diff --git a/server/pnpm-lock.yaml b/server/pnpm-lock.yaml
index 1c4553cc3..ec6235b11 100644
--- a/server/pnpm-lock.yaml
+++ b/server/pnpm-lock.yaml
@@ -80,7 +80,7 @@ dependencies:
   rate-limit-redis: 2.1.0
   redis: 3.1.2
   rimraf: 3.0.2
-  tachi-common: github.com/zkldi/tachi-common/65f1b0a6d7bf9c08d04b35901829df9e4b4207ff_ts-node@10.0.0+typescript@4.3.4
+  tachi-common: github.com/zkldi/tachi-common/0b3e388dd5f153e18a4cede1c9ba046f45c7a570_ts-node@10.0.0+typescript@4.3.4
   typescript: 4.3.4
   winston: 3.3.3
 
@@ -4233,9 +4233,9 @@ packages:
     engines: {node: '>=6'}
     dev: true
 
-  github.com/zkldi/tachi-common/65f1b0a6d7bf9c08d04b35901829df9e4b4207ff_ts-node@10.0.0+typescript@4.3.4:
-    resolution: {tarball: https://codeload.github.com/zkldi/tachi-common/tar.gz/65f1b0a6d7bf9c08d04b35901829df9e4b4207ff}
-    id: github.com/zkldi/tachi-common/65f1b0a6d7bf9c08d04b35901829df9e4b4207ff
+  github.com/zkldi/tachi-common/0b3e388dd5f153e18a4cede1c9ba046f45c7a570_ts-node@10.0.0+typescript@4.3.4:
+    resolution: {tarball: https://codeload.github.com/zkldi/tachi-common/tar.gz/0b3e388dd5f153e18a4cede1c9ba046f45c7a570}
+    id: github.com/zkldi/tachi-common/0b3e388dd5f153e18a4cede1c9ba046f45c7a570
     name: tachi-common
     version: 0.1.0
     dependencies:
diff --git a/server/src/server/middleware/auth.test.ts b/server/src/server/middleware/auth.test.ts
index 6ba947863..8bc2b5d98 100644
--- a/server/src/server/middleware/auth.test.ts
+++ b/server/src/server/middleware/auth.test.ts
@@ -11,7 +11,7 @@ t.test("#SetRequestPermissions", (t) => {
 			userID: 1,
 			identifier: "Mock API Token",
 			permissions: {
-				"create:goal": true,
+				customise_profile: true,
 			},
 			token: "mock_token",
 		});
@@ -26,7 +26,7 @@ t.test("#SetRequestPermissions", (t) => {
 			userID: 1,
 			identifier: "Mock API Token",
 			permissions: {
-				"create:goal": true,
+				customise_profile: true,
 			},
 			token: "mock_token",
 		});
diff --git a/server/src/server/middleware/auth.ts b/server/src/server/middleware/auth.ts
index d94403fc8..8e857cd1b 100644
--- a/server/src/server/middleware/auth.ts
+++ b/server/src/server/middleware/auth.ts
@@ -15,9 +15,8 @@ const GuestToken: APITokenDocument = {
 };
 
 export const AllPermissions: Record<APIPermissions, true> = {
-	"create:goal": true,
-	"manage:goal": true,
-	"submit:score": true,
+	customise_profile: true,
+	submit_score: true,
 };
 
 /**
diff --git a/server/src/server/router/api/v1/users/_userID/router.ts b/server/src/server/router/api/v1/users/_userID/router.ts
index e7f16e0ae..f1fe25492 100644
--- a/server/src/server/router/api/v1/users/_userID/router.ts
+++ b/server/src/server/router/api/v1/users/_userID/router.ts
@@ -1,8 +1,9 @@
 import { Router } from "express";
 import db from "../../../../../../external/mongo/db";
 import { SYMBOL_TachiData } from "../../../../../../lib/constants/tachi";
-import { GetUserFromParam } from "./middleware";
+import { GetUserFromParam, RequireAuthedAsUser } from "./middleware";
 import gamePTRouter from "./games/_game/_playtype/router";
+import { RequirePermissions } from "../../../../../middleware/auth";
 
 const router: Router = Router({ mergeParams: true });
 
@@ -41,6 +42,8 @@ router.get("/game-stats", async (req, res) => {
 	});
 });
 
+router.put("/pfp", RequireAuthedAsUser, RequirePermissions(""))
+
 router.use("/games/:game/:playtype", gamePTRouter);
 
 export default router;
diff --git a/server/src/server/router/ir/barbatos/router.ts b/server/src/server/router/ir/barbatos/router.ts
index ab5c8d670..8eecf4220 100644
--- a/server/src/server/router/ir/barbatos/router.ts
+++ b/server/src/server/router/ir/barbatos/router.ts
@@ -7,7 +7,7 @@ import { SYMBOL_TachiAPIAuth } from "../../../../lib/constants/tachi";
 
 const router: Router = Router({ mergeParams: true });
 
-router.use(RequirePermissions("submit:score"));
+router.use(RequirePermissions("submit_score"));
 
 /**
  * Submits a single score document from Barbatos clients.
diff --git a/server/src/server/router/ir/beatoraja/router.test.ts b/server/src/server/router/ir/beatoraja/router.test.ts
index cd5999f0a..861d64a6f 100644
--- a/server/src/server/router/ir/beatoraja/router.test.ts
+++ b/server/src/server/router/ir/beatoraja/router.test.ts
@@ -13,7 +13,7 @@ t.test("POST /ir/beatoraja/submit-score", (t) => {
 			userID: 1,
 			identifier: "Mock API Beatoraja Token",
 			permissions: {
-				"submit:score": true,
+				"submit_score": true,
 			},
 			token: "mock_token",
 		})
@@ -166,7 +166,7 @@ t.test("POST /ir/beatoraja/submit-course", (t) => {
 			userID: 1,
 			identifier: "Mock API Beatoraja Token",
 			permissions: {
-				"submit:score": true,
+				"submit_score": true,
 			},
 			token: "mock_token",
 		})
diff --git a/server/src/server/router/ir/chunitachi/router.ts b/server/src/server/router/ir/chunitachi/router.ts
index 5d6043f70..469510526 100644
--- a/server/src/server/router/ir/chunitachi/router.ts
+++ b/server/src/server/router/ir/chunitachi/router.ts
@@ -11,7 +11,7 @@ const router: Router = Router({ mergeParams: true });
  * Submits a single score document from Chunitachi clients.
  * @name POST /ir/chunitachi/score/submit
  */
-router.post("/import", RequirePermissions("submit:score"), async (req, res) => {
+router.post("/import", RequirePermissions("submit_score"), async (req, res) => {
 	const userDoc = await GetUserWithIDGuaranteed(req[SYMBOL_TachiAPIAuth].userID!);
 
 	if (req.body?.head?.game !== "chunithm") {
diff --git a/server/src/server/router/ir/direct-manual/router.test.ts b/server/src/server/router/ir/direct-manual/router.test.ts
index 9f3ce37ab..bee2ffa0f 100644
--- a/server/src/server/router/ir/direct-manual/router.test.ts
+++ b/server/src/server/router/ir/direct-manual/router.test.ts
@@ -12,12 +12,12 @@ t.test("POST /ir/direct-manual/import", async (t) => {
 
 	t.beforeEach(ResetDBState);
 
-	t.test("Should require submit:score permissions", async (t) => {
+	t.test("Should require submit_score permissions", async (t) => {
 		await db["api-tokens"].insert({
 			token: "foo",
 			identifier: "bar",
 			permissions: {
-				"submit:score": false,
+				"submit_score": false,
 			},
 			userID: 1,
 		});
@@ -28,7 +28,7 @@ t.test("POST /ir/direct-manual/import", async (t) => {
 
 		t.equal(res.body.success, false);
 
-		t.match(res.body.description, /submit:score/u);
+		t.match(res.body.description, /submit_score/u);
 
 		t.end();
 	});
diff --git a/server/src/server/router/ir/direct-manual/router.ts b/server/src/server/router/ir/direct-manual/router.ts
index 7281f3973..aa25671ab 100644
--- a/server/src/server/router/ir/direct-manual/router.ts
+++ b/server/src/server/router/ir/direct-manual/router.ts
@@ -14,7 +14,7 @@ const router: Router = Router({ mergeParams: true });
  */
 router.post(
 	"/import",
-	RequirePermissions("submit:score"),
+	RequirePermissions("submit_score"),
 	RequireLoggedInSession,
 	async (req, res) => {
 		const userDoc = await GetUserWithIDGuaranteed(req[SYMBOL_TachiAPIAuth].userID!);
diff --git a/server/src/server/router/ir/fervidex/router.ts b/server/src/server/router/ir/fervidex/router.ts
index dcfa80ac1..1378dbce2 100644
--- a/server/src/server/router/ir/fervidex/router.ts
+++ b/server/src/server/router/ir/fervidex/router.ts
@@ -151,7 +151,7 @@ const ValidateModelHeader: RequestHandler = (req, res, next) => {
 	return next();
 };
 
-router.use(RequirePermissions("submit:score"), ValidateFervidexHeader, ValidateModelHeader);
+router.use(RequirePermissions("submit_score"), ValidateFervidexHeader, ValidateModelHeader);
 
 /**
  * Submits all of a users data to Kamaitachi. This data is extremely minimal,
diff --git a/server/src/server/router/ir/usc/router.test.ts b/server/src/server/router/ir/usc/router.test.ts
index 9bae5d32a..1076c7978 100644
--- a/server/src/server/router/ir/usc/router.test.ts
+++ b/server/src/server/router/ir/usc/router.test.ts
@@ -13,7 +13,7 @@ async function InsertFakeUSCAuth() {
 		userID: 1,
 		identifier: "USC Token",
 		permissions: {
-			"submit:score": true,
+			"submit_score": true,
 		},
 		token: "foo",
 	});
@@ -44,7 +44,7 @@ t.test("GET /ir/usc", async (t) => {
 		userID: 1,
 		identifier: "USC Token",
 		permissions: {
-			"submit:score": true,
+			"submit_score": true,
 		},
 		token: "foo",
 	});
diff --git a/server/src/server/router/ir/usc/router.ts b/server/src/server/router/ir/usc/router.ts
index 0a6a2ff62..0bb611528 100644
--- a/server/src/server/router/ir/usc/router.ts
+++ b/server/src/server/router/ir/usc/router.ts
@@ -234,7 +234,7 @@ router.get("/charts/:chartHash/leaderboard", RetrieveChart, async (req, res) =>
  * https://uscir.readthedocs.io/en/latest/endpoints/score-submit.html
  * @name POST /ir/usc/scores
  */
-router.post("/scores", RequirePermissions("submit:score"), async (req, res) => {
+router.post("/scores", RequirePermissions("submit_score"), async (req, res) => {
 	if (typeof req.body.chart !== "object" || req.body.chart === null) {
 		return res.status(200).json({
 			statusCode: STATUS_CODES.BAD_REQ,
@@ -316,7 +316,7 @@ router.post("/scores", RequirePermissions("submit:score"), async (req, res) => {
  */
 router.post(
 	"/replays",
-	RequirePermissions("submit:score"),
+	RequirePermissions("submit_score"),
 	CreateMulterSingleUploadMiddleware("replay", ONE_MEGABYTE, logger),
 	async (req, res) => {
 		if (typeof req.body.identifier !== "string") {
diff --git a/server/src/test-utils/mock-db/api-tokens.json b/server/src/test-utils/mock-db/api-tokens.json
index 17cf24b8f..769b6da56 100644
--- a/server/src/test-utils/mock-db/api-tokens.json
+++ b/server/src/test-utils/mock-db/api-tokens.json
@@ -3,7 +3,7 @@
         "userID": 1,
         "token": "fake_api_token",
         "permissions": {
-            "submit:goal": true
+            "submit_score": true
         },
         "identifier": "Mock Token For Testing"
     }