diff --git a/components/boards/board-cards.tsx b/components/boards/board-cards.tsx
index 8b61c72..e0b066d 100644
--- a/components/boards/board-cards.tsx
+++ b/components/boards/board-cards.tsx
@@ -13,7 +13,14 @@ import { getColorForIndex } from "@/lib/utils/colors";
 import { format } from "date-fns";
 import { DeleteBoardDialog } from "@/components/boards/delete-board-dialog";
 
-export function BoardCards({ teamBoards }: { teamBoards: Board[] | null }) {
+export function BoardCards({
+  teamBoards,
+  userRole,
+}: {
+  teamBoards: Board[] | null;
+  userRole: string;
+}) {
+  console.log(userRole);
   return (
     <div className="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 gap-4">
       {teamBoards ? (
@@ -34,11 +41,13 @@ export function BoardCards({ teamBoards }: { teamBoards: Board[] | null }) {
                 />
                 {board.name}
               </CardTitle>
-              <DeleteBoardDialog
-                boardId={board.id}
-                boardName={board.name}
-                teamId={board.teamId}
-              />
+              {userRole === "Admin" && (
+                <DeleteBoardDialog
+                  boardId={board.id}
+                  boardName={board.name}
+                  teamId={board.teamId}
+                />
+              )}
             </CardHeader>
             <CardContent className="text-sm text-muted-foreground">
               <p>
@@ -47,7 +56,7 @@ export function BoardCards({ teamBoards }: { teamBoards: Board[] | null }) {
               </p>
             </CardContent>
             <CardFooter className="relative justify-end">
-              <Link href={`/board/${board.id}`} className="ml-auto">
+              <Link href={`/boards/${board.id}`} className="ml-auto">
                 <Button
                   variant="ghost"
                   className="hover:bg-accent/50 transition-colors flex items-center gap-2"
diff --git a/lib/auth/permission-utils.ts b/lib/auth/permission-utils.ts
new file mode 100644
index 0000000..3bc0eed
--- /dev/null
+++ b/lib/auth/permission-utils.ts
@@ -0,0 +1,49 @@
+import { BoardService } from "../services/board/board-service";
+import { TeamService } from "../services/team/team-service";
+
+export async function hasTeamPermission(
+  userId: string,
+  teamId: string
+): Promise<boolean> {
+  const userRole = await TeamService.getUserTeamRole(userId, teamId);
+  if (!userRole) {
+    return false;
+  }
+
+  return true;
+}
+
+export async function hasBoardPermission(
+  userId: string,
+  boardId: string
+): Promise<boolean> {
+  const teamId = await BoardService.getTeamIdByBoardId(boardId);
+  if (!teamId) {
+    return false;
+  }
+  const userRole = await TeamService.getUserTeamRole(userId, teamId);
+  if (!userRole) {
+    return false;
+  }
+
+  return true;
+}
+
+export async function isTeamAdmin(
+  userId: string,
+  teamId: string
+): Promise<boolean> {
+  const userRole = await TeamService.getUserTeamRole(userId, teamId);
+  return userRole === "Admin";
+}
+
+export async function isBoardAdmin(
+  userId: string,
+  boardId: string
+): Promise<boolean> {
+  const teamId = await BoardService.getTeamIdByBoardId(boardId);
+  if (!teamId) {
+    return false;
+  }
+  return isTeamAdmin(userId, teamId);
+}
diff --git a/lib/services/board/board-service.ts b/lib/services/board/board-service.ts
index cff8bfb..8d8d5d0 100644
--- a/lib/services/board/board-service.ts
+++ b/lib/services/board/board-service.ts
@@ -3,7 +3,7 @@ import { IBoardService } from "./types";
 import dbConnect from "@/db/dbConnect";
 import { LayerSchema } from "@/types/KonvaNodeSchema";
 import { createAutomergeServer } from "@/lib/automerge-server";
-import { createBoard, deleteBoard } from "@/db/data";
+import { createBoard, deleteBoard, getBoardById } from "@/db/data";
 import { Board } from "@prisma/client";
 export class BoardService implements IBoardService {
   constructor() {}
@@ -36,4 +36,15 @@ export class BoardService implements IBoardService {
       throw error;
     }
   }
+
+  static async getTeamIdByBoardId(boardId: string): Promise<string | null> {
+    try {
+      await dbConnect();
+      const board = await getBoardById(boardId);
+      return board?.teamId || null;
+    } catch (error) {
+      console.error(error);
+      throw error;
+    }
+  }
 }
diff --git a/lib/services/team/team-service.ts b/lib/services/team/team-service.ts
index 3b2634f..35aa112 100644
--- a/lib/services/team/team-service.ts
+++ b/lib/services/team/team-service.ts
@@ -5,13 +5,32 @@ export class TeamService {
     userId: string,
     teamId: string
   ): Promise<boolean> {
-    const member = await prisma.teamMember.findFirst({
+    const teamMember = await prisma.teamMember.findFirst({
       where: {
         userId,
         teamId,
       },
     });
+    return teamMember !== null;
+  }
+
+  static async getUserTeamRole(
+    userId: string,
+    teamId: string
+  ): Promise<string | null> {
+    const teamMember = await prisma.teamMember.findFirst({
+      where: {
+        userId,
+        teamId,
+      },
+      include: {
+        role: true,
+      },
+    });
+    if (teamMember == null) {
+      return null;
+    }
 
-    return !!member;
+    return teamMember.role.name;
   }
 }
diff --git a/middleware.ts b/middleware.ts
new file mode 100644
index 0000000..51db9f0
--- /dev/null
+++ b/middleware.ts
@@ -0,0 +1,66 @@
+import { NextResponse } from "next/server";
+import type { NextRequest } from "next/server";
+import { getToken } from "next-auth/jwt";
+
+const publicPaths = [
+  "/auth/login",
+  "/auth/register",
+  "/auth/error",
+  "/auth/verify",
+  "/api/auth",
+  "/api/socket",
+];
+
+const isPublicPath = (path: string) => {
+  const normalizedPath = path.endsWith("/") ? path.slice(0, -1) : path;
+  console.log(`Checking path: ${normalizedPath}`);
+
+  return publicPaths.some(
+    (publicPath) =>
+      normalizedPath === publicPath ||
+      normalizedPath.startsWith(`${publicPath}/`)
+  );
+};
+
+export async function middleware(request: NextRequest) {
+  const { pathname } = request.nextUrl;
+
+  if (pathname === "/api/auth/session" || pathname === "/api/auth/session/") {
+    return NextResponse.next();
+  }
+
+  if (isPublicPath(pathname)) {
+    return NextResponse.next();
+  }
+
+  const token = await getToken({
+    req: request,
+    secret: process.env.NEXTAUTH_SECRET,
+  });
+
+  if (!token && !isPublicPath(pathname)) {
+    const url = request.nextUrl.clone();
+    url.pathname = "/auth/login";
+    return NextResponse.redirect(url);
+  }
+
+  if (
+    pathname.startsWith("/api/") &&
+    !pathname.startsWith("/api/auth/") &&
+    !pathname.startsWith("/api/socket") &&
+    !token
+  ) {
+    return new NextResponse(null, {
+      status: 401,
+      headers: {
+        "Content-Type": "application/json",
+      },
+    });
+  }
+
+  return NextResponse.next();
+}
+
+export const config = {
+  matcher: ["/((?!_next/static|_next/image|favicon.ico|public).*)"],
+};
diff --git a/pages/_app.tsx b/pages/_app.tsx
index f5025c1..29e97d9 100644
--- a/pages/_app.tsx
+++ b/pages/_app.tsx
@@ -12,7 +12,6 @@ type AppPropsWithSession = AppProps & {
   };
 };
 function MyApp({ Component, pageProps, router }: AppPropsWithSession) {
-  console.log(router.pathname);
   const isTeamRoute = router.pathname.startsWith("/teams");
   const isTeamsRoute = router.pathname === "/teams";
 
diff --git a/pages/api/boards/[id]/delete.ts b/pages/api/boards/[id]/delete.ts
index a7d1744..839dcd1 100644
--- a/pages/api/boards/[id]/delete.ts
+++ b/pages/api/boards/[id]/delete.ts
@@ -2,6 +2,7 @@ import type { NextApiRequest, NextApiResponse } from "next";
 import { BoardService } from "@/lib/services/board";
 import { getServerSession } from "next-auth/next";
 import { authOptions } from "@/lib/auth/auth";
+import { isBoardAdmin } from "@/lib/auth/permission-utils";
 
 export default async function handler(
   req: NextApiRequest,
@@ -23,15 +24,12 @@ export default async function handler(
     }
 
     const boardService = new BoardService();
-    // const hasTeamAccess = await boardService.verifyTeamAccess(
-    //   session.user.id,
-    //   teamId
-    // );
-    // if (!hasTeamAccess) {
-    //   return res
-    //     .status(403)
-    //     .json({ message: "Forbidden: No access to this team" });
-    // }
+    const isAdmin = await isBoardAdmin(session.user.id, boardId);
+    if (!isAdmin) {
+      return res
+        .status(403)
+        .json({ message: "Forbidden: No access to this board" });
+    }
 
     const board = await boardService.delete(boardId);
 
diff --git a/pages/api/boards/[id]/url.ts b/pages/api/boards/[id]/url.ts
index f4199c2..08d30f5 100644
--- a/pages/api/boards/[id]/url.ts
+++ b/pages/api/boards/[id]/url.ts
@@ -2,6 +2,7 @@ import type { NextApiRequest, NextApiResponse } from "next";
 import { getServerSession } from "next-auth/next";
 import { authOptions } from "@/lib/auth/auth";
 import { getBoardDocUrl } from "@/db/data";
+import { hasBoardPermission } from "@/lib/auth/permission-utils";
 
 export default async function handler(
   req: NextApiRequest,
@@ -22,6 +23,13 @@ export default async function handler(
       return res.status(400).json({ message: "Board ID is required" });
     }
 
+    const hasPermission = await hasBoardPermission(session.user.id, boardId);
+    if (!hasPermission) {
+      return res
+        .status(403)
+        .json({ message: "Forbidden: No access to this board" });
+    }
+
     const docUrl = await getBoardDocUrl(boardId);
 
     return res.status(200).json({ docUrl });
diff --git a/pages/api/boards/create.ts b/pages/api/boards/create.ts
index 3034845..812c7ac 100644
--- a/pages/api/boards/create.ts
+++ b/pages/api/boards/create.ts
@@ -4,6 +4,7 @@ import { BoardService } from "@/lib/services/board";
 import { getServerSession } from "next-auth/next";
 import { authOptions } from "@/lib/auth/auth";
 import { ZodError } from "zod";
+import { hasTeamPermission } from "@/lib/auth/permission-utils";
 
 export default async function handler(
   req: NextApiRequest,
@@ -27,15 +28,13 @@ export default async function handler(
     const validatedData = schemaBoard.parse(data);
 
     const boardService = new BoardService();
-    // const hasTeamAccess = await boardService.verifyTeamAccess(
-    //   session.user.id,
-    //   teamId
-    // );
-    // if (!hasTeamAccess) {
-    //   return res
-    //     .status(403)
-    //     .json({ message: "Forbidden: No access to this team" });
-    // }
+
+    const hasPermission = await hasTeamPermission(session.user.id, teamId);
+    if (!hasPermission) {
+      return res
+        .status(403)
+        .json({ message: "Forbidden: No access to this team" });
+    }
 
     const board = await boardService.create({
       name: validatedData.name,
diff --git a/pages/board/[id]/index.tsx b/pages/board/[id]/index.tsx
deleted file mode 100644
index 3dd3a4a..0000000
--- a/pages/board/[id]/index.tsx
+++ /dev/null
@@ -1,32 +0,0 @@
-import { GetServerSideProps } from "next";
-
-import { getBoardById } from "@/db/data";
-import { BoardContextProvider } from "@/components/board/context/board-context";
-import { BoardProvider } from "@/components/board/board-provider";
-
-interface BoardPageProps {
-  boardId: string;
-  docUrl: string;
-}
-
-export default function BoardPage({ boardId, docUrl }: BoardPageProps) {
-  return <BoardProvider boardId={boardId} docUrl={docUrl} />;
-}
-
-export const getServerSideProps: GetServerSideProps = async ({ params }) => {
-  const boardId = params?.id as string;
-  const board = await getBoardById(boardId);
-
-  if (!board || !board.docUrl) {
-    return {
-      notFound: true,
-    };
-  }
-
-  return {
-    props: {
-      boardId,
-      docUrl: board.docUrl.toString(),
-    },
-  };
-};
diff --git a/pages/boards/[id]/index.tsx b/pages/boards/[id]/index.tsx
new file mode 100644
index 0000000..27f91b2
--- /dev/null
+++ b/pages/boards/[id]/index.tsx
@@ -0,0 +1,51 @@
+import { GetServerSideProps } from "next";
+import { getBoardById } from "@/db/data";
+import { BoardProvider } from "@/components/board/board-provider";
+import { hasBoardPermission } from "@/lib/auth/permission-utils";
+import { getSession } from "next-auth/react";
+
+interface BoardPageProps {
+  boardId: string;
+  docUrl: string;
+}
+
+export default function BoardPage({ boardId, docUrl }: BoardPageProps) {
+  return <BoardProvider boardId={boardId} docUrl={docUrl} />;
+}
+
+export const getServerSideProps: GetServerSideProps = async ({
+  req,
+  params,
+}) => {
+  const boardId = params?.id as string;
+  const session = await getSession({ req });
+
+  if (!session?.user) {
+    return {
+      redirect: {
+        destination: "/auth/signin",
+        permanent: false,
+      },
+    };
+  }
+
+  const hasPermission = await hasBoardPermission(session.user.id, boardId);
+
+  if (!hasPermission) {
+    return {
+      redirect: {
+        destination: "/teams",
+        permanent: false,
+      },
+    };
+  }
+
+  const board = await getBoardById(boardId);
+
+  return {
+    props: {
+      boardId,
+      docUrl: board?.docUrl?.toString() || "",
+    },
+  };
+};
diff --git a/pages/board/[id]/preview.tsx b/pages/boards/[id]/preview.tsx
similarity index 100%
rename from pages/board/[id]/preview.tsx
rename to pages/boards/[id]/preview.tsx
diff --git a/pages/teams/[id]/boards.tsx b/pages/teams/[id]/boards.tsx
index d251803..a7a65ae 100644
--- a/pages/teams/[id]/boards.tsx
+++ b/pages/teams/[id]/boards.tsx
@@ -3,15 +3,21 @@ import { getTeamBoards, getTeam } from "@/db/data";
 import { BoardCards } from "@/components/boards/board-cards";
 import { getSession } from "next-auth/react";
 import { CreateBoardDialog } from "@/components/boards/create-board-dialog";
-
+import { TeamService } from "@/lib/services/team/team-service";
 interface BoardsPageProps {
   boards: string;
   team: string;
+  userRole: string;
 }
 
-export default function BoardsPage({ boards, team }: BoardsPageProps) {
+export default function BoardsPage({
+  boards,
+  team,
+  userRole,
+}: BoardsPageProps) {
   const parsedBoards = JSON.parse(boards);
   const parsedTeam = JSON.parse(team);
+  const parsedUserRole = JSON.parse(userRole);
   return (
     <div className="container mx-auto py-6">
       <div className="flex justify-between items-center mb-8">
@@ -19,7 +25,9 @@ export default function BoardsPage({ boards, team }: BoardsPageProps) {
         <CreateBoardDialog teamId={parsedTeam.id as string} />
       </div>
 
-      {parsedBoards && <BoardCards teamBoards={parsedBoards} />}
+      {parsedBoards && (
+        <BoardCards teamBoards={parsedBoards} userRole={parsedUserRole} />
+      )}
     </div>
   );
 }
@@ -35,8 +43,15 @@ export const getServerSideProps: GetServerSideProps = async (context) => {
       },
     };
   }
-
   const teamId = context.params?.id as string;
+  const userRole = await TeamService.getUserTeamRole(session.user.id, teamId);
+
+  if (!userRole) {
+    return {
+      notFound: true,
+    };
+  }
+
   const team = await getTeam(teamId);
 
   if (!team) {
@@ -51,6 +66,7 @@ export const getServerSideProps: GetServerSideProps = async (context) => {
     props: {
       boards: JSON.stringify(boards),
       team: JSON.stringify(team),
+      userRole: JSON.stringify(userRole),
     },
   };
 };
diff --git a/pages/teams/[id]/members.tsx b/pages/teams/[id]/members.tsx
index 229ed5e..5bc4447 100644
--- a/pages/teams/[id]/members.tsx
+++ b/pages/teams/[id]/members.tsx
@@ -4,15 +4,22 @@ import { MembersList } from "@/components/teams/members-list";
 import { getSession } from "next-auth/react";
 import { TeamService } from "@/lib/services/team/team-service";
 import { Button } from "@/components/ui/button";
+import { hasTeamPermission } from "@/lib/auth/permission-utils";
 
 interface MembersPageProps {
   members: string;
   team: string;
+  userRole: string;
 }
 
-export default function MembersPage({ members, team }: MembersPageProps) {
+export default function MembersPage({
+  members,
+  team,
+  userRole,
+}: MembersPageProps) {
   const parsedTeam = JSON.parse(team);
   const parsedMembers = JSON.parse(members);
+  const parsedUserRole = JSON.parse(userRole);
   return (
     <div className="container mx-auto py-6">
       <div className="flex justify-between items-center mb-8">
@@ -39,17 +46,11 @@ export const getServerSideProps: GetServerSideProps = async (context) => {
 
   const teamId = context.params?.id as string;
   const team = await getTeam(teamId);
+  const userRole = await TeamService.getUserTeamRole(session.user.id, teamId);
 
-  const isUserMemberOfTeam = await TeamService.isUserMemberOfTeam(
-    session.user.id,
-    teamId
-  );
-  if (!isUserMemberOfTeam) {
+  if (!userRole) {
     return {
-      redirect: {
-        destination: "/teams",
-        permanent: false,
-      },
+      notFound: true,
     };
   }
 
@@ -59,6 +60,7 @@ export const getServerSideProps: GetServerSideProps = async (context) => {
     props: {
       members: JSON.stringify(members),
       team: JSON.stringify(team),
+      userRole: JSON.stringify(userRole),
     },
   };
 };
diff --git a/server.ts b/server.ts
index 3883e1c..a1d6a6f 100644
--- a/server.ts
+++ b/server.ts
@@ -6,7 +6,13 @@ import { createAutomergeServer } from "@/lib/automerge-server";
 const dev = process.env.NODE_ENV !== "production";
 const hostname = "localhost";
 const port = parseInt(process.env.PORT || "3000", 10);
-const app = next({ dev });
+const app = next({
+  dev,
+  hostname,
+  port,
+
+  customServer: true,
+});
 const handle = app.getRequestHandler();
 
 app.prepare().then(() => {
@@ -28,7 +34,7 @@ app.prepare().then(() => {
   server.on("upgrade", (request, socket, head) => {
     if (!request.url) return socket.destroy();
 
-    const { pathname } = new URL(request.url, `http://${hostname}`);
+    const { pathname } = new URL(request.url, `http://${hostname}:${port}`);
 
     if (pathname === "/_next/webpack-hmr") {
       return;
diff --git a/types/BoardAction.d.ts b/types/BoardAction.d.ts
deleted file mode 100644
index 7c373c5..0000000
--- a/types/BoardAction.d.ts
+++ /dev/null
@@ -1,9 +0,0 @@
-enum BoardAction {
-  CREATE = "CREATE",
-  DELETE = "DELETE",
-  UPDATE = "UPDATE",
-  REVERT_HISTORY = "REVERT_HISTORY",
-  MERGE = "MERGE",
-}
-
-export default BoardAction;
diff --git a/types/TeamInvitationStatus.d.ts b/types/TeamInvitationStatus.d.ts
deleted file mode 100644
index 4f8b8f6..0000000
--- a/types/TeamInvitationStatus.d.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-enum TeamInvitationStatus {
-  PENDING = "PENDING",
-  ACCEPTED = "ACCEPTED",
-  REJECTED = "REJECTED",
-  CANCELLED = "CANCELLED",
-}
-
-export default TeamInvitationStatus;
diff --git a/types/User.d.ts b/types/User.d.ts
deleted file mode 100644
index b80c585..0000000
--- a/types/User.d.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-export default interface User {
-  id: string;
-  name: string;
-  email: string;
-  password: string;
-  createdAt: Date;
-  updatedAt: Date;
-}