diff --git a/ayanova/devdocs/todo.txt b/ayanova/devdocs/todo.txt
index 997918c2..a5e365b8 100644
--- a/ayanova/devdocs/todo.txt
+++ b/ayanova/devdocs/todo.txt
@@ -41,7 +41,11 @@ All platforms and browsers
 			- DONE Make about contextual and insert a menu item to view log		
 		- DONE WIRE up save menu item and add code to disable save on broken rules (and make red, disabled etc)
 		- DONE Move wire up event code from app.vue to gzmenu and call it from app.vue
-		- Need rights in form state so can easily enable / disable etc
+###		- Need rights in form state so can easily enable / disable etc
+			- BIG TODO: it would be far nicer if rights to objects were stored in a single JSON fragment that could be easily copied into javascript and c# 
+				- code automatically builds rights collection from json fragment so can use it between both projects and more easily update it in one central spot
+				- Get that working then come back to the rest of the rights in client side
+			- Need to create sample users in server project that have all the different widget right combinations for testing purposes
 		- Wire up delete menu item
 			- api code is stubbed out for delete, need to write that as well
 		- DONE TODO navigating through menu doesn't "back" properly when clicking back on browser controls
diff --git a/ayanova/src/api/authorizationroles.js b/ayanova/src/api/authorizationroles.js
new file mode 100644
index 00000000..3ef2a878
--- /dev/null
+++ b/ayanova/src/api/authorizationroles.js
@@ -0,0 +1,90 @@
+import store from "../store";
+import ayatype from "./ayatype";
+export default {
+  AUTHORIZATION_ROLES: {
+    ///<summary>No role set</summary>
+    NoRole: 0,
+    ///<summary>BizAdminLimited</summary>
+    BizAdminLimited: 1,
+    ///<summary>BizAdminFull</summary>
+    BizAdminFull: 2,
+    ///<summary>DispatchLimited</summary>
+    DispatchLimited: 4,
+    ///<summary>DispatchFull</summary>
+    DispatchFull: 8,
+    ///<summary>InventoryLimited</summary>
+    InventoryLimited: 16,
+    ///<summary>InventoryFull</summary>
+    InventoryFull: 32,
+    ///<summary>AccountingFull</summary>
+    AccountingFull: 64, //No limited role, not sure if there is a need
+    ///<summary>TechLimited</summary>
+    TechLimited: 128,
+    ///<summary>TechFull</summary>
+    TechFull: 256,
+    ///<summary>SubContractorLimited</summary>
+    SubContractorLimited: 512,
+    ///<summary>SubContractorFull</summary>
+    SubContractorFull: 1024,
+    ///<summary>ClientLimited</summary>
+    ClientLimited: 2048,
+    ///<summary>ClientFull</summary>
+    ClientFull: 4096,
+    ///<summary>OpsAdminLimited</summary>
+    OpsAdminLimited: 8192,
+    ///<summary>OpsAdminFull</summary>
+    OpsAdminFull: 16384
+  },
+  hasRole(role) {
+    if (!store.state.roles || store.state.roles === 0) {
+      return false;
+    }
+    return role === (store.state.roles & role);
+  },
+  rights(objType, objId) {
+    //NOTE: this is to mirror the functionality of BizRoles.cs where all rights by role are specified in server project
+    //any change there needs to be mirrored here
+
+    //from bizroles.cs:
+    //HOW THIS WORKS / WHATS EXPECTED
+    //Change = CREATE, RETRIEVE, UPDATE, DELETE - Full rights
+    //EditOwn = special subset of CHANGE: You can create and if it's one you created then you have rights to edit it or delete, but you can't edit ones others have created
+    //ReadFullRecord = You can read *all* the fields of the record, but can't modify it. Change is automatically checked for so only add different roles from change
+    //PICKLIST NOTE: this does not control getting a list of names for selection which is role independent because it's required for so much indirectly
+    //DELETE = There is no specific delete right for now though it's checked for by routes in Authorized.cs in case we want to add it in future as a separate right from create.
+
+    //TODO: get this working, then decompose it into several files to make it cleaner
+    var ret = {
+      change: false,
+      editOwn: false,
+      readFull: false,
+      delete: false
+    };
+
+    switch (objType) {
+      case ayatype.Widget:
+        //WIDGET
+        //  Change = AuthorizationRoles.BizAdminFull | AuthorizationRoles.InventoryFull,
+        //  EditOwn = AuthorizationRoles.TechFull,
+        //  ReadFullRecord = AuthorizationRoles.BizAdminLimited | AuthorizationRoles.InventoryLimited
+        ret.change =
+          this.hasrole(this.AUTHORIZATION_ROLES.BizAdminFull) ||
+          this.hasrole(this.AUTHORIZATION_ROLES.InventoryFull);
+        ret.editOwn =
+          objId == store.state.userId &&
+          this.hasrole(this.AUTHORIZATION_ROLES.TechFull);
+        ret.readFull =
+          this.hasrole(this.AUTHORIZATION_ROLES.BizAdminLimited) ||
+          this.hasRole(this.AUTHORIZATION_ROLES.InventoryLimited);
+        ret.delete = ret.change || ret.editOwn;
+
+        // ////////////////////////////////////////////////////////////
+
+        break;
+      default:
+        throw new "authorizationroles::rights - not coded for object type "() +
+          objType;
+    }
+    return ret;
+  }
+};
diff --git a/ayanova/src/api/ayatype.js b/ayanova/src/api/ayatype.js
new file mode 100644
index 00000000..b820dfcd
--- /dev/null
+++ b/ayanova/src/api/ayatype.js
@@ -0,0 +1,29 @@
+export default {
+  NoType: 0,
+  Global: 1,
+  Widget: 2,
+  User: 3,
+  ServerState: 4,
+  License: 5,
+  LogFile: 6,
+  DEPRECATED_REUSELATER_7: 7,
+  DEPRECATED_REUSELATER_8: 8,
+  JobOperations: 9,
+  AyaNova7Import: 10,
+  TrialSeeder: 11,
+  Metrics: 12,
+  Locale: 13,
+  UserOptions: 14,
+  DEPRECATED_REUSELATER_15: 15,
+  DEPRECATED_REUSELATER_16: 16,
+  FileAttachment: 17,
+  DataFilter: 18,
+  FormCustom: 19
+};
+/**
+ *
+ * This is a mirror of AyaType.cs in server project
+ * To update just copy the contents of AyaType.cs and replace " =" with ":" (without quotes obvsly)
+ *
+ *
+ */
diff --git a/ayanova/src/api/initialize.js b/ayanova/src/api/initialize.js
index 11990c87..9c874aa0 100644
--- a/ayanova/src/api/initialize.js
+++ b/ayanova/src/api/initialize.js
@@ -1,6 +1,6 @@
 /* xeslint-disable */
 import store from "../store";
-import roles from "./roles";
+import roles from "./authorizationroles";
 import locale from "./locale";
 import api from "./gzapi";
 
diff --git a/ayanova/src/api/roles.js b/ayanova/src/api/roles.js
deleted file mode 100644
index 0ac2696c..00000000
--- a/ayanova/src/api/roles.js
+++ /dev/null
@@ -1,43 +0,0 @@
-import store from "../store";
-export default {
-  AUTHORIZATION_ROLES: {
-    ///<summary>No role set</summary>
-    NoRole: 0,
-    ///<summary>BizAdminLimited</summary>
-    BizAdminLimited: 1,
-    ///<summary>BizAdminFull</summary>
-    BizAdminFull: 2,
-    ///<summary>DispatchLimited</summary>
-    DispatchLimited: 4,
-    ///<summary>DispatchFull</summary>
-    DispatchFull: 8,
-    ///<summary>InventoryLimited</summary>
-    InventoryLimited: 16,
-    ///<summary>InventoryFull</summary>
-    InventoryFull: 32,
-    ///<summary>AccountingFull</summary>
-    AccountingFull: 64, //No limited role, not sure if there is a need
-    ///<summary>TechLimited</summary>
-    TechLimited: 128,
-    ///<summary>TechFull</summary>
-    TechFull: 256,
-    ///<summary>SubContractorLimited</summary>
-    SubContractorLimited: 512,
-    ///<summary>SubContractorFull</summary>
-    SubContractorFull: 1024,
-    ///<summary>ClientLimited</summary>
-    ClientLimited: 2048,
-    ///<summary>ClientFull</summary>
-    ClientFull: 4096,
-    ///<summary>OpsAdminLimited</summary>
-    OpsAdminLimited: 8192,
-    ///<summary>OpsAdminFull</summary>
-    OpsAdminFull: 16384
-  },
-  hasRole(role) {
-    if (!store.state.roles || store.state.roles === 0) {
-      return false;
-    }
-    return role === (store.state.roles & role);
-  }
-};
diff --git a/ayanova/src/main.js b/ayanova/src/main.js
index 0817ca8b..a0beddf5 100644
--- a/ayanova/src/main.js
+++ b/ayanova/src/main.js
@@ -19,7 +19,7 @@ import gzutil from "./api/gzutil";
 import locale from "./api/locale";
 import gzapi from "./api/gzapi";
 import gzform from "./api/gzform";
-import roles from "./api/roles"
+import roles from "./api/authorizationroles";
 import "@/assets/css/main.css";
 
 import gzdateandtimepicker from "./components/gzdateandtimepicker.vue";