Should GATT_PERM_READ_AUTHEN_GET be (x & 0x02) instead of (x & 0x03)?

I had code

  provisioningScanCharacteristic.setReadProperty(true);
  provisioningScanCharacteristic.setWriteProperty(true);
  //provisioningScanCharacteristic.setWritePermissions(GATT_PERM_WRITE);
  //provisioningScanCharacteristic.setReadPermissions(GATT_PERM_READ);
  provisioningScanCharacteristic.setUserDescriptor("prov-scan");
  provisioningScanCharacteristic.setWriteCallback(writeCB);
  provisioningScanCharacteristic.setReadCallback(readCB);

And the user descriptor works, but read and write does not work.

If I uncomment the permission lines, the read and write works but user descriptor no longer works.

It seems in function BLECharacteristic::generateAttrDescriptorDeclaration, when _char_attr_read_permissions is 1, GATT_PERM_READ_AUTHEN_GET still get valid and set _desc_read_permissions to GATT_PERM_READ_AUTHEN_SC_REQ, but the authentation should not be required.

Should GATT_PERM_READ_AUTHEN_GET be (x & 0x02) instead of (x & 0x03)?