diff --git a/app/Http/Controllers/BookingController.php b/app/Http/Controllers/BookingController.php
index 89c78366..a91f34f5 100644
--- a/app/Http/Controllers/BookingController.php
+++ b/app/Http/Controllers/BookingController.php
@@ -10,6 +10,7 @@ use App\Rate;
 use App\UserBankSlip;
 use App\User;
 use App\Invoice;
+use App\SettingCredit;
 use Auth;
 use Validator;
 use DateTime;
@@ -87,10 +88,16 @@ class BookingController extends Controller
     {
         $rates = Rate::orderby('updated_at','desc')->first();
         $term = $request->input('term');
-        $amount = $request->input("amount");
+        $amount = $request->input("amount");    // in RMB
+        $creditLimit = SettingCredit::orderby('updated_at','desc')->first();
+        if($amount > $creditLimit->rmb_credit_limit){
+            return response()->json("Exceed credit limit, need approved from admin", 401);
+        }
+
         $user = Auth::user(); 
         $rate = 1; // default rate to 1 
 
+
         switch ($term) {
             case "x1_cash":
                 $rate = $rates->x1_cash;
@@ -197,107 +204,107 @@ class BookingController extends Controller
         $book_id->cnap = $request->input('cnap');
         $book_id->save();
  
-		return response()->json(['book_id'=>$book_id],200);
-	}
+        return response()->json(['book_id'=>$book_id],200);
+    }
 
-	public function uploadbankslip(Request $request, $id)
-	{
-		$booking = Booking::where('user_id',Auth::user()->id)->where('id',$id)->first();
-		
-		/* Validation*/
-		if (!$booking)
-		{
-			return response()->json(['message'=>'Access denied'], 200);
-		}
+    public function uploadbankslip(Request $request, $id)
+    {
+        $booking = Booking::where('user_id',Auth::user()->id)->where('id',$id)->first();
+        
+        /* Validation*/
+        if (!$booking)
+        {
+            return response()->json(['message'=>'Access denied'], 200);
+        }
 
-		$validator = Validator::make($request->all(), [
-			'file'   => 'image|mimes:jpg,jpeg,bmp,png'
-		]);
+        $validator = Validator::make($request->all(), [
+            'file'   => 'image|mimes:jpg,jpeg,bmp,png'
+        ]);
 
-		if($validator->fails())
-		{
-			return response()->json(['message'=>'Incorrect format'],200);
-		}
+        if($validator->fails())
+        {
+            return response()->json(['message'=>'Incorrect format'],200);
+        }
 
 
-		if(!$bankslip_file = $request->file('file'))
-		{
-			return response()->json(['message' => 'No file detected'], 400);
-		}
-		/* End Validation */
-		$filename = $bankslip_file->getClientOriginalName();
-		$ext = $bankslip_file->getClientOriginalExtension();
-		$input['file'] = $filename;
+        if(!$bankslip_file = $request->file('file'))
+        {
+            return response()->json(['message' => 'No file detected'], 400);
+        }
+        /* End Validation */
+        $filename = $bankslip_file->getClientOriginalName();
+        $ext = $bankslip_file->getClientOriginalExtension();
+        $input['file'] = $filename;
 
-		$unique_name = 'bank_slip_' . md5($filename. time()); // probably not a good idea 
-		$unique_image_path = $unique_name. '.' .$ext;
-		Storage::putFileAs(
-			'user_bankslip', $bankslip_file, $unique_image_path
-		); 
+        $unique_name = 'bank_slip_' . md5($filename. time()); // probably not a good idea 
+        $unique_image_path = $unique_name. '.' .$ext;
+        Storage::putFileAs(
+            'user_bankslip', $bankslip_file, $unique_image_path
+        ); 
 
-		$user_bankslip = new UserBankSlip;
-		$user_bankslip->booking_id = $booking->id;
-		$user_bankslip->bankslip_path =  $unique_image_path;
-		$user_bankslip->transfer_amount = $request->input('transfer_amount');
-		$user_bankslip->save();
+        $user_bankslip = new UserBankSlip;
+        $user_bankslip->booking_id = $booking->id;
+        $user_bankslip->bankslip_path =  $unique_image_path;
+        $user_bankslip->transfer_amount = $request->input('transfer_amount');
+        $user_bankslip->save();
 
 
-		return response()->json(['message'=>"Success"],200);
-	}
+        return response()->json(['message'=>"Success"],200);
+    }
 
-	public function updateBankSlipAmount(Request $request, $id){
-		$booking = Booking::where('user_id',Auth::user()->id)->where('id',$id)->first();
-		$user_bankslip = $booking->userBankSlip()->first();
+    public function updateBankSlipAmount(Request $request, $id){
+        $booking = Booking::where('user_id',Auth::user()->id)->where('id',$id)->first();
+        $user_bankslip = $booking->userBankSlip()->first();
 
-		if(!$user_bankslip){
-			return response()->json(["message"=> "not found"],400);
-		}
-		$user_bankslip->transfer_amount = $request->input('transfer_amount');
-		$user_bankslip->save();
-		return response()->json(["message"=> "Success"],200);
-	}
+        if(!$user_bankslip){
+            return response()->json(["message"=> "not found"],400);
+        }
+        $user_bankslip->transfer_amount = $request->input('transfer_amount');
+        $user_bankslip->save();
+        return response()->json(["message"=> "Success"],200);
+    }
 
-	public function uploadPurchaseOrder(Request $request, $id)
-	{
-		$booking = Booking::where('user_id',Auth::user()->id)->where('id',$id)->first();
+    public function uploadPurchaseOrder(Request $request, $id)
+    {
+        $booking = Booking::where('user_id',Auth::user()->id)->where('id',$id)->first();
 
-		/* Validation */
-			if (!$booking)
-			{
-				return response()->json(['message'=>'Access denied'], 200);
-			}
+        /* Validation */
+            if (!$booking)
+            {
+                return response()->json(['message'=>'Access denied'], 200);
+            }
 
-			$validator = Validator::make($request->all(), [
-				'file'   => 'image|mimes:jpg,jpeg,bmp,png'
-			]);
+            $validator = Validator::make($request->all(), [
+                'file'   => 'image|mimes:jpg,jpeg,bmp,png'
+            ]);
 
-			if($validator->fails())
-			{
-				return response()->json(['message'=>'Incorrect format'],200);
-			}
+            if($validator->fails())
+            {
+                return response()->json(['message'=>'Incorrect format'],200);
+            }
 
-			if(!$user_input_file = $request->file('file'))
-			{
-				return response()->json(['message' => 'No file detected'], 400);
-			}
-		/* End Validation */
+            if(!$user_input_file = $request->file('file'))
+            {
+                return response()->json(['message' => 'No file detected'], 400);
+            }
+        /* End Validation */
 
-		$filename = $user_input_file->getClientOriginalName();
-		$ext = $user_input_file->getClientOriginalExtension();
+        $filename = $user_input_file->getClientOriginalName();
+        $ext = $user_input_file->getClientOriginalExtension();
 
-		$input['file'] = $filename;
-		$unique_name = 'purchase_order_' . md5($filename. time());
-		$unique_image_path = $unique_name. '.' .$ext;
-		Storage::putFileAs(
-			'purchase_order',/*folder name*/ $user_input_file, $unique_image_path
-		);
+        $input['file'] = $filename;
+        $unique_name = 'purchase_order_' . md5($filename. time());
+        $unique_image_path = $unique_name. '.' .$ext;
+        Storage::putFileAs(
+            'purchase_order',/*folder name*/ $user_input_file, $unique_image_path
+        );
 
-		$user_po = new PurchaseOrder;
-		$user_po->image_path = $unique_image_path;
-		$user_po->book_id = $booking->id;
-		$user_po->save();
+        $user_po = new PurchaseOrder;
+        $user_po->image_path = $unique_image_path;
+        $user_po->book_id = $booking->id;
+        $user_po->save();
 
-		return response()->json(['message'=>'Success'],200);
+        return response()->json(['message'=>'Success'],200);
     }
     
     public function confirmPurchaseOrder($id){
@@ -307,179 +314,179 @@ class BookingController extends Controller
         return response()->json(['message'=>'Success'],200);
     }
 
-	public function delete(Booking $book_id)
-	{
-		$booking = Booking::where('user_id', Auth::user())->where('id', $book_id)->firstOrFail();
-		$booking->delete($book_id);
-		return response()->json($book_id, 204);
-	}
+    public function delete(Booking $book_id)
+    {
+        $booking = Booking::where('user_id', Auth::user())->where('id', $book_id)->firstOrFail();
+        $booking->delete($book_id);
+        return response()->json($book_id, 204);
+    }
 
-	public function cancel(Request $request, $book_id)
-	{
-		if (!$booking = Booking::where('user_id',Auth::user()->id)->where('id',$book_id)->first())
-		{
-			return response()->json(['message'=>'Access denied'], 200);
-		}
+    public function cancel(Request $request, $book_id)
+    {
+        if (!$booking = Booking::where('user_id',Auth::user()->id)->where('id',$book_id)->first())
+        {
+            return response()->json(['message'=>'Access denied'], 200);
+        }
 
-		$booking->is_cancel = true;
-		$booking->save();
+        $booking->is_cancel = true;
+        $booking->save();
 
-		return response()->json(['message'=>'Success'],200);
-	}
+        return response()->json(['message'=>'Success'],200);
+    }
 
-	public function calculation(Request $request)
-	{
-		$amount = $request->input('amount');
-		$term = $request->input('term');
-		$china_beneficiary = $request->input('china_beneficiary');
-		$rates = Rate::orderby('updated_at','desc')->first();
+    public function calculation(Request $request)
+    {
+        $amount = $request->input('amount');
+        $term = $request->input('term');
+        $china_beneficiary = $request->input('china_beneficiary');
+        $rates = Rate::orderby('updated_at','desc')->first();
  
-		// TODO : get marking 
-		$marking = "123X";
+        // TODO : get marking 
+        $marking = "123X";
  
-		switch ($term) {
-		 case "x1_cash":
-			 $rate = $rates->x1_cash;
-			 $payment_method = "cash";
-			 break;
-		 case "x1_cheque":
-			 $rate = $rates->x1_cheque;
-			 $payment_method = "Cheque";
-			 break;
-		 case "x1_ba":
-			 $rate = $rates->x1_ba;
-			 $payment_method = "BA";
-			 break;
-		 case "x2_cash":
-			 $rate = $rates->x2_cash;
-			 $payment_method = "Cash";
-			 break;
-		 case "x2_cheque":
-			 $rate = $rates->x2_cheque;
-			 $payment_method = "Cheque";
-			 break;
-		 case "x2_ba":
-			 $rate = $rates->x2_ba;
-			 $payment_method = "BA";
-			 break;
-		 default:
-			 return response()->json([
-				 'success' => false,
-				 'message' => 'Invalid input',
-			 ], 422);
-			 break;
-		 }
+        switch ($term) {
+         case "x1_cash":
+             $rate = $rates->x1_cash;
+             $payment_method = "cash";
+             break;
+         case "x1_cheque":
+             $rate = $rates->x1_cheque;
+             $payment_method = "Cheque";
+             break;
+         case "x1_ba":
+             $rate = $rates->x1_ba;
+             $payment_method = "BA";
+             break;
+         case "x2_cash":
+             $rate = $rates->x2_cash;
+             $payment_method = "Cash";
+             break;
+         case "x2_cheque":
+             $rate = $rates->x2_cheque;
+             $payment_method = "Cheque";
+             break;
+         case "x2_ba":
+             $rate = $rates->x2_ba;
+             $payment_method = "BA";
+             break;
+         default:
+             return response()->json([
+                 'success' => false,
+                 'message' => 'Invalid input',
+             ], 422);
+             break;
+         }
  
-		 if ($amount >= 10000 && ($term == 'x2_cash' || $term = 'x2_cheque' || $term = 'x2_ba')) {
-			 $svcharge = 0;
-		 } else {
-			 $svcharge = 20.00;
-		 }
+         if ($amount >= 10000 && ($term == 'x2_cash' || $term = 'x2_cheque' || $term = 'x2_ba')) {
+             $svcharge = 0;
+         } else {
+             $svcharge = 20.00;
+         }
  
-		 $bankin_amount = round(($amount + $svcharge) / $rate + (0 * ($amount + $svcharge)), 2);
+         $bankin_amount = round(($amount + $svcharge) / $rate + (0 * ($amount + $svcharge)), 2);
  
-		 return response()->json([
-			 'date' => date('Y-m-d'),
-			 'marking' => $marking,
-			 'amount' => $amount,
-			 'payment_method' => $payment_method,
-			 'service_charge' => $svcharge,
-			 'rate' => $rate,
-			 'bankin_amount' => $bankin_amount,
-			 'china_beneficary' => $china_beneficiary
-		 ], 200);
-	}
+         return response()->json([
+             'date' => date('Y-m-d'),
+             'marking' => $marking,
+             'amount' => $amount,
+             'payment_method' => $payment_method,
+             'service_charge' => $svcharge,
+             'rate' => $rate,
+             'bankin_amount' => $bankin_amount,
+             'china_beneficary' => $china_beneficiary
+         ], 200);
+    }
 
-	public function approveBankSlip(Request $request, $book_id)
-	{
-		if (!$booking = Booking::where('user_id',Auth::user()->id)->where('id',$book_id)->first())
-		{
-			return response()->json(['message'=>'Access denied'], 200);
-		}
+    public function approveBankSlip(Request $request, $book_id)
+    {
+        if (!$booking = Booking::where('user_id',Auth::user()->id)->where('id',$book_id)->first())
+        {
+            return response()->json(['message'=>'Access denied'], 200);
+        }
 
-		if(!$userBankSlip = UserBankSlip::where('book_id',$booking->id)->first())
-		{
-			return response()->json(['message'=>'Access denied'], 200);   
-		}
+        if(!$userBankSlip = UserBankSlip::where('booking_id',$booking->id)->first())
+        {
+            return response()->json(['message'=>'Access denied'], 200);   
+        }
 
-		// Rejected bankslip cannot be approve again
-		if($userBankSlip->is_reject == 1)
-		{
-			return response()->json(['message'=>'Bankslip already rejected'],200);    
-		}
+        // Rejected bankslip cannot be approve again
+        if($userBankSlip->is_reject == 1)
+        {
+            return response()->json(['message'=>'Bankslip already rejected'],200);    
+        }
 
-		$userBankSlip->is_approve = 1;
-		$userBankSlip->save();
-		return response()->json(['message'=>'Success'],200);
-	}
+        $userBankSlip->is_approve = 1;
+        $userBankSlip->save();
+        return response()->json(['message'=>'Success'],200);
+    }
 
-	public function rejectBankSlip(Request $request, $book_id)
-	{
-		if (!$booking = Booking::where('user_id',Auth::user()->id)->where('id',$book_id)->first())
-		{
-			return response()->json(['message'=>'Access denied'], 200);
-		}
+    public function rejectBankSlip(Request $request, $book_id)
+    {
+        if (!$booking = Booking::where('user_id',Auth::user()->id)->where('id',$book_id)->first())
+        {
+            return response()->json(['message'=>'Access denied'], 200);
+        }
 
-		if(!$userBankSlip = UserBankSlip::where('book_id',$booking->id)->first())
-		{
-			return response()->json(['message'=>'Access denied'], 200);
-		}
+        if(!$userBankSlip = UserBankSlip::where('booking_id',$booking->id)->first())
+        {
+            return response()->json(['message'=>'Access denied'], 200);
+        }
 
-		// approved bankslip cannot be reject again
-		if($userBankSlip->is_approve == 1)
-		{
-			return response()->json(['message'=>'Bankslip already approved'],200);    
-		}
+        // approved bankslip cannot be reject again
+        if($userBankSlip->is_approve == 1)
+        {
+            return response()->json(['message'=>'Bankslip already approved'],200);    
+        }
 
-		$userBankSlip->is_reject = 1;
-		$userBankSlip->reject_reason = $request->reject_reason;
-		$userBankSlip->save();
+        $userBankSlip->is_reject = 1;
+        $userBankSlip->reject_reason = $request->reject_reason;
+        $userBankSlip->save();
 
-		return response()->json(['message'=>'Success'],200);
-	}
+        return response()->json(['message'=>'Success'],200);
+    }
 
-	public function uploadInvoice(Request $request, $id)
-	{
-		$booking = Booking::where('user_id',Auth::user()->id)->where('id',$id)->first();
+    public function uploadInvoice(Request $request, $id)
+    {
+        $booking = Booking::where('user_id',Auth::user()->id)->where('id',$id)->first();
 
-		/* Validation */
-			if (!$booking)
-			{
-				return response()->json(['message'=>'Access denied'], 200);
-			}
+        /* Validation */
+            if (!$booking)
+            {
+                return response()->json(['message'=>'Access denied'], 200);
+            }
 
-			$validator = Validator::make($request->all(), [
-				'invoice_path'   => 'mimes:jpg,jpeg,bmp,png,pdf,doc,docx'
-			]);
+            $validator = Validator::make($request->all(), [
+                'invoice_path'   => 'mimes:jpg,jpeg,bmp,png,pdf,doc,docx'
+            ]);
 
-			if($validator->fails())
-			{
-				return response()->json(['message'=>'Incorrect format'],200);
-			}
+            if($validator->fails())
+            {
+                return response()->json(['message'=>'Incorrect format'],200);
+            }
 
-			if(!$input_file = $request->file('invoice_path'))
-			{
-				return response()->json(['message'=>'No file detected'], 400);
-			}
-		/* End Validation */
+            if(!$input_file = $request->file('invoice_path'))
+            {
+                return response()->json(['message'=>'No file detected'], 400);
+            }
+        /* End Validation */
 
-		$filename = $input_file->getClientOriginalName();
-		$ext = $input_file->getClientOriginalExtension();
+        $filename = $input_file->getClientOriginalName();
+        $ext = $input_file->getClientOriginalExtension();
 
-		$input['invoice_path'] = $filename;
-		$unique_name = 'invoice' . md5($filename. time());
-		$unique_file_url = $unique_name. '.' .$ext;
-		Storage::putFileAs(
-			'invoice',/*folder name*/ $input_file, $unique_file_url
-		);
-		
-		$invoice = new Invoice;
-		$invoice->invoice_path = $unique_file_url;
-		$invoice->amount = $request->input('amount');
-		$invoice->booking_id = $booking->id;
-		$invoice->save();
+        $input['invoice_path'] = $filename;
+        $unique_name = 'invoice' . md5($filename. time());
+        $unique_file_url = $unique_name. '.' .$ext;
+        Storage::putFileAs(
+            'invoice',/*folder name*/ $input_file, $unique_file_url
+        );
+        
+        $invoice = new Invoice;
+        $invoice->invoice_path = $unique_file_url;
+        $invoice->amount = $request->input('amount');
+        $invoice->booking_id = $booking->id;
+        $invoice->save();
 
-		return response()->json(['message'=>"Success"],200);
-	}
+        return response()->json(['message'=>"Success"],200);
+    }
 
 }
diff --git a/database/factories/SettingCreditFactory.php b/database/factories/SettingCreditFactory.php
index 890b6be2..2eb3fafc 100644
--- a/database/factories/SettingCreditFactory.php
+++ b/database/factories/SettingCreditFactory.php
@@ -4,6 +4,7 @@ use Faker\Generator as Faker;
 
 $factory->define(App\SettingCredit::class, function (Faker $faker) {
     return [
-        //
+        'rmb_credit_limit' => $faker->randomDigit,
+        'usd_credit_limit' => $faker->randomDigit
     ];
 });
diff --git a/tests/Feature/BookingTest.php b/tests/Feature/BookingTest.php
index cf137702..ee02d4f7 100644
--- a/tests/Feature/BookingTest.php
+++ b/tests/Feature/BookingTest.php
@@ -16,12 +16,14 @@ use App\User;
 use App\Booking;
 use App\UserBankSlip;
 use App\Role; 
+use App\SettingCredit;
 
 class BookingTest extends TestCase
 {
     protected $user;
     protected $booking;
     protected $userBankSlip;
+    protected $setting_credit;
     
     public function setUp()
     {
@@ -29,6 +31,7 @@ class BookingTest extends TestCase
         Artisan::call('db:seed');
 
         $this->user = factory(User::class)->create();
+        $this->setting_credit = factory(SettingCredit::class)->create();
         $this->booking = factory(Booking::class)->create([
             'user_id' => $this->user->id
         ]);
@@ -67,8 +70,14 @@ class BookingTest extends TestCase
             'usd_book_cnap' => '2131rew',
             'usd_book_bank_branch' => '2131rew',
             'verification_status' => '1'
-        ])
-        ->assertStatus(201);
+        ]);
+
+        if(14000 > $this->setting_credit->rmb_credit_limit){
+            $response->assertStatus(401);  
+        }
+        else{
+            $response->assertStatus(201);   
+        }
     }
 
     public function testuploadbankslip()