diff --git a/server/src/lib/score-import/framework/user-game-stats/rating.ts b/server/src/lib/score-import/framework/user-game-stats/rating.ts
index bfd689e80..8fa4a42b5 100644
--- a/server/src/lib/score-import/framework/user-game-stats/rating.ts
+++ b/server/src/lib/score-import/framework/user-game-stats/rating.ts
@@ -364,15 +364,15 @@ async function GetBestJubilityOnSongs(
 						$switch: {
 							branches: [
 								{
-									case: { $in: ["$difficulty", ["HARD BSC", "BSC"]] },
+									case: { $in: ["$chart.difficulty", ["HARD BSC", "BSC"]] },
 									then: "BSC",
 								},
 								{
-									case: { $in: ["$difficulty", ["HARD ADV", "ADV"]] },
+									case: { $in: ["$chart.difficulty", ["HARD ADV", "ADV"]] },
 									then: "ADV",
 								},
 								{
-									case: { $in: ["$difficulty", ["HARD EXT", "EXT"]] },
+									case: { $in: ["$chart.difficulty", ["HARD EXT", "EXT"]] },
 									then: "EXT",
 								},
 							],
diff --git a/server/src/server/router/api/v1/admin/router.test.ts b/server/src/server/router/api/v1/admin/router.test.ts
index f4c995913..147e8010c 100644
--- a/server/src/server/router/api/v1/admin/router.test.ts
+++ b/server/src/server/router/api/v1/admin/router.test.ts
@@ -3,6 +3,7 @@ import db from "external/mongo/db";
 import { ONE_MINUTE } from "lib/constants/time";
 import { ChangeRootLogLevel, GetLogLevel } from "lib/logger/logger";
 import { ServerConfig } from "lib/setup/config";
+import { UserAuthLevels } from "tachi-common";
 import t from "tap";
 import { CreateFakeAuthCookie } from "test-utils/fake-auth";
 import mockApi from "test-utils/mock-api";
@@ -14,12 +15,26 @@ import type { ScoreDocument } from "tachi-common";
 const LOG_LEVEL = ServerConfig.LOGGER_CONFIG.LOG_LEVEL;
 
 t.test("POST /api/v1/admin/change-log-level", async (t) => {
-	t.beforeEach(() => {
+	t.beforeEach(async () => {
 		ChangeRootLogLevel(LOG_LEVEL);
+		await db.users.update({ id: 1 }, { $set: { authLevel: UserAuthLevels.ADMIN } });
 	});
 
 	const auth = await CreateFakeAuthCookie(mockApi);
 
+	t.test("Should require an admin authlevel", async (t) => {
+		await db.users.update({ id: 1 }, { $set: { authLevel: UserAuthLevels.USER } });
+
+		const res = await mockApi.post("/api/v1/admin/change-log-level").set("Cookie", auth).send({
+			noReset: true,
+			logLevel: "crit",
+		});
+
+		t.equal(res.statusCode, 403);
+
+		t.end();
+	});
+
 	t.test("Should change the log level on the server.", async (t) => {
 		const res = await mockApi.post("/api/v1/admin/change-log-level").set("Cookie", auth).send({
 			noReset: true,
@@ -66,29 +81,53 @@ t.test("POST /api/v1/admin/change-log-level", async (t) => {
 
 t.test("POST /api/v1/admin/delete-score", async (t) => {
 	t.beforeEach(ResetDBState);
+	t.beforeEach(async () => {
+		await db.users.update({ id: 1 }, { $set: { authLevel: UserAuthLevels.ADMIN } });
+	});
 
 	const auth = await CreateFakeAuthCookie(mockApi);
 
-	await db.scores.insert(
-		deepmerge<ScoreDocument>(TestingIIDXSPScore, {
-			scoreID: "deleteme",
-		})
-	);
+	t.test("Should require an admin authlevel", async (t) => {
+		await db.users.update({ id: 1 }, { $set: { authLevel: UserAuthLevels.USER } });
 
-	const res = await mockApi
-		.post("/api/v1/admin/delete-score")
-		.set({
-			Cookie: auth,
-		})
-		.send({
-			scoreID: "deleteme",
-		});
+		const res = await mockApi
+			.post("/api/v1/admin/delete-score")
+			.set({
+				Cookie: auth,
+			})
+			.send({
+				scoreID: "deleteme",
+			});
 
-	t.equal(res.statusCode, 200);
+		t.equal(res.statusCode, 403);
 
-	const dbScore = await db.scores.findOne({ scoreID: "deleteme" });
+		t.end();
+	});
 
-	t.equal(dbScore, null, "Should remove the score from the database.");
+	t.test("Should delete another user's score.", async (t) => {
+		await db.scores.insert(
+			deepmerge<ScoreDocument>(TestingIIDXSPScore, {
+				scoreID: "deleteme",
+			})
+		);
+
+		const res = await mockApi
+			.post("/api/v1/admin/delete-score")
+			.set({
+				Cookie: auth,
+			})
+			.send({
+				scoreID: "deleteme",
+			});
+
+		t.equal(res.statusCode, 200);
+
+		const dbScore = await db.scores.findOne({ scoreID: "deleteme" });
+
+		t.equal(dbScore, null, "Should remove the score from the database.");
+
+		t.end();
+	});
 
 	t.end();
 });
diff --git a/server/src/server/router/api/v1/users/_userID/games/_game/_playtype/settings/router.test.ts b/server/src/server/router/api/v1/users/_userID/games/_game/_playtype/settings/router.test.ts
index d080d3fab..bcd4d6b2b 100644
--- a/server/src/server/router/api/v1/users/_userID/games/_game/_playtype/settings/router.test.ts
+++ b/server/src/server/router/api/v1/users/_userID/games/_game/_playtype/settings/router.test.ts
@@ -4,6 +4,7 @@ import t from "tap";
 import mockApi from "test-utils/mock-api";
 import ResetDBState from "test-utils/resets";
 import type { UGPTSettings } from "tachi-common";
+import { mkFakeUser } from "test-utils/misc";
 
 t.test("GET /api/v1/users/:userID/games/:game/:playtype/settings", (t) => {
 	t.beforeEach(ResetDBState);
@@ -315,6 +316,7 @@ t.test("PATCH /api/v1/users/:userID/games/:game/:playtype/settings", (t) => {
 	});
 
 	t.test("Requires the user to be authed as the requested user.", async (t) => {
+		await db.users.insert(mkFakeUser(2));
 		await db["api-tokens"].insert({
 			userID: 2,
 			identifier: "api_token",
diff --git a/server/src/server/router/api/v1/users/_userID/games/_game/_playtype/showcase/router.test.ts b/server/src/server/router/api/v1/users/_userID/games/_game/_playtype/showcase/router.test.ts
index d49ac45f0..9dc221468 100644
--- a/server/src/server/router/api/v1/users/_userID/games/_game/_playtype/showcase/router.test.ts
+++ b/server/src/server/router/api/v1/users/_userID/games/_game/_playtype/showcase/router.test.ts
@@ -7,6 +7,7 @@ import ResetDBState from "test-utils/resets";
 import { Testing511SPA, TestingIIDXFolderSP10, TestingIIDXSPScorePB } from "test-utils/test-data";
 import { CreateFolderChartLookup } from "utils/folder";
 import type { ChartDocument, UserDocument } from "tachi-common";
+import { mkFakeUser } from "test-utils/misc";
 
 const SetFolders = async () => {
 	await db.folders.insert(TestingIIDXFolderSP10);
@@ -276,6 +277,7 @@ t.test("PUT /api/v1/users/:userID/games/:game/:playtype/showcase", (t) => {
 	);
 
 	t.test("Requires the user to be authed as the requested user.", async (t) => {
+		await db.users.insert(mkFakeUser(2));
 		await db["api-tokens"].insert({
 			userID: 2,
 			identifier: "alt_token",
diff --git a/server/src/server/router/api/v1/users/_userID/middleware.ts b/server/src/server/router/api/v1/users/_userID/middleware.ts
index 74524600a..793196188 100644
--- a/server/src/server/router/api/v1/users/_userID/middleware.ts
+++ b/server/src/server/router/api/v1/users/_userID/middleware.ts
@@ -1,10 +1,10 @@
 import { SYMBOL_TACHI_API_AUTH } from "lib/constants/tachi";
+import CreateLogCtx from "lib/logger/logger";
 import { UserAuthLevels } from "tachi-common";
 import { IsNullish } from "utils/misc";
 import { AssignToReqTachiData, GetTachiData } from "utils/req-tachi-data";
 import { GetUserWithID, ResolveUser } from "utils/user";
 import type { RequestHandler } from "express";
-import CreateLogCtx from "lib/logger/logger";
 
 const logger = CreateLogCtx(__filename);
 
@@ -59,6 +59,7 @@ export const RequireAuthedAsUser: RequestHandler = async (req, res, next) => {
 	const user = GetTachiData(req, "requestedUser");
 
 	const requestingUserID = req[SYMBOL_TACHI_API_AUTH].userID;
+
 	if (requestingUserID === null) {
 		return res.status(401).json({
 			success: false,
@@ -72,7 +73,7 @@ export const RequireAuthedAsUser: RequestHandler = async (req, res, next) => {
 		logger.severe(`${requestingUserID} is signed in as someone who does not exist.`);
 		return res.status(500).json({
 			success: false,
-			description: `You are signed in as someone who does not exist.`
+			description: `You are signed in as someone who does not exist.`,
 		});
 	}
 
@@ -82,7 +83,6 @@ export const RequireAuthedAsUser: RequestHandler = async (req, res, next) => {
 		return;
 	}
 
-
 	if (requestingUserID !== user.id) {
 		return res.status(403).json({
 			success: false,
diff --git a/server/src/test-utils/mock-db/users.json b/server/src/test-utils/mock-db/users.json
index 83225b47a..0fb771965 100644
--- a/server/src/test-utils/mock-db/users.json
+++ b/server/src/test-utils/mock-db/users.json
@@ -12,6 +12,6 @@
 		"customBannerLocation": null,
 		"clan": null,
 		"badges": [],
-		"authLevel": 3
+		"authLevel": 1
 	}
 ]
\ No newline at end of file