refactor permission check
move model file
rename routes