diff --git a/pkg/service/scripts.go b/pkg/service/scripts.go
index b353002..d502c6e 100644
--- a/pkg/service/scripts.go
+++ b/pkg/service/scripts.go
@@ -2,7 +2,11 @@ package service
 
 import (
 	"context"
+	"fmt"
+
 	"git.itzana.me/strafesnet/maps-service/pkg/api"
+	"git.itzana.me/strafesnet/maps-service/pkg/datastore"
+	"git.itzana.me/strafesnet/maps-service/pkg/model"
 )
 
 var (
@@ -14,7 +18,28 @@ var (
 //
 // POST /scripts
 func (svc *Service) CreateScript(ctx context.Context, req *api.ScriptCreate) (*api.ID, error){
-	return nil,nil
+	userInfo, ok := ctx.Value("UserInfo").(*UserInfo)
+	if !ok{
+		return nil, ErrUserInfo
+	}
+
+	if !userInfo.Roles.ScriptWrite{
+		return nil, ErrPermissionDenied
+	}
+
+	script, err := svc.DB.Scripts().Create(ctx, model.Script{
+		ID:           0,
+		Hash:         0, // TODO
+		Source:       req.Source,
+		SubmissionID: req.SubmissionID.Or(0),
+	})
+	if err != nil{
+		return nil, err
+	}
+
+	return &api.ID{
+		ID:script.ID,
+	}, nil
 }
 // DeleteScript implements deleteScript operation.
 //
@@ -22,7 +47,16 @@ func (svc *Service) CreateScript(ctx context.Context, req *api.ScriptCreate) (*a
 //
 // DELETE /scripts/{ScriptID}
 func (svc *Service) DeleteScript(ctx context.Context, params api.DeleteScriptParams) error{
-	return nil
+	userInfo, ok := ctx.Value("UserInfo").(*UserInfo)
+	if !ok{
+		return ErrUserInfo
+	}
+
+	if !userInfo.Roles.ScriptWrite{
+		return ErrPermissionDenied
+	}
+
+	return svc.DB.Scripts().Delete(ctx, params.ScriptID)
 }
 // GetScript implements getScript operation.
 //
@@ -30,7 +64,24 @@ func (svc *Service) DeleteScript(ctx context.Context, params api.DeleteScriptPar
 //
 // GET /scripts/{ScriptID}
 func (svc *Service) GetScript(ctx context.Context, params api.GetScriptParams) (*api.Script, error){
-	return nil,nil
+	_, ok := ctx.Value("UserInfo").(*UserInfo)
+	if !ok{
+		return nil, ErrUserInfo
+	}
+
+	// Read permission for scripts only requires you to be logged in
+
+	script, err := svc.DB.Scripts().Get(ctx, params.ScriptID)
+	if err != nil{
+		return nil, err
+	}
+
+	return &api.Script{
+		ID:           script.ID,
+		Hash:         fmt.Sprintf("%x",script.Hash),
+		Source:       script.Source,
+		SubmissionID: script.SubmissionID,
+	}, nil
 }
 // UpdateScript implements updateScript operation.
 //
@@ -38,5 +89,23 @@ func (svc *Service) GetScript(ctx context.Context, params api.GetScriptParams) (
 //
 // PATCH /scripts/{ScriptID}
 func (svc *Service) UpdateScript(ctx context.Context, req *api.ScriptUpdate, params api.UpdateScriptParams) error{
-	return nil
+	userInfo, ok := ctx.Value("UserInfo").(*UserInfo)
+	if !ok{
+		return ErrUserInfo
+	}
+
+	if !userInfo.Roles.ScriptWrite{
+		return ErrPermissionDenied
+	}
+
+	pmap := datastore.Optional()
+	if source,ok:=req.Source.Get();ok{
+		pmap.Add("source",source)
+		panic("unimplemented")
+		pmap.Add("from_script_hash",0)
+	}
+	if SubmissionID,ok:=req.SubmissionID.Get();ok{
+		pmap.Add("submission_id",SubmissionID)
+	}
+	return svc.DB.Scripts().Update(ctx, req.ID, pmap)
 }