diff --git a/wwwroot/api/check_perm.dspy b/wwwroot/api/check_perm.dspy
new file mode 100644
index 0000000..c4dff55
--- /dev/null
+++ b/wwwroot/api/check_perm.dspy
@@ -0,0 +1,14 @@
+# check_perm.dspy
+
+dbname = get_module_dbname('rbac')
+async with DBPools().sqlorContext(dbname) as sor:
+    recs = await sor.sqlExe(
+        "SELECT path, roleid FROM rolepermission WHERE path LIKE '%login%'", {})
+    perms = [{"path": getattr(r, "path", ""), "roleid": getattr(r, "roleid", "")} for r in (recs or [])]
+    
+    # Also check up_login
+    recs2 = await sor.sqlExe(
+        "SELECT path, roleid FROM rolepermission WHERE path LIKE '%up_login%' OR path LIKE '%login.ui%'", {})
+    perms2 = [{"path": getattr(r, "path", ""), "roleid": getattr(r, "roleid", "")} for r in (recs2 or [])]
+
+return json.dumps({"login_perms": perms, "up_login_perms": perms2}, ensure_ascii=False)