diff --git a/routes/api.php b/routes/api.php
index 01baa55b..38322b8f 100644
--- a/routes/api.php
+++ b/routes/api.php
@@ -18,77 +18,79 @@ Use App\SettingSupplier;
 */
 
 Route::middleware('auth:api')->get('/user', function (Request $request) {
-    return $request->user();
+	return $request->user();
 });
 
 
-
 //Route::middleware('auth:api')->get('/user', function (Request $request) {
 //    return $request->user();
 //});
 Route::group(['middleware' => 'auth:api'], function () {
-    Route::post('logout', 'Auth\LoginController@logout');
+	Route::post('logout', 'Auth\LoginController@logout');
 
-    /*Route for the booking */
-    Route::get('/booking', 'BookingController@index');
-    Route::get('/booking/{book_id}', 'BookingController@show');
-    Route::put('/booking/{book_id}', 'BookingController@update');
-    Route::delete('/booking/{book_id}', 'BookingController@delete');
-    Route::post('/booking', 'BookingController@store');
-    Route::post('/booking/calculation', 'BookingController@calculation');
-    Route::post('/booking/{book_id}/cancel', 'BookingController@cancel');
-    Route::post('/booking/{id}/upload-user-bankslip', 'BookingController@uploadbankslip');
-    Route::post('/booking/{id}/upload-po', 'BookingController@uploadPurchaseOrder');
-    Route::patch('/booking/{id}/bankslip-amount', 'BookingController@updateBankSlipAmount');
-    Route::post('booking/{book_id}/approve-bank-slip','BookingController@approveBankSlip');
-    Route::get('/user', 'UserController@show');
+	/*Route for the booking */
+	Route::get('/booking', 'BookingController@index');
+	Route::get('/booking/{book_id}', 'BookingController@show');
+	Route::put('/booking/{book_id}', 'BookingController@update');
+	Route::delete('/booking/{book_id}', 'BookingController@delete');
+	Route::post('/booking', 'BookingController@store');
+	Route::post('/booking/calculation', 'BookingController@calculation');
+	Route::post('/booking/{book_id}/cancel', 'BookingController@cancel');
+	Route::post('/booking/{id}/upload-user-bankslip', 'BookingController@uploadbankslip');
+	Route::post('/booking/{id}/upload-po', 'BookingController@uploadPurchaseOrder');
+	Route::patch('/booking/{id}/bankslip-amount', 'BookingController@updateBankSlipAmount');
+	Route::post('booking/{book_id}/reject-bank-slip','BookingController@rejectBankSlip');
+	Route::post('booking/{book_id}/approve-bank-slip','BookingController@approveBankSlip');
+	Route::post('booking/{book_id}/cancel', 'BookingController@cancel');
+	Route::get('/user', 'UserController@show');
 });
 
-    Route::patch('settings/profile', 'Settings\ProfileController@update');
-    Route::patch('settings/password', 'Settings\PasswordController@update');
+	Route::patch('settings/profile', 'Settings\ProfileController@update');
+	Route::patch('settings/password', 'Settings\PasswordController@update');
 
 
 Route::group(['middleware' => 'guest:api'], function () {
-    Route::post('login', 'Auth\LoginController@login');
-    Route::post('register', 'Auth\RegisterController@register');
-    Route::post('password/email', 'Auth\ForgotPasswordController@sendResetLinkEmail');
-    Route::post('password/reset', 'Auth\ResetPasswordController@reset');
+	Route::post('login', 'Auth\LoginController@login');
+	Route::post('register', 'Auth\RegisterController@register');
+	Route::post('password/email', 'Auth\ForgotPasswordController@sendResetLinkEmail');
+	Route::post('password/reset', 'Auth\ResetPasswordController@reset');
 
-    Route::post('oauth/{driver}', 'Auth\OAuthController@redirectToProvider');
-    Route::get('oauth/{driver}/callback', 'Auth\OAuthController@handleProviderCallback')->name('oauth.callback');
+	Route::post('oauth/{driver}', 'Auth\OAuthController@redirectToProvider');
+	Route::get('oauth/{driver}/callback', 'Auth\OAuthController@handleProviderCallback')->name('oauth.callback');
+});
+
+Route::group(['middleware' => 'role:admin'], function() {
+	Route::post('update-rate', 'RateController@store');
+	Route::put('update-rate/{rate}', 'RateController@update');
+	Route::delete('update-rate/{rate}', 'RateController@delete');
+
+	Route::get('setting-credit', 'SettingCreditController@index');
+	Route::get('setting-credit/{credit}', 'SettingCreditController@show');
+	Route::post('setting-credit', 'SettingCreditController@store');
+	Route::put('setting-credit/{credit}', 'SettingCreditController@update');
+	Route::delete('setting-credit/{credit}', 'SettingCreditController@delete');
+
+	Route::get('setting-supplier', 'SettingSupplierController@index');
+	Route::get('setting-supplier/{supplier}', 'SettingSupplierController@show');
+	Route::post('setting-supplier', 'SettingSupplierController@store');
+	Route::put('setting-supplier/{supplier}', 'SettingSupplierController@update');
+	Route::delete('setting-supplier/{supplier}', 'SettingSupplierController@delete');
+
+	Route::get('setting-beneficiary', 'SettingBeneficiaryController@index');
+	Route::get('setting-beneficiary/{beneficiary}', 'SettingBeneficiaryController@show');
+	Route::post('setting-beneficiary', 'SettingBeneficiaryController@store');
+	Route::put('setting-beneficiary/{beneficiary}', 'SettingBeneficiaryController@update');
+	Route::delete('setting-beneficiary/{beneficiary}', 'SettingBeneficiaryController@delete');
 });
 
 
 Route::get('update-rate', 'RateController@index');
 Route::get('update-rate/{rate}', 'RateController@show');
-Route::post('update-rate', 'RateController@store');
-Route::put('update-rate/{rate}', 'RateController@update');
-Route::delete('update-rate/{rate}', 'RateController@delete');
 
-Route::get('setting-beneficiary', 'SettingBeneficiaryController@index');
-Route::get('setting-beneficiary/{beneficiary}', 'SettingBeneficiaryController@show');
-Route::post('setting-beneficiary', 'SettingBeneficiaryController@store');
-Route::put('setting-beneficiary/{beneficiary}', 'SettingBeneficiaryController@update');
-Route::delete('setting-beneficiary/{beneficiary}', 'SettingBeneficiaryController@delete');
-
-Route::get('setting-credit', 'SettingCreditController@index');
-Route::get('setting-credit/{credit}', 'SettingCreditController@show');
-Route::post('setting-credit', 'SettingCreditController@store');
-Route::put('setting-credit/{credit}', 'SettingCreditController@update');
-Route::delete('setting-credit/{credit}', 'SettingCreditController@delete');
-
-Route::get('setting-supplier', 'SettingSupplierController@index');
-Route::get('setting-supplier/{supplier}', 'SettingSupplierController@show');
-Route::post('setting-supplier', 'SettingSupplierController@store');
-Route::put('setting-supplier/{supplier}', 'SettingSupplierController@update');
-Route::delete('setting-supplier/{supplier}', 'SettingSupplierController@delete');
 
 Route::post('upload-china-bankslip', 'ChinaBankSlipController@store');
 
 
-Route::post('booking/{book_id}/reject-bank-slip','BookingController@rejectBankSlip');
-Route::post('booking/{book_id}/approve-bank-slip','BookingController@approveBankSlip');
-Route::post('booking/{book_id}/cancel', 'BookingController@cancel');
 Route::post('booking/{id}/upload-user-bankslip', 'BookingController@uploadbankslip');
 Route::post('booking/{id}/upload-po', 'BookingController@uploadPurchaseOrder');
 
diff --git a/tests/Feature/BookingTest.php b/tests/Feature/BookingTest.php
index e931b4b7..54380aa0 100644
--- a/tests/Feature/BookingTest.php
+++ b/tests/Feature/BookingTest.php
@@ -33,7 +33,6 @@ class BookingTest extends TestCase
         $this->userBankSlip = factory(UserBankSlip::class)->create([
             'booking_id' => $this->booking->id
         ]);
-
     }
 
     public function testPost()
@@ -77,7 +76,7 @@ class BookingTest extends TestCase
         if(!file_exists($bankslip_url)){
             $response->assertStatus(400);
         }
-        
+
         $this->actingAs($this->user)
             ->json('POST', '/api/booking/' . $this->booking->id . '/upload-user-bankslip', [
                 'file' => $bankslip_url