt = SeedDate, IsActive = true },
+            new Permission { Id = PermUsersView,          Code = "users.view",            Description = "View and manage staff user accounts",                                CreatedAt = SeedDate, IsActive = true },
+            new Permission { Id = PermRolesView,          Code = "roles.view",            Description = "View and manage roles and their permission sets",                    CreatedAt = SeedDate, IsActive = true },
+            new Permission { Id = PermRegionsView,        Code = "regions.view",          Description = "View and manage regions and region configuration",                   CreatedAt = SeedDate, IsActive = true },
+            new Permission { Id = PermRoutesView,         Code = "routes.view",           Description = "View and manage delivery routes",                                    CreatedAt = SeedDate, IsActive = true },
+            new Permission { Id = PermVehiclesView,       Code = "vehicles.view",         Description = "View and manage fleet vehicles",                                     CreatedAt = SeedDate, IsActive = true },
+
+            // ── Granular API permissions ──────────────────────────────────────────
+            new Permission { Id = PermClaimView,          Code = "claim.view",            Description = "View agency claims and settlement status",                           CreatedAt = SeedDate, IsActive = true },
+            new Permission { Id = PermClaimManage,        Code = "claim.manage",          Description = "Create and settle agency claims",                                    CreatedAt = SeedDate, IsActive = true },
+            new Permission { Id = PermDeliveryTaskView,   Code = "delivery-task.view",    Description = "View delivery tasks within a ride",                                  CreatedAt = SeedDate, IsActive = true },
+            new Permission { Id = PermDeliveryTaskManage, Code = "delivery-task.manage",  Description = "Confirm and fail delivery tasks",                                    CreatedAt = SeedDate, IsActive = true },
+            new Permission { Id = PermDriverView,         Code = "driver.view",           Description = "View driver profiles and license details",                           CreatedAt = SeedDate, IsActive = true },
+            new Permission { Id = PermDriverManage,       Code = "driver.manage",         Description = "Create and update driver profiles",                                  CreatedAt = SeedDate, IsActive = true },
+            new Permission { Id = PermGrnView,            Code = "grn.view",              Description = "View goods receipt notes",                                           CreatedAt = SeedDate, IsActive = true },
+            new Permission { Id = PermGrnManage,          Code = "grn.manage",            Description = "Create and confirm goods receipts",                                  CreatedAt = SeedDate, IsActive = true },
+            new Permission { Id = PermLoadingSheetView,   Code = "loading-sheet.view",    Description = "View loading sheets and their items",                                CreatedAt = SeedDate, IsActive = true },
+            new Permission { Id = PermLoadingSheetManage, Code = "loading-sheet.manage",  Description = "Create, edit, and confirm loading sheets",                           CreatedAt = SeedDate, IsActive = true },
+            new Permission { Id = PermPriceListView,      Code = "price-list.view",       Description = "View regional price lists",                                          CreatedAt = SeedDate, IsActive = true },
+            new Permission { Id = PermPriceListManage,    Code = "price-list.manage",     Description = "Create and manage item price lists",                                 CreatedAt = SeedDate, IsActive = true },
+            new Permission { Id = PermPurchaseOrderView,  Code = "purchase-order.view",   Description = "View purchase orders and line items",                                CreatedAt = SeedDate, IsActive = true },
+            new Permission { Id = PermPurchaseOrderManage,Code = "purchase-order.manage", Description = "Create, confirm, and close purchase orders",                         CreatedAt = SeedDate, IsActive = true },
+            new Permission { Id = PermPurchaseReturnManage,Code= "purchase-return.manage",Description = "Create and manage purchase returns to suppliers",                    CreatedAt = SeedDate, IsActive = true },
+            new Permission { Id = PermRegionView,         Code = "region.view",           Description = "View regions and their configuration",                               CreatedAt = SeedDate, IsActive = true },
+            new Permission { Id = PermRegionManage,       Code = "region.manage",         Description = "Create and update regions, targets, and budgets",                    CreatedAt = SeedDate, IsActive = true },
+            new Permission { Id = PermReturnView,         Code = "return.view",           Description = "View order returns",                                                 CreatedAt = SeedDate, IsActive = true },
+            new Permission { Id = PermReturnManage,       Code = "return.manage",         Description = "Create and manage order returns",                                    CreatedAt = SeedDate, IsActive = true },
+            new Permission { Id = PermRouteView,          Code = "route.view",            Description = "View delivery routes",                                               CreatedAt = SeedDate, IsActive = true },
+            new Permission { Id = PermRouteManage,        Code = "route.manage",          Description = "Create and manage delivery routes",                                  CreatedAt = SeedDate, IsActive = true },
+            new Permission { Id = PermSchemeView,         Code = "scheme.view",           Description = "View pricing schemes and promotions",                                CreatedAt = SeedDate, IsActive = true },
+            new Permission { Id = PermSchemeManage,       Code = "scheme.manage",         Description = "Create and configure pricing schemes",                               CreatedAt = SeedDate, IsActive = true },
+            new Permission { Id = PermStockView,          Code = "stock.view",            Description = "View stock balances and movements",                                  CreatedAt = SeedDate, IsActive = true },
+            new Permission { Id = PermStockManage,        Code = "stock.manage",          Description = "Transfer stock and record damage or adjustments",                    CreatedAt = SeedDate, IsActive = true },
+            new Permission { Id = PermStoreView,          Code = "store.view",            Description = "View store accounts and balances",                                   CreatedAt = SeedDate, IsActive = true },
+            new Permission { Id = PermStoreManage,        Code = "store.manage",          Description = "Create and update store accounts",                                   CreatedAt = SeedDate, IsActive = true },
+            new Permission { Id = PermSupplierClaimView,  Code = "supplier-claim.view",   Description = "View supplier claims",                                               CreatedAt = SeedDate, IsActive = true },
+            new Permission { Id = PermSupplierClaimManage,Code = "supplier-claim.manage", Description = "Create and resolve supplier claims",                                 CreatedAt = SeedDate, IsActive = true },
+            new Permission { Id = PermSysConfigView,      Code = "sys-config.view",       Description = "View system configuration settings",                                 CreatedAt = SeedDate, IsActive = true },
+            new Permission { Id = PermSysConfigManage,    Code = "sys-config.manage",     Description = "Update system configuration settings",                               CreatedAt = SeedDate, IsActive = true }
+        );
+
+        // SuperAdmin gets every permission
+        modelBuilder.Entity<RolePermission>().HasData(
+            // ── Legacy broad permissions ──────────────────────────────────────────
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermOrdersView,         CreatedAt = SeedDate, IsActive = true },
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermRidesView,          CreatedAt = SeedDate, IsActive = true },
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermLoadingView,        CreatedAt = SeedDate, IsActive = true },
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermStoresView,         CreatedAt = SeedDate, IsActive = true },
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermSalesVisitsCheckin, CreatedAt = SeedDate, IsActive = true },
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermItemsView,          CreatedAt = SeedDate, IsActive = true },
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermCategoriesView,     CreatedAt = SeedDate, IsActive = true },
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermWarehousesView,     CreatedAt = SeedDate, IsActive = true },
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermPurchaseOrdersView, CreatedAt = SeedDate, IsActive = true },
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermPricelistsView,     CreatedAt = SeedDate, IsActive = true },
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermSchemesView,        CreatedAt = SeedDate, IsActive = true },
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermSuppliersView,      CreatedAt = SeedDate, IsActive = true },
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermDriverProfilesView, CreatedAt = SeedDate, IsActive = true },
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermComplianceManage,   CreatedAt = SeedDate, IsActive = true },
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermUsersView,          CreatedAt = SeedDate, IsActive = true },
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermRolesView,          CreatedAt = SeedDate, IsActive = true },
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermRegionsView,        CreatedAt = SeedDate, IsActive = true },
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermRoutesView,         CreatedAt = SeedDate, IsActive = true },
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermVehiclesView,       CreatedAt = SeedDate, IsActive = true },
+
+            // ── Granular API permissions ──────────────────────────────────────────
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermClaimView,          CreatedAt = SeedDate, IsActive = true },
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermClaimManage,        CreatedAt = SeedDate, IsActive = true },
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermDeliveryTaskView,   CreatedAt = SeedDate, IsActive = true },
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermDeliveryTaskManage, CreatedAt = SeedDate, IsActive = true },
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermDriverView,         CreatedAt = SeedDate, IsActive = true },
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermDriverManage,       CreatedAt = SeedDate, IsActive = true },
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermGrnView,            CreatedAt = SeedDate, IsActive = true },
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermGrnManage,          CreatedAt = SeedDate, IsActive = true },
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermLoadingSheetView,   CreatedAt = SeedDate, IsActive = true },
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermLoadingSheetManage, CreatedAt = SeedDate, IsActive = true },
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermPriceListView,      CreatedAt = SeedDate, IsActive = true },
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermPriceListManage,    CreatedAt = SeedDate, IsActive = true },
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermPurchaseOrderView,  CreatedAt = SeedDate, IsActive = true },
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermPurchaseOrderManage,CreatedAt = SeedDate, IsActive = true },
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermPurchaseReturnManage,CreatedAt = SeedDate, IsActive = true },
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermRegionView,         CreatedAt = SeedDate, IsActive = true },
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermRegionManage,       CreatedAt = SeedDate, IsActive = true },
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermReturnView,         CreatedAt = SeedDate, IsActive = true },
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermReturnManage,       CreatedAt = SeedDate, IsActive = true },
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermRouteView,          CreatedAt = SeedDate, IsActive = true },
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermRouteManage,        CreatedAt = SeedDate, IsActive = true },
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermSchemeView,         CreatedAt = SeedDate, IsActive = true },
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermSchemeManage,       CreatedAt = SeedDate, IsActive = true },
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermStockView,          CreatedAt = SeedDate, IsActive = true },
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermStockManage,        CreatedAt = SeedDate, IsActive = true },
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermStoreView,          CreatedAt = SeedDate, IsActive = true },
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermStoreManage,        CreatedAt = SeedDate, IsActive = true },
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermSupplierClaimView,  CreatedAt = SeedDate, IsActive = true },
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermSupplierClaimManage,CreatedAt = SeedDate, IsActive = true },
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermSysConfigView,      CreatedAt = SeedDate, IsActive = true },
+            new RolePermission { FK_RoleId = SuperAdminRoleId, FK_PermissionId = PermSysConfigManage,    CreatedAt = SeedDate, IsActive = true }
         );
     }
 }

Distribution/Features/Auth/AuthController.cs

@@ -1,3 +1,5 @@
+using System.IdentityModel.Tokens.Jwt;
+using Distribution.Features.User;
 using Distribution.Infra.Authorization;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
@@ -6,32 +8,93 @@ namespace Distribution.Features.Auth;
 
 [ApiController]
 [Route("api/auth")]
-public class AuthController(AuthService service, ICurrentUserService currentUser) : ControllerBase
+public class AuthController(AuthService service, ICurrentUserService currentUser, IUserRepository userRepo) : ControllerBase
 {
     private static IActionResult ToActionResult(AuthHexResponse result) =>
         result.Success ? new OkObjectResult(result) : new ObjectResult(result) { StatusCode = result.StatusCode is >= 400 and < 600 ? result.StatusCode : 401 };
 
     [HttpPost("login")]
-    public async Task<IActionResult> Login(LoginRequest request, CancellationToken ct) =>
-        ToActionResult(await service.LoginAsync(request, ct));
+    [AllowAnonymous]
+    public async Task<IActionResult> Login(LoginRequest request, CancellationToken ct)
+    {
+        var result = await service.LoginAsync(request, ct);
+
+        if (!result.Success || result.Data is not { } data)
+            return ToActionResult(result);
+
+        string? token = null;
+        TimeSpan maxAge = TimeSpan.FromHours(1);
+
+        if (data.TryGetProperty("accessToken", out var tokenEl))
+            token = tokenEl.GetString();
+
+        if (data.TryGetProperty("expiresIn", out var expEl))
+            maxAge = TimeSpan.FromSeconds(expEl.GetInt32());
+
+        if (!string.IsNullOrEmpty(token))
+        {
+            Response.Cookies.Append("access-token", token, new CookieOptions
+            {
+                HttpOnly = true,
+                SameSite = SameSiteMode.Lax,
+                Path = "/",
+                MaxAge = maxAge,
+                Secure = Request.IsHttps,
+            });
+        }
+
+        MeResponse? profile = null;
+        if (!string.IsNullOrEmpty(token))
+        {
+            var jwt = new JwtSecurityTokenHandler().ReadJwtToken(token);
+            var userIdStr = jwt.Claims.FirstOrDefault(c => c.Type == "UserId")?.Value;
+            if (Guid.TryParse(userIdStr, out var userId))
+            {
+                var user = await userRepo.GetByIdAsync(userId);
+                if (user is not null)
+                    profile = new MeResponse(
+                        user.Id,
+                        user.Username,
+                        user.FK_RoleId,
+                        user.Role?.Name ?? string.Empty,
+                        user.Role?.Level ?? 0);
+            }
+        }
+
+        return Ok(new { result.StatusCode, result.Success, result.Message, result.Data, profile });
+    }
 
     [HttpPost("register")]
+    [AllowAnonymous]
     public async Task<IActionResult> Register(RegisterRequest request, CancellationToken ct) =>
         ToActionResult(await service.RegisterAsync(request, ct));
 
     [HttpGet("me")]
     [Authorize]
-    public async Task<IActionResult> Me(CancellationToken ct)
+    public async Task<IActionResult> Me()
     {
-        var userId = currentUser.UserId ?? throw new UnauthorizedAccessException();
-        return ToActionResult(await service.GetUserDetailsAsync(userId, ct));
+        if (currentUser.UserId is null) return Unauthorized();
+        var user = await userRepo.GetByIdAsync(currentUser.UserId.Value);
+        if (user is null) return Unauthorized();
+        return Ok(new MeResponse(
+            user.Id,
+            user.Username,
+            user.FK_RoleId,
+            user.Role?.Name ?? string.Empty,
+            user.Role?.Level ?? 0));
     }
 
     [HttpPost("logout")]
-    [Authorize]
-    public async Task<IActionResult> Logout(CancellationToken ct)
+    [AllowAnonymous]
+    public IActionResult Logout()
     {
-        var token = Request.Headers.Authorization.ToString().Replace("Bearer ", "", StringComparison.OrdinalIgnoreCase);
-        return ToActionResult(await service.LogoutAsync(token, ct));
+        Response.Cookies.Delete("access-token", new CookieOptions
+        {
+            HttpOnly = true,
+            SameSite = SameSiteMode.Lax,
+            Path = "/",
+            Secure = Request.IsHttps,
+        });
+        return Ok(new { success = true });
     }
 }

Distribution/Features/Auth/AuthDTOs.cs

@@ -1,5 +1,16 @@
 namespace Distribution.Features.Auth;
 
-public record LoginRequest(string Username, string Password);
+public record LoginRequest(
+    string Identifier,
+    string Password,
+    Guid? UserTypeId = null,
+    string DeviceName = "Unknown Device");
 
-public record RegisterRequest(string Username, string Password, string? FullName);
+public record RegisterRequest(string Username, string email, string Password, string? FullName);
+
+public record MeResponse(
+    Guid UserId,
+    string Username,
+    Guid RoleId,
+    string RoleCode,
+    int RoleLevel);

Distribution/Features/Auth/AuthHexClient.cs

@@ -1,12 +1,11 @@
 using System.Net.Http.Json;
 
-namespace Distribution.Infra.Authorization;
+namespace Distribution.Features.Auth;
 
 /// <summary>
 /// Proxies own-user auth calls (login/register/getUserDetails/logout) to the external AuthHex
-/// identity service. AuthHex owns credentials and issues the RS256-signed JWT this app validates
-/// (see JwtTokenService's replacement — token generation is no longer done locally); this app
-/// never sees or stores a plaintext/hashed password for the AuthHex-authenticated flow.
+/// identity service. AuthHex owns credentials and issues the RS256-signed JWT this app validates;
+/// this app never sees or stores a plaintext/hashed password.
 /// </summary>
 public class AuthHexClient(HttpClient http) : IAuthHexClient
 {

Distribution/Features/Auth/AuthHexResponse.cs

@@ -1,7 +1,7 @@
 using System.Text.Json;
 using System.Text.Json.Serialization;
 
-namespace Distribution.Infra.Authorization;
+namespace Distribution.Features.Auth;
 
 /// <summary>Raw response shape returned by AuthHex's `/api/user` endpoint for every functionName.</summary>
 public record AuthHexResponse(

Distribution/Features/Auth/AuthService.cs

@@ -1,17 +1,21 @@
-using Distribution.Infra.Authorization;
 
 namespace Distribution.Features.Auth;
 
 /// <summary>
 /// Own-user auth is fully delegated to AuthHex — this service only proxies the four functions
 /// AuthHex exposes (loginUser/registerUser/getUserDetails/LogoutUser). No local password check or
-/// token issuance happens here; AuthHex owns credentials and signs the JWT this app validates
-/// (see Program.cs's JwtBearer registration + OnTokenValidated role mapping).
+/// token issuance happens here; AuthHex owns credentials and signs the JWT this app validates.
 /// </summary>
 public class AuthService(IAuthHexClient authHex)
 {
     public Task<AuthHexResponse> LoginAsync(LoginRequest request, CancellationToken ct = default) =>
-        authHex.CallAsync("loginUser", request, reference: Guid.NewGuid().ToString(), ct: ct);
+        authHex.CallAsync("loginUser", new
+        {
+            identifier = request.Identifier,
+            password = request.Password,
+            userTypeId = request.UserTypeId,
+            deviceName = request.DeviceName
+        }, reference: Guid.NewGuid().ToString(), ct: ct);
 
     public Task<AuthHexResponse> RegisterAsync(RegisterRequest request, CancellationToken ct = default) =>
         authHex.CallAsync("registerUser", request, reference: Guid.NewGuid().ToString(), ct: ct);

Distribution/Features/Auth/AuthServiceClient.cs

@@ -1,20 +0,0 @@
-namespace Distribution.Features.Auth;
-
-/// <summary>
-/// Typed HttpClient that proxies requests to the external Auth Service.
-/// Registered via AddHttpClient&lt;AuthServiceClient&gt; in Program.cs.
-/// BaseAddress is configured from AuthService:BaseUrl in appsettings.json.
-///
-/// TODO: Implement methods once Auth Service contract is agreed.
-/// </summary>
-public class AuthServiceClient(HttpClient http) : IAuthServiceClient
-{
-    // TODO: implement proxy methods, e.g.:
-    //
-    // public async Task<AuthServiceResponse?> LoginAsync(LoginRequest request, CancellationToken ct)
-    // {
-    //     var response = await http.PostAsJsonAsync("/TODO_AUTH_SERVICE_LOGIN_PATH", request, ct);
-    //     if (!response.IsSuccessStatusCode) return null;
-    //     return await response.Content.ReadFromJsonAsync<AuthServiceResponse>(ct);
-    // }
-}

Distribution/Features/Auth/AuthServiceOptions.cs

@@ -1,11 +0,0 @@
-namespace Distribution.Features.Auth;
-
-public class AuthServiceOptions
-{
-    public const string SectionName = "AuthService";
-
-    /// <summary>Base URL of the external Auth Service, e.g. "https://auth.internal".</summary>
-    public string BaseUrl { get; set; } = string.Empty;
-
-    // TODO: add other config (API keys, timeout, etc.) once Auth Service is defined.
-}

Distribution/Features/Auth/IAuthHexClient.cs

@@ -1,4 +1,4 @@
-namespace Distribution.Infra.Authorization;
+namespace Distribution.Features.Auth;
 
 public interface IAuthHexClient
 {

Distribution/Features/Auth/IAuthServiceClient.cs

@@ -1,16 +0,0 @@
-namespace Distribution.Features.Auth;
-
-/// <summary>
-/// Connector to the external Auth Service. This backend proxies all auth
-/// traffic from the Next.js frontend through to the Auth Service — the
-/// frontend never calls the Auth Service directly.
-///
-/// TODO: Fill in the method signatures once the Auth Service contract is agreed.
-/// </summary>
-public interface IAuthServiceClient
-{
-    // TODO: define methods based on Auth Service contract, e.g.:
-    // Task<AuthServiceResponse?> LoginAsync(LoginRequest request, CancellationToken ct);
-    // Task<AuthServiceResponse?> RefreshAsync(string refreshToken, CancellationToken ct);
-    // Task LogoutAsync(string token, CancellationToken ct);
-}

Distribution/Features/Claims/ClaimController.cs

@@ -1,4 +1,5 @@
-using Distribution.Infra.Authorization;
+using Distribution.Infra.Authorization;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 namespace Distribution.Features.Claims;
@@ -7,10 +8,12 @@ namespace Distribution.Features.Claims;
 public class ClaimController(ClaimService service, ICurrentUserService currentUser) : ControllerBase
 {
     [HttpGet("api/claims")]
+    [Authorize("claim.view")]
     public async Task<IActionResult> GetAll() =>
         Ok(await service.GetAllAsync());
 
     [HttpGet("api/claims/{id:guid}")]
+    [Authorize("claim.view")]
     public async Task<IActionResult> GetById(Guid id)
     {
         var result = await service.GetByIdAsync(id);
@@ -18,6 +21,7 @@ public class ClaimController(ClaimService service, ICurrentUserService currentUs
     }
 
     [HttpPost("api/claims")]
+    [Authorize("claim.manage")]
     public async Task<IActionResult> Create(CreateClaimRequest request, CancellationToken ct)
     {
         try
@@ -29,6 +33,7 @@ public class ClaimController(ClaimService service, ICurrentUserService currentUs
     }
 
     [HttpPut("api/claims/{id:guid}")]
+    [Authorize("claim.manage")]
     public async Task<IActionResult> Update(Guid id, UpdateClaimRequest request, CancellationToken ct)
     {
         try
@@ -40,6 +45,7 @@ public class ClaimController(ClaimService service, ICurrentUserService currentUs
     }
 
     [HttpPost("api/claims/{id:guid}/settle")]
+    [Authorize("claim.manage")]
     public async Task<IActionResult> Settle(Guid id, SettleClaimRequest request, CancellationToken ct)
     {
         var userId = currentUser.UserId ?? request.SettledByUserId;

Distribution/Features/DeliveryRide/DeliveryTaskController.cs

@@ -1,4 +1,5 @@
-using Distribution.Models;
+using Distribution.Models;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 namespace Distribution.Features.DeliveryRide;
@@ -8,6 +9,7 @@ namespace Distribution.Features.DeliveryRide;
 public class DeliveryTaskController(DeliveryTaskService service) : ControllerBase
 {
     [HttpPost("rides/{rideId:guid}/tasks/generate")]
+    [Authorize("delivery-task.manage")]
     public async Task<IActionResult> Generate(Guid rideId, CancellationToken ct)
     {
         try
@@ -21,6 +23,7 @@ public class DeliveryTaskController(DeliveryTaskService service) : ControllerBas
 
     [HttpGet("rides/{rideId:guid}/tasks")]
     [HttpGet("rides/{rideId:guid}/delivery-tasks")]
+    [Authorize("delivery-task.view")]
     public async Task<IActionResult> GetByRide(Guid rideId)
     {
         var result = await service.GetByRideIdAsync(rideId);
@@ -28,6 +31,7 @@ public class DeliveryTaskController(DeliveryTaskService service) : ControllerBas
     }
 
     [HttpGet("delivery-tasks")]
+    //[Authorize("delivery-task.view")]
     public async Task<IActionResult> GetAll(
         [FromQuery] DeliveryTaskStatus? status,
         [FromQuery] int page = 1,
@@ -38,6 +42,7 @@ public class DeliveryTaskController(DeliveryTaskService service) : ControllerBas
     }
 
     [HttpGet("delivery-tasks/{id:guid}")]
+    [Authorize("delivery-task.view")]
     public async Task<IActionResult> GetById(Guid id)
     {
         var result = await service.GetByIdAsync(id);
@@ -45,6 +50,7 @@ public class DeliveryTaskController(DeliveryTaskService service) : ControllerBas
     }
 
     [HttpPut("delivery-tasks/{id:guid}/quantities")]
+    [Authorize("delivery-task.manage")]
     public async Task<IActionResult> SetQuantities(Guid id, SetQuantitiesRequest request, CancellationToken ct)
     {
         try
@@ -57,6 +63,7 @@ public class DeliveryTaskController(DeliveryTaskService service) : ControllerBas
     }
 
     [HttpPost("delivery-tasks/{id:guid}/confirm")]
+    [Authorize("delivery-task.manage")]
     public async Task<IActionResult> Confirm(Guid id, CancellationToken ct)
     {
         try
@@ -69,6 +76,7 @@ public class DeliveryTaskController(DeliveryTaskService service) : ControllerBas
     }
 
     [HttpPost("delivery-tasks/{id:guid}/fail")]
+    [Authorize("delivery-task.manage")]
     public async Task<IActionResult> Fail(Guid id, FailTaskRequest request, CancellationToken ct)
     {
         try

Distribution/Features/DriverProfile/DriverProfileController.cs

@@ -1,5 +1,6 @@
-using Distribution.Features.DriverComplianceConfig;
+using Distribution.Features.DriverComplianceConfig;
 using Distribution.Infra.Authorization;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 namespace Distribution.Features.DriverProfile;
@@ -12,6 +13,7 @@ public class DriverProfileController(
     ICurrentUserService currentUser) : ControllerBase
 {
     [HttpGet]
+    [Authorize("driver.view")]
     public async Task<IActionResult> GetAll([FromQuery] int page = 1, [FromQuery] int pageSize = 20)
     {
         var result = await service.GetAllAsync(page, pageSize);
@@ -19,6 +21,7 @@ public class DriverProfileController(
     }
 
     [HttpGet("{id:guid}")]
+    [Authorize("driver.view")]
     public async Task<IActionResult> GetById(Guid id)
     {
         var result = await service.GetByIdAsync(id);
@@ -26,6 +29,7 @@ public class DriverProfileController(
     }
 
     [HttpPost]
+    [Authorize("driver.manage")]
     public async Task<IActionResult> Create(CreateDriverProfileRequest request, CancellationToken ct)
     {
         try
@@ -44,6 +48,7 @@ public class DriverProfileController(
     }
 
     [HttpPut("{id:guid}")]
+    [Authorize("driver.manage")]
     public async Task<IActionResult> Update(Guid id, UpdateDriverProfileRequest request, CancellationToken ct)
     {
         var result = await service.UpdateAsync(id, request, ct);
@@ -51,6 +56,7 @@ public class DriverProfileController(
     }
 
     [HttpDelete("{id:guid}")]
+    [Authorize("driver.manage")]
     public async Task<IActionResult> Deactivate(Guid id, CancellationToken ct)
     {
         var success = await service.DeactivateAsync(id, ct);
@@ -58,6 +64,7 @@ public class DriverProfileController(
     }
 
     [HttpGet("compliance")]
+    [Authorize("driver.view")]
     public async Task<IActionResult> GetCompliance()
     {
         var result = await complianceService.GetAsync();
@@ -65,6 +72,7 @@ public class DriverProfileController(
     }
 
     [HttpPut("compliance")]
+    [Authorize("driver.manage")]
     public async Task<IActionResult> UpsertCompliance(UpdateDriverComplianceConfigRequest request, CancellationToken ct)
     {
         var userId = currentUser.UserId ?? throw new UnauthorizedAccessException();

Distribution/Features/Grn/GrnController.cs

@@ -1,4 +1,5 @@
-using Distribution.Infra.Authorization;
+using Distribution.Infra.Authorization;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 namespace Distribution.Features.Grn;
@@ -7,6 +8,7 @@ namespace Distribution.Features.Grn;
 public class GrnController(GrnService service, ICurrentUserService currentUser) : ControllerBase
 {
     [HttpGet("api/goods-receipts")]
+    [Authorize("grn.view")]
     public async Task<IActionResult> GetAll(
         [FromQuery] Guid? purchaseOrderId,
         [FromQuery] int page = 1,
@@ -17,6 +19,7 @@ public class GrnController(GrnService service, ICurrentUserService currentUser)
     }
 
     [HttpGet("api/goods-receipts/{id:guid}")]
+    [Authorize("grn.view")]
     public async Task<IActionResult> GetById(Guid id)
     {
         var result = await service.GetByIdAsync(id);
@@ -24,6 +27,7 @@ public class GrnController(GrnService service, ICurrentUserService currentUser)
     }
 
     [HttpPost("api/goods-receipts")]
+    [Authorize("grn.manage")]
     public async Task<IActionResult> CreateFlat(CreateFlatGrnRequest request, CancellationToken ct)
     {
         // TEMPORARY: currentUser.UserId is always unset due to the broken auth middleware
@@ -42,6 +46,7 @@ public class GrnController(GrnService service, ICurrentUserService currentUser)
 
     /// <summary>Goods received without a purchase order.</summary>
     [HttpPost("api/goods-receipts/direct")]
+    [Authorize("grn.manage")]
     public async Task<IActionResult> CreateDirect(CreateDirectGrnRequest request, CancellationToken ct)
     {
         var userId = currentUser.UserId ?? request.ReceivedByUserId;
@@ -55,10 +60,12 @@ public class GrnController(GrnService service, ICurrentUserService currentUser)
     }
 
     [HttpGet("api/purchase-orders/{id:guid}/goods-receipts")]
+    [Authorize("grn.view")]
     public async Task<IActionResult> GetByPurchaseOrder(Guid id) =>
         Ok(await service.GetByPurchaseOrderIdAsync(id));
 
     [HttpPost("api/purchase-orders/{id:guid}/goods-receipts")]
+    [Authorize("grn.manage")]
     public async Task<IActionResult> Create(Guid id, CreateGrnRequest request, CancellationToken ct)
     {
         var userId = currentUser.UserId ?? request.ReceivedByUserId;

Distribution/Features/LoadingEvent/LoadingSheetController.cs

@@ -1,14 +1,19 @@
-using Distribution.Models;
 using Distribution.Infra.Authorization;
+using Distribution.Models;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 namespace Distribution.Features.LoadingEvent;
 
 [ApiController]
 [Route("api/loading-sheets")]
-public class LoadingSheetController(LoadingSheetService service, ICurrentUserService currentUser) : ControllerBase
+public class LoadingSheetController(
+    LoadingSheetService service,
+    IScopeAccessService scopeAccess,
+    ICurrentUserService currentUser) : ControllerBase
 {
     [HttpGet]
+    //[Authorize("loading-sheet.view")]
     public async Task<IActionResult> GetAll(
         [FromQuery] Guid? rideId,
         [FromQuery] LoadingSheetStatus? status,
@@ -17,11 +22,26 @@ public class LoadingSheetController(LoadingSheetService service, ICurrentUserSer
         [FromQuery] int page = 1,
         [FromQuery] int pageSize = 20)
     {
+        if (routeId.HasValue)
+        {
+            var userId = currentUser.UserId;
+            if (userId.HasValue && !await scopeAccess.HasRouteScopeAsync(userId.Value, routeId.Value))
+                return StatusCode(403);
+        }
+
+        if (regionId.HasValue)
+        {
+            var userId = currentUser.UserId;
+            if (userId.HasValue && !await scopeAccess.HasRegionScopeAsync(userId.Value, regionId.Value))
+                return StatusCode(403);
+        }
+
         var result = await service.GetAllAsync(rideId, status, routeId, regionId, page, pageSize);
         return Ok(result);
     }
 
     [HttpGet("{id:guid}")]
+    [Authorize("loading-sheet.view")]
     public async Task<IActionResult> GetById(Guid id)
     {
         var result = await service.GetByIdAsync(id);
@@ -29,6 +49,7 @@ public class LoadingSheetController(LoadingSheetService service, ICurrentUserSer
     }
 
     [HttpPost]
+    [Authorize("loading-sheet.manage")]
     public async Task<IActionResult> Create(CreateLoadingSheetRequest request, CancellationToken ct)
     {
         // TEMPORARY: currentUser.UserId is always unset due to the broken auth middleware
@@ -45,6 +66,7 @@ public class LoadingSheetController(LoadingSheetService service, ICurrentUserSer
     }
 
     [HttpPut("{id:guid}/items")]
+    [Authorize("loading-sheet.manage")]
     public async Task<IActionResult> SetItems(Guid id, SetItemsRequest request, CancellationToken ct)
     {
         try
@@ -57,6 +79,7 @@ public class LoadingSheetController(LoadingSheetService service, ICurrentUserSer
     }
 
     [HttpPost("{id:guid}/confirm")]
+    [Authorize("loading-sheet.manage")]
     public async Task<IActionResult> Confirm(Guid id, ConfirmLoadingSheetRequest request, CancellationToken ct)
     {
         // TEMPORARY: currentUser.UserId is always unset due to the broken auth middleware

Distribution/Features/PriceList/PriceListController.cs

@@ -1,16 +1,31 @@
-using Microsoft.AspNetCore.Mvc;
+using Distribution.Infra.Authorization;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
 
 namespace Distribution.Features.PriceList;
 
 [ApiController]
 [Route("api/price-lists")]
-public class PriceListController(PriceListService service) : ControllerBase
+public class PriceListController(
+    PriceListService service,
+    IScopeAccessService scopeAccess,
+    ICurrentUserService currentUser) : ControllerBase
 {
     [HttpGet]
-    public async Task<IActionResult> GetAll([FromQuery] Guid? regionId) =>
-        Ok(await service.GetAllAsync(regionId));
+    [Authorize("price-list.view")]
+    public async Task<IActionResult> GetAll([FromQuery] Guid? regionId)
+    {
+        if (regionId.HasValue)
+        {
+            var userId = currentUser.UserId;
+            if (userId.HasValue && !await scopeAccess.HasRegionScopeAsync(userId.Value, regionId.Value))
+                return StatusCode(403);
+        }
+        return Ok(await service.GetAllAsync(regionId));
+    }
 
     [HttpGet("resolve")]
+    [Authorize("price-list.view")]
     public async Task<IActionResult> Resolve([FromQuery] Guid itemId, [FromQuery] Guid storeId, [FromQuery] DateTime saleDate)
     {
         var result = await service.ResolveByStoreAsync(itemId, storeId, saleDate);
@@ -18,6 +33,7 @@ public class PriceListController(PriceListService service) : ControllerBase
     }
 
     [HttpGet("{id:guid}")]
+    [Authorize("price-list.view")]
     public async Task<IActionResult> GetById(Guid id)
     {
         var result = await service.GetByIdAsync(id);
@@ -25,6 +41,7 @@ public class PriceListController(PriceListService service) : ControllerBase
     }
 
     [HttpPost]
+    [Authorize("price-list.manage")]
     public async Task<IActionResult> Create(CreatePriceListRequest request, CancellationToken ct)
     {
         var result = await service.CreateAsync(request, ct);
@@ -32,6 +49,7 @@ public class PriceListController(PriceListService service) : ControllerBase
     }
 
     [HttpPut("{id:guid}")]
+    [Authorize("price-list.manage")]
     public async Task<IActionResult> Update(Guid id, UpdatePriceListRequest request, CancellationToken ct)
     {
         try
@@ -46,6 +64,7 @@ public class PriceListController(PriceListService service) : ControllerBase
     }
 
     [HttpDelete("{id:guid}")]
+    [Authorize("price-list.manage")]
     public async Task<IActionResult> Delete(Guid id, CancellationToken ct)
     {
         var deleted = await service.DeleteAsync(id, ct);
@@ -53,6 +72,7 @@ public class PriceListController(PriceListService service) : ControllerBase
     }
 
     [HttpPut("{id:guid}/items/{sku}")]
+    [Authorize("price-list.manage")]
     public async Task<IActionResult> UpsertItem(Guid id, string sku, UpsertPriceListItemRequest request, CancellationToken ct)
     {
         try
@@ -67,6 +87,7 @@ public class PriceListController(PriceListService service) : ControllerBase
     }
 
     [HttpDelete("{id:guid}/items/{sku}")]
+    [Authorize("price-list.manage")]
     public async Task<IActionResult> RemoveItem(Guid id, string sku, CancellationToken ct)
     {
         try

Distribution/Features/PurchaseOrder/PoController.cs

@@ -1,5 +1,6 @@
-using Distribution.Infra.Authorization;
+using Distribution.Infra.Authorization;
 using Distribution.Models;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 namespace Distribution.Features.Po;
@@ -9,10 +10,12 @@ namespace Distribution.Features.Po;
 public class PoController(PoService service, ICurrentUserService currentUser) : ControllerBase
 {
     [HttpGet]
+    [Authorize("purchase-order.view")]
     public async Task<IActionResult> GetAll([FromQuery] Guid? supplierId, [FromQuery] PurchaseOrderStatus? status) =>
         Ok(await service.GetAllAsync(supplierId, status));
 
     [HttpGet("{id:guid}")]
+    [Authorize("purchase-order.view")]
     public async Task<IActionResult> GetById(Guid id)
     {
         var result = await service.GetByIdAsync(id);
@@ -20,6 +23,7 @@ public class PoController(PoService service, ICurrentUserService currentUser) :
     }
 
     [HttpPost]
+    [Authorize("purchase-order.manage")]
     public async Task<IActionResult> Create(CreatePoRequest request, CancellationToken ct)
     {
         // TEMPORARY: currentUser.UserId is always unset due to the broken auth middleware
@@ -35,6 +39,7 @@ public class PoController(PoService service, ICurrentUserService currentUser) :
     }
 
     [HttpPut("{id:guid}")]
+    [Authorize("purchase-order.manage")]
     public async Task<IActionResult> Update(Guid id, UpdatePoRequest request, CancellationToken ct)
     {
         try
@@ -46,6 +51,7 @@ public class PoController(PoService service, ICurrentUserService currentUser) :
     }
 
     [HttpPost("{id:guid}/close")]
+    [Authorize("purchase-order.manage")]
     public async Task<IActionResult> Close(Guid id, CancellationToken ct)
     {
         try
@@ -57,6 +63,7 @@ public class PoController(PoService service, ICurrentUserService currentUser) :
     }
 
     [HttpPost("{id:guid}/cancel")]
+    [Authorize("purchase-order.manage")]
     public async Task<IActionResult> Cancel(Guid id, CancelPoRequest request, CancellationToken ct)
     {
         try
@@ -68,6 +75,7 @@ public class PoController(PoService service, ICurrentUserService currentUser) :
     }
 
     [HttpPost("{id:guid}/items/{itemId:guid}/cancel")]
+    [Authorize("purchase-order.manage")]
     public async Task<IActionResult> CancelLine(Guid id, Guid itemId, CancelPoLineRequest request, CancellationToken ct)
     {
         try
@@ -79,6 +87,7 @@ public class PoController(PoService service, ICurrentUserService currentUser) :
     }
 
     [HttpPost("{id:guid}/match-invoice")]
+    [Authorize("purchase-order.view")]
     public async Task<IActionResult> MatchInvoice(Guid id, [FromQuery] Guid? invoiceId, [FromQuery] Guid? grnId)
     {
         var result = await service.MatchInvoiceToPoAsync(id, invoiceId, grnId);
@@ -86,6 +95,7 @@ public class PoController(PoService service, ICurrentUserService currentUser) :
     }
 
     [HttpPost("{id:guid}/resolve-variance")]
+    [Authorize("purchase-order.manage")]
     public async Task<IActionResult> ResolveVariance(Guid id, ResolveInvoiceVarianceRequest request, CancellationToken ct)
     {
         try

Distribution/Features/PurchaseReturn/PurchaseReturnController.cs

@@ -1,4 +1,5 @@
-using Distribution.Infra.Authorization;
+using Distribution.Infra.Authorization;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 namespace Distribution.Features.PurchaseReturn;
@@ -7,6 +8,7 @@ namespace Distribution.Features.PurchaseReturn;
 public class PurchaseReturnController(PurchaseReturnService service, ICurrentUserService currentUser) : ControllerBase
 {
     [HttpGet("api/purchase-returns/{id:guid}")]
+    [Authorize("purchase-order.view")]
     public async Task<IActionResult> GetById(Guid id)
     {
         var result = await service.GetByIdAsync(id);
@@ -14,10 +16,12 @@ public class PurchaseReturnController(PurchaseReturnService service, ICurrentUse
     }
 
     [HttpGet("api/purchase-orders/{id:guid}/returns")]
+    [Authorize("purchase-order.view")]
     public async Task<IActionResult> GetByPurchaseOrder(Guid id) =>
         Ok(await service.GetByPurchaseOrderIdAsync(id));
 
     [HttpPost("api/purchase-orders/{id:guid}/returns")]
+    [Authorize("purchase-return.manage")]
     public async Task<IActionResult> Create(Guid id, CreatePurchaseReturnRequest request, CancellationToken ct)
     {
         // TEMPORARY: currentUser.UserId is always unset due to the broken auth middleware

Distribution/Features/Region/RegionController.cs

@@ -1,28 +1,39 @@
-using Microsoft.AspNetCore.Mvc;
+using Distribution.Infra.Authorization;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
 
 namespace Distribution.Features.Region;
 
 [ApiController]
 [Route("api/regions")]
-public class RegionController(RegionService service) : ControllerBase
+public class RegionController(
+    RegionService service,
+    IScopeAccessService scopeAccess,
+    ICurrentUserService currentUser) : ControllerBase
 {
     [HttpGet]
+    [Authorize("region.view")]
     public async Task<IActionResult> GetAll() =>
         Ok(await service.GetAllAsync());
 
-    // Suggested code for the Add Region form; the user may override it.
     [HttpGet("next-code")]
+    [Authorize("region.view")]
     public async Task<IActionResult> GetNextCode() =>
         Ok(await service.GetNextCodeAsync());
 
     [HttpGet("{id:guid}")]
+    [Authorize("region.view")]
     public async Task<IActionResult> GetById(Guid id)
     {
+        var userId = currentUser.UserId;
+        if (userId.HasValue && !await scopeAccess.HasRegionScopeAsync(userId.Value, id))
+            return StatusCode(403);
         var result = await service.GetByIdAsync(id);
         return result is null ? NotFound() : Ok(result);
     }
 
     [HttpPost]
+    [Authorize("region.manage")]
     public async Task<IActionResult> Create(CreateRegionRequest request, CancellationToken ct)
     {
         var result = await service.CreateAsync(request, ct);
@@ -30,6 +41,7 @@ public class RegionController(RegionService service) : ControllerBase
     }
 
     [HttpPut("{id:guid}")]
+    [Authorize("region.manage")]
     public async Task<IActionResult> Update(Guid id, UpdateRegionRequest request, CancellationToken ct)
     {
         var result = await service.UpdateAsync(id, request, ct);
@@ -37,6 +49,7 @@ public class RegionController(RegionService service) : ControllerBase
     }
 
     [HttpDelete("{id:guid}")]
+    [Authorize("region.manage")]
     public async Task<IActionResult> Delete(Guid id, CancellationToken ct)
     {
         var deleted = await service.DeleteAsync(id, ct);
@@ -44,6 +57,7 @@ public class RegionController(RegionService service) : ControllerBase
     }
 
     [HttpGet("{id:guid}/manager")]
+    [Authorize("region.view")]
     public async Task<IActionResult> GetManager(Guid id)
     {
         var result = await service.GetManagerAsync(id);
@@ -51,6 +65,7 @@ public class RegionController(RegionService service) : ControllerBase
     }
 
     [HttpPut("{id:guid}/manager")]
+    [Authorize("region.manage")]
     public async Task<IActionResult> SetManager(Guid id, SetRegionManagerRequest request, CancellationToken ct)
     {
         try
@@ -65,14 +80,15 @@ public class RegionController(RegionService service) : ControllerBase
     }
 
     [HttpDelete("{id:guid}/manager")]
+    [Authorize("region.manage")]
     public async Task<IActionResult> RemoveManager(Guid id, CancellationToken ct)
     {
         var removed = await service.RemoveManagerAsync(id, ct);
         return removed ? NoContent() : NotFound();
     }
 
-    //targets/budgets/agencies/tax-rule.
     [HttpPut("{id:guid}/manage")]
+    [Authorize("region.manage")]
     public async Task<IActionResult> Manage(Guid id, ManageRegionRequest request, CancellationToken ct)
     {
         var result = await service.ManageAsync(id, request, ct);
@@ -80,6 +96,7 @@ public class RegionController(RegionService service) : ControllerBase
     }
 
     [HttpGet("{id:guid}/hierarchy")]
+    [Authorize("region.view")]
     public async Task<IActionResult> GetHierarchy(Guid id)
     {
         var result = await service.GetHierarchyAsync(id);
@@ -87,18 +104,20 @@ public class RegionController(RegionService service) : ControllerBase
     }
 
     [HttpGet("{id:guid}/dashboard")]
+    [Authorize("region.view")]
     public async Task<IActionResult> GetDashboard(Guid id, [FromQuery] string period)
     {
         var result = await service.GetDashboardAsync(id, period);
         return result is null ? NotFound() : Ok(result);
     }
 
-    // Flat CRUD-list view over targets/budgets/tax-rules/agency-maps across all regions.
     [HttpGet("manage-entries")]
+    [Authorize("region.view")]
     public async Task<IActionResult> GetManageEntries() =>
         Ok(await service.GetManageEntriesAsync());
 
     [HttpDelete("manage-entries/{entryType}/{id:guid}")]
+    [Authorize("region.manage")]
     public async Task<IActionResult> DeleteManageEntry(RegionManageEntryType entryType, Guid id, CancellationToken ct)
     {
         var deleted = await service.DeleteManageEntryAsync(entryType, id, ct);

Distribution/Features/Returns/ReturnController.cs

@@ -1,4 +1,5 @@
 using Distribution.Infra.Authorization;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 namespace Distribution.Features.Returns;
@@ -7,10 +8,12 @@ namespace Distribution.Features.Returns;
 public class ReturnController(ReturnService service, ICurrentUserService currentUser) : ControllerBase
 {
     [HttpGet("api/returns")]
+    [Authorize("return.view")]
     public async Task<IActionResult> GetAll() =>
         Ok(await service.GetAllAsync());
 
     [HttpGet("api/returns/{id:guid}")]
+    [Authorize("return.view")]
     public async Task<IActionResult> GetById(Guid id)
     {
         var result = await service.GetByIdAsync(id);
@@ -18,6 +21,7 @@ public class ReturnController(ReturnService service, ICurrentUserService current
     }
 
     [HttpPatch("api/returns/{id:guid}/reasons")]
+    [Authorize("return.manage")]
     public async Task<IActionResult> UpdateReasons(Guid id, UpdateSaleReturnReasonsRequest request, CancellationToken ct)
     {
         try
@@ -29,10 +33,12 @@ public class ReturnController(ReturnService service, ICurrentUserService current
     }
 
     [HttpGet("api/shop-pos/{id:guid}/returns")]
+    [Authorize("return.view")]
     public async Task<IActionResult> GetByShopPO(Guid id) =>
         Ok(await service.GetByShopPOIdAsync(id));
 
     [HttpPost("api/shop-pos/{id:guid}/returns")]
+    [Authorize("return.manage")]
     public async Task<IActionResult> Create(Guid id, CreateSaleReturnRequest request, CancellationToken ct)
     {
         var userId = currentUser.UserId ?? request.CreatedByUserId;

Distribution/Features/Role/IRoleRepository.cs

@@ -5,4 +5,8 @@ public interface IRoleRepository
     Task<Models.Role?> GetByIdAsync(Guid id);
     Task<List<Models.Role>> GetAllAsync();
     Task<List<Models.RolePermission>> GetPermissionsAsync(Guid roleId);
+    Task AddAsync(Models.Role role);
+    void Update(Models.Role role);
+    void Remove(Models.Role role);
+    Task ReplacePermissionsAsync(Guid roleId, List<Guid> permissionIds);
 }

Distribution/Features/Role/RoleController.cs

@@ -23,4 +23,32 @@ public class RoleController(RoleService service) : ControllerBase
         var result = await service.GetPermissionsAsync(id);
         return result is null ? NotFound() : Ok(result);
     }
+
+    [HttpPost]
+    public async Task<IActionResult> Create(CreateRoleRequest request, CancellationToken ct)
+    {
+        var result = await service.CreateAsync(request, ct);
+        return CreatedAtAction(nameof(GetById), new { id = result.Id }, result);
+    }
+
+    [HttpPut("{id:guid}")]
+    public async Task<IActionResult> Update(Guid id, UpdateRoleRequest request, CancellationToken ct)
+    {
+        var result = await service.UpdateAsync(id, request, ct);
+        return result is null ? NotFound() : Ok(result);
+    }
+
+    [HttpPut("{id:guid}/permissions")]
+    public async Task<IActionResult> AssignPermissions(Guid id, AssignRolePermissionsRequest request, CancellationToken ct)
+    {
+        var result = await service.AssignPermissionsAsync(id, request, ct);
+        return result is null ? NotFound() : Ok(result);
+    }
+
+    [HttpDelete("{id:guid}")]
+    public async Task<IActionResult> Deactivate(Guid id, CancellationToken ct)
+    {
+        var deactivated = await service.DeactivateAsync(id, ct);
+        return deactivated ? NoContent() : NotFound();
+    }
 }

Distribution/Features/Role/RoleDTOs.cs

@@ -1,5 +1,7 @@
 namespace Distribution.Features.Role;
 
 public record RoleResponse(Guid Id, string Name, int Level, bool IsActive, DateTime CreatedAt);
-
 public record RolePermissionResponse(Guid PermissionId, string Code, string Description);
+public record CreateRoleRequest(string Name, int Level);
+public record UpdateRoleRequest(string Name, int Level);
+public record AssignRolePermissionsRequest(List<Guid> PermissionIds);

Distribution/Features/Role/RoleRepository.cs

@@ -1,4 +1,5 @@
 using Distribution.Data;
+using Distribution.Models;
 using Microsoft.EntityFrameworkCore;
 
 namespace Distribution.Features.Role;
@@ -16,4 +17,29 @@ public class RoleRepository(AppDBContext context) : IRoleRepository
             .Include(rp => rp.Permission)
             .Where(rp => rp.FK_RoleId == roleId && rp.IsActive)
             .ToListAsync();
+
+    public async Task AddAsync(Models.Role role) =>
+        await context.Roles.AddAsync(role);
+
+    public void Update(Models.Role role) =>
+        context.Roles.Update(role);
+
+    public void Remove(Models.Role role)
+    {
+        role.IsActive = false;
+        context.Roles.Update(role);
+    }
+
+    public async Task ReplacePermissionsAsync(Guid roleId, List<Guid> permissionIds)
+    {
+        var existing = await context.RolePermissions
+            .Where(rp => rp.FK_RoleId == roleId)
+            .ToListAsync();
+        context.RolePermissions.RemoveRange(existing);
+        context.RolePermissions.AddRange(permissionIds.Select(pid => new RolePermission
+        {
+            FK_RoleId = roleId,
+            FK_PermissionId = pid
+        }));
+    }
 }

Distribution/Features/Role/RoleService.cs

@@ -1,18 +1,23 @@
+using Distribution.Infra.UoW;
+
 namespace Distribution.Features.Role;
 
-public class RoleService(IRoleRepository repo)
+public class RoleService(IRoleRepository repo, IUnitOfWork uow)
 {
+    private static RoleResponse ToResponse(Models.Role r) =>
+        new(r.Id, r.Name, r.Level, r.IsActive, r.CreatedAt);
+
     public async Task<List<RoleResponse>> GetAllAsync() =>
         (await repo.GetAllAsync())
             .Where(r => r.IsActive)
-            .Select(r => new RoleResponse(r.Id, r.Name, r.Level, r.IsActive, r.CreatedAt))
+            .Select(ToResponse)
             .ToList();
 
     public async Task<RoleResponse?> GetByIdAsync(Guid id)
     {
         var role = await repo.GetByIdAsync(id);
         if (role is null || !role.IsActive) return null;
-        return new RoleResponse(role.Id, role.Name, role.Level, role.IsActive, role.CreatedAt);
+        return ToResponse(role);
     }
 
     public async Task<List<RolePermissionResponse>?> GetPermissionsAsync(Guid roleId)
@@ -23,4 +28,77 @@ public class RoleService(IRoleRepository repo)
             .Select(rp => new RolePermissionResponse(rp.FK_PermissionId, rp.Permission.Code, rp.Permission.Description))
             .ToList();
     }
+
+    public async Task<RoleResponse> CreateAsync(CreateRoleRequest request, CancellationToken ct = default)
+    {
+        var role = new Models.Role { Name = request.Name, Level = request.Level };
+        await uow.BeginAsync(ct);
+        try
+        {
+            await repo.AddAsync(role);
+            await uow.CommitAsync(ct);
+        }
+        catch
+        {
+            await uow.RollbackAsync(ct);
+            throw;
+        }
+        return ToResponse(role);
+    }
+
+    public async Task<RoleResponse?> UpdateAsync(Guid id, UpdateRoleRequest request, CancellationToken ct = default)
+    {
+        var role = await repo.GetByIdAsync(id);
+        if (role is null || !role.IsActive) return null;
+        role.Name = request.Name;
+        role.Level = request.Level;
+        await uow.BeginAsync(ct);
+        try
+        {
+            repo.Update(role);
+            await uow.CommitAsync(ct);
+        }
+        catch
+        {
+            await uow.RollbackAsync(ct);
+            throw;
+        }
+        return ToResponse(role);
+    }
+
+    public async Task<bool> DeactivateAsync(Guid id, CancellationToken ct = default)
+    {
+        var role = await repo.GetByIdAsync(id);
+        if (role is null || !role.IsActive) return false;
+        await uow.BeginAsync(ct);
+        try
+        {
+            repo.Remove(role);
+            await uow.CommitAsync(ct);
+        }
+        catch
+        {
+            await uow.RollbackAsync(ct);
+            throw;
+        }
+        return true;
+    }
+
+    public async Task<List<RolePermissionResponse>?> AssignPermissionsAsync(Guid id, AssignRolePermissionsRequest request, CancellationToken ct = default)
+    {
+        var role = await repo.GetByIdAsync(id);
+        if (role is null || !role.IsActive) return null;
+        await uow.BeginAsync(ct);
+        try
+        {
+            await repo.ReplacePermissionsAsync(id, request.PermissionIds);
+            await uow.CommitAsync(ct);
+        }
+        catch
+        {
+            await uow.RollbackAsync(ct);
+            throw;
+        }
+        return await GetPermissionsAsync(id);
+    }
 }

Distribution/Features/Route/RouteController.cs

@@ -1,23 +1,34 @@
-using Microsoft.AspNetCore.Mvc;
+using Distribution.Infra.Authorization;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
 
 namespace Distribution.Features.Route;
 
 [ApiController]
 [Route("api/routes")]
-public class RouteController(RouteService service) : ControllerBase
+public class RouteController(
+    RouteService service,
+    IScopeAccessService scopeAccess,
+    ICurrentUserService currentUser) : ControllerBase
 {
     [HttpGet]
+    [Authorize("route.view")]
     public async Task<IActionResult> GetAll() =>
         Ok(await service.GetAllAsync());
 
     [HttpGet("{id:guid}")]
+    [Authorize("route.view")]
     public async Task<IActionResult> GetById(Guid id)
     {
+        var userId = currentUser.UserId;
+        if (userId.HasValue && !await scopeAccess.HasRouteScopeAsync(userId.Value, id))
+            return StatusCode(403);
         var result = await service.GetByIdAsync(id);
         return result is null ? NotFound() : Ok(result);
     }
 
     [HttpPost]
+    [Authorize("route.manage")]
     public async Task<IActionResult> Create(CreateRouteRequest request, CancellationToken ct)
     {
         var result = await service.CreateAsync(request, ct);
@@ -25,6 +36,7 @@ public class RouteController(RouteService service) : ControllerBase
     }
 
     [HttpPut("{id:guid}")]
+    [Authorize("route.manage")]
     public async Task<IActionResult> Update(Guid id, UpdateRouteRequest request, CancellationToken ct)
     {
         var result = await service.UpdateAsync(id, request, ct);
@@ -32,6 +44,7 @@ public class RouteController(RouteService service) : ControllerBase
     }
 
     [HttpPut("{id:guid}/region")]
+    [Authorize("route.manage")]
     public async Task<IActionResult> AssignToRegion(Guid id, AssignRouteToRegionRequest request, CancellationToken ct)
     {
         var result = await service.AssignToRegionAsync(id, request, ct);
@@ -39,6 +52,7 @@ public class RouteController(RouteService service) : ControllerBase
     }
 
     [HttpDelete("{id:guid}")]
+    [Authorize("route.manage")]
     public async Task<IActionResult> Delete(Guid id, CancellationToken ct)
     {
         var deleted = await service.DeleteAsync(id, ct);
@@ -46,6 +60,7 @@ public class RouteController(RouteService service) : ControllerBase
     }
 
     [HttpPost("{id:guid}/stores")]
+    [Authorize("route.manage")]
     public async Task<IActionResult> AssignStores(Guid id, AssignStoresToRouteRequest request, CancellationToken ct)
     {
         var result = await service.AssignStoresToRouteAsync(id, request, ct);
@@ -53,6 +68,7 @@ public class RouteController(RouteService service) : ControllerBase
     }
 
     [HttpPut("{id:guid}/owner")]
+    [Authorize("route.manage")]
     public async Task<IActionResult> AssignOwner(Guid id, AssignRouteOwnerRequest request, CancellationToken ct)
     {
         var result = await service.AssignOwnerAsync(id, request, ct);
@@ -60,10 +76,12 @@ public class RouteController(RouteService service) : ControllerBase
     }
 
     [HttpPost("{id:guid}/optimize")]
+    [Authorize("route.manage")]
     public IActionResult OptimizeSequence(Guid id) =>
         StatusCode(StatusCodes.Status501NotImplemented);
 
     [HttpPost("{id:guid}/visits/check-in")]
+    [Authorize("route.manage")]
     public async Task<IActionResult> CheckIn(Guid id, RecordCheckInRequest request, CancellationToken ct)
     {
         try
@@ -75,6 +93,7 @@ public class RouteController(RouteService service) : ControllerBase
     }
 
     [HttpPost("{id:guid}/visits/check-out")]
+    [Authorize("route.manage")]
     public async Task<IActionResult> CheckOut(Guid id, RecordCheckOutRequest request, CancellationToken ct)
     {
         var result = await service.RecordCheckOutAsync(id, request, ct);

Distribution/Features/Scheme/SchemeController.cs

@@ -1,4 +1,5 @@
-using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
 
 namespace Distribution.Features.Scheme;
 
@@ -7,10 +8,12 @@ namespace Distribution.Features.Scheme;
 public class SchemeController(SchemeService service) : ControllerBase
 {
     [HttpGet]
+    [Authorize("scheme.view")]
     public async Task<IActionResult> GetAll([FromQuery] Guid? regionId) =>
         Ok(await service.GetAllAsync(regionId));
 
     [HttpGet("{id:guid}")]
+    [Authorize("scheme.view")]
     public async Task<IActionResult> GetById(Guid id)
     {
         var result = await service.GetByIdAsync(id);
@@ -18,6 +21,7 @@ public class SchemeController(SchemeService service) : ControllerBase
     }
 
     [HttpPost]
+    [Authorize("scheme.manage")]
     public async Task<IActionResult> Create(CreateSchemeRequest request, CancellationToken ct)
     {
         try
@@ -32,6 +36,7 @@ public class SchemeController(SchemeService service) : ControllerBase
     }
 
     [HttpPut("{id:guid}")]
+    [Authorize("scheme.manage")]
     public async Task<IActionResult> Update(Guid id, UpdateSchemeRequest request, CancellationToken ct)
     {
         try
@@ -46,6 +51,7 @@ public class SchemeController(SchemeService service) : ControllerBase
     }
 
     [HttpDelete("{id:guid}")]
+    [Authorize("scheme.manage")]
     public async Task<IActionResult> Delete(Guid id, CancellationToken ct)
     {
         var deleted = await service.DeleteAsync(id, ct);
@@ -53,6 +59,7 @@ public class SchemeController(SchemeService service) : ControllerBase
     }
 
     [HttpPut("{id:guid}/free-goods-rule")]
+    [Authorize("scheme.manage")]
     public async Task<IActionResult> SetFreeGoodsRule(Guid id, SetFreeGoodsRuleRequest request, CancellationToken ct)
     {
         try
@@ -67,6 +74,7 @@ public class SchemeController(SchemeService service) : ControllerBase
     }
 
     [HttpDelete("{id:guid}/free-goods-rule")]
+    [Authorize("scheme.manage")]
     public async Task<IActionResult> ClearFreeGoodsRule(Guid id, CancellationToken ct)
     {
         var result = await service.ClearFreeGoodsRuleAsync(id, ct);
@@ -74,6 +82,7 @@ public class SchemeController(SchemeService service) : ControllerBase
     }
 
     [HttpPut("{id:guid}/bundle-components/{itemId:guid}")]
+    [Authorize("scheme.manage")]
     public async Task<IActionResult> UpsertBundleComponent(Guid id, Guid itemId, UpsertBundleComponentRequest request, CancellationToken ct)
     {
         try
@@ -88,6 +97,7 @@ public class SchemeController(SchemeService service) : ControllerBase
     }
 
     [HttpDelete("{id:guid}/bundle-components/{itemId:guid}")]
+    [Authorize("scheme.manage")]
     public async Task<IActionResult> RemoveBundleComponent(Guid id, Guid itemId, CancellationToken ct)
     {
         var result = await service.RemoveBundleComponentAsync(id, itemId, ct);
@@ -95,6 +105,7 @@ public class SchemeController(SchemeService service) : ControllerBase
     }
 
     [HttpGet("eligible")]
+    [Authorize("scheme.view")]
     public async Task<IActionResult> GetEligible([FromQuery] Guid storeId, [FromQuery] Guid orderId)
     {
         var result = await service.EvaluateEligibilityAsync(storeId, orderId);
@@ -102,6 +113,7 @@ public class SchemeController(SchemeService service) : ControllerBase
     }
 
     [HttpGet("{id:guid}/spend")]
+    [Authorize("scheme.view")]
     public async Task<IActionResult> GetSpend(Guid id)
     {
         var result = await service.GetSpendAsync(id);
@@ -109,6 +121,7 @@ public class SchemeController(SchemeService service) : ControllerBase
     }
 
     [HttpGet("{id:guid}/roi")]
+    [Authorize("scheme.view")]
     public async Task<IActionResult> GetROI(Guid id)
     {
         var result = await service.GetROIAsync(id);
@@ -121,6 +134,7 @@ public class SchemeController(SchemeService service) : ControllerBase
 public class SchemeOrderController(SchemeService service) : ControllerBase
 {
     [HttpPost("{id:guid}/apply-scheme")]
+    [Authorize("scheme.manage")]
     public async Task<IActionResult> ApplyScheme(Guid id, ApplySchemeRequest request, CancellationToken ct)
     {
         try

Distribution/Features/Stock/StockController.cs

@@ -1,5 +1,6 @@
-using Distribution.Infra.Authorization;
+using Distribution.Infra.Authorization;
 using Distribution.Models;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 namespace Distribution.Features.Stock;
@@ -8,9 +9,10 @@ namespace Distribution.Features.Stock;
 [Route("api/stock")]
 public class StockController(StockService service, ICurrentUserService currentUser) : ControllerBase
 {
-    // ── Query ──────────────────────────────────────────────────────────────
+    // ── Query ──────────────────────────────────────────────────────────────────
 
     [HttpGet("balances")]
+    [Authorize("stock.view")]
     public async Task<IActionResult> GetBalances(
         [FromQuery] Guid? locationId,
         [FromQuery] LocationType? locationType,
@@ -23,6 +25,7 @@ public class StockController(StockService service, ICurrentUserService currentUs
     }
 
     [HttpGet("low-stock")]
+    [Authorize("stock.view")]
     public async Task<IActionResult> GetLowStock([FromQuery] Guid? locationId)
     {
         var result = await service.GetLowStockAsync(locationId);
@@ -30,6 +33,7 @@ public class StockController(StockService service, ICurrentUserService currentUs
     }
 
     [HttpGet("balances/{itemId}/total")]
+    [Authorize("stock.view")]
     public async Task<IActionResult> GetItemTotal(Guid itemId)
     {
         var result = await service.GetItemTotalAsync(itemId);
@@ -39,6 +43,7 @@ public class StockController(StockService service, ICurrentUserService currentUs
 
     /// <summary>Next free number for auto-generated serials (e.g. after ...-0005 the answer is 6).</summary>
     [HttpGet("serials/next-sequence")]
+    [Authorize("stock.view")]
     public async Task<IActionResult> GetNextSerialSequence([FromQuery] Guid itemId, [FromQuery] string prefix = "")
     {
         var next = await service.GetNextSerialSequenceAsync(itemId, prefix);
@@ -46,6 +51,7 @@ public class StockController(StockService service, ICurrentUserService currentUs
     }
 
     [HttpGet("movements")]
+    //[Authorize("stock.view")]
     public async Task<IActionResult> GetMovements(
         [FromQuery] Guid? locationId,
         [FromQuery] Guid? itemId,
@@ -59,9 +65,10 @@ public class StockController(StockService service, ICurrentUserService currentUs
         return Ok(result);
     }
 
-    // ── Write ──────────────────────────────────────────────────────────────
+    // ── Write ──────────────────────────────────────────────────────────────────
 
     [HttpPost("transfer")]
+    [Authorize("stock.manage")]
     public async Task<IActionResult> Transfer(TransferRequest request, CancellationToken ct)
     {
         if (currentUser.UserId is null) return Unauthorized();
@@ -74,6 +81,7 @@ public class StockController(StockService service, ICurrentUserService currentUs
     }
 
     [HttpPost("damage")]
+    [Authorize("stock.manage")]
     public async Task<IActionResult> RecordDamage(DamageRequest request, CancellationToken ct)
     {
         if (currentUser.UserId is null) return Unauthorized();
@@ -86,6 +94,7 @@ public class StockController(StockService service, ICurrentUserService currentUs
     }
 
     [HttpPost("customer-return")]
+    [Authorize("stock.manage")]
     public async Task<IActionResult> RecordCustomerReturn(CustomerReturnRequest request, CancellationToken ct)
     {
         if (currentUser.UserId is null) return Unauthorized();
@@ -98,6 +107,7 @@ public class StockController(StockService service, ICurrentUserService currentUs
     }
 
     [HttpPost("adjustment")]
+    [Authorize("stock.manage")]
     public async Task<IActionResult> Adjust(AdjustmentRequest request, CancellationToken ct)
     {
         // TEMPORARY: currentUser.UserId is always unset due to the broken auth middleware
@@ -113,6 +123,7 @@ public class StockController(StockService service, ICurrentUserService currentUs
     }
 
     [HttpPatch("movements/{id}/reason")]
+    [Authorize("stock.manage")]
     public async Task<IActionResult> UpdateMovementReason(Guid id, UpdateMovementReasonRequest request, CancellationToken ct)
     {
         try

Distribution/Features/Store/StoreController.cs

@@ -1,13 +1,19 @@
-using Distribution.Models;
+using Distribution.Infra.Authorization;
+using Distribution.Models;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 namespace Distribution.Features.Store;
 
 [ApiController]
 [Route("api/stores")]
-public class StoreController(StoreService service) : ControllerBase
+public class StoreController(
+    StoreService service,
+    IScopeAccessService scopeAccess,
+    ICurrentUserService currentUser) : ControllerBase
 {
     [HttpGet]
+    [Authorize("store.view")]
     public async Task<IActionResult> GetAll(
         [FromQuery] Guid? routeId,
         [FromQuery] string? search,
@@ -16,13 +22,18 @@ public class StoreController(StoreService service) : ControllerBase
         Ok(await service.GetAllAsync(routeId, search, page, pageSize));
 
     [HttpGet("{id:guid}")]
+    [Authorize("store.view")]
     public async Task<IActionResult> GetById(Guid id)
     {
+        var userId = currentUser.UserId;
+        if (userId.HasValue && !await scopeAccess.HasStoreScopeAsync(userId.Value, id))
+            return StatusCode(403);
         var result = await service.GetByIdAsync(id);
         return result is null ? NotFound() : Ok(result);
     }
 
     [HttpPost]
+    [Authorize("store.manage")]
     public async Task<IActionResult> Create(CreateStoreRequest request, CancellationToken ct)
     {
         var result = await service.CreateAsync(request, ct);
@@ -30,6 +41,7 @@ public class StoreController(StoreService service) : ControllerBase
     }
 
     [HttpPut("{id:guid}")]
+    [Authorize("store.manage")]
     public async Task<IActionResult> Update(Guid id, UpdateStoreRequest request, CancellationToken ct)
     {
         var result = await service.UpdateAsync(id, request, ct);
@@ -37,6 +49,7 @@ public class StoreController(StoreService service) : ControllerBase
     }
 
     [HttpDelete("{id:guid}")]
+    [Authorize("store.manage")]
     public async Task<IActionResult> Delete(Guid id, CancellationToken ct)
     {
         var deleted = await service.DeleteAsync(id, ct);
@@ -44,6 +57,7 @@ public class StoreController(StoreService service) : ControllerBase
     }
 
     [HttpPut("{id:guid}/credit-limit")]
+    [Authorize("store.manage")]
     public async Task<IActionResult> UpdateCreditLimit(Guid id, UpdateCreditLimitRequest request, CancellationToken ct)
     {
         var result = await service.UpdateCreditLimitAsync(id, request, ct);
@@ -51,6 +65,7 @@ public class StoreController(StoreService service) : ControllerBase
     }
 
     [HttpPut("{id:guid}/outstanding-balance")]
+    [Authorize("store.manage")]
     public async Task<IActionResult> UpdateOutstandingBalance(Guid id, UpdateOutstandingBalanceRequest request, CancellationToken ct)
     {
         var result = await service.UpdateOutstandingBalanceAsync(id, request, ct);
@@ -58,6 +73,7 @@ public class StoreController(StoreService service) : ControllerBase
     }
 
     [HttpGet("{id:guid}/outstanding-balance")]
+    [Authorize("store.view")]
     public async Task<IActionResult> GetOutstandingBalance(Guid id)
     {
         var result = await service.GetOutstandingBalanceAsync(id);
@@ -65,6 +81,7 @@ public class StoreController(StoreService service) : ControllerBase
     }
 
     [HttpPut("{id:guid}/segment")]
+    [Authorize("store.manage")]
     public async Task<IActionResult> ClassifySegment(Guid id, ClassifySegmentRequest request, CancellationToken ct)
     {
         var result = await service.ClassifySegmentAsync(id, request, ct);
@@ -72,6 +89,7 @@ public class StoreController(StoreService service) : ControllerBase
     }
 
     [HttpGet("{id:guid}/visit-history")]
+    [Authorize("store.view")]
     public async Task<IActionResult> GetVisitHistory(Guid id)
     {
         var result = await service.GetVisitHistoryAsync(id);
@@ -79,6 +97,7 @@ public class StoreController(StoreService service) : ControllerBase
     }
 
     [HttpGet("{id:guid}/schemes/{schemeId:guid}/eligibility")]
+    [Authorize("store.view")]
     public async Task<IActionResult> CheckSchemeEligibility(Guid id, Guid schemeId)
     {
         var result = await service.CheckSchemeEligibilityAsync(id, schemeId);
@@ -86,6 +105,7 @@ public class StoreController(StoreService service) : ControllerBase
     }
 
     [HttpGet("{id:guid}/dashboard")]
+    [Authorize("store.view")]
     public async Task<IActionResult> GetDashboard(Guid id, [FromQuery] string period)
     {
         var result = await service.GetDashboardAsync(id, period);
@@ -93,6 +113,7 @@ public class StoreController(StoreService service) : ControllerBase
     }
 
     [HttpPatch("{id:guid}/status")]
+    [Authorize("store.manage")]
     public async Task<IActionResult> PatchStatus(Guid id, PatchStoreStatusRequest request, CancellationToken ct)
     {
         var result = await service.SetActiveStatusAsync(id, request.IsActive, ct);

Distribution/Features/Store/StoreService.cs

@@ -11,7 +11,7 @@ public class StoreService(IStoreRepository repo, IUnitOfWork uow, ICurrentUserSe
     private const int GlobalScopeRoleLevel = 50;
     private const int CreditApproverRoleLevel = 20;
 
-    private bool HasGlobalScope => currentUser.RoleLevel >= GlobalScopeRoleLevel;
+    private async Task<bool> HasGlobalScopeAsync() => await currentUser.GetRoleLevelAsync() >= GlobalScopeRoleLevel;
 
     private async Task<bool> HasStoreScopeAsync(Guid storeId)
     {
@@ -122,7 +122,7 @@ public class StoreService(IStoreRepository repo, IUnitOfWork uow, ICurrentUserSe
 
     public async Task<StoreResponse?> UpdateCreditLimitAsync(Guid id, UpdateCreditLimitRequest request, CancellationToken ct = default)
     {
-        if (currentUser.RoleLevel < CreditApproverRoleLevel) return null;
+        if (await currentUser.GetRoleLevelAsync() < CreditApproverRoleLevel) return null;
         var store = await repo.GetByIdAsync(id);
         if (store is null || !store.IsActive) return null;
         if (!await HasStoreScopeAsync(id)) return null;
@@ -143,7 +143,7 @@ public class StoreService(IStoreRepository repo, IUnitOfWork uow, ICurrentUserSe
 
     public async Task<StoreResponse?> UpdateOutstandingBalanceAsync(Guid id, UpdateOutstandingBalanceRequest request, CancellationToken ct = default)
     {
-        if (currentUser.RoleLevel < CreditApproverRoleLevel) return null;
+        if (await currentUser.GetRoleLevelAsync() < CreditApproverRoleLevel) return null;
         var store = await repo.GetByIdAsync(id);
         if (store is null || !store.IsActive) return null;
         if (!await HasStoreScopeAsync(id)) return null;

Distribution/Features/SupplierClaims/SupplierClaimController.cs

@@ -1,4 +1,5 @@
-using Distribution.Infra.Authorization;
+using Distribution.Infra.Authorization;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 namespace Distribution.Features.SupplierClaims;
@@ -7,10 +8,12 @@ namespace Distribution.Features.SupplierClaims;
 public class SupplierClaimController(SupplierClaimService service, ICurrentUserService currentUser) : ControllerBase
 {
     [HttpGet("api/supplier-claims")]
+    [Authorize("supplier-claim.view")]
     public async Task<IActionResult> GetAll() =>
         Ok(await service.GetAllAsync());
 
     [HttpGet("api/supplier-claims/{id:guid}")]
+    [Authorize("supplier-claim.view")]
     public async Task<IActionResult> GetById(Guid id)
     {
         var result = await service.GetByIdAsync(id);
@@ -18,10 +21,12 @@ public class SupplierClaimController(SupplierClaimService service, ICurrentUserS
     }
 
     [HttpGet("api/purchase-orders/{id:guid}/claims")]
+    [Authorize("supplier-claim.view")]
     public async Task<IActionResult> GetByPurchaseOrder(Guid id) =>
         Ok(await service.GetByPurchaseOrderIdAsync(id));
 
     [HttpPost("api/purchase-orders/{id:guid}/claims")]
+    [Authorize("supplier-claim.manage")]
     public async Task<IActionResult> Create(Guid id, CreateSupplierClaimRequest request, CancellationToken ct)
     {
         // TEMPORARY: currentUser.UserId is always unset due to the broken auth middleware
@@ -37,6 +42,7 @@ public class SupplierClaimController(SupplierClaimService service, ICurrentUserS
     }
 
     [HttpPut("api/supplier-claims/{id:guid}")]
+    [Authorize("supplier-claim.manage")]
     public async Task<IActionResult> Update(Guid id, UpdateSupplierClaimRequest request, CancellationToken ct)
     {
         try
@@ -48,6 +54,7 @@ public class SupplierClaimController(SupplierClaimService service, ICurrentUserS
     }
 
     [HttpPost("api/supplier-claims/{id:guid}/approve")]
+    [Authorize("supplier-claim.manage")]
     public async Task<IActionResult> Approve(Guid id, ApproveSupplierClaimRequest request, CancellationToken ct)
     {
         var userId = currentUser.UserId ?? request.ApprovedByUserId;
@@ -62,6 +69,7 @@ public class SupplierClaimController(SupplierClaimService service, ICurrentUserS
     }
 
     [HttpPost("api/supplier-claims/{id:guid}/reject")]
+    [Authorize("supplier-claim.manage")]
     public async Task<IActionResult> Reject(Guid id, RejectSupplierClaimRequest request, CancellationToken ct)
     {
         var userId = currentUser.UserId ?? request.RejectedByUserId;

Distribution/Features/SysConfig/SysConfigController.cs

@@ -1,5 +1,6 @@
 using Distribution.Infra.Authorization;
 using Distribution.Models;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 namespace Distribution.Features.SysConfig;
@@ -9,11 +10,12 @@ namespace Distribution.Features.SysConfig;
 public class SysConfigController(SysConfigService service, ICurrentUserService currentUser) : ControllerBase
 {
     [HttpGet]
+    [Authorize("sys-config.view")]
     public async Task<IActionResult> GetAll() =>
         Ok(await service.GetAllAsync());
 
-    // Typed shortcut — must be declared before {key} to take precedence
     [HttpGet("invoice-creation-mode")]
+    [Authorize("sys-config.view")]
     public async Task<IActionResult> GetInvoiceCreationMode()
     {
         var mode = await service.GetInvoiceCreationModeAsync();
@@ -21,6 +23,7 @@ public class SysConfigController(SysConfigService service, ICurrentUserService c
     }
 
     [HttpPut("invoice-creation-mode")]
+    [Authorize("sys-config.manage")]
     public async Task<IActionResult> SetInvoiceCreationMode(SetInvoiceCreationModeRequest request, CancellationToken ct)
     {
         var userId = currentUser.UserId ?? throw new UnauthorizedAccessException();
@@ -33,6 +36,7 @@ public class SysConfigController(SysConfigService service, ICurrentUserService c
     }
 
     [HttpGet("{key}")]
+    [Authorize("sys-config.view")]
     public async Task<IActionResult> GetByKey(string key)
     {
         var result = await service.GetByKeyAsync(key);
@@ -40,6 +44,7 @@ public class SysConfigController(SysConfigService service, ICurrentUserService c
     }
 
     [HttpPut("{key}")]
+    [Authorize("sys-config.manage")]
     public async Task<IActionResult> Set(string key, SetSysConfigRequest request, CancellationToken ct)
     {
         var userId = currentUser.UserId ?? request.UserId;

Distribution/Features/User/UserDTOs.cs

@@ -1,7 +1,9 @@
+using System.ComponentModel.DataAnnotations;
+
 namespace Distribution.Features.User;
 
 public record CreateUserRequest(
-    string Username,
+    [EmailAddress] string Username,
     string Password,
     string FullName,
     Guid RoleId,

Distribution/Features/User/UserService.cs

@@ -1,12 +1,10 @@
+using Distribution.Features.Auth;
 using Distribution.Infra.UoW;
-using Microsoft.AspNetCore.Identity;
 
 namespace Distribution.Features.User;
 
-public class UserService(IUserRepository repo, IUnitOfWork uow)
+public class UserService(IUserRepository repo, IUnitOfWork uow, IAuthHexClient authHex)
 {
-    private readonly PasswordHasher<Models.User> _hasher = new();
-
     private static UserResponse ToResponse(Models.User u) =>
         new(u.Id, u.Username, u.FullName, u.FK_RoleId, u.Role?.Name ?? string.Empty,
             u.FK_ReportsToUserId, u.IsActive, u.CreatedAt, u.UpdatedAt);
@@ -33,12 +31,30 @@ public class UserService(IUserRepository repo, IUnitOfWork uow)
             FK_RoleId = request.RoleId,
             FK_ReportsToUserId = request.ReportsToUserId
         };
-        user.PasswordHash = _hasher.HashPassword(user, request.Password);
 
         await uow.BeginAsync(ct);
         try
         {
             await repo.AddAsync(user);
+
+            var authResult = await authHex.CallAsync("registerUser", new
+            {
+                userId = user.Id,
+                userName = request.Username,
+                email = request.Username,
+                fullname = request.FullName,
+                password = request.Password,
+                roleId = request.RoleId,
+                userTypeId = "00000001-0000-0000-0000-200000000000",
+                sendCredentialsEmail = false
+            }, reference: user.Id.ToString(), ct: ct);
+
+            if (!authResult.Success)
+            {
+                await uow.RollbackAsync(ct);
+                throw new InvalidOperationException($"AuthHex registration failed: {authResult.Message}");
+            }
+
             await uow.CommitAsync(ct);
         }
         catch

Distribution/Infra/Authorization/AuthenticatedAttribute.cs

@@ -1,14 +0,0 @@
-using Microsoft.AspNetCore.Mvc;
-using Microsoft.AspNetCore.Mvc.Filters;
-
-namespace Distribution.Infra.Authorization;
-
-[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method)]
-public class AuthenticatedAttribute : Attribute, IAuthorizationFilter
-{
-    public void OnAuthorization(AuthorizationFilterContext context)
-    {
-        if (context.HttpContext.User.Identity?.IsAuthenticated != true)
-            context.Result = new UnauthorizedResult();
-    }
-}

Distribution/Infra/Authorization/AuthorizationController.cs

@@ -1,4 +1,4 @@
-using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc;
 
 namespace Distribution.Infra.Authorization;
 
@@ -17,6 +17,14 @@ public class AuthorizationController(
         return Ok(new PermissionCheckResponse(result));
     }
 
+    [HttpGet("my-permissions")]
+    public async Task<IActionResult> GetMyPermissions()
+    {
+        if (currentUser.RoleId is not { } roleId) return Unauthorized();
+        var permissions = await permissionService.GetRolePermissionsAsync(roleId);
+        return Ok(new RolePermissionsResponse(permissions));
+    }
+
     [HttpGet("scopes/stores/{storeId:guid}")]
     public async Task<IActionResult> CheckStoreScope(Guid storeId)
     {
@@ -49,3 +57,15 @@ public class AuthorizationController(
         return Ok(new AccessibleStoresResponse(result));
     }
 }
+
+[ApiController]
+[Route("api/permissions")]
+public class PermissionController(IPermissionService permissionService) : ControllerBase
+{
+    [HttpGet]
+    public async Task<IActionResult> GetAll()
+    {
+        var permissions = await permissionService.GetAllAsync();
+        return Ok(permissions.Select(p => new { permissionId = p.Id, p.Code, p.Description }));
+    }
+}

Distribution/Infra/Authorization/AuthorizationDTOs.cs

@@ -2,6 +2,8 @@ namespace Distribution.Infra.Authorization;
 
 public record PermissionCheckResponse(bool HasPermission);
 
+public record RolePermissionsResponse(List<string> Permissions);
+
 public record StoreScopeCheckResponse(bool HasScope);
 
 public record RouteScopeCheckResponse(bool HasScope);

Distribution/Infra/Authorization/CurrentUser/CurrentUserService.cs

@@ -1,46 +0,0 @@
-using Microsoft.AspNetCore.Http;
-
-namespace Distribution.Infra.Authorization;
-
-public class CurrentUserService : ICurrentUserService
-{
-    private readonly IHttpContextAccessor _httpContextAccessor;
-
-    public CurrentUserService(IHttpContextAccessor httpContextAccessor)
-    {
-        _httpContextAccessor = httpContextAccessor;
-    }
-
-    private System.Security.Claims.ClaimsPrincipal? User => _httpContextAccessor.HttpContext?.User;
-
-    public bool IsAuthenticated => User?.Identity?.IsAuthenticated ?? false;
-
-    public Guid? UserId
-    {
-        get
-        {
-            var value = User?.FindFirst("sub")?.Value ?? User?.FindFirst(System.Security.Claims.ClaimTypes.NameIdentifier)?.Value;
-            return Guid.TryParse(value, out var id) ? id : null;
-        }
-    }
-
-    public Guid? RoleId
-    {
-        get
-        {
-            var value = User?.FindFirst("role_id")?.Value;
-            return Guid.TryParse(value, out var id) ? id : null;
-        }
-    }
-
-    public string? Username => User?.FindFirst("username")?.Value;
-
-    public int RoleLevel
-    {
-        get
-        {
-            var value = User?.FindFirst("role_level")?.Value;
-            return int.TryParse(value, out var level) ? level : 0;
-        }
-    }
-}

Distribution/Infra/Authorization/CurrentUserService.cs

@@ -0,0 +1,47 @@
+using System.Security.Claims;
+using Distribution.Data;
+using Microsoft.AspNetCore.Http;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Caching.Memory;
+
+namespace Distribution.Infra.Authorization;
+
+public class CurrentUserService(IHttpContextAccessor http, AppDBContext db, IMemoryCache cache) : ICurrentUserService
+{
+    private ClaimsPrincipal? User => http.HttpContext?.User;
+
+    public bool IsAuthenticated => User?.Identity?.IsAuthenticated ?? false;
+    public Guid? UserId => Guid.TryParse(User?.FindFirst("UserId")?.Value, out var id) ? id : null;
+    public Guid? RoleId => Guid.TryParse(User?.FindFirst("RoleId")?.Value, out var id) ? id : null;
+
+    public async Task<string?> GetUsernameAsync()
+    {
+        if (UserId is not { } id) return null;
+        var key = $"user_rolename_{id}";
+        if (cache.TryGetValue(key, out string? cached)) return cached;
+        var user = await db.Users.AsNoTracking().FirstOrDefaultAsync(u => u.Id == id);
+        cache.Set(key, user?.Username, TimeSpan.FromMinutes(10));
+        return user?.Username;
+    }
+
+    public async Task<string?> GetRoleCodeAsync()
+    {
+        if (RoleId is not { } id) return null;
+        var key = $"role_name_{id}";
+        if (cache.TryGetValue(key, out string? cached)) return cached;
+        var role = await db.Roles.AsNoTracking().FirstOrDefaultAsync(r => r.Id == id);
+        cache.Set(key, role?.Name, TimeSpan.FromMinutes(10));
+        return role?.Name;
+    }
+
+    public async Task<int> GetRoleLevelAsync()
+    {
+        if (RoleId is not { } id) return 0;
+        var key = $"role_level_{id}";
+        if (cache.TryGetValue(key, out int cached)) return cached;
+        var role = await db.Roles.AsNoTracking().FirstOrDefaultAsync(r => r.Id == id);
+        var level = role?.Level ?? 0;
+        cache.Set(key, level, TimeSpan.FromMinutes(10));
+        return level;
+    }
+}

Distribution/Infra/Authorization/ICurrentUserService.cs

@@ -4,7 +4,8 @@ public interface ICurrentUserService
 {
     Guid? UserId { get; }
     Guid? RoleId { get; }
-    string? Username { get; }
-    int RoleLevel { get; }
     bool IsAuthenticated { get; }
+    Task<string?> GetUsernameAsync();
+    Task<string?> GetRoleCodeAsync();
+    Task<int> GetRoleLevelAsync();
 }

Distribution/Infra/Authorization/Jwt/RsaXmlKeyReader.cs

@@ -1,32 +0,0 @@
-using System.Security.Cryptography;
-using System.Xml.Linq;
-
-namespace Distribution.Infra.Authorization;
-
-/// <summary>
-/// Parses an XML-format RSA public key (`&lt;RSAKeyValue&gt;...&lt;/RSAKeyValue&gt;`, as issued by
-/// AuthHex) into an <see cref="RSA"/> instance. Written by hand instead of relying on
-/// RSA.FromXmlString, which is Windows-only in .NET (throws PlatformNotSupportedException on
-/// Linux/macOS) — this keeps token validation portable across hosts.
-/// </summary>
-public static class RsaXmlKeyReader
-{
-    public static RSA ReadPublicKey(string xml)
-    {
-        var root = XElement.Parse(xml);
-        var modulus = root.Element("Modulus")?.Value
-            ?? throw new InvalidOperationException("RSA XML key is missing <Modulus>.");
-        var exponent = root.Element("Exponent")?.Value
-            ?? throw new InvalidOperationException("RSA XML key is missing <Exponent>.");
-
-        var parameters = new RSAParameters
-        {
-            Modulus = Convert.FromBase64String(modulus),
-            Exponent = Convert.FromBase64String(exponent)
-        };
-
-        var rsa = RSA.Create();
-        rsa.ImportParameters(parameters);
-        return rsa;
-    }
-}

Distribution/Infra/Authorization/Middleware/ApiResponse.cs

@@ -1,10 +0,0 @@
-namespace Distribution.Infra.Authorization.Middleware;
-
-/// <summary>Stand-in for OSMCore's OMSCore.Common.Models.IOs.ApiResponse&lt;T&gt;, which has no equivalent in this project.</summary>
-public sealed record ApiResponse<T>
-{
-    public int StatusCode { get; init; }
-    public bool Success { get; init; }
-    public string? Message { get; init; }
-    public T? Data { get; init; }
-}

Distribution/Infra/Authorization/Middleware/JwtOptions.cs

@@ -1,13 +0,0 @@
-namespace Distribution.Infra.Authorization.Middleware;
-
-/// <summary>
-/// Ported from OSMCore's System/Authentication/JwtOptions.cs. Binds to the same "Jwt" config
-/// section already used by Program.cs's AddJwtBearer setup (Jwt:PublicKey/Audience/Issuer) — no
-/// new config keys needed.
-/// </summary>
-public sealed record JwtOptions
-{
-    public string PublicKey { get; init; } = string.Empty;
-    public string Audience { get; init; } = string.Empty;
-    public string Issuer { get; init; } = string.Empty;
-}

Distribution/Infra/Authorization/Permission/IPermissionRepository.cs

@@ -1,6 +1,10 @@
+using Distribution.Models;
+
 namespace Distribution.Infra.Authorization;
 
 public interface IPermissionRepository
 {
     Task<bool> HasPermissionAsync(Guid roleId, string permissionCode);
+    Task<List<string>> GetRolePermissionsAsync(Guid roleId);
+    Task<List<Permission>> GetAllAsync();
 }

Distribution/Infra/Authorization/Permission/IPermissionService.cs

@@ -1,6 +1,10 @@
+using Distribution.Models;
+
 namespace Distribution.Infra.Authorization;
 
 public interface IPermissionService
 {
     Task<bool> HasPermissionAsync(Guid roleId, string permissionCode);
+    Task<List<string>> GetRolePermissionsAsync(Guid roleId);
+    Task<List<Permission>> GetAllAsync();
 }

Distribution/Infra/Authorization/Permission/PermissionRepository.cs

@@ -1,4 +1,5 @@
 using Distribution.Data;
+using Distribution.Models;
 using Microsoft.EntityFrameworkCore;
 
 namespace Distribution.Infra.Authorization;
@@ -10,4 +11,15 @@ public class PermissionRepository(AppDBContext context) : IPermissionRepository
             .Where(rp => rp.FK_RoleId == roleId && rp.IsActive)
             .Join(context.Permissions.Where(p => p.IsActive), rp => rp.FK_PermissionId, p => p.Id, (rp, p) => p.Code)
             .AnyAsync(code => code == permissionCode);
+
+    public Task<List<string>> GetRolePermissionsAsync(Guid roleId) =>
+        context.RolePermissions
+            .Where(rp => rp.FK_RoleId == roleId && rp.IsActive)
+            .Select(rp => rp.Permission)
+            .Where(p => p.IsActive)
+            .Select(p => p.Code)
+            .ToListAsync();
+
+    public Task<List<Permission>> GetAllAsync() =>
+        context.Permissions.Where(p => p.IsActive).ToListAsync();
 }

Distribution/Infra/Authorization/Permission/PermissionService.cs

@@ -1,7 +1,15 @@
+using Distribution.Models;
+
 namespace Distribution.Infra.Authorization;
 
 public class PermissionService(IPermissionRepository repo) : IPermissionService
 {
     public Task<bool> HasPermissionAsync(Guid roleId, string permissionCode) =>
         repo.HasPermissionAsync(roleId, permissionCode);
+
+    public Task<List<string>> GetRolePermissionsAsync(Guid roleId) =>
+        repo.GetRolePermissionsAsync(roleId);
+
+    public Task<List<Permission>> GetAllAsync() =>
+        repo.GetAllAsync();
 }

Distribution/Infra/Authorization/PermissionAuthorizationHandler.cs

@@ -1,23 +1,24 @@
-
-//namespace Distribution.Infra.Authorization;
+using Microsoft.AspNetCore.Authorization;
 
-//public class PermissionAuthorizationHandler : AuthorizationHandler<PermissionRequirement>
-//{
-//    private readonly IPermissionService _permissionService;
+namespace Distribution.Infra.Authorization;
 
-//    public PermissionAuthorizationHandler(IPermissionService permissionService)
-//    {
-//        _permissionService = permissionService;
-//    }
+public class PermissionAuthorizationHandler : AuthorizationHandler<PermissionRequirement>
+{
+    private readonly IPermissionService _permissionService;
 
-//    protected override async Task HandleRequirementAsync(
-//        AuthorizationHandlerContext context, PermissionRequirement requirement)
-//    {
-//        var roleIdClaim = context.User.FindFirst("role_id")?.Value;
-//        if (!Guid.TryParse(roleIdClaim, out var roleId))
-//            return;
+    public PermissionAuthorizationHandler(IPermissionService permissionService)
+    {
+        _permissionService = permissionService;
+    }
 
-//        if (await _permissionService.HasPermissionAsync(roleId, requirement.PermissionCode))
-//            context.Succeed(requirement);
-//    }
-//}
+    protected override async Task HandleRequirementAsync(
+        AuthorizationHandlerContext context, PermissionRequirement requirement)
+    {
+        var roleIdClaim = context.User.FindFirst("RoleId")?.Value;
+        if (!Guid.TryParse(roleIdClaim, out var roleId))
+            return;
+
+        if (await _permissionService.HasPermissionAsync(roleId, requirement.PermissionCode))
+            context.Succeed(requirement);
+    }
+}

Distribution/Infra/Authorization/PermissionPolicyProvider.cs

@@ -1,31 +1,32 @@
-//using Microsoft.Extensions.Options;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.Extensions.Options;
 
-//namespace Distribution.Infra.Authorization;
+namespace Distribution.Infra.Authorization;
 
-//public class PermissionPolicyProvider : IAuthorizationPolicyProvider
-//{
-//    private readonly DefaultAuthorizationPolicyProvider _fallback;
+public class PermissionPolicyProvider : IAuthorizationPolicyProvider
+{
+    private readonly DefaultAuthorizationPolicyProvider _fallback;
 
-//    public PermissionPolicyProvider(IOptions<AuthorizationOptions> options)
-//    {
-//        _fallback = new DefaultAuthorizationPolicyProvider(options);
-//    }
+    public PermissionPolicyProvider(IOptions<AuthorizationOptions> options)
+    {
+        _fallback = new DefaultAuthorizationPolicyProvider(options);
+    }
 
-//    public Task<AuthorizationPolicy> GetDefaultPolicyAsync() => _fallback.GetDefaultPolicyAsync();
+    public Task<AuthorizationPolicy> GetDefaultPolicyAsync() => _fallback.GetDefaultPolicyAsync();
 
-//    public Task<AuthorizationPolicy?> GetFallbackPolicyAsync() => _fallback.GetFallbackPolicyAsync();
+    public Task<AuthorizationPolicy?> GetFallbackPolicyAsync() => _fallback.GetFallbackPolicyAsync();
 
-//    public Task<AuthorizationPolicy?> GetPolicyAsync(string policyName)
-//    {
-//        if (policyName.Contains('.'))
-//        {
-//            var policy = new AuthorizationPolicyBuilder()
-//                .RequireAuthenticatedUser()
-//                .AddRequirements(new PermissionRequirement(policyName))
-//                .Build();
-//            return Task.FromResult<AuthorizationPolicy?>(policy);
-//        }
+    public Task<AuthorizationPolicy?> GetPolicyAsync(string policyName)
+    {
+        if (policyName.Contains('.'))
+        {
+            var policy = new AuthorizationPolicyBuilder()
+                .RequireAuthenticatedUser()
+                .AddRequirements(new PermissionRequirement(policyName))
+                .Build();
+            return Task.FromResult<AuthorizationPolicy?>(policy);
+        }
 
-//        return _fallback.GetPolicyAsync(policyName);
-//    }
-//}
+        return _fallback.GetPolicyAsync(policyName);
+    }
+}

Distribution/Infra/Authorization/PermissionRequirement.cs

@@ -1,12 +1,13 @@
-
-//namespace Distribution.Infra.Authorization;
+using Microsoft.AspNetCore.Authorization;
 
-//public class PermissionRequirement : IAuthorizationRequirement
-//{
-//    public string PermissionCode { get; }
+namespace Distribution.Infra.Authorization;
 
-//    public PermissionRequirement(string permissionCode)
-//    {
-//        PermissionCode = permissionCode;
-//    }
-//}
+public class PermissionRequirement : IAuthorizationRequirement
+{
+    public string PermissionCode { get; }
+
+    public PermissionRequirement(string permissionCode)
+    {
+        PermissionCode = permissionCode;
+    }
+}

Distribution/Middleware/AuthMiddleware.cs

@@ -1,5 +1,5 @@
 using System.IdentityModel.Tokens.Jwt;
-using System.Text;
+using System.Security.Cryptography;
 using Microsoft.IdentityModel.Tokens;
 
 namespace Distribution.Middleware;
@@ -13,18 +13,24 @@ public class AuthMiddleware(RequestDelegate next, IConfiguration config)
             .Replace("Bearer ", "", StringComparison.OrdinalIgnoreCase)
             .Trim();
 
+        if (string.IsNullOrEmpty(token))
+            token = context.Request.Cookies["access-token"] ?? string.Empty;
+
         if (!string.IsNullOrEmpty(token))
         {
-            var key = config["Jwt:Key"];
-            if (!string.IsNullOrEmpty(key))
+            var publicKeyXml = config["Jwt:PublicKey"];
+            if (!string.IsNullOrEmpty(publicKeyXml))
             {
                 try
                 {
+                    var rsa = RSA.Create();
+                    rsa.FromXmlString(publicKeyXml);
                     var principal = new JwtSecurityTokenHandler().ValidateToken(token,
                         new TokenValidationParameters
                         {
                             ValidateIssuerSigningKey = true,
-                            IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(key)),
+                            IssuerSigningKey = new RsaSecurityKey(rsa),
+                            ValidAlgorithms = [SecurityAlgorithms.RsaSha256],
                             ValidateIssuer = true,
                             ValidIssuer = config["Jwt:Issuer"],
                             ValidateAudience = true,

Distribution/Middleware/BearerResponseHandler.cs

@@ -0,0 +1,31 @@
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.Extensions.Options;
+using System.Text.Encodings.Web;
+
+namespace Distribution.Middleware;
+
+/// <summary>
+/// Authentication handler that exists solely to provide Challenge (401) and Forbid (403)
+/// responses for UseAuthorization(). Token validation is handled upstream by AuthMiddleware,
+/// so HandleAuthenticateAsync returns NoResult to leave HttpContext.User untouched.
+/// </summary>
+public class BearerResponseHandler(
+    IOptionsMonitor<AuthenticationSchemeOptions> options,
+    ILoggerFactory logger,
+    UrlEncoder encoder) : AuthenticationHandler<AuthenticationSchemeOptions>(options, logger, encoder)
+{
+    protected override Task<AuthenticateResult> HandleAuthenticateAsync() =>
+        Task.FromResult(AuthenticateResult.NoResult());
+
+    protected override Task HandleChallengeAsync(AuthenticationProperties properties)
+    {
+        Response.StatusCode = StatusCodes.Status401Unauthorized;
+        return Task.CompletedTask;
+    }
+
+    protected override Task HandleForbiddenAsync(AuthenticationProperties properties)
+    {
+        Response.StatusCode = StatusCodes.Status403Forbidden;
+        return Task.CompletedTask;
+    }
+}

Distribution/Migrations/20261009042242_SeedPermissionsAndRolePermissions.cs

@@ -0,0 +1,22 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace Distribution.Migrations
+{
+    /// <inheritdoc />
+    public partial class SeedPermissionsAndRolePermissions : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+
+        }
+    }
+}

Distribution/Migrations/20261013085624_user.cs

@@ -0,0 +1,29 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace Distribution.Migrations
+{
+    /// <inheritdoc />
+    public partial class user : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.InsertData(
+                table: "Users",
+                columns: new[] { "Id", "CreatedAt", "FK_ReportsToUserId", "FK_RoleId", "FullName", "IsActive", "PasswordHash", "UpdatedAt", "Username" },
+                values: new object[] { new Guid("00000001-0000-0000-0000-000000000001"), new DateTime(2026, 10, 13, 0, 0, 0, 0, DateTimeKind.Unspecified), null, new Guid("10000000-0000-0000-0000-000000000006"), "Super Admin", true, "N/A", null, "superadmin" });
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DeleteData(
+                table: "Users",
+                keyColumn: "Id",
+                keyValue: new Guid("00000001-0000-0000-0000-000000000001"));
+        }
+    }
+}

Distribution/Migrations/20261014080332_seed_permissions_and_superadmin.cs

@@ -0,0 +1,287 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+#pragma warning disable CA1814 // Prefer jagged arrays over multidimensional
+
+namespace Distribution.Migrations
+{
+    /// <inheritdoc />
+    public partial class seed_permissions_and_superadmin : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.InsertData(
+                table: "Permissions",
+                columns: new[] { "Id", "Code", "CreatedAt", "Description", "IsActive" },
+                values: new object[,]
+                {
+                    { new Guid("20000000-0000-0000-0000-000000000001"), "orders.view", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "View shop POs, invoices, payments and returns", true },
+                    { new Guid("20000000-0000-0000-0000-000000000002"), "rides.view", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "View and manage delivery rides and delivery tasks", true },
+                    { new Guid("20000000-0000-0000-0000-000000000003"), "loading.view", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "View and manage loading sheets", true },
+                    { new Guid("20000000-0000-0000-0000-000000000004"), "stores.view", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "View store accounts, credit limits and balances", true },
+                    { new Guid("20000000-0000-0000-0000-000000000005"), "sales_visits.checkin", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "Check in and out of scheduled store visits", true },
+                    { new Guid("20000000-0000-0000-0000-000000000006"), "items.view", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "View and manage catalogue products", true },
+                    { new Guid("20000000-0000-0000-0000-000000000007"), "categories.view", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "View and manage product categories and brands", true },
+                    { new Guid("20000000-0000-0000-0000-000000000008"), "warehouses.view", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "View stock balances, movements, warehouses and reports", true },
+                    { new Guid("20000000-0000-0000-0000-000000000009"), "purchase_orders.view", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "View and manage purchase orders, GRNs and supplier claims", true },
+                    { new Guid("20000000-0000-0000-0000-000000000010"), "pricelists.view", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "View and manage regional price lists", true },
+                    { new Guid("20000000-0000-0000-0000-000000000011"), "schemes.view", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "View and manage pricing schemes and promotions", true },
+                    { new Guid("20000000-0000-0000-0000-000000000012"), "suppliers.view", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "View and manage supplier accounts", true },
+                    { new Guid("20000000-0000-0000-0000-000000000013"), "driver_profiles.view", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "View and manage driver profiles and licensing", true },
+                    { new Guid("20000000-0000-0000-0000-000000000014"), "compliance.manage", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "Manage driver compliance rules", true },
+                    { new Guid("20000000-0000-0000-0000-000000000015"), "users.view", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "View and manage staff user accounts", true },
+                    { new Guid("20000000-0000-0000-0000-000000000016"), "roles.view", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "View and manage roles and their permission sets", true },
+                    { new Guid("20000000-0000-0000-0000-000000000017"), "regions.view", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "View and manage regions and region configuration", true },
+                    { new Guid("20000000-0000-0000-0000-000000000018"), "routes.view", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "View and manage delivery routes", true },
+                    { new Guid("20000000-0000-0000-0000-000000000019"), "vehicles.view", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "View and manage fleet vehicles", true }
+                });
+
+            migrationBuilder.InsertData(
+                table: "Roles",
+                columns: new[] { "Id", "CreatedAt", "IsActive", "Level", "Name" },
+                values: new object[] { new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), true, 100, "SuperAdmin" });
+
+            migrationBuilder.UpdateData(
+                table: "Users",
+                keyColumn: "Id",
+                keyValue: new Guid("00000001-0000-0000-0000-000000000001"),
+                column: "FK_RoleId",
+                value: new Guid("10000000-0000-0000-0000-000000000007"));
+
+            migrationBuilder.InsertData(
+                table: "RolePermissions",
+                columns: new[] { "FK_PermissionId", "FK_RoleId", "CreatedAt", "Id", "IsActive" },
+                values: new object[,]
+                {
+                    { new Guid("20000000-0000-0000-0000-000000000001"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("18023ad9-33e9-4a8c-81ab-dc53a932bdb7"), true },
+                    { new Guid("20000000-0000-0000-0000-000000000002"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("825d5a5f-2c80-4082-8c33-d49aa37feaae"), true },
+                    { new Guid("20000000-0000-0000-0000-000000000003"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("a1e975e8-0444-44f4-99c9-ecb145f5e178"), true },
+                    { new Guid("20000000-0000-0000-0000-000000000004"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("fa741a9c-6ea9-4b44-bc1c-98251e2ce264"), true },
+                    { new Guid("20000000-0000-0000-0000-000000000005"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("fd511b82-6a48-459e-8da8-8db040b8b5a6"), true },
+                    { new Guid("20000000-0000-0000-0000-000000000006"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("92e7a255-974a-47e1-94bd-227f2b40f61f"), true },
+                    { new Guid("20000000-0000-0000-0000-000000000007"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("b82510e3-b3c1-4f41-97f9-e76790f9728c"), true },
+                    { new Guid("20000000-0000-0000-0000-000000000008"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("4b35173b-142c-4387-8991-604d32f6dc27"), true },
+                    { new Guid("20000000-0000-0000-0000-000000000009"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("c41ce69f-e683-4c3f-8e5c-f7b0f06f6496"), true },
+                    { new Guid("20000000-0000-0000-0000-000000000010"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("7aa9f9a1-3c36-4141-97cd-074f47ba6c5a"), true },
+                    { new Guid("20000000-0000-0000-0000-000000000011"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("deb01208-aca1-473f-ae08-1f64f54ddd6c"), true },
+                    { new Guid("20000000-0000-0000-0000-000000000012"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("3c426f42-2433-489b-a85c-7d94ca0290f6"), true },
+                    { new Guid("20000000-0000-0000-0000-000000000013"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("3ed4863f-6683-47e2-b4f4-89f73655c461"), true },
+                    { new Guid("20000000-0000-0000-0000-000000000014"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("f4346c74-c269-4bf1-9626-e7670d8075ef"), true },
+                    { new Guid("20000000-0000-0000-0000-000000000015"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("3ca2691e-ae21-436e-9204-1333a727ffd4"), true },
+                    { new Guid("20000000-0000-0000-0000-000000000016"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("b86df36b-17c4-4d3e-a102-4aa2f2d8e2c3"), true },
+                    { new Guid("20000000-0000-0000-0000-000000000017"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("8c82e198-b505-428b-b1a0-05eb8207bd5d"), true },
+                    { new Guid("20000000-0000-0000-0000-000000000018"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("a3c69976-d0d6-4890-be7e-5e40f1d36506"), true },
+                    { new Guid("20000000-0000-0000-0000-000000000019"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("ba9dc1ed-beea-424b-9db0-30e4825ab011"), true }
+                });
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000001"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000002"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000003"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000004"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000005"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000006"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000007"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000008"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000009"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000010"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000011"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000012"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000013"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000014"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000015"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000016"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000017"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000018"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000019"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000001"));
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000002"));
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000003"));
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000004"));
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000005"));
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000006"));
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000007"));
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000008"));
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000009"));
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000010"));
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000011"));
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000012"));
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000013"));
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000014"));
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000015"));
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000016"));
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000017"));
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000018"));
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000019"));
+
+            migrationBuilder.DeleteData(
+                table: "Roles",
+                keyColumn: "Id",
+                keyValue: new Guid("10000000-0000-0000-0000-000000000007"));
+
+            migrationBuilder.UpdateData(
+                table: "Users",
+                keyColumn: "Id",
+                keyValue: new Guid("00000001-0000-0000-0000-000000000001"),
+                column: "FK_RoleId",
+                value: new Guid("10000000-0000-0000-0000-000000000006"));
+        }
+    }
+}

Distribution/Migrations/20261014081051_useradmin.cs

@@ -0,0 +1,285 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace Distribution.Migrations
+{
+    /// <inheritdoc />
+    public partial class useradmin : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000001"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("7475d3c3-2388-4939-8a09-d7879ffd81c9"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000002"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("e8303485-de75-4541-8616-3dc3d043dead"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000003"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("63baa4e1-e268-4afb-b045-0bbc89b6e559"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000004"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("c75fddcd-7f32-4878-8558-9a70fc752760"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000005"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("4fcfb308-625f-42e0-b54e-ddfb8beaf7a6"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000006"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("09d70c50-aa17-4e21-bbef-8f800c009c38"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000007"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("5201456f-d2d1-47d8-a1be-a74f89d2598e"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000008"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("e4d7f7f9-4149-41af-a79f-d37845dfb30b"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000009"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("e796d680-ac2e-4e8e-aa39-86137067714a"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000010"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("97b043ea-aa01-4c3e-81ee-e9e91f1f9f8a"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000011"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("f04db587-2f88-4e9f-9ccf-4ac650aea07b"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000012"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("372a968b-a962-4a60-afd6-1b69a6a5dd3f"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000013"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("2dd911e7-2217-4dd1-b0aa-18ae5983c6af"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000014"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("03f4ab42-49dc-4aac-912b-a0a14415cf87"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000015"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("d9522f5e-963a-4670-8241-35e65a349970"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000016"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("2f789a49-103e-4ad9-adda-9ab1cd2e86d9"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000017"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("17d668ef-09e7-4886-af6e-63817bf25a1b"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000018"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("8b90d8fa-ca60-4eca-a0ba-02a32d99bf50"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000019"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("17e9237e-b390-4779-ab51-0e872c25c67d"));
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000001"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("18023ad9-33e9-4a8c-81ab-dc53a932bdb7"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000002"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("825d5a5f-2c80-4082-8c33-d49aa37feaae"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000003"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("a1e975e8-0444-44f4-99c9-ecb145f5e178"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000004"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("fa741a9c-6ea9-4b44-bc1c-98251e2ce264"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000005"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("fd511b82-6a48-459e-8da8-8db040b8b5a6"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000006"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("92e7a255-974a-47e1-94bd-227f2b40f61f"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000007"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("b82510e3-b3c1-4f41-97f9-e76790f9728c"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000008"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("4b35173b-142c-4387-8991-604d32f6dc27"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000009"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("c41ce69f-e683-4c3f-8e5c-f7b0f06f6496"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000010"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("7aa9f9a1-3c36-4141-97cd-074f47ba6c5a"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000011"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("deb01208-aca1-473f-ae08-1f64f54ddd6c"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000012"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("3c426f42-2433-489b-a85c-7d94ca0290f6"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000013"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("3ed4863f-6683-47e2-b4f4-89f73655c461"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000014"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("f4346c74-c269-4bf1-9626-e7670d8075ef"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000015"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("3ca2691e-ae21-436e-9204-1333a727ffd4"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000016"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("b86df36b-17c4-4d3e-a102-4aa2f2d8e2c3"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000017"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("8c82e198-b505-428b-b1a0-05eb8207bd5d"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000018"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("a3c69976-d0d6-4890-be7e-5e40f1d36506"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000019"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("ba9dc1ed-beea-424b-9db0-30e4825ab011"));
+        }
+    }
+}

Distribution/Migrations/20261015074722_userpermissions.cs

@@ -0,0 +1,673 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+#pragma warning disable CA1814 // Prefer jagged arrays over multidimensional
+
+namespace Distribution.Migrations
+{
+    /// <inheritdoc />
+    public partial class userpermissions : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.InsertData(
+                table: "Permissions",
+                columns: new[] { "Id", "Code", "CreatedAt", "Description", "IsActive" },
+                values: new object[,]
+                {
+                    { new Guid("20000000-0000-0000-0000-000000000020"), "claim.view", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "View agency claims and settlement status", true },
+                    { new Guid("20000000-0000-0000-0000-000000000021"), "claim.manage", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "Create and settle agency claims", true },
+                    { new Guid("20000000-0000-0000-0000-000000000022"), "delivery-task.view", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "View delivery tasks within a ride", true },
+                    { new Guid("20000000-0000-0000-0000-000000000023"), "delivery-task.manage", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "Confirm and fail delivery tasks", true },
+                    { new Guid("20000000-0000-0000-0000-000000000024"), "driver.view", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "View driver profiles and license details", true },
+                    { new Guid("20000000-0000-0000-0000-000000000025"), "driver.manage", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "Create and update driver profiles", true },
+                    { new Guid("20000000-0000-0000-0000-000000000026"), "grn.view", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "View goods receipt notes", true },
+                    { new Guid("20000000-0000-0000-0000-000000000027"), "grn.manage", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "Create and confirm goods receipts", true },
+                    { new Guid("20000000-0000-0000-0000-000000000028"), "loading-sheet.view", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "View loading sheets and their items", true },
+                    { new Guid("20000000-0000-0000-0000-000000000029"), "loading-sheet.manage", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "Create, edit, and confirm loading sheets", true },
+                    { new Guid("20000000-0000-0000-0000-000000000030"), "price-list.view", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "View regional price lists", true },
+                    { new Guid("20000000-0000-0000-0000-000000000031"), "price-list.manage", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "Create and manage item price lists", true },
+                    { new Guid("20000000-0000-0000-0000-000000000032"), "purchase-order.view", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "View purchase orders and line items", true },
+                    { new Guid("20000000-0000-0000-0000-000000000033"), "purchase-order.manage", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "Create, confirm, and close purchase orders", true },
+                    { new Guid("20000000-0000-0000-0000-000000000034"), "purchase-return.manage", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "Create and manage purchase returns to suppliers", true },
+                    { new Guid("20000000-0000-0000-0000-000000000035"), "region.view", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "View regions and their configuration", true },
+                    { new Guid("20000000-0000-0000-0000-000000000036"), "region.manage", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "Create and update regions, targets, and budgets", true },
+                    { new Guid("20000000-0000-0000-0000-000000000037"), "return.view", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "View order returns", true },
+                    { new Guid("20000000-0000-0000-0000-000000000038"), "return.manage", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "Create and manage order returns", true },
+                    { new Guid("20000000-0000-0000-0000-000000000039"), "route.view", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "View delivery routes", true },
+                    { new Guid("20000000-0000-0000-0000-000000000040"), "route.manage", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "Create and manage delivery routes", true },
+                    { new Guid("20000000-0000-0000-0000-000000000041"), "scheme.view", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "View pricing schemes and promotions", true },
+                    { new Guid("20000000-0000-0000-0000-000000000042"), "scheme.manage", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "Create and configure pricing schemes", true },
+                    { new Guid("20000000-0000-0000-0000-000000000043"), "stock.view", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "View stock balances and movements", true },
+                    { new Guid("20000000-0000-0000-0000-000000000044"), "stock.manage", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "Transfer stock and record damage or adjustments", true },
+                    { new Guid("20000000-0000-0000-0000-000000000045"), "store.view", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "View store accounts and balances", true },
+                    { new Guid("20000000-0000-0000-0000-000000000046"), "store.manage", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "Create and update store accounts", true },
+                    { new Guid("20000000-0000-0000-0000-000000000047"), "supplier-claim.view", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "View supplier claims", true },
+                    { new Guid("20000000-0000-0000-0000-000000000048"), "supplier-claim.manage", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "Create and resolve supplier claims", true },
+                    { new Guid("20000000-0000-0000-0000-000000000049"), "sys-config.view", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "View system configuration settings", true },
+                    { new Guid("20000000-0000-0000-0000-000000000050"), "sys-config.manage", new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), "Update system configuration settings", true }
+                });
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000001"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("e7ab6e43-7142-456e-a7f4-41a98daafbd9"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000002"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("38c173a0-6fb4-475e-8743-643b143cde23"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000003"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("587c3956-3c69-49da-8839-5bee906ac5bd"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000004"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("7e1a8a4d-807b-4b3d-ad76-21ab2b4b5a65"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000005"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("5272f534-dba6-4899-8661-5687fffef070"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000006"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("b3cd2db4-f3c4-44cc-bc94-d3b39f4c4672"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000007"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("f9483ce1-aa1a-409e-a618-d049642f8972"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000008"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("1e82cd6b-7024-4a5e-a987-b7c6f2ff706e"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000009"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("64171cfe-734a-4f02-adc4-20a51cc7526f"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000010"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("fd7bcaf8-2022-4cdb-8964-76d5e98a4cfb"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000011"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("bb8e7d27-eebe-4cd9-91ec-124397e69040"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000012"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("0f85f8d1-40c9-49f7-9bbd-35aead4f4bc8"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000013"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("defa1474-5a40-4def-9759-a3130859584d"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000014"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("02e29292-1019-42de-a4d8-d4f125892d51"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000015"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("172a530b-a9c9-41f7-b523-174d77ff1dd2"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000016"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("8a5a322d-c2b6-428b-8f78-f743cf5abfef"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000017"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("cba0ecc5-2219-437c-8cfc-b989d6274261"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000018"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("aefa2578-8a39-45cd-b054-e86e15199831"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000019"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("a8cd8a2e-3e24-4768-9203-70d2323a535b"));
+
+            migrationBuilder.InsertData(
+                table: "RolePermissions",
+                columns: new[] { "FK_PermissionId", "FK_RoleId", "CreatedAt", "Id", "IsActive" },
+                values: new object[,]
+                {
+                    { new Guid("20000000-0000-0000-0000-000000000020"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("e46f2b96-2913-4536-a427-b67a792cba72"), true },
+                    { new Guid("20000000-0000-0000-0000-000000000021"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("f727a037-c5a2-4745-b426-703b3e73d651"), true },
+                    { new Guid("20000000-0000-0000-0000-000000000022"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("4ef8970e-3f1b-49bd-a30d-289c4584da3b"), true },
+                    { new Guid("20000000-0000-0000-0000-000000000023"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("00531be2-4d6d-492d-8ab8-72d5e94c36f0"), true },
+                    { new Guid("20000000-0000-0000-0000-000000000024"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("5b6a5647-5a28-4326-8802-1d13ecfc94b1"), true },
+                    { new Guid("20000000-0000-0000-0000-000000000025"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("69ec8424-eab4-45a6-a503-941d5738d3f9"), true },
+                    { new Guid("20000000-0000-0000-0000-000000000026"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("f6d80758-8221-41b8-9099-c6bae5611f86"), true },
+                    { new Guid("20000000-0000-0000-0000-000000000027"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("db1dd417-9733-46e0-ab24-b174da6197e9"), true },
+                    { new Guid("20000000-0000-0000-0000-000000000028"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("a04196e8-d113-433f-a672-317f7f0d4faa"), true },
+                    { new Guid("20000000-0000-0000-0000-000000000029"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("2a15a3df-317f-4f0f-abc7-360c8ec97fbb"), true },
+                    { new Guid("20000000-0000-0000-0000-000000000030"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("68b90295-945a-430e-afdc-16bb61ef5d43"), true },
+                    { new Guid("20000000-0000-0000-0000-000000000031"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("7fa5ec71-edb1-4687-a95f-a506a794626a"), true },
+                    { new Guid("20000000-0000-0000-0000-000000000032"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("d3fef7f2-d827-4064-a900-9f872647eb82"), true },
+                    { new Guid("20000000-0000-0000-0000-000000000033"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("88c098e2-d32a-40ff-9832-a08977c6adb0"), true },
+                    { new Guid("20000000-0000-0000-0000-000000000034"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("e77ea9ea-20e5-4689-af38-a21489ffb9fd"), true },
+                    { new Guid("20000000-0000-0000-0000-000000000035"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("47efe028-429d-4213-a86f-62a5c88e9cbf"), true },
+                    { new Guid("20000000-0000-0000-0000-000000000036"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("025cf58c-b01a-4d27-ae0e-395c9b0f7e55"), true },
+                    { new Guid("20000000-0000-0000-0000-000000000037"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("88a3c70e-cc58-4844-ae2c-4670784c2977"), true },
+                    { new Guid("20000000-0000-0000-0000-000000000038"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("63994f0c-edb8-4ac4-9d06-3f433799dd1a"), true },
+                    { new Guid("20000000-0000-0000-0000-000000000039"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("a167986f-164e-4e3b-876e-2113cba53d51"), true },
+                    { new Guid("20000000-0000-0000-0000-000000000040"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("2a470650-ecb2-488d-a3ad-ea4afe51de29"), true },
+                    { new Guid("20000000-0000-0000-0000-000000000041"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("f0882a97-6eed-4800-830e-0ad60df76b56"), true },
+                    { new Guid("20000000-0000-0000-0000-000000000042"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("d5afb82e-2001-4ef7-87b0-b0a510919f6b"), true },
+                    { new Guid("20000000-0000-0000-0000-000000000043"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("79ed7453-80b7-499f-b9fd-41d5aa0c258c"), true },
+                    { new Guid("20000000-0000-0000-0000-000000000044"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("bb0ae3a2-0dfd-41ae-898d-02fbc31636e8"), true },
+                    { new Guid("20000000-0000-0000-0000-000000000045"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("7f176330-117a-4dd2-931f-eb0543818378"), true },
+                    { new Guid("20000000-0000-0000-0000-000000000046"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("0ac9e74e-34ae-48b2-af29-0646c443cc6d"), true },
+                    { new Guid("20000000-0000-0000-0000-000000000047"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("37bda3bc-88df-45e2-9cf5-5014df0df5c0"), true },
+                    { new Guid("20000000-0000-0000-0000-000000000048"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("209149dc-eb8d-4825-9ee1-9aea3d8a8371"), true },
+                    { new Guid("20000000-0000-0000-0000-000000000049"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("961f7973-672b-4837-b16f-d0976ccd3d14"), true },
+                    { new Guid("20000000-0000-0000-0000-000000000050"), new Guid("10000000-0000-0000-0000-000000000007"), new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified), new Guid("d0908026-efc0-4226-95b7-340e03add727"), true }
+                });
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000020"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000021"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000022"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000023"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000024"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000025"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000026"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000027"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000028"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000029"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000030"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000031"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000032"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000033"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000034"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000035"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000036"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000037"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000038"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000039"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000040"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000041"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000042"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000043"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000044"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000045"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000046"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000047"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000048"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000049"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000050"), new Guid("10000000-0000-0000-0000-000000000007") });
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000020"));
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000021"));
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000022"));
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000023"));
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000024"));
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000025"));
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000026"));
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000027"));
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000028"));
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000029"));
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000030"));
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000031"));
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000032"));
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000033"));
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000034"));
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000035"));
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000036"));
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000037"));
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000038"));
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000039"));
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000040"));
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000041"));
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000042"));
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000043"));
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000044"));
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000045"));
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000046"));
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000047"));
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000048"));
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000049"));
+
+            migrationBuilder.DeleteData(
+                table: "Permissions",
+                keyColumn: "Id",
+                keyValue: new Guid("20000000-0000-0000-0000-000000000050"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000001"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("7475d3c3-2388-4939-8a09-d7879ffd81c9"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000002"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("e8303485-de75-4541-8616-3dc3d043dead"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000003"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("63baa4e1-e268-4afb-b045-0bbc89b6e559"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000004"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("c75fddcd-7f32-4878-8558-9a70fc752760"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000005"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("4fcfb308-625f-42e0-b54e-ddfb8beaf7a6"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000006"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("09d70c50-aa17-4e21-bbef-8f800c009c38"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000007"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("5201456f-d2d1-47d8-a1be-a74f89d2598e"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000008"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("e4d7f7f9-4149-41af-a79f-d37845dfb30b"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000009"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("e796d680-ac2e-4e8e-aa39-86137067714a"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000010"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("97b043ea-aa01-4c3e-81ee-e9e91f1f9f8a"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000011"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("f04db587-2f88-4e9f-9ccf-4ac650aea07b"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000012"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("372a968b-a962-4a60-afd6-1b69a6a5dd3f"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000013"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("2dd911e7-2217-4dd1-b0aa-18ae5983c6af"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000014"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("03f4ab42-49dc-4aac-912b-a0a14415cf87"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000015"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("d9522f5e-963a-4670-8241-35e65a349970"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000016"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("2f789a49-103e-4ad9-adda-9ab1cd2e86d9"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000017"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("17d668ef-09e7-4886-af6e-63817bf25a1b"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000018"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("8b90d8fa-ca60-4eca-a0ba-02a32d99bf50"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000019"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("17e9237e-b390-4779-ab51-0e872c25c67d"));
+        }
+    }
+}

Distribution/Migrations/20261015075640_seed_granular_permissions.cs

@@ -0,0 +1,719 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace Distribution.Migrations
+{
+    /// <inheritdoc />
+    public partial class seed_granular_permissions : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000001"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("2933abc2-b472-4870-8af7-a54a3adc4163"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000002"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("d599d707-9645-4aad-8277-b492b2284eca"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000003"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("912132ef-5996-4a7f-acdf-e70a8aebec61"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000004"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("3193b6b5-8656-41a5-88f1-264cda89dc38"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000005"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("33a3bace-319c-4394-a8ca-66f4983e8a65"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000006"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("d67d727b-6bc6-437e-b52a-69bc6a78a009"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000007"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("03c210fa-f841-4262-96a8-d167bcca84de"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000008"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("4949daa6-2136-400a-8b92-a0650ebd433d"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000009"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("abd013d2-5d26-4e08-ab9c-506a8bd8a4fc"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000010"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("f6ea9dbf-42ec-4fdf-b61a-5359f302e3de"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000011"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("1a6d4dfe-32f5-4860-8c0c-3109f6dbdc56"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000012"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("6387f234-eb63-43f1-8b20-1262cc646ef7"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000013"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("bf6e1071-4c1e-45ba-ac90-54935832ab33"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000014"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("2e009c83-d9be-41b1-9cfb-a720671f9531"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000015"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("0a1c09c4-4851-4c03-a728-be2be77425cb"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000016"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("6d5cfd42-9ad3-4c6a-81c1-27c92fa70746"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000017"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("cdd856de-60ba-431a-9c18-59368cf5f325"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000018"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("28ecd453-8762-4614-8c75-321017dc8338"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000019"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("697b6d8b-4d31-4e40-b8f2-46bc4c25e8c0"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000020"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("2648e7f7-34fe-4c86-99eb-f42fb0a92384"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000021"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("5c19d416-b3c5-4b78-b80e-0ebdf2255d2f"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000022"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("e464f639-caa3-4425-867d-60acde28d6c7"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000023"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("2cab1137-c04d-4c18-a1fd-d8124f22e884"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000024"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("08269d0d-a571-472b-be37-ff18235f30ef"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000025"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("1823483d-ddfc-4350-a856-d2b320fc87e9"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000026"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("8c80626e-c979-46b5-8148-2cbec4f501d2"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000027"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("1f67a189-4f7a-4ff1-8041-5c84b85aa6aa"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000028"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("fbac4979-75e8-4042-b5f2-adbbbe79b636"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000029"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("65594d44-edad-4d65-a3b8-a65724ad95ff"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000030"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("b4ad27a0-a8a0-4240-b5ec-ea35741cf19f"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000031"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("870ec304-5917-40c9-8d12-fae978878145"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000032"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("6f6e106a-7b27-46fe-8adb-d21f0ad04062"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000033"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("e32960f9-5a95-4c6f-be9d-85d59643bd62"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000034"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("4fbb45f2-1826-4f4e-8846-a937f04fc9c6"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000035"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("f051c92e-c893-4148-a0c4-987382532c3b"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000036"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("ed96284a-ed40-4521-91c5-6d757efc9ea4"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000037"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("34e8490d-a7ac-4940-bb92-b04c5f2d2a0f"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000038"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("cba2d7cb-7a88-4635-b059-0bb7da52aa5a"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000039"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("4e0efeeb-463b-48d7-835f-4337e5f8db1d"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000040"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("ded75a35-1149-4831-8980-a5552b8aba39"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000041"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("5376fc5a-24df-4a10-ae8d-bf4a7cb41dce"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000042"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("736c95bf-4f53-46e7-b773-ad38ec3ddd8d"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000043"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("a08f24a4-f5c0-426c-a415-42c7823dae7a"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000044"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("1bfece31-2930-4a2f-beef-be08d3bfb95b"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000045"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("b04a9be1-cf18-4c25-9ea7-a71db0973fd1"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000046"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("6973c3f9-6578-4965-ada2-f257f0933c16"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000047"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("7e191e49-0548-4943-8811-d53c3740d6ad"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000048"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("b419616e-ccd8-4872-ba8d-10dc80482a85"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000049"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("c0f12314-72e1-438b-b5f2-0b3aafa8ee40"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000050"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("7357049c-1163-4dbf-afb4-44c77cdff207"));
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000001"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("e7ab6e43-7142-456e-a7f4-41a98daafbd9"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000002"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("38c173a0-6fb4-475e-8743-643b143cde23"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000003"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("587c3956-3c69-49da-8839-5bee906ac5bd"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000004"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("7e1a8a4d-807b-4b3d-ad76-21ab2b4b5a65"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000005"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("5272f534-dba6-4899-8661-5687fffef070"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000006"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("b3cd2db4-f3c4-44cc-bc94-d3b39f4c4672"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000007"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("f9483ce1-aa1a-409e-a618-d049642f8972"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000008"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("1e82cd6b-7024-4a5e-a987-b7c6f2ff706e"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000009"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("64171cfe-734a-4f02-adc4-20a51cc7526f"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000010"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("fd7bcaf8-2022-4cdb-8964-76d5e98a4cfb"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000011"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("bb8e7d27-eebe-4cd9-91ec-124397e69040"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000012"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("0f85f8d1-40c9-49f7-9bbd-35aead4f4bc8"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000013"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("defa1474-5a40-4def-9759-a3130859584d"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000014"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("02e29292-1019-42de-a4d8-d4f125892d51"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000015"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("172a530b-a9c9-41f7-b523-174d77ff1dd2"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000016"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("8a5a322d-c2b6-428b-8f78-f743cf5abfef"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000017"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("cba0ecc5-2219-437c-8cfc-b989d6274261"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000018"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("aefa2578-8a39-45cd-b054-e86e15199831"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000019"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("a8cd8a2e-3e24-4768-9203-70d2323a535b"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000020"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("e46f2b96-2913-4536-a427-b67a792cba72"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000021"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("f727a037-c5a2-4745-b426-703b3e73d651"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000022"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("4ef8970e-3f1b-49bd-a30d-289c4584da3b"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000023"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("00531be2-4d6d-492d-8ab8-72d5e94c36f0"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000024"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("5b6a5647-5a28-4326-8802-1d13ecfc94b1"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000025"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("69ec8424-eab4-45a6-a503-941d5738d3f9"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000026"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("f6d80758-8221-41b8-9099-c6bae5611f86"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000027"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("db1dd417-9733-46e0-ab24-b174da6197e9"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000028"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("a04196e8-d113-433f-a672-317f7f0d4faa"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000029"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("2a15a3df-317f-4f0f-abc7-360c8ec97fbb"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000030"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("68b90295-945a-430e-afdc-16bb61ef5d43"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000031"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("7fa5ec71-edb1-4687-a95f-a506a794626a"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000032"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("d3fef7f2-d827-4064-a900-9f872647eb82"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000033"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("88c098e2-d32a-40ff-9832-a08977c6adb0"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000034"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("e77ea9ea-20e5-4689-af38-a21489ffb9fd"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000035"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("47efe028-429d-4213-a86f-62a5c88e9cbf"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000036"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("025cf58c-b01a-4d27-ae0e-395c9b0f7e55"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000037"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("88a3c70e-cc58-4844-ae2c-4670784c2977"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000038"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("63994f0c-edb8-4ac4-9d06-3f433799dd1a"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000039"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("a167986f-164e-4e3b-876e-2113cba53d51"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000040"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("2a470650-ecb2-488d-a3ad-ea4afe51de29"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000041"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("f0882a97-6eed-4800-830e-0ad60df76b56"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000042"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("d5afb82e-2001-4ef7-87b0-b0a510919f6b"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000043"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("79ed7453-80b7-499f-b9fd-41d5aa0c258c"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000044"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("bb0ae3a2-0dfd-41ae-898d-02fbc31636e8"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000045"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("7f176330-117a-4dd2-931f-eb0543818378"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000046"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("0ac9e74e-34ae-48b2-af29-0646c443cc6d"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000047"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("37bda3bc-88df-45e2-9cf5-5014df0df5c0"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000048"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("209149dc-eb8d-4825-9ee1-9aea3d8a8371"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000049"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("961f7973-672b-4837-b16f-d0976ccd3d14"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000050"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("d0908026-efc0-4226-95b7-340e03add727"));
+        }
+    }
+}

Distribution/Migrations/20261017150452_DropUserPasswordHash.cs

@@ -0,0 +1,786 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace Distribution.Migrations
+{
+    /// <inheritdoc />
+    public partial class DropUserPasswordHash : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "PasswordHash",
+                table: "Users");
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000001"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("acbf0349-4cd7-4948-8d22-9219310c7a07"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000002"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("4b1e0b1a-882e-4ae7-b803-386e1e61acb2"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000003"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("15d15e2a-ab44-43e0-b3bf-ccaa35e3fb91"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000004"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("c2343053-018d-4026-bf14-a135479ab631"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000005"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("a77e8dd8-3092-49f7-bee9-aeaaa767e134"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000006"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("4083847f-a4e8-43fd-92d1-27277a039efe"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000007"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("b5ca40f7-369f-4430-b5e9-765c11bf6c13"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000008"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("1d42928a-bec4-4b3c-b883-a119d783a613"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000009"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("8adf4b1a-b698-458f-8a4d-d959829cc56e"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000010"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("a01bf160-9d5f-4f34-8973-769df6805e45"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000011"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("b4457af3-480c-4955-bc52-14d153491cb1"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000012"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("a7f9799f-7543-4f04-9a1c-a3223798d99a"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000013"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("b44bce8a-2bcf-4a63-a9e8-f27d0f6c6e89"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000014"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("5e75cbdd-6504-404e-a189-ec2f0bf8bfdd"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000015"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("4e36584f-1037-47e0-85ed-697d1c1783f0"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000016"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("eee22621-efb1-4d61-afb6-8d7fded31a16"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000017"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("f587f5d1-9138-413a-aaa1-7dd56dcc981d"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000018"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("0bda014d-3942-4367-9293-6cbde6ac39a5"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000019"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("a88ddd26-e0fa-4a13-8696-882af90fb4e4"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000020"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("bd2a1844-8506-4f0b-bb0e-f20325d87bc0"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000021"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("048ab71b-72d3-44b8-aea8-b05b4596d8bf"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000022"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("dbebf109-7413-425e-aaa8-5f58d2513d23"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000023"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("1316245a-b4e0-4657-bdbf-8d8e257b26f9"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000024"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("29bbdcca-19e6-4888-b43a-15cca7e3b4d2"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000025"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("96796f8a-ce0a-47d7-9ba0-c1230bc588bb"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000026"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("91994dc9-b18c-43d4-8cf1-47fe3f81ce7c"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000027"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("71270de2-8615-4084-a379-11069d0ab05b"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000028"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("5f974740-5e83-4483-9a93-8db1d62a7bb0"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000029"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("2faed272-d596-44c7-a131-eb78d7fcc72f"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000030"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("505fd8fb-3d1d-4ce0-8cf3-010e828a801b"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000031"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("71ce7b4d-bff6-4ab1-97d4-1c11ae17f05e"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000032"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("7fcc357a-a68e-4966-bddb-3dfd02223ffa"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000033"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("e77ec892-1a69-45d2-a9f5-11fd92b07b96"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000034"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("a6b56c75-c110-4122-9ecc-65145bed96a1"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000035"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("723bdc97-c6da-4950-adf3-77bee7e97405"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000036"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("bf074feb-9bda-4244-8372-1abe67706060"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000037"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("ed4592b7-e4a6-40bb-b846-6f0f42fedb0e"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000038"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("0428f07f-2a19-4cab-a61e-013356607a3e"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000039"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("cc6396f7-7a64-4af9-9e66-7ca9a642f615"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000040"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("17f53c09-0ff5-4491-86a8-9725b4dbc7cc"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000041"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("7731cbca-d29e-41d0-85d1-7016b2a2f26f"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000042"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("c60ed0dd-eedf-4f15-accc-5913c182dd50"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000043"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("4bffcc65-ec6d-4b8b-8613-b872bedf8399"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000044"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("b6817e86-b3bf-4e87-882a-128dfa11c3dc"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000045"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("a02e4ff9-b950-400b-b312-e0a59c5a6cf0"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000046"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("3563d851-8dda-4d6c-b33a-cb16a3538a51"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000047"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("bcd5a22a-0d6d-4fe6-a9d9-c179188f6a4c"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000048"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("08376f57-d92c-411f-bcb9-d88bcb646e51"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000049"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("1dbe1273-2cc6-4d0e-b7d2-1c1e5b620935"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000050"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("3927638d-2b9b-463f-907e-ec4ae5e30ad4"));
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<string>(
+                name: "PasswordHash",
+                table: "Users",
+                type: "longtext",
+                nullable: false)
+                .Annotation("MySql:CharSet", "utf8mb4");
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000001"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("2933abc2-b472-4870-8af7-a54a3adc4163"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000002"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("d599d707-9645-4aad-8277-b492b2284eca"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000003"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("912132ef-5996-4a7f-acdf-e70a8aebec61"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000004"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("3193b6b5-8656-41a5-88f1-264cda89dc38"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000005"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("33a3bace-319c-4394-a8ca-66f4983e8a65"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000006"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("d67d727b-6bc6-437e-b52a-69bc6a78a009"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000007"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("03c210fa-f841-4262-96a8-d167bcca84de"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000008"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("4949daa6-2136-400a-8b92-a0650ebd433d"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000009"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("abd013d2-5d26-4e08-ab9c-506a8bd8a4fc"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000010"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("f6ea9dbf-42ec-4fdf-b61a-5359f302e3de"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000011"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("1a6d4dfe-32f5-4860-8c0c-3109f6dbdc56"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000012"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("6387f234-eb63-43f1-8b20-1262cc646ef7"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000013"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("bf6e1071-4c1e-45ba-ac90-54935832ab33"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000014"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("2e009c83-d9be-41b1-9cfb-a720671f9531"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000015"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("0a1c09c4-4851-4c03-a728-be2be77425cb"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000016"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("6d5cfd42-9ad3-4c6a-81c1-27c92fa70746"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000017"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("cdd856de-60ba-431a-9c18-59368cf5f325"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000018"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("28ecd453-8762-4614-8c75-321017dc8338"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000019"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("697b6d8b-4d31-4e40-b8f2-46bc4c25e8c0"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000020"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("2648e7f7-34fe-4c86-99eb-f42fb0a92384"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000021"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("5c19d416-b3c5-4b78-b80e-0ebdf2255d2f"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000022"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("e464f639-caa3-4425-867d-60acde28d6c7"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000023"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("2cab1137-c04d-4c18-a1fd-d8124f22e884"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000024"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("08269d0d-a571-472b-be37-ff18235f30ef"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000025"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("1823483d-ddfc-4350-a856-d2b320fc87e9"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000026"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("8c80626e-c979-46b5-8148-2cbec4f501d2"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000027"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("1f67a189-4f7a-4ff1-8041-5c84b85aa6aa"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000028"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("fbac4979-75e8-4042-b5f2-adbbbe79b636"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000029"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("65594d44-edad-4d65-a3b8-a65724ad95ff"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000030"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("b4ad27a0-a8a0-4240-b5ec-ea35741cf19f"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000031"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("870ec304-5917-40c9-8d12-fae978878145"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000032"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("6f6e106a-7b27-46fe-8adb-d21f0ad04062"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000033"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("e32960f9-5a95-4c6f-be9d-85d59643bd62"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000034"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("4fbb45f2-1826-4f4e-8846-a937f04fc9c6"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000035"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("f051c92e-c893-4148-a0c4-987382532c3b"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000036"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("ed96284a-ed40-4521-91c5-6d757efc9ea4"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000037"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("34e8490d-a7ac-4940-bb92-b04c5f2d2a0f"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000038"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("cba2d7cb-7a88-4635-b059-0bb7da52aa5a"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000039"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("4e0efeeb-463b-48d7-835f-4337e5f8db1d"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000040"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("ded75a35-1149-4831-8980-a5552b8aba39"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000041"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("5376fc5a-24df-4a10-ae8d-bf4a7cb41dce"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000042"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("736c95bf-4f53-46e7-b773-ad38ec3ddd8d"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000043"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("a08f24a4-f5c0-426c-a415-42c7823dae7a"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000044"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("1bfece31-2930-4a2f-beef-be08d3bfb95b"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000045"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("b04a9be1-cf18-4c25-9ea7-a71db0973fd1"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000046"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("6973c3f9-6578-4965-ada2-f257f0933c16"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000047"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("7e191e49-0548-4943-8811-d53c3740d6ad"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000048"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("b419616e-ccd8-4872-ba8d-10dc80482a85"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000049"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("c0f12314-72e1-438b-b5f2-0b3aafa8ee40"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000050"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("7357049c-1163-4dbf-afb4-44c77cdff207"));
+
+            migrationBuilder.UpdateData(
+                table: "Users",
+                keyColumn: "Id",
+                keyValue: new Guid("00000001-0000-0000-0000-000000000001"),
+                column: "PasswordHash",
+                value: "N/A");
+
+            migrationBuilder.UpdateData(
+                table: "Users",
+                keyColumn: "Id",
+                keyValue: new Guid("29000000-0000-0000-0000-000000000001"),
+                column: "PasswordHash",
+                value: "AQAAAAIAAYagAAAAEKGnq/U4j6uM9g5mFkxbUE8WU/AhnSNiwrKCiPAqGnzNcaMgZAF5Zal/rJUUYPZPpg==");
+
+            migrationBuilder.UpdateData(
+                table: "Users",
+                keyColumn: "Id",
+                keyValue: new Guid("29000000-0000-0000-0000-000000000002"),
+                column: "PasswordHash",
+                value: "AQAAAAIAAYagAAAAEKGnq/U4j6uM9g5mFkxbUE8WU/AhnSNiwrKCiPAqGnzNcaMgZAF5Zal/rJUUYPZPpg==");
+
+            migrationBuilder.UpdateData(
+                table: "Users",
+                keyColumn: "Id",
+                keyValue: new Guid("29000000-0000-0000-0000-000000000003"),
+                column: "PasswordHash",
+                value: "AQAAAAIAAYagAAAAEKGnq/U4j6uM9g5mFkxbUE8WU/AhnSNiwrKCiPAqGnzNcaMgZAF5Zal/rJUUYPZPpg==");
+
+            migrationBuilder.UpdateData(
+                table: "Users",
+                keyColumn: "Id",
+                keyValue: new Guid("29000000-0000-0000-0000-000000000004"),
+                column: "PasswordHash",
+                value: "AQAAAAIAAYagAAAAEKGnq/U4j6uM9g5mFkxbUE8WU/AhnSNiwrKCiPAqGnzNcaMgZAF5Zal/rJUUYPZPpg==");
+
+            migrationBuilder.UpdateData(
+                table: "Users",
+                keyColumn: "Id",
+                keyValue: new Guid("29000000-0000-0000-0000-000000000005"),
+                column: "PasswordHash",
+                value: "AQAAAAIAAYagAAAAEKGnq/U4j6uM9g5mFkxbUE8WU/AhnSNiwrKCiPAqGnzNcaMgZAF5Zal/rJUUYPZPpg==");
+
+            migrationBuilder.UpdateData(
+                table: "Users",
+                keyColumn: "Id",
+                keyValue: new Guid("29000000-0000-0000-0000-000000000006"),
+                column: "PasswordHash",
+                value: "AQAAAAIAAYagAAAAEKGnq/U4j6uM9g5mFkxbUE8WU/AhnSNiwrKCiPAqGnzNcaMgZAF5Zal/rJUUYPZPpg==");
+
+            migrationBuilder.UpdateData(
+                table: "Users",
+                keyColumn: "Id",
+                keyValue: new Guid("70000000-0000-0000-0000-000000000001"),
+                column: "PasswordHash",
+                value: "AQAAAAIAAYagAAAAEKGnq/U4j6uM9g5mFkxbUE8WU/AhnSNiwrKCiPAqGnzNcaMgZAF5Zal/rJUUYPZPpg==");
+        }
+    }
+}

Distribution/Migrations/20261018101600_removepass.cs

@@ -0,0 +1,719 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace Distribution.Migrations
+{
+    /// <inheritdoc />
+    public partial class removepass : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000001"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("db785a23-5337-4fc8-b460-80c30b707d79"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000002"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("b07b73f9-2c8b-4dff-af5c-42622b026321"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000003"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("2e867ba5-2739-4ce4-b8d7-25b14ed392c1"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000004"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("203d855d-f2d0-43d0-9d4f-9c4d0e8e7566"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000005"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("edd2a0ee-1ca9-47ff-9df6-7254929aef80"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000006"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("644b5ee5-f2c5-4187-a3d4-322cdd5c95d7"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000007"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("70fdf921-f3fd-4e66-bfd2-cb7bb156fa34"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000008"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("e2de5341-4146-4c84-a584-8788774c14df"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000009"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("ece07436-4a0b-435c-888b-a22c14612dc4"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000010"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("b72f8737-7a21-48c0-809a-bc0d3fdd7063"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000011"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("fe1efed0-271f-45e3-a58b-244f1115246f"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000012"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("1b58e809-e4a0-4108-af6e-fd0dac7b3163"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000013"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("881e8e67-e2ee-47be-94f7-77da73a05365"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000014"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("e5d0baa8-9def-4b81-8727-5886b2906eaf"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000015"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("a46ec771-5e79-4595-bb40-91e8a954a792"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000016"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("ef8b1808-3b14-43a8-ba75-30551e643cc5"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000017"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("50142904-8d40-424b-aeb3-53e8cb110445"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000018"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("4bd67f53-7f84-492c-83f9-fd6488fa88b7"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000019"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("d9a0eb59-600e-47e9-8e07-8b7bffc93f8b"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000020"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("e5a9d4da-9497-4e7e-8fb9-796927cbb510"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000021"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("ffa29833-505e-4f56-9a4d-58f5df844af2"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000022"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("4e54994b-7ce1-4b99-aa98-de00c1d205fa"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000023"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("f45b7352-f42a-4bb3-9d1e-d7cbe2665c0c"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000024"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("27744965-334b-4da2-8a2d-5d7433d11b9d"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000025"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("cec1991b-ea93-45b0-b380-01cf0d36fc17"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000026"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("25675bb4-2ab5-437c-bee8-1b1ec1741736"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000027"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("5fc66d40-1960-4028-af48-cf51a80bff04"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000028"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("bd4e1740-a8b6-4a53-8633-a68c9858b3f5"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000029"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("9de97081-77d7-43c3-90b9-af3bc9d4bbef"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000030"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("6ae05e16-95e5-4d43-bfa0-56991393d76f"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000031"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("eb096aea-92c9-4556-ba4f-3084da223c7d"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000032"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("6c9dac72-200a-46eb-b49e-699b1ca775b5"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000033"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("8c8d0c74-40f6-4164-a6a7-6d2374ef162a"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000034"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("4a0d8cea-c33d-45a6-bd42-d8a51ce321c8"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000035"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("a0ea0280-8e40-45bc-88e4-c3feb92e36d4"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000036"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("61da4c55-4f19-4ce4-bfc9-3fa9073365a2"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000037"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("fbab8f2e-f224-42a0-be16-b7ea4e24eec5"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000038"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("bcf7f883-e6c8-4a97-8a27-6814b0ed9144"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000039"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("13c01d81-198b-45cb-9de9-f25130e16313"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000040"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("667c3022-ea0d-4d1c-8ae4-b64e2f104295"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000041"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("78607299-2f5c-4edb-9143-c4a83395f731"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000042"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("e53313fd-c6d4-4d52-827f-14cfd55401eb"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000043"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("c2521113-60f4-41fa-8ded-6b6a6b91a584"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000044"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("14532efd-d9f9-4a46-a7c3-fbfbe85a6f13"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000045"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("438bbd52-ee61-4afc-9d59-7d0407da4f1d"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000046"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("3e3d0cd9-f95e-4c1c-b829-cd02f1bad987"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000047"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("84daf87e-d3e1-4f4e-9a57-ec9996fff41d"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000048"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("ddcb8caf-106e-4072-b48e-a2542de51211"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000049"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("95d39d28-c5c7-4e82-87eb-40570db1c1f5"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000050"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("b8e7b327-33c9-4420-b4d1-0071c58a5c95"));
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000001"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("acbf0349-4cd7-4948-8d22-9219310c7a07"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000002"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("4b1e0b1a-882e-4ae7-b803-386e1e61acb2"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000003"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("15d15e2a-ab44-43e0-b3bf-ccaa35e3fb91"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000004"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("c2343053-018d-4026-bf14-a135479ab631"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000005"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("a77e8dd8-3092-49f7-bee9-aeaaa767e134"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000006"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("4083847f-a4e8-43fd-92d1-27277a039efe"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000007"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("b5ca40f7-369f-4430-b5e9-765c11bf6c13"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000008"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("1d42928a-bec4-4b3c-b883-a119d783a613"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000009"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("8adf4b1a-b698-458f-8a4d-d959829cc56e"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000010"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("a01bf160-9d5f-4f34-8973-769df6805e45"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000011"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("b4457af3-480c-4955-bc52-14d153491cb1"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000012"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("a7f9799f-7543-4f04-9a1c-a3223798d99a"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000013"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("b44bce8a-2bcf-4a63-a9e8-f27d0f6c6e89"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000014"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("5e75cbdd-6504-404e-a189-ec2f0bf8bfdd"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000015"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("4e36584f-1037-47e0-85ed-697d1c1783f0"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000016"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("eee22621-efb1-4d61-afb6-8d7fded31a16"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000017"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("f587f5d1-9138-413a-aaa1-7dd56dcc981d"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000018"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("0bda014d-3942-4367-9293-6cbde6ac39a5"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000019"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("a88ddd26-e0fa-4a13-8696-882af90fb4e4"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000020"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("bd2a1844-8506-4f0b-bb0e-f20325d87bc0"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000021"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("048ab71b-72d3-44b8-aea8-b05b4596d8bf"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000022"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("dbebf109-7413-425e-aaa8-5f58d2513d23"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000023"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("1316245a-b4e0-4657-bdbf-8d8e257b26f9"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000024"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("29bbdcca-19e6-4888-b43a-15cca7e3b4d2"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000025"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("96796f8a-ce0a-47d7-9ba0-c1230bc588bb"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000026"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("91994dc9-b18c-43d4-8cf1-47fe3f81ce7c"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000027"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("71270de2-8615-4084-a379-11069d0ab05b"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000028"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("5f974740-5e83-4483-9a93-8db1d62a7bb0"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000029"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("2faed272-d596-44c7-a131-eb78d7fcc72f"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000030"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("505fd8fb-3d1d-4ce0-8cf3-010e828a801b"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000031"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("71ce7b4d-bff6-4ab1-97d4-1c11ae17f05e"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000032"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("7fcc357a-a68e-4966-bddb-3dfd02223ffa"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000033"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("e77ec892-1a69-45d2-a9f5-11fd92b07b96"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000034"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("a6b56c75-c110-4122-9ecc-65145bed96a1"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000035"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("723bdc97-c6da-4950-adf3-77bee7e97405"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000036"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("bf074feb-9bda-4244-8372-1abe67706060"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000037"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("ed4592b7-e4a6-40bb-b846-6f0f42fedb0e"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000038"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("0428f07f-2a19-4cab-a61e-013356607a3e"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000039"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("cc6396f7-7a64-4af9-9e66-7ca9a642f615"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000040"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("17f53c09-0ff5-4491-86a8-9725b4dbc7cc"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000041"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("7731cbca-d29e-41d0-85d1-7016b2a2f26f"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000042"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("c60ed0dd-eedf-4f15-accc-5913c182dd50"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000043"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("4bffcc65-ec6d-4b8b-8613-b872bedf8399"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000044"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("b6817e86-b3bf-4e87-882a-128dfa11c3dc"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000045"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("a02e4ff9-b950-400b-b312-e0a59c5a6cf0"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000046"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("3563d851-8dda-4d6c-b33a-cb16a3538a51"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000047"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("bcd5a22a-0d6d-4fe6-a9d9-c179188f6a4c"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000048"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("08376f57-d92c-411f-bcb9-d88bcb646e51"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000049"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("1dbe1273-2cc6-4d0e-b7d2-1c1e5b620935"));
+
+            migrationBuilder.UpdateData(
+                table: "RolePermissions",
+                keyColumns: new[] { "FK_PermissionId", "FK_RoleId" },
+                keyValues: new object[] { new Guid("20000000-0000-0000-0000-000000000050"), new Guid("10000000-0000-0000-0000-000000000007") },
+                column: "Id",
+                value: new Guid("3927638d-2b9b-463f-907e-ec4ae5e30ad4"));
+        }
+    }
+}

Distribution/Migrations/AppDBContextModelSnapshot.cs

@@ -1193,6 +1193,408 @@ namespace Distribution.Migrations
                     b.HasKey("Id");
 
                     b.ToTable("Permissions");
+
+                    b.HasData(
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000001"),
+                            Code = "orders.view",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "View shop POs, invoices, payments and returns",
+                            IsActive = true
+                        },
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000002"),
+                            Code = "rides.view",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "View and manage delivery rides and delivery tasks",
+                            IsActive = true
+                        },
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000003"),
+                            Code = "loading.view",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "View and manage loading sheets",
+                            IsActive = true
+                        },
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000004"),
+                            Code = "stores.view",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "View store accounts, credit limits and balances",
+                            IsActive = true
+                        },
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000005"),
+                            Code = "sales_visits.checkin",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "Check in and out of scheduled store visits",
+                            IsActive = true
+                        },
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000006"),
+                            Code = "items.view",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "View and manage catalogue products",
+                            IsActive = true
+                        },
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000007"),
+                            Code = "categories.view",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "View and manage product categories and brands",
+                            IsActive = true
+                        },
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000008"),
+                            Code = "warehouses.view",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "View stock balances, movements, warehouses and reports",
+                            IsActive = true
+                        },
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000009"),
+                            Code = "purchase_orders.view",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "View and manage purchase orders, GRNs and supplier claims",
+                            IsActive = true
+                        },
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000010"),
+                            Code = "pricelists.view",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "View and manage regional price lists",
+                            IsActive = true
+                        },
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000011"),
+                            Code = "schemes.view",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "View and manage pricing schemes and promotions",
+                            IsActive = true
+                        },
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000012"),
+                            Code = "suppliers.view",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "View and manage supplier accounts",
+                            IsActive = true
+                        },
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000013"),
+                            Code = "driver_profiles.view",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "View and manage driver profiles and licensing",
+                            IsActive = true
+                        },
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000014"),
+                            Code = "compliance.manage",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "Manage driver compliance rules",
+                            IsActive = true
+                        },
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000015"),
+                            Code = "users.view",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "View and manage staff user accounts",
+                            IsActive = true
+                        },
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000016"),
+                            Code = "roles.view",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "View and manage roles and their permission sets",
+                            IsActive = true
+                        },
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000017"),
+                            Code = "regions.view",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "View and manage regions and region configuration",
+                            IsActive = true
+                        },
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000018"),
+                            Code = "routes.view",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "View and manage delivery routes",
+                            IsActive = true
+                        },
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000019"),
+                            Code = "vehicles.view",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "View and manage fleet vehicles",
+                            IsActive = true
+                        },
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000020"),
+                            Code = "claim.view",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "View agency claims and settlement status",
+                            IsActive = true
+                        },
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000021"),
+                            Code = "claim.manage",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "Create and settle agency claims",
+                            IsActive = true
+                        },
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000022"),
+                            Code = "delivery-task.view",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "View delivery tasks within a ride",
+                            IsActive = true
+                        },
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000023"),
+                            Code = "delivery-task.manage",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "Confirm and fail delivery tasks",
+                            IsActive = true
+                        },
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000024"),
+                            Code = "driver.view",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "View driver profiles and license details",
+                            IsActive = true
+                        },
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000025"),
+                            Code = "driver.manage",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "Create and update driver profiles",
+                            IsActive = true
+                        },
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000026"),
+                            Code = "grn.view",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "View goods receipt notes",
+                            IsActive = true
+                        },
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000027"),
+                            Code = "grn.manage",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "Create and confirm goods receipts",
+                            IsActive = true
+                        },
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000028"),
+                            Code = "loading-sheet.view",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "View loading sheets and their items",
+                            IsActive = true
+                        },
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000029"),
+                            Code = "loading-sheet.manage",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "Create, edit, and confirm loading sheets",
+                            IsActive = true
+                        },
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000030"),
+                            Code = "price-list.view",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "View regional price lists",
+                            IsActive = true
+                        },
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000031"),
+                            Code = "price-list.manage",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "Create and manage item price lists",
+                            IsActive = true
+                        },
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000032"),
+                            Code = "purchase-order.view",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "View purchase orders and line items",
+                            IsActive = true
+                        },
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000033"),
+                            Code = "purchase-order.manage",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "Create, confirm, and close purchase orders",
+                            IsActive = true
+                        },
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000034"),
+                            Code = "purchase-return.manage",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "Create and manage purchase returns to suppliers",
+                            IsActive = true
+                        },
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000035"),
+                            Code = "region.view",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "View regions and their configuration",
+                            IsActive = true
+                        },
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000036"),
+                            Code = "region.manage",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "Create and update regions, targets, and budgets",
+                            IsActive = true
+                        },
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000037"),
+                            Code = "return.view",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "View order returns",
+                            IsActive = true
+                        },
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000038"),
+                            Code = "return.manage",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "Create and manage order returns",
+                            IsActive = true
+                        },
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000039"),
+                            Code = "route.view",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "View delivery routes",
+                            IsActive = true
+                        },
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000040"),
+                            Code = "route.manage",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "Create and manage delivery routes",
+                            IsActive = true
+                        },
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000041"),
+                            Code = "scheme.view",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "View pricing schemes and promotions",
+                            IsActive = true
+                        },
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000042"),
+                            Code = "scheme.manage",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "Create and configure pricing schemes",
+                            IsActive = true
+                        },
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000043"),
+                            Code = "stock.view",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "View stock balances and movements",
+                            IsActive = true
+                        },
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000044"),
+                            Code = "stock.manage",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "Transfer stock and record damage or adjustments",
+                            IsActive = true
+                        },
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000045"),
+                            Code = "store.view",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "View store accounts and balances",
+                            IsActive = true
+                        },
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000046"),
+                            Code = "store.manage",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "Create and update store accounts",
+                            IsActive = true
+                        },
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000047"),
+                            Code = "supplier-claim.view",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "View supplier claims",
+                            IsActive = true
+                        },
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000048"),
+                            Code = "supplier-claim.manage",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "Create and resolve supplier claims",
+                            IsActive = true
+                        },
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000049"),
+                            Code = "sys-config.view",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "View system configuration settings",
+                            IsActive = true
+                        },
+                        new
+                        {
+                            Id = new Guid("20000000-0000-0000-0000-000000000050"),
+                            Code = "sys-config.manage",
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Description = "Update system configuration settings",
+                            IsActive = true
+                        });
                 });
 
             modelBuilder.Entity("Distribution.Models.PriceList", b =>
@@ -1787,6 +2189,14 @@ namespace Distribution.Migrations
                             IsActive = true,
                             Level = 60,
                             Name = "RegionalAgency"
+                        },
+                        new
+                        {
+                            Id = new Guid("10000000-0000-0000-0000-000000000007"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            IsActive = true,
+                            Level = 100,
+                            Name = "SuperAdmin"
                         });
                 });
 
@@ -1812,6 +2222,408 @@ namespace Distribution.Migrations
                     b.HasIndex("FK_PermissionId");
 
                     b.ToTable("RolePermissions");
+
+                    b.HasData(
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000001"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("db785a23-5337-4fc8-b460-80c30b707d79"),
+                            IsActive = true
+                        },
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000002"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("b07b73f9-2c8b-4dff-af5c-42622b026321"),
+                            IsActive = true
+                        },
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000003"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("2e867ba5-2739-4ce4-b8d7-25b14ed392c1"),
+                            IsActive = true
+                        },
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000004"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("203d855d-f2d0-43d0-9d4f-9c4d0e8e7566"),
+                            IsActive = true
+                        },
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000005"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("edd2a0ee-1ca9-47ff-9df6-7254929aef80"),
+                            IsActive = true
+                        },
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000006"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("644b5ee5-f2c5-4187-a3d4-322cdd5c95d7"),
+                            IsActive = true
+                        },
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000007"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("70fdf921-f3fd-4e66-bfd2-cb7bb156fa34"),
+                            IsActive = true
+                        },
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000008"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("e2de5341-4146-4c84-a584-8788774c14df"),
+                            IsActive = true
+                        },
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000009"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("ece07436-4a0b-435c-888b-a22c14612dc4"),
+                            IsActive = true
+                        },
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000010"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("b72f8737-7a21-48c0-809a-bc0d3fdd7063"),
+                            IsActive = true
+                        },
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000011"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("fe1efed0-271f-45e3-a58b-244f1115246f"),
+                            IsActive = true
+                        },
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000012"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("1b58e809-e4a0-4108-af6e-fd0dac7b3163"),
+                            IsActive = true
+                        },
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000013"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("881e8e67-e2ee-47be-94f7-77da73a05365"),
+                            IsActive = true
+                        },
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000014"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("e5d0baa8-9def-4b81-8727-5886b2906eaf"),
+                            IsActive = true
+                        },
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000015"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("a46ec771-5e79-4595-bb40-91e8a954a792"),
+                            IsActive = true
+                        },
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000016"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("ef8b1808-3b14-43a8-ba75-30551e643cc5"),
+                            IsActive = true
+                        },
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000017"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("50142904-8d40-424b-aeb3-53e8cb110445"),
+                            IsActive = true
+                        },
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000018"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("4bd67f53-7f84-492c-83f9-fd6488fa88b7"),
+                            IsActive = true
+                        },
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000019"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("d9a0eb59-600e-47e9-8e07-8b7bffc93f8b"),
+                            IsActive = true
+                        },
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000020"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("e5a9d4da-9497-4e7e-8fb9-796927cbb510"),
+                            IsActive = true
+                        },
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000021"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("ffa29833-505e-4f56-9a4d-58f5df844af2"),
+                            IsActive = true
+                        },
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000022"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("4e54994b-7ce1-4b99-aa98-de00c1d205fa"),
+                            IsActive = true
+                        },
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000023"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("f45b7352-f42a-4bb3-9d1e-d7cbe2665c0c"),
+                            IsActive = true
+                        },
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000024"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("27744965-334b-4da2-8a2d-5d7433d11b9d"),
+                            IsActive = true
+                        },
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000025"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("cec1991b-ea93-45b0-b380-01cf0d36fc17"),
+                            IsActive = true
+                        },
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000026"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("25675bb4-2ab5-437c-bee8-1b1ec1741736"),
+                            IsActive = true
+                        },
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000027"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("5fc66d40-1960-4028-af48-cf51a80bff04"),
+                            IsActive = true
+                        },
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000028"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("bd4e1740-a8b6-4a53-8633-a68c9858b3f5"),
+                            IsActive = true
+                        },
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000029"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("9de97081-77d7-43c3-90b9-af3bc9d4bbef"),
+                            IsActive = true
+                        },
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000030"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("6ae05e16-95e5-4d43-bfa0-56991393d76f"),
+                            IsActive = true
+                        },
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000031"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("eb096aea-92c9-4556-ba4f-3084da223c7d"),
+                            IsActive = true
+                        },
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000032"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("6c9dac72-200a-46eb-b49e-699b1ca775b5"),
+                            IsActive = true
+                        },
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000033"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("8c8d0c74-40f6-4164-a6a7-6d2374ef162a"),
+                            IsActive = true
+                        },
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000034"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("4a0d8cea-c33d-45a6-bd42-d8a51ce321c8"),
+                            IsActive = true
+                        },
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000035"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("a0ea0280-8e40-45bc-88e4-c3feb92e36d4"),
+                            IsActive = true
+                        },
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000036"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("61da4c55-4f19-4ce4-bfc9-3fa9073365a2"),
+                            IsActive = true
+                        },
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000037"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("fbab8f2e-f224-42a0-be16-b7ea4e24eec5"),
+                            IsActive = true
+                        },
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000038"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("bcf7f883-e6c8-4a97-8a27-6814b0ed9144"),
+                            IsActive = true
+                        },
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000039"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("13c01d81-198b-45cb-9de9-f25130e16313"),
+                            IsActive = true
+                        },
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000040"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("667c3022-ea0d-4d1c-8ae4-b64e2f104295"),
+                            IsActive = true
+                        },
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000041"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("78607299-2f5c-4edb-9143-c4a83395f731"),
+                            IsActive = true
+                        },
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000042"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("e53313fd-c6d4-4d52-827f-14cfd55401eb"),
+                            IsActive = true
+                        },
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000043"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("c2521113-60f4-41fa-8ded-6b6a6b91a584"),
+                            IsActive = true
+                        },
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000044"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("14532efd-d9f9-4a46-a7c3-fbfbe85a6f13"),
+                            IsActive = true
+                        },
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000045"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("438bbd52-ee61-4afc-9d59-7d0407da4f1d"),
+                            IsActive = true
+                        },
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000046"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("3e3d0cd9-f95e-4c1c-b829-cd02f1bad987"),
+                            IsActive = true
+                        },
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000047"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("84daf87e-d3e1-4f4e-9a57-ec9996fff41d"),
+                            IsActive = true
+                        },
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000048"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("ddcb8caf-106e-4072-b48e-a2542de51211"),
+                            IsActive = true
+                        },
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000049"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("95d39d28-c5c7-4e82-87eb-40570db1c1f5"),
+                            IsActive = true
+                        },
+                        new
+                        {
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FK_PermissionId = new Guid("20000000-0000-0000-0000-000000000050"),
+                            CreatedAt = new DateTime(2026, 8, 18, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("b8e7b327-33c9-4420-b4d1-0071c58a5c95"),
+                            IsActive = true
+                        });
                 });
 
             modelBuilder.Entity("Distribution.Models.Route", b =>
@@ -3157,10 +3969,6 @@ namespace Distribution.Migrations
                     b.Property<bool>("IsActive")
                         .HasColumnType("tinyint(1)");
 
-                    b.Property<string>("PasswordHash")
-                        .IsRequired()
-                        .HasColumnType("longtext");
-
                     b.Property<DateTime?>("UpdatedAt")
                         .HasColumnType("datetime(6)");
 
@@ -3184,7 +3992,6 @@ namespace Distribution.Migrations
                             FK_RoleId = new Guid("10000000-0000-0000-0000-000000000002"),
                             FullName = "Sunil Fernando",
                             IsActive = true,
-                            PasswordHash = "AQAAAAIAAYagAAAAEKGnq/U4j6uM9g5mFkxbUE8WU/AhnSNiwrKCiPAqGnzNcaMgZAF5Zal/rJUUYPZPpg==",
                             Username = "sunil.fernando"
                         },
                         new
@@ -3195,7 +4002,6 @@ namespace Distribution.Migrations
                             FK_RoleId = new Guid("10000000-0000-0000-0000-000000000001"),
                             FullName = "Nimal Perera",
                             IsActive = true,
-                            PasswordHash = "AQAAAAIAAYagAAAAEKGnq/U4j6uM9g5mFkxbUE8WU/AhnSNiwrKCiPAqGnzNcaMgZAF5Zal/rJUUYPZPpg==",
                             Username = "nimal.perera"
                         },
                         new
@@ -3206,7 +4012,6 @@ namespace Distribution.Migrations
                             FK_RoleId = new Guid("10000000-0000-0000-0000-000000000001"),
                             FullName = "Kamal Silva",
                             IsActive = true,
-                            PasswordHash = "AQAAAAIAAYagAAAAEKGnq/U4j6uM9g5mFkxbUE8WU/AhnSNiwrKCiPAqGnzNcaMgZAF5Zal/rJUUYPZPpg==",
                             Username = "kamal.silva"
                         },
                         new
@@ -3217,7 +4022,6 @@ namespace Distribution.Migrations
                             FK_RoleId = new Guid("10000000-0000-0000-0000-000000000001"),
                             FullName = "Ruwan Jayasuriya",
                             IsActive = true,
-                            PasswordHash = "AQAAAAIAAYagAAAAEKGnq/U4j6uM9g5mFkxbUE8WU/AhnSNiwrKCiPAqGnzNcaMgZAF5Zal/rJUUYPZPpg==",
                             Username = "ruwan.jayasuriya"
                         },
                         new
@@ -3228,7 +4032,6 @@ namespace Distribution.Migrations
                             FK_RoleId = new Guid("10000000-0000-0000-0000-000000000001"),
                             FullName = "Priyantha Kumara",
                             IsActive = true,
-                            PasswordHash = "AQAAAAIAAYagAAAAEKGnq/U4j6uM9g5mFkxbUE8WU/AhnSNiwrKCiPAqGnzNcaMgZAF5Zal/rJUUYPZPpg==",
                             Username = "priyantha.kumara"
                         },
                         new
@@ -3238,7 +4041,6 @@ namespace Distribution.Migrations
                             FK_RoleId = new Guid("10000000-0000-0000-0000-000000000005"),
                             FullName = "Priya Rajapaksa",
                             IsActive = true,
-                            PasswordHash = "AQAAAAIAAYagAAAAEKGnq/U4j6uM9g5mFkxbUE8WU/AhnSNiwrKCiPAqGnzNcaMgZAF5Zal/rJUUYPZPpg==",
                             Username = "priya.rajapaksa"
                         },
                         new
@@ -3248,8 +4050,16 @@ namespace Distribution.Migrations
                             FK_RoleId = new Guid("10000000-0000-0000-0000-000000000006"),
                             FullName = "Channa De Silva",
                             IsActive = true,
-                            PasswordHash = "AQAAAAIAAYagAAAAEKGnq/U4j6uM9g5mFkxbUE8WU/AhnSNiwrKCiPAqGnzNcaMgZAF5Zal/rJUUYPZPpg==",
                             Username = "channa.desilva"
+                        },
+                        new
+                        {
+                            Id = new Guid("00000001-0000-0000-0000-000000000001"),
+                            CreatedAt = new DateTime(2026, 10, 13, 0, 0, 0, 0, DateTimeKind.Unspecified),
+                            FK_RoleId = new Guid("10000000-0000-0000-0000-000000000007"),
+                            FullName = "Super Admin",
+                            IsActive = true,
+                            Username = "superadmin"
                         });
                 });
 

Distribution/Models/User.cs

@@ -5,7 +5,6 @@ namespace Distribution.Models
     public class User : Template
     {
         public string Username { get; set; }
-        public string PasswordHash { get; set; }
         public string FullName { get; set; }
 
         public Guid FK_RoleId { get; set; }

Distribution/Program.cs

@@ -36,6 +36,9 @@ using Distribution.Features.SysConfig;
 using Distribution.Features.Warehouse;
 using Distribution.Infra.Authorization;
 using Distribution.Infra.UoW;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc.Authorization;
 using Microsoft.EntityFrameworkCore;
 
 var builder = WebApplication.CreateBuilder(args);
@@ -115,6 +118,7 @@ builder.Services.AddScoped<DeliveryTaskService>();
 builder.Services.AddScoped<PaymentService>();
 builder.Services.AddScoped<SysConfigService>();
 
+builder.Services.AddMemoryCache();
 builder.Services.AddHttpContextAccessor();
 builder.Services.AddScoped<ICurrentUserService, CurrentUserService>();
 builder.Services.AddHttpClient<IAuthHexClient, AuthHexClient>(client =>
@@ -126,29 +130,26 @@ builder.Services.AddScoped<IPermissionRepository, PermissionRepository>();
 builder.Services.AddScoped<IScopeRepository, ScopeRepository>();
 builder.Services.AddScoped<IPermissionService, PermissionService>();
 builder.Services.AddScoped<IScopeAccessService, ScopeAccessService>();
-// ── Auth Service connector ───────────────────────────────────────────────────
-builder.Services.Configure<AuthServiceOptions>(
-    builder.Configuration.GetSection(AuthServiceOptions.SectionName));
-
-var authServiceBaseUrl = builder.Configuration[$"{AuthServiceOptions.SectionName}:BaseUrl"];
-
-builder.Services.AddHttpClient<AuthServiceClient>(client =>
-{
-    if (!string.IsNullOrWhiteSpace(authServiceBaseUrl))
-        client.BaseAddress = new Uri(authServiceBaseUrl);
-});
-
-builder.Services.AddScoped<IAuthServiceClient, AuthServiceClient>();
+builder.Services.AddAuthentication("Bearer")
+    .AddScheme<AuthenticationSchemeOptions, BearerResponseHandler>("Bearer", _ => { });
+builder.Services.AddAuthorization();
+builder.Services.AddSingleton<IAuthorizationPolicyProvider, PermissionPolicyProvider>();
+builder.Services.AddScoped<IAuthorizationHandler, PermissionAuthorizationHandler>();
 
 var allowedOrigins = builder.Configuration.GetSection("Cors:AllowedOrigins").Get<string[]>() ?? [];
 builder.Services.AddCors(options =>
     options.AddDefaultPolicy(policy =>
         policy.WithOrigins(allowedOrigins)
               .AllowAnyHeader()
-              .AllowAnyMethod()));
+              .AllowAnyMethod()
+              .AllowCredentials()));
 
-builder.Services.AddControllers()
-    .AddJsonOptions(options => options.JsonSerializerOptions.Converters.Add(new JsonStringEnumConverter()));
+builder.Services.AddControllers(options =>
+{
+    var policy = new AuthorizationPolicyBuilder().RequireAuthenticatedUser().Build();
+    options.Filters.Add(new AuthorizeFilter(policy));
+})
+.AddJsonOptions(options => options.JsonSerializerOptions.Converters.Add(new JsonStringEnumConverter()));
 builder.Services.AddEndpointsApiExplorer();
 builder.Services.AddOpenApi();
 builder.Services.AddSwaggerGen();
@@ -165,6 +166,8 @@ if (app.Environment.IsDevelopment())
 //app.UseHttpsRedirection();
 app.UseCors();
 app.UseMiddleware<AuthMiddleware>();
+app.UseAuthentication();
+app.UseAuthorization();
 app.MapControllers();
 
 app.Run();

Distribution/Properties/launchSettings.json

@@ -6,7 +6,7 @@
       "dotnetRunMessages": true,
       "launchBrowser": true,
       "launchUrl": "swagger",
-      "applicationUrl": "http://localhost:5089",
+      "applicationUrl": "http://localhost:8802",
       "environmentVariables": {
         "ASPNETCORE_ENVIRONMENT": "Development"
       }
@@ -16,7 +16,7 @@
       "dotnetRunMessages": true,
       "launchBrowser": true,
       "launchUrl": "swagger",
-      "applicationUrl": "https://localhost:7025;http://localhost:5089",
+      "applicationUrl": "https://localhost:7025;http://localhost:8802",
       "environmentVariables": {
         "ASPNETCORE_ENVIRONMENT": "Development"
       }

Distribution/appsettings.json

@@ -21,7 +21,7 @@
 
   },
   "AuthHex": {
-    "BaseUrl": "http://localhost:8801"
+    "BaseUrl": "http://localhost:6703"
   },
   "StoreManagement": {
     "UnverifiedKycOrderThreshold": 0

Distribution/docs/authentication_flow.md

@@ -1,102 +1,116 @@
-# Authentication — Own-User Auth via External Identity Service (AuthHex)
+# Authentication & Authorization Layer
 
-**Status**: Done
-**Depends On**: — (cross-cutting infrastructure, not a numbered feature step)
+## External Auth Service (AuthHex)
+- Runs on `http://localhost:6703`
+- Owns credentials — this app never stores passwords
+- Issues RS256-signed JWTs with claims: `sub`, `role_id`, `role_level`, `username`, `role_code`
 
 ---
 
-## Goal
-
-Own-user (staff/API) authentication is delegated to an external identity service ("AuthHex"),
-which owns credentials and signs RS256 JWTs. This app validates those tokens and maps them onto
-its own `User`/`Role` tables so the existing permission-policy authorization stays unchanged.
-
----
-
-## Background / Context
-
-Previously this app verified passwords and minted its own HMAC-signed JWT locally. That's been
-replaced — AuthHex now owns credentials and signing; this app only holds AuthHex's **public** key
-to validate tokens, and never sees a plaintext password for this flow.
-
-Authorization is untouched: permission policies, role levels, scope checks, and the seeded role
-set all still work exactly as before, because every validated token is mapped back onto a local
-`User`/`Role` row before any authorization check runs.
-
----
-
-## Configuration Changes
-
-```jsonc
-"Jwt": {
-  "PublicKey": "<RSAKeyValue>...</RSAKeyValue>",
-  "Audience": "AuthHexClient",
-  "Issuer": "AuthHex"
-},
-"AuthHex": { "BaseUrl": "http://localhost:6102" }
-```
-
-`Jwt:Key` (old symmetric secret) is removed. `Jwt:PublicKey` is AuthHex's RSA public key in XML
-format (not PEM).
-
----
-
-## API Endpoints
-
-| Method | Route | Notes |
-|---|---|---|
-| POST | /api/auth/login | Proxies to AuthHex `loginUser` |
-| POST | /api/auth/register | Proxies to AuthHex `registerUser` |
-| GET | /api/auth/me | `[Authorize]`, proxies to AuthHex `getUserDetails` |
-| POST | /api/auth/logout | `[Authorize]`, proxies to AuthHex `LogoutUser` |
-
-All four just forward to `POST {AuthHex:BaseUrl}/api/user` and pass AuthHex's response back
-as-is. No cookie — token returned in the response body, sent back as `Authorization: Bearer`.
-
----
-
-## Business Rules
-
-1. No local password check or token issuance — both delegated to AuthHex.
-2. `AddJwtBearer` validates issuer/audience/signature/lifetime against AuthHex's public key.
-3. `OnTokenValidated` maps the token's `sub` claim to a local `User` (`IUserRepository`); fails
-   the token if no matching active user exists.
-4. On success, `username`/`role_id`/`role_level` claims are attached from the **local** `User`/
-   `Role` row — authorization checks downstream are unaffected by anything AuthHex's own token
-   claims contain.
-5. Only one validation mechanism runs (`AddJwtBearer`) — two ported alternatives exist but are not
-   registered (see Implementation Notes).
-6. No refresh tokens — once the AuthHex-issued token expires, the client must log in again.
-
----
-
-## Permissions to Add to Seed
-
-None — this only changes authentication. Permission policies and role seed data are untouched.
-
----
-
-## Open Questions
-
-- Add a refresh-token flow if AuthHex doesn't offer one and re-login UX proves disruptive.
-- Keep or delete the ported `AuthMiddleware`/`JwtMiddleware` if never actually needed.
-- No retry/circuit-breaker if AuthHex is unreachable.
-
----
-
-## Implementation Notes
+## Directory Structure
 
 ```
-Features/Auth/            — AuthController, AuthService, AuthDTOs (thin AuthHex proxies)
-Infra/Authorization/
-  AuthHex/                 — IAuthHexClient, AuthHexClient, AuthHexResponse
-  Jwt/RsaXmlKeyReader.cs    — portable XML→RSA key parser (RSA.FromXmlString is Windows-only)
-  Middleware/               — AuthMiddleware, JwtMiddleware, JwtOptions, ApiResponse
-                               (ported from OSMCore for reference — NOT registered)
-Program.cs                 — AddHttpClient<IAuthHexClient>, AddJwtBearer + OnTokenValidated
-                               (maps token → local User/Role → role_id/role_level claims)
+Infra/
+├── Auth/                          External auth service integration
+│   ├── AuthHexClient.cs           HTTP proxy to AuthHex (/api/user)
+│   ├── IAuthHexClient.cs
+│   └── AuthHexResponse.cs         Raw response shape from AuthHex
+│
+└── Authorization/                 This app's permission enforcement
+    ├── PermissionRequirement.cs   ASP.NET Core requirement (wraps permission code string)
+    ├── PermissionPolicyProvider.cs Builds policy dynamically for any "x.y" string
+    ├── PermissionAuthorizationHandler.cs  Evaluates requirement against DB
+    ├── AuthorizationController.cs  Exposes permission/scope check endpoints
+    ├── CurrentUserService.cs       Extracts typed claims from HttpContext.User
+    ├── ICurrentUserService.cs
+    ├── AuthorizationDTOs.cs
+    ├── Permission/
+    │   ├── PermissionRepository.cs  Queries RolePermissions + Permissions tables
+    │   ├── PermissionService.cs
+    │   ├── IPermissionRepository.cs
+    │   └── IPermissionService.cs
+    └── Scope/
+        ├── ScopeRepository.cs       Queries UserStoreScopes / UserRouteScopes / UserRegionScopes
+        ├── ScopeAccessService.cs    Resolves accessible stores via store → route → region hierarchy
+        ├── IScopeRepository.cs
+        └── IScopeAccessService.cs
 ```
 
-**Gotcha:** don't run more than one of `AddJwtBearer` / `AuthMiddleware` /
-`JwtMiddleware.CustomMiddlewareAttribute` at once — each re-validates the same token
-independently.
+---
+
+## Login Flow
+
+```
+POST /api/auth/login
+  → AuthController
+  → AuthService.LoginAsync
+  → AuthHexClient.CallAsync("loginUser", ...)
+  → POST http://localhost:6703/api/user
+  ← RS256-signed JWT returned to client
+```
+
+---
+
+## Request Flow
+
+```
+Incoming request with Authorization: Bearer <jwt>
+  │
+  ▼
+AuthMiddleware (Middleware/AuthMiddleware.cs)
+  - Reads Jwt:PublicKey from appsettings.json
+  - RSA.Create().FromXmlString(publicKeyXml)
+  - Validates JWT signature (RS256), issuer, audience, lifetime
+  - Sets HttpContext.User = principal (claims: sub, role_id, role_level, username)
+  │
+  ▼
+app.UseAuthorization()
+  - Global AuthorizeFilter: requires IsAuthenticated on every endpoint
+  - [Authorize("brand.view")] triggers PermissionPolicyProvider
+      → builds AuthorizationPolicy with PermissionRequirement("brand.view")
+      → PermissionAuthorizationHandler reads role_id claim
+      → PermissionService.HasPermissionAsync(roleId, "brand.view")
+      → DB: RolePermissions JOIN Permissions WHERE code = "brand.view"
+  │
+  ▼
+Controller
+  - ICurrentUserService.UserId / RoleId / RoleLevel extracted from HttpContext.User
+  - Scope guards: HasStoreScopeAsync / HasRouteScopeAsync / HasRegionScopeAsync
+```
+
+---
+
+## Scope System
+
+Scope controls which **records** a user can access (not just which actions).
+
+| Assignment table | Access granted to |
+|---|---|
+| `UserStoreScopes` | Specific stores directly |
+| `UserRouteScopes` | All stores on that route |
+| `UserRegionScopes` | All routes → all stores in that region |
+
+`ScopeAccessService.GetAccessibleStoreIdsAsync` merges all three levels and deduplicates.
+
+---
+
+## Pipeline Order (Program.cs)
+
+```csharp
+app.UseCors();
+app.UseMiddleware<AuthMiddleware>();  // 1. populate HttpContext.User
+app.UseAuthorization();              // 2. evaluate [Authorize] attributes
+```
+
+`UseAuthentication()` is intentionally absent — JWT validation is done manually in `AuthMiddleware`, not via ASP.NET Core's built-in bearer scheme.
+
+---
+
+## appsettings.json Keys
+
+| Key | Purpose |
+|---|---|
+| `Jwt:PublicKey` | RSA XML public key from AuthHex (used by AuthMiddleware) |
+| `Jwt:Issuer` | `AuthHex` |
+| `Jwt:Audience` | `AuthHexClient` |
+| `AuthHex:BaseUrl` | `http://localhost:6703` |

Distribution/docs/refactor_frontend_api_reference.md

@@ -1,6 +1,6 @@
 # Frontend API Reference — ERP Distribution (Post-Refactor)
 
-> Last updated: 2026-09-17  
+> Last updated: 2026-10-13  
 > Base URL: `https://<host>/api`  
 > All responses are JSON. Enum fields are serialized as **strings** (e.g. `"Pending"`, `"ModeB"`).  
 > All `Guid` fields are UUID v4 strings. All `DateTime` fields are ISO 8601.
@@ -9,7 +9,8 @@
 
 ## Table of Contents
 
-1. [Pagination](#pagination)
+1. [Authentication](#authentication)
+2. [Pagination](#pagination)
 2. [Enums Reference](#enums-reference)
 3. [ShopPO](#shoppo)
 4. [Invoice](#invoice)
@@ -24,6 +25,146 @@
 
 ---
 
+## Authentication
+
+### Login
+
+```http
+POST /api/auth/login
+Content-Type: application/json
+
+{
+  "identifier": "string",
+  "password": "string",
+  "userTypeId": "uuid | null",
+  "deviceName": "string"
+}
+```
+
+| Field | Type | Required | Notes |
+|-------|------|----------|-------|
+| `identifier` | `string` | Yes | Username or email |
+| `password` | `string` | Yes | |
+| `userTypeId` | `Guid?` | No | Scopes login to a specific user type |
+| `deviceName` | `string` | No | Defaults to `"Unknown Device"` |
+
+**Response:** AuthHex response. On success, the server also sets an **HttpOnly** cookie `access-token` containing the JWT (expiry driven by the `expiresIn` field, defaulting to 1 hour).
+
+```json
+{
+  "statusCode": 200,
+  "success": true,
+  "message": null,
+  "data": {
+    "accessToken": "<jwt>",
+    "expiresIn": 3600
+  }
+}
+```
+
+### Using the Token
+
+The server sets the JWT as an `HttpOnly` cookie (`access-token`) on login. For browser clients the cookie is sent automatically on every same-origin request — no manual token handling is needed.
+
+For non-browser clients (or cross-origin requests with `withCredentials: true`), include the JWT explicitly:
+
+```http
+Authorization: Bearer <jwt>
+```
+
+The middleware accepts either the `Authorization: Bearer` header **or** the `access-token` cookie, preferring the header.
+
+### Register
+
+```http
+POST /api/auth/register
+Content-Type: application/json
+
+{
+  "username": "string",
+  "password": "string"
+}
+```
+
+### Get Current User
+
+```http
+GET /api/auth/me
+Authorization: Bearer <jwt>
+```
+
+**Response:**
+```json
+{
+  "userId": "uuid",
+  "username": "string",
+  "roleId": "uuid",
+  "roleCode": "string",
+  "roleLevel": 0
+}
+```
+
+### Logout
+
+```http
+POST /api/auth/logout
+```
+
+Deletes the `access-token` cookie server-side. No request body required.
+
+**Response:**
+```json
+{ "success": true }
+```
+
+> **Note:** Logout only clears the cookie on this server. The JWT itself is not invalidated at AuthHex — it remains valid until it expires.
+
+### Error Responses
+
+| Status | Meaning |
+|--------|---------|
+| `401` | No token supplied, token invalid, or token expired |
+| `403` | Token is valid but the user's role does not have the required permission |
+
+### Permission Check (optional)
+
+The frontend can check whether the current user holds a specific permission before rendering UI elements:
+
+```http
+GET /api/authorization/permissions/{permissionCode}
+Authorization: Bearer <jwt>
+```
+
+**Response:**
+```json
+{ "hasPermission": true }
+```
+
+Common permission codes: `brand.view`, `stock.manage`, `ride.view`, `loading-sheet.manage`, etc.
+
+### Scope Check (optional)
+
+Check whether the user has data-access scope over a specific resource:
+
+```http
+GET /api/authorization/scopes/stores/{storeId}
+GET /api/authorization/scopes/routes/{routeId}
+GET /api/authorization/scopes/regions/{regionId}
+GET /api/authorization/scopes/stores
+```
+
+Single-resource checks (`/stores/{id}`, `/routes/{id}`, `/regions/{id}`) return:
+```json
+{ "hasScope": true }
+```
+
+`GET /api/authorization/scopes/stores` returns all store IDs the current user can access:
+```json
+{ "storeIds": ["uuid", "uuid"] }
+```
+
+---
+
 ## Pagination
 
 All list endpoints return a `PagedResponse<T>`:

distribution_fe/app/(auth)/login/page.tsx

@@ -1,14 +1,82 @@
+'use client'
+
+import { useState, useEffect, type FormEvent } from 'react'
+import { useRouter } from 'next/navigation'
+import { useAuth } from '@/contexts/auth-context'
+import { getApiError } from '@/lib/api'
+import { Input } from '@/components/ui/input'
+import { Button } from '@/components/ui/button'
+import { Label } from '@/components/ui/label'
+
 export default function LoginPage() {
+  const { login, user, loading } = useAuth()
+  const router = useRouter()
+  const [identifier, setIdentifier] = useState('')
+  const [password, setPassword] = useState('')
+  const [error, setError] = useState<string | null>(null)
+  const [submitting, setSubmitting] = useState(false)
+
+  useEffect(() => {
+    if (!loading && user) {
+      router.replace('/')
+    }
+  }, [user, loading, router])
+
+  async function handleSubmit(e: FormEvent) {
+    e.preventDefault()
+    setError(null)
+    setSubmitting(true)
+    try {
+      await login(identifier, password)
+    } catch (err) {
+      setError(getApiError(err))
+    } finally {
+      setSubmitting(false)
+    }
+  }
+
   return (
     <div className="flex min-h-svh items-center justify-center bg-background">
-      <div className="flex w-full max-w-sm flex-col gap-6 p-6">
+      <form onSubmit={handleSubmit} className="flex w-full max-w-sm flex-col gap-6 p-6">
         <div className="flex flex-col gap-1 text-center">
           <h1 className="text-2xl font-semibold text-foreground">Sign in</h1>
-          <p className="text-sm text-muted-foreground">
-            Authentication will be wired up once the backend is ready.
-          </p>
+          <p className="text-sm text-muted-foreground">Distribution ERP</p>
         </div>
-      </div>
+
+        <div className="flex flex-col gap-4">
+          <div className="flex flex-col gap-1.5">
+            <Label htmlFor="identifier">Email</Label>
+            <Input
+              id="identifier"
+              type="email"
+              autoComplete="email"
+              required
+              value={identifier}
+              onChange={(e) => setIdentifier(e.target.value)}
+            />
+          </div>
+
+          <div className="flex flex-col gap-1.5">
+            <Label htmlFor="password">Password</Label>
+            <Input
+              id="password"
+              type="password"
+              autoComplete="current-password"
+              required
+              value={password}
+              onChange={(e) => setPassword(e.target.value)}
+            />
+          </div>
+
+          {error && (
+            <p className="text-sm text-destructive">{error}</p>
+          )}
+
+          <Button type="submit" disabled={submitting} className="w-full">
+            {submitting ? 'Signing in…' : 'Sign in'}
+          </Button>
+        </div>
+      </form>
     </div>
   )
 }

distribution_fe/app/(dashboard)/_components/dashboard-client.tsx

@@ -21,6 +21,7 @@ import {
   getApiError,
   getPaginatedItems,
 } from '@/lib/api/index'
+import { useAuth } from '@/contexts/auth-context'
 import type { LowStockItemResponse, StockMovementResponse } from '@/types/api'
 
 const STORAGE_KEY = 'distribution-dashboard-widgets-v3'
@@ -38,6 +39,7 @@ interface WidgetMeta {
   cat: Category
   title: string
   size: Size
+  permission: string
 }
 
 const CATEGORY_META: Record<Category, { label: string; text: string; bg: string; solid: string }> = {
@@ -48,17 +50,17 @@ const CATEGORY_META: Record<Category, { label: string; text: string; bg: string;
 }
 
 const WIDGET_META: WidgetMeta[] = [
-  { id: 'pendingPO', cat: 'sales', title: 'Pending Shop POs', size: 'sm' },
-  { id: 'awaitingConfirm', cat: 'sales', title: 'Awaiting Confirmation', size: 'sm' },
-  { id: 'fulfillRate', cat: 'sales', title: 'Fulfillment Rate', size: 'md' },
-  { id: 'openRides', cat: 'ops', title: 'Open Rides', size: 'md' },
-  { id: 'loadingSheetsByStatus', cat: 'ops', title: 'Loading Sheets by Status', size: 'md' },
-  { id: 'deliveryTasks', cat: 'ops', title: 'Pending Delivery Tasks', size: 'sm' },
-  { id: 'lowStock', cat: 'stock', title: 'Low Stock Alerts', size: 'lg' },
-  { id: 'stockMovements', cat: 'stock', title: 'Recent Stock Movements', size: 'lg' },
-  { id: 'warehouseBalance', cat: 'stock', title: 'Warehouse Balances', size: 'md' },
-  { id: 'outstandingPay', cat: 'finance', title: 'Outstanding Payments', size: 'sm' },
-  { id: 'invoiceStatus', cat: 'finance', title: 'Invoices by Status', size: 'md' },
+  { id: 'pendingPO',            cat: 'sales',   title: 'Pending Shop POs',          size: 'sm', permission: 'orders.view' },
+  { id: 'awaitingConfirm',      cat: 'sales',   title: 'Awaiting Confirmation',      size: 'sm', permission: 'orders.view' },
+  { id: 'fulfillRate',          cat: 'sales',   title: 'Fulfillment Rate',           size: 'md', permission: 'orders.view' },
+  { id: 'openRides',            cat: 'ops',     title: 'Open Rides',                 size: 'md', permission: 'rides.view' },
+  { id: 'loadingSheetsByStatus',cat: 'ops',     title: 'Loading Sheets by Status',   size: 'md', permission: 'loading-sheet.view' },
+  { id: 'deliveryTasks',        cat: 'ops',     title: 'Pending Delivery Tasks',     size: 'sm', permission: 'delivery-task.view' },
+  { id: 'lowStock',             cat: 'stock',   title: 'Low Stock Alerts',           size: 'lg', permission: 'stock.view' },
+  { id: 'stockMovements',       cat: 'stock',   title: 'Recent Stock Movements',     size: 'lg', permission: 'stock.view' },
+  { id: 'warehouseBalance',     cat: 'stock',   title: 'Warehouse Balances',         size: 'md', permission: 'stock.view' },
+  { id: 'outstandingPay',       cat: 'finance', title: 'Outstanding Payments',       size: 'sm', permission: 'orders.view' },
+  { id: 'invoiceStatus',        cat: 'finance', title: 'Invoices by Status',         size: 'md', permission: 'orders.view' },
 ]
 
 const DEFAULT_ACTIVE = [
@@ -200,68 +202,137 @@ interface DashboardData {
   finalizedInvoiceCount: number
 }
 
-async function loadDashboardData(): Promise<DashboardData> {
-  const [
-    pendingPO, awaitingConfirm, allPO, fulfilledPO,
-    openRidesRes,
-    plannedSheets, confirmedSheets,
-    pendingTasks, partialTasks,
-    lowStock,
-    movements,
-    balances,
-    outstanding,
-    draftInv, printedInv, finalizedInv,
-  ] = await Promise.all([
-    shopPos.list({ status: 'Pending', pageSize: 1 }),
-    shopPos.list({ confirmed: true, status: 'Pending', pageSize: 1 }),
-    shopPos.list({ pageSize: 1 }),
-    shopPos.list({ status: 'Fulfilled', pageSize: 1 }),
-    rides.list({ status: 'Open', pageSize: 5 }),
-    loadingSheets.list({ status: 'Planned', pageSize: 1 }),
-    loadingSheets.list({ status: 'Confirmed', pageSize: 1 }),
-    deliveryTasks.list({ status: 'Pending', pageSize: 1 }),
-    deliveryTasks.list({ status: 'PartiallyDelivered', pageSize: 1 }),
-    stock.lowStock(),
-    stock.movements({ pageSize: 5 }),
-    stock.balances({ locationType: 'Warehouse', pageSize: 300 }),
-    invoices.outstandingSummary(),
-    invoices.list({ status: 'Draft', pageSize: 1 }),
-    invoices.list({ status: 'Printed', pageSize: 1 }),
-    invoices.list({ status: 'Finalized', pageSize: 1 }),
-  ])
-
-  const balanceRows = getPaginatedItems(balances)
-  const byWarehouse = new Map<string, WarehouseBalanceRow>()
-  for (const b of balanceRows) {
-    const existing = byWarehouse.get(b.locationId)
-    if (existing) existing.quantity += b.quantity
-    else byWarehouse.set(b.locationId, { locationId: b.locationId, name: b.locationName, quantity: b.quantity })
-  }
-  const warehouseBalances = Array.from(byWarehouse.values())
-    .sort((a, b) => b.quantity - a.quantity)
-    .slice(0, 5)
-
+function emptyDashboardData(): DashboardData {
   return {
-    pendingPOCount: pendingPO.total,
-    awaitingConfirmCount: awaitingConfirm.total,
-    totalPOCount: allPO.total,
-    fulfilledPOCount: fulfilledPO.total,
-    openRides: getPaginatedItems(openRidesRes).map(r => ({ id: r.id, vehicleNumberPlate: r.vehicleNumberPlate, driverFullName: r.driverFullName })),
-    plannedSheetsCount: plannedSheets.total,
-    confirmedSheetsCount: confirmedSheets.total,
-    pendingTasksCount: pendingTasks.total,
-    partialTasksCount: partialTasks.total,
-    lowStock: getPaginatedItems(lowStock).slice(0, 5),
-    movements: getPaginatedItems(movements),
-    warehouseBalances,
-    outstandingAmount: outstanding.outstandingAmount,
-    outstandingInvoiceCount: outstanding.invoiceCount,
-    draftInvoiceCount: draftInv.total,
-    printedInvoiceCount: printedInv.total,
-    finalizedInvoiceCount: finalizedInv.total,
+    pendingPOCount: 0, awaitingConfirmCount: 0, totalPOCount: 0, fulfilledPOCount: 0,
+    openRides: [],
+    plannedSheetsCount: 0, confirmedSheetsCount: 0,
+    pendingTasksCount: 0, partialTasksCount: 0,
+    lowStock: [], movements: [], warehouseBalances: [],
+    outstandingAmount: 0, outstandingInvoiceCount: 0,
+    draftInvoiceCount: 0, printedInvoiceCount: 0, finalizedInvoiceCount: 0,
   }
 }
 
+async function loadDashboardData(activeIds: Set<string>): Promise<DashboardData> {
+  const data = emptyDashboardData()
+  const fetches: Promise<void>[] = []
+
+  if (activeIds.has('pendingPO') || activeIds.has('awaitingConfirm') || activeIds.has('fulfillRate')) {
+    fetches.push(
+      Promise.all([
+        shopPos.list({ status: 'Pending', pageSize: 1 }),
+        shopPos.list({ confirmed: true, status: 'Pending', pageSize: 1 }),
+        shopPos.list({ pageSize: 1 }),
+        shopPos.list({ status: 'Fulfilled', pageSize: 1 }),
+      ]).then(([pending, awaiting, all, fulfilled]) => {
+        data.pendingPOCount = pending.total
+        data.awaitingConfirmCount = awaiting.total
+        data.totalPOCount = all.total
+        data.fulfilledPOCount = fulfilled.total
+      }).catch(() => {})
+    )
+  }
+
+  if (activeIds.has('openRides')) {
+    fetches.push(
+      rides.list({ status: 'Open', pageSize: 5 })
+        .then(res => {
+          data.openRides = getPaginatedItems(res).map(r => ({
+            id: r.id, vehicleNumberPlate: r.vehicleNumberPlate, driverFullName: r.driverFullName,
+          }))
+        })
+        .catch(() => {})
+    )
+  }
+
+  if (activeIds.has('loadingSheetsByStatus')) {
+    fetches.push(
+      Promise.all([
+        loadingSheets.list({ status: 'Planned', pageSize: 1 }),
+        loadingSheets.list({ status: 'Confirmed', pageSize: 1 }),
+      ]).then(([planned, confirmed]) => {
+        data.plannedSheetsCount = planned.total
+        data.confirmedSheetsCount = confirmed.total
+      }).catch(() => {})
+    )
+  }
+
+  if (activeIds.has('deliveryTasks')) {
+    fetches.push(
+      Promise.all([
+        deliveryTasks.list({ status: 'Pending', pageSize: 1 }),
+        deliveryTasks.list({ status: 'PartiallyDelivered', pageSize: 1 }),
+      ]).then(([pending, partial]) => {
+        data.pendingTasksCount = pending.total
+        data.partialTasksCount = partial.total
+      }).catch(() => {})
+    )
+  }
+
+  if (activeIds.has('lowStock')) {
+    fetches.push(
+      stock.lowStock()
+        .then(res => { data.lowStock = getPaginatedItems(res).slice(0, 5) })
+        .catch(() => {})
+    )
+  }
+
+  if (activeIds.has('stockMovements')) {
+    fetches.push(
+      stock.movements({ pageSize: 5 })
+        .then(res => { data.movements = getPaginatedItems(res) })
+        .catch(() => {})
+    )
+  }
+
+  if (activeIds.has('warehouseBalance')) {
+    fetches.push(
+      stock.balances({ locationType: 'Warehouse', pageSize: 300 })
+        .then(res => {
+          const byWarehouse = new Map<string, WarehouseBalanceRow>()
+          for (const b of getPaginatedItems(res)) {
+            const existing = byWarehouse.get(b.locationId)
+            if (existing) existing.quantity += b.quantity
+            else byWarehouse.set(b.locationId, { locationId: b.locationId, name: b.locationName, quantity: b.quantity })
+          }
+          data.warehouseBalances = Array.from(byWarehouse.values())
+            .sort((a, b) => b.quantity - a.quantity)
+            .slice(0, 5)
+        })
+        .catch(() => {})
+    )
+  }
+
+  if (activeIds.has('outstandingPay')) {
+    fetches.push(
+      invoices.outstandingSummary()
+        .then(res => {
+          data.outstandingAmount = res.outstandingAmount
+          data.outstandingInvoiceCount = res.invoiceCount
+        })
+        .catch(() => {})
+    )
+  }
+
+  if (activeIds.has('invoiceStatus')) {
+    fetches.push(
+      Promise.all([
+        invoices.list({ status: 'Draft', pageSize: 1 }),
+        invoices.list({ status: 'Printed', pageSize: 1 }),
+        invoices.list({ status: 'Finalized', pageSize: 1 }),
+      ]).then(([draft, printed, finalized]) => {
+        data.draftInvoiceCount = draft.total
+        data.printedInvoiceCount = printed.total
+        data.finalizedInvoiceCount = finalized.total
+      }).catch(() => {})
+    )
+  }
+
+  await Promise.all(fetches)
+  return data
+}
+
 function CategoryPill({ cat }: { cat: Category }) {
   const meta = CATEGORY_META[cat]
   return (
@@ -462,6 +533,7 @@ function mergeLayoutsChange(
 }
 
 export function DashboardClient() {
+  const { hasPermission } = useAuth()
   const [data, setData] = useState<DashboardData | null>(null)
   const [loading, setLoading] = useState(true)
   const [state, setState] = useState<DashboardLayoutState>(defaultLayoutState)
@@ -470,6 +542,16 @@ export function DashboardClient() {
   const [category, setCategory] = useState<'all' | Category>('all')
   const { width, containerRef, mounted } = useContainerWidth({ initialWidth: 1200 })
 
+  const allowedIds = useMemo(
+    () => new Set(WIDGET_META.filter(w => hasPermission(w.permission)).map(w => w.id)),
+    [hasPermission],
+  )
+
+  const permittedActiveIds = useMemo(
+    () => state.activeIds.filter(id => allowedIds.has(id)),
+    [state.activeIds, allowedIds],
+  )
+
   useEffect(() => {
     setState(loadStoredLayoutState())
   }, [])
@@ -486,13 +568,13 @@ export function DashboardClient() {
   const fetchData = useCallback(async () => {
     setLoading(true)
     try {
-      setData(await loadDashboardData())
+      setData(await loadDashboardData(new Set(permittedActiveIds)))
     } catch (err) {
       toast.add({ title: 'Failed to load dashboard', description: getApiError(err), type: 'error' })
     } finally {
       setLoading(false)
     }
-  }, [])
+  }, [permittedActiveIds])
 
   useEffect(() => {
     fetchData()
@@ -525,11 +607,11 @@ export function DashboardClient() {
   }
 
   const visibleWidgets = useMemo(
-    () => state.activeIds
+    () => permittedActiveIds
       .map(id => WIDGET_META.find(w => w.id === id))
       .filter((w): w is WidgetMeta => Boolean(w))
       .filter(w => category === 'all' || w.cat === category),
-    [state.activeIds, category],
+    [permittedActiveIds, category],
   )
 
   const visibleLayouts = useMemo(() => {
@@ -577,7 +659,7 @@ export function DashboardClient() {
                 </button>
               </div>
               <div className="flex flex-col gap-1">
-                {WIDGET_META.map(w => {
+                {WIDGET_META.filter(w => allowedIds.has(w.id)).map(w => {
                   const checked = state.activeIds.includes(w.id)
                   return (
                     <label

distribution_fe/app/(dashboard)/configuration/_components/grn-tax-card.tsx

@@ -120,7 +120,7 @@ export function GrnTaxCard() {
     setSettings(s => ({ ...s, [field]: value }))
     setPending(p => ({ ...p, [configKey]: true }))
     try {
-      await sysConfig.set(configKey, String(value), user.id)
+      await sysConfig.set(configKey, String(value), user?.userId)
     } catch (err) {
       setSettings(s => ({ ...s, [field]: previous }))
       toast.add({ title: 'Failed to update configuration', description: getApiError(err), type: 'error' })

distribution_fe/app/(dashboard)/configuration/_components/product-capabilities-card.tsx

@@ -92,7 +92,7 @@ export function ProductCapabilitiesCard() {
     setForm(f => ({ ...f, [formKey]: value }))
     setPendingKeys(p => ({ ...p, [configKey]: true }))
     try {
-      await sysConfig.set(configKey, String(value), user.id)
+      await sysConfig.set(configKey, String(value), user?.userId)
     } catch (err) {
       setForm(f => ({ ...f, [formKey]: previous }))
       toast.add({ title: 'Failed to update configuration', description: getApiError(err), type: 'error' })
@@ -107,7 +107,7 @@ export function ProductCapabilitiesCard() {
     if (value === previous) return
     setPendingKeys(p => ({ ...p, [ITEM_TRACKING_KEYS.defaultWarrantyPeriodDays]: true }))
     try {
-      await sysConfig.set(ITEM_TRACKING_KEYS.defaultWarrantyPeriodDays, String(value), user.id)
+      await sysConfig.set(ITEM_TRACKING_KEYS.defaultWarrantyPeriodDays, String(value), user?.userId)
     } catch (err) {
       setForm(f => ({ ...f, defaultWarrantyPeriodDays: previous }))
       toast.add({ title: 'Failed to update configuration', description: getApiError(err), type: 'error' })

distribution_fe/app/(dashboard)/network/regions/_components/region-sheet.tsx

@@ -50,7 +50,9 @@ export function RegionSheet({ open, onClose, region, readOnly = false, onSuccess
           .then((res) => {
             if (!form.getValues('code')) form.setValue('code', res.code)
           })
-          .catch(() => {})
+          .catch(() => {
+            toast.add({ title: 'Could not suggest a code — enter one manually', type: 'warning' })
+          })
       }
     }
   }, [open, region])

distribution_fe/app/(dashboard)/pricing/price-lists/new/page.tsx

@@ -39,7 +39,11 @@ export default function NewPriceListPage() {
   })
 
   useEffect(() => {
-    regionsApi.list({ pageSize: 100 }).then((res) => setRegionsList(getPaginatedItems(res))).catch(() => {})
+    regionsApi.list({ pageSize: 100 })
+      .then((res) => setRegionsList(getPaginatedItems(res)))
+      .catch(() => {
+        toast.add({ title: 'Failed to load regions', type: 'error' })
+      })
   }, [])
 
   async function onSubmit(values: FormValues) {

distribution_fe/app/(dashboard)/pricing/schemes/_components/scheme-sheet.tsx

@@ -86,7 +86,11 @@ export function SchemeSheet({ open, onClose, scheme, onSuccess }: SchemeSheetPro
 
   useEffect(() => {
     if (open) {
-      regionsApi.list({ pageSize: 100 }).then((res) => setRegionsList(getPaginatedItems(res))).catch(() => {})
+      regionsApi.list({ pageSize: 100 })
+        .then((res) => setRegionsList(getPaginatedItems(res)))
+        .catch(() => {
+          toast.add({ title: 'Failed to load regions', type: 'error' })
+        })
     }
   }, [open])
 

distribution_fe/app/(dashboard)/users/_components/user-sheet.tsx

@@ -1,110 +1,97 @@
-'use client'
+'use client'
 
-import { useEffect, useState } from 'react'
+import { useEffect } from 'react'
 import { useForm, zodResolver, z } from '@/lib/form'
 import { FormField } from '@/components/shared/form-field'
 import { Input } from '@/components/ui/input'
-import { Checkbox } from '@/components/ui/checkbox'
-import {
-  Select,
-  SelectContent,
-  SelectItem,
-  SelectTrigger,
-  SelectValue,
-} from '@/components/ui/select'
 import { Button } from '@/components/ui/button'
 import {
-  Dialog,
-  DialogContent,
-  DialogHeader,
-  DialogTitle,
-  DialogDescription,
-  DialogFooter,
+  Dialog, DialogContent, DialogHeader, DialogTitle, DialogDescription, DialogFooter,
 } from '@/components/ui/dialog'
 import { FieldGroup } from '@/components/ui/field'
+import {
+  Select, SelectContent, SelectItem, SelectTrigger, SelectValue,
+} from '@/components/ui/select'
 import { toast } from '@/components/ui/toast'
-import { users as usersApi, roles as rolesApi, getApiError } from '@/lib/api/index'
+import { users as usersApi, getApiError } from '@/lib/api/index'
 import type { UserResponse, RoleResponse } from '@/types/api'
 
 const createSchema = z.object({
-  fullName: z.string().min(1, 'Full name is required'),
-  username: z.string().min(1, 'Username is required'),
-  roleId: z.string().min(1, 'Role is required'),
+  username: z.string().email('Must be a valid email'),
   password: z.string().min(6, 'Password must be at least 6 characters'),
-  isActive: z.boolean(),
+  fullName: z.string().min(1, 'Full name is required'),
+  roleId: z.string().min(1, 'Role is required'),
+  reportsToUserId: z.string().optional(),
 })
 
 const editSchema = z.object({
   fullName: z.string().min(1, 'Full name is required'),
-  username: z.string().min(1, 'Username is required'),
   roleId: z.string().min(1, 'Role is required'),
-  isActive: z.boolean(),
 })
 
-type CreateFormValues = z.infer<typeof createSchema>
-type EditFormValues = z.infer<typeof editSchema>
+type CreateValues = z.infer<typeof createSchema>
+type EditValues = z.infer<typeof editSchema>
 
 interface UserSheetProps {
   open: boolean
   onClose: () => void
   user: UserResponse | null
+  roles: RoleResponse[]
+  users: UserResponse[]
   onSuccess: () => void
 }
 
-export function UserSheet({ open, onClose, user, onSuccess }: UserSheetProps) {
+export function UserSheet({ open, onClose, user, roles, users, onSuccess }: UserSheetProps) {
   const isEdit = !!user
-  const [roles, setRoles] = useState<RoleResponse[]>([])
 
-  const createForm = useForm<CreateFormValues>({
+  const createForm = useForm<CreateValues>({
     resolver: zodResolver(createSchema),
-    defaultValues: { fullName: '', username: '', roleId: '', password: '', isActive: true },
+    defaultValues: { username: '', password: '', fullName: '', roleId: '', reportsToUserId: '' },
   })
 
-  const editForm = useForm<EditFormValues>({
+  const editForm = useForm<EditValues>({
     resolver: zodResolver(editSchema),
-    defaultValues: { fullName: '', username: '', roleId: '', isActive: true },
+    defaultValues: { fullName: '', roleId: '' },
   })
 
-  const form = isEdit ? editForm : createForm
-
   useEffect(() => {
     if (open) {
-      rolesApi.list().then(setRoles).catch((err) =>
-        toast.add({ title: 'Failed to load roles', description: getApiError(err), type: 'error' })
-      )
-
-      if (isEdit && user) {
-        editForm.reset({
-          fullName: user.fullName,
-          username: user.username,
-          roleId: user.roleId,
-          isActive: user.isActive,
-        })
+      if (user) {
+        editForm.reset({ fullName: user.fullName, roleId: user.roleId })
       } else {
-        createForm.reset({ fullName: '', username: '', roleId: '', password: '', isActive: true })
+        createForm.reset({ username: '', password: '', fullName: '', roleId: '', reportsToUserId: '' })
       }
     }
   }, [open, user])
 
-  async function onSubmitCreate(values: CreateFormValues) {
+  async function onCreateSubmit(values: CreateValues) {
     try {
-      await usersApi.create(values)
+      await usersApi.create({
+        username: values.username,
+        password: values.password,
+        fullName: values.fullName,
+        roleId: values.roleId,
+        reportsToUserId: values.reportsToUserId || null,
+      })
       toast.add({ title: 'User created', type: 'success' })
       onSuccess()
       onClose()
     } catch (err) {
-      toast.add({ title: 'Failed to save', description: getApiError(err), type: 'error' })
+      toast.add({ title: 'Failed to create user', description: getApiError(err), type: 'error' })
     }
   }
 
-  async function onSubmitEdit(values: EditFormValues) {
+  async function onEditSubmit(values: EditValues) {
     try {
-      await usersApi.update(user!.id, values)
+      await usersApi.update(user!.id, { fullName: values.fullName })
+      if (values.roleId !== user!.roleId) {
+        await usersApi.assignRole(user!.id, values.roleId)
+      }
       toast.add({ title: 'User updated', type: 'success' })
       onSuccess()
       onClose()
     } catch (err) {
-      toast.add({ title: 'Failed to save', description: getApiError(err), type: 'error' })
+      toast.add({ title: 'Failed to update user', description: getApiError(err), type: 'error' })
     }
   }
 
@@ -114,12 +101,12 @@ export function UserSheet({ open, onClose, user, onSuccess }: UserSheetProps) {
         <DialogHeader>
           <DialogTitle>{isEdit ? 'Edit User' : 'Add User'}</DialogTitle>
           <DialogDescription>
-            {isEdit ? 'Update the user details below.' : 'Create a new staff account.'}
+            {isEdit ? 'Update user details and role.' : 'Create a new staff account.'}
           </DialogDescription>
         </DialogHeader>
 
         {isEdit ? (
-          <form onSubmit={editForm.handleSubmit(onSubmitEdit)} className="flex flex-col gap-6">
+          <form onSubmit={editForm.handleSubmit(onEditSubmit)} className="flex flex-col gap-6">
             <FieldGroup>
               <FormField
                 control={editForm.control}
@@ -134,31 +121,11 @@ export function UserSheet({ open, onClose, user, onSuccess }: UserSheetProps) {
                     value={field.value as string}
                     onChange={field.onChange}
                     onBlur={field.onBlur}
-                    placeholder="e.g. John Smith"
+                    placeholder="e.g. Nimal Perera"
                     aria-invalid={invalid}
                   />
                 )}
               />
-
-              <FormField
-                control={editForm.control}
-                name="username"
-                label="Username"
-                required
-                render={({ field, invalid }) => (
-                  <Input
-                    id="username"
-                    name={field.name}
-                    ref={field.ref}
-                    value={field.value as string}
-                    onChange={field.onChange}
-                    onBlur={field.onBlur}
-                    placeholder="e.g. john.smith"
-                    aria-invalid={invalid}
-                  />
-                )}
-              />
-
               <FormField
                 control={editForm.control}
                 name="roleId"
@@ -167,49 +134,46 @@ export function UserSheet({ open, onClose, user, onSuccess }: UserSheetProps) {
                 render={({ field }) => (
                   <Select value={field.value as string} onValueChange={field.onChange}>
                     <SelectTrigger>
-                      <SelectValue placeholder="Select a role" />
+                      <SelectValue placeholder="Select role" />
                     </SelectTrigger>
                     <SelectContent>
                       {roles.map((r) => (
-                        <SelectItem key={r.id} value={r.id}>
-                          {r.name}
-                        </SelectItem>
+                        <SelectItem key={r.id} value={r.id}>{r.name}</SelectItem>
                       ))}
                     </SelectContent>
                   </Select>
                 )}
               />
-
-              <FormField
-                control={editForm.control}
-                name="isActive"
-                render={({ field }) => (
-                  <div className="flex items-center gap-2">
-                    <Checkbox
-                      id="isActive"
-                      checked={field.value as boolean}
-                      onCheckedChange={field.onChange}
-                    />
-                    <label htmlFor="isActive" className="text-sm font-medium cursor-pointer">
-                      Active
-                    </label>
-                  </div>
-                )}
-              />
             </FieldGroup>
-
             <DialogFooter>
-              <Button type="button" variant="outline" onClick={onClose}>
-                Cancel
-              </Button>
+              <Button type="button" variant="outline" onClick={onClose}>Cancel</Button>
               <Button type="submit" disabled={editForm.formState.isSubmitting}>
                 {editForm.formState.isSubmitting ? 'Saving…' : 'Save Changes'}
               </Button>
             </DialogFooter>
           </form>
         ) : (
-          <form onSubmit={createForm.handleSubmit(onSubmitCreate)} className="flex flex-col gap-6">
+          <form onSubmit={createForm.handleSubmit(onCreateSubmit)} className="flex flex-col gap-6">
             <FieldGroup>
+              <FormField
+                control={createForm.control}
+                name="username"
+                label="Email"
+                required
+                render={({ field, invalid }) => (
+                  <Input
+                    id="username"
+                    type="email"
+                    name={field.name}
+                    ref={field.ref}
+                    value={field.value as string}
+                    onChange={field.onChange}
+                    onBlur={field.onBlur}
+                    placeholder="e.g. nimal.perera@company.com"
+                    aria-invalid={invalid}
+                  />
+                )}
+              />
               <FormField
                 control={createForm.control}
                 name="fullName"
@@ -223,52 +187,11 @@ export function UserSheet({ open, onClose, user, onSuccess }: UserSheetProps) {
                     value={field.value as string}
                     onChange={field.onChange}
                     onBlur={field.onBlur}
-                    placeholder="e.g. John Smith"
+                    placeholder="e.g. Nimal Perera"
                     aria-invalid={invalid}
                   />
                 )}
               />
-
-              <FormField
-                control={createForm.control}
-                name="username"
-                label="Username"
-                required
-                render={({ field, invalid }) => (
-                  <Input
-                    id="username"
-                    name={field.name}
-                    ref={field.ref}
-                    value={field.value as string}
-                    onChange={field.onChange}
-                    onBlur={field.onBlur}
-                    placeholder="e.g. john.smith"
-                    aria-invalid={invalid}
-                  />
-                )}
-              />
-
-              <FormField
-                control={createForm.control}
-                name="roleId"
-                label="Role"
-                required
-                render={({ field }) => (
-                  <Select value={field.value as string} onValueChange={field.onChange}>
-                    <SelectTrigger>
-                      <SelectValue placeholder="Select a role" />
-                    </SelectTrigger>
-                    <SelectContent>
-                      {roles.map((r) => (
-                        <SelectItem key={r.id} value={r.id}>
-                          {r.name}
-                        </SelectItem>
-                      ))}
-                    </SelectContent>
-                  </Select>
-                )}
-              />
-
               <FormField
                 control={createForm.control}
                 name="password"
@@ -277,42 +200,57 @@ export function UserSheet({ open, onClose, user, onSuccess }: UserSheetProps) {
                 render={({ field, invalid }) => (
                   <Input
                     id="password"
+                    type="password"
                     name={field.name}
                     ref={field.ref}
-                    type="password"
                     value={field.value as string}
                     onChange={field.onChange}
                     onBlur={field.onBlur}
-                    placeholder="Min. 6 characters"
                     aria-invalid={invalid}
                   />
                 )}
               />
-
               <FormField
                 control={createForm.control}
-                name="isActive"
+                name="roleId"
+                label="Role"
+                required
                 render={({ field }) => (
-                  <div className="flex items-center gap-2">
-                    <Checkbox
-                      id="isActive"
-                      checked={field.value as boolean}
-                      onCheckedChange={field.onChange}
-                    />
-                    <label htmlFor="isActive" className="text-sm font-medium cursor-pointer">
-                      Active
-                    </label>
-                  </div>
+                  <Select value={field.value as string} onValueChange={field.onChange}>
+                    <SelectTrigger>
+                      <SelectValue placeholder="Select role" />
+                    </SelectTrigger>
+                    <SelectContent>
+                      {roles.map((r) => (
+                        <SelectItem key={r.id} value={r.id}>{r.name}</SelectItem>
+                      ))}
+                    </SelectContent>
+                  </Select>
+                )}
+              />
+              <FormField
+                control={createForm.control}
+                name="reportsToUserId"
+                label="Reports To"
+                render={({ field }) => (
+                  <Select value={field.value as string} onValueChange={field.onChange}>
+                    <SelectTrigger>
+                      <SelectValue placeholder="None" />
+                    </SelectTrigger>
+                    <SelectContent>
+                      <SelectItem value="">None</SelectItem>
+                      {users.map((u) => (
+                        <SelectItem key={u.id} value={u.id}>{u.fullName}</SelectItem>
+                      ))}
+                    </SelectContent>
+                  </Select>
                 )}
               />
             </FieldGroup>
-
             <DialogFooter>
-              <Button type="button" variant="outline" onClick={onClose}>
-                Cancel
-              </Button>
+              <Button type="button" variant="outline" onClick={onClose}>Cancel</Button>
               <Button type="submit" disabled={createForm.formState.isSubmitting}>
-                {createForm.formState.isSubmitting ? 'Saving…' : 'Create User'}
+                {createForm.formState.isSubmitting ? 'Creating…' : 'Create User'}
               </Button>
             </DialogFooter>
           </form>

distribution_fe/app/(dashboard)/users/_components/user-view-sheet.tsx

@@ -0,0 +1,49 @@
+'use client'
+
+import { Badge } from '@/components/ui/badge'
+import { Dialog, DialogContent, DialogHeader, DialogTitle } from '@/components/ui/dialog'
+import type { UserResponse } from '@/types/api'
+
+const fmtDate = (v: string) =>
+  new Date(v).toLocaleDateString('en-GB', { day: '2-digit', month: 'short', year: 'numeric' })
+
+function Row({ label, value }: { label: string; value: React.ReactNode }) {
+  return (
+    <div className="flex items-center justify-between py-2 text-sm border-b last:border-0">
+      <span className="text-muted-foreground">{label}</span>
+      <span className="font-medium text-right">{value}</span>
+    </div>
+  )
+}
+
+interface UserViewSheetProps {
+  open: boolean
+  onClose: () => void
+  user: UserResponse | null
+}
+
+export function UserViewSheet({ open, onClose, user }: UserViewSheetProps) {
+  if (!user) return null
+
+  return (
+    <Dialog open={open} onOpenChange={(v) => !v && onClose()}>
+      <DialogContent className="overflow-y-auto sm:max-w-lg">
+        <DialogHeader>
+          <DialogTitle>User Details</DialogTitle>
+        </DialogHeader>
+        <div className="flex flex-col">
+          <Row label="Username" value={user.username} />
+          <Row label="Full Name" value={user.fullName} />
+          <Row label="Role" value={user.roleName} />
+          <Row label="Status" value={
+            <Badge variant={user.isActive ? 'default' : 'secondary'}>
+              {user.isActive ? 'Active' : 'Inactive'}
+            </Badge>
+          } />
+          <Row label="Created" value={fmtDate(user.createdAt)} />
+          {user.updatedAt && <Row label="Updated" value={fmtDate(user.updatedAt)} />}
+        </div>
+      </DialogContent>
+    </Dialog>
+  )
+}

distribution_fe/app/(dashboard)/users/_components/users-client.tsx

@@ -1,4 +1,4 @@
-'use client'
+'use client'
 
 import { useState, useEffect, useCallback, useMemo } from 'react'
 import { HugeiconsIcon } from '@hugeicons/react'
@@ -8,28 +8,37 @@ import { DataTable } from '@/components/shared/data-table'
 import type { TableConfig } from '@/components/shared/data-table'
 import { Badge } from '@/components/ui/badge'
 import { Button } from '@/components/ui/button'
+import {
+  Dialog, DialogContent, DialogHeader, DialogTitle, DialogDescription, DialogFooter,
+} from '@/components/ui/dialog'
 import { toast } from '@/components/ui/toast'
-import { users as usersApi, getApiError, getPaginatedItems } from '@/lib/api/index'
-import type { UserResponse } from '@/types/api'
+import { users as usersApi, roles as rolesApi, getApiError } from '@/lib/api/index'
+import type { UserResponse, RoleResponse } from '@/types/api'
 
 import { UserSheet } from './user-sheet'
+import { UserViewSheet } from './user-view-sheet'
 
 export function UsersClient() {
   const [data, setData] = useState<UserResponse[]>([])
+  const [rolesList, setRolesList] = useState<RoleResponse[]>([])
   const [loading, setLoading] = useState(true)
   const [total, setTotal] = useState(0)
-  const [page, setPage] = useState(1)
   const [pageSize, setPageSize] = useState(20)
 
   const [sheetOpen, setSheetOpen] = useState(false)
   const [editing, setEditing] = useState<UserResponse | null>(null)
+  const [viewOpen, setViewOpen] = useState(false)
+  const [viewing, setViewing] = useState<UserResponse | null>(null)
+  const [confirmTarget, setConfirmTarget] = useState<UserResponse | null>(null)
+  const [deactivating, setDeactivating] = useState(false)
 
-  const fetchData = useCallback(async (p: number, ps: number) => {
+  const fetchData = useCallback(async () => {
     setLoading(true)
     try {
-      const res = await usersApi.list({ page: p, pageSize: ps })
-      setData(getPaginatedItems(res))
-      setTotal(res.total)
+      const [items, roles] = await Promise.all([usersApi.list(), rolesApi.list()])
+      setData(items)
+      setTotal(items.length)
+      setRolesList(roles)
     } catch (err) {
       toast.add({ title: 'Failed to load users', description: getApiError(err), type: 'error' })
     } finally {
@@ -37,54 +46,48 @@ export function UsersClient() {
     }
   }, [])
 
-  useEffect(() => {
-    fetchData(page, pageSize)
-  }, [fetchData, page, pageSize])
+  useEffect(() => { fetchData() }, [fetchData])
 
-  function openCreate() {
-    setEditing(null)
-    setSheetOpen(true)
-  }
+  function openCreate() { setEditing(null); setSheetOpen(true) }
+  function openEdit(user: UserResponse) { setEditing(user); setSheetOpen(true) }
+  function openView(user: UserResponse) { setViewing(user); setViewOpen(true) }
 
-  function openEdit(user: UserResponse) {
-    setEditing(user)
-    setSheetOpen(true)
-  }
-
-  async function toggleActive(user: UserResponse) {
+  async function confirmDeactivate() {
+    if (!confirmTarget) return
+    setDeactivating(true)
     try {
-      await usersApi.update(user.id, { isActive: !user.isActive })
-      toast.add({
-        title: user.isActive ? 'User deactivated' : 'User activated',
-        type: 'success',
-      })
-      fetchData(page, pageSize)
+      await usersApi.deactivate(confirmTarget.id)
+      toast.add({ title: 'User deactivated', type: 'success' })
+      setConfirmTarget(null)
+      fetchData()
     } catch (err) {
-      toast.add({ title: 'Failed to update user', description: getApiError(err), type: 'error' })
+      toast.add({ title: 'Failed to deactivate user', description: getApiError(err), type: 'error' })
+    } finally {
+      setDeactivating(false)
     }
   }
 
   const tableConfig = useMemo<TableConfig<UserResponse>>(() => ({
     rowKey: 'id',
-    serverSide: true,
     stickyHeader: true,
     emptyMessage: 'No users yet. Add one to get started.',
     pagination: { enabled: true, pageSize, pageSizeOptions: [10, 20, 50] },
     columns: [
       {
-        key: 'fullName',
-        title: 'Name',
-        fields: ['fullName', 'username'],
-        minWidth: 200,
-        cellRender: (row) => (
-          <div className="flex flex-col">
-            <span className="text-sm font-medium">{row.fullName}</span>
-            <span className="text-xs text-muted-foreground">{row.username}</span>
-          </div>
-        ),
+        key: 'username',
+        title: 'Username',
+        fields: [{ key: 'username', primary: true }],
+        sortable: true,
+        minWidth: 160,
       },
       {
-        key: 'roleName',
+        key: 'fullName',
+        title: 'Full Name',
+        fields: [{ key: 'fullName' }],
+        minWidth: 180,
+      },
+      {
+        key: 'role',
         title: 'Role',
         fields: [{ key: 'roleName' }],
         minWidth: 140,
@@ -93,45 +96,35 @@ export function UsersClient() {
         key: 'status',
         title: 'Status',
         fields: ['isActive'],
-        width: 120,
+        width: 100,
         cellRender: (row) => (
           <Badge variant={row.isActive ? 'default' : 'secondary'}>
             {row.isActive ? 'Active' : 'Inactive'}
           </Badge>
         ),
       },
+      {
+        key: 'createdAt',
+        title: 'Created',
+        fields: [{ key: 'createdAt', transform: (v) => new Date(v as string).toLocaleDateString('en-GB', { day: '2-digit', month: 'short', year: 'numeric' }) }],
+        width: 140,
+      },
     ],
     rowActions: {
       actions: () => [
-        {
-          action: 'edit',
-          label: 'Edit user',
-          onClick: openEdit,
-        },
-        {
-          action: 'deactivate',
-          label: 'Deactivate user',
-          onClick: toggleActive,
-          visible: (target) => target.isActive,
-        },
-        {
-          action: 'activate',
-          label: 'Activate user',
-          onClick: toggleActive,
-          visible: (target) => !target.isActive,
-        },
+        { action: 'view', label: 'View user', onClick: openView },
+        { action: 'edit', label: 'Edit user', onClick: openEdit },
+        { action: 'cancel', label: 'Deactivate user', onClick: (u) => setConfirmTarget(u), visible: (t) => t.isActive },
       ],
     },
-  }), [pageSize, openEdit, toggleActive])
+  }), [pageSize])
 
   return (
     <>
       <div className="flex items-center justify-between">
         <div>
           <h1 className="text-2xl font-semibold text-foreground">Users</h1>
-          <p className="text-sm text-muted-foreground mt-0.5">
-            Staff accounts and their role assignments
-          </p>
+          <p className="text-sm text-muted-foreground mt-0.5">Staff accounts and their role assignments</p>
         </div>
         <Button onClick={openCreate}>
           <HugeiconsIcon icon={Add01Icon} size={16} />
@@ -144,18 +137,43 @@ export function UsersClient() {
         data={data}
         loading={loading}
         totalCount={total}
-        onServerSideChange={({ page: p }) => {
-          setPage(p.page)
-          setPageSize(p.pageSize)
-        }}
+        onServerSideChange={({ page: p }) => setPageSize(p.pageSize)}
       />
 
       <UserSheet
         open={sheetOpen}
         onClose={() => setSheetOpen(false)}
         user={editing}
-        onSuccess={() => fetchData(page, pageSize)}
+        roles={rolesList}
+        users={data}
+        onSuccess={() => fetchData()}
       />
+
+      <UserViewSheet
+        open={viewOpen}
+        onClose={() => setViewOpen(false)}
+        user={viewing}
+      />
+
+      <Dialog open={!!confirmTarget} onOpenChange={(v) => !v && setConfirmTarget(null)}>
+        <DialogContent className="sm:max-w-sm">
+          <DialogHeader>
+            <DialogTitle>Deactivate user?</DialogTitle>
+            <DialogDescription>
+              <span className="font-medium text-foreground">{confirmTarget?.fullName}</span>
+              {' '}({confirmTarget?.username}) will lose access immediately. This cannot be undone from here.
+            </DialogDescription>
+          </DialogHeader>
+          <DialogFooter>
+            <Button variant="outline" onClick={() => setConfirmTarget(null)} disabled={deactivating}>
+              Cancel
+            </Button>
+            <Button variant="destructive" onClick={confirmDeactivate} disabled={deactivating}>
+              {deactivating ? 'Deactivating…' : 'Deactivate'}
+            </Button>
+          </DialogFooter>
+        </DialogContent>
+      </Dialog>
     </>
   )
 }

distribution_fe/app/(dashboard)/users/page.tsx

@@ -1,4 +1,4 @@
-import { UsersClient } from './_components/users-client'
+import { UsersClient } from './_components/users-client'
 
 export default function UsersPage() {
   return <UsersClient />

distribution_fe/app/(dashboard)/users/roles/_components/role-sheet.tsx

@@ -1,28 +1,36 @@
-'use client'
+'use client'
 
-import { useEffect } from 'react'
+import { useEffect, useState } from 'react'
 import { useForm, zodResolver, z } from '@/lib/form'
 import { FormField } from '@/components/shared/form-field'
 import { Input } from '@/components/ui/input'
 import { Checkbox } from '@/components/ui/checkbox'
+import {
+  Select, SelectContent, SelectItem, SelectTrigger, SelectValue,
+} from '@/components/ui/select'
 import { Button } from '@/components/ui/button'
 import {
-  Dialog,
-  DialogContent,
-  DialogHeader,
-  DialogTitle,
-  DialogDescription,
-  DialogFooter,
+  Dialog, DialogContent, DialogHeader, DialogTitle, DialogDescription, DialogFooter,
 } from '@/components/ui/dialog'
 import { FieldGroup } from '@/components/ui/field'
 import { toast } from '@/components/ui/toast'
-import { roles as rolesApi, getApiError } from '@/lib/api/index'
-import type { RoleResponse } from '@/types/api'
+import { roles as rolesApi, permissions as permissionsApi, getApiError } from '@/lib/api/index'
+import type { RoleResponse, PermissionResponse } from '@/types/api'
+import { PERMISSION_CATEGORIES } from '@/config/permissions'
+
+const ROLE_LEVELS: { value: number; label: string; description: string }[] = [
+  { value: 10,  label: 'Level 10 — Field Agent',       description: 'Front-line sales rep; can place orders and check in to visits' },
+  { value: 20,  label: 'Level 20 — Supervisor',        description: 'Oversees agents; can approve variances and update store credit limits' },
+  { value: 30,  label: 'Level 30 — Area Manager',      description: 'Manages a group of supervisors within an area' },
+  { value: 40,  label: 'Level 40 — Area Supervisor',   description: 'Senior oversight across multiple areas' },
+  { value: 50,  label: 'Level 50 — Regional Manager',  description: 'Controls region targets, budgets and route assignments' },
+  { value: 60,  label: 'Level 60 — Regional Agency',   description: 'Agency-level access across any region; broader scope than Regional Manager' },
+  { value: 100, label: 'Level 100 — Super Admin',      description: 'Full system access; all permissions granted' },
+]
 
 const schema = z.object({
   name: z.string().min(1, 'Name is required'),
-  level: z.number().int().min(1, 'Level must be at least 1'),
-  isActive: z.boolean(),
+  level: z.string().min(1, 'Level is required'),
 })
 
 type FormValues = z.infer<typeof schema>
@@ -37,44 +45,64 @@ interface RoleSheetProps {
 export function RoleSheet({ open, onClose, role, onSuccess }: RoleSheetProps) {
   const isEdit = !!role
 
+  const [allPermissions, setAllPermissions] = useState<PermissionResponse[]>([])
+  const [selectedIds, setSelectedIds] = useState<Set<string>>(new Set())
+
   const form = useForm<FormValues>({
     resolver: zodResolver(schema),
-    defaultValues: { name: '', level: 1, isActive: true },
+    defaultValues: { name: '', level: '' },
   })
 
   useEffect(() => {
-    if (open) {
-      form.reset(
-        role
-          ? { name: role.name, level: role.level, isActive: role.isActive }
-          : { name: '', level: 1, isActive: true }
-      )
+    if (!open) return
+    permissionsApi.list().then(setAllPermissions).catch(() => {})
+    if (role) {
+      form.reset({ name: role.name, level: String(role.level) })
+      rolesApi.getPermissions(role.id)
+        .then((perms) => setSelectedIds(new Set(perms.map((p) => p.permissionId))))
+        .catch(() => {})
+    } else {
+      form.reset({ name: '', level: '' })
+      setSelectedIds(new Set())
     }
   }, [open, role])
 
+  function togglePermission(id: string) {
+    setSelectedIds((prev) => {
+      const next = new Set(prev)
+      next.has(id) ? next.delete(id) : next.add(id)
+      return next
+    })
+  }
+
   async function onSubmit(values: FormValues) {
+    const body = { name: values.name, level: parseInt(values.level, 10) }
     try {
+      let roleId: string
       if (isEdit) {
-        await rolesApi.update(role!.id, values)
+        await rolesApi.update(role!.id, body)
+        roleId = role!.id
         toast.add({ title: 'Role updated', type: 'success' })
       } else {
-        await rolesApi.create(values)
+        const created = await rolesApi.create(body)
+        roleId = created.id
         toast.add({ title: 'Role created', type: 'success' })
       }
+      await rolesApi.assignPermissions(roleId, Array.from(selectedIds))
       onSuccess()
       onClose()
     } catch (err) {
-      toast.add({ title: 'Failed to save', description: getApiError(err), type: 'error' })
+      toast.add({ title: 'Failed to save role', description: getApiError(err), type: 'error' })
     }
   }
 
   return (
     <Dialog open={open} onOpenChange={(v) => !v && onClose()}>
-      <DialogContent className="overflow-y-auto sm:max-w-lg">
+      <DialogContent className="overflow-y-auto sm:max-w-3xl">
         <DialogHeader>
           <DialogTitle>{isEdit ? 'Edit Role' : 'Add Role'}</DialogTitle>
           <DialogDescription>
-            {isEdit ? 'Update the role details below.' : 'Add a new role to the system.'}
+            {isEdit ? 'Update role details and permissions.' : 'Create a new role and assign permissions.'}
           </DialogDescription>
         </DialogHeader>
 
@@ -93,54 +121,91 @@ export function RoleSheet({ open, onClose, role, onSuccess }: RoleSheetProps) {
                   value={field.value as string}
                   onChange={field.onChange}
                   onBlur={field.onBlur}
-                  placeholder="e.g. Sales Manager"
+                  placeholder="e.g. Sales Rep"
                   aria-invalid={invalid}
                 />
               )}
             />
-
             <FormField
               control={form.control}
               name="level"
               label="Level"
               required
-              render={({ field, invalid }) => (
-                <Input
-                  id="level"
-                  name={field.name}
-                  ref={field.ref}
-                  type="number"
-                  value={String(field.value as number)}
-                  onChange={(e) => field.onChange(parseInt(e.target.value) || 1)}
-                  onBlur={field.onBlur}
-                  placeholder="e.g. 1"
-                  aria-invalid={invalid}
-                />
-              )}
-            />
-
-            <FormField
-              control={form.control}
-              name="isActive"
               render={({ field }) => (
-                <div className="flex items-center gap-2">
-                  <Checkbox
-                    id="isActive"
-                    checked={field.value as boolean}
-                    onCheckedChange={field.onChange}
-                  />
-                  <label htmlFor="isActive" className="text-sm font-medium cursor-pointer">
-                    Active
-                  </label>
-                </div>
+                <Select value={field.value as string} onValueChange={field.onChange}>
+                  <SelectTrigger>
+                    <SelectValue placeholder="Select level" />
+                  </SelectTrigger>
+                  <SelectContent>
+                    {ROLE_LEVELS.map((l) => (
+                      <SelectItem key={l.value} value={String(l.value)}>
+                        <div className="flex flex-col">
+                          <span className="font-medium">{l.label}</span>
+                          <span className="text-xs text-muted-foreground">{l.description}</span>
+                        </div>
+                      </SelectItem>
+                    ))}
+                  </SelectContent>
+                </Select>
               )}
             />
           </FieldGroup>
 
+          {allPermissions.length > 0 && (
+            <div className="flex flex-col gap-2">
+              <p className="text-sm font-medium">Permissions</p>
+              <div className="border rounded-md max-h-[28rem] overflow-y-auto p-3">
+                <div className="grid grid-cols-2 gap-3">
+                  {PERMISSION_CATEGORIES.map((cat) => {
+                    const catPerms = allPermissions.filter((p) => cat.codes.includes(p.code))
+                    if (catPerms.length === 0) return null
+                    const allChecked = catPerms.every((p) => selectedIds.has(p.permissionId))
+                    const someChecked = catPerms.some((p) => selectedIds.has(p.permissionId))
+                    return (
+                      <div key={cat.id} className="rounded-md border bg-muted/30 p-3 flex flex-col gap-2">
+                        <div className="flex items-center gap-2">
+                          <Checkbox
+                            id={`cat-${cat.id}`}
+                            checked={allChecked}
+                            data-state={someChecked && !allChecked ? 'indeterminate' : undefined}
+                            onCheckedChange={(checked) => {
+                              setSelectedIds((prev) => {
+                                const next = new Set(prev)
+                                catPerms.forEach((p) => checked ? next.add(p.permissionId) : next.delete(p.permissionId))
+                                return next
+                              })
+                            }}
+                          />
+                          <label htmlFor={`cat-${cat.id}`} className="text-xs font-semibold uppercase tracking-wide text-muted-foreground cursor-pointer select-none">
+                            {cat.label}
+                          </label>
+                        </div>
+                        <div className="flex flex-col gap-1.5 pl-6">
+                          {catPerms.map((p) => (
+                            <div key={p.permissionId} className="flex items-start gap-2">
+                              <Checkbox
+                                id={p.permissionId}
+                                checked={selectedIds.has(p.permissionId)}
+                                onCheckedChange={() => togglePermission(p.permissionId)}
+                                className="mt-0.5"
+                              />
+                              <label htmlFor={p.permissionId} className="text-sm cursor-pointer flex flex-col">
+                                <span className="font-medium">{p.code}</span>
+                                {p.description && <span className="text-muted-foreground text-xs">{p.description}</span>}
+                              </label>
+                            </div>
+                          ))}
+                        </div>
+                      </div>
+                    )
+                  })}
+                </div>
+              </div>
+            </div>
+          )}
+
           <DialogFooter>
-            <Button type="button" variant="outline" onClick={onClose}>
-              Cancel
-            </Button>
+            <Button type="button" variant="outline" onClick={onClose}>Cancel</Button>
             <Button type="submit" disabled={form.formState.isSubmitting}>
               {form.formState.isSubmitting ? 'Saving…' : isEdit ? 'Save Changes' : 'Create Role'}
             </Button>

distribution_fe/app/(dashboard)/users/roles/_components/role-view-sheet.tsx

@@ -0,0 +1,77 @@
+'use client'
+
+import { useEffect, useState } from 'react'
+import { Badge } from '@/components/ui/badge'
+import { Dialog, DialogContent, DialogHeader, DialogTitle } from '@/components/ui/dialog'
+import { toast } from '@/components/ui/toast'
+import { roles as rolesApi, getApiError } from '@/lib/api/index'
+import type { RoleResponse, PermissionResponse } from '@/types/api'
+
+const fmtDate = (v: string) =>
+  new Date(v).toLocaleDateString('en-GB', { day: '2-digit', month: 'short', year: 'numeric' })
+
+interface RoleViewSheetProps {
+  open: boolean
+  onClose: () => void
+  role: RoleResponse | null
+}
+
+function Row({ label, value }: { label: string; value: React.ReactNode }) {
+  return (
+    <div className="flex items-center justify-between border-b py-2 text-sm last:border-0">
+      <span className="text-muted-foreground">{label}</span>
+      <span className="font-medium text-right">{value}</span>
+    </div>
+  )
+}
+
+export function RoleViewSheet({ open, onClose, role }: RoleViewSheetProps) {
+  const [permissions, setPermissions] = useState<PermissionResponse[]>([])
+  const [loading, setLoading] = useState(false)
+
+  useEffect(() => {
+    if (!open || !role) return
+    setLoading(true)
+    rolesApi.getPermissions(role.id)
+      .then(setPermissions)
+      .catch((err) => toast.add({ title: 'Failed to load permissions', description: getApiError(err), type: 'error' }))
+      .finally(() => setLoading(false))
+  }, [open, role])
+
+  if (!role) return null
+
+  return (
+    <Dialog open={open} onOpenChange={(v) => !v && onClose()}>
+      <DialogContent className="overflow-y-auto sm:max-w-lg">
+        <DialogHeader>
+          <DialogTitle>Role Details</DialogTitle>
+        </DialogHeader>
+
+        <div className="flex flex-col">
+          <Row label="Name" value={role.name} />
+          <Row label="Level" value={role.level} />
+          <Row label="Status" value={<Badge variant={role.isActive ? 'default' : 'secondary'}>{role.isActive ? 'Active' : 'Inactive'}</Badge>} />
+          <Row label="Created At" value={fmtDate(role.createdAt)} />
+        </div>
+
+        <div className="mt-2 flex flex-col gap-2">
+          <p className="text-sm font-medium">Permissions</p>
+          {loading ? (
+            <p className="text-sm text-muted-foreground">Loading…</p>
+          ) : permissions.length === 0 ? (
+            <p className="text-sm text-muted-foreground">No permissions assigned to this role.</p>
+          ) : (
+            <div className="max-h-64 overflow-y-auto rounded-md border p-3 flex flex-col gap-2">
+              {permissions.map((p) => (
+                <div key={p.permissionId} className="flex flex-col">
+                  <span className="text-sm font-medium">{p.code}</span>
+                  {p.description && <span className="text-xs text-muted-foreground">{p.description}</span>}
+                </div>
+              ))}
+            </div>
+          )}
+        </div>
+      </DialogContent>
+    </Dialog>
+  )
+}

distribution_fe/app/(dashboard)/users/roles/_components/roles-client.tsx

@@ -1,4 +1,4 @@
-'use client'
+'use client'
 
 import { useState, useEffect, useCallback, useMemo } from 'react'
 import { HugeiconsIcon } from '@hugeicons/react'
@@ -13,21 +13,25 @@ import { roles as rolesApi, getApiError } from '@/lib/api/index'
 import type { RoleResponse } from '@/types/api'
 
 import { RoleSheet } from './role-sheet'
+import { RoleViewSheet } from './role-view-sheet'
 
 export function RolesClient() {
   const [data, setData] = useState<RoleResponse[]>([])
   const [loading, setLoading] = useState(true)
   const [total, setTotal] = useState(0)
+  const [pageSize, setPageSize] = useState(20)
 
   const [sheetOpen, setSheetOpen] = useState(false)
   const [editing, setEditing] = useState<RoleResponse | null>(null)
+  const [viewOpen, setViewOpen] = useState(false)
+  const [viewing, setViewing] = useState<RoleResponse | null>(null)
 
   const fetchData = useCallback(async () => {
     setLoading(true)
     try {
-      const res = await rolesApi.list()
-      setData(res)
-      setTotal(res.length)
+      const items = await rolesApi.list()
+      setData(items)
+      setTotal(items.length)
     } catch (err) {
       toast.add({ title: 'Failed to load roles', description: getApiError(err), type: 'error' })
     } finally {
@@ -35,30 +39,19 @@ export function RolesClient() {
     }
   }, [])
 
-  useEffect(() => {
-    fetchData()
-  }, [fetchData])
+  useEffect(() => { fetchData() }, [fetchData])
 
-  function openCreate() {
-    setEditing(null)
-    setSheetOpen(true)
-  }
+  function openCreate() { setEditing(null); setSheetOpen(true) }
+  function openEdit(role: RoleResponse) { setEditing(role); setSheetOpen(true) }
+  function openView(role: RoleResponse) { setViewing(role); setViewOpen(true) }
 
-  function openEdit(role: RoleResponse) {
-    setEditing(role)
-    setSheetOpen(true)
-  }
-
-  async function toggleActive(role: RoleResponse) {
+  async function handleDeactivate(role: RoleResponse) {
     try {
-      await rolesApi.update(role.id, { isActive: !role.isActive })
-      toast.add({
-        title: role.isActive ? 'Role deactivated' : 'Role activated',
-        type: 'success',
-      })
+      await rolesApi.deactivate(role.id)
+      toast.add({ title: 'Role deactivated', type: 'success' })
       fetchData()
     } catch (err) {
-      toast.add({ title: 'Failed to update role', description: getApiError(err), type: 'error' })
+      toast.add({ title: 'Failed to deactivate role', description: getApiError(err), type: 'error' })
     }
   }
 
@@ -66,64 +59,54 @@ export function RolesClient() {
     rowKey: 'id',
     stickyHeader: true,
     emptyMessage: 'No roles yet. Add one to get started.',
-    pagination: { enabled: true, pageSize: 20, pageSizeOptions: [10, 20, 50] },
+    pagination: { enabled: true, pageSize, pageSizeOptions: [10, 20, 50] },
     columns: [
       {
         key: 'name',
-        title: 'Role',
+        title: 'Role Name',
         fields: [{ key: 'name', primary: true }],
         sortable: true,
-        minWidth: 200,
+        minWidth: 180,
       },
       {
         key: 'level',
         title: 'Level',
-        fields: [{ key: 'level', transform: (v) => `Level ${v}` }],
+        fields: [{ key: 'level' }],
         width: 100,
       },
       {
         key: 'status',
         title: 'Status',
         fields: ['isActive'],
-        width: 120,
+        width: 100,
         cellRender: (row) => (
           <Badge variant={row.isActive ? 'default' : 'secondary'}>
             {row.isActive ? 'Active' : 'Inactive'}
           </Badge>
         ),
       },
+      {
+        key: 'createdAt',
+        title: 'Created',
+        fields: [{ key: 'createdAt', transform: (v) => new Date(v as string).toLocaleDateString('en-GB', { day: '2-digit', month: 'short', year: 'numeric' }) }],
+        width: 140,
+      },
     ],
     rowActions: {
       actions: () => [
-        {
-          action: 'edit',
-          label: 'Edit role',
-          onClick: openEdit,
-        },
-        {
-          action: 'deactivate',
-          label: 'Deactivate role',
-          onClick: toggleActive,
-          visible: (target) => target.isActive,
-        },
-        {
-          action: 'activate',
-          label: 'Activate role',
-          onClick: toggleActive,
-          visible: (target) => !target.isActive,
-        },
+        { action: 'view', label: 'View role & permissions', onClick: openView },
+        { action: 'edit', label: 'Edit role', onClick: openEdit },
+        { action: 'cancel', label: 'Deactivate role', onClick: handleDeactivate, visible: (t) => t.isActive },
       ],
     },
-  }), [openEdit, toggleActive])
+  }), [pageSize])
 
   return (
     <>
       <div className="flex items-center justify-between">
         <div>
           <h1 className="text-2xl font-semibold text-foreground">Roles</h1>
-          <p className="text-sm text-muted-foreground mt-0.5">
-            Permission sets that control what each role can see and do
-          </p>
+          <p className="text-sm text-muted-foreground mt-0.5">Permission sets that control what each role can see and do</p>
         </div>
         <Button onClick={openCreate}>
           <HugeiconsIcon icon={Add01Icon} size={16} />
@@ -136,6 +119,7 @@ export function RolesClient() {
         data={data}
         loading={loading}
         totalCount={total}
+        onServerSideChange={({ page: p }) => setPageSize(p.pageSize)}
       />
 
       <RoleSheet
@@ -144,6 +128,12 @@ export function RolesClient() {
         role={editing}
         onSuccess={() => fetchData()}
       />
+
+      <RoleViewSheet
+        open={viewOpen}
+        onClose={() => setViewOpen(false)}
+        role={viewing}
+      />
     </>
   )
 }

distribution_fe/app/(dashboard)/users/roles/page.tsx

@@ -1,4 +1,4 @@
-import { RolesClient } from './_components/roles-client'
+import { RolesClient } from './_components/roles-client'
 
 export default function RolesPage() {
   return <RolesClient />

distribution_fe/components/layout/app-sidebar.tsx

@@ -25,32 +25,26 @@ import {
   CollapsibleContent,
   CollapsibleTrigger,
 } from '@/components/ui/collapsible'
-import {
-  Select,
-  SelectContent,
-  SelectItem,
-  SelectTrigger,
-  SelectValue,
-} from '@/components/ui/select'
 import {
   Tooltip,
   TooltipContent,
   TooltipTrigger,
 } from '@/components/ui/tooltip'
-import { useAuth, type Role } from '@/contexts/auth-context'
+import { Button } from '@/components/ui/button'
+import { useAuth } from '@/contexts/auth-context'
 import { DASHBOARD_ITEM, CONFIGURATION_ITEM, NAV_GROUPS, type NavGroup, type NavItem } from '@/config/nav'
 
-function canSee(item: NavItem, permissions: string[]): boolean {
+function canSee(item: NavItem, permissions: Set<string>): boolean {
   if (!item.permission) return true
-  return permissions.includes('*') || permissions.includes(item.permission)
+  return permissions.has(item.permission)
 }
 
-function isGroupVisible(group: NavGroup, permissions: string[]): boolean {
+function isGroupVisible(group: NavGroup, permissions: Set<string>): boolean {
   return group.items.some((item) => canSee(item, permissions))
 }
 
 export function AppSidebar() {
-  const { user, setRole, permissions } = useAuth()
+  const { user, permissions, logout } = useAuth()
   const pathname = usePathname()
 
   const dashboardActive = pathname === DASHBOARD_ITEM.href
@@ -137,7 +131,6 @@ export function AppSidebar() {
             >
               <SidebarGroup className="py-0">
                 <SidebarMenu>
-                  {/* Group trigger — looks like a regular nav button */}
                   <SidebarMenuItem>
                     <SidebarMenuButton
                       render={<CollapsibleTrigger />}
@@ -154,7 +147,6 @@ export function AppSidebar() {
                     </SidebarMenuButton>
                   </SidebarMenuItem>
 
-                  {/* Sub-items with indent line */}
                   <CollapsibleContent>
                     <SidebarMenuSub>
                       {visibleItems.map((item) => {
@@ -186,20 +178,22 @@ export function AppSidebar() {
         })}
 
         {/* Configuration — standalone, no sub-nav */}
-        <SidebarGroup className="py-1">
-          <SidebarMenu>
-            <SidebarMenuItem>
-              <SidebarMenuButton
-                render={<Link href={CONFIGURATION_ITEM.href} />}
-                isActive={configurationActive}
-                tooltip={CONFIGURATION_ITEM.title}
-              >
-                <HugeiconsIcon icon={CONFIGURATION_ITEM.icon} size={18} />
-                <span>{CONFIGURATION_ITEM.title}</span>
-              </SidebarMenuButton>
-            </SidebarMenuItem>
-          </SidebarMenu>
-        </SidebarGroup>
+        {canSee(CONFIGURATION_ITEM, permissions) && (
+          <SidebarGroup className="py-1">
+            <SidebarMenu>
+              <SidebarMenuItem>
+                <SidebarMenuButton
+                  render={<Link href={CONFIGURATION_ITEM.href} />}
+                  isActive={configurationActive}
+                  tooltip={CONFIGURATION_ITEM.title}
+                >
+                  <HugeiconsIcon icon={CONFIGURATION_ITEM.icon} size={18} />
+                  <span>{CONFIGURATION_ITEM.title}</span>
+                </SidebarMenuButton>
+              </SidebarMenuItem>
+            </SidebarMenu>
+          </SidebarGroup>
+        )}
       </SidebarContent>
 
       <SidebarFooter>
@@ -209,18 +203,16 @@ export function AppSidebar() {
           </div>
           <div className="flex min-w-0 flex-1 flex-col group-data-[collapsible=icon]:hidden">
             <span className="truncate text-sm font-medium text-sidebar-foreground">
-              {user.fullName}
+              {user?.username ?? '—'}
             </span>
-            <Select value={user.role} onValueChange={(v) => setRole(v as Role)}>
-              <SelectTrigger className="h-5 border-0 p-0 text-xs text-muted-foreground shadow-none focus:ring-0">
-                <SelectValue />
-              </SelectTrigger>
-              <SelectContent>
-                <SelectItem value="admin">Admin</SelectItem>
-                <SelectItem value="warehouse">Warehouse</SelectItem>
-                <SelectItem value="sales">Sales</SelectItem>
-              </SelectContent>
-            </Select>
+            <Button
+              variant="ghost"
+              size="sm"
+              onClick={logout}
+              className="h-auto justify-start p-0 text-xs text-muted-foreground hover:text-foreground hover:bg-transparent"
+            >
+              Sign out
+            </Button>
           </div>
         </div>
       </SidebarFooter>

distribution_fe/components/layout/bottom-nav.tsx

@@ -16,7 +16,7 @@ export function BottomNav() {
 
   const visibleItems: NavItem[] = BOTTOM_NAV_CANDIDATES.filter((item) => {
     if (!item.permission) return true
-    return permissions.includes('*') || permissions.includes(item.permission)
+    return permissions.has(item.permission)
   }).slice(0, MAX_TABS)
 
   return (

distribution_fe/config/nav.ts

@@ -55,6 +55,7 @@ export const CONFIGURATION_ITEM: NavItem = {
   title: 'Configuration',
   href: '/configuration',
   icon: Settings01Icon,
+  permission: 'sys-config.view',
 }
 
 export const NAV_GROUPS: NavGroup[] = [

distribution_fe/config/permissions.ts

@@ -0,0 +1,126 @@
+export interface PermissionCategory {
+  id: string
+  label: string
+  codes: string[]
+}
+
+export const PERMISSION_CATEGORIES: PermissionCategory[] = [
+  {
+    id: 'sales',
+    label: 'Sales & Orders',
+    codes: [
+      'orders.view',
+      'stores.view',
+      'store.view',
+      'store.manage',
+      'sales_visits.checkin',
+      'return.view',
+      'return.manage',
+    ],
+  },
+  {
+    id: 'operations',
+    label: 'Operations',
+    codes: [
+      'rides.view',
+      'loading.view',
+      'loading-sheet.view',
+      'loading-sheet.manage',
+      'delivery-task.view',
+      'delivery-task.manage',
+    ],
+  },
+  {
+    id: 'stock',
+    label: 'Stock & Inventory',
+    codes: [
+      'warehouses.view',
+      'stock.view',
+      'stock.manage',
+      'items.view',
+      'categories.view',
+    ],
+  },
+  {
+    id: 'procurement',
+    label: 'Procurement',
+    codes: [
+      'purchase_orders.view',
+      'purchase-order.view',
+      'purchase-order.manage',
+      'purchase-return.manage',
+      'grn.view',
+      'grn.manage',
+      'suppliers.view',
+      'supplier-claim.view',
+      'supplier-claim.manage',
+    ],
+  },
+  {
+    id: 'pricing',
+    label: 'Pricing',
+    codes: [
+      'pricelists.view',
+      'price-list.view',
+      'price-list.manage',
+      'schemes.view',
+      'scheme.view',
+      'scheme.manage',
+    ],
+  },
+  {
+    id: 'claims',
+    label: 'Claims',
+    codes: [
+      'claim.view',
+      'claim.manage',
+    ],
+  },
+  {
+    id: 'network',
+    label: 'Network & Routes',
+    codes: [
+      'regions.view',
+      'region.view',
+      'region.manage',
+      'routes.view',
+      'route.view',
+      'route.manage',
+    ],
+  },
+  {
+    id: 'fleet',
+    label: 'Fleet & Drivers',
+    codes: [
+      'vehicles.view',
+      'driver_profiles.view',
+      'driver.view',
+      'driver.manage',
+      'compliance.manage',
+    ],
+  },
+  {
+    id: 'users',
+    label: 'User Management',
+    codes: [
+      'users.view',
+      'roles.view',
+    ],
+  },
+  {
+    id: 'system',
+    label: 'System',
+    codes: [
+      'sys-config.view',
+      'sys-config.manage',
+    ],
+  },
+]
+
+export const ALL_PERMISSION_CODES = new Set(
+  PERMISSION_CATEGORIES.flatMap((c) => c.codes),
+)
+
+export function getCategoryForCode(code: string): PermissionCategory | undefined {
+  return PERMISSION_CATEGORIES.find((c) => c.codes.includes(code))
+}

distribution_fe/contexts/auth-context.tsx

@@ -1,101 +1,109 @@
 'use client'
 
-import { createContext, useContext, useState, type ReactNode } from 'react'
+import { createContext, useContext, useState, useEffect, useCallback, type ReactNode } from 'react'
+import { useRouter } from 'next/navigation'
+import { api, registerUnauthorizedHandler } from '@/lib/api'
 
-export type Role = 'admin' | 'warehouse' | 'sales'
-
-export interface MockUser {
-  id: string
-  fullName: string
+export interface User {
+  userId: string
   username: string
   roleId: string
-  role: Role
+  roleCode: string
+  roleLevel: number
 }
 
 interface AuthContextValue {
-  user: MockUser
-  permissions: string[]
-  setRole: (role: Role) => void
+  user: User | null
+  permissions: Set<string>
+  loading: boolean
+  login: (identifier: string, password: string) => Promise<void>
+  logout: () => Promise<void>
+  hasPermission: (code: string) => boolean
 }
 
-// Mock permissions per role — replace with real API call once auth is implemented
-const MOCK_PERMISSIONS: Record<Role, string[]> = {
-  admin: ['*'],
-  warehouse: [
-    'items.view',
-    'categories.view',
-    'regions.view',
-    'routes.view',
-    'vehicles.view',
-    'warehouses.view',
-    'loading.view',
-    'loading.dispatch',
-    'loading.receive',
-    'loading.resolve',
-    'rides.view',
-    'rides.manage',
-    'rides.cancel.request',
-    'driver_profiles.view',
-    'compliance.manage',
-  ],
-  sales: [
-    'stores.view',
-    'stores.create',
-    'stores.update',
-    'orders.view',
-    'orders.create',
-    'orders.update',
-    'items.view',
-    'categories.view',
-    'regions.view',
-    'routes.view',
-    'rides.view',
-    'driver_profiles.view',
-    'sales_visits.checkin',
-  ],
+const PERMISSIONS_KEY = 'app:permissions'
+
+function savePermissions(perms: string[]): void {
+  try {
+    localStorage.setItem(PERMISSIONS_KEY, JSON.stringify(perms))
+  } catch {}
 }
 
-const MOCK_USERS: Record<Role, MockUser> = {
-  admin: {
-    id: '00000000-0000-0000-0000-000000000001',
-    fullName: 'Admin User',
-    username: 'admin',
-    roleId: '00000000-0000-0000-0000-000000000010',
-    role: 'admin',
-  },
-  warehouse: {
-    id: '00000000-0000-0000-0000-000000000002',
-    fullName: 'Warehouse Staff',
-    username: 'warehouse',
-    roleId: '00000000-0000-0000-0000-000000000011',
-    role: 'warehouse',
-  },
-  sales: {
-    id: '00000000-0000-0000-0000-000000000003',
-    fullName: 'Sales Rep',
-    username: 'sales',
-    roleId: '00000000-0000-0000-0000-000000000012',
-    role: 'sales',
-  },
+function readPermissions(): Set<string> {
+  try {
+    const raw = localStorage.getItem(PERMISSIONS_KEY)
+    if (raw) return new Set(JSON.parse(raw) as string[])
+  } catch {}
+  return new Set()
+}
+
+function clearPermissions(): void {
+  try {
+    localStorage.removeItem(PERMISSIONS_KEY)
+  } catch {}
 }
 
 const AuthContext = createContext<AuthContextValue | null>(null)
 
 export function AuthProvider({ children }: { children: ReactNode }) {
-  const [role, setRoleState] = useState<Role>('admin')
+  const router = useRouter()
+  const [user, setUser] = useState<User | null>(null)
+  const [permissions, setPermissions] = useState<Set<string>>(new Set())
+  const [loading, setLoading] = useState(true)
 
-  function setRole(newRole: Role) {
-    setRoleState(newRole)
+  const loadSession = useCallback(async () => {
+    setLoading(true)
+    try {
+      const { data } = await api.get<User>('/auth/me')
+      setUser(data)
+      setPermissions(readPermissions())
+    } catch {
+      setUser(null)
+      setPermissions(new Set())
+    } finally {
+      setLoading(false)
+    }
+  }, [])
+
+  useEffect(() => {
+    loadSession()
+  }, [loadSession])
+
+  useEffect(() => {
+    return registerUnauthorizedHandler(() => {
+      clearPermissions()
+      setUser(null)
+      setPermissions(new Set())
+      router.push('/login')
+    })
+  }, [router])
+
+  async function login(identifier: string, password: string) {
+    const { data: loginData } = await api.post<{ profile: User }>('/auth/login', { identifier, password, deviceName: 'Web' })
+    setUser(loginData.profile)
+    const { data: permData } = await api.get<{ permissions: string[] }>('/authorization/my-permissions')
+    savePermissions(permData.permissions)
+    setPermissions(new Set(permData.permissions))
+    router.push('/')
+  }
+
+  async function logout() {
+    try {
+      await api.post('/auth/logout')
+    } finally {
+      clearPermissions()
+      setUser(null)
+      setPermissions(new Set())
+      router.push('/login')
+    }
+  }
+
+  function hasPermission(code: string): boolean {
+    return permissions.has(code)
   }
 
   return (
-    <AuthContext.Provider
-      value={{
-        user: MOCK_USERS[role],
-        permissions: MOCK_PERMISSIONS[role],
-        setRole,
-      }}
-    >
+    <AuthContext.Provider value={{ user, permissions, loading, login, logout, hasPermission }}>
       {children}
     </AuthContext.Provider>
   )

distribution_fe/hooks/use-permission.ts

@@ -4,17 +4,15 @@ import { useAuth } from '@/contexts/auth-context'
 
 export function usePermission(permission: string): boolean {
   const { permissions } = useAuth()
-  return permissions.includes('*') || permissions.includes(permission)
+  return permissions.has(permission)
 }
 
 export function usePermissions(codes: string[]): boolean[] {
   const { permissions } = useAuth()
-  const isAdmin = permissions.includes('*')
-  return codes.map((code) => isAdmin || permissions.includes(code))
+  return codes.map((code) => permissions.has(code))
 }
 
 export function useHasAnyPermission(codes: string[]): boolean {
   const { permissions } = useAuth()
-  if (permissions.includes('*')) return true
-  return codes.some((code) => permissions.includes(code))
+  return codes.some((code) => permissions.has(code))
 }