refactor code. fix permission validation.