permission works and add unit tests