Add test for `has_permission`