Account (Set|Change)Passsword (#267)

api/authmethods/account_test.go

@@ -0,0 +1,206 @@
+package authmethods_test
+
+import (
+	"fmt"
+	"net/http"
+	"testing"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/authmethods"
+	"github.com/hashicorp/boundary/internal/auth/password"
+	"github.com/hashicorp/boundary/internal/servers/controller"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestAccounts_List(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	orgId := "o_1234567890"
+	amId := "paum_1234567890"
+	tc := controller.NewTestController(t, &controller.TestControllerOpts{
+		DisableAuthorizationFailures: true,
+		DefaultOrgId:                 orgId,
+		DefaultAuthMethodId:          amId,
+		DefaultLoginName:             "user",
+		DefaultPassword:              "passpass",
+	})
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	accountClient := authmethods.NewAccountsClient(client)
+
+	expected, apiErr, err := accountClient.List(tc.Context(), amId)
+	assert.NoError(err)
+	assert.Nil(apiErr)
+	// A default account is created when a test controller is started.
+	assert.Len(expected, 1)
+
+	expected = append(expected, &authmethods.Account{Attributes: map[string]interface{}{"login_name": "loginname1"}})
+
+	expected[1], apiErr, err = accountClient.Create(tc.Context(), amId, authmethods.WithType("password"), authmethods.WithPasswordAccountLoginName(expected[1].Attributes["login_name"].(string)))
+	assert.NoError(err)
+	assert.Nil(apiErr)
+
+	ul, apiErr, err := accountClient.List(tc.Context(), amId)
+	assert.NoError(err)
+	assert.Nil(apiErr)
+	assert.ElementsMatch(comparableSlice(expected[:2]), comparableSlice(ul))
+
+	for i := 2; i < 10; i++ {
+		newAcct, apiErr, err := accountClient.Create(tc.Context(), amId, authmethods.WithType("password"), authmethods.WithPasswordAccountLoginName(fmt.Sprintf("loginname%d", i)))
+		expected = append(expected, newAcct)
+		assert.NoError(err)
+		assert.Nil(apiErr)
+	}
+	ul, apiErr, err = accountClient.List(tc.Context(), amId)
+	require.NoError(err)
+	assert.Nil(apiErr)
+	assert.ElementsMatch(comparableSlice(expected), comparableSlice(ul))
+}
+
+func comparableSlice(in []*authmethods.Account) []authmethods.Account {
+	var filtered []authmethods.Account
+	for _, i := range in {
+		p := authmethods.Account{
+			Id:          i.Id,
+			Name:        i.Name,
+			Description: i.Description,
+			CreatedTime: i.CreatedTime,
+			UpdatedTime: i.UpdatedTime,
+			Attributes:  i.Attributes,
+		}
+		filtered = append(filtered, p)
+	}
+	return filtered
+}
+
+func TestAccount_Crud(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	orgId := "o_1234567890"
+	amId := "paum_1234567890"
+	tc := controller.NewTestController(t, &controller.TestControllerOpts{
+		DisableAuthorizationFailures: true,
+		DefaultOrgId:                 orgId,
+		DefaultAuthMethodId:          amId,
+		DefaultLoginName:             "user",
+		DefaultPassword:              "passpass",
+	})
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	accountClient := authmethods.NewAccountsClient(client)
+
+	checkAccount := func(step string, u *authmethods.Account, apiErr *api.Error, err error, wantedName string, wantedVersion uint32) {
+		assert.NoError(err, step)
+		if !assert.Nil(apiErr, step) && apiErr.Message != "" {
+			t.Errorf("ApiError message: %q", apiErr.Message)
+		}
+		require.NotNil(u, "returned no resource", step)
+		gotName := ""
+		if u.Name != "" {
+			gotName = u.Name
+		}
+		assert.Equal(wantedName, gotName, step)
+		assert.EqualValues(wantedVersion, u.Version)
+	}
+
+	u, apiErr, err := accountClient.Create(tc.Context(), amId, authmethods.WithType("password"), authmethods.WithName("foo"), authmethods.WithPasswordAccountLoginName("loginname"))
+	checkAccount("create", u, apiErr, err, "foo", 1)
+
+	u, apiErr, err = accountClient.Read(tc.Context(), amId, u.Id)
+	checkAccount("read", u, apiErr, err, "foo", 1)
+
+	u, apiErr, err = accountClient.Update(tc.Context(), amId, u.Id, u.Version, authmethods.WithName("bar"))
+	checkAccount("update", u, apiErr, err, "bar", 2)
+
+	u, apiErr, err = accountClient.Update(tc.Context(), amId, u.Id, u.Version, authmethods.DefaultName())
+	checkAccount("update", u, apiErr, err, "", 3)
+
+	existed, _, err := accountClient.Delete(tc.Context(), amId, u.Id)
+	require.NoError(err)
+	assert.Nil(apiErr)
+	assert.True(existed, "Expected existing account when deleted, but it wasn't.")
+
+	existed, apiErr, err = accountClient.Delete(tc.Context(), amId, u.Id)
+	require.NoError(err)
+	assert.Nil(apiErr)
+	assert.False(existed, "Expected account to not exist when deleted, but it did.")
+}
+
+func TestAccount_CustomMethods(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	orgId := "o_1234567890"
+	amId := "paum_1234567890"
+	tc := controller.NewTestController(t, &controller.TestControllerOpts{
+		DisableAuthorizationFailures: true,
+		DefaultOrgId:                 orgId,
+		DefaultAuthMethodId:          amId,
+		DefaultLoginName:             "user",
+		DefaultPassword:              "passpass",
+	})
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	accountClient := authmethods.NewAccountsClient(client)
+
+	al, apiErr, err := accountClient.List(tc.Context(), amId)
+	require.NoError(err)
+	require.Nil(apiErr)
+	require.Len(al, 1)
+
+	acct := al[0]
+
+	setAcct, apiErr, err := accountClient.SetPassword(tc.Context(), amId, acct.Id, "setpassword", acct.Version)
+	require.NoError(err)
+	require.Nil(apiErr)
+	require.NotNil(setAcct)
+	assert.Equal(acct.Version+1, setAcct.Version)
+
+	changeAcct, apiErr, err := accountClient.ChangePassword(tc.Context(), amId, acct.Id, "setpassword", "changepassword", setAcct.Version)
+	require.NoError(err)
+	require.Nil(apiErr)
+	require.NotNil(changeAcct)
+	assert.Equal(setAcct.Version+1, changeAcct.Version)
+}
+
+func TestAccount_Errors(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	orgId := "o_1234567890"
+	amId := "paum_1234567890"
+	tc := controller.NewTestController(t, &controller.TestControllerOpts{
+		DisableAuthorizationFailures: true,
+		DefaultOrgId:                 orgId,
+		DefaultAuthMethodId:          amId,
+		DefaultLoginName:             "user",
+		DefaultPassword:              "passpass",
+	})
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	accountClient := authmethods.NewAccountsClient(client)
+
+	u, apiErr, err := accountClient.Create(tc.Context(), amId, authmethods.WithType("password"), authmethods.WithPasswordAccountLoginName("first"))
+	require.NoError(err)
+	assert.Nil(apiErr)
+	assert.NotNil(u)
+
+	// Create another resource with the same name.
+	_, apiErr, err = accountClient.Create(tc.Context(), amId, authmethods.WithType("password"), authmethods.WithPasswordAccountLoginName("first"))
+	require.NoError(err)
+	assert.NotNil(apiErr)
+
+	_, apiErr, err = accountClient.Read(tc.Context(), amId, password.AccountPrefix+"_doesntexis")
+	require.NoError(err)
+	assert.NotNil(apiErr)
+	assert.EqualValues(http.StatusNotFound, apiErr.Status)
+
+	_, apiErr, err = accountClient.Read(tc.Context(), amId, "invalid id")
+	require.NoError(err)
+	assert.NotNil(apiErr)
+	assert.EqualValues(http.StatusForbidden, apiErr.Status)
+
+	_, apiErr, err = accountClient.Update(tc.Context(), amId, u.Id, u.Version)
+	require.NoError(err)
+	assert.NotNil(apiErr)
+	assert.EqualValues(http.StatusBadRequest, apiErr.Status)
+}

api/authmethods/changepassword.go

@@ -0,0 +1,65 @@
+package authmethods
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/kr/pretty"
+)
+
+func (c *AccountsClient) ChangePassword(ctx context.Context, authMethodId, accountId, oldPassword, newPassword string, version uint32, opt ...Option) (*Account, *api.Error, error) {
+	if authMethodId == "" {
+		return nil, nil, fmt.Errorf("empty authMethodId value passed into ChangePassword request")
+	}
+	if accountId == "" {
+		return nil, nil, fmt.Errorf("empty accountId value passed into ChangePassword request")
+	}
+	if c.client == nil {
+		return nil, nil, fmt.Errorf("nil client in ChangePassword request")
+	}
+
+	opts, apiOpts := getOpts(opt...)
+
+	if version == 0 {
+		if !opts.withAutomaticVersioning {
+			return nil, nil, errors.New("zero version number passed into Update request and automatic versioning not specified")
+		}
+		existingTarget, existingApiErr, existingErr := c.Read(ctx, authMethodId, accountId, opt...)
+		if existingErr != nil {
+			return nil, nil, fmt.Errorf("error performing initial check-and-set read: %w", existingErr)
+		}
+		if existingApiErr != nil {
+			return nil, nil, fmt.Errorf("error from controller when performing initial check-and-set read: %s", pretty.Sprint(existingApiErr))
+		}
+		if existingTarget == nil {
+			return nil, nil, errors.New("nil resource found when performing initial check-and-set read")
+		}
+		version = existingTarget.Version
+	}
+
+	reqBody := map[string]interface{}{
+		"version":      version,
+		"old_password": oldPassword,
+		"new_password": newPassword,
+	}
+
+	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("auth-methods/%s/accounts/%s:change-password", authMethodId, accountId), reqBody, apiOpts...)
+	if err != nil {
+		return nil, nil, fmt.Errorf("error creating ChangePassword request: %w", err)
+	}
+
+	resp, err := c.client.Do(req)
+	if err != nil {
+		return nil, nil, fmt.Errorf("error performing client request during ChangePassword call: %w", err)
+	}
+
+	target := new(Account)
+	apiErr, err := resp.Decode(target)
+	if err != nil {
+		return nil, nil, fmt.Errorf("error decoding ChangePassword response: %w", err)
+	}
+
+	return target, apiErr, nil
+}

api/authmethods/setpassword.go

@@ -0,0 +1,64 @@
+package authmethods
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/kr/pretty"
+)
+
+func (c *AccountsClient) SetPassword(ctx context.Context, authMethodId, accountId, password string, version uint32, opt ...Option) (*Account, *api.Error, error) {
+	if authMethodId == "" {
+		return nil, nil, fmt.Errorf("empty authMethodId value passed into SetPassword request")
+	}
+	if accountId == "" {
+		return nil, nil, fmt.Errorf("empty accountId value passed into SetPassword request")
+	}
+	if c.client == nil {
+		return nil, nil, fmt.Errorf("nil client in SetPassword request")
+	}
+
+	opts, apiOpts := getOpts(opt...)
+
+	if version == 0 {
+		if !opts.withAutomaticVersioning {
+			return nil, nil, errors.New("zero version number passed into Update request and automatic versioning not specified")
+		}
+		existingTarget, existingApiErr, existingErr := c.Read(ctx, authMethodId, accountId, opt...)
+		if existingErr != nil {
+			return nil, nil, fmt.Errorf("error performing initial check-and-set read: %w", existingErr)
+		}
+		if existingApiErr != nil {
+			return nil, nil, fmt.Errorf("error from controller when performing initial check-and-set read: %s", pretty.Sprint(existingApiErr))
+		}
+		if existingTarget == nil {
+			return nil, nil, errors.New("nil resource found when performing initial check-and-set read")
+		}
+		version = existingTarget.Version
+	}
+
+	reqBody := map[string]interface{}{
+		"version":  version,
+		"password": password,
+	}
+
+	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("auth-methods/%s/accounts/%s:set-password", authMethodId, accountId), reqBody, apiOpts...)
+	if err != nil {
+		return nil, nil, fmt.Errorf("error creating SetPassword request: %w", err)
+	}
+
+	resp, err := c.client.Do(req)
+	if err != nil {
+		return nil, nil, fmt.Errorf("error performing client request during SetPassword call: %w", err)
+	}
+
+	target := new(Account)
+	apiErr, err := resp.Decode(target)
+	if err != nil {
+		return nil, nil, fmt.Errorf("error decoding SetPassword response: %w", err)
+	}
+
+	return target, apiErr, nil
+}

internal/auth/password/account.go

@@ -19,8 +19,8 @@ type Account struct {
 	CredentialId string `gorm:"-"`
 }
 
-func allocAccount() Account {
-	return Account{
+func allocAccount() *Account {
+	return &Account{
 		Account: &store.Account{},
 	}
 }

internal/auth/password/query.go

@@ -10,6 +10,7 @@ select acct.name,                        -- Account.Name
        acct.scope_id,                    -- Account.ScopeId
        acct.create_time,                 -- Account.CreateTime
        acct.update_time,                 -- Account.UpdateTime
+       acct.version,                     -- Account.Version
        cred.private_id as credential_id, -- Account.CredentialId
        cred.private_id,                  -- Argon2Credential.PrivateId
        cred.password_conf_id,            -- Argon2Credential.PasswordConfId

internal/auth/password/repository_account.go

@@ -109,13 +109,13 @@ func (r *Repository) LookupAccount(ctx context.Context, withPublicId string, opt
 	}
 	a := allocAccount()
 	a.PublicId = withPublicId
-	if err := r.reader.LookupByPublicId(ctx, &a); err != nil {
+	if err := r.reader.LookupByPublicId(ctx, a); err != nil {
 		if errors.Is(err, db.ErrRecordNotFound) {
 			return nil, nil
 		}
 		return nil, fmt.Errorf("lookup: password account: failed %w for %s", err, withPublicId)
 	}
-	return &a, nil
+	return a, nil
 }
 
 // ListAccounts in an auth method and supports WithLimit option.

internal/auth/password/repository_password.go

@@ -83,18 +83,15 @@ func (r *Repository) Authenticate(ctx context.Context, authMethodId string, logi
 	return acct.Account, nil
 }
 
-// ChangePassword updates the password for loginName in authMethodId to new
-// if old equals the stored password. The account for the loginName is
-// returned with a new CredentialId if password is successfully changed.
+// ChangePassword updates the password for accountId to new if old equals
+// the stored password. The account for the loginName is returned with a
+// new CredentialId if password is successfully changed.
 //
-// Returns nil if old does not match the stored password for loginName.
+// Returns nil if old does not match the stored password for accountId.
 // Returns ErrPasswordsEqual if old and new are equal.
-func (r *Repository) ChangePassword(ctx context.Context, authMethodId string, loginName string, old, new string) (*Account, error) {
-	if authMethodId == "" {
-		return nil, fmt.Errorf("change password: no authMethodId: %w", db.ErrInvalidParameter)
-	}
-	if loginName == "" {
-		return nil, fmt.Errorf("change password: no loginName: %w", db.ErrInvalidParameter)
+func (r *Repository) ChangePassword(ctx context.Context, accountId string, old, new string, version uint32) (*Account, error) {
+	if accountId == "" {
+		return nil, fmt.Errorf("change password: no account id: %w", db.ErrInvalidParameter)
 	}
 	if old == "" {
 		return nil, fmt.Errorf("change password: no old password: %w", db.ErrInvalidParameter)
@@ -105,8 +102,19 @@ func (r *Repository) ChangePassword(ctx context.Context, authMethodId string, lo
 	if old == new {
 		return nil, fmt.Errorf("change password: %w", ErrPasswordsEqual)
 	}
+	if version == 0 {
+		return nil, fmt.Errorf("change password: no version supplied: %w", db.ErrInvalidParameter)
+	}
 
-	acct, err := r.authenticate(ctx, authMethodId, loginName, old)
+	authAccount, err := r.LookupAccount(ctx, accountId)
+	if err != nil {
+		return nil, fmt.Errorf("change password: lookup account: %w", err)
+	}
+	if authAccount == nil {
+		return nil, fmt.Errorf("change password: lookup account: account not found: %w", db.ErrRecordNotFound)
+	}
+
+	acct, err := r.authenticate(ctx, authAccount.GetAuthMethodId(), authAccount.GetLoginName(), old)
 	if err != nil {
 		return nil, fmt.Errorf("change password: %w", err)
 	}
@@ -114,14 +122,14 @@ func (r *Repository) ChangePassword(ctx context.Context, authMethodId string, lo
 		return nil, nil
 	}
 
-	cc, err := r.currentConfig(ctx, authMethodId)
+	cc, err := r.currentConfig(ctx, authAccount.GetAuthMethodId())
 	if err != nil {
 		return nil, fmt.Errorf("change password: retrieve current password configuration: %w", err)
 	}
 	if cc.MinPasswordLength > len(new) {
 		return nil, fmt.Errorf("change password: %w", ErrTooShort)
 	}
-	newCred, err := newArgon2Credential(acct.PublicId, new, cc.argon2())
+	newCred, err := newArgon2Credential(accountId, new, cc.argon2())
 	if err != nil {
 		return nil, fmt.Errorf("change password: %w", err)
 	}
@@ -132,8 +140,20 @@ func (r *Repository) ChangePassword(ctx context.Context, authMethodId string, lo
 
 	oldCred := acct.Argon2Credential
 
+	var updatedAccount *Account
 	_, err = r.writer.DoTx(ctx, db.StdRetryCnt, db.ExpBackoff{},
 		func(_ db.Reader, w db.Writer) error {
+			updatedAccount = allocAccount()
+			updatedAccount.PublicId = accountId
+			updatedAccount.Version = version + 1
+			rowsUpdated, err := w.Update(ctx, updatedAccount, []string{"Version"}, nil, db.WithOplog(r.wrapper, acct.Account.oplog(oplog.OpType_OP_TYPE_UPDATE)), db.WithVersion(&version))
+			if err != nil {
+				return fmt.Errorf("change password: unable to update account version: %w", err)
+			}
+			if rowsUpdated != 1 {
+				return fmt.Errorf("change password: updated account and %d rows updated", rowsUpdated)
+			}
+
 			rowsDeleted, err := w.Delete(ctx, oldCred, db.WithOplog(r.wrapper, oldCred.oplog(oplog.OpType_OP_TYPE_DELETE)))
 			if err == nil && rowsDeleted > 1 {
 				return db.ErrMultipleRecords
@@ -149,8 +169,8 @@ func (r *Repository) ChangePassword(ctx context.Context, authMethodId string, lo
 	}
 
 	// change the Credential Id
-	acct.Account.CredentialId = newCred.PrivateId
-	return acct.Account, nil
+	updatedAccount.CredentialId = newCred.PrivateId
+	return updatedAccount, nil
 }
 
 func (r *Repository) authenticate(ctx context.Context, authMethodId string, loginName string, password string) (*authAccount, error) {
@@ -198,31 +218,50 @@ func (r *Repository) authenticate(ctx context.Context, authMethodId string, logi
 
 // SetPassword sets the password for accountId to password. If password
 // contains an empty string, the password for accountId will be deleted.
-func (r *Repository) SetPassword(ctx context.Context, accountId string, password string) error {
+func (r *Repository) SetPassword(ctx context.Context, accountId string, password string, version uint32) (*Account, error) {
 	if accountId == "" {
-		return fmt.Errorf("set password: no accountId: %w", db.ErrInvalidParameter)
+		return nil, fmt.Errorf("set password: no accountId: %w", db.ErrInvalidParameter)
+	}
+	if version == 0 {
+		return nil, fmt.Errorf("set password: no version supplied: %w", db.ErrInvalidParameter)
 	}
 
 	var newCred *Argon2Credential
 	if password != "" {
 		cc, err := r.currentConfigForAccount(ctx, accountId)
 		if err != nil {
-			return fmt.Errorf("set password: retrieve current configuration: %w", err)
+			return nil, fmt.Errorf("set password: retrieve current configuration: %w", err)
+		}
+		if cc == nil {
+			return nil, fmt.Errorf("set password: retrieve current configuration: %w", db.ErrRecordNotFound)
 		}
 		if cc.MinPasswordLength > len(password) {
-			return fmt.Errorf("set password: new password: %w", ErrTooShort)
+			return nil, fmt.Errorf("set password: new password: %w", ErrTooShort)
 		}
 		newCred, err = newArgon2Credential(accountId, password, cc.argon2())
 		if err != nil {
-			return fmt.Errorf("set password: %w", err)
+			return nil, fmt.Errorf("set password: %w", err)
 		}
 		if err := newCred.encrypt(ctx, r.wrapper); err != nil {
-			return fmt.Errorf("set password: encrypt: %w", err)
+			return nil, fmt.Errorf("set password: encrypt: %w", err)
 		}
 	}
 
+	var acct *Account
 	_, err := r.writer.DoTx(ctx, db.StdRetryCnt, db.ExpBackoff{},
 		func(rr db.Reader, w db.Writer) error {
+			updatedAccount := allocAccount()
+			updatedAccount.PublicId = accountId
+			updatedAccount.Version = version + 1
+			rowsUpdated, err := w.Update(ctx, updatedAccount, []string{"Version"}, nil, db.WithOplog(r.wrapper, updatedAccount.oplog(oplog.OpType_OP_TYPE_UPDATE)), db.WithVersion(&version))
+			if err != nil {
+				return fmt.Errorf("set password: unable to update account version: %w", err)
+			}
+			if rowsUpdated != 1 {
+				return fmt.Errorf("set password: updated account and %d rows updated", rowsUpdated)
+			}
+			acct = updatedAccount
+
 			oldCred := allocCredential()
 			if err := rr.LookupWhere(ctx, &oldCred, "password_account_id = ?", accountId); err != nil {
 				if !errors.Is(err, db.ErrRecordNotFound) {
@@ -246,7 +285,7 @@ func (r *Repository) SetPassword(ctx context.Context, accountId string, password
 		},
 	)
 	if err != nil {
-		return fmt.Errorf("set password: %w", err)
+		return nil, fmt.Errorf("set password: %w", err)
 	}
-	return nil
+	return acct, nil
 }

internal/auth/password/repository_password_test.go

@@ -248,91 +248,84 @@ func TestRepository_ChangePassword(t *testing.T) {
 	require.NoError(t, err)
 	require.NotNil(t, repo)
 
+	o, _ := iam.TestScopes(t, conn)
+	authMethod := TestAuthMethods(t, conn, o.GetPublicId(), 1)[0]
+
 	inAcct := &Account{
 		Account: &store.Account{
-			LoginName: "kazmierczak",
+			LoginName:    "kazmierczak",
+			AuthMethodId: authMethod.PublicId,
 		},
 	}
 	passwd := "12345678"
 
+	acct, err := repo.CreateAccount(context.Background(), inAcct, WithPassword(passwd))
+	require.NoError(t, err)
+	require.NotNil(t, acct)
+
 	type args struct {
-		authMethodId string
-		loginName    string
-		old, new     string
+		acctId   string
+		old, new string
 	}
 
 	var tests = []struct {
-		name            string
-		args            args
-		useAuthMethodId bool
-		wantAccount     bool
-		wantIsErr       error
+		name        string
+		args        args
+		wantAccount bool
+		wantIsErr   error
 	}{
 		{
-			name: "invalid-no-authMethodId",
+			name: "invalid-no-accountId",
 			args: args{
-				authMethodId: "",
-				loginName:    inAcct.LoginName,
-				old:          passwd,
-				new:          "12345678-changed",
-			},
-			useAuthMethodId: true,
-			wantIsErr:       db.ErrInvalidParameter,
-		},
-		{
-			name: "invalid-no-loginName",
-			args: args{
-				loginName: "",
-				old:       passwd,
-				new:       "12345678-changed",
+				acctId: "",
+				old:    passwd,
+				new:    "12345678-changed",
 			},
 			wantIsErr: db.ErrInvalidParameter,
 		},
 		{
 			name: "invalid-no-old-password",
 			args: args{
-				loginName: inAcct.LoginName,
-				old:       "",
-				new:       "12345678-changed",
+				acctId: acct.PublicId,
+				old:    "",
+				new:    "12345678-changed",
 			},
 			wantIsErr: db.ErrInvalidParameter,
 		},
 		{
 			name: "invalid-no-new-password",
 			args: args{
-				loginName: inAcct.LoginName,
-				old:       passwd,
-				new:       "",
+				acctId: acct.PublicId,
+				old:    passwd,
+				new:    "",
 			},
 			wantIsErr: db.ErrInvalidParameter,
 		},
 		{
 			name: "invalid-same-passwords",
 			args: args{
-				loginName: inAcct.LoginName,
-				old:       passwd,
-				new:       passwd,
+				acctId: acct.PublicId,
+				old:    passwd,
+				new:    passwd,
 			},
 			wantIsErr: ErrPasswordsEqual,
 		},
 		{
-			name: "auth-failure-unknown-authMethodId",
+			name: "auth-failure-unknown-accountId",
 			args: args{
-				authMethodId: "not-an-authMethod-Id",
-				loginName:    inAcct.LoginName,
-				old:          passwd,
-				new:          "12345678-changed",
+				acctId: "not-an-account-Id",
+				old:    passwd,
+				new:    "12345678-changed",
 			},
-			useAuthMethodId: true,
-			wantAccount:     false,
-			wantIsErr:       nil,
+			wantAccount: false,
+			wantIsErr:   db.ErrRecordNotFound,
 		},
 		{
 			name: "auth-failure-wrong-old-password",
 			args: args{
-				loginName: inAcct.LoginName,
-				old:       "wrong-password",
-				new:       "12345678-changed",
+				acctId: acct.PublicId,
+				old:    "wrong-password",
+				new:    "12345678-changed",
 			},
 			wantAccount: false,
 			wantIsErr:   nil,
@@ -340,18 +333,18 @@ func TestRepository_ChangePassword(t *testing.T) {
 		{
 			name: "password-to-short",
 			args: args{
-				loginName: inAcct.LoginName,
-				old:       passwd,
-				new:       "1",
+				acctId: acct.PublicId,
+				old:    passwd,
+				new:    "1",
 			},
 			wantIsErr: ErrTooShort,
 		},
 		{
 			name: "valid",
 			args: args{
-				loginName: inAcct.LoginName,
-				old:       passwd,
-				new:       "12345678-changed",
+				acctId: acct.PublicId,
+				old:    passwd,
+				new:    "12345678-changed",
 			},
 			wantAccount: true,
 		},
@@ -361,16 +354,6 @@ func TestRepository_ChangePassword(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
 
-			o, _ := iam.TestScopes(t, conn)
-			authMethod := TestAuthMethods(t, conn, o.GetPublicId(), 1)[0]
-			inAcct.AuthMethodId = authMethod.PublicId
-			outAcct, err := repo.CreateAccount(context.Background(), inAcct, WithPassword(passwd))
-			require.NoError(err)
-			require.NotNil(outAcct)
-
-			if !tt.useAuthMethodId {
-				tt.args.authMethodId = authMethod.PublicId
-			}
 			// Calls to Authenticate should always succeed in these tests
 			authFn := func(pwd string, name string) *Account {
 				acct, err := repo.Authenticate(context.Background(), inAcct.AuthMethodId, inAcct.LoginName, pwd)
@@ -381,7 +364,7 @@ func TestRepository_ChangePassword(t *testing.T) {
 			// authenticate with original password
 			authAcct1 := authFn(passwd, "original account")
 
-			chgAuthAcct, err := repo.ChangePassword(context.Background(), tt.args.authMethodId, tt.args.loginName, tt.args.old, tt.args.new)
+			chgAuthAcct, err := repo.ChangePassword(context.Background(), tt.args.acctId, tt.args.old, tt.args.new, authAcct1.Version)
 			if tt.wantIsErr != nil {
 				assert.Error(err)
 				assert.Truef(errors.Is(err, tt.wantIsErr), "want err: %q got: %q", tt.wantIsErr, err)
@@ -421,127 +404,134 @@ func TestRepository_SetPassword(t *testing.T) {
 	require.NoError(t, err)
 	require.NotNil(t, repo)
 
-	template := &Account{
-		Account: &store.Account{
-			LoginName: "kazmierczak",
-		},
-	}
+	o, _ := iam.TestScopes(t, conn)
+	authMethod := TestAuthMethods(t, conn, o.GetPublicId(), 1)[0]
+
 	origPasswd := "12345678"
 
-	wantAuthenticate := func(t *testing.T, authMethodId string, pwd string, msg string) string {
-		acct, err := repo.Authenticate(context.Background(), authMethodId, template.LoginName, pwd)
+	createAccount := func(un string) func(string) *Account {
+		return func(pw string) *Account {
+			inAcct := &Account{
+				Account: &store.Account{
+					AuthMethodId: authMethod.PublicId,
+					LoginName:    un,
+				},
+			}
+			var opts []Option
+			if pw != "" {
+				opts = append(opts, WithPassword(origPasswd))
+			}
+			acct, err := repo.CreateAccount(context.Background(), inAcct, opts...)
+			require.NoError(t, err)
+			require.NotNil(t, acct)
+			return acct
+		}
+	}
+
+	wantAuthenticate := func(t *testing.T, ln, pw, msg string) string {
+		acct, err := repo.Authenticate(context.Background(), authMethod.PublicId, ln, pw)
 		assert.NoErrorf(t, err, "%s: authenticate should not return an error", msg)
 		if assert.NotNilf(t, acct, "%s: authenticate should succeed", msg) {
 			return acct.CredentialId
 		}
 		return ""
 	}
-	wantNoAuthenticate := func(t *testing.T, authMethodId string, pwd string, msg string) string {
-		if authMethodId == "" || pwd == "" {
-			return ""
-		}
-		acct, err := repo.Authenticate(context.Background(), authMethodId, template.LoginName, pwd)
+	wantNoAuthenticate := func(t *testing.T, ln, pw, msg string) string {
+		acct, err := repo.Authenticate(context.Background(), authMethod.PublicId, ln, pw)
 		assert.NoErrorf(t, err, "%s: authenticate should not return an error", msg)
 		assert.Nilf(t, acct, "%s: authenticate should not succeed", msg)
 		return ""
 	}
 
-	type args struct {
-		accountId string
-		password  string
-	}
-
 	var tests = []struct {
-		name               string
-		args               args
-		createWithPassword bool
-		useArgsAccountId   bool
-		wantIsErr          error
+		name       string
+		oldPw      string
+		newPw      string
+		createAcct func(string) *Account
 	}{
 		{
-			name: "no-accountId",
-			args: args{
-				accountId: "",
-				password:  "abcdefghijk",
-			},
-			createWithPassword: true,
-			useArgsAccountId:   true,
-			wantIsErr:          db.ErrInvalidParameter,
+			name:       "valid-new-password-no-old-password",
+			createAcct: createAccount("validnewpwnoold"),
+			oldPw:      "",
+			newPw:      "abcdefghijk",
 		},
 		{
-			name: "new-passsword-too-short",
-			args: args{
-				password: "a",
-			},
-			wantIsErr: ErrTooShort,
+			name:       "valid-new-password-delete-old-password",
+			createAcct: createAccount("validnewpwyesold"),
+			oldPw:      origPasswd,
+			newPw:      "abcdefghijk",
 		},
 		{
-			name: "valid-new-password-no-old-password",
-			args: args{
-				password: "abcdefghijk",
-			},
-		},
-		{
-			name: "valid-new-password-delete-old-password",
-			args: args{
-				password: "abcdefghijk",
-			},
-			createWithPassword: true,
-		},
-		{
-			name: "valid-delete-password-no-new-password",
-			args: args{
-				password: "",
-			},
-			createWithPassword: true,
+			name:       "valid-delete-password-no-new-password",
+			createAcct: createAccount("nonewyesold"),
+			oldPw:      origPasswd,
+			newPw:      "",
 		},
 	}
 	for _, tt := range tests {
 		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
-
-			o, _ := iam.TestScopes(t, conn)
-			authMethod := TestAuthMethods(t, conn, o.GetPublicId(), 1)[0]
-			inAcct := template.clone()
-			inAcct.AuthMethodId = authMethod.PublicId
-			var opts []Option
-			if tt.createWithPassword {
-				opts = append(opts, WithPassword(origPasswd))
-			}
-			outAcct, err := repo.CreateAccount(context.Background(), inAcct, opts...)
-			require.NoError(err)
-			require.NotNil(outAcct)
+			acct := tt.createAcct(tt.oldPw)
 
 			nextAuth := wantNoAuthenticate
-			if tt.createWithPassword {
+			if tt.oldPw != "" {
 				nextAuth = wantAuthenticate
 			}
-			oldCredId := nextAuth(t, authMethod.PublicId, origPasswd, "after create account")
+			oldCredId := nextAuth(t, acct.LoginName, origPasswd, "after create account")
 
-			if !tt.useArgsAccountId {
-				tt.args.accountId = outAcct.PublicId
-			}
-
-			err = repo.SetPassword(context.Background(), tt.args.accountId, tt.args.password)
-			if tt.wantIsErr != nil {
-				assert.Error(err)
-				assert.Truef(errors.Is(err, tt.wantIsErr), "want err: %q got: %q", tt.wantIsErr, err)
-				newCredId := nextAuth(t, authMethod.PublicId, origPasswd, "SetPassword failed")
-				assert.Equal(oldCredId, newCredId)
-				return
-			}
+			acct, err = repo.SetPassword(context.Background(), acct.PublicId, tt.newPw, acct.Version)
 			require.NoError(err)
 
 			if oldCredId != "" {
-				wantNoAuthenticate(t, authMethod.PublicId, origPasswd, "old password")
+				wantNoAuthenticate(t, acct.LoginName, origPasswd, "old password")
 				assert.NoError(db.TestVerifyOplog(t, rw, oldCredId, db.WithOperation(oplog.OpType_OP_TYPE_DELETE), db.WithCreateNotBefore(10*time.Second)))
 			}
-			if tt.args.password != "" {
-				newCredId := wantAuthenticate(t, authMethod.PublicId, tt.args.password, "new password")
+			if tt.newPw != "" {
+				newCredId := wantAuthenticate(t, acct.LoginName, tt.newPw, "new password")
 				assert.NotEqual(oldCredId, newCredId)
 				assert.NoError(db.TestVerifyOplog(t, rw, newCredId, db.WithOperation(oplog.OpType_OP_TYPE_CREATE), db.WithCreateNotBefore(10*time.Second)))
 			}
 		})
 	}
+
+	badInputAcct := createAccount("badinputusername")("")
+	badInputCases := []struct {
+		name      string
+		accountId string
+		pw        string
+		version   uint32
+		wantError error
+	}{
+		{
+			name:      "no id",
+			pw:        "anylongpassword",
+			version:   1,
+			wantError: db.ErrInvalidParameter,
+		},
+		{
+			name:      "short pw",
+			accountId: badInputAcct.PublicId,
+			pw:        "c",
+			version:   1,
+			wantError: ErrTooShort,
+		},
+		{
+			name:      "no version",
+			accountId: badInputAcct.PublicId,
+			pw:        "anylongpassword",
+			wantError: db.ErrInvalidParameter,
+		},
+	}
+	for _, tt := range badInputCases {
+		t.Run(tt.name, func(t *testing.T) {
+			assert := assert.New(t)
+
+			acct, err := repo.SetPassword(context.Background(), tt.accountId, tt.pw, tt.version)
+			assert.Error(err)
+			assert.Truef(errors.Is(err, tt.wantError), "want err: %q got: %q", tt.wantError, err)
+			assert.Nil(acct)
+		})
+	}
+
 }

internal/gen/controller.swagger.json

@@ -65,12 +65,6 @@
             "schema": {
               "$ref": "#/definitions/controller.api.resources.scopes.v1.Scope"
             }
-          },
-          {
-            "name": "scope_id",
-            "in": "query",
-            "required": false,
-            "type": "string"
           }
         ],
         "tags": [
@@ -286,23 +280,84 @@
             "schema": {
               "$ref": "#/definitions/controller.api.resources.authmethods.v1.Account"
             }
+          }
+        ],
+        "tags": [
+          "controller.api.services.v1.AccountService"
+        ]
+      }
+    },
+    "/v1/scopes/*/auth-methods/{auth_method_id}/accounts/{id}:change-password": {
+      "post": {
+        "summary": "Sets the password for the provided account.",
+        "operationId": "AccountService_ChangePassword",
+        "responses": {
+          "200": {
+            "description": "",
+            "schema": {
+              "$ref": "#/definitions/controller.api.resources.authmethods.v1.Account"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "auth_method_id",
+            "in": "path",
+            "required": true,
+            "type": "string"
           },
           {
-            "name": "version",
-            "in": "query",
-            "required": false,
-            "type": "integer",
-            "format": "int64"
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "type": "string"
           },
           {
-            "name": "update_mask",
-            "in": "query",
-            "required": false,
-            "type": "array",
-            "items": {
-              "type": "string"
-            },
-            "collectionFormat": "multi"
+            "name": "body",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/controller.api.services.v1.ChangePasswordRequest"
+            }
+          }
+        ],
+        "tags": [
+          "controller.api.services.v1.AccountService"
+        ]
+      }
+    },
+    "/v1/scopes/*/auth-methods/{auth_method_id}/accounts/{id}:set-password": {
+      "post": {
+        "summary": "Sets the password for the provided account.",
+        "operationId": "AccountService_SetPassword",
+        "responses": {
+          "200": {
+            "description": "",
+            "schema": {
+              "$ref": "#/definitions/controller.api.resources.authmethods.v1.Account"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "auth_method_id",
+            "in": "path",
+            "required": true,
+            "type": "string"
+          },
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "type": "string"
+          },
+          {
+            "name": "body",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/controller.api.services.v1.SetPasswordRequest"
+            }
           }
         ],
         "tags": [
@@ -422,23 +477,6 @@
             "schema": {
               "$ref": "#/definitions/controller.api.resources.authmethods.v1.AuthMethod"
             }
-          },
-          {
-            "name": "version",
-            "in": "query",
-            "required": false,
-            "type": "integer",
-            "format": "int64"
-          },
-          {
-            "name": "update_mask",
-            "in": "query",
-            "required": false,
-            "type": "array",
-            "items": {
-              "type": "string"
-            },
-            "collectionFormat": "multi"
           }
         ],
         "tags": [
@@ -653,23 +691,6 @@
             "schema": {
               "$ref": "#/definitions/controller.api.resources.groups.v1.Group"
             }
-          },
-          {
-            "name": "version",
-            "in": "query",
-            "required": false,
-            "type": "integer",
-            "format": "int64"
-          },
-          {
-            "name": "update_mask",
-            "in": "query",
-            "required": false,
-            "type": "array",
-            "items": {
-              "type": "string"
-            },
-            "collectionFormat": "multi"
           }
         ],
         "tags": [
@@ -703,14 +724,6 @@
             "schema": {
               "$ref": "#/definitions/controller.api.services.v1.GroupMemberIdsMessage"
             }
-          },
-          {
-            "name": "version",
-            "description": "The version ensures the group hasn't changed since it was last retrieved and if\nit has the request will fail.",
-            "in": "query",
-            "required": false,
-            "type": "integer",
-            "format": "int64"
           }
         ],
         "tags": [
@@ -744,14 +757,6 @@
             "schema": {
               "$ref": "#/definitions/controller.api.services.v1.GroupMemberIdsMessage"
             }
-          },
-          {
-            "name": "version",
-            "description": "The version ensures the group hasn't changed since it was last retrieved and if\nit has the request will fail.",
-            "in": "query",
-            "required": false,
-            "type": "integer",
-            "format": "int64"
           }
         ],
         "tags": [
@@ -785,14 +790,6 @@
             "schema": {
               "$ref": "#/definitions/controller.api.services.v1.GroupMemberIdsMessage"
             }
-          },
-          {
-            "name": "version",
-            "description": "The version ensures the group hasn't changed since it was last retrieved and if\nit has the request will fail.",
-            "in": "query",
-            "required": false,
-            "type": "integer",
-            "format": "int64"
           }
         ],
         "tags": [
@@ -1009,23 +1006,6 @@
             "schema": {
               "$ref": "#/definitions/controller.api.resources.hosts.v1.HostSet"
             }
-          },
-          {
-            "name": "version",
-            "in": "query",
-            "required": false,
-            "type": "integer",
-            "format": "int64"
-          },
-          {
-            "name": "update_mask",
-            "in": "query",
-            "required": false,
-            "type": "array",
-            "items": {
-              "type": "string"
-            },
-            "collectionFormat": "multi"
           }
         ],
         "tags": [
@@ -1288,23 +1268,6 @@
             "schema": {
               "$ref": "#/definitions/controller.api.resources.hosts.v1.Host"
             }
-          },
-          {
-            "name": "version",
-            "in": "query",
-            "required": false,
-            "type": "integer",
-            "format": "int64"
-          },
-          {
-            "name": "update_mask",
-            "in": "query",
-            "required": false,
-            "type": "array",
-            "items": {
-              "type": "string"
-            },
-            "collectionFormat": "multi"
           }
         ],
         "tags": [
@@ -1391,23 +1354,6 @@
             "schema": {
               "$ref": "#/definitions/controller.api.resources.hosts.v1.HostCatalog"
             }
-          },
-          {
-            "name": "version",
-            "in": "query",
-            "required": false,
-            "type": "integer",
-            "format": "int64"
-          },
-          {
-            "name": "update_mask",
-            "in": "query",
-            "required": false,
-            "type": "array",
-            "items": {
-              "type": "string"
-            },
-            "collectionFormat": "multi"
           }
         ],
         "tags": [
@@ -1543,23 +1489,6 @@
             "schema": {
               "$ref": "#/definitions/controller.api.resources.roles.v1.Role"
             }
-          },
-          {
-            "name": "version",
-            "in": "query",
-            "required": false,
-            "type": "integer",
-            "format": "int64"
-          },
-          {
-            "name": "update_mask",
-            "in": "query",
-            "required": false,
-            "type": "array",
-            "items": {
-              "type": "string"
-            },
-            "collectionFormat": "multi"
           }
         ],
         "tags": [
@@ -1593,14 +1522,6 @@
             "schema": {
               "$ref": "#/definitions/controller.api.services.v1.GrantStringsMessage"
             }
-          },
-          {
-            "name": "version",
-            "description": "The version ensures the role hasn't changed since it was last retrieved and if\nit has the request will fail.",
-            "in": "query",
-            "required": false,
-            "type": "integer",
-            "format": "int64"
           }
         ],
         "tags": [
@@ -1634,14 +1555,6 @@
             "schema": {
               "$ref": "#/definitions/controller.api.services.v1.PrincipalIdsMessage"
             }
-          },
-          {
-            "name": "version",
-            "description": "The version ensures the role hasn't changed since it was last retrieved and if\nit has the request will fail.",
-            "in": "query",
-            "required": false,
-            "type": "integer",
-            "format": "int64"
           }
         ],
         "tags": [
@@ -1675,14 +1588,6 @@
             "schema": {
               "$ref": "#/definitions/controller.api.services.v1.GrantStringsMessage"
             }
-          },
-          {
-            "name": "version",
-            "description": "The version ensures the role hasn't changed since it was last retrieved and if\nit has the request will fail.",
-            "in": "query",
-            "required": false,
-            "type": "integer",
-            "format": "int64"
           }
         ],
         "tags": [
@@ -1716,14 +1621,6 @@
             "schema": {
               "$ref": "#/definitions/controller.api.services.v1.PrincipalIdsMessage"
             }
-          },
-          {
-            "name": "version",
-            "description": "The version ensures the role hasn't changed since it was last retrieved and if\nit has the request will fail.",
-            "in": "query",
-            "required": false,
-            "type": "integer",
-            "format": "int64"
           }
         ],
         "tags": [
@@ -1757,14 +1654,6 @@
             "schema": {
               "$ref": "#/definitions/controller.api.services.v1.GrantStringsMessage"
             }
-          },
-          {
-            "name": "version",
-            "description": "The version ensures the role hasn't changed since it was last retrieved and if\nit has the request will fail.",
-            "in": "query",
-            "required": false,
-            "type": "integer",
-            "format": "int64"
           }
         ],
         "tags": [
@@ -1798,14 +1687,6 @@
             "schema": {
               "$ref": "#/definitions/controller.api.services.v1.PrincipalIdsMessage"
             }
-          },
-          {
-            "name": "version",
-            "description": "The version ensures the role hasn't changed since it was last retrieved and if\nit has the request will fail.",
-            "in": "query",
-            "required": false,
-            "type": "integer",
-            "format": "int64"
           }
         ],
         "tags": [
@@ -1941,23 +1822,6 @@
             "schema": {
               "$ref": "#/definitions/controller.api.resources.users.v1.User"
             }
-          },
-          {
-            "name": "version",
-            "in": "query",
-            "required": false,
-            "type": "integer",
-            "format": "int64"
-          },
-          {
-            "name": "update_mask",
-            "in": "query",
-            "required": false,
-            "type": "array",
-            "items": {
-              "type": "string"
-            },
-            "collectionFormat": "multi"
           }
         ],
         "tags": [
@@ -2043,23 +1907,6 @@
             "schema": {
               "$ref": "#/definitions/controller.api.resources.scopes.v1.Scope"
             }
-          },
-          {
-            "name": "version",
-            "in": "query",
-            "required": false,
-            "type": "integer",
-            "format": "int64"
-          },
-          {
-            "name": "update_mask",
-            "in": "query",
-            "required": false,
-            "type": "array",
-            "items": {
-              "type": "string"
-            },
-            "collectionFormat": "multi"
           }
         ],
         "tags": [
@@ -2769,6 +2616,35 @@
         }
       }
     },
+    "controller.api.services.v1.ChangePasswordRequest": {
+      "type": "object",
+      "properties": {
+        "auth_method_id": {
+          "type": "string"
+        },
+        "id": {
+          "type": "string"
+        },
+        "version": {
+          "type": "integer",
+          "format": "int64"
+        },
+        "old_password": {
+          "type": "string"
+        },
+        "new_password": {
+          "type": "string"
+        }
+      }
+    },
+    "controller.api.services.v1.ChangePasswordResponse": {
+      "type": "object",
+      "properties": {
+        "item": {
+          "$ref": "#/definitions/controller.api.resources.authmethods.v1.Account"
+        }
+      }
+    },
     "controller.api.services.v1.CreateAccountResponse": {
       "type": "object",
       "properties": {
@@ -3219,6 +3095,32 @@
     "controller.api.services.v1.SetHostSetHostsResponse": {
       "type": "object"
     },
+    "controller.api.services.v1.SetPasswordRequest": {
+      "type": "object",
+      "properties": {
+        "auth_method_id": {
+          "type": "string"
+        },
+        "id": {
+          "type": "string"
+        },
+        "version": {
+          "type": "integer",
+          "format": "int64"
+        },
+        "password": {
+          "type": "string"
+        }
+      }
+    },
+    "controller.api.services.v1.SetPasswordResponse": {
+      "type": "object",
+      "properties": {
+        "item": {
+          "$ref": "#/definitions/controller.api.resources.authmethods.v1.Account"
+        }
+      }
+    },
     "controller.api.services.v1.SetRoleGrantsResponse": {
       "type": "object",
       "properties": {
@@ -3370,6 +3272,20 @@
       },
       "title": "Timestamp for storage messages.  We've defined a new local type wrapper\nof google.protobuf.Timestamp so we can implement sql.Scanner and sql.Valuer\ninterfaces.  See:\nhttps://golang.org/pkg/database/sql/#Scanner\nhttps://golang.org/pkg/database/sql/driver/#Valuer"
     },
+    "google.protobuf.FieldMask": {
+      "type": "object",
+      "properties": {
+        "paths": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "The set of field mask paths."
+        }
+      },
+      "description": "paths: \"f.a\"\n    paths: \"f.b.d\"\n\nHere `f` represents a field in some root message, `a` and `b`\nfields in the message found in `f`, and `d` a field found in the\nmessage in `f.b`.\n\nField masks are used to specify a subset of fields that should be\nreturned by a get operation or modified by an update operation.\nField masks also have a custom JSON encoding (see below).\n\n# Field Masks in Projections\n\nWhen used in the context of a projection, a response message or\nsub-message is filtered by the API to only contain those fields as\nspecified in the mask. For example, if the mask in the previous\nexample is applied to a response message as follows:\n\n    f {\n      a : 22\n      b {\n        d : 1\n        x : 2\n      }\n      y : 13\n    }\n    z: 8\n\nThe result will not contain specific values for fields x,y and z\n(their value will be set to the default, and omitted in proto text\noutput):\n\n\n    f {\n      a : 22\n      b {\n        d : 1\n      }\n    }\n\nA repeated field is not allowed except at the last position of a\npaths string.\n\nIf a FieldMask object is not present in a get operation, the\noperation applies to all fields (as if a FieldMask of all fields\nhad been specified).\n\nNote that a field mask does not necessarily apply to the\ntop-level response message. In case of a REST get operation, the\nfield mask applies directly to the response, but in case of a REST\nlist operation, the mask instead applies to each individual message\nin the returned resource list. In case of a REST custom method,\nother definitions may be used. Where the mask applies will be\nclearly documented together with its declaration in the API.  In\nany case, the effect on the returned resource/resources is required\nbehavior for APIs.\n\n# Field Masks in Update Operations\n\nA field mask in update operations specifies which fields of the\ntargeted resource are going to be updated. The API is required\nto only change the values of the fields as specified in the mask\nand leave the others untouched. If a resource is passed in to\ndescribe the updated values, the API ignores the values of all\nfields not covered by the mask.\n\nIf a repeated field is specified for an update operation, new values will\nbe appended to the existing repeated field in the target resource. Note that\na repeated field is only allowed in the last position of a `paths` string.\n\nIf a sub-message is specified in the last position of the field mask for an\nupdate operation, then new value will be merged into the existing sub-message\nin the target resource.\n\nFor example, given the target message:\n\n    f {\n      b {\n        d: 1\n        x: 2\n      }\n      c: [1]\n    }\n\nAnd an update message:\n\n    f {\n      b {\n        d: 10\n      }\n      c: [2]\n    }\n\nthen if the field mask is:\n\n paths: [\"f.b\", \"f.c\"]\n\nthen the result will be:\n\n    f {\n      b {\n        d: 10\n        x: 2\n      }\n      c: [1, 2]\n    }\n\nAn implementation may provide options to override this default behavior for\nrepeated and message fields.\n\nIn order to reset a field's value to the default, the field must\nbe in the mask and set to the default value in the provided resource.\nHence, in order to reset all fields of a resource, provide a default\ninstance of the resource and set all fields in the mask, or do\nnot provide a mask as described below.\n\nIf a field mask is not present on update, the operation applies to\nall fields (as if a field mask of all fields has been specified).\nNote that in the presence of schema evolution, this may mean that\nfields the client does not know and has therefore not filled into\nthe request will be reset to their default. If this is unwanted\nbehavior, a specific service may require a client to always specify\na field mask, producing an error if not.\n\nAs with get operations, the location of the resource which\ndescribes the updated values in the request message depends on the\noperation kind. In any case, the effect of the field mask is\nrequired to be honored by the API.\n\n## Considerations for HTTP REST\n\nThe HTTP kind of an update operation which uses a field mask must\nbe set to PATCH instead of PUT in order to satisfy HTTP semantics\n(PUT must only be used for full updates).\n\n# JSON Encoding of Field Masks\n\nIn JSON, a field mask is encoded as a single string where paths are\nseparated by a comma. Fields name in each path are converted\nto/from lower-camel naming conventions.\n\nAs an example, consider the following message declarations:\n\n    message Profile {\n      User user = 1;\n      Photo photo = 2;\n    }\n    message User {\n      string display_name = 1;\n      string address = 2;\n    }\n\nIn proto a field mask for `Profile` may look as such:\n\n    mask {\n      paths: \"user.display_name\"\n      paths: \"photo\"\n    }\n\nIn JSON, the same mask is represented as below:\n\n    {\n      mask: \"user.displayName,photo\"\n    }\n\n# Field Masks and OLine truncated
+      "title": "`FieldMask` represents a set of symbolic field paths, for example:"
+    },
     "google.protobuf.NullValue": {
       "type": "string",
       "enum": [

internal/gen/controller/api/services/account_service.pb.go

@@ -584,6 +584,250 @@ func (x *DeleteAccountResponse) GetExisted() bool {
 	return false
 }
 
+type SetPasswordRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	AuthMethodId string `protobuf:"bytes,1,opt,name=auth_method_id,json=authMethodId,proto3" json:"auth_method_id,omitempty"`
+	Id           string `protobuf:"bytes,2,opt,name=id,proto3" json:"id,omitempty"`
+	Version      uint32 `protobuf:"varint,3,opt,name=version,proto3" json:"version,omitempty"`
+	Password     string `protobuf:"bytes,4,opt,name=password,proto3" json:"password,omitempty"`
+}
+
+func (x *SetPasswordRequest) Reset() {
+	*x = SetPasswordRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_controller_api_services_v1_account_service_proto_msgTypes[10]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SetPasswordRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SetPasswordRequest) ProtoMessage() {}
+
+func (x *SetPasswordRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_controller_api_services_v1_account_service_proto_msgTypes[10]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SetPasswordRequest.ProtoReflect.Descriptor instead.
+func (*SetPasswordRequest) Descriptor() ([]byte, []int) {
+	return file_controller_api_services_v1_account_service_proto_rawDescGZIP(), []int{10}
+}
+
+func (x *SetPasswordRequest) GetAuthMethodId() string {
+	if x != nil {
+		return x.AuthMethodId
+	}
+	return ""
+}
+
+func (x *SetPasswordRequest) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *SetPasswordRequest) GetVersion() uint32 {
+	if x != nil {
+		return x.Version
+	}
+	return 0
+}
+
+func (x *SetPasswordRequest) GetPassword() string {
+	if x != nil {
+		return x.Password
+	}
+	return ""
+}
+
+type SetPasswordResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Item *authmethods.Account `protobuf:"bytes,1,opt,name=item,proto3" json:"item,omitempty"`
+}
+
+func (x *SetPasswordResponse) Reset() {
+	*x = SetPasswordResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_controller_api_services_v1_account_service_proto_msgTypes[11]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SetPasswordResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SetPasswordResponse) ProtoMessage() {}
+
+func (x *SetPasswordResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_controller_api_services_v1_account_service_proto_msgTypes[11]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SetPasswordResponse.ProtoReflect.Descriptor instead.
+func (*SetPasswordResponse) Descriptor() ([]byte, []int) {
+	return file_controller_api_services_v1_account_service_proto_rawDescGZIP(), []int{11}
+}
+
+func (x *SetPasswordResponse) GetItem() *authmethods.Account {
+	if x != nil {
+		return x.Item
+	}
+	return nil
+}
+
+type ChangePasswordRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	AuthMethodId string `protobuf:"bytes,1,opt,name=auth_method_id,json=authMethodId,proto3" json:"auth_method_id,omitempty"`
+	Id           string `protobuf:"bytes,2,opt,name=id,proto3" json:"id,omitempty"`
+	Version      uint32 `protobuf:"varint,3,opt,name=version,proto3" json:"version,omitempty"`
+	OldPassword  string `protobuf:"bytes,4,opt,name=old_password,proto3" json:"old_password,omitempty"`
+	NewPassword  string `protobuf:"bytes,5,opt,name=new_password,proto3" json:"new_password,omitempty"`
+}
+
+func (x *ChangePasswordRequest) Reset() {
+	*x = ChangePasswordRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_controller_api_services_v1_account_service_proto_msgTypes[12]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ChangePasswordRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ChangePasswordRequest) ProtoMessage() {}
+
+func (x *ChangePasswordRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_controller_api_services_v1_account_service_proto_msgTypes[12]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ChangePasswordRequest.ProtoReflect.Descriptor instead.
+func (*ChangePasswordRequest) Descriptor() ([]byte, []int) {
+	return file_controller_api_services_v1_account_service_proto_rawDescGZIP(), []int{12}
+}
+
+func (x *ChangePasswordRequest) GetAuthMethodId() string {
+	if x != nil {
+		return x.AuthMethodId
+	}
+	return ""
+}
+
+func (x *ChangePasswordRequest) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *ChangePasswordRequest) GetVersion() uint32 {
+	if x != nil {
+		return x.Version
+	}
+	return 0
+}
+
+func (x *ChangePasswordRequest) GetOldPassword() string {
+	if x != nil {
+		return x.OldPassword
+	}
+	return ""
+}
+
+func (x *ChangePasswordRequest) GetNewPassword() string {
+	if x != nil {
+		return x.NewPassword
+	}
+	return ""
+}
+
+type ChangePasswordResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Item *authmethods.Account `protobuf:"bytes,1,opt,name=item,proto3" json:"item,omitempty"`
+}
+
+func (x *ChangePasswordResponse) Reset() {
+	*x = ChangePasswordResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_controller_api_services_v1_account_service_proto_msgTypes[13]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ChangePasswordResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ChangePasswordResponse) ProtoMessage() {}
+
+func (x *ChangePasswordResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_controller_api_services_v1_account_service_proto_msgTypes[13]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ChangePasswordResponse.ProtoReflect.Descriptor instead.
+func (*ChangePasswordResponse) Descriptor() ([]byte, []int) {
+	return file_controller_api_services_v1_account_service_proto_rawDescGZIP(), []int{13}
+}
+
+func (x *ChangePasswordResponse) GetItem() *authmethods.Account {
+	if x != nil {
+		return x.Item
+	}
+	return nil
+}
+
 var File_controller_api_services_v1_account_service_proto protoreflect.FileDescriptor
 
 var file_controller_api_services_v1_account_service_proto_rawDesc = []byte{
@@ -671,83 +915,146 @@ var file_controller_api_services_v1_account_service_proto_rawDesc = []byte{
 	0x22, 0x31, 0x0a, 0x15, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e,
 	0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x65, 0x78, 0x69,
 	0x73, 0x74, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x65, 0x78, 0x69, 0x73,
-	0x74, 0x65, 0x64, 0x32, 0xec, 0x08, 0x0a, 0x0e, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x53,
-	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0xcd, 0x01, 0x0a, 0x0a, 0x47, 0x65, 0x74, 0x41, 0x63,
-	0x63, 0x6f, 0x75, 0x6e, 0x74, 0x12, 0x2d, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c,
-	0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e,
-	0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x1a, 0x2e, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65,
-	0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76,
-	0x31, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x60, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x40, 0x12, 0x38, 0x2f, 0x76,
-	0x31, 0x2f, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x73, 0x2f, 0x2a, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x2d,
-	0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x73, 0x2f, 0x7b, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x6d, 0x65,
-	0x74, 0x68, 0x6f, 0x64, 0x5f, 0x69, 0x64, 0x7d, 0x2f, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74,
-	0x73, 0x2f, 0x7b, 0x69, 0x64, 0x7d, 0x62, 0x04, 0x69, 0x74, 0x65, 0x6d, 0x92, 0x41, 0x17, 0x12,
-	0x15, 0x47, 0x65, 0x74, 0x73, 0x20, 0x61, 0x20, 0x73, 0x69, 0x6e, 0x67, 0x6c, 0x65, 0x20, 0x41,
-	0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x12, 0xe0, 0x01, 0x0a, 0x0c, 0x4c, 0x69, 0x73, 0x74, 0x41,
-	0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x73, 0x12, 0x2f, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f,
+	0x74, 0x65, 0x64, 0x22, 0x80, 0x01, 0x0a, 0x12, 0x53, 0x65, 0x74, 0x50, 0x61, 0x73, 0x73, 0x77,
+	0x6f, 0x72, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x24, 0x0a, 0x0e, 0x61, 0x75,
+	0x74, 0x68, 0x5f, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x0c, 0x61, 0x75, 0x74, 0x68, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x49, 0x64,
+	0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64,
+	0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x0d, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x1a, 0x0a, 0x08, 0x70, 0x61,
+	0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x61,
+	0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x22, 0x5b, 0x0a, 0x13, 0x53, 0x65, 0x74, 0x50, 0x61, 0x73,
+	0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x44, 0x0a,
+	0x04, 0x69, 0x74, 0x65, 0x6d, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x30, 0x2e, 0x63, 0x6f,
+	0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x6d, 0x65, 0x74, 0x68, 0x6f,
+	0x64, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x52, 0x04, 0x69,
+	0x74, 0x65, 0x6d, 0x22, 0xaf, 0x01, 0x0a, 0x15, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x50, 0x61,
+	0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x24, 0x0a,
+	0x0e, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x5f, 0x69, 0x64, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x61, 0x75, 0x74, 0x68, 0x4d, 0x65, 0x74, 0x68, 0x6f,
+	0x64, 0x49, 0x64, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x02, 0x69, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x0d, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x22, 0x0a,
+	0x0c, 0x6f, 0x6c, 0x64, 0x5f, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x04, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x0c, 0x6f, 0x6c, 0x64, 0x5f, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72,
+	0x64, 0x12, 0x22, 0x0a, 0x0c, 0x6e, 0x65, 0x77, 0x5f, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72,
+	0x64, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x6e, 0x65, 0x77, 0x5f, 0x70, 0x61, 0x73,
+	0x73, 0x77, 0x6f, 0x72, 0x64, 0x22, 0x5e, 0x0a, 0x16, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x50,
+	0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
+	0x44, 0x0a, 0x04, 0x69, 0x74, 0x65, 0x6d, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x30, 0x2e,
+	0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72,
+	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x6d, 0x65, 0x74,
+	0x68, 0x6f, 0x64, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x52,
+	0x04, 0x69, 0x74, 0x65, 0x6d, 0x32, 0xec, 0x0c, 0x0a, 0x0e, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e,
+	0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0xcd, 0x01, 0x0a, 0x0a, 0x47, 0x65, 0x74,
+	0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x12, 0x2d, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f,
 	0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
-	0x73, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74,
-	0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x30, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72,
-	0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63,
-	0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e,
-	0x74, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x6d, 0x82, 0xd3, 0xe4, 0x93,
-	0x02, 0x35, 0x12, 0x33, 0x2f, 0x76, 0x31, 0x2f, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x73, 0x2f, 0x2a,
-	0x2f, 0x61, 0x75, 0x74, 0x68, 0x2d, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x73, 0x2f, 0x7b, 0x61,
-	0x75, 0x74, 0x68, 0x5f, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x5f, 0x69, 0x64, 0x7d, 0x2f, 0x61,
-	0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x73, 0x92, 0x41, 0x2f, 0x12, 0x2d, 0x4c, 0x69, 0x73, 0x74,
-	0x73, 0x20, 0x61, 0x6c, 0x6c, 0x20, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x73, 0x20, 0x69,
-	0x6e, 0x20, 0x61, 0x20, 0x73, 0x70, 0x65, 0x63, 0x69, 0x66, 0x69, 0x63, 0x20, 0x61, 0x75, 0x74,
-	0x68, 0x20, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x2e, 0x12, 0xf8, 0x01, 0x0a, 0x0d, 0x43, 0x72,
-	0x65, 0x61, 0x74, 0x65, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x12, 0x30, 0x2e, 0x63, 0x6f,
-	0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72,
-	0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41,
-	0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x31, 0x2e,
+	0x73, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2e, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c,
+	0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73,
+	0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x60, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x40, 0x12, 0x38,
+	0x2f, 0x76, 0x31, 0x2f, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x73, 0x2f, 0x2a, 0x2f, 0x61, 0x75, 0x74,
+	0x68, 0x2d, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x73, 0x2f, 0x7b, 0x61, 0x75, 0x74, 0x68, 0x5f,
+	0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x5f, 0x69, 0x64, 0x7d, 0x2f, 0x61, 0x63, 0x63, 0x6f, 0x75,
+	0x6e, 0x74, 0x73, 0x2f, 0x7b, 0x69, 0x64, 0x7d, 0x62, 0x04, 0x69, 0x74, 0x65, 0x6d, 0x92, 0x41,
+	0x17, 0x12, 0x15, 0x47, 0x65, 0x74, 0x73, 0x20, 0x61, 0x20, 0x73, 0x69, 0x6e, 0x67, 0x6c, 0x65,
+	0x20, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x12, 0xe0, 0x01, 0x0a, 0x0c, 0x4c, 0x69, 0x73,
+	0x74, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x73, 0x12, 0x2f, 0x2e, 0x63, 0x6f, 0x6e, 0x74,
+	0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69,
+	0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x63, 0x63, 0x6f, 0x75,
+	0x6e, 0x74, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x30, 0x2e, 0x63, 0x6f, 0x6e,
+	0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76,
+	0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x63, 0x63, 0x6f,
+	0x75, 0x6e, 0x74, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x6d, 0x82, 0xd3,
+	0xe4, 0x93, 0x02, 0x35, 0x12, 0x33, 0x2f, 0x76, 0x31, 0x2f, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x73,
+	0x2f, 0x2a, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x2d, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x73, 0x2f,
+	0x7b, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x5f, 0x69, 0x64, 0x7d,
+	0x2f, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x73, 0x92, 0x41, 0x2f, 0x12, 0x2d, 0x4c, 0x69,
+	0x73, 0x74, 0x73, 0x20, 0x61, 0x6c, 0x6c, 0x20, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x73,
+	0x20, 0x69, 0x6e, 0x20, 0x61, 0x20, 0x73, 0x70, 0x65, 0x63, 0x69, 0x66, 0x69, 0x63, 0x20, 0x61,
+	0x75, 0x74, 0x68, 0x20, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x2e, 0x12, 0xf8, 0x01, 0x0a, 0x0d,
+	0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x12, 0x30, 0x2e,
 	0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73,
 	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74,
-	0x65, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x22, 0x81, 0x01, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x41, 0x22, 0x33, 0x2f, 0x76, 0x31, 0x2f, 0x73,
-	0x63, 0x6f, 0x70, 0x65, 0x73, 0x2f, 0x2a, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x2d, 0x6d, 0x65, 0x74,
-	0x68, 0x6f, 0x64, 0x73, 0x2f, 0x7b, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x6d, 0x65, 0x74, 0x68, 0x6f,
-	0x64, 0x5f, 0x69, 0x64, 0x7d, 0x2f, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x73, 0x3a, 0x04,
-	0x69, 0x74, 0x65, 0x6d, 0x62, 0x04, 0x69, 0x74, 0x65, 0x6d, 0x92, 0x41, 0x37, 0x12, 0x35, 0x43,
-	0x72, 0x65, 0x61, 0x74, 0x65, 0x73, 0x20, 0x61, 0x20, 0x73, 0x69, 0x6e, 0x67, 0x6c, 0x65, 0x20,
-	0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x20, 0x69, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x70,
-	0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x64, 0x20, 0x61, 0x75, 0x74, 0x68, 0x20, 0x6d, 0x65, 0x74,
-	0x68, 0x6f, 0x64, 0x2e, 0x12, 0xda, 0x01, 0x0a, 0x0d, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41,
-	0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x12, 0x30, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c,
-	0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73,
-	0x2e, 0x76, 0x31, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e,
-	0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x31, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72,
+	0x65, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
+	0x31, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69,
+	0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65,
+	0x61, 0x74, 0x65, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x22, 0x81, 0x01, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x41, 0x22, 0x33, 0x2f, 0x76, 0x31,
+	0x2f, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x73, 0x2f, 0x2a, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x2d, 0x6d,
+	0x65, 0x74, 0x68, 0x6f, 0x64, 0x73, 0x2f, 0x7b, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x6d, 0x65, 0x74,
+	0x68, 0x6f, 0x64, 0x5f, 0x69, 0x64, 0x7d, 0x2f, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x73,
+	0x3a, 0x04, 0x69, 0x74, 0x65, 0x6d, 0x62, 0x04, 0x69, 0x74, 0x65, 0x6d, 0x92, 0x41, 0x37, 0x12,
+	0x35, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x73, 0x20, 0x61, 0x20, 0x73, 0x69, 0x6e, 0x67, 0x6c,
+	0x65, 0x20, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x20, 0x69, 0x6e, 0x20, 0x74, 0x68, 0x65,
+	0x20, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x64, 0x20, 0x61, 0x75, 0x74, 0x68, 0x20, 0x6d,
+	0x65, 0x74, 0x68, 0x6f, 0x64, 0x2e, 0x12, 0xda, 0x01, 0x0a, 0x0d, 0x55, 0x70, 0x64, 0x61, 0x74,
+	0x65, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x12, 0x30, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72,
 	0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63,
 	0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x63, 0x6f,
-	0x75, 0x6e, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x64, 0x82, 0xd3, 0xe4,
-	0x93, 0x02, 0x46, 0x32, 0x38, 0x2f, 0x76, 0x31, 0x2f, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x73, 0x2f,
-	0x2a, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x2d, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x73, 0x2f, 0x7b,
-	0x61, 0x75, 0x74, 0x68, 0x5f, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x5f, 0x69, 0x64, 0x7d, 0x2f,
-	0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x73, 0x2f, 0x7b, 0x69, 0x64, 0x7d, 0x3a, 0x04, 0x69,
-	0x74, 0x65, 0x6d, 0x62, 0x04, 0x69, 0x74, 0x65, 0x6d, 0x92, 0x41, 0x15, 0x12, 0x13, 0x55, 0x70,
-	0x64, 0x61, 0x74, 0x65, 0x73, 0x20, 0x61, 0x6e, 0x20, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74,
-	0x2e, 0x12, 0xce, 0x01, 0x0a, 0x0d, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x63, 0x6f,
-	0x75, 0x6e, 0x74, 0x12, 0x30, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72,
-	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31,
-	0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x31, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c,
+	0x75, 0x6e, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x31, 0x2e, 0x63, 0x6f, 0x6e,
+	0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76,
+	0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63,
+	0x63, 0x6f, 0x75, 0x6e, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x64, 0x82,
+	0xd3, 0xe4, 0x93, 0x02, 0x46, 0x32, 0x38, 0x2f, 0x76, 0x31, 0x2f, 0x73, 0x63, 0x6f, 0x70, 0x65,
+	0x73, 0x2f, 0x2a, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x2d, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x73,
+	0x2f, 0x7b, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x5f, 0x69, 0x64,
+	0x7d, 0x2f, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x73, 0x2f, 0x7b, 0x69, 0x64, 0x7d, 0x3a,
+	0x04, 0x69, 0x74, 0x65, 0x6d, 0x62, 0x04, 0x69, 0x74, 0x65, 0x6d, 0x92, 0x41, 0x15, 0x12, 0x13,
+	0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x73, 0x20, 0x61, 0x6e, 0x20, 0x61, 0x63, 0x63, 0x6f, 0x75,
+	0x6e, 0x74, 0x2e, 0x12, 0xce, 0x01, 0x0a, 0x0d, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63,
+	0x63, 0x6f, 0x75, 0x6e, 0x74, 0x12, 0x30, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c,
 	0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e,
 	0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x58, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x3a,
-	0x2a, 0x38, 0x2f, 0x76, 0x31, 0x2f, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x73, 0x2f, 0x2a, 0x2f, 0x61,
-	0x75, 0x74, 0x68, 0x2d, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x73, 0x2f, 0x7b, 0x61, 0x75, 0x74,
-	0x68, 0x5f, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x5f, 0x69, 0x64, 0x7d, 0x2f, 0x61, 0x63, 0x63,
-	0x6f, 0x75, 0x6e, 0x74, 0x73, 0x2f, 0x7b, 0x69, 0x64, 0x7d, 0x92, 0x41, 0x15, 0x12, 0x13, 0x44,
-	0x65, 0x6c, 0x65, 0x74, 0x65, 0x73, 0x20, 0x61, 0x6e, 0x20, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e,
-	0x74, 0x2e, 0x42, 0x4d, 0x5a, 0x4b, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d,
-	0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x62, 0x6f, 0x75, 0x6e, 0x64,
-	0x61, 0x72, 0x79, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x67, 0x65, 0x6e,
-	0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2f, 0x61, 0x70, 0x69, 0x2f,
-	0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x3b, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
-	0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x31, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f,
+	0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
+	0x73, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x63, 0x6f, 0x75,
+	0x6e, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x58, 0x82, 0xd3, 0xe4, 0x93,
+	0x02, 0x3a, 0x2a, 0x38, 0x2f, 0x76, 0x31, 0x2f, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x73, 0x2f, 0x2a,
+	0x2f, 0x61, 0x75, 0x74, 0x68, 0x2d, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x73, 0x2f, 0x7b, 0x61,
+	0x75, 0x74, 0x68, 0x5f, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x5f, 0x69, 0x64, 0x7d, 0x2f, 0x61,
+	0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x73, 0x2f, 0x7b, 0x69, 0x64, 0x7d, 0x92, 0x41, 0x15, 0x12,
+	0x13, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x73, 0x20, 0x61, 0x6e, 0x20, 0x61, 0x63, 0x63, 0x6f,
+	0x75, 0x6e, 0x74, 0x2e, 0x12, 0xf7, 0x01, 0x0a, 0x0b, 0x53, 0x65, 0x74, 0x50, 0x61, 0x73, 0x73,
+	0x77, 0x6f, 0x72, 0x64, 0x12, 0x2e, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65,
+	0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76,
+	0x31, 0x2e, 0x53, 0x65, 0x74, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x1a, 0x2f, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65,
+	0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76,
+	0x31, 0x2e, 0x53, 0x65, 0x74, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x86, 0x01, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x50, 0x22, 0x45,
+	0x2f, 0x76, 0x31, 0x2f, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x73, 0x2f, 0x2a, 0x2f, 0x61, 0x75, 0x74,
+	0x68, 0x2d, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x73, 0x2f, 0x7b, 0x61, 0x75, 0x74, 0x68, 0x5f,
+	0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x5f, 0x69, 0x64, 0x7d, 0x2f, 0x61, 0x63, 0x63, 0x6f, 0x75,
+	0x6e, 0x74, 0x73, 0x2f, 0x7b, 0x69, 0x64, 0x7d, 0x3a, 0x73, 0x65, 0x74, 0x2d, 0x70, 0x61, 0x73,
+	0x73, 0x77, 0x6f, 0x72, 0x64, 0x3a, 0x01, 0x2a, 0x62, 0x04, 0x69, 0x74, 0x65, 0x6d, 0x92, 0x41,
+	0x2d, 0x12, 0x2b, 0x53, 0x65, 0x74, 0x73, 0x20, 0x74, 0x68, 0x65, 0x20, 0x70, 0x61, 0x73, 0x73,
+	0x77, 0x6f, 0x72, 0x64, 0x20, 0x66, 0x6f, 0x72, 0x20, 0x74, 0x68, 0x65, 0x20, 0x70, 0x72, 0x6f,
+	0x76, 0x69, 0x64, 0x65, 0x64, 0x20, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x2e, 0x12, 0x83,
+	0x02, 0x0a, 0x0e, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72,
+	0x64, 0x12, 0x31, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61,
+	0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x43,
+	0x68, 0x61, 0x6e, 0x67, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x1a, 0x32, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65,
+	0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x76,
+	0x31, 0x2e, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x89, 0x01, 0x82, 0xd3, 0xe4, 0x93, 0x02,
+	0x53, 0x22, 0x48, 0x2f, 0x76, 0x31, 0x2f, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x73, 0x2f, 0x2a, 0x2f,
+	0x61, 0x75, 0x74, 0x68, 0x2d, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x73, 0x2f, 0x7b, 0x61, 0x75,
+	0x74, 0x68, 0x5f, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x5f, 0x69, 0x64, 0x7d, 0x2f, 0x61, 0x63,
+	0x63, 0x6f, 0x75, 0x6e, 0x74, 0x73, 0x2f, 0x7b, 0x69, 0x64, 0x7d, 0x3a, 0x63, 0x68, 0x61, 0x6e,
+	0x67, 0x65, 0x2d, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x3a, 0x01, 0x2a, 0x62, 0x04,
+	0x69, 0x74, 0x65, 0x6d, 0x92, 0x41, 0x2d, 0x12, 0x2b, 0x53, 0x65, 0x74, 0x73, 0x20, 0x74, 0x68,
+	0x65, 0x20, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x20, 0x66, 0x6f, 0x72, 0x20, 0x74,
+	0x68, 0x65, 0x20, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x64, 0x20, 0x61, 0x63, 0x63, 0x6f,
+	0x75, 0x6e, 0x74, 0x2e, 0x42, 0x4d, 0x5a, 0x4b, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63,
+	0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x62, 0x6f, 0x75,
+	0x6e, 0x64, 0x61, 0x72, 0x79, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x67,
+	0x65, 0x6e, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2f, 0x61, 0x70,
+	0x69, 0x2f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x3b, 0x73, 0x65, 0x72, 0x76, 0x69,
+	0x63, 0x65, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -762,44 +1069,54 @@ func file_controller_api_services_v1_account_service_proto_rawDescGZIP() []byte
 	return file_controller_api_services_v1_account_service_proto_rawDescData
 }
 
-var file_controller_api_services_v1_account_service_proto_msgTypes = make([]protoimpl.MessageInfo, 10)
+var file_controller_api_services_v1_account_service_proto_msgTypes = make([]protoimpl.MessageInfo, 14)
 var file_controller_api_services_v1_account_service_proto_goTypes = []interface{}{
-	(*GetAccountRequest)(nil),     // 0: controller.api.services.v1.GetAccountRequest
-	(*GetAccountResponse)(nil),    // 1: controller.api.services.v1.GetAccountResponse
-	(*ListAccountsRequest)(nil),   // 2: controller.api.services.v1.ListAccountsRequest
-	(*ListAccountsResponse)(nil),  // 3: controller.api.services.v1.ListAccountsResponse
-	(*CreateAccountRequest)(nil),  // 4: controller.api.services.v1.CreateAccountRequest
-	(*CreateAccountResponse)(nil), // 5: controller.api.services.v1.CreateAccountResponse
-	(*UpdateAccountRequest)(nil),  // 6: controller.api.services.v1.UpdateAccountRequest
-	(*UpdateAccountResponse)(nil), // 7: controller.api.services.v1.UpdateAccountResponse
-	(*DeleteAccountRequest)(nil),  // 8: controller.api.services.v1.DeleteAccountRequest
-	(*DeleteAccountResponse)(nil), // 9: controller.api.services.v1.DeleteAccountResponse
-	(*authmethods.Account)(nil),   // 10: controller.api.resources.authmethods.v1.Account
-	(*field_mask.FieldMask)(nil),  // 11: google.protobuf.FieldMask
+	(*GetAccountRequest)(nil),      // 0: controller.api.services.v1.GetAccountRequest
+	(*GetAccountResponse)(nil),     // 1: controller.api.services.v1.GetAccountResponse
+	(*ListAccountsRequest)(nil),    // 2: controller.api.services.v1.ListAccountsRequest
+	(*ListAccountsResponse)(nil),   // 3: controller.api.services.v1.ListAccountsResponse
+	(*CreateAccountRequest)(nil),   // 4: controller.api.services.v1.CreateAccountRequest
+	(*CreateAccountResponse)(nil),  // 5: controller.api.services.v1.CreateAccountResponse
+	(*UpdateAccountRequest)(nil),   // 6: controller.api.services.v1.UpdateAccountRequest
+	(*UpdateAccountResponse)(nil),  // 7: controller.api.services.v1.UpdateAccountResponse
+	(*DeleteAccountRequest)(nil),   // 8: controller.api.services.v1.DeleteAccountRequest
+	(*DeleteAccountResponse)(nil),  // 9: controller.api.services.v1.DeleteAccountResponse
+	(*SetPasswordRequest)(nil),     // 10: controller.api.services.v1.SetPasswordRequest
+	(*SetPasswordResponse)(nil),    // 11: controller.api.services.v1.SetPasswordResponse
+	(*ChangePasswordRequest)(nil),  // 12: controller.api.services.v1.ChangePasswordRequest
+	(*ChangePasswordResponse)(nil), // 13: controller.api.services.v1.ChangePasswordResponse
+	(*authmethods.Account)(nil),    // 14: controller.api.resources.authmethods.v1.Account
+	(*field_mask.FieldMask)(nil),   // 15: google.protobuf.FieldMask
 }
 var file_controller_api_services_v1_account_service_proto_depIdxs = []int32{
-	10, // 0: controller.api.services.v1.GetAccountResponse.item:type_name -> controller.api.resources.authmethods.v1.Account
-	10, // 1: controller.api.services.v1.ListAccountsResponse.items:type_name -> controller.api.resources.authmethods.v1.Account
-	10, // 2: controller.api.services.v1.CreateAccountRequest.item:type_name -> controller.api.resources.authmethods.v1.Account
-	10, // 3: controller.api.services.v1.CreateAccountResponse.item:type_name -> controller.api.resources.authmethods.v1.Account
-	10, // 4: controller.api.services.v1.UpdateAccountRequest.item:type_name -> controller.api.resources.authmethods.v1.Account
-	11, // 5: controller.api.services.v1.UpdateAccountRequest.update_mask:type_name -> google.protobuf.FieldMask
-	10, // 6: controller.api.services.v1.UpdateAccountResponse.item:type_name -> controller.api.resources.authmethods.v1.Account
-	0,  // 7: controller.api.services.v1.AccountService.GetAccount:input_type -> controller.api.services.v1.GetAccountRequest
-	2,  // 8: controller.api.services.v1.AccountService.ListAccounts:input_type -> controller.api.services.v1.ListAccountsRequest
-	4,  // 9: controller.api.services.v1.AccountService.CreateAccount:input_type -> controller.api.services.v1.CreateAccountRequest
-	6,  // 10: controller.api.services.v1.AccountService.UpdateAccount:input_type -> controller.api.services.v1.UpdateAccountRequest
-	8,  // 11: controller.api.services.v1.AccountService.DeleteAccount:input_type -> controller.api.services.v1.DeleteAccountRequest
-	1,  // 12: controller.api.services.v1.AccountService.GetAccount:output_type -> controller.api.services.v1.GetAccountResponse
-	3,  // 13: controller.api.services.v1.AccountService.ListAccounts:output_type -> controller.api.services.v1.ListAccountsResponse
-	5,  // 14: controller.api.services.v1.AccountService.CreateAccount:output_type -> controller.api.services.v1.CreateAccountResponse
-	7,  // 15: controller.api.services.v1.AccountService.UpdateAccount:output_type -> controller.api.services.v1.UpdateAccountResponse
-	9,  // 16: controller.api.services.v1.AccountService.DeleteAccount:output_type -> controller.api.services.v1.DeleteAccountResponse
-	12, // [12:17] is the sub-list for method output_type
-	7,  // [7:12] is the sub-list for method input_type
-	7,  // [7:7] is the sub-list for extension type_name
-	7,  // [7:7] is the sub-list for extension extendee
-	0,  // [0:7] is the sub-list for field type_name
+	14, // 0: controller.api.services.v1.GetAccountResponse.item:type_name -> controller.api.resources.authmethods.v1.Account
+	14, // 1: controller.api.services.v1.ListAccountsResponse.items:type_name -> controller.api.resources.authmethods.v1.Account
+	14, // 2: controller.api.services.v1.CreateAccountRequest.item:type_name -> controller.api.resources.authmethods.v1.Account
+	14, // 3: controller.api.services.v1.CreateAccountResponse.item:type_name -> controller.api.resources.authmethods.v1.Account
+	14, // 4: controller.api.services.v1.UpdateAccountRequest.item:type_name -> controller.api.resources.authmethods.v1.Account
+	15, // 5: controller.api.services.v1.UpdateAccountRequest.update_mask:type_name -> google.protobuf.FieldMask
+	14, // 6: controller.api.services.v1.UpdateAccountResponse.item:type_name -> controller.api.resources.authmethods.v1.Account
+	14, // 7: controller.api.services.v1.SetPasswordResponse.item:type_name -> controller.api.resources.authmethods.v1.Account
+	14, // 8: controller.api.services.v1.ChangePasswordResponse.item:type_name -> controller.api.resources.authmethods.v1.Account
+	0,  // 9: controller.api.services.v1.AccountService.GetAccount:input_type -> controller.api.services.v1.GetAccountRequest
+	2,  // 10: controller.api.services.v1.AccountService.ListAccounts:input_type -> controller.api.services.v1.ListAccountsRequest
+	4,  // 11: controller.api.services.v1.AccountService.CreateAccount:input_type -> controller.api.services.v1.CreateAccountRequest
+	6,  // 12: controller.api.services.v1.AccountService.UpdateAccount:input_type -> controller.api.services.v1.UpdateAccountRequest
+	8,  // 13: controller.api.services.v1.AccountService.DeleteAccount:input_type -> controller.api.services.v1.DeleteAccountRequest
+	10, // 14: controller.api.services.v1.AccountService.SetPassword:input_type -> controller.api.services.v1.SetPasswordRequest
+	12, // 15: controller.api.services.v1.AccountService.ChangePassword:input_type -> controller.api.services.v1.ChangePasswordRequest
+	1,  // 16: controller.api.services.v1.AccountService.GetAccount:output_type -> controller.api.services.v1.GetAccountResponse
+	3,  // 17: controller.api.services.v1.AccountService.ListAccounts:output_type -> controller.api.services.v1.ListAccountsResponse
+	5,  // 18: controller.api.services.v1.AccountService.CreateAccount:output_type -> controller.api.services.v1.CreateAccountResponse
+	7,  // 19: controller.api.services.v1.AccountService.UpdateAccount:output_type -> controller.api.services.v1.UpdateAccountResponse
+	9,  // 20: controller.api.services.v1.AccountService.DeleteAccount:output_type -> controller.api.services.v1.DeleteAccountResponse
+	11, // 21: controller.api.services.v1.AccountService.SetPassword:output_type -> controller.api.services.v1.SetPasswordResponse
+	13, // 22: controller.api.services.v1.AccountService.ChangePassword:output_type -> controller.api.services.v1.ChangePasswordResponse
+	16, // [16:23] is the sub-list for method output_type
+	9,  // [9:16] is the sub-list for method input_type
+	9,  // [9:9] is the sub-list for extension type_name
+	9,  // [9:9] is the sub-list for extension extendee
+	0,  // [0:9] is the sub-list for field type_name
 }
 
 func init() { file_controller_api_services_v1_account_service_proto_init() }
@@ -928,6 +1245,54 @@ func file_controller_api_services_v1_account_service_proto_init() {
 				return nil
 			}
 		}
+		file_controller_api_services_v1_account_service_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SetPasswordRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_controller_api_services_v1_account_service_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SetPasswordResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_controller_api_services_v1_account_service_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ChangePasswordRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_controller_api_services_v1_account_service_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ChangePasswordResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
 	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
@@ -935,7 +1300,7 @@ func file_controller_api_services_v1_account_service_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_controller_api_services_v1_account_service_proto_rawDesc,
 			NumEnums:      0,
-			NumMessages:   10,
+			NumMessages:   14,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
@@ -992,6 +1357,14 @@ type AccountServiceClient interface {
 	// response itself specifies if the resource existed before the DeleteAccount
 	// request was received.
 	DeleteAccount(ctx context.Context, in *DeleteAccountRequest, opts ...grpc.CallOption) (*DeleteAccountResponse, error)
+	// SetPassword sets the account's password to the one provided in the
+	// request. This method is intended for administration purpose and as such
+	// does not require the old password.
+	SetPassword(ctx context.Context, in *SetPasswordRequest, opts ...grpc.CallOption) (*SetPasswordResponse, error)
+	// ChangePassword changes the account's password to the one provided in the
+	// request. This method is intended for end users and requires the existing
+	// password to be provided for authentication purposes.
+	ChangePassword(ctx context.Context, in *ChangePasswordRequest, opts ...grpc.CallOption) (*ChangePasswordResponse, error)
 }
 
 type accountServiceClient struct {
@@ -1047,6 +1420,24 @@ func (c *accountServiceClient) DeleteAccount(ctx context.Context, in *DeleteAcco
 	return out, nil
 }
 
+func (c *accountServiceClient) SetPassword(ctx context.Context, in *SetPasswordRequest, opts ...grpc.CallOption) (*SetPasswordResponse, error) {
+	out := new(SetPasswordResponse)
+	err := c.cc.Invoke(ctx, "/controller.api.services.v1.AccountService/SetPassword", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *accountServiceClient) ChangePassword(ctx context.Context, in *ChangePasswordRequest, opts ...grpc.CallOption) (*ChangePasswordResponse, error) {
+	out := new(ChangePasswordResponse)
+	err := c.cc.Invoke(ctx, "/controller.api.services.v1.AccountService/ChangePassword", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 // AccountServiceServer is the server API for AccountService service.
 type AccountServiceServer interface {
 	// GetAccount returns a stored Account if present. The provided request must
@@ -1080,6 +1471,14 @@ type AccountServiceServer interface {
 	// response itself specifies if the resource existed before the DeleteAccount
 	// request was received.
 	DeleteAccount(context.Context, *DeleteAccountRequest) (*DeleteAccountResponse, error)
+	// SetPassword sets the account's password to the one provided in the
+	// request. This method is intended for administration purpose and as such
+	// does not require the old password.
+	SetPassword(context.Context, *SetPasswordRequest) (*SetPasswordResponse, error)
+	// ChangePassword changes the account's password to the one provided in the
+	// request. This method is intended for end users and requires the existing
+	// password to be provided for authentication purposes.
+	ChangePassword(context.Context, *ChangePasswordRequest) (*ChangePasswordResponse, error)
 }
 
 // UnimplementedAccountServiceServer can be embedded to have forward compatible implementations.
@@ -1101,6 +1500,12 @@ func (*UnimplementedAccountServiceServer) UpdateAccount(context.Context, *Update
 func (*UnimplementedAccountServiceServer) DeleteAccount(context.Context, *DeleteAccountRequest) (*DeleteAccountResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method DeleteAccount not implemented")
 }
+func (*UnimplementedAccountServiceServer) SetPassword(context.Context, *SetPasswordRequest) (*SetPasswordResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method SetPassword not implemented")
+}
+func (*UnimplementedAccountServiceServer) ChangePassword(context.Context, *ChangePasswordRequest) (*ChangePasswordResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ChangePassword not implemented")
+}
 
 func RegisterAccountServiceServer(s *grpc.Server, srv AccountServiceServer) {
 	s.RegisterService(&_AccountService_serviceDesc, srv)
@@ -1196,6 +1601,42 @@ func _AccountService_DeleteAccount_Handler(srv interface{}, ctx context.Context,
 	return interceptor(ctx, in, info, handler)
 }
 
+func _AccountService_SetPassword_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(SetPasswordRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AccountServiceServer).SetPassword(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/controller.api.services.v1.AccountService/SetPassword",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AccountServiceServer).SetPassword(ctx, req.(*SetPasswordRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _AccountService_ChangePassword_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ChangePasswordRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AccountServiceServer).ChangePassword(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/controller.api.services.v1.AccountService/ChangePassword",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AccountServiceServer).ChangePassword(ctx, req.(*ChangePasswordRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 var _AccountService_serviceDesc = grpc.ServiceDesc{
 	ServiceName: "controller.api.services.v1.AccountService",
 	HandlerType: (*AccountServiceServer)(nil),
@@ -1220,6 +1661,14 @@ var _AccountService_serviceDesc = grpc.ServiceDesc{
 			MethodName: "DeleteAccount",
 			Handler:    _AccountService_DeleteAccount_Handler,
 		},
+		{
+			MethodName: "SetPassword",
+			Handler:    _AccountService_SetPassword_Handler,
+		},
+		{
+			MethodName: "ChangePassword",
+			Handler:    _AccountService_ChangePassword_Handler,
+		},
 	},
 	Streams:  []grpc.StreamDesc{},
 	Metadata: "controller/api/services/v1/account_service.proto",

internal/gen/controller/api/services/account_service.pb.gw.go

@@ -50,6 +50,7 @@ func request_AccountService_GetAccount_0(ctx context.Context, marshaler runtime.
 	}
 
 	protoReq.AuthMethodId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "auth_method_id", err)
 	}
@@ -60,6 +61,7 @@ func request_AccountService_GetAccount_0(ctx context.Context, marshaler runtime.
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -93,6 +95,7 @@ func local_request_AccountService_GetAccount_0(ctx context.Context, marshaler ru
 	}
 
 	protoReq.AuthMethodId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "auth_method_id", err)
 	}
@@ -103,6 +106,7 @@ func local_request_AccountService_GetAccount_0(ctx context.Context, marshaler ru
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -140,6 +144,7 @@ func request_AccountService_ListAccounts_0(ctx context.Context, marshaler runtim
 	}
 
 	protoReq.AuthMethodId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "auth_method_id", err)
 	}
@@ -173,6 +178,7 @@ func local_request_AccountService_ListAccounts_0(ctx context.Context, marshaler
 	}
 
 	protoReq.AuthMethodId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "auth_method_id", err)
 	}
@@ -214,6 +220,7 @@ func request_AccountService_CreateAccount_0(ctx context.Context, marshaler runti
 	}
 
 	protoReq.AuthMethodId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "auth_method_id", err)
 	}
@@ -248,6 +255,7 @@ func local_request_AccountService_CreateAccount_0(ctx context.Context, marshaler
 	}
 
 	protoReq.AuthMethodId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "auth_method_id", err)
 	}
@@ -293,6 +301,7 @@ func request_AccountService_UpdateAccount_0(ctx context.Context, marshaler runti
 	}
 
 	protoReq.AuthMethodId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "auth_method_id", err)
 	}
@@ -303,6 +312,7 @@ func request_AccountService_UpdateAccount_0(ctx context.Context, marshaler runti
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -351,6 +361,7 @@ func local_request_AccountService_UpdateAccount_0(ctx context.Context, marshaler
 	}
 
 	protoReq.AuthMethodId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "auth_method_id", err)
 	}
@@ -361,6 +372,7 @@ func local_request_AccountService_UpdateAccount_0(ctx context.Context, marshaler
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -394,6 +406,7 @@ func request_AccountService_DeleteAccount_0(ctx context.Context, marshaler runti
 	}
 
 	protoReq.AuthMethodId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "auth_method_id", err)
 	}
@@ -404,6 +417,7 @@ func request_AccountService_DeleteAccount_0(ctx context.Context, marshaler runti
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -430,6 +444,7 @@ func local_request_AccountService_DeleteAccount_0(ctx context.Context, marshaler
 	}
 
 	protoReq.AuthMethodId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "auth_method_id", err)
 	}
@@ -440,6 +455,7 @@ func local_request_AccountService_DeleteAccount_0(ctx context.Context, marshaler
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -449,10 +465,193 @@ func local_request_AccountService_DeleteAccount_0(ctx context.Context, marshaler
 
 }
 
+func request_AccountService_SetPassword_0(ctx context.Context, marshaler runtime.Marshaler, client AccountServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq SetPasswordRequest
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	var (
+		val string
+		ok  bool
+		err error
+		_   = err
+	)
+
+	val, ok = pathParams["auth_method_id"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "auth_method_id")
+	}
+
+	protoReq.AuthMethodId, err = runtime.String(val)
+
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "auth_method_id", err)
+	}
+
+	val, ok = pathParams["id"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
+	}
+
+	protoReq.Id, err = runtime.String(val)
+
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
+	}
+
+	msg, err := client.SetPassword(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_AccountService_SetPassword_0(ctx context.Context, marshaler runtime.Marshaler, server AccountServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq SetPasswordRequest
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	var (
+		val string
+		ok  bool
+		err error
+		_   = err
+	)
+
+	val, ok = pathParams["auth_method_id"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "auth_method_id")
+	}
+
+	protoReq.AuthMethodId, err = runtime.String(val)
+
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "auth_method_id", err)
+	}
+
+	val, ok = pathParams["id"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
+	}
+
+	protoReq.Id, err = runtime.String(val)
+
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
+	}
+
+	msg, err := server.SetPassword(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_AccountService_ChangePassword_0(ctx context.Context, marshaler runtime.Marshaler, client AccountServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq ChangePasswordRequest
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	var (
+		val string
+		ok  bool
+		err error
+		_   = err
+	)
+
+	val, ok = pathParams["auth_method_id"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "auth_method_id")
+	}
+
+	protoReq.AuthMethodId, err = runtime.String(val)
+
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "auth_method_id", err)
+	}
+
+	val, ok = pathParams["id"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
+	}
+
+	protoReq.Id, err = runtime.String(val)
+
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
+	}
+
+	msg, err := client.ChangePassword(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_AccountService_ChangePassword_0(ctx context.Context, marshaler runtime.Marshaler, server AccountServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq ChangePasswordRequest
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	var (
+		val string
+		ok  bool
+		err error
+		_   = err
+	)
+
+	val, ok = pathParams["auth_method_id"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "auth_method_id")
+	}
+
+	protoReq.AuthMethodId, err = runtime.String(val)
+
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "auth_method_id", err)
+	}
+
+	val, ok = pathParams["id"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
+	}
+
+	protoReq.Id, err = runtime.String(val)
+
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
+	}
+
+	msg, err := server.ChangePassword(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
 // RegisterAccountServiceHandlerServer registers the http handlers for service AccountService to "mux".
 // UnaryRPC     :call AccountServiceServer directly.
 // StreamingRPC :currently unsupported pending https://github.com/grpc/grpc-go/issues/906.
-// Note that using this registration option will cause many gRPC library features (such as grpc.SendHeader, etc) to stop working. Consider using RegisterAccountServiceHandlerFromEndpoint instead.
 func RegisterAccountServiceHandlerServer(ctx context.Context, mux *runtime.ServeMux, server AccountServiceServer) error {
 
 	mux.Handle("GET", pattern_AccountService_GetAccount_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
@@ -555,6 +754,46 @@ func RegisterAccountServiceHandlerServer(ctx context.Context, mux *runtime.Serve
 
 	})
 
+	mux.Handle("POST", pattern_AccountService_SetPassword_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		rctx, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/controller.api.services.v1.AccountService/SetPassword")
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_AccountService_SetPassword_0(rctx, inboundMarshaler, server, req, pathParams)
+		ctx = runtime.NewServerMetadataContext(ctx, md)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_AccountService_SetPassword_0(ctx, mux, outboundMarshaler, w, req, response_AccountService_SetPassword_0{resp}, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_AccountService_ChangePassword_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		rctx, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/controller.api.services.v1.AccountService/ChangePassword")
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_AccountService_ChangePassword_0(rctx, inboundMarshaler, server, req, pathParams)
+		ctx = runtime.NewServerMetadataContext(ctx, md)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_AccountService_ChangePassword_0(ctx, mux, outboundMarshaler, w, req, response_AccountService_ChangePassword_0{resp}, mux.GetForwardResponseOptions()...)
+
+	})
+
 	return nil
 }
 
@@ -696,6 +935,46 @@ func RegisterAccountServiceHandlerClient(ctx context.Context, mux *runtime.Serve
 
 	})
 
+	mux.Handle("POST", pattern_AccountService_SetPassword_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		rctx, err := runtime.AnnotateContext(ctx, mux, req, "/controller.api.services.v1.AccountService/SetPassword")
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_AccountService_SetPassword_0(rctx, inboundMarshaler, client, req, pathParams)
+		ctx = runtime.NewServerMetadataContext(ctx, md)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_AccountService_SetPassword_0(ctx, mux, outboundMarshaler, w, req, response_AccountService_SetPassword_0{resp}, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_AccountService_ChangePassword_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		rctx, err := runtime.AnnotateContext(ctx, mux, req, "/controller.api.services.v1.AccountService/ChangePassword")
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_AccountService_ChangePassword_0(rctx, inboundMarshaler, client, req, pathParams)
+		ctx = runtime.NewServerMetadataContext(ctx, md)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_AccountService_ChangePassword_0(ctx, mux, outboundMarshaler, w, req, response_AccountService_ChangePassword_0{resp}, mux.GetForwardResponseOptions()...)
+
+	})
+
 	return nil
 }
 
@@ -726,6 +1005,24 @@ func (m response_AccountService_UpdateAccount_0) XXX_ResponseBody() interface{}
 	return response.Item
 }
 
+type response_AccountService_SetPassword_0 struct {
+	proto.Message
+}
+
+func (m response_AccountService_SetPassword_0) XXX_ResponseBody() interface{} {
+	response := m.Message.(*SetPasswordResponse)
+	return response.Item
+}
+
+type response_AccountService_ChangePassword_0 struct {
+	proto.Message
+}
+
+func (m response_AccountService_ChangePassword_0) XXX_ResponseBody() interface{} {
+	response := m.Message.(*ChangePasswordResponse)
+	return response.Item
+}
+
 var (
 	pattern_AccountService_GetAccount_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 1, 0, 2, 2, 1, 0, 4, 1, 5, 3, 2, 4, 1, 0, 4, 1, 5, 5}, []string{"v1", "scopes", "auth-methods", "auth_method_id", "accounts", "id"}, ""))
 
@@ -736,6 +1033,10 @@ var (
 	pattern_AccountService_UpdateAccount_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 1, 0, 2, 2, 1, 0, 4, 1, 5, 3, 2, 4, 1, 0, 4, 1, 5, 5}, []string{"v1", "scopes", "auth-methods", "auth_method_id", "accounts", "id"}, ""))
 
 	pattern_AccountService_DeleteAccount_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 1, 0, 2, 2, 1, 0, 4, 1, 5, 3, 2, 4, 1, 0, 4, 1, 5, 5}, []string{"v1", "scopes", "auth-methods", "auth_method_id", "accounts", "id"}, ""))
+
+	pattern_AccountService_SetPassword_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 1, 0, 2, 2, 1, 0, 4, 1, 5, 3, 2, 4, 1, 0, 4, 1, 5, 5}, []string{"v1", "scopes", "auth-methods", "auth_method_id", "accounts", "id"}, "set-password"))
+
+	pattern_AccountService_ChangePassword_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 1, 0, 2, 2, 1, 0, 4, 1, 5, 3, 2, 4, 1, 0, 4, 1, 5, 5}, []string{"v1", "scopes", "auth-methods", "auth_method_id", "accounts", "id"}, "change-password"))
 )
 
 var (
@@ -748,4 +1049,8 @@ var (
 	forward_AccountService_UpdateAccount_0 = runtime.ForwardResponseMessage
 
 	forward_AccountService_DeleteAccount_0 = runtime.ForwardResponseMessage
+
+	forward_AccountService_SetPassword_0 = runtime.ForwardResponseMessage
+
+	forward_AccountService_ChangePassword_0 = runtime.ForwardResponseMessage
 )

internal/gen/controller/api/services/auth_method_service.pb.gw.go

@@ -50,6 +50,7 @@ func request_AuthMethodService_GetAuthMethod_0(ctx context.Context, marshaler ru
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -83,6 +84,7 @@ func local_request_AuthMethodService_GetAuthMethod_0(ctx context.Context, marsha
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -205,6 +207,7 @@ func request_AuthMethodService_UpdateAuthMethod_0(ctx context.Context, marshaler
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -253,6 +256,7 @@ func local_request_AuthMethodService_UpdateAuthMethod_0(ctx context.Context, mar
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -286,6 +290,7 @@ func request_AuthMethodService_DeleteAuthMethod_0(ctx context.Context, marshaler
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -312,6 +317,7 @@ func local_request_AuthMethodService_DeleteAuthMethod_0(ctx context.Context, mar
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -324,7 +330,6 @@ func local_request_AuthMethodService_DeleteAuthMethod_0(ctx context.Context, mar
 // RegisterAuthMethodServiceHandlerServer registers the http handlers for service AuthMethodService to "mux".
 // UnaryRPC     :call AuthMethodServiceServer directly.
 // StreamingRPC :currently unsupported pending https://github.com/grpc/grpc-go/issues/906.
-// Note that using this registration option will cause many gRPC library features (such as grpc.SendHeader, etc) to stop working. Consider using RegisterAuthMethodServiceHandlerFromEndpoint instead.
 func RegisterAuthMethodServiceHandlerServer(ctx context.Context, mux *runtime.ServeMux, server AuthMethodServiceServer) error {
 
 	mux.Handle("GET", pattern_AuthMethodService_GetAuthMethod_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {

internal/gen/controller/api/services/authenticate_service.pb.gw.go

@@ -54,6 +54,7 @@ func request_AuthenticationService_Authenticate_0(ctx context.Context, marshaler
 	}
 
 	protoReq.AuthMethodId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "auth_method_id", err)
 	}
@@ -88,6 +89,7 @@ func local_request_AuthenticationService_Authenticate_0(ctx context.Context, mar
 	}
 
 	protoReq.AuthMethodId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "auth_method_id", err)
 	}
@@ -100,7 +102,6 @@ func local_request_AuthenticationService_Authenticate_0(ctx context.Context, mar
 // RegisterAuthenticationServiceHandlerServer registers the http handlers for service AuthenticationService to "mux".
 // UnaryRPC     :call AuthenticationServiceServer directly.
 // StreamingRPC :currently unsupported pending https://github.com/grpc/grpc-go/issues/906.
-// Note that using this registration option will cause many gRPC library features (such as grpc.SendHeader, etc) to stop working. Consider using RegisterAuthenticationServiceHandlerFromEndpoint instead.
 func RegisterAuthenticationServiceHandlerServer(ctx context.Context, mux *runtime.ServeMux, server AuthenticationServiceServer) error {
 
 	mux.Handle("POST", pattern_AuthenticationService_Authenticate_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {

internal/gen/controller/api/services/authtokens_service.pb.gw.go

@@ -50,6 +50,7 @@ func request_AuthTokenService_GetAuthToken_0(ctx context.Context, marshaler runt
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -83,6 +84,7 @@ func local_request_AuthTokenService_GetAuthToken_0(ctx context.Context, marshale
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -152,6 +154,7 @@ func request_AuthTokenService_DeleteAuthToken_0(ctx context.Context, marshaler r
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -178,6 +181,7 @@ func local_request_AuthTokenService_DeleteAuthToken_0(ctx context.Context, marsh
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -190,7 +194,6 @@ func local_request_AuthTokenService_DeleteAuthToken_0(ctx context.Context, marsh
 // RegisterAuthTokenServiceHandlerServer registers the http handlers for service AuthTokenService to "mux".
 // UnaryRPC     :call AuthTokenServiceServer directly.
 // StreamingRPC :currently unsupported pending https://github.com/grpc/grpc-go/issues/906.
-// Note that using this registration option will cause many gRPC library features (such as grpc.SendHeader, etc) to stop working. Consider using RegisterAuthTokenServiceHandlerFromEndpoint instead.
 func RegisterAuthTokenServiceHandlerServer(ctx context.Context, mux *runtime.ServeMux, server AuthTokenServiceServer) error {
 
 	mux.Handle("GET", pattern_AuthTokenService_GetAuthToken_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {

internal/gen/controller/api/services/group_service.pb.gw.go

@@ -50,6 +50,7 @@ func request_GroupService_GetGroup_0(ctx context.Context, marshaler runtime.Mars
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -83,6 +84,7 @@ func local_request_GroupService_GetGroup_0(ctx context.Context, marshaler runtim
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -205,6 +207,7 @@ func request_GroupService_UpdateGroup_0(ctx context.Context, marshaler runtime.M
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -253,6 +256,7 @@ func local_request_GroupService_UpdateGroup_0(ctx context.Context, marshaler run
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -286,6 +290,7 @@ func request_GroupService_DeleteGroup_0(ctx context.Context, marshaler runtime.M
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -312,6 +317,7 @@ func local_request_GroupService_DeleteGroup_0(ctx context.Context, marshaler run
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -350,6 +356,7 @@ func request_GroupService_AddGroupMembers_0(ctx context.Context, marshaler runti
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -391,6 +398,7 @@ func local_request_GroupService_AddGroupMembers_0(ctx context.Context, marshaler
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -436,6 +444,7 @@ func request_GroupService_SetGroupMembers_0(ctx context.Context, marshaler runti
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -477,6 +486,7 @@ func local_request_GroupService_SetGroupMembers_0(ctx context.Context, marshaler
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -522,6 +532,7 @@ func request_GroupService_RemoveGroupMembers_0(ctx context.Context, marshaler ru
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -563,6 +574,7 @@ func local_request_GroupService_RemoveGroupMembers_0(ctx context.Context, marsha
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -582,7 +594,6 @@ func local_request_GroupService_RemoveGroupMembers_0(ctx context.Context, marsha
 // RegisterGroupServiceHandlerServer registers the http handlers for service GroupService to "mux".
 // UnaryRPC     :call GroupServiceServer directly.
 // StreamingRPC :currently unsupported pending https://github.com/grpc/grpc-go/issues/906.
-// Note that using this registration option will cause many gRPC library features (such as grpc.SendHeader, etc) to stop working. Consider using RegisterGroupServiceHandlerFromEndpoint instead.
 func RegisterGroupServiceHandlerServer(ctx context.Context, mux *runtime.ServeMux, server GroupServiceServer) error {
 
 	mux.Handle("GET", pattern_GroupService_GetGroup_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {

internal/gen/controller/api/services/host_catalog_service.pb.gw.go

@@ -50,6 +50,7 @@ func request_HostCatalogService_GetHostCatalog_0(ctx context.Context, marshaler
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -83,6 +84,7 @@ func local_request_HostCatalogService_GetHostCatalog_0(ctx context.Context, mars
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -205,6 +207,7 @@ func request_HostCatalogService_UpdateHostCatalog_0(ctx context.Context, marshal
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -253,6 +256,7 @@ func local_request_HostCatalogService_UpdateHostCatalog_0(ctx context.Context, m
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -286,6 +290,7 @@ func request_HostCatalogService_DeleteHostCatalog_0(ctx context.Context, marshal
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -312,6 +317,7 @@ func local_request_HostCatalogService_DeleteHostCatalog_0(ctx context.Context, m
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -324,7 +330,6 @@ func local_request_HostCatalogService_DeleteHostCatalog_0(ctx context.Context, m
 // RegisterHostCatalogServiceHandlerServer registers the http handlers for service HostCatalogService to "mux".
 // UnaryRPC     :call HostCatalogServiceServer directly.
 // StreamingRPC :currently unsupported pending https://github.com/grpc/grpc-go/issues/906.
-// Note that using this registration option will cause many gRPC library features (such as grpc.SendHeader, etc) to stop working. Consider using RegisterHostCatalogServiceHandlerFromEndpoint instead.
 func RegisterHostCatalogServiceHandlerServer(ctx context.Context, mux *runtime.ServeMux, server HostCatalogServiceServer) error {
 
 	mux.Handle("GET", pattern_HostCatalogService_GetHostCatalog_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {

internal/gen/controller/api/services/host_service.pb.gw.go

@@ -50,6 +50,7 @@ func request_HostService_GetHost_0(ctx context.Context, marshaler runtime.Marsha
 	}
 
 	protoReq.HostCatalogId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "host_catalog_id", err)
 	}
@@ -60,6 +61,7 @@ func request_HostService_GetHost_0(ctx context.Context, marshaler runtime.Marsha
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -93,6 +95,7 @@ func local_request_HostService_GetHost_0(ctx context.Context, marshaler runtime.
 	}
 
 	protoReq.HostCatalogId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "host_catalog_id", err)
 	}
@@ -103,6 +106,7 @@ func local_request_HostService_GetHost_0(ctx context.Context, marshaler runtime.
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -140,6 +144,7 @@ func request_HostService_ListHosts_0(ctx context.Context, marshaler runtime.Mars
 	}
 
 	protoReq.HostCatalogId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "host_catalog_id", err)
 	}
@@ -173,6 +178,7 @@ func local_request_HostService_ListHosts_0(ctx context.Context, marshaler runtim
 	}
 
 	protoReq.HostCatalogId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "host_catalog_id", err)
 	}
@@ -214,6 +220,7 @@ func request_HostService_CreateHost_0(ctx context.Context, marshaler runtime.Mar
 	}
 
 	protoReq.HostCatalogId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "host_catalog_id", err)
 	}
@@ -248,6 +255,7 @@ func local_request_HostService_CreateHost_0(ctx context.Context, marshaler runti
 	}
 
 	protoReq.HostCatalogId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "host_catalog_id", err)
 	}
@@ -293,6 +301,7 @@ func request_HostService_UpdateHost_0(ctx context.Context, marshaler runtime.Mar
 	}
 
 	protoReq.HostCatalogId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "host_catalog_id", err)
 	}
@@ -303,6 +312,7 @@ func request_HostService_UpdateHost_0(ctx context.Context, marshaler runtime.Mar
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -351,6 +361,7 @@ func local_request_HostService_UpdateHost_0(ctx context.Context, marshaler runti
 	}
 
 	protoReq.HostCatalogId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "host_catalog_id", err)
 	}
@@ -361,6 +372,7 @@ func local_request_HostService_UpdateHost_0(ctx context.Context, marshaler runti
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -394,6 +406,7 @@ func request_HostService_DeleteHost_0(ctx context.Context, marshaler runtime.Mar
 	}
 
 	protoReq.HostCatalogId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "host_catalog_id", err)
 	}
@@ -404,6 +417,7 @@ func request_HostService_DeleteHost_0(ctx context.Context, marshaler runtime.Mar
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -430,6 +444,7 @@ func local_request_HostService_DeleteHost_0(ctx context.Context, marshaler runti
 	}
 
 	protoReq.HostCatalogId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "host_catalog_id", err)
 	}
@@ -440,6 +455,7 @@ func local_request_HostService_DeleteHost_0(ctx context.Context, marshaler runti
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -452,7 +468,6 @@ func local_request_HostService_DeleteHost_0(ctx context.Context, marshaler runti
 // RegisterHostServiceHandlerServer registers the http handlers for service HostService to "mux".
 // UnaryRPC     :call HostServiceServer directly.
 // StreamingRPC :currently unsupported pending https://github.com/grpc/grpc-go/issues/906.
-// Note that using this registration option will cause many gRPC library features (such as grpc.SendHeader, etc) to stop working. Consider using RegisterHostServiceHandlerFromEndpoint instead.
 func RegisterHostServiceHandlerServer(ctx context.Context, mux *runtime.ServeMux, server HostServiceServer) error {
 
 	mux.Handle("GET", pattern_HostService_GetHost_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {

internal/gen/controller/api/services/host_set_service.pb.gw.go

@@ -50,6 +50,7 @@ func request_HostSetService_GetHostSet_0(ctx context.Context, marshaler runtime.
 	}
 
 	protoReq.HostCatalogId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "host_catalog_id", err)
 	}
@@ -60,6 +61,7 @@ func request_HostSetService_GetHostSet_0(ctx context.Context, marshaler runtime.
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -93,6 +95,7 @@ func local_request_HostSetService_GetHostSet_0(ctx context.Context, marshaler ru
 	}
 
 	protoReq.HostCatalogId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "host_catalog_id", err)
 	}
@@ -103,6 +106,7 @@ func local_request_HostSetService_GetHostSet_0(ctx context.Context, marshaler ru
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -140,6 +144,7 @@ func request_HostSetService_ListHostSets_0(ctx context.Context, marshaler runtim
 	}
 
 	protoReq.HostCatalogId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "host_catalog_id", err)
 	}
@@ -173,6 +178,7 @@ func local_request_HostSetService_ListHostSets_0(ctx context.Context, marshaler
 	}
 
 	protoReq.HostCatalogId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "host_catalog_id", err)
 	}
@@ -214,6 +220,7 @@ func request_HostSetService_CreateHostSet_0(ctx context.Context, marshaler runti
 	}
 
 	protoReq.HostCatalogId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "host_catalog_id", err)
 	}
@@ -248,6 +255,7 @@ func local_request_HostSetService_CreateHostSet_0(ctx context.Context, marshaler
 	}
 
 	protoReq.HostCatalogId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "host_catalog_id", err)
 	}
@@ -293,6 +301,7 @@ func request_HostSetService_UpdateHostSet_0(ctx context.Context, marshaler runti
 	}
 
 	protoReq.HostCatalogId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "host_catalog_id", err)
 	}
@@ -303,6 +312,7 @@ func request_HostSetService_UpdateHostSet_0(ctx context.Context, marshaler runti
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -351,6 +361,7 @@ func local_request_HostSetService_UpdateHostSet_0(ctx context.Context, marshaler
 	}
 
 	protoReq.HostCatalogId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "host_catalog_id", err)
 	}
@@ -361,6 +372,7 @@ func local_request_HostSetService_UpdateHostSet_0(ctx context.Context, marshaler
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -394,6 +406,7 @@ func request_HostSetService_DeleteHostSet_0(ctx context.Context, marshaler runti
 	}
 
 	protoReq.HostCatalogId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "host_catalog_id", err)
 	}
@@ -404,6 +417,7 @@ func request_HostSetService_DeleteHostSet_0(ctx context.Context, marshaler runti
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -430,6 +444,7 @@ func local_request_HostSetService_DeleteHostSet_0(ctx context.Context, marshaler
 	}
 
 	protoReq.HostCatalogId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "host_catalog_id", err)
 	}
@@ -440,6 +455,7 @@ func local_request_HostSetService_DeleteHostSet_0(ctx context.Context, marshaler
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -470,6 +486,7 @@ func request_HostSetService_AddHostSetHosts_0(ctx context.Context, marshaler run
 	}
 
 	protoReq.HostCatalogId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "host_catalog_id", err)
 	}
@@ -480,6 +497,7 @@ func request_HostSetService_AddHostSetHosts_0(ctx context.Context, marshaler run
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -513,6 +531,7 @@ func local_request_HostSetService_AddHostSetHosts_0(ctx context.Context, marshal
 	}
 
 	protoReq.HostCatalogId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "host_catalog_id", err)
 	}
@@ -523,6 +542,7 @@ func local_request_HostSetService_AddHostSetHosts_0(ctx context.Context, marshal
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -560,6 +580,7 @@ func request_HostSetService_SetHostSetHosts_0(ctx context.Context, marshaler run
 	}
 
 	protoReq.HostCatalogId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "host_catalog_id", err)
 	}
@@ -570,6 +591,7 @@ func request_HostSetService_SetHostSetHosts_0(ctx context.Context, marshaler run
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -603,6 +625,7 @@ func local_request_HostSetService_SetHostSetHosts_0(ctx context.Context, marshal
 	}
 
 	protoReq.HostCatalogId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "host_catalog_id", err)
 	}
@@ -613,6 +636,7 @@ func local_request_HostSetService_SetHostSetHosts_0(ctx context.Context, marshal
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -650,6 +674,7 @@ func request_HostSetService_RemoveHostSetHosts_0(ctx context.Context, marshaler
 	}
 
 	protoReq.HostCatalogId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "host_catalog_id", err)
 	}
@@ -660,6 +685,7 @@ func request_HostSetService_RemoveHostSetHosts_0(ctx context.Context, marshaler
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -693,6 +719,7 @@ func local_request_HostSetService_RemoveHostSetHosts_0(ctx context.Context, mars
 	}
 
 	protoReq.HostCatalogId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "host_catalog_id", err)
 	}
@@ -703,6 +730,7 @@ func local_request_HostSetService_RemoveHostSetHosts_0(ctx context.Context, mars
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -722,7 +750,6 @@ func local_request_HostSetService_RemoveHostSetHosts_0(ctx context.Context, mars
 // RegisterHostSetServiceHandlerServer registers the http handlers for service HostSetService to "mux".
 // UnaryRPC     :call HostSetServiceServer directly.
 // StreamingRPC :currently unsupported pending https://github.com/grpc/grpc-go/issues/906.
-// Note that using this registration option will cause many gRPC library features (such as grpc.SendHeader, etc) to stop working. Consider using RegisterHostSetServiceHandlerFromEndpoint instead.
 func RegisterHostSetServiceHandlerServer(ctx context.Context, mux *runtime.ServeMux, server HostSetServiceServer) error {
 
 	mux.Handle("GET", pattern_HostSetService_GetHostSet_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {

internal/gen/controller/api/services/role_service.pb.gw.go

@@ -50,6 +50,7 @@ func request_RoleService_GetRole_0(ctx context.Context, marshaler runtime.Marsha
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -83,6 +84,7 @@ func local_request_RoleService_GetRole_0(ctx context.Context, marshaler runtime.
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -205,6 +207,7 @@ func request_RoleService_UpdateRole_0(ctx context.Context, marshaler runtime.Mar
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -253,6 +256,7 @@ func local_request_RoleService_UpdateRole_0(ctx context.Context, marshaler runti
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -286,6 +290,7 @@ func request_RoleService_DeleteRole_0(ctx context.Context, marshaler runtime.Mar
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -312,6 +317,7 @@ func local_request_RoleService_DeleteRole_0(ctx context.Context, marshaler runti
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -350,6 +356,7 @@ func request_RoleService_AddRolePrincipals_0(ctx context.Context, marshaler runt
 	}
 
 	protoReq.RoleId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "role_id", err)
 	}
@@ -391,6 +398,7 @@ func local_request_RoleService_AddRolePrincipals_0(ctx context.Context, marshale
 	}
 
 	protoReq.RoleId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "role_id", err)
 	}
@@ -436,6 +444,7 @@ func request_RoleService_SetRolePrincipals_0(ctx context.Context, marshaler runt
 	}
 
 	protoReq.RoleId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "role_id", err)
 	}
@@ -477,6 +486,7 @@ func local_request_RoleService_SetRolePrincipals_0(ctx context.Context, marshale
 	}
 
 	protoReq.RoleId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "role_id", err)
 	}
@@ -522,6 +532,7 @@ func request_RoleService_RemoveRolePrincipals_0(ctx context.Context, marshaler r
 	}
 
 	protoReq.RoleId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "role_id", err)
 	}
@@ -563,6 +574,7 @@ func local_request_RoleService_RemoveRolePrincipals_0(ctx context.Context, marsh
 	}
 
 	protoReq.RoleId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "role_id", err)
 	}
@@ -608,6 +620,7 @@ func request_RoleService_AddRoleGrants_0(ctx context.Context, marshaler runtime.
 	}
 
 	protoReq.RoleId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "role_id", err)
 	}
@@ -649,6 +662,7 @@ func local_request_RoleService_AddRoleGrants_0(ctx context.Context, marshaler ru
 	}
 
 	protoReq.RoleId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "role_id", err)
 	}
@@ -694,6 +708,7 @@ func request_RoleService_SetRoleGrants_0(ctx context.Context, marshaler runtime.
 	}
 
 	protoReq.RoleId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "role_id", err)
 	}
@@ -735,6 +750,7 @@ func local_request_RoleService_SetRoleGrants_0(ctx context.Context, marshaler ru
 	}
 
 	protoReq.RoleId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "role_id", err)
 	}
@@ -780,6 +796,7 @@ func request_RoleService_RemoveRoleGrants_0(ctx context.Context, marshaler runti
 	}
 
 	protoReq.RoleId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "role_id", err)
 	}
@@ -821,6 +838,7 @@ func local_request_RoleService_RemoveRoleGrants_0(ctx context.Context, marshaler
 	}
 
 	protoReq.RoleId, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "role_id", err)
 	}
@@ -840,7 +858,6 @@ func local_request_RoleService_RemoveRoleGrants_0(ctx context.Context, marshaler
 // RegisterRoleServiceHandlerServer registers the http handlers for service RoleService to "mux".
 // UnaryRPC     :call RoleServiceServer directly.
 // StreamingRPC :currently unsupported pending https://github.com/grpc/grpc-go/issues/906.
-// Note that using this registration option will cause many gRPC library features (such as grpc.SendHeader, etc) to stop working. Consider using RegisterRoleServiceHandlerFromEndpoint instead.
 func RegisterRoleServiceHandlerServer(ctx context.Context, mux *runtime.ServeMux, server RoleServiceServer) error {
 
 	mux.Handle("GET", pattern_RoleService_GetRole_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {

internal/gen/controller/api/services/scope_service.pb.gw.go

@@ -50,6 +50,7 @@ func request_ScopeService_GetScope_0(ctx context.Context, marshaler runtime.Mars
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -83,6 +84,7 @@ func local_request_ScopeService_GetScope_0(ctx context.Context, marshaler runtim
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -223,6 +225,7 @@ func request_ScopeService_UpdateScope_0(ctx context.Context, marshaler runtime.M
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -271,6 +274,7 @@ func local_request_ScopeService_UpdateScope_0(ctx context.Context, marshaler run
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -304,6 +308,7 @@ func request_ScopeService_DeleteScope_0(ctx context.Context, marshaler runtime.M
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -330,6 +335,7 @@ func local_request_ScopeService_DeleteScope_0(ctx context.Context, marshaler run
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -342,7 +348,6 @@ func local_request_ScopeService_DeleteScope_0(ctx context.Context, marshaler run
 // RegisterScopeServiceHandlerServer registers the http handlers for service ScopeService to "mux".
 // UnaryRPC     :call ScopeServiceServer directly.
 // StreamingRPC :currently unsupported pending https://github.com/grpc/grpc-go/issues/906.
-// Note that using this registration option will cause many gRPC library features (such as grpc.SendHeader, etc) to stop working. Consider using RegisterScopeServiceHandlerFromEndpoint instead.
 func RegisterScopeServiceHandlerServer(ctx context.Context, mux *runtime.ServeMux, server ScopeServiceServer) error {
 
 	mux.Handle("GET", pattern_ScopeService_GetScope_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {

internal/gen/controller/api/services/user_service.pb.gw.go

@@ -50,6 +50,7 @@ func request_UserService_GetUser_0(ctx context.Context, marshaler runtime.Marsha
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -83,6 +84,7 @@ func local_request_UserService_GetUser_0(ctx context.Context, marshaler runtime.
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -205,6 +207,7 @@ func request_UserService_UpdateUser_0(ctx context.Context, marshaler runtime.Mar
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -253,6 +256,7 @@ func local_request_UserService_UpdateUser_0(ctx context.Context, marshaler runti
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -286,6 +290,7 @@ func request_UserService_DeleteUser_0(ctx context.Context, marshaler runtime.Mar
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -312,6 +317,7 @@ func local_request_UserService_DeleteUser_0(ctx context.Context, marshaler runti
 	}
 
 	protoReq.Id, err = runtime.String(val)
+
 	if err != nil {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
 	}
@@ -324,7 +330,6 @@ func local_request_UserService_DeleteUser_0(ctx context.Context, marshaler runti
 // RegisterUserServiceHandlerServer registers the http handlers for service UserService to "mux".
 // UnaryRPC     :call UserServiceServer directly.
 // StreamingRPC :currently unsupported pending https://github.com/grpc/grpc-go/issues/906.
-// Note that using this registration option will cause many gRPC library features (such as grpc.SendHeader, etc) to stop working. Consider using RegisterUserServiceHandlerFromEndpoint instead.
 func RegisterUserServiceHandlerServer(ctx context.Context, mux *runtime.ServeMux, server UserServiceServer) error {
 
 	mux.Handle("GET", pattern_UserService_GetUser_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {

internal/proto/local/controller/api/services/v1/account_service.proto

@@ -87,6 +87,34 @@ service AccountService {
       summary: "Deletes an account."
     };
   }
+
+  // SetPassword sets the account's password to the one provided in the
+  // request. This method is intended for administration purpose and as such
+  // does not require the old password.
+  rpc SetPassword(SetPasswordRequest) returns (SetPasswordResponse) {
+    option (google.api.http) = {
+      post: "/v1/scopes/*/auth-methods/{auth_method_id}/accounts/{id}:set-password"
+      body: "*"
+      response_body: "item"
+    };
+    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
+      summary: "Sets the password for the provided account."
+    };
+  }
+
+  // ChangePassword changes the account's password to the one provided in the
+  // request. This method is intended for end users and requires the existing
+  // password to be provided for authentication purposes.
+  rpc ChangePassword(ChangePasswordRequest) returns (ChangePasswordResponse) {
+    option (google.api.http) = {
+      post: "/v1/scopes/*/auth-methods/{auth_method_id}/accounts/{id}:change-password"
+      body: "*"
+      response_body: "item"
+    };
+    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
+      summary: "Sets the password for the provided account."
+    };
+  }
 }
 
 message GetAccountRequest {
@@ -138,3 +166,26 @@ message DeleteAccountRequest {
 message DeleteAccountResponse {
   bool existed = 1;
 }
+
+message SetPasswordRequest {
+  string auth_method_id = 1;
+  string id = 2;
+  uint32 version = 3;
+  string password = 4;
+}
+
+message SetPasswordResponse {
+  resources.authmethods.v1.Account item = 1;
+}
+
+message ChangePasswordRequest {
+  string auth_method_id = 1;
+  string id = 2;
+  uint32 version = 3;
+  string old_password = 4 [json_name="old_password"];
+  string new_password = 5 [json_name="new_password"];
+}
+
+message ChangePasswordResponse {
+  resources.authmethods.v1.Account item = 1;
+}

internal/servers/controller/handler_test.go

@@ -75,6 +75,8 @@ func TestHandleImplementedPaths(t *testing.T) {
 
 			// custom methods
 			"v1/scopes/someid/auth-methods/someid:authenticate",
+			"v1/scopes/someid/auth-methods/someid/accounts/someid:set-password",
+			"v1/scopes/someid/auth-methods/someid/accounts/someid:change-password",
 			"v1/scopes/someid/roles/someid:add-principals",
 			"v1/scopes/someid/roles/someid:set-principals",
 			"v1/scopes/someid/roles/someid:remove-principals",

internal/servers/controller/handlers/accounts/account_service.go

@@ -134,6 +134,40 @@ func (s Service) DeleteAccount(ctx context.Context, req *pbs.DeleteAccountReques
 	return &pbs.DeleteAccountResponse{Existed: existed}, nil
 }
 
+// ChangePassword implements the interface pbs.AccountServiceServer.
+func (s Service) ChangePassword(ctx context.Context, req *pbs.ChangePasswordRequest) (*pbs.ChangePasswordResponse, error) {
+	authResults := auth.Verify(ctx)
+	if authResults.Error != nil {
+		return nil, authResults.Error
+	}
+	if err := validateChangePasswordRequest(req); err != nil {
+		return nil, err
+	}
+	u, err := s.changePasswordInRepo(ctx, req.GetId(), req.GetVersion(), req.GetOldPassword(), req.GetNewPassword())
+	if err != nil {
+		return nil, err
+	}
+	u.Scope = authResults.Scope
+	return &pbs.ChangePasswordResponse{Item: u}, nil
+}
+
+// SetPassword implements the interface pbs.AccountServiceServer.
+func (s Service) SetPassword(ctx context.Context, req *pbs.SetPasswordRequest) (*pbs.SetPasswordResponse, error) {
+	authResults := auth.Verify(ctx)
+	if authResults.Error != nil {
+		return nil, authResults.Error
+	}
+	if err := validateSetPasswordRequest(req); err != nil {
+		return nil, err
+	}
+	u, err := s.setPasswordInRepo(ctx, req.GetId(), req.GetVersion(), req.GetPassword())
+	if err != nil {
+		return nil, err
+	}
+	u.Scope = authResults.Scope
+	return &pbs.SetPasswordResponse{Item: u}, nil
+}
+
 func (s Service) getFromRepo(ctx context.Context, id string) (*pb.Account, error) {
 	repo, err := s.repoFn()
 	if err != nil {
@@ -158,9 +192,6 @@ func (s Service) createInRepo(ctx context.Context, authMethodId string, item *pb
 		return nil, status.Errorf(codes.InvalidArgument, "Provided attributes don't match expected format.")
 	}
 	opts := []password.Option{password.WithLoginName(pwAttrs.GetLoginName())}
-	if pwAttrs.GetPassword() != nil {
-		opts = append(opts, password.WithPassword(pwAttrs.GetPassword().GetValue()))
-	}
 	if item.GetName() != nil {
 		opts = append(opts, password.WithName(item.GetName().GetValue()))
 	}
@@ -175,7 +206,12 @@ func (s Service) createInRepo(ctx context.Context, authMethodId string, item *pb
 	if err != nil {
 		return nil, err
 	}
-	out, err := repo.CreateAccount(ctx, a)
+
+	var createOpts []password.Option
+	if pwAttrs.GetPassword() != nil {
+		createOpts = append(createOpts, password.WithPassword(pwAttrs.GetPassword().GetValue()))
+	}
+	out, err := repo.CreateAccount(ctx, a, createOpts...)
 	if err != nil {
 		return nil, status.Errorf(codes.Internal, "Unable to create user: %v.", err)
 	}
@@ -260,6 +296,33 @@ func (s Service) listFromRepo(ctx context.Context, authMethodId string) ([]*pb.A
 	return outUl, nil
 }
 
+func (s Service) changePasswordInRepo(ctx context.Context, id string, version uint32, oldPassword, newPassword string) (*pb.Account, error) {
+	repo, err := s.repoFn()
+	if err != nil {
+		return nil, err
+	}
+	out, err := repo.ChangePassword(ctx, id, oldPassword, newPassword, version)
+	if err != nil {
+		return nil, status.Errorf(codes.Internal, "Unable to change password: %v.", err)
+	}
+	if out == nil {
+		return nil, status.Errorf(codes.PermissionDenied, "Failed to change password.")
+	}
+	return toProto(out)
+}
+
+func (s Service) setPasswordInRepo(ctx context.Context, id string, version uint32, password string) (*pb.Account, error) {
+	repo, err := s.repoFn()
+	if err != nil {
+		return nil, err
+	}
+	out, err := repo.SetPassword(ctx, id, password, version)
+	if err != nil {
+		return nil, status.Errorf(codes.Internal, "Unable to set password: %v.", err)
+	}
+	return toProto(out)
+}
+
 func toProto(in *password.Account) (*pb.Account, error) {
 	out := pb.Account{
 		Id:           in.GetPublicId(),
@@ -363,6 +426,46 @@ func validateListRequest(req *pbs.ListAccountsRequest) error {
 	return nil
 }
 
+func validateChangePasswordRequest(req *pbs.ChangePasswordRequest) error {
+	badFields := map[string]string{}
+	if !validId(req.GetId(), password.AccountPrefix+"_") {
+		badFields["id"] = "Improperly formatted identifier."
+	}
+	if !validId(req.GetAuthMethodId(), password.AuthMethodPrefix+"_") {
+		badFields["auth_method_id"] = "Invalid formatted identifier."
+	}
+	if req.GetVersion() == 0 {
+		badFields["version"] = "Existing resource version is required for an update."
+	}
+	if req.GetNewPassword() == "" {
+		badFields["new_password"] = "This is a required field."
+	}
+	if req.GetOldPassword() == "" {
+		badFields["old_password"] = "This is a required field."
+	}
+	if len(badFields) > 0 {
+		return handlers.InvalidArgumentErrorf("Improperly formatted identifier.", badFields)
+	}
+	return nil
+}
+
+func validateSetPasswordRequest(req *pbs.SetPasswordRequest) error {
+	badFields := map[string]string{}
+	if !validId(req.GetId(), password.AccountPrefix+"_") {
+		badFields["id"] = "Improperly formatted identifier."
+	}
+	if !validId(req.GetAuthMethodId(), password.AuthMethodPrefix+"_") {
+		badFields["auth_method_id"] = "Invalid formatted identifier."
+	}
+	if req.GetVersion() == 0 {
+		badFields["version"] = "Existing resource version is required for an update."
+	}
+	if len(badFields) > 0 {
+		return handlers.InvalidArgumentErrorf("Improperly formatted identifier.", badFields)
+	}
+	return nil
+}
+
 func validateUpdateRequest(req *pbs.UpdateAccountRequest) error {
 	badFields := map[string]string{}
 	if !validId(req.GetId(), password.AccountPrefix+"_") {

internal/servers/controller/handlers/accounts/account_service_test.go

@@ -824,3 +824,272 @@ func TestUpdate(t *testing.T) {
 		})
 	}
 }
+
+func TestSetPassword(t *testing.T) {
+	conn, _ := db.TestSetup(t, "postgres")
+	rw := db.New(conn)
+	wrap := db.TestWrapper(t)
+	repoFn := func() (*password.Repository, error) {
+		return password.NewRepository(rw, rw, wrap)
+	}
+
+	o, _ := iam.TestScopes(t, conn)
+	tested, err := accounts.NewService(repoFn)
+	require.NoError(t, err, "Error when getting new auth_method service.")
+
+	createAccount := func(t *testing.T, pw string) *pb.Account {
+		am := password.TestAuthMethods(t, conn, o.GetPublicId(), 1)[0]
+		pwAttrs := &pb.PasswordAccountAttributes{
+			LoginName: "testusername",
+		}
+		if pw != "" {
+			pwAttrs.Password = wrapperspb.String(pw)
+		}
+		attrs, err := handlers.ProtoToStruct(pwAttrs)
+		createResp, err := tested.CreateAccount(auth.DisabledAuthTestContext(auth.WithScopeId(o.GetPublicId())), &pbs.CreateAccountRequest{
+			AuthMethodId: am.GetPublicId(),
+			Item: &pb.Account{
+				Type:       "password",
+				Attributes: attrs,
+			},
+		})
+		require.NoError(t, err)
+		require.NotNil(t, createResp)
+		require.NotNil(t, createResp.GetItem())
+		return createResp.GetItem()
+	}
+
+	cases := []struct {
+		name  string
+		oldPw string
+		newPw string
+	}{
+		{
+			name:  "has old set new",
+			oldPw: "originalpassword",
+			newPw: "a different password",
+		},
+		{
+			name:  "has old unset new",
+			oldPw: "originalpassword",
+			newPw: "",
+		},
+		{
+			name:  "no old password set new",
+			oldPw: "",
+			newPw: "a different password",
+		},
+	}
+
+	for _, tt := range cases {
+		t.Run(tt.name, func(t *testing.T) {
+			assert, require := assert.New(t), require.New(t)
+			acct := createAccount(t, tt.oldPw)
+
+			setResp, err := tested.SetPassword(auth.DisabledAuthTestContext(auth.WithScopeId(o.GetPublicId())), &pbs.SetPasswordRequest{
+				AuthMethodId: acct.GetAuthMethodId(),
+				Id:           acct.GetId(),
+				Version:      acct.GetVersion(),
+				Password:     tt.newPw,
+			})
+			require.NoError(err)
+			assert.Equal(acct.GetVersion()+1, setResp.GetItem().GetVersion())
+			// clear uncomparable fields
+			acct.Version, setResp.GetItem().Version = 0, 0
+			acct.UpdatedTime, setResp.GetItem().UpdatedTime = nil, nil
+
+			assert.Empty(cmp.Diff(acct, setResp.GetItem(), protocmp.Transform()))
+		})
+	}
+
+	defaultAcct := createAccount(t, "")
+	badRequestCases := []struct {
+		name         string
+		authMethodId string
+		accountId    string
+		version      uint32
+		password     string
+	}{
+		{
+			name:         "empty auth method",
+			authMethodId: "",
+			accountId:    defaultAcct.GetId(),
+			version:      defaultAcct.GetVersion(),
+			password:     "somepassword",
+		},
+		{
+			name:         "empty account id",
+			authMethodId: defaultAcct.GetAuthMethodId(),
+			accountId:    "",
+			version:      defaultAcct.GetVersion(),
+			password:     "somepassword",
+		},
+		{
+			name:         "unset version",
+			authMethodId: defaultAcct.GetAuthMethodId(),
+			accountId:    defaultAcct.GetId(),
+			version:      0,
+			password:     "somepassword",
+		},
+	}
+
+	for _, tt := range badRequestCases {
+		t.Run(tt.name, func(t *testing.T) {
+			assert := assert.New(t)
+
+			setResp, err := tested.SetPassword(auth.DisabledAuthTestContext(auth.WithScopeId(o.GetPublicId())), &pbs.SetPasswordRequest{
+				AuthMethodId: tt.authMethodId,
+				Id:           tt.accountId,
+				Version:      tt.version,
+				Password:     tt.password,
+			})
+			assert.Error(err)
+			assert.Nil(setResp)
+		})
+	}
+}
+
+func TestChangePassword(t *testing.T) {
+	conn, _ := db.TestSetup(t, "postgres")
+	rw := db.New(conn)
+	wrap := db.TestWrapper(t)
+	repoFn := func() (*password.Repository, error) {
+		return password.NewRepository(rw, rw, wrap)
+	}
+
+	o, _ := iam.TestScopes(t, conn)
+	tested, err := accounts.NewService(repoFn)
+	require.NoError(t, err, "Error when getting new auth_method service.")
+
+	createAccount := func(t *testing.T, pw string) *pb.Account {
+		am := password.TestAuthMethods(t, conn, o.GetPublicId(), 1)[0]
+		pwAttrs := &pb.PasswordAccountAttributes{
+			LoginName: "testusername",
+		}
+		if pw != "" {
+			pwAttrs.Password = wrapperspb.String(pw)
+		}
+		attrs, err := handlers.ProtoToStruct(pwAttrs)
+		createResp, err := tested.CreateAccount(auth.DisabledAuthTestContext(auth.WithScopeId(o.GetPublicId())), &pbs.CreateAccountRequest{
+			AuthMethodId: am.GetPublicId(),
+			Item: &pb.Account{
+				Type:       "password",
+				Attributes: attrs,
+			},
+		})
+		require.NoError(t, err)
+		require.NotNil(t, createResp)
+		require.NotNil(t, createResp.GetItem())
+		return createResp.GetItem()
+	}
+
+	t.Run("valid update", func(t *testing.T) {
+		assert, require := assert.New(t), require.New(t)
+		acct := createAccount(t, "originalpassword")
+
+		changeResp, err := tested.ChangePassword(auth.DisabledAuthTestContext(auth.WithScopeId(o.GetPublicId())), &pbs.ChangePasswordRequest{
+			AuthMethodId: acct.GetAuthMethodId(),
+			Id:           acct.GetId(),
+			Version:      acct.GetVersion(),
+			OldPassword:  "originalpassword",
+			NewPassword:  "a different password",
+		})
+		require.NoError(err)
+		assert.Equal(acct.GetVersion()+1, changeResp.GetItem().GetVersion())
+		// clear uncomparable fields
+		acct.Version, changeResp.GetItem().Version = 0, 0
+		acct.UpdatedTime, changeResp.GetItem().UpdatedTime = nil, nil
+
+		assert.Empty(cmp.Diff(acct, changeResp.GetItem(), protocmp.Transform()))
+	})
+
+	t.Run("unauthenticated update", func(t *testing.T) {
+		assert := assert.New(t)
+		acct := createAccount(t, "originalpassword")
+
+		changeResp, err := tested.ChangePassword(auth.DisabledAuthTestContext(auth.WithScopeId(o.GetPublicId())), &pbs.ChangePasswordRequest{
+			AuthMethodId: acct.GetAuthMethodId(),
+			Id:           acct.GetId(),
+			Version:      acct.GetVersion(),
+			OldPassword:  "thewrongpassword",
+			NewPassword:  "a different password",
+		})
+		assert.Error(err)
+		assert.Nil(changeResp)
+	})
+
+	defaultAcct := createAccount(t, "")
+	badRequestCases := []struct {
+		name         string
+		authMethodId string
+		accountId    string
+		version      uint32
+		oldPW        string
+		newPW        string
+	}{
+		{
+			name:         "empty auth method",
+			authMethodId: "",
+			accountId:    defaultAcct.GetId(),
+			version:      defaultAcct.GetVersion(),
+			oldPW:        "somepassword",
+			newPW:        "anewpassword",
+		},
+		{
+			name:         "empty account id",
+			authMethodId: defaultAcct.GetAuthMethodId(),
+			accountId:    "",
+			version:      defaultAcct.GetVersion(),
+			oldPW:        "somepassword",
+			newPW:        "anewpassword",
+		},
+		{
+			name:         "unset version",
+			authMethodId: defaultAcct.GetAuthMethodId(),
+			accountId:    defaultAcct.GetId(),
+			version:      0,
+			oldPW:        "somepassword",
+			newPW:        "anewpassword",
+		},
+		{
+			name:         "no old password",
+			authMethodId: defaultAcct.GetAuthMethodId(),
+			accountId:    defaultAcct.GetId(),
+			version:      defaultAcct.GetVersion(),
+			oldPW:        "",
+			newPW:        "anewpassword",
+		},
+		{
+			name:         "no new password",
+			authMethodId: defaultAcct.GetAuthMethodId(),
+			accountId:    defaultAcct.GetId(),
+			version:      defaultAcct.GetVersion(),
+			oldPW:        "somepassword",
+			newPW:        "",
+		},
+		{
+			name:         "matching old and new passwords",
+			authMethodId: defaultAcct.GetAuthMethodId(),
+			accountId:    defaultAcct.GetId(),
+			version:      defaultAcct.GetVersion(),
+			oldPW:        "somepassword",
+			newPW:        "somepassword",
+		},
+	}
+
+	for _, tt := range badRequestCases {
+		t.Run(tt.name, func(t *testing.T) {
+			assert := assert.New(t)
+
+			changeResp, err := tested.ChangePassword(auth.DisabledAuthTestContext(auth.WithScopeId(o.GetPublicId())), &pbs.ChangePasswordRequest{
+				AuthMethodId: tt.authMethodId,
+				Id:           tt.accountId,
+				Version:      tt.version,
+				OldPassword:  tt.oldPW,
+				NewPassword:  tt.newPW,
+			})
+			assert.Error(err)
+			assert.Nil(changeResp)
+		})
+	}
+}

internal/types/action/action.go

@@ -25,6 +25,8 @@ const (
 	AddMembers       Type = 16
 	SetMembers       Type = 17
 	RemoveMembers    Type = 18
+	SetPassword      Type = 19
+	ChangePassword   Type = 20
 )
 
 var Map = map[string]Type{
@@ -46,6 +48,8 @@ var Map = map[string]Type{
 	AddMembers.String():       AddMembers,
 	SetMembers.String():       SetMembers,
 	RemoveMembers.String():    RemoveMembers,
+	SetPassword.String():      SetPassword,
+	ChangePassword.String():   ChangePassword,
 }
 
 func (a Type) String() string {
@@ -69,5 +73,7 @@ func (a Type) String() string {
 		"add-members",
 		"set-members",
 		"remove-members",
+		"set-password",
+		"change-password",
 	}[a]
 }