fix: check_user_rights to check from the role