ADD: api/controller && test for user authority