fix: permission for actions My Favorites