uint8_t bt_gatt_check_perm(struct bt_conn *conn, const struct bt_gatt_attr *attr,
                        uint16_t mask)
{
        if ((mask & BT_GATT_PERM_READ) &&
            (!(attr->perm & BT_GATT_PERM_READ_MASK) || !attr->read)) {
                return BT_ATT_ERR_READ_NOT_PERMITTED;
        }

        if ((mask & BT_GATT_PERM_WRITE) &&
            (!(attr->perm & BT_GATT_PERM_WRITE_MASK) || !attr->write)) {
                return BT_ATT_ERR_WRITE_NOT_PERMITTED;
        }

        if (IS_ENABLED(CONFIG_BT_CONN_DISABLE_SECURITY)) {
                return 0;
        }

        mask &= attr->perm;

        /*
         * Core Specification 5.4 Vol. 3 Part C 10.3.1
         *
         * If neither an LTK nor an STK is available, the service
         * request shall be rejected with the error code
         *  ^`^|Insufficient Authentication ^`^}.
         * Note: When the link is not encrypted, the error code
         *  ^`^|Insufficient Authentication ^`^} does not indicate that
         *  MITM protection is required.
         *
         * If an LTK or an STK is available and encryption is
         * required (LE security mode 1) but encryption is not
         * enabled, the service request shall be rejected with
         * the error code  ^`^|Insufficient Encryption ^`^}.
         */

        if (mask & (BT_GATT_PERM_ENCRYPT_MASK | BT_GATT_PERM_AUTHEN_MASK)) {
#if defined(CONFIG_BT_SMP)
                if (!conn->encrypt) {
                        if (bt_conn_ltk_present(conn)) {
                                return BT_ATT_ERR_INSUFFICIENT_ENCRYPTION;
                        } else {
                                return BT_ATT_ERR_AUTHENTICATION;
                        }
                }

                if (mask & BT_GATT_PERM_AUTHEN_MASK) {
                        if (bt_conn_get_security(conn) < BT_SECURITY_L3) {
                                return BT_ATT_ERR_AUTHENTICATION;
                        }
                }

                if (mask & BT_GATT_PERM_LESC_MASK) {
                        const struct bt_keys *keys = conn->le.keys;

                        if (!keys || (keys->flags & BT_KEYS_SC) == 0) {
                                return BT_ATT_ERR_AUTHENTICATION;
                        }
                }

static ssize_t read_u8(struct bt_conn *conn, const struct bt_gatt_attr *attr, void *buf,
                       uint16_t len, uint16_t offset)
{
        const uint8_t *value = attr->user_data;
        printk("security level: %d\n", bt_conn_get_security(conn));
        return bt_gatt_attr_read(conn, attr, buf, len, offset, &value, sizeof(value));
}

static ssize_t write_u8(struct bt_conn *conn, const struct bt_gatt_attr *attr, const void *buf,
                        uint16_t len, uint16_t offset, uint8_t flags)
{
        uint8_t *value = attr->user_data;
        printk("security level: %d\n", bt_conn_get_security(conn));
        return sizeof(gatt_value);
}

BT_GATT_SERVICE_DEFINE(ess_svc,
        BT_GATT_PRIMARY_SERVICE(BT_UUID_ESS),

        /* Temperature Sensor 1 */
        BT_GATT_CHARACTERISTIC(BT_UUID_TEMPERATURE, (BT_GATT_CHRC_READ | BT_GATT_CHRC_WRITE),
                               (BT_GATT_PERM_READ_LESC | BT_GATT_PERM_WRITE_LESC), read_u8,
                               write_u8, &gatt_value),
);