diff --git a/src/main/java/xyz/playedu/api/controller/backend/CourseChapterController.java b/src/main/java/xyz/playedu/api/controller/backend/CourseChapterController.java
index 9956fa2..f3d95c3 100644
--- a/src/main/java/xyz/playedu/api/controller/backend/CourseChapterController.java
+++ b/src/main/java/xyz/playedu/api/controller/backend/CourseChapterController.java
@@ -5,9 +5,11 @@ import org.springframework.context.ApplicationContext;
 import org.springframework.validation.annotation.Validated;
 import org.springframework.web.bind.annotation.*;
 import xyz.playedu.api.PlayEduBackendThreadLocal;
+import xyz.playedu.api.constant.BPermissionConstant;
 import xyz.playedu.api.domain.CourseChapter;
 import xyz.playedu.api.event.CourseChapterDestroyEvent;
 import xyz.playedu.api.exception.NotFoundException;
+import xyz.playedu.api.middleware.BackendPermissionMiddleware;
 import xyz.playedu.api.request.backend.CourseChapterRequest;
 import xyz.playedu.api.service.CourseChapterService;
 import xyz.playedu.api.types.JsonResponse;
@@ -36,6 +38,7 @@ public class CourseChapterController {
         return JsonResponse.data(chapters);
     }
 
+    @BackendPermissionMiddleware(slug = BPermissionConstant.COURSE)
     @GetMapping("/create")
     public JsonResponse create(@PathVariable(name = "courseId") Integer courseId) {
         List<CourseChapter> chapters = chapterService.getChaptersByCourseId(courseId);
@@ -44,18 +47,21 @@ public class CourseChapterController {
         return JsonResponse.data(data);
     }
 
+    @BackendPermissionMiddleware(slug = BPermissionConstant.COURSE)
     @PostMapping("/create")
     public JsonResponse store(@PathVariable(name = "courseId") Integer courseId, @RequestBody @Validated CourseChapterRequest req) {
         chapterService.create(courseId, req.getName(), req.getSort());
         return JsonResponse.success();
     }
 
+    @BackendPermissionMiddleware(slug = BPermissionConstant.COURSE)
     @GetMapping("/{id}")
     public JsonResponse edit(@PathVariable(name = "courseId") Integer courseId, @PathVariable(name = "id") Integer id) throws NotFoundException {
         CourseChapter chapter = chapterService.findOrFail(id, courseId);
         return JsonResponse.data(chapter);
     }
 
+    @BackendPermissionMiddleware(slug = BPermissionConstant.COURSE)
     @PutMapping("/{id}")
     public JsonResponse update(@PathVariable(name = "courseId") Integer courseId, @PathVariable(name = "id") Integer id, @RequestBody @Validated CourseChapterRequest req) throws NotFoundException {
         CourseChapter chapter = chapterService.findOrFail(id, courseId);
@@ -63,6 +69,7 @@ public class CourseChapterController {
         return JsonResponse.success();
     }
 
+    @BackendPermissionMiddleware(slug = BPermissionConstant.COURSE)
     @DeleteMapping("/{id}")
     public JsonResponse destroy(@PathVariable(name = "courseId") Integer courseId, @PathVariable(name = "id") Integer id) throws NotFoundException {
         CourseChapter chapter = chapterService.findOrFail(id, courseId);
diff --git a/src/main/java/xyz/playedu/api/controller/backend/CourseHourController.java b/src/main/java/xyz/playedu/api/controller/backend/CourseHourController.java
index e58d4c7..7c99c3d 100644
--- a/src/main/java/xyz/playedu/api/controller/backend/CourseHourController.java
+++ b/src/main/java/xyz/playedu/api/controller/backend/CourseHourController.java
@@ -6,10 +6,12 @@ import org.springframework.context.ApplicationContext;
 import org.springframework.validation.annotation.Validated;
 import org.springframework.web.bind.annotation.*;
 import xyz.playedu.api.PlayEduBackendThreadLocal;
+import xyz.playedu.api.constant.BPermissionConstant;
 import xyz.playedu.api.domain.CourseHour;
 import xyz.playedu.api.event.CourseHourCreatedEvent;
 import xyz.playedu.api.event.CourseHourDestroyEvent;
 import xyz.playedu.api.exception.NotFoundException;
+import xyz.playedu.api.middleware.BackendPermissionMiddleware;
 import xyz.playedu.api.request.backend.CourseHourRequest;
 import xyz.playedu.api.service.CourseHourService;
 import xyz.playedu.api.types.JsonResponse;
@@ -37,11 +39,13 @@ public class CourseHourController {
         return JsonResponse.data(hours);
     }
 
+    @BackendPermissionMiddleware(slug = BPermissionConstant.COURSE)
     @GetMapping("/create")
     public JsonResponse create(@PathVariable(name = "courseId") Integer courseId) {
         return JsonResponse.data(null);
     }
 
+    @BackendPermissionMiddleware(slug = BPermissionConstant.COURSE)
     @PostMapping("/create")
     public JsonResponse store(@PathVariable(name = "courseId") Integer courseId, @RequestBody @Validated CourseHourRequest req) {
         CourseHour courseHour = hourService.create(courseId, req.getChapterId(), req.getTitle(), req.getType(), req.getDuration(), req.getPublishedAt());
@@ -49,12 +53,14 @@ public class CourseHourController {
         return JsonResponse.success();
     }
 
+    @BackendPermissionMiddleware(slug = BPermissionConstant.COURSE)
     @GetMapping("/{id}")
     public JsonResponse edit(@PathVariable(name = "courseId") Integer courseId, @PathVariable(name = "id") Integer id) throws NotFoundException {
         CourseHour courseHour = hourService.findOrFail(id, courseId);
         return JsonResponse.data(courseHour);
     }
 
+    @BackendPermissionMiddleware(slug = BPermissionConstant.COURSE)
     @PutMapping("/{id}")
     public JsonResponse update(@PathVariable(name = "courseId") Integer courseId, @PathVariable(name = "id") Integer id, @RequestBody @Validated CourseHourRequest req) throws NotFoundException {
         CourseHour courseHour = hourService.findOrFail(id, courseId);
@@ -62,6 +68,7 @@ public class CourseHourController {
         return JsonResponse.success();
     }
 
+    @BackendPermissionMiddleware(slug = BPermissionConstant.COURSE)
     @DeleteMapping("/{id}")
     public JsonResponse destroy(@PathVariable(name = "courseId") Integer courseId, @PathVariable(name = "id") Integer id) throws NotFoundException {
         CourseHour courseHour = hourService.findOrFail(id, courseId);