               exchange.close() # don't leak a channel
               @addClient socketId, exchange.name, routingKey
 
+    ensureGroupPermission =(group, account, roles)->
+      console.log 'ensure group permission', group, account, roles
+      {JPermissionSet} = @bongo.models
+      client = {context: group.slug}
+      JPermissionSet.checkPermission client, "read activities", group,
+        (err, hasPermission)->
+          if err then callback err
+          else
+            console.log {hasPermission}
 
     joinClientGroupHelper =(messageData, routingKey, socketId)->
+      console.trace()
       {JAccount, JGroup} = @bongo.models
-      fail = (err)=> @rejectClient routingKey; console.error err  if err
-      @authenticate messageData, routingKey, (session)->
+      fail = (err)=>
+        console.error err  if err
+        @rejectClient routingKey
+      @authenticate messageData, routingKey, (session)=>
         unless session then fail()
-        else
-          selector = {'profile.nickname': session.username}
-          JAccount.one selector, (err, account)->
+        else JAccount.one {'profile.nickname': session.username},
+          (err, account)=>
             if err or not account then fail err
-            else
-              JGroup.one {slug: messageData.group}, (err, group)->
-                if err or not group then fail err
-                else 
-                  group.fetchRolesByAccount account, (err, roles)->
-                    if err or not roles then fail err
-                    else
+            else JGroup.one {slug: messageData.group}, (err, group)=>
+              if err or not group then fail err
+              else 
+                group.fetchRolesByAccount account, (err, roles)=>
+                  if err or not roles then fail err
+                  else ensureGroupPermission.call this, group, account, roles
 
     joinClient =(messageData, socketId)->
       {channel, routingKey, serviceType} = messageData

    bongo.mq.ready =>
      {connection} = bongo.mq
      @monitorPresence connection
      connection.exchange @resourceName, AUTH_EXCHANGE_OPTIONS, (authExchange)=>
        connection.queue  @resourceName, (authQueue)=>
          authQueue.bind authExchange, ''

            authQueue.subscribe (message, headers, deliveryInfo)=>
              {routingKey, correlationId} = deliveryInfo
              socketId = correlationId
              messageData = (try JSON.parse messageStr) or message
              switch routingKey
                when 'kite.join'
                  @addService messageData
                when 'kite.leave'
