diff --git a/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/SysCategoryController.java b/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/SysCategoryController.java
index 4ba0c25a..0c20e96e 100644
--- a/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/SysCategoryController.java
+++ b/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/SysCategoryController.java
@@ -16,6 +16,7 @@ import com.jero.common.util.oConvertUtils;
 import com.jero.modules.system.entity.SysCategory;
 import com.jero.modules.system.model.TreeSelectModel;
 import com.jero.modules.system.service.ISysCategoryService;
+import org.apache.shiro.authz.annotation.RequiresPermissions;
 import org.jeecgframework.poi.excel.ExcelImportUtil;
 import org.jeecgframework.poi.excel.def.NormalExcelConstants;
 import org.jeecgframework.poi.excel.entity.ExportParams;
@@ -54,6 +55,7 @@ public class SysCategoryController {
 	 * @param req
 	 * @return
 	 */
+	@RequiresPermissions("sys:category:list")
 	@GetMapping(value = "/rootList")
 	public Result<IPage<SysCategory>> queryPageList(SysCategory sysCategory,
 									  @RequestParam(name="pageNo", defaultValue="1") Integer pageNo,
@@ -76,7 +78,8 @@ public class SysCategoryController {
 		result.setResult(pageList);
 		return result;
 	}
-	
+
+	@RequiresPermissions("sys:category:list")
 	@GetMapping(value = "/childList")
 	public Result<List<SysCategory>> queryPageList(SysCategory sysCategory,HttpServletRequest req) {
 		Result<List<SysCategory>> result = new Result<List<SysCategory>>();
@@ -93,6 +96,7 @@ public class SysCategoryController {
 	 * @param sysCategory
 	 * @return
 	 */
+	@RequiresPermissions("sys:category:list")
 	@PostMapping(value = "/add")
 	public Result<SysCategory> add(@RequestBody SysCategory sysCategory) {
 		Result<SysCategory> result = new Result<SysCategory>();
@@ -111,6 +115,7 @@ public class SysCategoryController {
 	 * @param sysCategory
 	 * @return
 	 */
+	@RequiresPermissions("sys:category:list")
 	@PutMapping(value = "/edit")
 	public Result<SysCategory> edit(@RequestBody SysCategory sysCategory) {
 		Result<SysCategory> result = new Result<SysCategory>();
@@ -129,6 +134,7 @@ public class SysCategoryController {
 	 * @param id
 	 * @return
 	 */
+	@RequiresPermissions("sys:category:list")
 	@DeleteMapping(value = "/delete")
 	public Result<SysCategory> delete(@RequestParam(name="id",required=true) String id) {
 		Result<SysCategory> result = new Result<SysCategory>();
@@ -148,6 +154,7 @@ public class SysCategoryController {
 	 * @param ids
 	 * @return
 	 */
+	@RequiresPermissions("sys:category:list")
 	@DeleteMapping(value = "/deleteBatch")
 	public Result<SysCategory> deleteBatch(@RequestParam(name="ids",required=true) String ids) {
 		Result<SysCategory> result = new Result<SysCategory>();
@@ -165,6 +172,7 @@ public class SysCategoryController {
 	 * @param id
 	 * @return
 	 */
+	@RequiresPermissions("sys:category:list")
 	@GetMapping(value = "/queryById")
 	public Result<SysCategory> queryById(@RequestParam(name="id",required=true) String id) {
 		Result<SysCategory> result = new Result<SysCategory>();
@@ -183,6 +191,7 @@ public class SysCategoryController {
    *
    * @param request
    */
+  @RequiresPermissions("sys:category:list")
   @RequestMapping(value = "/exportXls")
   public ModelAndView exportXls(HttpServletRequest request, SysCategory sysCategory) {
       // Step.1 组装查询条件查询数据
@@ -214,6 +223,7 @@ public class SysCategoryController {
    * @param response
    * @return
    */
+  @RequiresPermissions("sys:category:list")
   @RequestMapping(value = "/importExcel", method = RequestMethod.POST)
   public Result<?> importExcel(HttpServletRequest request, HttpServletResponse response) {
       MultipartHttpServletRequest multipartRequest = (MultipartHttpServletRequest) request;
@@ -264,6 +274,7 @@ public class SysCategoryController {
   /**
      * 加载单个数据 用于回显
    */
+  	@RequiresPermissions("sys:category:list")
     @RequestMapping(value = "/loadOne", method = RequestMethod.GET)
  	public Result<SysCategory> loadOne(@RequestParam(name="field") String field,@RequestParam(name="val") String val) {
  		Result<SysCategory> result = new Result<SysCategory>();
@@ -293,6 +304,7 @@ public class SysCategoryController {
     /**
           * 加载节点的子数据
      */
+	@RequiresPermissions("sys:category:list")
     @RequestMapping(value = "/loadTreeChildren", method = RequestMethod.GET)
 	public Result<List<TreeSelectModel>> loadTreeChildren(@RequestParam(name="pid") String pid) {
 		Result<List<TreeSelectModel>> result = new Result<List<TreeSelectModel>>();
@@ -311,6 +323,7 @@ public class SysCategoryController {
     /**
          * 加载一级节点/如果是同步 则所有数据
      */
+	@RequiresPermissions("sys:category:list")
     @RequestMapping(value = "/loadTreeRoot", method = RequestMethod.GET)
    	public Result<List<TreeSelectModel>> loadTreeRoot(@RequestParam(name="async") Boolean async,@RequestParam(name="pcode") String pcode) {
    		Result<List<TreeSelectModel>> result = new Result<List<TreeSelectModel>>();
@@ -332,6 +345,7 @@ public class SysCategoryController {
     /**
          * 递归求子节点 同步加载用到
      */
+	@RequiresPermissions("sys:category:list")
   	private void loadAllCategoryChildren(List<TreeSelectModel> ls) {
   		for (TreeSelectModel tsm : ls) {
 			List<TreeSelectModel> temp = this.sysCategoryService.queryListByPid(tsm.getKey());
@@ -348,6 +362,7 @@ public class SysCategoryController {
 	  * @param code
 	  * @return
 	  */
+	 @RequiresPermissions("sys:category:list")
 	 @GetMapping(value = "/checkCode")
 	 public Result<?> checkCode(@RequestParam(name="pid",required = false) String pid,@RequestParam(name="code",required = false) String code) {
 		if(oConvertUtils.isEmpty(code)){
@@ -373,6 +388,7 @@ public class SysCategoryController {
 	  * @param condition
 	  * @return
 	  */
+	 @RequiresPermissions("sys:category:list")
 	 @RequestMapping(value = "/loadTreeData", method = RequestMethod.GET)
 	 public Result<List<TreeSelectModel>> loadDict(@RequestParam(name="pid",required = false) String pid,@RequestParam(name="pcode",required = false) String pcode, @RequestParam(name="condition",required = false) String condition) {
 		 Result<List<TreeSelectModel>> result = new Result<List<TreeSelectModel>>();
@@ -411,6 +427,7 @@ public class SysCategoryController {
 	  * @param ids
 	  * @return
 	  */
+	 @RequiresPermissions("sys:category:list")
 	 @RequestMapping(value = "/loadDictItem", method = RequestMethod.GET)
 	 public Result<List<String>> loadDictItem(@RequestParam(name = "ids") String ids) {
 		 Result<List<String>> result = new Result<>();
@@ -437,6 +454,7 @@ public class SysCategoryController {
 	  * @param code
 	  * @return
 	  */
+	 @RequiresPermissions("sys:category:list")
 	 @RequestMapping(value = "/loadAllData", method = RequestMethod.GET)
 	 public Result<List<DictModel>> loadAllData(@RequestParam(name="code",required = true) String code) {
 		 Result<List<DictModel>> result = new Result<List<DictModel>>();
@@ -464,6 +482,7 @@ public class SysCategoryController {
 	  * @param parentIds
 	  * @return
 	  */
+	 @RequiresPermissions("sys:category:list")
 	 @GetMapping("/getChildListBatch")
 	 public Result getChildListBatch(@RequestParam("parentIds") String parentIds) {
 		 try {
diff --git a/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/SysDepartController.java b/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/SysDepartController.java
index 46253632..6048bc72 100644
--- a/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/SysDepartController.java
+++ b/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/SysDepartController.java
@@ -24,6 +24,7 @@ import com.jero.modules.system.model.DepartIdModel;
 import com.jero.modules.system.service.ISysDepartService;
 import com.jero.modules.system.service.ISysUserDepartService;
 import com.jero.modules.system.service.ISysUserService;
+import org.apache.shiro.authz.annotation.RequiresPermissions;
 import org.jeecgframework.poi.excel.ExcelImportUtil;
 import org.jeecgframework.poi.excel.def.NormalExcelConstants;
 import org.jeecgframework.poi.excel.entity.ExportParams;
@@ -66,6 +67,7 @@ public class SysDepartController {
 	 *
 	 * @return
 	 */
+	@RequiresPermissions("sys:depart:list")
 	@RequestMapping(value = "/queryMyDeptTreeList", method = RequestMethod.GET)
 	public Result<List<SysDepartTreeModel>> queryMyDeptTreeList() {
 		Result<List<SysDepartTreeModel>> result = new Result<>();
@@ -91,6 +93,7 @@ public class SysDepartController {
 	 * 
 	 * @return
 	 */
+	@RequiresPermissions("sys:depart:list")
 	@RequestMapping(value = "/queryTreeList", method = RequestMethod.GET)
 	public Result<List<SysDepartTreeModel>> queryTreeList() {
 		Result<List<SysDepartTreeModel>> result = new Result<>();
@@ -116,6 +119,7 @@ public class SysDepartController {
 	 * @return
 	 */
 	//@RequiresRoles({"admin"})
+	@RequiresPermissions("sys:depart:list")
 	@RequestMapping(value = "/add", method = RequestMethod.POST)
 	@CacheEvict(value= {CacheConstant.SYS_DEPARTS_CACHE,CacheConstant.SYS_DEPART_IDS_CACHE}, allEntries=true)
 	public Result<SysDepart> add(@RequestBody SysDepart sysDepart, HttpServletRequest request) {
@@ -142,6 +146,7 @@ public class SysDepartController {
 	 * @return
 	 */
 	//@RequiresRoles({"admin"})
+	@RequiresPermissions("sys:depart:list")
 	@RequestMapping(value = "/edit", method = RequestMethod.PUT)
 	@CacheEvict(value= {CacheConstant.SYS_DEPARTS_CACHE,CacheConstant.SYS_DEPART_IDS_CACHE}, allEntries=true)
 	public Result<SysDepart> edit(@RequestBody SysDepart sysDepart, HttpServletRequest request) {
@@ -170,6 +175,7 @@ public class SysDepartController {
     * @return
     */
 	//@RequiresRoles({"admin"})
+	 @RequiresPermissions("sys:depart:list")
     @RequestMapping(value = "/delete", method = RequestMethod.DELETE)
 	@CacheEvict(value= {CacheConstant.SYS_DEPARTS_CACHE,CacheConstant.SYS_DEPART_IDS_CACHE}, allEntries=true)
    public Result<SysDepart> delete(@RequestParam(name="id",required=true) String id) {
@@ -198,6 +204,7 @@ public class SysDepartController {
 	 * @return
 	 */
 	//@RequiresRoles({"admin"})
+	@RequiresPermissions("sys:depart:list")
 	@RequestMapping(value = "/deleteBatch", method = RequestMethod.DELETE)
 	@CacheEvict(value= {CacheConstant.SYS_DEPARTS_CACHE,CacheConstant.SYS_DEPART_IDS_CACHE}, allEntries=true)
 	public Result<SysDepart> deleteBatch(@RequestParam(name = "ids", required = true) String ids) {
@@ -217,6 +224,7 @@ public class SysDepartController {
 	 * 
 	 * @return
 	 */
+	@RequiresPermissions("sys:depart:list")
 	@RequestMapping(value = "/queryIdTree", method = RequestMethod.GET)
 	public Result<List<DepartIdModel>> queryIdTree() {
 //		Result<List<DepartIdModel>> result = new Result<List<DepartIdModel>>();
@@ -257,6 +265,7 @@ public class SysDepartController {
 	 * @param keyWord
 	 * @return
 	 */
+	@RequiresPermissions("sys:depart:list")
 	@RequestMapping(value = "/searchBy", method = RequestMethod.GET)
 	public Result<List<SysDepartTreeModel>> searchBy(@RequestParam(name = "keyWord", required = true) String keyWord,@RequestParam(name = "myDeptSearch", required = false) String myDeptSearch) {
 		Result<List<SysDepartTreeModel>> result = new Result<List<SysDepartTreeModel>>();
@@ -282,6 +291,7 @@ public class SysDepartController {
      *
      * @param request
      */
+	@RequiresPermissions("sys:depart:list")
     @RequestMapping(value = "/exportXls")
     public ModelAndView exportXls(SysDepart sysDepart,HttpServletRequest request) {
         // Step.1 组装查询条件
@@ -313,6 +323,7 @@ public class SysDepartController {
      * @return
      */
     //@RequiresRoles({"admin"})
+	@RequiresPermissions("sys:depart:list")
     @RequestMapping(value = "/importExcel", method = RequestMethod.POST)
 	@CacheEvict(value= {CacheConstant.SYS_DEPARTS_CACHE,CacheConstant.SYS_DEPART_IDS_CACHE}, allEntries=true)
     public Result<?> importExcel(HttpServletRequest request, HttpServletResponse response) {
@@ -390,6 +401,7 @@ public class SysDepartController {
 	 * 查询所有部门信息
 	 * @return
 	 */
+	@RequiresPermissions("sys:depart:list")
 	@GetMapping("listAll")
 	public Result<List<SysDepart>> listAll(@RequestParam(name = "id", required = false) String id) {
 		Result<List<SysDepart>> result = new Result<>();
@@ -409,6 +421,7 @@ public class SysDepartController {
 	 *
 	 * @return
 	 */
+	@RequiresPermissions("sys:depart:list")
 	@RequestMapping(value = "/queryTreeByKeyWord", method = RequestMethod.GET)
 	public Result<Map<String,Object>> queryTreeByKeyWord(@RequestParam(name = "keyWord", required = false) String keyWord) {
 		Result<Map<String,Object>> result = new Result<>();
@@ -436,6 +449,7 @@ public class SysDepartController {
 	 * @param orgCode
 	 * @return
 	 */
+	@RequiresPermissions("sys:depart:list")
 	@GetMapping("/getDepartName")
 	public Result<SysDepart> getDepartName(@RequestParam(name = "orgCode") String orgCode) {
 		Result<SysDepart> result = new Result<>();
@@ -453,6 +467,7 @@ public class SysDepartController {
 	 * @param id
 	 * @return
 	 */
+	@RequiresPermissions("sys:depart:list")
 	@GetMapping("/getUsersByDepartId")
 	public Result<List<SysUser>> getUsersByDepartId(@RequestParam(name = "id") String id) {
 		Result<List<SysUser>> result = new Result<>();
@@ -468,18 +483,19 @@ public class SysDepartController {
 	 * @date 2021/3/24 8:50
 	 * @param departId 部门id
 	 */
+	@RequiresPermissions("sys:depart:list")
 	@GetMapping("/listParentDepartsByDepId")
 	List<SysDepartTreeModel> listParentDepartsByDepId(@RequestParam("departId") String departId){
 		return sysDepartService.listParentDepartsByDepId(departId);
 	}
-	@GetMapping("/listSonDepartsByDepId")
-			
 	/**
 	 * 根据部门id查询部门所有的子级(不包含自己)
 	 * @author 马志朝
 	 * @date 2021/3/24 8:54
 	 * @param departId 部门id
 	 */
+	@RequiresPermissions("sys:depart:list")
+	@GetMapping("/listSonDepartsByDepId")
 	List<SysDepartTreeModel> listSonDepartsByDepId(@RequestParam("departId") String departId){
 		return sysDepartService.listSonDepartsByDepId(departId);
 	}
diff --git a/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/SysDictController.java b/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/SysDictController.java
index 10dbf9b1..da1dc74c 100644
--- a/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/SysDictController.java
+++ b/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/SysDictController.java
@@ -10,6 +10,7 @@ import io.swagger.annotations.Api;
 import io.swagger.annotations.ApiOperation;
 import lombok.extern.slf4j.Slf4j;
 import org.apache.shiro.SecurityUtils;
+import org.apache.shiro.authz.annotation.RequiresPermissions;
 import org.apache.shiro.authz.annotation.RequiresRoles;
 import com.jero.common.api.vo.Result;
 import com.jero.common.constant.CacheConstant;
@@ -68,6 +69,7 @@ public class SysDictController {
 	@Autowired
 	public RedisTemplate<String, Object> redisTemplate;
 
+	@RequiresPermissions("sys:dict:list")
 	@RequestMapping(value = "/page", method = RequestMethod.GET)
 	@ApiOperation(value = "字典控制器-分页列表查询", notes = "字典控制器-分页列表查询")
 	public Result<IPage<SysDict>> queryPageList(SysDict sysDict, @RequestParam(name="pageNo", defaultValue="1") Integer pageNo,
@@ -94,6 +96,7 @@ public class SysDictController {
 	 * @return
 	 */
 	@SuppressWarnings("unchecked")
+	@RequiresPermissions("sys:dict:list")
 	@ApiOperation(value = "字典控制器-树形字典数据", notes = "字典控制器-树形字典数据")
 	@RequestMapping(value = "/treeList", method = RequestMethod.GET)
 	public Result<List<SysDictTree>> treeList(SysDict sysDict, @RequestParam(name="pageNo", defaultValue="1") Integer pageNo,
@@ -122,6 +125,7 @@ public class SysDictController {
 	 * @param dictCode 表名,文本字段,code字段  | 举例：sys_user,realname,id
 	 * @return
 	 */
+	@RequiresPermissions("sys:dict:list")
 	@ApiOperation(value = "字典控制器-根据字典编码获取字典数据", notes = "字典控制器-根据字典编码获取字典数据")
 	@RequestMapping(value = "/getDictItems/{dictCode}", method = RequestMethod.GET)
 	public Result<List<DictModel>> getDictItems(@PathVariable String dictCode, @RequestParam(value = "sign",required = false) String sign, HttpServletRequest request) {
@@ -173,6 +177,7 @@ public class SysDictController {
 	 *
 	 * @return
 	 */
+	@RequiresPermissions("sys:dict:list")
 	@ApiOperation(value = "字典控制器-获取全部字典数据", notes = "字典控制器-获取全部字典数据")
 	@RequestMapping(value = "/queryAllDictItems", method = RequestMethod.GET)
 	public Result<?> queryAllDictItems(HttpServletRequest request) {
@@ -186,6 +191,7 @@ public class SysDictController {
 	 * @param dictCode
 	 * @return
 	 */
+	@RequiresPermissions("sys:dict:list")
 	@ApiOperation(value = "字典控制器-通过字典code和字典值key获取字典数据", notes = "字典控制器-通过字典code和字典值key获取字典数据")
 	@RequestMapping(value = "/getDictText/{dictCode}/{key}", method = RequestMethod.GET)
 	public Result<String> getDictText(@PathVariable("dictCode") String dictCode, @PathVariable("key") String key) {
@@ -209,6 +215,7 @@ public class SysDictController {
 	 * @param dictCode
 	 * @return
 	 */
+	@RequiresPermissions("sys:dict:list")
 	@ApiOperation(value = "字典控制器-通过字典code获取字典数据", notes = "字典控制器-通过字典code获取字典数据")
 	@RequestMapping(value = "/loadDict/{dictCode}", method = RequestMethod.GET)
 	public Result<List<DictModel>> loadDict(@PathVariable String dictCode,
@@ -248,6 +255,7 @@ public class SysDictController {
 	/**
 	 * 根据字典code加载字典text 返回
 	 */
+	@RequiresPermissions("sys:dict:list")
 	@ApiOperation(value = "字典控制器-根据字典code加载字典text", notes = "字典控制器-根据字典code加载字典text")
 	@RequestMapping(value = "/loadDictItem/{dictCode}", method = RequestMethod.GET)
 	public Result<List<String>> loadDictItem(@PathVariable String dictCode, @RequestParam(name="key") String keys, @RequestParam(value = "sign",required = false) String sign, HttpServletRequest request) {
@@ -279,6 +287,7 @@ public class SysDictController {
 	/**
 	 * 根据表名——显示字段-存储字段 pid 加载树形数据
 	 */
+	@RequiresPermissions("sys:dict:list")
 	@ApiOperation(value = "字典控制器-根据表名—显示字段-存储字段 pid 加载树形数据", notes = "字典控制器-根据表名—显示字段-存储字段 pid 加载树形数据")
 	@RequestMapping(value = "/loadTreeData", method = RequestMethod.GET)
 	public Result<List<TreeSelectModel>> loadTreeData(@RequestParam(name="pid") String pid, @RequestParam(name="pidField") String pidField,
@@ -301,6 +310,7 @@ public class SysDictController {
 	/**
 	 * 查询后返回树型数据
 	 */
+	@RequiresPermissions("sys:dict:list")
 	@ApiOperation(value = "字典控制器-根据表名—显示字段-存储字段 加载树形数据", notes = "字典控制器-根据表名—显示字段-存储字段 加载树形数据")
 	@RequestMapping(value = "/queryAllTreeData", method = RequestMethod.GET)
 	public Result<List<TreeSelectModel>> queryAllTreeData(@RequestParam(name="pidField") String pidField,
@@ -324,6 +334,7 @@ public class SysDictController {
 	 * @param sysDict
 	 * @return
 	 */
+	@RequiresPermissions("sys:dict:list")
 	@ApiOperation(value = "字典控制器-新增字典", notes = "字典控制器-新增字典")
 	@RequiresRoles({"admin"})
 	@RequestMapping(value = "/add", method = RequestMethod.POST)
@@ -348,6 +359,7 @@ public class SysDictController {
 	 * @param sysDict
 	 * @return
 	 */
+	@RequiresPermissions("sys:dict:list")
 	@ApiOperation(value = "字典控制器-编辑字典", notes = "字典控制器-编辑字典")
 	@RequiresRoles({"admin"})
 	@RequestMapping(value = "/edit", method = RequestMethod.PUT)
@@ -373,6 +385,7 @@ public class SysDictController {
 	 * @param id
 	 * @return
 	 */
+	@RequiresPermissions("sys:dict:list")
 	@ApiOperation(value = "字典控制器-删除字典", notes = "字典控制器-删除字典")
 	@RequiresRoles({"admin"})
 	@DeleteMapping(value = "/delete")
@@ -393,8 +406,8 @@ public class SysDictController {
 	 * @param ids
 	 * @return
 	 */
+	@RequiresPermissions("sys:dict:list")
 	@ApiOperation(value = "字典控制器-批量字典", notes = "字典控制器-批量字典")
-	@RequiresRoles({"admin"})
 	@DeleteMapping(value = "/deleteBatch")
 	@CacheEvict(value= CacheConstant.SYS_DICT_CACHE, allEntries=true)
 	public Result<SysDict> deleteBatch(@RequestParam(name="ids",required=true) String ids) {
@@ -413,6 +426,7 @@ public class SysDictController {
 	 * @date 修改时间 2021.4.8
 	 * @return
 	 */
+	@RequiresPermissions("sys:dict:list")
 	@RequestMapping(value = "/refleshCache")
 	public Result<?> refleshCache() {
 		Result<?> result = new Result<SysDict>();
@@ -425,6 +439,7 @@ public class SysDictController {
 	 *
 	 * @param request
 	 */
+	@RequiresPermissions("sys:dict:list")
 	@RequestMapping(value = "/exportXls")
 	public ModelAndView exportXls(SysDict sysDict, HttpServletRequest request) {
 		// Step.1 组装查询条件
@@ -462,6 +477,7 @@ public class SysDictController {
 	 * @param
 	 * @return
 	 */
+	@RequiresPermissions("sys:dict:list")
 	@RequiresRoles({"admin"})
 	@PostMapping(value = "/importExcel")
 	public Result<?> importExcel(HttpServletRequest request, HttpServletResponse response) {
@@ -522,6 +538,7 @@ public class SysDictController {
 	 * 查询被删除的列表
 	 * @return
 	 */
+	@RequiresPermissions("sys:dict:list")
 	@GetMapping(value = "/deleteList")
 	public Result<List<SysDict>> deleteList() {
 		Result<List<SysDict>> result = new Result<List<SysDict>>();
@@ -536,6 +553,7 @@ public class SysDictController {
 	 * @param id
 	 * @return
 	 */
+	@RequiresPermissions("sys:dict:list")
 	@DeleteMapping(value = "/deletePhysic/{id}")
 	public Result<?> deletePhysic(@PathVariable String id) {
 		try {
@@ -552,6 +570,7 @@ public class SysDictController {
 	 * @param id
 	 * @return
 	 */
+	@RequiresPermissions("sys:dict:list")
 	@PutMapping(value = "/back/{id}")
 	public Result<?> back(@PathVariable String id) {
 		try {
diff --git a/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/SysDictItemController.java b/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/SysDictItemController.java
index b02e8414..17ae15ab 100644
--- a/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/SysDictItemController.java
+++ b/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/SysDictItemController.java
@@ -9,6 +9,7 @@ import javax.servlet.http.HttpServletRequest;
 import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
 import io.swagger.annotations.ApiOperation;
 import org.apache.commons.lang.StringUtils;
+import org.apache.shiro.authz.annotation.RequiresPermissions;
 import org.apache.shiro.authz.annotation.RequiresRoles;
 import com.jero.common.api.vo.Result;
 import com.jero.common.constant.CacheConstant;
@@ -54,6 +55,7 @@ public class SysDictItemController {
 	 * @param req
 	 * @return
 	 */
+	@RequiresPermissions("sys:dict:list")
 	@RequestMapping(value = "/page", method = RequestMethod.GET)
 	public Result<IPage<SysDictItem>> queryPageList(SysDictItem sysDictItem,@RequestParam(name="pageNo", defaultValue="1") Integer pageNo,
 									  @RequestParam(name="pageSize", defaultValue="10") Integer pageSize,HttpServletRequest req) {
@@ -72,6 +74,7 @@ public class SysDictItemController {
 	 * @return
 	 */
 	//@RequiresRoles({"admin"})
+	@RequiresPermissions("sys:dict:list")
 	@RequestMapping(value = "/add", method = RequestMethod.POST)
 	@CacheEvict(value= CacheConstant.SYS_DICT_CACHE, allEntries=true)
 	public Result<SysDictItem> add(@RequestBody SysDictItem sysDictItem) {
@@ -93,6 +96,7 @@ public class SysDictItemController {
 	 * @return
 	 */
 	//@RequiresRoles({"admin"})
+	@RequiresPermissions("sys:dict:list")
 	@RequestMapping(value = "/edit", method = RequestMethod.PUT)
 	@CacheEvict(value=CacheConstant.SYS_DICT_CACHE, allEntries=true)
 	public Result<SysDictItem> edit(@RequestBody SysDictItem sysDictItem) {
@@ -117,6 +121,7 @@ public class SysDictItemController {
 	 * @return
 	 */
 	//@RequiresRoles({"admin"})
+	@RequiresPermissions("sys:dict:list")
 	@RequestMapping(value = "/delete", method = RequestMethod.DELETE)
 	@CacheEvict(value=CacheConstant.SYS_DICT_CACHE, allEntries=true)
 	public Result<SysDictItem> delete(@RequestParam(name="id",required=true) String id) {
@@ -139,6 +144,7 @@ public class SysDictItemController {
 	 * @return
 	 */
 	//@RequiresRoles({"admin"})
+	@RequiresPermissions("sys:dict:list")
 	@RequestMapping(value = "/deleteBatch", method = RequestMethod.DELETE)
 	@CacheEvict(value=CacheConstant.SYS_DICT_CACHE, allEntries=true)
 	public Result<SysDictItem> deleteBatch(@RequestParam(name="ids",required=true) String ids) {
@@ -158,6 +164,7 @@ public class SysDictItemController {
 	 * @param request
 	 * @return
 	 */
+	@RequiresPermissions("sys:dict:list")
 	@RequestMapping(value = "/dictItemCheck", method = RequestMethod.GET)
 	@ApiOperation("字典重复校验接口")
 	public Result<Object> doDictItemCheck(SysDictItem sysDictItem, HttpServletRequest request) {
diff --git a/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/SysRoleController.java b/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/SysRoleController.java
index 88f8ab4b..764db82e 100644
--- a/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/SysRoleController.java
+++ b/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/SysRoleController.java
@@ -13,6 +13,7 @@ import java.util.Map;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
+import org.apache.shiro.authz.annotation.RequiresPermissions;
 import org.apache.shiro.authz.annotation.RequiresRoles;
 import com.jero.common.api.vo.Result;
 import com.jero.common.constant.CacheConstant;
@@ -89,6 +90,7 @@ public class SysRoleController {
 	 * @param req
 	 * @return
 	 */
+	@RequiresPermissions("sys:role:list")
 	@RequestMapping(value = "/page", method = RequestMethod.GET)
 	public Result<IPage<SysRole>> queryPageList(SysRole role,
 									  @RequestParam(name="pageNo", defaultValue="1") Integer pageNo,
@@ -108,6 +110,7 @@ public class SysRoleController {
 	 * @param role
 	 * @return
 	 */
+	@RequiresPermissions("sys:role:list")
 	@RequestMapping(value = "/add", method = RequestMethod.POST)
 	//@RequiresRoles({"admin"})
 	public Result<SysRole> add(@RequestBody SysRole role) {
@@ -129,6 +132,7 @@ public class SysRoleController {
 	 * @return
 	 */
 	//@RequiresRoles({"admin"})
+	@RequiresPermissions("sys:role:list")
 	@RequestMapping(value = "/edit", method = RequestMethod.PUT)
 	public Result<SysRole> edit(@RequestBody SysRole role) {
 		Result<SysRole> result = new Result<SysRole>();
@@ -153,6 +157,7 @@ public class SysRoleController {
 	 * @return
 	 */
 	//@RequiresRoles({"admin"})
+	@RequiresPermissions("sys:role:list")
 	@RequestMapping(value = "/delete", method = RequestMethod.DELETE)
 	public Result<?> delete(@RequestParam(name="id",required=true) String id) {
 		sysRoleService.deleteRole(id);
@@ -165,6 +170,7 @@ public class SysRoleController {
 	 * @return
 	 */
 	//@RequiresRoles({"admin"})
+	@RequiresPermissions("sys:role:list")
 	@RequestMapping(value = "/deleteBatch", method = RequestMethod.DELETE)
 	public Result<SysRole> deleteBatch(@RequestParam(name="ids",required=true) String ids) {
 		Result<SysRole> result = new Result<SysRole>();
@@ -182,6 +188,7 @@ public class SysRoleController {
 	 * @param id
 	 * @return
 	 */
+	@RequiresPermissions("sys:role:list")
 	@RequestMapping(value = "/queryById", method = RequestMethod.GET)
 	public Result<SysRole> queryById(@RequestParam(name="id",required=true) String id) {
 		Result<SysRole> result = new Result<SysRole>();
@@ -194,7 +201,7 @@ public class SysRoleController {
 		}
 		return result;
 	}
-	
+	@RequiresPermissions("sys:role:list")
 	@RequestMapping(value = "/queryall", method = RequestMethod.GET)
 	public Result<List<SysRole>> queryall() {
 		Result<List<SysRole>> result = new Result<>();
@@ -211,6 +218,7 @@ public class SysRoleController {
 	/**
 	  * 校验角色编码唯一
 	 */
+	@RequiresPermissions("sys:role:list")
 	@RequestMapping(value = "/checkRoleCode", method = RequestMethod.GET)
 	public Result<Boolean> checkUsername(String id,String roleCode) {
 		Result<Boolean> result = new Result<>();
@@ -250,6 +258,7 @@ public class SysRoleController {
 	 * 导出excel
 	 * @param request
 	 */
+	@RequiresPermissions("sys:role:list")
 	@RequestMapping(value = "/exportXls")
 	public ModelAndView exportXls(SysRole sysRole,HttpServletRequest request) {
 		// Step.1 组装查询条件
@@ -272,6 +281,7 @@ public class SysRoleController {
 	 * @param response
 	 * @return
 	 */
+	@RequiresPermissions("sys:role:list")
 	@RequestMapping(value = "/importExcel", method = RequestMethod.POST)
 	public Result<?> importExcel(HttpServletRequest request, HttpServletResponse response) {
 		MultipartHttpServletRequest multipartRequest = (MultipartHttpServletRequest) request;
@@ -301,6 +311,7 @@ public class SysRoleController {
 	/**
 	 * 查询数据规则数据
 	 */
+	@RequiresPermissions("sys:role:list")
 	@GetMapping(value = "/datarule/{permissionId}/{roleId}")
 	public Result<?> loadDatarule(@PathVariable("permissionId") String permissionId,@PathVariable("roleId") String roleId) {
 		List<SysPermissionDataRule> list = sysPermissionDataRuleService.getPermRuleListByPermId(permissionId);
@@ -330,6 +341,7 @@ public class SysRoleController {
 	/**
 	 * 保存数据规则至角色菜单关联表
 	 */
+	@RequiresPermissions("sys:role:list")
 	@PostMapping(value = "/datarule")
 	public Result<?> saveDatarule(@RequestBody JSONObject jsonObject) {
 		try {
@@ -360,6 +372,7 @@ public class SysRoleController {
 	 * @param request
 	 * @return
 	 */
+	@RequiresPermissions("sys:role:list")
 	@RequestMapping(value = "/queryTreeList", method = RequestMethod.GET)
 	public Result<Map<String,Object>> queryTreeList(HttpServletRequest request) {
 		Result<Map<String,Object>> result = new Result<>();
@@ -385,7 +398,7 @@ public class SysRoleController {
 		}
 		return result;
 	}
-	
+	@RequiresPermissions("sys:role:list")
 	private void getTreeModelList(List<TreeModel> treeList,List<SysPermission> metaList,TreeModel temp) {
 		for (SysPermission permission : metaList) {
 			String tempPid = permission.getParentId();
diff --git a/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/SysUserController.java b/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/SysUserController.java
index f973752c..18b64d70 100644
--- a/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/SysUserController.java
+++ b/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/SysUserController.java
@@ -30,6 +30,8 @@ import com.jero.modules.system.model.SysUserSysDepartModel;
 import com.jero.modules.system.service.*;
 import com.jero.modules.system.vo.SysDepartUsersVO;
 import com.jero.modules.system.vo.SysUserRoleVO;
+import org.apache.shiro.subject.Subject;
+import org.checkerframework.framework.qual.RequiresQualifier;
 import org.jeecgframework.poi.excel.ExcelImportUtil;
 import org.jeecgframework.poi.excel.def.NormalExcelConstants;
 import org.jeecgframework.poi.excel.entity.ExportParams;
@@ -102,11 +104,12 @@ public class SysUserController {
      * @param req
      * @return
      */
+    @RequiresPermissions("sys:user:list")
     @PermissionData(pageComponent = "system/UserList")
 	@RequestMapping(value = "/page", method = RequestMethod.GET)
 	public Result<IPage<SysUser>> queryPageList(SysUser user,@RequestParam(name="pageNo", defaultValue="1") Integer pageNo,
 									  @RequestParam(name="pageSize", defaultValue="10") Integer pageSize,HttpServletRequest req) {
-		Result<IPage<SysUser>> result = new Result<IPage<SysUser>>();
+        Result<IPage<SysUser>> result = new Result<IPage<SysUser>>();
 		QueryWrapper<SysUser> queryWrapper = QueryGenerator.initQueryWrapper(user, req.getParameterMap());
     	//TODO 外部模拟登陆临时账号，列表不显示
         queryWrapper.ne("username","_reserve_user_external");
@@ -130,7 +133,7 @@ public class SysUserController {
 	}
 
     //@RequiresRoles({"admin"})
-    //@RequiresPermissions("user:add")
+    @RequiresPermissions("user:add")
 	@RequestMapping(value = "/add", method = RequestMethod.POST)
 	public Result<SysUser> add(@RequestBody JSONObject jsonObject) {
 		Result<SysUser> result = new Result<SysUser>();
@@ -156,7 +159,7 @@ public class SysUserController {
 	}
 
     //@RequiresRoles({"admin"})
-    //@RequiresPermissions("user:edit")
+    @RequiresPermissions("user:edit")
 	@RequestMapping(value = "/edit", method = RequestMethod.PUT)
 	public Result<SysUser> edit(@RequestBody JSONObject jsonObject) {
 		Result<SysUser> result = new Result<SysUser>();
@@ -188,6 +191,7 @@ public class SysUserController {
 	 * 删除用户
 	 */
 	//@RequiresRoles({"admin"})
+    @RequiresPermissions("sys:user:list")
 	@RequestMapping(value = "/delete", method = RequestMethod.DELETE)
 	public Result<?> delete(@RequestParam(name="id",required=true) String id) {
 		baseCommonService.addLog("删除用户，id： " +id ,CommonConstant.LOG_TYPE_2, 3);
@@ -199,6 +203,7 @@ public class SysUserController {
 	 * 批量删除用户
 	 */
 	//@RequiresRoles({"admin"})
+    @RequiresPermissions("sys:user:list")
 	@RequestMapping(value = "/deleteBatch", method = RequestMethod.DELETE)
 	public Result<?> deleteBatch(@RequestParam(name="ids",required=true) String ids) {
 		baseCommonService.addLog("批量删除用户， ids： " +ids ,CommonConstant.LOG_TYPE_2, 3);
@@ -212,6 +217,7 @@ public class SysUserController {
 	 * @return
 	 */
 	//@RequiresRoles({"admin"})
+    @RequiresPermissions("sys:user:list")
 	@RequestMapping(value = "/frozenBatch", method = RequestMethod.PUT)
 	public Result<SysUser> frozenBatch(@RequestBody JSONObject jsonObject) {
 		Result<SysUser> result = new Result<SysUser>();
@@ -233,7 +239,7 @@ public class SysUserController {
 		return result;
 
     }
-
+    @RequiresPermissions("sys:user:list")
     @RequestMapping(value = "/queryById", method = RequestMethod.GET)
     public Result<SysUser> queryById(@RequestParam(name = "id", required = true) String id) {
         Result<SysUser> result = new Result<SysUser>();
@@ -246,7 +252,7 @@ public class SysUserController {
         }
         return result;
     }
-
+    @RequiresPermissions("sys:user:list")
     @RequestMapping(value = "/queryUserRole", method = RequestMethod.GET)
     public Result<List<String>> queryUserRole(@RequestParam(name = "userid", required = true) String userid) {
         Result<List<String>> result = new Result<>();
@@ -272,6 +278,7 @@ public class SysUserController {
      * @param sysUser
      * @return
      */
+    @RequiresPermissions("sys:user:list")
     @RequestMapping(value = "/checkOnlyUser", method = RequestMethod.GET)
     public Result<Boolean> checkOnlyUser(SysUser sysUser) {
         Result<Boolean> result = new Result<>();
@@ -299,6 +306,7 @@ public class SysUserController {
      * 修改密码
      */
     //@RequiresRoles({"admin"})
+    @RequiresPermissions("sys:user:list")
     @RequestMapping(value = "/changePassword", method = RequestMethod.PUT)
     public Result<?> changePassword(@RequestBody SysUser sysUser) {
         SysUser u = this.sysUserService.getOne(new LambdaQueryWrapper<SysUser>().eq(SysUser::getUsername, sysUser.getUsername()));
@@ -315,6 +323,7 @@ public class SysUserController {
      * @param userId
      * @return
      */
+    @RequiresPermissions("sys:user:list")
     @RequestMapping(value = "/userDepartList", method = RequestMethod.GET)
     public Result<List<DepartIdModel>> getUserDepartsList(@RequestParam(name = "userId", required = true) String userId) {
         Result<List<DepartIdModel>> result = new Result<>();
@@ -343,6 +352,7 @@ public class SysUserController {
      *
      * @return
      */
+    @RequiresPermissions("sys:user:list")
     @RequestMapping(value = "/generateUserId", method = RequestMethod.GET)
     public Result<String> generateUserId() {
         Result<String> result = new Result<>();
@@ -359,6 +369,7 @@ public class SysUserController {
      * @param id
      * @return
      */
+    @RequiresPermissions("sys:user:list")
     @RequestMapping(value = "/queryUserByDepId", method = RequestMethod.GET)
     public Result<List<SysUser>> queryUserByDepId(@RequestParam(name = "id", required = true) String id,@RequestParam(name="realname",required=false) String realname) {
         Result<List<SysUser>> result = new Result<>();
@@ -395,6 +406,7 @@ public class SysUserController {
      * @param request
      * @param sysUser
      */
+    @RequiresPermissions("sys:user:list")
     @RequestMapping(value = "/exportXls")
     public ModelAndView exportXls(SysUser sysUser,HttpServletRequest request) {
         // Step.1 组装查询条件
@@ -428,7 +440,7 @@ public class SysUserController {
      * @return
      */
     //@RequiresRoles({"admin"})
-    //@RequiresPermissions("user:import")
+    @RequiresPermissions("user:import")
     @RequestMapping(value = "/importExcel", method = RequestMethod.POST)
     public Result<?> importExcel(HttpServletRequest request, HttpServletResponse response)throws IOException {
         MultipartHttpServletRequest multipartRequest = (MultipartHttpServletRequest) request;
@@ -508,6 +520,7 @@ public class SysUserController {
 	 * @param userIds
 	 * @return
 	 */
+    @RequiresPermissions("sys:user:list")
 	@RequestMapping(value = "/queryByIds", method = RequestMethod.GET)
 	public Result<Collection<SysUser>> queryByIds(@RequestParam String userIds) {
 		Result<Collection<SysUser>> result = new Result<>();
@@ -535,7 +548,7 @@ public class SysUserController {
 		}
 		return sysUserService.resetPassword(username,oldpassword,password,confirmpassword);
 	}
-
+    @RequiresPermissions("sys:user:list")
     @RequestMapping(value = "/userRoleList", method = RequestMethod.GET)
     public Result<IPage<SysUser>> userRoleList(@RequestParam(name="pageNo", defaultValue="1") Integer pageNo,
                                                @RequestParam(name="pageSize", defaultValue="10") Integer pageSize, HttpServletRequest req) {
@@ -556,6 +569,7 @@ public class SysUserController {
      * @return
      */
     //@RequiresRoles({"admin"})
+    @RequiresPermissions("sys:user:list")
     @RequestMapping(value = "/addSysUserRole", method = RequestMethod.POST)
     public Result<String> addSysUserRole(@RequestBody SysUserRoleVO sysUserRoleVO) {
         Result<String> result = new Result<String>();
@@ -587,6 +601,7 @@ public class SysUserController {
      * @return
      */
     //@RequiresRoles({"admin"})
+    @RequiresPermissions("sys:user:list")
     @RequestMapping(value = "/deleteUserRole", method = RequestMethod.DELETE)
     public Result<SysUserRole> deleteUserRole(@RequestParam(name="roleId") String roleId,
                                                     @RequestParam(name="userId",required=true) String userId
@@ -611,6 +626,7 @@ public class SysUserController {
      * @return
      */
     //@RequiresRoles({"admin"})
+    @RequiresPermissions("sys:user:list")
     @RequestMapping(value = "/deleteUserRoleBatch", method = RequestMethod.DELETE)
     public Result<SysUserRole> deleteUserRoleBatch(
             @RequestParam(name="roleId") String roleId,
@@ -632,6 +648,7 @@ public class SysUserController {
      * 部门用户列表
      */
     @RequestMapping(value = "/departUserList", method = RequestMethod.GET)
+    @RequiresPermissions("sys:user:list")
     public Result<IPage<SysUser>> departUserList(@RequestParam(name="pageNo", defaultValue="1") Integer pageNo,
                                                  @RequestParam(name="pageSize", defaultValue="10") Integer pageSize, HttpServletRequest req) {
         Result<IPage<SysUser>> result = new Result<IPage<SysUser>>();
@@ -678,6 +695,7 @@ public class SysUserController {
      * 若某个用户包含多个部门，则会显示多条记录，可自行处理成单条记录
      */
     @GetMapping("/queryByOrgCode")
+    @RequiresPermissions("sys:user:list")
     public Result<?> queryByDepartId(
             @RequestParam(name = "pageNo", defaultValue = "1") Integer pageNo,
             @RequestParam(name = "pageSize", defaultValue = "10") Integer pageSize,
@@ -692,6 +710,7 @@ public class SysUserController {
      * 给指定部门添加对应的用户
      */
     //@RequiresRoles({"admin"})
+    @RequiresPermissions("sys:user:list")
     @RequestMapping(value = "/editSysDepartWithUser", method = RequestMethod.POST)
     public Result<String> editSysDepartWithUser(@RequestBody SysDepartUsersVO sysDepartUsersVO) {
         Result<String> result = new Result<String>();
@@ -721,6 +740,7 @@ public class SysUserController {
      *   删除指定机构的用户关系
      */
     //@RequiresRoles({"admin"})
+    @RequiresPermissions("sys:user:list")
     @RequestMapping(value = "/deleteUserInDepart", method = RequestMethod.DELETE)
     public Result<SysUserDepart> deleteUserInDepart(@RequestParam(name="depId") String depId,
                                                     @RequestParam(name="userId",required=true) String userId
@@ -753,6 +773,7 @@ public class SysUserController {
      * 批量删除指定机构的用户关系
      */
     //@RequiresRoles({"admin"})
+    @RequiresPermissions("sys:user:list")
     @RequestMapping(value = "/deleteUserInDepartBatch", method = RequestMethod.DELETE)
     public Result<SysUserDepart> deleteUserInDepartBatch(
             @RequestParam(name="depId") String depId,
@@ -777,6 +798,7 @@ public class SysUserController {
          *  查询当前用户的所有部门/当前部门编码
      * @return
      */
+    @RequiresPermissions("sys:user:list")
     @RequestMapping(value = "/getCurrentUserDeparts", method = RequestMethod.GET)
     public Result<Map<String,Object>> getCurrentUserDeparts() {
         Result<Map<String,Object>> result = new Result<Map<String,Object>>();
@@ -880,6 +902,7 @@ public class SysUserController {
 	 * @param
 	 * @return
 	 */
+    @RequiresPermissions("sys:user:list")
 	@GetMapping("/querySysUser")
 	public Result<Map<String, Object>> querySysUser(SysUser sysUser) {
 		String phone = sysUser.getPhone();
@@ -989,6 +1012,7 @@ public class SysUserController {
 	 * 
 	 * @return
 	 */
+    @RequiresPermissions("sys:user:list")
 	@GetMapping("/getUserSectionInfoByToken")
 	public Result<?> getUserSectionInfoByToken(HttpServletRequest request, @RequestParam(name = "token", required = false) String token) {
 		try {
@@ -1026,6 +1050,7 @@ public class SysUserController {
 	 * @param pageSize
 	 * @return
 	 */
+    @RequiresPermissions("sys:user:list")
 	@GetMapping("/appUserList")
 	public Result<?> appUserList(@RequestParam(name = "keyword", required = false) String keyword,
             @RequestParam(name = "username", required = false) String username,
@@ -1063,6 +1088,7 @@ public class SysUserController {
      *
      * @return logicDeletedUserList
      */
+    @RequiresPermissions("sys:user:list")
     @GetMapping("/recycleBin")
     public Result getRecycleBin() {
         List<SysUser> logicDeletedUserList = sysUserService.queryLogicDeleted();
@@ -1083,6 +1109,7 @@ public class SysUserController {
      * @param jsonObject
      * @return
      */
+    @RequiresPermissions("sys:user:list")
     @RequestMapping(value = "/putRecycleBin", method = RequestMethod.PUT)
     public Result putRecycleBin(@RequestBody JSONObject jsonObject, HttpServletRequest request) {
         String userIds = jsonObject.getString("userIds");
@@ -1102,6 +1129,7 @@ public class SysUserController {
      * @return
      */
     //@RequiresRoles({"admin"})
+    @RequiresPermissions("sys:user:list")
     @RequestMapping(value = "/deleteRecycleBin", method = RequestMethod.DELETE)
     public Result deleteRecycleBin(@RequestParam("userIds") String userIds) {
         if (StringUtils.isNotBlank(userIds)) {
@@ -1116,6 +1144,7 @@ public class SysUserController {
      * @param jsonObject
      * @return
      */
+    @RequiresPermissions("sys:user:list")
     @RequestMapping(value = "/appEdit", method = RequestMethod.PUT)
     public Result<SysUser> appEdit(HttpServletRequest request,@RequestBody JSONObject jsonObject) {
         Result<SysUser> result = new Result<SysUser>();
@@ -1195,6 +1224,7 @@ public class SysUserController {
      *
      * @return Result
      */
+    @RequiresPermissions("sys:user:list")
     @GetMapping("/queryChildrenByUsername")
     public Result queryChildrenByUsername(@RequestParam("userId") String userId) {
         //获取用户信息