diff --git a/gen/openapi/auth/v1/auth_service.swagger.json b/gen/openapi/auth/v1/auth_service.swagger.json
index 5819df6..95faf6e 100644
--- a/gen/openapi/auth/v1/auth_service.swagger.json
+++ b/gen/openapi/auth/v1/auth_service.swagger.json
@@ -16,6 +16,39 @@
     "application/json"
   ],
   "paths": {
+    "/gapi/auth/v1/account/status": {
+      "post": {
+        "summary": "GetAccountStatus 获取sudo的ttl",
+        "operationId": "AuthService_GetAccountStatus",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "$ref": "#/definitions/v1GetAccountStatusResponse"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "#/definitions/rpcStatus"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "body",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/v1GetAccountStatusRequest"
+            }
+          }
+        ],
+        "tags": [
+          "AuthService"
+        ]
+      }
+    },
     "/gapi/auth/v1/login": {
       "post": {
         "summary": "用户登录",
@@ -49,6 +82,361 @@
         ]
       }
     },
+    "/gapi/auth/v1/mfa/email/activate": {
+      "post": {
+        "operationId": "AuthService_ActivateEmailMFA",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "$ref": "#/definitions/v1ActivateEmailMFAResponse"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "#/definitions/rpcStatus"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "body",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/v1ActivateEmailMFARequest"
+            }
+          }
+        ],
+        "tags": [
+          "AuthService"
+        ]
+      }
+    },
+    "/gapi/auth/v1/mfa/email/add": {
+      "post": {
+        "summary": "Email",
+        "operationId": "AuthService_AddEmailMFA",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "$ref": "#/definitions/v1AddEmailMFAResponse"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "#/definitions/rpcStatus"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "body",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/v1AddEmailMFARequest"
+            }
+          }
+        ],
+        "tags": [
+          "AuthService"
+        ]
+      }
+    },
+    "/gapi/auth/v1/mfa/email/check": {
+      "post": {
+        "operationId": "AuthService_CheckEmailMFA",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "$ref": "#/definitions/v1CheckEmailMFAResponse"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "#/definitions/rpcStatus"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "body",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/v1CheckEmailMFARequest"
+            }
+          }
+        ],
+        "tags": [
+          "AuthService"
+        ]
+      }
+    },
+    "/gapi/auth/v1/mfa/email/disable": {
+      "post": {
+        "operationId": "AuthService_DisableEmailMFA",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "$ref": "#/definitions/v1DisableEmailMFAResponse"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "#/definitions/rpcStatus"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "body",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/v1DisableEmailMFARequest"
+            }
+          }
+        ],
+        "tags": [
+          "AuthService"
+        ]
+      }
+    },
+    "/gapi/auth/v1/mfa/email/send": {
+      "post": {
+        "operationId": "AuthService_SendCodeEmailMFA",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "$ref": "#/definitions/v1SendCodeEmailMFAResponse"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "#/definitions/rpcStatus"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "body",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/v1SendCodeEmailMFARequest"
+            }
+          }
+        ],
+        "tags": [
+          "AuthService"
+        ]
+      }
+    },
+    "/gapi/auth/v1/mfa/email/setPrimary": {
+      "post": {
+        "operationId": "AuthService_SetPrimaryEmailMFA",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "$ref": "#/definitions/v1SetPrimaryEmailMFAResponse"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "#/definitions/rpcStatus"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "body",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/v1SetPrimaryEmailMFARequest"
+            }
+          }
+        ],
+        "tags": [
+          "AuthService"
+        ]
+      }
+    },
+    "/gapi/auth/v1/mfa/status": {
+      "post": {
+        "summary": "检查MFA状态，并返回MFA状态",
+        "operationId": "AuthService_GetMFAStatus",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "$ref": "#/definitions/v1GetMFAStatusResponse"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "#/definitions/rpcStatus"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "body",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/v1GetMFAStatusRequest"
+            }
+          }
+        ],
+        "tags": [
+          "AuthService"
+        ]
+      }
+    },
+    "/gapi/auth/v1/mfa/totp/active": {
+      "post": {
+        "summary": "TOTP\n添加TOTP",
+        "operationId": "AuthService_ActiveTOTP",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "$ref": "#/definitions/v1ActiveTOTPResponse"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "#/definitions/rpcStatus"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "body",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/v1ActiveTOTPRequest"
+            }
+          }
+        ],
+        "tags": [
+          "AuthService"
+        ]
+      }
+    },
+    "/gapi/auth/v1/mfa/totp/check": {
+      "post": {
+        "operationId": "AuthService_CheckTOTP",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "$ref": "#/definitions/v1CheckTOTPResponse"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "#/definitions/rpcStatus"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "body",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/v1CheckTOTPRequest"
+            }
+          }
+        ],
+        "tags": [
+          "AuthService"
+        ]
+      }
+    },
+    "/gapi/auth/v1/mfa/totp/disable": {
+      "post": {
+        "operationId": "AuthService_DisableTOTP",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "$ref": "#/definitions/v1DisableTOTPResponse"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "#/definitions/rpcStatus"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "body",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/v1DisableTOTPRequest"
+            }
+          }
+        ],
+        "tags": [
+          "AuthService"
+        ]
+      }
+    },
+    "/gapi/auth/v1/mfa/totp/recover": {
+      "post": {
+        "operationId": "AuthService_RecoverTOTP",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "$ref": "#/definitions/v1RecoverTOTPResponse"
+            }
+          },
+          "default": {
+            "description": "An unexpected error response.",
+            "schema": {
+              "$ref": "#/definitions/rpcStatus"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "body",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/v1RecoverTOTPRequest"
+            }
+          }
+        ],
+        "tags": [
+          "AuthService"
+        ]
+      }
+    },
     "/gapi/auth/v1/refreshToken": {
       "post": {
         "summary": "Token刷新",
@@ -145,6 +533,139 @@
         }
       }
     },
+    "v1ActivateEmailMFARequest": {
+      "type": "object",
+      "properties": {
+        "email": {
+          "type": "string"
+        },
+        "verificationCode": {
+          "type": "string"
+        }
+      }
+    },
+    "v1ActivateEmailMFAResponse": {
+      "type": "object"
+    },
+    "v1ActiveTOTPRequest": {
+      "type": "object",
+      "properties": {
+        "secretKey": {
+          "type": "string"
+        },
+        "totpCode": {
+          "type": "string"
+        }
+      },
+      "title": "TOTP"
+    },
+    "v1ActiveTOTPResponse": {
+      "type": "object"
+    },
+    "v1AddEmailMFARequest": {
+      "type": "object",
+      "properties": {
+        "email": {
+          "type": "string"
+        }
+      },
+      "title": "Email MFA"
+    },
+    "v1AddEmailMFAResponse": {
+      "type": "object"
+    },
+    "v1CheckEmailMFARequest": {
+      "type": "object",
+      "properties": {
+        "email": {
+          "type": "string"
+        },
+        "verificationCode": {
+          "type": "string"
+        }
+      }
+    },
+    "v1CheckEmailMFAResponse": {
+      "type": "object"
+    },
+    "v1CheckTOTPRequest": {
+      "type": "object",
+      "properties": {
+        "totpCode": {
+          "type": "string"
+        }
+      }
+    },
+    "v1CheckTOTPResponse": {
+      "type": "object"
+    },
+    "v1DisableEmailMFARequest": {
+      "type": "object",
+      "properties": {
+        "email": {
+          "type": "string"
+        }
+      }
+    },
+    "v1DisableEmailMFAResponse": {
+      "type": "object"
+    },
+    "v1DisableTOTPRequest": {
+      "type": "object",
+      "properties": {
+        "totpCode": {
+          "type": "string"
+        }
+      }
+    },
+    "v1DisableTOTPResponse": {
+      "type": "object"
+    },
+    "v1EmailStatus": {
+      "type": "object",
+      "properties": {
+        "email": {
+          "type": "string"
+        },
+        "isPrimary": {
+          "type": "boolean"
+        },
+        "isActive": {
+          "type": "boolean"
+        }
+      }
+    },
+    "v1GetAccountStatusRequest": {
+      "type": "object"
+    },
+    "v1GetAccountStatusResponse": {
+      "type": "object",
+      "properties": {
+        "sudoTtl": {
+          "type": "string",
+          "format": "int64"
+        }
+      }
+    },
+    "v1GetMFAStatusRequest": {
+      "type": "object"
+    },
+    "v1GetMFAStatusResponse": {
+      "type": "object",
+      "properties": {
+        "totpStatus": {
+          "$ref": "#/definitions/v1TOTPStatus"
+        },
+        "emailStatus": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "$ref": "#/definitions/v1EmailStatus"
+          }
+        }
+      },
+      "title": "为后期拓展可能做保留"
+    },
     "v1LoginRequest": {
       "type": "object",
       "properties": {
@@ -171,6 +692,31 @@
         }
       }
     },
+    "v1RecoverTOTPRequest": {
+      "type": "object",
+      "properties": {
+        "recoveryCode": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      }
+    },
+    "v1RecoverTOTPResponse": {
+      "type": "object",
+      "properties": {
+        "newSecretKey": {
+          "type": "string"
+        },
+        "newRecoveryCode": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      }
+    },
     "v1RefreshTokenRequest": {
       "type": "object",
       "properties": {
@@ -214,6 +760,39 @@
           "type": "string"
         }
       }
+    },
+    "v1SendCodeEmailMFARequest": {
+      "type": "object",
+      "properties": {
+        "email": {
+          "type": "string"
+        }
+      }
+    },
+    "v1SendCodeEmailMFAResponse": {
+      "type": "object"
+    },
+    "v1SetPrimaryEmailMFARequest": {
+      "type": "object",
+      "properties": {
+        "newEmail": {
+          "type": "string"
+        },
+        "oldEmail": {
+          "type": "string"
+        }
+      }
+    },
+    "v1SetPrimaryEmailMFAResponse": {
+      "type": "object"
+    },
+    "v1TOTPStatus": {
+      "type": "object",
+      "properties": {
+        "isActive": {
+          "type": "boolean"
+        }
+      }
     }
   }
 }
diff --git a/gen/proto/auth/v1/auth_service.pb.go b/gen/proto/auth/v1/auth_service.pb.go
index 0918ba7..773fc3d 100644
--- a/gen/proto/auth/v1/auth_service.pb.go
+++ b/gen/proto/auth/v1/auth_service.pb.go
@@ -359,6 +359,1196 @@ func (x *RefreshTokenResponse) GetRefreshToken() string {
 	return ""
 }
 
+type GetMFAStatusRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *GetMFAStatusRequest) Reset() {
+	*x = GetMFAStatusRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_auth_v1_auth_service_proto_msgTypes[6]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GetMFAStatusRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetMFAStatusRequest) ProtoMessage() {}
+
+func (x *GetMFAStatusRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_auth_v1_auth_service_proto_msgTypes[6]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetMFAStatusRequest.ProtoReflect.Descriptor instead.
+func (*GetMFAStatusRequest) Descriptor() ([]byte, []int) {
+	return file_auth_v1_auth_service_proto_rawDescGZIP(), []int{6}
+}
+
+// 为后期拓展可能做保留
+type GetMFAStatusResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	TotpStatus  *TOTPStatus    `protobuf:"bytes,1,opt,name=totp_status,json=totpStatus,proto3" json:"totp_status,omitempty"`
+	EmailStatus []*EmailStatus `protobuf:"bytes,2,rep,name=email_status,json=emailStatus,proto3" json:"email_status,omitempty"`
+}
+
+func (x *GetMFAStatusResponse) Reset() {
+	*x = GetMFAStatusResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_auth_v1_auth_service_proto_msgTypes[7]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GetMFAStatusResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetMFAStatusResponse) ProtoMessage() {}
+
+func (x *GetMFAStatusResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_auth_v1_auth_service_proto_msgTypes[7]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetMFAStatusResponse.ProtoReflect.Descriptor instead.
+func (*GetMFAStatusResponse) Descriptor() ([]byte, []int) {
+	return file_auth_v1_auth_service_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *GetMFAStatusResponse) GetTotpStatus() *TOTPStatus {
+	if x != nil {
+		return x.TotpStatus
+	}
+	return nil
+}
+
+func (x *GetMFAStatusResponse) GetEmailStatus() []*EmailStatus {
+	if x != nil {
+		return x.EmailStatus
+	}
+	return nil
+}
+
+type TOTPStatus struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	IsActive bool `protobuf:"varint,1,opt,name=is_active,json=isActive,proto3" json:"is_active,omitempty"`
+}
+
+func (x *TOTPStatus) Reset() {
+	*x = TOTPStatus{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_auth_v1_auth_service_proto_msgTypes[8]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *TOTPStatus) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TOTPStatus) ProtoMessage() {}
+
+func (x *TOTPStatus) ProtoReflect() protoreflect.Message {
+	mi := &file_auth_v1_auth_service_proto_msgTypes[8]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TOTPStatus.ProtoReflect.Descriptor instead.
+func (*TOTPStatus) Descriptor() ([]byte, []int) {
+	return file_auth_v1_auth_service_proto_rawDescGZIP(), []int{8}
+}
+
+func (x *TOTPStatus) GetIsActive() bool {
+	if x != nil {
+		return x.IsActive
+	}
+	return false
+}
+
+type EmailStatus struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Email     string `protobuf:"bytes,1,opt,name=email,proto3" json:"email,omitempty"`
+	IsPrimary bool   `protobuf:"varint,2,opt,name=is_primary,json=isPrimary,proto3" json:"is_primary,omitempty"`
+	IsActive  bool   `protobuf:"varint,3,opt,name=is_active,json=isActive,proto3" json:"is_active,omitempty"`
+}
+
+func (x *EmailStatus) Reset() {
+	*x = EmailStatus{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_auth_v1_auth_service_proto_msgTypes[9]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *EmailStatus) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*EmailStatus) ProtoMessage() {}
+
+func (x *EmailStatus) ProtoReflect() protoreflect.Message {
+	mi := &file_auth_v1_auth_service_proto_msgTypes[9]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use EmailStatus.ProtoReflect.Descriptor instead.
+func (*EmailStatus) Descriptor() ([]byte, []int) {
+	return file_auth_v1_auth_service_proto_rawDescGZIP(), []int{9}
+}
+
+func (x *EmailStatus) GetEmail() string {
+	if x != nil {
+		return x.Email
+	}
+	return ""
+}
+
+func (x *EmailStatus) GetIsPrimary() bool {
+	if x != nil {
+		return x.IsPrimary
+	}
+	return false
+}
+
+func (x *EmailStatus) GetIsActive() bool {
+	if x != nil {
+		return x.IsActive
+	}
+	return false
+}
+
+// TOTP
+type ActiveTOTPRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	SecretKey string `protobuf:"bytes,1,opt,name=secret_key,json=secretKey,proto3" json:"secret_key,omitempty"`
+	TotpCode  string `protobuf:"bytes,2,opt,name=totp_code,json=totpCode,proto3" json:"totp_code,omitempty"`
+}
+
+func (x *ActiveTOTPRequest) Reset() {
+	*x = ActiveTOTPRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_auth_v1_auth_service_proto_msgTypes[10]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ActiveTOTPRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ActiveTOTPRequest) ProtoMessage() {}
+
+func (x *ActiveTOTPRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_auth_v1_auth_service_proto_msgTypes[10]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ActiveTOTPRequest.ProtoReflect.Descriptor instead.
+func (*ActiveTOTPRequest) Descriptor() ([]byte, []int) {
+	return file_auth_v1_auth_service_proto_rawDescGZIP(), []int{10}
+}
+
+func (x *ActiveTOTPRequest) GetSecretKey() string {
+	if x != nil {
+		return x.SecretKey
+	}
+	return ""
+}
+
+func (x *ActiveTOTPRequest) GetTotpCode() string {
+	if x != nil {
+		return x.TotpCode
+	}
+	return ""
+}
+
+type ActiveTOTPResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *ActiveTOTPResponse) Reset() {
+	*x = ActiveTOTPResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_auth_v1_auth_service_proto_msgTypes[11]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ActiveTOTPResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ActiveTOTPResponse) ProtoMessage() {}
+
+func (x *ActiveTOTPResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_auth_v1_auth_service_proto_msgTypes[11]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ActiveTOTPResponse.ProtoReflect.Descriptor instead.
+func (*ActiveTOTPResponse) Descriptor() ([]byte, []int) {
+	return file_auth_v1_auth_service_proto_rawDescGZIP(), []int{11}
+}
+
+type DisableTOTPRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	TotpCode string `protobuf:"bytes,1,opt,name=totp_code,json=totpCode,proto3" json:"totp_code,omitempty"`
+}
+
+func (x *DisableTOTPRequest) Reset() {
+	*x = DisableTOTPRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_auth_v1_auth_service_proto_msgTypes[12]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *DisableTOTPRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DisableTOTPRequest) ProtoMessage() {}
+
+func (x *DisableTOTPRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_auth_v1_auth_service_proto_msgTypes[12]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DisableTOTPRequest.ProtoReflect.Descriptor instead.
+func (*DisableTOTPRequest) Descriptor() ([]byte, []int) {
+	return file_auth_v1_auth_service_proto_rawDescGZIP(), []int{12}
+}
+
+func (x *DisableTOTPRequest) GetTotpCode() string {
+	if x != nil {
+		return x.TotpCode
+	}
+	return ""
+}
+
+type DisableTOTPResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *DisableTOTPResponse) Reset() {
+	*x = DisableTOTPResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_auth_v1_auth_service_proto_msgTypes[13]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *DisableTOTPResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DisableTOTPResponse) ProtoMessage() {}
+
+func (x *DisableTOTPResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_auth_v1_auth_service_proto_msgTypes[13]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DisableTOTPResponse.ProtoReflect.Descriptor instead.
+func (*DisableTOTPResponse) Descriptor() ([]byte, []int) {
+	return file_auth_v1_auth_service_proto_rawDescGZIP(), []int{13}
+}
+
+type CheckTOTPRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	TotpCode string `protobuf:"bytes,1,opt,name=totp_code,json=totpCode,proto3" json:"totp_code,omitempty"`
+}
+
+func (x *CheckTOTPRequest) Reset() {
+	*x = CheckTOTPRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_auth_v1_auth_service_proto_msgTypes[14]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CheckTOTPRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CheckTOTPRequest) ProtoMessage() {}
+
+func (x *CheckTOTPRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_auth_v1_auth_service_proto_msgTypes[14]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CheckTOTPRequest.ProtoReflect.Descriptor instead.
+func (*CheckTOTPRequest) Descriptor() ([]byte, []int) {
+	return file_auth_v1_auth_service_proto_rawDescGZIP(), []int{14}
+}
+
+func (x *CheckTOTPRequest) GetTotpCode() string {
+	if x != nil {
+		return x.TotpCode
+	}
+	return ""
+}
+
+type CheckTOTPResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *CheckTOTPResponse) Reset() {
+	*x = CheckTOTPResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_auth_v1_auth_service_proto_msgTypes[15]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CheckTOTPResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CheckTOTPResponse) ProtoMessage() {}
+
+func (x *CheckTOTPResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_auth_v1_auth_service_proto_msgTypes[15]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CheckTOTPResponse.ProtoReflect.Descriptor instead.
+func (*CheckTOTPResponse) Descriptor() ([]byte, []int) {
+	return file_auth_v1_auth_service_proto_rawDescGZIP(), []int{15}
+}
+
+type RecoverTOTPRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	RecoveryCode []string `protobuf:"bytes,1,rep,name=recovery_code,json=recoveryCode,proto3" json:"recovery_code,omitempty"`
+}
+
+func (x *RecoverTOTPRequest) Reset() {
+	*x = RecoverTOTPRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_auth_v1_auth_service_proto_msgTypes[16]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RecoverTOTPRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RecoverTOTPRequest) ProtoMessage() {}
+
+func (x *RecoverTOTPRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_auth_v1_auth_service_proto_msgTypes[16]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RecoverTOTPRequest.ProtoReflect.Descriptor instead.
+func (*RecoverTOTPRequest) Descriptor() ([]byte, []int) {
+	return file_auth_v1_auth_service_proto_rawDescGZIP(), []int{16}
+}
+
+func (x *RecoverTOTPRequest) GetRecoveryCode() []string {
+	if x != nil {
+		return x.RecoveryCode
+	}
+	return nil
+}
+
+type RecoverTOTPResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	NewSecretKey    string   `protobuf:"bytes,1,opt,name=new_secret_key,json=newSecretKey,proto3" json:"new_secret_key,omitempty"`
+	NewRecoveryCode []string `protobuf:"bytes,2,rep,name=new_recovery_code,json=newRecoveryCode,proto3" json:"new_recovery_code,omitempty"`
+}
+
+func (x *RecoverTOTPResponse) Reset() {
+	*x = RecoverTOTPResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_auth_v1_auth_service_proto_msgTypes[17]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RecoverTOTPResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RecoverTOTPResponse) ProtoMessage() {}
+
+func (x *RecoverTOTPResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_auth_v1_auth_service_proto_msgTypes[17]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RecoverTOTPResponse.ProtoReflect.Descriptor instead.
+func (*RecoverTOTPResponse) Descriptor() ([]byte, []int) {
+	return file_auth_v1_auth_service_proto_rawDescGZIP(), []int{17}
+}
+
+func (x *RecoverTOTPResponse) GetNewSecretKey() string {
+	if x != nil {
+		return x.NewSecretKey
+	}
+	return ""
+}
+
+func (x *RecoverTOTPResponse) GetNewRecoveryCode() []string {
+	if x != nil {
+		return x.NewRecoveryCode
+	}
+	return nil
+}
+
+// Email MFA
+type AddEmailMFARequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Email string `protobuf:"bytes,1,opt,name=email,proto3" json:"email,omitempty"`
+}
+
+func (x *AddEmailMFARequest) Reset() {
+	*x = AddEmailMFARequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_auth_v1_auth_service_proto_msgTypes[18]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AddEmailMFARequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AddEmailMFARequest) ProtoMessage() {}
+
+func (x *AddEmailMFARequest) ProtoReflect() protoreflect.Message {
+	mi := &file_auth_v1_auth_service_proto_msgTypes[18]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AddEmailMFARequest.ProtoReflect.Descriptor instead.
+func (*AddEmailMFARequest) Descriptor() ([]byte, []int) {
+	return file_auth_v1_auth_service_proto_rawDescGZIP(), []int{18}
+}
+
+func (x *AddEmailMFARequest) GetEmail() string {
+	if x != nil {
+		return x.Email
+	}
+	return ""
+}
+
+type AddEmailMFAResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *AddEmailMFAResponse) Reset() {
+	*x = AddEmailMFAResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_auth_v1_auth_service_proto_msgTypes[19]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AddEmailMFAResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AddEmailMFAResponse) ProtoMessage() {}
+
+func (x *AddEmailMFAResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_auth_v1_auth_service_proto_msgTypes[19]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AddEmailMFAResponse.ProtoReflect.Descriptor instead.
+func (*AddEmailMFAResponse) Descriptor() ([]byte, []int) {
+	return file_auth_v1_auth_service_proto_rawDescGZIP(), []int{19}
+}
+
+type ActivateEmailMFARequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Email            string `protobuf:"bytes,1,opt,name=email,proto3" json:"email,omitempty"`
+	VerificationCode string `protobuf:"bytes,2,opt,name=verification_code,json=verificationCode,proto3" json:"verification_code,omitempty"`
+}
+
+func (x *ActivateEmailMFARequest) Reset() {
+	*x = ActivateEmailMFARequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_auth_v1_auth_service_proto_msgTypes[20]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ActivateEmailMFARequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ActivateEmailMFARequest) ProtoMessage() {}
+
+func (x *ActivateEmailMFARequest) ProtoReflect() protoreflect.Message {
+	mi := &file_auth_v1_auth_service_proto_msgTypes[20]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ActivateEmailMFARequest.ProtoReflect.Descriptor instead.
+func (*ActivateEmailMFARequest) Descriptor() ([]byte, []int) {
+	return file_auth_v1_auth_service_proto_rawDescGZIP(), []int{20}
+}
+
+func (x *ActivateEmailMFARequest) GetEmail() string {
+	if x != nil {
+		return x.Email
+	}
+	return ""
+}
+
+func (x *ActivateEmailMFARequest) GetVerificationCode() string {
+	if x != nil {
+		return x.VerificationCode
+	}
+	return ""
+}
+
+type ActivateEmailMFAResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *ActivateEmailMFAResponse) Reset() {
+	*x = ActivateEmailMFAResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_auth_v1_auth_service_proto_msgTypes[21]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ActivateEmailMFAResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ActivateEmailMFAResponse) ProtoMessage() {}
+
+func (x *ActivateEmailMFAResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_auth_v1_auth_service_proto_msgTypes[21]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ActivateEmailMFAResponse.ProtoReflect.Descriptor instead.
+func (*ActivateEmailMFAResponse) Descriptor() ([]byte, []int) {
+	return file_auth_v1_auth_service_proto_rawDescGZIP(), []int{21}
+}
+
+type SetPrimaryEmailMFARequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	NewEmail string `protobuf:"bytes,1,opt,name=new_email,json=newEmail,proto3" json:"new_email,omitempty"`
+	OldEmail string `protobuf:"bytes,2,opt,name=old_email,json=oldEmail,proto3" json:"old_email,omitempty"`
+}
+
+func (x *SetPrimaryEmailMFARequest) Reset() {
+	*x = SetPrimaryEmailMFARequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_auth_v1_auth_service_proto_msgTypes[22]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SetPrimaryEmailMFARequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SetPrimaryEmailMFARequest) ProtoMessage() {}
+
+func (x *SetPrimaryEmailMFARequest) ProtoReflect() protoreflect.Message {
+	mi := &file_auth_v1_auth_service_proto_msgTypes[22]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SetPrimaryEmailMFARequest.ProtoReflect.Descriptor instead.
+func (*SetPrimaryEmailMFARequest) Descriptor() ([]byte, []int) {
+	return file_auth_v1_auth_service_proto_rawDescGZIP(), []int{22}
+}
+
+func (x *SetPrimaryEmailMFARequest) GetNewEmail() string {
+	if x != nil {
+		return x.NewEmail
+	}
+	return ""
+}
+
+func (x *SetPrimaryEmailMFARequest) GetOldEmail() string {
+	if x != nil {
+		return x.OldEmail
+	}
+	return ""
+}
+
+type SetPrimaryEmailMFAResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *SetPrimaryEmailMFAResponse) Reset() {
+	*x = SetPrimaryEmailMFAResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_auth_v1_auth_service_proto_msgTypes[23]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SetPrimaryEmailMFAResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SetPrimaryEmailMFAResponse) ProtoMessage() {}
+
+func (x *SetPrimaryEmailMFAResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_auth_v1_auth_service_proto_msgTypes[23]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SetPrimaryEmailMFAResponse.ProtoReflect.Descriptor instead.
+func (*SetPrimaryEmailMFAResponse) Descriptor() ([]byte, []int) {
+	return file_auth_v1_auth_service_proto_rawDescGZIP(), []int{23}
+}
+
+type SendCodeEmailMFARequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Email string `protobuf:"bytes,1,opt,name=email,proto3" json:"email,omitempty"`
+}
+
+func (x *SendCodeEmailMFARequest) Reset() {
+	*x = SendCodeEmailMFARequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_auth_v1_auth_service_proto_msgTypes[24]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SendCodeEmailMFARequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SendCodeEmailMFARequest) ProtoMessage() {}
+
+func (x *SendCodeEmailMFARequest) ProtoReflect() protoreflect.Message {
+	mi := &file_auth_v1_auth_service_proto_msgTypes[24]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SendCodeEmailMFARequest.ProtoReflect.Descriptor instead.
+func (*SendCodeEmailMFARequest) Descriptor() ([]byte, []int) {
+	return file_auth_v1_auth_service_proto_rawDescGZIP(), []int{24}
+}
+
+func (x *SendCodeEmailMFARequest) GetEmail() string {
+	if x != nil {
+		return x.Email
+	}
+	return ""
+}
+
+type SendCodeEmailMFAResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *SendCodeEmailMFAResponse) Reset() {
+	*x = SendCodeEmailMFAResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_auth_v1_auth_service_proto_msgTypes[25]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SendCodeEmailMFAResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SendCodeEmailMFAResponse) ProtoMessage() {}
+
+func (x *SendCodeEmailMFAResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_auth_v1_auth_service_proto_msgTypes[25]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SendCodeEmailMFAResponse.ProtoReflect.Descriptor instead.
+func (*SendCodeEmailMFAResponse) Descriptor() ([]byte, []int) {
+	return file_auth_v1_auth_service_proto_rawDescGZIP(), []int{25}
+}
+
+type CheckEmailMFARequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Email            string `protobuf:"bytes,1,opt,name=email,proto3" json:"email,omitempty"`
+	VerificationCode string `protobuf:"bytes,2,opt,name=verification_code,json=verificationCode,proto3" json:"verification_code,omitempty"`
+}
+
+func (x *CheckEmailMFARequest) Reset() {
+	*x = CheckEmailMFARequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_auth_v1_auth_service_proto_msgTypes[26]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CheckEmailMFARequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CheckEmailMFARequest) ProtoMessage() {}
+
+func (x *CheckEmailMFARequest) ProtoReflect() protoreflect.Message {
+	mi := &file_auth_v1_auth_service_proto_msgTypes[26]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CheckEmailMFARequest.ProtoReflect.Descriptor instead.
+func (*CheckEmailMFARequest) Descriptor() ([]byte, []int) {
+	return file_auth_v1_auth_service_proto_rawDescGZIP(), []int{26}
+}
+
+func (x *CheckEmailMFARequest) GetEmail() string {
+	if x != nil {
+		return x.Email
+	}
+	return ""
+}
+
+func (x *CheckEmailMFARequest) GetVerificationCode() string {
+	if x != nil {
+		return x.VerificationCode
+	}
+	return ""
+}
+
+type CheckEmailMFAResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *CheckEmailMFAResponse) Reset() {
+	*x = CheckEmailMFAResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_auth_v1_auth_service_proto_msgTypes[27]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CheckEmailMFAResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CheckEmailMFAResponse) ProtoMessage() {}
+
+func (x *CheckEmailMFAResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_auth_v1_auth_service_proto_msgTypes[27]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CheckEmailMFAResponse.ProtoReflect.Descriptor instead.
+func (*CheckEmailMFAResponse) Descriptor() ([]byte, []int) {
+	return file_auth_v1_auth_service_proto_rawDescGZIP(), []int{27}
+}
+
+type DisableEmailMFARequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Email string `protobuf:"bytes,1,opt,name=email,proto3" json:"email,omitempty"`
+}
+
+func (x *DisableEmailMFARequest) Reset() {
+	*x = DisableEmailMFARequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_auth_v1_auth_service_proto_msgTypes[28]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *DisableEmailMFARequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DisableEmailMFARequest) ProtoMessage() {}
+
+func (x *DisableEmailMFARequest) ProtoReflect() protoreflect.Message {
+	mi := &file_auth_v1_auth_service_proto_msgTypes[28]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DisableEmailMFARequest.ProtoReflect.Descriptor instead.
+func (*DisableEmailMFARequest) Descriptor() ([]byte, []int) {
+	return file_auth_v1_auth_service_proto_rawDescGZIP(), []int{28}
+}
+
+func (x *DisableEmailMFARequest) GetEmail() string {
+	if x != nil {
+		return x.Email
+	}
+	return ""
+}
+
+type DisableEmailMFAResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *DisableEmailMFAResponse) Reset() {
+	*x = DisableEmailMFAResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_auth_v1_auth_service_proto_msgTypes[29]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *DisableEmailMFAResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DisableEmailMFAResponse) ProtoMessage() {}
+
+func (x *DisableEmailMFAResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_auth_v1_auth_service_proto_msgTypes[29]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DisableEmailMFAResponse.ProtoReflect.Descriptor instead.
+func (*DisableEmailMFAResponse) Descriptor() ([]byte, []int) {
+	return file_auth_v1_auth_service_proto_rawDescGZIP(), []int{29}
+}
+
+type GetAccountStatusRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *GetAccountStatusRequest) Reset() {
+	*x = GetAccountStatusRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_auth_v1_auth_service_proto_msgTypes[30]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GetAccountStatusRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetAccountStatusRequest) ProtoMessage() {}
+
+func (x *GetAccountStatusRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_auth_v1_auth_service_proto_msgTypes[30]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetAccountStatusRequest.ProtoReflect.Descriptor instead.
+func (*GetAccountStatusRequest) Descriptor() ([]byte, []int) {
+	return file_auth_v1_auth_service_proto_rawDescGZIP(), []int{30}
+}
+
+type GetAccountStatusResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	SudoTtl int64 `protobuf:"varint,1,opt,name=sudo_ttl,json=sudoTtl,proto3" json:"sudo_ttl,omitempty"`
+}
+
+func (x *GetAccountStatusResponse) Reset() {
+	*x = GetAccountStatusResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_auth_v1_auth_service_proto_msgTypes[31]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GetAccountStatusResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetAccountStatusResponse) ProtoMessage() {}
+
+func (x *GetAccountStatusResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_auth_v1_auth_service_proto_msgTypes[31]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetAccountStatusResponse.ProtoReflect.Descriptor instead.
+func (*GetAccountStatusResponse) Descriptor() ([]byte, []int) {
+	return file_auth_v1_auth_service_proto_rawDescGZIP(), []int{31}
+}
+
+func (x *GetAccountStatusResponse) GetSudoTtl() int64 {
+	if x != nil {
+		return x.SudoTtl
+	}
+	return 0
+}
+
 var File_auth_v1_auth_service_proto protoreflect.FileDescriptor
 
 var file_auth_v1_auth_service_proto_rawDesc = []byte{
@@ -400,31 +1590,209 @@ var file_auth_v1_auth_service_proto_rawDesc = []byte{
 	0x65, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73,
 	0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x23, 0x0a, 0x0d, 0x72, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68,
 	0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x72, 0x65,
-	0x66, 0x72, 0x65, 0x73, 0x68, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x32, 0xbd, 0x02, 0x0a, 0x0b, 0x41,
-	0x75, 0x74, 0x68, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x62, 0x0a, 0x08, 0x52, 0x65,
-	0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x12, 0x18, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x2e, 0x76, 0x31,
-	0x2e, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x1a, 0x19, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x67, 0x69, 0x73,
-	0x74, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x21, 0x82, 0xd3, 0xe4,
-	0x93, 0x02, 0x1b, 0x3a, 0x01, 0x2a, 0x22, 0x16, 0x2f, 0x67, 0x61, 0x70, 0x69, 0x2f, 0x61, 0x75,
-	0x74, 0x68, 0x2f, 0x76, 0x31, 0x2f, 0x72, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x12, 0x56,
-	0x0a, 0x05, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x12, 0x15, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x2e, 0x76,
-	0x31, 0x2e, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16,
-	0x2e, 0x61, 0x75, 0x74, 0x68, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x1e, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x18, 0x3a, 0x01,
-	0x2a, 0x22, 0x13, 0x2f, 0x67, 0x61, 0x70, 0x69, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x2f, 0x76, 0x31,
-	0x2f, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x12, 0x72, 0x0a, 0x0c, 0x52, 0x65, 0x66, 0x72, 0x65, 0x73,
-	0x68, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x1c, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x2e, 0x76, 0x31,
-	0x2e, 0x52, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x1a, 0x1d, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x2e, 0x76, 0x31, 0x2e, 0x52,
-	0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x22, 0x25, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x1f, 0x3a, 0x01, 0x2a, 0x22, 0x1a,
-	0x2f, 0x67, 0x61, 0x70, 0x69, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x2f, 0x76, 0x31, 0x2f, 0x72, 0x65,
-	0x66, 0x72, 0x65, 0x73, 0x68, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x42, 0x3c, 0x5a, 0x3a, 0x67, 0x69,
-	0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6a, 0x75, 0x61, 0x6e, 0x6a, 0x69, 0x54,
-	0x65, 0x63, 0x68, 0x2f, 0x6a, 0x54, 0x65, 0x72, 0x6d, 0x2d, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f,
-	0x67, 0x65, 0x6e, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x2f, 0x76,
-	0x31, 0x3b, 0x61, 0x75, 0x74, 0x68, 0x56, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x66, 0x72, 0x65, 0x73, 0x68, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x22, 0x15, 0x0a, 0x13, 0x47, 0x65,
+	0x74, 0x4d, 0x46, 0x41, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x22, 0x85, 0x01, 0x0a, 0x14, 0x47, 0x65, 0x74, 0x4d, 0x46, 0x41, 0x53, 0x74, 0x61, 0x74,
+	0x75, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x34, 0x0a, 0x0b, 0x74, 0x6f,
+	0x74, 0x70, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x13, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x4f, 0x54, 0x50, 0x53, 0x74,
+	0x61, 0x74, 0x75, 0x73, 0x52, 0x0a, 0x74, 0x6f, 0x74, 0x70, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73,
+	0x12, 0x37, 0x0a, 0x0c, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73,
+	0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x2e, 0x76, 0x31,
+	0x2e, 0x45, 0x6d, 0x61, 0x69, 0x6c, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x0b, 0x65, 0x6d,
+	0x61, 0x69, 0x6c, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0x29, 0x0a, 0x0a, 0x54, 0x4f, 0x54,
+	0x50, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x1b, 0x0a, 0x09, 0x69, 0x73, 0x5f, 0x61, 0x63,
+	0x74, 0x69, 0x76, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x69, 0x73, 0x41, 0x63,
+	0x74, 0x69, 0x76, 0x65, 0x22, 0x5f, 0x0a, 0x0b, 0x45, 0x6d, 0x61, 0x69, 0x6c, 0x53, 0x74, 0x61,
+	0x74, 0x75, 0x73, 0x12, 0x14, 0x0a, 0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x12, 0x1d, 0x0a, 0x0a, 0x69, 0x73, 0x5f,
+	0x70, 0x72, 0x69, 0x6d, 0x61, 0x72, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x69,
+	0x73, 0x50, 0x72, 0x69, 0x6d, 0x61, 0x72, 0x79, 0x12, 0x1b, 0x0a, 0x09, 0x69, 0x73, 0x5f, 0x61,
+	0x63, 0x74, 0x69, 0x76, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x69, 0x73, 0x41,
+	0x63, 0x74, 0x69, 0x76, 0x65, 0x22, 0x4f, 0x0a, 0x11, 0x41, 0x63, 0x74, 0x69, 0x76, 0x65, 0x54,
+	0x4f, 0x54, 0x50, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x65,
+	0x63, 0x72, 0x65, 0x74, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09,
+	0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x4b, 0x65, 0x79, 0x12, 0x1b, 0x0a, 0x09, 0x74, 0x6f, 0x74,
+	0x70, 0x5f, 0x63, 0x6f, 0x64, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x74, 0x6f,
+	0x74, 0x70, 0x43, 0x6f, 0x64, 0x65, 0x22, 0x14, 0x0a, 0x12, 0x41, 0x63, 0x74, 0x69, 0x76, 0x65,
+	0x54, 0x4f, 0x54, 0x50, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x31, 0x0a, 0x12,
+	0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x54, 0x4f, 0x54, 0x50, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x74, 0x6f, 0x74, 0x70, 0x5f, 0x63, 0x6f, 0x64, 0x65, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x74, 0x6f, 0x74, 0x70, 0x43, 0x6f, 0x64, 0x65, 0x22,
+	0x15, 0x0a, 0x13, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x54, 0x4f, 0x54, 0x50, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x2f, 0x0a, 0x10, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x54,
+	0x4f, 0x54, 0x50, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x74, 0x6f,
+	0x74, 0x70, 0x5f, 0x63, 0x6f, 0x64, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x74,
+	0x6f, 0x74, 0x70, 0x43, 0x6f, 0x64, 0x65, 0x22, 0x13, 0x0a, 0x11, 0x43, 0x68, 0x65, 0x63, 0x6b,
+	0x54, 0x4f, 0x54, 0x50, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x39, 0x0a, 0x12,
+	0x52, 0x65, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x54, 0x4f, 0x54, 0x50, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x12, 0x23, 0x0a, 0x0d, 0x72, 0x65, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x5f, 0x63,
+	0x6f, 0x64, 0x65, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x72, 0x65, 0x63, 0x6f, 0x76,
+	0x65, 0x72, 0x79, 0x43, 0x6f, 0x64, 0x65, 0x22, 0x67, 0x0a, 0x13, 0x52, 0x65, 0x63, 0x6f, 0x76,
+	0x65, 0x72, 0x54, 0x4f, 0x54, 0x50, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x24,
+	0x0a, 0x0e, 0x6e, 0x65, 0x77, 0x5f, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x5f, 0x6b, 0x65, 0x79,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x6e, 0x65, 0x77, 0x53, 0x65, 0x63, 0x72, 0x65,
+	0x74, 0x4b, 0x65, 0x79, 0x12, 0x2a, 0x0a, 0x11, 0x6e, 0x65, 0x77, 0x5f, 0x72, 0x65, 0x63, 0x6f,
+	0x76, 0x65, 0x72, 0x79, 0x5f, 0x63, 0x6f, 0x64, 0x65, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52,
+	0x0f, 0x6e, 0x65, 0x77, 0x52, 0x65, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x43, 0x6f, 0x64, 0x65,
+	0x22, 0x2a, 0x0a, 0x12, 0x41, 0x64, 0x64, 0x45, 0x6d, 0x61, 0x69, 0x6c, 0x4d, 0x46, 0x41, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x14, 0x0a, 0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x22, 0x15, 0x0a, 0x13,
+	0x41, 0x64, 0x64, 0x45, 0x6d, 0x61, 0x69, 0x6c, 0x4d, 0x46, 0x41, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x22, 0x5c, 0x0a, 0x17, 0x41, 0x63, 0x74, 0x69, 0x76, 0x61, 0x74, 0x65, 0x45,
+	0x6d, 0x61, 0x69, 0x6c, 0x4d, 0x46, 0x41, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x14,
+	0x0a, 0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65,
+	0x6d, 0x61, 0x69, 0x6c, 0x12, 0x2b, 0x0a, 0x11, 0x76, 0x65, 0x72, 0x69, 0x66, 0x69, 0x63, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x6f, 0x64, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x10, 0x76, 0x65, 0x72, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x43, 0x6f, 0x64,
+	0x65, 0x22, 0x1a, 0x0a, 0x18, 0x41, 0x63, 0x74, 0x69, 0x76, 0x61, 0x74, 0x65, 0x45, 0x6d, 0x61,
+	0x69, 0x6c, 0x4d, 0x46, 0x41, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x55, 0x0a,
+	0x19, 0x53, 0x65, 0x74, 0x50, 0x72, 0x69, 0x6d, 0x61, 0x72, 0x79, 0x45, 0x6d, 0x61, 0x69, 0x6c,
+	0x4d, 0x46, 0x41, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x6e, 0x65,
+	0x77, 0x5f, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x6e,
+	0x65, 0x77, 0x45, 0x6d, 0x61, 0x69, 0x6c, 0x12, 0x1b, 0x0a, 0x09, 0x6f, 0x6c, 0x64, 0x5f, 0x65,
+	0x6d, 0x61, 0x69, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x6f, 0x6c, 0x64, 0x45,
+	0x6d, 0x61, 0x69, 0x6c, 0x22, 0x1c, 0x0a, 0x1a, 0x53, 0x65, 0x74, 0x50, 0x72, 0x69, 0x6d, 0x61,
+	0x72, 0x79, 0x45, 0x6d, 0x61, 0x69, 0x6c, 0x4d, 0x46, 0x41, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x22, 0x2f, 0x0a, 0x17, 0x53, 0x65, 0x6e, 0x64, 0x43, 0x6f, 0x64, 0x65, 0x45, 0x6d,
+	0x61, 0x69, 0x6c, 0x4d, 0x46, 0x41, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x14, 0x0a,
+	0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x6d,
+	0x61, 0x69, 0x6c, 0x22, 0x1a, 0x0a, 0x18, 0x53, 0x65, 0x6e, 0x64, 0x43, 0x6f, 0x64, 0x65, 0x45,
+	0x6d, 0x61, 0x69, 0x6c, 0x4d, 0x46, 0x41, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
+	0x59, 0x0a, 0x14, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x45, 0x6d, 0x61, 0x69, 0x6c, 0x4d, 0x46, 0x41,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x14, 0x0a, 0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x12, 0x2b, 0x0a,
+	0x11, 0x76, 0x65, 0x72, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x6f,
+	0x64, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x10, 0x76, 0x65, 0x72, 0x69, 0x66, 0x69,
+	0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x43, 0x6f, 0x64, 0x65, 0x22, 0x17, 0x0a, 0x15, 0x43, 0x68,
+	0x65, 0x63, 0x6b, 0x45, 0x6d, 0x61, 0x69, 0x6c, 0x4d, 0x46, 0x41, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x22, 0x2e, 0x0a, 0x16, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x45, 0x6d,
+	0x61, 0x69, 0x6c, 0x4d, 0x46, 0x41, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x14, 0x0a,
+	0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x6d,
+	0x61, 0x69, 0x6c, 0x22, 0x19, 0x0a, 0x17, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x45, 0x6d,
+	0x61, 0x69, 0x6c, 0x4d, 0x46, 0x41, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x19,
+	0x0a, 0x17, 0x47, 0x65, 0x74, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x53, 0x74, 0x61, 0x74,
+	0x75, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x35, 0x0a, 0x18, 0x47, 0x65, 0x74,
+	0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x73, 0x75, 0x64, 0x6f, 0x5f, 0x74, 0x74,
+	0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x03, 0x52, 0x07, 0x73, 0x75, 0x64, 0x6f, 0x54, 0x74, 0x6c,
+	0x32, 0x82, 0x0e, 0x0a, 0x0b, 0x41, 0x75, 0x74, 0x68, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
+	0x12, 0x62, 0x0a, 0x08, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x12, 0x18, 0x2e, 0x61,
+	0x75, 0x74, 0x68, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x19, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x2e, 0x76, 0x31,
+	0x2e, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x22, 0x21, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x1b, 0x3a, 0x01, 0x2a, 0x22, 0x16, 0x2f, 0x67,
+	0x61, 0x70, 0x69, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x2f, 0x76, 0x31, 0x2f, 0x72, 0x65, 0x67, 0x69,
+	0x73, 0x74, 0x65, 0x72, 0x12, 0x56, 0x0a, 0x05, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x12, 0x15, 0x2e,
+	0x61, 0x75, 0x74, 0x68, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x2e, 0x76, 0x31, 0x2e, 0x4c,
+	0x6f, 0x67, 0x69, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x1e, 0x82, 0xd3,
+	0xe4, 0x93, 0x02, 0x18, 0x3a, 0x01, 0x2a, 0x22, 0x13, 0x2f, 0x67, 0x61, 0x70, 0x69, 0x2f, 0x61,
+	0x75, 0x74, 0x68, 0x2f, 0x76, 0x31, 0x2f, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x12, 0x72, 0x0a, 0x0c,
+	0x52, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x1c, 0x2e, 0x61,
+	0x75, 0x74, 0x68, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x54, 0x6f,
+	0x6b, 0x65, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1d, 0x2e, 0x61, 0x75, 0x74,
+	0x68, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x54, 0x6f, 0x6b, 0x65,
+	0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x25, 0x82, 0xd3, 0xe4, 0x93, 0x02,
+	0x1f, 0x3a, 0x01, 0x2a, 0x22, 0x1a, 0x2f, 0x67, 0x61, 0x70, 0x69, 0x2f, 0x61, 0x75, 0x74, 0x68,
+	0x2f, 0x76, 0x31, 0x2f, 0x72, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x54, 0x6f, 0x6b, 0x65, 0x6e,
+	0x12, 0x70, 0x0a, 0x0c, 0x47, 0x65, 0x74, 0x4d, 0x46, 0x41, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73,
+	0x12, 0x1c, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x46,
+	0x41, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1d,
+	0x2e, 0x61, 0x75, 0x74, 0x68, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x46, 0x41, 0x53,
+	0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x23, 0x82,
+	0xd3, 0xe4, 0x93, 0x02, 0x1d, 0x3a, 0x01, 0x2a, 0x22, 0x18, 0x2f, 0x67, 0x61, 0x70, 0x69, 0x2f,
+	0x61, 0x75, 0x74, 0x68, 0x2f, 0x76, 0x31, 0x2f, 0x6d, 0x66, 0x61, 0x2f, 0x73, 0x74, 0x61, 0x74,
+	0x75, 0x73, 0x12, 0x6f, 0x0a, 0x0a, 0x41, 0x63, 0x74, 0x69, 0x76, 0x65, 0x54, 0x4f, 0x54, 0x50,
+	0x12, 0x1a, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x76,
+	0x65, 0x54, 0x4f, 0x54, 0x50, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1b, 0x2e, 0x61,
+	0x75, 0x74, 0x68, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x76, 0x65, 0x54, 0x4f, 0x54,
+	0x50, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x28, 0x82, 0xd3, 0xe4, 0x93, 0x02,
+	0x22, 0x3a, 0x01, 0x2a, 0x22, 0x1d, 0x2f, 0x67, 0x61, 0x70, 0x69, 0x2f, 0x61, 0x75, 0x74, 0x68,
+	0x2f, 0x76, 0x31, 0x2f, 0x6d, 0x66, 0x61, 0x2f, 0x74, 0x6f, 0x74, 0x70, 0x2f, 0x61, 0x63, 0x74,
+	0x69, 0x76, 0x65, 0x12, 0x73, 0x0a, 0x0b, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x54, 0x4f,
+	0x54, 0x50, 0x12, 0x1b, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x69, 0x73,
+	0x61, 0x62, 0x6c, 0x65, 0x54, 0x4f, 0x54, 0x50, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
+	0x1c, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c,
+	0x65, 0x54, 0x4f, 0x54, 0x50, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x29, 0x82,
+	0xd3, 0xe4, 0x93, 0x02, 0x23, 0x3a, 0x01, 0x2a, 0x22, 0x1e, 0x2f, 0x67, 0x61, 0x70, 0x69, 0x2f,
+	0x61, 0x75, 0x74, 0x68, 0x2f, 0x76, 0x31, 0x2f, 0x6d, 0x66, 0x61, 0x2f, 0x74, 0x6f, 0x74, 0x70,
+	0x2f, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x12, 0x6b, 0x0a, 0x09, 0x43, 0x68, 0x65, 0x63,
+	0x6b, 0x54, 0x4f, 0x54, 0x50, 0x12, 0x19, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x2e, 0x76, 0x31, 0x2e,
+	0x43, 0x68, 0x65, 0x63, 0x6b, 0x54, 0x4f, 0x54, 0x50, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x1a, 0x1a, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x68, 0x65, 0x63, 0x6b,
+	0x54, 0x4f, 0x54, 0x50, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x27, 0x82, 0xd3,
+	0xe4, 0x93, 0x02, 0x21, 0x3a, 0x01, 0x2a, 0x22, 0x1c, 0x2f, 0x67, 0x61, 0x70, 0x69, 0x2f, 0x61,
+	0x75, 0x74, 0x68, 0x2f, 0x76, 0x31, 0x2f, 0x6d, 0x66, 0x61, 0x2f, 0x74, 0x6f, 0x74, 0x70, 0x2f,
+	0x63, 0x68, 0x65, 0x63, 0x6b, 0x12, 0x73, 0x0a, 0x0b, 0x52, 0x65, 0x63, 0x6f, 0x76, 0x65, 0x72,
+	0x54, 0x4f, 0x54, 0x50, 0x12, 0x1b, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x2e, 0x76, 0x31, 0x2e, 0x52,
+	0x65, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x54, 0x4f, 0x54, 0x50, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x1a, 0x1c, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x63, 0x6f,
+	0x76, 0x65, 0x72, 0x54, 0x4f, 0x54, 0x50, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
+	0x29, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x23, 0x3a, 0x01, 0x2a, 0x22, 0x1e, 0x2f, 0x67, 0x61, 0x70,
+	0x69, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x2f, 0x76, 0x31, 0x2f, 0x6d, 0x66, 0x61, 0x2f, 0x74, 0x6f,
+	0x74, 0x70, 0x2f, 0x72, 0x65, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x12, 0x70, 0x0a, 0x0b, 0x41, 0x64,
+	0x64, 0x45, 0x6d, 0x61, 0x69, 0x6c, 0x4d, 0x46, 0x41, 0x12, 0x1b, 0x2e, 0x61, 0x75, 0x74, 0x68,
+	0x2e, 0x76, 0x31, 0x2e, 0x41, 0x64, 0x64, 0x45, 0x6d, 0x61, 0x69, 0x6c, 0x4d, 0x46, 0x41, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1c, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x2e, 0x76, 0x31,
+	0x2e, 0x41, 0x64, 0x64, 0x45, 0x6d, 0x61, 0x69, 0x6c, 0x4d, 0x46, 0x41, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x26, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x20, 0x3a, 0x01, 0x2a, 0x22,
+	0x1b, 0x2f, 0x67, 0x61, 0x70, 0x69, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x2f, 0x76, 0x31, 0x2f, 0x6d,
+	0x66, 0x61, 0x2f, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x2f, 0x61, 0x64, 0x64, 0x12, 0x84, 0x01, 0x0a,
+	0x10, 0x41, 0x63, 0x74, 0x69, 0x76, 0x61, 0x74, 0x65, 0x45, 0x6d, 0x61, 0x69, 0x6c, 0x4d, 0x46,
+	0x41, 0x12, 0x20, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x63, 0x74, 0x69,
+	0x76, 0x61, 0x74, 0x65, 0x45, 0x6d, 0x61, 0x69, 0x6c, 0x4d, 0x46, 0x41, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x63,
+	0x74, 0x69, 0x76, 0x61, 0x74, 0x65, 0x45, 0x6d, 0x61, 0x69, 0x6c, 0x4d, 0x46, 0x41, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x2b, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x25, 0x3a, 0x01,
+	0x2a, 0x22, 0x20, 0x2f, 0x67, 0x61, 0x70, 0x69, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x2f, 0x76, 0x31,
+	0x2f, 0x6d, 0x66, 0x61, 0x2f, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x2f, 0x61, 0x63, 0x74, 0x69, 0x76,
+	0x61, 0x74, 0x65, 0x12, 0x8c, 0x01, 0x0a, 0x12, 0x53, 0x65, 0x74, 0x50, 0x72, 0x69, 0x6d, 0x61,
+	0x72, 0x79, 0x45, 0x6d, 0x61, 0x69, 0x6c, 0x4d, 0x46, 0x41, 0x12, 0x22, 0x2e, 0x61, 0x75, 0x74,
+	0x68, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x74, 0x50, 0x72, 0x69, 0x6d, 0x61, 0x72, 0x79, 0x45,
+	0x6d, 0x61, 0x69, 0x6c, 0x4d, 0x46, 0x41, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x23,
+	0x2e, 0x61, 0x75, 0x74, 0x68, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x74, 0x50, 0x72, 0x69, 0x6d,
+	0x61, 0x72, 0x79, 0x45, 0x6d, 0x61, 0x69, 0x6c, 0x4d, 0x46, 0x41, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x22, 0x2d, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x27, 0x3a, 0x01, 0x2a, 0x22, 0x22,
+	0x2f, 0x67, 0x61, 0x70, 0x69, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x2f, 0x76, 0x31, 0x2f, 0x6d, 0x66,
+	0x61, 0x2f, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x2f, 0x73, 0x65, 0x74, 0x50, 0x72, 0x69, 0x6d, 0x61,
+	0x72, 0x79, 0x12, 0x80, 0x01, 0x0a, 0x10, 0x53, 0x65, 0x6e, 0x64, 0x43, 0x6f, 0x64, 0x65, 0x45,
+	0x6d, 0x61, 0x69, 0x6c, 0x4d, 0x46, 0x41, 0x12, 0x20, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x2e, 0x76,
+	0x31, 0x2e, 0x53, 0x65, 0x6e, 0x64, 0x43, 0x6f, 0x64, 0x65, 0x45, 0x6d, 0x61, 0x69, 0x6c, 0x4d,
+	0x46, 0x41, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x61, 0x75, 0x74, 0x68,
+	0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x6e, 0x64, 0x43, 0x6f, 0x64, 0x65, 0x45, 0x6d, 0x61, 0x69,
+	0x6c, 0x4d, 0x46, 0x41, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x27, 0x82, 0xd3,
+	0xe4, 0x93, 0x02, 0x21, 0x3a, 0x01, 0x2a, 0x22, 0x1c, 0x2f, 0x67, 0x61, 0x70, 0x69, 0x2f, 0x61,
+	0x75, 0x74, 0x68, 0x2f, 0x76, 0x31, 0x2f, 0x6d, 0x66, 0x61, 0x2f, 0x65, 0x6d, 0x61, 0x69, 0x6c,
+	0x2f, 0x73, 0x65, 0x6e, 0x64, 0x12, 0x78, 0x0a, 0x0d, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x45, 0x6d,
+	0x61, 0x69, 0x6c, 0x4d, 0x46, 0x41, 0x12, 0x1d, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x2e, 0x76, 0x31,
+	0x2e, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x45, 0x6d, 0x61, 0x69, 0x6c, 0x4d, 0x46, 0x41, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1e, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x2e, 0x76, 0x31, 0x2e,
+	0x43, 0x68, 0x65, 0x63, 0x6b, 0x45, 0x6d, 0x61, 0x69, 0x6c, 0x4d, 0x46, 0x41, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x28, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x22, 0x3a, 0x01, 0x2a,
+	0x22, 0x1d, 0x2f, 0x67, 0x61, 0x70, 0x69, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x2f, 0x76, 0x31, 0x2f,
+	0x6d, 0x66, 0x61, 0x2f, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x2f, 0x63, 0x68, 0x65, 0x63, 0x6b, 0x12,
+	0x80, 0x01, 0x0a, 0x0f, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x45, 0x6d, 0x61, 0x69, 0x6c,
+	0x4d, 0x46, 0x41, 0x12, 0x1f, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x69,
+	0x73, 0x61, 0x62, 0x6c, 0x65, 0x45, 0x6d, 0x61, 0x69, 0x6c, 0x4d, 0x46, 0x41, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x1a, 0x20, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x2e, 0x76, 0x31, 0x2e, 0x44,
+	0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x45, 0x6d, 0x61, 0x69, 0x6c, 0x4d, 0x46, 0x41, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x2a, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x24, 0x3a, 0x01,
+	0x2a, 0x22, 0x1f, 0x2f, 0x67, 0x61, 0x70, 0x69, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x2f, 0x76, 0x31,
+	0x2f, 0x6d, 0x66, 0x61, 0x2f, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x2f, 0x64, 0x69, 0x73, 0x61, 0x62,
+	0x6c, 0x65, 0x12, 0x80, 0x01, 0x0a, 0x10, 0x47, 0x65, 0x74, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e,
+	0x74, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x20, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x2e, 0x76,
+	0x31, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x53, 0x74, 0x61, 0x74,
+	0x75, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x61, 0x75, 0x74, 0x68,
+	0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x53, 0x74,
+	0x61, 0x74, 0x75, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x27, 0x82, 0xd3,
+	0xe4, 0x93, 0x02, 0x21, 0x3a, 0x01, 0x2a, 0x22, 0x1c, 0x2f, 0x67, 0x61, 0x70, 0x69, 0x2f, 0x61,
+	0x75, 0x74, 0x68, 0x2f, 0x76, 0x31, 0x2f, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x2f, 0x73,
+	0x74, 0x61, 0x74, 0x75, 0x73, 0x42, 0x3c, 0x5a, 0x3a, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e,
+	0x63, 0x6f, 0x6d, 0x2f, 0x6a, 0x75, 0x61, 0x6e, 0x6a, 0x69, 0x54, 0x65, 0x63, 0x68, 0x2f, 0x6a,
+	0x54, 0x65, 0x72, 0x6d, 0x2d, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x2f, 0x76, 0x31, 0x3b, 0x61, 0x75, 0x74,
+	0x68, 0x56, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -439,27 +1807,79 @@ func file_auth_v1_auth_service_proto_rawDescGZIP() []byte {
 	return file_auth_v1_auth_service_proto_rawDescData
 }
 
-var file_auth_v1_auth_service_proto_msgTypes = make([]protoimpl.MessageInfo, 6)
+var file_auth_v1_auth_service_proto_msgTypes = make([]protoimpl.MessageInfo, 32)
 var file_auth_v1_auth_service_proto_goTypes = []interface{}{
-	(*RegisterRequest)(nil),      // 0: auth.v1.RegisterRequest
-	(*LoginResponse)(nil),        // 1: auth.v1.LoginResponse
-	(*RegisterResponse)(nil),     // 2: auth.v1.RegisterResponse
-	(*LoginRequest)(nil),         // 3: auth.v1.LoginRequest
-	(*RefreshTokenRequest)(nil),  // 4: auth.v1.RefreshTokenRequest
-	(*RefreshTokenResponse)(nil), // 5: auth.v1.RefreshTokenResponse
+	(*RegisterRequest)(nil),            // 0: auth.v1.RegisterRequest
+	(*LoginResponse)(nil),              // 1: auth.v1.LoginResponse
+	(*RegisterResponse)(nil),           // 2: auth.v1.RegisterResponse
+	(*LoginRequest)(nil),               // 3: auth.v1.LoginRequest
+	(*RefreshTokenRequest)(nil),        // 4: auth.v1.RefreshTokenRequest
+	(*RefreshTokenResponse)(nil),       // 5: auth.v1.RefreshTokenResponse
+	(*GetMFAStatusRequest)(nil),        // 6: auth.v1.GetMFAStatusRequest
+	(*GetMFAStatusResponse)(nil),       // 7: auth.v1.GetMFAStatusResponse
+	(*TOTPStatus)(nil),                 // 8: auth.v1.TOTPStatus
+	(*EmailStatus)(nil),                // 9: auth.v1.EmailStatus
+	(*ActiveTOTPRequest)(nil),          // 10: auth.v1.ActiveTOTPRequest
+	(*ActiveTOTPResponse)(nil),         // 11: auth.v1.ActiveTOTPResponse
+	(*DisableTOTPRequest)(nil),         // 12: auth.v1.DisableTOTPRequest
+	(*DisableTOTPResponse)(nil),        // 13: auth.v1.DisableTOTPResponse
+	(*CheckTOTPRequest)(nil),           // 14: auth.v1.CheckTOTPRequest
+	(*CheckTOTPResponse)(nil),          // 15: auth.v1.CheckTOTPResponse
+	(*RecoverTOTPRequest)(nil),         // 16: auth.v1.RecoverTOTPRequest
+	(*RecoverTOTPResponse)(nil),        // 17: auth.v1.RecoverTOTPResponse
+	(*AddEmailMFARequest)(nil),         // 18: auth.v1.AddEmailMFARequest
+	(*AddEmailMFAResponse)(nil),        // 19: auth.v1.AddEmailMFAResponse
+	(*ActivateEmailMFARequest)(nil),    // 20: auth.v1.ActivateEmailMFARequest
+	(*ActivateEmailMFAResponse)(nil),   // 21: auth.v1.ActivateEmailMFAResponse
+	(*SetPrimaryEmailMFARequest)(nil),  // 22: auth.v1.SetPrimaryEmailMFARequest
+	(*SetPrimaryEmailMFAResponse)(nil), // 23: auth.v1.SetPrimaryEmailMFAResponse
+	(*SendCodeEmailMFARequest)(nil),    // 24: auth.v1.SendCodeEmailMFARequest
+	(*SendCodeEmailMFAResponse)(nil),   // 25: auth.v1.SendCodeEmailMFAResponse
+	(*CheckEmailMFARequest)(nil),       // 26: auth.v1.CheckEmailMFARequest
+	(*CheckEmailMFAResponse)(nil),      // 27: auth.v1.CheckEmailMFAResponse
+	(*DisableEmailMFARequest)(nil),     // 28: auth.v1.DisableEmailMFARequest
+	(*DisableEmailMFAResponse)(nil),    // 29: auth.v1.DisableEmailMFAResponse
+	(*GetAccountStatusRequest)(nil),    // 30: auth.v1.GetAccountStatusRequest
+	(*GetAccountStatusResponse)(nil),   // 31: auth.v1.GetAccountStatusResponse
 }
 var file_auth_v1_auth_service_proto_depIdxs = []int32{
-	0, // 0: auth.v1.AuthService.Register:input_type -> auth.v1.RegisterRequest
-	3, // 1: auth.v1.AuthService.Login:input_type -> auth.v1.LoginRequest
-	4, // 2: auth.v1.AuthService.RefreshToken:input_type -> auth.v1.RefreshTokenRequest
-	2, // 3: auth.v1.AuthService.Register:output_type -> auth.v1.RegisterResponse
-	1, // 4: auth.v1.AuthService.Login:output_type -> auth.v1.LoginResponse
-	5, // 5: auth.v1.AuthService.RefreshToken:output_type -> auth.v1.RefreshTokenResponse
-	3, // [3:6] is the sub-list for method output_type
-	0, // [0:3] is the sub-list for method input_type
-	0, // [0:0] is the sub-list for extension type_name
-	0, // [0:0] is the sub-list for extension extendee
-	0, // [0:0] is the sub-list for field type_name
+	8,  // 0: auth.v1.GetMFAStatusResponse.totp_status:type_name -> auth.v1.TOTPStatus
+	9,  // 1: auth.v1.GetMFAStatusResponse.email_status:type_name -> auth.v1.EmailStatus
+	0,  // 2: auth.v1.AuthService.Register:input_type -> auth.v1.RegisterRequest
+	3,  // 3: auth.v1.AuthService.Login:input_type -> auth.v1.LoginRequest
+	4,  // 4: auth.v1.AuthService.RefreshToken:input_type -> auth.v1.RefreshTokenRequest
+	6,  // 5: auth.v1.AuthService.GetMFAStatus:input_type -> auth.v1.GetMFAStatusRequest
+	10, // 6: auth.v1.AuthService.ActiveTOTP:input_type -> auth.v1.ActiveTOTPRequest
+	12, // 7: auth.v1.AuthService.DisableTOTP:input_type -> auth.v1.DisableTOTPRequest
+	14, // 8: auth.v1.AuthService.CheckTOTP:input_type -> auth.v1.CheckTOTPRequest
+	16, // 9: auth.v1.AuthService.RecoverTOTP:input_type -> auth.v1.RecoverTOTPRequest
+	18, // 10: auth.v1.AuthService.AddEmailMFA:input_type -> auth.v1.AddEmailMFARequest
+	20, // 11: auth.v1.AuthService.ActivateEmailMFA:input_type -> auth.v1.ActivateEmailMFARequest
+	22, // 12: auth.v1.AuthService.SetPrimaryEmailMFA:input_type -> auth.v1.SetPrimaryEmailMFARequest
+	24, // 13: auth.v1.AuthService.SendCodeEmailMFA:input_type -> auth.v1.SendCodeEmailMFARequest
+	26, // 14: auth.v1.AuthService.CheckEmailMFA:input_type -> auth.v1.CheckEmailMFARequest
+	28, // 15: auth.v1.AuthService.DisableEmailMFA:input_type -> auth.v1.DisableEmailMFARequest
+	30, // 16: auth.v1.AuthService.GetAccountStatus:input_type -> auth.v1.GetAccountStatusRequest
+	2,  // 17: auth.v1.AuthService.Register:output_type -> auth.v1.RegisterResponse
+	1,  // 18: auth.v1.AuthService.Login:output_type -> auth.v1.LoginResponse
+	5,  // 19: auth.v1.AuthService.RefreshToken:output_type -> auth.v1.RefreshTokenResponse
+	7,  // 20: auth.v1.AuthService.GetMFAStatus:output_type -> auth.v1.GetMFAStatusResponse
+	11, // 21: auth.v1.AuthService.ActiveTOTP:output_type -> auth.v1.ActiveTOTPResponse
+	13, // 22: auth.v1.AuthService.DisableTOTP:output_type -> auth.v1.DisableTOTPResponse
+	15, // 23: auth.v1.AuthService.CheckTOTP:output_type -> auth.v1.CheckTOTPResponse
+	17, // 24: auth.v1.AuthService.RecoverTOTP:output_type -> auth.v1.RecoverTOTPResponse
+	19, // 25: auth.v1.AuthService.AddEmailMFA:output_type -> auth.v1.AddEmailMFAResponse
+	21, // 26: auth.v1.AuthService.ActivateEmailMFA:output_type -> auth.v1.ActivateEmailMFAResponse
+	23, // 27: auth.v1.AuthService.SetPrimaryEmailMFA:output_type -> auth.v1.SetPrimaryEmailMFAResponse
+	25, // 28: auth.v1.AuthService.SendCodeEmailMFA:output_type -> auth.v1.SendCodeEmailMFAResponse
+	27, // 29: auth.v1.AuthService.CheckEmailMFA:output_type -> auth.v1.CheckEmailMFAResponse
+	29, // 30: auth.v1.AuthService.DisableEmailMFA:output_type -> auth.v1.DisableEmailMFAResponse
+	31, // 31: auth.v1.AuthService.GetAccountStatus:output_type -> auth.v1.GetAccountStatusResponse
+	17, // [17:32] is the sub-list for method output_type
+	2,  // [2:17] is the sub-list for method input_type
+	2,  // [2:2] is the sub-list for extension type_name
+	2,  // [2:2] is the sub-list for extension extendee
+	0,  // [0:2] is the sub-list for field type_name
 }
 
 func init() { file_auth_v1_auth_service_proto_init() }
@@ -480,8 +1900,32 @@ func file_auth_v1_auth_service_proto_init() {
 				return nil
 			}
 		}
-		file_auth_v1_auth_service_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*LoginResponse); i {
+		file_auth_v1_auth_service_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*LoginResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_auth_v1_auth_service_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RegisterResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_auth_v1_auth_service_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*LoginRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -492,8 +1936,8 @@ func file_auth_v1_auth_service_proto_init() {
 				return nil
 			}
 		}
-		file_auth_v1_auth_service_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RegisterResponse); i {
+		file_auth_v1_auth_service_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RefreshTokenRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -504,8 +1948,8 @@ func file_auth_v1_auth_service_proto_init() {
 				return nil
 			}
 		}
-		file_auth_v1_auth_service_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*LoginRequest); i {
+		file_auth_v1_auth_service_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RefreshTokenResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -516,8 +1960,8 @@ func file_auth_v1_auth_service_proto_init() {
 				return nil
 			}
 		}
-		file_auth_v1_auth_service_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RefreshTokenRequest); i {
+		file_auth_v1_auth_service_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GetMFAStatusRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -528,8 +1972,296 @@ func file_auth_v1_auth_service_proto_init() {
 				return nil
 			}
 		}
-		file_auth_v1_auth_service_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RefreshTokenResponse); i {
+		file_auth_v1_auth_service_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GetMFAStatusResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_auth_v1_auth_service_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*TOTPStatus); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_auth_v1_auth_service_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*EmailStatus); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_auth_v1_auth_service_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ActiveTOTPRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_auth_v1_auth_service_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ActiveTOTPResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_auth_v1_auth_service_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*DisableTOTPRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_auth_v1_auth_service_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*DisableTOTPResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_auth_v1_auth_service_proto_msgTypes[14].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CheckTOTPRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_auth_v1_auth_service_proto_msgTypes[15].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CheckTOTPResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_auth_v1_auth_service_proto_msgTypes[16].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RecoverTOTPRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_auth_v1_auth_service_proto_msgTypes[17].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RecoverTOTPResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_auth_v1_auth_service_proto_msgTypes[18].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AddEmailMFARequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_auth_v1_auth_service_proto_msgTypes[19].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AddEmailMFAResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_auth_v1_auth_service_proto_msgTypes[20].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ActivateEmailMFARequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_auth_v1_auth_service_proto_msgTypes[21].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ActivateEmailMFAResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_auth_v1_auth_service_proto_msgTypes[22].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SetPrimaryEmailMFARequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_auth_v1_auth_service_proto_msgTypes[23].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SetPrimaryEmailMFAResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_auth_v1_auth_service_proto_msgTypes[24].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SendCodeEmailMFARequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_auth_v1_auth_service_proto_msgTypes[25].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SendCodeEmailMFAResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_auth_v1_auth_service_proto_msgTypes[26].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CheckEmailMFARequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_auth_v1_auth_service_proto_msgTypes[27].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CheckEmailMFAResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_auth_v1_auth_service_proto_msgTypes[28].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*DisableEmailMFARequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_auth_v1_auth_service_proto_msgTypes[29].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*DisableEmailMFAResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_auth_v1_auth_service_proto_msgTypes[30].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GetAccountStatusRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_auth_v1_auth_service_proto_msgTypes[31].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GetAccountStatusResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -547,7 +2279,7 @@ func file_auth_v1_auth_service_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_auth_v1_auth_service_proto_rawDesc,
 			NumEnums:      0,
-			NumMessages:   6,
+			NumMessages:   32,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/gen/proto/auth/v1/auth_service.pb.gw.go b/gen/proto/auth/v1/auth_service.pb.gw.go
index e7bec1b..cb583ba 100644
--- a/gen/proto/auth/v1/auth_service.pb.gw.go
+++ b/gen/proto/auth/v1/auth_service.pb.gw.go
@@ -133,13 +133,721 @@ func local_request_AuthService_RefreshToken_0(ctx context.Context, marshaler run
 
 }
 
+func request_AuthService_GetMFAStatus_0(ctx context.Context, marshaler runtime.Marshaler, client AuthServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq GetMFAStatusRequest
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.GetMFAStatus(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_AuthService_GetMFAStatus_0(ctx context.Context, marshaler runtime.Marshaler, server AuthServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq GetMFAStatusRequest
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.GetMFAStatus(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_AuthService_ActiveTOTP_0(ctx context.Context, marshaler runtime.Marshaler, client AuthServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq ActiveTOTPRequest
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.ActiveTOTP(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_AuthService_ActiveTOTP_0(ctx context.Context, marshaler runtime.Marshaler, server AuthServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq ActiveTOTPRequest
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.ActiveTOTP(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_AuthService_DisableTOTP_0(ctx context.Context, marshaler runtime.Marshaler, client AuthServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq DisableTOTPRequest
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.DisableTOTP(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_AuthService_DisableTOTP_0(ctx context.Context, marshaler runtime.Marshaler, server AuthServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq DisableTOTPRequest
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.DisableTOTP(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_AuthService_CheckTOTP_0(ctx context.Context, marshaler runtime.Marshaler, client AuthServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq CheckTOTPRequest
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.CheckTOTP(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_AuthService_CheckTOTP_0(ctx context.Context, marshaler runtime.Marshaler, server AuthServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq CheckTOTPRequest
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.CheckTOTP(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_AuthService_RecoverTOTP_0(ctx context.Context, marshaler runtime.Marshaler, client AuthServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq RecoverTOTPRequest
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.RecoverTOTP(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_AuthService_RecoverTOTP_0(ctx context.Context, marshaler runtime.Marshaler, server AuthServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq RecoverTOTPRequest
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.RecoverTOTP(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_AuthService_AddEmailMFA_0(ctx context.Context, marshaler runtime.Marshaler, client AuthServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq AddEmailMFARequest
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.AddEmailMFA(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_AuthService_AddEmailMFA_0(ctx context.Context, marshaler runtime.Marshaler, server AuthServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq AddEmailMFARequest
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.AddEmailMFA(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_AuthService_ActivateEmailMFA_0(ctx context.Context, marshaler runtime.Marshaler, client AuthServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq ActivateEmailMFARequest
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.ActivateEmailMFA(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_AuthService_ActivateEmailMFA_0(ctx context.Context, marshaler runtime.Marshaler, server AuthServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq ActivateEmailMFARequest
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.ActivateEmailMFA(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_AuthService_SetPrimaryEmailMFA_0(ctx context.Context, marshaler runtime.Marshaler, client AuthServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq SetPrimaryEmailMFARequest
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.SetPrimaryEmailMFA(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_AuthService_SetPrimaryEmailMFA_0(ctx context.Context, marshaler runtime.Marshaler, server AuthServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq SetPrimaryEmailMFARequest
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.SetPrimaryEmailMFA(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_AuthService_SendCodeEmailMFA_0(ctx context.Context, marshaler runtime.Marshaler, client AuthServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq SendCodeEmailMFARequest
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.SendCodeEmailMFA(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_AuthService_SendCodeEmailMFA_0(ctx context.Context, marshaler runtime.Marshaler, server AuthServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq SendCodeEmailMFARequest
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.SendCodeEmailMFA(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_AuthService_CheckEmailMFA_0(ctx context.Context, marshaler runtime.Marshaler, client AuthServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq CheckEmailMFARequest
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.CheckEmailMFA(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_AuthService_CheckEmailMFA_0(ctx context.Context, marshaler runtime.Marshaler, server AuthServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq CheckEmailMFARequest
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.CheckEmailMFA(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_AuthService_DisableEmailMFA_0(ctx context.Context, marshaler runtime.Marshaler, client AuthServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq DisableEmailMFARequest
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.DisableEmailMFA(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_AuthService_DisableEmailMFA_0(ctx context.Context, marshaler runtime.Marshaler, server AuthServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq DisableEmailMFARequest
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.DisableEmailMFA(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_AuthService_GetAccountStatus_0(ctx context.Context, marshaler runtime.Marshaler, client AuthServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq GetAccountStatusRequest
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.GetAccountStatus(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_AuthService_GetAccountStatus_0(ctx context.Context, marshaler runtime.Marshaler, server AuthServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq GetAccountStatusRequest
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.GetAccountStatus(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
 // RegisterAuthServiceHandlerServer registers the http handlers for service AuthService to "mux".
 // UnaryRPC     :call AuthServiceServer directly.
 // StreamingRPC :currently unsupported pending https://github.com/grpc/grpc-go/issues/906.
 // Note that using this registration option will cause many gRPC library features to stop working. Consider using RegisterAuthServiceHandlerFromEndpoint instead.
 func RegisterAuthServiceHandlerServer(ctx context.Context, mux *runtime.ServeMux, server AuthServiceServer) error {
 
-	mux.Handle("POST", pattern_AuthService_Register_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+	mux.Handle("POST", pattern_AuthService_Register_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/auth.v1.AuthService/Register", runtime.WithHTTPPathPattern("/gapi/auth/v1/register"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_AuthService_Register_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_AuthService_Register_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_AuthService_Login_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/auth.v1.AuthService/Login", runtime.WithHTTPPathPattern("/gapi/auth/v1/login"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_AuthService_Login_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_AuthService_Login_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_AuthService_RefreshToken_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/auth.v1.AuthService/RefreshToken", runtime.WithHTTPPathPattern("/gapi/auth/v1/refreshToken"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_AuthService_RefreshToken_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_AuthService_RefreshToken_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_AuthService_GetMFAStatus_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/auth.v1.AuthService/GetMFAStatus", runtime.WithHTTPPathPattern("/gapi/auth/v1/mfa/status"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_AuthService_GetMFAStatus_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_AuthService_GetMFAStatus_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_AuthService_ActiveTOTP_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/auth.v1.AuthService/ActiveTOTP", runtime.WithHTTPPathPattern("/gapi/auth/v1/mfa/totp/active"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_AuthService_ActiveTOTP_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_AuthService_ActiveTOTP_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_AuthService_DisableTOTP_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/auth.v1.AuthService/DisableTOTP", runtime.WithHTTPPathPattern("/gapi/auth/v1/mfa/totp/disable"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_AuthService_DisableTOTP_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_AuthService_DisableTOTP_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_AuthService_CheckTOTP_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/auth.v1.AuthService/CheckTOTP", runtime.WithHTTPPathPattern("/gapi/auth/v1/mfa/totp/check"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_AuthService_CheckTOTP_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_AuthService_CheckTOTP_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_AuthService_RecoverTOTP_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/auth.v1.AuthService/RecoverTOTP", runtime.WithHTTPPathPattern("/gapi/auth/v1/mfa/totp/recover"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_AuthService_RecoverTOTP_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_AuthService_RecoverTOTP_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_AuthService_AddEmailMFA_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/auth.v1.AuthService/AddEmailMFA", runtime.WithHTTPPathPattern("/gapi/auth/v1/mfa/email/add"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_AuthService_AddEmailMFA_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_AuthService_AddEmailMFA_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_AuthService_ActivateEmailMFA_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/auth.v1.AuthService/ActivateEmailMFA", runtime.WithHTTPPathPattern("/gapi/auth/v1/mfa/email/activate"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_AuthService_ActivateEmailMFA_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_AuthService_ActivateEmailMFA_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_AuthService_SetPrimaryEmailMFA_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/auth.v1.AuthService/SetPrimaryEmailMFA", runtime.WithHTTPPathPattern("/gapi/auth/v1/mfa/email/setPrimary"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_AuthService_SetPrimaryEmailMFA_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_AuthService_SetPrimaryEmailMFA_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_AuthService_SendCodeEmailMFA_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/auth.v1.AuthService/SendCodeEmailMFA", runtime.WithHTTPPathPattern("/gapi/auth/v1/mfa/email/send"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_AuthService_SendCodeEmailMFA_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_AuthService_SendCodeEmailMFA_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_AuthService_CheckEmailMFA_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
 		ctx, cancel := context.WithCancel(req.Context())
 		defer cancel()
 		var stream runtime.ServerTransportStream
@@ -147,12 +855,12 @@ func RegisterAuthServiceHandlerServer(ctx context.Context, mux *runtime.ServeMux
 		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
 		var err error
 		var annotatedContext context.Context
-		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/auth.v1.AuthService/Register", runtime.WithHTTPPathPattern("/gapi/auth/v1/register"))
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/auth.v1.AuthService/CheckEmailMFA", runtime.WithHTTPPathPattern("/gapi/auth/v1/mfa/email/check"))
 		if err != nil {
 			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
 			return
 		}
-		resp, md, err := local_request_AuthService_Register_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		resp, md, err := local_request_AuthService_CheckEmailMFA_0(annotatedContext, inboundMarshaler, server, req, pathParams)
 		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
 		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
 		if err != nil {
@@ -160,11 +868,11 @@ func RegisterAuthServiceHandlerServer(ctx context.Context, mux *runtime.ServeMux
 			return
 		}
 
-		forward_AuthService_Register_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+		forward_AuthService_CheckEmailMFA_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
 
 	})
 
-	mux.Handle("POST", pattern_AuthService_Login_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+	mux.Handle("POST", pattern_AuthService_DisableEmailMFA_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
 		ctx, cancel := context.WithCancel(req.Context())
 		defer cancel()
 		var stream runtime.ServerTransportStream
@@ -172,12 +880,12 @@ func RegisterAuthServiceHandlerServer(ctx context.Context, mux *runtime.ServeMux
 		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
 		var err error
 		var annotatedContext context.Context
-		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/auth.v1.AuthService/Login", runtime.WithHTTPPathPattern("/gapi/auth/v1/login"))
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/auth.v1.AuthService/DisableEmailMFA", runtime.WithHTTPPathPattern("/gapi/auth/v1/mfa/email/disable"))
 		if err != nil {
 			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
 			return
 		}
-		resp, md, err := local_request_AuthService_Login_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		resp, md, err := local_request_AuthService_DisableEmailMFA_0(annotatedContext, inboundMarshaler, server, req, pathParams)
 		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
 		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
 		if err != nil {
@@ -185,11 +893,11 @@ func RegisterAuthServiceHandlerServer(ctx context.Context, mux *runtime.ServeMux
 			return
 		}
 
-		forward_AuthService_Login_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+		forward_AuthService_DisableEmailMFA_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
 
 	})
 
-	mux.Handle("POST", pattern_AuthService_RefreshToken_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+	mux.Handle("POST", pattern_AuthService_GetAccountStatus_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
 		ctx, cancel := context.WithCancel(req.Context())
 		defer cancel()
 		var stream runtime.ServerTransportStream
@@ -197,12 +905,12 @@ func RegisterAuthServiceHandlerServer(ctx context.Context, mux *runtime.ServeMux
 		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
 		var err error
 		var annotatedContext context.Context
-		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/auth.v1.AuthService/RefreshToken", runtime.WithHTTPPathPattern("/gapi/auth/v1/refreshToken"))
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/auth.v1.AuthService/GetAccountStatus", runtime.WithHTTPPathPattern("/gapi/auth/v1/account/status"))
 		if err != nil {
 			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
 			return
 		}
-		resp, md, err := local_request_AuthService_RefreshToken_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		resp, md, err := local_request_AuthService_GetAccountStatus_0(annotatedContext, inboundMarshaler, server, req, pathParams)
 		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
 		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
 		if err != nil {
@@ -210,7 +918,7 @@ func RegisterAuthServiceHandlerServer(ctx context.Context, mux *runtime.ServeMux
 			return
 		}
 
-		forward_AuthService_RefreshToken_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+		forward_AuthService_GetAccountStatus_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
 
 	})
 
@@ -321,6 +1029,270 @@ func RegisterAuthServiceHandlerClient(ctx context.Context, mux *runtime.ServeMux
 
 	})
 
+	mux.Handle("POST", pattern_AuthService_GetMFAStatus_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/auth.v1.AuthService/GetMFAStatus", runtime.WithHTTPPathPattern("/gapi/auth/v1/mfa/status"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_AuthService_GetMFAStatus_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_AuthService_GetMFAStatus_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_AuthService_ActiveTOTP_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/auth.v1.AuthService/ActiveTOTP", runtime.WithHTTPPathPattern("/gapi/auth/v1/mfa/totp/active"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_AuthService_ActiveTOTP_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_AuthService_ActiveTOTP_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_AuthService_DisableTOTP_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/auth.v1.AuthService/DisableTOTP", runtime.WithHTTPPathPattern("/gapi/auth/v1/mfa/totp/disable"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_AuthService_DisableTOTP_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_AuthService_DisableTOTP_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_AuthService_CheckTOTP_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/auth.v1.AuthService/CheckTOTP", runtime.WithHTTPPathPattern("/gapi/auth/v1/mfa/totp/check"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_AuthService_CheckTOTP_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_AuthService_CheckTOTP_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_AuthService_RecoverTOTP_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/auth.v1.AuthService/RecoverTOTP", runtime.WithHTTPPathPattern("/gapi/auth/v1/mfa/totp/recover"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_AuthService_RecoverTOTP_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_AuthService_RecoverTOTP_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_AuthService_AddEmailMFA_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/auth.v1.AuthService/AddEmailMFA", runtime.WithHTTPPathPattern("/gapi/auth/v1/mfa/email/add"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_AuthService_AddEmailMFA_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_AuthService_AddEmailMFA_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_AuthService_ActivateEmailMFA_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/auth.v1.AuthService/ActivateEmailMFA", runtime.WithHTTPPathPattern("/gapi/auth/v1/mfa/email/activate"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_AuthService_ActivateEmailMFA_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_AuthService_ActivateEmailMFA_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_AuthService_SetPrimaryEmailMFA_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/auth.v1.AuthService/SetPrimaryEmailMFA", runtime.WithHTTPPathPattern("/gapi/auth/v1/mfa/email/setPrimary"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_AuthService_SetPrimaryEmailMFA_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_AuthService_SetPrimaryEmailMFA_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_AuthService_SendCodeEmailMFA_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/auth.v1.AuthService/SendCodeEmailMFA", runtime.WithHTTPPathPattern("/gapi/auth/v1/mfa/email/send"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_AuthService_SendCodeEmailMFA_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_AuthService_SendCodeEmailMFA_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_AuthService_CheckEmailMFA_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/auth.v1.AuthService/CheckEmailMFA", runtime.WithHTTPPathPattern("/gapi/auth/v1/mfa/email/check"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_AuthService_CheckEmailMFA_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_AuthService_CheckEmailMFA_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_AuthService_DisableEmailMFA_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/auth.v1.AuthService/DisableEmailMFA", runtime.WithHTTPPathPattern("/gapi/auth/v1/mfa/email/disable"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_AuthService_DisableEmailMFA_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_AuthService_DisableEmailMFA_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_AuthService_GetAccountStatus_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/auth.v1.AuthService/GetAccountStatus", runtime.WithHTTPPathPattern("/gapi/auth/v1/account/status"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_AuthService_GetAccountStatus_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_AuthService_GetAccountStatus_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
 	return nil
 }
 
@@ -330,6 +1302,30 @@ var (
 	pattern_AuthService_Login_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3}, []string{"gapi", "auth", "v1", "login"}, ""))
 
 	pattern_AuthService_RefreshToken_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3}, []string{"gapi", "auth", "v1", "refreshToken"}, ""))
+
+	pattern_AuthService_GetMFAStatus_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3, 2, 4}, []string{"gapi", "auth", "v1", "mfa", "status"}, ""))
+
+	pattern_AuthService_ActiveTOTP_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3, 2, 4, 2, 5}, []string{"gapi", "auth", "v1", "mfa", "totp", "active"}, ""))
+
+	pattern_AuthService_DisableTOTP_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3, 2, 4, 2, 5}, []string{"gapi", "auth", "v1", "mfa", "totp", "disable"}, ""))
+
+	pattern_AuthService_CheckTOTP_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3, 2, 4, 2, 5}, []string{"gapi", "auth", "v1", "mfa", "totp", "check"}, ""))
+
+	pattern_AuthService_RecoverTOTP_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3, 2, 4, 2, 5}, []string{"gapi", "auth", "v1", "mfa", "totp", "recover"}, ""))
+
+	pattern_AuthService_AddEmailMFA_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3, 2, 4, 2, 5}, []string{"gapi", "auth", "v1", "mfa", "email", "add"}, ""))
+
+	pattern_AuthService_ActivateEmailMFA_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3, 2, 4, 2, 5}, []string{"gapi", "auth", "v1", "mfa", "email", "activate"}, ""))
+
+	pattern_AuthService_SetPrimaryEmailMFA_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3, 2, 4, 2, 5}, []string{"gapi", "auth", "v1", "mfa", "email", "setPrimary"}, ""))
+
+	pattern_AuthService_SendCodeEmailMFA_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3, 2, 4, 2, 5}, []string{"gapi", "auth", "v1", "mfa", "email", "send"}, ""))
+
+	pattern_AuthService_CheckEmailMFA_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3, 2, 4, 2, 5}, []string{"gapi", "auth", "v1", "mfa", "email", "check"}, ""))
+
+	pattern_AuthService_DisableEmailMFA_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3, 2, 4, 2, 5}, []string{"gapi", "auth", "v1", "mfa", "email", "disable"}, ""))
+
+	pattern_AuthService_GetAccountStatus_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3, 2, 4}, []string{"gapi", "auth", "v1", "account", "status"}, ""))
 )
 
 var (
@@ -338,4 +1334,28 @@ var (
 	forward_AuthService_Login_0 = runtime.ForwardResponseMessage
 
 	forward_AuthService_RefreshToken_0 = runtime.ForwardResponseMessage
+
+	forward_AuthService_GetMFAStatus_0 = runtime.ForwardResponseMessage
+
+	forward_AuthService_ActiveTOTP_0 = runtime.ForwardResponseMessage
+
+	forward_AuthService_DisableTOTP_0 = runtime.ForwardResponseMessage
+
+	forward_AuthService_CheckTOTP_0 = runtime.ForwardResponseMessage
+
+	forward_AuthService_RecoverTOTP_0 = runtime.ForwardResponseMessage
+
+	forward_AuthService_AddEmailMFA_0 = runtime.ForwardResponseMessage
+
+	forward_AuthService_ActivateEmailMFA_0 = runtime.ForwardResponseMessage
+
+	forward_AuthService_SetPrimaryEmailMFA_0 = runtime.ForwardResponseMessage
+
+	forward_AuthService_SendCodeEmailMFA_0 = runtime.ForwardResponseMessage
+
+	forward_AuthService_CheckEmailMFA_0 = runtime.ForwardResponseMessage
+
+	forward_AuthService_DisableEmailMFA_0 = runtime.ForwardResponseMessage
+
+	forward_AuthService_GetAccountStatus_0 = runtime.ForwardResponseMessage
 )
diff --git a/gen/proto/auth/v1/auth_service.pb.ts b/gen/proto/auth/v1/auth_service.pb.ts
index e8747a4..6e14dbf 100644
--- a/gen/proto/auth/v1/auth_service.pb.ts
+++ b/gen/proto/auth/v1/auth_service.pb.ts
@@ -36,6 +36,107 @@ export type RefreshTokenResponse = {
   refreshToken?: string
 }
 
+export type GetMFAStatusRequest = {
+}
+
+export type GetMFAStatusResponse = {
+  totpStatus?: TOTPStatus
+  emailStatus?: EmailStatus[]
+}
+
+export type TOTPStatus = {
+  isActive?: boolean
+}
+
+export type EmailStatus = {
+  email?: string
+  isPrimary?: boolean
+  isActive?: boolean
+}
+
+export type ActiveTOTPRequest = {
+  secretKey?: string
+  totpCode?: string
+}
+
+export type ActiveTOTPResponse = {
+}
+
+export type DisableTOTPRequest = {
+  totpCode?: string
+}
+
+export type DisableTOTPResponse = {
+}
+
+export type CheckTOTPRequest = {
+  totpCode?: string
+}
+
+export type CheckTOTPResponse = {
+}
+
+export type RecoverTOTPRequest = {
+  recoveryCode?: string[]
+}
+
+export type RecoverTOTPResponse = {
+  newSecretKey?: string
+  newRecoveryCode?: string[]
+}
+
+export type AddEmailMFARequest = {
+  email?: string
+}
+
+export type AddEmailMFAResponse = {
+}
+
+export type ActivateEmailMFARequest = {
+  email?: string
+  verificationCode?: string
+}
+
+export type ActivateEmailMFAResponse = {
+}
+
+export type SetPrimaryEmailMFARequest = {
+  newEmail?: string
+  oldEmail?: string
+}
+
+export type SetPrimaryEmailMFAResponse = {
+}
+
+export type SendCodeEmailMFARequest = {
+  email?: string
+}
+
+export type SendCodeEmailMFAResponse = {
+}
+
+export type CheckEmailMFARequest = {
+  email?: string
+  verificationCode?: string
+}
+
+export type CheckEmailMFAResponse = {
+}
+
+export type DisableEmailMFARequest = {
+  email?: string
+}
+
+export type DisableEmailMFAResponse = {
+}
+
+export type GetAccountStatusRequest = {
+}
+
+export type GetAccountStatusResponse = {
+  sudoTtl?: string
+}
+
 export class AuthService {
   static Register(req: RegisterRequest, initReq?: fm.InitReq): Promise<RegisterResponse> {
     return fm.fetchReq<RegisterRequest, RegisterResponse>(`/gapi/auth/v1/register`, {...initReq, method: "POST", body: JSON.stringify(req, fm.replacer)})
@@ -46,4 +147,40 @@ export class AuthService {
   static RefreshToken(req: RefreshTokenRequest, initReq?: fm.InitReq): Promise<RefreshTokenResponse> {
     return fm.fetchReq<RefreshTokenRequest, RefreshTokenResponse>(`/gapi/auth/v1/refreshToken`, {...initReq, method: "POST", body: JSON.stringify(req, fm.replacer)})
   }
+  static GetMFAStatus(req: GetMFAStatusRequest, initReq?: fm.InitReq): Promise<GetMFAStatusResponse> {
+    return fm.fetchReq<GetMFAStatusRequest, GetMFAStatusResponse>(`/gapi/auth/v1/mfa/status`, {...initReq, method: "POST", body: JSON.stringify(req, fm.replacer)})
+  }
+  static ActiveTOTP(req: ActiveTOTPRequest, initReq?: fm.InitReq): Promise<ActiveTOTPResponse> {
+    return fm.fetchReq<ActiveTOTPRequest, ActiveTOTPResponse>(`/gapi/auth/v1/mfa/totp/active`, {...initReq, method: "POST", body: JSON.stringify(req, fm.replacer)})
+  }
+  static DisableTOTP(req: DisableTOTPRequest, initReq?: fm.InitReq): Promise<DisableTOTPResponse> {
+    return fm.fetchReq<DisableTOTPRequest, DisableTOTPResponse>(`/gapi/auth/v1/mfa/totp/disable`, {...initReq, method: "POST", body: JSON.stringify(req, fm.replacer)})
+  }
+  static CheckTOTP(req: CheckTOTPRequest, initReq?: fm.InitReq): Promise<CheckTOTPResponse> {
+    return fm.fetchReq<CheckTOTPRequest, CheckTOTPResponse>(`/gapi/auth/v1/mfa/totp/check`, {...initReq, method: "POST", body: JSON.stringify(req, fm.replacer)})
+  }
+  static RecoverTOTP(req: RecoverTOTPRequest, initReq?: fm.InitReq): Promise<RecoverTOTPResponse> {
+    return fm.fetchReq<RecoverTOTPRequest, RecoverTOTPResponse>(`/gapi/auth/v1/mfa/totp/recover`, {...initReq, method: "POST", body: JSON.stringify(req, fm.replacer)})
+  }
+  static AddEmailMFA(req: AddEmailMFARequest, initReq?: fm.InitReq): Promise<AddEmailMFAResponse> {
+    return fm.fetchReq<AddEmailMFARequest, AddEmailMFAResponse>(`/gapi/auth/v1/mfa/email/add`, {...initReq, method: "POST", body: JSON.stringify(req, fm.replacer)})
+  }
+  static ActivateEmailMFA(req: ActivateEmailMFARequest, initReq?: fm.InitReq): Promise<ActivateEmailMFAResponse> {
+    return fm.fetchReq<ActivateEmailMFARequest, ActivateEmailMFAResponse>(`/gapi/auth/v1/mfa/email/activate`, {...initReq, method: "POST", body: JSON.stringify(req, fm.replacer)})
+  }
+  static SetPrimaryEmailMFA(req: SetPrimaryEmailMFARequest, initReq?: fm.InitReq): Promise<SetPrimaryEmailMFAResponse> {
+    return fm.fetchReq<SetPrimaryEmailMFARequest, SetPrimaryEmailMFAResponse>(`/gapi/auth/v1/mfa/email/setPrimary`, {...initReq, method: "POST", body: JSON.stringify(req, fm.replacer)})
+  }
+  static SendCodeEmailMFA(req: SendCodeEmailMFARequest, initReq?: fm.InitReq): Promise<SendCodeEmailMFAResponse> {
+    return fm.fetchReq<SendCodeEmailMFARequest, SendCodeEmailMFAResponse>(`/gapi/auth/v1/mfa/email/send`, {...initReq, method: "POST", body: JSON.stringify(req, fm.replacer)})
+  }
+  static CheckEmailMFA(req: CheckEmailMFARequest, initReq?: fm.InitReq): Promise<CheckEmailMFAResponse> {
+    return fm.fetchReq<CheckEmailMFARequest, CheckEmailMFAResponse>(`/gapi/auth/v1/mfa/email/check`, {...initReq, method: "POST", body: JSON.stringify(req, fm.replacer)})
+  }
+  static DisableEmailMFA(req: DisableEmailMFARequest, initReq?: fm.InitReq): Promise<DisableEmailMFAResponse> {
+    return fm.fetchReq<DisableEmailMFARequest, DisableEmailMFAResponse>(`/gapi/auth/v1/mfa/email/disable`, {...initReq, method: "POST", body: JSON.stringify(req, fm.replacer)})
+  }
+  static GetAccountStatus(req: GetAccountStatusRequest, initReq?: fm.InitReq): Promise<GetAccountStatusResponse> {
+    return fm.fetchReq<GetAccountStatusRequest, GetAccountStatusResponse>(`/gapi/auth/v1/account/status`, {...initReq, method: "POST", body: JSON.stringify(req, fm.replacer)})
+  }
 }
\ No newline at end of file
diff --git a/gen/proto/auth/v1/auth_service_grpc.pb.go b/gen/proto/auth/v1/auth_service_grpc.pb.go
index 3b631e3..5cb85a5 100644
--- a/gen/proto/auth/v1/auth_service_grpc.pb.go
+++ b/gen/proto/auth/v1/auth_service_grpc.pb.go
@@ -19,9 +19,21 @@ import (
 const _ = grpc.SupportPackageIsVersion7
 
 const (
-	AuthService_Register_FullMethodName     = "/auth.v1.AuthService/Register"
-	AuthService_Login_FullMethodName        = "/auth.v1.AuthService/Login"
-	AuthService_RefreshToken_FullMethodName = "/auth.v1.AuthService/RefreshToken"
+	AuthService_Register_FullMethodName           = "/auth.v1.AuthService/Register"
+	AuthService_Login_FullMethodName              = "/auth.v1.AuthService/Login"
+	AuthService_RefreshToken_FullMethodName       = "/auth.v1.AuthService/RefreshToken"
+	AuthService_GetMFAStatus_FullMethodName       = "/auth.v1.AuthService/GetMFAStatus"
+	AuthService_ActiveTOTP_FullMethodName         = "/auth.v1.AuthService/ActiveTOTP"
+	AuthService_DisableTOTP_FullMethodName        = "/auth.v1.AuthService/DisableTOTP"
+	AuthService_CheckTOTP_FullMethodName          = "/auth.v1.AuthService/CheckTOTP"
+	AuthService_RecoverTOTP_FullMethodName        = "/auth.v1.AuthService/RecoverTOTP"
+	AuthService_AddEmailMFA_FullMethodName        = "/auth.v1.AuthService/AddEmailMFA"
+	AuthService_ActivateEmailMFA_FullMethodName   = "/auth.v1.AuthService/ActivateEmailMFA"
+	AuthService_SetPrimaryEmailMFA_FullMethodName = "/auth.v1.AuthService/SetPrimaryEmailMFA"
+	AuthService_SendCodeEmailMFA_FullMethodName   = "/auth.v1.AuthService/SendCodeEmailMFA"
+	AuthService_CheckEmailMFA_FullMethodName      = "/auth.v1.AuthService/CheckEmailMFA"
+	AuthService_DisableEmailMFA_FullMethodName    = "/auth.v1.AuthService/DisableEmailMFA"
+	AuthService_GetAccountStatus_FullMethodName   = "/auth.v1.AuthService/GetAccountStatus"
 )
 
 // AuthServiceClient is the client API for AuthService service.
@@ -34,6 +46,23 @@ type AuthServiceClient interface {
 	Login(ctx context.Context, in *LoginRequest, opts ...grpc.CallOption) (*LoginResponse, error)
 	// Token刷新
 	RefreshToken(ctx context.Context, in *RefreshTokenRequest, opts ...grpc.CallOption) (*RefreshTokenResponse, error)
+	// 检查MFA状态，并返回MFA状态
+	GetMFAStatus(ctx context.Context, in *GetMFAStatusRequest, opts ...grpc.CallOption) (*GetMFAStatusResponse, error)
+	// TOTP
+	// 添加TOTP
+	ActiveTOTP(ctx context.Context, in *ActiveTOTPRequest, opts ...grpc.CallOption) (*ActiveTOTPResponse, error)
+	DisableTOTP(ctx context.Context, in *DisableTOTPRequest, opts ...grpc.CallOption) (*DisableTOTPResponse, error)
+	CheckTOTP(ctx context.Context, in *CheckTOTPRequest, opts ...grpc.CallOption) (*CheckTOTPResponse, error)
+	RecoverTOTP(ctx context.Context, in *RecoverTOTPRequest, opts ...grpc.CallOption) (*RecoverTOTPResponse, error)
+	// Email
+	AddEmailMFA(ctx context.Context, in *AddEmailMFARequest, opts ...grpc.CallOption) (*AddEmailMFAResponse, error)
+	ActivateEmailMFA(ctx context.Context, in *ActivateEmailMFARequest, opts ...grpc.CallOption) (*ActivateEmailMFAResponse, error)
+	SetPrimaryEmailMFA(ctx context.Context, in *SetPrimaryEmailMFARequest, opts ...grpc.CallOption) (*SetPrimaryEmailMFAResponse, error)
+	SendCodeEmailMFA(ctx context.Context, in *SendCodeEmailMFARequest, opts ...grpc.CallOption) (*SendCodeEmailMFAResponse, error)
+	CheckEmailMFA(ctx context.Context, in *CheckEmailMFARequest, opts ...grpc.CallOption) (*CheckEmailMFAResponse, error)
+	DisableEmailMFA(ctx context.Context, in *DisableEmailMFARequest, opts ...grpc.CallOption) (*DisableEmailMFAResponse, error)
+	// GetAccountStatus 获取sudo的ttl
+	GetAccountStatus(ctx context.Context, in *GetAccountStatusRequest, opts ...grpc.CallOption) (*GetAccountStatusResponse, error)
 }
 
 type authServiceClient struct {
@@ -71,6 +100,114 @@ func (c *authServiceClient) RefreshToken(ctx context.Context, in *RefreshTokenRe
 	return out, nil
 }
 
+func (c *authServiceClient) GetMFAStatus(ctx context.Context, in *GetMFAStatusRequest, opts ...grpc.CallOption) (*GetMFAStatusResponse, error) {
+	out := new(GetMFAStatusResponse)
+	err := c.cc.Invoke(ctx, AuthService_GetMFAStatus_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *authServiceClient) ActiveTOTP(ctx context.Context, in *ActiveTOTPRequest, opts ...grpc.CallOption) (*ActiveTOTPResponse, error) {
+	out := new(ActiveTOTPResponse)
+	err := c.cc.Invoke(ctx, AuthService_ActiveTOTP_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *authServiceClient) DisableTOTP(ctx context.Context, in *DisableTOTPRequest, opts ...grpc.CallOption) (*DisableTOTPResponse, error) {
+	out := new(DisableTOTPResponse)
+	err := c.cc.Invoke(ctx, AuthService_DisableTOTP_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *authServiceClient) CheckTOTP(ctx context.Context, in *CheckTOTPRequest, opts ...grpc.CallOption) (*CheckTOTPResponse, error) {
+	out := new(CheckTOTPResponse)
+	err := c.cc.Invoke(ctx, AuthService_CheckTOTP_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *authServiceClient) RecoverTOTP(ctx context.Context, in *RecoverTOTPRequest, opts ...grpc.CallOption) (*RecoverTOTPResponse, error) {
+	out := new(RecoverTOTPResponse)
+	err := c.cc.Invoke(ctx, AuthService_RecoverTOTP_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *authServiceClient) AddEmailMFA(ctx context.Context, in *AddEmailMFARequest, opts ...grpc.CallOption) (*AddEmailMFAResponse, error) {
+	out := new(AddEmailMFAResponse)
+	err := c.cc.Invoke(ctx, AuthService_AddEmailMFA_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *authServiceClient) ActivateEmailMFA(ctx context.Context, in *ActivateEmailMFARequest, opts ...grpc.CallOption) (*ActivateEmailMFAResponse, error) {
+	out := new(ActivateEmailMFAResponse)
+	err := c.cc.Invoke(ctx, AuthService_ActivateEmailMFA_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *authServiceClient) SetPrimaryEmailMFA(ctx context.Context, in *SetPrimaryEmailMFARequest, opts ...grpc.CallOption) (*SetPrimaryEmailMFAResponse, error) {
+	out := new(SetPrimaryEmailMFAResponse)
+	err := c.cc.Invoke(ctx, AuthService_SetPrimaryEmailMFA_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *authServiceClient) SendCodeEmailMFA(ctx context.Context, in *SendCodeEmailMFARequest, opts ...grpc.CallOption) (*SendCodeEmailMFAResponse, error) {
+	out := new(SendCodeEmailMFAResponse)
+	err := c.cc.Invoke(ctx, AuthService_SendCodeEmailMFA_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *authServiceClient) CheckEmailMFA(ctx context.Context, in *CheckEmailMFARequest, opts ...grpc.CallOption) (*CheckEmailMFAResponse, error) {
+	out := new(CheckEmailMFAResponse)
+	err := c.cc.Invoke(ctx, AuthService_CheckEmailMFA_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *authServiceClient) DisableEmailMFA(ctx context.Context, in *DisableEmailMFARequest, opts ...grpc.CallOption) (*DisableEmailMFAResponse, error) {
+	out := new(DisableEmailMFAResponse)
+	err := c.cc.Invoke(ctx, AuthService_DisableEmailMFA_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *authServiceClient) GetAccountStatus(ctx context.Context, in *GetAccountStatusRequest, opts ...grpc.CallOption) (*GetAccountStatusResponse, error) {
+	out := new(GetAccountStatusResponse)
+	err := c.cc.Invoke(ctx, AuthService_GetAccountStatus_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 // AuthServiceServer is the server API for AuthService service.
 // All implementations must embed UnimplementedAuthServiceServer
 // for forward compatibility
@@ -81,6 +218,23 @@ type AuthServiceServer interface {
 	Login(context.Context, *LoginRequest) (*LoginResponse, error)
 	// Token刷新
 	RefreshToken(context.Context, *RefreshTokenRequest) (*RefreshTokenResponse, error)
+	// 检查MFA状态，并返回MFA状态
+	GetMFAStatus(context.Context, *GetMFAStatusRequest) (*GetMFAStatusResponse, error)
+	// TOTP
+	// 添加TOTP
+	ActiveTOTP(context.Context, *ActiveTOTPRequest) (*ActiveTOTPResponse, error)
+	DisableTOTP(context.Context, *DisableTOTPRequest) (*DisableTOTPResponse, error)
+	CheckTOTP(context.Context, *CheckTOTPRequest) (*CheckTOTPResponse, error)
+	RecoverTOTP(context.Context, *RecoverTOTPRequest) (*RecoverTOTPResponse, error)
+	// Email
+	AddEmailMFA(context.Context, *AddEmailMFARequest) (*AddEmailMFAResponse, error)
+	ActivateEmailMFA(context.Context, *ActivateEmailMFARequest) (*ActivateEmailMFAResponse, error)
+	SetPrimaryEmailMFA(context.Context, *SetPrimaryEmailMFARequest) (*SetPrimaryEmailMFAResponse, error)
+	SendCodeEmailMFA(context.Context, *SendCodeEmailMFARequest) (*SendCodeEmailMFAResponse, error)
+	CheckEmailMFA(context.Context, *CheckEmailMFARequest) (*CheckEmailMFAResponse, error)
+	DisableEmailMFA(context.Context, *DisableEmailMFARequest) (*DisableEmailMFAResponse, error)
+	// GetAccountStatus 获取sudo的ttl
+	GetAccountStatus(context.Context, *GetAccountStatusRequest) (*GetAccountStatusResponse, error)
 	mustEmbedUnimplementedAuthServiceServer()
 }
 
@@ -97,6 +251,42 @@ func (UnimplementedAuthServiceServer) Login(context.Context, *LoginRequest) (*Lo
 func (UnimplementedAuthServiceServer) RefreshToken(context.Context, *RefreshTokenRequest) (*RefreshTokenResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method RefreshToken not implemented")
 }
+func (UnimplementedAuthServiceServer) GetMFAStatus(context.Context, *GetMFAStatusRequest) (*GetMFAStatusResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetMFAStatus not implemented")
+}
+func (UnimplementedAuthServiceServer) ActiveTOTP(context.Context, *ActiveTOTPRequest) (*ActiveTOTPResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ActiveTOTP not implemented")
+}
+func (UnimplementedAuthServiceServer) DisableTOTP(context.Context, *DisableTOTPRequest) (*DisableTOTPResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method DisableTOTP not implemented")
+}
+func (UnimplementedAuthServiceServer) CheckTOTP(context.Context, *CheckTOTPRequest) (*CheckTOTPResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method CheckTOTP not implemented")
+}
+func (UnimplementedAuthServiceServer) RecoverTOTP(context.Context, *RecoverTOTPRequest) (*RecoverTOTPResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method RecoverTOTP not implemented")
+}
+func (UnimplementedAuthServiceServer) AddEmailMFA(context.Context, *AddEmailMFARequest) (*AddEmailMFAResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method AddEmailMFA not implemented")
+}
+func (UnimplementedAuthServiceServer) ActivateEmailMFA(context.Context, *ActivateEmailMFARequest) (*ActivateEmailMFAResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ActivateEmailMFA not implemented")
+}
+func (UnimplementedAuthServiceServer) SetPrimaryEmailMFA(context.Context, *SetPrimaryEmailMFARequest) (*SetPrimaryEmailMFAResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method SetPrimaryEmailMFA not implemented")
+}
+func (UnimplementedAuthServiceServer) SendCodeEmailMFA(context.Context, *SendCodeEmailMFARequest) (*SendCodeEmailMFAResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method SendCodeEmailMFA not implemented")
+}
+func (UnimplementedAuthServiceServer) CheckEmailMFA(context.Context, *CheckEmailMFARequest) (*CheckEmailMFAResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method CheckEmailMFA not implemented")
+}
+func (UnimplementedAuthServiceServer) DisableEmailMFA(context.Context, *DisableEmailMFARequest) (*DisableEmailMFAResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method DisableEmailMFA not implemented")
+}
+func (UnimplementedAuthServiceServer) GetAccountStatus(context.Context, *GetAccountStatusRequest) (*GetAccountStatusResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetAccountStatus not implemented")
+}
 func (UnimplementedAuthServiceServer) mustEmbedUnimplementedAuthServiceServer() {}
 
 // UnsafeAuthServiceServer may be embedded to opt out of forward compatibility for this service.
@@ -164,6 +354,222 @@ func _AuthService_RefreshToken_Handler(srv interface{}, ctx context.Context, dec
 	return interceptor(ctx, in, info, handler)
 }
 
+func _AuthService_GetMFAStatus_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetMFAStatusRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AuthServiceServer).GetMFAStatus(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AuthService_GetMFAStatus_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AuthServiceServer).GetMFAStatus(ctx, req.(*GetMFAStatusRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _AuthService_ActiveTOTP_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ActiveTOTPRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AuthServiceServer).ActiveTOTP(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AuthService_ActiveTOTP_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AuthServiceServer).ActiveTOTP(ctx, req.(*ActiveTOTPRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _AuthService_DisableTOTP_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DisableTOTPRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AuthServiceServer).DisableTOTP(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AuthService_DisableTOTP_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AuthServiceServer).DisableTOTP(ctx, req.(*DisableTOTPRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _AuthService_CheckTOTP_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CheckTOTPRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AuthServiceServer).CheckTOTP(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AuthService_CheckTOTP_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AuthServiceServer).CheckTOTP(ctx, req.(*CheckTOTPRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _AuthService_RecoverTOTP_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RecoverTOTPRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AuthServiceServer).RecoverTOTP(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AuthService_RecoverTOTP_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AuthServiceServer).RecoverTOTP(ctx, req.(*RecoverTOTPRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _AuthService_AddEmailMFA_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(AddEmailMFARequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AuthServiceServer).AddEmailMFA(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AuthService_AddEmailMFA_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AuthServiceServer).AddEmailMFA(ctx, req.(*AddEmailMFARequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _AuthService_ActivateEmailMFA_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ActivateEmailMFARequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AuthServiceServer).ActivateEmailMFA(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AuthService_ActivateEmailMFA_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AuthServiceServer).ActivateEmailMFA(ctx, req.(*ActivateEmailMFARequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _AuthService_SetPrimaryEmailMFA_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(SetPrimaryEmailMFARequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AuthServiceServer).SetPrimaryEmailMFA(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AuthService_SetPrimaryEmailMFA_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AuthServiceServer).SetPrimaryEmailMFA(ctx, req.(*SetPrimaryEmailMFARequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _AuthService_SendCodeEmailMFA_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(SendCodeEmailMFARequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AuthServiceServer).SendCodeEmailMFA(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AuthService_SendCodeEmailMFA_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AuthServiceServer).SendCodeEmailMFA(ctx, req.(*SendCodeEmailMFARequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _AuthService_CheckEmailMFA_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CheckEmailMFARequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AuthServiceServer).CheckEmailMFA(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AuthService_CheckEmailMFA_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AuthServiceServer).CheckEmailMFA(ctx, req.(*CheckEmailMFARequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _AuthService_DisableEmailMFA_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DisableEmailMFARequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AuthServiceServer).DisableEmailMFA(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AuthService_DisableEmailMFA_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AuthServiceServer).DisableEmailMFA(ctx, req.(*DisableEmailMFARequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _AuthService_GetAccountStatus_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetAccountStatusRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AuthServiceServer).GetAccountStatus(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AuthService_GetAccountStatus_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AuthServiceServer).GetAccountStatus(ctx, req.(*GetAccountStatusRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 // AuthService_ServiceDesc is the grpc.ServiceDesc for AuthService service.
 // It's only intended for direct use with grpc.RegisterService,
 // and not to be introspected or modified (even as a copy)
@@ -183,6 +589,54 @@ var AuthService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "RefreshToken",
 			Handler:    _AuthService_RefreshToken_Handler,
 		},
+		{
+			MethodName: "GetMFAStatus",
+			Handler:    _AuthService_GetMFAStatus_Handler,
+		},
+		{
+			MethodName: "ActiveTOTP",
+			Handler:    _AuthService_ActiveTOTP_Handler,
+		},
+		{
+			MethodName: "DisableTOTP",
+			Handler:    _AuthService_DisableTOTP_Handler,
+		},
+		{
+			MethodName: "CheckTOTP",
+			Handler:    _AuthService_CheckTOTP_Handler,
+		},
+		{
+			MethodName: "RecoverTOTP",
+			Handler:    _AuthService_RecoverTOTP_Handler,
+		},
+		{
+			MethodName: "AddEmailMFA",
+			Handler:    _AuthService_AddEmailMFA_Handler,
+		},
+		{
+			MethodName: "ActivateEmailMFA",
+			Handler:    _AuthService_ActivateEmailMFA_Handler,
+		},
+		{
+			MethodName: "SetPrimaryEmailMFA",
+			Handler:    _AuthService_SetPrimaryEmailMFA_Handler,
+		},
+		{
+			MethodName: "SendCodeEmailMFA",
+			Handler:    _AuthService_SendCodeEmailMFA_Handler,
+		},
+		{
+			MethodName: "CheckEmailMFA",
+			Handler:    _AuthService_CheckEmailMFA_Handler,
+		},
+		{
+			MethodName: "DisableEmailMFA",
+			Handler:    _AuthService_DisableEmailMFA_Handler,
+		},
+		{
+			MethodName: "GetAccountStatus",
+			Handler:    _AuthService_GetAccountStatus_Handler,
+		},
 	},
 	Streams:  []grpc.StreamDesc{},
 	Metadata: "auth/v1/auth_service.proto",
diff --git a/proto/auth/v1/auth_service.proto b/proto/auth/v1/auth_service.proto
index a916a33..276eb99 100644
--- a/proto/auth/v1/auth_service.proto
+++ b/proto/auth/v1/auth_service.proto
@@ -29,6 +29,92 @@ service AuthService {
       body: "*"
     };
   }
+
+  // 检查MFA状态，并返回MFA状态
+  rpc GetMFAStatus(GetMFAStatusRequest) returns (GetMFAStatusResponse) {
+    option (google.api.http) = {
+      post: "/gapi/auth/v1/mfa/status",
+      body: "*"
+    };
+  }
+
+  // TOTP
+  // 添加TOTP
+  rpc ActiveTOTP(ActiveTOTPRequest) returns (ActiveTOTPResponse) {
+    option (google.api.http) = {
+      post: "/gapi/auth/v1/mfa/totp/active",
+      body: "*"
+    };
+  }
+
+  rpc DisableTOTP(DisableTOTPRequest) returns (DisableTOTPResponse) {
+    option (google.api.http) = {
+      post: "/gapi/auth/v1/mfa/totp/disable",
+      body: "*"
+    };
+  }
+  rpc CheckTOTP(CheckTOTPRequest) returns (CheckTOTPResponse) {
+    option (google.api.http) = {
+      post: "/gapi/auth/v1/mfa/totp/check",
+      body: "*"
+    };
+  }
+  rpc RecoverTOTP(RecoverTOTPRequest) returns (RecoverTOTPResponse) {
+    option (google.api.http) = {
+      post: "/gapi/auth/v1/mfa/totp/recover",
+      body: "*"
+    };
+  }
+
+  // Email
+  rpc AddEmailMFA(AddEmailMFARequest) returns (AddEmailMFAResponse) {
+    option (google.api.http) = {
+      post: "/gapi/auth/v1/mfa/email/add",
+      body: "*"
+    };
+  }
+
+  rpc ActivateEmailMFA(ActivateEmailMFARequest) returns (ActivateEmailMFAResponse) {
+    option (google.api.http) = {
+      post: "/gapi/auth/v1/mfa/email/activate",
+      body: "*"
+    };
+  }
+
+  rpc SetPrimaryEmailMFA(SetPrimaryEmailMFARequest) returns (SetPrimaryEmailMFAResponse) {
+    option (google.api.http) = {
+        post: "/gapi/auth/v1/mfa/email/setPrimary",
+        body: "*"
+      };
+  }
+  rpc SendCodeEmailMFA(SendCodeEmailMFARequest) returns (SendCodeEmailMFAResponse) {
+    option (google.api.http) = {
+      post: "/gapi/auth/v1/mfa/email/send",
+      body: "*"
+    };
+  }
+
+  rpc CheckEmailMFA(CheckEmailMFARequest) returns (CheckEmailMFAResponse) {
+    option (google.api.http) = {
+      post: "/gapi/auth/v1/mfa/email/check",
+      body: "*"
+    };
+  }
+
+  rpc DisableEmailMFA(DisableEmailMFARequest) returns (DisableEmailMFAResponse) {
+    option (google.api.http) = {
+      post: "/gapi/auth/v1/mfa/email/disable",
+      body: "*"
+    };
+  }
+
+  // GetAccountStatus 获取sudo的ttl
+  rpc GetAccountStatus(GetAccountStatusRequest) returns (GetAccountStatusResponse) {
+    option (google.api.http) = {
+      post: "/gapi/auth/v1/account/status",
+      body: "*"
+    };
+  }
 }
 
 message RegisterRequest {
@@ -60,4 +146,87 @@ message RefreshTokenRequest {
 message RefreshTokenResponse {
   string access_token = 1;
   string refresh_token = 3;
+}
+
+message GetMFAStatusRequest {}
+
+// 为后期拓展可能做保留
+message GetMFAStatusResponse {
+  TOTPStatus totp_status = 1;
+  repeated EmailStatus email_status = 2;
+}
+
+message TOTPStatus {
+  bool is_active = 1;
+}
+
+message EmailStatus {
+  string email = 1;
+  bool   is_primary = 2;
+  bool   is_active = 3;
+}
+
+// TOTP
+message ActiveTOTPRequest{
+  string secret_key = 1;
+  string totp_code = 2;
+}
+message ActiveTOTPResponse{}
+
+message DisableTOTPRequest {
+  string totp_code = 1;
+}
+message DisableTOTPResponse {}
+
+message CheckTOTPRequest {
+  string totp_code = 1;
+}
+message CheckTOTPResponse {}
+
+message RecoverTOTPRequest {
+  repeated string recovery_code= 1;
+}
+
+message RecoverTOTPResponse {
+  string new_secret_key = 1;
+  repeated string new_recovery_code = 2;
+}
+
+// Email MFA
+message AddEmailMFARequest {
+  string email = 1;
+}
+message AddEmailMFAResponse {}
+
+message ActivateEmailMFARequest {
+  string email = 1;
+  string verification_code = 2;
+}
+message ActivateEmailMFAResponse {}
+
+message SetPrimaryEmailMFARequest {
+  string new_email = 1;
+  string old_email = 2;
+}
+message SetPrimaryEmailMFAResponse {}
+
+message SendCodeEmailMFARequest{
+  string email = 1;
+}
+message SendCodeEmailMFAResponse{}
+
+message CheckEmailMFARequest {
+  string email = 1;
+  string verification_code = 2;
+}
+message CheckEmailMFAResponse {}
+
+message DisableEmailMFARequest {
+  string email = 1;
+}
+message DisableEmailMFAResponse {}
+
+message GetAccountStatusRequest{}
+message GetAccountStatusResponse{
+  int64 sudo_ttl = 1;
 }
\ No newline at end of file