diff --git a/src/main/java/com/example/nto/controller/BookingController.java b/src/main/java/com/example/nto/controller/BookingController.java
index a4ed8b1..1ce9439 100644
--- a/src/main/java/com/example/nto/controller/BookingController.java
+++ b/src/main/java/com/example/nto/controller/BookingController.java
@@ -20,16 +20,16 @@ public class BookingController {
 
     private final BookingService bookingService;
 
-    @GetMapping("/{code}/booking")
+    @GetMapping("/{code}/{password}/booking")
     @ResponseStatus(code = HttpStatus.OK)
-    public Map<LocalDate, List<PlaceDto>> getByDate(@PathVariable String code) {
-        return bookingService.getFreePlace(code);
+    public Map<LocalDate, List<PlaceDto>> getByDate(@PathVariable String code, @PathVariable String password) {
+        return bookingService.getFreePlace(code, password);
     }
 
-    @PostMapping("/{code}/book")
+    @PostMapping("/{code}/{password}/book")
     @ResponseStatus(code = HttpStatus.CREATED)
-    public void create(@PathVariable String code, @RequestBody BookingCreateDto bookingCreateDto) {
-        bookingService.create(code, bookingCreateDto);
+    public void create(@PathVariable String code, @RequestBody BookingCreateDto bookingCreateDto, @PathVariable String password) {
+        bookingService.create(code, password, bookingCreateDto);
     }
 
 }
diff --git a/src/main/java/com/example/nto/controller/EmployeeController.java b/src/main/java/com/example/nto/controller/EmployeeController.java
index 28b2fa1..e9e8f0e 100644
--- a/src/main/java/com/example/nto/controller/EmployeeController.java
+++ b/src/main/java/com/example/nto/controller/EmployeeController.java
@@ -16,14 +16,14 @@ public class EmployeeController {
 
     @GetMapping("/{code}/info")
     @ResponseStatus(code = HttpStatus.OK)
-    public EmployeeDto getByCode(@PathVariable String code) {
-        return employeeService.getByCode(code);
+    public EmployeeDto getByCode(@PathVariable String login) {
+        return employeeService.getByCode(login);
     }
 
     @GetMapping("/login/{username}/{password}")
     @ResponseStatus(code = HttpStatus.OK)
-    public void login(@PathVariable String username, @PathVariable String password){
-        employeeService.auth(username, password);
+    public EmployeeDto login(@PathVariable String username, @PathVariable String password){
+        return employeeService.auth(username, password);
     }
 
 }
diff --git a/src/main/java/com/example/nto/controller/dto/EmployeeCreateDto.java b/src/main/java/com/example/nto/controller/dto/EmployeeCreateDto.java
new file mode 100644
index 0000000..ec7a585
--- /dev/null
+++ b/src/main/java/com/example/nto/controller/dto/EmployeeCreateDto.java
@@ -0,0 +1,18 @@
+package com.example.nto.controller.dto;
+
+import jakarta.validation.constraints.NotNull;
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+public class EmployeeCreateDto {
+    @NotNull
+    private String username;
+    @NotNull
+    private String password;
+}
diff --git a/src/main/java/com/example/nto/controller/dto/EmployeeDto.java b/src/main/java/com/example/nto/controller/dto/EmployeeDto.java
index aecb5e1..710da9f 100644
--- a/src/main/java/com/example/nto/controller/dto/EmployeeDto.java
+++ b/src/main/java/com/example/nto/controller/dto/EmployeeDto.java
@@ -9,6 +9,7 @@ import lombok.NoArgsConstructor;
 
 import java.time.LocalDate;
 import java.util.Map;
+import java.util.Optional;
 import java.util.TreeMap;
 
 @Data
@@ -19,7 +20,6 @@ public class EmployeeDto {
     private String name;
     private String photoUrl;
     private Map<LocalDate, PlaceDto> booking;
-    private String password;
 
     public static EmployeeDto toDto(Employee employee) {
         Map<LocalDate, PlaceDto> dtoTreeMap = new TreeMap<>();
@@ -27,6 +27,15 @@ public class EmployeeDto {
             dtoTreeMap.put(booking.getDate(), PlaceDto.toDto(booking.getPlace()));
         }
 
-        return new EmployeeDto(employee.getName(), employee.getPhotoUrl(), dtoTreeMap, employee.getPassword());
+        return new EmployeeDto(employee.getName(), employee.getPhotoUrl(), dtoTreeMap);
+    }
+
+    public static EmployeeDto toDtoOpt(Optional<Employee> employee) {
+        Map<LocalDate, PlaceDto> dtoTreeMap = new TreeMap<>();
+        for (Booking booking : employee.get().getBookingList()) {
+            dtoTreeMap.put(booking.getDate(), PlaceDto.toDto(booking.getPlace()));
+        }
+
+        return new EmployeeDto(employee.get().getName(), employee.get().getPhotoUrl(), dtoTreeMap);
     }
 }
diff --git a/src/main/java/com/example/nto/entity/Employee.java b/src/main/java/com/example/nto/entity/Employee.java
index 25f2296..26ebe38 100644
--- a/src/main/java/com/example/nto/entity/Employee.java
+++ b/src/main/java/com/example/nto/entity/Employee.java
@@ -8,6 +8,7 @@ import lombok.NoArgsConstructor;
 
 import java.util.Collection;
 import java.util.List;
+import java.util.Set;
 
 @Data
 @Entity
@@ -38,4 +39,7 @@ public class Employee {
 
     @OneToMany(mappedBy = "employee", cascade = CascadeType.ALL, fetch = FetchType.LAZY)
     private List<Booking> bookingList;
+
+    @ManyToMany
+    private Set<Role> roles;
 }
diff --git a/src/main/java/com/example/nto/entity/Role.java b/src/main/java/com/example/nto/entity/Role.java
new file mode 100644
index 0000000..75fa41d
--- /dev/null
+++ b/src/main/java/com/example/nto/entity/Role.java
@@ -0,0 +1,21 @@
+package com.example.nto.entity;
+
+import jakarta.persistence.*;
+import lombok.AllArgsConstructor;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Entity
+@NoArgsConstructor
+@AllArgsConstructor
+@Data
+public class Role {
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    private long id;
+
+    @Column(name = "role")
+    private String role;
+
+}
diff --git a/src/main/java/com/example/nto/exception/InvalidPassword.java b/src/main/java/com/example/nto/exception/InvalidPassword.java
new file mode 100644
index 0000000..352a305
--- /dev/null
+++ b/src/main/java/com/example/nto/exception/InvalidPassword.java
@@ -0,0 +1,7 @@
+package com.example.nto.exception;
+
+public class InvalidPassword extends RuntimeException {
+    public InvalidPassword(String message) {
+        super(message);
+    }
+}
diff --git a/src/main/java/com/example/nto/service/BookingService.java b/src/main/java/com/example/nto/service/BookingService.java
index 64e6ac6..37cd9f0 100644
--- a/src/main/java/com/example/nto/service/BookingService.java
+++ b/src/main/java/com/example/nto/service/BookingService.java
@@ -9,7 +9,7 @@ import java.util.List;
 import java.util.Map;
 
 public interface BookingService {
-    Map<LocalDate, List<PlaceDto>> getFreePlace(String code);
+    Map<LocalDate, List<PlaceDto>> getFreePlace(String code, String password);
 
-    Booking create(String code, BookingCreateDto bookingCreateDto);
+    Booking create(String code, String password, BookingCreateDto bookingCreateDto);
 }
diff --git a/src/main/java/com/example/nto/service/EmployeeService.java b/src/main/java/com/example/nto/service/EmployeeService.java
index 1b29fd3..2a0994f 100644
--- a/src/main/java/com/example/nto/service/EmployeeService.java
+++ b/src/main/java/com/example/nto/service/EmployeeService.java
@@ -1,13 +1,11 @@
 package com.example.nto.service;
 
-import com.example.nto.controller.dto.EmployeeCreateDto;
 import com.example.nto.controller.dto.EmployeeDto;
-import com.example.nto.entity.Employee;
 import com.example.nto.exception.InvalidPassword;
 
 public interface EmployeeService {
     EmployeeDto getByCode(String code);
 
-    void auth(String username, String password) throws InvalidPassword;
+    EmployeeDto auth(String username, String password) throws InvalidPassword;
 
 }
diff --git a/src/main/java/com/example/nto/service/impl/BookingServiceImpl.java b/src/main/java/com/example/nto/service/impl/BookingServiceImpl.java
index bbf63f4..957d6e5 100644
--- a/src/main/java/com/example/nto/service/impl/BookingServiceImpl.java
+++ b/src/main/java/com/example/nto/service/impl/BookingServiceImpl.java
@@ -37,8 +37,8 @@ public class BookingServiceImpl implements BookingService {
 
     @Override
     @Transactional(readOnly = true)
-    public Map<LocalDate, List<PlaceDto>> getFreePlace(String code) {
-//        employeeService.auth(code);
+    public Map<LocalDate, List<PlaceDto>> getFreePlace(String code, String password) {
+        employeeService.auth(code, password);
 
         List<Place> allPlaces = placeRepository.findAll();
 
@@ -72,14 +72,15 @@ public class BookingServiceImpl implements BookingService {
 
     @Override
     @Transactional
-    public Booking create(String code, BookingCreateDto bookingCreateDto) {
+    public Booking create(String code, String password, BookingCreateDto bookingCreateDto) {
+        employeeService.auth(code, password);
         LocalDate date = bookingCreateDto.getDate();
         LocalDate today = LocalDate.now(ZoneId.systemDefault());
         if (date.isBefore(today) || date.isAfter(today.plusDays(daysAhead))) {
             throw new IllegalArgumentException("Date is out of booking window");
         }
 
-        Employee employee = employeeRepository.findByCode(code)
+        Employee employee = employeeRepository.findByUsername(code)
                 .orElseThrow(() -> new EmployeeNotFoundException("Employee with " + code + " code not found!"));
 
         long placeId = bookingCreateDto.getPlaceId();
diff --git a/src/main/java/com/example/nto/service/impl/EmployeeServiceImpl.java b/src/main/java/com/example/nto/service/impl/EmployeeServiceImpl.java
index ee3872f..1ccec1e 100644
--- a/src/main/java/com/example/nto/service/impl/EmployeeServiceImpl.java
+++ b/src/main/java/com/example/nto/service/impl/EmployeeServiceImpl.java
@@ -1,18 +1,14 @@
 package com.example.nto.service.impl;
 
-import com.example.nto.controller.dto.EmployeeCreateDto;
 import com.example.nto.controller.dto.EmployeeDto;
 import com.example.nto.entity.Employee;
-import com.example.nto.exception.EmployeeAlreadyExists;
 import com.example.nto.exception.EmployeeNotFoundException;
 import com.example.nto.exception.InvalidPassword;
 import com.example.nto.exception.InvalidUsername;
 import com.example.nto.repository.EmployeeRepository;
 import com.example.nto.service.EmployeeService;
-import com.example.nto.utils.PasswordValidator;
 
 import lombok.RequiredArgsConstructor;
-import lombok.extern.java.Log;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
@@ -38,15 +34,16 @@ public class EmployeeServiceImpl implements EmployeeService {
 
     @Override
     @Transactional(readOnly = true)
-    public void auth(String username, String password) throws InvalidPassword {
+    public EmployeeDto auth(String username, String password) throws InvalidPassword {
         Optional<Employee> employee = employeeRepository.findByUsername(username);
         if(employee.isEmpty()){
             throw new InvalidUsername("Invalid Username");
         }
 
 
-        if(!EmployeeDto.toDto(employee.get()).getPassword().equals(password)){
-            throw new InvalidPassword("Wrong password: " + password + " " + EmployeeDto.toDto(employee.get()).getPassword());
+        if(!employee.get().getPassword().equals(password)){
+            throw new InvalidPassword("Wrong password: " + password);
         }
+        return EmployeeDto.toDtoOpt(employee);
     }
 }
diff --git a/src/main/java/com/example/nto/utils/PasswordValidator.java b/src/main/java/com/example/nto/utils/PasswordValidator.java
new file mode 100644
index 0000000..a490119
--- /dev/null
+++ b/src/main/java/com/example/nto/utils/PasswordValidator.java
@@ -0,0 +1,16 @@
+package com.example.nto.utils;
+
+import java.util.regex.Pattern;
+
+public class PasswordValidator {
+    public static boolean validate(String password){
+        Pattern p = Pattern.compile("*[%?()*^$#@!/.,><|';:]*");
+        if(password.length() < 8){
+            return false;
+        }
+        if(!p.matcher(password).matches()){
+            return false;
+        }
+        return true;
+    }
+}