added TODO: add authorization on ViewModels