From e8c9a307ab4b917fe180ed62529276a344a292f7 Mon Sep 17 00:00:00 2001
From: Tom Butcher <thomasbutcher15@gmail.com>
Date: Thu, 20 Aug 2026 20:15:07 +0100
Subject: [PATCH] Enhance route permission checks across management and
 inventory modules

This commit updates various route handlers in the management and inventory modules to include permission checks using the `checkPermissions` middleware. The changes ensure that access to properties, values, and search functionalities for different entities (e.g., users, products, tax rates) is properly restricted based on user permissions. This enhancement improves the security and integrity of the application by enforcing role-based access control across multiple routes.
---
 src/routes/finance/invoices.js             | 6 +++---
 src/routes/finance/payments.js             | 6 +++---
 src/routes/finance/taxrecords.js           | 6 +++---
 src/routes/inventory/filamentstocks.js     | 6 +++---
 src/routes/inventory/orderitems.js         | 6 +++---
 src/routes/inventory/partstocks.js         | 6 +++---
 src/routes/inventory/productstocks.js      | 6 +++---
 src/routes/inventory/purchaseorders.js     | 6 +++---
 src/routes/inventory/shipments.js          | 6 +++---
 src/routes/inventory/stockaudits.js        | 2 +-
 src/routes/inventory/stockevents.js        | 6 +++---
 src/routes/inventory/stocklocations.js     | 6 +++---
 src/routes/inventory/stocktransfers.js     | 6 +++---
 src/routes/management/apppasswords.js      | 6 +++---
 src/routes/management/auditlogs.js         | 3 ++-
 src/routes/management/courier.js           | 6 +++---
 src/routes/management/courierservice.js    | 6 +++---
 src/routes/management/documentjobs.js      | 6 +++---
 src/routes/management/documentprinters.js  | 6 +++---
 src/routes/management/documentsizes.js     | 6 +++---
 src/routes/management/documenttemplates.js | 6 +++---
 src/routes/management/filaments.js         | 6 +++---
 src/routes/management/filamentskus.js      | 6 +++---
 src/routes/management/files.js             | 6 +++---
 src/routes/management/hosts.js             | 6 +++---
 src/routes/management/materials.js         | 6 +++---
 src/routes/management/notetypes.js         | 6 +++---
 src/routes/management/parts.js             | 6 +++---
 src/routes/management/partskus.js          | 6 +++---
 src/routes/management/permissionsetting.js | 6 +++---
 src/routes/management/productcategories.js | 6 +++---
 src/routes/management/products.js          | 6 +++---
 src/routes/management/productskus.js       | 6 +++---
 src/routes/management/taxrates.js          | 6 +++---
 src/routes/management/usergroups.js        | 6 +++---
 src/routes/management/users.js             | 6 +++---
 src/routes/management/vendors.js           | 6 +++---
 src/routes/production/filamentprofiles.js  | 6 +++---
 src/routes/production/gcodefiles.js        | 6 +++---
 src/routes/production/jobs.js              | 6 +++---
 src/routes/production/printerprofiles.js   | 6 +++---
 src/routes/production/printers.js          | 6 +++---
 src/routes/production/subjobs.js           | 6 +++---
 src/routes/sales/clients.js                | 6 +++---
 src/routes/sales/listings.js               | 6 +++---
 src/routes/sales/listingvarients.js        | 6 +++---
 src/routes/sales/marketplaces.js           | 6 +++---
 src/routes/sales/salesorders.js            | 6 +++---
 48 files changed, 141 insertions(+), 140 deletions(-)

diff --git a/src/routes/finance/invoices.js b/src/routes/finance/invoices.js
index 15d81ec..c47bde8 100644
--- a/src/routes/finance/invoices.js
+++ b/src/routes/finance/invoices.js
@@ -64,7 +64,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   );
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('invoice', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -74,11 +74,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listInvoicesByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('invoice', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getInvoicePropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('invoice', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchInvoicesRouteHandler(req, res, search);
 });
diff --git a/src/routes/finance/payments.js b/src/routes/finance/payments.js
index 36c3fbc..fdd64c2 100644
--- a/src/routes/finance/payments.js
+++ b/src/routes/finance/payments.js
@@ -55,7 +55,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listPaymentsRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('payment', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -65,11 +65,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listPaymentsByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('payment', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getPaymentPropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('payment', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchPaymentsRouteHandler(req, res, search);
 });
diff --git a/src/routes/finance/taxrecords.js b/src/routes/finance/taxrecords.js
index 1c56332..1a30490 100644
--- a/src/routes/finance/taxrecords.js
+++ b/src/routes/finance/taxrecords.js
@@ -40,7 +40,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listTaxRecordsRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('taxRecord', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -50,11 +50,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listTaxRecordsByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('taxRecord', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getTaxRecordPropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('taxRecord', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchTaxRecordsRouteHandler(req, res, search);
 });
diff --git a/src/routes/inventory/filamentstocks.js b/src/routes/inventory/filamentstocks.js
index e7dfd56..2dabd30 100644
--- a/src/routes/inventory/filamentstocks.js
+++ b/src/routes/inventory/filamentstocks.js
@@ -50,7 +50,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listFilamentStocksRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('filamentStock', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -60,11 +60,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listFilamentStocksByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('filamentStock', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getFilamentStockPropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('filamentStock', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchFilamentStocksRouteHandler(req, res, search);
 });
diff --git a/src/routes/inventory/orderitems.js b/src/routes/inventory/orderitems.js
index fc9a82d..88f695b 100644
--- a/src/routes/inventory/orderitems.js
+++ b/src/routes/inventory/orderitems.js
@@ -64,7 +64,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   );
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('orderItem', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -74,11 +74,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listOrderItemsByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('orderItem', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getOrderItemPropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('orderItem', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchOrderItemsRouteHandler(req, res, search);
 });
diff --git a/src/routes/inventory/partstocks.js b/src/routes/inventory/partstocks.js
index 570fc68..e9bfd46 100644
--- a/src/routes/inventory/partstocks.js
+++ b/src/routes/inventory/partstocks.js
@@ -42,7 +42,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listPartStocksRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('partStock', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -52,11 +52,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listPartStocksByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('partStock', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getPartStockPropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('partStock', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchPartStocksRouteHandler(req, res, search);
 });
diff --git a/src/routes/inventory/productstocks.js b/src/routes/inventory/productstocks.js
index 42044b4..d27dc65 100644
--- a/src/routes/inventory/productstocks.js
+++ b/src/routes/inventory/productstocks.js
@@ -41,7 +41,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listProductStocksRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('productStock', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -51,11 +51,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listProductStocksByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('productStock', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getProductStockPropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('productStock', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchProductStocksRouteHandler(req, res, search);
 });
diff --git a/src/routes/inventory/purchaseorders.js b/src/routes/inventory/purchaseorders.js
index b1ea5cc..588a767 100644
--- a/src/routes/inventory/purchaseorders.js
+++ b/src/routes/inventory/purchaseorders.js
@@ -68,7 +68,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listPurchaseOrdersRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('purchaseOrder', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -78,11 +78,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listPurchaseOrdersByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('purchaseOrder', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getPurchaseOrderPropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('purchaseOrder', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchPurchaseOrdersRouteHandler(req, res, search);
 });
diff --git a/src/routes/inventory/shipments.js b/src/routes/inventory/shipments.js
index 2542302..793a946 100644
--- a/src/routes/inventory/shipments.js
+++ b/src/routes/inventory/shipments.js
@@ -69,7 +69,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   );
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('shipment', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -83,11 +83,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listShipmentsByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('shipment', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getShipmentPropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('shipment', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchShipmentsRouteHandler(req, res, search);
 });
diff --git a/src/routes/inventory/stockaudits.js b/src/routes/inventory/stockaudits.js
index a1a94bd..1dda6df 100644
--- a/src/routes/inventory/stockaudits.js
+++ b/src/routes/inventory/stockaudits.js
@@ -51,7 +51,7 @@ router.post('/', isAuthenticated, checkPermissions('stockAudit', 'new'), async (
 });
 
 // get stock audit stats
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('stockAudit', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchStockAuditsRouteHandler(req, res, search);
 });
diff --git a/src/routes/inventory/stockevents.js b/src/routes/inventory/stockevents.js
index 4bfd7f3..98de1d0 100644
--- a/src/routes/inventory/stockevents.js
+++ b/src/routes/inventory/stockevents.js
@@ -31,7 +31,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listStockEventsRouteHandler(req, res, page, limit, filter, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('stockEvent', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -41,11 +41,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listStockEventsByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('stockEvent', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getStockEventPropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('stockEvent', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchStockEventsRouteHandler(req, res, search);
 });
diff --git a/src/routes/inventory/stocklocations.js b/src/routes/inventory/stocklocations.js
index 04c21fd..90139fb 100644
--- a/src/routes/inventory/stocklocations.js
+++ b/src/routes/inventory/stocklocations.js
@@ -30,7 +30,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listStockLocationsRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('stockLocation', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -40,11 +40,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listStockLocationsByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('stockLocation', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getStockLocationPropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('stockLocation', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchStockLocationsRouteHandler(req, res, search);
 });
diff --git a/src/routes/inventory/stocktransfers.js b/src/routes/inventory/stocktransfers.js
index 69b1961..1b5ffc2 100644
--- a/src/routes/inventory/stocktransfers.js
+++ b/src/routes/inventory/stocktransfers.js
@@ -39,7 +39,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listStockTransfersRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('stockTransfer', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -49,11 +49,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listStockTransfersByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('stockTransfer', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getStockTransferPropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('stockTransfer', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchStockTransfersRouteHandler(req, res, search);
 });
diff --git a/src/routes/management/apppasswords.js b/src/routes/management/apppasswords.js
index 8b663a1..f081167 100644
--- a/src/routes/management/apppasswords.js
+++ b/src/routes/management/apppasswords.js
@@ -39,19 +39,19 @@ router.get('/', isAuthenticated, async (req, res) => {
   listAppPasswordsRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('appPassword', 'list'), isAuthenticated, async (req, res) => {
   const properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   const masterFilter = req.query.masterFilter ? JSON.parse(req.query.masterFilter) : {};
   listAppPasswordsByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('appPassword', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getAppPasswordPropertyValuesRouteHandler(req, res, property);
 });
 
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('appPassword', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchAppPasswordsRouteHandler(req, res, search);
 });
diff --git a/src/routes/management/auditlogs.js b/src/routes/management/auditlogs.js
index 7d521fe..c001776 100644
--- a/src/routes/management/auditlogs.js
+++ b/src/routes/management/auditlogs.js
@@ -1,5 +1,6 @@
 import express from 'express';
 import { isAuthenticated } from '../../keycloak.js';
+import { checkPermissions } from '../../database/permissions.js';
 import {
   listAuditLogsRouteHandler,
   getAuditLogRouteHandler,
@@ -35,7 +36,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   );
 });
 
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('auditLog', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchAuditLogsRouteHandler(req, res, search);
 });
diff --git a/src/routes/management/courier.js b/src/routes/management/courier.js
index bda0809..493653b 100644
--- a/src/routes/management/courier.js
+++ b/src/routes/management/courier.js
@@ -40,7 +40,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listCouriersRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('courier', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -50,12 +50,12 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listCouriersByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('courier', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getCourierPropertyValuesRouteHandler(req, res, property);
 });
 
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('courier', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchCouriersRouteHandler(req, res, search);
 });
diff --git a/src/routes/management/courierservice.js b/src/routes/management/courierservice.js
index 646aad5..39ad134 100644
--- a/src/routes/management/courierservice.js
+++ b/src/routes/management/courierservice.js
@@ -64,7 +64,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listCourierServicesRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('courierService', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -74,12 +74,12 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listCourierServicesByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('courierService', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getCourierServicePropertyValuesRouteHandler(req, res, property);
 });
 
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('courierService', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchCourierServicesRouteHandler(req, res, search);
 });
diff --git a/src/routes/management/documentjobs.js b/src/routes/management/documentjobs.js
index c5f557f..57e059b 100644
--- a/src/routes/management/documentjobs.js
+++ b/src/routes/management/documentjobs.js
@@ -38,7 +38,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listDocumentJobsRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('documentJob', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -48,12 +48,12 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listDocumentJobsByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('documentJob', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getDocumentJobPropertyValuesRouteHandler(req, res, property);
 });
 
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('documentJob', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchDocumentJobsRouteHandler(req, res, search);
 });
diff --git a/src/routes/management/documentprinters.js b/src/routes/management/documentprinters.js
index 246e0db..1d3f885 100644
--- a/src/routes/management/documentprinters.js
+++ b/src/routes/management/documentprinters.js
@@ -39,7 +39,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listDocumentPrintersRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('documentPrinter', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -49,12 +49,12 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listDocumentPrintersByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('documentPrinter', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getDocumentPrinterPropertyValuesRouteHandler(req, res, property);
 });
 
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('documentPrinter', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchDocumentPrintersRouteHandler(req, res, search);
 });
diff --git a/src/routes/management/documentsizes.js b/src/routes/management/documentsizes.js
index 5985eca..bba42ce 100644
--- a/src/routes/management/documentsizes.js
+++ b/src/routes/management/documentsizes.js
@@ -30,7 +30,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listDocumentSizesRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('documentSize', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -40,12 +40,12 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listDocumentSizesByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('documentSize', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getDocumentSizePropertyValuesRouteHandler(req, res, property);
 });
 
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('documentSize', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchDocumentSizesRouteHandler(req, res, search);
 });
diff --git a/src/routes/management/documenttemplates.js b/src/routes/management/documenttemplates.js
index e94ab07..9565a2d 100644
--- a/src/routes/management/documenttemplates.js
+++ b/src/routes/management/documenttemplates.js
@@ -54,7 +54,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listDocumentTemplatesRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('documentTemplate', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -64,12 +64,12 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listDocumentTemplatesByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('documentTemplate', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getDocumentTemplatePropertyValuesRouteHandler(req, res, property);
 });
 
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('documentTemplate', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchDocumentTemplatesRouteHandler(req, res, search);
 });
diff --git a/src/routes/management/filaments.js b/src/routes/management/filaments.js
index 7cfb490..f73df55 100644
--- a/src/routes/management/filaments.js
+++ b/src/routes/management/filaments.js
@@ -60,7 +60,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listFilamentsRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('filament', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -70,12 +70,12 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listFilamentsByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('filament', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getFilamentPropertyValuesRouteHandler(req, res, property);
 });
 
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('filament', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchFilamentsRouteHandler(req, res, search);
 });
diff --git a/src/routes/management/filamentskus.js b/src/routes/management/filamentskus.js
index 3b34e6c..d3b0ce4 100644
--- a/src/routes/management/filamentskus.js
+++ b/src/routes/management/filamentskus.js
@@ -49,7 +49,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listFilamentSkusRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('filamentSku', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   let masterFilter = {};
@@ -59,11 +59,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listFilamentSkusByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('filamentSku', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getFilamentSkuPropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('filamentSku', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchFilamentSkusRouteHandler(req, res, search);
 });
diff --git a/src/routes/management/files.js b/src/routes/management/files.js
index b6fb0de..861149f 100644
--- a/src/routes/management/files.js
+++ b/src/routes/management/files.js
@@ -42,7 +42,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listFilesRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('file', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -52,12 +52,12 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listFilesByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('file', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getFilePropertyValuesRouteHandler(req, res, property);
 });
 
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('file', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchFilesRouteHandler(req, res, search);
 });
diff --git a/src/routes/management/hosts.js b/src/routes/management/hosts.js
index 9b8ef4e..76663ba 100644
--- a/src/routes/management/hosts.js
+++ b/src/routes/management/hosts.js
@@ -38,7 +38,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listHostsRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('host', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -48,12 +48,12 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listHostsByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('host', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getHostPropertyValuesRouteHandler(req, res, property);
 });
 
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('host', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchHostsRouteHandler(req, res, search);
 });
diff --git a/src/routes/management/materials.js b/src/routes/management/materials.js
index 4afaf2b..60c5225 100644
--- a/src/routes/management/materials.js
+++ b/src/routes/management/materials.js
@@ -38,7 +38,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listMaterialsRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('material', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -48,12 +48,12 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listMaterialsByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('material', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getMaterialPropertyValuesRouteHandler(req, res, property);
 });
 
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('material', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchMaterialsRouteHandler(req, res, search);
 });
diff --git a/src/routes/management/notetypes.js b/src/routes/management/notetypes.js
index 9a54aa2..81d06a1 100644
--- a/src/routes/management/notetypes.js
+++ b/src/routes/management/notetypes.js
@@ -38,7 +38,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listNoteTypesRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('noteType', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -48,11 +48,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listNoteTypesByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('noteType', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getNoteTypePropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('noteType', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchNoteTypesRouteHandler(req, res, search);
 });
diff --git a/src/routes/management/parts.js b/src/routes/management/parts.js
index 510886a..3aa7e76 100644
--- a/src/routes/management/parts.js
+++ b/src/routes/management/parts.js
@@ -49,7 +49,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   );
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('part', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -59,12 +59,12 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listPartsByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('part', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getPartPropertyValuesRouteHandler(req, res, property);
 });
 
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('part', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchPartsRouteHandler(req, res, search);
 });
diff --git a/src/routes/management/partskus.js b/src/routes/management/partskus.js
index 6a8365f..20591ea 100644
--- a/src/routes/management/partskus.js
+++ b/src/routes/management/partskus.js
@@ -50,7 +50,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listPartSkusRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('partSku', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   let masterFilter = {};
@@ -60,11 +60,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listPartSkusByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('partSku', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getPartSkuPropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('partSku', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchPartSkusRouteHandler(req, res, search);
 });
diff --git a/src/routes/management/permissionsetting.js b/src/routes/management/permissionsetting.js
index 7badae4..8e4405a 100644
--- a/src/routes/management/permissionsetting.js
+++ b/src/routes/management/permissionsetting.js
@@ -38,7 +38,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   );
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('permissionSetting', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -48,12 +48,12 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listPermissionSettingsByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('permissionSetting', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getPermissionSettingsPropertyValuesRouteHandler(req, res, property);
 });
 
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('permissionSetting', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchPermissionSettingsRouteHandler(req, res, search);
 });
diff --git a/src/routes/management/productcategories.js b/src/routes/management/productcategories.js
index c5e5051..8e87bdf 100644
--- a/src/routes/management/productcategories.js
+++ b/src/routes/management/productcategories.js
@@ -29,7 +29,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listProductCategoriesRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('productCategory', 'list'), isAuthenticated, async (req, res) => {
   const properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -39,12 +39,12 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listProductCategoriesByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('productCategory', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getProductCategoryPropertyValuesRouteHandler(req, res, property);
 });
 
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('productCategory', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchProductCategoriesRouteHandler(req, res, search);
 });
diff --git a/src/routes/management/products.js b/src/routes/management/products.js
index b48f81f..5559f73 100644
--- a/src/routes/management/products.js
+++ b/src/routes/management/products.js
@@ -50,7 +50,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listProductsRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('product', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -60,12 +60,12 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listProductsByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('product', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getProductPropertyValuesRouteHandler(req, res, property);
 });
 
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('product', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchProductsRouteHandler(req, res, search);
 });
diff --git a/src/routes/management/productskus.js b/src/routes/management/productskus.js
index d479fcc..94488d6 100644
--- a/src/routes/management/productskus.js
+++ b/src/routes/management/productskus.js
@@ -50,7 +50,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listProductSkusRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('productSku', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   let masterFilter = {};
@@ -60,11 +60,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listProductSkusByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('productSku', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getProductSkuPropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('productSku', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchProductSkusRouteHandler(req, res, search);
 });
diff --git a/src/routes/management/taxrates.js b/src/routes/management/taxrates.js
index 5ee2fe8..0d862b5 100644
--- a/src/routes/management/taxrates.js
+++ b/src/routes/management/taxrates.js
@@ -48,7 +48,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listTaxRatesRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('taxRate', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -58,12 +58,12 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listTaxRatesByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('taxRate', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getTaxRatePropertyValuesRouteHandler(req, res, property);
 });
 
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('taxRate', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchTaxRatesRouteHandler(req, res, search);
 });
diff --git a/src/routes/management/usergroups.js b/src/routes/management/usergroups.js
index 4df45a8..472a667 100644
--- a/src/routes/management/usergroups.js
+++ b/src/routes/management/usergroups.js
@@ -38,7 +38,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   );
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('userGroup', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -48,12 +48,12 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listUserGroupsByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('userGroup', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getUserGroupPropertyValuesRouteHandler(req, res, property);
 });
 
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('userGroup', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchUserGroupsRouteHandler(req, res, search);
 });
diff --git a/src/routes/management/users.js b/src/routes/management/users.js
index 684d6ed..c77943b 100644
--- a/src/routes/management/users.js
+++ b/src/routes/management/users.js
@@ -40,7 +40,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listUsersRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('user', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -50,11 +50,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listUsersByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('user', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getUserPropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('user', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchUsersRouteHandler(req, res, search);
 });
diff --git a/src/routes/management/vendors.js b/src/routes/management/vendors.js
index eae759e..b072ddb 100644
--- a/src/routes/management/vendors.js
+++ b/src/routes/management/vendors.js
@@ -38,7 +38,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listVendorsRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('vendor', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -48,12 +48,12 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listVendorsByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('vendor', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getVendorPropertyValuesRouteHandler(req, res, property);
 });
 
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('vendor', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchVendorsRouteHandler(req, res, search);
 });
diff --git a/src/routes/production/filamentprofiles.js b/src/routes/production/filamentprofiles.js
index bbe67ef..7315809 100644
--- a/src/routes/production/filamentprofiles.js
+++ b/src/routes/production/filamentprofiles.js
@@ -36,7 +36,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   );
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('filamentProfile', 'list'), isAuthenticated, async (req, res) => {
   const properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -46,12 +46,12 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listFilamentProfilesByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('filamentProfile', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getFilamentProfilePropertyValuesRouteHandler(req, res, property);
 });
 
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('filamentProfile', 'list'), isAuthenticated, async (req, res) => {
   searchFilamentProfilesRouteHandler(req, res, req.query.search);
 });
 
diff --git a/src/routes/production/gcodefiles.js b/src/routes/production/gcodefiles.js
index 88f5da9..925487f 100644
--- a/src/routes/production/gcodefiles.js
+++ b/src/routes/production/gcodefiles.js
@@ -39,7 +39,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listGCodeFilesRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('gcodeFile', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -49,11 +49,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listGCodeFilesByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('gcodeFile', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getGCodeFilePropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('gcodeFile', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchGCodeFilesRouteHandler(req, res, search);
 });
diff --git a/src/routes/production/jobs.js b/src/routes/production/jobs.js
index 71bafe2..0de3bde 100644
--- a/src/routes/production/jobs.js
+++ b/src/routes/production/jobs.js
@@ -48,7 +48,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listJobsRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('job', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -58,11 +58,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listJobsByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('job', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getJobPropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('job', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchJobsRouteHandler(req, res, search);
 });
diff --git a/src/routes/production/printerprofiles.js b/src/routes/production/printerprofiles.js
index d7b2be6..1358c39 100644
--- a/src/routes/production/printerprofiles.js
+++ b/src/routes/production/printerprofiles.js
@@ -35,7 +35,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listPrinterProfilesRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('printerProfile', 'list'), isAuthenticated, async (req, res) => {
   const properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -45,12 +45,12 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listPrinterProfilesByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('printerProfile', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getPrinterProfilePropertyValuesRouteHandler(req, res, property);
 });
 
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('printerProfile', 'list'), isAuthenticated, async (req, res) => {
   searchPrinterProfilesRouteHandler(req, res, req.query.search);
 });
 
diff --git a/src/routes/production/printers.js b/src/routes/production/printers.js
index 9608719..093f318 100644
--- a/src/routes/production/printers.js
+++ b/src/routes/production/printers.js
@@ -39,7 +39,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listPrintersRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('printer', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -49,11 +49,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listPrintersByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('printer', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getPrinterPropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('printer', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchPrintersRouteHandler(req, res, search);
 });
diff --git a/src/routes/production/subjobs.js b/src/routes/production/subjobs.js
index 889cc44..3c88401 100644
--- a/src/routes/production/subjobs.js
+++ b/src/routes/production/subjobs.js
@@ -46,7 +46,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listSubJobsRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('subJob', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -56,11 +56,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listSubJobsByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('subJob', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getSubJobPropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('subJob', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchSubJobsRouteHandler(req, res, search);
 });
diff --git a/src/routes/sales/clients.js b/src/routes/sales/clients.js
index 8b9b74d..9bdf0bf 100644
--- a/src/routes/sales/clients.js
+++ b/src/routes/sales/clients.js
@@ -39,7 +39,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listClientsRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('client', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -49,11 +49,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listClientsByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('client', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getClientPropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('client', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchClientsRouteHandler(req, res, search);
 });
diff --git a/src/routes/sales/listings.js b/src/routes/sales/listings.js
index 4e38281..82de1bf 100644
--- a/src/routes/sales/listings.js
+++ b/src/routes/sales/listings.js
@@ -65,7 +65,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listListingsRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('listing', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -75,11 +75,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listListingsByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('listing', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getListingPropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('listing', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchListingsRouteHandler(req, res, search);
 });
diff --git a/src/routes/sales/listingvarients.js b/src/routes/sales/listingvarients.js
index 4a58c7e..e6f54f5 100644
--- a/src/routes/sales/listingvarients.js
+++ b/src/routes/sales/listingvarients.js
@@ -52,7 +52,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listListingVarientsRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('listingVarient', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -62,11 +62,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listListingVarientsByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('listingVarient', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getListingVarientPropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('listingVarient', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchListingVarientsRouteHandler(req, res, search);
 });
diff --git a/src/routes/sales/marketplaces.js b/src/routes/sales/marketplaces.js
index 67ecc78..0ce39af 100644
--- a/src/routes/sales/marketplaces.js
+++ b/src/routes/sales/marketplaces.js
@@ -54,7 +54,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listMarketplacesRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('marketplace', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -64,11 +64,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listMarketplacesByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('marketplace', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getMarketplacePropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('marketplace', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchMarketplacesRouteHandler(req, res, search);
 });
diff --git a/src/routes/sales/salesorders.js b/src/routes/sales/salesorders.js
index d6637d2..c72d65f 100644
--- a/src/routes/sales/salesorders.js
+++ b/src/routes/sales/salesorders.js
@@ -41,7 +41,7 @@ router.get('/', isAuthenticated, async (req, res) => {
   listSalesOrdersRouteHandler(req, res, page, limit, property, filter, search, getSort(sort, listAllowedSorters), order);
 });
 
-router.get('/properties', isAuthenticated, async (req, res) => {
+router.get('/properties', checkPermissions('salesOrder', 'list'), isAuthenticated, async (req, res) => {
   let properties = convertPropertiesString(req.query.properties);
   const filter = await getFilter(req.query, propertiesAllowedFilters, false);
   var masterFilter = {};
@@ -51,11 +51,11 @@ router.get('/properties', isAuthenticated, async (req, res) => {
   listSalesOrdersByPropertiesRouteHandler(req, res, properties, filter, masterFilter);
 });
 
-router.get('/values', isAuthenticated, async (req, res) => {
+router.get('/values', checkPermissions('salesOrder', 'list'), isAuthenticated, async (req, res) => {
   const { property } = req.query;
   getSalesOrderPropertyValuesRouteHandler(req, res, property);
 });
-router.get('/search', isAuthenticated, async (req, res) => {
+router.get('/search', checkPermissions('salesOrder', 'list'), isAuthenticated, async (req, res) => {
   const { search } = req.query;
   searchSalesOrdersRouteHandler(req, res, search);
 });