Add product.js, user can be admin, default 0w