diff --git a/api/user.http.go b/api/user.http.go
index 4b468c7..8b48490 100644
--- a/api/user.http.go
+++ b/api/user.http.go
@@ -1,155 +1,131 @@
 package user
 
 import (
+	"github.com/gin-gonic/gin"
 	"context"
 	"git.diulo.com/mogfee/kit/middleware"
 	"git.diulo.com/mogfee/kit/errors"
 	"git.diulo.com/mogfee/kit/response"
-	"github.com/gin-gonic/gin"
 )
 
 func RegisterUserHandler(app *gin.Engine, srv UserServer, m ...middleware.Middleware) {
 	app.GET("/api/v1/user/list", httpListHandler(srv, m...))
+	app.GET("/api/v1/user/auto", httpAutoHandler(srv, m...))
+	app.GET("/api/v1/user/all", httpAllHandler(srv, m...))
+	app.GET("/api/v1/user/login_list", httpLoginWithListHandler(srv, m...))
 	app.GET("/api/v1/user/login", httpLoginHandler(srv, m...))
-	app.GET("/api/v1/user/delete2", httpDelete2Handler(srv, m...))
-	app.GET("/api/v1/user/delete3", httpDelete3Handler(srv, m...))
-	app.GET("/api/v1/user/delete", httpDeleteHandler(srv, m...))
-	app.GET("/api/v1/user/delete1", httpDelete1Handler(srv, m...))
 }
 func httpListHandler(srv UserServer, m ...middleware.Middleware) func(c *gin.Context) {
 	return func(c *gin.Context) {
-		var post LoginRequest
-		resp := response.New(c)
-		if err := resp.BindQuery(&post); err != nil {
-			resp.Error(err)
-			return
-		}
-		h := func(ctx context.Context, a any) (any, error) {
-			return srv.List(ctx, a.(*LoginRequest))
-		}
-		out, err := middleware.HttpMiddleware(c, h, m...)(c, &post)
-		if err != nil {
-			resp.Error(err)
-		} else {
-			if v, ok := out.(*LoginResponse); ok {
-				resp.Success(v)
-			} else {
-				resp.Error(errors.InternalServer("RESULT_TYPE_ERROR", "LoginResponse"))
-			}
-		}
-	}
-}
-func httpLoginHandler(srv UserServer, m ...middleware.Middleware) func(c *gin.Context) {
-	return func(c *gin.Context) {
-		var post LoginRequest
+		var post Request
 		resp := response.New(c)
 		if err := resp.BindQuery(&post); err != nil {
 			resp.Error(err)
 			return
 		}
 		h := func(ctx context.Context, a any) (any, error) {
-			return srv.Login(ctx, a.(*LoginRequest))
+			return srv.List(ctx, a.(*Request))
 		}
 		out, err := middleware.HttpMiddleware(c, h, m...)(c, &post)
 		if err != nil {
 			resp.Error(err)
 		} else {
-			if v, ok := out.(*LoginResponse); ok {
+			if v, ok := out.(*Response); ok {
 				resp.Success(v)
 			} else {
-				resp.Error(errors.InternalServer("RESULT_TYPE_ERROR", "LoginResponse"))
+				resp.Error(errors.InternalServer("RESULT_TYPE_ERROR", "Response"))
 			}
 		}
 	}
 }
-func httpDelete2Handler(srv UserServer, m ...middleware.Middleware) func(c *gin.Context) {
+func httpAutoHandler(srv UserServer, m ...middleware.Middleware) func(c *gin.Context) {
 	return func(c *gin.Context) {
-		var post LoginRequest
+		var post Request
 		resp := response.New(c)
 		if err := resp.BindQuery(&post); err != nil {
 			resp.Error(err)
 			return
 		}
 		h := func(ctx context.Context, a any) (any, error) {
-			return srv.Delete2(ctx, a.(*LoginRequest))
+			return srv.Auto(ctx, a.(*Request))
 		}
 		out, err := middleware.HttpMiddleware(c, h, m...)(c, &post)
 		if err != nil {
 			resp.Error(err)
 		} else {
-			if v, ok := out.(*LoginResponse); ok {
+			if v, ok := out.(*Response); ok {
 				resp.Success(v)
 			} else {
-				resp.Error(errors.InternalServer("RESULT_TYPE_ERROR", "LoginResponse"))
+				resp.Error(errors.InternalServer("RESULT_TYPE_ERROR", "Response"))
 			}
 		}
 	}
 }
-func httpDelete3Handler(srv UserServer, m ...middleware.Middleware) func(c *gin.Context) {
+func httpAllHandler(srv UserServer, m ...middleware.Middleware) func(c *gin.Context) {
 	return func(c *gin.Context) {
-		var post LoginRequest
+		var post Request
 		resp := response.New(c)
 		if err := resp.BindQuery(&post); err != nil {
 			resp.Error(err)
 			return
 		}
 		h := func(ctx context.Context, a any) (any, error) {
-			return srv.Delete3(ctx, a.(*LoginRequest))
+			return srv.All(ctx, a.(*Request))
 		}
 		out, err := middleware.HttpMiddleware(c, h, m...)(c, &post)
 		if err != nil {
 			resp.Error(err)
 		} else {
-			if v, ok := out.(*LoginResponse); ok {
+			if v, ok := out.(*Response); ok {
 				resp.Success(v)
 			} else {
-				resp.Error(errors.InternalServer("RESULT_TYPE_ERROR", "LoginResponse"))
+				resp.Error(errors.InternalServer("RESULT_TYPE_ERROR", "Response"))
 			}
 		}
 	}
 }
-func httpDeleteHandler(srv UserServer, m ...middleware.Middleware) func(c *gin.Context) {
+func httpLoginWithListHandler(srv UserServer, m ...middleware.Middleware) func(c *gin.Context) {
 	return func(c *gin.Context) {
-		var post LoginRequest
+		var post Request
 		resp := response.New(c)
 		if err := resp.BindQuery(&post); err != nil {
 			resp.Error(err)
 			return
 		}
 		h := func(ctx context.Context, a any) (any, error) {
-			return srv.Delete(ctx, a.(*LoginRequest))
+			return srv.LoginWithList(ctx, a.(*Request))
 		}
 		out, err := middleware.HttpMiddleware(c, h, m...)(c, &post)
 		if err != nil {
 			resp.Error(err)
 		} else {
-			if v, ok := out.(*LoginResponse); ok {
+			if v, ok := out.(*Response); ok {
 				resp.Success(v)
 			} else {
-				resp.Error(errors.InternalServer("RESULT_TYPE_ERROR", "LoginResponse"))
+				resp.Error(errors.InternalServer("RESULT_TYPE_ERROR", "Response"))
 			}
 		}
 	}
 }
-func httpDelete1Handler(srv UserServer, m ...middleware.Middleware) func(c *gin.Context) {
+func httpLoginHandler(srv UserServer, m ...middleware.Middleware) func(c *gin.Context) {
 	return func(c *gin.Context) {
-		var post LoginRequest
+		var post Request
 		resp := response.New(c)
 		if err := resp.BindQuery(&post); err != nil {
 			resp.Error(err)
 			return
 		}
 		h := func(ctx context.Context, a any) (any, error) {
-			return srv.Delete1(ctx, a.(*LoginRequest))
+			return srv.Login(ctx, a.(*Request))
 		}
 		out, err := middleware.HttpMiddleware(c, h, m...)(c, &post)
 		if err != nil {
 			resp.Error(err)
 		} else {
-			if v, ok := out.(*LoginResponse); ok {
+			if v, ok := out.(*Response); ok {
 				resp.Success(v)
 			} else {
-				resp.Error(errors.InternalServer("RESULT_TYPE_ERROR", "LoginResponse"))
+				resp.Error(errors.InternalServer("RESULT_TYPE_ERROR", "Response"))
 			}
 		}
 	}
diff --git a/api/user.pb.go b/api/user.pb.go
index 50968b5..1507694 100644
--- a/api/user.pb.go
+++ b/api/user.pb.go
@@ -8,11 +8,9 @@ package user
 
 import (
 	_ "git.diulo.com/mogfee/kit/third_party/auth"
-	_ "github.com/envoyproxy/protoc-gen-validate/validate"
 	_ "google.golang.org/genproto/googleapis/api/annotations"
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
-	_ "google.golang.org/protobuf/types/descriptorpb"
 	reflect "reflect"
 	sync "sync"
 )
@@ -24,19 +22,14 @@ const (
 	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
 )
 
-type LoginRequest struct {
+type Request struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
-
-	// 用户名
-	Username  string `protobuf:"bytes,1,opt,name=username,proto3" json:"username,omitempty"`
-	Password  string `protobuf:"bytes,2,opt,name=password,proto3" json:"password,omitempty"`
-	FirstName string `protobuf:"bytes,3,opt,name=first_name,json=firstName,proto3" json:"first_name,omitempty"`
 }
 
-func (x *LoginRequest) Reset() {
-	*x = LoginRequest{}
+func (x *Request) Reset() {
+	*x = Request{}
 	if protoimpl.UnsafeEnabled {
 		mi := &file_user_proto_msgTypes[0]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -44,13 +37,13 @@ func (x *LoginRequest) Reset() {
 	}
 }
 
-func (x *LoginRequest) String() string {
+func (x *Request) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*LoginRequest) ProtoMessage() {}
+func (*Request) ProtoMessage() {}
 
-func (x *LoginRequest) ProtoReflect() protoreflect.Message {
+func (x *Request) ProtoReflect() protoreflect.Message {
 	mi := &file_user_proto_msgTypes[0]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -62,33 +55,12 @@ func (x *LoginRequest) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use LoginRequest.ProtoReflect.Descriptor instead.
-func (*LoginRequest) Descriptor() ([]byte, []int) {
+// Deprecated: Use Request.ProtoReflect.Descriptor instead.
+func (*Request) Descriptor() ([]byte, []int) {
 	return file_user_proto_rawDescGZIP(), []int{0}
 }
 
-func (x *LoginRequest) GetUsername() string {
-	if x != nil {
-		return x.Username
-	}
-	return ""
-}
-
-func (x *LoginRequest) GetPassword() string {
-	if x != nil {
-		return x.Password
-	}
-	return ""
-}
-
-func (x *LoginRequest) GetFirstName() string {
-	if x != nil {
-		return x.FirstName
-	}
-	return ""
-}
-
-type LoginResponse struct {
+type Response struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
@@ -97,8 +69,8 @@ type LoginResponse struct {
 	Token string `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"`
 }
 
-func (x *LoginResponse) Reset() {
-	*x = LoginResponse{}
+func (x *Response) Reset() {
+	*x = Response{}
 	if protoimpl.UnsafeEnabled {
 		mi := &file_user_proto_msgTypes[1]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -106,13 +78,13 @@ func (x *LoginResponse) Reset() {
 	}
 }
 
-func (x *LoginResponse) String() string {
+func (x *Response) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*LoginResponse) ProtoMessage() {}
+func (*Response) ProtoMessage() {}
 
-func (x *LoginResponse) ProtoReflect() protoreflect.Message {
+func (x *Response) ProtoReflect() protoreflect.Message {
 	mi := &file_user_proto_msgTypes[1]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -124,12 +96,12 @@ func (x *LoginResponse) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use LoginResponse.ProtoReflect.Descriptor instead.
-func (*LoginResponse) Descriptor() ([]byte, []int) {
+// Deprecated: Use Response.ProtoReflect.Descriptor instead.
+func (*Response) Descriptor() ([]byte, []int) {
 	return file_user_proto_rawDescGZIP(), []int{1}
 }
 
-func (x *LoginResponse) GetToken() string {
+func (x *Response) GetToken() string {
 	if x != nil {
 		return x.Token
 	}
@@ -140,64 +112,43 @@ var File_user_proto protoreflect.FileDescriptor
 
 var file_user_proto_rawDesc = []byte{
 	0x0a, 0x0a, 0x75, 0x73, 0x65, 0x72, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x0d, 0x63, 0x6f,
-	0x6d, 0x2e, 0x64, 0x69, 0x75, 0x6c, 0x6f, 0x2e, 0x61, 0x70, 0x69, 0x1a, 0x17, 0x76, 0x61, 0x6c,
-	0x69, 0x64, 0x61, 0x74, 0x65, 0x2f, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x2e, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1c, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x61, 0x70, 0x69,
-	0x2f, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x1a, 0x0f, 0x61, 0x75, 0x74, 0x68, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x2e, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x1a, 0x20, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x62, 0x75, 0x66, 0x2f, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x2e,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x7b, 0x0a, 0x0c, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x25, 0x0a, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d,
-	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x09, 0xfa, 0x42, 0x06, 0x72, 0x04, 0x10, 0x04,
-	0x18, 0x0a, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x25, 0x0a, 0x08,
-	0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x09,
-	0xfa, 0x42, 0x06, 0x72, 0x04, 0x10, 0x04, 0x18, 0x0a, 0x52, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77,
-	0x6f, 0x72, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x66, 0x69, 0x72, 0x73, 0x74, 0x5f, 0x6e, 0x61, 0x6d,
-	0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x66, 0x69, 0x72, 0x73, 0x74, 0x4e, 0x61,
-	0x6d, 0x65, 0x22, 0x25, 0x0a, 0x0d, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x32, 0xea, 0x04, 0x0a, 0x04, 0x75, 0x73,
-	0x65, 0x72, 0x12, 0x68, 0x0a, 0x04, 0x6c, 0x69, 0x73, 0x74, 0x12, 0x1b, 0x2e, 0x63, 0x6f, 0x6d,
-	0x2e, 0x64, 0x69, 0x75, 0x6c, 0x6f, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x6c, 0x6f, 0x67, 0x69, 0x6e,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1c, 0x2e, 0x63, 0x6f, 0x6d, 0x2e, 0x64, 0x69,
-	0x75, 0x6c, 0x6f, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x25, 0xba, 0x45, 0x09, 0x75, 0x73, 0x65, 0x72, 0x3a, 0x6c,
-	0x69, 0x73, 0x74, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x13, 0x12, 0x11, 0x2f, 0x61, 0x70, 0x69, 0x2f,
-	0x76, 0x31, 0x2f, 0x75, 0x73, 0x65, 0x72, 0x2f, 0x6c, 0x69, 0x73, 0x74, 0x12, 0x61, 0x0a, 0x05,
-	0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x12, 0x1b, 0x2e, 0x63, 0x6f, 0x6d, 0x2e, 0x64, 0x69, 0x75, 0x6c,
-	0x6f, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x1a, 0x1c, 0x2e, 0x63, 0x6f, 0x6d, 0x2e, 0x64, 0x69, 0x75, 0x6c, 0x6f, 0x2e, 0x61,
-	0x70, 0x69, 0x2e, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x22, 0x1d, 0xc0, 0x45, 0x01, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x14, 0x12, 0x12, 0x2f, 0x61, 0x70,
-	0x69, 0x2f, 0x76, 0x31, 0x2f, 0x75, 0x73, 0x65, 0x72, 0x2f, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x12,
-	0x65, 0x0a, 0x07, 0x64, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x32, 0x12, 0x1b, 0x2e, 0x63, 0x6f, 0x6d,
-	0x2e, 0x64, 0x69, 0x75, 0x6c, 0x6f, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x6c, 0x6f, 0x67, 0x69, 0x6e,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1c, 0x2e, 0x63, 0x6f, 0x6d, 0x2e, 0x64, 0x69,
-	0x75, 0x6c, 0x6f, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x1f, 0xc8, 0x45, 0x01, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x16,
-	0x12, 0x14, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x75, 0x73, 0x65, 0x72, 0x2f, 0x64,
-	0x65, 0x6c, 0x65, 0x74, 0x65, 0x32, 0x12, 0x65, 0x0a, 0x07, 0x64, 0x65, 0x6c, 0x65, 0x74, 0x65,
-	0x33, 0x12, 0x1b, 0x2e, 0x63, 0x6f, 0x6d, 0x2e, 0x64, 0x69, 0x75, 0x6c, 0x6f, 0x2e, 0x61, 0x70,
-	0x69, 0x2e, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1c,
-	0x2e, 0x63, 0x6f, 0x6d, 0x2e, 0x64, 0x69, 0x75, 0x6c, 0x6f, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x6c,
-	0x6f, 0x67, 0x69, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x1f, 0xc8, 0x45,
-	0x00, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x16, 0x12, 0x14, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31,
-	0x2f, 0x75, 0x73, 0x65, 0x72, 0x2f, 0x64, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x33, 0x12, 0x63, 0x0a,
-	0x06, 0x64, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x12, 0x1b, 0x2e, 0x63, 0x6f, 0x6d, 0x2e, 0x64, 0x69,
-	0x75, 0x6c, 0x6f, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x1a, 0x1c, 0x2e, 0x63, 0x6f, 0x6d, 0x2e, 0x64, 0x69, 0x75, 0x6c, 0x6f,
-	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
-	0x73, 0x65, 0x22, 0x1e, 0xc0, 0x45, 0x00, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x15, 0x12, 0x13, 0x2f,
-	0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x75, 0x73, 0x65, 0x72, 0x2f, 0x64, 0x65, 0x6c, 0x65,
-	0x74, 0x65, 0x12, 0x62, 0x0a, 0x07, 0x64, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x31, 0x12, 0x1b, 0x2e,
-	0x63, 0x6f, 0x6d, 0x2e, 0x64, 0x69, 0x75, 0x6c, 0x6f, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x6c, 0x6f,
-	0x67, 0x69, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1c, 0x2e, 0x63, 0x6f, 0x6d,
-	0x2e, 0x64, 0x69, 0x75, 0x6c, 0x6f, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x6c, 0x6f, 0x67, 0x69, 0x6e,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x1c, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x16,
-	0x12, 0x14, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x75, 0x73, 0x65, 0x72, 0x2f, 0x64,
-	0x65, 0x6c, 0x65, 0x74, 0x65, 0x31, 0x42, 0x09, 0x5a, 0x07, 0x2e, 0x2f, 0x3b, 0x75, 0x73, 0x65,
-	0x72, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x6d, 0x2e, 0x64, 0x69, 0x75, 0x6c, 0x6f, 0x2e, 0x61, 0x70, 0x69, 0x1a, 0x1c, 0x67, 0x6f, 0x6f,
+	0x67, 0x6c, 0x65, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x0f, 0x61, 0x75, 0x74, 0x68, 0x2f,
+	0x61, 0x75, 0x74, 0x68, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x09, 0x0a, 0x07, 0x72, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x20, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x12, 0x14, 0x0a, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x32, 0xcb, 0x03, 0x0a, 0x04, 0x75, 0x73, 0x65, 0x72,
+	0x12, 0x5e, 0x0a, 0x04, 0x6c, 0x69, 0x73, 0x74, 0x12, 0x16, 0x2e, 0x63, 0x6f, 0x6d, 0x2e, 0x64,
+	0x69, 0x75, 0x6c, 0x6f, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x1a, 0x17, 0x2e, 0x63, 0x6f, 0x6d, 0x2e, 0x64, 0x69, 0x75, 0x6c, 0x6f, 0x2e, 0x61, 0x70, 0x69,
+	0x2e, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x25, 0xba, 0x45, 0x09, 0x75, 0x73,
+	0x65, 0x72, 0x3a, 0x6c, 0x69, 0x73, 0x74, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x13, 0x12, 0x11, 0x2f,
+	0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x75, 0x73, 0x65, 0x72, 0x2f, 0x6c, 0x69, 0x73, 0x74,
+	0x12, 0x55, 0x0a, 0x04, 0x61, 0x75, 0x74, 0x6f, 0x12, 0x16, 0x2e, 0x63, 0x6f, 0x6d, 0x2e, 0x64,
+	0x69, 0x75, 0x6c, 0x6f, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x1a, 0x17, 0x2e, 0x63, 0x6f, 0x6d, 0x2e, 0x64, 0x69, 0x75, 0x6c, 0x6f, 0x2e, 0x61, 0x70, 0x69,
+	0x2e, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x1c, 0xc0, 0x45, 0x01, 0x82, 0xd3,
+	0xe4, 0x93, 0x02, 0x13, 0x12, 0x11, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x75, 0x73,
+	0x65, 0x72, 0x2f, 0x61, 0x75, 0x74, 0x6f, 0x12, 0x53, 0x0a, 0x03, 0x61, 0x6c, 0x6c, 0x12, 0x16,
+	0x2e, 0x63, 0x6f, 0x6d, 0x2e, 0x64, 0x69, 0x75, 0x6c, 0x6f, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x17, 0x2e, 0x63, 0x6f, 0x6d, 0x2e, 0x64, 0x69, 0x75,
+	0x6c, 0x6f, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
+	0x1b, 0xc0, 0x45, 0x00, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x12, 0x12, 0x10, 0x2f, 0x61, 0x70, 0x69,
+	0x2f, 0x76, 0x31, 0x2f, 0x75, 0x73, 0x65, 0x72, 0x2f, 0x61, 0x6c, 0x6c, 0x12, 0x61, 0x0a, 0x0d,
+	0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x57, 0x69, 0x74, 0x68, 0x4c, 0x69, 0x73, 0x74, 0x12, 0x16, 0x2e,
+	0x63, 0x6f, 0x6d, 0x2e, 0x64, 0x69, 0x75, 0x6c, 0x6f, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x17, 0x2e, 0x63, 0x6f, 0x6d, 0x2e, 0x64, 0x69, 0x75, 0x6c,
+	0x6f, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x1f,
+	0x82, 0xd3, 0xe4, 0x93, 0x02, 0x19, 0x12, 0x17, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f,
+	0x75, 0x73, 0x65, 0x72, 0x2f, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x5f, 0x6c, 0x69, 0x73, 0x74, 0x12,
+	0x54, 0x0a, 0x05, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x12, 0x16, 0x2e, 0x63, 0x6f, 0x6d, 0x2e, 0x64,
+	0x69, 0x75, 0x6c, 0x6f, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x1a, 0x17, 0x2e, 0x63, 0x6f, 0x6d, 0x2e, 0x64, 0x69, 0x75, 0x6c, 0x6f, 0x2e, 0x61, 0x70, 0x69,
+	0x2e, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x1a, 0x82, 0xd3, 0xe4, 0x93, 0x02,
+	0x14, 0x12, 0x12, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x75, 0x73, 0x65, 0x72, 0x2f,
+	0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x42, 0x09, 0x5a, 0x07, 0x2e, 0x2f, 0x3b, 0x75, 0x73, 0x65, 0x72,
+	0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -214,24 +165,22 @@ func file_user_proto_rawDescGZIP() []byte {
 
 var file_user_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
 var file_user_proto_goTypes = []interface{}{
-	(*LoginRequest)(nil),  // 0: com.diulo.api.loginRequest
-	(*LoginResponse)(nil), // 1: com.diulo.api.loginResponse
+	(*Request)(nil),  // 0: com.diulo.api.request
+	(*Response)(nil), // 1: com.diulo.api.response
 }
 var file_user_proto_depIdxs = []int32{
-	0, // 0: com.diulo.api.user.list:input_type -> com.diulo.api.loginRequest
-	0, // 1: com.diulo.api.user.login:input_type -> com.diulo.api.loginRequest
-	0, // 2: com.diulo.api.user.delete2:input_type -> com.diulo.api.loginRequest
-	0, // 3: com.diulo.api.user.delete3:input_type -> com.diulo.api.loginRequest
-	0, // 4: com.diulo.api.user.delete:input_type -> com.diulo.api.loginRequest
-	0, // 5: com.diulo.api.user.delete1:input_type -> com.diulo.api.loginRequest
-	1, // 6: com.diulo.api.user.list:output_type -> com.diulo.api.loginResponse
-	1, // 7: com.diulo.api.user.login:output_type -> com.diulo.api.loginResponse
-	1, // 8: com.diulo.api.user.delete2:output_type -> com.diulo.api.loginResponse
-	1, // 9: com.diulo.api.user.delete3:output_type -> com.diulo.api.loginResponse
-	1, // 10: com.diulo.api.user.delete:output_type -> com.diulo.api.loginResponse
-	1, // 11: com.diulo.api.user.delete1:output_type -> com.diulo.api.loginResponse
-	6, // [6:12] is the sub-list for method output_type
-	0, // [0:6] is the sub-list for method input_type
+	0, // 0: com.diulo.api.user.list:input_type -> com.diulo.api.request
+	0, // 1: com.diulo.api.user.auto:input_type -> com.diulo.api.request
+	0, // 2: com.diulo.api.user.all:input_type -> com.diulo.api.request
+	0, // 3: com.diulo.api.user.loginWithList:input_type -> com.diulo.api.request
+	0, // 4: com.diulo.api.user.login:input_type -> com.diulo.api.request
+	1, // 5: com.diulo.api.user.list:output_type -> com.diulo.api.response
+	1, // 6: com.diulo.api.user.auto:output_type -> com.diulo.api.response
+	1, // 7: com.diulo.api.user.all:output_type -> com.diulo.api.response
+	1, // 8: com.diulo.api.user.loginWithList:output_type -> com.diulo.api.response
+	1, // 9: com.diulo.api.user.login:output_type -> com.diulo.api.response
+	5, // [5:10] is the sub-list for method output_type
+	0, // [0:5] is the sub-list for method input_type
 	0, // [0:0] is the sub-list for extension type_name
 	0, // [0:0] is the sub-list for extension extendee
 	0, // [0:0] is the sub-list for field type_name
@@ -244,7 +193,7 @@ func file_user_proto_init() {
 	}
 	if !protoimpl.UnsafeEnabled {
 		file_user_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*LoginRequest); i {
+			switch v := v.(*Request); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -256,7 +205,7 @@ func file_user_proto_init() {
 			}
 		}
 		file_user_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*LoginResponse); i {
+			switch v := v.(*Response); i {
 			case 0:
 				return &v.state
 			case 1:
diff --git a/api/user.pb.validate.go b/api/user.pb.validate.go
index f42da11..e7037a8 100644
--- a/api/user.pb.validate.go
+++ b/api/user.pb.validate.go
@@ -35,65 +35,40 @@ var (
 	_ = sort.Sort
 )
 
-// Validate checks the field values on LoginRequest with the rules defined in
-// the proto definition for this message. If any rules are violated, the first
+// Validate checks the field values on Request with the rules defined in the
+// proto definition for this message. If any rules are violated, the first
 // error encountered is returned, or nil if there are no violations.
-func (m *LoginRequest) Validate() error {
+func (m *Request) Validate() error {
 	return m.validate(false)
 }
 
-// ValidateAll checks the field values on LoginRequest with the rules defined
-// in the proto definition for this message. If any rules are violated, the
-// result is a list of violation errors wrapped in LoginRequestMultiError, or
-// nil if none found.
-func (m *LoginRequest) ValidateAll() error {
+// ValidateAll checks the field values on Request with the rules defined in the
+// proto definition for this message. If any rules are violated, the result is
+// a list of violation errors wrapped in RequestMultiError, or nil if none found.
+func (m *Request) ValidateAll() error {
 	return m.validate(true)
 }
 
-func (m *LoginRequest) validate(all bool) error {
+func (m *Request) validate(all bool) error {
 	if m == nil {
 		return nil
 	}
 
 	var errors []error
 
-	if l := utf8.RuneCountInString(m.GetUsername()); l < 4 || l > 10 {
-		err := LoginRequestValidationError{
-			field:  "Username",
-			reason: "value length must be between 4 and 10 runes, inclusive",
-		}
-		if !all {
-			return err
-		}
-		errors = append(errors, err)
-	}
-
-	if l := utf8.RuneCountInString(m.GetPassword()); l < 4 || l > 10 {
-		err := LoginRequestValidationError{
-			field:  "Password",
-			reason: "value length must be between 4 and 10 runes, inclusive",
-		}
-		if !all {
-			return err
-		}
-		errors = append(errors, err)
-	}
-
-	// no validation rules for FirstName
-
 	if len(errors) > 0 {
-		return LoginRequestMultiError(errors)
+		return RequestMultiError(errors)
 	}
 
 	return nil
 }
 
-// LoginRequestMultiError is an error wrapping multiple validation errors
-// returned by LoginRequest.ValidateAll() if the designated constraints aren't met.
-type LoginRequestMultiError []error
+// RequestMultiError is an error wrapping multiple validation errors returned
+// by Request.ValidateAll() if the designated constraints aren't met.
+type RequestMultiError []error
 
 // Error returns a concatenation of all the error messages it wraps.
-func (m LoginRequestMultiError) Error() string {
+func (m RequestMultiError) Error() string {
 	var msgs []string
 	for _, err := range m {
 		msgs = append(msgs, err.Error())
@@ -102,11 +77,11 @@ func (m LoginRequestMultiError) Error() string {
 }
 
 // AllErrors returns a list of validation violation errors.
-func (m LoginRequestMultiError) AllErrors() []error { return m }
+func (m RequestMultiError) AllErrors() []error { return m }
 
-// LoginRequestValidationError is the validation error returned by
-// LoginRequest.Validate if the designated constraints aren't met.
-type LoginRequestValidationError struct {
+// RequestValidationError is the validation error returned by Request.Validate
+// if the designated constraints aren't met.
+type RequestValidationError struct {
 	field  string
 	reason string
 	cause  error
@@ -114,22 +89,22 @@ type LoginRequestValidationError struct {
 }
 
 // Field function returns field value.
-func (e LoginRequestValidationError) Field() string { return e.field }
+func (e RequestValidationError) Field() string { return e.field }
 
 // Reason function returns reason value.
-func (e LoginRequestValidationError) Reason() string { return e.reason }
+func (e RequestValidationError) Reason() string { return e.reason }
 
 // Cause function returns cause value.
-func (e LoginRequestValidationError) Cause() error { return e.cause }
+func (e RequestValidationError) Cause() error { return e.cause }
 
 // Key function returns key value.
-func (e LoginRequestValidationError) Key() bool { return e.key }
+func (e RequestValidationError) Key() bool { return e.key }
 
 // ErrorName returns error name.
-func (e LoginRequestValidationError) ErrorName() string { return "LoginRequestValidationError" }
+func (e RequestValidationError) ErrorName() string { return "RequestValidationError" }
 
 // Error satisfies the builtin error interface
-func (e LoginRequestValidationError) Error() string {
+func (e RequestValidationError) Error() string {
 	cause := ""
 	if e.cause != nil {
 		cause = fmt.Sprintf(" | caused by: %v", e.cause)
@@ -141,14 +116,14 @@ func (e LoginRequestValidationError) Error() string {
 	}
 
 	return fmt.Sprintf(
-		"invalid %sLoginRequest.%s: %s%s",
+		"invalid %sRequest.%s: %s%s",
 		key,
 		e.field,
 		e.reason,
 		cause)
 }
 
-var _ error = LoginRequestValidationError{}
+var _ error = RequestValidationError{}
 
 var _ interface {
 	Field() string
@@ -156,24 +131,24 @@ var _ interface {
 	Key() bool
 	Cause() error
 	ErrorName() string
-} = LoginRequestValidationError{}
+} = RequestValidationError{}
 
-// Validate checks the field values on LoginResponse with the rules defined in
-// the proto definition for this message. If any rules are violated, the first
+// Validate checks the field values on Response with the rules defined in the
+// proto definition for this message. If any rules are violated, the first
 // error encountered is returned, or nil if there are no violations.
-func (m *LoginResponse) Validate() error {
+func (m *Response) Validate() error {
 	return m.validate(false)
 }
 
-// ValidateAll checks the field values on LoginResponse with the rules defined
-// in the proto definition for this message. If any rules are violated, the
-// result is a list of violation errors wrapped in LoginResponseMultiError, or
-// nil if none found.
-func (m *LoginResponse) ValidateAll() error {
+// ValidateAll checks the field values on Response with the rules defined in
+// the proto definition for this message. If any rules are violated, the
+// result is a list of violation errors wrapped in ResponseMultiError, or nil
+// if none found.
+func (m *Response) ValidateAll() error {
 	return m.validate(true)
 }
 
-func (m *LoginResponse) validate(all bool) error {
+func (m *Response) validate(all bool) error {
 	if m == nil {
 		return nil
 	}
@@ -183,19 +158,18 @@ func (m *LoginResponse) validate(all bool) error {
 	// no validation rules for Token
 
 	if len(errors) > 0 {
-		return LoginResponseMultiError(errors)
+		return ResponseMultiError(errors)
 	}
 
 	return nil
 }
 
-// LoginResponseMultiError is an error wrapping multiple validation errors
-// returned by LoginResponse.ValidateAll() if the designated constraints
-// aren't met.
-type LoginResponseMultiError []error
+// ResponseMultiError is an error wrapping multiple validation errors returned
+// by Response.ValidateAll() if the designated constraints aren't met.
+type ResponseMultiError []error
 
 // Error returns a concatenation of all the error messages it wraps.
-func (m LoginResponseMultiError) Error() string {
+func (m ResponseMultiError) Error() string {
 	var msgs []string
 	for _, err := range m {
 		msgs = append(msgs, err.Error())
@@ -204,11 +178,11 @@ func (m LoginResponseMultiError) Error() string {
 }
 
 // AllErrors returns a list of validation violation errors.
-func (m LoginResponseMultiError) AllErrors() []error { return m }
+func (m ResponseMultiError) AllErrors() []error { return m }
 
-// LoginResponseValidationError is the validation error returned by
-// LoginResponse.Validate if the designated constraints aren't met.
-type LoginResponseValidationError struct {
+// ResponseValidationError is the validation error returned by
+// Response.Validate if the designated constraints aren't met.
+type ResponseValidationError struct {
 	field  string
 	reason string
 	cause  error
@@ -216,22 +190,22 @@ type LoginResponseValidationError struct {
 }
 
 // Field function returns field value.
-func (e LoginResponseValidationError) Field() string { return e.field }
+func (e ResponseValidationError) Field() string { return e.field }
 
 // Reason function returns reason value.
-func (e LoginResponseValidationError) Reason() string { return e.reason }
+func (e ResponseValidationError) Reason() string { return e.reason }
 
 // Cause function returns cause value.
-func (e LoginResponseValidationError) Cause() error { return e.cause }
+func (e ResponseValidationError) Cause() error { return e.cause }
 
 // Key function returns key value.
-func (e LoginResponseValidationError) Key() bool { return e.key }
+func (e ResponseValidationError) Key() bool { return e.key }
 
 // ErrorName returns error name.
-func (e LoginResponseValidationError) ErrorName() string { return "LoginResponseValidationError" }
+func (e ResponseValidationError) ErrorName() string { return "ResponseValidationError" }
 
 // Error satisfies the builtin error interface
-func (e LoginResponseValidationError) Error() string {
+func (e ResponseValidationError) Error() string {
 	cause := ""
 	if e.cause != nil {
 		cause = fmt.Sprintf(" | caused by: %v", e.cause)
@@ -243,14 +217,14 @@ func (e LoginResponseValidationError) Error() string {
 	}
 
 	return fmt.Sprintf(
-		"invalid %sLoginResponse.%s: %s%s",
+		"invalid %sResponse.%s: %s%s",
 		key,
 		e.field,
 		e.reason,
 		cause)
 }
 
-var _ error = LoginResponseValidationError{}
+var _ error = ResponseValidationError{}
 
 var _ interface {
 	Field() string
@@ -258,4 +232,4 @@ var _ interface {
 	Key() bool
 	Cause() error
 	ErrorName() string
-} = LoginResponseValidationError{}
+} = ResponseValidationError{}
diff --git a/api/user.ts b/api/user.ts
index 066c638..072ea67 100644
--- a/api/user.ts
+++ b/api/user.ts
@@ -1,57 +1,47 @@
 // @ts-ignore
 import {Config,http} from "./http";
-export interface loginRequest {
-	//用户名
-	username: string
-	password: string
-	firstName: string
+export interface request {
 }
 
-export interface loginResponse {
+export interface response {
 	//密钥
 	token: string
 }
 
 export class userService{
-	//列表
-	static async list(data :loginRequest, param?: Config<loginRequest>):Promise<loginResponse>{
-		return http<loginRequest, loginResponse>('/api/v1/user/list', {
+	static async list(data :request, param?: Config<request>):Promise<response>{
+		return http<request, response>('/api/v1/user/list', {
 			...param,
 			data: data,
 			method:'GET'
 		})
 	}
 	//等了
-	static async login(data :loginRequest, param?: Config<loginRequest>):Promise<loginResponse>{
-		return http<loginRequest, loginResponse>('/api/v1/user/login', {
+	static async auto(data :request, param?: Config<request>):Promise<response>{
+		return http<request, response>('/api/v1/user/auto', {
 			...param,
 			data: data,
 			method:'GET'
 		})
 	}
-	static async delete2(data :loginRequest, param?: Config<loginRequest>):Promise<loginResponse>{
-		return http<loginRequest, loginResponse>('/api/v1/user/delete2', {
+	static async all(data :request, param?: Config<request>):Promise<response>{
+		return http<request, response>('/api/v1/user/all', {
 			...param,
 			data: data,
 			method:'GET'
 		})
 	}
-	static async delete3(data :loginRequest, param?: Config<loginRequest>):Promise<loginResponse>{
-		return http<loginRequest, loginResponse>('/api/v1/user/delete3', {
+	//有 "user:list"
+	static async loginWithList(data :request, param?: Config<request>):Promise<response>{
+		return http<request, response>('/api/v1/user/login_list', {
 			...param,
 			data: data,
 			method:'GET'
 		})
 	}
-	static async delete(data :loginRequest, param?: Config<loginRequest>):Promise<loginResponse>{
-		return http<loginRequest, loginResponse>('/api/v1/user/delete', {
-			...param,
-			data: data,
-			method:'GET'
-		})
-	}
-	static async delete1(data :loginRequest, param?: Config<loginRequest>):Promise<loginResponse>{
-		return http<loginRequest, loginResponse>('/api/v1/user/delete1', {
+	// 没有 "user:list" 权限
+	static async login(data :request, param?: Config<request>):Promise<response>{
+		return http<request, response>('/api/v1/user/login', {
 			...param,
 			data: data,
 			method:'GET'
diff --git a/api/user_grpc.pb.go b/api/user_grpc.pb.go
index 0f13dcf..7279ac8 100644
--- a/api/user_grpc.pb.go
+++ b/api/user_grpc.pb.go
@@ -19,26 +19,25 @@ import (
 const _ = grpc.SupportPackageIsVersion7
 
 const (
-	User_List_FullMethodName    = "/com.diulo.api.user/list"
-	User_Login_FullMethodName   = "/com.diulo.api.user/login"
-	User_Delete2_FullMethodName = "/com.diulo.api.user/delete2"
-	User_Delete3_FullMethodName = "/com.diulo.api.user/delete3"
-	User_Delete_FullMethodName  = "/com.diulo.api.user/delete"
-	User_Delete1_FullMethodName = "/com.diulo.api.user/delete1"
+	User_List_FullMethodName          = "/com.diulo.api.user/list"
+	User_Auto_FullMethodName          = "/com.diulo.api.user/auto"
+	User_All_FullMethodName           = "/com.diulo.api.user/all"
+	User_LoginWithList_FullMethodName = "/com.diulo.api.user/loginWithList"
+	User_Login_FullMethodName         = "/com.diulo.api.user/login"
 )
 
 // UserClient is the client API for User service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
 type UserClient interface {
-	// 列表
-	List(ctx context.Context, in *LoginRequest, opts ...grpc.CallOption) (*LoginResponse, error)
+	List(ctx context.Context, in *Request, opts ...grpc.CallOption) (*Response, error)
 	// 等了
-	Login(ctx context.Context, in *LoginRequest, opts ...grpc.CallOption) (*LoginResponse, error)
-	Delete2(ctx context.Context, in *LoginRequest, opts ...grpc.CallOption) (*LoginResponse, error)
-	Delete3(ctx context.Context, in *LoginRequest, opts ...grpc.CallOption) (*LoginResponse, error)
-	Delete(ctx context.Context, in *LoginRequest, opts ...grpc.CallOption) (*LoginResponse, error)
-	Delete1(ctx context.Context, in *LoginRequest, opts ...grpc.CallOption) (*LoginResponse, error)
+	Auto(ctx context.Context, in *Request, opts ...grpc.CallOption) (*Response, error)
+	All(ctx context.Context, in *Request, opts ...grpc.CallOption) (*Response, error)
+	// 有 "user:list"
+	LoginWithList(ctx context.Context, in *Request, opts ...grpc.CallOption) (*Response, error)
+	// 没有 "user:list" 权限
+	Login(ctx context.Context, in *Request, opts ...grpc.CallOption) (*Response, error)
 }
 
 type userClient struct {
@@ -49,8 +48,8 @@ func NewUserClient(cc grpc.ClientConnInterface) UserClient {
 	return &userClient{cc}
 }
 
-func (c *userClient) List(ctx context.Context, in *LoginRequest, opts ...grpc.CallOption) (*LoginResponse, error) {
-	out := new(LoginResponse)
+func (c *userClient) List(ctx context.Context, in *Request, opts ...grpc.CallOption) (*Response, error) {
+	out := new(Response)
 	err := c.cc.Invoke(ctx, User_List_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
@@ -58,45 +57,36 @@ func (c *userClient) List(ctx context.Context, in *LoginRequest, opts ...grpc.Ca
 	return out, nil
 }
 
-func (c *userClient) Login(ctx context.Context, in *LoginRequest, opts ...grpc.CallOption) (*LoginResponse, error) {
-	out := new(LoginResponse)
-	err := c.cc.Invoke(ctx, User_Login_FullMethodName, in, out, opts...)
+func (c *userClient) Auto(ctx context.Context, in *Request, opts ...grpc.CallOption) (*Response, error) {
+	out := new(Response)
+	err := c.cc.Invoke(ctx, User_Auto_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
 	return out, nil
 }
 
-func (c *userClient) Delete2(ctx context.Context, in *LoginRequest, opts ...grpc.CallOption) (*LoginResponse, error) {
-	out := new(LoginResponse)
-	err := c.cc.Invoke(ctx, User_Delete2_FullMethodName, in, out, opts...)
+func (c *userClient) All(ctx context.Context, in *Request, opts ...grpc.CallOption) (*Response, error) {
+	out := new(Response)
+	err := c.cc.Invoke(ctx, User_All_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
 	return out, nil
 }
 
-func (c *userClient) Delete3(ctx context.Context, in *LoginRequest, opts ...grpc.CallOption) (*LoginResponse, error) {
-	out := new(LoginResponse)
-	err := c.cc.Invoke(ctx, User_Delete3_FullMethodName, in, out, opts...)
+func (c *userClient) LoginWithList(ctx context.Context, in *Request, opts ...grpc.CallOption) (*Response, error) {
+	out := new(Response)
+	err := c.cc.Invoke(ctx, User_LoginWithList_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
 	return out, nil
 }
 
-func (c *userClient) Delete(ctx context.Context, in *LoginRequest, opts ...grpc.CallOption) (*LoginResponse, error) {
-	out := new(LoginResponse)
-	err := c.cc.Invoke(ctx, User_Delete_FullMethodName, in, out, opts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *userClient) Delete1(ctx context.Context, in *LoginRequest, opts ...grpc.CallOption) (*LoginResponse, error) {
-	out := new(LoginResponse)
-	err := c.cc.Invoke(ctx, User_Delete1_FullMethodName, in, out, opts...)
+func (c *userClient) Login(ctx context.Context, in *Request, opts ...grpc.CallOption) (*Response, error) {
+	out := new(Response)
+	err := c.cc.Invoke(ctx, User_Login_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -107,14 +97,14 @@ func (c *userClient) Delete1(ctx context.Context, in *LoginRequest, opts ...grpc
 // All implementations must embed UnimplementedUserServer
 // for forward compatibility
 type UserServer interface {
-	// 列表
-	List(context.Context, *LoginRequest) (*LoginResponse, error)
+	List(context.Context, *Request) (*Response, error)
 	// 等了
-	Login(context.Context, *LoginRequest) (*LoginResponse, error)
-	Delete2(context.Context, *LoginRequest) (*LoginResponse, error)
-	Delete3(context.Context, *LoginRequest) (*LoginResponse, error)
-	Delete(context.Context, *LoginRequest) (*LoginResponse, error)
-	Delete1(context.Context, *LoginRequest) (*LoginResponse, error)
+	Auto(context.Context, *Request) (*Response, error)
+	All(context.Context, *Request) (*Response, error)
+	// 有 "user:list"
+	LoginWithList(context.Context, *Request) (*Response, error)
+	// 没有 "user:list" 权限
+	Login(context.Context, *Request) (*Response, error)
 	mustEmbedUnimplementedUserServer()
 }
 
@@ -122,23 +112,20 @@ type UserServer interface {
 type UnimplementedUserServer struct {
 }
 
-func (UnimplementedUserServer) List(context.Context, *LoginRequest) (*LoginResponse, error) {
+func (UnimplementedUserServer) List(context.Context, *Request) (*Response, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method List not implemented")
 }
-func (UnimplementedUserServer) Login(context.Context, *LoginRequest) (*LoginResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method Login not implemented")
-}
-func (UnimplementedUserServer) Delete2(context.Context, *LoginRequest) (*LoginResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method Delete2 not implemented")
+func (UnimplementedUserServer) Auto(context.Context, *Request) (*Response, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Auto not implemented")
 }
-func (UnimplementedUserServer) Delete3(context.Context, *LoginRequest) (*LoginResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method Delete3 not implemented")
+func (UnimplementedUserServer) All(context.Context, *Request) (*Response, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method All not implemented")
 }
-func (UnimplementedUserServer) Delete(context.Context, *LoginRequest) (*LoginResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method Delete not implemented")
+func (UnimplementedUserServer) LoginWithList(context.Context, *Request) (*Response, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method LoginWithList not implemented")
 }
-func (UnimplementedUserServer) Delete1(context.Context, *LoginRequest) (*LoginResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method Delete1 not implemented")
+func (UnimplementedUserServer) Login(context.Context, *Request) (*Response, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Login not implemented")
 }
 func (UnimplementedUserServer) mustEmbedUnimplementedUserServer() {}
 
@@ -154,7 +141,7 @@ func RegisterUserServer(s grpc.ServiceRegistrar, srv UserServer) {
 }
 
 func _User_List_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(LoginRequest)
+	in := new(Request)
 	if err := dec(in); err != nil {
 		return nil, err
 	}
@@ -166,97 +153,79 @@ func _User_List_Handler(srv interface{}, ctx context.Context, dec func(interface
 		FullMethod: User_List_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(UserServer).List(ctx, req.(*LoginRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _User_Login_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(LoginRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(UserServer).Login(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: User_Login_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(UserServer).Login(ctx, req.(*LoginRequest))
+		return srv.(UserServer).List(ctx, req.(*Request))
 	}
 	return interceptor(ctx, in, info, handler)
 }
 
-func _User_Delete2_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(LoginRequest)
+func _User_Auto_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(Request)
 	if err := dec(in); err != nil {
 		return nil, err
 	}
 	if interceptor == nil {
-		return srv.(UserServer).Delete2(ctx, in)
+		return srv.(UserServer).Auto(ctx, in)
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: User_Delete2_FullMethodName,
+		FullMethod: User_Auto_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(UserServer).Delete2(ctx, req.(*LoginRequest))
+		return srv.(UserServer).Auto(ctx, req.(*Request))
 	}
 	return interceptor(ctx, in, info, handler)
 }
 
-func _User_Delete3_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(LoginRequest)
+func _User_All_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(Request)
 	if err := dec(in); err != nil {
 		return nil, err
 	}
 	if interceptor == nil {
-		return srv.(UserServer).Delete3(ctx, in)
+		return srv.(UserServer).All(ctx, in)
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: User_Delete3_FullMethodName,
+		FullMethod: User_All_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(UserServer).Delete3(ctx, req.(*LoginRequest))
+		return srv.(UserServer).All(ctx, req.(*Request))
 	}
 	return interceptor(ctx, in, info, handler)
 }
 
-func _User_Delete_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(LoginRequest)
+func _User_LoginWithList_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(Request)
 	if err := dec(in); err != nil {
 		return nil, err
 	}
 	if interceptor == nil {
-		return srv.(UserServer).Delete(ctx, in)
+		return srv.(UserServer).LoginWithList(ctx, in)
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: User_Delete_FullMethodName,
+		FullMethod: User_LoginWithList_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(UserServer).Delete(ctx, req.(*LoginRequest))
+		return srv.(UserServer).LoginWithList(ctx, req.(*Request))
 	}
 	return interceptor(ctx, in, info, handler)
 }
 
-func _User_Delete1_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(LoginRequest)
+func _User_Login_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(Request)
 	if err := dec(in); err != nil {
 		return nil, err
 	}
 	if interceptor == nil {
-		return srv.(UserServer).Delete1(ctx, in)
+		return srv.(UserServer).Login(ctx, in)
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: User_Delete1_FullMethodName,
+		FullMethod: User_Login_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(UserServer).Delete1(ctx, req.(*LoginRequest))
+		return srv.(UserServer).Login(ctx, req.(*Request))
 	}
 	return interceptor(ctx, in, info, handler)
 }
@@ -273,24 +242,20 @@ var User_ServiceDesc = grpc.ServiceDesc{
 			Handler:    _User_List_Handler,
 		},
 		{
-			MethodName: "login",
-			Handler:    _User_Login_Handler,
+			MethodName: "auto",
+			Handler:    _User_Auto_Handler,
 		},
 		{
-			MethodName: "delete2",
-			Handler:    _User_Delete2_Handler,
+			MethodName: "all",
+			Handler:    _User_All_Handler,
 		},
 		{
-			MethodName: "delete3",
-			Handler:    _User_Delete3_Handler,
+			MethodName: "loginWithList",
+			Handler:    _User_LoginWithList_Handler,
 		},
 		{
-			MethodName: "delete",
-			Handler:    _User_Delete_Handler,
-		},
-		{
-			MethodName: "delete1",
-			Handler:    _User_Delete1_Handler,
+			MethodName: "login",
+			Handler:    _User_Login_Handler,
 		},
 	},
 	Streams:  []grpc.StreamDesc{},
diff --git a/api/user_http.pb.go b/api/user_http.pb.go
index 8f54480..8ffd733 100644
--- a/api/user_http.pb.go
+++ b/api/user_http.pb.go
@@ -7,26 +7,24 @@ import (
 )
 
 type UserHTTPServer interface {
-	List(context.Context, *LoginRequest) (*LoginResponse, error)
-	Login(context.Context, *LoginRequest) (*LoginResponse, error)
-	Delete2(context.Context, *LoginRequest) (*LoginResponse, error)
-	Delete3(context.Context, *LoginRequest) (*LoginResponse, error)
-	Delete(context.Context, *LoginRequest) (*LoginResponse, error)
-	Delete1(context.Context, *LoginRequest) (*LoginResponse, error)
+	List(context.Context, *Request) (*Response, error)
+	Auto(context.Context, *Request) (*Response, error)
+	All(context.Context, *Request) (*Response, error)
+	LoginWithList(context.Context, *Request) (*Response, error)
+	Login(context.Context, *Request) (*Response, error)
 }
 
 func RegisterUserHTTPServer(s *http.Server, srv UserServer) {
 	r := s.Route("/")
 	r.GET("/api/v1/user/list", _User_List0_HTTP_Handler(srv))
+	r.GET("/api/v1/user/auto", _User_Auto0_HTTP_Handler(srv))
+	r.GET("/api/v1/user/all", _User_All0_HTTP_Handler(srv))
+	r.GET("/api/v1/user/login_list", _User_LoginWithList0_HTTP_Handler(srv))
 	r.GET("/api/v1/user/login", _User_Login0_HTTP_Handler(srv))
-	r.GET("/api/v1/user/delete2", _User_Delete20_HTTP_Handler(srv))
-	r.GET("/api/v1/user/delete3", _User_Delete30_HTTP_Handler(srv))
-	r.GET("/api/v1/user/delete", _User_Delete0_HTTP_Handler(srv))
-	r.GET("/api/v1/user/delete1", _User_Delete10_HTTP_Handler(srv))
 }
 func _User_List0_HTTP_Handler(srv UserHTTPServer) func(ctx http.Context) error {
 	return func(ctx http.Context) error {
-		var in LoginRequest
+		var in Request
 		//user:list
 		var newCtx context.Context = ctx
 		newCtx = jwt.SetAuthKeyContext(newCtx, "user:list")
@@ -36,110 +34,90 @@ func _User_List0_HTTP_Handler(srv UserHTTPServer) func(ctx http.Context) error {
 		}
 		http.SetOperation(ctx, "/com.diulo.api.user/list")
 		h := ctx.Middleware(func(ctx context.Context, req interface{}) (interface{}, error) {
-			return srv.List(ctx, req.(*LoginRequest))
+			return srv.List(ctx, req.(*Request))
 		})
 		out, err := h(newCtx, &in)
 		if err != nil {
 			return err
 		}
-		reply := out.(*LoginResponse)
+		reply := out.(*Response)
 		return ctx.Result(200, reply)
 	}
 }
-func _User_Login0_HTTP_Handler(srv UserHTTPServer) func(ctx http.Context) error {
+func _User_Auto0_HTTP_Handler(srv UserHTTPServer) func(ctx http.Context) error {
 	return func(ctx http.Context) error {
-		var in LoginRequest
+		var in Request
 		var newCtx context.Context = ctx
 		newCtx = jwt.SetNeedAuthContext(newCtx, true)
 		if err := ctx.BindQuery(&in); err != nil {
 			return err
 		}
-		http.SetOperation(ctx, "/com.diulo.api.user/login")
-		h := ctx.Middleware(func(ctx context.Context, req interface{}) (interface{}, error) {
-			return srv.Login(ctx, req.(*LoginRequest))
-		})
-		out, err := h(newCtx, &in)
-		if err != nil {
-			return err
-		}
-		reply := out.(*LoginResponse)
-		return ctx.Result(200, reply)
-	}
-}
-func _User_Delete20_HTTP_Handler(srv UserHTTPServer) func(ctx http.Context) error {
-	return func(ctx http.Context) error {
-		var in LoginRequest
-		var newCtx context.Context = ctx
-		newCtx = jwt.SetAutoAuthContext(newCtx, true)
-		if err := ctx.BindQuery(&in); err != nil {
-			return err
-		}
-		http.SetOperation(ctx, "/com.diulo.api.user/delete2")
+		http.SetOperation(ctx, "/com.diulo.api.user/auto")
 		h := ctx.Middleware(func(ctx context.Context, req interface{}) (interface{}, error) {
-			return srv.Delete2(ctx, req.(*LoginRequest))
+			return srv.Auto(ctx, req.(*Request))
 		})
 		out, err := h(newCtx, &in)
 		if err != nil {
 			return err
 		}
-		reply := out.(*LoginResponse)
+		reply := out.(*Response)
 		return ctx.Result(200, reply)
 	}
 }
-func _User_Delete30_HTTP_Handler(srv UserHTTPServer) func(ctx http.Context) error {
+func _User_All0_HTTP_Handler(srv UserHTTPServer) func(ctx http.Context) error {
 	return func(ctx http.Context) error {
-		var in LoginRequest
+		var in Request
 		var newCtx context.Context = ctx
 		if err := ctx.BindQuery(&in); err != nil {
 			return err
 		}
-		http.SetOperation(ctx, "/com.diulo.api.user/delete3")
+		http.SetOperation(ctx, "/com.diulo.api.user/all")
 		h := ctx.Middleware(func(ctx context.Context, req interface{}) (interface{}, error) {
-			return srv.Delete3(ctx, req.(*LoginRequest))
+			return srv.All(ctx, req.(*Request))
 		})
 		out, err := h(newCtx, &in)
 		if err != nil {
 			return err
 		}
-		reply := out.(*LoginResponse)
+		reply := out.(*Response)
 		return ctx.Result(200, reply)
 	}
 }
-func _User_Delete0_HTTP_Handler(srv UserHTTPServer) func(ctx http.Context) error {
+func _User_LoginWithList0_HTTP_Handler(srv UserHTTPServer) func(ctx http.Context) error {
 	return func(ctx http.Context) error {
-		var in LoginRequest
+		var in Request
 		var newCtx context.Context = ctx
 		if err := ctx.BindQuery(&in); err != nil {
 			return err
 		}
-		http.SetOperation(ctx, "/com.diulo.api.user/delete")
+		http.SetOperation(ctx, "/com.diulo.api.user/loginWithList")
 		h := ctx.Middleware(func(ctx context.Context, req interface{}) (interface{}, error) {
-			return srv.Delete(ctx, req.(*LoginRequest))
+			return srv.LoginWithList(ctx, req.(*Request))
 		})
 		out, err := h(newCtx, &in)
 		if err != nil {
 			return err
 		}
-		reply := out.(*LoginResponse)
+		reply := out.(*Response)
 		return ctx.Result(200, reply)
 	}
 }
-func _User_Delete10_HTTP_Handler(srv UserHTTPServer) func(ctx http.Context) error {
+func _User_Login0_HTTP_Handler(srv UserHTTPServer) func(ctx http.Context) error {
 	return func(ctx http.Context) error {
-		var in LoginRequest
+		var in Request
 		var newCtx context.Context = ctx
 		if err := ctx.BindQuery(&in); err != nil {
 			return err
 		}
-		http.SetOperation(ctx, "/com.diulo.api.user/delete1")
+		http.SetOperation(ctx, "/com.diulo.api.user/login")
 		h := ctx.Middleware(func(ctx context.Context, req interface{}) (interface{}, error) {
-			return srv.Delete1(ctx, req.(*LoginRequest))
+			return srv.Login(ctx, req.(*Request))
 		})
 		out, err := h(newCtx, &in)
 		if err != nil {
 			return err
 		}
-		reply := out.(*LoginResponse)
+		reply := out.(*Response)
 		return ctx.Result(200, reply)
 	}
 }
diff --git a/cmd/kit/main.go b/cmd/kit/main.go
index 2594210..4f135e7 100644
--- a/cmd/kit/main.go
+++ b/cmd/kit/main.go
@@ -35,7 +35,6 @@ func (u *Kit) Generate(plugin *protogen.Plugin) error {
 		return nil
 	}
 	u.addImports("context")
-	u.addImports("git.diulo.com/mogfee/kit/middleware/jwt")
 	u.addImports("git.diulo.com/mogfee/kit/transport/http")
 	for _, f := range plugin.Files {
 		if len(f.Services) == 0 {
@@ -45,8 +44,8 @@ func (u *Kit) Generate(plugin *protogen.Plugin) error {
 		for _, s := range f.Services {
 			addAuthKey := false
 			for _, m := range s.Methods {
-				_, needAuth, autoAuth := protogen2.GetAuthKey(m)
-				if needAuth || autoAuth {
+				_, needAuth := protogen2.GetAuthKey(m)
+				if needAuth {
 					addAuthKey = true
 				}
 			}
@@ -99,7 +98,7 @@ func (u *Kit) Generate(plugin *protogen.Plugin) error {
 }
 
 func (u *Kit) genGet(f *protogen.File, s *protogen.Service, t *protogen.GeneratedFile, m *protogen.Method) {
-	authKey, needAuth, autoAuth := protogen2.GetAuthKey(m)
+	authKey, needAuth := protogen2.GetAuthKey(m)
 	method, path := protogen2.GetProtoMethod(m)
 	if method == "" {
 		return
@@ -117,10 +116,6 @@ func (u *Kit) genGet(f *protogen.File, s *protogen.Service, t *protogen.Generate
 	if needAuth {
 		t.P(`newCtx = jwt.SetNeedAuthContext(newCtx, `, needAuth, `)`)
 	}
-	if autoAuth {
-		t.P(`newCtx = jwt.SetAutoAuthContext(newCtx, `, autoAuth, `)`)
-	}
-
 	if method == protogen2.METHOD_GET {
 		t.P(`if err := ctx.BindQuery(&in); err != nil {
 			return err
diff --git a/example/main.go b/example/main.go
index 67ad3bf..77040e5 100644
--- a/example/main.go
+++ b/example/main.go
@@ -5,8 +5,10 @@ import (
 	"flag"
 	"fmt"
 	"git.diulo.com/mogfee/kit"
+	user "git.diulo.com/mogfee/kit/api"
 	"git.diulo.com/mogfee/kit/errors"
-	"git.diulo.com/mogfee/kit/middleware/cors"
+	"git.diulo.com/mogfee/kit/example/service"
+	"git.diulo.com/mogfee/kit/middleware/jwt"
 	"git.diulo.com/mogfee/kit/transport/http"
 )
 
@@ -21,8 +23,9 @@ func main() {
 	runApp(host)
 }
 func runApp(host string) {
-	hs := http.NewServer(
+	tokenKey := "1234567890123456"
 
+	hs := http.NewServer(
 		http.Address(host),
 		//http.Middleware(
 		//logging.Server(),
@@ -35,7 +38,8 @@ func runApp(host string) {
 		//	}
 		//}),
 		http.Middleware(
-			cors.Cors()),
+			jwt.JWT(jwt.WithJwtKey(tokenKey), jwt.WithFromKey("query:token")),
+		),
 	)
 	route := hs.Route("/")
 	route.GET("/api/v1/answer/listCategory", func(ctx http.Context) error {
@@ -56,7 +60,7 @@ func runApp(host string) {
 		return ctx.Result(200, reply)
 	})
 
-	//user.RegisterUserHTTPServer(hs, &service.UserService{})
+	user.RegisterUserHTTPServer(hs, service.NewUserService(tokenKey))
 	//client, err := clientv3.New(clientv3.Config{
 	//	Endpoints: []string{"127.0.0.1:2379"},
 	//})
diff --git a/example/service/service.go b/example/service/service.go
index 89e2dcd..8d35a30 100644
--- a/example/service/service.go
+++ b/example/service/service.go
@@ -2,38 +2,62 @@ package service
 
 import (
 	"context"
-	"encoding/json"
-	"fmt"
 	user "git.diulo.com/mogfee/kit/api"
 	"git.diulo.com/mogfee/kit/middleware/jwt"
-	"git.diulo.com/mogfee/kit/transport"
 )
 
-type UserService struct {
+type userServer struct {
 	user.UnimplementedUserServer
+	tokenKey string
 }
 
-func (*UserService) Login(ctx context.Context, req *user.LoginRequest) (*user.LoginResponse, error) {
-	//return nil, errors.BadRequest("BadRequest", "B")
-	return &user.LoginResponse{Token: "182131292"}, nil
+func NewUserService(tokenKey string) user.UserServer {
+	return &userServer{
+		tokenKey: tokenKey,
+	}
+}
+func (userServer) List(ctx context.Context, request *user.Request) (*user.Response, error) {
+	return &user.Response{
+		Token: "ok",
+	}, nil
 }
-func (*UserService) List(ctx context.Context, req *user.LoginRequest) (*user.LoginResponse, error) {
-	fmt.Println(jwt.FromUserContext(ctx))
-	fmt.Println(jwt.FromAuthKeyContext(ctx))
 
-	tr, ok := transport.FromServerContext(ctx)
-	if ok {
-		return &user.LoginResponse{Token: tr.Operation()}, nil
-	}
-	//fmt.Println(ctx.Value("userId"))
-	//return nil, errors.Wrap(errors.InternalServer("InternalServer", "B"), "")
+func (userServer) Auto(ctx context.Context, request *user.Request) (*user.Response, error) {
+	return &user.Response{
+		Token: "ok",
+	}, nil
+
+}
 
-	//b, _ := json.Marshal(req)
-	return &user.LoginResponse{Token: "123123"}, nil
+func (userServer) All(ctx context.Context, request *user.Request) (*user.Response, error) {
+	return &user.Response{
+		Token: "ok",
+	}, nil
 }
-func (*UserService) Delete(ctx context.Context, req *user.LoginRequest) (*user.LoginResponse, error) {
-	//return nil, errors.New("bad err")
 
-	b, _ := json.Marshal(req)
-	return &user.LoginResponse{Token: string(b)}, nil
+func (s *userServer) LoginWithList(ctx context.Context, request *user.Request) (*user.Response, error) {
+	token, _, err := jwt.GetToken(s.tokenKey, &jwt.UserInfo{
+		UserId:      1,
+		UserName:    "test",
+		UserType:    "user",
+		Permissions: []string{"user:list"},
+		UniqueId:    "",
+	})
+	if err != nil {
+		return nil, err
+	}
+	return &user.Response{Token: token}, nil
+}
+
+func (s *userServer) Login(ctx context.Context, request *user.Request) (*user.Response, error) {
+	token, _, err := jwt.GetToken(s.tokenKey, &jwt.UserInfo{
+		UserId:   1,
+		UserName: "test",
+		UserType: "user",
+		UniqueId: "",
+	})
+	if err != nil {
+		return nil, err
+	}
+	return &user.Response{Token: token}, nil
 }
diff --git a/git.diulo.com/mogfee/kit/third_party/auth/auth.pb.go b/git.diulo.com/mogfee/kit/third_party/auth/auth.pb.go
index 5496356..de6701b 100644
--- a/git.diulo.com/mogfee/kit/third_party/auth/auth.pb.go
+++ b/git.diulo.com/mogfee/kit/third_party/auth/auth.pb.go
@@ -37,14 +37,6 @@ var file_third_party_auth_auth_proto_extTypes = []protoimpl.ExtensionInfo{
 		Tag:           "varint,1112,opt,name=auth",
 		Filename:      "third_party/auth/auth.proto",
 	},
-	{
-		ExtendedType:  (*descriptorpb.MethodOptions)(nil),
-		ExtensionType: (*bool)(nil),
-		Field:         1113,
-		Name:          "auth.auto_auth",
-		Tag:           "varint,1113,opt,name=auto_auth",
-		Filename:      "third_party/auth/auth.proto",
-	},
 }
 
 // Extension fields to descriptorpb.MethodOptions.
@@ -57,10 +49,6 @@ var (
 	//
 	// optional bool auth = 1112;
 	E_Auth = &file_third_party_auth_auth_proto_extTypes[1]
-	// 可以不授权
-	//
-	// optional bool auto_auth = 1113;
-	E_AutoAuth = &file_third_party_auth_auth_proto_extTypes[2]
 )
 
 var File_third_party_auth_auth_proto protoreflect.FileDescriptor
@@ -77,14 +65,10 @@ var file_third_party_auth_auth_proto_rawDesc = []byte{
 	0x79, 0x3a, 0x33, 0x0a, 0x04, 0x61, 0x75, 0x74, 0x68, 0x12, 0x1e, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
 	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x4d, 0x65, 0x74, 0x68,
 	0x6f, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0xd8, 0x08, 0x20, 0x01, 0x28, 0x08,
-	0x52, 0x04, 0x61, 0x75, 0x74, 0x68, 0x3a, 0x3c, 0x0a, 0x09, 0x61, 0x75, 0x74, 0x6f, 0x5f, 0x61,
-	0x75, 0x74, 0x68, 0x12, 0x1e, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x4f, 0x70, 0x74, 0x69,
-	0x6f, 0x6e, 0x73, 0x18, 0xd9, 0x08, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x61, 0x75, 0x74, 0x6f,
-	0x41, 0x75, 0x74, 0x68, 0x42, 0x2b, 0x5a, 0x29, 0x67, 0x69, 0x74, 0x2e, 0x64, 0x69, 0x75, 0x6c,
-	0x6f, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6d, 0x6f, 0x67, 0x66, 0x65, 0x65, 0x2f, 0x6b, 0x69, 0x74,
-	0x2f, 0x74, 0x68, 0x69, 0x72, 0x64, 0x5f, 0x70, 0x61, 0x72, 0x74, 0x79, 0x2f, 0x61, 0x75, 0x74,
-	0x68, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x52, 0x04, 0x61, 0x75, 0x74, 0x68, 0x42, 0x2b, 0x5a, 0x29, 0x67, 0x69, 0x74, 0x2e, 0x64, 0x69,
+	0x75, 0x6c, 0x6f, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6d, 0x6f, 0x67, 0x66, 0x65, 0x65, 0x2f, 0x6b,
+	0x69, 0x74, 0x2f, 0x74, 0x68, 0x69, 0x72, 0x64, 0x5f, 0x70, 0x61, 0x72, 0x74, 0x79, 0x2f, 0x61,
+	0x75, 0x74, 0x68, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var file_third_party_auth_auth_proto_goTypes = []interface{}{
@@ -93,11 +77,10 @@ var file_third_party_auth_auth_proto_goTypes = []interface{}{
 var file_third_party_auth_auth_proto_depIdxs = []int32{
 	0, // 0: auth.auth_key:extendee -> google.protobuf.MethodOptions
 	0, // 1: auth.auth:extendee -> google.protobuf.MethodOptions
-	0, // 2: auth.auto_auth:extendee -> google.protobuf.MethodOptions
-	3, // [3:3] is the sub-list for method output_type
-	3, // [3:3] is the sub-list for method input_type
-	3, // [3:3] is the sub-list for extension type_name
-	0, // [0:3] is the sub-list for extension extendee
+	2, // [2:2] is the sub-list for method output_type
+	2, // [2:2] is the sub-list for method input_type
+	2, // [2:2] is the sub-list for extension type_name
+	0, // [0:2] is the sub-list for extension extendee
 	0, // [0:0] is the sub-list for field type_name
 }
 
@@ -113,7 +96,7 @@ func file_third_party_auth_auth_proto_init() {
 			RawDescriptor: file_third_party_auth_auth_proto_rawDesc,
 			NumEnums:      0,
 			NumMessages:   0,
-			NumExtensions: 3,
+			NumExtensions: 2,
 			NumServices:   0,
 		},
 		GoTypes:           file_third_party_auth_auth_proto_goTypes,
diff --git a/middleware/jwt/ctx.go b/middleware/jwt/ctx.go
new file mode 100644
index 0000000..a9f661e
--- /dev/null
+++ b/middleware/jwt/ctx.go
@@ -0,0 +1,37 @@
+package jwt
+
+import "golang.org/x/net/context"
+
+type userIdKey struct{}
+type authKey struct{}
+type needAuthKey struct{}
+
+func SetUserContext(ctx context.Context, user *UserInfo) context.Context {
+	return context.WithValue(ctx, userIdKey{}, user)
+}
+func FromUserContext(ctx context.Context) (user *UserInfo, ok bool) {
+	user, ok = ctx.Value(userIdKey{}).(*UserInfo)
+	return
+}
+
+func SetAuthKeyContext(ctx context.Context, key string) context.Context {
+	return context.WithValue(ctx, authKey{}, key)
+}
+func FromAuthKeyContext(ctx context.Context) string {
+	v := ctx.Value(authKey{})
+	if v == nil {
+		return ""
+	}
+	return v.(string)
+}
+
+func SetNeedAuthContext(ctx context.Context, auth bool) context.Context {
+	return context.WithValue(ctx, needAuthKey{}, auth)
+}
+func FromNeedAuthContext(ctx context.Context) bool {
+	v := ctx.Value(needAuthKey{})
+	if v == nil {
+		return false
+	}
+	return v.(bool)
+}
diff --git a/middleware/jwt/default.go b/middleware/jwt/default.go
new file mode 100644
index 0000000..289e96c
--- /dev/null
+++ b/middleware/jwt/default.go
@@ -0,0 +1,62 @@
+package jwt
+
+import (
+	"context"
+	"git.diulo.com/mogfee/kit/errors"
+	"git.diulo.com/mogfee/kit/transport"
+	"git.diulo.com/mogfee/kit/transport/http"
+	"strings"
+)
+
+type jwtDefault struct {
+}
+
+func (j *jwtDefault) GetToken(ctx context.Context, key string) (tokenStr string) {
+	arr := strings.Split(key, ":")
+	if len(arr) != 2 {
+		return ""
+	}
+	switch arr[0] {
+	case "cookie":
+		if tr, ok := transport.FromServerContext(ctx); ok {
+			if tr1, ok := tr.(http.Transporter); ok {
+				if co, err := tr1.Request().Cookie(arr[1]); err == nil {
+					return co.Value
+				}
+			}
+		}
+	case "header":
+		if tr, ok := transport.FromServerContext(ctx); ok {
+			return tr.RequestHeader().Get(arr[1])
+		}
+	case "query":
+		if tr, ok := transport.FromServerContext(ctx); ok {
+			if ht, ok := tr.(http.Transporter); ok {
+				return ht.Request().URL.Query().Get(arr[1])
+			}
+		}
+	}
+	return ""
+}
+
+func (j *jwtDefault) ParseToken(ctx context.Context, key string, token string) (*UserInfo, error) {
+	userInfo, err := Parse(key, token)
+	if err != nil {
+		return nil, err
+	}
+	return userInfo, nil
+}
+
+func (j *jwtDefault) Validate(ctx context.Context, permission string, permissions []string) error {
+	allowPers := strings.Split(permission, "|")
+	allowMap := make(map[string]bool, len(allowPers))
+	for _, v := range allowPers {
+		allowMap[v] = true
+	}
+	for _, v := range permissions {
+		if allowMap[v] {
+			return nil
+		}
+	}
+	return errors.Unauthorized("TOKEN_PERMISSION_BAD", "")
+}
diff --git a/middleware/jwt/jwt.go b/middleware/jwt/jwt.go
index 3972a1b..4a4707e 100644
--- a/middleware/jwt/jwt.go
+++ b/middleware/jwt/jwt.go
@@ -4,21 +4,8 @@ import (
 	"context"
 	"git.diulo.com/mogfee/kit/errors"
 	"git.diulo.com/mogfee/kit/middleware"
-	"git.diulo.com/mogfee/kit/transport"
-	"git.diulo.com/mogfee/kit/transport/http"
-	"strings"
 )
 
-const (
-	permissionNoCheck = "none"
-)
-
-type userIdKey struct{}
-type authKey struct{}
-type needAuthKey struct{}
-
-type GetFromToken func(ctx context.Context) string
-type ParseFunc func(ctx context.Context, key string, tokenStr string) (*UserInfo, bool, error)
 type JwtOption func(o *options)
 
 func WithJwtKey(jwtKey string) JwtOption {
@@ -27,57 +14,36 @@ func WithJwtKey(jwtKey string) JwtOption {
 	}
 }
 
-func WithValidate(validate func(authKey string) error) JwtOption {
+func WithFromKey(fromKey string) JwtOption {
 	return func(o *options) {
-		o.validate = validate
+		o.fromKey = fromKey
 	}
 }
-
-func WithValidatePermission(validatePermission func(permissions []string, key string) bool) JwtOption {
+func WithValidate(val JwtValidate) JwtOption {
 	return func(o *options) {
-		o.validatePermission = validatePermission
-	}
-}
-
-func WithParseFunc(parseFunc ParseFunc) JwtOption {
-	return func(o *options) {
-		o.parseFunc = parseFunc
-	}
-}
-
-func WithGetFromToken(fun GetFromToken) JwtOption {
-	return func(o *options) {
-		o.fromToken = fun
+		o.validate = val
 	}
 }
 
 type options struct {
-	jwtKey  string
-	fromKey string //cookie:token header:key
-	//validate           func(authKey string) error
-	//validatePermission func(validatePermission []string, key string) bool
-	parseFunc ParseFunc
-	//fromToken          GetFromToken
+	jwtKey   string
+	fromKey  string //cookie:token header:key
+	validate JwtValidate
+}
+type JwtValidate interface {
+	//GetToken 获取token
+	GetToken(ctx context.Context, key string) (tokenStr string)
+	//ParseToken 解析token获取用户信息
+	ParseToken(ctx context.Context, key string, token string) (*UserInfo, error)
+	//Validate 校验权限
+	Validate(ctx context.Context, permission string, permissions []string) error
 }
 
 func JWT(opts ...JwtOption) middleware.Middleware {
 	var cfg = &options{
-		jwtKey:             "JssLx22bjQwnyqby",
-		validatePermission: InSlice,
-		parseFunc: func(ctx context.Context, key string, tokenStr string) (*UserInfo, bool, error) {
-			userInfo, err := Parse(key, tokenStr)
-			if err != nil {
-				return nil, false, err
-			}
-			return userInfo, userInfo.UserId > 0, nil
-		},
-		fromToken: func(ctx context.Context) string {
-			var tokenStr string
-			if tr, ok := transport.FromServerContext(ctx); ok {
-				tokenStr = tr.RequestHeader().Get("token")
-			}
-			return tokenStr
-		},
+		jwtKey:   "JssLx22bjQwnyqby",
+		fromKey:  "header:token",
+		validate: &jwtDefault{},
 	}
 	for _, o := range opts {
 		o(cfg)
@@ -85,112 +51,35 @@ func JWT(opts ...JwtOption) middleware.Middleware {
 
 	return func(handler middleware.Handler) middleware.Handler {
 		return func(ctx context.Context, a any) (any, error) {
+			//1. 解析token
+			//2. 获取用户信息
+			//3. 校验权限
+			//4. 设置ctx
 			authKey := FromAuthKeyContext(ctx)
 			needAuth := FromNeedAuthContext(ctx)
-			autoAuth := FromAutoAuthContext(ctx)
 
-			tokenStr := getTokenStr(ctx, cfg.fromKey)
-			userInfo, checkOk, err := cfg.parseFunc(ctx, cfg.jwtKey, tokenStr)
+			// 解析token
+			tokenStr := cfg.validate.GetToken(ctx, cfg.fromKey)
+			if tokenStr == "" && needAuth {
+				return nil, errors.Unauthorized("NO_TOKEN", "")
+			}
+
+			userInfo, err := cfg.validate.ParseToken(ctx, cfg.jwtKey, tokenStr)
 			if err != nil {
 				return nil, err
 			}
+			if needAuth && userInfo.UserId == 0 {
+				return nil, errors.Unauthorized("TOKEN_BAD", "")
+			}
 
-			//需要验证
-			if needAuth {
-				if !checkOk {
-					return nil, errors.Unauthorized("TOKEN_PERMISSION_BAD", "")
+			if authKey != "" {
+				if err := cfg.validate.Validate(ctx, authKey, userInfo.Permissions); err != nil {
+					return nil, err
 				}
-				//if authKey != "" {
-				//	if !cfg.validatePermission(userInfo.Permissions, authKey) {
-				//		return nil, errors.Unauthorized("TOKEN_PERMISSION_BAD", "")
-				//	}
-				//}
-				//if cfg.validate != nil {
-				//	if err = cfg.validate(userInfo.UniqueId); err != nil {
-				//		return nil, err
-				//	}
-				//}
-			} else if autoAuth {
-
-			} else {
-
-			}
-			if checkOk {
-				ctx = SetUserContext(ctx, userInfo)
 			}
+
+			ctx = SetUserContext(ctx, userInfo)
 			return handler(ctx, a)
 		}
 	}
 }
-func getTokenStr(ctx context.Context, fromKey string) string {
-	arr := strings.Split(fromKey, ":")
-	if len(arr) != 2 {
-		return ""
-	}
-	switch arr[0] {
-	case "cookie":
-		if tr, ok := transport.FromServerContext(ctx); ok {
-			if tr1, ok := tr.(http.Transporter); ok {
-				if co, err := tr1.Request().Cookie(arr[1]); err == nil {
-					return co.Value
-				}
-			}
-		}
-	case "header":
-		if tr, ok := transport.FromServerContext(ctx); ok {
-			return tr.RequestHeader().Get(arr[1])
-		}
-	}
-	return ""
-}
-func InSlice(validatePermission []string, key string) bool {
-	for _, e := range validatePermission {
-		if e == key {
-			return true
-		}
-	}
-	return false
-}
-func SetUserContext(ctx context.Context, user *UserInfo) context.Context {
-	return context.WithValue(ctx, userIdKey{}, user)
-}
-func FromUserContext(ctx context.Context) (user *UserInfo, ok bool) {
-	user, ok = ctx.Value(userIdKey{}).(*UserInfo)
-	return
-}
-
-func SetAuthKeyContext(ctx context.Context, key string) context.Context {
-	return context.WithValue(ctx, authKey{}, key)
-}
-func FromAuthKeyContext(ctx context.Context) string {
-	v := ctx.Value(authKey{})
-	if v == nil {
-		return ""
-	}
-	return v.(string)
-}
-
-func SetNeedAuthContext(ctx context.Context, auth bool) context.Context {
-	return context.WithValue(ctx, needAuthKey{}, auth)
-}
-func FromNeedAuthContext(ctx context.Context) bool {
-	v := ctx.Value(needAuthKey{})
-	if v == nil {
-		return false
-	}
-	return v.(bool)
-}
-
-type autoAuthKey struct {
-}
-
-func SetAutoAuthContext(ctx context.Context, autoAuth bool) context.Context {
-	return context.WithValue(ctx, autoAuthKey{}, autoAuth)
-}
-func FromAutoAuthContext(ctx context.Context) bool {
-	v := ctx.Value(autoAuthKey{})
-	if v == nil {
-		return false
-	}
-	return v.(bool)
-}
diff --git a/middleware/jwt/token.go b/middleware/jwt/token.go
index 2597a1b..7313212 100644
--- a/middleware/jwt/token.go
+++ b/middleware/jwt/token.go
@@ -55,7 +55,7 @@ func GetToken(key string, info *UserInfo) (token string, uniqId string, err erro
 
 func Parse(key string, tokenStr string) (*UserInfo, error) {
 	if tokenStr == "" {
-		return nil, errors.Unauthorized("TOKEN_ERROR", "")
+		return &UserInfo{}, nil
 	}
 	str, err := Decrypt(tokenStr, []byte(key), key)
 	if err != nil {
diff --git a/proto/user.proto b/proto/user.proto
index 04eae30..dcf172b 100644
--- a/proto/user.proto
+++ b/proto/user.proto
@@ -3,61 +3,50 @@ package com.diulo.api;
 
 option go_package = "./;user";
 
-import "validate/validate.proto";
+//import "validate/validate.proto";
 import "google/api/annotations.proto";
 //import "google/protobuf/wrappers.proto";
 import "auth/auth.proto";
-import "google/protobuf/descriptor.proto";
+//import "google/protobuf/descriptor.proto";
 
 service user{
-  //列表
-  rpc list(loginRequest)returns(loginResponse){
+
+  rpc list(request)returns(response){
     option(auth.auth_key) = "user:list";
     option(google.api.http) = {
       get:"/api/v1/user/list"
     };
   }
   //等了
-  rpc login(loginRequest)returns(loginResponse){
+  rpc auto(request)returns(response){
     option(auth.auth) = true;
     option (google.api.http) = {
-      get: "/api/v1/user/login",
-    };
-  }
-
-  rpc delete2(loginRequest)returns(loginResponse){
-    option(auth.auto_auth) = true;
-    option (google.api.http) = {
-      get: "/api/v1/user/delete2",
+      get: "/api/v1/user/auto",
     };
   }
 
-  rpc delete3(loginRequest)returns(loginResponse){
-    option(auth.auto_auth) = false;
+  rpc all(request)returns(response){
+    option(auth.auth) = false;
     option (google.api.http) = {
-      get: "/api/v1/user/delete3",
+      get: "/api/v1/user/all",
     };
   }
-  rpc delete(loginRequest)returns(loginResponse){
-    option(auth.auth) = false;
+  //有 "user:list"
+  rpc loginWithList(request)returns(response){
     option (google.api.http) = {
-      get: "/api/v1/user/delete",
+      get: "/api/v1/user/login_list",
     };
   }
-
-  rpc delete1(loginRequest)returns(loginResponse){
+  // 没有 "user:list" 权限
+  rpc login(request)returns(response){
     option (google.api.http) = {
-      get: "/api/v1/user/delete1",
+      get: "/api/v1/user/login",
     };
   }
 }
-message loginRequest{
-  //用户名
-  string username = 1 [(validate.rules).string = {min_len:4,max_len:10}];
-  string password = 2 [(validate.rules).string = {min_len:4,max_len:10}];
-  string first_name = 3;
+message request{
 }
-message loginResponse{
+message response{
   //密钥
   string token = 1;
 }
\ No newline at end of file
diff --git a/protogen/protogen.go b/protogen/protogen.go
index c913e50..92833e0 100644
--- a/protogen/protogen.go
+++ b/protogen/protogen.go
@@ -33,11 +33,11 @@ func GetProtoMethod(m *protogen.Method) (method string, path string) {
 	return "", ""
 }
 
-func GetAuthKey(m *protogen.Method) (authKey string, needAuth bool, autoAuth bool) {
+func GetAuthKey(m *protogen.Method) (authKey string, needAuth bool) {
 	if op, ok := m.Desc.Options().(*descriptorpb.MethodOptions); ok {
 		if opts, err := proto.GetExtension(op, auth.E_AuthKey); err == nil {
 			if vv := opts.(*string); ok && *vv != "" {
-				return *vv, true, false
+				return *vv, true
 			}
 		}
 	}
@@ -45,17 +45,9 @@ func GetAuthKey(m *protogen.Method) (authKey string, needAuth bool, autoAuth boo
 	if op, ok := m.Desc.Options().(*descriptorpb.MethodOptions); ok {
 		if opts, err := proto.GetExtension(op, auth.E_Auth); err == nil {
 			if v, ok := opts.(*bool); ok && *v {
-				return "", true, false
+				return "", true
 			}
 		}
 	}
-
-	if op, ok := m.Desc.Options().(*descriptorpb.MethodOptions); ok {
-		if opts, err := proto.GetExtension(op, auth.E_AutoAuth); err == nil {
-			if v, ok := opts.(*bool); ok && *v {
-				return "", false, true
-			}
-		}
-	}
-	return "", false, false
+	return "", false
 }
diff --git a/third_party/auth/auth.pb.go b/third_party/auth/auth.pb.go
index 5ffb4ec..f64739b 100644
--- a/third_party/auth/auth.pb.go
+++ b/third_party/auth/auth.pb.go
@@ -37,14 +37,6 @@ var file_auth_proto_extTypes = []protoimpl.ExtensionInfo{
 		Tag:           "varint,1112,opt,name=auth",
 		Filename:      "auth.proto",
 	},
-	{
-		ExtendedType:  (*descriptorpb.MethodOptions)(nil),
-		ExtensionType: (*bool)(nil),
-		Field:         1113,
-		Name:          "auth.auto_auth",
-		Tag:           "varint,1113,opt,name=auto_auth",
-		Filename:      "auth.proto",
-	},
 }
 
 // Extension fields to descriptorpb.MethodOptions.
@@ -57,10 +49,6 @@ var (
 	//
 	// optional bool auth = 1112;
 	E_Auth = &file_auth_proto_extTypes[1]
-	// 可以不授权
-	//
-	// optional bool auto_auth = 1113;
-	E_AutoAuth = &file_auth_proto_extTypes[2]
 )
 
 var File_auth_proto protoreflect.FileDescriptor
@@ -76,14 +64,10 @@ var file_auth_proto_rawDesc = []byte{
 	0x3a, 0x33, 0x0a, 0x04, 0x61, 0x75, 0x74, 0x68, 0x12, 0x1e, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
 	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x4d, 0x65, 0x74, 0x68, 0x6f,
 	0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0xd8, 0x08, 0x20, 0x01, 0x28, 0x08, 0x52,
-	0x04, 0x61, 0x75, 0x74, 0x68, 0x3a, 0x3c, 0x0a, 0x09, 0x61, 0x75, 0x74, 0x6f, 0x5f, 0x61, 0x75,
-	0x74, 0x68, 0x12, 0x1e, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x62, 0x75, 0x66, 0x2e, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f,
-	0x6e, 0x73, 0x18, 0xd9, 0x08, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x61, 0x75, 0x74, 0x6f, 0x41,
-	0x75, 0x74, 0x68, 0x42, 0x2b, 0x5a, 0x29, 0x67, 0x69, 0x74, 0x2e, 0x64, 0x69, 0x75, 0x6c, 0x6f,
-	0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6d, 0x6f, 0x67, 0x66, 0x65, 0x65, 0x2f, 0x6b, 0x69, 0x74, 0x2f,
-	0x74, 0x68, 0x69, 0x72, 0x64, 0x5f, 0x70, 0x61, 0x72, 0x74, 0x79, 0x2f, 0x61, 0x75, 0x74, 0x68,
-	0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x04, 0x61, 0x75, 0x74, 0x68, 0x42, 0x2b, 0x5a, 0x29, 0x67, 0x69, 0x74, 0x2e, 0x64, 0x69, 0x75,
+	0x6c, 0x6f, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6d, 0x6f, 0x67, 0x66, 0x65, 0x65, 0x2f, 0x6b, 0x69,
+	0x74, 0x2f, 0x74, 0x68, 0x69, 0x72, 0x64, 0x5f, 0x70, 0x61, 0x72, 0x74, 0x79, 0x2f, 0x61, 0x75,
+	0x74, 0x68, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var file_auth_proto_goTypes = []interface{}{
@@ -92,11 +76,10 @@ var file_auth_proto_goTypes = []interface{}{
 var file_auth_proto_depIdxs = []int32{
 	0, // 0: auth.auth_key:extendee -> google.protobuf.MethodOptions
 	0, // 1: auth.auth:extendee -> google.protobuf.MethodOptions
-	0, // 2: auth.auto_auth:extendee -> google.protobuf.MethodOptions
-	3, // [3:3] is the sub-list for method output_type
-	3, // [3:3] is the sub-list for method input_type
-	3, // [3:3] is the sub-list for extension type_name
-	0, // [0:3] is the sub-list for extension extendee
+	2, // [2:2] is the sub-list for method output_type
+	2, // [2:2] is the sub-list for method input_type
+	2, // [2:2] is the sub-list for extension type_name
+	0, // [0:2] is the sub-list for extension extendee
 	0, // [0:0] is the sub-list for field type_name
 }
 
@@ -112,7 +95,7 @@ func file_auth_proto_init() {
 			RawDescriptor: file_auth_proto_rawDesc,
 			NumEnums:      0,
 			NumMessages:   0,
-			NumExtensions: 3,
+			NumExtensions: 2,
 			NumServices:   0,
 		},
 		GoTypes:           file_auth_proto_goTypes,
diff --git a/third_party/auth/auth.proto b/third_party/auth/auth.proto
index 8ce4599..d9c5f7b 100644
--- a/third_party/auth/auth.proto
+++ b/third_party/auth/auth.proto
@@ -9,6 +9,4 @@ extend google.protobuf.MethodOptions{
   string auth_key = 1111;
   //是否必须授权
   bool auth = 1112;
-  //可以不授权
-  bool auto_auth = 1113;
 }
\ No newline at end of file
diff --git a/third_party/auth/git.diulo.com/mogfee/kit/third_party/auth/auth.pb.go b/third_party/auth/git.diulo.com/mogfee/kit/third_party/auth/auth.pb.go
deleted file mode 100644
index 5ffb4ec..0000000
--- a/third_party/auth/git.diulo.com/mogfee/kit/third_party/auth/auth.pb.go
+++ /dev/null
@@ -1,126 +0,0 @@
-// Code generated by protoc-gen-go. DO NOT EDIT.
-// versions:
-// 	protoc-gen-go v1.28.1
-// 	protoc        v3.17.3
-// source: auth.proto
-
-package auth
-
-import (
-	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
-	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
-	descriptorpb "google.golang.org/protobuf/types/descriptorpb"
-	reflect "reflect"
-)
-
-const (
-	// Verify that this generated code is sufficiently up-to-date.
-	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
-	// Verify that runtime/protoimpl is sufficiently up-to-date.
-	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
-)
-
-var file_auth_proto_extTypes = []protoimpl.ExtensionInfo{
-	{
-		ExtendedType:  (*descriptorpb.MethodOptions)(nil),
-		ExtensionType: (*string)(nil),
-		Field:         1111,
-		Name:          "auth.auth_key",
-		Tag:           "bytes,1111,opt,name=auth_key",
-		Filename:      "auth.proto",
-	},
-	{
-		ExtendedType:  (*descriptorpb.MethodOptions)(nil),
-		ExtensionType: (*bool)(nil),
-		Field:         1112,
-		Name:          "auth.auth",
-		Tag:           "varint,1112,opt,name=auth",
-		Filename:      "auth.proto",
-	},
-	{
-		ExtendedType:  (*descriptorpb.MethodOptions)(nil),
-		ExtensionType: (*bool)(nil),
-		Field:         1113,
-		Name:          "auth.auto_auth",
-		Tag:           "varint,1113,opt,name=auto_auth",
-		Filename:      "auth.proto",
-	},
-}
-
-// Extension fields to descriptorpb.MethodOptions.
-var (
-	// 权限|分割多个权限
-	//
-	// optional string auth_key = 1111;
-	E_AuthKey = &file_auth_proto_extTypes[0]
-	// 是否必须授权
-	//
-	// optional bool auth = 1112;
-	E_Auth = &file_auth_proto_extTypes[1]
-	// 可以不授权
-	//
-	// optional bool auto_auth = 1113;
-	E_AutoAuth = &file_auth_proto_extTypes[2]
-)
-
-var File_auth_proto protoreflect.FileDescriptor
-
-var file_auth_proto_rawDesc = []byte{
-	0x0a, 0x0a, 0x61, 0x75, 0x74, 0x68, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x04, 0x61, 0x75,
-	0x74, 0x68, 0x1a, 0x20, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x62, 0x75, 0x66, 0x2f, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x2e, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x3a, 0x3a, 0x0a, 0x08, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x6b, 0x65, 0x79,
-	0x12, 0x1e, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
-	0x75, 0x66, 0x2e, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73,
-	0x18, 0xd7, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x61, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79,
-	0x3a, 0x33, 0x0a, 0x04, 0x61, 0x75, 0x74, 0x68, 0x12, 0x1e, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
-	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x4d, 0x65, 0x74, 0x68, 0x6f,
-	0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0xd8, 0x08, 0x20, 0x01, 0x28, 0x08, 0x52,
-	0x04, 0x61, 0x75, 0x74, 0x68, 0x3a, 0x3c, 0x0a, 0x09, 0x61, 0x75, 0x74, 0x6f, 0x5f, 0x61, 0x75,
-	0x74, 0x68, 0x12, 0x1e, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x62, 0x75, 0x66, 0x2e, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f,
-	0x6e, 0x73, 0x18, 0xd9, 0x08, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x61, 0x75, 0x74, 0x6f, 0x41,
-	0x75, 0x74, 0x68, 0x42, 0x2b, 0x5a, 0x29, 0x67, 0x69, 0x74, 0x2e, 0x64, 0x69, 0x75, 0x6c, 0x6f,
-	0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6d, 0x6f, 0x67, 0x66, 0x65, 0x65, 0x2f, 0x6b, 0x69, 0x74, 0x2f,
-	0x74, 0x68, 0x69, 0x72, 0x64, 0x5f, 0x70, 0x61, 0x72, 0x74, 0x79, 0x2f, 0x61, 0x75, 0x74, 0x68,
-	0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
-}
-
-var file_auth_proto_goTypes = []interface{}{
-	(*descriptorpb.MethodOptions)(nil), // 0: google.protobuf.MethodOptions
-}
-var file_auth_proto_depIdxs = []int32{
-	0, // 0: auth.auth_key:extendee -> google.protobuf.MethodOptions
-	0, // 1: auth.auth:extendee -> google.protobuf.MethodOptions
-	0, // 2: auth.auto_auth:extendee -> google.protobuf.MethodOptions
-	3, // [3:3] is the sub-list for method output_type
-	3, // [3:3] is the sub-list for method input_type
-	3, // [3:3] is the sub-list for extension type_name
-	0, // [0:3] is the sub-list for extension extendee
-	0, // [0:0] is the sub-list for field type_name
-}
-
-func init() { file_auth_proto_init() }
-func file_auth_proto_init() {
-	if File_auth_proto != nil {
-		return
-	}
-	type x struct{}
-	out := protoimpl.TypeBuilder{
-		File: protoimpl.DescBuilder{
-			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_auth_proto_rawDesc,
-			NumEnums:      0,
-			NumMessages:   0,
-			NumExtensions: 3,
-			NumServices:   0,
-		},
-		GoTypes:           file_auth_proto_goTypes,
-		DependencyIndexes: file_auth_proto_depIdxs,
-		ExtensionInfos:    file_auth_proto_extTypes,
-	}.Build()
-	File_auth_proto = out.File
-	file_auth_proto_rawDesc = nil
-	file_auth_proto_goTypes = nil
-	file_auth_proto_depIdxs = nil
-}