added authorization permission logic, but cant finished