diff --git a/cmd/gateway/main.go b/cmd/gateway/main.go
index c97d405..2a7eaf2 100644
--- a/cmd/gateway/main.go
+++ b/cmd/gateway/main.go
@@ -3,6 +3,7 @@ package main
 import (
 	"flag"
 	"fmt"
+	"log"
 	"net/http"
 
 	"git.chrishayward.xyz/x/users/gateway"
diff --git a/proto/users.pb.go b/proto/users.pb.go
index 7a61cfc..a6d977c 100644
--- a/proto/users.pb.go
+++ b/proto/users.pb.go
@@ -185,6 +185,61 @@ func (x *UserInfo) GetId() int64 {
 	return 0
 }
 
+type UserRole struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Id   int64  `protobuf:"varint,1,opt,name=id,proto3" json:"id,omitempty"`
+	Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
+}
+
+func (x *UserRole) Reset() {
+	*x = UserRole{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_proto_users_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *UserRole) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UserRole) ProtoMessage() {}
+
+func (x *UserRole) ProtoReflect() protoreflect.Message {
+	mi := &file_proto_users_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UserRole.ProtoReflect.Descriptor instead.
+func (*UserRole) Descriptor() ([]byte, []int) {
+	return file_proto_users_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *UserRole) GetId() int64 {
+	if x != nil {
+		return x.Id
+	}
+	return 0
+}
+
+func (x *UserRole) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
 type RegisterRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -196,7 +251,7 @@ type RegisterRequest struct {
 func (x *RegisterRequest) Reset() {
 	*x = RegisterRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_proto_users_proto_msgTypes[3]
+		mi := &file_proto_users_proto_msgTypes[4]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -209,7 +264,7 @@ func (x *RegisterRequest) String() string {
 func (*RegisterRequest) ProtoMessage() {}
 
 func (x *RegisterRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_users_proto_msgTypes[3]
+	mi := &file_proto_users_proto_msgTypes[4]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -222,7 +277,7 @@ func (x *RegisterRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RegisterRequest.ProtoReflect.Descriptor instead.
 func (*RegisterRequest) Descriptor() ([]byte, []int) {
-	return file_proto_users_proto_rawDescGZIP(), []int{3}
+	return file_proto_users_proto_rawDescGZIP(), []int{4}
 }
 
 func (x *RegisterRequest) GetForm() *UserForm {
@@ -241,7 +296,7 @@ type RegisterResponse struct {
 func (x *RegisterResponse) Reset() {
 	*x = RegisterResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_proto_users_proto_msgTypes[4]
+		mi := &file_proto_users_proto_msgTypes[5]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -254,7 +309,7 @@ func (x *RegisterResponse) String() string {
 func (*RegisterResponse) ProtoMessage() {}
 
 func (x *RegisterResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_users_proto_msgTypes[4]
+	mi := &file_proto_users_proto_msgTypes[5]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -267,7 +322,7 @@ func (x *RegisterResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RegisterResponse.ProtoReflect.Descriptor instead.
 func (*RegisterResponse) Descriptor() ([]byte, []int) {
-	return file_proto_users_proto_rawDescGZIP(), []int{4}
+	return file_proto_users_proto_rawDescGZIP(), []int{5}
 }
 
 type LoginRequest struct {
@@ -281,7 +336,7 @@ type LoginRequest struct {
 func (x *LoginRequest) Reset() {
 	*x = LoginRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_proto_users_proto_msgTypes[5]
+		mi := &file_proto_users_proto_msgTypes[6]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -294,7 +349,7 @@ func (x *LoginRequest) String() string {
 func (*LoginRequest) ProtoMessage() {}
 
 func (x *LoginRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_users_proto_msgTypes[5]
+	mi := &file_proto_users_proto_msgTypes[6]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -307,7 +362,7 @@ func (x *LoginRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use LoginRequest.ProtoReflect.Descriptor instead.
 func (*LoginRequest) Descriptor() ([]byte, []int) {
-	return file_proto_users_proto_rawDescGZIP(), []int{5}
+	return file_proto_users_proto_rawDescGZIP(), []int{6}
 }
 
 func (x *LoginRequest) GetForm() *UserForm {
@@ -328,7 +383,7 @@ type LoginResponse struct {
 func (x *LoginResponse) Reset() {
 	*x = LoginResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_proto_users_proto_msgTypes[6]
+		mi := &file_proto_users_proto_msgTypes[7]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -341,7 +396,7 @@ func (x *LoginResponse) String() string {
 func (*LoginResponse) ProtoMessage() {}
 
 func (x *LoginResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_users_proto_msgTypes[6]
+	mi := &file_proto_users_proto_msgTypes[7]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -354,7 +409,7 @@ func (x *LoginResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use LoginResponse.ProtoReflect.Descriptor instead.
 func (*LoginResponse) Descriptor() ([]byte, []int) {
-	return file_proto_users_proto_rawDescGZIP(), []int{6}
+	return file_proto_users_proto_rawDescGZIP(), []int{7}
 }
 
 func (x *LoginResponse) GetToken() *UserToken {
@@ -376,7 +431,7 @@ type AuthorizeRequest struct {
 func (x *AuthorizeRequest) Reset() {
 	*x = AuthorizeRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_proto_users_proto_msgTypes[7]
+		mi := &file_proto_users_proto_msgTypes[8]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -389,7 +444,7 @@ func (x *AuthorizeRequest) String() string {
 func (*AuthorizeRequest) ProtoMessage() {}
 
 func (x *AuthorizeRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_users_proto_msgTypes[7]
+	mi := &file_proto_users_proto_msgTypes[8]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -402,7 +457,7 @@ func (x *AuthorizeRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AuthorizeRequest.ProtoReflect.Descriptor instead.
 func (*AuthorizeRequest) Descriptor() ([]byte, []int) {
-	return file_proto_users_proto_rawDescGZIP(), []int{7}
+	return file_proto_users_proto_rawDescGZIP(), []int{8}
 }
 
 func (x *AuthorizeRequest) GetSecret() string {
@@ -424,13 +479,14 @@ type AuthorizeResponse struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	User *UserInfo `protobuf:"bytes,1,opt,name=user,proto3" json:"user,omitempty"`
+	User  *UserInfo   `protobuf:"bytes,1,opt,name=user,proto3" json:"user,omitempty"`
+	Roles []*UserRole `protobuf:"bytes,2,rep,name=roles,proto3" json:"roles,omitempty"`
 }
 
 func (x *AuthorizeResponse) Reset() {
 	*x = AuthorizeResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_proto_users_proto_msgTypes[8]
+		mi := &file_proto_users_proto_msgTypes[9]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -443,7 +499,7 @@ func (x *AuthorizeResponse) String() string {
 func (*AuthorizeResponse) ProtoMessage() {}
 
 func (x *AuthorizeResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_users_proto_msgTypes[8]
+	mi := &file_proto_users_proto_msgTypes[9]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -456,7 +512,7 @@ func (x *AuthorizeResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AuthorizeResponse.ProtoReflect.Descriptor instead.
 func (*AuthorizeResponse) Descriptor() ([]byte, []int) {
-	return file_proto_users_proto_rawDescGZIP(), []int{8}
+	return file_proto_users_proto_rawDescGZIP(), []int{9}
 }
 
 func (x *AuthorizeResponse) GetUser() *UserInfo {
@@ -466,6 +522,13 @@ func (x *AuthorizeResponse) GetUser() *UserInfo {
 	return nil
 }
 
+func (x *AuthorizeResponse) GetRoles() []*UserRole {
+	if x != nil {
+		return x.Roles
+	}
+	return nil
+}
+
 type ResetPasswordRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -477,7 +540,7 @@ type ResetPasswordRequest struct {
 func (x *ResetPasswordRequest) Reset() {
 	*x = ResetPasswordRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_proto_users_proto_msgTypes[9]
+		mi := &file_proto_users_proto_msgTypes[10]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -490,7 +553,7 @@ func (x *ResetPasswordRequest) String() string {
 func (*ResetPasswordRequest) ProtoMessage() {}
 
 func (x *ResetPasswordRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_users_proto_msgTypes[9]
+	mi := &file_proto_users_proto_msgTypes[10]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -503,7 +566,7 @@ func (x *ResetPasswordRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ResetPasswordRequest.ProtoReflect.Descriptor instead.
 func (*ResetPasswordRequest) Descriptor() ([]byte, []int) {
-	return file_proto_users_proto_rawDescGZIP(), []int{9}
+	return file_proto_users_proto_rawDescGZIP(), []int{10}
 }
 
 func (x *ResetPasswordRequest) GetForm() *UserForm {
@@ -524,7 +587,7 @@ type ResetPasswordResponse struct {
 func (x *ResetPasswordResponse) Reset() {
 	*x = ResetPasswordResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_proto_users_proto_msgTypes[10]
+		mi := &file_proto_users_proto_msgTypes[11]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -537,7 +600,7 @@ func (x *ResetPasswordResponse) String() string {
 func (*ResetPasswordResponse) ProtoMessage() {}
 
 func (x *ResetPasswordResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_users_proto_msgTypes[10]
+	mi := &file_proto_users_proto_msgTypes[11]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -550,7 +613,7 @@ func (x *ResetPasswordResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ResetPasswordResponse.ProtoReflect.Descriptor instead.
 func (*ResetPasswordResponse) Descriptor() ([]byte, []int) {
-	return file_proto_users_proto_rawDescGZIP(), []int{10}
+	return file_proto_users_proto_rawDescGZIP(), []int{11}
 }
 
 func (x *ResetPasswordResponse) GetToken() *UserToken {
@@ -572,7 +635,7 @@ type ChangePasswordRequest struct {
 func (x *ChangePasswordRequest) Reset() {
 	*x = ChangePasswordRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_proto_users_proto_msgTypes[11]
+		mi := &file_proto_users_proto_msgTypes[12]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -585,7 +648,7 @@ func (x *ChangePasswordRequest) String() string {
 func (*ChangePasswordRequest) ProtoMessage() {}
 
 func (x *ChangePasswordRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_users_proto_msgTypes[11]
+	mi := &file_proto_users_proto_msgTypes[12]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -598,7 +661,7 @@ func (x *ChangePasswordRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ChangePasswordRequest.ProtoReflect.Descriptor instead.
 func (*ChangePasswordRequest) Descriptor() ([]byte, []int) {
-	return file_proto_users_proto_rawDescGZIP(), []int{11}
+	return file_proto_users_proto_rawDescGZIP(), []int{12}
 }
 
 func (x *ChangePasswordRequest) GetToken() *UserToken {
@@ -624,7 +687,7 @@ type ChangePasswordResponse struct {
 func (x *ChangePasswordResponse) Reset() {
 	*x = ChangePasswordResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_proto_users_proto_msgTypes[12]
+		mi := &file_proto_users_proto_msgTypes[13]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -637,7 +700,7 @@ func (x *ChangePasswordResponse) String() string {
 func (*ChangePasswordResponse) ProtoMessage() {}
 
 func (x *ChangePasswordResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_proto_users_proto_msgTypes[12]
+	mi := &file_proto_users_proto_msgTypes[13]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -650,7 +713,202 @@ func (x *ChangePasswordResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ChangePasswordResponse.ProtoReflect.Descriptor instead.
 func (*ChangePasswordResponse) Descriptor() ([]byte, []int) {
-	return file_proto_users_proto_rawDescGZIP(), []int{12}
+	return file_proto_users_proto_rawDescGZIP(), []int{13}
+}
+
+type ListRolesRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Secret string `protobuf:"bytes,1,opt,name=secret,proto3" json:"secret,omitempty"`
+}
+
+func (x *ListRolesRequest) Reset() {
+	*x = ListRolesRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_proto_users_proto_msgTypes[14]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ListRolesRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListRolesRequest) ProtoMessage() {}
+
+func (x *ListRolesRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_proto_users_proto_msgTypes[14]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListRolesRequest.ProtoReflect.Descriptor instead.
+func (*ListRolesRequest) Descriptor() ([]byte, []int) {
+	return file_proto_users_proto_rawDescGZIP(), []int{14}
+}
+
+func (x *ListRolesRequest) GetSecret() string {
+	if x != nil {
+		return x.Secret
+	}
+	return ""
+}
+
+type ListRolesResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Roles []*UserRole `protobuf:"bytes,2,rep,name=roles,proto3" json:"roles,omitempty"`
+}
+
+func (x *ListRolesResponse) Reset() {
+	*x = ListRolesResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_proto_users_proto_msgTypes[15]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ListRolesResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListRolesResponse) ProtoMessage() {}
+
+func (x *ListRolesResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_proto_users_proto_msgTypes[15]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListRolesResponse.ProtoReflect.Descriptor instead.
+func (*ListRolesResponse) Descriptor() ([]byte, []int) {
+	return file_proto_users_proto_rawDescGZIP(), []int{15}
+}
+
+func (x *ListRolesResponse) GetRoles() []*UserRole {
+	if x != nil {
+		return x.Roles
+	}
+	return nil
+}
+
+type SetRolesRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Secret string      `protobuf:"bytes,1,opt,name=secret,proto3" json:"secret,omitempty"`
+	User   *UserInfo   `protobuf:"bytes,2,opt,name=user,proto3" json:"user,omitempty"`
+	Roles  []*UserRole `protobuf:"bytes,3,rep,name=roles,proto3" json:"roles,omitempty"`
+}
+
+func (x *SetRolesRequest) Reset() {
+	*x = SetRolesRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_proto_users_proto_msgTypes[16]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SetRolesRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SetRolesRequest) ProtoMessage() {}
+
+func (x *SetRolesRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_proto_users_proto_msgTypes[16]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SetRolesRequest.ProtoReflect.Descriptor instead.
+func (*SetRolesRequest) Descriptor() ([]byte, []int) {
+	return file_proto_users_proto_rawDescGZIP(), []int{16}
+}
+
+func (x *SetRolesRequest) GetSecret() string {
+	if x != nil {
+		return x.Secret
+	}
+	return ""
+}
+
+func (x *SetRolesRequest) GetUser() *UserInfo {
+	if x != nil {
+		return x.User
+	}
+	return nil
+}
+
+func (x *SetRolesRequest) GetRoles() []*UserRole {
+	if x != nil {
+		return x.Roles
+	}
+	return nil
+}
+
+type SetRolesResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *SetRolesResponse) Reset() {
+	*x = SetRolesResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_proto_users_proto_msgTypes[17]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SetRolesResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SetRolesResponse) ProtoMessage() {}
+
+func (x *SetRolesResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_proto_users_proto_msgTypes[17]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SetRolesResponse.ProtoReflect.Descriptor instead.
+func (*SetRolesResponse) Descriptor() ([]byte, []int) {
+	return file_proto_users_proto_rawDescGZIP(), []int{17}
 }
 
 var File_proto_users_proto protoreflect.FileDescriptor
@@ -673,7 +931,10 @@ var file_proto_users_proto_rawDesc = []byte{
 	0x52, 0x07, 0x65, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x88, 0x01, 0x01, 0x42, 0x0a, 0x0a, 0x08,
 	0x5f, 0x65, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x22, 0x1a, 0x0a, 0x08, 0x55, 0x73, 0x65, 0x72,
 	0x49, 0x6e, 0x66, 0x6f, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x03,
-	0x52, 0x02, 0x69, 0x64, 0x22, 0x36, 0x0a, 0x0f, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72,
+	0x52, 0x02, 0x69, 0x64, 0x22, 0x2e, 0x0a, 0x08, 0x55, 0x73, 0x65, 0x72, 0x52, 0x6f, 0x6c, 0x65,
+	0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x03, 0x52, 0x02, 0x69, 0x64,
+	0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04,
+	0x6e, 0x61, 0x6d, 0x65, 0x22, 0x36, 0x0a, 0x0f, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72,
 	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x23, 0x0a, 0x04, 0x66, 0x6f, 0x72, 0x6d, 0x18,
 	0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0f, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x73, 0x2e, 0x55, 0x73,
 	0x65, 0x72, 0x46, 0x6f, 0x72, 0x6d, 0x52, 0x04, 0x66, 0x6f, 0x72, 0x6d, 0x22, 0x12, 0x0a, 0x10,
@@ -690,51 +951,77 @@ var file_proto_users_proto_rawDesc = []byte{
 	0x28, 0x09, 0x52, 0x06, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x12, 0x26, 0x0a, 0x05, 0x74, 0x6f,
 	0x6b, 0x65, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x75, 0x73, 0x65, 0x72,
 	0x73, 0x2e, 0x55, 0x73, 0x65, 0x72, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x52, 0x05, 0x74, 0x6f, 0x6b,
-	0x65, 0x6e, 0x22, 0x38, 0x0a, 0x11, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x52,
+	0x65, 0x6e, 0x22, 0x5f, 0x0a, 0x11, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x52,
 	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x23, 0x0a, 0x04, 0x75, 0x73, 0x65, 0x72, 0x18,
 	0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0f, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x73, 0x2e, 0x55, 0x73,
-	0x65, 0x72, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x04, 0x75, 0x73, 0x65, 0x72, 0x22, 0x3b, 0x0a, 0x14,
-	0x52, 0x65, 0x73, 0x65, 0x74, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x12, 0x23, 0x0a, 0x04, 0x66, 0x6f, 0x72, 0x6d, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x0f, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x73, 0x2e, 0x55, 0x73, 0x65, 0x72, 0x46,
-	0x6f, 0x72, 0x6d, 0x52, 0x04, 0x66, 0x6f, 0x72, 0x6d, 0x22, 0x3f, 0x0a, 0x15, 0x52, 0x65, 0x73,
-	0x65, 0x74, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
-	0x73, 0x65, 0x12, 0x26, 0x0a, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x10, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x73, 0x2e, 0x55, 0x73, 0x65, 0x72, 0x54, 0x6f,
-	0x6b, 0x65, 0x6e, 0x52, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x22, 0x64, 0x0a, 0x15, 0x43, 0x68,
-	0x61, 0x6e, 0x67, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x12, 0x26, 0x0a, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x10, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x73, 0x2e, 0x55, 0x73, 0x65, 0x72, 0x54,
-	0x6f, 0x6b, 0x65, 0x6e, 0x52, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x23, 0x0a, 0x04, 0x66,
-	0x6f, 0x72, 0x6d, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0f, 0x2e, 0x75, 0x73, 0x65, 0x72,
+	0x65, 0x72, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x04, 0x75, 0x73, 0x65, 0x72, 0x12, 0x25, 0x0a, 0x05,
+	0x72, 0x6f, 0x6c, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0f, 0x2e, 0x75, 0x73,
+	0x65, 0x72, 0x73, 0x2e, 0x55, 0x73, 0x65, 0x72, 0x52, 0x6f, 0x6c, 0x65, 0x52, 0x05, 0x72, 0x6f,
+	0x6c, 0x65, 0x73, 0x22, 0x3b, 0x0a, 0x14, 0x52, 0x65, 0x73, 0x65, 0x74, 0x50, 0x61, 0x73, 0x73,
+	0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x23, 0x0a, 0x04, 0x66,
+	0x6f, 0x72, 0x6d, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0f, 0x2e, 0x75, 0x73, 0x65, 0x72,
 	0x73, 0x2e, 0x55, 0x73, 0x65, 0x72, 0x46, 0x6f, 0x72, 0x6d, 0x52, 0x04, 0x66, 0x6f, 0x72, 0x6d,
-	0x22, 0x18, 0x0a, 0x16, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f,
-	0x72, 0x64, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x32, 0xdd, 0x02, 0x0a, 0x05, 0x55,
-	0x73, 0x65, 0x72, 0x73, 0x12, 0x3d, 0x0a, 0x08, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72,
-	0x12, 0x16, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x73, 0x2e, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65,
-	0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x17, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x73,
-	0x2e, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x22, 0x00, 0x12, 0x34, 0x0a, 0x05, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x12, 0x13, 0x2e, 0x75,
-	0x73, 0x65, 0x72, 0x73, 0x2e, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x1a, 0x14, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x73, 0x2e, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x52,
-	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x40, 0x0a, 0x09, 0x41, 0x75, 0x74,
-	0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x12, 0x17, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x73, 0x2e, 0x41,
-	0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
-	0x18, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x73, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a,
-	0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x4c, 0x0a, 0x0d, 0x52,
-	0x65, 0x73, 0x65, 0x74, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x1b, 0x2e, 0x75,
-	0x73, 0x65, 0x72, 0x73, 0x2e, 0x52, 0x65, 0x73, 0x65, 0x74, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f,
-	0x72, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1c, 0x2e, 0x75, 0x73, 0x65, 0x72,
-	0x73, 0x2e, 0x52, 0x65, 0x73, 0x65, 0x74, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52,
-	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x4f, 0x0a, 0x0e, 0x43, 0x68, 0x61,
-	0x6e, 0x67, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x1c, 0x2e, 0x75, 0x73,
-	0x65, 0x72, 0x73, 0x2e, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f,
-	0x72, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1d, 0x2e, 0x75, 0x73, 0x65, 0x72,
-	0x73, 0x2e, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x42, 0x24, 0x5a, 0x22, 0x67, 0x69,
-	0x74, 0x2e, 0x63, 0x68, 0x72, 0x69, 0x73, 0x68, 0x61, 0x79, 0x77, 0x61, 0x72, 0x64, 0x2e, 0x78,
-	0x79, 0x7a, 0x2f, 0x78, 0x2f, 0x75, 0x73, 0x65, 0x72, 0x73, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x22, 0x3f, 0x0a, 0x15, 0x52, 0x65, 0x73, 0x65, 0x74, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72,
+	0x64, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x05, 0x74, 0x6f, 0x6b,
+	0x65, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x73,
+	0x2e, 0x55, 0x73, 0x65, 0x72, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x52, 0x05, 0x74, 0x6f, 0x6b, 0x65,
+	0x6e, 0x22, 0x64, 0x0a, 0x15, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77,
+	0x6f, 0x72, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x26, 0x0a, 0x05, 0x74, 0x6f,
+	0x6b, 0x65, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x75, 0x73, 0x65, 0x72,
+	0x73, 0x2e, 0x55, 0x73, 0x65, 0x72, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x52, 0x05, 0x74, 0x6f, 0x6b,
+	0x65, 0x6e, 0x12, 0x23, 0x0a, 0x04, 0x66, 0x6f, 0x72, 0x6d, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x0f, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x73, 0x2e, 0x55, 0x73, 0x65, 0x72, 0x46, 0x6f, 0x72,
+	0x6d, 0x52, 0x04, 0x66, 0x6f, 0x72, 0x6d, 0x22, 0x18, 0x0a, 0x16, 0x43, 0x68, 0x61, 0x6e, 0x67,
+	0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x22, 0x2a, 0x0a, 0x10, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x6f, 0x6c, 0x65, 0x73, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x22, 0x3a, 0x0a,
+	0x11, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x6f, 0x6c, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x12, 0x25, 0x0a, 0x05, 0x72, 0x6f, 0x6c, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x0f, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x73, 0x2e, 0x55, 0x73, 0x65, 0x72, 0x52, 0x6f,
+	0x6c, 0x65, 0x52, 0x05, 0x72, 0x6f, 0x6c, 0x65, 0x73, 0x22, 0x75, 0x0a, 0x0f, 0x53, 0x65, 0x74,
+	0x52, 0x6f, 0x6c, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x16, 0x0a, 0x06,
+	0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x73, 0x65,
+	0x63, 0x72, 0x65, 0x74, 0x12, 0x23, 0x0a, 0x04, 0x75, 0x73, 0x65, 0x72, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x0f, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x73, 0x2e, 0x55, 0x73, 0x65, 0x72, 0x49,
+	0x6e, 0x66, 0x6f, 0x52, 0x04, 0x75, 0x73, 0x65, 0x72, 0x12, 0x25, 0x0a, 0x05, 0x72, 0x6f, 0x6c,
+	0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0f, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x73,
+	0x2e, 0x55, 0x73, 0x65, 0x72, 0x52, 0x6f, 0x6c, 0x65, 0x52, 0x05, 0x72, 0x6f, 0x6c, 0x65, 0x73,
+	0x22, 0x12, 0x0a, 0x10, 0x53, 0x65, 0x74, 0x52, 0x6f, 0x6c, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x32, 0xde, 0x03, 0x0a, 0x05, 0x55, 0x73, 0x65, 0x72, 0x73, 0x12, 0x3d,
+	0x0a, 0x08, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x12, 0x16, 0x2e, 0x75, 0x73, 0x65,
+	0x72, 0x73, 0x2e, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0x17, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x73, 0x2e, 0x52, 0x65, 0x67, 0x69, 0x73,
+	0x74, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x34, 0x0a,
+	0x05, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x12, 0x13, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x73, 0x2e, 0x4c,
+	0x6f, 0x67, 0x69, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x14, 0x2e, 0x75, 0x73,
+	0x65, 0x72, 0x73, 0x2e, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x22, 0x00, 0x12, 0x40, 0x0a, 0x09, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65,
+	0x12, 0x17, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x73, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69,
+	0x7a, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x18, 0x2e, 0x75, 0x73, 0x65, 0x72,
+	0x73, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x4c, 0x0a, 0x0d, 0x52, 0x65, 0x73, 0x65, 0x74, 0x50, 0x61,
+	0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x1b, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x73, 0x2e, 0x52,
+	0x65, 0x73, 0x65, 0x74, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x1a, 0x1c, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x73, 0x2e, 0x52, 0x65, 0x73, 0x65,
+	0x74, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x22, 0x00, 0x12, 0x4f, 0x0a, 0x0e, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x50, 0x61, 0x73,
+	0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x1c, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x73, 0x2e, 0x43, 0x68,
+	0x61, 0x6e, 0x67, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x1a, 0x1d, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x73, 0x2e, 0x43, 0x68, 0x61, 0x6e,
+	0x67, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x22, 0x00, 0x12, 0x40, 0x0a, 0x09, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x6f, 0x6c, 0x65,
+	0x73, 0x12, 0x17, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x73, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x6f,
+	0x6c, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x18, 0x2e, 0x75, 0x73, 0x65,
+	0x72, 0x73, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x6f, 0x6c, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x3d, 0x0a, 0x08, 0x53, 0x65, 0x74, 0x52, 0x6f, 0x6c,
+	0x65, 0x73, 0x12, 0x16, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x73, 0x2e, 0x53, 0x65, 0x74, 0x52, 0x6f,
+	0x6c, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x17, 0x2e, 0x75, 0x73, 0x65,
+	0x72, 0x73, 0x2e, 0x53, 0x65, 0x74, 0x52, 0x6f, 0x6c, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x22, 0x00, 0x42, 0x24, 0x5a, 0x22, 0x67, 0x69, 0x74, 0x2e, 0x63, 0x68, 0x72,
+	0x69, 0x73, 0x68, 0x61, 0x79, 0x77, 0x61, 0x72, 0x64, 0x2e, 0x78, 0x79, 0x7a, 0x2f, 0x78, 0x2f,
+	0x75, 0x73, 0x65, 0x72, 0x73, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x33,
 }
 
 var (
@@ -749,21 +1036,26 @@ func file_proto_users_proto_rawDescGZIP() []byte {
 	return file_proto_users_proto_rawDescData
 }
 
-var file_proto_users_proto_msgTypes = make([]protoimpl.MessageInfo, 13)
+var file_proto_users_proto_msgTypes = make([]protoimpl.MessageInfo, 18)
 var file_proto_users_proto_goTypes = []interface{}{
 	(*UserForm)(nil),               // 0: users.UserForm
 	(*UserToken)(nil),              // 1: users.UserToken
 	(*UserInfo)(nil),               // 2: users.UserInfo
-	(*RegisterRequest)(nil),        // 3: users.RegisterRequest
-	(*RegisterResponse)(nil),       // 4: users.RegisterResponse
-	(*LoginRequest)(nil),           // 5: users.LoginRequest
-	(*LoginResponse)(nil),          // 6: users.LoginResponse
-	(*AuthorizeRequest)(nil),       // 7: users.AuthorizeRequest
-	(*AuthorizeResponse)(nil),      // 8: users.AuthorizeResponse
-	(*ResetPasswordRequest)(nil),   // 9: users.ResetPasswordRequest
-	(*ResetPasswordResponse)(nil),  // 10: users.ResetPasswordResponse
-	(*ChangePasswordRequest)(nil),  // 11: users.ChangePasswordRequest
-	(*ChangePasswordResponse)(nil), // 12: users.ChangePasswordResponse
+	(*UserRole)(nil),               // 3: users.UserRole
+	(*RegisterRequest)(nil),        // 4: users.RegisterRequest
+	(*RegisterResponse)(nil),       // 5: users.RegisterResponse
+	(*LoginRequest)(nil),           // 6: users.LoginRequest
+	(*LoginResponse)(nil),          // 7: users.LoginResponse
+	(*AuthorizeRequest)(nil),       // 8: users.AuthorizeRequest
+	(*AuthorizeResponse)(nil),      // 9: users.AuthorizeResponse
+	(*ResetPasswordRequest)(nil),   // 10: users.ResetPasswordRequest
+	(*ResetPasswordResponse)(nil),  // 11: users.ResetPasswordResponse
+	(*ChangePasswordRequest)(nil),  // 12: users.ChangePasswordRequest
+	(*ChangePasswordResponse)(nil), // 13: users.ChangePasswordResponse
+	(*ListRolesRequest)(nil),       // 14: users.ListRolesRequest
+	(*ListRolesResponse)(nil),      // 15: users.ListRolesResponse
+	(*SetRolesRequest)(nil),        // 16: users.SetRolesRequest
+	(*SetRolesResponse)(nil),       // 17: users.SetRolesResponse
 }
 var file_proto_users_proto_depIdxs = []int32{
 	0,  // 0: users.RegisterRequest.form:type_name -> users.UserForm
@@ -771,25 +1063,33 @@ var file_proto_users_proto_depIdxs = []int32{
 	1,  // 2: users.LoginResponse.token:type_name -> users.UserToken
 	1,  // 3: users.AuthorizeRequest.token:type_name -> users.UserToken
 	2,  // 4: users.AuthorizeResponse.user:type_name -> users.UserInfo
-	0,  // 5: users.ResetPasswordRequest.form:type_name -> users.UserForm
-	1,  // 6: users.ResetPasswordResponse.token:type_name -> users.UserToken
-	1,  // 7: users.ChangePasswordRequest.token:type_name -> users.UserToken
-	0,  // 8: users.ChangePasswordRequest.form:type_name -> users.UserForm
-	3,  // 9: users.Users.Register:input_type -> users.RegisterRequest
-	5,  // 10: users.Users.Login:input_type -> users.LoginRequest
-	7,  // 11: users.Users.Authorize:input_type -> users.AuthorizeRequest
-	9,  // 12: users.Users.ResetPassword:input_type -> users.ResetPasswordRequest
-	11, // 13: users.Users.ChangePassword:input_type -> users.ChangePasswordRequest
-	4,  // 14: users.Users.Register:output_type -> users.RegisterResponse
-	6,  // 15: users.Users.Login:output_type -> users.LoginResponse
-	8,  // 16: users.Users.Authorize:output_type -> users.AuthorizeResponse
-	10, // 17: users.Users.ResetPassword:output_type -> users.ResetPasswordResponse
-	12, // 18: users.Users.ChangePassword:output_type -> users.ChangePasswordResponse
-	14, // [14:19] is the sub-list for method output_type
-	9,  // [9:14] is the sub-list for method input_type
-	9,  // [9:9] is the sub-list for extension type_name
-	9,  // [9:9] is the sub-list for extension extendee
-	0,  // [0:9] is the sub-list for field type_name
+	3,  // 5: users.AuthorizeResponse.roles:type_name -> users.UserRole
+	0,  // 6: users.ResetPasswordRequest.form:type_name -> users.UserForm
+	1,  // 7: users.ResetPasswordResponse.token:type_name -> users.UserToken
+	1,  // 8: users.ChangePasswordRequest.token:type_name -> users.UserToken
+	0,  // 9: users.ChangePasswordRequest.form:type_name -> users.UserForm
+	3,  // 10: users.ListRolesResponse.roles:type_name -> users.UserRole
+	2,  // 11: users.SetRolesRequest.user:type_name -> users.UserInfo
+	3,  // 12: users.SetRolesRequest.roles:type_name -> users.UserRole
+	4,  // 13: users.Users.Register:input_type -> users.RegisterRequest
+	6,  // 14: users.Users.Login:input_type -> users.LoginRequest
+	8,  // 15: users.Users.Authorize:input_type -> users.AuthorizeRequest
+	10, // 16: users.Users.ResetPassword:input_type -> users.ResetPasswordRequest
+	12, // 17: users.Users.ChangePassword:input_type -> users.ChangePasswordRequest
+	14, // 18: users.Users.ListRoles:input_type -> users.ListRolesRequest
+	16, // 19: users.Users.SetRoles:input_type -> users.SetRolesRequest
+	5,  // 20: users.Users.Register:output_type -> users.RegisterResponse
+	7,  // 21: users.Users.Login:output_type -> users.LoginResponse
+	9,  // 22: users.Users.Authorize:output_type -> users.AuthorizeResponse
+	11, // 23: users.Users.ResetPassword:output_type -> users.ResetPasswordResponse
+	13, // 24: users.Users.ChangePassword:output_type -> users.ChangePasswordResponse
+	15, // 25: users.Users.ListRoles:output_type -> users.ListRolesResponse
+	17, // 26: users.Users.SetRoles:output_type -> users.SetRolesResponse
+	20, // [20:27] is the sub-list for method output_type
+	13, // [13:20] is the sub-list for method input_type
+	13, // [13:13] is the sub-list for extension type_name
+	13, // [13:13] is the sub-list for extension extendee
+	0,  // [0:13] is the sub-list for field type_name
 }
 
 func init() { file_proto_users_proto_init() }
@@ -835,7 +1135,7 @@ func file_proto_users_proto_init() {
 			}
 		}
 		file_proto_users_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RegisterRequest); i {
+			switch v := v.(*UserRole); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -847,7 +1147,7 @@ func file_proto_users_proto_init() {
 			}
 		}
 		file_proto_users_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RegisterResponse); i {
+			switch v := v.(*RegisterRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -859,7 +1159,7 @@ func file_proto_users_proto_init() {
 			}
 		}
 		file_proto_users_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*LoginRequest); i {
+			switch v := v.(*RegisterResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -871,7 +1171,7 @@ func file_proto_users_proto_init() {
 			}
 		}
 		file_proto_users_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*LoginResponse); i {
+			switch v := v.(*LoginRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -883,7 +1183,7 @@ func file_proto_users_proto_init() {
 			}
 		}
 		file_proto_users_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*AuthorizeRequest); i {
+			switch v := v.(*LoginResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -895,7 +1195,7 @@ func file_proto_users_proto_init() {
 			}
 		}
 		file_proto_users_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*AuthorizeResponse); i {
+			switch v := v.(*AuthorizeRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -907,7 +1207,7 @@ func file_proto_users_proto_init() {
 			}
 		}
 		file_proto_users_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ResetPasswordRequest); i {
+			switch v := v.(*AuthorizeResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -919,7 +1219,7 @@ func file_proto_users_proto_init() {
 			}
 		}
 		file_proto_users_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ResetPasswordResponse); i {
+			switch v := v.(*ResetPasswordRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -931,7 +1231,7 @@ func file_proto_users_proto_init() {
 			}
 		}
 		file_proto_users_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ChangePasswordRequest); i {
+			switch v := v.(*ResetPasswordResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -943,6 +1243,18 @@ func file_proto_users_proto_init() {
 			}
 		}
 		file_proto_users_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ChangePasswordRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_proto_users_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*ChangePasswordResponse); i {
 			case 0:
 				return &v.state
@@ -954,6 +1266,54 @@ func file_proto_users_proto_init() {
 				return nil
 			}
 		}
+		file_proto_users_proto_msgTypes[14].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ListRolesRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_proto_users_proto_msgTypes[15].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ListRolesResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_proto_users_proto_msgTypes[16].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SetRolesRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_proto_users_proto_msgTypes[17].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SetRolesResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
 	}
 	file_proto_users_proto_msgTypes[0].OneofWrappers = []interface{}{}
 	file_proto_users_proto_msgTypes[1].OneofWrappers = []interface{}{}
@@ -963,7 +1323,7 @@ func file_proto_users_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_proto_users_proto_rawDesc,
 			NumEnums:      0,
-			NumMessages:   13,
+			NumMessages:   18,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/proto/users.proto b/proto/users.proto
index 62504ae..837e517 100644
--- a/proto/users.proto
+++ b/proto/users.proto
@@ -10,6 +10,8 @@ service Users {
   rpc Authorize (AuthorizeRequest) returns (AuthorizeResponse) {}
   rpc ResetPassword (ResetPasswordRequest) returns (ResetPasswordResponse) {}
   rpc ChangePassword (ChangePasswordRequest) returns (ChangePasswordResponse) {}
+  rpc ListRoles (ListRolesRequest) returns (ListRolesResponse) {}
+  rpc SetRoles (SetRolesRequest) returns (SetRolesResponse) {}
 }
 
 message UserForm {
@@ -27,6 +29,11 @@ message UserInfo {
   int64 id = 1;
 }
 
+message UserRole {
+  int64 id = 1;
+  string name = 2;
+}
+
 message RegisterRequest {
   UserForm form = 1;
 }
@@ -50,6 +57,7 @@ message AuthorizeRequest {
 
 message AuthorizeResponse {
   UserInfo user = 1;
+  repeated UserRole roles = 2;
 }
 
 message ResetPasswordRequest {
@@ -68,3 +76,21 @@ message ChangePasswordRequest {
 message ChangePasswordResponse {
   
 }
+
+message ListRolesRequest {
+  string secret = 1;
+}
+
+message ListRolesResponse {
+  repeated UserRole roles = 2;
+}
+
+message SetRolesRequest {
+  string secret = 1;
+  UserInfo user = 2;
+  repeated UserRole roles = 3;
+}
+
+message SetRolesResponse {
+
+}
diff --git a/proto/users_grpc.pb.go b/proto/users_grpc.pb.go
index daabf99..2ed2835 100644
--- a/proto/users_grpc.pb.go
+++ b/proto/users_grpc.pb.go
@@ -24,6 +24,8 @@ const (
 	Users_Authorize_FullMethodName      = "/users.Users/Authorize"
 	Users_ResetPassword_FullMethodName  = "/users.Users/ResetPassword"
 	Users_ChangePassword_FullMethodName = "/users.Users/ChangePassword"
+	Users_ListRoles_FullMethodName      = "/users.Users/ListRoles"
+	Users_SetRoles_FullMethodName       = "/users.Users/SetRoles"
 )
 
 // UsersClient is the client API for Users service.
@@ -35,6 +37,8 @@ type UsersClient interface {
 	Authorize(ctx context.Context, in *AuthorizeRequest, opts ...grpc.CallOption) (*AuthorizeResponse, error)
 	ResetPassword(ctx context.Context, in *ResetPasswordRequest, opts ...grpc.CallOption) (*ResetPasswordResponse, error)
 	ChangePassword(ctx context.Context, in *ChangePasswordRequest, opts ...grpc.CallOption) (*ChangePasswordResponse, error)
+	ListRoles(ctx context.Context, in *ListRolesRequest, opts ...grpc.CallOption) (*ListRolesResponse, error)
+	SetRoles(ctx context.Context, in *SetRolesRequest, opts ...grpc.CallOption) (*SetRolesResponse, error)
 }
 
 type usersClient struct {
@@ -90,6 +94,24 @@ func (c *usersClient) ChangePassword(ctx context.Context, in *ChangePasswordRequ
 	return out, nil
 }
 
+func (c *usersClient) ListRoles(ctx context.Context, in *ListRolesRequest, opts ...grpc.CallOption) (*ListRolesResponse, error) {
+	out := new(ListRolesResponse)
+	err := c.cc.Invoke(ctx, Users_ListRoles_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *usersClient) SetRoles(ctx context.Context, in *SetRolesRequest, opts ...grpc.CallOption) (*SetRolesResponse, error) {
+	out := new(SetRolesResponse)
+	err := c.cc.Invoke(ctx, Users_SetRoles_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 // UsersServer is the server API for Users service.
 // All implementations must embed UnimplementedUsersServer
 // for forward compatibility
@@ -99,6 +121,8 @@ type UsersServer interface {
 	Authorize(context.Context, *AuthorizeRequest) (*AuthorizeResponse, error)
 	ResetPassword(context.Context, *ResetPasswordRequest) (*ResetPasswordResponse, error)
 	ChangePassword(context.Context, *ChangePasswordRequest) (*ChangePasswordResponse, error)
+	ListRoles(context.Context, *ListRolesRequest) (*ListRolesResponse, error)
+	SetRoles(context.Context, *SetRolesRequest) (*SetRolesResponse, error)
 	mustEmbedUnimplementedUsersServer()
 }
 
@@ -121,6 +145,12 @@ func (UnimplementedUsersServer) ResetPassword(context.Context, *ResetPasswordReq
 func (UnimplementedUsersServer) ChangePassword(context.Context, *ChangePasswordRequest) (*ChangePasswordResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method ChangePassword not implemented")
 }
+func (UnimplementedUsersServer) ListRoles(context.Context, *ListRolesRequest) (*ListRolesResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListRoles not implemented")
+}
+func (UnimplementedUsersServer) SetRoles(context.Context, *SetRolesRequest) (*SetRolesResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method SetRoles not implemented")
+}
 func (UnimplementedUsersServer) mustEmbedUnimplementedUsersServer() {}
 
 // UnsafeUsersServer may be embedded to opt out of forward compatibility for this service.
@@ -224,6 +254,42 @@ func _Users_ChangePassword_Handler(srv interface{}, ctx context.Context, dec fun
 	return interceptor(ctx, in, info, handler)
 }
 
+func _Users_ListRoles_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListRolesRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(UsersServer).ListRoles(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Users_ListRoles_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(UsersServer).ListRoles(ctx, req.(*ListRolesRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Users_SetRoles_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(SetRolesRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(UsersServer).SetRoles(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Users_SetRoles_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(UsersServer).SetRoles(ctx, req.(*SetRolesRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 // Users_ServiceDesc is the grpc.ServiceDesc for Users service.
 // It's only intended for direct use with grpc.RegisterService,
 // and not to be introspected or modified (even as a copy)
@@ -251,6 +317,14 @@ var Users_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "ChangePassword",
 			Handler:    _Users_ChangePassword_Handler,
 		},
+		{
+			MethodName: "ListRoles",
+			Handler:    _Users_ListRoles_Handler,
+		},
+		{
+			MethodName: "SetRoles",
+			Handler:    _Users_SetRoles_Handler,
+		},
 	},
 	Streams:  []grpc.StreamDesc{},
 	Metadata: "proto/users.proto",
diff --git a/server/models/role.go b/server/models/role.go
new file mode 100644
index 0000000..907af43
--- /dev/null
+++ b/server/models/role.go
@@ -0,0 +1,9 @@
+package models
+
+import "gorm.io/gorm"
+
+type Role struct {
+	gorm.Model
+	Name  string
+	Users []User
+}
diff --git a/server/models/user.go b/server/models/user.go
index 96612ce..91562f4 100644
--- a/server/models/user.go
+++ b/server/models/user.go
@@ -6,5 +6,6 @@ type User struct {
 	gorm.Model
 	Email    string
 	Password string
+	Roles    []Role
 	Sessions []Session
 }
diff --git a/server/server.go b/server/server.go
index 3c9d124..07739a9 100644
--- a/server/server.go
+++ b/server/server.go
@@ -21,7 +21,7 @@ type usersServer struct {
 }
 
 func NewUsersServer(secret *string, db *gorm.DB) proto.UsersServer {
-	db.AutoMigrate(&models.User{}, &models.Session{}, &models.PasswordToken{})
+	db.AutoMigrate(&models.User{}, &models.Role{}, &models.Session{}, &models.PasswordToken{})
 	return &usersServer{
 		secret: secret,
 		db:     db,
@@ -39,8 +39,8 @@ func (m *usersServer) Register(ctx context.Context, in *proto.RegisterRequest) (
 	}
 
 	// Check for an existing user.
-	var user models.User
-	tx := m.db.First(&user, "email = ?", in.Form.Email)
+	var u models.User
+	tx := m.db.First(&u, "email = ?", in.Form.Email)
 	if tx.RowsAffected != 0 {
 		return nil, errors.New("User already exists.")
 	}
@@ -53,9 +53,9 @@ func (m *usersServer) Register(ctx context.Context, in *proto.RegisterRequest) (
 	}
 
 	// Create the new user.
-	user.Email = in.Form.Email
-	user.Password = string(bytes)
-	tx = m.db.Create(&user)
+	u.Email = in.Form.Email
+	u.Password = string(bytes)
+	tx = m.db.Create(&u)
 	if tx.RowsAffected == 0 {
 		log.Fatalf("Failed to save user: %v", err)
 		return nil, errors.New("Failed to save user.")
@@ -72,26 +72,26 @@ func (m *usersServer) Login(ctx context.Context, in *proto.LoginRequest) (*proto
 	}
 
 	// Find the user.
-	var user models.User
-	tx := m.db.First(&user, "email = ?", in.Form.Email)
+	var u models.User
+	tx := m.db.First(&u, "email = ?", in.Form.Email)
 	if tx.RowsAffected == 0 {
 		return nil, errors.New("User not found.")
 	}
 
 	// Compare the passwords.
-	if err := bcrypt.CompareHashAndPassword([]byte(user.Password), []byte(*in.Form.Password)); err != nil {
+	if err := bcrypt.CompareHashAndPassword([]byte(u.Password), []byte(*in.Form.Password)); err != nil {
 		return nil, errors.New("Passwords do not match.")
 	}
 
 	// Create a session.
-	session := &models.Session{
+	s := &models.Session{
 		Token:   uuid.NewString(),
 		Expires: time.Now().AddDate(0, 0, 1).UnixNano(),
-		UserID:  user.ID,
+		UserID:  u.ID,
 	}
 
 	// Save the token.
-	tx = m.db.Create(&session)
+	tx = m.db.Create(&s)
 	if tx.RowsAffected == 0 {
 		return nil, errors.New("Failed to create session.")
 	}
@@ -99,8 +99,8 @@ func (m *usersServer) Login(ctx context.Context, in *proto.LoginRequest) (*proto
 	// Return the response.
 	return &proto.LoginResponse{
 		Token: &proto.UserToken{
-			Token:   session.Token,
-			Expires: &session.Expires,
+			Token:   s.Token,
+			Expires: &s.Expires,
 		},
 	}, nil
 }
@@ -112,42 +112,59 @@ func (m *usersServer) Authorize(ctx context.Context, in *proto.AuthorizeRequest)
 	}
 
 	// Find the session.
-	var session models.Session
-	tx := m.db.First(&session, "token = ?", in.Token.Token)
+	var s models.Session
+	tx := m.db.First(&s, "token = ?", in.Token.Token)
 	if tx.RowsAffected == 0 {
 		return nil, errors.New("Session not found.")
 	}
 
 	// Make sure the session hasn't expired.
-	if time.Now().UnixNano() > session.Expires {
+	if time.Now().UnixNano() > s.Expires {
 		return nil, errors.New("Token is expired.")
 	}
 
-	// Return the user ID.
+	// Find the user.
+	var u models.User
+	tx = m.db.Model(&models.User{}).Preload("Roles").First(&u, "id = ?", s.UserID)
+	if tx.RowsAffected == 0 {
+		return nil, errors.New("Failed to load roles.")
+	}
+
+	// Return the response.
+	res := &proto.AuthorizeResponse{
+		User: &proto.UserInfo{},
+	}
+
+	for _, r := range u.Roles {
+		res.Roles = append(res.Roles, &proto.UserRole{
+			Id:   int64(r.ID),
+			Name: r.Name,
+		})
+	}
 	return &proto.AuthorizeResponse{
 		User: &proto.UserInfo{
-			Id: int64(session.UserID),
+			Id: int64(s.UserID),
 		},
 	}, nil
 }
 
 func (m *usersServer) ResetPassword(ctx context.Context, in *proto.ResetPasswordRequest) (*proto.ResetPasswordResponse, error) {
-	// Find the user.
-	var user models.User
-	tx := m.db.First(&user, "email = ?", in.Form.Email)
+	// Find the u.
+	var u models.User
+	tx := m.db.First(&u, "email = ?", in.Form.Email)
 	if tx.RowsAffected == 0 {
 		return nil, errors.New("User not found.")
 	}
 
 	// Generate a reset token.
-	resetToken := &models.PasswordToken{
-		UserID:  user.ID,
+	rt := &models.PasswordToken{
+		UserID:  u.ID,
 		Token:   uuid.NewString(),
 		Expires: time.Now().UnixNano(),
 	}
 
 	// Save the token.
-	tx = m.db.Create(resetToken)
+	tx = m.db.Create(rt)
 	if tx.RowsAffected == 0 {
 		return nil, errors.New("Failed to create token.")
 	}
@@ -155,22 +172,22 @@ func (m *usersServer) ResetPassword(ctx context.Context, in *proto.ResetPassword
 	// Return the response.
 	return &proto.ResetPasswordResponse{
 		Token: &proto.UserToken{
-			Token: resetToken.Token,
+			Token: rt.Token,
 		},
 	}, nil
 }
 
 func (m *usersServer) ChangePassword(ctx context.Context, in *proto.ChangePasswordRequest) (*proto.ChangePasswordResponse, error) {
 	// Find the reset token.
-	var resetToken models.PasswordToken
-	tx := m.db.First(&resetToken, "token = ?", in.Token.Token)
+	var rt models.PasswordToken
+	tx := m.db.First(&rt, "token = ?", in.Token.Token)
 	if tx.RowsAffected == 0 {
 		return nil, errors.New("Token not found.")
 	}
 
 	// Find the user.
-	var user models.User
-	tx = m.db.First(&user, "id = ?", resetToken.UserID)
+	var u models.User
+	tx = m.db.First(&u, "id = ?", rt.UserID)
 	if tx.RowsAffected == 0 {
 		return nil, errors.New("User not found.")
 	}
@@ -182,17 +199,68 @@ func (m *usersServer) ChangePassword(ctx context.Context, in *proto.ChangePasswo
 		return nil, errors.New("Failed to encode password.")
 	}
 
-	user.Password = string(bytes)
-	if tx = m.db.Save(user); tx.RowsAffected == 0 {
+	u.Password = string(bytes)
+	if tx = m.db.Save(u); tx.RowsAffected == 0 {
 		return nil, errors.New("Failed to update password.")
 	}
 
 	// Expire current token.
-	resetToken.Expires = time.Now().UnixNano()
-	if tx = m.db.Save(&resetToken); tx.RowsAffected == 0 {
+	rt.Expires = time.Now().UnixNano()
+	if tx = m.db.Save(&rt); tx.RowsAffected == 0 {
 		return nil, errors.New("Failed to update password.")
 	}
 
 	// Return the response.
 	return nil, nil
 }
+
+func (m *usersServer) ListRoles(ctx context.Context, in *proto.ListRolesRequest) (*proto.ListRolesResponse, error) {
+	// Make sure the secrets match.
+	if in.Secret != *m.secret {
+		return nil, errors.New("Secrets do not match.")
+	}
+
+	// Get all of the available roles.
+	var roles []models.Role
+	if tx := m.db.Find(&roles); tx.RowsAffected == 0 {
+		return nil, errors.New("Failed to find roles.")
+	}
+
+	// Return the response.
+	res := &proto.ListRolesResponse{}
+	for _, r := range roles {
+		res.Roles = append(res.Roles, &proto.UserRole{
+			Id:   int64(r.ID),
+			Name: r.Name,
+		})
+	}
+	return res, nil
+}
+
+func (m *usersServer) SetRoles(ctx context.Context, in *proto.SetRolesRequest) (*proto.SetRolesResponse, error) {
+	// Make sure the secrets match.
+	if in.Secret != *m.secret {
+		return nil, errors.New("Secrets do not match.")
+	}
+
+	// Find the user.
+	var u models.User
+	if tx := m.db.First(&u, "id = ?", in.User.Id); tx.RowsAffected == 0 {
+		return nil, errors.New("User not found.")
+	}
+
+	// Add the roles.
+	var r models.Role
+	for _, x := range in.Roles {
+		if tx := m.db.First(&r, "id = ?", x.Id); tx.RowsAffected != 0 {
+			u.Roles = append(u.Roles, r)
+		}
+	}
+
+	// Save the user.
+	if tx := m.db.Save(&u); tx.RowsAffected == 0 {
+		return nil, errors.New("Failed to add roles.")
+	}
+
+	return nil, nil
+}