change permission functions to only pass userId