From 172a917086f9be7a579c55f5698d7150ae217a08 Mon Sep 17 00:00:00 2001
From: AdisakKanthawilang <adisak@frappet.com>
Date: Tue, 10 Sep 2024 11:42:11 +0700
Subject: [PATCH] fix

---
 BMA.EHR.Command.Service/Controllers/OrderController.cs | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/BMA.EHR.Command.Service/Controllers/OrderController.cs b/BMA.EHR.Command.Service/Controllers/OrderController.cs
index fd2792db..e131ec3e 100644
--- a/BMA.EHR.Command.Service/Controllers/OrderController.cs
+++ b/BMA.EHR.Command.Service/Controllers/OrderController.cs
@@ -609,6 +609,13 @@ namespace BMA.EHR.Command.Service.Controllers
         {
             try
             {
+                var getPermission = await _permission.GetPermissionAPIAsync("LIST", "COMMAND");
+                var jsonData = JsonConvert.DeserializeObject<JObject>(getPermission);
+                if (jsonData["status"]?.ToString() != "200")
+                {
+                    return Error(jsonData["message"]?.ToString(), StatusCodes.Status403Forbidden);
+                }
+
                 var data = (await _repository.GetAllAsync())
                             .Select(d => new
                             {