add test for permission