code: function access(permission, account, callback) {
    // User #1 has all privileges:
    if (account.uid === 1) {
      callback(null, true);
      return;
    }
  
    // If permissions is already loaded, use them.
    if (account.permissions) {
      callback(null, account.permissions.indexOf(permission) > -1);
      return;
    }
  
    role_permissions(account.roles, function (err, permissions) {
      if (err) {
        callback(err);
        return;
      }
  
      callback(null, permissions.indexOf(permission) > -1);
    });
  }
docs: Check if user has a specific permission.
  
  Like user_access() in Drupal core.
  
  Unlike in Drupal, we do not have a global user object, so this
  implementation always require the account parameter to be set.