diff --git a/app/app.py b/app/app.py
index 4ef6d47..3762c14 100644
--- a/app/app.py
+++ b/app/app.py
@@ -129,10 +129,59 @@ def require_capability(cap):
 #       AUTH
 # ================
 
+import pyotp, base64, os
+
+@app.route("/auth/enable_2fa", methods=["POST"])
+@login_required
+def enable_2fa():
+    db = SessionLocal()
+    if app.config["AUTH_MODE"] == "oauth":
+        email = session["user"]["email"]
+    else:
+        email = session["db_user"]["email"]
+
+    u = db.query(User).filter_by(email=email).first()
+    secret = base64.b32encode(os.urandom(10)).decode("utf-8")
+    u.totp_secret = secret
+    u.twofa_enabled = True
+    db.commit()
+    db.close()
+
+    # Você mostra esse secret como QR code no frontend (otpauth:// URI)
+    return jsonify({"secret": secret})
+
+
 @app.route("/auth_mode")
 def auth_mode():
     return jsonify({"mode": app.config["AUTH_MODE"]})
 
+@app.route("/auth/login", methods=["GET", "POST"])
+def db_login():
+    if request.method == "GET":
+        return send_file("/srv/auth/login.html")
+
+    email = request.form.get("email")
+    password = request.form.get("password")
+    token = request.form.get("token")  # código 2FA
+
+    db = SessionLocal()
+    user = db.query(User).filter_by(email=email).first()
+
+    if not user or user.password != password:
+        db.close()
+        return jsonify({"error": "Invalid credentials"}), 401
+
+    if user.twofa_enabled:
+        totp = pyotp.TOTP(user.totp_secret)
+        if not totp.verify(token):
+            db.close()
+            return jsonify({"error": "Invalid 2FA token"}), 401
+
+    db.close()
+    session["db_user"] = {"email": user.email, "name": user.name, "role": user.role}
+    return redirect("/")
+
+
 
 oauth = OAuth(app)
 google = oauth.register(