diff --git a/AsbCloudInfrastructure/Repository/UserRoleRepository.cs b/AsbCloudInfrastructure/Repository/UserRoleRepository.cs
index 52c087fa..e386bb7f 100644
--- a/AsbCloudInfrastructure/Repository/UserRoleRepository.cs
+++ b/AsbCloudInfrastructure/Repository/UserRoleRepository.cs
@@ -5,6 +5,7 @@ using AsbCloudApp.Repositories;
 using AsbCloudDb;
 using AsbCloudDb.Model;
 using AsbCloudInfrastructure.EfCache;
+using DocumentFormat.OpenXml.Vml.Office;
 using Mapster;
 using Microsoft.EntityFrameworkCore;
 using System;
@@ -177,14 +178,23 @@ namespace AsbCloudInfrastructure.Repository
             return false;
         }
 
+        private IEnumerable<UserRoleDto> GetNestedByIds(IEnumerable<int> ids, int recursionLevel = 7)
+        { 
+            var roles = new List<UserRoleDto>();
+            foreach (var id in ids)
+                roles.AddRange(GetNestedById(id, recursionLevel));
+
+            return roles;
+        }
+
         private async Task UpdateIncludedRolesAsync(UserRoleDto dto, CancellationToken token)
         {
             if (dto?.Roles is null)
                 return;
 
-            var idsIncludeRole = dto.Roles.Select(x => x.Id);
+            var idsIncludeRole = GetNestedByIds(dto.Roles.Select(x => x.Id)).Select(x => x.Id);
 
-            if (idsIncludeRole.Any(x => x == dto.Id))
+            if (idsIncludeRole is null || idsIncludeRole.Any(x => x == dto.Id))
                 throw new ArgumentInvalidException("Invalid include role", nameof(UserRoleDto));
 
             var relations = await dbContext.RelationUserRoleUserRoles
@@ -203,6 +213,21 @@ namespace AsbCloudInfrastructure.Repository
             DropCacheRelationUserRoleUserRole();
         }
 
+        //private IEnumerable<int> GetNestedRoleIds(UserRoleDto dto)
+        //{
+        //    var result = new List<int>();
+        //    if (dto.Roles is not null)
+        //    {
+        //        foreach (var role in dto.Roles)
+        //        { 
+        //            result.Add(role.Id);
+        //            if (role.Roles is not null)
+        //                GetNestedRoleIds(role);
+        //        }
+        //    }
+        //    return result;
+        //}
+
         private async Task UpdatePermissionsAsync(UserRoleDto dto, CancellationToken token)
         {
             if (dto?.Permissions is null)