Check for private route

Diligent.WebAPI.Business/Services/CategoryService.cs

@@ -31,6 +31,12 @@ namespace Diligent.WebAPI.Business.Services
             var user = await _userManager.FindByIdAsync(userId.ToString());
             var role = (await _userManager.GetRolesAsync(user))[0];
 
+            if(parentCategoryId != -1)
+            {
+                var categories = await _context.UserCategories.Where(x => x.UserId == userId && x.CategoryId == parentCategoryId).ToListAsync();
+                if (categories.Count == 0) return null;
+            }
+
             if (role == "SuperAdmin")
                 if (parentCategoryId == -1)
                 {