diff --git a/rbac/check_perm.py b/rbac/check_perm.py
index 8e81b11..9b6c6c7 100644
--- a/rbac/check_perm.py
+++ b/rbac/check_perm.py
@@ -40,13 +40,13 @@ def get_apikey_from_token(token):
 	except:
 		return None
 
-async def get_user_roles():
-	userid = await get_user()
+async def get_user_roles(userid):
 	sql = "select b.name from userrole a, role b where a.userid=${userid}$ and a.roleid = b.id"
 	db = DBPools()
 	roles = []
+	dbname = await get_dbname()
 	async with db.sqlorContext(dbname) as sor:
-		recs = sor.sqlExe(sql, {'userid':userid})
+		recs = await sor.sqlExe(sql, {'userid':userid})
 		if len(recs) < 1:
 			return roles
 		for r in recs:
@@ -115,15 +115,15 @@ async def getAuthenticationUserid(sor, request):
 			return None
 		return recs[0].userid
 	
-async def objcheckperm(obj, userid, path, request):
+async def objcheckperm(obj, request, userid, path):
+	debug(f'check permission: {userid=}, {path=}')
 	sql = """select distinct a.*, c.userid from
-(select id, path from permission where path=${path}$ and del_flg='0') a
+(select id, path from permission where path=${path}$) a
 right join
 	rolepermission b on a.id = b.permid
 right join userrole c on b.roleid = c.roleid
 where c.userid = ${userid}$
-and b.del_flg='0'
-and c.del_flg='0'"""
+"""
 
 	rf = RegisterFunction()
 	dbname = await rf.exe('get_module_dbname', 'rbac')
@@ -134,7 +134,7 @@ and c.del_flg='0'"""
 			debug(f'{path=} not found in permission, can access')
 			return True
 		if userid is None:
-			userid = await getAPIkeyUserid(sor, request)
+			userid = await getAuthenticationUserid(sor, request)
 		if userid is None:
 			debug(f'{userid=} is None, can not access {path=}')
 			return False
diff --git a/script/init.py b/script/init.py
index 75851b2..fa200f6 100644
--- a/script/init.py
+++ b/script/init.py
@@ -1,5 +1,7 @@
 import os
 import sys
+import argparse
+
 from traceback import format_exc
 import asyncio
 from appPublic.uniqueID import getID
@@ -10,6 +12,7 @@ from appPublic.folderUtils import listFile
 from appPublic.registerfunction import RegisterFunction
 
 from sqlor.dbpools import DBPools
+from rbac.check_perm import mypassword
 databases = {
 		"sage":{
 			"driver":"aiomysql",
@@ -38,6 +41,8 @@ async def insert_perm(path):
 av_folders = [
 	'/index.ui',
 	'/user.ui',
+	'/menu.ui',
+	'/get_code.dspy',
 	'/top.ui',
 	'/center',
 	'/bottom.ui',
@@ -64,6 +69,7 @@ rbac_tables = [
 	
 role_perms = {
 	'superuser': [
+		'/get_code.dspy',
 		'/rbac/add_adminuser.ui',
 		'/rbac/add_adminuser.dspy',
 		'/rbac/role/index.ui',
@@ -96,17 +102,19 @@ role_perms = {
 	]
 }
 
-async def init_perms(sor):
-	for rn, pths in role_perms.items():
-		roles = await sor.sqlExe('select * from role where name=${rn}$', {'rn':rn})
-		if len(roles) == 0:
-			continue
-		for p in pths:
-			perms = await sor.sqlExe('select * from permission where path=${p}$', {'p':p})
-			if len(perms):
-				await sor.C('rolepermission', {'id':getID(), 
-							'roleid':roles[0].id,
-							'permid':perms[0].id})
+async def init_perms():
+	db = DBPools()
+	async with db.sqlorContext('sage') as sor:
+		for rn, pths in role_perms.items():
+			roles = await sor.sqlExe('select * from role where name=${rn}$', {'rn':rn})
+			if len(roles) == 0:
+				continue
+			for p in pths:
+				perms = await sor.sqlExe('select * from permission where path=${p}$', {'p':p})
+				if len(perms):
+					await sor.C('rolepermission', {'id':getID(), 
+								'roleid':roles[0].id,
+								'permid':perms[0].id})
 	
 async def init_rbac(passwd):
 	db = DBPools()
@@ -137,10 +145,9 @@ async def init_rbac(passwd):
 			'roleid':roleid
 		}
 		await sor.C('userrole', ns1)
-		await init_perms(sor)
 
-async def add_permissions():
-	root = os.path.abspath('../wwwroot')
+async def add_permissions(workdir):
+	root = os.path.join(workdir, 'wwwroot')
 	for f in listFile(root, rescursive=True):
 		cnt = len(root)
 		pth = f[cnt:]
@@ -153,14 +160,22 @@ async def add_permissions():
 		if act:
 			await insert_perm(pth)
 
-async def main(passwd):
-	await add_permissions()
+async def main(workdir, passwd):
+	await add_permissions(workdir)
 	await init_rbac(passwd)
-if __name__ == '__main__':
-	if len(sys.argv) < 2:
-		print(f'Usage:\n{sys.argv[0]} super_user_passwd\n')
-		sys.exit(1)
-	supassword = sys.argv[1]
-	DBPools(databases)
-	asyncio.get_event_loop().run_until_complete(main(supassword))
+	await init_perms()
+
+if __name__ == '__main__':
+	parser = argparse.ArgumentParser(prog='RBAC init')
+	parser.add_argument('-w', '--workdir')
+	parser.add_argument('password')
+	args = parser.parse_args()
+	if args.password is None:
+		parser.usage()
+		sys.exit(1)
+	print(f'{args=}')
+	config = getConfig(args.workdir, {'workdir':args.workdir})
+	supassword = mypassword(args.password)
+	DBPools(config.databases)
+	asyncio.get_event_loop().run_until_complete(main(args.workdir, supassword))
 
diff --git a/wwwroot/userpassword_login.dspy b/wwwroot/userpassword_login.dspy
index 89386c2..883e3f0 100644
--- a/wwwroot/userpassword_login.dspy
+++ b/wwwroot/userpassword_login.dspy
@@ -1,11 +1,11 @@
 username = params_kw.get('username')
-passwd = params_kw.get('password')
+passwd = params_kw.get('passwd')
 if not passwd:
-	return Error(title='Login failed', message='Password is required')
+	return UiError(title='Login failed', message='Password is required')
 passwd = password(passwd)
-rzt = await check_user_password(username, passwd):
+rzt = await check_user_password(request, username, passwd)
 if rzt:
-	return Message(title='Logined', message=f'Welcome back {get_usernme()}')
-return Error(title='login failed', message='user and password mismatch')
+	return UiMessage(title='Logined', message=f'Welcome back ')
+return UiError(title='login failed', message='user and password mismatch')
 	
 		
diff --git a/wwwroot/userpassword_login.ui b/wwwroot/userpassword_login.ui
index 57debd7..e8933ad 100644
--- a/wwwroot/userpassword_login.ui
+++ b/wwwroot/userpassword_login.ui
@@ -4,8 +4,8 @@
     "options":{
         "auto_open":true,
         "anthor":"cc",
-        "width":"70%",
-        "height":"70%"
+        "cwidth":20,
+        "cheight":"14"
     },
     "subwidgets":[
 		{