diff --git a/src/api/controllers/v1/staff.controller.js b/src/api/controllers/v1/staff.controller.js
index 45b0f31..2285fd1 100644
--- a/src/api/controllers/v1/staff.controller.js
+++ b/src/api/controllers/v1/staff.controller.js
@@ -3,6 +3,8 @@ import { pick } from 'lodash';
 import messages from '../../../config/messages';
 import { handler as ErrorHandler } from '../../middlewares/error';
 import User from '../../../common/models/user.model';
+import {hash} from 'bcryptjs';
+
 
 /**
  * Create
@@ -14,10 +16,12 @@ import User from '../../../common/models/user.model';
 exports.create = async (req, res, next) => {
     // transform data
     req.body.created_by = pick(req.user, ['id', 'name']);
+    
 
     // save data
     await User.create(req.body)
         .then(data => {
+            console.log(data); 
             res.json({
                 code: 0,
                 message: messages.CREATE_SUCCESS,
@@ -25,7 +29,22 @@ exports.create = async (req, res, next) => {
             });
         }).catch(ex => {
             ErrorHandler(ex, req, res, next);
+
+
         });
+    // await User.destroy({
+    //     where : {
+    //         email: "teststaff@gmail.com"
+    //     }
+    // }).then( rs => { 
+    //     return res.json({
+    //         ms: "success"
+    //     });
+    // }).catch(ex => {
+    //     ErrorHandler(ex,req,res,next);
+    // })
+
+    
 };
 
 /**
@@ -36,16 +55,19 @@ exports.create = async (req, res, next) => {
  * @returns {Promise<StorySchema[]>, APIException>}
  */
 exports.list = async (req, res, next) => {
-    // req.query.types = User.Types.STAFF;
-    User.list(
-        req.query
+    req.query.services = User.Services.STAFF;
+    // console.log(req.query)
+    await User.list(
+       req.query
     ).then(result => {
+        console.log(result );
         res.json({
             code: 0,
             count: req.totalRecords,
             data: result.map(
                 x => User.transform(x)
             )
+            
         });
     }).catch(ex => {
         ErrorHandler(ex, req, res, next);
diff --git a/src/api/controllers/v1/user.controller.js b/src/api/controllers/v1/user.controller.js
index f79ec62..39508b5 100644
--- a/src/api/controllers/v1/user.controller.js
+++ b/src/api/controllers/v1/user.controller.js
@@ -41,7 +41,7 @@ exports.create = async (req, res, next) => {
  * @returns {Promise<StorySchema[]>, APIException>}
  */
 exports.list = async (req, res, next) => {
-    req.query.services = User.Services.USER
+    req.query.services = User.Services.USER;
     User.list(
         req.query
     ).then(result => {
diff --git a/src/api/middlewares/auth.middleware.js b/src/api/middlewares/auth.middleware.js
index 5ac8eaf..7ffcc3f 100644
--- a/src/api/middlewares/auth.middleware.js
+++ b/src/api/middlewares/auth.middleware.js
@@ -73,6 +73,7 @@ function parseAuthHeader(headerValue) {
  * @returns {Object}
  */
 function getUserFromJwtPayload(jwtPayload) {
+    
     const user = {
         id: jwtPayload.id,
         name: jwtPayload.name,
@@ -102,6 +103,7 @@ function checkStaffPermission(req, requestedPermissions) {
     if (requestedPermissions.includes(Configs.PERMISSION_LOGGED_IN)) {
         return true;
     }
+    
 
     // check service permissions
     const { permissions } = req.user;
@@ -135,6 +137,7 @@ const getTokenInfo = (req) => {
         return null;
     }
     jwt.payload = jsonwentoken.decode(jwt.value, { json: true });
+    // console.log(jwt);
     return jwt;
 };
 /**
@@ -192,7 +195,7 @@ const loadInfo = async (req) => {
     req.tokenInfo = tokenInfo;
     req.authInfo = getAuthInfo(req);
 
-    console.log(req.authInfo);
+    // console.log(req.authInfo);
     // load permission for staff
     if (req.authInfo.accessLevel === ConsumerGroups.STAFF && user !== null) {
         req.user.permissions = await Configs.getStaffPermissions(
@@ -238,7 +241,7 @@ const checkPermission = async (req, permissions, additionalCheck) => {
             return null;
         case ConsumerGroups.STAFF:
             // remove user permission
-            console.log("1231231232");
+            // console.log("1231231232");
             if (userPermissionIndex !== -1) {
                 permissionsToCheck.splice(userPermissionIndex, 1);
             }
@@ -257,12 +260,12 @@ const checkPermission = async (req, permissions, additionalCheck) => {
             }
             break;
 
-        case ConsumerGroups.ADMINISTRATOR:
-            if (adminPermissionIndex !== -1 && userPermissionIndex=== -1) {
-                console.log("ConsumerGroups.ADMINISTRATOR");
-                return null
-            };
-            break;
+        // case ConsumerGroups.ADMINISTRATOR:
+        //     if (adminPermissionIndex !== -1 && userPermissionIndex=== -1) {
+        //         console.log("ConsumerGroups.ADMINISTRATOR");
+        //         return null
+        //     };
+        //     break;
         default:
             // reject guest access
             return apiError;
diff --git a/src/api/middlewares/authen.middleware.js b/src/api/middlewares/authen.middleware.js
index a00101d..3226dfe 100644
--- a/src/api/middlewares/authen.middleware.js
+++ b/src/api/middlewares/authen.middleware.js
@@ -35,7 +35,7 @@ exports.loadUser = async (req, res, next) => {
     try {
         const user = await User.getUserByPhoneOrEmail({ email: req.body.email || req.body.username });
         if (!user) {
-            return res.status(400).json({ message: 'email or password incorrect' });
+            return res.status(400).json({ message: 'email  incorrect' });
         }
         req.locals = {
             user
@@ -47,10 +47,11 @@ exports.loadUser = async (req, res, next) => {
 };
 exports.checkPassword = async (req, res, next) => {
     const { user } = req.locals;
+    console.log(user.password);
     // console.log(user);
     const isCheck = await User.passwordMatches(user, req.body.password);
     if (!isCheck) {
-        return res.status(400).json({ message: 'Email or password incorrect' });
+        return res.status(400).json({ message: ' password incorrect' });
     }
     return next();
 };
diff --git a/src/api/middlewares/staff.middleware.js b/src/api/middlewares/staff.middleware.js
index 99da6c4..fa25e45 100644
--- a/src/api/middlewares/staff.middleware.js
+++ b/src/api/middlewares/staff.middleware.js
@@ -44,10 +44,18 @@ exports.load = async (req, res, next) => {
  */
 exports.count = async (req, res, next) => {
     try {
-        req.query.types = User.Types.STAFF;
-        req.totalRecords = await User.totalRecords(
-            req.query
-        );
+        req.query.service = User.Types.STAFF;
+        const total = await User.count({
+            where: {
+                service: req.query.service,
+                is_active : true
+            }
+        });
+        // console.log(total);
+        // req.totalRecords = await User.totalRecords(
+        //     req.query
+        // );
+        req.totalRecords = total;
         return next();
     } catch (ex) {
         return ErrorHandler(ex, req, res, next);
@@ -57,11 +65,13 @@ exports.count = async (req, res, next) => {
 /**
  * Load item by id add to req locals.
  */
-exports.checkEmail = async (req, res, next) => {
+exports.checkExistingEmail = async (req, res, next) => {
     try {
-        const user = await User.findOne({ email: req.body.email });
+        const user = await User.findOne( {
+            where: { email: req.body.email }
+        });
         if (user) {
-            return res.status(400).json({ message: 'email have aldready exist' });
+            return res.status(400).json({ message: 'email have aldready exist', data: user , email: req.body.email});
         }
         return next();
     } catch (ex) {
@@ -86,6 +96,7 @@ exports.prepareParams = async (req, res, next) => {
     const params = cloneDeep(req.body);
     params.type = User.Types.STAFF;
     params.service = User.Services.STAFF;
+    // params.password = "123456";
     if (params.name) {
         params.normalize_name = convertToEn(`${params.name}`);
     }
diff --git a/src/api/routes/v1/staff.route.js b/src/api/routes/v1/staff.route.js
index 0a414b9..50218fb 100644
--- a/src/api/routes/v1/staff.route.js
+++ b/src/api/routes/v1/staff.route.js
@@ -22,8 +22,9 @@ router
     )
     .post(
         validate(createValidation),
-        // authorize([permissions.LOGGED_IN]),
+        authorize([permissions.LOGGED_IN]),
         middleware.prepareParams,
+        middleware.checkExistingEmail,
         controller.create
     );
 
diff --git a/src/common/models/user.model.js b/src/common/models/user.model.js
index 2f3768e..1adcbc2 100644
--- a/src/common/models/user.model.js
+++ b/src/common/models/user.model.js
@@ -339,7 +339,7 @@ User.addHook('beforeCreate', async (model) => {
     if (user.password) {
         const rounds = 10;
         user.password = await hash(user.password, rounds);
-        console.log(123212312312321312);
+        console.log("pass created");
     }
 
     return user;
@@ -452,6 +452,8 @@ function filterConditions(params) {
     }
     delete options.services;
 
+    // console.log("delete services from asfsd");
+
     if (options.genders) {
         options.gender = { [Op.in]: options.genders.split(',') };
     }
@@ -480,6 +482,7 @@ function filterConditions(params) {
     // Date Filter
     checkMinMaxOfConditionFields(options, 'created_at', 'Date');
 
+
     return options;
 }
 
@@ -561,7 +564,10 @@ User.transform = (params, includeRestrictedFields = true) => {
             'created_by'
         ];
         fields.push(...privateFiles);
-    }
+    };
+
+    // console.log(fields + "@@@");
+
     fields.forEach((field) => {
         transformed[field] = params[field];
     });
@@ -589,6 +595,7 @@ User.transform = (params, includeRestrictedFields = true) => {
     dateFields.forEach((field) => {
         transformed[field] = moment(params[field]).unix();
     });
+    // console.log(transformed);
 
     return transformed;
 };
@@ -837,10 +844,13 @@ User.list = async ({
         min_total_debt,
         max_total_debt,
     });
+
     const sorts = sortConditions({
         sort_by,
         order_by
     });
+
+
     return User.findAll({
         where: options,
         order: [sorts],
diff --git a/src/config/locales/en.json b/src/config/locales/en.json
index 3ef04e7..adf5344 100644
--- a/src/config/locales/en.json
+++ b/src/config/locales/en.json
@@ -23,5 +23,9 @@
 	"Cannot access 'user' before initialization": "Cannot access 'user' before initialization",
 	"Không tìm thấy người dùng này!": "Không tìm thấy người dùng này!",
 	"Không tìm thấy người dùng này!!!!": "Không tìm thấy người dùng này!!!!",
-	"Missing where attribute in the options parameter": "Missing where attribute in the options parameter"
+	"Missing where attribute in the options parameter": "Missing where attribute in the options parameter",
+	"column user.services does not exist": "column user.services does not exist",
+	"log is not defined": "log is not defined",
+	"connect ETIMEDOUT 113.177.27.200:5432": "connect ETIMEDOUT 113.177.27.200:5432",
+	"Validation error: Validation isEmail on email failed": "Validation error: Validation isEmail on email failed"
 }
\ No newline at end of file