appHeader: hasPermission inject