diff --git a/user.go b/user.go
index ff91e44..0018f89 100644
--- a/user.go
+++ b/user.go
@@ -2,9 +2,18 @@ package gpaste
 
 import "golang.org/x/crypto/bcrypt"
 
+type Role string
+
+const (
+	RoleUnset Role = ""
+	RoleUser  Role = "user"
+	RoleAdmin Role = "admin"
+)
+
 type User struct {
 	Username       string `json:"username"`
 	HashedPassword []byte `json:"hashed_password"`
+	Roles          []Role `json:"roles"`
 }
 
 type UserStore interface {
diff --git a/userstore_test.go b/userstore_test.go
index 5b74d09..b9d4371 100644
--- a/userstore_test.go
+++ b/userstore_test.go
@@ -4,6 +4,7 @@ import (
 	"testing"
 
 	"git.t-juice.club/torjus/gpaste"
+	"github.com/google/go-cmp/cmp"
 )
 
 func RunUserStoreTest(newFunc func() (func(), gpaste.UserStore), t *testing.T) {
@@ -11,31 +12,40 @@ func RunUserStoreTest(newFunc func() (func(), gpaste.UserStore), t *testing.T) {
 		cleanup, s := newFunc()
 		t.Cleanup(cleanup)
 
-		userMap := make(map[string]string)
+		userMap := make(map[string]*gpaste.User)
+		passwordMap := make(map[string]string)
 		for i := 0; i < 10; i++ {
-			userMap[randomString(8)] = randomString(16)
-		}
-
-		for k, v := range userMap {
+			username := randomString(8)
+			password := randomString(16)
+			passwordMap[username] = password
 			user := &gpaste.User{
-				Username: k,
+				Username: username,
+				Roles:    []gpaste.Role{gpaste.RoleAdmin},
 			}
-			if err := user.SetPassword(v); err != nil {
+			if err := user.SetPassword(password); err != nil {
 				t.Fatalf("Error setting password: %s", err)
 			}
+			userMap[username] = user
+		}
+
+		for _, user := range userMap {
 			if err := s.Store(user); err != nil {
 				t.Fatalf("Error storing user: %s", err)
 			}
 		}
 
-		for k, v := range userMap {
+		for k := range userMap {
 			user, err := s.Get(k)
 			if err != nil {
 				t.Errorf("Error getting user: %s", err)
 			}
-			if err := user.ValidatePassword(v); err != nil {
+			if err := user.ValidatePassword(passwordMap[user.Username]); err != nil {
 				t.Errorf("Error verifying password: %s", err)
 			}
+
+			if !cmp.Equal(user, userMap[k]) {
+				t.Errorf("User mismatch: %s", cmp.Diff(user, userMap[k]))
+			}
 		}
 	})
 }