diff --git a/packages/convertions/convertions.go b/packages/convertions/convertions.go
index f476527..7852286 100644
--- a/packages/convertions/convertions.go
+++ b/packages/convertions/convertions.go
@@ -12,6 +12,11 @@ import (
 	"github.com/google/uuid"
 )
 
+func StringToUint8(s string) (uint8, error) {
+	v, err := strconv.ParseUint(s, 10, 8)
+	return uint8(v), err
+}
+
 func StringToUint32(s string) (uint32, error) {
 	v, err := strconv.ParseUint(s, 10, 32)
 	return uint32(v), err
diff --git a/packages/httpRequest/hubs.go b/packages/httpRequest/hubs.go
index 91897b4..e18ebb4 100644
--- a/packages/httpRequest/hubs.go
+++ b/packages/httpRequest/hubs.go
@@ -289,12 +289,19 @@ func HandleHubUserRemove(response http.ResponseWriter, request *http.Request) {
 	if !ok {
 		return
 	}
-	color, err := convertions.StringToRgba(request.FormValue("newname"))
+	targetId, err := convertions.StringToUuid(request.FormValue("targetid"))
 	if err != nil {
-		http.Error(response, "bad color", http.StatusBadRequest)
+		http.Error(response, "bad targetid", http.StatusBadRequest)
 		return
 	}
-	hub.Color = color
+	hub.Mu.Lock()
+	if _, exists := hub.Users[targetId]; !exists {
+		hub.Mu.Unlock()
+		http.Error(response, "user not found", http.StatusNotFound)
+		return
+	}
+	delete(hub.Users, targetId)
+	hub.Mu.Unlock()
 	response.WriteHeader(http.StatusAccepted)
 }
 
@@ -311,12 +318,173 @@ func HandleHubRenameUser(response http.ResponseWriter, request *http.Request) {
 	}
 	hub.Mu.RLock()
 	target, ok := hub.Users[targetId]
+	hub.Mu.RUnlock()
 	if !ok {
 		http.Error(response, "no users found", http.StatusNotFound)
 		return
 	}
-	hub.Mu.RUnlock()
 	target.Name = newName
 
 	response.WriteHeader(http.StatusAccepted)
 }
+
+func HandleHubRenameSelf(response http.ResponseWriter, request *http.Request) {
+	hubUser, _, _, ok := hubPermissionContext(response, request, normal, types.PermissionSelfRename)
+	if !ok {
+		return
+	}
+	hubUser.Name = request.FormValue("newname")
+	response.WriteHeader(http.StatusAccepted)
+}
+
+func HandleHubToggleMuteUser(response http.ResponseWriter, request *http.Request) {
+	_, hub, _, ok := hubPermissionContext(response, request, normal, types.PermissionMuteUser)
+	if !ok {
+		return
+	}
+	targetId, err := convertions.StringToUuid(request.FormValue("targetid"))
+	if err != nil {
+		http.Error(response, "bad targetid", http.StatusBadRequest)
+		return
+	}
+	hub.Mu.RLock()
+	target, ok := hub.Users[targetId]
+	hub.Mu.RUnlock()
+	if !ok {
+		http.Error(response, "user not found", http.StatusNotFound)
+		return
+	}
+	target.IsMuted = !target.IsMuted
+	response.WriteHeader(http.StatusAccepted)
+}
+
+func HandleHubUserAddRole(response http.ResponseWriter, request *http.Request) {
+	_, hub, _, ok := hubPermissionContext(response, request, normal, types.PermissionUserAddRole)
+	if !ok {
+		return
+	}
+	targetId, err := convertions.StringToUuid(request.FormValue("targetid"))
+	if err != nil {
+		http.Error(response, "bad targetid", http.StatusBadRequest)
+		return
+	}
+	roleId, err := convertions.StringToUint8(request.FormValue("roleid"))
+	if err != nil {
+		http.Error(response, "bad roleid", http.StatusBadRequest)
+		return
+	}
+	hub.Mu.RLock()
+	target, ok := hub.Users[targetId]
+	role := hub.Roles[roleId]
+	hub.Mu.RUnlock()
+	if !ok {
+		http.Error(response, "user not found", http.StatusNotFound)
+		return
+	}
+	if role == nil {
+		http.Error(response, "role not found", http.StatusNotFound)
+		return
+	}
+	target.Roles.Add(roleId)
+	response.WriteHeader(http.StatusAccepted)
+}
+
+func HandleHubUserRemoveRole(response http.ResponseWriter, request *http.Request) {
+	_, hub, _, ok := hubPermissionContext(response, request, normal, types.PermissionUserRemoveRole)
+	if !ok {
+		return
+	}
+	targetId, err := convertions.StringToUuid(request.FormValue("targetid"))
+	if err != nil {
+		http.Error(response, "bad targetid", http.StatusBadRequest)
+		return
+	}
+	roleId, err := convertions.StringToUint8(request.FormValue("roleid"))
+	if err != nil {
+		http.Error(response, "bad roleid", http.StatusBadRequest)
+		return
+	}
+	hub.Mu.RLock()
+	target, ok := hub.Users[targetId]
+	hub.Mu.RUnlock()
+	if !ok {
+		http.Error(response, "user not found", http.StatusNotFound)
+		return
+	}
+	target.Roles.Remove(roleId)
+	response.WriteHeader(http.StatusAccepted)
+}
+
+func HandleHubCreateRole(response http.ResponseWriter, request *http.Request) {
+	_, hub, _, ok := hubPermissionContext(response, request, normal, types.PermissionCreateRole)
+	if !ok {
+		return
+	}
+	name := request.FormValue("name")
+	if name == "" {
+		http.Error(response, "empty name", http.StatusBadRequest)
+		return
+	}
+	hub.Mu.Lock()
+	var freeId uint8
+	found := false
+	for i := uint8(1); i < types.HubBoundRolesMax; i++ {
+		if hub.Roles[i] == nil {
+			freeId = i
+			found = true
+			break
+		}
+	}
+	if !found {
+		hub.Mu.Unlock()
+		http.Error(response, "no role slots available", http.StatusConflict)
+		return
+	}
+	hub.Roles[freeId] = &types.HubRole{
+		Id:        freeId,
+		Name:      name,
+		Color:     types.RandomRgba(),
+		CreatedAt: time.Now(),
+	}
+	hub.Mu.Unlock()
+	response.WriteHeader(http.StatusCreated)
+}
+
+func HandleHubRemoveRole(response http.ResponseWriter, request *http.Request) {
+	_, hub, _, ok := hubPermissionContext(response, request, normal, types.PermissionRemoveRole)
+	if !ok {
+		return
+	}
+	roleId, err := convertions.StringToUint8(request.FormValue("roleid"))
+	if err != nil {
+		http.Error(response, "bad roleid", http.StatusBadRequest)
+		return
+	}
+	if roleId == 0 || roleId == types.HubBoundRolesMax {
+		http.Error(response, "cannot remove system role", http.StatusForbidden)
+		return
+	}
+	hub.Mu.Lock()
+	if hub.Roles[roleId] == nil {
+		hub.Mu.Unlock()
+		http.Error(response, "role not found", http.StatusNotFound)
+		return
+	}
+	hub.Roles[roleId] = nil
+	hub.Mu.Unlock()
+	response.WriteHeader(http.StatusAccepted)
+}
+
+func HandleHubSelfRoleRemove(response http.ResponseWriter, request *http.Request) {
+	hubUser, _, _, ok := hubPermissionContext(response, request, normal, types.PermissionSelfRoleRemove)
+	if !ok {
+		return
+	}
+	roleId, err := convertions.StringToUint8(request.FormValue("roleid"))
+	if err != nil {
+		http.Error(response, "bad roleid", http.StatusBadRequest)
+		return
+	}
+	hubUser.Roles.Remove(roleId)
+	response.WriteHeader(http.StatusAccepted)
+}
diff --git a/packages/types/types.go b/packages/types/types.go
index a5b45fe..291a5e0 100644
--- a/packages/types/types.go
+++ b/packages/types/types.go
@@ -259,7 +259,6 @@ type HubRole struct {
 	Color        Rgba        `json:"color"`
 	Id           uint8       `json:"id"`
 	BoundedGroup uint8       `json:"boundedGroup"` // BoundedGroup 0 for global
-	IsDeleted    bool        `json:"-"`
 }
 
 func (h *HubRole) GrantPermission(r Permissions) {