diff --git a/app/contact/api/engine/manage_contact.php b/app/contact/api/engine/manage_contact.php
index d9dfb25..76a4f3a 100644
--- a/app/contact/api/engine/manage_contact.php
+++ b/app/contact/api/engine/manage_contact.php
@@ -4,6 +4,8 @@
     require '../../../assets/utils/classes/FileUploader.php';
     require '../../../assets/utils/classes/ContactManager.php';
 
+    require_role($user_role, ['owner', 'admin', 'staff']);
+
     $id = (int)$data['id'];
 
     try {
diff --git a/app/contact/api/engine/manage_contact_type.php b/app/contact/api/engine/manage_contact_type.php
index 7b2663e..f24ac5c 100644
--- a/app/contact/api/engine/manage_contact_type.php
+++ b/app/contact/api/engine/manage_contact_type.php
@@ -3,6 +3,8 @@
     require '../../../assets/utils/db_auth.php';
     require '../../../assets/utils/classes/ContactManager.php';
 
+    require_role($user_role, ['owner', 'admin']);
+
     try {
         dbTransaction($pdo2, function($pdo) use ($data, $company_id, $logging) {
             $contact = new ContactManager($pdo, $company_id);
diff --git a/app/contact/api/engine/remove_contact.php b/app/contact/api/engine/remove_contact.php
index 28dc3c9..7f82c3a 100644
--- a/app/contact/api/engine/remove_contact.php
+++ b/app/contact/api/engine/remove_contact.php
@@ -3,6 +3,8 @@
     require '../../../assets/utils/db_auth.php';
     require '../../../assets/utils/classes/ContactManager.php';
 
+    require_role($user_role, ['owner', 'admin']);
+
     try {
 
         dbTransaction($pdo2, function($pdo) use ($data, $company_id) {
diff --git a/app/contact/api/engine/remove_contact_type.php b/app/contact/api/engine/remove_contact_type.php
index 6e89e9e..593120d 100644
--- a/app/contact/api/engine/remove_contact_type.php
+++ b/app/contact/api/engine/remove_contact_type.php
@@ -3,6 +3,8 @@
     require '../../../assets/utils/db_auth.php';
     require '../../../assets/utils/classes/ContactManager.php';
 
+    require_role($user_role, ['owner', 'admin']);
+
     try {
 
         dbTransaction($pdo2, function($pdo) use ($data, $company_id) {
diff --git a/app/ics/api/engine/approve_stock.php b/app/ics/api/engine/approve_stock.php
index 5077cf5..3c11df8 100644
--- a/app/ics/api/engine/approve_stock.php
+++ b/app/ics/api/engine/approve_stock.php
@@ -16,6 +16,8 @@ require '../../../assets/utils/db_auth.php';
 require '../../../assets/utils/classes/StockManager.php';
 require '../../../assets/utils/classes/WarehouseManager.php';
 
+require_role($user_role, ['owner', 'admin']);
+
 $id           = (int)($data['id']        ?? 0);
 $warehouse_id = (int)($data['warehouse'] ?? 0);
 $type         = $data['type'] ?? '';
diff --git a/app/ics/api/engine/delete_stock_in.php b/app/ics/api/engine/delete_stock_in.php
index d4e2bbb..33ab892 100644
--- a/app/ics/api/engine/delete_stock_in.php
+++ b/app/ics/api/engine/delete_stock_in.php
@@ -3,6 +3,8 @@
     require '../../../assets/utils/db_auth.php';
     require '../../../assets/utils/classes/WarehouseManager.php';
 
+    require_role($user_role, ['owner', 'admin']);
+
     try {
 
         dbTransaction($pdo2, function($pdo) use ($data, $company_id) {
diff --git a/app/ics/api/engine/delete_stock_out.php b/app/ics/api/engine/delete_stock_out.php
index 2f19b97..9b0d720 100644
--- a/app/ics/api/engine/delete_stock_out.php
+++ b/app/ics/api/engine/delete_stock_out.php
@@ -3,6 +3,8 @@
     require '../../../assets/utils/db_auth.php';
     require '../../../assets/utils/classes/WarehouseManager.php';
 
+    require_role($user_role, ['owner', 'admin']);
+
     try {
 
         dbTransaction($pdo2, function($pdo) use ($data, $company_id) {
diff --git a/app/ics/api/engine/delete_stock_transfer.php b/app/ics/api/engine/delete_stock_transfer.php
index c211a84..a14bb3c 100644
--- a/app/ics/api/engine/delete_stock_transfer.php
+++ b/app/ics/api/engine/delete_stock_transfer.php
@@ -3,6 +3,8 @@
     require '../../../assets/utils/db_auth.php';
     require '../../../assets/utils/classes/WarehouseManager.php';
 
+    require_role($user_role, ['owner', 'admin']);
+
     try {
 
         dbTransaction($pdo2, function($pdo) use ($data, $company_id) {
diff --git a/app/include_ending.php b/app/include_ending.php
index 547ed39..dcfcce6 100644
--- a/app/include_ending.php
+++ b/app/include_ending.php
@@ -1,7 +1,7 @@
 <div class="row">
     <div class="col-12">
         <footer class="text-center py-2 mt-6 text-secondary ">
-        <p class="mb-0">Copyright © 2026 InApp Inventory Dashboard. Developed by <a href="https://codescandy.com/"
+        <p class="mb-0">Copyright © 2026 TRx WMS. Developed by <a href="https://codescandy.com/"
             target="_blank" class="text-primary">CodesCandy</a> </p>
         </footer>
     </div>
diff --git a/app/inventory/api/engine/manager.php b/app/inventory/api/engine/manager.php
index c85d5ad..bbbbca7 100644
--- a/app/inventory/api/engine/manager.php
+++ b/app/inventory/api/engine/manager.php
@@ -1,17 +1,21 @@
-<?php 
+<?php
     session_start();
-
     require '../../../assets/utils/db_auth.php';
 
-    $sql = "SELECT * 
-        FROM user
-        WHERE 
-            username not in ('support','extra')";
-    $sth = $pdo1->query($sql);
+    require_role($user_role, ['owner', 'admin']);
+
+    $sth = $pdo1->prepare(
+        "SELECT u.user_id, u.name, u.surname, u.email
+         FROM user u
+         INNER JOIN company_map_user m
+            ON m.user_id = u.user_id
+           AND m.company_id = :company_id
+         ORDER BY u.name ASC"
+    );
+    $sth->execute([':company_id' => $company_id]);
     db_check($sth, $answer);
 
-    $answer["output"] = $sth->fetchAll(PDO::FETCH_ASSOC);
-    $answer["success"] = 1;
+    $answer['output']  = $sth->fetchAll(PDO::FETCH_ASSOC);
+    $answer['success'] = 1;
     exit(json_encode($answer));
-
-?>
\ No newline at end of file
+?>
diff --git a/app/setting/api/engine/manage_company.php b/app/setting/api/engine/manage_company.php
index 7017cb5..a0ebbca 100644
--- a/app/setting/api/engine/manage_company.php
+++ b/app/setting/api/engine/manage_company.php
@@ -3,6 +3,8 @@
     require '../../../assets/utils/db_auth.php';
     require '../../../assets/utils/classes/FileUploader.php';
 
+    require_role($user_role, ['owner', 'admin']);
+
     // ─── Allowed upload MIME types ────────────────────────────────────────────
     const ALLOWED_MIME = ['image/jpeg', 'image/png', 'image/gif', 'image/webp'];
     const MAX_SIZE     = 2 * 1024 * 1024; // 2 MB
diff --git a/app/setting/api/engine/manage_smtp.php b/app/setting/api/engine/manage_smtp.php
index c77f9ee..614a39b 100644
--- a/app/setting/api/engine/manage_smtp.php
+++ b/app/setting/api/engine/manage_smtp.php
@@ -2,20 +2,7 @@
     session_start();
     require '../../../assets/utils/db_auth.php';
 
-    // ─── Role guard: only owner/admin ────────────────────────────────────────
-    $sth = $pdo1->prepare("
-        SELECT role FROM company_map_user
-        WHERE company_id = :company_id AND user_id = :user_id
-        LIMIT 1
-    ");
-    $sth->execute([':company_id' => $company_id, ':user_id' => $user_id]);
-    db_check($sth, $answer);
-
-    if (!in_array($sth->fetchColumn(), ['owner', 'admin'], true)) {
-        $answer['message'] = 'You do not have permission to change SMTP settings.';
-        http_response_code(403);
-        exit(json_encode($answer));
-    }
+    require_role($user_role, ['owner', 'admin']);
 
     // ─── Encrypt password — same method/key/iv as config.php ─────────────────
     function encrypt_password(string $plain): string {
diff --git a/app/setting/api/engine/test_smtp.php b/app/setting/api/engine/test_smtp.php
index 4c9bdee..edd5802 100644
--- a/app/setting/api/engine/test_smtp.php
+++ b/app/setting/api/engine/test_smtp.php
@@ -2,6 +2,8 @@
     session_start();
     require '../../../assets/utils/db_auth.php';
 
+    require_role($user_role, ['owner', 'admin']);
+
     try {
 
         $to = trim($data['test_email'] ?? '');