diff --git a/src/common/options/roles.ts b/src/common/options/roles.ts
index 68c0e51d..93212af7 100644
--- a/src/common/options/roles.ts
+++ b/src/common/options/roles.ts
@@ -4,7 +4,6 @@ export const variant: Record<UserRole, { class: string }> = {
   [UserRole.Disabled]: { class: 'badge-ghost' },
   [UserRole.Restricted]: { class: 'badge-error' },
   [UserRole.Inactive]: { class: 'badge-ghost' },
-  [UserRole.Normal]: { class: 'badge-neutral' },
   [UserRole.Supported]: { class: 'badge-neutral' },
   [UserRole.Supporter]: { class: 'badge-primary' },
   [UserRole.Verified]: { class: 'badge-outline' },
diff --git a/src/components/T/multi-checkbox.vue b/src/components/T/multi-checkbox.vue
new file mode 100644
index 00000000..6693bacb
--- /dev/null
+++ b/src/components/T/multi-checkbox.vue
@@ -0,0 +1,65 @@
+<script setup lang="ts" generic="T extends string | number">
+import { match } from 'switch-pattern'
+import type { HTMLAttributes } from 'vue'
+
+interface Option {
+  label: string | number
+  value: T
+  disabled?: boolean
+  attrs?: HTMLAttributes
+}
+
+defineProps<{
+  options: Option[]
+  size?: 'xs' | 'sm' | 'lg'
+}>()
+
+const modelValue = defineModel<T[]>('modelValue')
+
+function toggle(value: T, checked: boolean) {
+  const _v = [modelValue.value!.includes(value), checked] as const
+
+  const { exact, patterns: m } = match(_v)
+
+  switch (m) {
+    case (exact([true, true])):
+    case (exact([false, false])):
+    {
+      return
+    }
+
+    case (exact([false, true])): {
+      modelValue.value?.push(value)
+      return
+    }
+    case (exact([true, false])): {
+      modelValue.value?.splice(modelValue.value.findIndex(i => i === value), 1)
+    }
+  }
+}
+// checkbox-xs checkbox-md checkbox-lg
+</script>
+
+<template>
+  <div>
+    <div
+      v-for="opt in options"
+      :key="opt.value"
+      class="form-control"
+    >
+      <label class="label cursor-pointer justify-start gap-4">
+        <input
+          class="checkbox"
+          :class="{
+            [`checkbox-${size}`]: size,
+          }"
+          type="checkbox"
+          v-bind="opt.attrs"
+          :checked="modelValue?.includes(opt.value)"
+          @change="ev => toggle(opt.value, (ev.target as any).checked)"
+        >
+        <span class="label-text text-nowrap">{{ opt.label }}</span>
+      </label>
+    </div>
+  </div>
+</template>
diff --git a/src/composables/useAdapterConfig.ts b/src/composables/useAdapterConfig.ts
index 0d8d1a6f..3d22b37c 100644
--- a/src/composables/useAdapterConfig.ts
+++ b/src/composables/useAdapterConfig.ts
@@ -6,6 +6,7 @@ import {
   leaderboardRankingSystems as supportedLeaderboardRankingSystems,
   modes as supportedModes,
   rankingSystems as supportedRankingSystems,
+  userRoles as supportedRoles,
   rulesets as supportedRulesets,
 } from '~/server/trpc/config'
 
@@ -19,5 +20,6 @@ export default () => {
     hasRuleset,
     hasLeaderboardRankingSystem,
     hasRankingSystem,
+    supportedRoles,
   }
 }
diff --git a/src/def/user.ts b/src/def/user.ts
index 14874950..de3a7901 100755
--- a/src/def/user.ts
+++ b/src/def/user.ts
@@ -39,16 +39,11 @@ export enum UserRole {
   // restricted type
   Disabled = 'disabled',
   Restricted = 'restricted',
-
-  // // registered without login
-  // Registered = 'registered',
   Inactive = 'inactive',
-  Normal = 'normal',
   Supported = 'supported',
   Supporter = 'supporter',
 
-  // bancho.py privileges
-  Verified = 'whitelisted',
+  Verified = 'verified',
 
   // bancho privileges
   Alumni = 'alumni',
@@ -68,6 +63,8 @@ export enum UserRole {
   Bot = 'bot',
 }
 
+export const userRoles = Object.values(UserRole).filter((value): value is UserRole => typeof value === 'number') as readonly UserRole[]
+
 export interface UserOldName {
   from: Date
   to: Date
diff --git a/src/locales/base/en-GB.ts b/src/locales/base/en-GB.ts
index f2b28302..27b101fe 100644
--- a/src/locales/base/en-GB.ts
+++ b/src/locales/base/en-GB.ts
@@ -71,7 +71,6 @@ export default {
     [UserRole.Restricted]: 'Restricted',
     // [UserRole.Registered]: 'Registered',
     [UserRole.Inactive]: 'Inactive',
-    [UserRole.Normal]: 'Normal',
     [UserRole.Supported]: 'Supported',
     [UserRole.Supporter]: 'Supporter',
     [UserRole.Verified]: 'Verified',
diff --git a/src/locales/base/fr-FR.ts b/src/locales/base/fr-FR.ts
index 6759e1a7..9f821ead 100644
--- a/src/locales/base/fr-FR.ts
+++ b/src/locales/base/fr-FR.ts
@@ -52,7 +52,6 @@ export default {
     [UserRole.Restricted]: 'Restreint',
     // [UserRole.Registered]: 'Enregistré',
     [UserRole.Inactive]: 'Inactif',
-    [UserRole.Normal]: 'Normal',
     [UserRole.Supported]: 'Supporté',
     [UserRole.Supporter]: 'Supporter',
     [UserRole.Verified]: 'Vérifié',
diff --git a/src/locales/base/zh-CN.ts b/src/locales/base/zh-CN.ts
index 4cfe6761..bb5e5b5e 100644
--- a/src/locales/base/zh-CN.ts
+++ b/src/locales/base/zh-CN.ts
@@ -65,7 +65,6 @@ export default {
     [UserRole.Restricted]: '已被封禁',
     // [UserRole.Registered]: '已注册',
     [UserRole.Inactive]: '不活跃的',
-    [UserRole.Normal]: '普通',
     [UserRole.Supported]: '赞助过',
     [UserRole.Supporter]: '赞助者',
     [UserRole.Verified]: '已认证',
diff --git a/src/pages/admin/users/[id].vue b/src/pages/admin/users/[id].vue
index 5dfc48e3..9fabdda2 100644
--- a/src/pages/admin/users/[id].vue
+++ b/src/pages/admin/users/[id].vue
@@ -1,15 +1,26 @@
 <script setup lang="ts">
 import md5 from 'md5'
+import type { HTMLAttributes, InputHTMLAttributes } from 'vue'
 import { CountryCode } from '~/def/country-code'
-import { roles as options } from '~/common/options'
+import { UserRole } from '~/def/user'
+import { useSession } from '~/store/session'
 
 const app = useNuxtApp()
 const { t } = useI18n()
 const route = useRoute('admin-users-id')
+const adapter = useAdapterConfig()
+const session = useSession()
+
+const disallowUserEditItselfRole = new Set([
+  UserRole.Owner,
+  UserRole.Admin,
+  UserRole.Staff,
+])
 
 const error = ref<Error>()
 const f = await app.$client.admin.userManagement.detail.query(route.params.id)
 const detail = ref(f as typeof f & { password?: string })
+
 // eslint-disable-next-line antfu/no-const-enum
 const enum Status {
   Idle,
@@ -24,6 +35,22 @@ const icon = {
 } as const
 const status = ref(Status.Idle)
 
+const opts = computed(() =>
+  createOptions(UserRole, (_, v) => t(localeKey.role(v)))
+    .map((item) => {
+      const attrs: HTMLAttributes & InputHTMLAttributes = {}
+      if (
+        (session.user?.id === detail.value.id && disallowUserEditItselfRole.has(item.value)) // prevent self from removing its priv
+        || !isEditable(session.role, item.value)
+      ) {
+        attrs.disabled = true
+      }
+
+      return { ...item, attrs }
+    })
+    .filter(i => adapter.supportedRoles.includes(i.value))
+)
+
 async function save() {
   error.value = undefined
   status.value = Status.Pending
@@ -40,6 +67,23 @@ async function save() {
     }
   }
 }
+
+// TODO server validation impl same logic
+function isEditable(stat: Record<'admin' | 'owner' | 'staff', boolean>, role: UserRole) {
+  switch (role) {
+    case UserRole.Admin: {
+      return stat.owner
+    }
+    case UserRole.Staff: {
+      return stat.admin || stat.owner
+    }
+    case UserRole.Owner: {
+      return stat.owner
+    }
+    default:
+      return true
+  }
+}
 </script>
 
 <i18n lang="yaml">
@@ -78,7 +122,12 @@ fr-FR:
 <template>
   <div v-if="detail" class="container custom-container">
     <div v-if="error" class="overflow-x-auto text-left alert alert-error">
-      <svg xmlns="http://www.w3.org/2000/svg" class="w-6 h-6 stroke-current shrink-0" fill="none" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M10 14l2-2m0 0l2-2m-2 2l-2-2m2 2l2 2m7-2a9 9 0 11-18 0 9 9 0 0118 0z" /></svg>
+      <svg xmlns="http://www.w3.org/2000/svg" class="w-6 h-6 stroke-current shrink-0" fill="none" viewBox="0 0 24 24">
+        <path
+          stroke-linecap="round" stroke-linejoin="round" stroke-width="2"
+          d="M10 14l2-2m0 0l2-2m-2 2l-2-2m2 2l2 2m7-2a9 9 0 11-18 0 9 9 0 0118 0z"
+        />
+      </svg>
       <pre>{{ formatGucchoError(error) }}</pre>
     </div>
     <dl>
@@ -143,11 +192,8 @@ fr-FR:
           <img :alt="detail.flag" :src="getFlagURL(detail.flag)" class="w-6">
           <select v-model="detail.flag" class="w-full select select-sm">
             <option
-              v-for="countryCode in CountryCode"
-              :key="countryCode"
-              :disabled="countryCode === detail.flag"
-              :selected="countryCode === detail.flag"
-              :value="countryCode"
+              v-for="countryCode in CountryCode" :key="countryCode" :disabled="countryCode === detail.flag"
+              :selected="countryCode === detail.flag" :value="countryCode"
             >
               <template v-if="countryCode === CountryCode.Unknown">
                 ❓
@@ -169,7 +215,7 @@ fr-FR:
           {{ t('roles') }}
         </dt>
         <dd class="striped-text">
-          <t-multi-select v-model="detail.roles" class="w-full" size="sm" :options="options($t)" />
+          <t-multi-checkbox v-model="detail.roles" size="sm" :options="opts" />
         </dd>
       </div>
     </dl>
diff --git a/src/pages/admin/users/index.vue b/src/pages/admin/users/index.vue
index e1972ca1..4a388f31 100644
--- a/src/pages/admin/users/index.vue
+++ b/src/pages/admin/users/index.vue
@@ -5,6 +5,7 @@ import { type UserCompact, type UserOptional, UserRole } from '~/def/user'
 
 const { t, locale } = useI18n()
 const route = useRoute('admin-users')
+
 const validator = object({
   page: coerce.number().default(0),
   perPage: coerce.number().default(10),
diff --git a/src/server/backend/$base/index.ts b/src/server/backend/$base/index.ts
index 621d2566..38b86611 100644
--- a/src/server/backend/$base/index.ts
+++ b/src/server/backend/$base/index.ts
@@ -46,5 +46,6 @@ export const hasRuleset: HasRuleset = <M extends ActiveMode>(
 ): ruleset is AvailableRuleset<M> => false
 
 export { modes, rulesets } from '~/def'
+export { userRoles } from '~/def/user'
 
 export const features = new Set<Feature>([])
diff --git a/src/server/backend/bancho.py/drizzle/schema.ts b/src/server/backend/bancho.py/drizzle/schema.ts
index af2e984d..6506b6c2 100644
--- a/src/server/backend/bancho.py/drizzle/schema.ts
+++ b/src/server/backend/bancho.py/drizzle/schema.ts
@@ -1,6 +1,5 @@
 import { bigint, boolean, char, date, datetime, index, int, mysqlEnum, mysqlTable, primaryKey, timestamp, tinyint, unique, varchar } from 'drizzle-orm/mysql-core'
 import { relations, sql } from 'drizzle-orm'
-import { userRelations } from '../../../singleton/service'
 import { decimal } from './fixed-point'
 
 const bpyServerEnum = mysqlEnum('server', ['osu!', 'private'])
diff --git a/src/server/backend/bancho.py/index.ts b/src/server/backend/bancho.py/index.ts
index 3cf6d281..27fb437c 100644
--- a/src/server/backend/bancho.py/index.ts
+++ b/src/server/backend/bancho.py/index.ts
@@ -1,7 +1,21 @@
 import type { Feature } from '~/def/features'
+import { UserRole } from '~/def/user'
 
 export { modes, rulesets, rankingSystems, leaderboardRankingSystems } from '~/def'
 
+export const userRoles = [
+  UserRole.Restricted,
+  UserRole.Verified,
+  UserRole.Supporter,
+  UserRole.Alumni,
+  UserRole.TournamentStaff,
+  UserRole.BeatmapNominator,
+  UserRole.Moderator,
+  UserRole.Admin,
+  UserRole.Owner,
+  UserRole.Bot,
+]
+
 export {
   hasLeaderboardRankingSystem,
   hasRankingSystem,
diff --git a/src/server/backend/bancho.py/transforms/user.ts b/src/server/backend/bancho.py/transforms/user.ts
index 74691aa2..5d34487e 100644
--- a/src/server/backend/bancho.py/transforms/user.ts
+++ b/src/server/backend/bancho.py/transforms/user.ts
@@ -25,9 +25,6 @@ export function toRoles(priv: number): UserRole[] {
   if ((priv & BanchoPyPrivilege.Normal) !== BanchoPyPrivilege.Normal) {
     roles.push(UserRole.Restricted)
   }
-  else if (priv & (BanchoPyPrivilege.Verified | BanchoPyPrivilege.Normal)) {
-    roles.push(UserRole.Normal)
-  }
 
   if (priv & BanchoPyPrivilege.Whitelisted) {
     roles.push(UserRole.Verified)
@@ -73,7 +70,10 @@ export function toRoles(priv: number): UserRole[] {
 }
 
 export function toBanchoPyPriv(input: UserRole[]): number {
-  let curr = 0
+  let curr = input.includes(UserRole.Restricted)
+    ? BanchoPyPrivilege.Any
+    : BanchoPyPrivilege.Normal
+
   for (const role of input) {
     curr |= toOneBanchoPyPriv(role)
   }
@@ -84,10 +84,6 @@ export function toOneBanchoPyPriv(role: UserRole): number {
   switch (role) {
     case UserRole.Restricted:
       return BanchoPyPrivilege.Any
-    // case UserRole.Registered:
-    //   return BanchoPyPrivilege.Normal
-    case UserRole.Normal:
-      return BanchoPyPrivilege.Verified | BanchoPyPrivilege.Normal
     case UserRole.Verified:
       return BanchoPyPrivilege.Whitelisted
     case UserRole.Supporter:
@@ -100,8 +96,8 @@ export function toOneBanchoPyPriv(role: UserRole): number {
       return BanchoPyPrivilege.Nominator
     case UserRole.Moderator:
       return BanchoPyPrivilege.Mod
-    case UserRole.Staff:
-      return BanchoPyPrivilege.Staff
+    // case UserRole.Staff:
+    //   return BanchoPyPrivilege.Staff
     case UserRole.Admin:
       return BanchoPyPrivilege.Admin
     case UserRole.Owner:
diff --git a/src/server/backend/ppy.sb@bancho.py/index.ts b/src/server/backend/ppy.sb@bancho.py/index.ts
index d344801e..b0619bb5 100644
--- a/src/server/backend/ppy.sb@bancho.py/index.ts
+++ b/src/server/backend/ppy.sb@bancho.py/index.ts
@@ -9,6 +9,7 @@ export {
   rulesets,
   rankingSystems,
   leaderboardRankingSystems,
+  userRoles,
 } from '../bancho.py'
 export type { Id, ScoreId } from '../bancho.py'
 
diff --git a/src/server/trpc/config.ts b/src/server/trpc/config.ts
index b47f6c19..76c38d40 100644
--- a/src/server/trpc/config.ts
+++ b/src/server/trpc/config.ts
@@ -6,4 +6,5 @@ export {
   rulesets,
   rankingSystems,
   leaderboardRankingSystems,
+  userRoles,
 } from '$active'
diff --git a/src/server/trpc/routers/user.ts b/src/server/trpc/routers/user.ts
index 23254426..3c8226e2 100644
--- a/src/server/trpc/routers/user.ts
+++ b/src/server/trpc/routers/user.ts
@@ -21,7 +21,6 @@ import { type LeaderboardRankingSystem } from '~/def/common'
 import { Mail } from '~/def/mail'
 import { type RankingSystemScore } from '~/def/score'
 import { Scope, type UserCompact, UserRole } from '~/def/user'
-import type { GlobalI18n } from '~/locales/@types'
 import { Constant } from '~/server/common/constants'
 import { MapProvider, ScoreProvider, UserProvider, mail, mailToken, sessions, userRelations, users } from '~/server/singleton/service'
 import ui from '~~/guccho.ui.config'
@@ -29,11 +28,12 @@ import { Logger } from '$base/logger'
 
 const logger = Logger.child({ label: 'user' })
 
-export const map = getPath<GlobalI18n>()()
+export const map = localeKey.root
 
-function visible(user: Pick<UserCompact<any>, 'id' | 'roles'>, viewer?: Pick<UserCompact<any>, 'id' | 'roles'>) {
-  const isSelf = user.id === viewer?.id
-  return user.roles.includes(UserRole.Normal) || isSelf || viewer?.roles.includes(UserRole.Staff)
+function userIsVisible(user: Pick<UserCompact<any>, 'id' | 'roles'>, viewer?: Pick<UserCompact<any>, 'id' | 'roles'>) {
+  return user.id === viewer?.id
+  || viewer?.roles.includes(UserRole.Staff)
+  || (!user.roles.includes(UserRole.Restricted))
 }
 
 const userNotFoundError = createGucchoError(GucchoError.UserNotFound)
@@ -58,7 +58,7 @@ export const router = _router({
         scope: Scope.Self,
       })
 
-      if (!visible(user, ctx.user)) {
+      if (!userIsVisible(user, ctx.user)) {
         throw userNotFoundError
       }
       return mapId(user, UserProvider.idToString)
@@ -90,7 +90,7 @@ export const router = _router({
       }
       const user = await users.getCompact({ handle: input.handle, scope: Scope.Self })
 
-      if (!visible(user, ctx.user)) {
+      if (!userIsVisible(user, ctx.user)) {
         throw userNotFoundError
       }
 
@@ -149,7 +149,7 @@ export const router = _router({
 
       const user = await users.getCompact({ handle: input.handle, scope: Scope.Self })
 
-      if (!visible(user, ctx.user)) {
+      if (!userIsVisible(user, ctx.user)) {
         throw userNotFoundError
       }
 
@@ -203,7 +203,7 @@ export const router = _router({
     .query(async ({ input: { handle, type }, ctx }) => {
       const user = await users.getCompact({ handle, scope: Scope.Self })
 
-      if (!visible(user, ctx.user)) {
+      if (!userIsVisible(user, ctx.user)) {
         raiseError(userNotFoundError)
       }
 
@@ -248,7 +248,7 @@ export const router = _router({
           ),
 
           content: t(
-            localeKey.mail.content(variant),
+            mailVariant.content.__path__,
             {
               serverName,
               otp,
@@ -313,7 +313,7 @@ export const router = _router({
          ),
 
          content: t(
-           localeKey.mail.content(variant),
+           mailVariant.content.__path__,
             {
               serverName,
               name: user.name,
diff --git a/src/store/session.ts b/src/store/session.ts
index 0756d43e..fb2af49a 100644
--- a/src/store/session.ts
+++ b/src/store/session.ts
@@ -10,6 +10,8 @@ export const useSession = defineStore('session', {
     userId?: string
     user?: Omit<UserFull<string>, 'statistics'>
     role: {
+      admin: boolean
+      owner: boolean
       staff: boolean
     }
   } => ({
@@ -17,6 +19,8 @@ export const useSession = defineStore('session', {
     user: undefined,
     userId: undefined,
     role: {
+      admin: false,
+      owner: false,
       staff: false,
     },
   }),