auth.api.hasPermission - Better Auth