bugfix: haspermission API