add permission

src/main/java/au/com/royalpay/payment/manage/appclient/core/impls/RetailAppServiceImp.java

@@ -268,10 +268,13 @@ public class RetailAppServiceImp implements RetailAppService {
     @Override
     public void changeSurchargeEnable(JSONObject device, UpdateSurchargeDTO updateSurchargeDTO) {
         JSONObject client = clientManager.getClientInfo(device.getIntValue("client_id"));
+        JSONObject account = clientAccountMapper.findById(device.getString("account_id"));
+        if(PartnerRole.getRole(account.getIntValue("role")) != PartnerRole.ADMIN){
+            throw new ForbiddenException("You have no permission");
+        }
         if (client == null) {
             throw new NotFoundException("Client not found, please check");
         }
-        JSONObject account = clientAccountMapper.findById(device.getString("account_id"));
         if (updateSurchargeDTO.getApiSurcharge() != null) {
             clientModifySupport.processClientConfigModify(new SwitchPermissionModify(account,client.getString("client_moniker"),"api_surcharge",updateSurchargeDTO.getApiSurcharge()));
         }