refactoring with custom viewSet and permission