finished adding product crud module

fix:
- read permission
- filter status