diff --git a/CulinaryCommandApp/Components/App.razor b/CulinaryCommandApp/Components/App.razor
index 02516b2..88e8715 100644
--- a/CulinaryCommandApp/Components/App.razor
+++ b/CulinaryCommandApp/Components/App.razor
@@ -1,6 +1,5 @@
 ﻿@namespace CulinaryCommand.Components
-@inject NavigationManager Nav
-@inject CulinaryCommand.Services.AuthService Auth
+@using Microsoft.AspNetCore.Components.Authorization
 
 <!DOCTYPE html>
 <html lang="en">
@@ -12,6 +11,7 @@
     <link rel="stylesheet" href="bootstrap/bootstrap.min.css" />
     <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap-icons@1.11.3/font/bootstrap-icons.min.css" />
     <link rel="stylesheet" href="css/app.css" />
+    <link rel="stylesheet" href="css/landing.css" />
     <link rel="stylesheet" href="CulinaryCommand.styles.css" />
     <link rel="icon" type="image/png" href="images/favicon.png" />
     <HeadOutlet />
@@ -21,9 +21,9 @@
 <body>
     @* <Routes @rendermode=RenderMode.InteractiveServer /> *@
 
-    <CascadingValue Value="Auth">
-        <Routes />
-    </CascadingValue>
+   <CascadingAuthenticationState>
+        <Routes @rendermode="InteractiveServer"/>
+    </CascadingAuthenticationState>
 
 
     <script src="https://cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/js/bootstrap.bundle.min.js"
@@ -34,23 +34,3 @@
 </body>
 
 </html>
-
-@code {
-    @* private bool _initialized;
-
-    protected override async Task OnAfterRenderAsync(bool firstRender)
-    {
-        if (firstRender && !_initialized)
-        {
-            // Don't re-hydrate if user is already on /signin or /signup
-            var path = Nav.Uri.ToLower();
-            if (!path.Contains("/signin") && !path.Contains("/signup"))
-            {
-                await Auth.InitializeFromJsAsync();
-            }
-
-            _initialized = true;
-            StateHasChanged();
-        }
-    } *@
-}
\ No newline at end of file
diff --git a/CulinaryCommandApp/Components/Custom/LocationSelector.razor b/CulinaryCommandApp/Components/Custom/LocationSelector.razor
index 7ee3b21..a3696b2 100644
--- a/CulinaryCommandApp/Components/Custom/LocationSelector.razor
+++ b/CulinaryCommandApp/Components/Custom/LocationSelector.razor
@@ -1,50 +1,43 @@
-@using CulinaryCommand.Models
 @using CulinaryCommand.Services
 @using CulinaryCommand.Data.Entities
-@using System.Xml
 @using System.Text.Json
-
-@inject AuthService Auth
+@using CulinaryCommand.Services.UserContextSpace
 
 @inject ILocationService LocationService
 @inject LocationState LocationState
-@inject IJSRuntime JS
-
-
+@inject IUserContextService UserCtx
 @inject IJSRuntime JS
 @inject NavigationManager NavigationManager
 
 <!-- Location Dropdown -->
 <div class="dropdown me-3">
     <button class="btn btn-light dropdown-toggle d-flex align-items-center py-2 pe-3" type="button" id="businessMenu"
-        data-bs-toggle="dropdown" aria-expanded="false" style="height:3rem;" title="View and edit restaurants">
+            data-bs-toggle="dropdown" aria-expanded="false" style="height:3rem;" title="View and edit restaurants">
 
         <div class="icon-box d-flex align-items-center justify-content-center me-2"
-            style="background-color:#d3ddd5; width:2.5rem; height:2.5rem; border-radius:0.45rem;">
+             style="background-color:#d3ddd5; width:2.5rem; height:2.5rem; border-radius:0.45rem;">
             <i class="bi bi-building fs-4" style="color:#688f72;"></i>
         </div>
+
         <span>@(LocationState.CurrentLocation?.Name ?? "Select Location")</span>
     </button>
 
     <ul class="dropdown-menu dropdown-menu-end shadow-lg" aria-labelledby="businessMenu">
         @if (ManagedLocations.Any())
         {
-            <li>
-                <h6 class="dropdown-header">Locations</h6>
-            </li>
-
+            <li><h6 class="dropdown-header">Locations</h6></li>
 
-            @foreach (Location location in ManagedLocations ?? Enumerable.Empty<Location>())
+            @foreach (var location in ManagedLocations)
             {
                 <li>
-                    <div
-                        class="dropdown-item d-flex justify-content-between align-items-center @(LocationState.CurrentLocation == location ? "active" : "")">
+                    <div class="dropdown-item d-flex justify-content-between align-items-center @(LocationState.CurrentLocation?.Id == location.Id ? "active" : "")">
                         <span class="flex-grow-1" style="cursor: pointer;"
-                            @onclick="() => SetLocation(location)">
+                              @onclick="() => SetLocation(location)">
                             @location.Name
                         </span>
+
                         <button class="btn btn-link p-0 ms-2 edit-btn" title="Edit @location.Name"
-                            @onclick="() => EditLocation(location)" @onclick:stopPropagation="true">
+                                @onclick="() => EditLocation(location)" @onclick:stopPropagation="true">
                             <i class="bi bi-pencil-fill fs-9 text-muted"></i>
                         </button>
                     </div>
@@ -55,80 +48,84 @@
         {
             <li>
                 <div class="d-flex justify-content-between align-items-center"
-                    style="padding: 0.5rem 1rem;  font-size: 0.95rem;">
-                    <span class="flex-grow-1" style="cursor: pointer;">
-                        No locations.
-                    </span>
-                    @* <button class="btn btn-link p-0 ms-2 edit-btn" 
-                        @onclick="() => AddRestaurant()" @onclick:stopPropagation="true">
-                        <i class="bi bi-plus-square-fill fs-9 text-active"></i>
-                    </button> *@
+                     style="padding: 0.5rem 1rem; font-size: 0.95rem;">
+                    <span class="flex-grow-1">No locations.</span>
                 </div>
             </li>
         }
-
     </ul>
 </div>
 
 @code {
     private List<Location> ManagedLocations { get; set; } = new();
-    private bool hydrated = false;
+    private bool _loadedOnce;
 
     protected override async Task OnAfterRenderAsync(bool firstRender)
     {
-        if (firstRender)
-        {
-            // Wait for auth hydration
-            await Auth.EnsureHydratedAsync();
+        if (!firstRender || _loadedOnce) return;
+        _loadedOnce = true;
 
-            if (!Auth.IsSignedIn)
-            {
-                // Do NOT redirect here — navbar dropdown is visible on all pages,
-                // so returning silently is correct
-                return;
-            }
-
-            // 1. Load cached instantly
-            ManagedLocations = await LoadCachedLocationsAsync();
+        // 1) Load cached instantly (never fails hard)
+        ManagedLocations = await LoadCachedLocationsAsync();
+        if (LocationState.CurrentLocation == null && ManagedLocations.Any())
+            await LocationState.SetCurrentLocationAsync(ManagedLocations.First());
 
-            // 2. Load fresh server data
-            await LoadLocationsFromServerAsync();
+        StateHasChanged();
 
-            hydrated = true;
+        // 2) Load fresh server data if we can resolve user context
+        await LoadLocationsFromServerAsync();
 
-            StateHasChanged();
-        }
+        StateHasChanged();
     }
 
-
     private async Task<List<Location>> LoadCachedLocationsAsync()
     {
-        var json = await JS.InvokeAsync<string>("localStorage.getItem", "cc_locations");
-        return string.IsNullOrWhiteSpace(json)
-        ? new List<Location>()
-        : (JsonSerializer.Deserialize<List<Location>>(json) ?? new List<Location>());
+        try
+        {
+            var json = await JS.InvokeAsync<string?>("localStorage.getItem", "cc_locations");
+            return string.IsNullOrWhiteSpace(json)
+                ? new List<Location>()
+                : (JsonSerializer.Deserialize<List<Location>>(json) ?? new List<Location>());
+        }
+        catch
+        {
+            return new List<Location>();
+        }
     }
 
     private async Task LoadLocationsFromServerAsync()
     {
-        if (Auth.UserRole == "Admin")
+        var ctx = await UserCtx.GetAsync();
+
+        // If not authenticated / not linked to DB user yet, do nothing.
+        if (ctx.User?.Id is null) return;
+
+        List<Location> fresh;
+
+        if (ctx.User?.Role == "Admin")
         {
-            ManagedLocations = await LocationService.GetLocationsByCompanyAsync(Auth.CompanyId!.Value);
+            if (ctx.User.CompanyId is null) return;
+            fresh = await LocationService.GetLocationsByCompanyAsync(ctx.User?.CompanyId.Value);
         }
-        else if (Auth.UserRole == "Manager") 
+        else if (ctx.User?.Role == "Manager")
         {
-            ManagedLocations = await LocationService.GetLocationsByManagerAsync(Auth.UserId!.Value);
+            fresh = await LocationService.GetLocationsByManagerAsync(ctx.User?.Id);
         }
-        else {
-            ManagedLocations = await LocationService.GetLocationsByEmployeeAsync(Auth.UserId!.Value);
+        else
+        {
+            fresh = await LocationService.GetLocationsByEmployeeAsync(ctx.User?.Id);
         }
 
-        // Update localStorage
-        await JS.InvokeAsync<object>("localStorage.setItem",
-        "cc_locations",
-        JsonSerializer.Serialize(ManagedLocations));
+        ManagedLocations = fresh ?? new List<Location>();
+
+        // Cache
+        try
+        {
+            await JS.InvokeAsync<object>("localStorage.setItem", "cc_locations", JsonSerializer.Serialize(ManagedLocations));
+        }
+        catch { /* ignore caching failures */ }
 
-        // Set a default current location if none
+        // Default current location
         if (LocationState.CurrentLocation == null && ManagedLocations.Any())
             await LocationState.SetCurrentLocationAsync(ManagedLocations.First());
     }
@@ -142,4 +139,4 @@
     {
         NavigationManager.NavigateTo($"/settings/locations/{location.Id}");
     }
-}
\ No newline at end of file
+}
diff --git a/CulinaryCommandApp/Components/Custom/LogoutWidget.razor b/CulinaryCommandApp/Components/Custom/LogoutWidget.razor
index c367af7..6b9a55c 100644
--- a/CulinaryCommandApp/Components/Custom/LogoutWidget.razor
+++ b/CulinaryCommandApp/Components/Custom/LogoutWidget.razor
@@ -1,5 +1,4 @@
 @rendermode InteractiveServer
-@inject CulinaryCommand.Services.AuthService Auth
 @inject NavigationManager Nav
 
 <button class="btn btn-outline-danger" @onclick="Logout">Logout</button>
@@ -7,7 +6,6 @@
 @code {
     private async Task Logout()
     {
-        await Auth.LogoutAsync();
         Nav.NavigateTo("/signin", true); // hard reload
     }
 }
diff --git a/CulinaryCommandApp/Components/Custom/ProfileDropdown.razor b/CulinaryCommandApp/Components/Custom/ProfileDropdown.razor
index 6cd7fb8..e4aba68 100644
--- a/CulinaryCommandApp/Components/Custom/ProfileDropdown.razor
+++ b/CulinaryCommandApp/Components/Custom/ProfileDropdown.razor
@@ -1,6 +1,6 @@
 @using CulinaryCommand.Services
-@inject AuthService Auth
-@inject IJSRuntime JS
+@using CulinaryCommand.Services.UserContextSpace
+@inject IUserContextService UserCtx
 @inject NavigationManager Nav
 @rendermode InteractiveServer
 
@@ -18,18 +18,18 @@
              style="width:2.5rem; height:2.5rem;" />
 
         <div class="text-start">
-            <div class="fw-semibold">@Auth.UserEmail</div>
-            <small class="text-muted">@Auth.UserRole</small>
+            <div class="fw-semibold">@UserEmail</div>
+            <small class="text-muted">@UserRole</small>
         </div>
     </button>
 
     <ul class="dropdown-menu dropdown-menu-end shadow-lg" aria-labelledby="profileMenu">
-        <li><h6 class="dropdown-header">@Auth.Company</h6></li>
+        <li><h6 class="dropdown-header">@CompanyName</h6></li>
         <li><a class="dropdown-item" href="/profile">View Profile</a></li>
         <li><a class="dropdown-item" href="/settings">Settings</a></li>
         <li><hr class="dropdown-divider" /></li>
         <li>
-            <button class="dropdown-item text-danger fw-semibold" @onclick="() => Logout()">
+            <button class="dropdown-item text-danger fw-semibold" @onclick="Logout">
                 <i class="bi bi-box-arrow-right me-2"></i> Logout
             </button>
         </li>
@@ -39,40 +39,34 @@
 @code {
     private string UserEmail = "Guest";
     private string UserRole = "";
-    private string Company = "";
-    private bool _hydrated = false;
+    private string CompanyName = "";
 
-    protected override async Task OnAfterRenderAsync(bool firstRender)
+    protected override async Task OnInitializedAsync()
     {
-        if (firstRender) {
+        var ctx = await UserCtx.GetAsync();
+        UserEmail = string.IsNullOrWhiteSpace(ctx.Email) ? "Guest" : ctx.Email;
+        UserRole = ctx.User?.Role ?? "";
+        CompanyName = ctx.User?.Company?.Name ?? "";
+    }
+
+    private bool _loaded;
 
-            if (!_hydrated)
-            {
-                // Load from localStorage
-                UserEmail = await JS.InvokeAsync<string>("localStorage.getItem", "cc_email") ?? "Guest";
-                UserRole = await JS.InvokeAsync<string>("localStorage.getItem", "cc_role") ?? "";
-                Company = await JS.InvokeAsync<string>("localStorage.getItem", "cc_company") ?? "";
+    protected override async Task OnAfterRenderAsync(bool firstRender)
+    {
+        if (!firstRender || _loaded) return;
+        _loaded = true;
 
-                // Subscribe to AuthService changes
-                Auth.OnAuthStateChanged += Refresh;
+        var ctx = await UserCtx.RefreshAsync();
+        UserEmail = string.IsNullOrWhiteSpace(ctx.Email) ? "Guest" : ctx.Email;
+        UserRole = ctx.User?.Role ?? "";
+        CompanyName = ctx.User?.Company?.Name ?? "";
 
-                _hydrated = true;
-                StateHasChanged();
-            }
-        }
+        StateHasChanged();
     }
 
-    private void Refresh() => InvokeAsync(StateHasChanged);
 
-    private async Task Logout()
-    {
-        await Auth.LogoutAsync();
+    private void Logout() => Nav.NavigateTo("/logout", forceLoad: true);
+
 
-        Nav.NavigateTo("/signin", forceLoad: true);
-    }
 
-    public void Dispose()
-    {
-        Auth.OnAuthStateChanged -= Refresh;
-    }
 }
diff --git a/CulinaryCommandApp/Components/Custom/UserLocationTagPicker.razor b/CulinaryCommandApp/Components/Custom/UserLocationTagPicker.razor
index aaefd25..c0853df 100644
--- a/CulinaryCommandApp/Components/Custom/UserLocationTagPicker.razor
+++ b/CulinaryCommandApp/Components/Custom/UserLocationTagPicker.razor
@@ -1,6 +1,5 @@
 @using CulinaryCommand.Data.Entities
 @inject ILocationService LocationService
-@inject AuthService Auth
 @rendermode InteractiveServer
 
 <div class="tag-picker">
@@ -38,6 +37,7 @@
 @code {
     [Parameter]
     public int UserId { get; set; }
+    [Parameter] public int? CompanyId { get; set; }
 
     [Parameter]
     public List<int> AssignedIds { get; set; } = new();
@@ -49,11 +49,29 @@
     private List<Location> AssignedLocations = new();
     private List<Location> UnassignedLocations = new();
 
+    private int? _loadedCompanyId;
+
     private bool IsMenuOpen = false;
 
-    protected override async Task OnInitializedAsync()
+    protected override async Task OnParametersSetAsync()
     {
-        AllLocations = await LocationService.GetLocationsByCompanyAsync(Auth.CurrentUser?.CompanyId);
+        // Parent hasn't provided CompanyId yet
+        if (CompanyId is null)
+        {
+            AllLocations.Clear();
+            RefreshLists(); // will show just the assigned tags (if any exist in AssignedIds)
+            return;
+        }
+
+        // Avoid reloading every render
+        if (_loadedCompanyId == CompanyId && AllLocations.Count > 0)
+        {
+            RefreshLists();
+            return;
+        }
+
+        _loadedCompanyId = CompanyId;
+        AllLocations = await LocationService.GetLocationsByCompanyAsync(CompanyId.Value);
         RefreshLists();
     }
 
@@ -61,7 +79,6 @@
     {
         AssignedLocations = AllLocations.Where(l => AssignedIds.Contains(l.Id)).ToList();
         UnassignedLocations = AllLocations.Where(l => !AssignedIds.Contains(l.Id)).ToList();
-        StateHasChanged();
     }
 
     private async Task AddLocation(int id)
diff --git a/CulinaryCommandApp/Components/Layout/Home.razor b/CulinaryCommandApp/Components/Layout/Home.razor
new file mode 100644
index 0000000..8171bd5
--- /dev/null
+++ b/CulinaryCommandApp/Components/Layout/Home.razor
@@ -0,0 +1,237 @@
+﻿@page "/"
+@namespace CulinaryCommand.Components.Pages
+@layout CulinaryCommand.Components.Layout.PublicLayout
+@rendermode InteractiveServer
+
+@inject NavigationManager Nav
+@inject CulinaryCommand.Services.UserContextSpace.IUserContextService UserCtx
+
+<div class="cc-hero">
+    <div class="cc-shell">
+
+        <div class="cc-top">
+            <div class="cc-mark">
+                <i class="bi bi-journal-check"></i>
+            </div>
+            <div>
+                <div class="cc-title">Culinary Command</div>
+                <div class="cc-subtitle">Tasks, inventory, recipes, and team management — in one place.</div>
+            </div>
+        </div>
+
+        <div class="cc-grid">
+
+            <div class="cc-card">
+                <div class="cc-card-head">
+                    <div class="cc-pill">
+                        <i class="bi bi-person-badge"></i>
+                        <span>Owner / Admin</span>
+                    </div>
+                    <div class="cc-card-title">Create your company</div>
+                    <div class="cc-card-text">
+                        Set up your company and locations, then invite managers and employees.
+                    </div>
+                </div>
+
+                <button class="btn btn-success w-100 cc-btn"
+                        @onclick="() => Nav.NavigateTo(adminSignup, true)">
+                    Create Company
+                </button>
+
+                <div class="cc-muted mt-2">
+                    Admins are the only users who can create a new organization.
+                </div>
+            </div>
+
+            <div class="cc-card cc-card-alt">
+                <div class="cc-card-head">
+                    <div class="cc-pill cc-pill-alt">
+                        <i class="bi bi-people"></i>
+                        <span>Employee / Manager</span>
+                    </div>
+                    <div class="cc-card-title">Join your team</div>
+                    <div class="cc-card-text">
+                        Use your invite link to set your password, then sign in.
+                    </div>
+                </div>
+
+                <div class="d-grid gap-2">
+                    <button class="btn btn-dark w-100 cc-btn"
+                            @onclick="() => Nav.NavigateTo(signIn, true)">
+                        Sign In
+                    </button>
+
+                    <button class="btn btn-outline-secondary w-100 cc-btn"
+                            @onclick="() => Nav.NavigateTo(invite, true)">
+                        I have an invite link
+                    </button>
+                </div>
+
+                <div class="cc-muted mt-2">
+                    Don’t have an invite? Ask your manager or admin.
+                </div>
+            </div>
+
+        </div>
+
+        <div class="cc-foot">
+            By continuing, you agree to your organization’s access policies.
+        </div>
+
+    </div>
+</div>
+
+<style>
+    .cc-hero{
+        min-height: calc(100vh - 0px);
+        display:flex;
+        align-items:center;
+        justify-content:center;
+        padding: 48px 18px;
+        background:
+            radial-gradient(900px 420px at 20% 10%, rgba(25,135,84,.14), transparent 60%),
+            radial-gradient(800px 380px at 80% 0%, rgba(0,0,0,.08), transparent 55%),
+            #f8fafc;
+    }
+
+    .cc-shell{
+        width: 100%;
+        max-width: 980px;
+    }
+
+    .cc-top{
+        display:flex;
+        align-items:center;
+        gap: 14px;
+        margin-bottom: 22px;
+        padding: 18px 18px 0 18px;
+    }
+
+    .cc-mark{
+        width: 54px;
+        height: 54px;
+        border-radius: 16px;
+        display:flex;
+        align-items:center;
+        justify-content:center;
+        background: rgba(25,135,84,.12);
+        color: #198754;
+        font-size: 24px;
+        flex: 0 0 auto;
+        border: 1px solid rgba(25,135,84,.18);
+    }
+
+    .cc-title{
+        font-weight: 800;
+        letter-spacing: -0.5px;
+        font-size: 34px;
+        line-height: 1.1;
+        color: #111827;
+    }
+
+    .cc-subtitle{
+        margin-top: 6px;
+        font-size: 16px;
+        color: #4b5563;
+        max-width: 660px;
+    }
+
+    .cc-grid{
+        display:grid;
+        grid-template-columns: 1fr 1fr;
+        gap: 14px;
+        padding: 18px;
+    }
+
+    .cc-card{
+        border-radius: 18px;
+        background: #ffffff;
+        border: 1px solid rgba(17,24,39,.08);
+        box-shadow: 0 10px 30px rgba(17,24,39,.06);
+        padding: 18px;
+        display:flex;
+        flex-direction:column;
+        justify-content:space-between;
+        min-height: 250px;
+    }
+
+    .cc-card-alt{
+        background:
+            linear-gradient(180deg, rgba(17,24,39,.02), rgba(17,24,39,0)),
+            #ffffff;
+    }
+
+    .cc-card-head{
+        margin-bottom: 14px;
+    }
+
+    .cc-pill{
+        display:inline-flex;
+        align-items:center;
+        gap: 8px;
+        padding: 6px 10px;
+        border-radius: 999px;
+        background: rgba(25,135,84,.10);
+        border: 1px solid rgba(25,135,84,.18);
+        color: #166534;
+        font-weight: 700;
+        font-size: 13px;
+        margin-bottom: 10px;
+    }
+
+    .cc-pill-alt{
+        background: rgba(17,24,39,.06);
+        border-color: rgba(17,24,39,.10);
+        color: #111827;
+    }
+
+    .cc-card-title{
+        font-size: 20px;
+        font-weight: 800;
+        color: #111827;
+        margin-bottom: 6px;
+        letter-spacing: -0.2px;
+    }
+
+    .cc-card-text{
+        color: #4b5563;
+        font-size: 14.5px;
+        line-height: 1.45;
+        max-width: 44ch;
+    }
+
+    .cc-btn{
+        border-radius: 12px;
+        padding: 12px 14px;
+        font-weight: 800;
+    }
+
+    .cc-muted{
+        color: #6b7280;
+        font-size: 12.5px;
+        line-height: 1.35;
+    }
+
+    .cc-foot{
+        text-align:center;
+        color: #6b7280;
+        font-size: 12.5px;
+        padding: 6px 18px 0 18px;
+    }
+</style>
+
+@code {
+    private const string signIn = "/login";
+    private const string adminSignup = "/adminsignup";
+    private const string invite = "/invite";
+
+    protected override async Task OnInitializedAsync()
+    {
+        // If already signed in, go straight to dashboard.
+        var ctx = await UserCtx.GetAsync();
+        if (ctx.User?.Id != null)
+        {
+            Nav.NavigateTo("/dashboard", forceLoad: true);
+        }
+    }
+}
diff --git a/CulinaryCommandApp/Components/Layout/MainLayout.razor b/CulinaryCommandApp/Components/Layout/MainLayout.razor
index d507af9..7bc738f 100644
--- a/CulinaryCommandApp/Components/Layout/MainLayout.razor
+++ b/CulinaryCommandApp/Components/Layout/MainLayout.razor
@@ -1,45 +1,29 @@
 @inherits LayoutComponentBase
-@using CulinaryCommand.Models
-@using CulinaryCommand.Services
-@inject CulinaryCommand.Services.AuthService Auth
-@inject NavigationManager Nav
-@inject LocationState LocationState
-@using System.Threading.Tasks
-@rendermode InteractiveServer
-
-
-<div class="page">
-  <div class="sidebar"><NavMenu /></div>
-
-  <main>
-    <div class="top-row px-4 d-flex justify-content-end align-items-center">
-        <LocationSelector />
-        <ProfileDropdown />
-    </div>
-
-    <article class="content px-4">
-      @Body
-    </article>
-  </main>
-</div>
-
-@code {
-  private bool _hydrated;
-
-  protected override async Task OnAfterRenderAsync(bool firstRender)
-  {
-      if (!firstRender || _hydrated)
-          return;
-
-      await LocationState.HydrateAsync();
-      
-      var path = Nav.Uri.ToLowerInvariant();
-      if (!path.Contains("/signin") && !path.Contains("/signup") && !path.Contains("/adminsignup"))
-      {
-          await Auth.EnsureHydratedAsync();
-      }
-
-      _hydrated = true;
-      StateHasChanged();
-  }
-}
+@using Microsoft.AspNetCore.Components.Authorization
+
+<AuthorizeView>
+    <Authorized>
+        <div class="page">
+            <div class="sidebar">
+                <NavMenu />
+            </div>
+
+            <main>
+                <div class="top-row px-4 d-flex justify-content-end align-items-center">
+                    <LocationSelector />
+                    <ProfileDropdown />
+                </div>
+
+                <article class="content px-4">
+                    @Body
+                </article>
+            </main>
+        </div>
+    </Authorized>
+
+    <NotAuthorized>
+        <main class="public-page">
+            @Body
+        </main>
+    </NotAuthorized>
+</AuthorizeView>
diff --git a/CulinaryCommandApp/Components/Layout/NavMenu.razor b/CulinaryCommandApp/Components/Layout/NavMenu.razor
index 49be8e9..14aa4d5 100644
--- a/CulinaryCommandApp/Components/Layout/NavMenu.razor
+++ b/CulinaryCommandApp/Components/Layout/NavMenu.razor
@@ -1,9 +1,11 @@
 ﻿@namespace CulinaryCommand.Components.Layout
+@using CulinaryCommand.Services.UserContextSpace
 @using Microsoft.AspNetCore.Components
 @using Microsoft.AspNetCore.Components.Routing
 @using CulinaryCommand.Components.Custom
+@using CulinaryCommand.Services
+@inject IUserContextService UserCtx
 @rendermode InteractiveServer
-@inject AuthService Auth
 
 <div class="top-row ps-3 navbar navbar-dark">
     <div class="container-fluid">
@@ -16,7 +18,7 @@
 <div class="nav-scrollable" onclick="document.querySelector('.navbar-toggler').click()">
     <nav class="flex-column">
         <div class="nav-item px-3">
-            <NavLink class="nav-link" href="/" Match="NavLinkMatch.All">
+            <NavLink class="nav-link" href="/dashboard" Match="NavLinkMatch.All">
                 <span class="bi bi-house-door-fill nav-icon" aria-hidden="true"></span> Home
             </NavLink>
         </div>
@@ -27,23 +29,51 @@
             </NavLink>
         </div>
 
-        @if (Auth.UserRole == "Employee")
-        {
         <div class="nav-item px-3">
             <NavLink class="nav-link" href="/tasks">
                 <span class="bi bi-list-nested nav-icon" aria-hidden="true"></span> My Tasks
             </NavLink>
         </div>
-        }
-        else { @* admin or manager *@
+
+        <div class="nav-item px-3">
+            <NavLink class="nav-link" href="/inventory-management">
+                <span class="bi bi-box-seam nav-icon" aria-hidden="true"></span> Inventory
+            </NavLink>
+        </div>
+
+        @if (_role == "Admin")
+        {
+            <div class="nav-item px-3">
+                <NavLink class="nav-link" href="recipes">
+                    <span class="bi bi-journal-text nav-icon"></span> Recipes
+                </NavLink>
+            </div>
+            <div class="nav-item px-3">
+                <NavLink class="nav-link" href="ingredients">
+                    <span class="bi bi-basket3 nav-icon"></span> Ingredients
+                </NavLink>
+            </div>
             <div class="nav-item px-3">
                 <NavLink class="nav-link" href="/assign-tasks">
                     <span class="bi bi-clipboard-check nav-icon" aria-hidden="true"></span> Assign Tasks
                 </NavLink>
             </div>
+            <div class="nav-item px-3">
+                <NavLink class="nav-link" href="/purchase-orders">
+                    <span class="bi bi-cart3 nav-icon" aria-hidden="true"></span> Purchase Orders
+                </NavLink>
+            </div>
+            <div class="nav-item px-3">
+                <NavLink class="nav-link" href="users">
+                    <span class="bi bi-people nav-icon"></span> Manage Users
+                </NavLink>
+            </div>
+        }
+        else if (_role == "Manager")
+        {
             <div class="nav-item px-3">
                 <NavLink class="nav-link" href="recipes">
-                    <span class="bi bi-journal-text nav-icon"></span>Recipes
+                    <span class="bi bi-journal-text nav-icon"></span> Recipes
                 </NavLink>
             </div>
             <div class="nav-item px-3">
@@ -64,26 +94,17 @@
             
             
         }
-        @if (Auth.UserRole == "Admin")
-        {
-            <div class="nav-item px-3">
-                <NavLink class="nav-link" href="users">
-                    <span class="bi bi-people nav-icon"></span> Manage Users
-                </NavLink>
-            </div>
-        }
     </nav>
 </div>
 
 @code {
+    private string? _role;
 
-    protected override void OnInitialized()
-    {
-        Auth.OnAuthStateChanged += StateHasChanged;
-    }
-
-    public void Dispose()
+    protected override async Task OnInitializedAsync()
     {
-        Auth.OnAuthStateChanged -= StateHasChanged;
+        // Compile-safe even if auth isn't working yet:
+        // - If not authenticated or DB user not found, _role stays null.
+        var ctx = await UserCtx.GetAsync();
+        _role = ctx.User?.Role;
     }
-}
\ No newline at end of file
+}
diff --git a/CulinaryCommandApp/Components/Layout/NoAccess.razor b/CulinaryCommandApp/Components/Layout/NoAccess.razor
new file mode 100644
index 0000000..68a7e4c
--- /dev/null
+++ b/CulinaryCommandApp/Components/Layout/NoAccess.razor
@@ -0,0 +1,14 @@
+@page "/no-access"
+@rendermode InteractiveServer
+
+<div class="signin-container">
+    <div class="signin-card">
+        <h2>No access</h2>
+        <p>
+            You successfully signed in with Cognito, but your account isn’t invited/assigned to a restaurant yet.
+            Contact an admin to be added.
+        </p>
+
+        <a class="btn btn-outline-danger w-100" href="/logout">Log out</a>
+    </div>
+</div>
diff --git a/CulinaryCommandApp/Components/Layout/PublicLayout.razor b/CulinaryCommandApp/Components/Layout/PublicLayout.razor
new file mode 100644
index 0000000..c6792a7
--- /dev/null
+++ b/CulinaryCommandApp/Components/Layout/PublicLayout.razor
@@ -0,0 +1,5 @@
+@inherits LayoutComponentBase
+
+<main class="public-page">
+    @Body
+</main>
diff --git a/CulinaryCommandApp/Components/Pages/AdminSignUp.razor b/CulinaryCommandApp/Components/Pages/AdminSignUp.razor
index a8fad23..653b043 100644
--- a/CulinaryCommandApp/Components/Pages/AdminSignUp.razor
+++ b/CulinaryCommandApp/Components/Pages/AdminSignUp.razor
@@ -1,126 +1,367 @@
 @page "/adminsignup"
-@using System.ComponentModel.DataAnnotations
 @using CulinaryCommand.Models
 @using Microsoft.AspNetCore.Components
-@using CulinaryCommand.Services
-@using CulinaryCommand.Data.Entities
-@inject IUserService UserService
+@using Microsoft.AspNetCore.Components.Forms
+@inject CulinaryCommand.Services.IUserService UserService
 @inject NavigationManager Navigation
 @rendermode InteractiveServer
 
 <PageTitle>Admin Sign Up - Culinary Command</PageTitle>
 
-<div class="signup-container">
-    <div class="signup-card">
-        <div class="text-center mb-4">
-            <h1 class="app-title">Culinary Command</h1>
-            <p class="signup-subtitle">Create a new account</p>
-        </div>
+<div class="cc-hero">
+    <div class="cc-shell">
 
-        @*display error message if registering fails*@
-        @if (!string.IsNullOrEmpty(errorMessage))
-        {
-            <div class="alert alert-danger" role ="alert">
-            @errorMessage
+        <div class="cc-top">
+            <div class="cc-mark">
+                <i class="bi bi-person-badge"></i>
             </div>
-        }
-
-        @if (!string.IsNullOrEmpty(successMessage))
-        {
-            <div class="alert alert-success" role="alert">
-                @successMessage
+            <div>
+                <div class="cc-title">Create your company</div>
+                <div class="cc-subtitle">Add your locations, create the admin account, then invite your team.</div>
             </div>
-        }
+        </div>
 
-        <EditForm Model="@Signup" OnValidSubmit="@HandleSubmit" FormName="SignUpForm">
-    <DataAnnotationsValidator />
-    <ValidationSummary />
+        <div class="cc-formcard">
 
-    <!-- COMPANY -->
-    <h4 class="mb-3">Restaurant Information</h4>
+            @if (!string.IsNullOrEmpty(errorMessage))
+            {
+                <div class="alert alert-danger" role="alert">@errorMessage</div>
+            }
 
-    <div class="mb-3">
-        <label class="form-label">Restaurant Name</label>
-        <InputText class="form-control" @bind-Value="Signup.Company.Name" />
-        <ValidationMessage For="@(() => Signup.Company.Name)" />
-    </div>
+            @if (!string.IsNullOrEmpty(successMessage))
+            {
+                <div class="alert alert-success" role="alert">@successMessage</div>
+            }
 
-    <div class="mb-3">
-        <label class="form-label">Address</label>
-        <InputText class="form-control" @bind-Value="Signup.Company.Address" />
-    </div>
+            <EditForm Model="@Signup" OnValidSubmit="@HandleSubmit">
+                <DataAnnotationsValidator />
+                <ValidationSummary />
 
-    <div class="row">
-        <div class="col">
-            <label class="form-label">City</label>
-            <InputText class="form-control" @bind-Value="Signup.Company.City" />
-        </div>
-        <div class="col">
-            <label class="form-label">State</label>
-            <InputText class="form-control" @bind-Value="Signup.Company.State" />
-        </div>
-        <div class="col">
-            <label class="form-label">Zip</label>
-            <InputText class="form-control" @bind-Value="Signup.Company.ZipCode" />
-        </div>
-    </div>
+                <div class="cc-section">
+                    <div class="cc-section-head">
+                        <div class="cc-section-title">Company</div>
+                        <div class="cc-section-note">This is the organization that owns the locations.</div>
+                    </div>
 
+                    <div class="cc-grid2">
+                        <div>
+                            <label class="form-label">Company Name</label>
+                            <InputText class="form-control cc-input" @bind-Value="Signup.Company.Name" />
+                        </div>
 
-    <!-- ADMIN -->
-    <h4 class="mt-4 mb-3">Admin Account</h4>
+                        <div>
+                            <label class="form-label">Company Email (optional)</label>
+                            <InputText class="form-control cc-input" @bind-Value="Signup.Company.Email" />
+                        </div>
 
-    <div class="row">
-        <div class="col">
-            <label class="form-label">First Name</label>
-            <InputText class="form-control" @bind-Value="FirstName" />
-        </div>
-        <div class="col">
-            <label class="form-label">Last Name</label>
-            <InputText class="form-control" @bind-Value="LastName" />
-        </div>
-    </div>
+                        <div class="cc-span2">
+                            <label class="form-label">Company Phone (optional)</label>
+                            <InputText class="form-control cc-input" @bind-Value="Signup.Company.Phone" />
+                        </div>
+                    </div>
+                </div>
 
-    <div class="mb-3">
-        <label class="form-label">Email</label>
-        <InputText type="email" class="form-control" @bind-Value="Signup.Admin.Email" />
-        <ValidationMessage For="@(() => Signup.Admin.Email)" />
-    </div>
+                <div class="cc-divider"></div>
 
-    <div class="mb-3">
-        <label class="form-label">Password</label>
-        <InputText type="password" class="form-control" @bind-Value="Signup.Admin.Password" />
-        <ValidationMessage For="@(() => Signup.Admin.Password)" />
-    </div>
+                <div class="cc-section">
+                    <div class="cc-section-row">
+                        <div>
+                            <div class="cc-section-title">Locations</div>
+                            <div class="cc-section-note">Add one or more restaurant locations.</div>
+                        </div>
+
+                        <button type="button"
+                                class="btn btn-outline-success cc-btn-sm"
+                                @onclick="AddLocation"
+                                disabled="@isSubmitting">
+                            <i class="bi bi-plus-lg me-1"></i> Add Location
+                        </button>
+                    </div>
+
+                    @foreach (var loc in Signup.Locations.ToList())
+                    {
+                        var locIndex = Signup.Locations.IndexOf(loc);
+
+                        <div class="cc-loc-card" @key="loc">
+                            <div class="cc-loc-head">
+                                <div class="cc-loc-title">Location @(locIndex + 1)</div>
+
+                                <button type="button"
+                                        class="btn btn-outline-danger cc-btn-sm"
+                                        @onclick="() => RemoveLocation(loc)"
+                                        disabled="@(isSubmitting || Signup.Locations.Count == 1)">
+                                    Remove
+                                </button>
+                            </div>
+
+                            <div class="cc-grid2">
+                                <div class="cc-span2">
+                                    <label class="form-label">Location Name</label>
+                                    <InputText class="form-control cc-input" @bind-Value="loc.Name" />
+                                </div>
+
+                                <div class="cc-span2">
+                                    <label class="form-label">Address</label>
+                                    <InputText class="form-control cc-input" @bind-Value="loc.Address" />
+                                </div>
+
+                                <div>
+                                    <label class="form-label">City</label>
+                                    <InputText class="form-control cc-input" @bind-Value="loc.City" />
+                                </div>
 
-    <button type="submit" class="btn btn-success w-100 mt-3">
-        Create Account
-    </button>
-</EditForm>
+                                <div>
+                                    <label class="form-label">State</label>
+                                    <InputText class="form-control cc-input" @bind-Value="loc.State" />
+                                </div>
 
-        <!-- Sign In Link -->
-        <div class="text-center mt-4">
-            <span class="text-muted">Already have an account? </span>
-            <a href="/signin" class="signin-link">Sign in</a>
+                                <div class="cc-span2">
+                                    <label class="form-label">Zip</label>
+                                    <InputText class="form-control cc-input" @bind-Value="loc.ZipCode" />
+                                </div>
+
+                                <div class="cc-span2">
+                                    <label class="form-label">MarginEdge Key (optional)</label>
+                                    <InputText class="form-control cc-input" @bind-Value="loc.MarginEdgeKey" />
+                                </div>
+                            </div>
+                        </div>
+                    }
+                </div>
+
+                <div class="cc-divider"></div>
+
+                <div class="cc-section">
+                    <div class="cc-section-head">
+                        <div class="cc-section-title">Admin Profile</div>
+                        <div class="cc-section-note">This user owns the company and can invite others.</div>
+                    </div>
+
+                    <div class="cc-grid2">
+                        <div>
+                            <label class="form-label">First Name</label>
+                            <InputText class="form-control cc-input" @bind-Value="FirstName" />
+                        </div>
+
+                        <div>
+                            <label class="form-label">Last Name</label>
+                            <InputText class="form-control cc-input" @bind-Value="LastName" />
+                        </div>
+
+                        <div class="cc-span2">
+                            <label class="form-label">Admin Email</label>
+                            <InputText type="email" class="form-control cc-input" @bind-Value="Signup.Admin.Email" />
+                        </div>
+
+                        <div class="cc-span2">
+                            <label class="form-label">Admin Password</label>
+                            <InputText type="password" class="form-control cc-input" @bind-Value="Signup.Admin.Password" />
+                        </div>
+                    </div>
+                </div>
+
+                <button type="submit" class="btn btn-success w-100 cc-btn mt-2" disabled="@isSubmitting">
+                    @(isSubmitting ? "Creating..." : "Create Company")
+                </button>
+
+                <div class="cc-footlink">
+                    <span class="text-muted">Already have an account?</span>
+                    <a href="/signin" class="ms-2">Sign in</a>
+                </div>
+
+            </EditForm>
         </div>
     </div>
 </div>
 
-@code {
-    private bool showPassword = false;
-    private bool showConfirmPassword = false;
+<style>
+    .cc-hero{
+        min-height: calc(100vh - 0px);
+        display:flex;
+        align-items:flex-start;
+        justify-content:center;
+        padding: 44px 18px;
+        background:
+            radial-gradient(900px 420px at 20% 10%, rgba(25,135,84,.14), transparent 60%),
+            radial-gradient(800px 380px at 80% 0%, rgba(0,0,0,.08), transparent 55%),
+            #f8fafc;
+    }
 
-    //flag to track if form is being submitted
-    private bool isSubmitting = false;
+    .cc-shell{ width:100%; max-width: 980px; }
+
+    .cc-top{
+        display:flex;
+        align-items:center;
+        gap: 14px;
+        margin-bottom: 14px;
+        padding: 0 6px;
+    }
+
+    .cc-mark{
+        width: 52px;
+        height: 52px;
+        border-radius: 16px;
+        display:flex;
+        align-items:center;
+        justify-content:center;
+        background: rgba(25,135,84,.12);
+        color: #198754;
+        font-size: 22px;
+        border: 1px solid rgba(25,135,84,.18);
+        flex: 0 0 auto;
+    }
+
+    .cc-title{
+        font-weight: 850;
+        letter-spacing: -0.5px;
+        font-size: 28px;
+        line-height: 1.1;
+        color: #111827;
+    }
+
+    .cc-subtitle{
+        margin-top: 6px;
+        font-size: 14.5px;
+        color: #4b5563;
+        max-width: 680px;
+    }
+
+    .cc-formcard{
+        border-radius: 18px;
+        background: #ffffff;
+        border: 1px solid rgba(17,24,39,.08);
+        box-shadow: 0 10px 30px rgba(17,24,39,.06);
+        padding: 18px;
+    }
+
+    .cc-section{ padding: 4px 2px; }
+
+    .cc-section-head{ margin-bottom: 10px; }
 
-    // messages to display to the user
+    .cc-section-row{
+        display:flex;
+        align-items:center;
+        justify-content:space-between;
+        gap: 12px;
+        margin-bottom: 10px;
+    }
+
+    .cc-section-title{
+        font-weight: 850;
+        color: #111827;
+        letter-spacing: -0.2px;
+        font-size: 16px;
+    }
+
+    .cc-section-note{
+        margin-top: 4px;
+        color: #6b7280;
+        font-size: 12.5px;
+        line-height: 1.35;
+    }
+
+    .cc-divider{
+        height: 1px;
+        background: rgba(17,24,39,.08);
+        margin: 14px 0;
+    }
+
+    .cc-grid2{
+        display:grid;
+        grid-template-columns: 1fr 1fr;
+        gap: 12px;
+    }
+
+    .cc-span2{ grid-column: span 2; }
+
+    @* @media (max-width: 860px){
+        .cc-grid2{ grid-template-columns: 1fr; }
+        .cc-span2{ grid-column: span 1; }
+        .cc-section-row{ flex-direction: column; align-items: stretch; }
+    } *@
+
+    .cc-input{
+        border-radius: 12px;
+        padding: 10px 12px;
+    }
+
+    .cc-btn{
+        border-radius: 12px;
+        padding: 12px 14px;
+        font-weight: 850;
+    }
+
+    .cc-btn-sm{
+        border-radius: 999px;
+        font-weight: 800;
+        padding: 6px 12px;
+    }
+
+    .cc-loc-card{
+        border-radius: 16px;
+        border: 1px solid rgba(17,24,39,.08);
+        background:
+            linear-gradient(180deg, rgba(17,24,39,.02), rgba(17,24,39,0)),
+            #ffffff;
+        padding: 14px;
+        margin-bottom: 12px;
+    }
+
+    .cc-loc-head{
+        display:flex;
+        align-items:center;
+        justify-content:space-between;
+        gap: 10px;
+        margin-bottom: 10px;
+    }
+
+    .cc-loc-title{
+        font-weight: 850;
+        color: #111827;
+        font-size: 14px;
+    }
+
+    .cc-footlink{
+        text-align:center;
+        margin-top: 14px;
+        font-size: 13px;
+    }
+
+    .cc-footlink a{
+        text-decoration:none;
+        font-weight: 800;
+    }
+</style>
+
+@code {
+    private bool isSubmitting = false;
     private string errorMessage = string.Empty;
     private string successMessage = string.Empty;
 
     private SignupRequest Signup { get; set; } = new();
-    
+
     private string FirstName { get; set; } = string.Empty;
     private string LastName { get; set; } = string.Empty;
 
+    protected override void OnInitialized()
+    {
+        Signup.Locations ??= new List<LocationSignup>();
+
+        if (Signup.Locations.Count == 0)
+            Signup.Locations.Add(new LocationSignup());
+    }
+
+    private void AddLocation()
+    {
+        Signup.Locations.Add(new LocationSignup());
+    }
+
+    private void RemoveLocation(LocationSignup loc)
+    {
+        if (Signup.Locations.Count <= 1) return;
+        Signup.Locations.Remove(loc);
+    }
+
     private async Task HandleSubmit()
     {
         errorMessage = "";
@@ -129,11 +370,11 @@
 
         try
         {
-            // Combine first and last name
             Signup.Admin.Name = $"{FirstName} {LastName}".Trim();
-            
-            // You will write this service method.
+
             await UserService.CreateAdminWithCompanyAndLocationAsync(Signup);
+
+            successMessage = "Company created. Redirecting to sign in...";
             Navigation.NavigateTo("/signin", true);
         }
         catch (Exception ex)
@@ -145,14 +386,4 @@
             isSubmitting = false;
         }
     }
-    private void TogglePasswordVisibility()
-    {
-        showPassword = !showPassword;
-    }
-
-    private void ToggleConfirmPasswordVisibility()
-    {
-        showConfirmPassword = !showConfirmPassword;
-    }
-
-}
\ No newline at end of file
+}
diff --git a/CulinaryCommandApp/Components/Pages/AdminView.razor b/CulinaryCommandApp/Components/Pages/AdminView.razor
index 307be3f..f32f9d0 100644
--- a/CulinaryCommandApp/Components/Pages/AdminView.razor
+++ b/CulinaryCommandApp/Components/Pages/AdminView.razor
@@ -42,6 +42,3 @@
 </div>
 </div>
 
-@code {
-    [Inject] private CulinaryCommand.Services.AuthService Auth { get; set; } = default!;
-}
diff --git a/CulinaryCommandApp/Components/Pages/Assignments/AdminAssignTask.razor b/CulinaryCommandApp/Components/Pages/Assignments/AdminAssignTask.razor
index 47a10f3..3b73c89 100644
--- a/CulinaryCommandApp/Components/Pages/Assignments/AdminAssignTask.razor
+++ b/CulinaryCommandApp/Components/Pages/Assignments/AdminAssignTask.razor
@@ -3,8 +3,8 @@
 @using CulinaryCommand.Data.Entities
 @using CulinaryCommand.Services
 @using CulinaryCommand.Data.Enums;
-
-@inject AuthService Auth
+@using CulinaryCommand.Services.UserContextSpace
+@inject IUserContextService UserCtx
 @inject NavigationManager Nav
 @inject ILocationService LocationService
 @inject IUserService UserService
@@ -248,11 +248,10 @@ else
 }
 
 @code {
+    private UserContext? _ctx;
     private bool ready;
     private bool allowed;
-    private List<Location> locations = new();
     private List<User> teamMembers = new();
-
     private List<Tasks> assignments = new();
     private TaskFormModel newTask = new();
     private int? selectedLocationId;
@@ -264,71 +263,51 @@ else
     private readonly List<string> priorityOptions = new() { "Low", "Normal", "High", "Critical" };
     private readonly List<string> statusBuckets = new() { "Pending", "In Progress", "Completed" };
 
-    protected override async Task OnAfterRenderAsync(bool firstRender)
+    protected override async Task OnInitializedAsync()
     {
-        if (!firstRender) return;
+        _ctx = await UserCtx.GetAsync();
 
-        await Auth.EnsureHydratedAsync();
-
-        allowed = Auth.IsSignedIn && (Auth.UserRole == "Admin" || Auth.UserRole == "Manager");
+        if (!_ctx.IsAuthenticated)
+        {
+            Nav.NavigateTo("/login", true);
+            return;
+        }
 
-        if (!Auth.IsSignedIn)
+        // Invite-only: authenticated but not in DB
+        if (_ctx.User is null)
         {
-            Nav.NavigateTo("/signin", replace: true);
+            Nav.NavigateTo("/no-access", true);
             return;
         }
 
+        allowed =
+            string.Equals(_ctx.User.Role, "Admin", StringComparison.OrdinalIgnoreCase) ||
+            string.Equals(_ctx.User.Role, "Manager", StringComparison.OrdinalIgnoreCase);
+
         if (!allowed)
         {
             ready = true;
-            StateHasChanged();
             return;
         }
 
-        // use header-selected location as source of truth
+        // Ensure LocationState is hydrated if user deep-links here
+        if (LocationState.ManagedLocations.Count == 0 && _ctx.AccessibleLocations.Any())
+            await LocationState.SetLocationsAsync(_ctx.AccessibleLocations);
+
+        // Source of truth: header-selected location
         selectedLocationId = LocationState.CurrentLocation?.Id;
 
         LocationState.OnChange += HandleLocationStateChanged;
 
-        await LoadLocationsAsync();
         await LoadTeamAsync();
         await LoadRecipesAsync();
         await LoadAssignmentsAsync();
 
         ready = true;
-        StateHasChanged();
     }
 
-    private async Task LoadLocationsAsync()
-    {
-        try
-        {
-            if (Auth.UserRole == "Admin")
-            {
-                locations = await LocationService.GetLocationsByCompanyAsync(Auth.CompanyId ?? 0);
-            }
-            else
-            {
-                locations = await LocationService.GetLocationsByManagerAsync(Auth.UserId ?? 0);
-            }
-        }
-        catch
-        {
-            locations = new()
-            {
-                new Location { Id = 1, Name = "Main Kitchen" },
-                new Location { Id = 2, Name = "Prep Lab" }
-            };
-        }
-
-        if (!locations.Any())
-        {
-            locations.Add(new Location { Id = 1, Name = "Main Kitchen" });
-        }
 
-        // fallback only if header has no location
-        selectedLocationId ??= LocationState.CurrentLocation?.Id ?? locations.FirstOrDefault()?.Id;
-    }
+    
 
     private async Task LoadTeamAsync()
     {
@@ -414,9 +393,7 @@ else
             DueDate = newTask.DueDate ?? DateTime.Today,
             Notes = newTask.Notes?.Trim(),
             LocationId = selectedLocationId.Value,
-            Assigner = Auth.CurrentUser?.Name
-                ?? Auth.UserEmail
-                ?? "Manager",
+            Assigner = "Manager",
             Kind = newTask.TaskType,
             Par = newTask.Par,
             Count = newTask.Count,
diff --git a/CulinaryCommandApp/Components/Pages/Assignments/MyTasks.razor b/CulinaryCommandApp/Components/Pages/Assignments/MyTasks.razor
index 31604c8..fd8b81c 100644
--- a/CulinaryCommandApp/Components/Pages/Assignments/MyTasks.razor
+++ b/CulinaryCommandApp/Components/Pages/Assignments/MyTasks.razor
@@ -5,8 +5,9 @@
 @using CulinaryCommand.Data.Entities
 @using CulinaryCommand.Data.Enums
 @using CulinaryCommand.Services
+@using CulinaryCommand.Services.UserContextSpace
 
-@inject AuthService Auth
+@inject IUserContextService UserCtx
 @inject ITaskAssignmentService TaskService
 @inject LocationState LocationState
 @inject NavigationManager Nav
@@ -22,7 +23,7 @@
         <div class="mt-5">Loading your tasks...</div>
     </div>
 }
-else if (!Auth.IsSignedIn)
+else if (_ctx?.IsAuthenticated != true)
 {
     <div class="container mt-4">
         <div class="alert alert-warning mt-4">
@@ -51,6 +52,8 @@ else
 }
 
 @code {
+    private UserContext? _ctx;
+
     private bool ready;
     private string username = "Cook";
 
@@ -60,23 +63,32 @@ else
 
     private bool _isLoadingTasks = false;
 
-    protected override async Task OnAfterRenderAsync(bool firstRender)
+    protected override async Task OnInitializedAsync()
     {
-        if (!firstRender) return;
+        _ctx = await UserCtx.GetAsync();
 
-        await Auth.EnsureHydratedAsync();
+        // If not authenticated, bounce to Cognito login
+        if (_ctx.IsAuthenticated != true)
+        {
+            Nav.NavigateTo("/login", true);
+            return;
+        }
 
-        if (!Auth.IsSignedIn)
+        // Invite-only: authenticated but not in DB
+        if (_ctx.User is null)
         {
-            ready = true;
-            StateHasChanged();
+            Nav.NavigateTo("/no-access", true);
             return;
         }
 
-        username = Auth.CurrentUser?.Name
-            ?? Auth.UserEmail
+        username = _ctx.User.Name
+            ?? _ctx.Email
             ?? "Cook";
 
+        // If user deep-linked here, ensure LocationState is hydrated
+        if (LocationState.ManagedLocations.Count == 0 && _ctx.AccessibleLocations.Any())
+            await LocationState.SetLocationsAsync(_ctx.AccessibleLocations);
+
         selectedLocationId = LocationState.CurrentLocation?.Id;
 
         LocationState.OnChange -= HandleLocationStateChanged;
@@ -85,7 +97,6 @@ else
         await LoadTasksAsync();
 
         ready = true;
-        StateHasChanged();
     }
 
     private async Task LoadTasksAsync()
@@ -95,14 +106,15 @@ else
         _isLoadingTasks = true;
         try
         {
-            if (!Auth.UserId.HasValue)
+            var userId = _ctx?.User?.Id;
+            if (userId is null)
             {
                 allTasks = new();
                 prepTasks = new();
                 return;
             }
 
-            allTasks = await TaskService.GetForUserAsync(Auth.UserId.Value, selectedLocationId);
+            allTasks = await TaskService.GetForUserAsync(userId.Value, selectedLocationId);
 
             prepTasks = allTasks
                 @* .Where(t => t.Kind == WorkTaskKind.PrepFromRecipe) *@
@@ -133,9 +145,9 @@ else
         await InvokeAsync(StateHasChanged);
     }
 
-    private async void HandleLocationStateChanged()
+    private void HandleLocationStateChanged()
     {
-        await InvokeAsync(async () =>
+        _ = InvokeAsync(async () =>
         {
             selectedLocationId = LocationState.CurrentLocation?.Id ?? selectedLocationId;
             await LoadTasksAsync();
diff --git a/CulinaryCommandApp/Components/Pages/Dashboard.razor b/CulinaryCommandApp/Components/Pages/Dashboard.razor
index c2b1390..a50c2ca 100644
--- a/CulinaryCommandApp/Components/Pages/Dashboard.razor
+++ b/CulinaryCommandApp/Components/Pages/Dashboard.razor
@@ -2,32 +2,34 @@
 @rendermode InteractiveServer
 
 @using CulinaryCommand.Components.Custom
+@using CulinaryCommand.Services.UserContextSpace
 @using CulinaryCommandApp.AIDashboard.Services.Reporting
 @using CulinaryCommandApp.AIDashboard.Services.DTOs
+@using CulinaryCommand.Services
 @inject Microsoft.AspNetCore.Hosting.IWebHostEnvironment Env
-@inject CulinaryCommand.Services.AuthService Auth
 @inject NavigationManager Nav
 @inject AIReportingService ReportingService
-
+@inject IUserContextService UserCtx
 
 @if (!_ready)
 {
     <div class="text-center mt-5">Loading…</div>
 }
-else if (!Auth.IsSignedIn)
+else if (!_isSignedIn)
 {
     <div class="text-center mt-5">
-        You’re not signed in. <button class="btn btn-success" @onclick="() => NavigateToSignIn()">Go to Sign In</button>
+        You’re not signed in.
+        <button class="btn btn-success" @onclick="NavigateToSignIn">Go to Sign In</button>
     </div>
 }
 else
 {
     <div class="container mt-4">
-        @if (Auth.UserRole == "Admin")
+        @if (_role == "Admin")
         {
             <AdminView />
         }
-        else if (Auth.UserRole == "Manager")
+        else if (_role == "Manager")
         {
             <ManagerView />
         }
@@ -40,19 +42,17 @@ else
 
         <div class="card mt-4">
             <div class="card-body">
-                <h5 class="card-title">
-                    Weekly Report Analysis
-                </h5>
+                <h5 class="card-title">Weekly Report Analysis</h5>
 
                 @if (_aiLoading)
                 {
-                    <div> Loading analysis from Gemini...</div>
+                    <div>Loading analysis from Gemini...</div>
                 }
                 else if (_aiAnalysisObj == null)
                 {
-                    <div class="text-muted"> No analysis available.</div>
+                    <div class="text-muted">No analysis available.</div>
                 }
-                else 
+                else
                 {
                     <div class="row g-3">
                         <div class="col-md-4">
@@ -136,43 +136,51 @@ else
                 }
             </div>
         </div>
-
     </div>
 }
 
 @code {
     private bool _ready;
+    private bool _isSignedIn;
+    private string? _role;
+
     private bool _aiLoading;
     private string? _aiAnalysis;
     private AIAnalysisResultDTO? _aiAnalysisObj;
-    private bool _aiLoadedOnce = false;
+    private bool _aiLoadedOnce;
+
+    protected override async Task OnInitializedAsync()
+    {
+        var ctx = await UserCtx.GetAsync();
+        _isSignedIn = ctx.User?.Id != null;
+        _role = ctx.User?.Role;
+
+        _ready = true;
+    }
 
     protected override async Task OnAfterRenderAsync(bool firstRender)
     {
         if (!firstRender) return;
-        await Auth.EnsureHydratedAsync(); // safe here (interactive)
-        _ready = true;
-        StateHasChanged();
 
-        if (!_aiLoadedOnce && Auth.IsSignedIn)
+        if (_isSignedIn && !_aiLoadedOnce)
         {
             _aiLoadedOnce = true;
             _aiLoading = true;
             StateHasChanged();
 
-            // Get analysis:
-
-            try
-            {
-                var csvPath = Path.Combine(Env.ContentRootPath, "AIDashboard", "Services", "Reporting", "test_data.csv");
-                _aiAnalysis = await ReportingService.AnalyzeCsvAsync(csvPath);
-                
-                // Try to deserialize the returned JSON into the DTO so we can render structured cards UI.
-                if (!string.IsNullOrWhiteSpace(_aiAnalysis))
+            try{
+               if (!string.IsNullOrWhiteSpace(_aiAnalysis))
                 {
-                    var options = new System.Text.Json.JsonSerializerOptions { PropertyNameCaseInsensitive = true };
-                    _aiAnalysisObj = System.Text.Json.JsonSerializer.Deserialize<AIAnalysisResultDTO>(_aiAnalysis, options);
-                }
+                    var csvPath = Path.Combine(Env.ContentRootPath, "AIDashboard", "Services", "Reporting", "test_data.csv");
+                    _aiAnalysis = await ReportingService.AnalyzeCsvAsync(csvPath);
+                    
+                    // Try to deserialize the returned JSON into the DTO so we can render structured cards UI.
+                    if (!string.IsNullOrWhiteSpace(_aiAnalysis))
+                    {
+                        var options = new System.Text.Json.JsonSerializerOptions { PropertyNameCaseInsensitive = true };
+                        _aiAnalysisObj = System.Text.Json.JsonSerializer.Deserialize<AIAnalysisResultDTO>(_aiAnalysis, options);
+                    }
+                } 
             }
             catch(Exception e)
             {
@@ -185,12 +193,14 @@ else
                 _aiLoading = false;
                 StateHasChanged();
             }
+            _aiLoading = false;
+            //_aiAnalysisObj = null;          //  Uncoomment above and delete curent like to activate AI
+            StateHasChanged();
         }
-
     }
 
     private void NavigateToSignIn()
     {
-        Nav.NavigateTo("/signin");
+        Nav.NavigateTo("/login", forceLoad: true);
     }
-}
\ No newline at end of file
+}
diff --git a/CulinaryCommandApp/Components/Pages/EmployeeView.razor b/CulinaryCommandApp/Components/Pages/EmployeeView.razor
index b066f23..4de9701 100644
--- a/CulinaryCommandApp/Components/Pages/EmployeeView.razor
+++ b/CulinaryCommandApp/Components/Pages/EmployeeView.razor
@@ -2,17 +2,16 @@
 @implements IDisposable
 <div class="employee-dashboard">
     <h2 class="mb-4 text-warning">Employee Dashboard</h2>
-    <p>Welcome, @(Auth.CurrentUser?.Name ?? "User")!</p>
+    <p>Welcome, </p>
 
     <ul>
         <li>View your active tasks and prep items</li>
-        <li>Check your assigned location: @(LocationState.CurrentLocation?.Name ?? "Not assigned")</li>
+        <li>Check your assigned location: </li>
         <li>Submit updates to your manager</li>
     </ul>
 </div>
 
 @code {
-    [Inject] private CulinaryCommand.Services.AuthService Auth { get; set; } = default!;
     [Inject] private CulinaryCommand.Services.LocationState LocationState { get; set; } = default!;
 
     private async void HandleLocationStateChanged()
diff --git a/CulinaryCommandApp/Components/Pages/Home.razor.css b/CulinaryCommandApp/Components/Pages/Home.Tworazor.css
similarity index 100%
rename from CulinaryCommandApp/Components/Pages/Home.razor.css
rename to CulinaryCommandApp/Components/Pages/Home.Tworazor.css
diff --git a/CulinaryCommandApp/Components/Pages/Home.razor b/CulinaryCommandApp/Components/Pages/HomeTwo.razor
similarity index 99%
rename from CulinaryCommandApp/Components/Pages/Home.razor
rename to CulinaryCommandApp/Components/Pages/HomeTwo.razor
index cdaa3c7..5c964bd 100644
--- a/CulinaryCommandApp/Components/Pages/Home.razor
+++ b/CulinaryCommandApp/Components/Pages/HomeTwo.razor
@@ -1,7 +1,6 @@
-﻿@page "/"
+﻿@* @page "/"
 @namespace CulinaryCommand.Components.Pages
 @inject NavigationManager Nav
-@inject AuthService Auth
 
 <PageTitle>Culinary Command - Restaurant Command Center</PageTitle>
 
@@ -187,4 +186,4 @@
 
         showLanding = true;
     }
-}
+} *@
diff --git a/CulinaryCommandApp/Components/Pages/InviteSignUp.razor b/CulinaryCommandApp/Components/Pages/InviteSignUp.razor
new file mode 100644
index 0000000..9b986d6
--- /dev/null
+++ b/CulinaryCommandApp/Components/Pages/InviteSignUp.razor
@@ -0,0 +1,199 @@
+@rendermode InteractiveServer
+
+@using CulinaryCommand.Models
+@using CulinaryCommand.Services.UserContextSpace
+
+
+@inject IUserService UserService
+@inject IUserContextService UserCtx
+
+<div class="cc-invite-wrap">
+
+    <h5 class="cc-invite-title">Invite a User</h5>
+    <p class="cc-invite-subtitle">Send an invite link so they can set their password and sign in.</p>
+
+    @if (!hydrated)
+    {
+        <div class="cc-muted">Loading...</div>
+    }
+    else if (!_allowed)
+    {
+        <div class="alert alert-warning mb-0">
+            You do not have permission to invite users for this location.
+        </div>
+    }
+    else if (invalid)
+    {
+        <div class="alert alert-danger">
+            Something went wrong. Please check the form and try again.
+        </div>
+    }
+    else if (success)
+    {
+        <div class="alert alert-success">
+            Invite sent! They can use the invite link to set a password and sign in.
+        </div>
+
+        <div class="d-flex gap-2">
+            <button type="button" class="btn btn-success" @onclick="Close">Done</button>
+            <button type="button" class="btn btn-outline-secondary" @onclick="InviteAnother">Invite Another</button>
+        </div>
+    }
+    else
+    {
+        <EditForm Model="@Model" OnValidSubmit="Invite">
+            <DataAnnotationsValidator />
+            <ValidationSummary />
+
+            <div class="row mb-3">
+                <div class="col-md-6">
+                    <label class="form-label">First Name</label>
+                    <InputText class="form-control" @bind-Value="Model.FirstName" />
+                </div>
+                <div class="col-md-6">
+                    <label class="form-label">Last Name</label>
+                    <InputText class="form-control" @bind-Value="Model.LastName" />
+                </div>
+            </div>
+
+            <div class="mb-3">
+                <label class="form-label">Email</label>
+                <InputText class="form-control" @bind-Value="Model.Email" />
+            </div>
+
+            <div class="mb-3">
+                <label class="form-label">Role</label>
+                <InputSelect class="form-select" @bind-Value="Model.Role">
+                    <option value="">Select role</option>
+                    <option value="Employee">Employee</option>
+                    <option value="Manager">Manager</option>
+                </InputSelect>
+            </div>
+
+            <div class="d-flex gap-2">
+                <button type="submit" class="btn btn-success" disabled="@submitting">
+                    @(submitting ? "Sending..." : "Send Invite")
+                </button>
+
+                <button type="button" class="btn btn-outline-secondary" @onclick="Close" disabled="@submitting">
+                    Cancel
+                </button>
+            </div>
+        </EditForm>
+    }
+
+</div>
+
+@code {
+    [Parameter] public int LocationId { get; set; }
+    [Parameter] public EventCallback OnClose { get; set; }
+    [Parameter] public EventCallback OnInvited { get; set; }
+
+    private CreateUserForLocationRequest Model = new();
+
+    private bool hydrated = false;
+    private bool _allowed = false;
+
+    private bool invalid = false;
+    private bool success = false;
+    private bool submitting = false;
+
+    private UserContext? _ctx;
+
+    protected override async Task OnInitializedAsync()
+    {
+        _ctx = await UserCtx.GetAsync();
+
+        if (_ctx?.IsAuthenticated != true || _ctx.User is null)
+        {
+            await OnClose.InvokeAsync();
+            return;
+        }
+
+        _allowed =
+            string.Equals(_ctx.User.Role, "Admin", StringComparison.OrdinalIgnoreCase) ||
+            string.Equals(_ctx.User.Role, "Manager", StringComparison.OrdinalIgnoreCase);
+
+        Model.LocationId = LocationId;
+
+        hydrated = true;
+    }
+
+    private async Task Invite()
+    {
+        invalid = false;
+
+        if (!_allowed || _ctx?.User is null) { invalid = true; return; }
+        if (_ctx.User.CompanyId is null) { invalid = true; return; }
+        if (submitting) return;
+
+        submitting = true;
+
+        try
+        {
+            var newUser = await UserService.CreateInvitedUserForLocationAsync(
+                Model,
+                _ctx.User.CompanyId.Value,
+                _ctx.User.Id
+            );
+
+            await UserService.SendInviteEmailAsync(newUser);
+
+            success = true;
+            await OnInvited.InvokeAsync();
+        }
+        catch
+        {
+            invalid = true;
+        }
+        finally
+        {
+            submitting = false;
+        }
+    }
+
+    private async Task Close()
+    {
+        await OnClose.InvokeAsync();
+    }
+
+    private void InviteAnother()
+    {
+        Model = new CreateUserForLocationRequest
+        {
+            LocationId = LocationId
+        };
+
+        invalid = false;
+        success = false;
+        submitting = false;
+    }
+}
+
+<style>
+    .cc-invite-wrap{
+        border-radius: 16px;
+        border: 1px solid rgba(17,24,39,.08);
+        background: #fff;
+        padding: 16px;
+        box-shadow: 0 8px 20px rgba(17,24,39,.05);
+    }
+
+    .cc-invite-title{
+        font-weight: 850;
+        margin-bottom: 2px;
+        color: #111827;
+        letter-spacing: -0.2px;
+    }
+
+    .cc-invite-subtitle{
+        color: #6b7280;
+        font-size: 13px;
+        margin-bottom: 12px;
+    }
+
+    .cc-muted{
+        color: #6b7280;
+        font-size: 13px;
+    }
+</style>
diff --git a/CulinaryCommandApp/Components/Pages/ManagerView.razor b/CulinaryCommandApp/Components/Pages/ManagerView.razor
index b9f6768..00211f3 100644
--- a/CulinaryCommandApp/Components/Pages/ManagerView.razor
+++ b/CulinaryCommandApp/Components/Pages/ManagerView.razor
@@ -1,19 +1,34 @@
+@page "/manager"
 @rendermode InteractiveServer
-@inject IJSRuntime JS
-@inject ILocationService LocationService
-@inject LocationState LocationState
-@inject AuthService Auth
+
 @using CulinaryCommand.Data.Entities
+@using CulinaryCommand.Services.UserContextSpace
+
+
+@inject NavigationManager Nav
+@inject IUserContextService UserCtx
+@inject LocationState LocationState
 
 <div class="manager-dashboard">
     <h2 class="mb-4 text-primary">Manager Dashboard</h2>
-    @if (LocationState.CurrentLocation is null)
+
+    @if (!_ready)
+    {
+        <div class="text-center mt-5">Loading...</div>
+    }
+    else if (!_allowed)
+    {
+        <div class="alert alert-warning mt-4">
+            You need manager or admin permissions to view this page.
+        </div>
+    }
+    else if (LocationState.CurrentLocation is null)
     {
         <p>You have no locations. Add a location in settings.</p>
     }
     else
     {
-        <p>Welcome, Manager of @LocationState.CurrentLocation.Name (@Auth.CompanyCode)</p>
+        <p>Welcome, Manager of @LocationState.CurrentLocation.Name (@companyCode)</p>
         <ul>
             <li>View and assign employee tasks</li>
             <li>Review daily summaries for your location</li>
@@ -24,19 +39,19 @@
             <div class="row g-5">
                 <div class="col-12 col-md-6">
                     <DashboardCard Title="Prep Items Needing Attention" Value="5 items" Color="#ffc107"
-                        IconClass="bi bi-exclamation-triangle" Link="/prep" />
+                                   IconClass="bi bi-exclamation-triangle" Link="/prep" />
                     <DashboardCard Title="Orders Pending Approval" Value="3 orders" Color="#688f72"
-                        IconClass="bi bi-file-earmark-check" Link="/orders" />
-                    <DashboardCard Title="Daily Summaries / Reports" Value="1" Color="#883ae1" IconClass="bi bi-file-text"
-                        Link="/reports" />
+                                   IconClass="bi bi-file-earmark-check" Link="/orders" />
+                    <DashboardCard Title="Daily Summaries / Reports" Value="1" Color="#883ae1"
+                                   IconClass="bi bi-file-text" Link="/reports" />
                 </div>
                 <div class="col-12 col-md-6">
-                    <DashboardCard Title="Active Tasks by Employee" Value="6 tasks" Color="#3662e3" IconClass="bi bi-people"
-                        Link="/tasks" />
-                    <DashboardCard Title="Low Stock Ingredients" Value="2" Color="#ca3a31" IconClass="bi bi-box-seam"
-                        Link="/inventory-management" />
-                    <DashboardCard Title="Manage Employees" Value="35" Color="#e28743" IconClass="bi bi-person-gear"
-                        Link="/employees" />
+                    <DashboardCard Title="Active Tasks by Employee" Value="6 tasks" Color="#3662e3"
+                                   IconClass="bi bi-people" Link="/assign-tasks" />
+                    <DashboardCard Title="Low Stock Ingredients" Value="2" Color="#ca3a31"
+                                   IconClass="bi bi-box-seam" Link="/inventory-management" />
+                    <DashboardCard Title="Manage Employees" Value="35" Color="#e28743"
+                                   IconClass="bi bi-person-gear" Link="/employees" />
                 </div>
             </div>
 
@@ -45,12 +60,12 @@
                     <div class="card shadow-sm d-flex flex-column py-3 px-4 mb-5">
                         <p class="fs-5 fw-semibold mb-3">Recent Activity</p>
                         <div class="activity-list">
-                            <ActivityCard Title="Sarah assigned 3 new prep tasks to kitchen staff" TimeInfo="10 minutes ago"
-                                IconClass="bi bi-people" />
-                            <ActivityCard Title="New order #1234 received from Table 7" TimeInfo="35 minutes ago"
-                                IconClass="bi bi-file-earmark-check" />
-                            <ActivityCard Title="Inventory alert: Tomatoes below threshold" TimeInfo="1 hour ago"
-                                IconClass="bi bi-box-seam" />
+                            <ActivityCard Title="Sarah assigned 3 new prep tasks to kitchen staff"
+                                          TimeInfo="10 minutes ago" IconClass="bi bi-people" />
+                            <ActivityCard Title="New order #1234 received from Table 7"
+                                          TimeInfo="35 minutes ago" IconClass="bi bi-file-earmark-check" />
+                            <ActivityCard Title="Inventory alert: Tomatoes below threshold"
+                                          TimeInfo="1 hour ago" IconClass="bi bi-box-seam" />
                         </div>
                     </div>
                 </div>
@@ -59,60 +74,38 @@
     }
 </div>
 
-
 @code {
-    private bool _initializedFromJS = false;
-
-    protected override async Task OnAfterRenderAsync(bool firstRender)
-    {
-        if (firstRender)
-        {
-            //hydrate from localStorage IMMEDIATELY
-            await LoadLocationFromLocalStorage();
+    private bool _ready;
+    private bool _allowed;
+    private string companyCode = "";
 
-            //background refresh to sync/validate with server
-            _ = RefreshLocationFromServer();
-        }
-    }
-
-    private async Task LoadLocationFromLocalStorage()
+    protected override async Task OnInitializedAsync()
     {
-        string? idStr = await JS.InvokeAsync<string?>("localStorage.getItem", "cc_activeLocationId");
+        var ctx = await UserCtx.GetAsync();
 
-        if (int.TryParse(idStr, out int id) && id > 0)
-        {
-            Location? cached = await LocationService.GetLocationByIdAsync(id);
-            await LocationState.SetCurrentLocationAsync(cached);
-        }
-        else
+        if (!ctx.IsAuthenticated)
         {
-            await LocationState.SetCurrentLocationAsync(null);
+            Nav.NavigateTo("/login", true);
+            return;
         }
 
-        _initializedFromJS = true;
-        StateHasChanged(); // re-render after local hydration
-    }
-
-    private async Task RefreshLocationFromServer()
-    {
-        if (LocationState.CurrentLocation == null)
+        if (ctx.User is null)
+        {
+            Nav.NavigateTo("/no-access", true);
             return;
+        }
 
-        int id = LocationState.CurrentLocation.Id;
+        _allowed =
+            string.Equals(ctx.User.Role, "Admin", StringComparison.OrdinalIgnoreCase) ||
+            string.Equals(ctx.User.Role, "Manager", StringComparison.OrdinalIgnoreCase);
 
-        var fresh = await LocationService.GetLocationByIdAsync(id);
+        // CompanyCode lives on Company
+        companyCode = ctx.User.Company?.CompanyCode ?? "";
 
-        if (fresh != null)
-        {
-            await LocationState.SetCurrentLocationAsync(fresh);
-        }
-        else
-        {
-            // Location removed or permission revoked
-            await JS.InvokeVoidAsync("localStorage.removeItem", "cc_activeLocationId");
-            await LocationState.SetCurrentLocationAsync(null!);
-        }
+        // Ensure LocationState is hydrated if this page is hit directly
+        if (LocationState.ManagedLocations.Count == 0 && ctx.AccessibleLocations.Any())
+            await LocationState.SetLocationsAsync(ctx.AccessibleLocations);
 
-        StateHasChanged();
+        _ready = true;
     }
-}
\ No newline at end of file
+}
diff --git a/CulinaryCommandApp/Components/Pages/OnBoarding.razor b/CulinaryCommandApp/Components/Pages/OnBoarding.razor
new file mode 100644
index 0000000..4a6e565
--- /dev/null
+++ b/CulinaryCommandApp/Components/Pages/OnBoarding.razor
@@ -0,0 +1,8 @@
+@page "/onboarding"
+@namespace CulinaryCommand.Components.Pages
+@layout CulinaryCommand.Components.Layout.PublicLayout
+@rendermode InteractiveServer
+
+<h2>Onboarding</h2>
+<p>You’re signed in, but you don’t have any locations assigned yet.</p>
+<a class="btn btn-outline-danger" href="/logout">Log out</a>
diff --git a/CulinaryCommandApp/Components/Pages/PostLogin.razor b/CulinaryCommandApp/Components/Pages/PostLogin.razor
new file mode 100644
index 0000000..4d58b50
--- /dev/null
+++ b/CulinaryCommandApp/Components/Pages/PostLogin.razor
@@ -0,0 +1,79 @@
+@page "/post-login"
+@namespace CulinaryCommand.Components.Pages
+@layout CulinaryCommand.Components.Layout.PublicLayout
+@rendermode InteractiveServer
+
+@using CulinaryCommand.Services.UserContextSpace
+@using CulinaryCommand.Data.Entities
+
+@inject NavigationManager Nav
+@inject IUserContextService UserContext
+@inject CulinaryCommand.Services.LocationState LocationState
+
+<h3 style="text-align:center; margin-top:2rem;">Signing you in…</h3>
+<p style="text-align:center; color: rgba(0,0,0,.65);">@status</p>
+
+@if (!string.IsNullOrWhiteSpace(error))
+{
+    <div class="container mt-4">
+        <div class="alert alert-danger">
+            <strong>Post-login failed:</strong><br />
+            @error
+        </div>
+    </div>
+}
+
+@code {
+    private bool _ran;
+    private string status = "Initializing…";
+    private string? error;
+
+    protected override async Task OnAfterRenderAsync(bool firstRender)
+    {
+        if (!firstRender || _ran) return;
+        _ran = true;
+
+        try
+        {
+            status = "Loading user context…";
+            StateHasChanged();
+
+            var ctx = await UserContext.RefreshAsync();
+
+            if (!ctx.IsAuthenticated)
+            {
+                status = "Not authenticated. Redirecting…";
+                StateHasChanged();
+                Nav.NavigateTo("/", replace: true);   // NO forceLoad
+                return;
+            }
+
+            if (ctx.User is null)
+            {
+                status = "No local user found (invite-only). Redirecting…";
+                StateHasChanged();
+                Nav.NavigateTo("/no-access", replace: true);
+                return;
+            }
+
+            status = "Loading locations…";
+            StateHasChanged();
+
+            // JS-safe now (we're in OnAfterRender)
+            await LocationState.SetLocationsAsync(ctx.AccessibleLocations);
+
+            var target = (ctx.AccessibleLocations?.Any() == true) ? "/dashboard" : "/onboarding";
+
+            status = $"Redirecting to {target}…";
+            StateHasChanged();
+
+            Nav.NavigateTo(target, replace: true);   // NO forceLoad
+        }
+        catch (Exception ex)
+        {
+            error = ex.ToString();
+            status = "Error occurred.";
+            StateHasChanged();
+        }
+    }
+}
diff --git a/CulinaryCommandApp/Components/Pages/Recipes/RecipeList.razor b/CulinaryCommandApp/Components/Pages/Recipes/RecipeList.razor
index 88fa57d..4705381 100644
--- a/CulinaryCommandApp/Components/Pages/Recipes/RecipeList.razor
+++ b/CulinaryCommandApp/Components/Pages/Recipes/RecipeList.razor
@@ -1,10 +1,16 @@
+@* @page "/recipes" *@
+@rendermode InteractiveServer
+@implements IDisposable
+
 @using CulinaryCommand.Data.Entities
+@using CulinaryCommand.Services
+@using CulinaryCommand.Services.UserContextSpace
+
 @inject NavigationManager Nav
 @inject IJSRuntime Js
 @inject RecipeService Recipes
-@inject AuthService Auth
 @inject LocationState LocationState
-@rendermode InteractiveServer
+@inject IUserContextService UserCtx
 
 <h3 class="mb-3">Recipes</h3>
 
@@ -60,41 +66,46 @@ else
 }
 
 @code {
+    private UserContext? _ctx;
+
     private List<Recipe>? recipes;
     private bool priv = false;
 
     protected override async Task OnInitializedAsync()
     {
-        LocationState.OnChange += RefreshRecipes;
-        Auth.OnAuthStateChanged += AuthChanged;
-
-        await Auth.EnsureHydratedAsync();
+        _ctx = await UserCtx.GetAsync();
 
-        UpdatePriv();
-        await LoadRecipesAsync();
-    }
+        // If not authenticated, bounce to Cognito login
+        if (_ctx.IsAuthenticated != true)
+        {
+            Nav.NavigateTo("/login", true);
+            return;
+        }
 
-    @* protected override async Task OnAfterRenderAsync(bool firstRender)
-    {
-        if (firstRender)
+        // Invite-only: authenticated but not in DB
+        if (_ctx.User is null)
         {
-            await Auth.EnsureHydratedAsync();
-            UpdatePriv();
-            await LoadRecipesAsync();
-            StateHasChanged();
+            Nav.NavigateTo("/no-access", true);
+            return;
         }
-    } *@
 
-    private void UpdatePriv()
-    {
-        var role = Auth.CurrentUser?.Role;
-        priv = role is "Manager" or "Admin";
+        // Ensure LocationState is hydrated if user deep-links here
+        if (LocationState.ManagedLocations.Count == 0 && _ctx.AccessibleLocations.Any())
+            await LocationState.SetLocationsAsync(_ctx.AccessibleLocations);
+
+        UpdatePriv();
+
+        LocationState.OnChange += RefreshRecipes;
+
+        await LoadRecipesAsync();
     }
 
-    private void AuthChanged()
+    private void UpdatePriv()
     {
-        UpdatePriv();
-        _ = InvokeAsync(StateHasChanged);
+        var role = _ctx?.User?.Role;
+        priv =
+            string.Equals(role, "Manager", StringComparison.OrdinalIgnoreCase) ||
+            string.Equals(role, "Admin", StringComparison.OrdinalIgnoreCase);
     }
 
     private async Task LoadRecipesAsync()
@@ -129,6 +140,7 @@ else
         {
             await Recipes.DeleteAsync(id);
             await LoadRecipesAsync();
+            await InvokeAsync(StateHasChanged);
         }
     }
 
@@ -151,7 +163,5 @@ else
     public void Dispose()
     {
         LocationState.OnChange -= RefreshRecipes;
-        Auth.OnAuthStateChanged -= AuthChanged;
     }
 }
-
diff --git a/CulinaryCommandApp/Components/Pages/SignIn.razor b/CulinaryCommandApp/Components/Pages/SignIn.razor
index 6cf92c8..a060d29 100644
--- a/CulinaryCommandApp/Components/Pages/SignIn.razor
+++ b/CulinaryCommandApp/Components/Pages/SignIn.razor
@@ -1,137 +1,8 @@
 @page "/signin"
-@namespace CulinaryCommand.Components.Pages
-@inject IUserService UserService
-@inject ILocationService LocationService
-@inject LocationState LocationState
-@inject AuthService Auth
 @inject NavigationManager Nav
-@using CulinaryCommand.Data.Enums
-@using CulinaryCommand.Data.Entities
-@using Microsoft.AspNetCore.Components.Forms
 @rendermode InteractiveServer
 
-
-<PageTitle>Sign In - Culinary Command</PageTitle>
-
-<div class="signin-container">
-    <div class="signin-card">
-        <div class="text-center mb-4">
-            <h1 class="app-title">Culinary Command</h1>
-            <p class="subtitle">Sign In To Your Account</p>
-        </div>
-
-        <EditForm Model="@signInModel" OnValidSubmit="@HandleSubmit" FormName="SignInForm">
-        <DataAnnotationsValidator />
-        <ValidationSummary />
-
-            <!-- Selecting your role (Manager or Cook) -->
-            <!-- Radio only allows one selection at a time (manager or cook)-->
-            <div class="role-selection mb-4">
-                <div class="btn-group w-100" role="group">
-                    <input type="radio" class="btn-check" name="role" id="manager" value="Manager" @onchange="@((e) => signInModel.Role = e.Value?.ToString())" checked="@(signInModel.Role == "Manager")">
-                    <label class="btn btn-outline-success role-btn" for="manager">
-                    <i class="fas fa-building me-2"></i>Manager
-                    </label>
-
-                    <input type="radio" class="btn-check" name="role" id="cook" value="Cook" @onchange="@((e) => signInModel.Role = e.Value?.ToString())" checked="@(signInModel.Role == "Cook")">
-                    <label class="btn btn-outline-success role-btn" for="cook">
-                    <i class="fas fa-building me-2"></i>Cook
-                    </label>
-                </div>
-            </div>
-            <!-- Email -->
-            <div class="mb-3">
-                <label for="username" class="form-label">Email</label>
-                <InputText id="username" type="text" class="form-control" @bind-Value="signInModel.Email" placeholder="Enter your email" />
-            </div>
-
-            <!-- Password -->
-            <div class="mb-3">
-                <label for="password" class="form-label">Password</label>
-                <div class="password-input-container">
-                    <InputText id="password" type="@(showPassword ? "text" : "password")" class="form-control" @bind-Value="signInModel.Password" placeholder="Enter your password" />
-                    <button type="button" class="password-toggle-btn" @onclick="TogglePasswordVisibility">
-                        <i class="fas @(showPassword ? "fa-eye-slash" : "fa-eye")"></i>
-                    </button>
-                </div>
-            </div>
-
-            <!-- Remember Me and Forget Password buttons -->
-            <div class="d-flex justify-content-between align-items-center mb-4">
-                <div class="form-check">
-                    <InputCheckbox id="remember" class="form-check-input" @bind-Value="signInModel.RememberMe" />
-                    <label class="form-check-label" for="remember">
-                        Remember me
-                    </label>
-                </div>
-                <a href="/forgot-password" class="forgot-password-link">Forgot your password?</a>
-            </div>
-
-            <!-- Sign In button -->
-            <button type="submit" class="btn btn-success w-100 signin-btn">Sign in</button>
-        </EditForm>
-
-        <!-- Sign Up Link -->
-        <div class="text-center mt-4">
-            <span class="text-muted">Don't have an account? </span>
-            <a href="/signup" class="signup-link">Sign up</a>
-        </div>
-
-        <!-- Admin Sign Up Link -->
-        <div class="text-center mt-3">
-            <span class="text-muted">Adding a new restaurant? </span>
-            <a href="/adminsignup" class="signup-link">Create Restaurant</a>
-        </div>
-    </div>
-</div>
-
 @code {
-    private SignInModel signInModel;
-    private bool showPassword = false;
-
-    protected override void OnInitialized()
-    {
-        if (signInModel == null)
-        signInModel = new() { Role = Roles.Manager.ToString() }; // Default to manager
-        if (Auth.IsSignedIn)
-        {
-            Nav.NavigateTo("/dashboard");
-        }
-    }
-
-    private async Task HandleSubmit() 
-    {
-        Console.WriteLine($"Role: {signInModel.Role}");
-        Console.WriteLine($"Email: {signInModel.Email}");
-        Console.WriteLine($"Password: {signInModel.Password}");
-        Console.WriteLine($"Remember Me: {signInModel.RememberMe}");
-        User? user = await UserService.ValidateCredentialsAsync(signInModel.Email, signInModel.Password);
-        if (user != null)
-        {
-            var userLocations = await LocationService.GetLocationsByManagerAsync(user.Id);
-            await LocationState.SetLocationsAsync(userLocations);
-            await Auth.SignInAsync(user);
-            await LocationService.LoadAndPersistLocationsAsync(user.Id);
-            Nav.NavigateTo("/dashboard");
-        }
-
-        else
-        {
-            Console.WriteLine(value: $"NOT VALID");
-        }
-
-    }
-
-    private void TogglePasswordVisibility()
-    {
-        showPassword = !showPassword;
-    }
-
-    private class SignInModel 
-    {
-        public string Role { get; set; } 
-        public string Email { get; set; }
-        public string Password { get; set; }
-        public bool RememberMe { get; set; } = false;
-    }
-}
\ No newline at end of file
+  protected override void OnInitialized()
+    => Nav.NavigateTo("/login", forceLoad: true);
+}
diff --git a/CulinaryCommandApp/Components/Pages/UserSettings/AccountSetup.razor b/CulinaryCommandApp/Components/Pages/UserSettings/AccountSetup.razor
index d0ba556..a3e3e01 100644
--- a/CulinaryCommandApp/Components/Pages/UserSettings/AccountSetup.razor
+++ b/CulinaryCommandApp/Components/Pages/UserSettings/AccountSetup.razor
@@ -1,12 +1,14 @@
 @page "/account/setup"
+@rendermode InteractiveServer
+
 @using CulinaryCommand.Data.Entities
 @using Microsoft.AspNetCore.WebUtilities
+
 @inject NavigationManager Nav
 @inject IUserService UserService
-@inject AuthService Auth
 @inject ILocationService locationService
 
-<h3>Set Your Password</h3>
+<h3>Activate Your Account</h3>
 
 @if (invalid)
 {
@@ -15,25 +17,27 @@
 else if (success)
 {
     <div class="alert alert-success">
-        Your account is now active! <a href="/signin">Sign In</a>
+        Your account is now active! <a href="/login">Continue to Sign In</a>
     </div>
 }
 else
 {
     <EditForm Model="@model" OnValidSubmit="Submit">
-        <DataAnnotationsValidator/>
+        <DataAnnotationsValidator />
 
         <div class="mb-3">
             <label class="form-label">New Password</label>
-            <InputText class="form-control" @bind-Value="model.Password" type="password"/>
+            <InputText class="form-control" @bind-Value="model.Password" type="password" />
         </div>
 
         <div class="mb-3">
             <label class="form-label">Confirm Password</label>
-            <InputText class="form-control" @bind-Value="model.ConfirmPassword" type="password"/>
+            <InputText class="form-control" @bind-Value="model.ConfirmPassword" type="password" />
         </div>
 
-        <button class="btn btn-success">Activate Account</button>
+        <button class="btn btn-success" disabled="@submitting">
+            @(submitting ? "Activating..." : "Activate Account")
+        </button>
     </EditForm>
 }
 
@@ -41,54 +45,74 @@ else
     private string? token;
     private bool invalid = false;
     private bool success = false;
+    private bool submitting = false;
 
     private PasswordModel model = new();
-
     private User? invitedUser;
 
     protected override async Task OnInitializedAsync()
     {
         var uri = Nav.ToAbsoluteUri(Nav.Uri);
+
         if (QueryHelpers.ParseQuery(uri.Query).TryGetValue("token", out var t))
         {
             token = t!;
             invitedUser = await UserService.GetUserByInviteTokenAsync(token);
 
             if (invitedUser == null)
-            {
                 invalid = true;
-            }
         }
-        else invalid = true;
+        else
+        {
+            invalid = true;
+        }
     }
 
     private async Task Submit()
     {
-        if (model.Password != model.ConfirmPassword)
+        if (submitting) return;
+        submitting = true;
+
+        try
         {
-            invalid = true;
-            return;
-        }
+            if (string.IsNullOrWhiteSpace(token))
+            {
+                invalid = true;
+                return;
+            }
 
-        bool ok = await UserService.ActivateUserAsync(token!, model.Password);
+            if (string.IsNullOrWhiteSpace(model.Password) ||
+                model.Password != model.ConfirmPassword)
+            {
+                invalid = true;
+                return;
+            }
 
-        if (!ok)
-        {
-            invalid = true;
-            return;
-        }
+            // Activate in your DB (invite-only gate)
+            var ok = await UserService.ActivateUserAsync(token, model.Password);
+
+            if (!ok)
+            {
+                invalid = true;
+                return;
+            }
 
-        if (invitedUser != null){
-            // Auto-login after activation
-            User freshUser = await UserService.GetUserByEmailAsync(invitedUser.Email!);
-            await Auth.SignInAsync(freshUser);
+            // Optional: if you still need any server-side prep, keep it.
+            // But DO NOT attempt Auth.SignInAsync here (Cognito owns login now).
+            if (invitedUser != null)
+            {
+                // If this method is safe/needed, keep it; otherwise remove.
+                await locationService.LoadAndPersistLocationsAsync(invitedUser.Id);
+            }
 
-            await locationService.LoadAndPersistLocationsAsync(invitedUser.Id);
+            success = true;
 
-            Nav.NavigateTo("/");
+            // Send them into Cognito login. /post-login will hydrate user + locations.
+            Nav.NavigateTo("/login", true);
         }
-        else {
-            Nav.NavigateTo("/signIn", forceLoad: true);
+        finally
+        {
+            submitting = false;
         }
     }
 
@@ -97,4 +121,4 @@ else
         public string Password { get; set; } = "";
         public string ConfirmPassword { get; set; } = "";
     }
-}
\ No newline at end of file
+}
diff --git a/CulinaryCommandApp/Components/Pages/UserSettings/LocationSettings/InviteUserForm.razor b/CulinaryCommandApp/Components/Pages/UserSettings/LocationSettings/InviteUserForm.razor
index da13e7d..4577dc7 100644
--- a/CulinaryCommandApp/Components/Pages/UserSettings/LocationSettings/InviteUserForm.razor
+++ b/CulinaryCommandApp/Components/Pages/UserSettings/LocationSettings/InviteUserForm.razor
@@ -1,6 +1,8 @@
 @using CulinaryCommand.Models
+@using CulinaryCommand.Services.UserContextSpace
+
 @inject IUserService UserService
-@inject AuthService Auth
+@inject IUserContextService UserCtx
 
 <div class="card shadow-sm p-3 mb-4">
 
@@ -10,6 +12,12 @@
     {
         <p>Loading...</p>
     }
+    else if (!_allowed)
+    {
+        <div class="alert alert-warning mb-0">
+            You do not have permission to invite users for this location.
+        </div>
+    }
     else
     {
         <EditForm Model="@Model" OnValidSubmit="Invite">
@@ -41,8 +49,10 @@
                 </InputSelect>
             </div>
 
-            <button type="submit" class="btn btn-success">Send Invite</button>
-            <button type="button" class="btn btn-outline-secondary ms-2" @onclick="Close">Cancel</button>
+            <button type="submit" class="btn btn-success" disabled="@_sending">
+                @(_sending ? "Sending..." : "Send Invite")
+            </button>
+            <button type="button" class="btn btn-outline-secondary ms-2" @onclick="Close" disabled="@_sending">Cancel</button>
         </EditForm>
     }
 
@@ -56,41 +66,66 @@
     private CreateUserForLocationRequest Model = new();
     private bool hydrated = false;
 
-    protected override async Task OnAfterRenderAsync(bool firstRender)
-    {
-        if (!firstRender) return;
+    private UserContext? _ctx;
+    private bool _allowed;
+    private bool _sending;
 
-        // Wait for auth hydrate
-        await Auth.EnsureHydratedAsync();
+    protected override async Task OnInitializedAsync()
+    {
+        _ctx = await UserCtx.GetAsync();
 
-        if (!Auth.IsSignedIn)
+        if (_ctx.IsAuthenticated != true)
         {
             // Form shouldn't operate if user is not auth'd
             await OnClose.InvokeAsync();
             return;
         }
 
-        // Now set model
+        // invite-only: must exist in DB
+        if (_ctx.User is null)
+        {
+            await OnClose.InvokeAsync();
+            return;
+        }
+
+        // Allow Admin/Manager (match your existing patterns)
+        _allowed =
+            string.Equals(_ctx.User.Role, "Admin", StringComparison.OrdinalIgnoreCase) ||
+            string.Equals(_ctx.User.Role, "Manager", StringComparison.OrdinalIgnoreCase);
+
         Model.LocationId = LocationId;
 
         hydrated = true;
-        StateHasChanged();
     }
 
     private async Task Invite()
     {
-        // Auth is guaranteed hydrated now
-        var newUser = await UserService.CreateInvitedUserForLocationAsync(
-            Model,
-            Auth.CompanyId!.Value,
-            Auth.UserId!.Value
-        );
+        if (!_allowed || _ctx?.User is null) return;
+        if (_sending) return;
+
+        // Need company + inviter
+        if (_ctx.User.CompanyId is null)
+            return;
+
+        _sending = true;
+        try
+        {
+            var newUser = await UserService.CreateInvitedUserForLocationAsync(
+                Model,
+                _ctx.User.CompanyId.Value,
+                _ctx.User.Id
+            );
 
-        await UserService.SendInviteEmailAsync(newUser);
+            await UserService.SendInviteEmailAsync(newUser);
 
-        await OnInvited.InvokeAsync();
-        await OnClose.InvokeAsync();
+            await OnInvited.InvokeAsync();
+            await OnClose.InvokeAsync();
+        }
+        finally
+        {
+            _sending = false;
+        }
     }
 
     private async Task Close() => await OnClose.InvokeAsync();
-}
\ No newline at end of file
+}
diff --git a/CulinaryCommandApp/Components/Pages/UserSettings/LocationSettings/LocationEmployeeView.razor b/CulinaryCommandApp/Components/Pages/UserSettings/LocationSettings/LocationEmployeeView.razor
index 9538df1..9fd4e4c 100644
--- a/CulinaryCommandApp/Components/Pages/UserSettings/LocationSettings/LocationEmployeeView.razor
+++ b/CulinaryCommandApp/Components/Pages/UserSettings/LocationSettings/LocationEmployeeView.razor
@@ -1,22 +1,12 @@
+@rendermode InteractiveServer
 @using CulinaryCommand.Data.Entities
-@inject AuthService Auth
-
-@foreach (var loc in Locations)
-{
-    <div class="card shadow-sm p-3 mb-3">
-        <div class="d-flex justify-content-between">
-            <div>
-                <h5>@loc.Name</h5>
-                <p class="text-muted mb-1">@loc.Address</p>
-                <small>@loc.City, @loc.State @loc.ZipCode</small>
-            </div>
-        </div>
-    </div>
-}
+@using CulinaryCommand.Services.UserContextSpace
+
+@inject IUserContextService UserCtx
 
-@* <div class="card shadow-sm p-3">
+<div class="card shadow-sm p-3">
 
-    <h4>@Auth.Company</h4>
+    <h4>@(CompanyDisplay ?? "Company")</h4>
 
     @if (Location == null)
     {
@@ -29,8 +19,21 @@
         <p class="mb-1">@Location.City, @Location.State @Location.ZipCode</p>
     }
 
-</div> *@
+</div>
 
 @code {
-    [Parameter] public List<Location> Locations { get; set; } = new List<Location>();
-}
\ No newline at end of file
+    [Parameter] public Location? Location { get; set; }
+
+    private string? CompanyDisplay;
+
+    protected override async Task OnInitializedAsync()
+    {
+        var ctx = await UserCtx.GetAsync();
+
+        // Invite-only: ctx.User null means authenticated but not in DB
+        CompanyDisplay =
+            ctx.User?.Company?.Name
+            ?? ctx.User?.Company?.CompanyCode
+            ?? "Company";
+    }
+}
diff --git a/CulinaryCommandApp/Components/Pages/UserSettings/LocationSettings/LocationUserAdminView.razor b/CulinaryCommandApp/Components/Pages/UserSettings/LocationSettings/LocationUserAdminView.razor
index aa71e77..6f0663f 100644
--- a/CulinaryCommandApp/Components/Pages/UserSettings/LocationSettings/LocationUserAdminView.razor
+++ b/CulinaryCommandApp/Components/Pages/UserSettings/LocationSettings/LocationUserAdminView.razor
@@ -1,81 +1,95 @@
+@rendermode InteractiveServer
+
 @using CulinaryCommand.Models
 @using CulinaryCommand.Data.Entities
+@using CulinaryCommand.Services.UserContextSpace
+
 @inject IUserService UserService
 @inject ILocationService LocationService
-@inject AuthService Auth
+@inject IUserContextService UserCtx
 @inject NavigationManager Nav
 
 <div class="location-user-admin">
 
     <h4 class="mb-3">Users Assigned to This Location</h4>
 
-    <button class="btn btn-success mb-3" @onclick="ShowInviteForm">
-        <i class="bi bi-person-plus me-2"></i>Invite User
-    </button>
-
-    <button class="btn btn-outline-primary mb-3 ms-2" @onclick="ShowAddExistingForm">
-        <i class="bi bi-person-check me-2"></i>Add Existing User
-    </button>
-
-    @if (showInvite)
+    @if (!_ready)
     {
-        <InviteUserForm 
-            LocationId="LocationId"
-            OnClose="HideInviteForm"
-            OnInvited="ReloadUsers" />
+        <div>Loading...</div>
     }
-
-    @if (showAddExisting)
+    else if (!_allowed)
     {
-        <div class="card card-body mb-3">
-            <label class="form-label fw-semibold">Select Existing User</label>
-
-            <select class="form-select" @bind="selectedUserId">
-                <option value="">-- Select User --</option>
-                @foreach (var u in AvailableUsers)
-                {
-                    <option value="@u.Id">@u.Name (@u.Email)</option>
-                }
-            </select>
-
-            <div class="mt-3 d-flex gap-2">
-                <button class="btn btn-success" @onclick="AddExistingUser"
-                        disabled="@(!CanAddExisting)">
-                    Add to Location
-                </button>
-
-                <button class="btn btn-outline-secondary" @onclick="HideAddExistingForm">
-                    Cancel
-                </button>
-            </div>
+        <div class="alert alert-warning">
+            You do not have permission to manage users for this location.
         </div>
     }
-
-    @if (Users.Count == 0)
-    {
-        <div class="alert alert-info">No users assigned to this location yet.</div>
-    }
     else
     {
-        <table class="table table-striped">
-            <thead>
-                <tr>
-                    <th>Name</th>
-                    <th>Email</th>
-                    <th>Role</th>
-                    <th style="width: 150px;"></th>
-                </tr>
-            </thead>
-            <tbody>
-                @foreach (var user in Users)
-                {
-                    <tr>
-                        <td>@user.Name</td>
-                        <td>@user.Email</td>
-                        <td>@user.Role</td>
-                        <td class="text-end">
+        <button class="btn btn-success mb-3" @onclick="ShowInviteForm">
+            <i class="bi bi-person-plus me-2"></i>Invite User
+        </button>
+
+        <button class="btn btn-outline-primary mb-3 ms-2" @onclick="ShowAddExistingForm">
+            <i class="bi bi-person-check me-2"></i>Add Existing User
+        </button>
+
+        @if (showInvite)
+        {
+            <InviteUserForm
+                LocationId="LocationId"
+                OnClose="HideInviteForm"
+                OnInvited="ReloadUsers" />
+        }
+
+        @if (showAddExisting)
+        {
+            <div class="card card-body mb-3">
+                <label class="form-label fw-semibold">Select Existing User</label>
+
+                <select class="form-select" @bind="selectedUserId">
+                    <option value="">-- Select User --</option>
+                    @foreach (var u in AvailableUsers)
+                    {
+                        <option value="@u.Id">@u.Name (@u.Email)</option>
+                    }
+                </select>
+
+                <div class="mt-3 d-flex gap-2">
+                    <button class="btn btn-success" @onclick="AddExistingUser"
+                            disabled="@(!CanAddExisting)">
+                        Add to Location
+                    </button>
+
+                    <button class="btn btn-outline-secondary" @onclick="HideAddExistingForm">
+                        Cancel
+                    </button>
+                </div>
+            </div>
+        }
 
-                            <div class="d-flex justify-content-end">
+        @if (Users.Count == 0)
+        {
+            <div class="alert alert-info">No users assigned to this location yet.</div>
+        }
+        else
+        {
+            <table class="table table-striped">
+                <thead>
+                    <tr>
+                        <th>Name</th>
+                        <th>Email</th>
+                        <th>Role</th>
+                        <th style="width: 150px;"></th>
+                    </tr>
+                </thead>
+                <tbody>
+                    @foreach (var user in Users)
+                    {
+                        <tr>
+                            <td>@user.Name</td>
+                            <td>@user.Email</td>
+                            <td>@user.Role</td>
+                            <td class="text-end">
                                 @if (user.Role == "Manager")
                                 {
                                     <button class="btn btn-warning btn-sm me-2"
@@ -83,26 +97,24 @@
                                         Demote
                                     </button>
                                 }
-                                else if (user.Role == "Employee")
+                                else
                                 {
                                     <button class="btn btn-primary btn-sm me-2"
                                             @onclick="() => Promote(user)">
                                         Promote
                                     </button>
                                 }
-                                @if (!(user.Role == "Admin" && user.Id == Auth.CurrentUser?.Id)) {
-                                    @* Admins shouldn't be able to remove themselves *@
-                                    <button class="btn btn-danger btn-sm"
-                                            @onclick="() => RemoveUser(user)">
-                                        Remove
-                                    </button>
-                                }
-                            </div>
-                        </td>
-                    </tr>
-                }
-            </tbody>
-        </table>
+
+                                <button class="btn btn-danger btn-sm"
+                                        @onclick="() => RemoveUser(user)">
+                                    Remove
+                                </button>
+                            </td>
+                        </tr>
+                    }
+                </tbody>
+            </table>
+        }
     }
 
 </div>
@@ -110,34 +122,47 @@
 @code {
     [Parameter] public int LocationId { get; set; }
 
+    private UserContext? _ctx;
+
+    private bool _ready;
+    private bool _allowed;
+
     private bool showInvite = false;
     private bool showAddExisting = false;
 
-    private bool hydrated = false;
-
     private List<User> Users = new();
     private List<User> AvailableUsers = new();
 
     private string? selectedUserId; // dropdown binding
 
-    protected override async Task OnAfterRenderAsync(bool firstRender)
+    protected override async Task OnInitializedAsync()
     {
-        if (!firstRender)
-            return;
+        _ctx = await UserCtx.GetAsync();
 
-        await Auth.EnsureHydratedAsync();
+        if (_ctx.IsAuthenticated != true)
+        {
+            Nav.NavigateTo("/login", true);
+            return;
+        }
 
-        if (!Auth.IsSignedIn)
+        if (_ctx.User is null)
         {
-            Nav.NavigateTo("/signin", replace: true);
+            Nav.NavigateTo("/no-access", true);
             return;
         }
 
-        await ReloadUsers();
-        await LoadAvailableUsers();
+        // Gate: allow Admin/Manager to manage location users
+        _allowed =
+            string.Equals(_ctx.User.Role, "Admin", StringComparison.OrdinalIgnoreCase) ||
+            string.Equals(_ctx.User.Role, "Manager", StringComparison.OrdinalIgnoreCase);
 
-        hydrated = true;
-        StateHasChanged();
+        if (_allowed)
+        {
+            await ReloadUsers();
+            await LoadAvailableUsers();
+        }
+
+        _ready = true;
     }
 
     private async Task ReloadUsers()
@@ -149,9 +174,9 @@
 
     private async Task LoadAvailableUsers()
     {
-        if (Auth.CompanyId == null) return;
+        if (_ctx?.User?.CompanyId is null) return;
 
-        var companyUsers = await UserService.GetUsersByCompanyAsync(Auth.CompanyId.Value);
+        var companyUsers = await UserService.GetUsersByCompanyAsync(_ctx.User.CompanyId.Value);
 
         var assignedIds = Users.Select(u => u.Id).ToHashSet();
 
@@ -176,6 +201,8 @@
 
     private async Task AddExistingUser()
     {
+        if (!_allowed) return;
+
         if (!int.TryParse(selectedUserId, out var userId))
             return;
 
@@ -196,14 +223,20 @@
     }
 
     // ---------------------------
-    // Existing logic unchanged
+    // Invite form
     // ---------------------------
 
     private void ShowInviteForm() => showInvite = true;
     private void HideInviteForm() => showInvite = false;
 
+    // ---------------------------
+    // Manage assignments/roles
+    // ---------------------------
+
     private async Task RemoveUser(User user)
     {
+        if (!_allowed) return;
+
         await LocationService.RemoveUserFromLocationAsync(LocationId, user.Id);
 
         if (user.Role == "Manager")
@@ -214,6 +247,8 @@
 
     private async Task Promote(User user)
     {
+        if (!_allowed) return;
+
         user.Role = "Manager";
         await UserService.UpdateUserAsync(user);
         await LocationService.AddManagerToLocationAsync(LocationId, user.Id);
@@ -222,9 +257,11 @@
 
     private async Task Demote(User user)
     {
+        if (!_allowed) return;
+
         user.Role = "Employee";
         await UserService.UpdateUserAsync(user);
         await LocationService.RemoveManagerFromLocationAsync(LocationId, user.Id);
         await ReloadUsers();
     }
-}
\ No newline at end of file
+}
diff --git a/CulinaryCommandApp/Components/Pages/UserSettings/LocationSettings/SettingsLocations.razor b/CulinaryCommandApp/Components/Pages/UserSettings/LocationSettings/SettingsLocations.razor
index 176253e..87e4e31 100644
--- a/CulinaryCommandApp/Components/Pages/UserSettings/LocationSettings/SettingsLocations.razor
+++ b/CulinaryCommandApp/Components/Pages/UserSettings/LocationSettings/SettingsLocations.razor
@@ -1,28 +1,37 @@
-@inject AuthService Auth
-@inject ILocationService LocationService
-@inject NavigationManager Nav
+@rendermode InteractiveServer
+
 @using CulinaryCommand.Components.Pages.UserSettings.LocationSettings
 @using CulinaryCommand.Data.Entities
-@rendermode InteractiveServer
+@using CulinaryCommand.Services.UserContextSpace
+
+@inject ILocationService LocationService
+@inject IUserContextService UserCtx
+@inject NavigationManager Nav
 
 <div>
     @if (!hydrated)
     {
         <p>Loading locations...</p>
     }
+    else if (!_allowed)
+    {
+        <div class="alert alert-warning">
+            You need to be signed in and assigned to a company to manage locations.
+        </div>
+    }
     else
     {
-        @if (Auth.UserRole == "Admin")
+        @if (IsAdmin)
         {
-            <LocationAdminView 
+            <LocationAdminView
                 Locations="locations"
                 OnCreate="Create"
                 OnEdit="Update"
                 OnDelete="Delete" />
         }
-        else if (Auth.UserRole == "Manager")
+        else if (IsManager)
         {
-            <LocationManagerView 
+            <LocationManagerView
                 Locations="locations"
                 OnEdit="Update" />
         }
@@ -38,47 +47,70 @@
     private Location? employeeLocation;
     private bool hydrated = false;
 
-    protected override async Task OnAfterRenderAsync(bool firstRender)
+    private UserContext? _ctx;
+    private bool _allowed;
+
+    private bool IsAdmin => string.Equals(_ctx?.User?.Role, "Admin", StringComparison.OrdinalIgnoreCase);
+    private bool IsManager => string.Equals(_ctx?.User?.Role, "Manager", StringComparison.OrdinalIgnoreCase);
+
+    protected override async Task OnInitializedAsync()
     {
-        if (!firstRender) return;
+        _ctx = await UserCtx.GetAsync();
 
-        // 1. Hydrate Auth first
-        await Auth.EnsureHydratedAsync();
+        // Not authenticated => go to Cognito login route
+        if (_ctx.IsAuthenticated != true)
+        {
+            Nav.NavigateTo("/login", true);
+            return;
+        }
 
-        if (!Auth.IsSignedIn)
+        // Invite-only: authenticated but not in DB
+        if (_ctx.User is null)
         {
-            Nav.NavigateTo("/signin", replace: true);
+            Nav.NavigateTo("/no-access", true);
             return;
         }
 
-        // 2. Load location data AFTER hydration
-        await LoadLocations();
+        // Must have company to manage locations (admins/managers/employees)
+        _allowed = _ctx.User.CompanyId is not null;
+
+        if (_allowed)
+            await LoadLocations();
 
         hydrated = true;
-        StateHasChanged();
     }
 
     private async Task LoadLocations()
     {
-        if (Auth.UserRole == "Admin")
+        if (_ctx?.User is null) return;
+
+        if (IsAdmin)
         {
-            locations = await LocationService.GetLocationsByCompanyAsync(Auth.CompanyId!.Value);
+            if (_ctx.User.CompanyId is null) { locations = new(); return; }
+            locations = await LocationService.GetLocationsByCompanyAsync(_ctx.User.CompanyId.Value);
+            employeeLocation = null;
         }
-        else if (Auth.UserRole == "Manager")
+        else if (IsManager)
         {
-            locations = await LocationService.GetLocationsByManagerAsync(Auth.UserId!.Value);
+            locations = await LocationService.GetLocationsByManagerAsync(_ctx.User.Id);
+            employeeLocation = null;
         }
         else
         {
-            locations = await LocationService.GetLocationsByEmployeeAsync(Auth.UserId!.Value);
-
+            employeeLocation = (await LocationService.GetLocationsByEmployeeAsync(_ctx.User.Id)).FirstOrDefault();
+            locations = new();
         }
     }
 
     private async Task Create(Location loc)
     {
-        loc.CompanyId = Auth.CompanyId!.Value;
-        await LocationService.CreateLocationAsync(loc, Auth.UserId!.Value);
+        if (_ctx?.User?.CompanyId is null) return;
+
+        loc.CompanyId = _ctx.User.CompanyId.Value;
+
+        // CreateLocationAsync(loc, createdByUserId)
+        await LocationService.CreateLocationAsync(loc, _ctx.User.Id);
+
         await LoadLocations();
         StateHasChanged();
     }
@@ -96,4 +128,4 @@
         await LoadLocations();
         StateHasChanged();
     }
-}
\ No newline at end of file
+}
diff --git a/CulinaryCommandApp/Components/Pages/UserSettings/Settings.razor b/CulinaryCommandApp/Components/Pages/UserSettings/Settings.razor
index 96a532c..46cdc20 100644
--- a/CulinaryCommandApp/Components/Pages/UserSettings/Settings.razor
+++ b/CulinaryCommandApp/Components/Pages/UserSettings/Settings.razor
@@ -3,10 +3,12 @@
 @using CulinaryCommand.Data.Entities
 @using CulinaryCommand.Models
 @using CulinaryCommand.Components.Pages.UserSettings.LocationSettings
+@using Microsoft.AspNetCore.Authorization
 @inject NavigationManager Nav
-@inject AuthService Auth
 @inject ILocationService LocationService
 @rendermode InteractiveServer
+@attribute [Authorize]
+
 
 <PageTitle>Settings - Culinary Command</PageTitle>
 
@@ -101,32 +103,6 @@
         ? "profile"
         : Tab!.ToLowerInvariant();
 
-    private bool _hydrating = false;
-
-    protected override async Task OnAfterRenderAsync(bool firstRender)
-    {
-        if (firstRender && !_hydrating)
-        {
-            _hydrating = true;
-
-            await Auth.EnsureHydratedAsync();
-
-            if (!Auth.IsSignedIn)
-            {
-                Nav.NavigateTo("/signin", replace: true);
-                return;
-            }
-
-            if (string.IsNullOrWhiteSpace(Tab))
-                Nav.NavigateTo("/settings/profile", replace: true);
-
-            if (Auth.UserId != null)
-                await LocationService.LoadAndPersistLocationsAsync(Auth.UserId.Value);
-
-            StateHasChanged();
-        }
-    }
-
     private void NavigateToTab(string tab)
     {
         Nav.NavigateTo($"/settings/{tab}", forceLoad: false);
diff --git a/CulinaryCommandApp/Components/Pages/UserSettings/SettingsCompany.razor b/CulinaryCommandApp/Components/Pages/UserSettings/SettingsCompany.razor
index 33673b2..ef98acc 100644
--- a/CulinaryCommandApp/Components/Pages/UserSettings/SettingsCompany.razor
+++ b/CulinaryCommandApp/Components/Pages/UserSettings/SettingsCompany.razor
@@ -1,22 +1,37 @@
-@using CulinaryCommand.Services
+@rendermode InteractiveServer
+
 @using CulinaryCommand.Data.Entities
-@inject AuthService Auth
+@using CulinaryCommand.Services
+@using CulinaryCommand.Services.UserContextSpace
+
 @inject NavigationManager Nav
 @inject ICompanyService CompanyService
-@rendermode InteractiveServer
+@inject IUserContextService UserCtx
 
 <div class="tab-pane active">
     <h4 class="mb-4">
         <i class="fas fa-building me-2"></i>Company Settings
     </h4>
 
-    @if (companyModel is null)
+    @if (!_ready)
+    {
+        <div>Loading...</div>
+    }
+    else if (!_allowed)
+    {
+        <div class="alert alert-warning">
+            You do not have permission to manage company settings.
+        </div>
+    }
+    else if (companyModel is null)
     {
         <div class="alert alert-warning">
             You do not belong to a company yet. Create one below.
         </div>
 
         <EditForm Model="@createCompanyModel" OnValidSubmit="@HandleCreateCompany">
+            <DataAnnotationsValidator />
+
             <div class="mb-3">
                 <label class="form-label">Company Name</label>
                 <InputText class="form-control" @bind-Value="createCompanyModel.Name" />
@@ -27,7 +42,9 @@
                 <InputText class="form-control" @bind-Value="createCompanyModel.CompanyCode" />
             </div>
 
-            <button class="btn btn-primary">Create Company</button>
+            <button class="btn btn-primary" disabled="@_saving">
+                @(_saving ? "Creating..." : "Create Company")
+            </button>
         </EditForm>
 
         <hr class="my-4" />
@@ -35,6 +52,8 @@
     else
     {
         <EditForm Model="@companyModel" OnValidSubmit="@HandleCompanySubmit">
+            <DataAnnotationsValidator />
+
             <div class="mb-3">
                 <label class="form-label">Company Name</label>
                 <InputText class="form-control" @bind-Value="companyModel.Name" />
@@ -45,94 +64,127 @@
                 <InputText class="form-control" @bind-Value="companyModel.CompanyCode" />
             </div>
 
-            <button class="btn btn-success">Update Company</button>
+            <button class="btn btn-success" disabled="@_saving">
+                @(_saving ? "Saving..." : "Update Company")
+            </button>
         </EditForm>
     }
 </div>
 
 @code {
+    private UserContext? _ctx;
+
+    private bool _ready;
+    private bool _allowed;
+    private bool _saving;
+
     private CompanyModel? companyModel;
     private CompanyModel createCompanyModel = new();
 
-    protected override async Task OnAfterRenderAsync(bool firstRender)
+    protected override async Task OnInitializedAsync()
     {
-        if (!firstRender) return;
+        _ctx = await UserCtx.GetAsync();
 
-        // Wait for AuthService to hydrate
-        await Auth.EnsureHydratedAsync();
+        if (_ctx.IsAuthenticated != true)
+        {
+            Nav.NavigateTo("/login", true);
+            return;
+        }
 
-        if (!Auth.IsSignedIn)
+        if (_ctx.User is null)
         {
-            Nav.NavigateTo("/signin", replace: true);
+            Nav.NavigateTo("/no-access", true);
             return;
         }
 
-        // Now safe to use Auth.CurrentUser
-        if (Auth.CurrentUser?.Company != null)
+        // Gate: Admin only (change if needed)
+        _allowed = string.Equals(_ctx.User.Role, "Admin", StringComparison.OrdinalIgnoreCase);
+
+        if (_allowed && _ctx.User.Company is not null)
         {
             companyModel = new CompanyModel
             {
-                Id = Auth.CurrentUser.Company.Id,
-                Name = Auth.CurrentUser.Company.Name,
-                CompanyCode = Auth.CurrentUser.Company.CompanyCode
-                
+                Id = _ctx.User.Company.Id,
+                Name = _ctx.User.Company.Name,
+                CompanyCode = _ctx.User.Company.CompanyCode
             };
         }
 
-        StateHasChanged(); // re-render now that the model is populated
+        _ready = true;
     }
 
     private async Task HandleCompanySubmit()
     {
-        if (companyModel is null || Auth.CurrentUser?.CompanyId is null)
-        return;
+        if (!_allowed || companyModel is null) return;
+        if (_saving) return;
 
-        var updated = new Company
+        _saving = true;
+        try
         {
-            Id = companyModel.Id,
-            Name = companyModel.Name,
-            CompanyCode = companyModel.CompanyCode
-        };
+            var updated = new Company
+            {
+                Id = companyModel.Id,
+                Name = companyModel.Name ?? string.Empty,
+                CompanyCode = companyModel.CompanyCode ?? string.Empty
+            };
 
-        await CompanyService.UpdateCompanyAsync(updated);
+            await CompanyService.UpdateCompanyAsync(updated);
 
-        // reload updated company for the current user
-        var refreshedCompany = await CompanyService.GetCompanyByIdAsync(updated.Id);
+            // Refresh user context so other UI sees latest company/locations
+            _ctx = await UserCtx.RefreshAsync();
 
-        if (Auth.CurrentUser != null)
+            // Re-hydrate the form model from refreshed context if present
+            if (_ctx.User?.Company is not null)
+            {
+                companyModel = new CompanyModel
+                {
+                    Id = _ctx.User.Company.Id,
+                    Name = _ctx.User.Company.Name,
+                    CompanyCode = _ctx.User.Company.CompanyCode
+                };
+            }
+        }
+        finally
         {
-            Auth.CurrentUser.Company = refreshedCompany;
-            //Auth.NotifyStateChanged();
+            _saving = false;
         }
-
-        Console.WriteLine("Company updated successfully.");
     }
 
     private async Task HandleCreateCompany()
     {
-        var newCompany = new Company
+        if (!_allowed) return;
+        if (_saving) return;
+
+        _saving = true;
+        try
         {
-            Name = createCompanyModel.Name,
-            CompanyCode = createCompanyModel.CompanyCode
-        };
+            var newCompany = new Company
+            {
+                Name = createCompanyModel.Name ?? string.Empty,
+                CompanyCode = createCompanyModel.CompanyCode ?? string.Empty
+            };
 
-        var created = await CompanyService.CreateCompanyAsync(newCompany);
+            var created = await CompanyService.CreateCompanyAsync(newCompany);
 
-        if (Auth.CurrentUser != null)
-        {
-            Auth.CurrentUser.CompanyId = created.Id;
-            Auth.CurrentUser.Company = created;
-            //Auth.NotifyStateChanged();
-        }
+            // IMPORTANT:
+            // Your DB also needs to link the current user to this company.
+            // If CreateCompanyAsync DOES NOT do that, you'll want a UserService method like:
+            //   await UserService.AssignCompanyAsync(_ctx.User.Id, created.Id);
+            // For now we refresh and rely on your backend behavior.
 
-        companyModel = new CompanyModel
-        {
-            Id = created.Id,
-            Name = created.Name,
-            CompanyCode = created.CompanyCode
-        };
+            _ctx = await UserCtx.RefreshAsync();
 
-        Console.WriteLine("Company created successfully.");
+            companyModel = new CompanyModel
+            {
+                Id = created.Id,
+                Name = created.Name,
+                CompanyCode = created.CompanyCode
+            };
+        }
+        finally
+        {
+            _saving = false;
+        }
     }
 
     private class CompanyModel
@@ -141,4 +193,4 @@
         public string? Name { get; set; }
         public string? CompanyCode { get; set; }
     }
-}
\ No newline at end of file
+}
diff --git a/CulinaryCommandApp/Components/Pages/UserSettings/SettingsProfile.razor b/CulinaryCommandApp/Components/Pages/UserSettings/SettingsProfile.razor
index 097d071..dc50b38 100644
--- a/CulinaryCommandApp/Components/Pages/UserSettings/SettingsProfile.razor
+++ b/CulinaryCommandApp/Components/Pages/UserSettings/SettingsProfile.razor
@@ -1,173 +1,228 @@
+@rendermode InteractiveServer
+
 @using CulinaryCommand.Services
-@inject AuthService Auth
+@using CulinaryCommand.Services.UserContextSpace
+
 @inject IUserService UserService
+@inject IUserContextService UserCtx
 @inject NavigationManager Nav
-@rendermode InteractiveServer
 
 <div class="tab-pane active">
     <h4 class="mb-4">
         <i class="fas fa-user me-2"></i>Profile Information
     </h4>
 
-    <EditForm Model="@profileModel" OnValidSubmit="@HandleProfileSubmit">
-        <div class="row mb-3">
-            <div class="col-md-6">
-                <label for="firstName" class="form-label">First Name</label>
-                <InputText id="firstName" class="form-control"
-                           @bind-Value="profileModel.FirstName"
-                           placeholder="Enter your first name" />
+    @if (!_ready)
+    {
+        <div>Loading...</div>
+    }
+    else if (!_ctx?.IsAuthenticated ?? true)
+    {
+        <div class="alert alert-warning">
+            You need to sign in to view your profile.
+        </div>
+    }
+    else if (_ctx?.User is null)
+    {
+        <div class="alert alert-warning">
+            Your account is not linked to an invited user record. Contact an admin.
+        </div>
+    }
+    else
+    {
+        <EditForm Model="@profileModel" OnValidSubmit="@HandleProfileSubmit">
+            <DataAnnotationsValidator />
+
+            <div class="row mb-3">
+                <div class="col-md-6">
+                    <label for="firstName" class="form-label">First Name</label>
+                    <InputText id="firstName" class="form-control"
+                               @bind-Value="profileModel.FirstName"
+                               placeholder="Enter your first name" />
+                </div>
+                <div class="col-md-6">
+                    <label for="lastName" class="form-label">Last Name</label>
+                    <InputText id="lastName" class="form-control"
+                               @bind-Value="profileModel.LastName"
+                               placeholder="Enter your last name" />
+                </div>
             </div>
-            <div class="col-md-6">
-                <label for="lastName" class="form-label">Last Name</label>
-                <InputText id="lastName" class="form-control"
-                           @bind-Value="profileModel.LastName"
-                           placeholder="Enter your last name" />
+
+            <div class="mb-3">
+                <label for="email" class="form-label">Email Address</label>
+                <InputText id="email" type="email" class="form-control"
+                           @bind-Value="profileModel.Email"
+                           placeholder="Enter your email" />
             </div>
-        </div>
 
-        <div class="mb-3">
-            <label for="email" class="form-label">Email Address</label>
-            <InputText id="email" type="email" class="form-control"
-                       @bind-Value="profileModel.Email"
-                       placeholder="Enter your email" />
-        </div>
+            <div class="mb-3">
+                <label for="phone" class="form-label">Phone Number</label>
+                <InputText id="phone" type="tel" class="form-control"
+                           @bind-Value="profileModel.Phone"
+                           placeholder="Enter your phone number" />
+            </div>
 
-        <div class="mb-3">
-            <label for="phone" class="form-label">Phone Number</label>
-            <InputText id="phone" type="tel" class="form-control"
-                       @bind-Value="profileModel.Phone"
-                       placeholder="Enter your phone number" />
-        </div>
+            <div class="mb-3">
+                <label for="role" class="form-label">Current Role</label>
+                <select id="role" class="form-control" @bind="profileModel.Role" disabled="@(!_canEditRole)">
+                    <option value="Manager">Manager</option>
+                    <option value="Cook">Cook</option>
+                    <option value="Admin">Admin</option>
+                </select>
+
+                @if (!_canEditRole)
+                {
+                    <div class="form-text text-muted">
+                        Role changes are restricted to Admins.
+                    </div>
+                }
+            </div>
 
-        <div class="mb-3">
-            <label for="role" class="form-label">Current Role</label>
-            <select id="role" class="form-control" @bind="profileModel.Role">
-                <option value="Manager">Manager</option>
-                <option value="Cook">Cook</option>
-                <option value="Admin">Admin</option>
-            </select>
-        </div>
+            <button type="submit" class="btn btn-success settings-btn" disabled="@_saving">
+                @(_saving ? "Saving..." : "Update Profile")
+            </button>
 
-        <button type="submit" class="btn btn-success settings-btn">Update Profile</button>
-    </EditForm>
-
-    <!-- Danger Zone -->
-    <div class="danger-zone mt-5">
-        <h5 class="text-danger mb-3">
-            <i class="fas fa-exclamation-triangle me-2"></i>Danger Zone
-        </h5>
-        <p class="text-muted mb-4">
-            These actions are permanent and cannot be undone. Please proceed with caution.
-        </p>
-
-        <div class="row g-3">
-            <div class="col-md-6">
-                <div class="danger-action-card">
-                    <h6 class="mb-2">Export Your Data</h6>
-                    <p class="text-muted small mb-3">Download a copy of all your account data</p>
-                    <button class="btn btn-outline-info w-100" @onclick="ExportData">
-                        <i class="fas fa-download me-2"></i>Export Data
-                    </button>
+            @if (!string.IsNullOrWhiteSpace(_saveMessage))
+            {
+                <div class="mt-3 alert alert-info">@_saveMessage</div>
+            }
+        </EditForm>
+
+        <!-- Danger Zone -->
+        <div class="danger-zone mt-5">
+            <h5 class="text-danger mb-3">
+                <i class="fas fa-exclamation-triangle me-2"></i>Danger Zone
+            </h5>
+            <p class="text-muted mb-4">
+                These actions are permanent and cannot be undone. Please proceed with caution.
+            </p>
+
+            <div class="row g-3">
+                <div class="col-md-6">
+                    <div class="danger-action-card">
+                        <h6 class="mb-2">Export Your Data</h6>
+                        <p class="text-muted small mb-3">Download a copy of all your account data</p>
+                        <button class="btn btn-outline-info w-100" @onclick="ExportData">
+                            <i class="fas fa-download me-2"></i>Export Data
+                        </button>
+                    </div>
                 </div>
-            </div>
-            <div class="col-md-6">
-                <div class="danger-action-card">
-                    <h6 class="mb-2">Reset All Settings</h6>
-                    <p class="text-muted small mb-3">Restore all settings to default values</p>
-                    <button class="btn btn-outline-warning w-100" @onclick="ResetSettings">
-                        <i class="fas fa-undo me-2"></i>Reset Settings
-                    </button>
+                <div class="col-md-6">
+                    <div class="danger-action-card">
+                        <h6 class="mb-2">Reset All Settings</h6>
+                        <p class="text-muted small mb-3">Restore all settings to default values</p>
+                        <button class="btn btn-outline-warning w-100" @onclick="ResetSettings">
+                            <i class="fas fa-undo me-2"></i>Reset Settings
+                        </button>
+                    </div>
                 </div>
-            </div>
-            <div class="col-md-6">
-                <div class="danger-action-card">
-                    <h6 class="mb-2">Deactivate Account</h6>
-                    <p class="text-muted small mb-3">Temporarily disable your account access</p>
-                    <button class="btn btn-outline-danger w-100" @onclick="DeactivateAccount">
-                        <i class="fas fa-user-slash me-2"></i>Deactivate
-                    </button>
+                <div class="col-md-6">
+                    <div class="danger-action-card">
+                        <h6 class="mb-2">Deactivate Account</h6>
+                        <p class="text-muted small mb-3">Temporarily disable your account access</p>
+                        <button class="btn btn-outline-danger w-100" @onclick="DeactivateAccount">
+                            <i class="fas fa-user-slash me-2"></i>Deactivate
+                        </button>
+                    </div>
                 </div>
-            </div>
-            <div class="col-md-6">
-                <div class="danger-action-card">
-                    <h6 class="mb-2">Delete Account</h6>
-                    <p class="text-muted small mb-3">Permanently delete your account and all data</p>
-                    <button class="btn btn-danger w-100" @onclick="DeleteAccount">
-                        <i class="fas fa-trash me-2"></i>Delete Forever
-                    </button>
+                <div class="col-md-6">
+                    <div class="danger-action-card">
+                        <h6 class="mb-2">Delete Account</h6>
+                        <p class="text-muted small mb-3">Permanently delete your account and all data</p>
+                        <button class="btn btn-danger w-100" @onclick="DeleteAccount">
+                            <i class="fas fa-trash me-2"></i>Delete Forever
+                        </button>
+                    </div>
                 </div>
             </div>
         </div>
-    </div>
+    }
 </div>
 
 @code {
-    private ProfileModel profileModel = new();
+    private UserContext? _ctx;
 
-    private bool _startedHydration = false;
+    private bool _ready;
+    private bool _saving;
+    private string? _saveMessage;
 
-    protected override async Task OnAfterRenderAsync(bool firstRender)
+    private bool _canEditRole;
+
+    private ProfileModel profileModel = new();
+
+    protected override async Task OnInitializedAsync()
     {
-        if (firstRender && !_startedHydration)
+        _ctx = await UserCtx.GetAsync();
+
+        if (_ctx.IsAuthenticated != true)
         {
-            _startedHydration = true;
+            Nav.NavigateTo("/login", true);
+            return;
+        }
 
-            await Auth.EnsureHydratedAsync();
+        if (_ctx.User is null)
+        {
+            Nav.NavigateTo("/no-access", true);
+            return;
+        }
 
-            if (!Auth.IsSignedIn)
-            {
-                Nav.NavigateTo("/signin", replace: true);
-                return;
-            }
+        _canEditRole = string.Equals(_ctx.User.Role, "Admin", StringComparison.OrdinalIgnoreCase);
 
-            // Now safe to initialize UI model
-            if (Auth.CurrentUser != null)
-            {
-                var user = Auth.CurrentUser;
+        // Initialize UI model from DB user
+        var user = _ctx.User;
 
-                var parts = (user.Name ?? "").Split(' ', 2);
-                profileModel.FirstName = parts.Length > 0 ? parts[0] : "";
-                profileModel.LastName  = parts.Length > 1 ? parts[1] : "";
-                profileModel.Email     = user.Email;
-                profileModel.Phone     = user.Phone;
-                profileModel.Role      = user.Role;
+        var parts = (user.Name ?? "").Split(' ', 2);
+        profileModel.FirstName = parts.Length > 0 ? parts[0] : "";
+        profileModel.LastName  = parts.Length > 1 ? parts[1] : "";
+        profileModel.Email     = user.Email;
+        profileModel.Phone     = user.Phone;
+        profileModel.Role      = user.Role;
 
-                StateHasChanged();
-            }
-        }
+        _ready = true;
     }
 
     private async Task HandleProfileSubmit()
     {
-        Console.WriteLine($"Profile updated: {profileModel.FirstName} {profileModel.LastName}");
-        // TODO: Persist to backend
-        if (Auth.UserId is null)
-    {
-        Console.WriteLine("Cannot update profile: no signed-in user.");
-        return;
-    }
+        if (_saving) return;
 
-    await UserService.UpdateUserProfileAsync(
-        Auth.UserId.Value,
-        profileModel.FirstName ?? "",
-        profileModel.LastName ?? "",
-        profileModel.Email ?? "",
-        profileModel.Phone ?? "",
-        profileModel.Role ?? ""
-    );
-
-    // Refresh AuthService's CurrentUser so UI updates:
-    if (Auth.CurrentUser != null)
-    {
-        Auth.CurrentUser.Name  = $"{profileModel.FirstName} {profileModel.LastName}".Trim();
-        Auth.CurrentUser.Email = profileModel.Email;
-        Auth.CurrentUser.Phone = profileModel.Phone;
-        Auth.CurrentUser.Role  = profileModel.Role;
+        if (_ctx?.User?.Id is null)
+        {
+            _saveMessage = "Cannot update profile: no signed-in user.";
+            return;
+        }
 
-        //Auth.NotifyStateChanged();
-    }
+        _saving = true;
+        _saveMessage = null;
 
-    Console.WriteLine("Profile saved!");
+        try
+        {
+            // If they can't edit role, keep existing role
+            var roleToSave = _canEditRole
+                ? (profileModel.Role ?? _ctx.User.Role ?? "Cook")
+                : (_ctx.User.Role ?? "Cook");
+
+            await UserService.UpdateUserProfileAsync(
+                _ctx.User.Id,
+                profileModel.FirstName ?? "",
+                profileModel.LastName ?? "",
+                profileModel.Email ?? "",
+                profileModel.Phone ?? "",
+                roleToSave
+            );
+
+            // Refresh context so rest of app sees updates
+            _ctx = await UserCtx.RefreshAsync();
+
+            _saveMessage = "Profile saved!";
+        }
+        catch (Exception ex)
+        {
+            _saveMessage = $"Failed to save profile: {ex.Message}";
+        }
+        finally
+        {
+            _saving = false;
+        }
     }
 
     private void ExportData() => Console.WriteLine("Exporting user data...");
@@ -177,11 +232,10 @@
 
     private class ProfileModel
     {
-        public int? userId {get; set;}
         public string? FirstName { get; set; }
         public string? LastName  { get; set; }
         public string? Email     { get; set; }
         public string? Phone     { get; set; }
         public string? Role      { get; set; }
     }
-}
\ No newline at end of file
+}
diff --git a/CulinaryCommandApp/Components/Pages/Users/Edit.razor b/CulinaryCommandApp/Components/Pages/Users/Edit.razor
index 6ea6a24..3d91b7a 100644
--- a/CulinaryCommandApp/Components/Pages/Users/Edit.razor
+++ b/CulinaryCommandApp/Components/Pages/Users/Edit.razor
@@ -1,9 +1,12 @@
 @page "/users/edit/{id:int}"
+@rendermode InteractiveServer
+
 @using CulinaryCommand.Data.Entities
+@using CulinaryCommand.Services.UserContextSpace
+
 @inject IUserService UserService
-@inject AuthService Auth
+@inject IUserContextService UserCtx
 @inject NavigationManager Nav
-@rendermode InteractiveServer
 
 <h3>Edit User</h3>
 
@@ -11,6 +14,12 @@
 {
     <p>Loading...</p>
 }
+else if (!_allowed)
+{
+    <div class="alert alert-warning">
+        You do not have permission to edit users.
+    </div>
+}
 else
 {
     <UserForm Model="model" FormTitle="Edit User" OnValidSubmit="Save" />
@@ -18,28 +27,46 @@ else
 
 @code {
     [Parameter] public int id { get; set; }
+
     private User? model;
+    private bool _allowed;
+    private UserContext? _ctx;
 
     protected override async Task OnInitializedAsync()
     {
-        // Wait for hydration
-        await Auth.EnsureHydratedAsync();
+        _ctx = await UserCtx.GetAsync();
+
+        if (_ctx.IsAuthenticated != true)
+        {
+            Nav.NavigateTo("/login", true);
+            return;
+        }
 
-        if (!Auth.IsSignedIn)
+        if (_ctx.User is null)
         {
-            Nav.NavigateTo("/signin", replace: true);
+            Nav.NavigateTo("/no-access", true);
             return;
         }
 
-        // Safe to use Auth.UserId, Auth.UserRole, etc now
+        _allowed =
+            string.Equals(_ctx.User.Role, "Admin", StringComparison.OrdinalIgnoreCase) ||
+            string.Equals(_ctx.User.Role, "Manager", StringComparison.OrdinalIgnoreCase);
+
+        // Load model either way so the page can show something (or you can early-return if you prefer)
         model = await UserService.GetUserByIdAsync(id);
     }
 
     private async Task Save(User u)
     {
+        if (!_allowed)
+            return;
+
         await UserService.UpdateUserAsync(u);
-        await UserService.AssignLocationsAsync(u.Id, u.UserLocations.Select(x => x.LocationId).ToList());
-       
+
+        // If UserLocations is null, don't blow up
+        var locIds = u.UserLocations?.Select(x => x.LocationId).ToList() ?? new List<int>();
+        await UserService.AssignLocationsAsync(u.Id, locIds);
+
         Nav.NavigateTo("/users");
     }
 }
diff --git a/CulinaryCommandApp/Components/Pages/Users/UserForm.razor b/CulinaryCommandApp/Components/Pages/Users/UserForm.razor
index 1f2ff0f..169382d 100644
--- a/CulinaryCommandApp/Components/Pages/Users/UserForm.razor
+++ b/CulinaryCommandApp/Components/Pages/Users/UserForm.razor
@@ -31,7 +31,7 @@
 
         <div class="mb-3">
             <label class="form-label">Assigned Locations</label>
-            <UserLocationTagPicker AssignedIds="AssignedLocationIds" UserId="Model.Id" OnChanged="OnLocationChanged" />
+            <UserLocationTagPicker CompanyId="Model.CompanyId" AssignedIds="AssignedLocationIds" UserId="Model.Id" OnChanged="OnLocationChanged" />
         </div>
 
         <button class="btn btn-success" @onclick="Save">Save</button>
diff --git a/CulinaryCommandApp/Components/Pages/Users/UserList.razor b/CulinaryCommandApp/Components/Pages/Users/UserList.razor
index dc66da7..664f626 100644
--- a/CulinaryCommandApp/Components/Pages/Users/UserList.razor
+++ b/CulinaryCommandApp/Components/Pages/Users/UserList.razor
@@ -1,10 +1,21 @@
+@rendermode InteractiveServer
+@implements IDisposable
+
 @using CulinaryCommand.Data.Entities
+@using CulinaryCommand.Services
+@using CulinaryCommand.Services.UserContextSpace
+
 @inject IUserService Users
-@inject AuthService Auth
+@inject IUserContextService UserCtx
+@inject LocationState LocationState
 @inject NavigationManager Nav
-@rendermode InteractiveServer
+
 <h3 class="mb-3">Users</h3>
-<button class="btn btn-success mb-3" @onclick="CreateUser">+ Add User</button>
+
+@if (priv)
+{
+    <button class="btn btn-success mb-3" @onclick="CreateUser">+ Add User</button>
+}
 
 @if (_users == null)
 {
@@ -29,7 +40,7 @@ else
                     <td>@u.Name</td>
                     <td>@u.Email</td>
                     <td>@u.Role</td>
-                    <td>@string.Join(", ", u.UserLocations.Select(x => x.Location.Name))</td>
+                    <td>@FormatLocations(u)</td>
                     <td>
                         <button class="btn btn-primary me-2" @onclick="() => Edit(u.Id)">Edit</button>
                         <button class="btn btn-danger" @onclick="() => Delete(u.Id)">Delete</button>
@@ -41,27 +52,68 @@ else
 }
 
 @code {
-    List<User>? _users;
+    private UserContext? _ctx;
+    private List<User>? _users;
+    private bool priv = false;
 
-    protected override async Task OnAfterRenderAsync(bool firstRender)
+    protected override async Task OnInitializedAsync()
     {
-        if (firstRender)
+        _ctx = await UserCtx.GetAsync();
+
+        // If not authenticated, bounce to Cognito login
+        if (_ctx.IsAuthenticated != true)
+        {
+            Nav.NavigateTo("/login", true);
+            return;
+        }
+
+        // Invite-only: authenticated but not in DB
+        if (_ctx.User is null)
         {
-            // Wait for JS + hydration
-            await Auth.EnsureHydratedAsync();
+            Nav.NavigateTo("/no-access", true);
+            return;
+        }
 
-            if (!Auth.IsSignedIn)
-            {
-                Nav.NavigateTo("/signin", replace: true);
-                return;
-            }
+        // Ensure LocationState has locations (same as RecipeList)
+        if (LocationState.ManagedLocations.Count == 0 && _ctx.AccessibleLocations.Any())
+            await LocationState.SetLocationsAsync(_ctx.AccessibleLocations);
 
-            // Now safe to load data
-            @* _users = await Users.GetAllUsersAsync(); *@
-            _users = await Users.GetUsersByCompanyAsync(Auth.CurrentUser?.CompanyId ?? 0);
+        UpdatePriv();
 
-            StateHasChanged();
+        LocationState.OnChange += RefreshUsers;
+
+        await LoadUsersAsync();
+    }
+
+    private void UpdatePriv()
+    {
+        var role = _ctx?.User?.Role;
+        priv =
+            string.Equals(role, "Manager", StringComparison.OrdinalIgnoreCase) ||
+            string.Equals(role, "Admin", StringComparison.OrdinalIgnoreCase);
+    }
+
+    private async Task LoadUsersAsync()
+    {
+        var loc = LocationState.CurrentLocation;
+
+        if (loc == null)
+        {
+            _users = new List<User>();
+            return;
         }
+
+        // ✅ only users for current location (and optionally filtered by company)
+        _users = await Users.GetUsersForLocationAsync(loc.Id, _ctx!.User!.CompanyId);
+    }
+
+    private void RefreshUsers()
+    {
+        _ = InvokeAsync(async () =>
+        {
+            await LoadUsersAsync();
+            StateHasChanged();
+        });
     }
 
     void CreateUser() => Nav.NavigateTo("/users/create");
@@ -69,7 +121,25 @@ else
 
     async Task Delete(int id)
     {
+        if (!priv) return;
+
         await Users.DeleteUserAsync(id);
-        _users = await Users.GetAllUsersAsync();
+        await LoadUsersAsync();
+        await InvokeAsync(StateHasChanged);
+    }
+
+    private static string FormatLocations(User u)
+    {
+        var names = u.UserLocations?
+            .Select(x => x.Location?.Name)
+            .Where(n => !string.IsNullOrWhiteSpace(n))
+            .ToList() ?? new List<string>();
+
+        return names.Count == 0 ? "-" : string.Join(", ", names);
+    }
+
+    public void Dispose()
+    {
+        LocationState.OnChange -= RefreshUsers;
     }
 }
diff --git a/CulinaryCommandApp/Components/Pages/WhoAmI.razor b/CulinaryCommandApp/Components/Pages/WhoAmI.razor
new file mode 100644
index 0000000..e4e70e3
--- /dev/null
+++ b/CulinaryCommandApp/Components/Pages/WhoAmI.razor
@@ -0,0 +1,36 @@
+@page "/whoami"
+@rendermode InteractiveServer
+@inject CulinaryCommand.Services.UserContextSpace.IUserContextService UserCtxSvc
+
+<h3>WhoAmI</h3>
+
+@if (_ctx is null)
+{
+    <p>Loading...</p>
+}
+else
+{
+    <p><b>IsAuthenticated:</b> @_ctx.IsAuthenticated</p>
+    <p><b>Email:</b> @_ctx.Email</p>
+    <p><b>CognitoSub:</b> @_ctx.CognitoSub</p>
+
+    @if (_ctx.User is null)
+    {
+        <p style="color:crimson"><b>DB User:</b> NOT FOUND</p>
+    }
+    else
+    {
+        <p style="color:green">
+            <b>DB User:</b> Found (Id=@_ctx.User.Id, Role=@_ctx.User.Role, CompanyId=@_ctx.User.CompanyId)
+        </p>
+    }
+}
+
+@code {
+    private CulinaryCommand.Services.UserContextSpace.UserContext? _ctx;
+
+    protected override async Task OnInitializedAsync()
+    {
+        _ctx = await UserCtxSvc.RefreshAsync();
+    }
+}
diff --git a/CulinaryCommandApp/Components/Routes.razor b/CulinaryCommandApp/Components/Routes.razor
index 3387be6..a6c78ec 100644
--- a/CulinaryCommandApp/Components/Routes.razor
+++ b/CulinaryCommandApp/Components/Routes.razor
@@ -1,9 +1,7 @@
 ﻿@namespace CulinaryCommand.Components
-@inject CulinaryCommand.Services.AuthService Auth
 @inject NavigationManager Nav
-@rendermode InteractiveServer
 
-<Router AppAssembly="@typeof(Program).Assembly" PreferExactMatches="true">
+<Router AppAssembly="@typeof(CulinaryCommand.Components.Pages.SignIn).Assembly" PreferExactMatches="true">
     <Found Context="routeData">
         @if (routeData.PageType == typeof(CulinaryCommand.Components.Pages.SignIn)
         || routeData.PageType == typeof(CulinaryCommand.Components.Pages.SignUp)
@@ -22,24 +20,5 @@
             <p>Sorry, nothing found at this address.</p>
         </LayoutView>
     </NotFound>
-</Router>
-
-@code {
-    @* private bool _initialized;
-
-    protected override async Task OnAfterRenderAsync(bool firstRender)
-    {
-        if (firstRender && !_initialized)
-        {
-            // Don't re-hydrate if user is already on /signin, /signup or /adminsignup
-            var path = Nav.Uri.ToLower();
-            if (!path.Contains("/signin") && !path.Contains("/signup") && !path.Contains("/adminsignup"))
-            {
-                await Auth.InitializeFromJsAsync();
-            }
 
-            _initialized = true;
-            StateHasChanged();
-        }
-    } *@
-}
+</Router>
diff --git a/CulinaryCommandApp/CulinaryCommand.csproj b/CulinaryCommandApp/CulinaryCommand.csproj
index 4e4019a..ff42df0 100644
--- a/CulinaryCommandApp/CulinaryCommand.csproj
+++ b/CulinaryCommandApp/CulinaryCommand.csproj
@@ -11,8 +11,12 @@
   </PropertyGroup>
 
   <ItemGroup>
+    <PackageReference Include="AWSSDK.CognitoIdentityProvider" Version="4.0.5.1" />
+    <PackageReference Include="AWSSDK.Extensions.NETCore.Setup" Version="4.0.3.22" />
     <PackageReference Include="BCrypt.Net-Next" Version="4.0.3" />
     <PackageReference Include="Google.GenAI" Version="0.13.1" />
+    <PackageReference Include="Microsoft.AspNetCore.Authentication.Cookies" Version="2.3.9" />
+    <PackageReference Include="Microsoft.AspNetCore.Authentication.OpenIdConnect" Version="9.0.0" />
     <PackageReference Include="Microsoft.EntityFrameworkCore" Version="9.0.0" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="9.0.0">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
@@ -22,6 +26,7 @@
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>
+    <PackageReference Include="Microsoft.IdentityModel.Protocols.OpenIdConnect" Version="8.15.0" />
     <PackageReference Include="Pomelo.EntityFrameworkCore.MySql" Version="9.0.0" />
     <Content Include="AIDashboard\**\*"> 
       <CopyToPublishDirectory>PreserveNewest</CopyToPublishDirectory> 
diff --git a/CulinaryCommandApp/Data/Models/SignUpModel.cs b/CulinaryCommandApp/Data/Models/SignUpModel.cs
new file mode 100644
index 0000000..848da8b
--- /dev/null
+++ b/CulinaryCommandApp/Data/Models/SignUpModel.cs
@@ -0,0 +1,12 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+
+namespace CulinaryCommandApp.Data.Models
+{
+    public class SignUpModel
+    {
+        
+    }
+}
\ No newline at end of file
diff --git a/CulinaryCommandApp/Models/SignupRequest.cs b/CulinaryCommandApp/Models/SignupRequest.cs
index 14473cd..28a3a70 100644
--- a/CulinaryCommandApp/Models/SignupRequest.cs
+++ b/CulinaryCommandApp/Models/SignupRequest.cs
@@ -1,15 +1,68 @@
-using System;
-using System.Collections.Generic;
 using System.ComponentModel.DataAnnotations;
-using System.Linq;
-using System.Threading.Tasks;
 
 namespace CulinaryCommand.Models
 {
     public class SignupRequest
     {
-        public CompanySignupModel Company { get; set; } = new();
-        public LocationSignupModel Location { get; set; } = new();
-        public AdminSignupModel Admin { get; set; } = new();
+        [Required]
+        public CompanySignup Company { get; set; } = new();
+
+        [Required]
+        public AdminSignup Admin { get; set; } = new();
+
+        [MinLength(1, ErrorMessage = "At least one location is required.")]
+        public List<LocationSignup> Locations { get; set; } = new() { new LocationSignup() };
+    }
+
+    public class CompanySignup
+    {
+        [Required]
+        public string Name { get; set; } = string.Empty;
+
+        public string? Address { get; set; }
+        public string? City { get; set; }
+        public string? State { get; set; }
+        public string? ZipCode { get; set; }
+
+        public string? Phone { get; set; }
+        public string? Email { get; set; }
+
+        public string? Description { get; set; }
+        public string? LLCName { get; set; }
+        public string? TaxId { get; set; }
+    }
+
+    public class LocationSignup
+    {
+        [Required]
+        public string Name { get; set; } = string.Empty;
+
+        [Required]
+        public string Address { get; set; } = string.Empty;
+
+        [Required]
+        public string City { get; set; } = string.Empty;
+
+        [Required]
+        public string State { get; set; } = string.Empty;
+
+        [Required]
+        public string ZipCode { get; set; } = string.Empty;
+
+        public string? MarginEdgeKey { get; set; }
+    }
+
+    public class AdminSignup
+    {
+        [Required]
+        public string Name { get; set; } = string.Empty;
+
+        public string? Phone { get; set; }
+
+        [Required, EmailAddress]
+        public string Email { get; set; } = string.Empty;
+
+        [Required]
+        public string Password { get; set; } = string.Empty;
     }
-}
\ No newline at end of file
+}
diff --git a/CulinaryCommandApp/Program.cs b/CulinaryCommandApp/Program.cs
index 7952c98..3c07746 100644
--- a/CulinaryCommandApp/Program.cs
+++ b/CulinaryCommandApp/Program.cs
@@ -1,86 +1,150 @@
 using Microsoft.EntityFrameworkCore;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.AspNetCore.Authentication.Cookies;
+using Microsoft.AspNetCore.Authentication.OpenIdConnect;
+using Microsoft.IdentityModel.Protocols.OpenIdConnect;
 using CulinaryCommand.Data;
 using CulinaryCommand.Services;
 using CulinaryCommand.Inventory.Services;
 using CulinaryCommand.PurchaseOrder.Services;
+using CulinaryCommand.Components;
 using CulinaryCommand.Inventory;
 using CulinaryCommand.Inventory.Services.Interfaces;
-using System; // for Version, TimeSpan
-using System.Linq;
-using CulinaryCommand.Components; // for args.Any
-using Google.GenAI;
 using CulinaryCommandApp.AIDashboard.Services.Reporting;
+using Google.GenAI;
+using System;
+using CulinaryCommand.Services.UserContextSpace;
+using Amazon.CognitoIdentityProvider;
+using Amazon.Extensions.NETCore.Setup;
+using CulinaryCommandApp.Services;
 
 
-var builder = WebApplication.CreateBuilder(args);
 
+var builder = WebApplication.CreateBuilder(args);
 
-// FORCE EF to load your config when running "dotnet ef"
-// builder.Configuration.AddJsonFile("appsettings.json", optional: false, reloadOnChange: true);
-// builder.Configuration.AddJsonFile($"appsettings.{builder.Environment.EnvironmentName}.json", optional: true);
-
-// Add services to the container.
+//
+// =====================
+// UI
+// =====================
 builder.Services.AddRazorComponents()
     .AddInteractiveServerComponents();
 
-// Register Google GenAI client and AIReportingService so they can be injected.
-// The Client will pick up the GOOGLE_API_KEY from environment variables (set in deploy.yml).
+//
+// =====================
+// Cognito Authentication (MUST be before Build)
+// =====================
+// ===== Cognito Auth (OIDC) =====
+builder.Services
+  .AddAuthentication(options =>
+  {
+      options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
+      options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
+  })
+  .AddCookie()
+  .AddOpenIdConnect(options =>
+  {
+    options.SignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
+      var userPoolId = "us-east-2_SULe0c9vr";
+      var region = "us-east-2";
+
+      options.Authority = $"https://cognito-idp.{region}.amazonaws.com/{userPoolId}";
+      options.MetadataAddress = $"{options.Authority}/.well-known/openid-configuration";
+
+      options.ClientId = "55joip0viah9qtj7dndhvma2gt";
+      var cognitoClientId = builder.Configuration["Authentication:Cognito:ClientId"];
+        var cognitoSecretFromEnv = Environment.GetEnvironmentVariable("COGNITO_CLIENT_SECRET");
+        var cognitoSecretFromConfig = builder.Configuration["Authentication:Cognito:ClientSecret"];
+
+        var cognitoClientSecret =
+            !string.IsNullOrWhiteSpace(cognitoSecretFromEnv) ? cognitoSecretFromEnv :
+            cognitoSecretFromConfig;
+
+        options.ClientId = cognitoClientId;
+        options.ClientSecret = cognitoClientSecret;
+
+
+      options.ResponseType = OpenIdConnectResponseType.Code;
+      options.SaveTokens = true;
+
+      options.CallbackPath = "/signin-oidc";
+      options.SignedOutCallbackPath = "/signout-callback-oidc";
+
+      options.RequireHttpsMetadata = true; // keep true
+
+      options.Scope.Clear();
+      options.Scope.Add("openid");
+      options.Scope.Add("email");
+      options.Scope.Add("profile");
+
+      options.TokenValidationParameters.NameClaimType = "cognito:username";
+      options.TokenValidationParameters.RoleClaimType = "cognito:groups";
+  });
+
+builder.Services.AddAuthorization();
+
+//
+// =====================
+// AI Services
+// =====================
 builder.Services.AddSingleton<Client>(_ => new Client());
 builder.Services.AddScoped<AIReportingService>();
 
-// DB hookup
-// var conn = builder.Configuration.GetConnectionString("DefaultConnection");
-// if (string.IsNullOrWhiteSpace(conn))
+// var googleKey =
+//     Environment.GetEnvironmentVariable("GOOGLE_API_KEY")
+//     ?? builder.Configuration["Google:ApiKey"]; // optional appsettings slot
+
+// if (!string.IsNullOrWhiteSpace(googleKey))
 // {
-//     throw new InvalidOperationException("Missing connection string 'Default'. Set ConnectionStrings__Default via environment or config.");
+//     builder.Services.AddSingleton(_ => new Google.GenAI.Client(apiKey: googleKey));
+//     builder.Services.AddScoped<AIReportingService>();
+//     Console.WriteLine("✅ AI enabled (GOOGLE_API_KEY found).");
+// }
+// else
+// {
+//     Console.WriteLine("⚠️ GOOGLE_API_KEY not set; AI features disabled.");
+//     // Do NOT register AIReportingService at all.
 // }
-// Console.WriteLine("CONNECTION STRING FROM CONFIG:");
-// Console.WriteLine(conn);
-
 
-// builder.Services.AddDbContext<AppDbContext>(opt =>
-//     opt.UseMySql(conn, new MySqlServerVersion(new Version(8, 0, 36)),
-//         mySqlOptions => mySqlOptions.EnableRetryOnFailure()
-//     )
-// );
 
-// DB hookup
+//
+// =====================
+// Database
+// =====================
 var conn = builder.Configuration.GetConnectionString("DefaultConnection");
 if (string.IsNullOrWhiteSpace(conn))
 {
-    throw new InvalidOperationException("Missing connection string 'DefaultConnection'. Set ConnectionStrings__DefaultConnection via environment or config.");
+    throw new InvalidOperationException(
+        "Missing connection string 'DefaultConnection'");
 }
 
-// Mask password for logs (primarily for debugging in the Lightsail instance)
-string MaskPwd(string s)
-{
-    if (string.IsNullOrEmpty(s)) return s;
-    var parts = s.Split(';', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries);
-    for (int i = 0; i < parts.Length; i++)
-    {
-        if (parts[i].StartsWith("Pwd=", StringComparison.OrdinalIgnoreCase))
-            parts[i] = "Pwd=****";
-    }
-    return string.Join(';', parts);
-}
-Console.WriteLine($"[Startup] Using MySQL connection: {MaskPwd(conn)}");
-
 builder.Services.AddDbContext<AppDbContext>(opt =>
-    opt.UseMySql(conn, new MySqlServerVersion(new Version(8, 0, 36)), mySqlOpts =>
-    {
-        // Enable transient retry for RDS connectivity hiccups
-        mySqlOpts.EnableRetryOnFailure(maxRetryCount: 5, maxRetryDelay: TimeSpan.FromSeconds(10), errorNumbersToAdd: null);
-    }));
-
-// registers services with Scoped lifetime.
+    opt.UseMySql(
+        conn,
+        new MySqlServerVersion(new Version(8, 0, 36)),
+        mySqlOpts => mySqlOpts.EnableRetryOnFailure()
+    )
+);
+
+//
+// =====================
+// Application Services
+// =====================
+
+builder.Services.AddCascadingAuthenticationState();
+builder.Services.AddHttpContextAccessor();
 builder.Services.AddScoped<IUserService, UserService>();
-builder.Services.AddScoped<AuthService>();
+builder.Services.AddScoped<IUserContextService, UserContextService>();
+
+builder.Services.AddDefaultAWSOptions(builder.Configuration.GetAWSOptions());
+builder.Services.AddAWSService<IAmazonCognitoIdentityProvider>();
+builder.Services.AddScoped<CognitoProvisioningService>();
+
 builder.Services.AddScoped<RecipeService>();
 builder.Services.AddScoped<UnitService>();
 builder.Services.AddScoped<IngredientService>();
+builder.Services.AddScoped<IIngredientService, IngredientService>();
 builder.Services.AddScoped<ILocationService, LocationService>();
 builder.Services.AddScoped<LocationState>();
-builder.Services.AddScoped<IIngredientService, IngredientService>();
 builder.Services.AddScoped<ICompanyService, CompanyService>();
 builder.Services.AddScoped<IUnitService, UnitService>();
 builder.Services.AddScoped<IInventoryTransactionService, InventoryTransactionService>();
@@ -90,27 +154,37 @@ string MaskPwd(string s)
 builder.Services.AddScoped<IPurchaseOrderService, PurchaseOrderService>();
 builder.Services.AddSingleton<EnumService>();
 
+//
+// =====================
+// Build App
+// =====================
 var app = builder.Build();
 
 // Determine whether the app should only run migrations and exit
 var migrateOnly = (Environment.GetEnvironmentVariable("MIGRATE_ONLY")?.Equals("true", StringComparison.OrdinalIgnoreCase) == true)
                   || (args != null && args.Any(a => a.Equals("--migrate-only", StringComparison.OrdinalIgnoreCase)));
 
+//
+// =====================
 // Apply pending EF Core migrations at startup
+// =====================
 using (var scope = app.Services.CreateScope())
 {
     try
     {
-        var database = scope.ServiceProvider.GetRequiredService<AppDbContext>();
-        database.Database.Migrate();
+        var db = scope.ServiceProvider.GetRequiredService<AppDbContext>();
+        db.Database.Migrate();
     }
     catch (Exception ex)
     {
-        Console.WriteLine($"[Startup] Migration failed: {ex.GetType().Name} - {ex.Message}");
-        // Optionally: keep running without schema update; remove this catch to fail hard instead
+        Console.WriteLine($"[Startup] Migration warning: {ex.Message}");
     }
 }
 
+//
+// =====================
+// Middleware
+// =====================
 if (migrateOnly)
 {
     Console.WriteLine("[Startup] MIGRATE_ONLY set; exiting after applying migrations.");
@@ -127,10 +201,52 @@ string MaskPwd(string s)
 }
 
 // Temporarily disable HTTPS redirect for development
+
 app.UseStaticFiles();
 app.UseAntiforgery();
 
+app.UseAuthentication();
+app.UseAuthorization();
+  
+//
+// =====================
+// Routes
+// =====================
 app.MapRazorComponents<App>()
     .AddInteractiveServerRenderMode();
 
+app.MapGet("/health", () => "OK");
+
+var cognitoDomain = builder.Configuration["Authentication:Cognito:Domain"];
+var clientId = builder.Configuration["Authentication:Cognito:ClientId"];
+var callbackPath = builder.Configuration["Authentication:Cognito:CallbackPath"] ?? "/signin-oidc";
+var logoutCallbackPath = builder.Configuration["Authentication:Cognito:SignedOutCallbackPath"] ?? "/signout-callback-oidc";
+
+app.MapGet("/login", async (HttpContext ctx) =>
+{
+    await ctx.ChallengeAsync(
+        OpenIdConnectDefaults.AuthenticationScheme,
+        new AuthenticationProperties { RedirectUri = "/post-login" }
+    );
+});
+
+app.MapGet("/logout", async (HttpContext ctx, IConfiguration config) =>
+{
+    // Clear local cookie
+    await ctx.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
+
+    var domain = config["Authentication:Cognito:Domain"]!.TrimEnd('/');
+    var clientId = config["Authentication:Cognito:ClientId"]!;
+
+    var postLogout = $"{ctx.Request.Scheme}://{ctx.Request.Host}/"; // must match allowed sign-out URL
+
+    var url = $"{domain}/logout" +
+              $"?client_id={Uri.EscapeDataString(clientId)}" +
+              $"&logout_uri={Uri.EscapeDataString(postLogout)}";
+
+    return Results.Redirect(url);
+});
+
+
+
 app.Run();
diff --git a/CulinaryCommandApp/Services/AuthService.cs b/CulinaryCommandApp/Services/AuthService.cs
deleted file mode 100644
index d24908f..0000000
--- a/CulinaryCommandApp/Services/AuthService.cs
+++ /dev/null
@@ -1,264 +0,0 @@
-using System.Text.Json;
-using CulinaryCommand.Data;
-using CulinaryCommand.Data.Entities;
-using Microsoft.EntityFrameworkCore;
-using Microsoft.JSInterop;
-
-namespace CulinaryCommand.Services
-{
-    public class AuthService
-    {
-        private readonly IJSRuntime _js;
-        private readonly AppDbContext _context;
-        private bool _hydrated;
-
-        private readonly IServiceScopeFactory _scopeFactory;
-
-        public AuthService(IJSRuntime js, IServiceScopeFactory scopeFactory)
-        {
-            _js = js;
-            _scopeFactory = scopeFactory;
-
-            ManagedLocations = new List<Location>();
-            Locations = new List<string>();
-        }
-
-        public bool IsSignedIn { get; private set; }
-        public User? CurrentUser { get; private set; }
-
-        public string? UserEmail { get; private set; }
-        public int? UserId { get; private set; }
-        public string? UserRole { get; private set; }
-
-        public string? Company { get; private set; }
-        public string? CompanyCode { get; private set; }
-        public int? CompanyId { get; private set; }
-
-        public string? Location { get; private set; }
-        public int? ActiveLocationId { get; private set; }
-        public List<int>? LocationIds { get; private set; }
-
-        public List<string> Locations { get; private set; }
-        public List<Location> ManagedLocations { get; private set; }
-
-        public event Action? OnAuthStateChanged;
-        private void Raise() => OnAuthStateChanged?.Invoke();
-
-        /// <summary>
-        /// Ensure the auth state is hydrated from localStorage + DB.
-        /// Safe to call multiple times; only runs once.
-        /// </summary>
-        public async Task EnsureHydratedAsync()
-        {
-
-            if (_hydrated) return;
-
-            // Wait for JS/localStorage
-            for (int i = 0; i < 50; i++)
-            {
-                try
-                {
-                    var test = await _js.InvokeAsync<string?>("localStorage.getItem", "cc_email");
-                    if (test != null) break;
-                }
-                catch { }
-                await Task.Delay(50);
-            }
-
-            // Create fresh, thread-safe DbContext
-            using var scope = _scopeFactory.CreateScope();
-            var db = scope.ServiceProvider.GetRequiredService<AppDbContext>();
-
-            try
-            {
-                var idString = await _js.InvokeAsync<string?>("localStorage.getItem", "cc_userId");
-
-                if (!int.TryParse(idString, out var userId))
-                {
-                    IsSignedIn = false;
-                    CurrentUser = null;
-                    _hydrated = true;
-                    Raise();
-                    return;
-                }
-
-                var user = await db.Users
-                    .Include(u => u.Company)
-                    .Include(u => u.UserLocations).ThenInclude(ul => ul.Location)
-                    .Include(u => u.ManagerLocations).ThenInclude(ml => ml.Location)
-                    .FirstOrDefaultAsync(u => u.Id == userId);
-
-                if (user == null)
-                {
-                    IsSignedIn = false;
-                    CurrentUser = null;
-                    _hydrated = true;
-                    Raise();
-                    return;
-                }
-
-                await ApplyUserAsync(user, fromSignIn: false);
-                IsSignedIn = true;
-            }
-            catch (Exception ex)
-            {
-                Console.WriteLine($"Hydration error: {ex}");
-                IsSignedIn = false;
-                CurrentUser = null;
-            }
-            finally
-            {
-                _hydrated = true;
-                Raise();
-            }
-        }
-
-        /// <summary>
-        /// Called after a successful login or invite-activation.
-        /// </summary>
-        public async Task SignInAsync(User user)
-        {
-            await ApplyUserAsync(user, fromSignIn: true);
-            Raise();
-        }
-
-        private async Task ApplyUserAsync(User user, bool fromSignIn)
-        {
-            CurrentUser = user;
-
-            UserId = user.Id;
-            UserEmail = user.Email;
-            UserRole = user.Role;
-
-            CompanyId = user.CompanyId;
-            Company = user.Company?.Name;
-            CompanyCode = user.Company?.CompanyCode;
-
-            Locations = user.UserLocations?
-                .Select(ul => ul.Location.Name)
-                .Distinct()
-                .ToList() ?? new List<string>();
-
-            LocationIds = user.UserLocations?
-                .Select(ul => ul.LocationId)
-                .Distinct()
-                .ToList() ?? new List<int>();
-
-            // Admin: can see all locations in their company
-            if (user.Role == "Admin")
-            {
-                ManagedLocations = user.Company?.Locations?.ToList() ?? new List<Location>();
-            }
-            else
-            {
-                // Manager/Employee: locations assigned through UserLocations
-                ManagedLocations = user.UserLocations?
-                    .Select(ul => ul.Location)
-                    .Distinct()
-                    .ToList() ?? new List<Location>();
-            }
-
-            // Get active location from localStorage if present
-            var activeLocationIdStr = await _js.InvokeAsync<string?>("localStorage.getItem", "cc_activeLocationId");
-            if (int.TryParse(activeLocationIdStr, out var activeLocId) && (LocationIds?.Contains(activeLocId) ?? false))
-            {
-                ActiveLocationId = activeLocId;
-                Location = user.UserLocations
-                    .Where(ul => ul.LocationId == activeLocId)
-                    .Select(ul => ul.Location.Name)
-                    .FirstOrDefault();
-            }
-            else
-            {
-                ActiveLocationId = LocationIds?.FirstOrDefault();
-                Location = user.UserLocations
-                    .Select(ul => ul.Location.Name)
-                    .FirstOrDefault();
-            }
-
-            IsSignedIn = true;
-
-            // Only write to localStorage on sign-in / login-type actions
-            if (fromSignIn)
-            {
-                await _js.InvokeVoidAsync("localStorage.setItem", "cc_userId", UserId?.ToString() ?? "");
-                await _js.InvokeVoidAsync("localStorage.setItem", "cc_email", UserEmail ?? "");
-                await _js.InvokeVoidAsync("localStorage.setItem", "cc_role", UserRole ?? "");
-                await _js.InvokeVoidAsync("localStorage.setItem", "cc_company", Company ?? "");
-                await _js.InvokeVoidAsync("localStorage.setItem", "cc_companyCode", CompanyCode ?? "");
-                await _js.InvokeVoidAsync("localStorage.setItem", "cc_companyId", CompanyId?.ToString() ?? "");
-                await _js.InvokeVoidAsync("localStorage.setItem", "cc_locationIds",
-                    JsonSerializer.Serialize(LocationIds ?? new List<int>()));
-
-                await _js.InvokeVoidAsync("localStorage.setItem", "cc_activeLocationId",
-                    ActiveLocationId?.ToString() ?? "");
-                await _js.InvokeVoidAsync("localStorage.setItem", "cc_location", Location ?? "");
-            }
-        }
-
-        public async Task LogoutAsync()
-        {
-            CurrentUser = null;
-            UserEmail = null;
-            UserId = null;
-            UserRole = null;
-
-            Company = null;
-            CompanyCode = null;
-            CompanyId = null;
-
-            Location = null;
-            ActiveLocationId = null;
-            LocationIds = null;
-
-            Locations = new List<string>();
-            ManagedLocations = new List<Location>();
-
-            IsSignedIn = false;
-
-            await _js.InvokeVoidAsync("localStorage.removeItem", "cc_userId");
-            await _js.InvokeVoidAsync("localStorage.removeItem", "cc_email");
-            await _js.InvokeVoidAsync("localStorage.removeItem", "cc_role");
-            await _js.InvokeVoidAsync("localStorage.removeItem", "cc_company");
-            await _js.InvokeVoidAsync("localStorage.removeItem", "cc_companyCode");
-            await _js.InvokeVoidAsync("localStorage.removeItem", "cc_companyId");
-            await _js.InvokeVoidAsync("localStorage.removeItem", "cc_locationIds");
-            await _js.InvokeVoidAsync("localStorage.removeItem", "cc_activeLocationId");
-            await _js.InvokeVoidAsync("localStorage.removeItem", "cc_location");
-
-            _hydrated = false;
-            Raise();
-        }
-
-        public async Task<string?> GetUserIdStringAsync()
-        {
-            return await _js.InvokeAsync<string?>("localStorage.getItem", "cc_userId");
-        }
-
-        public async Task<bool> IsUserSignedInAsync()
-        {
-            var email = await _js.InvokeAsync<string?>("localStorage.getItem", "cc_email");
-            return !string.IsNullOrEmpty(email);
-        }
-
-        public async Task UpdateLocation(string newLoc)
-        {
-            Location = newLoc;
-            await _js.InvokeVoidAsync("localStorage.setItem", "cc_location", Location ?? "");
-            Raise();
-        }
-
-        public async Task UpdateActiveLocation(int newLocId)
-        {
-            ActiveLocationId = newLocId;
-            await _js.InvokeVoidAsync("localStorage.setItem", "cc_activeLocationId", newLocId.ToString());
-            Raise();
-        }
-
-        public async Task WaitForHydrationAsync()
-        {
-            if (_hydrated) return;
-            await EnsureHydratedAsync();
-        }
-    }
-}
\ No newline at end of file
diff --git a/CulinaryCommandApp/Services/CognitoProvisioningService.cs b/CulinaryCommandApp/Services/CognitoProvisioningService.cs
new file mode 100644
index 0000000..817b781
--- /dev/null
+++ b/CulinaryCommandApp/Services/CognitoProvisioningService.cs
@@ -0,0 +1,75 @@
+using Amazon.CognitoIdentityProvider;
+using Amazon.CognitoIdentityProvider.Model;
+
+namespace CulinaryCommandApp.Services;
+
+public class CognitoProvisioningService
+{
+    private readonly IAmazonCognitoIdentityProvider _cognito;
+    private readonly string _userPoolId;
+
+    public CognitoProvisioningService(IAmazonCognitoIdentityProvider cognito, IConfiguration config)
+    {
+        _cognito = cognito ?? throw new ArgumentNullException(nameof(cognito));
+        _userPoolId = config["Authentication:Cognito:UserPoolId"]
+            ?? throw new InvalidOperationException("Missing config: Authentication:Cognito:UserPoolId");
+    }
+
+    public async Task CreateUserWithPasswordAsync(string email, string displayName, string password)
+    {
+        if (string.IsNullOrWhiteSpace(email))
+            throw new ArgumentException("Email is required.", nameof(email));
+        if (string.IsNullOrWhiteSpace(password))
+            throw new ArgumentException("Password is required.", nameof(password));
+
+        var username = email.Trim().ToLowerInvariant();
+        var name = string.IsNullOrWhiteSpace(displayName) ? username : displayName.Trim();
+
+        try
+        {
+            await _cognito.AdminCreateUserAsync(new AdminCreateUserRequest
+            {
+                UserPoolId = _userPoolId,
+                Username = username,
+                MessageAction = "SUPPRESS",
+                UserAttributes = new List<AttributeType>
+                {
+                    new AttributeType { Name = "email", Value = username },
+                    new AttributeType { Name = "email_verified", Value = "true" },
+                    new AttributeType { Name = "name", Value = name }
+                }
+            });
+        }
+        catch (UsernameExistsException ex)
+        {
+            throw new InvalidOperationException($"A Cognito user with email '{username}' already exists.", ex);
+        }
+        catch (InvalidPasswordException ex)
+        {
+            throw new InvalidOperationException("Password does not meet the Cognito password policy.", ex);
+        }
+        catch (Exception ex)
+        {
+            throw new InvalidOperationException("Failed to create Cognito user.", ex);
+        }
+
+        try
+        {
+            await _cognito.AdminSetUserPasswordAsync(new AdminSetUserPasswordRequest
+            {
+                UserPoolId = _userPoolId,
+                Username = username,
+                Password = password,
+                Permanent = true
+            });
+        }
+        catch (InvalidPasswordException ex)
+        {
+            throw new InvalidOperationException("Password does not meet the Cognito password policy.", ex);
+        }
+        catch (Exception ex)
+        {
+            throw new InvalidOperationException("Cognito user was created, but setting the password failed.", ex);
+        }
+    }
+}
diff --git a/CulinaryCommandApp/Services/LocationState.cs b/CulinaryCommandApp/Services/LocationState.cs
index d3e3ede..06cfaaf 100644
--- a/CulinaryCommandApp/Services/LocationState.cs
+++ b/CulinaryCommandApp/Services/LocationState.cs
@@ -4,14 +4,6 @@
 
 namespace CulinaryCommand.Services
 {
-    /*
-     * This class holds the current location state of 
-     * the app, including the list of managed locations
-     * of the logged in user
-     *
-     *
-     *
-     */
     public class LocationState
     {
         private readonly IJSRuntime _js;
@@ -40,35 +32,50 @@ public async Task HydrateAsync()
                 NotifyStateChanged();
             }
         }
-
-        public async Task SetLocationsAsync(List<Location> locations)
+        public async Task SetLocationsAsync(List<Location>? locations)
         {
             ManagedLocations = locations ?? new List<Location>();
 
-            // Try to restore saved current location
-            var savedId = await _js.InvokeAsync<string?>("localStorage.getItem", "cc_activeLocationId");
+            // Try to restore saved current location (but JS may not be ready during prerender)
+            string? savedId = null;
+            try
+            {
+                savedId = await _js.InvokeAsync<string?>("localStorage.getItem", "cc_activeLocationId");
+            }
+            catch (InvalidOperationException)
+            {
+                // JS not available yet (prerender). We'll just pick a default for now.
+            }
 
-            if (int.TryParse(savedId, out int id))
+            if (int.TryParse(savedId, out var id))
             {
                 CurrentLocation = ManagedLocations.FirstOrDefault(l => l.Id == id);
             }
 
-            // Default to first if invalid
+            // Default to first if invalid or not found
             CurrentLocation ??= ManagedLocations.FirstOrDefault();
 
             OnChange?.Invoke();
         }
 
-        public async Task SetCurrentLocationAsync(Location loc)
+        public async Task SetCurrentLocationAsync(Location? loc)
         {
             CurrentLocation = loc;
 
-            // Persist to localStorage
-            await _js.InvokeVoidAsync("localStorage.setItem", "cc_activeLocationId", loc.Id);
+            try
+            {
+                if (loc is null)
+                    await _js.InvokeVoidAsync("localStorage.removeItem", "cc_activeLocationId");
+                else
+                    await _js.InvokeVoidAsync("localStorage.setItem", "cc_activeLocationId", loc.Id.ToString());
+            }
+            catch (InvalidOperationException)
+            {
+                // JS not available yet (prerender). It's fine; UI state still updates.
+            }
 
             // OnChange?.Invoke();
             NotifyStateChanged();
         }
     }
-
 }
diff --git a/CulinaryCommandApp/Services/UserContextSpace/IUserContextService.cs b/CulinaryCommandApp/Services/UserContextSpace/IUserContextService.cs
new file mode 100644
index 0000000..36135c7
--- /dev/null
+++ b/CulinaryCommandApp/Services/UserContextSpace/IUserContextService.cs
@@ -0,0 +1,7 @@
+namespace CulinaryCommand.Services.UserContextSpace;
+
+public interface IUserContextService
+{
+    Task<UserContext> GetAsync(CancellationToken ct = default);
+    Task<UserContext> RefreshAsync(CancellationToken ct = default);
+}
diff --git a/CulinaryCommandApp/Services/UserContextSpace/UserContext.cs b/CulinaryCommandApp/Services/UserContextSpace/UserContext.cs
new file mode 100644
index 0000000..515f368
--- /dev/null
+++ b/CulinaryCommandApp/Services/UserContextSpace/UserContext.cs
@@ -0,0 +1,16 @@
+using CulinaryCommand.Data.Entities;
+
+namespace CulinaryCommand.Services.UserContextSpace;
+
+public sealed class UserContext
+{
+    public bool IsAuthenticated { get; init; }
+    public string? Email { get; init; }
+    public string? CognitoSub { get; init; }
+
+    // Null => invite-only user not found in DB
+    public User? User { get; init; }
+
+    // Normalized list for LocationState/UI
+    public List<Location> AccessibleLocations { get; init; } = new();
+}
diff --git a/CulinaryCommandApp/Services/UserContextSpace/UserContextService.cs b/CulinaryCommandApp/Services/UserContextSpace/UserContextService.cs
new file mode 100644
index 0000000..ad8740d
--- /dev/null
+++ b/CulinaryCommandApp/Services/UserContextSpace/UserContextService.cs
@@ -0,0 +1,116 @@
+using System.Security.Claims;
+using CulinaryCommand.Data;
+using CulinaryCommand.Data.Entities;
+using Microsoft.EntityFrameworkCore;
+
+namespace CulinaryCommand.Services.UserContextSpace;
+
+public sealed class UserContextService : IUserContextService
+{
+    private readonly IHttpContextAccessor _http;
+    private readonly IServiceScopeFactory _scopeFactory;
+
+    private UserContext? _cached;
+
+    public UserContextService(IHttpContextAccessor http, IServiceScopeFactory scopeFactory)
+    {
+        _http = http;
+        _scopeFactory = scopeFactory;
+    }
+
+    public Task<UserContext> GetAsync(CancellationToken ct = default)
+        => _cached is not null ? Task.FromResult(_cached) : RefreshAsync(ct);
+
+    public async Task<UserContext> RefreshAsync(CancellationToken ct = default)
+    {
+        var principal = _http.HttpContext?.User;
+        var isAuth = principal?.Identity?.IsAuthenticated == true;
+
+        if (!isAuth || principal is null)
+        {
+            _cached = new UserContext { IsAuthenticated = false };
+            return _cached;
+        }
+
+        var email =
+            principal.FindFirstValue(ClaimTypes.Email) ??
+            principal.FindFirstValue("email");
+
+        var sub =
+            principal.FindFirstValue(ClaimTypes.NameIdentifier) ??
+            principal.FindFirstValue("sub");
+
+        if (string.IsNullOrWhiteSpace(email))
+        {
+            _cached = new UserContext { IsAuthenticated = true, Email = null, CognitoSub = sub, User = null };
+            return _cached;
+        }
+
+        using var scope = _scopeFactory.CreateScope();
+        var db = scope.ServiceProvider.GetRequiredService<AppDbContext>();
+
+        var user = await db.Users
+            .Include(u => u.Company)
+                .ThenInclude(c => c.Locations)
+            .Include(u => u.UserLocations)
+                .ThenInclude(ul => ul.Location)
+            .Include(u => u.ManagerLocations)
+                .ThenInclude(ml => ml.Location)
+            .FirstOrDefaultAsync(u => u.Email == email, ct);
+
+        if (user is null)
+        {
+            _cached = new UserContext
+            {
+                IsAuthenticated = true,
+                Email = email,
+                CognitoSub = sub,
+                User = null
+            };
+            return _cached;
+        }
+
+        List<Location> accessibleLocations;
+
+        if (user.Role == "Admin")
+        {
+            accessibleLocations = user.Company?.Locations?.ToList() ?? new();
+        }
+        else if (user.Role == "Manager")
+        {
+            accessibleLocations = user.ManagerLocations?
+                .Select(x => x.Location)
+                .Distinct()
+                .ToList()
+                ?? new();
+
+            if (accessibleLocations.Count == 0)
+            {
+                accessibleLocations = user.UserLocations?
+                    .Select(x => x.Location)
+                    .Distinct()
+                    .ToList()
+                    ?? new();
+            }
+        }
+        else
+        {
+            accessibleLocations = user.UserLocations?
+                .Select(x => x.Location)
+                .Distinct()
+                .ToList()
+                ?? new();
+        }
+
+        _cached = new UserContext
+        {
+            IsAuthenticated = true,
+            Email = email,
+            CognitoSub = sub,
+            User = user,
+            AccessibleLocations = accessibleLocations
+        };
+
+        return _cached;
+    }
+}
diff --git a/CulinaryCommandApp/Services/UserService.cs b/CulinaryCommandApp/Services/UserService.cs
index 8ccfcec..cd031cf 100644
--- a/CulinaryCommandApp/Services/UserService.cs
+++ b/CulinaryCommandApp/Services/UserService.cs
@@ -4,6 +4,7 @@
 using System.Security.Cryptography;
 using Microsoft.AspNetCore.Identity;
 using CulinaryCommand.Models;
+using CulinaryCommandApp.Services;
 
 namespace CulinaryCommand.Services
 {
@@ -35,12 +36,14 @@ public class UserService : IUserService
         private readonly PasswordHasher<User> _passwordHasher = new();
         private readonly AppDbContext _context;
         private readonly IEmailSender _emailSender;
+        private readonly CognitoProvisioningService _cognito;
 
 
-        public UserService(AppDbContext context, IEmailSender emailSender)
+        public UserService(AppDbContext context, IEmailSender emailSender, CognitoProvisioningService cognito)
         {
             _context = context;
             _emailSender = emailSender;
+            _cognito = cognito;
         }
 
         public async Task<User> CreateUserAsync(User user)
@@ -255,80 +258,119 @@ private string LegacySha256(string input)
 
         public async Task<User> CreateAdminWithCompanyAndLocationAsync(SignupRequest req)
         {
-            if (req == null) throw new ArgumentNullException(nameof(req));
-            if (req.Admin == null) throw new Exception("Admin information is required.");
+            if (req?.Admin == null) throw new Exception("Admin information is required.");
             if (req.Company == null) throw new Exception("Company information is required.");
-            if (req.Location == null) throw new Exception("Location information is required.");
+            if (req.Locations == null || req.Locations.Count == 0) throw new Exception("At least one location is required.");
 
-            // Check if email already exists
-            if (await _context.Users.AnyAsync(u => u.Email == req.Admin.Email))
+            var email = req.Admin.Email.Trim().ToLowerInvariant();
+
+            if (await _context.Users.AnyAsync(u => u.Email == email))
                 throw new Exception("A user with this email already exists.");
 
-            // 1) Create Company
-            var company = new Company
+            var strategy = _context.Database.CreateExecutionStrategy();
+
+            return await strategy.ExecuteAsync(async () =>
             {
-                Name = req.Company.Name,
-                CompanyCode = req.Company.CompanyCode,
-                Address = req.Company.Address,
-                City = req.Company.City,
-                State = req.Company.State,
-                ZipCode = req.Company.ZipCode,
-                Phone = req.Company.Phone,
-                Email = req.Company.Email,
-                Description = req.Company.Description,
-                LLCName = req.Company.LLCName,
-                TaxId = req.Company.TaxId,
-                CreatedAt = DateTime.UtcNow,
-                UpdatedAt = DateTime.UtcNow
-            };
+                await using var tx = await _context.Database.BeginTransactionAsync();
 
-            _context.Companies.Add(company);
-            await _context.SaveChangesAsync();
+                try
+                {
+                    var company = new Company
+                    {
+                        Name = req.Company.Name.Trim(),
+                        CompanyCode = GenerateCompanyCode(req.Company.Name),
+                        Address = req.Company.Address,
+                        City = req.Company.City,
+                        State = req.Company.State,
+                        ZipCode = req.Company.ZipCode,
+                        Phone = req.Company.Phone,
+                        Email = req.Company.Email,
+                        Description = req.Company.Description,
+                        LLCName = req.Company.LLCName,
+                        TaxId = req.Company.TaxId,
+                        CreatedAt = DateTime.UtcNow,
+                        UpdatedAt = DateTime.UtcNow
+                    };
+
+                    _context.Companies.Add(company);
+                    await _context.SaveChangesAsync();
+
+                    var createdLocations = new List<Location>();
+
+                    foreach (var loc in req.Locations)
+                    {
+                        var location = new Location
+                        {
+                            Name = loc.Name.Trim(),
+                            Address = loc.Address.Trim(),
+                            City = loc.City.Trim(),
+                            State = loc.State.Trim(),
+                            ZipCode = loc.ZipCode.Trim(),
+                            MarginEdgeKey = loc.MarginEdgeKey,
+                            CompanyId = company.Id
+                        };
+
+                        _context.Locations.Add(location);
+                        createdLocations.Add(location);
+                    }
 
-            // 2) Create Location
-            var location = new Location
-            {
-                Name = req.Company.Name,
-                Address = req.Company.Address,
-                City = req.Company.City,
-                State = req.Company.State,
-                ZipCode = req.Company.ZipCode,
-                MarginEdgeKey = req.Location.MarginEdgeKey,
-                CompanyId = company.Id
-            };
+                    await _context.SaveChangesAsync();
 
-            _context.Locations.Add(location);
-            await _context.SaveChangesAsync();
+                    var admin = new User
+                    {
+                        Name = req.Admin.Name?.Trim(),
+                        Email = email,
+                        Password = HashPassword(req.Admin.Password),
+                        Phone = req.Admin.Phone,
+                        Role = "Admin",
+                        CompanyId = company.Id,
+                        CreatedAt = DateTime.UtcNow,
+                        UpdatedAt = DateTime.UtcNow,
+                        IsActive = true,
+                        EmailConfirmed = true
+                    };
+
+                    _context.Users.Add(admin);
+                    await _context.SaveChangesAsync();
+
+                    foreach (var loc in createdLocations)
+                    {
+                        _context.UserLocations.Add(new UserLocation
+                        {
+                            UserId = admin.Id,
+                            LocationId = loc.Id
+                        });
+                    }
 
-            // 3) Create Admin User
-            var admin = new User
-            {
-                Name = req.Admin.Name,
-                Email = req.Admin.Email,
-                Password = HashPassword(req.Admin.Password),
-                Phone = req.Admin.Phone,
-                Role = "Admin",
-                CompanyId = company.Id,
-                CreatedAt = DateTime.UtcNow,
-                UpdatedAt = DateTime.UtcNow
-            };
+                    await _context.SaveChangesAsync();
 
-            _context.Users.Add(admin);
-            await _context.SaveChangesAsync();
+                    // NOTE: if this throws, the DB transaction will roll back.
+                    await _cognito.CreateUserWithPasswordAsync(email, admin.Name ?? email, req.Admin.Password);
+
+                    await tx.CommitAsync();
+                    return admin;
+                }
+                catch
+                {
+                    await tx.RollbackAsync();
+                    throw;
+                }
+            });
+        }
 
-            // 4) Link Admin to Location (UserLocation table)
-            var link = new UserLocation
-            {
-                UserId = admin.Id,
-                LocationId = location.Id
-            };
 
-            _context.UserLocations.Add(link);
-            await _context.SaveChangesAsync();
 
-            return admin;
+        private static string GenerateCompanyCode(string companyName)
+        {
+            var cleaned = new string(companyName.Where(char.IsLetterOrDigit).ToArray()).ToUpperInvariant();
+            if (cleaned.Length > 8) cleaned = cleaned[..8];
+            if (cleaned.Length < 4) cleaned = cleaned.PadRight(4, 'X');
+
+            var suffix = RandomNumberGenerator.GetInt32(1000, 9999);
+            return $"{cleaned}{suffix}";
         }
 
+
         public async Task<User> CreateInvitedUserForLocationAsync(CreateUserForLocationRequest request, int companyId, int createdByUserId)
         {
             // normalize email
diff --git a/CulinaryCommandApp/appsettings.json b/CulinaryCommandApp/appsettings.json
index db25040..e9cfc53 100644
--- a/CulinaryCommandApp/appsettings.json
+++ b/CulinaryCommandApp/appsettings.json
@@ -8,5 +8,9 @@
       "Microsoft.AspNetCore": "Warning"
     }
   },
+  "environmentVariables": {
+    "ASPNETCORE_ENVIRONMENT": "Development",
+    "COGNITO_CLIENT_SECRET": "q1t4knmg3no7c12ab238a6ef426tkrdn9phsragac7l12ntk3gt"
+  },
   "AllowedHosts": "*"
 }
diff --git a/CulinaryCommandApp/wwwroot/css/landing.css b/CulinaryCommandApp/wwwroot/css/landing.css
new file mode 100644
index 0000000..6a35590
--- /dev/null
+++ b/CulinaryCommandApp/wwwroot/css/landing.css
@@ -0,0 +1,65 @@
+/* Clean public landing layout */
+.cc-landing {
+    min-height: calc(100vh - 0px);
+    display: grid;
+    place-items: center;
+    padding: 2.5rem 1rem;
+    background:
+      radial-gradient(1200px 600px at 20% 10%, rgba(25, 135, 84, 0.12), transparent 60%),
+      radial-gradient(900px 500px at 80% 20%, rgba(25, 135, 84, 0.08), transparent 55%),
+      linear-gradient(to bottom, #fafafa, #ffffff);
+  }
+  
+  .cc-landing-card {
+    width: 100%;
+    max-width: 560px;
+    background: #fff;
+    border: 1px solid rgba(0,0,0,.08);
+    border-radius: 18px;
+    padding: 2rem 2rem 1.5rem;
+    box-shadow: 0 18px 40px rgba(0, 0, 0, 0.08);
+  }
+  
+  .cc-landing-header {
+    text-align: center;
+    margin-bottom: 1.5rem;
+  }
+  
+  .cc-landing-badge {
+    width: 56px;
+    height: 56px;
+    margin: 0 auto 0.75rem;
+    border-radius: 14px;
+    display: grid;
+    place-items: center;
+    background: rgba(25, 135, 84, 0.12);
+    color: #198754;
+    font-size: 1.6rem;
+  }
+  
+  .cc-landing-title {
+    margin: 0;
+    font-size: 2.25rem;
+    font-weight: 800;
+    letter-spacing: -0.02em;
+  }
+  
+  .cc-landing-subtitle {
+    margin: 0.35rem auto 0;
+    max-width: 44ch;
+    color: rgba(0,0,0,.65);
+    font-size: 1.05rem;
+    line-height: 1.4;
+  }
+  
+  .cc-landing-actions {
+    display: grid;
+    gap: 0.75rem;
+    margin-top: 1.25rem;
+  }
+  
+  .cc-landing-footer {
+    margin-top: 1.25rem;
+    text-align: center;
+  }
+  
\ No newline at end of file
