diff --git a/client-pro/src/pages/permission/manage/index.jsx b/client-pro/src/pages/permission/manage/index.jsx
index 6c774a8..f1cdc48 100644
--- a/client-pro/src/pages/permission/manage/index.jsx
+++ b/client-pro/src/pages/permission/manage/index.jsx
@@ -6,7 +6,7 @@ import ProForm, {
 } from '@ant-design/pro-form';
 import ProTable from '@ant-design/pro-table';
 import { PageContainer } from '@ant-design/pro-layout';
-import { save, getResources, getRoles, search } from '../service';
+import { save, getResources, getRoles, search, upsert } from '../service';
 
 const EntryForm = (props) => {
     const actionRef = useRef();
@@ -15,6 +15,7 @@ const EntryForm = (props) => {
     const [role, setRole] = React.useState(null);
     const [resource, setResource] = React.useState(null);
     const [resources, setResources] = React.useState([]);
+    const [reload, setReload] = React.useState(false);
 
     // get roles 
     const fetchRoles = async () => {
@@ -23,32 +24,39 @@ const EntryForm = (props) => {
         return options;
     };
 
-    // get resources
-    const fetchResources = async () => {
-        const result = await getResources();
-        const options = result.data.map(r => ({ label: r.alias, value: r._id, resource: r }));
-        setResources(result.data);
-        return options;
-    };
+    const getPermissions = async () => {
+        const result = await search({ roleId: role.roleId, pageSize: -1, sort: 'resourceAlias' });
+        const filtered = resources.filter(x => !result.data.some(y => y.resourceId === x._id))
+            .map(z => (
+                {
+                    resourceAlias: z.alias, resourceId: z._id, resourceName: z.name,
+                    isAllowed: false, isDisabled: false,
+                    ...role,
+                }));
+        setData([...result.data, ...filtered]);
+    }
+
+    useEffect(() => {
+        const fetchData = async () => {
+            const result = await getResources();
+            setResources(result.data);
+        };
+        fetchData();
+    }, []);
 
     useEffect(() => {
         if (role) {
-            const asyncGetData = async () => {
-                const result = await search({ roleId: role.roleId, pageSize: -1 });
-                const filtered = resources.filter(x => !result.data.some(y => y.resourceId === x._id))
-                    .map(z => (
-                        {
-                            resourceAlias: z.alias, resourceId: z._id, resourceName: z.name,
-                            isAllowed: false, isDisabled: false,
-                            ...role,
-                        }));
-                console.log('filtered', filtered.length);
-                setData([...result.data, ...filtered]);
-            }
-            asyncGetData();
+            getPermissions();
         }
     }, [role]);
 
+    useEffect(() => {
+        if (reload) {
+            getPermissions();
+            setReload(false);
+        }
+    }, [reload]);
+
     const onFinish = async (values) => {
         console.log('values', values);
 
@@ -72,8 +80,16 @@ const EntryForm = (props) => {
         }
     };
 
-    const updatePermission = (entity) => {
-        console.log('entity', entity);
+    const updatePermission = async (entity) => {
+        const { createdBy, updatedBy, createdAt, updatedAt, __v, ...payload } = entity;
+        console.log('entity', payload);
+        const result = await upsert(payload);
+        if (result instanceof Error) {
+            message.error(result.message);
+        } else {
+            message.success(result.message);
+            setReload(true);
+        }
     }
 
     const columns = [
diff --git a/client-pro/src/pages/permission/service.js b/client-pro/src/pages/permission/service.js
index fe5aa57..abb9b53 100644
--- a/client-pro/src/pages/permission/service.js
+++ b/client-pro/src/pages/permission/service.js
@@ -20,6 +20,10 @@ export async function save(params) {
   return await post('/api/permissions/create', params);
 }
 
+export async function upsert(params) {
+  return await post('/api/permissions/upsert', params);
+}
+
 export async function remove(id, options) {
   return await del(`/api/permissions/delete?id=${id}`, {}, options);
 }
diff --git a/server/setup/permissions.jsonc b/server/setup/permissions.jsonc
index eacf9b1..c74d291 100644
--- a/server/setup/permissions.jsonc
+++ b/server/setup/permissions.jsonc
@@ -208,6 +208,15 @@
     "isAllowed": true,
     "isDisabled": false
   },
+  // /api/permissions/upsert for superadmin
+  {
+    "resourceName": "/api/permissions/upsert",
+    "resourceAlias": "Permissions upsert API",
+    "roleName": "superadmin",
+    "roleAlias": "Superadmin",
+    "isAllowed": true,
+    "isDisabled": false
+  },
   // /api/permissions/search for superadmin
   {
     "resourceName": "/api/permissions/search",
@@ -335,6 +344,15 @@
     "isAllowed": true,
     "isDisabled": false
   },
+  // /api/permissions/upsert for admin
+  {
+    "resourceName": "/api/permissions/upsert",
+    "resourceAlias": "Permissions upsert API",
+    "roleName": "admin",
+    "roleAlias": "Admin",
+    "isAllowed": true,
+    "isDisabled": false
+  },
   // /api/permissions/search for admin
   {
     "resourceName": "/api/permissions/search",
diff --git a/server/setup/resources.jsonc b/server/setup/resources.jsonc
index 3bb2062..28b0c25 100644
--- a/server/setup/resources.jsonc
+++ b/server/setup/resources.jsonc
@@ -185,6 +185,13 @@
     "type": "api"
   },
 
+  // upsert
+  {
+    "name": "/api/permissions/upsert",
+    "alias": "Permissions upsert API",
+    "type": "api"
+  },
+
   // search
   {
     "name": "/api/permissions/search",
diff --git a/server/src/core/repository.js b/server/src/core/repository.js
index 5b6f47c..d15b20a 100644
--- a/server/src/core/repository.js
+++ b/server/src/core/repository.js
@@ -9,10 +9,10 @@ const save = async (item, modelName) => {
 };
 
 const update = async (item, modelName) => {
-  const doc = await mongoose.models[modelName].findByIdAndUpdate(
-    item._id,
+  const doc = await mongoose.models[modelName].updateOne(
+    { _id: item._id },
     item,
-    { new: true }
+    {}
   );
   eventEmitter.emit(`${modelName}Updated`, doc);
   return doc;
diff --git a/server/src/modules/permission/controller.js b/server/src/modules/permission/controller.js
index b63b510..6f80564 100644
--- a/server/src/modules/permission/controller.js
+++ b/server/src/modules/permission/controller.js
@@ -23,11 +23,20 @@ const countHandler = async (req, res, next) => {
   return baseCountHandler(req, res, next);
 };
 
+const upsertHandler = async (req, res, next) => {
+  const { _id: id } = req.body;
+  if (id) {
+    return updateHandler(req, res, next);
+  }
+  return saveHandler(req, res, next);
+};
+
 router.get("/detail", getByIdHandler);
 router.post("/create", handleValidation(validate), saveHandler);
 router.put("/update", handleValidation(validate), updateHandler);
 router.post("/search", searchHandler);
 router.post("/count", countHandler);
 router.delete("/delete", deleteHandler);
+router.post("/upsert", handleValidation(validate), upsertHandler);
 
 module.exports = router;