refactor del hasAuthority , use subject.isPermitted('code:readonly')