implement remaining permissions / add tests