fix: check_user_rights