Refactor the permission service and add tests for it