feat(auth) : support authorities and component permissions

close #5