From 63c2da652cce5d591a76d4f338d2db81fc141f73 Mon Sep 17 00:00:00 2001
From: Blitblank <pmcgeee03@gmail.com>
Date: Tue, 24 Mar 2026 19:41:36 -0500
Subject: [PATCH 01/33] test api roles

---
 api/Program.cs               | 4 +++-
 api/src/Data/AppDbContext.cs | 2 +-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/api/Program.cs b/api/Program.cs
index 6bf5190..07d914f 100644
--- a/api/Program.cs
+++ b/api/Program.cs
@@ -21,13 +21,15 @@ builder.Services.AddDbContext<AppDbContext>(options =>
 builder.Services.AddControllers();
 
 // services
+builder.Services.AddScoped<UserService>();
 builder.Services.AddScoped<ItemService>();
 builder.Services.AddScoped<JwtService>();
 
 // configuration for jwt authentication
 builder.Services.AddIdentity<User, IdentityRole>()
     .AddEntityFrameworkStores<AppDbContext>()
-    .AddDefaultTokenProviders();
+    .AddDefaultTokenProviders()
+    .AddRoles<IdentityRole>();
 builder.Services.AddAuthentication(options => {
     options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
     options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
diff --git a/api/src/Data/AppDbContext.cs b/api/src/Data/AppDbContext.cs
index 88af273..fbbb596 100644
--- a/api/src/Data/AppDbContext.cs
+++ b/api/src/Data/AppDbContext.cs
@@ -10,7 +10,7 @@ public class AppDbContext : IdentityDbContext<User> {
 
     }
 
-    // Db set for each model besides Users (DbSet<template> is already defined in IdenityDbContext<template>)
+    // Db set for each model besides Users (DbSet<User> is already defined in IdentityDbContext<User>)
     public DbSet<Item> Items { get; set; }
     public DbSet<RefreshToken> RefreshTokens { get; set; }
 

From eeee94d0d615952757e104017dd63107720929fc Mon Sep 17 00:00:00 2001
From: Blitblank <pmcgeee03@gmail.com>
Date: Tue, 24 Mar 2026 19:41:48 -0500
Subject: [PATCH 02/33] what da

---
 api/src/Controllers/UsersController.cs | 50 ++++++++++++++++++++++++++
 api/src/Services/UserService.cs        | 39 ++++++++++++++++++++
 2 files changed, 89 insertions(+)
 create mode 100644 api/src/Controllers/UsersController.cs
 create mode 100644 api/src/Services/UserService.cs

diff --git a/api/src/Controllers/UsersController.cs b/api/src/Controllers/UsersController.cs
new file mode 100644
index 0000000..de66f0b
--- /dev/null
+++ b/api/src/Controllers/UsersController.cs
@@ -0,0 +1,50 @@
+
+// this is basically a demo on roles
+// level 0 can't access the users endpoint at all
+// level 1 has read permissions
+// level 2 has modify permissions
+
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Authorization;
+
+using agologumApi.Models;
+using agologumApi.Services;
+
+[ApiController]
+[Route("api/[controller]")]
+public class UsersController : ControllerBase {
+
+    private readonly UserService service_;
+
+    public UsersController(UserService service) {
+        service_ = service;
+    }
+
+    [Authorize(Roles = "Admin, Superuser")]
+    [HttpGet]
+    public async Task<ActionResult<List<User>>> getUsers() {
+        return Ok(await service_.GetAll());
+    }
+
+    [Authorize(Roles = "Admin, Superuser")]
+    [HttpGet("{id:int}")]
+    public async Task<ActionResult<User>> getUser(int id) {
+
+        var user = await service_.Get(id);
+
+        if (user == null) return NotFound();
+
+        return Ok(user);
+    }
+
+    [Authorize(Roles = "Superuser")]
+    [HttpDelete("{id}")]
+    public async Task<ActionResult> deleteUser(int id) {
+
+        var success = await service_.Delete(id);
+
+        if (!success) return NotFound();
+
+        return NoContent();
+    }
+}
\ No newline at end of file
diff --git a/api/src/Services/UserService.cs b/api/src/Services/UserService.cs
new file mode 100644
index 0000000..6bf5b8d
--- /dev/null
+++ b/api/src/Services/UserService.cs
@@ -0,0 +1,39 @@
+
+using Microsoft.EntityFrameworkCore;
+
+using agologumApi.Models;
+
+namespace agologumApi.Services;
+
+public class UserService {
+
+    private readonly AppDbContext db_;
+
+    public UserService(AppDbContext db) {
+        db_ = db;
+    }
+
+    public async Task<List<User>> GetAll() {
+        return await db_.Users.ToListAsync();
+    }
+
+    public async Task<User?> Get(int id) {
+        return await db_.Users.FindAsync(id);
+    }
+
+    public async Task<User?> Get(string name) {
+        return await db_.Users.FirstOrDefaultAsync(u => u.UserName == name);
+    }
+
+    public async Task<bool> Delete(int id) {
+        User? User = await db_.Users.FindAsync(id);
+        if(User != null) {
+            db_.Users.Remove(User);
+            await db_.SaveChangesAsync();
+            return true;
+        } else {
+            return false;
+        }
+    }
+
+}
\ No newline at end of file

From 12d1e65ed59fd41e7185a080bcbb4136de9dfe18 Mon Sep 17 00:00:00 2001
From: Blitblank <pmcgeee03@gmail.com>
Date: Wed, 25 Mar 2026 23:11:39 -0500
Subject: [PATCH 03/33] small roles update

---
 api/src/Controllers/AuthController.cs  | 11 +++++++++++
 api/src/Controllers/UsersController.cs |  6 +++---
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/api/src/Controllers/AuthController.cs b/api/src/Controllers/AuthController.cs
index 8afd69e..2f9fe6c 100644
--- a/api/src/Controllers/AuthController.cs
+++ b/api/src/Controllers/AuthController.cs
@@ -34,6 +34,17 @@ public class AuthController : ControllerBase {
         var result = await userManager_.CreateAsync(user, dto.Password);
         if(!result.Succeeded) return BadRequest(result.Errors);
 
+        // assigning roles to user
+        string role = "base";
+        if(dto.UserName == "bard") {
+            role = "Superuser";
+        } else if(dto.UserName.StartsWith("x")) {
+            role = "Admin";
+        } 
+        await userManager_.AddToRoleAsync(user, role); // TODO: error check this
+        // await _userManager.RemoveFromRoleAsync(user, "Admin"); // remove role
+        // var roles = await _userManager.GetRolesAsync(user); // get list of roles for user
+
         return CreatedAtAction(
             nameof(Register),
             new { id = user.Id }
diff --git a/api/src/Controllers/UsersController.cs b/api/src/Controllers/UsersController.cs
index de66f0b..5fab569 100644
--- a/api/src/Controllers/UsersController.cs
+++ b/api/src/Controllers/UsersController.cs
@@ -20,13 +20,13 @@ public class UsersController : ControllerBase {
         service_ = service;
     }
 
-    [Authorize(Roles = "Admin, Superuser")]
+    [Authorize(Policy = "RequireAdmin")]
     [HttpGet]
     public async Task<ActionResult<List<User>>> getUsers() {
         return Ok(await service_.GetAll());
     }
 
-    [Authorize(Roles = "Admin, Superuser")]
+    [Authorize(Policy = "RequireAdmin")]
     [HttpGet("{id:int}")]
     public async Task<ActionResult<User>> getUser(int id) {
 
@@ -37,7 +37,7 @@ public class UsersController : ControllerBase {
         return Ok(user);
     }
 
-    [Authorize(Roles = "Superuser")]
+    [Authorize(Policy = "RequireSuperuser")]
     [HttpDelete("{id}")]
     public async Task<ActionResult> deleteUser(int id) {
 

From 5afd9057f2943139b4ee50dfbd6aec88b209cf51 Mon Sep 17 00:00:00 2001
From: Blitblank <pmcgeee03@gmail.com>
Date: Fri, 27 Mar 2026 20:22:17 -0500
Subject: [PATCH 04/33] checkpoint

---
 client/src/api/UsersApi.ts           | 11 ++++++
 client/src/components/UsersTable.vue |  0
 client/src/pages/UsersForm.vue       | 56 ++++++++++++++++++++++++++++
 client/src/pages/UsersList.vue       |  0
 client/src/router/index.ts           |  4 +-
 client/src/stores/UsersStore.ts      | 32 ++++++++++++++++
 6 files changed, 102 insertions(+), 1 deletion(-)
 create mode 100644 client/src/api/UsersApi.ts
 create mode 100644 client/src/components/UsersTable.vue
 create mode 100644 client/src/pages/UsersForm.vue
 create mode 100644 client/src/pages/UsersList.vue
 create mode 100644 client/src/stores/UsersStore.ts

diff --git a/client/src/api/UsersApi.ts b/client/src/api/UsersApi.ts
new file mode 100644
index 0000000..484315d
--- /dev/null
+++ b/client/src/api/UsersApi.ts
@@ -0,0 +1,11 @@
+
+import api from "./axios.ts"
+import type { User } from "../models/User.ts";
+
+const API_URL: string = "/users";
+
+export const getUsers = () => api.get<User[]>(`${API_URL}`);
+
+export const getUser = (id: number) => api.get<User>(`${API_URL}/${id}`);
+
+export const deleteUser = (id: number) => api.delete<User>(`${API_URL}/${id}`);
diff --git a/client/src/components/UsersTable.vue b/client/src/components/UsersTable.vue
new file mode 100644
index 0000000..e69de29
diff --git a/client/src/pages/UsersForm.vue b/client/src/pages/UsersForm.vue
new file mode 100644
index 0000000..7350e46
--- /dev/null
+++ b/client/src/pages/UsersForm.vue
@@ -0,0 +1,56 @@
+<!-- pages/views in vue are basically root-level full-page components -->
+
+<script setup lang="ts">
+
+import { ref, onMounted } from "vue";
+import { useRoute, useRouter } from "vue-router";
+
+import { useItemsStore } from "../stores/ItemsStore.ts";
+import type { Item } from "../models/Item.ts";
+
+const store = useItemsStore();
+const route = useRoute();
+const router = useRouter();
+
+const item = ref<Item>({
+    id: 0,
+    name: "",
+    description: "",
+    createdAt: "",
+    lastEditedAt: ""
+});
+
+const id: string | undefined = route.params.id as string | undefined
+
+onMounted(() => {
+    if(id) {
+        const existing = store.items.find(i => i.id == Number(id));
+        if (existing) item.value = { ...existing };
+    }
+});
+
+async function save(): Promise<void> {
+    if(id) {
+        await store.updateItem(Number(id), item.value);
+    } else {
+        await store.addItem(item.value);
+    }
+
+    router.push("/items"); // redirect
+}
+
+</script>
+
+<template>
+
+    <div>
+        <h2>{{ id ? "Edit Item" : "Create Item" }}</h2> <!-- omg I love ternary operator :D -->
+
+        <form @submit.prevent="save">
+            <input v-model="item.name" placeholder="Name" />
+            <input v-model="item.description" placeholder="Name" />
+            <button type="submit">Save</button>
+        </form>
+    </div>
+
+</template>
\ No newline at end of file
diff --git a/client/src/pages/UsersList.vue b/client/src/pages/UsersList.vue
new file mode 100644
index 0000000..e69de29
diff --git a/client/src/router/index.ts b/client/src/router/index.ts
index 183b38a..1575f9d 100644
--- a/client/src/router/index.ts
+++ b/client/src/router/index.ts
@@ -17,7 +17,8 @@ const routes = [
 	{ path: "/register", component: RegisterForm },
 	{ path: "/items", component: ItemsList, meta: { requiresAuth: true } },
 	{ path: "/item/new", component: ItemForm, meta: { requiresAuth: true } },
-	{ path: "/item/:id", component: ItemForm, meta: { requiresAuth: true } }
+	{ path: "/item/:id", component: ItemForm, meta: { requiresAuth: true } },
+	{ path: "/users", component: ItemsList, meta: { requiresAuth: true } }
 ]; // I really like this
 
 const router = createRouter({
@@ -36,5 +37,6 @@ router.beforeEach((to, from, next) => {
 	}
 
 });
+// if the api responds unauthorized (401) then it also will auto-redirect to the login page
 
 export default router;
diff --git a/client/src/stores/UsersStore.ts b/client/src/stores/UsersStore.ts
new file mode 100644
index 0000000..064f686
--- /dev/null
+++ b/client/src/stores/UsersStore.ts
@@ -0,0 +1,32 @@
+
+import { defineStore } from "pinia";
+import type { User } from "../models/User.ts";
+import * as usersApi from "../api/UsersApi";
+
+interface UserState {
+    users: User[];
+    loading: boolean;
+}
+
+export const useUsersStore = defineStore("users", {
+    
+    state: (): UserState => ({
+        users: [],
+        loading: false
+    }),
+
+    actions: {
+        async fetchUsers() {
+            this.loading = true;
+            const response = await usersApi.getUsers();
+            this.users = response.data;
+            this.loading = false;
+        },
+
+        async removeUser(id: number) {
+            await usersApi.deleteUser(id);
+            this.users = this.users.filter(i => i.id !== id);
+        }
+    }
+
+});

From f271ff59f88ed8ecc9c07a2a2711bda92eba2251 Mon Sep 17 00:00:00 2001
From: Blitblank <pmcgeee03@gmail.com>
Date: Sat, 28 Mar 2026 00:01:45 -0500
Subject: [PATCH 05/33] added userDtos

---
 .env                                   |  6 +++
 api/src/Controllers/UsersController.cs | 27 ++++++++++++-
 api/src/Models/User.cs                 |  9 +++++
 client/src/api/AuthApi.ts              |  2 +-
 client/src/api/UsersApi.ts             |  8 ++--
 client/src/models/User.ts              |  8 ++--
 client/src/pages/UsersForm.vue         | 56 --------------------------
 client/src/pages/UsersList.vue         | 37 +++++++++++++++++
 client/src/pages/index.vue             |  6 +++
 client/src/router/index.ts             |  3 +-
 client/src/stores/UsersStore.ts        |  6 +--
 11 files changed, 97 insertions(+), 71 deletions(-)
 delete mode 100644 client/src/pages/UsersForm.vue

diff --git a/.env b/.env
index fba0b89..2af583f 100644
--- a/.env
+++ b/.env
@@ -2,3 +2,9 @@
 sike you thought I was like that
 
 hehehehee (urp so full)
+
+# TODO: should have basic public-safe environment variables here
+# then secret environment variables can be added via secrets in the ci script like so:
+# job: inject-seccrets $ echo API_KEY={{ secrets.API_KEY }} >> .env
+# then they dont have to be inserted by the docker container ( messy)
+
diff --git a/api/src/Controllers/UsersController.cs b/api/src/Controllers/UsersController.cs
index 5fab569..bf1ca7d 100644
--- a/api/src/Controllers/UsersController.cs
+++ b/api/src/Controllers/UsersController.cs
@@ -23,7 +23,23 @@ public class UsersController : ControllerBase {
     [Authorize(Policy = "RequireAdmin")]
     [HttpGet]
     public async Task<ActionResult<List<User>>> getUsers() {
-        return Ok(await service_.GetAll());
+        List<User> rawArray = await service_.GetAll();
+
+        List<UserDto> dtoArray = new List<UserDto>();
+
+        foreach(User user in rawArray) {
+            // TODO: can you operator overload a cast? if so cast<UserDto>(UserDto) would go hard
+            // if not then just a new custom cast function that returns a dto type will do
+            UserDto newDto = new UserDto{
+                CreatedAt = user.CreatedAt,
+                Email = user.Email,
+                Id = user.Id,
+                UserName = user.UserName
+            };
+            dtoArray.Add(newDto);
+        }
+
+        return Ok(dtoArray);
     }
 
     [Authorize(Policy = "RequireAdmin")]
@@ -34,7 +50,14 @@ public class UsersController : ControllerBase {
 
         if (user == null) return NotFound();
 
-        return Ok(user);
+        UserDto newDto = new UserDto{
+            CreatedAt = user.CreatedAt,
+            Email = user.Email,
+            Id = user.Id,
+            UserName = user.UserName
+        };
+
+        return Ok(newDto);
     }
 
     [Authorize(Policy = "RequireSuperuser")]
diff --git a/api/src/Models/User.cs b/api/src/Models/User.cs
index 98bdb7c..a2bc758 100644
--- a/api/src/Models/User.cs
+++ b/api/src/Models/User.cs
@@ -46,3 +46,12 @@ public class LoginDto {
     public string Password { get; set; } = "";
 
 }
+
+public class UserDto {
+
+    public DateTime CreatedAt { get; set; } = DateTime.UtcNow; // gets compressed to a string
+    public string? Email { get; set; } = "";
+    public string Id { get; set; } = "";
+    public string? UserName { get; set; } = "";
+
+};
diff --git a/client/src/api/AuthApi.ts b/client/src/api/AuthApi.ts
index 62b4a0a..b4bc8c9 100644
--- a/client/src/api/AuthApi.ts
+++ b/client/src/api/AuthApi.ts
@@ -3,7 +3,7 @@
 // handles user registration, user logins, tokens, password reset, etc.
 
 import { api, authStorage } from "./axios.ts"
-import type { User, RegisterDto, LoginDto } from "../models/User.ts";
+import type { UserDto, RegisterDto, LoginDto } from "../models/User.ts";
 
 const API_URL: string = "/auth";
 
diff --git a/client/src/api/UsersApi.ts b/client/src/api/UsersApi.ts
index 484315d..6c7a38e 100644
--- a/client/src/api/UsersApi.ts
+++ b/client/src/api/UsersApi.ts
@@ -1,11 +1,11 @@
 
 import api from "./axios.ts"
-import type { User } from "../models/User.ts";
+import type { UserDto } from "../models/User.ts";
 
 const API_URL: string = "/users";
 
-export const getUsers = () => api.get<User[]>(`${API_URL}`);
+export const getUsers = () => api.get<UserDto[]>(`${API_URL}`);
 
-export const getUser = (id: number) => api.get<User>(`${API_URL}/${id}`);
+export const getUser = (id: string) => api.get<UserDto>(`${API_URL}/${id}`);
 
-export const deleteUser = (id: number) => api.delete<User>(`${API_URL}/${id}`);
+export const deleteUser = (id: string) => api.delete<UserDto>(`${API_URL}/${id}`);
diff --git a/client/src/models/User.ts b/client/src/models/User.ts
index 48d8fcd..0357dce 100644
--- a/client/src/models/User.ts
+++ b/client/src/models/User.ts
@@ -2,11 +2,11 @@
 // models are the data objects stored in the database. models defined here must match models defined in api/models 
 // dtos here must match the the dtos in api/src/Modelts/Dto.cs in name (case insensitive) (types are intermediately serialized to strings)
 
-export interface User {
-    id: number;
-    username: string;
+export interface UserDto {
+    createdAt: string;
     email: string;
-    password: string;
+    id: string;
+    username: string;
 }
 
 export interface RegisterDto {
diff --git a/client/src/pages/UsersForm.vue b/client/src/pages/UsersForm.vue
deleted file mode 100644
index 7350e46..0000000
--- a/client/src/pages/UsersForm.vue
+++ /dev/null
@@ -1,56 +0,0 @@
-<!-- pages/views in vue are basically root-level full-page components -->
-
-<script setup lang="ts">
-
-import { ref, onMounted } from "vue";
-import { useRoute, useRouter } from "vue-router";
-
-import { useItemsStore } from "../stores/ItemsStore.ts";
-import type { Item } from "../models/Item.ts";
-
-const store = useItemsStore();
-const route = useRoute();
-const router = useRouter();
-
-const item = ref<Item>({
-    id: 0,
-    name: "",
-    description: "",
-    createdAt: "",
-    lastEditedAt: ""
-});
-
-const id: string | undefined = route.params.id as string | undefined
-
-onMounted(() => {
-    if(id) {
-        const existing = store.items.find(i => i.id == Number(id));
-        if (existing) item.value = { ...existing };
-    }
-});
-
-async function save(): Promise<void> {
-    if(id) {
-        await store.updateItem(Number(id), item.value);
-    } else {
-        await store.addItem(item.value);
-    }
-
-    router.push("/items"); // redirect
-}
-
-</script>
-
-<template>
-
-    <div>
-        <h2>{{ id ? "Edit Item" : "Create Item" }}</h2> <!-- omg I love ternary operator :D -->
-
-        <form @submit.prevent="save">
-            <input v-model="item.name" placeholder="Name" />
-            <input v-model="item.description" placeholder="Name" />
-            <button type="submit">Save</button>
-        </form>
-    </div>
-
-</template>
\ No newline at end of file
diff --git a/client/src/pages/UsersList.vue b/client/src/pages/UsersList.vue
index e69de29..3041bfc 100644
--- a/client/src/pages/UsersList.vue
+++ b/client/src/pages/UsersList.vue
@@ -0,0 +1,37 @@
+
+<script setup lang="ts">
+
+import { onMounted } from "vue"
+import { useRoute, useRouter } from "vue-router";
+import { useUsersStore } from "../stores/UsersStore.ts"
+import * as authApi from "../api/AuthApi";
+
+const store = useUsersStore()
+const router = useRouter();
+
+onMounted(() => {
+  store.fetchUsers()
+})
+
+function logout() {
+    authApi.logout();
+    router.push("/login");
+}
+
+</script>
+
+<template>
+    <div>
+        <h1>Users</h1>
+
+        <table>
+            <tr v-for="user in store.users" :key="user.id">
+                <td>{{ user.username }}</td>
+                <td>
+                    <button @click="store.removeUser(user.id)">Delete</button>
+                </td>
+            </tr>
+        </table>
+        <button @click="logout()">Logout</button>
+    </div>
+</template>
diff --git a/client/src/pages/index.vue b/client/src/pages/index.vue
index 0a8cab5..e6999c1 100644
--- a/client/src/pages/index.vue
+++ b/client/src/pages/index.vue
@@ -10,10 +10,16 @@
     <h3>yeah im so cool rn</h3>
     <h1>imagining what I could do with themes :o</h1>
 
+    <h3>TODO: if(logged in) show this stuff; else dont.</h3>
+
     <router-link to="/items" custom v-slot="{ navigate }">
         <button @click="navigate" role="link">Items</button>
     </router-link>
 
+    <router-link to="/users" custom v-slot="{ navigate }">
+        <button @click="navigate" role="link">Users</button>
+    </router-link>
+
     <router-link to="/register" custom v-slot="{ navigate }"> <!-- TODO: only if token == invalid -->
         <button @click="navigate" role="link">Register</button>
     </router-link>
diff --git a/client/src/router/index.ts b/client/src/router/index.ts
index 1575f9d..3d09595 100644
--- a/client/src/router/index.ts
+++ b/client/src/router/index.ts
@@ -6,6 +6,7 @@ import LoginForm from "../pages/LoginForm.vue";
 import RegisterForm from "../pages/RegisterForm.vue";
 import ItemsList from "../pages/ItemsList.vue";
 import ItemForm from "../pages/ItemForm.vue";
+import UsersList from "../pages/UsersList.vue";
 import index from "../pages/index.vue";
 
 import { authStorage } from "../api/axios.ts"
@@ -18,7 +19,7 @@ const routes = [
 	{ path: "/items", component: ItemsList, meta: { requiresAuth: true } },
 	{ path: "/item/new", component: ItemForm, meta: { requiresAuth: true } },
 	{ path: "/item/:id", component: ItemForm, meta: { requiresAuth: true } },
-	{ path: "/users", component: ItemsList, meta: { requiresAuth: true } }
+	{ path: "/users", component: UsersList, meta: { requiresAuth: true } }
 ]; // I really like this
 
 const router = createRouter({
diff --git a/client/src/stores/UsersStore.ts b/client/src/stores/UsersStore.ts
index 064f686..5b7e979 100644
--- a/client/src/stores/UsersStore.ts
+++ b/client/src/stores/UsersStore.ts
@@ -1,10 +1,10 @@
 
 import { defineStore } from "pinia";
-import type { User } from "../models/User.ts";
+import type { UserDto } from "../models/User.ts";
 import * as usersApi from "../api/UsersApi";
 
 interface UserState {
-    users: User[];
+    users: UserDto[];
     loading: boolean;
 }
 
@@ -23,7 +23,7 @@ export const useUsersStore = defineStore("users", {
             this.loading = false;
         },
 
-        async removeUser(id: number) {
+        async removeUser(id: string) {
             await usersApi.deleteUser(id);
             this.users = this.users.filter(i => i.id !== id);
         }

From 0af0ddf6b9f33461795909db8261e0ba480cde6b Mon Sep 17 00:00:00 2001
From: Blitblank <pmcgeee03@gmail.com>
Date: Sat, 28 Mar 2026 00:19:01 -0500
Subject: [PATCH 06/33] i was missing policies oops

---
 api/Program.cs | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/api/Program.cs b/api/Program.cs
index 07d914f..c74de6b 100644
--- a/api/Program.cs
+++ b/api/Program.cs
@@ -46,7 +46,14 @@ builder.Services.AddAuthentication(options => {
     };
 });
 
-builder.Services.AddAuthorization();
+builder.Services.AddAuthorization(options => {
+    options.AddPolicy("RequireAdmin", policy => {
+        policy.RequireRole("Admin", "Superuser");
+    });
+    options.AddPolicy("RequireSuperuser", policy => {
+        policy.RequireRole("Superuser");
+    });
+});
 
 // configuration for behind my nginx proxy
 builder.Services.Configure<ForwardedHeadersOptions>(options =>

From 214f1601b52a661f8dbd489e1a0d61ef6a824eb6 Mon Sep 17 00:00:00 2001
From: Blitblank <pmcgeee03@gmail.com>
Date: Sat, 28 Mar 2026 00:54:03 -0500
Subject: [PATCH 07/33] comment

---
 api/Program.cs | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/api/Program.cs b/api/Program.cs
index c74de6b..6e4f8b7 100644
--- a/api/Program.cs
+++ b/api/Program.cs
@@ -46,6 +46,9 @@ builder.Services.AddAuthentication(options => {
     };
 });
 
+// TODO: adding roles doesnt work atm because roles need to be seeded in the database first
+// maybe programamatically checking them at startup like if(roleManager_.FindAsync("Admin") == null { roleManager_.addAsync("Admin"); })
+// or something 
 builder.Services.AddAuthorization(options => {
     options.AddPolicy("RequireAdmin", policy => {
         policy.RequireRole("Admin", "Superuser");

From 2f3cb46af335ad60dc90dd0e1f5894450086c54e Mon Sep 17 00:00:00 2001
From: Blitblank <pmcgeee03@gmail.com>
Date: Tue, 21 Apr 2026 19:13:44 -0500
Subject: [PATCH 08/33] add roles seeding

---
 api/Program.cs                        | 27 ++++++++++++++++++---------
 api/src/Controllers/AuthController.cs |  7 ++++---
 client/src/pages/UsersList.vue        | 21 ++++++++++++++-------
 3 files changed, 36 insertions(+), 19 deletions(-)

diff --git a/api/Program.cs b/api/Program.cs
index 6e4f8b7..2248a49 100644
--- a/api/Program.cs
+++ b/api/Program.cs
@@ -46,16 +46,13 @@ builder.Services.AddAuthentication(options => {
     };
 });
 
-// TODO: adding roles doesnt work atm because roles need to be seeded in the database first
-// maybe programamatically checking them at startup like if(roleManager_.FindAsync("Admin") == null { roleManager_.addAsync("Admin"); })
-// or something 
 builder.Services.AddAuthorization(options => {
-    options.AddPolicy("RequireAdmin", policy => {
-        policy.RequireRole("Admin", "Superuser");
-    });
-    options.AddPolicy("RequireSuperuser", policy => {
-        policy.RequireRole("Superuser");
-    });
+
+    options.AddPolicy("SensitiveDataRead", policy =>
+        policy.RequireRole("admin", "superuser"));
+    options.AddPolicy("SensitiveDataModify", policy =>
+        policy.RequireRole("superuser"));
+
 });
 
 // configuration for behind my nginx proxy
@@ -123,6 +120,18 @@ using (var scope = app.Services.CreateScope()) {
             Thread.Sleep(5000);
         }
     }
+
+    // TODO: abstract this away
+    // auto seed Identity roles
+    var roleManager = scope.ServiceProvider.GetRequiredService<RoleManager<IdentityRole>>();
+    string[] roles = { "guest", "user", "dev", "mod", "admin", "superuser", "role1", "role2" };
+    foreach(string role in roles) {
+        if(!await roleManager.RoleExistsAsync(role)) {
+            await roleManager.CreateAsync(new IdentityRole(role));
+        }
+    }
+
+
 }
 
 app.Run();
diff --git a/api/src/Controllers/AuthController.cs b/api/src/Controllers/AuthController.cs
index 2f9fe6c..bc84737 100644
--- a/api/src/Controllers/AuthController.cs
+++ b/api/src/Controllers/AuthController.cs
@@ -37,12 +37,13 @@ public class AuthController : ControllerBase {
         // assigning roles to user
         string role = "base";
         if(dto.UserName == "bard") {
-            role = "Superuser";
+            role = "superuser";
         } else if(dto.UserName.StartsWith("x")) {
-            role = "Admin";
+            role = "admin";
         } 
         await userManager_.AddToRoleAsync(user, role); // TODO: error check this
-        // await _userManager.RemoveFromRoleAsync(user, "Admin"); // remove role
+        // these are here just in case you need them
+        // await _userManager.RemoveFromRoleAsync(user, "admin"); // remove role
         // var roles = await _userManager.GetRolesAsync(user); // get list of roles for user
 
         return CreatedAtAction(
diff --git a/client/src/pages/UsersList.vue b/client/src/pages/UsersList.vue
index 3041bfc..4441ca6 100644
--- a/client/src/pages/UsersList.vue
+++ b/client/src/pages/UsersList.vue
@@ -3,14 +3,14 @@
 
 import { onMounted } from "vue"
 import { useRoute, useRouter } from "vue-router";
-import { useUsersStore } from "../stores/UsersStore.ts"
+import { useItemsStore } from "../stores/ItemsStore.ts"
 import * as authApi from "../api/AuthApi";
 
-const store = useUsersStore()
+const store = useItemsStore()
 const router = useRouter();
 
 onMounted(() => {
-  store.fetchUsers()
+  store.fetchItems()
 })
 
 function logout() {
@@ -22,13 +22,20 @@ function logout() {
 
 <template>
     <div>
-        <h1>Users</h1>
+        <h1>Items</h1>
+
+        <router-link to="/item/new">Create Item</router-link>
 
         <table>
-            <tr v-for="user in store.users" :key="user.id">
-                <td>{{ user.username }}</td>
+            <tr v-for="item in store.items" :key="item.id">
+                <td>{{ item.name }}</td>
                 <td>
-                    <button @click="store.removeUser(user.id)">Delete</button>
+
+                    <router-link :to="`/item/${item.id}`" custom v-slot="{ navigate }">
+                        <button @click="navigate" role="link">Edit</button>
+                    </router-link>
+
+                    <button @click="store.removeItem(item.id)">Delete</button>
                 </td>
             </tr>
         </table>

From 143d194cdba6e25cef34593278e161ca08001194 Mon Sep 17 00:00:00 2001
From: Blitblank <pmcgeee03@gmail.com>
Date: Tue, 21 Apr 2026 19:18:54 -0500
Subject: [PATCH 09/33] fix: policy mismatch

---
 api/src/Controllers/UsersController.cs | 6 +++---
 scripts/DEV_README.md                  | 3 ++-
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/api/src/Controllers/UsersController.cs b/api/src/Controllers/UsersController.cs
index bf1ca7d..b1e0519 100644
--- a/api/src/Controllers/UsersController.cs
+++ b/api/src/Controllers/UsersController.cs
@@ -20,7 +20,7 @@ public class UsersController : ControllerBase {
         service_ = service;
     }
 
-    [Authorize(Policy = "RequireAdmin")]
+    [Authorize(Policy = "SensitiveDataRead")]
     [HttpGet]
     public async Task<ActionResult<List<User>>> getUsers() {
         List<User> rawArray = await service_.GetAll();
@@ -42,7 +42,7 @@ public class UsersController : ControllerBase {
         return Ok(dtoArray);
     }
 
-    [Authorize(Policy = "RequireAdmin")]
+    [Authorize(Policy = "SensitiveDataRead")]
     [HttpGet("{id:int}")]
     public async Task<ActionResult<User>> getUser(int id) {
 
@@ -60,7 +60,7 @@ public class UsersController : ControllerBase {
         return Ok(newDto);
     }
 
-    [Authorize(Policy = "RequireSuperuser")]
+    [Authorize(Policy = "SensitiveDataModify")]
     [HttpDelete("{id}")]
     public async Task<ActionResult> deleteUser(int id) {
 
diff --git a/scripts/DEV_README.md b/scripts/DEV_README.md
index bfee97f..71b6400 100644
--- a/scripts/DEV_README.md
+++ b/scripts/DEV_README.md
@@ -13,7 +13,8 @@ To see live logs:
 sudo docker logs -f -t agologum-api
 
 public user:
-> username=bard
+> username=bard (admin)
+> username=xvbard (superuser)
 > password=Public*890
 
 chrome dev tools troubleshooting

From 500961be07e6176523f1c00111eaafe02bedacdb Mon Sep 17 00:00:00 2001
From: Blitblank <pmcgeee03@gmail.com>
Date: Tue, 21 Apr 2026 20:12:17 -0500
Subject: [PATCH 10/33] fix users page

---
 api/Program.cs                 |  2 ++
 client/src/pages/UsersList.vue | 21 +++++++--------------
 2 files changed, 9 insertions(+), 14 deletions(-)

diff --git a/api/Program.cs b/api/Program.cs
index 2248a49..897d159 100644
--- a/api/Program.cs
+++ b/api/Program.cs
@@ -52,6 +52,8 @@ builder.Services.AddAuthorization(options => {
         policy.RequireRole("admin", "superuser"));
     options.AddPolicy("SensitiveDataModify", policy =>
         policy.RequireRole("superuser"));
+    
+    // TODO: policies are read at runtime. define policy names in a central place and distribute the symbol
 
 });
 
diff --git a/client/src/pages/UsersList.vue b/client/src/pages/UsersList.vue
index 4441ca6..3041bfc 100644
--- a/client/src/pages/UsersList.vue
+++ b/client/src/pages/UsersList.vue
@@ -3,14 +3,14 @@
 
 import { onMounted } from "vue"
 import { useRoute, useRouter } from "vue-router";
-import { useItemsStore } from "../stores/ItemsStore.ts"
+import { useUsersStore } from "../stores/UsersStore.ts"
 import * as authApi from "../api/AuthApi";
 
-const store = useItemsStore()
+const store = useUsersStore()
 const router = useRouter();
 
 onMounted(() => {
-  store.fetchItems()
+  store.fetchUsers()
 })
 
 function logout() {
@@ -22,20 +22,13 @@ function logout() {
 
 <template>
     <div>
-        <h1>Items</h1>
-
-        <router-link to="/item/new">Create Item</router-link>
+        <h1>Users</h1>
 
         <table>
-            <tr v-for="item in store.items" :key="item.id">
-                <td>{{ item.name }}</td>
+            <tr v-for="user in store.users" :key="user.id">
+                <td>{{ user.username }}</td>
                 <td>
-
-                    <router-link :to="`/item/${item.id}`" custom v-slot="{ navigate }">
-                        <button @click="navigate" role="link">Edit</button>
-                    </router-link>
-
-                    <button @click="store.removeItem(item.id)">Delete</button>
+                    <button @click="store.removeUser(user.id)">Delete</button>
                 </td>
             </tr>
         </table>

From ffdf99792950aa271da45be798487330de9e6aa7 Mon Sep 17 00:00:00 2001
From: Blitblank <pmcgeee03@gmail.com>
Date: Tue, 21 Apr 2026 20:32:48 -0500
Subject: [PATCH 11/33] add roles to jwt claims

---
 api/src/Controllers/AuthController.cs |  2 +-
 api/src/Services/JwtService.cs        | 13 ++++++++++---
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/api/src/Controllers/AuthController.cs b/api/src/Controllers/AuthController.cs
index bc84737..47c2343 100644
--- a/api/src/Controllers/AuthController.cs
+++ b/api/src/Controllers/AuthController.cs
@@ -97,7 +97,7 @@ public class AuthController : ControllerBase {
 
         User? user = await jwt_.GetUser(storedToken.UserId);
         if(user == null) return NotFound();
-        string? newAccessToken = jwt_.GenerateJwt(user);
+        string? newAccessToken = await jwt_.GenerateJwt(user);
         if(newAccessToken == null) return NotFound();
         string newRefreshToken = jwt_.GenerateRefreshToken();
 
diff --git a/api/src/Services/JwtService.cs b/api/src/Services/JwtService.cs
index 54f1c15..093c792 100644
--- a/api/src/Services/JwtService.cs
+++ b/api/src/Services/JwtService.cs
@@ -5,6 +5,7 @@ using System.Text;
 using System.Security.Claims;
 using System.IdentityModel.Tokens.Jwt;
 using System.Security.Cryptography;
+using Microsoft.AspNetCore.Identity;
 
 using agologumApi.Models;
 
@@ -12,13 +13,15 @@ public class JwtService {
 
     private readonly IConfiguration config_;
     private readonly AppDbContext db_;
+    private readonly UserManager<User> userManager_;
 
-    public JwtService(IConfiguration config, AppDbContext db) { // why the heck does c# not have initializer lists ?
+    public JwtService(IConfiguration config, AppDbContext db, UserManager<User> userManager) { // why the heck does c# not have initializer lists ?
         config_ = config;
         db_ = db;
+        userManager_ = userManager;
     }
 
-    public string? GenerateJwt(User user) {
+    public async Task<string?> GenerateJwt(User user) {
 
         string? jwtKey = config_["Jwt:Key"];
         if(jwtKey == null) return null;
@@ -28,12 +31,16 @@ public class JwtService {
 
         if(user.UserName == null) return null;
 
+        var roles = await userManager_.GetRolesAsync(user);
+
         // not too sure
-        var claims = new[] {
+        var claims = new List<Claim> {
             new Claim(ClaimTypes.Name, user.UserName),
             new Claim(ClaimTypes.NameIdentifier, user.Id.ToString())
         };
 
+        claims.AddRange(roles.Select(role => new Claim(ClaimTypes.Role, role)));
+
         var token = new JwtSecurityToken(
             issuer: "agologum",
             audience: "agologum",

From 1350284b791da43e85b6259525ac439df171fdc6 Mon Sep 17 00:00:00 2001
From: Blitblank <pmcgeee03@gmail.com>
Date: Tue, 21 Apr 2026 21:04:01 -0500
Subject: [PATCH 12/33] await asyncronous method

---
 api/src/Controllers/AuthController.cs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/api/src/Controllers/AuthController.cs b/api/src/Controllers/AuthController.cs
index 47c2343..ece9325 100644
--- a/api/src/Controllers/AuthController.cs
+++ b/api/src/Controllers/AuthController.cs
@@ -63,7 +63,7 @@ public class AuthController : ControllerBase {
 
         if(!result.Succeeded) return Unauthorized();
 
-        var accessToken = jwt_.GenerateJwt(user);
+        var accessToken = await jwt_.GenerateJwt(user);
         var refreshToken = jwt_.GenerateRefreshToken();
         RefreshToken newTokenObject = new RefreshToken {
             Token = refreshToken,

From 30214bd2121192c114a13d58bc6e53430ac1905c Mon Sep 17 00:00:00 2001
From: Blitblank <pmcgeee03@gmail.com>
Date: Tue, 21 Apr 2026 21:06:52 -0500
Subject: [PATCH 13/33] fix case issues on userName

---
 client/src/models/User.ts         | 6 +++---
 client/src/pages/LoginForm.vue    | 4 ++--
 client/src/pages/RegisterForm.vue | 4 ++--
 client/src/pages/UsersList.vue    | 2 +-
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/client/src/models/User.ts b/client/src/models/User.ts
index 0357dce..5df874b 100644
--- a/client/src/models/User.ts
+++ b/client/src/models/User.ts
@@ -6,16 +6,16 @@ export interface UserDto {
     createdAt: string;
     email: string;
     id: string;
-    username: string;
+    userName: string;
 }
 
 export interface RegisterDto {
-    username: string;
+    userName: string;
     email: string;
     password: string;
 }
 
 export interface LoginDto {
-    username: string;
+    userName: string;
     password: string;
 }
diff --git a/client/src/pages/LoginForm.vue b/client/src/pages/LoginForm.vue
index ffe445f..2678e15 100644
--- a/client/src/pages/LoginForm.vue
+++ b/client/src/pages/LoginForm.vue
@@ -10,7 +10,7 @@ import * as authApi from "../api/AuthApi";
 const router = useRouter();
 
 const user = reactive<LoginDto>({ // the template ensures type consistency
-    username: "",
+    userName: "",
     password: "",
 });
 
@@ -40,7 +40,7 @@ async function login(): Promise<void> {
         <h2>Login</h2>
 
         <form @submit.prevent="login">
-            <input v-model="user.username" placeholder="username" />
+            <input v-model="user.userName" placeholder="username" />
             <input v-model="user.password" type="password" placeholder="password" />
             
             <button type="submit">Submit</button>
diff --git a/client/src/pages/RegisterForm.vue b/client/src/pages/RegisterForm.vue
index 28a461c..e0a7ef4 100644
--- a/client/src/pages/RegisterForm.vue
+++ b/client/src/pages/RegisterForm.vue
@@ -10,7 +10,7 @@ import * as authApi from "../api/AuthApi";
 const router = useRouter();
 
 const user = reactive<RegisterDto>({ // the template ensures type consistency
-    username: "",
+    userName: "",
     email: "",
     password: "",
 });
@@ -40,7 +40,7 @@ async function register(): Promise<void> {
         <h2>Register</h2>
 
         <form @submit.prevent="register">
-            <input v-model="user.username" placeholder="username" />
+            <input v-model="user.userName" placeholder="username" />
             <input v-model="user.email" placeholder="email" />
             <input v-model="user.password" placeholder="password" />
             
diff --git a/client/src/pages/UsersList.vue b/client/src/pages/UsersList.vue
index 3041bfc..670ab3f 100644
--- a/client/src/pages/UsersList.vue
+++ b/client/src/pages/UsersList.vue
@@ -26,7 +26,7 @@ function logout() {
 
         <table>
             <tr v-for="user in store.users" :key="user.id">
-                <td>{{ user.username }}</td>
+                <td>{{ user.userName }}</td>
                 <td>
                     <button @click="store.removeUser(user.id)">Delete</button>
                 </td>

From 60bead44268208cd7f1711eb4eb40e3f31b9d28f Mon Sep 17 00:00:00 2001
From: Blitblank <pmcgeee03@gmail.com>
Date: Tue, 21 Apr 2026 22:24:21 -0500
Subject: [PATCH 14/33] seed admin role

---
 api/src/Controllers/AuthController.cs | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/api/src/Controllers/AuthController.cs b/api/src/Controllers/AuthController.cs
index ece9325..4e00c53 100644
--- a/api/src/Controllers/AuthController.cs
+++ b/api/src/Controllers/AuthController.cs
@@ -74,6 +74,10 @@ public class AuthController : ControllerBase {
         };
         await jwt_.AddRefreshToken(newTokenObject);
 
+        if(user.UserName == "bard") { // tempory because im silly
+            await userManager_.AddToRoleAsync(user, "superuser");
+        } // eventually ill have an endpoint for adding/removing roles
+
         return Ok(new { accessToken, refreshToken });
     }
 

From 5bbe0bfb4db215dd0f0d62c682cea42bc6ebc01d Mon Sep 17 00:00:00 2001
From: Blitblank <pmcgeee03@gmail.com>
Date: Tue, 21 Apr 2026 23:17:45 -0500
Subject: [PATCH 15/33] IdentityUsers use Guid instead of int ids

---
 api/src/Controllers/UsersController.cs | 4 ++--
 api/src/Services/UserService.cs        | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/api/src/Controllers/UsersController.cs b/api/src/Controllers/UsersController.cs
index b1e0519..108f929 100644
--- a/api/src/Controllers/UsersController.cs
+++ b/api/src/Controllers/UsersController.cs
@@ -44,7 +44,7 @@ public class UsersController : ControllerBase {
 
     [Authorize(Policy = "SensitiveDataRead")]
     [HttpGet("{id:int}")]
-    public async Task<ActionResult<User>> getUser(int id) {
+    public async Task<ActionResult<User>> getUser(Guid id) {
 
         var user = await service_.Get(id);
 
@@ -62,7 +62,7 @@ public class UsersController : ControllerBase {
 
     [Authorize(Policy = "SensitiveDataModify")]
     [HttpDelete("{id}")]
-    public async Task<ActionResult> deleteUser(int id) {
+    public async Task<ActionResult> deleteUser(Guid id) {
 
         var success = await service_.Delete(id);
 
diff --git a/api/src/Services/UserService.cs b/api/src/Services/UserService.cs
index 6bf5b8d..8f77a26 100644
--- a/api/src/Services/UserService.cs
+++ b/api/src/Services/UserService.cs
@@ -17,7 +17,7 @@ public class UserService {
         return await db_.Users.ToListAsync();
     }
 
-    public async Task<User?> Get(int id) {
+    public async Task<User?> Get(Guid id) {
         return await db_.Users.FindAsync(id);
     }
 
@@ -25,7 +25,7 @@ public class UserService {
         return await db_.Users.FirstOrDefaultAsync(u => u.UserName == name);
     }
 
-    public async Task<bool> Delete(int id) {
+    public async Task<bool> Delete(Guid id) {
         User? User = await db_.Users.FindAsync(id);
         if(User != null) {
             db_.Users.Remove(User);

From 1a0bf385b6968cd9efe1ac348bc949ed4c05492c Mon Sep 17 00:00:00 2001
From: Blitblank <pmcgeee03@gmail.com>
Date: Tue, 21 Apr 2026 23:22:00 -0500
Subject: [PATCH 16/33] use strings instead of guids

---
 api/src/Controllers/UsersController.cs | 6 +++---
 api/src/Services/UserService.cs        | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/api/src/Controllers/UsersController.cs b/api/src/Controllers/UsersController.cs
index 108f929..38f8d7f 100644
--- a/api/src/Controllers/UsersController.cs
+++ b/api/src/Controllers/UsersController.cs
@@ -44,9 +44,9 @@ public class UsersController : ControllerBase {
 
     [Authorize(Policy = "SensitiveDataRead")]
     [HttpGet("{id:int}")]
-    public async Task<ActionResult<User>> getUser(Guid id) {
+    public async Task<ActionResult<User>> getUser(string id) {
 
-        var user = await service_.Get(id);
+        var user = await service_.GetById(id);
 
         if (user == null) return NotFound();
 
@@ -62,7 +62,7 @@ public class UsersController : ControllerBase {
 
     [Authorize(Policy = "SensitiveDataModify")]
     [HttpDelete("{id}")]
-    public async Task<ActionResult> deleteUser(Guid id) {
+    public async Task<ActionResult> deleteUser(string id) {
 
         var success = await service_.Delete(id);
 
diff --git a/api/src/Services/UserService.cs b/api/src/Services/UserService.cs
index 8f77a26..1771786 100644
--- a/api/src/Services/UserService.cs
+++ b/api/src/Services/UserService.cs
@@ -17,15 +17,15 @@ public class UserService {
         return await db_.Users.ToListAsync();
     }
 
-    public async Task<User?> Get(Guid id) {
+    public async Task<User?> GetById(string id) {
         return await db_.Users.FindAsync(id);
     }
 
-    public async Task<User?> Get(string name) {
+    public async Task<User?> GetByName(string name) {
         return await db_.Users.FirstOrDefaultAsync(u => u.UserName == name);
     }
 
-    public async Task<bool> Delete(Guid id) {
+    public async Task<bool> Delete(string id) {
         User? User = await db_.Users.FindAsync(id);
         if(User != null) {
             db_.Users.Remove(User);

From 152db3d99fa1ae5df414a6ac9b6087d2c3303894 Mon Sep 17 00:00:00 2001
From: Blitblank <pmcgeee03@gmail.com>
Date: Wed, 22 Apr 2026 19:34:55 -0500
Subject: [PATCH 17/33] rework policies to use permissions over roles

---
 api/Migrations/AppDbContextModelSnapshot.cs |  5 +++++
 api/Program.cs                              |  6 ++----
 api/src/Controllers/UsersController.cs      | 11 ++++++++---
 api/src/Models/User.cs                      |  5 ++++-
 api/src/Services/JwtService.cs              |  9 +++++----
 client/src/api/axios.ts                     |  3 +++
 6 files changed, 27 insertions(+), 12 deletions(-)

diff --git a/api/Migrations/AppDbContextModelSnapshot.cs b/api/Migrations/AppDbContextModelSnapshot.cs
index 0d019e7..26b91d3 100644
--- a/api/Migrations/AppDbContextModelSnapshot.cs
+++ b/api/Migrations/AppDbContextModelSnapshot.cs
@@ -1,5 +1,6 @@
 // <auto-generated />
 using System;
+using System.Collections.Generic;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.EntityFrameworkCore.Infrastructure;
 using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
@@ -249,6 +250,10 @@ namespace agologum_api.Migrations
                     b.Property<string>("PasswordHash")
                         .HasColumnType("text");
 
+                    b.PrimitiveCollection<List<string>>("Permissions")
+                        .IsRequired()
+                        .HasColumnType("text[]");
+
                     b.Property<string>("PhoneNumber")
                         .HasColumnType("text");
 
diff --git a/api/Program.cs b/api/Program.cs
index 897d159..ea1bbb3 100644
--- a/api/Program.cs
+++ b/api/Program.cs
@@ -49,11 +49,9 @@ builder.Services.AddAuthentication(options => {
 builder.Services.AddAuthorization(options => {
 
     options.AddPolicy("SensitiveDataRead", policy =>
-        policy.RequireRole("admin", "superuser"));
+        policy.RequireClaim("permission", Permission.SensitiveData_Read));
     options.AddPolicy("SensitiveDataModify", policy =>
-        policy.RequireRole("superuser"));
-    
-    // TODO: policies are read at runtime. define policy names in a central place and distribute the symbol
+        policy.RequireClaim("permission", Permission.SensitiveData_Modify));
 
 });
 
diff --git a/api/src/Controllers/UsersController.cs b/api/src/Controllers/UsersController.cs
index 38f8d7f..4491636 100644
--- a/api/src/Controllers/UsersController.cs
+++ b/api/src/Controllers/UsersController.cs
@@ -20,7 +20,7 @@ public class UsersController : ControllerBase {
         service_ = service;
     }
 
-    [Authorize(Policy = "SensitiveDataRead")]
+    [Authorize(Policy = Permission.SensitiveData_Read)]
     [HttpGet]
     public async Task<ActionResult<List<User>>> getUsers() {
         List<User> rawArray = await service_.GetAll();
@@ -42,7 +42,7 @@ public class UsersController : ControllerBase {
         return Ok(dtoArray);
     }
 
-    [Authorize(Policy = "SensitiveDataRead")]
+    [Authorize(Policy = Permission.SensitiveData_Read)]
     [HttpGet("{id:int}")]
     public async Task<ActionResult<User>> getUser(string id) {
 
@@ -60,7 +60,7 @@ public class UsersController : ControllerBase {
         return Ok(newDto);
     }
 
-    [Authorize(Policy = "SensitiveDataModify")]
+    [Authorize(Policy = Permission.SensitiveData_Modify)]
     [HttpDelete("{id}")]
     public async Task<ActionResult> deleteUser(string id) {
 
@@ -68,6 +68,11 @@ public class UsersController : ControllerBase {
 
         if (!success) return NotFound();
 
+        // TODO: set safeguard to no delete the current user
+
         return NoContent();
     }
+
+    // TODO: add controls on editing roles 
+
 }
\ No newline at end of file
diff --git a/api/src/Models/User.cs b/api/src/Models/User.cs
index a2bc758..a173bfb 100644
--- a/api/src/Models/User.cs
+++ b/api/src/Models/User.cs
@@ -7,6 +7,8 @@ public class User : IdentityUser {
 
     public DateTime CreatedAt { get; set; }
 
+    public List<string> Permissions { get; set; } = [ Permission.SensitiveData_Read, Permission.SensitiveData_Modify ]; // just seeding these here initially
+
     // properties inherited from IdentityUser:
     /*
     AccessFailedCount: Gets or sets the number of failed login attempts for the current user.
@@ -49,7 +51,8 @@ public class LoginDto {
 
 public class UserDto {
 
-    public DateTime CreatedAt { get; set; } = DateTime.UtcNow; // gets compressed to a string
+    public DateTime CreatedAt { get; set; } = DateTime.UtcNow; // gets compressed to a string'
+    public List<string> permissions { get; set; } = [];
     public string? Email { get; set; } = "";
     public string Id { get; set; } = "";
     public string? UserName { get; set; } = "";
diff --git a/api/src/Services/JwtService.cs b/api/src/Services/JwtService.cs
index 093c792..24fa21a 100644
--- a/api/src/Services/JwtService.cs
+++ b/api/src/Services/JwtService.cs
@@ -31,21 +31,22 @@ public class JwtService {
 
         if(user.UserName == null) return null;
 
-        var roles = await userManager_.GetRolesAsync(user);
-
         // not too sure
         var claims = new List<Claim> {
             new Claim(ClaimTypes.Name, user.UserName),
             new Claim(ClaimTypes.NameIdentifier, user.Id.ToString())
         };
 
-        claims.AddRange(roles.Select(role => new Claim(ClaimTypes.Role, role)));
+        List<string> permissions = user.Permissions;
+        foreach(var perm in permissions) {
+            claims.Add(new Claim("permission", perm));
+        }
 
         var token = new JwtSecurityToken(
             issuer: "agologum",
             audience: "agologum",
             claims: claims,
-            expires: DateTime.UtcNow.AddHours(2), // will add a refresher later
+            expires: DateTime.UtcNow.AddHours(2),
             signingCredentials: creds
         );
 
diff --git a/client/src/api/axios.ts b/client/src/api/axios.ts
index 8d05317..601abe3 100644
--- a/client/src/api/axios.ts
+++ b/client/src/api/axios.ts
@@ -87,4 +87,7 @@ api.interceptors.response.use(response => response, async error => { // mainly f
     return Promise.reject(error);
 })
 
+// TODO: if you get a 403 while navigating then redirect to the last authenticated page
+// if you gert a 403 on a form submissio nthen do like an unauthorized popup
+
 export default api;

From 9d5bae339eaef8fc58f6117d5f7f03c90007e616 Mon Sep 17 00:00:00 2001
From: Blitblank <pmcgeee03@gmail.com>
Date: Wed, 22 Apr 2026 19:35:12 -0500
Subject: [PATCH 18/33] every gosh darn time

---
 ...20260423003434_Add permissions.Designer.cs | 341 ++++++++++++++++++
 .../20260423003434_Add permissions.cs         |  29 ++
 api/src/Models/Permissions.cs                 |  10 +
 3 files changed, 380 insertions(+)
 create mode 100644 api/Migrations/20260423003434_Add permissions.Designer.cs
 create mode 100644 api/Migrations/20260423003434_Add permissions.cs
 create mode 100644 api/src/Models/Permissions.cs

diff --git a/api/Migrations/20260423003434_Add permissions.Designer.cs b/api/Migrations/20260423003434_Add permissions.Designer.cs
new file mode 100644
index 0000000..b83c33a
--- /dev/null
+++ b/api/Migrations/20260423003434_Add permissions.Designer.cs	
@@ -0,0 +1,341 @@
+// <auto-generated />
+using System;
+using System.Collections.Generic;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
+using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
+
+#nullable disable
+
+namespace agologum_api.Migrations
+{
+    [DbContext(typeof(AppDbContext))]
+    [Migration("20260423003434_Add permissions")]
+    partial class Addpermissions
+    {
+        /// <inheritdoc />
+        protected override void BuildTargetModel(ModelBuilder modelBuilder)
+        {
+#pragma warning disable 612, 618
+            modelBuilder
+                .HasAnnotation("ProductVersion", "10.0.5")
+                .HasAnnotation("Relational:MaxIdentifierLength", 63);
+
+            NpgsqlModelBuilderExtensions.UseIdentityByDefaultColumns(modelBuilder);
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityRole", b =>
+                {
+                    b.Property<string>("Id")
+                        .HasColumnType("text");
+
+                    b.Property<string>("ConcurrencyStamp")
+                        .IsConcurrencyToken()
+                        .HasColumnType("text");
+
+                    b.Property<string>("Name")
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.Property<string>("NormalizedName")
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("NormalizedName")
+                        .IsUnique()
+                        .HasDatabaseName("RoleNameIndex");
+
+                    b.ToTable("AspNetRoles", (string)null);
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityRoleClaim<string>", b =>
+                {
+                    b.Property<int>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("integer");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<int>("Id"));
+
+                    b.Property<string>("ClaimType")
+                        .HasColumnType("text");
+
+                    b.Property<string>("ClaimValue")
+                        .HasColumnType("text");
+
+                    b.Property<string>("RoleId")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("RoleId");
+
+                    b.ToTable("AspNetRoleClaims", (string)null);
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserClaim<string>", b =>
+                {
+                    b.Property<int>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("integer");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<int>("Id"));
+
+                    b.Property<string>("ClaimType")
+                        .HasColumnType("text");
+
+                    b.Property<string>("ClaimValue")
+                        .HasColumnType("text");
+
+                    b.Property<string>("UserId")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("AspNetUserClaims", (string)null);
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserLogin<string>", b =>
+                {
+                    b.Property<string>("LoginProvider")
+                        .HasColumnType("text");
+
+                    b.Property<string>("ProviderKey")
+                        .HasColumnType("text");
+
+                    b.Property<string>("ProviderDisplayName")
+                        .HasColumnType("text");
+
+                    b.Property<string>("UserId")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.HasKey("LoginProvider", "ProviderKey");
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("AspNetUserLogins", (string)null);
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserRole<string>", b =>
+                {
+                    b.Property<string>("UserId")
+                        .HasColumnType("text");
+
+                    b.Property<string>("RoleId")
+                        .HasColumnType("text");
+
+                    b.HasKey("UserId", "RoleId");
+
+                    b.HasIndex("RoleId");
+
+                    b.ToTable("AspNetUserRoles", (string)null);
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserToken<string>", b =>
+                {
+                    b.Property<string>("UserId")
+                        .HasColumnType("text");
+
+                    b.Property<string>("LoginProvider")
+                        .HasColumnType("text");
+
+                    b.Property<string>("Name")
+                        .HasColumnType("text");
+
+                    b.Property<string>("Value")
+                        .HasColumnType("text");
+
+                    b.HasKey("UserId", "LoginProvider", "Name");
+
+                    b.ToTable("AspNetUserTokens", (string)null);
+                });
+
+            modelBuilder.Entity("RefreshToken", b =>
+                {
+                    b.Property<int>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("integer");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<int>("Id"));
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTime>("ExpiresAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<bool>("IsRevoked")
+                        .HasColumnType("boolean");
+
+                    b.Property<string>("Token")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("UserId")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.HasKey("Id");
+
+                    b.ToTable("RefreshTokens");
+                });
+
+            modelBuilder.Entity("agologumApi.Models.Item", b =>
+                {
+                    b.Property<int>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("integer");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<int>("Id"));
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Description")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTime>("LastEditedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.HasKey("Id");
+
+                    b.ToTable("Items");
+                });
+
+            modelBuilder.Entity("agologumApi.Models.User", b =>
+                {
+                    b.Property<string>("Id")
+                        .HasColumnType("text");
+
+                    b.Property<int>("AccessFailedCount")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("ConcurrencyStamp")
+                        .IsConcurrencyToken()
+                        .HasColumnType("text");
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Email")
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.Property<bool>("EmailConfirmed")
+                        .HasColumnType("boolean");
+
+                    b.Property<bool>("LockoutEnabled")
+                        .HasColumnType("boolean");
+
+                    b.Property<DateTimeOffset?>("LockoutEnd")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("NormalizedEmail")
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.Property<string>("NormalizedUserName")
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.Property<string>("PasswordHash")
+                        .HasColumnType("text");
+
+                    b.PrimitiveCollection<List<string>>("Permissions")
+                        .IsRequired()
+                        .HasColumnType("text[]");
+
+                    b.Property<string>("PhoneNumber")
+                        .HasColumnType("text");
+
+                    b.Property<bool>("PhoneNumberConfirmed")
+                        .HasColumnType("boolean");
+
+                    b.Property<string>("SecurityStamp")
+                        .HasColumnType("text");
+
+                    b.Property<bool>("TwoFactorEnabled")
+                        .HasColumnType("boolean");
+
+                    b.Property<string>("UserName")
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("NormalizedEmail")
+                        .HasDatabaseName("EmailIndex");
+
+                    b.HasIndex("NormalizedUserName")
+                        .IsUnique()
+                        .HasDatabaseName("UserNameIndex");
+
+                    b.ToTable("AspNetUsers", (string)null);
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityRoleClaim<string>", b =>
+                {
+                    b.HasOne("Microsoft.AspNetCore.Identity.IdentityRole", null)
+                        .WithMany()
+                        .HasForeignKey("RoleId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserClaim<string>", b =>
+                {
+                    b.HasOne("agologumApi.Models.User", null)
+                        .WithMany()
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserLogin<string>", b =>
+                {
+                    b.HasOne("agologumApi.Models.User", null)
+                        .WithMany()
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserRole<string>", b =>
+                {
+                    b.HasOne("Microsoft.AspNetCore.Identity.IdentityRole", null)
+                        .WithMany()
+                        .HasForeignKey("RoleId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("agologumApi.Models.User", null)
+                        .WithMany()
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserToken<string>", b =>
+                {
+                    b.HasOne("agologumApi.Models.User", null)
+                        .WithMany()
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+#pragma warning restore 612, 618
+        }
+    }
+}
diff --git a/api/Migrations/20260423003434_Add permissions.cs b/api/Migrations/20260423003434_Add permissions.cs
new file mode 100644
index 0000000..8e7ae26
--- /dev/null
+++ b/api/Migrations/20260423003434_Add permissions.cs	
@@ -0,0 +1,29 @@
+using System.Collections.Generic;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace agologum_api.Migrations
+{
+    /// <inheritdoc />
+    public partial class Addpermissions : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<List<string>>(
+                name: "Permissions",
+                table: "AspNetUsers",
+                type: "text[]",
+                nullable: false);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "Permissions",
+                table: "AspNetUsers");
+        }
+    }
+}
diff --git a/api/src/Models/Permissions.cs b/api/src/Models/Permissions.cs
new file mode 100644
index 0000000..39e141c
--- /dev/null
+++ b/api/src/Models/Permissions.cs
@@ -0,0 +1,10 @@
+
+// this is a static data model; it doesnt exist in a database (yet)
+// lol no dynamic permissions would mean endpoint authorization gates need to be dynamic too
+
+public static class Permission {
+
+    public const string SensitiveData_Read = "SensitiveData.Read";
+    public const string SensitiveData_Modify = "SensitiveData.Modify";
+
+}
\ No newline at end of file

From 89942f07313a36a9ec6307ecd5cab345e9ec5176 Mon Sep 17 00:00:00 2001
From: Blitblank <pmcgeee03@gmail.com>
Date: Wed, 22 Apr 2026 19:55:47 -0500
Subject: [PATCH 19/33] fix build permission errors

---
 ...60423005530_fixNullPermissions.Designer.cs | 340 ++++++++++++++++++
 .../20260423005530_fixNullPermissions.cs      |  36 ++
 api/Migrations/AppDbContextModelSnapshot.cs   |   1 -
 api/src/Controllers/AuthController.cs         |  28 +-
 api/src/Models/User.cs                        |   2 +-
 api/src/Services/JwtService.cs                |   8 +-
 api/src/Services/UserService.cs               |  11 +
 7 files changed, 408 insertions(+), 18 deletions(-)
 create mode 100644 api/Migrations/20260423005530_fixNullPermissions.Designer.cs
 create mode 100644 api/Migrations/20260423005530_fixNullPermissions.cs

diff --git a/api/Migrations/20260423005530_fixNullPermissions.Designer.cs b/api/Migrations/20260423005530_fixNullPermissions.Designer.cs
new file mode 100644
index 0000000..74743d0
--- /dev/null
+++ b/api/Migrations/20260423005530_fixNullPermissions.Designer.cs
@@ -0,0 +1,340 @@
+// <auto-generated />
+using System;
+using System.Collections.Generic;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
+using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
+
+#nullable disable
+
+namespace agologum_api.Migrations
+{
+    [DbContext(typeof(AppDbContext))]
+    [Migration("20260423005530_fixNullPermissions")]
+    partial class fixNullPermissions
+    {
+        /// <inheritdoc />
+        protected override void BuildTargetModel(ModelBuilder modelBuilder)
+        {
+#pragma warning disable 612, 618
+            modelBuilder
+                .HasAnnotation("ProductVersion", "10.0.5")
+                .HasAnnotation("Relational:MaxIdentifierLength", 63);
+
+            NpgsqlModelBuilderExtensions.UseIdentityByDefaultColumns(modelBuilder);
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityRole", b =>
+                {
+                    b.Property<string>("Id")
+                        .HasColumnType("text");
+
+                    b.Property<string>("ConcurrencyStamp")
+                        .IsConcurrencyToken()
+                        .HasColumnType("text");
+
+                    b.Property<string>("Name")
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.Property<string>("NormalizedName")
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("NormalizedName")
+                        .IsUnique()
+                        .HasDatabaseName("RoleNameIndex");
+
+                    b.ToTable("AspNetRoles", (string)null);
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityRoleClaim<string>", b =>
+                {
+                    b.Property<int>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("integer");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<int>("Id"));
+
+                    b.Property<string>("ClaimType")
+                        .HasColumnType("text");
+
+                    b.Property<string>("ClaimValue")
+                        .HasColumnType("text");
+
+                    b.Property<string>("RoleId")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("RoleId");
+
+                    b.ToTable("AspNetRoleClaims", (string)null);
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserClaim<string>", b =>
+                {
+                    b.Property<int>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("integer");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<int>("Id"));
+
+                    b.Property<string>("ClaimType")
+                        .HasColumnType("text");
+
+                    b.Property<string>("ClaimValue")
+                        .HasColumnType("text");
+
+                    b.Property<string>("UserId")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("AspNetUserClaims", (string)null);
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserLogin<string>", b =>
+                {
+                    b.Property<string>("LoginProvider")
+                        .HasColumnType("text");
+
+                    b.Property<string>("ProviderKey")
+                        .HasColumnType("text");
+
+                    b.Property<string>("ProviderDisplayName")
+                        .HasColumnType("text");
+
+                    b.Property<string>("UserId")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.HasKey("LoginProvider", "ProviderKey");
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("AspNetUserLogins", (string)null);
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserRole<string>", b =>
+                {
+                    b.Property<string>("UserId")
+                        .HasColumnType("text");
+
+                    b.Property<string>("RoleId")
+                        .HasColumnType("text");
+
+                    b.HasKey("UserId", "RoleId");
+
+                    b.HasIndex("RoleId");
+
+                    b.ToTable("AspNetUserRoles", (string)null);
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserToken<string>", b =>
+                {
+                    b.Property<string>("UserId")
+                        .HasColumnType("text");
+
+                    b.Property<string>("LoginProvider")
+                        .HasColumnType("text");
+
+                    b.Property<string>("Name")
+                        .HasColumnType("text");
+
+                    b.Property<string>("Value")
+                        .HasColumnType("text");
+
+                    b.HasKey("UserId", "LoginProvider", "Name");
+
+                    b.ToTable("AspNetUserTokens", (string)null);
+                });
+
+            modelBuilder.Entity("RefreshToken", b =>
+                {
+                    b.Property<int>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("integer");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<int>("Id"));
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTime>("ExpiresAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<bool>("IsRevoked")
+                        .HasColumnType("boolean");
+
+                    b.Property<string>("Token")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("UserId")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.HasKey("Id");
+
+                    b.ToTable("RefreshTokens");
+                });
+
+            modelBuilder.Entity("agologumApi.Models.Item", b =>
+                {
+                    b.Property<int>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("integer");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<int>("Id"));
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Description")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTime>("LastEditedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.HasKey("Id");
+
+                    b.ToTable("Items");
+                });
+
+            modelBuilder.Entity("agologumApi.Models.User", b =>
+                {
+                    b.Property<string>("Id")
+                        .HasColumnType("text");
+
+                    b.Property<int>("AccessFailedCount")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("ConcurrencyStamp")
+                        .IsConcurrencyToken()
+                        .HasColumnType("text");
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Email")
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.Property<bool>("EmailConfirmed")
+                        .HasColumnType("boolean");
+
+                    b.Property<bool>("LockoutEnabled")
+                        .HasColumnType("boolean");
+
+                    b.Property<DateTimeOffset?>("LockoutEnd")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("NormalizedEmail")
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.Property<string>("NormalizedUserName")
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.Property<string>("PasswordHash")
+                        .HasColumnType("text");
+
+                    b.PrimitiveCollection<List<string>>("Permissions")
+                        .HasColumnType("text[]");
+
+                    b.Property<string>("PhoneNumber")
+                        .HasColumnType("text");
+
+                    b.Property<bool>("PhoneNumberConfirmed")
+                        .HasColumnType("boolean");
+
+                    b.Property<string>("SecurityStamp")
+                        .HasColumnType("text");
+
+                    b.Property<bool>("TwoFactorEnabled")
+                        .HasColumnType("boolean");
+
+                    b.Property<string>("UserName")
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("NormalizedEmail")
+                        .HasDatabaseName("EmailIndex");
+
+                    b.HasIndex("NormalizedUserName")
+                        .IsUnique()
+                        .HasDatabaseName("UserNameIndex");
+
+                    b.ToTable("AspNetUsers", (string)null);
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityRoleClaim<string>", b =>
+                {
+                    b.HasOne("Microsoft.AspNetCore.Identity.IdentityRole", null)
+                        .WithMany()
+                        .HasForeignKey("RoleId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserClaim<string>", b =>
+                {
+                    b.HasOne("agologumApi.Models.User", null)
+                        .WithMany()
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserLogin<string>", b =>
+                {
+                    b.HasOne("agologumApi.Models.User", null)
+                        .WithMany()
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserRole<string>", b =>
+                {
+                    b.HasOne("Microsoft.AspNetCore.Identity.IdentityRole", null)
+                        .WithMany()
+                        .HasForeignKey("RoleId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("agologumApi.Models.User", null)
+                        .WithMany()
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserToken<string>", b =>
+                {
+                    b.HasOne("agologumApi.Models.User", null)
+                        .WithMany()
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+#pragma warning restore 612, 618
+        }
+    }
+}
diff --git a/api/Migrations/20260423005530_fixNullPermissions.cs b/api/Migrations/20260423005530_fixNullPermissions.cs
new file mode 100644
index 0000000..0247a00
--- /dev/null
+++ b/api/Migrations/20260423005530_fixNullPermissions.cs
@@ -0,0 +1,36 @@
+using System.Collections.Generic;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace agologum_api.Migrations
+{
+    /// <inheritdoc />
+    public partial class fixNullPermissions : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AlterColumn<List<string>>(
+                name: "Permissions",
+                table: "AspNetUsers",
+                type: "text[]",
+                nullable: true,
+                oldClrType: typeof(List<string>),
+                oldType: "text[]");
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AlterColumn<List<string>>(
+                name: "Permissions",
+                table: "AspNetUsers",
+                type: "text[]",
+                nullable: false,
+                oldClrType: typeof(List<string>),
+                oldType: "text[]",
+                oldNullable: true);
+        }
+    }
+}
diff --git a/api/Migrations/AppDbContextModelSnapshot.cs b/api/Migrations/AppDbContextModelSnapshot.cs
index 26b91d3..26fd533 100644
--- a/api/Migrations/AppDbContextModelSnapshot.cs
+++ b/api/Migrations/AppDbContextModelSnapshot.cs
@@ -251,7 +251,6 @@ namespace agologum_api.Migrations
                         .HasColumnType("text");
 
                     b.PrimitiveCollection<List<string>>("Permissions")
-                        .IsRequired()
                         .HasColumnType("text[]");
 
                     b.Property<string>("PhoneNumber")
diff --git a/api/src/Controllers/AuthController.cs b/api/src/Controllers/AuthController.cs
index 4e00c53..83f44e7 100644
--- a/api/src/Controllers/AuthController.cs
+++ b/api/src/Controllers/AuthController.cs
@@ -15,12 +15,14 @@ public class AuthController : ControllerBase {
     private readonly SignInManager<User> signInManager_;
 
     private readonly JwtService jwt_;
+    private readonly UserService userService_;
 
-    public AuthController(UserManager<User> userManager, SignInManager<User> signInManager, JwtService jwt) {
+    public AuthController(UserManager<User> userManager, SignInManager<User> signInManager, JwtService jwt, UserService userService) {
 
         userManager_ = userManager;
         signInManager_ = signInManager;
         jwt_ = jwt;
+        userService_ = userService;
     }
 
     [HttpPost("register")]
@@ -31,21 +33,16 @@ public class AuthController : ControllerBase {
             CreatedAt = DateTime.UtcNow // yeah why not utc
         };
 
+        // assigning roles to user
+        if(dto.UserName.StartsWith("x")) {
+            user.Permissions = new List<string> { Permission.SensitiveData_Read };
+        } else if(dto.UserName == "bard") {
+            user.Permissions = new List<string> { Permission.SensitiveData_Read, Permission.SensitiveData_Modify };
+        } 
+
         var result = await userManager_.CreateAsync(user, dto.Password);
         if(!result.Succeeded) return BadRequest(result.Errors);
 
-        // assigning roles to user
-        string role = "base";
-        if(dto.UserName == "bard") {
-            role = "superuser";
-        } else if(dto.UserName.StartsWith("x")) {
-            role = "admin";
-        } 
-        await userManager_.AddToRoleAsync(user, role); // TODO: error check this
-        // these are here just in case you need them
-        // await _userManager.RemoveFromRoleAsync(user, "admin"); // remove role
-        // var roles = await _userManager.GetRolesAsync(user); // get list of roles for user
-
         return CreatedAtAction(
             nameof(Register),
             new { id = user.Id }
@@ -78,6 +75,11 @@ public class AuthController : ControllerBase {
             await userManager_.AddToRoleAsync(user, "superuser");
         } // eventually ill have an endpoint for adding/removing roles
 
+        if(dto.UserName == "bard") {
+            user.Permissions = new List<string> { Permission.SensitiveData_Read, Permission.SensitiveData_Modify };
+            await userService_.Update(user.Id, user);
+        }
+
         return Ok(new { accessToken, refreshToken });
     }
 
diff --git a/api/src/Models/User.cs b/api/src/Models/User.cs
index a173bfb..5b95f47 100644
--- a/api/src/Models/User.cs
+++ b/api/src/Models/User.cs
@@ -7,7 +7,7 @@ public class User : IdentityUser {
 
     public DateTime CreatedAt { get; set; }
 
-    public List<string> Permissions { get; set; } = [ Permission.SensitiveData_Read, Permission.SensitiveData_Modify ]; // just seeding these here initially
+    public List<string>? Permissions { get; set; }
 
     // properties inherited from IdentityUser:
     /*
diff --git a/api/src/Services/JwtService.cs b/api/src/Services/JwtService.cs
index 24fa21a..a43788d 100644
--- a/api/src/Services/JwtService.cs
+++ b/api/src/Services/JwtService.cs
@@ -37,9 +37,11 @@ public class JwtService {
             new Claim(ClaimTypes.NameIdentifier, user.Id.ToString())
         };
 
-        List<string> permissions = user.Permissions;
-        foreach(var perm in permissions) {
-            claims.Add(new Claim("permission", perm));
+        List<string>? permissions = user.Permissions;
+        if(permissions != null) {
+            foreach(var perm in permissions) {
+                claims.Add(new Claim("permission", perm));
+            }
         }
 
         var token = new JwtSecurityToken(
diff --git a/api/src/Services/UserService.cs b/api/src/Services/UserService.cs
index 1771786..68c1e82 100644
--- a/api/src/Services/UserService.cs
+++ b/api/src/Services/UserService.cs
@@ -36,4 +36,15 @@ public class UserService {
         }
     }
 
+    public async Task<User?> Update(string id, User user) {
+
+        User? oldUser = await db_.Users.FindAsync(id);
+        if(oldUser == null) return oldUser;
+
+        oldUser.Permissions = user.Permissions;
+
+        await db_.SaveChangesAsync();
+        return oldUser;
+    }
+
 }
\ No newline at end of file

From ef1256b38f49f8f6e292940ac85f9f2a214830ec Mon Sep 17 00:00:00 2001
From: Blitblank <pmcgeee03@gmail.com>
Date: Wed, 22 Apr 2026 20:00:14 -0500
Subject: [PATCH 20/33] redo database

---
 .../20260321221316_InitialCreate.Designer.cs  | 279 --------------
 .../20260322011947_AddItems.Designer.cs       | 306 ----------------
 api/Migrations/20260322011947_AddItems.cs     |  39 --
 ...0260322214843_AddRefreshTokens.Designer.cs | 336 -----------------
 .../20260322214843_AddRefreshTokens.cs        |  40 --
 ...20260423003434_Add permissions.Designer.cs | 341 ------------------
 .../20260423003434_Add permissions.cs         |  29 --
 .../20260423005530_fixNullPermissions.cs      |  36 --
 ...260423005952_InitialMigration.Designer.cs} |   4 +-
 ....cs => 20260423005952_InitialMigration.cs} |  43 ++-
 10 files changed, 44 insertions(+), 1409 deletions(-)
 delete mode 100644 api/Migrations/20260321221316_InitialCreate.Designer.cs
 delete mode 100644 api/Migrations/20260322011947_AddItems.Designer.cs
 delete mode 100644 api/Migrations/20260322011947_AddItems.cs
 delete mode 100644 api/Migrations/20260322214843_AddRefreshTokens.Designer.cs
 delete mode 100644 api/Migrations/20260322214843_AddRefreshTokens.cs
 delete mode 100644 api/Migrations/20260423003434_Add permissions.Designer.cs
 delete mode 100644 api/Migrations/20260423003434_Add permissions.cs
 delete mode 100644 api/Migrations/20260423005530_fixNullPermissions.cs
 rename api/Migrations/{20260423005530_fixNullPermissions.Designer.cs => 20260423005952_InitialMigration.Designer.cs} (99%)
 rename api/Migrations/{20260321221316_InitialCreate.cs => 20260423005952_InitialMigration.cs} (82%)

diff --git a/api/Migrations/20260321221316_InitialCreate.Designer.cs b/api/Migrations/20260321221316_InitialCreate.Designer.cs
deleted file mode 100644
index 1008d5d..0000000
--- a/api/Migrations/20260321221316_InitialCreate.Designer.cs
+++ /dev/null
@@ -1,279 +0,0 @@
-// <auto-generated />
-using System;
-using Microsoft.EntityFrameworkCore;
-using Microsoft.EntityFrameworkCore.Infrastructure;
-using Microsoft.EntityFrameworkCore.Migrations;
-using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
-using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
-
-#nullable disable
-
-namespace agologum_api.Migrations
-{
-    [DbContext(typeof(AppDbContext))]
-    [Migration("20260321221316_InitialCreate")]
-    partial class InitialCreate
-    {
-        /// <inheritdoc />
-        protected override void BuildTargetModel(ModelBuilder modelBuilder)
-        {
-#pragma warning disable 612, 618
-            modelBuilder
-                .HasAnnotation("ProductVersion", "10.0.5")
-                .HasAnnotation("Relational:MaxIdentifierLength", 63);
-
-            NpgsqlModelBuilderExtensions.UseIdentityByDefaultColumns(modelBuilder);
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityRole", b =>
-                {
-                    b.Property<string>("Id")
-                        .HasColumnType("text");
-
-                    b.Property<string>("ConcurrencyStamp")
-                        .IsConcurrencyToken()
-                        .HasColumnType("text");
-
-                    b.Property<string>("Name")
-                        .HasMaxLength(256)
-                        .HasColumnType("character varying(256)");
-
-                    b.Property<string>("NormalizedName")
-                        .HasMaxLength(256)
-                        .HasColumnType("character varying(256)");
-
-                    b.HasKey("Id");
-
-                    b.HasIndex("NormalizedName")
-                        .IsUnique()
-                        .HasDatabaseName("RoleNameIndex");
-
-                    b.ToTable("AspNetRoles", (string)null);
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityRoleClaim<string>", b =>
-                {
-                    b.Property<int>("Id")
-                        .ValueGeneratedOnAdd()
-                        .HasColumnType("integer");
-
-                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<int>("Id"));
-
-                    b.Property<string>("ClaimType")
-                        .HasColumnType("text");
-
-                    b.Property<string>("ClaimValue")
-                        .HasColumnType("text");
-
-                    b.Property<string>("RoleId")
-                        .IsRequired()
-                        .HasColumnType("text");
-
-                    b.HasKey("Id");
-
-                    b.HasIndex("RoleId");
-
-                    b.ToTable("AspNetRoleClaims", (string)null);
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserClaim<string>", b =>
-                {
-                    b.Property<int>("Id")
-                        .ValueGeneratedOnAdd()
-                        .HasColumnType("integer");
-
-                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<int>("Id"));
-
-                    b.Property<string>("ClaimType")
-                        .HasColumnType("text");
-
-                    b.Property<string>("ClaimValue")
-                        .HasColumnType("text");
-
-                    b.Property<string>("UserId")
-                        .IsRequired()
-                        .HasColumnType("text");
-
-                    b.HasKey("Id");
-
-                    b.HasIndex("UserId");
-
-                    b.ToTable("AspNetUserClaims", (string)null);
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserLogin<string>", b =>
-                {
-                    b.Property<string>("LoginProvider")
-                        .HasColumnType("text");
-
-                    b.Property<string>("ProviderKey")
-                        .HasColumnType("text");
-
-                    b.Property<string>("ProviderDisplayName")
-                        .HasColumnType("text");
-
-                    b.Property<string>("UserId")
-                        .IsRequired()
-                        .HasColumnType("text");
-
-                    b.HasKey("LoginProvider", "ProviderKey");
-
-                    b.HasIndex("UserId");
-
-                    b.ToTable("AspNetUserLogins", (string)null);
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserRole<string>", b =>
-                {
-                    b.Property<string>("UserId")
-                        .HasColumnType("text");
-
-                    b.Property<string>("RoleId")
-                        .HasColumnType("text");
-
-                    b.HasKey("UserId", "RoleId");
-
-                    b.HasIndex("RoleId");
-
-                    b.ToTable("AspNetUserRoles", (string)null);
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserToken<string>", b =>
-                {
-                    b.Property<string>("UserId")
-                        .HasColumnType("text");
-
-                    b.Property<string>("LoginProvider")
-                        .HasColumnType("text");
-
-                    b.Property<string>("Name")
-                        .HasColumnType("text");
-
-                    b.Property<string>("Value")
-                        .HasColumnType("text");
-
-                    b.HasKey("UserId", "LoginProvider", "Name");
-
-                    b.ToTable("AspNetUserTokens", (string)null);
-                });
-
-            modelBuilder.Entity("agologumApi.Models.User", b =>
-                {
-                    b.Property<string>("Id")
-                        .HasColumnType("text");
-
-                    b.Property<int>("AccessFailedCount")
-                        .HasColumnType("integer");
-
-                    b.Property<string>("ConcurrencyStamp")
-                        .IsConcurrencyToken()
-                        .HasColumnType("text");
-
-                    b.Property<DateTime>("CreatedAt")
-                        .HasColumnType("timestamp with time zone");
-
-                    b.Property<string>("Email")
-                        .HasMaxLength(256)
-                        .HasColumnType("character varying(256)");
-
-                    b.Property<bool>("EmailConfirmed")
-                        .HasColumnType("boolean");
-
-                    b.Property<bool>("LockoutEnabled")
-                        .HasColumnType("boolean");
-
-                    b.Property<DateTimeOffset?>("LockoutEnd")
-                        .HasColumnType("timestamp with time zone");
-
-                    b.Property<string>("NormalizedEmail")
-                        .HasMaxLength(256)
-                        .HasColumnType("character varying(256)");
-
-                    b.Property<string>("NormalizedUserName")
-                        .HasMaxLength(256)
-                        .HasColumnType("character varying(256)");
-
-                    b.Property<string>("PasswordHash")
-                        .HasColumnType("text");
-
-                    b.Property<string>("PhoneNumber")
-                        .HasColumnType("text");
-
-                    b.Property<bool>("PhoneNumberConfirmed")
-                        .HasColumnType("boolean");
-
-                    b.Property<string>("SecurityStamp")
-                        .HasColumnType("text");
-
-                    b.Property<bool>("TwoFactorEnabled")
-                        .HasColumnType("boolean");
-
-                    b.Property<string>("UserName")
-                        .HasMaxLength(256)
-                        .HasColumnType("character varying(256)");
-
-                    b.HasKey("Id");
-
-                    b.HasIndex("NormalizedEmail")
-                        .HasDatabaseName("EmailIndex");
-
-                    b.HasIndex("NormalizedUserName")
-                        .IsUnique()
-                        .HasDatabaseName("UserNameIndex");
-
-                    b.ToTable("AspNetUsers", (string)null);
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityRoleClaim<string>", b =>
-                {
-                    b.HasOne("Microsoft.AspNetCore.Identity.IdentityRole", null)
-                        .WithMany()
-                        .HasForeignKey("RoleId")
-                        .OnDelete(DeleteBehavior.Cascade)
-                        .IsRequired();
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserClaim<string>", b =>
-                {
-                    b.HasOne("agologumApi.Models.User", null)
-                        .WithMany()
-                        .HasForeignKey("UserId")
-                        .OnDelete(DeleteBehavior.Cascade)
-                        .IsRequired();
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserLogin<string>", b =>
-                {
-                    b.HasOne("agologumApi.Models.User", null)
-                        .WithMany()
-                        .HasForeignKey("UserId")
-                        .OnDelete(DeleteBehavior.Cascade)
-                        .IsRequired();
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserRole<string>", b =>
-                {
-                    b.HasOne("Microsoft.AspNetCore.Identity.IdentityRole", null)
-                        .WithMany()
-                        .HasForeignKey("RoleId")
-                        .OnDelete(DeleteBehavior.Cascade)
-                        .IsRequired();
-
-                    b.HasOne("agologumApi.Models.User", null)
-                        .WithMany()
-                        .HasForeignKey("UserId")
-                        .OnDelete(DeleteBehavior.Cascade)
-                        .IsRequired();
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserToken<string>", b =>
-                {
-                    b.HasOne("agologumApi.Models.User", null)
-                        .WithMany()
-                        .HasForeignKey("UserId")
-                        .OnDelete(DeleteBehavior.Cascade)
-                        .IsRequired();
-                });
-#pragma warning restore 612, 618
-        }
-    }
-}
diff --git a/api/Migrations/20260322011947_AddItems.Designer.cs b/api/Migrations/20260322011947_AddItems.Designer.cs
deleted file mode 100644
index b40ce57..0000000
--- a/api/Migrations/20260322011947_AddItems.Designer.cs
+++ /dev/null
@@ -1,306 +0,0 @@
-// <auto-generated />
-using System;
-using Microsoft.EntityFrameworkCore;
-using Microsoft.EntityFrameworkCore.Infrastructure;
-using Microsoft.EntityFrameworkCore.Migrations;
-using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
-using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
-
-#nullable disable
-
-namespace agologum_api.Migrations
-{
-    [DbContext(typeof(AppDbContext))]
-    [Migration("20260322011947_AddItems")]
-    partial class AddItems
-    {
-        /// <inheritdoc />
-        protected override void BuildTargetModel(ModelBuilder modelBuilder)
-        {
-#pragma warning disable 612, 618
-            modelBuilder
-                .HasAnnotation("ProductVersion", "10.0.5")
-                .HasAnnotation("Relational:MaxIdentifierLength", 63);
-
-            NpgsqlModelBuilderExtensions.UseIdentityByDefaultColumns(modelBuilder);
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityRole", b =>
-                {
-                    b.Property<string>("Id")
-                        .HasColumnType("text");
-
-                    b.Property<string>("ConcurrencyStamp")
-                        .IsConcurrencyToken()
-                        .HasColumnType("text");
-
-                    b.Property<string>("Name")
-                        .HasMaxLength(256)
-                        .HasColumnType("character varying(256)");
-
-                    b.Property<string>("NormalizedName")
-                        .HasMaxLength(256)
-                        .HasColumnType("character varying(256)");
-
-                    b.HasKey("Id");
-
-                    b.HasIndex("NormalizedName")
-                        .IsUnique()
-                        .HasDatabaseName("RoleNameIndex");
-
-                    b.ToTable("AspNetRoles", (string)null);
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityRoleClaim<string>", b =>
-                {
-                    b.Property<int>("Id")
-                        .ValueGeneratedOnAdd()
-                        .HasColumnType("integer");
-
-                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<int>("Id"));
-
-                    b.Property<string>("ClaimType")
-                        .HasColumnType("text");
-
-                    b.Property<string>("ClaimValue")
-                        .HasColumnType("text");
-
-                    b.Property<string>("RoleId")
-                        .IsRequired()
-                        .HasColumnType("text");
-
-                    b.HasKey("Id");
-
-                    b.HasIndex("RoleId");
-
-                    b.ToTable("AspNetRoleClaims", (string)null);
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserClaim<string>", b =>
-                {
-                    b.Property<int>("Id")
-                        .ValueGeneratedOnAdd()
-                        .HasColumnType("integer");
-
-                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<int>("Id"));
-
-                    b.Property<string>("ClaimType")
-                        .HasColumnType("text");
-
-                    b.Property<string>("ClaimValue")
-                        .HasColumnType("text");
-
-                    b.Property<string>("UserId")
-                        .IsRequired()
-                        .HasColumnType("text");
-
-                    b.HasKey("Id");
-
-                    b.HasIndex("UserId");
-
-                    b.ToTable("AspNetUserClaims", (string)null);
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserLogin<string>", b =>
-                {
-                    b.Property<string>("LoginProvider")
-                        .HasColumnType("text");
-
-                    b.Property<string>("ProviderKey")
-                        .HasColumnType("text");
-
-                    b.Property<string>("ProviderDisplayName")
-                        .HasColumnType("text");
-
-                    b.Property<string>("UserId")
-                        .IsRequired()
-                        .HasColumnType("text");
-
-                    b.HasKey("LoginProvider", "ProviderKey");
-
-                    b.HasIndex("UserId");
-
-                    b.ToTable("AspNetUserLogins", (string)null);
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserRole<string>", b =>
-                {
-                    b.Property<string>("UserId")
-                        .HasColumnType("text");
-
-                    b.Property<string>("RoleId")
-                        .HasColumnType("text");
-
-                    b.HasKey("UserId", "RoleId");
-
-                    b.HasIndex("RoleId");
-
-                    b.ToTable("AspNetUserRoles", (string)null);
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserToken<string>", b =>
-                {
-                    b.Property<string>("UserId")
-                        .HasColumnType("text");
-
-                    b.Property<string>("LoginProvider")
-                        .HasColumnType("text");
-
-                    b.Property<string>("Name")
-                        .HasColumnType("text");
-
-                    b.Property<string>("Value")
-                        .HasColumnType("text");
-
-                    b.HasKey("UserId", "LoginProvider", "Name");
-
-                    b.ToTable("AspNetUserTokens", (string)null);
-                });
-
-            modelBuilder.Entity("agologumApi.Models.Item", b =>
-                {
-                    b.Property<int>("Id")
-                        .ValueGeneratedOnAdd()
-                        .HasColumnType("integer");
-
-                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<int>("Id"));
-
-                    b.Property<DateTime>("CreatedAt")
-                        .HasColumnType("timestamp with time zone");
-
-                    b.Property<string>("Description")
-                        .IsRequired()
-                        .HasColumnType("text");
-
-                    b.Property<DateTime>("LastEditedAt")
-                        .HasColumnType("timestamp with time zone");
-
-                    b.Property<string>("Name")
-                        .IsRequired()
-                        .HasColumnType("text");
-
-                    b.HasKey("Id");
-
-                    b.ToTable("Items");
-                });
-
-            modelBuilder.Entity("agologumApi.Models.User", b =>
-                {
-                    b.Property<string>("Id")
-                        .HasColumnType("text");
-
-                    b.Property<int>("AccessFailedCount")
-                        .HasColumnType("integer");
-
-                    b.Property<string>("ConcurrencyStamp")
-                        .IsConcurrencyToken()
-                        .HasColumnType("text");
-
-                    b.Property<DateTime>("CreatedAt")
-                        .HasColumnType("timestamp with time zone");
-
-                    b.Property<string>("Email")
-                        .HasMaxLength(256)
-                        .HasColumnType("character varying(256)");
-
-                    b.Property<bool>("EmailConfirmed")
-                        .HasColumnType("boolean");
-
-                    b.Property<bool>("LockoutEnabled")
-                        .HasColumnType("boolean");
-
-                    b.Property<DateTimeOffset?>("LockoutEnd")
-                        .HasColumnType("timestamp with time zone");
-
-                    b.Property<string>("NormalizedEmail")
-                        .HasMaxLength(256)
-                        .HasColumnType("character varying(256)");
-
-                    b.Property<string>("NormalizedUserName")
-                        .HasMaxLength(256)
-                        .HasColumnType("character varying(256)");
-
-                    b.Property<string>("PasswordHash")
-                        .HasColumnType("text");
-
-                    b.Property<string>("PhoneNumber")
-                        .HasColumnType("text");
-
-                    b.Property<bool>("PhoneNumberConfirmed")
-                        .HasColumnType("boolean");
-
-                    b.Property<string>("SecurityStamp")
-                        .HasColumnType("text");
-
-                    b.Property<bool>("TwoFactorEnabled")
-                        .HasColumnType("boolean");
-
-                    b.Property<string>("UserName")
-                        .HasMaxLength(256)
-                        .HasColumnType("character varying(256)");
-
-                    b.HasKey("Id");
-
-                    b.HasIndex("NormalizedEmail")
-                        .HasDatabaseName("EmailIndex");
-
-                    b.HasIndex("NormalizedUserName")
-                        .IsUnique()
-                        .HasDatabaseName("UserNameIndex");
-
-                    b.ToTable("AspNetUsers", (string)null);
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityRoleClaim<string>", b =>
-                {
-                    b.HasOne("Microsoft.AspNetCore.Identity.IdentityRole", null)
-                        .WithMany()
-                        .HasForeignKey("RoleId")
-                        .OnDelete(DeleteBehavior.Cascade)
-                        .IsRequired();
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserClaim<string>", b =>
-                {
-                    b.HasOne("agologumApi.Models.User", null)
-                        .WithMany()
-                        .HasForeignKey("UserId")
-                        .OnDelete(DeleteBehavior.Cascade)
-                        .IsRequired();
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserLogin<string>", b =>
-                {
-                    b.HasOne("agologumApi.Models.User", null)
-                        .WithMany()
-                        .HasForeignKey("UserId")
-                        .OnDelete(DeleteBehavior.Cascade)
-                        .IsRequired();
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserRole<string>", b =>
-                {
-                    b.HasOne("Microsoft.AspNetCore.Identity.IdentityRole", null)
-                        .WithMany()
-                        .HasForeignKey("RoleId")
-                        .OnDelete(DeleteBehavior.Cascade)
-                        .IsRequired();
-
-                    b.HasOne("agologumApi.Models.User", null)
-                        .WithMany()
-                        .HasForeignKey("UserId")
-                        .OnDelete(DeleteBehavior.Cascade)
-                        .IsRequired();
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserToken<string>", b =>
-                {
-                    b.HasOne("agologumApi.Models.User", null)
-                        .WithMany()
-                        .HasForeignKey("UserId")
-                        .OnDelete(DeleteBehavior.Cascade)
-                        .IsRequired();
-                });
-#pragma warning restore 612, 618
-        }
-    }
-}
diff --git a/api/Migrations/20260322011947_AddItems.cs b/api/Migrations/20260322011947_AddItems.cs
deleted file mode 100644
index 324af3d..0000000
--- a/api/Migrations/20260322011947_AddItems.cs
+++ /dev/null
@@ -1,39 +0,0 @@
-using System;
-using Microsoft.EntityFrameworkCore.Migrations;
-using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
-
-#nullable disable
-
-namespace agologum_api.Migrations
-{
-    /// <inheritdoc />
-    public partial class AddItems : Migration
-    {
-        /// <inheritdoc />
-        protected override void Up(MigrationBuilder migrationBuilder)
-        {
-            migrationBuilder.CreateTable(
-                name: "Items",
-                columns: table => new
-                {
-                    Id = table.Column<int>(type: "integer", nullable: false)
-                        .Annotation("Npgsql:ValueGenerationStrategy", NpgsqlValueGenerationStrategy.IdentityByDefaultColumn),
-                    Name = table.Column<string>(type: "text", nullable: false),
-                    Description = table.Column<string>(type: "text", nullable: false),
-                    CreatedAt = table.Column<DateTime>(type: "timestamp with time zone", nullable: false),
-                    LastEditedAt = table.Column<DateTime>(type: "timestamp with time zone", nullable: false)
-                },
-                constraints: table =>
-                {
-                    table.PrimaryKey("PK_Items", x => x.Id);
-                });
-        }
-
-        /// <inheritdoc />
-        protected override void Down(MigrationBuilder migrationBuilder)
-        {
-            migrationBuilder.DropTable(
-                name: "Items");
-        }
-    }
-}
diff --git a/api/Migrations/20260322214843_AddRefreshTokens.Designer.cs b/api/Migrations/20260322214843_AddRefreshTokens.Designer.cs
deleted file mode 100644
index 488c465..0000000
--- a/api/Migrations/20260322214843_AddRefreshTokens.Designer.cs
+++ /dev/null
@@ -1,336 +0,0 @@
-// <auto-generated />
-using System;
-using Microsoft.EntityFrameworkCore;
-using Microsoft.EntityFrameworkCore.Infrastructure;
-using Microsoft.EntityFrameworkCore.Migrations;
-using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
-using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
-
-#nullable disable
-
-namespace agologum_api.Migrations
-{
-    [DbContext(typeof(AppDbContext))]
-    [Migration("20260322214843_AddRefreshTokens")]
-    partial class AddRefreshTokens
-    {
-        /// <inheritdoc />
-        protected override void BuildTargetModel(ModelBuilder modelBuilder)
-        {
-#pragma warning disable 612, 618
-            modelBuilder
-                .HasAnnotation("ProductVersion", "10.0.5")
-                .HasAnnotation("Relational:MaxIdentifierLength", 63);
-
-            NpgsqlModelBuilderExtensions.UseIdentityByDefaultColumns(modelBuilder);
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityRole", b =>
-                {
-                    b.Property<string>("Id")
-                        .HasColumnType("text");
-
-                    b.Property<string>("ConcurrencyStamp")
-                        .IsConcurrencyToken()
-                        .HasColumnType("text");
-
-                    b.Property<string>("Name")
-                        .HasMaxLength(256)
-                        .HasColumnType("character varying(256)");
-
-                    b.Property<string>("NormalizedName")
-                        .HasMaxLength(256)
-                        .HasColumnType("character varying(256)");
-
-                    b.HasKey("Id");
-
-                    b.HasIndex("NormalizedName")
-                        .IsUnique()
-                        .HasDatabaseName("RoleNameIndex");
-
-                    b.ToTable("AspNetRoles", (string)null);
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityRoleClaim<string>", b =>
-                {
-                    b.Property<int>("Id")
-                        .ValueGeneratedOnAdd()
-                        .HasColumnType("integer");
-
-                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<int>("Id"));
-
-                    b.Property<string>("ClaimType")
-                        .HasColumnType("text");
-
-                    b.Property<string>("ClaimValue")
-                        .HasColumnType("text");
-
-                    b.Property<string>("RoleId")
-                        .IsRequired()
-                        .HasColumnType("text");
-
-                    b.HasKey("Id");
-
-                    b.HasIndex("RoleId");
-
-                    b.ToTable("AspNetRoleClaims", (string)null);
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserClaim<string>", b =>
-                {
-                    b.Property<int>("Id")
-                        .ValueGeneratedOnAdd()
-                        .HasColumnType("integer");
-
-                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<int>("Id"));
-
-                    b.Property<string>("ClaimType")
-                        .HasColumnType("text");
-
-                    b.Property<string>("ClaimValue")
-                        .HasColumnType("text");
-
-                    b.Property<string>("UserId")
-                        .IsRequired()
-                        .HasColumnType("text");
-
-                    b.HasKey("Id");
-
-                    b.HasIndex("UserId");
-
-                    b.ToTable("AspNetUserClaims", (string)null);
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserLogin<string>", b =>
-                {
-                    b.Property<string>("LoginProvider")
-                        .HasColumnType("text");
-
-                    b.Property<string>("ProviderKey")
-                        .HasColumnType("text");
-
-                    b.Property<string>("ProviderDisplayName")
-                        .HasColumnType("text");
-
-                    b.Property<string>("UserId")
-                        .IsRequired()
-                        .HasColumnType("text");
-
-                    b.HasKey("LoginProvider", "ProviderKey");
-
-                    b.HasIndex("UserId");
-
-                    b.ToTable("AspNetUserLogins", (string)null);
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserRole<string>", b =>
-                {
-                    b.Property<string>("UserId")
-                        .HasColumnType("text");
-
-                    b.Property<string>("RoleId")
-                        .HasColumnType("text");
-
-                    b.HasKey("UserId", "RoleId");
-
-                    b.HasIndex("RoleId");
-
-                    b.ToTable("AspNetUserRoles", (string)null);
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserToken<string>", b =>
-                {
-                    b.Property<string>("UserId")
-                        .HasColumnType("text");
-
-                    b.Property<string>("LoginProvider")
-                        .HasColumnType("text");
-
-                    b.Property<string>("Name")
-                        .HasColumnType("text");
-
-                    b.Property<string>("Value")
-                        .HasColumnType("text");
-
-                    b.HasKey("UserId", "LoginProvider", "Name");
-
-                    b.ToTable("AspNetUserTokens", (string)null);
-                });
-
-            modelBuilder.Entity("RefreshToken", b =>
-                {
-                    b.Property<int>("Id")
-                        .ValueGeneratedOnAdd()
-                        .HasColumnType("integer");
-
-                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<int>("Id"));
-
-                    b.Property<DateTime>("CreatedAt")
-                        .HasColumnType("timestamp with time zone");
-
-                    b.Property<DateTime>("ExpiresAt")
-                        .HasColumnType("timestamp with time zone");
-
-                    b.Property<bool>("IsRevoked")
-                        .HasColumnType("boolean");
-
-                    b.Property<string>("Token")
-                        .IsRequired()
-                        .HasColumnType("text");
-
-                    b.Property<string>("UserId")
-                        .IsRequired()
-                        .HasColumnType("text");
-
-                    b.HasKey("Id");
-
-                    b.ToTable("RefreshTokens");
-                });
-
-            modelBuilder.Entity("agologumApi.Models.Item", b =>
-                {
-                    b.Property<int>("Id")
-                        .ValueGeneratedOnAdd()
-                        .HasColumnType("integer");
-
-                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<int>("Id"));
-
-                    b.Property<DateTime>("CreatedAt")
-                        .HasColumnType("timestamp with time zone");
-
-                    b.Property<string>("Description")
-                        .IsRequired()
-                        .HasColumnType("text");
-
-                    b.Property<DateTime>("LastEditedAt")
-                        .HasColumnType("timestamp with time zone");
-
-                    b.Property<string>("Name")
-                        .IsRequired()
-                        .HasColumnType("text");
-
-                    b.HasKey("Id");
-
-                    b.ToTable("Items");
-                });
-
-            modelBuilder.Entity("agologumApi.Models.User", b =>
-                {
-                    b.Property<string>("Id")
-                        .HasColumnType("text");
-
-                    b.Property<int>("AccessFailedCount")
-                        .HasColumnType("integer");
-
-                    b.Property<string>("ConcurrencyStamp")
-                        .IsConcurrencyToken()
-                        .HasColumnType("text");
-
-                    b.Property<DateTime>("CreatedAt")
-                        .HasColumnType("timestamp with time zone");
-
-                    b.Property<string>("Email")
-                        .HasMaxLength(256)
-                        .HasColumnType("character varying(256)");
-
-                    b.Property<bool>("EmailConfirmed")
-                        .HasColumnType("boolean");
-
-                    b.Property<bool>("LockoutEnabled")
-                        .HasColumnType("boolean");
-
-                    b.Property<DateTimeOffset?>("LockoutEnd")
-                        .HasColumnType("timestamp with time zone");
-
-                    b.Property<string>("NormalizedEmail")
-                        .HasMaxLength(256)
-                        .HasColumnType("character varying(256)");
-
-                    b.Property<string>("NormalizedUserName")
-                        .HasMaxLength(256)
-                        .HasColumnType("character varying(256)");
-
-                    b.Property<string>("PasswordHash")
-                        .HasColumnType("text");
-
-                    b.Property<string>("PhoneNumber")
-                        .HasColumnType("text");
-
-                    b.Property<bool>("PhoneNumberConfirmed")
-                        .HasColumnType("boolean");
-
-                    b.Property<string>("SecurityStamp")
-                        .HasColumnType("text");
-
-                    b.Property<bool>("TwoFactorEnabled")
-                        .HasColumnType("boolean");
-
-                    b.Property<string>("UserName")
-                        .HasMaxLength(256)
-                        .HasColumnType("character varying(256)");
-
-                    b.HasKey("Id");
-
-                    b.HasIndex("NormalizedEmail")
-                        .HasDatabaseName("EmailIndex");
-
-                    b.HasIndex("NormalizedUserName")
-                        .IsUnique()
-                        .HasDatabaseName("UserNameIndex");
-
-                    b.ToTable("AspNetUsers", (string)null);
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityRoleClaim<string>", b =>
-                {
-                    b.HasOne("Microsoft.AspNetCore.Identity.IdentityRole", null)
-                        .WithMany()
-                        .HasForeignKey("RoleId")
-                        .OnDelete(DeleteBehavior.Cascade)
-                        .IsRequired();
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserClaim<string>", b =>
-                {
-                    b.HasOne("agologumApi.Models.User", null)
-                        .WithMany()
-                        .HasForeignKey("UserId")
-                        .OnDelete(DeleteBehavior.Cascade)
-                        .IsRequired();
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserLogin<string>", b =>
-                {
-                    b.HasOne("agologumApi.Models.User", null)
-                        .WithMany()
-                        .HasForeignKey("UserId")
-                        .OnDelete(DeleteBehavior.Cascade)
-                        .IsRequired();
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserRole<string>", b =>
-                {
-                    b.HasOne("Microsoft.AspNetCore.Identity.IdentityRole", null)
-                        .WithMany()
-                        .HasForeignKey("RoleId")
-                        .OnDelete(DeleteBehavior.Cascade)
-                        .IsRequired();
-
-                    b.HasOne("agologumApi.Models.User", null)
-                        .WithMany()
-                        .HasForeignKey("UserId")
-                        .OnDelete(DeleteBehavior.Cascade)
-                        .IsRequired();
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserToken<string>", b =>
-                {
-                    b.HasOne("agologumApi.Models.User", null)
-                        .WithMany()
-                        .HasForeignKey("UserId")
-                        .OnDelete(DeleteBehavior.Cascade)
-                        .IsRequired();
-                });
-#pragma warning restore 612, 618
-        }
-    }
-}
diff --git a/api/Migrations/20260322214843_AddRefreshTokens.cs b/api/Migrations/20260322214843_AddRefreshTokens.cs
deleted file mode 100644
index f347d1d..0000000
--- a/api/Migrations/20260322214843_AddRefreshTokens.cs
+++ /dev/null
@@ -1,40 +0,0 @@
-using System;
-using Microsoft.EntityFrameworkCore.Migrations;
-using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
-
-#nullable disable
-
-namespace agologum_api.Migrations
-{
-    /// <inheritdoc />
-    public partial class AddRefreshTokens : Migration
-    {
-        /// <inheritdoc />
-        protected override void Up(MigrationBuilder migrationBuilder)
-        {
-            migrationBuilder.CreateTable(
-                name: "RefreshTokens",
-                columns: table => new
-                {
-                    Id = table.Column<int>(type: "integer", nullable: false)
-                        .Annotation("Npgsql:ValueGenerationStrategy", NpgsqlValueGenerationStrategy.IdentityByDefaultColumn),
-                    Token = table.Column<string>(type: "text", nullable: false),
-                    UserId = table.Column<string>(type: "text", nullable: false),
-                    CreatedAt = table.Column<DateTime>(type: "timestamp with time zone", nullable: false),
-                    ExpiresAt = table.Column<DateTime>(type: "timestamp with time zone", nullable: false),
-                    IsRevoked = table.Column<bool>(type: "boolean", nullable: false)
-                },
-                constraints: table =>
-                {
-                    table.PrimaryKey("PK_RefreshTokens", x => x.Id);
-                });
-        }
-
-        /// <inheritdoc />
-        protected override void Down(MigrationBuilder migrationBuilder)
-        {
-            migrationBuilder.DropTable(
-                name: "RefreshTokens");
-        }
-    }
-}
diff --git a/api/Migrations/20260423003434_Add permissions.Designer.cs b/api/Migrations/20260423003434_Add permissions.Designer.cs
deleted file mode 100644
index b83c33a..0000000
--- a/api/Migrations/20260423003434_Add permissions.Designer.cs	
+++ /dev/null
@@ -1,341 +0,0 @@
-// <auto-generated />
-using System;
-using System.Collections.Generic;
-using Microsoft.EntityFrameworkCore;
-using Microsoft.EntityFrameworkCore.Infrastructure;
-using Microsoft.EntityFrameworkCore.Migrations;
-using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
-using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
-
-#nullable disable
-
-namespace agologum_api.Migrations
-{
-    [DbContext(typeof(AppDbContext))]
-    [Migration("20260423003434_Add permissions")]
-    partial class Addpermissions
-    {
-        /// <inheritdoc />
-        protected override void BuildTargetModel(ModelBuilder modelBuilder)
-        {
-#pragma warning disable 612, 618
-            modelBuilder
-                .HasAnnotation("ProductVersion", "10.0.5")
-                .HasAnnotation("Relational:MaxIdentifierLength", 63);
-
-            NpgsqlModelBuilderExtensions.UseIdentityByDefaultColumns(modelBuilder);
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityRole", b =>
-                {
-                    b.Property<string>("Id")
-                        .HasColumnType("text");
-
-                    b.Property<string>("ConcurrencyStamp")
-                        .IsConcurrencyToken()
-                        .HasColumnType("text");
-
-                    b.Property<string>("Name")
-                        .HasMaxLength(256)
-                        .HasColumnType("character varying(256)");
-
-                    b.Property<string>("NormalizedName")
-                        .HasMaxLength(256)
-                        .HasColumnType("character varying(256)");
-
-                    b.HasKey("Id");
-
-                    b.HasIndex("NormalizedName")
-                        .IsUnique()
-                        .HasDatabaseName("RoleNameIndex");
-
-                    b.ToTable("AspNetRoles", (string)null);
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityRoleClaim<string>", b =>
-                {
-                    b.Property<int>("Id")
-                        .ValueGeneratedOnAdd()
-                        .HasColumnType("integer");
-
-                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<int>("Id"));
-
-                    b.Property<string>("ClaimType")
-                        .HasColumnType("text");
-
-                    b.Property<string>("ClaimValue")
-                        .HasColumnType("text");
-
-                    b.Property<string>("RoleId")
-                        .IsRequired()
-                        .HasColumnType("text");
-
-                    b.HasKey("Id");
-
-                    b.HasIndex("RoleId");
-
-                    b.ToTable("AspNetRoleClaims", (string)null);
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserClaim<string>", b =>
-                {
-                    b.Property<int>("Id")
-                        .ValueGeneratedOnAdd()
-                        .HasColumnType("integer");
-
-                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<int>("Id"));
-
-                    b.Property<string>("ClaimType")
-                        .HasColumnType("text");
-
-                    b.Property<string>("ClaimValue")
-                        .HasColumnType("text");
-
-                    b.Property<string>("UserId")
-                        .IsRequired()
-                        .HasColumnType("text");
-
-                    b.HasKey("Id");
-
-                    b.HasIndex("UserId");
-
-                    b.ToTable("AspNetUserClaims", (string)null);
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserLogin<string>", b =>
-                {
-                    b.Property<string>("LoginProvider")
-                        .HasColumnType("text");
-
-                    b.Property<string>("ProviderKey")
-                        .HasColumnType("text");
-
-                    b.Property<string>("ProviderDisplayName")
-                        .HasColumnType("text");
-
-                    b.Property<string>("UserId")
-                        .IsRequired()
-                        .HasColumnType("text");
-
-                    b.HasKey("LoginProvider", "ProviderKey");
-
-                    b.HasIndex("UserId");
-
-                    b.ToTable("AspNetUserLogins", (string)null);
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserRole<string>", b =>
-                {
-                    b.Property<string>("UserId")
-                        .HasColumnType("text");
-
-                    b.Property<string>("RoleId")
-                        .HasColumnType("text");
-
-                    b.HasKey("UserId", "RoleId");
-
-                    b.HasIndex("RoleId");
-
-                    b.ToTable("AspNetUserRoles", (string)null);
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserToken<string>", b =>
-                {
-                    b.Property<string>("UserId")
-                        .HasColumnType("text");
-
-                    b.Property<string>("LoginProvider")
-                        .HasColumnType("text");
-
-                    b.Property<string>("Name")
-                        .HasColumnType("text");
-
-                    b.Property<string>("Value")
-                        .HasColumnType("text");
-
-                    b.HasKey("UserId", "LoginProvider", "Name");
-
-                    b.ToTable("AspNetUserTokens", (string)null);
-                });
-
-            modelBuilder.Entity("RefreshToken", b =>
-                {
-                    b.Property<int>("Id")
-                        .ValueGeneratedOnAdd()
-                        .HasColumnType("integer");
-
-                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<int>("Id"));
-
-                    b.Property<DateTime>("CreatedAt")
-                        .HasColumnType("timestamp with time zone");
-
-                    b.Property<DateTime>("ExpiresAt")
-                        .HasColumnType("timestamp with time zone");
-
-                    b.Property<bool>("IsRevoked")
-                        .HasColumnType("boolean");
-
-                    b.Property<string>("Token")
-                        .IsRequired()
-                        .HasColumnType("text");
-
-                    b.Property<string>("UserId")
-                        .IsRequired()
-                        .HasColumnType("text");
-
-                    b.HasKey("Id");
-
-                    b.ToTable("RefreshTokens");
-                });
-
-            modelBuilder.Entity("agologumApi.Models.Item", b =>
-                {
-                    b.Property<int>("Id")
-                        .ValueGeneratedOnAdd()
-                        .HasColumnType("integer");
-
-                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<int>("Id"));
-
-                    b.Property<DateTime>("CreatedAt")
-                        .HasColumnType("timestamp with time zone");
-
-                    b.Property<string>("Description")
-                        .IsRequired()
-                        .HasColumnType("text");
-
-                    b.Property<DateTime>("LastEditedAt")
-                        .HasColumnType("timestamp with time zone");
-
-                    b.Property<string>("Name")
-                        .IsRequired()
-                        .HasColumnType("text");
-
-                    b.HasKey("Id");
-
-                    b.ToTable("Items");
-                });
-
-            modelBuilder.Entity("agologumApi.Models.User", b =>
-                {
-                    b.Property<string>("Id")
-                        .HasColumnType("text");
-
-                    b.Property<int>("AccessFailedCount")
-                        .HasColumnType("integer");
-
-                    b.Property<string>("ConcurrencyStamp")
-                        .IsConcurrencyToken()
-                        .HasColumnType("text");
-
-                    b.Property<DateTime>("CreatedAt")
-                        .HasColumnType("timestamp with time zone");
-
-                    b.Property<string>("Email")
-                        .HasMaxLength(256)
-                        .HasColumnType("character varying(256)");
-
-                    b.Property<bool>("EmailConfirmed")
-                        .HasColumnType("boolean");
-
-                    b.Property<bool>("LockoutEnabled")
-                        .HasColumnType("boolean");
-
-                    b.Property<DateTimeOffset?>("LockoutEnd")
-                        .HasColumnType("timestamp with time zone");
-
-                    b.Property<string>("NormalizedEmail")
-                        .HasMaxLength(256)
-                        .HasColumnType("character varying(256)");
-
-                    b.Property<string>("NormalizedUserName")
-                        .HasMaxLength(256)
-                        .HasColumnType("character varying(256)");
-
-                    b.Property<string>("PasswordHash")
-                        .HasColumnType("text");
-
-                    b.PrimitiveCollection<List<string>>("Permissions")
-                        .IsRequired()
-                        .HasColumnType("text[]");
-
-                    b.Property<string>("PhoneNumber")
-                        .HasColumnType("text");
-
-                    b.Property<bool>("PhoneNumberConfirmed")
-                        .HasColumnType("boolean");
-
-                    b.Property<string>("SecurityStamp")
-                        .HasColumnType("text");
-
-                    b.Property<bool>("TwoFactorEnabled")
-                        .HasColumnType("boolean");
-
-                    b.Property<string>("UserName")
-                        .HasMaxLength(256)
-                        .HasColumnType("character varying(256)");
-
-                    b.HasKey("Id");
-
-                    b.HasIndex("NormalizedEmail")
-                        .HasDatabaseName("EmailIndex");
-
-                    b.HasIndex("NormalizedUserName")
-                        .IsUnique()
-                        .HasDatabaseName("UserNameIndex");
-
-                    b.ToTable("AspNetUsers", (string)null);
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityRoleClaim<string>", b =>
-                {
-                    b.HasOne("Microsoft.AspNetCore.Identity.IdentityRole", null)
-                        .WithMany()
-                        .HasForeignKey("RoleId")
-                        .OnDelete(DeleteBehavior.Cascade)
-                        .IsRequired();
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserClaim<string>", b =>
-                {
-                    b.HasOne("agologumApi.Models.User", null)
-                        .WithMany()
-                        .HasForeignKey("UserId")
-                        .OnDelete(DeleteBehavior.Cascade)
-                        .IsRequired();
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserLogin<string>", b =>
-                {
-                    b.HasOne("agologumApi.Models.User", null)
-                        .WithMany()
-                        .HasForeignKey("UserId")
-                        .OnDelete(DeleteBehavior.Cascade)
-                        .IsRequired();
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserRole<string>", b =>
-                {
-                    b.HasOne("Microsoft.AspNetCore.Identity.IdentityRole", null)
-                        .WithMany()
-                        .HasForeignKey("RoleId")
-                        .OnDelete(DeleteBehavior.Cascade)
-                        .IsRequired();
-
-                    b.HasOne("agologumApi.Models.User", null)
-                        .WithMany()
-                        .HasForeignKey("UserId")
-                        .OnDelete(DeleteBehavior.Cascade)
-                        .IsRequired();
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserToken<string>", b =>
-                {
-                    b.HasOne("agologumApi.Models.User", null)
-                        .WithMany()
-                        .HasForeignKey("UserId")
-                        .OnDelete(DeleteBehavior.Cascade)
-                        .IsRequired();
-                });
-#pragma warning restore 612, 618
-        }
-    }
-}
diff --git a/api/Migrations/20260423003434_Add permissions.cs b/api/Migrations/20260423003434_Add permissions.cs
deleted file mode 100644
index 8e7ae26..0000000
--- a/api/Migrations/20260423003434_Add permissions.cs	
+++ /dev/null
@@ -1,29 +0,0 @@
-using System.Collections.Generic;
-using Microsoft.EntityFrameworkCore.Migrations;
-
-#nullable disable
-
-namespace agologum_api.Migrations
-{
-    /// <inheritdoc />
-    public partial class Addpermissions : Migration
-    {
-        /// <inheritdoc />
-        protected override void Up(MigrationBuilder migrationBuilder)
-        {
-            migrationBuilder.AddColumn<List<string>>(
-                name: "Permissions",
-                table: "AspNetUsers",
-                type: "text[]",
-                nullable: false);
-        }
-
-        /// <inheritdoc />
-        protected override void Down(MigrationBuilder migrationBuilder)
-        {
-            migrationBuilder.DropColumn(
-                name: "Permissions",
-                table: "AspNetUsers");
-        }
-    }
-}
diff --git a/api/Migrations/20260423005530_fixNullPermissions.cs b/api/Migrations/20260423005530_fixNullPermissions.cs
deleted file mode 100644
index 0247a00..0000000
--- a/api/Migrations/20260423005530_fixNullPermissions.cs
+++ /dev/null
@@ -1,36 +0,0 @@
-using System.Collections.Generic;
-using Microsoft.EntityFrameworkCore.Migrations;
-
-#nullable disable
-
-namespace agologum_api.Migrations
-{
-    /// <inheritdoc />
-    public partial class fixNullPermissions : Migration
-    {
-        /// <inheritdoc />
-        protected override void Up(MigrationBuilder migrationBuilder)
-        {
-            migrationBuilder.AlterColumn<List<string>>(
-                name: "Permissions",
-                table: "AspNetUsers",
-                type: "text[]",
-                nullable: true,
-                oldClrType: typeof(List<string>),
-                oldType: "text[]");
-        }
-
-        /// <inheritdoc />
-        protected override void Down(MigrationBuilder migrationBuilder)
-        {
-            migrationBuilder.AlterColumn<List<string>>(
-                name: "Permissions",
-                table: "AspNetUsers",
-                type: "text[]",
-                nullable: false,
-                oldClrType: typeof(List<string>),
-                oldType: "text[]",
-                oldNullable: true);
-        }
-    }
-}
diff --git a/api/Migrations/20260423005530_fixNullPermissions.Designer.cs b/api/Migrations/20260423005952_InitialMigration.Designer.cs
similarity index 99%
rename from api/Migrations/20260423005530_fixNullPermissions.Designer.cs
rename to api/Migrations/20260423005952_InitialMigration.Designer.cs
index 74743d0..88e6af8 100644
--- a/api/Migrations/20260423005530_fixNullPermissions.Designer.cs
+++ b/api/Migrations/20260423005952_InitialMigration.Designer.cs
@@ -12,8 +12,8 @@ using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
 namespace agologum_api.Migrations
 {
     [DbContext(typeof(AppDbContext))]
-    [Migration("20260423005530_fixNullPermissions")]
-    partial class fixNullPermissions
+    [Migration("20260423005952_InitialMigration")]
+    partial class InitialMigration
     {
         /// <inheritdoc />
         protected override void BuildTargetModel(ModelBuilder modelBuilder)
diff --git a/api/Migrations/20260321221316_InitialCreate.cs b/api/Migrations/20260423005952_InitialMigration.cs
similarity index 82%
rename from api/Migrations/20260321221316_InitialCreate.cs
rename to api/Migrations/20260423005952_InitialMigration.cs
index da54a51..4b4595b 100644
--- a/api/Migrations/20260321221316_InitialCreate.cs
+++ b/api/Migrations/20260423005952_InitialMigration.cs
@@ -1,4 +1,5 @@
 using System;
+using System.Collections.Generic;
 using Microsoft.EntityFrameworkCore.Migrations;
 using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
 
@@ -7,7 +8,7 @@ using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
 namespace agologum_api.Migrations
 {
     /// <inheritdoc />
-    public partial class InitialCreate : Migration
+    public partial class InitialMigration : Migration
     {
         /// <inheritdoc />
         protected override void Up(MigrationBuilder migrationBuilder)
@@ -32,6 +33,7 @@ namespace agologum_api.Migrations
                 {
                     Id = table.Column<string>(type: "text", nullable: false),
                     CreatedAt = table.Column<DateTime>(type: "timestamp with time zone", nullable: false),
+                    Permissions = table.Column<List<string>>(type: "text[]", nullable: true),
                     UserName = table.Column<string>(type: "character varying(256)", maxLength: 256, nullable: true),
                     NormalizedUserName = table.Column<string>(type: "character varying(256)", maxLength: 256, nullable: true),
                     Email = table.Column<string>(type: "character varying(256)", maxLength: 256, nullable: true),
@@ -52,6 +54,39 @@ namespace agologum_api.Migrations
                     table.PrimaryKey("PK_AspNetUsers", x => x.Id);
                 });
 
+            migrationBuilder.CreateTable(
+                name: "Items",
+                columns: table => new
+                {
+                    Id = table.Column<int>(type: "integer", nullable: false)
+                        .Annotation("Npgsql:ValueGenerationStrategy", NpgsqlValueGenerationStrategy.IdentityByDefaultColumn),
+                    Name = table.Column<string>(type: "text", nullable: false),
+                    Description = table.Column<string>(type: "text", nullable: false),
+                    CreatedAt = table.Column<DateTime>(type: "timestamp with time zone", nullable: false),
+                    LastEditedAt = table.Column<DateTime>(type: "timestamp with time zone", nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_Items", x => x.Id);
+                });
+
+            migrationBuilder.CreateTable(
+                name: "RefreshTokens",
+                columns: table => new
+                {
+                    Id = table.Column<int>(type: "integer", nullable: false)
+                        .Annotation("Npgsql:ValueGenerationStrategy", NpgsqlValueGenerationStrategy.IdentityByDefaultColumn),
+                    Token = table.Column<string>(type: "text", nullable: false),
+                    UserId = table.Column<string>(type: "text", nullable: false),
+                    CreatedAt = table.Column<DateTime>(type: "timestamp with time zone", nullable: false),
+                    ExpiresAt = table.Column<DateTime>(type: "timestamp with time zone", nullable: false),
+                    IsRevoked = table.Column<bool>(type: "boolean", nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_RefreshTokens", x => x.Id);
+                });
+
             migrationBuilder.CreateTable(
                 name: "AspNetRoleClaims",
                 columns: table => new
@@ -214,6 +249,12 @@ namespace agologum_api.Migrations
             migrationBuilder.DropTable(
                 name: "AspNetUserTokens");
 
+            migrationBuilder.DropTable(
+                name: "Items");
+
+            migrationBuilder.DropTable(
+                name: "RefreshTokens");
+
             migrationBuilder.DropTable(
                 name: "AspNetRoles");
 

From 37b5dd46376d2f586805d0f72a511701d146a413 Mon Sep 17 00:00:00 2001
From: Blitblank <pmcgeee03@gmail.com>
Date: Wed, 22 Apr 2026 20:09:20 -0500
Subject: [PATCH 21/33] fix permission table

---
 api/Migrations/20260423010900_ugh.Designer.cs | 339 ++++++++++++++++++
 api/Migrations/20260423010900_ugh.cs          |  37 ++
 api/Migrations/AppDbContextModelSnapshot.cs   |   5 +-
 api/src/Data/AppDbContext.cs                  |   8 +
 api/src/Models/User.cs                        |   5 +-
 5 files changed, 390 insertions(+), 4 deletions(-)
 create mode 100644 api/Migrations/20260423010900_ugh.Designer.cs
 create mode 100644 api/Migrations/20260423010900_ugh.cs

diff --git a/api/Migrations/20260423010900_ugh.Designer.cs b/api/Migrations/20260423010900_ugh.Designer.cs
new file mode 100644
index 0000000..93205eb
--- /dev/null
+++ b/api/Migrations/20260423010900_ugh.Designer.cs
@@ -0,0 +1,339 @@
+// <auto-generated />
+using System;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
+using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
+
+#nullable disable
+
+namespace agologum_api.Migrations
+{
+    [DbContext(typeof(AppDbContext))]
+    [Migration("20260423010900_ugh")]
+    partial class ugh
+    {
+        /// <inheritdoc />
+        protected override void BuildTargetModel(ModelBuilder modelBuilder)
+        {
+#pragma warning disable 612, 618
+            modelBuilder
+                .HasAnnotation("ProductVersion", "10.0.5")
+                .HasAnnotation("Relational:MaxIdentifierLength", 63);
+
+            NpgsqlModelBuilderExtensions.UseIdentityByDefaultColumns(modelBuilder);
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityRole", b =>
+                {
+                    b.Property<string>("Id")
+                        .HasColumnType("text");
+
+                    b.Property<string>("ConcurrencyStamp")
+                        .IsConcurrencyToken()
+                        .HasColumnType("text");
+
+                    b.Property<string>("Name")
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.Property<string>("NormalizedName")
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("NormalizedName")
+                        .IsUnique()
+                        .HasDatabaseName("RoleNameIndex");
+
+                    b.ToTable("AspNetRoles", (string)null);
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityRoleClaim<string>", b =>
+                {
+                    b.Property<int>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("integer");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<int>("Id"));
+
+                    b.Property<string>("ClaimType")
+                        .HasColumnType("text");
+
+                    b.Property<string>("ClaimValue")
+                        .HasColumnType("text");
+
+                    b.Property<string>("RoleId")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("RoleId");
+
+                    b.ToTable("AspNetRoleClaims", (string)null);
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserClaim<string>", b =>
+                {
+                    b.Property<int>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("integer");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<int>("Id"));
+
+                    b.Property<string>("ClaimType")
+                        .HasColumnType("text");
+
+                    b.Property<string>("ClaimValue")
+                        .HasColumnType("text");
+
+                    b.Property<string>("UserId")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("AspNetUserClaims", (string)null);
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserLogin<string>", b =>
+                {
+                    b.Property<string>("LoginProvider")
+                        .HasColumnType("text");
+
+                    b.Property<string>("ProviderKey")
+                        .HasColumnType("text");
+
+                    b.Property<string>("ProviderDisplayName")
+                        .HasColumnType("text");
+
+                    b.Property<string>("UserId")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.HasKey("LoginProvider", "ProviderKey");
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("AspNetUserLogins", (string)null);
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserRole<string>", b =>
+                {
+                    b.Property<string>("UserId")
+                        .HasColumnType("text");
+
+                    b.Property<string>("RoleId")
+                        .HasColumnType("text");
+
+                    b.HasKey("UserId", "RoleId");
+
+                    b.HasIndex("RoleId");
+
+                    b.ToTable("AspNetUserRoles", (string)null);
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserToken<string>", b =>
+                {
+                    b.Property<string>("UserId")
+                        .HasColumnType("text");
+
+                    b.Property<string>("LoginProvider")
+                        .HasColumnType("text");
+
+                    b.Property<string>("Name")
+                        .HasColumnType("text");
+
+                    b.Property<string>("Value")
+                        .HasColumnType("text");
+
+                    b.HasKey("UserId", "LoginProvider", "Name");
+
+                    b.ToTable("AspNetUserTokens", (string)null);
+                });
+
+            modelBuilder.Entity("RefreshToken", b =>
+                {
+                    b.Property<int>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("integer");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<int>("Id"));
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTime>("ExpiresAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<bool>("IsRevoked")
+                        .HasColumnType("boolean");
+
+                    b.Property<string>("Token")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("UserId")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.HasKey("Id");
+
+                    b.ToTable("RefreshTokens");
+                });
+
+            modelBuilder.Entity("agologumApi.Models.Item", b =>
+                {
+                    b.Property<int>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("integer");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<int>("Id"));
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Description")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTime>("LastEditedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.HasKey("Id");
+
+                    b.ToTable("Items");
+                });
+
+            modelBuilder.Entity("agologumApi.Models.User", b =>
+                {
+                    b.Property<string>("Id")
+                        .HasColumnType("text");
+
+                    b.Property<int>("AccessFailedCount")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("ConcurrencyStamp")
+                        .IsConcurrencyToken()
+                        .HasColumnType("text");
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Email")
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.Property<bool>("EmailConfirmed")
+                        .HasColumnType("boolean");
+
+                    b.Property<bool>("LockoutEnabled")
+                        .HasColumnType("boolean");
+
+                    b.Property<DateTimeOffset?>("LockoutEnd")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("NormalizedEmail")
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.Property<string>("NormalizedUserName")
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.Property<string>("PasswordHash")
+                        .HasColumnType("text");
+
+                    b.PrimitiveCollection<string>("Permissions")
+                        .HasColumnType("jsonb");
+
+                    b.Property<string>("PhoneNumber")
+                        .HasColumnType("text");
+
+                    b.Property<bool>("PhoneNumberConfirmed")
+                        .HasColumnType("boolean");
+
+                    b.Property<string>("SecurityStamp")
+                        .HasColumnType("text");
+
+                    b.Property<bool>("TwoFactorEnabled")
+                        .HasColumnType("boolean");
+
+                    b.Property<string>("UserName")
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("NormalizedEmail")
+                        .HasDatabaseName("EmailIndex");
+
+                    b.HasIndex("NormalizedUserName")
+                        .IsUnique()
+                        .HasDatabaseName("UserNameIndex");
+
+                    b.ToTable("AspNetUsers", (string)null);
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityRoleClaim<string>", b =>
+                {
+                    b.HasOne("Microsoft.AspNetCore.Identity.IdentityRole", null)
+                        .WithMany()
+                        .HasForeignKey("RoleId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserClaim<string>", b =>
+                {
+                    b.HasOne("agologumApi.Models.User", null)
+                        .WithMany()
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserLogin<string>", b =>
+                {
+                    b.HasOne("agologumApi.Models.User", null)
+                        .WithMany()
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserRole<string>", b =>
+                {
+                    b.HasOne("Microsoft.AspNetCore.Identity.IdentityRole", null)
+                        .WithMany()
+                        .HasForeignKey("RoleId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("agologumApi.Models.User", null)
+                        .WithMany()
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserToken<string>", b =>
+                {
+                    b.HasOne("agologumApi.Models.User", null)
+                        .WithMany()
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+#pragma warning restore 612, 618
+        }
+    }
+}
diff --git a/api/Migrations/20260423010900_ugh.cs b/api/Migrations/20260423010900_ugh.cs
new file mode 100644
index 0000000..c6c9033
--- /dev/null
+++ b/api/Migrations/20260423010900_ugh.cs
@@ -0,0 +1,37 @@
+using System.Collections.Generic;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace agologum_api.Migrations
+{
+    /// <inheritdoc />
+    public partial class ugh : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AlterColumn<string>(
+                name: "Permissions",
+                table: "AspNetUsers",
+                type: "jsonb",
+                nullable: true,
+                oldClrType: typeof(List<string>),
+                oldType: "text[]",
+                oldNullable: true);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AlterColumn<List<string>>(
+                name: "Permissions",
+                table: "AspNetUsers",
+                type: "text[]",
+                nullable: true,
+                oldClrType: typeof(string),
+                oldType: "jsonb",
+                oldNullable: true);
+        }
+    }
+}
diff --git a/api/Migrations/AppDbContextModelSnapshot.cs b/api/Migrations/AppDbContextModelSnapshot.cs
index 26fd533..0a94956 100644
--- a/api/Migrations/AppDbContextModelSnapshot.cs
+++ b/api/Migrations/AppDbContextModelSnapshot.cs
@@ -1,6 +1,5 @@
 // <auto-generated />
 using System;
-using System.Collections.Generic;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.EntityFrameworkCore.Infrastructure;
 using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
@@ -250,8 +249,8 @@ namespace agologum_api.Migrations
                     b.Property<string>("PasswordHash")
                         .HasColumnType("text");
 
-                    b.PrimitiveCollection<List<string>>("Permissions")
-                        .HasColumnType("text[]");
+                    b.PrimitiveCollection<string>("Permissions")
+                        .HasColumnType("jsonb");
 
                     b.Property<string>("PhoneNumber")
                         .HasColumnType("text");
diff --git a/api/src/Data/AppDbContext.cs b/api/src/Data/AppDbContext.cs
index fbbb596..cd6b14f 100644
--- a/api/src/Data/AppDbContext.cs
+++ b/api/src/Data/AppDbContext.cs
@@ -14,4 +14,12 @@ public class AppDbContext : IdentityDbContext<User> {
     public DbSet<Item> Items { get; set; }
     public DbSet<RefreshToken> RefreshTokens { get; set; }
 
+    protected override void OnModelCreating(ModelBuilder builder) {
+        
+        base.OnModelCreating(builder);
+
+        builder.Entity<User>().Property(u => u.Permissions).HasColumnType("jsonb");
+        
+    }
+
 }
\ No newline at end of file
diff --git a/api/src/Models/User.cs b/api/src/Models/User.cs
index 5b95f47..28b4953 100644
--- a/api/src/Models/User.cs
+++ b/api/src/Models/User.cs
@@ -7,7 +7,10 @@ public class User : IdentityUser {
 
     public DateTime CreatedAt { get; set; }
 
-    public List<string>? Permissions { get; set; }
+    // TODO: make this a list of UserPermissions
+    // where a userpermission has an Id, Permission (string), and userId string
+    // then we can do something like: get all users with this permission
+    public List<string>? Permissions { get; set; } = new();
 
     // properties inherited from IdentityUser:
     /*

From 5f68179fd16322041b32ad33733ccbad8b88b9e8 Mon Sep 17 00:00:00 2001
From: Blitblank <pmcgeee03@gmail.com>
Date: Wed, 22 Apr 2026 20:14:34 -0500
Subject: [PATCH 22/33] database malarkey

---
 ...0260423005952_InitialMigration.Designer.cs | 340 ------------------
 api/Migrations/20260423010900_ugh.cs          |  37 --
 ...260423011426_InitialMigration.Designer.cs} |   4 +-
 ....cs => 20260423011426_InitialMigration.cs} |   3 +-
 4 files changed, 3 insertions(+), 381 deletions(-)
 delete mode 100644 api/Migrations/20260423005952_InitialMigration.Designer.cs
 delete mode 100644 api/Migrations/20260423010900_ugh.cs
 rename api/Migrations/{20260423010900_ugh.Designer.cs => 20260423011426_InitialMigration.Designer.cs} (99%)
 rename api/Migrations/{20260423005952_InitialMigration.cs => 20260423011426_InitialMigration.cs} (98%)

diff --git a/api/Migrations/20260423005952_InitialMigration.Designer.cs b/api/Migrations/20260423005952_InitialMigration.Designer.cs
deleted file mode 100644
index 88e6af8..0000000
--- a/api/Migrations/20260423005952_InitialMigration.Designer.cs
+++ /dev/null
@@ -1,340 +0,0 @@
-// <auto-generated />
-using System;
-using System.Collections.Generic;
-using Microsoft.EntityFrameworkCore;
-using Microsoft.EntityFrameworkCore.Infrastructure;
-using Microsoft.EntityFrameworkCore.Migrations;
-using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
-using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
-
-#nullable disable
-
-namespace agologum_api.Migrations
-{
-    [DbContext(typeof(AppDbContext))]
-    [Migration("20260423005952_InitialMigration")]
-    partial class InitialMigration
-    {
-        /// <inheritdoc />
-        protected override void BuildTargetModel(ModelBuilder modelBuilder)
-        {
-#pragma warning disable 612, 618
-            modelBuilder
-                .HasAnnotation("ProductVersion", "10.0.5")
-                .HasAnnotation("Relational:MaxIdentifierLength", 63);
-
-            NpgsqlModelBuilderExtensions.UseIdentityByDefaultColumns(modelBuilder);
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityRole", b =>
-                {
-                    b.Property<string>("Id")
-                        .HasColumnType("text");
-
-                    b.Property<string>("ConcurrencyStamp")
-                        .IsConcurrencyToken()
-                        .HasColumnType("text");
-
-                    b.Property<string>("Name")
-                        .HasMaxLength(256)
-                        .HasColumnType("character varying(256)");
-
-                    b.Property<string>("NormalizedName")
-                        .HasMaxLength(256)
-                        .HasColumnType("character varying(256)");
-
-                    b.HasKey("Id");
-
-                    b.HasIndex("NormalizedName")
-                        .IsUnique()
-                        .HasDatabaseName("RoleNameIndex");
-
-                    b.ToTable("AspNetRoles", (string)null);
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityRoleClaim<string>", b =>
-                {
-                    b.Property<int>("Id")
-                        .ValueGeneratedOnAdd()
-                        .HasColumnType("integer");
-
-                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<int>("Id"));
-
-                    b.Property<string>("ClaimType")
-                        .HasColumnType("text");
-
-                    b.Property<string>("ClaimValue")
-                        .HasColumnType("text");
-
-                    b.Property<string>("RoleId")
-                        .IsRequired()
-                        .HasColumnType("text");
-
-                    b.HasKey("Id");
-
-                    b.HasIndex("RoleId");
-
-                    b.ToTable("AspNetRoleClaims", (string)null);
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserClaim<string>", b =>
-                {
-                    b.Property<int>("Id")
-                        .ValueGeneratedOnAdd()
-                        .HasColumnType("integer");
-
-                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<int>("Id"));
-
-                    b.Property<string>("ClaimType")
-                        .HasColumnType("text");
-
-                    b.Property<string>("ClaimValue")
-                        .HasColumnType("text");
-
-                    b.Property<string>("UserId")
-                        .IsRequired()
-                        .HasColumnType("text");
-
-                    b.HasKey("Id");
-
-                    b.HasIndex("UserId");
-
-                    b.ToTable("AspNetUserClaims", (string)null);
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserLogin<string>", b =>
-                {
-                    b.Property<string>("LoginProvider")
-                        .HasColumnType("text");
-
-                    b.Property<string>("ProviderKey")
-                        .HasColumnType("text");
-
-                    b.Property<string>("ProviderDisplayName")
-                        .HasColumnType("text");
-
-                    b.Property<string>("UserId")
-                        .IsRequired()
-                        .HasColumnType("text");
-
-                    b.HasKey("LoginProvider", "ProviderKey");
-
-                    b.HasIndex("UserId");
-
-                    b.ToTable("AspNetUserLogins", (string)null);
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserRole<string>", b =>
-                {
-                    b.Property<string>("UserId")
-                        .HasColumnType("text");
-
-                    b.Property<string>("RoleId")
-                        .HasColumnType("text");
-
-                    b.HasKey("UserId", "RoleId");
-
-                    b.HasIndex("RoleId");
-
-                    b.ToTable("AspNetUserRoles", (string)null);
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserToken<string>", b =>
-                {
-                    b.Property<string>("UserId")
-                        .HasColumnType("text");
-
-                    b.Property<string>("LoginProvider")
-                        .HasColumnType("text");
-
-                    b.Property<string>("Name")
-                        .HasColumnType("text");
-
-                    b.Property<string>("Value")
-                        .HasColumnType("text");
-
-                    b.HasKey("UserId", "LoginProvider", "Name");
-
-                    b.ToTable("AspNetUserTokens", (string)null);
-                });
-
-            modelBuilder.Entity("RefreshToken", b =>
-                {
-                    b.Property<int>("Id")
-                        .ValueGeneratedOnAdd()
-                        .HasColumnType("integer");
-
-                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<int>("Id"));
-
-                    b.Property<DateTime>("CreatedAt")
-                        .HasColumnType("timestamp with time zone");
-
-                    b.Property<DateTime>("ExpiresAt")
-                        .HasColumnType("timestamp with time zone");
-
-                    b.Property<bool>("IsRevoked")
-                        .HasColumnType("boolean");
-
-                    b.Property<string>("Token")
-                        .IsRequired()
-                        .HasColumnType("text");
-
-                    b.Property<string>("UserId")
-                        .IsRequired()
-                        .HasColumnType("text");
-
-                    b.HasKey("Id");
-
-                    b.ToTable("RefreshTokens");
-                });
-
-            modelBuilder.Entity("agologumApi.Models.Item", b =>
-                {
-                    b.Property<int>("Id")
-                        .ValueGeneratedOnAdd()
-                        .HasColumnType("integer");
-
-                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<int>("Id"));
-
-                    b.Property<DateTime>("CreatedAt")
-                        .HasColumnType("timestamp with time zone");
-
-                    b.Property<string>("Description")
-                        .IsRequired()
-                        .HasColumnType("text");
-
-                    b.Property<DateTime>("LastEditedAt")
-                        .HasColumnType("timestamp with time zone");
-
-                    b.Property<string>("Name")
-                        .IsRequired()
-                        .HasColumnType("text");
-
-                    b.HasKey("Id");
-
-                    b.ToTable("Items");
-                });
-
-            modelBuilder.Entity("agologumApi.Models.User", b =>
-                {
-                    b.Property<string>("Id")
-                        .HasColumnType("text");
-
-                    b.Property<int>("AccessFailedCount")
-                        .HasColumnType("integer");
-
-                    b.Property<string>("ConcurrencyStamp")
-                        .IsConcurrencyToken()
-                        .HasColumnType("text");
-
-                    b.Property<DateTime>("CreatedAt")
-                        .HasColumnType("timestamp with time zone");
-
-                    b.Property<string>("Email")
-                        .HasMaxLength(256)
-                        .HasColumnType("character varying(256)");
-
-                    b.Property<bool>("EmailConfirmed")
-                        .HasColumnType("boolean");
-
-                    b.Property<bool>("LockoutEnabled")
-                        .HasColumnType("boolean");
-
-                    b.Property<DateTimeOffset?>("LockoutEnd")
-                        .HasColumnType("timestamp with time zone");
-
-                    b.Property<string>("NormalizedEmail")
-                        .HasMaxLength(256)
-                        .HasColumnType("character varying(256)");
-
-                    b.Property<string>("NormalizedUserName")
-                        .HasMaxLength(256)
-                        .HasColumnType("character varying(256)");
-
-                    b.Property<string>("PasswordHash")
-                        .HasColumnType("text");
-
-                    b.PrimitiveCollection<List<string>>("Permissions")
-                        .HasColumnType("text[]");
-
-                    b.Property<string>("PhoneNumber")
-                        .HasColumnType("text");
-
-                    b.Property<bool>("PhoneNumberConfirmed")
-                        .HasColumnType("boolean");
-
-                    b.Property<string>("SecurityStamp")
-                        .HasColumnType("text");
-
-                    b.Property<bool>("TwoFactorEnabled")
-                        .HasColumnType("boolean");
-
-                    b.Property<string>("UserName")
-                        .HasMaxLength(256)
-                        .HasColumnType("character varying(256)");
-
-                    b.HasKey("Id");
-
-                    b.HasIndex("NormalizedEmail")
-                        .HasDatabaseName("EmailIndex");
-
-                    b.HasIndex("NormalizedUserName")
-                        .IsUnique()
-                        .HasDatabaseName("UserNameIndex");
-
-                    b.ToTable("AspNetUsers", (string)null);
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityRoleClaim<string>", b =>
-                {
-                    b.HasOne("Microsoft.AspNetCore.Identity.IdentityRole", null)
-                        .WithMany()
-                        .HasForeignKey("RoleId")
-                        .OnDelete(DeleteBehavior.Cascade)
-                        .IsRequired();
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserClaim<string>", b =>
-                {
-                    b.HasOne("agologumApi.Models.User", null)
-                        .WithMany()
-                        .HasForeignKey("UserId")
-                        .OnDelete(DeleteBehavior.Cascade)
-                        .IsRequired();
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserLogin<string>", b =>
-                {
-                    b.HasOne("agologumApi.Models.User", null)
-                        .WithMany()
-                        .HasForeignKey("UserId")
-                        .OnDelete(DeleteBehavior.Cascade)
-                        .IsRequired();
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserRole<string>", b =>
-                {
-                    b.HasOne("Microsoft.AspNetCore.Identity.IdentityRole", null)
-                        .WithMany()
-                        .HasForeignKey("RoleId")
-                        .OnDelete(DeleteBehavior.Cascade)
-                        .IsRequired();
-
-                    b.HasOne("agologumApi.Models.User", null)
-                        .WithMany()
-                        .HasForeignKey("UserId")
-                        .OnDelete(DeleteBehavior.Cascade)
-                        .IsRequired();
-                });
-
-            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserToken<string>", b =>
-                {
-                    b.HasOne("agologumApi.Models.User", null)
-                        .WithMany()
-                        .HasForeignKey("UserId")
-                        .OnDelete(DeleteBehavior.Cascade)
-                        .IsRequired();
-                });
-#pragma warning restore 612, 618
-        }
-    }
-}
diff --git a/api/Migrations/20260423010900_ugh.cs b/api/Migrations/20260423010900_ugh.cs
deleted file mode 100644
index c6c9033..0000000
--- a/api/Migrations/20260423010900_ugh.cs
+++ /dev/null
@@ -1,37 +0,0 @@
-using System.Collections.Generic;
-using Microsoft.EntityFrameworkCore.Migrations;
-
-#nullable disable
-
-namespace agologum_api.Migrations
-{
-    /// <inheritdoc />
-    public partial class ugh : Migration
-    {
-        /// <inheritdoc />
-        protected override void Up(MigrationBuilder migrationBuilder)
-        {
-            migrationBuilder.AlterColumn<string>(
-                name: "Permissions",
-                table: "AspNetUsers",
-                type: "jsonb",
-                nullable: true,
-                oldClrType: typeof(List<string>),
-                oldType: "text[]",
-                oldNullable: true);
-        }
-
-        /// <inheritdoc />
-        protected override void Down(MigrationBuilder migrationBuilder)
-        {
-            migrationBuilder.AlterColumn<List<string>>(
-                name: "Permissions",
-                table: "AspNetUsers",
-                type: "text[]",
-                nullable: true,
-                oldClrType: typeof(string),
-                oldType: "jsonb",
-                oldNullable: true);
-        }
-    }
-}
diff --git a/api/Migrations/20260423010900_ugh.Designer.cs b/api/Migrations/20260423011426_InitialMigration.Designer.cs
similarity index 99%
rename from api/Migrations/20260423010900_ugh.Designer.cs
rename to api/Migrations/20260423011426_InitialMigration.Designer.cs
index 93205eb..24bf37e 100644
--- a/api/Migrations/20260423010900_ugh.Designer.cs
+++ b/api/Migrations/20260423011426_InitialMigration.Designer.cs
@@ -11,8 +11,8 @@ using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
 namespace agologum_api.Migrations
 {
     [DbContext(typeof(AppDbContext))]
-    [Migration("20260423010900_ugh")]
-    partial class ugh
+    [Migration("20260423011426_InitialMigration")]
+    partial class InitialMigration
     {
         /// <inheritdoc />
         protected override void BuildTargetModel(ModelBuilder modelBuilder)
diff --git a/api/Migrations/20260423005952_InitialMigration.cs b/api/Migrations/20260423011426_InitialMigration.cs
similarity index 98%
rename from api/Migrations/20260423005952_InitialMigration.cs
rename to api/Migrations/20260423011426_InitialMigration.cs
index 4b4595b..7f0a4eb 100644
--- a/api/Migrations/20260423005952_InitialMigration.cs
+++ b/api/Migrations/20260423011426_InitialMigration.cs
@@ -1,5 +1,4 @@
 using System;
-using System.Collections.Generic;
 using Microsoft.EntityFrameworkCore.Migrations;
 using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
 
@@ -33,7 +32,7 @@ namespace agologum_api.Migrations
                 {
                     Id = table.Column<string>(type: "text", nullable: false),
                     CreatedAt = table.Column<DateTime>(type: "timestamp with time zone", nullable: false),
-                    Permissions = table.Column<List<string>>(type: "text[]", nullable: true),
+                    Permissions = table.Column<string>(type: "jsonb", nullable: true),
                     UserName = table.Column<string>(type: "character varying(256)", maxLength: 256, nullable: true),
                     NormalizedUserName = table.Column<string>(type: "character varying(256)", maxLength: 256, nullable: true),
                     Email = table.Column<string>(type: "character varying(256)", maxLength: 256, nullable: true),

From 4f60336a37cd4b96fc22830d83397b390659847b Mon Sep 17 00:00:00 2001
From: Blitblank <pmcgeee03@gmail.com>
Date: Wed, 22 Apr 2026 20:21:39 -0500
Subject: [PATCH 23/33] it was staring me right in the face

---
 api/Program.cs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/api/Program.cs b/api/Program.cs
index ea1bbb3..e553957 100644
--- a/api/Program.cs
+++ b/api/Program.cs
@@ -48,9 +48,9 @@ builder.Services.AddAuthentication(options => {
 
 builder.Services.AddAuthorization(options => {
 
-    options.AddPolicy("SensitiveDataRead", policy =>
+    options.AddPolicy(Permission.SensitiveData_Read, policy =>
         policy.RequireClaim("permission", Permission.SensitiveData_Read));
-    options.AddPolicy("SensitiveDataModify", policy =>
+    options.AddPolicy(Permission.SensitiveData_Modify, policy =>
         policy.RequireClaim("permission", Permission.SensitiveData_Modify));
 
 });

From 68685e6398eb93023f887ad84f8545be9845a36e Mon Sep 17 00:00:00 2001
From: Blitblank <pmcgeee03@gmail.com>
Date: Wed, 22 Apr 2026 21:08:02 -0500
Subject: [PATCH 24/33] prevent self user deletion

---
 api/src/Controllers/UsersController.cs | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/api/src/Controllers/UsersController.cs b/api/src/Controllers/UsersController.cs
index 4491636..195741e 100644
--- a/api/src/Controllers/UsersController.cs
+++ b/api/src/Controllers/UsersController.cs
@@ -6,6 +6,8 @@
 
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.Authorization;
+using System.Security.Claims;
+using Microsoft.AspNetCore.Identity;
 
 using agologumApi.Models;
 using agologumApi.Services;
@@ -64,12 +66,13 @@ public class UsersController : ControllerBase {
     [HttpDelete("{id}")]
     public async Task<ActionResult> deleteUser(string id) {
 
+        var userId = User.FindFirstValue(ClaimTypes.NameIdentifier);
+        if(userId == id) return BadRequest(); // dont allow deletion of yourself
+
         var success = await service_.Delete(id);
 
         if (!success) return NotFound();
 
-        // TODO: set safeguard to no delete the current user
-
         return NoContent();
     }
 

From 1afa30040d5b8bcf5b67a55e1e025ca852ec7172 Mon Sep 17 00:00:00 2001
From: Blitblank <pmcgeee03@gmail.com>
Date: Wed, 22 Apr 2026 21:19:35 -0500
Subject: [PATCH 25/33] create userdto constructor out of user

---
 api/src/Controllers/AuthController.cs  |  2 +-
 api/src/Controllers/UsersController.cs | 14 ++------------
 api/src/Models/User.cs                 | 10 +++++++++-
 3 files changed, 12 insertions(+), 14 deletions(-)

diff --git a/api/src/Controllers/AuthController.cs b/api/src/Controllers/AuthController.cs
index 83f44e7..3364fc3 100644
--- a/api/src/Controllers/AuthController.cs
+++ b/api/src/Controllers/AuthController.cs
@@ -27,7 +27,7 @@ public class AuthController : ControllerBase {
 
     [HttpPost("register")]
     public async Task<ActionResult> Register(RegisterDto dto) {
-        var user = new User {
+        User user = new User {
             UserName = dto.UserName,
             Email = dto.Email,
             CreatedAt = DateTime.UtcNow // yeah why not utc
diff --git a/api/src/Controllers/UsersController.cs b/api/src/Controllers/UsersController.cs
index 195741e..f00325f 100644
--- a/api/src/Controllers/UsersController.cs
+++ b/api/src/Controllers/UsersController.cs
@@ -32,12 +32,7 @@ public class UsersController : ControllerBase {
         foreach(User user in rawArray) {
             // TODO: can you operator overload a cast? if so cast<UserDto>(UserDto) would go hard
             // if not then just a new custom cast function that returns a dto type will do
-            UserDto newDto = new UserDto{
-                CreatedAt = user.CreatedAt,
-                Email = user.Email,
-                Id = user.Id,
-                UserName = user.UserName
-            };
+            UserDto newDto = new UserDto(user);
             dtoArray.Add(newDto);
         }
 
@@ -52,12 +47,7 @@ public class UsersController : ControllerBase {
 
         if (user == null) return NotFound();
 
-        UserDto newDto = new UserDto{
-            CreatedAt = user.CreatedAt,
-            Email = user.Email,
-            Id = user.Id,
-            UserName = user.UserName
-        };
+        UserDto newDto = new UserDto(user);
 
         return Ok(newDto);
     }
diff --git a/api/src/Models/User.cs b/api/src/Models/User.cs
index 28b4953..8857f71 100644
--- a/api/src/Models/User.cs
+++ b/api/src/Models/User.cs
@@ -55,9 +55,17 @@ public class LoginDto {
 public class UserDto {
 
     public DateTime CreatedAt { get; set; } = DateTime.UtcNow; // gets compressed to a string'
-    public List<string> permissions { get; set; } = [];
+    public List<string>? Permissions { get; set; } = [];
     public string? Email { get; set; } = "";
     public string Id { get; set; } = "";
     public string? UserName { get; set; } = "";
 
+    public UserDto(User user) {
+        CreatedAt = user.CreatedAt;
+        Email = user.Email;
+        Id = user.Id;
+        UserName = user.UserName;
+        Permissions = user.Permissions;
+    }
+
 };

From baca04fa03a9f7111f7dc4306d43bdd761d51192 Mon Sep 17 00:00:00 2001
From: Blitblank <pmcgeee03@gmail.com>
Date: Wed, 22 Apr 2026 21:49:15 -0500
Subject: [PATCH 26/33] create permission modification endpoints

---
 api/src/Controllers/UsersController.cs | 48 ++++++++++++++++++++++++++
 client/src/models/User.ts              |  1 +
 2 files changed, 49 insertions(+)

diff --git a/api/src/Controllers/UsersController.cs b/api/src/Controllers/UsersController.cs
index f00325f..5adafb7 100644
--- a/api/src/Controllers/UsersController.cs
+++ b/api/src/Controllers/UsersController.cs
@@ -66,6 +66,54 @@ public class UsersController : ControllerBase {
         return NoContent();
     }
 
+    [Authorize(Policy = Permission.SensitiveData_Modify)]
+    [HttpDelete("{id}/permission")]
+    public async Task<ActionResult> removePermission(string id, string permission) {
+
+        var userId = User.FindFirstValue(ClaimTypes.NameIdentifier);
+        if(userId == id) return BadRequest(); // dont allow permission removal of yourself
+
+        // get list of permissions of that user
+        var user = await service_.GetById(id);
+        if (user == null) return NotFound();
+        if(user.Permissions == null) return NotFound();
+
+        // verify that the requested permission exists on that user
+        if(!user.Permissions.Contains(permission)) return NotFound();
+
+        // remove the permission from the permission list
+        user.Permissions.Remove(permission);
+
+        // update the user
+        await service_.Update(id, user);
+
+        return NoContent();
+    }
+
+    [Authorize(Policy = Permission.SensitiveData_Modify)]
+    [HttpPost("{id}/{permission}")] // TODO: this was made with a single button per permission in mind, but may be better as sending an array 
+    public async Task<ActionResult> addPermission(string id, string permission) {
+
+        // we'll allow the superuser to elevate their own permissions because they're the superuser
+
+        // get list of permissions of the user
+        var user = await service_.GetById(id);
+        if (user == null) return NotFound();
+        if(user.Permissions == null) return NotFound();
+
+        // remove add the permission to the user's permission list (if it doesnt already exist)
+        if(user.Permissions.Contains(permission)) return NoContent();
+        user.Permissions.Add(permission);
+
+        // update the user
+        await service_.Update(id, user);
+
+        return NoContent();
+
+        // fyi the user will need to sign out and sign back in so the new permissions are reflected in their jwt claims
+        // TODO: or on the client i could issue a refresh token request after a permission api call
+    }
+
     // TODO: add controls on editing roles 
 
 }
\ No newline at end of file
diff --git a/client/src/models/User.ts b/client/src/models/User.ts
index 5df874b..48c9573 100644
--- a/client/src/models/User.ts
+++ b/client/src/models/User.ts
@@ -7,6 +7,7 @@ export interface UserDto {
     email: string;
     id: string;
     userName: string;
+    permissions: string;
 }
 
 export interface RegisterDto {

From 42a59c8af30a5f620e3609734501bf16cb07ae8c Mon Sep 17 00:00:00 2001
From: Blitblank <pmcgeee03@gmail.com>
Date: Wed, 22 Apr 2026 23:08:33 -0500
Subject: [PATCH 27/33] add debugging frontend for permissions

---
 client/src/pages/UsersList.vue  | 22 ++++++++++++++++++++--
 client/src/stores/UsersStore.ts |  8 ++++++++
 2 files changed, 28 insertions(+), 2 deletions(-)

diff --git a/client/src/pages/UsersList.vue b/client/src/pages/UsersList.vue
index 670ab3f..cd978c8 100644
--- a/client/src/pages/UsersList.vue
+++ b/client/src/pages/UsersList.vue
@@ -1,7 +1,7 @@
 
 <script setup lang="ts">
 
-import { onMounted } from "vue"
+import { onMounted, reactive } from "vue"
 import { useRoute, useRouter } from "vue-router";
 import { useUsersStore } from "../stores/UsersStore.ts"
 import * as authApi from "../api/AuthApi";
@@ -18,6 +18,15 @@ function logout() {
     router.push("/login");
 }
 
+const inputs = reactive<Record<number, string>>({});
+store.users.forEach((_, i) => {
+    inputs[i] = ""
+});
+
+const addPermission = (userId: string, index: number) => {
+    if(inputs[index] != null) store.addPermission(userId, inputs[index]);
+}
+
 </script>
 
 <template>
@@ -25,11 +34,20 @@ function logout() {
         <h1>Users</h1>
 
         <table>
-            <tr v-for="user in store.users" :key="user.id">
+            <tr v-for="(user, index) in store.users" :key="user.id">
                 <td>{{ user.userName }}</td>
                 <td>
                     <button @click="store.removeUser(user.id)">Delete</button>
                 </td>
+                <td v-for="perm in user.permissions" :key="user.id">
+                    <button @click="store.removePermission(user.id, perm)">Remove {{ perm }} permission</button>
+                </td>
+                <td>
+                    <form @submit.prevent="addPermission(user.id, index)">
+                        <input type="text" v-model="inputs[index]" placeholder="permission" />
+                        <button type="submit">Add Permission</button>
+                    </form>
+                </td>
             </tr>
         </table>
         <button @click="logout()">Logout</button>
diff --git a/client/src/stores/UsersStore.ts b/client/src/stores/UsersStore.ts
index 5b7e979..a98ae95 100644
--- a/client/src/stores/UsersStore.ts
+++ b/client/src/stores/UsersStore.ts
@@ -26,6 +26,14 @@ export const useUsersStore = defineStore("users", {
         async removeUser(id: string) {
             await usersApi.deleteUser(id);
             this.users = this.users.filter(i => i.id !== id);
+        },
+
+        removePermission(id: string, permission: string) {
+            console.log("removing permission", permission, "for user", id);
+        },
+
+        addPermission(id: string, permission: string) {
+            console.log("adding permission", permission, "for user", id);
         }
     }
 

From b7989a1c2ba21c3576f92c4ea1e762b3dc3d720a Mon Sep 17 00:00:00 2001
From: Blitblank <pmcgeee03@gmail.com>
Date: Wed, 22 Apr 2026 23:21:22 -0500
Subject: [PATCH 28/33] add api calls to permission modifications

---
 client/src/api/UsersApi.ts      | 4 ++++
 client/src/stores/UsersStore.ts | 8 ++++----
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/client/src/api/UsersApi.ts b/client/src/api/UsersApi.ts
index 6c7a38e..7f279e5 100644
--- a/client/src/api/UsersApi.ts
+++ b/client/src/api/UsersApi.ts
@@ -9,3 +9,7 @@ export const getUsers = () => api.get<UserDto[]>(`${API_URL}`);
 export const getUser = (id: string) => api.get<UserDto>(`${API_URL}/${id}`);
 
 export const deleteUser = (id: string) => api.delete<UserDto>(`${API_URL}/${id}`);
+
+export const removePermission = (id: string, permission: string) => api.delete(`${API_URL}/${id}/permission`)
+
+export const addPermission = (id: string, permission: string) => api.delete(`${API_URL}/${id}/${permission}`)
diff --git a/client/src/stores/UsersStore.ts b/client/src/stores/UsersStore.ts
index a98ae95..70dab24 100644
--- a/client/src/stores/UsersStore.ts
+++ b/client/src/stores/UsersStore.ts
@@ -28,12 +28,12 @@ export const useUsersStore = defineStore("users", {
             this.users = this.users.filter(i => i.id !== id);
         },
 
-        removePermission(id: string, permission: string) {
-            console.log("removing permission", permission, "for user", id);
+        async removePermission(id: string, permission: string) {
+            await usersApi.removePermission(id, permission);
         },
 
-        addPermission(id: string, permission: string) {
-            console.log("adding permission", permission, "for user", id);
+        async addPermission(id: string, permission: string) {
+            await usersApi.addPermission(id, permission);
         }
     }
 

From 6761ae499b45d9f17f6a508072c356cd3821843a Mon Sep 17 00:00:00 2001
From: Blitblank <pmcgeee03@gmail.com>
Date: Wed, 22 Apr 2026 23:23:48 -0500
Subject: [PATCH 29/33] oops wrong http request type

---
 client/src/api/UsersApi.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/src/api/UsersApi.ts b/client/src/api/UsersApi.ts
index 7f279e5..f657a79 100644
--- a/client/src/api/UsersApi.ts
+++ b/client/src/api/UsersApi.ts
@@ -12,4 +12,4 @@ export const deleteUser = (id: string) => api.delete<UserDto>(`${API_URL}/${id}`
 
 export const removePermission = (id: string, permission: string) => api.delete(`${API_URL}/${id}/permission`)
 
-export const addPermission = (id: string, permission: string) => api.delete(`${API_URL}/${id}/${permission}`)
+export const addPermission = (id: string, permission: string) => api.post(`${API_URL}/${id}/${permission}`)

From 0cda948323caf0dee9cab8230b8717bef1735315 Mon Sep 17 00:00:00 2001
From: Blitblank <pmcgeee03@gmail.com>
Date: Wed, 22 Apr 2026 23:27:31 -0500
Subject: [PATCH 30/33] do the same to delete

---
 api/src/Controllers/UsersController.cs | 2 +-
 client/src/api/UsersApi.ts             | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/api/src/Controllers/UsersController.cs b/api/src/Controllers/UsersController.cs
index 5adafb7..b29e0fc 100644
--- a/api/src/Controllers/UsersController.cs
+++ b/api/src/Controllers/UsersController.cs
@@ -67,7 +67,7 @@ public class UsersController : ControllerBase {
     }
 
     [Authorize(Policy = Permission.SensitiveData_Modify)]
-    [HttpDelete("{id}/permission")]
+    [HttpDelete("{id}/{permission}")]
     public async Task<ActionResult> removePermission(string id, string permission) {
 
         var userId = User.FindFirstValue(ClaimTypes.NameIdentifier);
diff --git a/client/src/api/UsersApi.ts b/client/src/api/UsersApi.ts
index f657a79..54252b2 100644
--- a/client/src/api/UsersApi.ts
+++ b/client/src/api/UsersApi.ts
@@ -10,6 +10,6 @@ export const getUser = (id: string) => api.get<UserDto>(`${API_URL}/${id}`);
 
 export const deleteUser = (id: string) => api.delete<UserDto>(`${API_URL}/${id}`);
 
-export const removePermission = (id: string, permission: string) => api.delete(`${API_URL}/${id}/permission`)
+export const removePermission = (id: string, permission: string) => api.delete(`${API_URL}/${id}/${permission}`)
 
 export const addPermission = (id: string, permission: string) => api.post(`${API_URL}/${id}/${permission}`)

From be183c6fd3a378df7fdf3f834902ccb9dc6dc47b Mon Sep 17 00:00:00 2001
From: Blitblank <pmcgeee03@gmail.com>
Date: Wed, 22 Apr 2026 23:30:25 -0500
Subject: [PATCH 31/33] allow removal of self permissions, just not the
 important one

---
 api/src/Controllers/UsersController.cs | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/api/src/Controllers/UsersController.cs b/api/src/Controllers/UsersController.cs
index b29e0fc..f10b9e9 100644
--- a/api/src/Controllers/UsersController.cs
+++ b/api/src/Controllers/UsersController.cs
@@ -70,8 +70,7 @@ public class UsersController : ControllerBase {
     [HttpDelete("{id}/{permission}")]
     public async Task<ActionResult> removePermission(string id, string permission) {
 
-        var userId = User.FindFirstValue(ClaimTypes.NameIdentifier);
-        if(userId == id) return BadRequest(); // dont allow permission removal of yourself
+        if(permission == Permission.SensitiveData_Modify) return BadRequest(); // dont allow permission removal of whats allowing us to re-add premissions
 
         // get list of permissions of that user
         var user = await service_.GetById(id);

From ef1e9aa75907d9ab824356b0ccc018366397cec1 Mon Sep 17 00:00:00 2001
From: Blitblank <pmcgeee03@gmail.com>
Date: Wed, 22 Apr 2026 23:45:18 -0500
Subject: [PATCH 32/33] best of both worlds

---
 api/src/Controllers/UsersController.cs | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/api/src/Controllers/UsersController.cs b/api/src/Controllers/UsersController.cs
index f10b9e9..0ec74bf 100644
--- a/api/src/Controllers/UsersController.cs
+++ b/api/src/Controllers/UsersController.cs
@@ -30,8 +30,6 @@ public class UsersController : ControllerBase {
         List<UserDto> dtoArray = new List<UserDto>();
 
         foreach(User user in rawArray) {
-            // TODO: can you operator overload a cast? if so cast<UserDto>(UserDto) would go hard
-            // if not then just a new custom cast function that returns a dto type will do
             UserDto newDto = new UserDto(user);
             dtoArray.Add(newDto);
         }
@@ -70,7 +68,8 @@ public class UsersController : ControllerBase {
     [HttpDelete("{id}/{permission}")]
     public async Task<ActionResult> removePermission(string id, string permission) {
 
-        if(permission == Permission.SensitiveData_Modify) return BadRequest(); // dont allow permission removal of whats allowing us to re-add premissions
+	    var userId = User.FindFirstValue(ClaimTypes.NameIdentifier);
+        if(permission == Permission.SensitiveData_Modify && userId == id) return BadRequest(); // dont allow permission removal of whats allowing us to re-add premissions
 
         // get list of permissions of that user
         var user = await service_.GetById(id);

From 317a7bce9dcc3d37f007665b2a8f157e128dbef1 Mon Sep 17 00:00:00 2001
From: Blitblank <pmcgeee03@gmail.com>
Date: Thu, 23 Apr 2026 00:15:49 -0500
Subject: [PATCH 33/33] comments galore

---
 api/Program.cs                         | 30 +++++++---------
 api/src/Controllers/AuthController.cs  | 47 +++++++++++++++-----------
 api/src/Controllers/UsersController.cs |  1 +
 api/src/Models/User.cs                 |  6 ++--
 api/src/Services/ItemService.cs        |  1 +
 api/src/Services/JwtService.cs         | 14 ++++++--
 api/src/Services/UserService.cs        |  5 +++
 client/src/api/axios.ts                |  2 +-
 8 files changed, 62 insertions(+), 44 deletions(-)

diff --git a/api/Program.cs b/api/Program.cs
index e553957..d4f8478 100644
--- a/api/Program.cs
+++ b/api/Program.cs
@@ -1,4 +1,5 @@
 
+// system usings
 using Microsoft.AspNetCore.HttpOverrides;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.AspNetCore.Authentication.JwtBearer;
@@ -7,23 +8,27 @@ using Microsoft.AspNetCore.Identity;
 using Microsoft.AspNetCore.Identity.EntityFrameworkCore;
 using System.Text;
 
+// homeburger usings
 using agologumApi.Models;
 using agologumApi.Services;
 
 var builder = WebApplication.CreateBuilder(args);
 
+// make sure the jwt key exists or else abort, security issue
 var key = builder.Configuration["Jwt:Key"];
 if(key == null) return;
 
+// connect to the sql database
 builder.Services.AddDbContext<AppDbContext>(options => 
     options.UseNpgsql(builder.Configuration.GetConnectionString("DefaultConnection")));
 
 builder.Services.AddControllers();
 
-// services
+// add our services
 builder.Services.AddScoped<UserService>();
 builder.Services.AddScoped<ItemService>();
 builder.Services.AddScoped<JwtService>();
+// if this grows sufficiently large we can put elsewhere
 
 // configuration for jwt authentication
 builder.Services.AddIdentity<User, IdentityRole>()
@@ -46,6 +51,8 @@ builder.Services.AddAuthentication(options => {
     };
 });
 
+// authorization configurations; here's where we register our permissions to policies
+// TODO: this suspiciously looks able to be automated through a for loop, only if we can have a static dictionary maybe though?
 builder.Services.AddAuthorization(options => {
 
     options.AddPolicy(Permission.SensitiveData_Read, policy =>
@@ -70,6 +77,7 @@ builder.Services.Configure<ForwardedHeadersOptions>(options =>
 // Learn more about configuring OpenAPI at https://aka.ms/aspnet/openapi
 builder.Services.AddOpenApi();
 
+// cors; scary needs to be fixed
 builder.Services.AddCors(options =>
 {
     options.AddPolicy("dev",
@@ -78,17 +86,14 @@ builder.Services.AddCors(options =>
             policy.AllowAnyOrigin()
                   .AllowAnyHeader()
                   .AllowAnyMethod();
-        });
+        }); // TODO: scary please fix this
 });
 
+// more middleware; probably uncessary at this stage
 builder.Services.AddEndpointsApiExplorer();
 builder.Services.AddSwaggerGen();
 
-// https://www.reddit.com/r/dotnet/comments/1h7vzbs/how_do_you_guys_handle_authorization_on_a_web_api/
-// add authorization here
-// controllers will have endpoints based on authorization
-// frontend is a different story
-
+// build app
 var app = builder.Build();
 
 app.UseForwardedHeaders();
@@ -121,17 +126,6 @@ using (var scope = app.Services.CreateScope()) {
         }
     }
 
-    // TODO: abstract this away
-    // auto seed Identity roles
-    var roleManager = scope.ServiceProvider.GetRequiredService<RoleManager<IdentityRole>>();
-    string[] roles = { "guest", "user", "dev", "mod", "admin", "superuser", "role1", "role2" };
-    foreach(string role in roles) {
-        if(!await roleManager.RoleExistsAsync(role)) {
-            await roleManager.CreateAsync(new IdentityRole(role));
-        }
-    }
-
-
 }
 
 app.Run();
diff --git a/api/src/Controllers/AuthController.cs b/api/src/Controllers/AuthController.cs
index 3364fc3..0ecf3da 100644
--- a/api/src/Controllers/AuthController.cs
+++ b/api/src/Controllers/AuthController.cs
@@ -13,10 +13,11 @@ public class AuthController : ControllerBase {
     // identity things
     private readonly UserManager<User> userManager_;
     private readonly SignInManager<User> signInManager_;
-
+    // services
     private readonly JwtService jwt_;
     private readonly UserService userService_;
 
+    // class constructor (where are my initializer lists man)
     public AuthController(UserManager<User> userManager, SignInManager<User> signInManager, JwtService jwt, UserService userService) {
 
         userManager_ = userManager;
@@ -25,43 +26,49 @@ public class AuthController : ControllerBase {
         userService_ = userService;
     }
 
+    // register endpoint
     [HttpPost("register")]
     public async Task<ActionResult> Register(RegisterDto dto) {
+        // create a new user out of the dto from the request
         User user = new User {
             UserName = dto.UserName,
             Email = dto.Email,
             CreatedAt = DateTime.UtcNow // yeah why not utc
         };
 
-        // assigning roles to user
+        // assigning roles to user. create a user starting with x to give it permissions to read sensitive data
         if(dto.UserName.StartsWith("x")) {
             user.Permissions = new List<string> { Permission.SensitiveData_Read };
-        } else if(dto.UserName == "bard") {
-            user.Permissions = new List<string> { Permission.SensitiveData_Read, Permission.SensitiveData_Modify };
-        } 
+        }
 
+        // use Identity's user manager to add to db; error check if failed
         var result = await userManager_.CreateAsync(user, dto.Password);
         if(!result.Succeeded) return BadRequest(result.Errors);
 
+        // respond to post as necessary
         return CreatedAtAction(
             nameof(Register),
             new { id = user.Id }
         );
     }
 
+    // login endpoint
     [HttpPost("login")]
     public async Task<ActionResult> Login(LoginDto dto)
     {
+        // get the user from the database given the username
         var user = await userManager_.FindByNameAsync(dto.UserName);
+        // user not found with that name
+        if (user == null) return Unauthorized(); // unauthorized instead of not found to not give away info
 
-        if (user == null) return Unauthorized();
-
+        // use identity's password validation
         var result = await signInManager_.CheckPasswordSignInAsync(user, dto.Password, false);
-
+        // if failed then youre not real !
         if(!result.Succeeded) return Unauthorized();
 
+        // login sucess, give you an authentication token
         var accessToken = await jwt_.GenerateJwt(user);
-        var refreshToken = jwt_.GenerateRefreshToken();
+        var refreshToken = jwt_.GenerateRefreshToken(); // the refresh token is good enough to refresh your access token
         RefreshToken newTokenObject = new RefreshToken {
             Token = refreshToken,
             UserId = user.Id,
@@ -70,43 +77,44 @@ public class AuthController : ControllerBase {
             IsRevoked = false
         };
         await jwt_.AddRefreshToken(newTokenObject);
+        // the jwt says we trust who you are and can substitute it for login
+        // contains permissions claims too
 
-        if(user.UserName == "bard") { // tempory because im silly
-            await userManager_.AddToRoleAsync(user, "superuser");
-        } // eventually ill have an endpoint for adding/removing roles
-
-        if(dto.UserName == "bard") {
-            user.Permissions = new List<string> { Permission.SensitiveData_Read, Permission.SensitiveData_Modify };
-            await userService_.Update(user.Id, user);
-        }
-
+        // return both access and refresh token
         return Ok(new { accessToken, refreshToken });
     }
 
+    // logout endpoint
     [Authorize] // authorize is handled by middleware
     [HttpPost("logout")]
     public async Task<ActionResult> Logout(string refreshTokenString) {
         // revoke refresh token
         bool success = await jwt_.RevokeRefreshToken(refreshTokenString);
         if(!success) return NotFound();
+        // frontend refreshes page and detects logout
         return Ok();
     }
 
+    // refresh token endpoint
     [HttpPost("refresh")] // allow-anonymous by default
     public async Task<ActionResult> Refresh(TokenDto request) {
+        // reached when the frontend gets an unauthorized response and autoattempts to refresh if available
         
+        // get token from request and check if its valid
         RefreshToken? storedToken = await jwt_.GetRefreshToken(request.RefreshToken);
         if (storedToken == null) return Unauthorized();
         bool valid = (storedToken.IsRevoked) ||
                      (storedToken.ExpiresAt < DateTime.UtcNow);
         if(!valid) return Unauthorized(); // TODO: delete the invalid token
 
+        // get user from the token and give them new tokens
         User? user = await jwt_.GetUser(storedToken.UserId);
         if(user == null) return NotFound();
         string? newAccessToken = await jwt_.GenerateJwt(user);
         if(newAccessToken == null) return NotFound();
         string newRefreshToken = jwt_.GenerateRefreshToken();
 
+        // construct new token
         storedToken.IsRevoked = true;
         RefreshToken newTokenObject = new RefreshToken {
             Token = newRefreshToken,
@@ -117,10 +125,9 @@ public class AuthController : ControllerBase {
         };
 
         await jwt_.AddRefreshToken(newTokenObject);
-
+        // return new tokens
         return Ok(new { accessToken = newAccessToken, refreshToken = newRefreshToken });
 
-
     }
 
     // TODO
diff --git a/api/src/Controllers/UsersController.cs b/api/src/Controllers/UsersController.cs
index 0ec74bf..24339b0 100644
--- a/api/src/Controllers/UsersController.cs
+++ b/api/src/Controllers/UsersController.cs
@@ -68,6 +68,7 @@ public class UsersController : ControllerBase {
     [HttpDelete("{id}/{permission}")]
     public async Task<ActionResult> removePermission(string id, string permission) {
 
+        // get the user this request comes from. since it passed identity auth we can trust it
 	    var userId = User.FindFirstValue(ClaimTypes.NameIdentifier);
         if(permission == Permission.SensitiveData_Modify && userId == id) return BadRequest(); // dont allow permission removal of whats allowing us to re-add premissions
 
diff --git a/api/src/Models/User.cs b/api/src/Models/User.cs
index 8857f71..a542617 100644
--- a/api/src/Models/User.cs
+++ b/api/src/Models/User.cs
@@ -10,7 +10,7 @@ public class User : IdentityUser {
     // TODO: make this a list of UserPermissions
     // where a userpermission has an Id, Permission (string), and userId string
     // then we can do something like: get all users with this permission
-    public List<string>? Permissions { get; set; } = new();
+    public List<string>? Permissions { get; set; } = new(); // because this isnt very relational database happy
 
     // properties inherited from IdentityUser:
     /*
@@ -54,12 +54,14 @@ public class LoginDto {
 
 public class UserDto {
 
-    public DateTime CreatedAt { get; set; } = DateTime.UtcNow; // gets compressed to a string'
+    public DateTime CreatedAt { get; set; } = DateTime.UtcNow; // datetimes get compressed to a string
     public List<string>? Permissions { get; set; } = [];
     public string? Email { get; set; } = "";
     public string Id { get; set; } = "";
     public string? UserName { get; set; } = "";
 
+    // constructor out of a full User object
+    // REMEMBER: when adding fields to UserDto they must also be set in this constructor or else stuff breaks
     public UserDto(User user) {
         CreatedAt = user.CreatedAt;
         Email = user.Email;
diff --git a/api/src/Services/ItemService.cs b/api/src/Services/ItemService.cs
index 8fab9ff..8535a6f 100644
--- a/api/src/Services/ItemService.cs
+++ b/api/src/Services/ItemService.cs
@@ -5,6 +5,7 @@ using agologumApi.Models;
 
 namespace agologumApi.Services;
 
+// basic CRUD operations for items in the database
 public class ItemService {
 
     private readonly AppDbContext db_;
diff --git a/api/src/Services/JwtService.cs b/api/src/Services/JwtService.cs
index a43788d..b2c7c19 100644
--- a/api/src/Services/JwtService.cs
+++ b/api/src/Services/JwtService.cs
@@ -21,14 +21,16 @@ public class JwtService {
         userManager_ = userManager;
     }
 
+    // create a jwt string given a user (user contains permissions which go into claims)
     public async Task<string?> GenerateJwt(User user) {
 
+        // security stuff
         string? jwtKey = config_["Jwt:Key"];
         if(jwtKey == null) return null;
         var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(jwtKey));
 
         var creds = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);
-
+        // make sure the user is real
         if(user.UserName == null) return null;
 
         // not too sure
@@ -37,13 +39,15 @@ public class JwtService {
             new Claim(ClaimTypes.NameIdentifier, user.Id.ToString())
         };
 
+        // add each permission that the user has into the claims
         List<string>? permissions = user.Permissions;
         if(permissions != null) {
-            foreach(var perm in permissions) {
+            foreach(string perm in permissions) {
                 claims.Add(new Claim("permission", perm));
             }
         }
 
+        // construct that token
         var token = new JwtSecurityToken(
             issuer: "agologum",
             audience: "agologum",
@@ -56,6 +60,7 @@ public class JwtService {
 
     }
 
+    // generating a refresh token is just like a long random password
     public string GenerateRefreshToken() {
 
         byte[] randomBytes = new byte[64];
@@ -64,10 +69,12 @@ public class JwtService {
 
     }
 
+    // we store refresh tokens on our side to check against when a user requests a refresh
     public async Task<RefreshToken?> GetRefreshToken(string refreshTokenString) {
         return await db_.RefreshTokens.FirstOrDefaultAsync(u => u.Token == refreshTokenString);
     }
 
+    // add a refresh token to the token db store
     public async Task<RefreshToken> AddRefreshToken(RefreshToken refreshToken) {
         db_.RefreshTokens.Add(refreshToken);
         await db_.SaveChangesAsync();
@@ -77,8 +84,9 @@ public class JwtService {
     // helper to get the User from the id that exists in a refresh token object
     public async Task<User?> GetUser(string id) {
         return await db_.Users.FindAsync(id);
-    }
+    } // since other places aren't good for having references to db contexts
 
+    // remove refresh token from our store; called when user logs out
     public async Task<bool> RevokeRefreshToken(string refreshTokenString) {
         var refreshToken = await db_.RefreshTokens.FirstOrDefaultAsync(u => u.Token == refreshTokenString);
         if(refreshToken == null) return false;
diff --git a/api/src/Services/UserService.cs b/api/src/Services/UserService.cs
index 68c1e82..1800523 100644
--- a/api/src/Services/UserService.cs
+++ b/api/src/Services/UserService.cs
@@ -13,18 +13,22 @@ public class UserService {
         db_ = db;
     }
 
+    // get all users
     public async Task<List<User>> GetAll() {
         return await db_.Users.ToListAsync();
     }
 
+    // get one user with id of id
     public async Task<User?> GetById(string id) {
         return await db_.Users.FindAsync(id);
     }
 
+    // get one user with username of name
     public async Task<User?> GetByName(string name) {
         return await db_.Users.FirstOrDefaultAsync(u => u.UserName == name);
     }
 
+    // delete one user with id of id
     public async Task<bool> Delete(string id) {
         User? User = await db_.Users.FindAsync(id);
         if(User != null) {
@@ -36,6 +40,7 @@ public class UserService {
         }
     }
 
+    // update user of id with user
     public async Task<User?> Update(string id, User user) {
 
         User? oldUser = await db_.Users.FindAsync(id);
diff --git a/client/src/api/axios.ts b/client/src/api/axios.ts
index 601abe3..8a48736 100644
--- a/client/src/api/axios.ts
+++ b/client/src/api/axios.ts
@@ -88,6 +88,6 @@ api.interceptors.response.use(response => response, async error => { // mainly f
 })
 
 // TODO: if you get a 403 while navigating then redirect to the last authenticated page
-// if you gert a 403 on a form submissio nthen do like an unauthorized popup
+// if you gert a 403 on a form submissio nthen do like an unauthorized popup (message: stale session <login link>) (or redirect to login like i said elsewhere)
 
 export default api;