the usual way is to check the permissions on the backend and pass them as params to the page