server/AyaNova/biz/ReportBiz.cs

@@ -259,8 +259,15 @@ namespace AyaNova.Biz
                 effectiveRoles = effectiveUser.Roles;
             }
 
+            if (!AyaNova.Api.ControllerHelpers.Authorized.HasReadFullRole(effectiveRoles, report.ObjectType))
+            {
+                AddError(ApiErrorCode.NOT_AUTHORIZED, null, $"User not authorized for {report.ObjectType} type object");
+                return null;
+            }
 
 
+            //Get data
+
 
             //initialization