add 2 ability: admin can manage all, contractor can upload photo