diff --git a/server/src/db/models/user.model.ts b/server/src/db/models/user.model.ts
index a7ec173..0245eee 100644
--- a/server/src/db/models/user.model.ts
+++ b/server/src/db/models/user.model.ts
@@ -1,7 +1,7 @@
 import { db } from "../index.js";
 import type { User } from "@chessu/types";
 
-const create = async (user: User, password: string) => {
+export const create = async (user: User, password: string) => {
     if (user.name === "Guest" || user.email === undefined) {
         return null;
     }
@@ -9,7 +9,7 @@ const create = async (user: User, password: string) => {
     try {
         const res = await db.query(
             `INSERT INTO "user"(name, email, password) VALUES($1, $2, $3) RETURNING id, name, email`,
-            [user.name, user.email ?? null, password]
+            [user.name, user.email || null, password]
         );
         return res.rows[0] as User;
     } catch (err: unknown) {
@@ -18,12 +18,14 @@ const create = async (user: User, password: string) => {
     }
 };
 
-const find = async (where?: string, limit = 1) => {
+export const find = async (user: User, limit?: number) => {
     // if user is not specified, get all users
-    if (!where) {
+    if (!user) {
         try {
-            const res = await db.query(`SELECT id, name, email FROM "user"`);
-            return res.rows as Array<User>;
+            const res = await db.query(`SELECT id, name, email FROM "user" LIMIT $1`, [
+                limit ?? 10
+            ]);
+            return res.rows as Array<User & { password?: string }>;
         } catch (err: unknown) {
             console.log(err);
             return null;
@@ -31,31 +33,31 @@ const find = async (where?: string, limit = 1) => {
     }
 
     try {
-        /* const res = await db.query(
-            `SELECT id, name, email FROM "user" WHERE ${typeof user.id === "number" ? "id" : typeof user.name === "string" ? "name" : "email" } = $1 LIMIT $2`,
-            [typeof user.id === "number" ? user.id : typeof user.name === "string" ? user.name : user.email, limit]
-        ); */
-        const res = await db.query(`SELECT id, name, email FROM "user" WHERE $1 LIMIT $2`, [
-            where,
-            limit
-        ]);
-        return res.rows as Array<User>;
+        const res = await db.query(
+            `SELECT id, name, email, password FROM "user" WHERE name=$1 OR email=$2 LIMIT $3`,
+            [user.name, user.email, limit ?? 1]
+        );
+        return res.rows as Array<User & { password?: string }>;
     } catch (err: unknown) {
         console.log(err);
         return null;
     }
 };
 
-const update = async (id: number, data: string) => {
+export const update = async (id: number, updatedUser: User & { password?: string }) => {
     if (typeof id === "string" || id === 0) {
         return null;
     }
 
     try {
-        const res = await db.query(`UPDATE "user" SET $1 WHERE id = $2 RETURNING id, name, email`, [
-            data,
-            id
-        ]);
+        let query = `UPDATE "user" SET name=$1, email=$2 WHERE id=$3 RETURNING id, name, email`;
+        let values = [updatedUser.name, updatedUser.email, id];
+
+        if (updatedUser.password) {
+            query = `UPDATE "user" SET name=$1, email=$2, password=$3 WHERE id=$4 RETURNING id, name, email`;
+            values = [updatedUser.name, updatedUser.email, updatedUser.password, id];
+        }
+        const res = await db.query(query, values);
         return res.rows[0] as User;
     } catch (err: unknown) {
         console.log(err);
@@ -63,7 +65,7 @@ const update = async (id: number, data: string) => {
     }
 };
 
-const remove = async (id: number) => {
+export const remove = async (id: number) => {
     if (typeof id === "string" || id === 0) {
         return null;
     }
@@ -78,10 +80,3 @@ const remove = async (id: number) => {
         return null;
     }
 };
-
-export const UserModel = {
-    create,
-    find,
-    update,
-    remove
-};