add permission handling for shops