From 232faf0033cffd662f3712642067669871ec8bfc Mon Sep 17 00:00:00 2001
From: "huojin\\hj" <982011>
Date: Fri, 6 Jun 2025 16:46:06 +0800
Subject: [PATCH] =?UTF-8?q?=E6=9B=B4=E6=96=B0=E6=9D=83=E9=99=90=E9=97=AE?=
 =?UTF-8?q?=E9=A2=98=E3=80=81XSS=E8=84=9A=E6=9C=AC=E6=94=BB=E5=87=BB?=
 =?UTF-8?q?=E3=80=81=E7=A7=AF=E6=9C=A8=E6=8A=A5=E8=A1=A8=E6=8E=88=E6=9D=83?=
 =?UTF-8?q?=E3=80=81=E9=82=AE=E7=AE=B1=E9=87=8D=E5=A4=8D=E8=AF=B7=E6=B1=82?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../lab1024/sa/admin/Filter/XssFilter.java    |  14 +++
 .../sa/admin/Filter/XssRequestWrapper.java    |  30 +++++++
 .../lab1024/sa/admin/config/MvcConfig.java    |  13 +++
 .../address/controller/AddressController.java |   2 +-
 .../base/area/controller/AreaController.java  |   2 +-
 .../controller/CustomerController.java        |   2 +-
 .../base/item/controller/ItemController.java  |   2 +-
 .../controller/LocationController.java        |   2 +-
 .../stock/controller/StockController.java     |   2 +-
 .../controller/InventoryController.java       |   2 +-
 .../JimuReportTokenServiceImpl.java           |  49 +++++++---
 .../receive/asn/controller/AsnController.java |   2 +-
 .../controller/AsnDetailController.java       |   2 +-
 .../wms/requestSubmit/RequestSubmit.java      |  24 +++++
 .../RequestSubmitSubmitAspect.java            |  85 ++++++++++++++++++
 .../pick/controller/PickController.java       |   2 +-
 .../wms/task/controller/TaskController.java   |   2 +-
 .../controller/EmployeeController.java        |   5 ++
 .../login/controller/LoginController.java     |   6 +-
 .../system/login/service/LoginService.java    |   1 +
 .../menu/controller/MenuController.java       |   1 +
 .../controller/PositionController.java        |   8 +-
 .../support/AdminApiEncryptController.java    |   5 ++
 .../AdminDataMaskingDemoController.java       |   2 +
 .../support/AdminHeartBeatController.java     |   2 +
 .../support/AdminProtectController.java       |   5 ++
 .../system/support/AdminReloadController.java |   1 +
 .../support/AdminSerialNumberController.java  |   1 +
 .../support/AdminSmartJobController.java      |  13 +--
 .../src/main/resources/dev/application.yaml   |   7 +-
 .../src/main/resources/dev/log4j2-spring.xml  |   2 +-
 .../src/main/resources/dev/spy.properties     |   2 +-
 .../sa-admin/src/main/resources/javaboy.p12   | Bin 2738 -> 0 bytes
 .../src/main/resources/prod/application.yaml  |   6 +-
 .../src/main/resources/prod/log4j2-spring.xml |   2 +-
 .../sa-admin/src/main/resources/server.jks    | Bin 5729 -> 0 bytes
 .../controller/CodeGeneratorController.java   |   6 ++
 .../file/controller/FileController.java       |   4 +
 .../src/main/resources/dev/sa-base.yaml       |  16 ++--
 .../src/main/resources/prod/sa-base.yaml      |  12 +--
 40 files changed, 291 insertions(+), 53 deletions(-)
 create mode 100644 nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/Filter/XssFilter.java
 create mode 100644 nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/Filter/XssRequestWrapper.java
 create mode 100644 nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/requestSubmit/RequestSubmit.java
 create mode 100644 nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/requestSubmit/RequestSubmitSubmitAspect.java
 delete mode 100644 nc_wms_java/sa-admin/src/main/resources/javaboy.p12
 delete mode 100644 nc_wms_java/sa-admin/src/main/resources/server.jks

diff --git a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/Filter/XssFilter.java b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/Filter/XssFilter.java
new file mode 100644
index 0000000..da60bfa
--- /dev/null
+++ b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/Filter/XssFilter.java
@@ -0,0 +1,14 @@
+package net.lab1024.sa.admin.Filter;
+
+import jakarta.servlet.*;
+import jakarta.servlet.http.HttpServletRequest;
+import java.io.IOException;
+
+public class XssFilter implements Filter{
+
+    @Override
+    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
+            throws IOException, ServletException {
+        chain.doFilter(new XssRequestWrapper((HttpServletRequest) request), response);
+    }
+}
diff --git a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/Filter/XssRequestWrapper.java b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/Filter/XssRequestWrapper.java
new file mode 100644
index 0000000..7eef7d8
--- /dev/null
+++ b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/Filter/XssRequestWrapper.java
@@ -0,0 +1,30 @@
+package net.lab1024.sa.admin.Filter;
+
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletRequestWrapper;
+import org.jsoup.Jsoup;
+import org.jsoup.safety.Safelist;
+
+public class XssRequestWrapper extends HttpServletRequestWrapper {
+    public XssRequestWrapper(HttpServletRequest request) {
+        super(request);
+    }
+
+    @Override
+    public String[] getParameterValues(String parameter) {
+        String[] values = super.getParameterValues(parameter);
+        if (values == null) {
+            return null;
+        }
+        int count = values.length;
+        String[] encodedValues = new String[count];
+        for (int i = 0; i < count; i++) {
+            encodedValues[i] = cleanXss(values[i]);
+        }
+        return encodedValues;
+    }
+
+    private String cleanXss(String value) {
+        return Jsoup.clean(value, Safelist.relaxed());
+    }
+}
diff --git a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/config/MvcConfig.java b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/config/MvcConfig.java
index 232a88c..c9f175a 100644
--- a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/config/MvcConfig.java
+++ b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/config/MvcConfig.java
@@ -1,8 +1,11 @@
 package net.lab1024.sa.admin.config;
 
 import jakarta.annotation.Resource;
+import net.lab1024.sa.admin.Filter.XssFilter;
 import net.lab1024.sa.admin.interceptor.AdminInterceptor;
 import net.lab1024.sa.base.config.SwaggerConfig;
+import org.springframework.boot.web.servlet.FilterRegistrationBean;
+import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
 import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry;
@@ -36,4 +39,14 @@ public class MvcConfig implements WebMvcConfigurer {
         registry.addResourceHandler("/webjars/**").addResourceLocations("classpath:/META-INF/resources/webjars/");
     }
 
+    @Bean
+    public FilterRegistrationBean<XssFilter> xssFilterRegistration() {
+        FilterRegistrationBean<XssFilter> registration = new FilterRegistrationBean<>();
+        registration.setFilter(new XssFilter());
+        registration.addUrlPatterns("/*");
+        registration.setName("xssFilter");
+        registration.setOrder(1);
+        return registration;
+    }
+
 }
diff --git a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/base/address/controller/AddressController.java b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/base/address/controller/AddressController.java
index 62b587a..72f67f9 100644
--- a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/base/address/controller/AddressController.java
+++ b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/base/address/controller/AddressController.java
@@ -85,7 +85,7 @@ public class AddressController {
 
     @Operation(summary = "批量删除 @author hj")
     @PostMapping("/address/batchDelete")
-    @SaCheckPermission("address:batchDelete")
+    @SaCheckPermission("address:delete")
     @OperateLog
     public ResponseDTO<String> batchDelete(@RequestBody ValidateList<Long> idList) {
         return addressService.batchDelete(idList);
diff --git a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/base/area/controller/AreaController.java b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/base/area/controller/AreaController.java
index 82aedee..6568fb4 100644
--- a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/base/area/controller/AreaController.java
+++ b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/base/area/controller/AreaController.java
@@ -72,7 +72,7 @@ public class AreaController {
 
     @Operation(summary = "批量删除 @author hj")
     @PostMapping("/area/batchDelete")
-    @SaCheckPermission("area:batchDelete")
+    @SaCheckPermission("area:delete")
     @OperateLog
     public ResponseDTO<String> batchDelete(@RequestBody ValidateList<Long> idList) {
         return areaService.batchDelete(idList);
diff --git a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/base/customer/controller/CustomerController.java b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/base/customer/controller/CustomerController.java
index aced5b0..596a383 100644
--- a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/base/customer/controller/CustomerController.java
+++ b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/base/customer/controller/CustomerController.java
@@ -72,7 +72,7 @@ public class CustomerController {
 
     @Operation(summary = "批量删除 @author 霍锦")
     @PostMapping("/customer/batchDelete")
-    @SaCheckPermission("customer:batchDelete")
+    @SaCheckPermission("customer:delete")
     @OperateLog
     public ResponseDTO<String> batchDelete(@RequestBody ValidateList<Long> idList) {
         return customerService.batchDelete(idList);
diff --git a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/base/item/controller/ItemController.java b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/base/item/controller/ItemController.java
index 5c7edd3..76b3ef6 100644
--- a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/base/item/controller/ItemController.java
+++ b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/base/item/controller/ItemController.java
@@ -84,7 +84,7 @@ public class ItemController {
 
     @Operation(summary = "批量删除 @author 霍锦")
     @PostMapping("/item/batchDelete")
-    @SaCheckPermission("item:batchDelete")
+    @SaCheckPermission("item:delete")
     @OperateLog
     public ResponseDTO<String> batchDelete(@RequestBody ValidateList<Long> idList) {
         return itemService.batchDelete(idList);
diff --git a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/base/location/controller/LocationController.java b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/base/location/controller/LocationController.java
index a2585bf..b6daabd 100644
--- a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/base/location/controller/LocationController.java
+++ b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/base/location/controller/LocationController.java
@@ -73,7 +73,7 @@ public class LocationController {
 
     @Operation(summary = "批量删除 @author 霍锦")
     @PostMapping("/location/batchDelete")
-    @SaCheckPermission("location:batchDelete")
+    @SaCheckPermission("location:delete")
     @OperateLog
     public ResponseDTO<String> batchDelete(@RequestBody ValidateList<Long> idList) {
         return locationService.batchDelete(idList);
diff --git a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/base/stock/controller/StockController.java b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/base/stock/controller/StockController.java
index 1f3f1f2..313628b 100644
--- a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/base/stock/controller/StockController.java
+++ b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/base/stock/controller/StockController.java
@@ -84,7 +84,7 @@ public class StockController {
 
     @Operation(summary = "批量删除 @author 霍锦")
     @PostMapping("/stock/batchDelete")
-    @SaCheckPermission("stock:batchDelete")
+    @SaCheckPermission("stock:delete")
     @OperateLog
     public ResponseDTO<String> batchDelete(@RequestBody ValidateList<Long> idList) {
         return stockService.batchDelete(idList);
diff --git a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/inventory/inventory/controller/InventoryController.java b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/inventory/inventory/controller/InventoryController.java
index f5e28f5..f58a0e6 100644
--- a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/inventory/inventory/controller/InventoryController.java
+++ b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/inventory/inventory/controller/InventoryController.java
@@ -61,7 +61,7 @@ public class InventoryController {
 
     @Operation(summary = "批量删除 @author 霍锦")
     @PostMapping("/inventory/batchDelete")
-    @SaCheckPermission("inventory:batchDelete")
+    @SaCheckPermission("inventory:delete")
     @OperateLog
     public ResponseDTO<String> batchDelete(@RequestBody ValidateList<Long> idList) {
         return inventoryService.batchDelete(idList);
diff --git a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/jimuReport/JimuReportTokenServiceImpl.java b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/jimuReport/JimuReportTokenServiceImpl.java
index 7666fb5..407b0d2 100644
--- a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/jimuReport/JimuReportTokenServiceImpl.java
+++ b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/jimuReport/JimuReportTokenServiceImpl.java
@@ -1,28 +1,53 @@
 package net.lab1024.sa.admin.module.business.wms.jimuReport;
 
+import cn.dev33.satoken.session.SaSession;
+import cn.dev33.satoken.stp.StpUtil;
+import jakarta.annotation.Resource;
 import jakarta.servlet.http.HttpServletRequest;
+import lombok.extern.slf4j.Slf4j;
+import net.lab1024.sa.admin.module.system.login.domain.LoginResultVO;
+import net.lab1024.sa.admin.module.system.login.service.LoginService;
+import net.lab1024.sa.admin.util.AdminRequestUtil;
+import net.lab1024.sa.base.common.util.SmartRequestUtil;
+import org.apache.commons.lang3.StringUtils;
 import org.springframework.http.HttpHeaders;
 import org.jeecg.modules.jmreport.api.JmReportTokenServiceI;
 import org.springframework.stereotype.Component;
+import org.springframework.stereotype.Service;
 
 /**
  * 自定义积木报表鉴权(如果不进行自定义，则所有请求不做权限控制)
  * 1.自定义获取登录token
  * 2.自定义获取登录用户
  */
-@Component
+@Service
+@Slf4j
 public class JimuReportTokenServiceImpl implements JmReportTokenServiceI {
 
+    @Resource
+    private LoginService loginService;
+
     /**
      * 通过请求获取Token
+     *
      * @param request
      * @return
      */
     @Override
     public String getToken(HttpServletRequest request) {
-        //System.out.println("---------call---------getToken-----------------------");
-        //return TokenUtils.getTokenByRequest(request);
-        return "123456";
+        try {
+            String token = request.getParameter("token");
+            if (StringUtils.isNoneBlank(token)) {
+                return token;
+            }
+            String token2 = request.getHeader("x-access-token");
+            if (StringUtils.isNoneBlank(token2)) {
+                return token2;
+            }
+        } catch (Exception e) {
+            log.error("getToken error:{}", e.getMessage());
+        }
+        return null;
     }
 
     /**
@@ -47,6 +72,7 @@ public class JimuReportTokenServiceImpl implements JmReportTokenServiceI {
 
     /**
      * 通过Token获取登录人用户名
+     *
      * @param token
      * @return
      */
@@ -65,7 +91,7 @@ public class JimuReportTokenServiceImpl implements JmReportTokenServiceI {
     @Override
     public String[] getRoles(String token) {
         //积木内置三个角色 "admin","lowdeveloper","dbadeveloper"
-        return new String[]{"admin","lowdeveloper","dbadeveloper"};
+        return new String[]{"admin", "lowdeveloper", "dbadeveloper"};
     }
 
 
@@ -81,30 +107,31 @@ public class JimuReportTokenServiceImpl implements JmReportTokenServiceI {
         //onl:drag:clear:recovery          清空回收站
         //drag:analysis:sql                SQL解析
         //drag:design:getTotalData         仪表盘对Online表单展示数据
-        return new String[]{"drag:datasource:testConnection","onl:drag:clear:recovery","drag:analysis:sql","drag:design:getTotalData"};
+        return new String[]{"drag:datasource:testConnection", "onl:drag:clear:recovery", "drag:analysis:sql", "drag:design:getTotalData"};
     }
 
     /**
      * Token校验
+     *
      * @param token
      * @return
      */
     @Override
     public Boolean verifyToken(String token) {
-        //System.out.println("---------verify-----Token---------------");
-        //return TokenUtils.verifyToken(token, sysBaseAPI, redisUtil);
-        return true;
+        String loginId = (String) StpUtil.getLoginIdByToken(token);
+        return StringUtils.isNoneBlank(loginId);
     }
 
     /**
-     *  自定义请求头
+     * 自定义请求头
+     *
      * @return
      */
     @Override
     public HttpHeaders customApiHeader() {
         HttpHeaders header = new HttpHeaders();
         header.add("custom-header1", "Please set a custom value 1");
-        header.add("token", "token value 2");
+        header.add("token", "1231231313213");
         return header;
     }
 }
diff --git a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/receive/asn/controller/AsnController.java b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/receive/asn/controller/AsnController.java
index 46f7f8e..e128e94 100644
--- a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/receive/asn/controller/AsnController.java
+++ b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/receive/asn/controller/AsnController.java
@@ -70,7 +70,7 @@ public class AsnController {
 
     @Operation(summary = "批量删除 @author 霍锦")
     @PostMapping("/asn/batchDelete")
-    @SaCheckPermission("asn:batchDelete")
+    @SaCheckPermission("asn:delete")
     @OperateLog
     public ResponseDTO<String> batchDelete(@RequestBody ValidateList<Long> idList) {
         return asnService.batchDelete(idList);
diff --git a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/receive/asnDetail/controller/AsnDetailController.java b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/receive/asnDetail/controller/AsnDetailController.java
index 68f541f..3088e51 100644
--- a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/receive/asnDetail/controller/AsnDetailController.java
+++ b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/receive/asnDetail/controller/AsnDetailController.java
@@ -67,7 +67,7 @@ public class AsnDetailController {
 
     @Operation(summary = "批量删除 @author 霍锦")
     @PostMapping("/asnDetail/batchDelete")
-    @SaCheckPermission("asnDetail:batchDelete")
+    @SaCheckPermission("asnDetail:delete")
     @OperateLog
     public ResponseDTO<String> batchDelete(@RequestBody ValidateList<Long> idList) {
         return asnDetailService.batchDelete(idList);
diff --git a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/requestSubmit/RequestSubmit.java b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/requestSubmit/RequestSubmit.java
new file mode 100644
index 0000000..cfcaa48
--- /dev/null
+++ b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/requestSubmit/RequestSubmit.java
@@ -0,0 +1,24 @@
+package net.lab1024.sa.admin.module.business.wms.requestSubmit;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+@Target(ElementType.METHOD)
+@Retention(RetentionPolicy.RUNTIME)
+public @interface RequestSubmit {
+    // 限制时间（秒）
+    int value() default 1;
+
+    // 用户标识类型（可选：IP/USER_ID）
+    IdentifierType identifierType() default IdentifierType.IP;
+
+    // 自定义业务key（用于区分不同接口）
+    String key() default "";
+
+    enum IdentifierType {
+        IP,      // 根据IP限制
+        USER_ID  // 根据用户ID限制
+    }
+}
diff --git a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/requestSubmit/RequestSubmitSubmitAspect.java b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/requestSubmit/RequestSubmitSubmitAspect.java
new file mode 100644
index 0000000..f71d5b4
--- /dev/null
+++ b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/requestSubmit/RequestSubmitSubmitAspect.java
@@ -0,0 +1,85 @@
+package net.lab1024.sa.admin.module.business.wms.requestSubmit;
+
+import jakarta.annotation.Resource;
+import jakarta.servlet.http.HttpServletRequest;
+import net.lab1024.sa.base.common.domain.ResponseDTO;
+import net.lab1024.sa.base.common.util.SmartRequestUtil;
+import org.aspectj.lang.ProceedingJoinPoint;
+import org.aspectj.lang.annotation.Around;
+import org.aspectj.lang.annotation.Aspect;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.data.redis.core.StringRedisTemplate;
+import org.springframework.stereotype.Component;
+import org.springframework.web.context.request.RequestContextHolder;
+import org.springframework.web.context.request.ServletRequestAttributes;
+import java.util.concurrent.TimeUnit;
+
+@Aspect
+@Component
+public class RequestSubmitSubmitAspect {
+
+    @Autowired
+    private StringRedisTemplate redisTemplate;
+
+    @Around("@annotation(repeatSubmit)")
+    public Object around(ProceedingJoinPoint joinPoint, RequestSubmit repeatSubmit) throws Throwable {
+        // 1. 生成Redis Key
+        String redisKey = buildRedisKey(joinPoint, repeatSubmit);
+
+        // 2. 检查是否已存在请求记录
+        if (Boolean.TRUE.equals(redisTemplate.hasKey(redisKey))) {
+            return ResponseDTO.userErrorParam("邮箱验证码已发送，一分钟内请勿重复发送");
+        }
+
+        // 3. 记录当前请求
+        redisTemplate.opsForValue().set(
+                redisKey,
+                "1",
+                repeatSubmit.value(),
+                TimeUnit.SECONDS
+        );
+
+        // 4. 执行业务方法
+        return joinPoint.proceed();
+    }
+
+    private String buildRedisKey(ProceedingJoinPoint joinPoint, RequestSubmit repeatSubmit) {
+        HttpServletRequest request = ((ServletRequestAttributes) RequestContextHolder.currentRequestAttributes())
+                .getRequest();
+
+        StringBuilder key = new StringBuilder("request_submit:");
+
+        // 添加业务key
+        if (!repeatSubmit.key().isEmpty()) {
+            key.append(repeatSubmit.key()).append(":");
+        }
+
+        // 添加用户标识
+        switch (repeatSubmit.identifierType()) {
+            case IP:
+                key.append(getClientIp(request));
+                break;
+            case USER_ID:
+                // 实际项目中从Token或Session获取用户ID
+                Long userId = SmartRequestUtil.getRequestUserId();
+                if (userId == null) userId = 1L;
+                key.append(userId);
+                break;
+            default:
+                key.append("DEFAULT");
+        }
+
+        // 添加方法签名（防止不同接口冲突）
+        key.append(":").append(joinPoint.getSignature().toShortString());
+
+        return key.toString();
+    }
+
+    private String getClientIp(HttpServletRequest request) {
+        String ip = request.getHeader("X-Forwarded-For");
+        if (ip == null || ip.isEmpty() || "unknown".equalsIgnoreCase(ip)) {
+            ip = request.getRemoteAddr();
+        }
+        return ip;
+    }
+}
diff --git a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/shipping/pick/controller/PickController.java b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/shipping/pick/controller/PickController.java
index 053e61e..061e1af 100644
--- a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/shipping/pick/controller/PickController.java
+++ b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/shipping/pick/controller/PickController.java
@@ -63,7 +63,7 @@ public class PickController {
 
     @Operation(summary = "批量删除 @author 霍锦")
     @PostMapping("/pick/batchDelete")
-    @SaCheckPermission("pick:batchDelete")
+    @SaCheckPermission("pick:delete")
     public ResponseDTO<String> batchDelete(@RequestBody ValidateList<Long> idList) {
         return pickService.batchDelete(idList);
     }
diff --git a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/task/controller/TaskController.java b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/task/controller/TaskController.java
index 08a3dd3..3f8ddb3 100644
--- a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/task/controller/TaskController.java
+++ b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/business/wms/task/controller/TaskController.java
@@ -58,7 +58,7 @@ public class TaskController {
 
     @Operation(summary = "批量删除 @author 霍锦")
     @PostMapping("/task/batchDelete")
-    @SaCheckPermission("task:batchDelete")
+    @SaCheckPermission("task:delete")
     public ResponseDTO<String> batchDelete(@RequestBody ValidateList<Long> idList) {
         return taskService.batchDelete(idList);
     }
diff --git a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/system/employee/controller/EmployeeController.java b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/system/employee/controller/EmployeeController.java
index 3d4154f..49d7f61 100644
--- a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/system/employee/controller/EmployeeController.java
+++ b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/system/employee/controller/EmployeeController.java
@@ -36,6 +36,7 @@ public class EmployeeController {
 
     @PostMapping("/employee/query")
     @Operation(summary = "员工管理查询 @author yaozz")
+    @SaCheckPermission("system:employee:query")
     public ResponseDTO<PageResult<EmployeeVO>> query(@Valid @RequestBody EmployeeQueryForm query) {
         return employeeService.queryEmployee(query);
     }
@@ -56,6 +57,7 @@ public class EmployeeController {
 
     @Operation(summary = "更新员工个人中心信息 @author 善逸")
     @PostMapping("/employee/update/center")
+    @SaCheckPermission("system:employee:update")
     public ResponseDTO<String> updateCenter(@Valid @RequestBody EmployeeUpdateCenterForm updateCenterForm) {
         updateCenterForm.setEmployeeId(SmartRequestUtil.getRequestUserId());
         return employeeService.updateCenter(updateCenterForm);
@@ -63,6 +65,7 @@ public class EmployeeController {
 
     @Operation(summary = "更新登录人头像 @author 善逸")
     @PostMapping("/employee/update/avatar")
+    @SaCheckPermission("system:employee:update")
     public ResponseDTO<String> updateAvatar(@Valid @RequestBody EmployeeUpdateAvatarForm employeeUpdateAvatarForm) {
         employeeUpdateAvatarForm.setEmployeeId(SmartRequestUtil.getRequestUserId());
         return employeeService.updateAvatar(employeeUpdateAvatarForm);
@@ -92,6 +95,7 @@ public class EmployeeController {
     @Operation(summary = "修改密码 @author yaozz")
     @PostMapping("/employee/update/password")
     @ApiDecrypt
+    @SaCheckPermission("system:employee:password")
     public ResponseDTO<String> updatePassword(@Valid @RequestBody EmployeeUpdatePasswordForm updatePasswordForm) {
         updatePasswordForm.setEmployeeId(SmartRequestUtil.getRequestUserId());
         return employeeService.updatePassword(SmartRequestUtil.getRequestUser(), updatePasswordForm);
@@ -100,6 +104,7 @@ public class EmployeeController {
     @Operation(summary = "获取密码复杂度 @author yaozz")
     @GetMapping("/employee/getPasswordComplexityEnabled")
     @ApiDecrypt
+    @SaCheckPermission("system:employee:password")
     public ResponseDTO<Boolean> getPasswordComplexityEnabled() {
         return ResponseDTO.ok(level3ProtectConfigService.isPasswordComplexityEnabled());
     }
diff --git a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/system/login/controller/LoginController.java b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/system/login/controller/LoginController.java
index 95723ac..f07bb70 100644
--- a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/system/login/controller/LoginController.java
+++ b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/system/login/controller/LoginController.java
@@ -8,6 +8,7 @@ import jakarta.annotation.Resource;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.validation.Valid;
 import net.lab1024.sa.admin.constant.AdminSwaggerTagConst;
+import net.lab1024.sa.admin.module.business.wms.requestSubmit.RequestSubmit;
 import net.lab1024.sa.admin.module.system.login.domain.LoginForm;
 import net.lab1024.sa.admin.module.system.login.domain.LoginResultVO;
 import net.lab1024.sa.admin.module.system.login.service.LoginService;
@@ -17,6 +18,7 @@ import net.lab1024.sa.base.common.constant.RequestHeaderConst;
 import net.lab1024.sa.base.common.domain.ResponseDTO;
 import net.lab1024.sa.base.common.util.SmartRequestUtil;
 import net.lab1024.sa.base.module.support.captcha.domain.CaptchaVO;
+import net.lab1024.sa.base.module.support.repeatsubmit.annoation.RepeatSubmit;
 import net.lab1024.sa.base.module.support.securityprotect.service.Level3ProtectConfigService;
 import org.springframework.web.bind.annotation.*;
 
@@ -67,9 +69,11 @@ public class LoginController {
         return loginService.getCaptcha();
     }
 
-    @NoNeedLogin
+
     @GetMapping("/login/sendEmailCode/{loginName}")
     @Operation(summary = "获取邮箱登录验证码 @author yaozz")
+    @NoNeedLogin
+    @RequestSubmit(value = 60, key = "sendEmailCode")
     public ResponseDTO<String> sendEmailCode(@PathVariable String loginName) {
         return loginService.sendEmailCode(loginName);
     }
diff --git a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/system/login/service/LoginService.java b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/system/login/service/LoginService.java
index 9ef5ac1..5f0c5d2 100644
--- a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/system/login/service/LoginService.java
+++ b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/system/login/service/LoginService.java
@@ -231,6 +231,7 @@ public class LoginService implements StpInterface {
 
         // 获取登录结果信息
         String token = StpUtil.getTokenValue();
+
         LoginResultVO loginResultVO = getLoginResult(requestEmployee, token);
 
         //保存登录记录
diff --git a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/system/menu/controller/MenuController.java b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/system/menu/controller/MenuController.java
index 6cbcb9a..914ced8 100644
--- a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/system/menu/controller/MenuController.java
+++ b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/system/menu/controller/MenuController.java
@@ -57,6 +57,7 @@ public class MenuController {
 
     @Operation(summary = "查询菜单列表 @author yaozz")
     @GetMapping("/menu/query")
+    @SaCheckPermission("system:menu:query")
     public ResponseDTO<List<MenuVO>> queryMenuList() {
         return ResponseDTO.ok(menuService.queryMenuList(null));
     }
diff --git a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/system/position/controller/PositionController.java b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/system/position/controller/PositionController.java
index 832baf2..f41953b 100644
--- a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/system/position/controller/PositionController.java
+++ b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/system/position/controller/PositionController.java
@@ -1,5 +1,6 @@
 package net.lab1024.sa.admin.module.system.position.controller;
 
+import cn.dev33.satoken.annotation.SaCheckPermission;
 import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.tags.Tag;
 import jakarta.annotation.Resource;
@@ -34,31 +35,36 @@ public class PositionController {
 
     @Operation(summary = "分页查询 @author kaiyun")
     @PostMapping("/position/queryPage")
+    @SaCheckPermission("system:position:query")
     public ResponseDTO<PageResult<PositionVO>> queryPage(@RequestBody @Valid PositionQueryForm queryForm) {
         return ResponseDTO.ok(positionService.queryPage(queryForm));
     }
 
     @Operation(summary = "添加 @author kaiyun")
     @PostMapping("/position/add")
+    @SaCheckPermission("system:position:add")
     public ResponseDTO<String> add(@RequestBody @Valid PositionAddForm addForm) {
         return positionService.add(addForm);
     }
 
     @Operation(summary = "更新 @author kaiyun")
     @PostMapping("/position/update")
+    @SaCheckPermission("system:position:update")
     public ResponseDTO<String> update(@RequestBody @Valid PositionUpdateForm updateForm) {
         return positionService.update(updateForm);
     }
 
     @Operation(summary = "批量删除 @author kaiyun")
     @PostMapping("/position/batchDelete")
+    @SaCheckPermission("system:position:batchDelete")
     public ResponseDTO<String> batchDelete(@RequestBody ValidateList<Long> idList) {
         return positionService.batchDelete(idList);
     }
 
     @Operation(summary = "单个删除 @author kaiyun")
     @GetMapping("/position/delete/{positionId}")
-    public ResponseDTO<String> batchDelete(@PathVariable Long positionId) {
+    @SaCheckPermission("system:position:delete")
+    public ResponseDTO<String> delete(@PathVariable Long positionId) {
         return positionService.delete(positionId);
     }
 
diff --git a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/system/support/AdminApiEncryptController.java b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/system/support/AdminApiEncryptController.java
index 5540270..2f19b5d 100644
--- a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/system/support/AdminApiEncryptController.java
+++ b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/system/support/AdminApiEncryptController.java
@@ -1,5 +1,6 @@
 package net.lab1024.sa.admin.module.system.support;
 
+import cn.dev33.satoken.annotation.SaCheckPermission;
 import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.tags.Tag;
 import jakarta.validation.Valid;
@@ -37,6 +38,7 @@ public class AdminApiEncryptController extends SupportBaseController {
     @ApiDecrypt
     @PostMapping("/apiEncrypt/testRequestEncrypt")
     @Operation(summary = "测试 请求加密")
+    @SaCheckPermission("support:apiEncrypt:testRequestEncrypt")
     public ResponseDTO<JweForm> testRequestEncrypt(@RequestBody @Valid JweForm form) {
         return ResponseDTO.ok(form);
     }
@@ -44,6 +46,7 @@ public class AdminApiEncryptController extends SupportBaseController {
     @ApiEncrypt
     @PostMapping("/apiEncrypt/testResponseEncrypt")
     @Operation(summary = "测试 返回加密")
+    @SaCheckPermission("support:apiEncrypt:testResponseEncrypt")
     public ResponseDTO<JweForm> testResponseEncrypt(@RequestBody @Valid JweForm form) {
         return ResponseDTO.ok(form);
     }
@@ -52,6 +55,7 @@ public class AdminApiEncryptController extends SupportBaseController {
     @ApiEncrypt
     @PostMapping("/apiEncrypt/testDecryptAndEncrypt")
     @Operation(summary = "测试 请求参数加密和解密、返回数据加密和解密")
+    @SaCheckPermission("support:apiEncrypt:testDecryptAndEncrypt")
     public ResponseDTO<JweForm> testDecryptAndEncrypt(@RequestBody @Valid JweForm form) {
         return ResponseDTO.ok(form);
     }
@@ -60,6 +64,7 @@ public class AdminApiEncryptController extends SupportBaseController {
     @ApiEncrypt
     @PostMapping("/apiEncrypt/testArray")
     @Operation(summary = "测试 数组加密和解密")
+    @SaCheckPermission("support:apiEncrypt:testArray")
     public ResponseDTO<List<JweForm>> testArray(@RequestBody @Valid ValidateList<JweForm> list) {
         return ResponseDTO.ok(list);
     }
diff --git a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/system/support/AdminDataMaskingDemoController.java b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/system/support/AdminDataMaskingDemoController.java
index 40fc65d..b63e1e9 100644
--- a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/system/support/AdminDataMaskingDemoController.java
+++ b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/system/support/AdminDataMaskingDemoController.java
@@ -1,5 +1,6 @@
 package net.lab1024.sa.admin.module.system.support;
 
+import cn.dev33.satoken.annotation.SaCheckPermission;
 import cn.hutool.core.util.RandomUtil;
 import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.tags.Tag;
@@ -29,6 +30,7 @@ public class AdminDataMaskingDemoController extends SupportBaseController {
 
     @Operation(summary = "数据脱敏demo @author YouChain-yaozz")
     @GetMapping("/dataMasking/demo/query")
+    @SaCheckPermission("support:dataMasking:query")
     public ResponseDTO<List<DataVO>> query() {
 
         List<DataVO> list = new ArrayList<>();
diff --git a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/system/support/AdminHeartBeatController.java b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/system/support/AdminHeartBeatController.java
index 3885715..c3c3db5 100644
--- a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/system/support/AdminHeartBeatController.java
+++ b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/system/support/AdminHeartBeatController.java
@@ -1,5 +1,6 @@
 package net.lab1024.sa.admin.module.system.support;
 
+import cn.dev33.satoken.annotation.SaCheckPermission;
 import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.tags.Tag;
 import jakarta.annotation.Resource;
@@ -31,6 +32,7 @@ public class AdminHeartBeatController extends SupportBaseController {
 
     @PostMapping("/heartBeat/query")
     @Operation(summary = "查询心跳记录 @author yaozz")
+    @SaCheckPermission("support:heartBeat:query")
     public ResponseDTO<PageResult<HeartBeatRecordVO>> query(@RequestBody @Valid HeartBeatRecordQueryForm pageParam) {
         return heartBeatService.pageQuery(pageParam);
     }
diff --git a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/system/support/AdminProtectController.java b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/system/support/AdminProtectController.java
index 3b6b5ed..55421d2 100644
--- a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/system/support/AdminProtectController.java
+++ b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/system/support/AdminProtectController.java
@@ -1,5 +1,6 @@
 package net.lab1024.sa.admin.module.system.support;
 
+import cn.dev33.satoken.annotation.SaCheckPermission;
 import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.tags.Tag;
 import jakarta.annotation.Resource;
@@ -45,6 +46,7 @@ public class AdminProtectController extends SupportBaseController {
 
     @Operation(summary = "分页查询 @author YouChain-yaozz")
     @PostMapping("/protect/loginFail/queryPage")
+    @SaCheckPermission("support:loginFail:queryPage")
     public ResponseDTO<PageResult<LoginFailVO>> queryPage(@RequestBody @Valid LoginFailQueryForm queryForm) {
         return ResponseDTO.ok(securityLoginService.queryPage(queryForm));
     }
@@ -52,18 +54,21 @@ public class AdminProtectController extends SupportBaseController {
 
     @Operation(summary = "批量删除 @author YouChain-yaozz")
     @PostMapping("/protect/loginFail/batchDelete")
+    @SaCheckPermission("support:loginFail:batchDelete")
     public ResponseDTO<String> batchDelete(@RequestBody ValidateList<Long> idList) {
         return securityLoginService.batchDelete(idList);
     }
 
     @Operation(summary = "更新三级等保配置 @author YouChain-yaozz")
     @PostMapping("/protect/level3protect/updateConfig")
+    @SaCheckPermission("support:level3protect:updateConfig")
     public ResponseDTO<String> updateConfig(@RequestBody @Valid Level3ProtectConfigForm configForm) {
         return level3ProtectConfigService.updateLevel3Config(configForm);
     }
 
     @Operation(summary = "查询 三级等保配置 @author YouChain-yaozz")
     @GetMapping("/protect/level3protect/getConfig")
+    @SaCheckPermission("support:level3protect:getConfig")
     public ResponseDTO<String> getConfig() {
         return ResponseDTO.ok(configService.getConfigValue(ConfigKeyEnum.LEVEL3_PROTECT_CONFIG));
     }
diff --git a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/system/support/AdminReloadController.java b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/system/support/AdminReloadController.java
index 9cff022..fb81e16 100644
--- a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/system/support/AdminReloadController.java
+++ b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/system/support/AdminReloadController.java
@@ -32,6 +32,7 @@ public class AdminReloadController extends SupportBaseController {
 
     @Operation(summary = "查询reload列表 @author 开云")
     @GetMapping("/reload/query")
+    @SaCheckPermission("support:reload:query")
     public ResponseDTO<List<ReloadItemVO>> query() {
         return reloadService.query();
     }
diff --git a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/system/support/AdminSerialNumberController.java b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/system/support/AdminSerialNumberController.java
index 081ed77..f9b3bee 100644
--- a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/system/support/AdminSerialNumberController.java
+++ b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/system/support/AdminSerialNumberController.java
@@ -58,6 +58,7 @@ public class AdminSerialNumberController extends SupportBaseController {
 
     @Operation(summary = "获取所有单号定义 @author yaozz")
     @GetMapping("/serialNumber/all")
+    @SaCheckPermission("support:serialNumber:all")
     public ResponseDTO<List<SerialNumberEntity>> getAll() {
         return ResponseDTO.ok(serialNumberDao.selectList(null));
     }
diff --git a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/system/support/AdminSmartJobController.java b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/system/support/AdminSmartJobController.java
index 0d53b13..48ff3dc 100644
--- a/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/system/support/AdminSmartJobController.java
+++ b/nc_wms_java/sa-admin/src/main/java/net/lab1024/sa/admin/module/system/support/AdminSmartJobController.java
@@ -1,5 +1,6 @@
 package net.lab1024.sa.admin.module.system.support;
 
+import cn.dev33.satoken.annotation.SaCheckPermission;
 import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.tags.Tag;
 import jakarta.validation.Valid;
@@ -33,7 +34,7 @@ public class AdminSmartJobController extends SupportBaseController {
 
     @Operation(summary = "定时任务-立即执行 @yaozz")
     @PostMapping("/job/execute")
-    @RepeatSubmit
+    @SaCheckPermission("support:job:execute")
     public ResponseDTO<String> execute(@RequestBody @Valid SmartJobExecuteForm executeForm) {
         RequestUser requestUser = SmartRequestUtil.getRequestUser();
         executeForm.setUpdateName(requestUser.getUserName());
@@ -48,13 +49,14 @@ public class AdminSmartJobController extends SupportBaseController {
 
     @Operation(summary = "定时任务-分页查询 @yaozz")
     @PostMapping("/job/query")
+    @SaCheckPermission("support:job:query")
     public ResponseDTO<PageResult<SmartJobVO>> queryJob(@RequestBody @Valid SmartJobQueryForm queryForm) {
         return jobService.queryJob(queryForm);
     }
 
     @Operation(summary = "定时任务-添加任务 @huojin")
     @PostMapping("/job/add")
-    @RepeatSubmit
+    @SaCheckPermission("support:job:add")
     public ResponseDTO<String> addJob(@RequestBody @Valid SmartJobAddForm addForm) {
         RequestUser requestUser = SmartRequestUtil.getRequestUser();
         addForm.setUpdateName(requestUser.getUserName());
@@ -63,7 +65,7 @@ public class AdminSmartJobController extends SupportBaseController {
 
     @Operation(summary = "定时任务-更新-任务信息 @huojin")
     @PostMapping("/job/update")
-    @RepeatSubmit
+    @SaCheckPermission("support:job:update")
     public ResponseDTO<String> updateJob(@RequestBody @Valid SmartJobUpdateForm updateForm) {
         RequestUser requestUser = SmartRequestUtil.getRequestUser();
         updateForm.setUpdateName(requestUser.getUserName());
@@ -72,7 +74,7 @@ public class AdminSmartJobController extends SupportBaseController {
 
     @Operation(summary = "定时任务-更新-开启状态 @yaozz")
     @PostMapping("/job/update/enabled")
-    @RepeatSubmit
+    @SaCheckPermission("support:job:update")
     public ResponseDTO<String> updateJobEnabled(@RequestBody @Valid SmartJobEnabledUpdateForm updateForm) {
         RequestUser requestUser = SmartRequestUtil.getRequestUser();
         updateForm.setUpdateName(requestUser.getUserName());
@@ -81,13 +83,14 @@ public class AdminSmartJobController extends SupportBaseController {
 
     @Operation(summary = "定时任务-删除 @huojin")
     @GetMapping("/job/delete")
-    @RepeatSubmit
+    @SaCheckPermission("support:job:delete")
     public ResponseDTO<String> deleteJob(@RequestParam Integer jobId) {
         return jobService.deleteJob(jobId, SmartRequestUtil.getRequestUser());
     }
 
     @Operation(summary = "定时任务-执行记录-分页查询 @huojin")
     @PostMapping("/job/log/query")
+    @SaCheckPermission("support:job:log:query")
     public ResponseDTO<PageResult<SmartJobLogVO>> queryJobLog(@RequestBody @Valid SmartJobLogQueryForm queryForm) {
         return jobService.queryJobLog(queryForm);
     }
diff --git a/nc_wms_java/sa-admin/src/main/resources/dev/application.yaml b/nc_wms_java/sa-admin/src/main/resources/dev/application.yaml
index fe11e16..f6614f5 100644
--- a/nc_wms_java/sa-admin/src/main/resources/dev/application.yaml
+++ b/nc_wms_java/sa-admin/src/main/resources/dev/application.yaml
@@ -8,16 +8,15 @@
 # 项目配置: 名称、日志目录
 project:
   name: sa-admin
-  log-directory: /home/logs/nc_wms/${project.name}/${spring.profiles.active}
+  log-directory: /home/wms/java/${project.name}/${spring.profiles.active}
 
 # 项目端口和url根路径
 server:
   port: 8000
   ssl:
-    key-store: classpath:javaboy.p12
+    key-store: file:/ssl/server.jks
     key-store-type: PKCS12
-    key-store-password: 123456
-    key-alias: tomcathttps
+    key-store-password: 56uvgemn
     enabled: true
   servlet:
     context-path: /
diff --git a/nc_wms_java/sa-admin/src/main/resources/dev/log4j2-spring.xml b/nc_wms_java/sa-admin/src/main/resources/dev/log4j2-spring.xml
index 14e3eea..d03ceca 100644
--- a/nc_wms_java/sa-admin/src/main/resources/dev/log4j2-spring.xml
+++ b/nc_wms_java/sa-admin/src/main/resources/dev/log4j2-spring.xml
@@ -106,7 +106,7 @@
             <AppenderRef ref="druidSlowSqlLog"/>
         </logger>
 
-        <Root level="debug">
+        <Root level="info">
             <AppenderRef ref="Console"/>
             <AppenderRef ref="debug"/>
             <AppenderRef ref="info"/>
diff --git a/nc_wms_java/sa-admin/src/main/resources/dev/spy.properties b/nc_wms_java/sa-admin/src/main/resources/dev/spy.properties
index 667e1ea..07c57b3 100644
--- a/nc_wms_java/sa-admin/src/main/resources/dev/spy.properties
+++ b/nc_wms_java/sa-admin/src/main/resources/dev/spy.properties
@@ -15,4 +15,4 @@ dateformat=yyyy-MM-dd HH:mm:ss
 # 开启慢sql
 outagedetection=true
 # 慢SQL记录标准（单位秒）
-outagedetectioninterval=2
\ No newline at end of file
+outagedetectioninterval=5
\ No newline at end of file
diff --git a/nc_wms_java/sa-admin/src/main/resources/javaboy.p12 b/nc_wms_java/sa-admin/src/main/resources/javaboy.p12
deleted file mode 100644
index de3cea23d0206f1ec71b6db7bb8c4d1e33239281..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 2738
zcma)8c{~%2``>0GGvsJuNK?r5nYmYTj3$~0iy>F85E&yB<~}M!q&7o+ELSLWIEGxg
zkCfb|lALoE@%4NCzOO#7?_b~VAJ6M~p7-(m`F=ep3bYIa<UmoNHk{n@amI05yg)7>
zodP`%ra+AjV0{z?^6Eb*$TKhn^7H`CJ18nA&%a$TC=f)aK=cm4Gbr~z4hS#G7Nzyi
z3PUM?g%_08Z`+IyG)GHs)PD$GbhkVFS_cG@Jq!X$p<tYc{{JF~8v;N{aB@4v83Wxo
zz(9HM;RW43jn;b^k9uss8I|ntz5r9eeMvGmNd=V^V~^H671Ele!h4epk2S$3v-W1f
zTL=|D#9|KJk;-+nw7w%jP6!9=7X9QIY0ejWW(8Xp+_i7wV0Q?*?Zq5=QdXGZM0o3T
zl0hHGE3<%0&#<MHUp7P4g7(tAIO4Mhy)W#|AbACbf}_2MUXSKXuJlW}WO5GfXX<{u
z-@)Jbc|S*pNn85a)udf$WcXMx=~~e^!-3y%`jr`D?q_rHHm}d8KBvSixTP;ns8jVj
zZHW??g=)8M$47Kez-()oDd;5%7H^JsSYI;0PE?j*b<hZhB*>!ZeevuS+^sE;s1Lq7
zbwhe{G@^j0w{~M83e}9hC%qdOmxf+hf2-_=QHY9Cs~haPpD)FC;V&=z-Wf|RG!~O>
z8o;Q?be6QGL+nIkeB=?yxEu{MgM{vjzSVFxY%3%x!|E`Ah(nn3opt4JH&nl?q5S>k
zFPr0Co@mg9gLwCd70;JZ5B;c;9<{fbePMc%CGVBkRWUL=S=w%NzglKCSGC7`?eF3H
z8s+kKw6Nxm=riJ`LZ_c-3|vQ3PipyU4BZyjiaTqkDveL|iMCz(p&1!;7N%wEME(%R
z-z7W0*Is?fQeQWy7SuHzm>7`3^51^)rp4%Fss2}HFs;;bG{s*`>PbxlvYcq6QJcu~
zi2yI%boJ6Y?K9XPaSbOb%E7uM|F@24;E$bw*rXSC;b(HJ77;wN6Y=8p*qG6Hv+?lM
z6i^r(O(dB*yu!OWb+xfC+?A;IexEDIlUQGJ#MY?%)7peV(_p6LId946D_UFf_mKQa
z?|e_iFl(I5xvE=muGrIW*EL`Lbn&EYr-AeuWfRi@`?IF0s+8`apbH+h%%hgccYR!Z
z2x5x$ycUGQ9MNFlXToyqYm1&8(<+!rG~czOovfgYD6iA)O1&NBS$?Yy=H^dQrg(+A
zsqa=~X|1&3u%`f|eHdo?)7GxZtT1=-kFmTTA5Ff_-g?04WA{w)ja;M&TN#?zKaHU?
zOc#ph6PAxul)4ihvq+pjsT;}L`Bd|i6RN_$q*4tU9>7#rq4ObDi>{#NU;dn8QK|^4
zt{g9E`nCSaH$uO-4jCr4oyH7JmA6YsHj#?t;+9}4sCWjgV@2<R!RC82qVbhR>_&;V
zPje{e=Y^Ngpl58pemiO}p^;BZ=lfK7N&(E(k@g!Sdvh7ou+FY}RANxix3;V*e%ENA
zD#bTdF!rlxV1J!U7NO^1Nn968?NQhr*qDgbrQwx*|Lsk3Ubip@+xdE(SNH1hLy>?b
zb#OrDvbz6BgSmV35vD*yeV=3AIfPC>g#6*W6qCaxFEqIrz{B4kd6B4-gNtQOZsoeu
z85$Umr?d7h$zo^LR#m4$R~cm{mW82Hp2wlT*zmia$+THvwoF9)vL+WrDJu<w;bV35
z0p=}p`b@$_)fHaa(he~e0w1&6l*f((LSB6y79sroeRW{-xLmuRF`(j#MX|M|hyRNN
z=TAkg=5xS!0R?BR<&D3PBFu*92*rEQUTRVLo;T&xl=JPkp>7$c_-tBqQ!qxBHj#~P
z53mZkas``SH%1F4ZLk{_4!lkkXKSnq)pe1NoGI9y^^mU`Ej+y0{BQD_zHJ*0Y}RyK
z<)1b_MVsj_Q!zoE{1cbl!YW54;ebGZAHWyj3UEG{JP#@m;13|7j{hS&q9P0ywDR(G
zlTy)C)6_(x)wNM-8tNztIO>mxi<3?P2OL1xK|sJk^Z17W{<pveYHm&N4K?tTGX|sn
zmO;TaJ*{{Cm%ye1kk9y6*HztO&R8|N&r3#9I9BAtg(Wkx<E}rPWFs9sKjm``w22r6
zXqCB+o6K_AuT3ZPxWp8ISQ#z}QR6c2rl>t;Z4(cD5j}Do<>KQ)+H-xl;Oth$O67Ar
zw-qG#BO$b4BowhzoL#NR|I0ohMP$V9(!dF#fjmyIfH2m`Z&x<d-P9`_8Y_ffv*s`6
z-jk+v6-vy9h^9Z_GU@({9-+mU<%}-nTweP{Qb$WguG`5v>Z(|$LoSVvpTPL)2w}id
zR?!d00}_J@yNP45Mcl+h7qyOsA8e@8yDpzy^{WNu)|XY;m%iR`C8V+T-*w`h%I7t;
zQ(5PUbuY^r?66+P(_L^wk;H&&&uiqQ0|b#oXjR-(T$#P>{OXZN^YY|^$rZjDff@N$
z^2jmDqU1U`R#8YrS@1$hqSMCBo*nLiSeu!P^-qKRDjLZ|54QN6hsQ|4u#z@gSW~I3
z5N}rKK<>-!tC2Y$<i_(BgA2p1k*_NXOmRjo)>oRgKCNb<QHqW~?-4|d0o0H=m`Rby
z3f)3smKY<+=^MX?AKNo~Sfhaaz^8GVyL7o8;is+G{<tN(sO;h-$e`koAgQ>*PK0mo
zb7!i#^0dCgJo9(+^U4tH>2ib%tGy>cr0z?&(#m~@Bk~AGW&9oC9+rF7%X1yVz^)Tz
z`4QR7x#u{9E?v56eQsv>N>ArZcy-_n5}fza+V>;V4`7|woTVvfVnhUt`B{G^@3rwj
zaZzQ!YJR2GEArJxQJMn2n<}}>CC~~)*^78{Sk#8N*OMh_Zo6pe%E_BTzAeAOo8BZ+
z+BjSz9V%QAGE&!yRrF808-^6^ZL7;y0Hn~7Ze$esP@X4@0~KG?hgr{Cyc4?x=M^)g
z?-U=iiC4N+<xqe5{b(%J)_R*Z^t@qf)Z+6jT%mSe*>K9U@k3La%W!AL)VswmL@4|G
zb%A*w2ulW$%SE;muMN2PTsCq)rDHvyvxqBq0ITn11V(<0>1?kRjAyLj!iDTtawiOO
zla3X}NLMur{IFQ^Wr$32`8l7{Dc&B;ExV&ZiqbZA3GNPCcq!5GEnjB8VwYy-fVu3R
zA`b4meK-@RIk2y^A5x?JjWjMDp!tv+qWD^k&up0xk}c*Pls&OGM=?b?Jq6mnc*(X8
zQHm*7xmLD5H%yM?C}@}2oad+J_%bdxb+6s9c-7->@Zu})M6WTH9XTao5B6U;7awSu
zc%kx2Lh|fzeWl))>A@}@WO8>BA%mLv20+Ef3%a~%yx1QNxsmTnC!Zir_4KZcC7UC6
z1+!GFy1A=&eD0@rb%osyi&YV-3Z_ON=FrUj%sH{1<p{n>Yn^j&1w$bJn<5k*rGn!9
z^T&aJ5CB-Jql0+0NN#8vV9E?zs7(BZBR+Ek>rH$N{5^TXpQK{|7T(mXpU8k)5hU*0
Rh^pq5ayJd>#Qk67{0px9>(>AP

diff --git a/nc_wms_java/sa-admin/src/main/resources/prod/application.yaml b/nc_wms_java/sa-admin/src/main/resources/prod/application.yaml
index b99c60d..6872d5b 100644
--- a/nc_wms_java/sa-admin/src/main/resources/prod/application.yaml
+++ b/nc_wms_java/sa-admin/src/main/resources/prod/application.yaml
@@ -8,17 +8,17 @@
 # 项目配置: 名称、日志目录
 project:
   name: sa-admin
-  log-directory: /home/logs/nc_wms/${project.name}/${spring.profiles.active}
+  log-directory: /home/logs/wms/${project.name}/${spring.profiles.active}
 
 # 项目端口和url根路径
 server:
   port: 8000
   ssl:
-    #key-store: classpath:server.jks
+    #key-store: classpath:server.jks 56uvgemn
     #key-store: file:C:\Users\hj\Downloads\server.jks
     key-store: file:/home/wms/server.jks
     key-store-type: PKCS12
-    key-store-password: 56uvgemn
+    key-store-password: p263buoe
     enabled: true
   servlet:
     context-path: /
diff --git a/nc_wms_java/sa-admin/src/main/resources/prod/log4j2-spring.xml b/nc_wms_java/sa-admin/src/main/resources/prod/log4j2-spring.xml
index d03ceca..efb5e7d 100644
--- a/nc_wms_java/sa-admin/src/main/resources/prod/log4j2-spring.xml
+++ b/nc_wms_java/sa-admin/src/main/resources/prod/log4j2-spring.xml
@@ -106,7 +106,7 @@
             <AppenderRef ref="druidSlowSqlLog"/>
         </logger>
 
-        <Root level="info">
+        <Root level="error">
             <AppenderRef ref="Console"/>
             <AppenderRef ref="debug"/>
             <AppenderRef ref="info"/>
diff --git a/nc_wms_java/sa-admin/src/main/resources/server.jks b/nc_wms_java/sa-admin/src/main/resources/server.jks
deleted file mode 100644
index 5ae9e4b096a7a2d902a8289dca47b1dbd7447d51..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 5729
zcmeI0c{G&&9><?&W=xcQ-wg&K=9yu}8d;{X{SfktO4h95YR1-2n3&3vrL-VxiBg29
z@$(}~L|Uj&43$DiWY2PE{Hj~Od+)jToO{mwt2yU6XFkvO^L#&_=X~Ga&-e4Z)+W~`
z0RVt~yM!WwC>}m;zJYjxwzhhBM5LOBR|pvZz_ZH>Fav;Xk2)UG0RSXFL`8B#RK$E9
z90tN*ys)*dlu%)fQ!jkQw#{V@5FjojhYHP%w!j5~Ti5_75W5B9K*Dz;kOHvX_E;fE
zfMskJ;57C1_BCOKK$!=6V8tL2*6l3<ykTKs>YmIYR&;fbphH+SNR>4N7eEsOJwhUa
z$-Y5>C}OBrNJN;ASBMwN)Dh)iWsfp3LaCuhI7nKA3x|jBI1Omy=e%KR;~<;{UI(w^
z3`u;A1sCA`>nlT4Q11KuK{fzR1$hAG{mn2c2m(oMMXidAO|~Ycw;dnvi<F$%I=U2U
zq+~&Q<m4uePS7p7Z0@U>Xdll&M1gw?a8-9`V?bAKzx1h^tegW@)nOUDn9*Td+?%Pa
zr=H_7net617fC77vn#(nyXdMGci+OK<8kF^1s-vP0QnKi8~L{P3~3b7kKB73)CuLU
znk2ufdmS)xl>AWM`lx1&rclU7i`bHxd5e?__;86(3}9BYvL{WX_`2KfH&^))hJ;iC
z5sk)5t=bkRU}Tdm3|BVQb(+sLUjw%J$DGVO)3&WrVZ?jjYF1~-FY#v>9UsKC(hrNP
zI;usCyk4-L63A?)<Z@ohN!Ht3cC-6=L8)RP3=RTdAr-a+QDJkC40Bzi<PoBfaExI1
zU|Q;d4~)|J7RvZDtKIffXp3q{isitK5Jm`2)F`*Mr{2FhC^~9*m+IA)<$ov(!m@_>
z5Gv4C>OU<7Rgfiwe_9{|)*~o{7KDd1kVx-XP7nq{%8(M0T@?wkv2B8Z!V*4Ya<DE2
z^H(8ZOl<8TZr1ZWAh?b|z+r58e`ctF5QYT5&Hx9${ewZVF<%W3M3A8n2>sQDK$_^6
zKtUddgMW}LWbw@lMl<;0<>AIs^x+>IG5=8XKLl;+$dt2*ks1l7?h!(UI9VABurh{0
zEFm66Zf3qJ0(>3;L%<MJFpzoqfj&Sez&~xRS!W+&6^9gSN->NSSRA?Ke*8rCA&4z*
z{4GsUcVjQl#ti}h0uGQMB1{&TnjQX(b<$#2%HNs5EmT~-3+3gqWpqG6zf@&Di=)gE
zhT?woTKh&<TTDQia`!p^)BT)<({Y6l22LZuW7Ob3lH-6dU{c@m`6#mSQUUPm%MSEw
zZE$cGX0n;q63l}ds4*}c`ZI1k`$k+dXeTr7{9I~-u~Ds-tRq|NHsYwC!6*8i=8S=M
z4vBuZPjaGIrb}|jgbSgOL8dI6u#NPt^~Yxd1WqNglK4yQDEA<(PXGnDWZZ%@cXe|}
z;d%N#`*Wn4BJr2wCDE8cqSL&Rjc%O7m%t($fp<ctFx0QAQl)sP;FB~ZW=3@LsJ}&G
zRf(}9mAlci{%8kkgbqVlHhG*@VaV^>m!R=v48|BW=8AllJ6A+aTr3cjit%#zzC19?
z8?!usK#7G!IJ*J31do0keUf+Ip7{GFdXlojMu*S3mpH0_I=;6sATlaGSIF}4;QYbc
zOXs6HJDmC)GkjoC`p0j|^aT1oFc>&zb0n`KM8eh>?$g;3zPzuQivDQ#R)zx|SI2M2
zF0$ju(4OH3O^+zEvS=qe_2*ZhgNc<I?&c+!W0cUBg7ukW#3TXD1P6~`GGEmU{;lF{
zkJ27s?jh!x;x-C@X3d<(y$&Ny=Qf@or>8Ww*JTn(BvP!2?bF`rV8;hNg<L#bH=EMd
z%Q?92-ElRuv49tyKL?FpWV`be!K=GgpvjxNI)0n|cw_%0@UeX0nr8Alw5-!@b5Hu)
zciVFlnP&(H2>x}is`-0GY^(t5_yE{I=9#g|+<$+nR|UogGOH_siWqYZ3ytTZE?X)Y
z)OgC#lB+rs77J9mPP5-vDsNiAlmyHcG}|Uh_B1{F{Q7rnIc#N}5I(atB;RxI1(|~t
zty^+}SImTM=jkgseNrMixf;h2v%PcCnL%KC|B=1s8h*1=#NIr!dA>i`u0*P6M|?D)
zz79>ErCB+A2<ts{-Y(1lnB0$9r{%3z;dd30PskHgD&1XTiLYNR6+WA}?MpHbeQQL@
zO;eXQSI8HSE^~-eE*jD6tRePuHISZ0$kPH98m{V+la>zN>Ns|2or4}XRW{m!PS7$P
zkUHJ$H7b{X*Tg!DbE)VCF@<)$e$<L$lP9j@(=<%tYv}ZDP(C|z#4roJ&~`zK-hrPl
zUOYy4hBiqEpLm47cRgdqe6`weI40VmXU!k~>cQC1A47Ew+`$Dk*?J|O4P)o-)SeL(
zCY*fSyKu?0lUr9_yuIngV&4owa>ovvm}kwrcAtSNM&bve&d4>9BhH>#eY@?BxstSB
ziF&R}6kJ$-Kkh>rIIWtrFY5gw`)qf%u*o&!q~oqtyY=gJ-hZAJ&yHo3_R3evDyPm^
z!#>TD=s}Yj;W8D<T{5w}gDX#VxcT!Xopf_wp3+LpRnXlc)F3yiav|w<(5+96!|%k>
z_xHuVy6jLR(dZ_+FnoNaQ_7l~OgQzL{<uL-UCf&C7MEd9srzv4`6Zl86PN~N+MVG`
zepBtZ<B-i2tLTiYRoA+YJYDi$f1yKGQ8N*F)9G}fard!JTpr6oJUB0|cin?8Ij#$u
zZOOga#(No_6OvQmD$0RuwsbN@8tp-Q9B#*}Oi3LcEgf%~L5mK#=r5&`$IMPnr`Y6}
zyRUc8)vKaTR3Cjbwx%4{Q0>@-pO9`9rb>)tZ#j2k+*YA~!6G11`;)f9sbo9<tk0Y;
zW-c)T=$%u(rHW@!0}vzHaKX%xs3#;gu=mZ$AkqSQSyg#2!y~WnQG2Z+Ex>u)Pd54%
z-F`~q#BBjg+M8PgYIfzOl;XO?Q$=sW`U^Yk*$>%0F<-kcX)F0o;`(k2mr!WuoWlU#
z{utlGd}JU!P|zPf#M7<6L$*S^v8z@wDU{Hhd$mG;Z?RR<jRT8TGn>Z>q}R@$tp5Es
z(Pq8jUb-}9Fh8zLremq{Pz^~U*q~~wWH-Zl`(q)|Yzi5tcB2a3{v_|{RzWKg+Q+8$
zL)K95!_-DfWLa3mTk*vgk3!{0wtwphyYrkr;9(hITFkbJ<GILP+ebL)IzQpENL$zG
z*v~FOm-2<StK3+1&EG%#ioUfKkR+WAYGv@rB09G_$gM;c#CZXM>uSVsdwPGEK-9f1
z*O7o<vmfZMinSC>!+c`P6`Wtjpe%nec#xJB--12m%!__LNmrGtH`eKyDnAgdo%<M0
zNs9%qi0|`@a>3#hW>Qh_A9zbt9z?8tMC1E2moAPSoW||iRh4{)e@25E6_;%rwfT&-
z;ew9uX-#$~;a<}hgY|YCmpaz&w?#gw)+N=$>$_Yk0s{qAv!fDpWm7-28aimt4ganC
zs2s%LQ=_PuVeVwVT#+8GuOjH5Z7-dkJ1};)ShOs8UiHjmr4&#xG*3v>&-Fd`TP<=S
zxgz@P<y*w_f?O{;;K_9pZNAMm*o+AUa^As`7c{=*mhk{z^<ClxY$$KAyx65g_##Z>
z5>bfU_#}FVMqKSitNpW&{@F+W?4y77(Lej>A27ksKAP1>e?1%!H<-=xRfq~t{{mUK
zhSqO=aPM&A&2>%6o^<K{%U1~G_P;_F6eP|3&SXLsk#AUr6cFU@7J#w~3L<~uDp)Nn
z7N>>9X%aLc7FYS+{J(Ra|AcC$1fx$CtVMn<G85n~X^xPSVRtSwpr{PwQ>q#xXfjsW
z9}+Ve4&<=A5<r~==3LVC&=7)a^ScSmCD-TSQv_a4C2C;y0EeijxtLN}Ko-Dg)tw1_
zWTKaFC4Jw_vVZ%<qUz3-%cye&l~0yiWsOxg!z<HG?B#>)$zip7ueY8ReEun>F1tL#
zHu3~F!ZT;3$W%64H#Vd_{MXvd_uhEwE?u>PE&Gp3zdACHQmbm!>Q!B~op5hSS@1fL
z_%MAWeV5-t%fp?VXjJ-~^!TIrGF)B#+0pZ*8R?dbAuZKPKKI=9j1Tp-#Yc_>hV|<q
zg_YwKtrj|ra-{sz9qzSdeEx!JKpQ4Au>6k1{7X>tJ;||_b3ln^yn7S)j%RuK4*w)l
zBt_>(ZUWN&6F1@i1})ejB$HjhKmgMG3PqSGWh<okUmgL*teIpGdXNsJm50yMpkcrA
zl#l?8A7RQ@<^CyLmTor?N&sZVngfL(LMD(FlEal|2GUjoKp4aXPhWFlawAFB#E1VK
zIAZ@sn||b*8-*)R0v|5d?q@u?TcBkpWTw=0A7iQS<zF;yWB5!%C=Cwg4y6QTd$Vsx
znsFzt?iUlT<SG`ucH<ADm&w+VcVYGXatrtR7R;iS%X;3v!D(+_ioPe{W1<{NhFvUW
zZ<L+xE}LarJe~4xeLs8tvfuTA3`X<glf_qVhN41c-O`oY#N+0(oy`pq2)2aA6GE{n
zGWe*exEevu^^X-YJh|AMyIf)`Gbo)+{h1%#awUCc2gfp2HFjN-mH$nea{5-cu}pxe
zpQiJgj1yb<(>A-*QeQ%@&p!2<KJ(wN@M6X+d75o*E?o?eOxKA~a*B$&|MDu)@bcOX
jEXS3j`#FqpzgR3!cqKgKt*I(G=w6lo^o2+do$U5^h;iA?

diff --git a/nc_wms_java/sa-base/src/main/java/net/lab1024/sa/base/module/support/codegenerator/controller/CodeGeneratorController.java b/nc_wms_java/sa-base/src/main/java/net/lab1024/sa/base/module/support/codegenerator/controller/CodeGeneratorController.java
index c1bfc93..bc32903 100644
--- a/nc_wms_java/sa-base/src/main/java/net/lab1024/sa/base/module/support/codegenerator/controller/CodeGeneratorController.java
+++ b/nc_wms_java/sa-base/src/main/java/net/lab1024/sa/base/module/support/codegenerator/controller/CodeGeneratorController.java
@@ -1,5 +1,6 @@
 package net.lab1024.sa.base.module.support.codegenerator.controller;
 
+import cn.dev33.satoken.annotation.SaCheckPermission;
 import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.tags.Tag;
 import jakarta.annotation.Resource;
@@ -49,6 +50,7 @@ public class CodeGeneratorController extends SupportBaseController {
     @Operation(summary = "查询数据库的表 @author yaozz")
     @PostMapping("/codeGenerator/table/queryTableList")
     @ResponseBody
+    @SaCheckPermission("support:codeGenerator:queryTableList")
     public ResponseDTO<PageResult<TableVO>> queryTableList(@RequestBody @Valid TableQueryForm tableQueryForm) {
         return ResponseDTO.ok(codeGeneratorService.queryTableList(tableQueryForm));
     }
@@ -58,6 +60,7 @@ public class CodeGeneratorController extends SupportBaseController {
     @Operation(summary = "获取表的配置信息 @author yaozz")
     @GetMapping("/codeGenerator/table/getConfig/{table}")
     @ResponseBody
+    @SaCheckPermission("support:codeGenerator:getConfig")
     public ResponseDTO<TableConfigVO> getTableConfig(@PathVariable String table) {
         return ResponseDTO.ok(codeGeneratorService.getTableConfig(table));
     }
@@ -65,6 +68,7 @@ public class CodeGeneratorController extends SupportBaseController {
     @Operation(summary = "更新配置信息 @author yaozz")
     @PostMapping("/codeGenerator/table/updateConfig")
     @ResponseBody
+    @SaCheckPermission("support:codeGenerator:updateConfig")
     public ResponseDTO<String> updateConfig(@RequestBody @Valid CodeGeneratorConfigForm form) {
         return codeGeneratorService.updateConfig(form);
     }
@@ -74,12 +78,14 @@ public class CodeGeneratorController extends SupportBaseController {
     @Operation(summary = "代码预览 @author yaozz")
     @PostMapping("/codeGenerator/code/preview")
     @ResponseBody
+    @SaCheckPermission("support:codeGenerator:preview")
     public ResponseDTO<String> preview(@RequestBody @Valid CodeGeneratorPreviewForm form) {
         return codeGeneratorService.preview(form);
     }
 
     @Operation(summary = "代码下载 @author yaozz")
     @GetMapping(value = "/codeGenerator/code/download/{tableName}", produces = "application/octet-stream")
+    @SaCheckPermission("support:codeGenerator:download")
     public void download(@PathVariable String tableName, HttpServletResponse response) throws IOException {
 
         ResponseDTO<byte[]> download = codeGeneratorService.download(tableName);
diff --git a/nc_wms_java/sa-base/src/main/java/net/lab1024/sa/base/module/support/file/controller/FileController.java b/nc_wms_java/sa-base/src/main/java/net/lab1024/sa/base/module/support/file/controller/FileController.java
index 6dfcbf0..309f52a 100644
--- a/nc_wms_java/sa-base/src/main/java/net/lab1024/sa/base/module/support/file/controller/FileController.java
+++ b/nc_wms_java/sa-base/src/main/java/net/lab1024/sa/base/module/support/file/controller/FileController.java
@@ -1,5 +1,6 @@
 package net.lab1024.sa.base.module.support.file.controller;
 
+import cn.dev33.satoken.annotation.SaCheckPermission;
 import cn.hutool.extra.servlet.JakartaServletUtil;
 import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.tags.Tag;
@@ -40,6 +41,7 @@ public class FileController extends SupportBaseController {
 
     @Operation(summary = "文件上传 @author 胡克")
     @PostMapping("/file/upload")
+    @SaCheckPermission("support:file:upload")
     public ResponseDTO<FileUploadVO> upload(@RequestParam MultipartFile file, @RequestParam Integer folder) {
         RequestUser requestUser = SmartRequestUtil.getRequestUser();
         return fileService.fileUpload(file, folder, requestUser);
@@ -47,12 +49,14 @@ public class FileController extends SupportBaseController {
 
     @Operation(summary = "获取文件URL：根据fileKey @author 胡克")
     @GetMapping("/file/getFileUrl")
+    @SaCheckPermission("support:file:getFileUrl")
     public ResponseDTO<String> getUrl(@RequestParam String fileKey) {
         return fileService.getFileUrl(fileKey);
     }
 
     @Operation(summary = "下载文件流（根据fileKey） @author 胡克")
     @GetMapping("/file/downLoad")
+    @SaCheckPermission("support:file:download")
     public void downLoad(@RequestParam String fileKey, HttpServletRequest request, HttpServletResponse response) throws IOException {
         String userAgent = JakartaServletUtil.getHeaderIgnoreCase(request, RequestHeaderConst.USER_AGENT);
         ResponseDTO<FileDownloadVO> downloadFileResult = fileService.getDownloadFile(fileKey, userAgent);
diff --git a/nc_wms_java/sa-base/src/main/resources/dev/sa-base.yaml b/nc_wms_java/sa-base/src/main/resources/dev/sa-base.yaml
index f74f9e6..a63922e 100644
--- a/nc_wms_java/sa-base/src/main/resources/dev/sa-base.yaml
+++ b/nc_wms_java/sa-base/src/main/resources/dev/sa-base.yaml
@@ -23,12 +23,10 @@ spring:
   # redis 连接池配置信息
   data:
     redis:
-      sentinel:
-        master: mymaster
-        nodes: 47.117.45.79:26379,8.133.200.233:26379,123.60.65.29:26379
-        password: 123456 # Sentinel 密码
-      password: 123456   # Redis 主从节点密码
       database: 1
+      host: 127.0.0.1
+      port: 6379
+      password:
       timeout: 10000ms
       lettuce:
         pool:
@@ -84,8 +82,8 @@ file:
   storage:
     mode: local
     local:
-      upload-path: /home/ncwms/upload/   #文件上传目录
-      url-prefix:
+      upload-path: /home/wms/java/upload/   #文件上传目录
+      url-prefix: https://youchain5688.xyz:8000/upload/
     cloud:
       region: oss-cn-hangzhou
       endpoint: oss-cn-hangzhou.aliyuncs.com
@@ -156,7 +154,9 @@ sa-token:
   # 启动时的字符画打印
   is-print: false
   # 是否从cookie读取token
-  is-read-cookie: false
+  is-read-cookie: true
+  # 是否从Header读取token
+  is-read-header: true
 
 # SmartJob 定时任务配置(不需要可以直接删除以下配置，详细文档请看：https://www.xxxxxx.com)
 smart:
diff --git a/nc_wms_java/sa-base/src/main/resources/prod/sa-base.yaml b/nc_wms_java/sa-base/src/main/resources/prod/sa-base.yaml
index 71384ca..04f883f 100644
--- a/nc_wms_java/sa-base/src/main/resources/prod/sa-base.yaml
+++ b/nc_wms_java/sa-base/src/main/resources/prod/sa-base.yaml
@@ -1,9 +1,9 @@
 spring:
   # 数据库连接信息
   datasource:
-    url: jdbc:p6spy:mysql://47.103.100.52:53306/nc_wms?autoReconnect=true&useServerPreparedStmts=false&rewriteBatchedStatements=true&characterEncoding=UTF-8&useSSL=false&allowMultiQueries=true&serverTimezone=Asia/Shanghai&useCursorFetch=true
-    username: root
-    password: Youchain@56
+    url: jdbc:p6spy:mysql://10.1.114.14:3306/wmsqas?autoReconnect=true&useServerPreparedStmts=false&rewriteBatchedStatements=true&characterEncoding=UTF-8&useSSL=false&allowMultiQueries=true&serverTimezone=Asia/Shanghai&useCursorFetch=true
+    username: ncwmsdbadm
+    password: WmsDB@25#DQxi
     driver-class-name: com.p6spy.engine.spy.P6SpyDriver
     initial-size: 10
     min-idle: 10
@@ -25,7 +25,7 @@ spring:
     redis:
       sentinel:
         master: mymaster
-        nodes: 47.117.45.79:26379,8.133.200.233:26379,123.60.65.29:26379
+        nodes: 10.1.119.78:26379,10.1.119.79:26379,10.1.119.80:26379
         password: 123456 # Sentinel 密码
       password: 123456   # Redis 主从节点密码
       database: 1
@@ -84,8 +84,8 @@ file:
   storage:
     mode: local
     local:
-      upload-path: /home/nc_wms/upload/   #文件上传目录
-      url-prefix: http://123.60.65.29:8000/upload/
+      upload-path: /home/wms/upload/   #文件上传目录
+      url-prefix: https://ncwmshaqas.amecnsh.com:8000/upload/
     cloud:
       region: oss-cn-hangzhou
       endpoint: oss-cn-hangzhou.aliyuncs.com