diff --git a/src/controllers/EvaluationController.ts b/src/controllers/EvaluationController.ts
index 385e8f6..f40887d 100644
--- a/src/controllers/EvaluationController.ts
+++ b/src/controllers/EvaluationController.ts
@@ -31,7 +31,7 @@ import { Brackets, In } from "typeorm";
 import CallAPI from "../interfaces/call-api";
 import permission from "../interfaces/permission";
 import { RequestWithUser } from "../middlewares/user";
-import { setLogDataDiff } from "../interfaces/utils";
+import { resolveNodeId, resolveNodeLevel, setLogDataDiff } from "../interfaces/utils";
 import Extension from "../interfaces/extension";
 import { Portfolio } from "../entities/Portfolio";
 import { Performance } from "../entities/Performance";
@@ -152,64 +152,197 @@ export class EvaluationController {
     try {
       // await new permission().PermissionList(request, "SYS_EVA_REQ");
       let _data = await new permission().PermissionOrgList(request, "SYS_EVA_REQ");
-      await new CallAPI()
-        .PostData(request, "/org/finddna", _data)
-        .then((x) => {
-          _data = x;
-        })
-        .catch((x) => {});
+      const orgDna = await new permission().checkDna(request, request.user.sub)
+      let typeCondition: {
+        query?: string;
+        params?: any;
+      } = {};
+      let level = resolveNodeLevel(orgDna);
+      let nodeId = resolveNodeId(orgDna);
+      let conditions: string[] = [];
+      let params: any = {};
+      if (_data.privilege === "CHILD" || _data.privilege === "PARENT" || _data.privilege === "BROTHER") {
+        if (_data.privilege === "CHILD") {
+
+          if (level === 0 && orgDna.rootDnaId) {
+            conditions.push("evaluation.rootDnaId = :root");
+            params.root = orgDna.rootDnaId;
+          }
+
+          if (level != null && level >= 1 && orgDna.child1DnaId) {
+            conditions.push("evaluation.child1DnaId = :child1");
+            params.child1 = orgDna.child1DnaId;
+          }
+
+          if (level != null && level >= 2 && orgDna.child2DnaId) {
+            conditions.push("evaluation.child2DnaId = :child2");
+            params.child2 = orgDna.child2DnaId;
+          }
+
+          if (level != null && level >= 3 && orgDna.child3DnaId) {
+            conditions.push("evaluation.child3DnaId = :child3");
+            params.child3 = orgDna.child3DnaId;
+          }
+
+          if (level != null && level >= 4 && orgDna.child4DnaId) {
+            conditions.push("evaluation.child4DnaId = :child4");
+            params.child4 = orgDna.child4DnaId;
+          }
+
+          if (conditions.length > 0) {
+            typeCondition = {
+              query: conditions.join(" AND "),
+              params,
+            };
+          }
+        } else if (_data.privilege === "BROTHER") {
+          const parentLevel = level !== null ? level - 1 : null;
+          if (parentLevel != null && parentLevel === 0 && orgDna.rootDnaId) {
+            conditions.push("evaluation.rootDnaId = :root");
+            params.root = orgDna.rootDnaId;
+          }
+
+          if (parentLevel != null && parentLevel >= 1 && orgDna.child1DnaId) {
+            conditions.push("evaluation.child1DnaId = :child1");
+            params.child1 = orgDna.child1DnaId;
+          }
+
+          if (parentLevel != null && parentLevel >= 2 && orgDna.child2DnaId) {
+            conditions.push("evaluation.child2DnaId = :child2");
+            params.child2 = orgDna.child2DnaId;
+          }
+
+          if (parentLevel != null && parentLevel >= 3 && orgDna.child3DnaId) {
+            conditions.push("evaluation.child3DnaId = :child3");
+            params.child3 = orgDna.child3DnaId;
+          }
+
+          if (conditions.length > 0) {
+            typeCondition = {
+              query: conditions.join(" AND "),
+              params,
+            };
+          }
+        } else if (_data.privilege === "PARENT") {
+          if (level === 0) {
+            if (orgDna.rootDnaId) {
+              conditions.push("evaluation.rootDnaId = :root");
+              params.root = orgDna.rootDnaId;
+            }
+          } else if (level === 1) {
+            if (orgDna.rootDnaId) {
+              conditions.push("evaluation.rootDnaId = :root AND evaluation.child1DnaId IS NOT NULL");
+              params.root = orgDna.rootDnaId;
+            }
+          } else if (level === 2) {
+            conditions.push("evaluation.child1DnaId = :child1 AND evaluation.child2DnaId IS NOT NULL");
+            params.child1 = orgDna.child1DnaId;
+          } else if (level === 3) {
+            conditions.push("evaluation.child2DnaId = :child2 AND evaluation.child3DnaId IS NOT NULL");
+            params.child2 = orgDna.child2DnaId;
+          } else if (level === 4) {
+            conditions.push("evaluation.child3DnaId = :child3 AND evaluation.child4DnaId IS NOT NULL");
+            params.child3 = orgDna.child3DnaId;
+          }
+
+          if (conditions.length > 0) {
+            typeCondition = {
+              query: conditions.join(" AND "),
+              params,
+            };
+          }
+        }
+      } else if (_data.privilege === "OWNER" || _data.privilege === "ROOT") {
+        if (orgDna.rootDnaId) {
+          conditions.push("evaluation.rootDnaId = :root");
+          params.root = orgDna.rootDnaId;
+        }
+
+        if (orgDna.child1DnaId) {
+          conditions.push("evaluation.child1DnaId = :child1");
+          params.child1 = orgDna.child1DnaId;
+        }
+
+        if (orgDna.child2DnaId) {
+          conditions.push("evaluation.child2DnaId = :child2");
+          params.child2 = orgDna.child2DnaId;
+        }
+
+        if (orgDna.child3DnaId) {
+          conditions.push("evaluation.child3DnaId = :child3");
+          params.child3 = orgDna.child3DnaId;
+        }
+
+        if (orgDna.child4DnaId) {
+          conditions.push("evaluation.child4DnaId = :child4");
+          params.child4 = orgDna.child4DnaId;
+        }
+
+        if (conditions.length > 0) {
+          typeCondition = {
+            query: conditions.join(" AND "),
+            params,
+          };
+        }
+      } else if (_data.privilege === "NORMAL") {
+        console.log("test normal>>>");
+
+        if (level !== null && nodeId) {
+          switch (level) {
+            case 0:
+              typeCondition = {
+                query: `
+            evaluation.rootDnaId = :nodeId
+            AND evaluation.child1DnaId IS NULL
+          `,
+                params: { nodeId },
+              };
+              break;
+
+            case 1:
+              typeCondition = {
+                query: `
+            evaluation.child1DnaId = :nodeId
+            AND evaluation.child2DnaId IS NULL
+          `,
+                params: { nodeId },
+              };
+              break;
+
+            case 2:
+              typeCondition = {
+                query: `
+            evaluation.child2DnaId = :nodeId
+            AND evaluation.child3DnaId IS NULL
+          `,
+                params: { nodeId },
+              };
+              break;
+
+            case 3:
+              typeCondition = {
+                query: `
+            evaluation.child3DnaId = :nodeId
+            AND evaluation.child4DnaId IS NULL
+          `,
+                params: { nodeId },
+              };
+              break;
+
+            case 4:
+              typeCondition = {
+                query: `
+            evaluation.child4DnaId = :nodeId
+          `,
+                params: { nodeId },
+              };
+              break;
+          }
+        }
+      }
+
       let query = await AppDataSource.getRepository(Evaluation)
         .createQueryBuilder("evaluation")
-        .andWhere(
-          _data.root != undefined && _data.root != null
-            ? _data.root[0] != null
-              ? `evaluation.rootDnaId IN (:...root)`
-              : `evaluation.rootDnaId is null`
-            : "1=1",
-          {
-            root: _data.root,
-          },
-        )
-        .andWhere(
-          _data.child1 != undefined && _data.child1 != null
-            ? _data.child1[0] != null
-              ? `evaluation.child1DnaId IN (:...child1)`
-              : `evaluation.child1DnaId is ${_data.privilege == "PARENT" ? "not null" : "null"}`
-            : "1=1",
-          {
-            child1: _data.child1,
-          },
-        )
-        .andWhere(
-          _data.child2 != undefined && _data.child2 != null
-            ? _data.child2[0] != null
-              ? `evaluation.child2DnaId IN (:...child2)`
-              : `evaluation.child2DnaId is null`
-            : "1=1",
-          {
-            child2: _data.child2,
-          },
-        )
-        .andWhere(
-          _data.child3 != undefined && _data.child3 != null
-            ? _data.child3[0] != null
-              ? `evaluation.child3DnaId IN (:...child3)`
-              : `evaluation.child3DnaId is null`
-            : "1=1",
-          {
-            child3: _data.child3,
-          },
-        )
-        .andWhere(
-          _data.child4 != undefined && _data.child4 != null
-            ? _data.child4[0] != null
-              ? `evaluation.child4DnaId IN (:...child4)`
-              : `evaluation.child4DnaId is null`
-            : "1=1",
-          {
-            child4: _data.child4,
-          },
-        )
         .andWhere(
           new Brackets((qb) => {
             qb.andWhere(
@@ -236,6 +369,10 @@ export class EvaluationController {
           }),
         );
 
+      if (typeCondition.query) {
+        query.andWhere(typeCondition.query, typeCondition.params);
+      }
+
       if (body.sortBy) {
         query = query.orderBy(`evaluation.${body.sortBy}`, body.descending ? "DESC" : "ASC");
       } else {
@@ -839,8 +976,8 @@ export class EvaluationController {
           isSendInbox: true,
           isSendNotification: true,
         })
-        .then((x) => {})
-        .catch((x) => {});
+        .then((x) => { })
+        .catch((x) => { });
       return new HttpSuccess({
         id: evaluation.id,
       });
@@ -919,8 +1056,8 @@ export class EvaluationController {
           isSendInbox: true,
           isSendNotification: true,
         })
-        .then((x) => {})
-        .catch((x) => {});
+        .then((x) => { })
+        .catch((x) => { });
       return new HttpSuccess({
         id: evaluation.id,
       });
@@ -1772,8 +1909,8 @@ export class EvaluationController {
           isSendInbox: true,
           isSendNotification: true,
         })
-        .then((x) => {})
-        .catch((x) => {});
+        .then((x) => { })
+        .catch((x) => { });
       return new HttpSuccess();
     } catch (error: any) {
       if (error instanceof HttpError) {
@@ -1874,7 +2011,7 @@ export class EvaluationController {
         .then((x) => {
           _director = x;
         })
-        .catch((x) => {});
+        .catch((x) => { });
       await Promise.all(
         _director.map((director: any) => {
           return new CallAPI()
@@ -1887,8 +2024,8 @@ export class EvaluationController {
               isSendInbox: true,
               isSendNotification: true,
             })
-            .then((x) => {})
-            .catch((x) => {});
+            .then((x) => { })
+            .catch((x) => { });
         }),
       );
       return new HttpSuccess();
@@ -1994,8 +2131,8 @@ export class EvaluationController {
           isSendInbox: true,
           isSendNotification: true,
         })
-        .then((x) => {})
-        .catch((x) => {});
+        .then((x) => { })
+        .catch((x) => { });
       return new HttpSuccess();
     } catch (error: any) {
       if (error instanceof HttpError) {
@@ -2057,8 +2194,8 @@ export class EvaluationController {
           isSendInbox: true,
           isSendNotification: true,
         })
-        .then((x) => {})
-        .catch((x) => {});
+        .then((x) => { })
+        .catch((x) => { });
       return new HttpSuccess();
     } catch (error: any) {
       if (error instanceof HttpError) {
@@ -2115,8 +2252,8 @@ export class EvaluationController {
           isSendInbox: true,
           isSendNotification: true,
         })
-        .then((x) => {})
-        .catch((x) => {});
+        .then((x) => { })
+        .catch((x) => { });
       return new HttpSuccess();
     } catch (error: any) {
       if (error instanceof HttpError) {
@@ -2173,8 +2310,8 @@ export class EvaluationController {
           isSendInbox: true,
           isSendNotification: true,
         })
-        .then((x) => {})
-        .catch((x) => {});
+        .then((x) => { })
+        .catch((x) => { });
       return new HttpSuccess();
     } catch (error: any) {
       if (error instanceof HttpError) {
@@ -2286,8 +2423,8 @@ export class EvaluationController {
           isSendInbox: true,
           isSendNotification: true,
         })
-        .then((x) => {})
-        .catch((x) => {});
+        .then((x) => { })
+        .catch((x) => { });
       return new HttpSuccess();
     } catch (error: any) {
       if (error instanceof HttpError) {
@@ -2391,8 +2528,8 @@ export class EvaluationController {
           isSendInbox: true,
           isSendNotification: true,
         })
-        .then((x) => {})
-        .catch((x) => {});
+        .then((x) => { })
+        .catch((x) => { });
       return new HttpSuccess();
     } catch (error: any) {
       if (error instanceof HttpError) {
@@ -2456,8 +2593,8 @@ export class EvaluationController {
           isSendInbox: true,
           isSendNotification: true,
         })
-        .then((x) => {})
-        .catch((x) => {});
+        .then((x) => { })
+        .catch((x) => { });
       return new HttpSuccess();
     } catch (error: any) {
       if (error instanceof HttpError) {
@@ -2548,8 +2685,8 @@ export class EvaluationController {
           isSendInbox: true,
           isSendNotification: true,
         })
-        .then((x) => {})
-        .catch((x) => {});
+        .then((x) => { })
+        .catch((x) => { });
       return new HttpSuccess();
     } catch (error: any) {
       if (error instanceof HttpError) {
@@ -2602,8 +2739,8 @@ export class EvaluationController {
           isSendInbox: true,
           isSendNotification: true,
         })
-        .then((x) => {})
-        .catch((x) => {});
+        .then((x) => { })
+        .catch((x) => { });
       return new HttpSuccess();
     } catch (error: any) {
       if (error instanceof HttpError) {
@@ -2696,8 +2833,8 @@ export class EvaluationController {
           evaluation.datePrepareDoc2 == null
             ? null
             : new Date(
-                evaluation.datePrepareDoc2.setMonth(evaluation.datePrepareDoc2.getMonth() + 6),
-              ),
+              evaluation.datePrepareDoc2.setMonth(evaluation.datePrepareDoc2.getMonth() + 6),
+            ),
       };
 
       return new HttpSuccess(responseData);
@@ -2742,8 +2879,8 @@ export class EvaluationController {
           evaluation.datePrepareDoc2 == null
             ? null
             : new Date(
-                evaluation.datePrepareDoc2.setMonth(evaluation.datePrepareDoc2.getMonth() + 6),
-              ),
+              evaluation.datePrepareDoc2.setMonth(evaluation.datePrepareDoc2.getMonth() + 6),
+            ),
       };
 
       return new HttpSuccess(responseData);
@@ -2782,8 +2919,8 @@ export class EvaluationController {
           isSendInbox: true,
           isSendNotification: true,
         })
-        .then((x) => {})
-        .catch((x) => {});
+        .then((x) => { })
+        .catch((x) => { });
       return new HttpSuccess();
     } catch (error: any) {
       if (error instanceof HttpError) {
@@ -2820,8 +2957,8 @@ export class EvaluationController {
           isSendInbox: true,
           isSendNotification: true,
         })
-        .then((x) => {})
-        .catch((x) => {});
+        .then((x) => { })
+        .catch((x) => { });
       return new HttpSuccess();
     } catch (error: any) {
       if (error instanceof HttpError) {
diff --git a/src/interfaces/permission.ts b/src/interfaces/permission.ts
index 728664d..646b4c6 100644
--- a/src/interfaces/permission.ts
+++ b/src/interfaces/permission.ts
@@ -269,6 +269,20 @@ class CheckAuth {
     }
   }
 
+  public async checkDna(request: RequestWithUser, keycloakId: any) {
+    try {
+      const result = await new CallAPI().GetData(
+        request,
+        `/org/finddna-by-keycloak/${keycloakId}`,
+        false
+      );
+
+      return result;
+    } catch (error) {
+      console.error("Error calling API:", error);
+      throw error;
+    }
+  }
 
   public async PermissionCreate(req: RequestWithUser, system: string) {
     return await this.Permission(req, system, "CREATE");
diff --git a/src/interfaces/utils.ts b/src/interfaces/utils.ts
index c667f54..4f20713 100644
--- a/src/interfaces/utils.ts
+++ b/src/interfaces/utils.ts
@@ -45,3 +45,24 @@ export function addLogSequence(req: RequestWithUser, data: LogSequence) {
 export function editLogSequence(req: RequestWithUser, index: number, data: LogSequence) {
   req.app.locals.logData.sequence[index] = data;
 }
+
+export function resolveNodeLevel(data: any) {
+  if (data.child4DnaId) return 4;
+  if (data.child3DnaId) return 3;
+  if (data.child2DnaId) return 2;
+  if (data.child1DnaId) return 1;
+  if (data.rootDnaId) return 0;
+  return null;
+}
+
+
+export function resolveNodeId(data: any) {
+  return (
+    data.child4DnaId ??
+    data.child3DnaId ??
+    data.child2DnaId ??
+    data.child1DnaId ??
+    data.rootDnaId ??
+    null
+  );
+}
\ No newline at end of file