server/AyaNova/Controllers/DataListController.cs

@@ -57,12 +57,19 @@ namespace AyaNova.Api.Controllers
             if (!ModelState.IsValid)
                 return BadRequest(new ApiErrorResponse(ModelState));
 
-            //check rights at some point here            
+
 
             long UserId = UserIdFromContext.Id(HttpContext.Items);
-            ApiPagedResponse pr = await DataListFetcher.GetResponse(listOptions.DataListKey, ct, Url, nameof(List), listOptions, MOCK_WIDGET_DISPLAY_TEMPLATE_JSON, UserId);
-
-            return Ok(new ApiOkWithPagingResponse(pr));
+            var UserRoles = UserRolesFromContext.Roles(HttpContext.Items);
+            try
+            {
+                ApiPagedResponse pr = await DataListFetcher.GetResponse(listOptions.DataListKey, ct, Url, nameof(List), listOptions, UserId, UserRoles);
+                return Ok(new ApiOkWithPagingResponse(pr));
+            }
+            catch (System.NotSupportedException)
+            {
+                return StatusCode(403, new ApiNotAuthorizedResponse());
+            }
         }