diff --git a/hxhq-modules/hxhq-system/src/main/java/com/hxhq/business/controller/GspController.java b/hxhq-modules/hxhq-system/src/main/java/com/hxhq/business/controller/GspController.java
index 7b46b50..821c4b4 100644
--- a/hxhq-modules/hxhq-system/src/main/java/com/hxhq/business/controller/GspController.java
+++ b/hxhq-modules/hxhq-system/src/main/java/com/hxhq/business/controller/GspController.java
@@ -8,6 +8,7 @@ import com.hxhq.business.form.gsp.*;
 import com.hxhq.business.form.gyzj.SearchForm;
 import com.hxhq.business.service.IGspJcgjService;
 import com.hxhq.business.service.IGspTzService;
+import com.hxhq.common.security.annotation.RequiresPermissions;
 import com.hxhq.common.security.utils.SecurityUtils;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.validation.annotation.Validated;
@@ -51,6 +52,7 @@ public class GspController extends BaseController {
      * 查询供试品管理列表
      */
     @GetMapping("/list")
+    @RequiresPermissions("business:resource:gsp:list")
     public TableDataInfo list(GspSearchListForm form) {
         startPage();
         List<Gsp> list = gspService.queryList(form);
@@ -61,6 +63,7 @@ public class GspController extends BaseController {
      * 稽查轨迹列表
      */
     @GetMapping("/jcgjList")
+    @RequiresPermissions("business:resource:gsp:list")
     public TableDataInfo jcgjList(GspJcgj form)
     {
         startPage();
@@ -72,6 +75,7 @@ public class GspController extends BaseController {
      * 台账列表
      */
     @GetMapping("/tzList")
+    @RequiresPermissions("business:resource:gsp:list")
     public TableDataInfo tzList(GspTz form)
     {
         startPage();
@@ -83,6 +87,7 @@ public class GspController extends BaseController {
      * 获取供试品管理详细信息
      */
     @GetMapping(value = "/info")
+    @RequiresPermissions("business:resource:gsp:xq")
     public AjaxResult getInfo(Long id) {
         return AjaxResult.success(gspService.getById(id));
     }
@@ -91,6 +96,7 @@ public class GspController extends BaseController {
      * 新增供试品管理信息
      */
     @PostMapping("/save")
+    @RequiresPermissions("business:resource:gsp:xz")
     public AjaxResult save(@RequestBody @Validated GspForm form) {
         form.setQmrId(SecurityUtils.getUserId());
         gspService.save(form);
@@ -101,6 +107,7 @@ public class GspController extends BaseController {
      * 编辑供试品管理信息
      */
     @PostMapping("/edit")
+    @RequiresPermissions("business:resource:gsp:bj")
     public AjaxResult edit(@RequestBody @Validated GspBjForm form) {
         form.setQmrId(SecurityUtils.getUserId());
         gspService.edit(form);
@@ -110,6 +117,7 @@ public class GspController extends BaseController {
     /**
      * 审核编辑
      */
+    @RequiresPermissions("business:resource:gsp:shbj")
     @PostMapping("shbj")
     public AjaxResult shbj(@RequestBody GspShbjForm form)
     {
@@ -121,6 +129,7 @@ public class GspController extends BaseController {
      * 钥匙发放
      */
     @PostMapping("/ysff")
+    @RequiresPermissions("business:resource:gsp:ysff")
     public AjaxResult ysff(@RequestBody GspYsffForm form)
     {
         form.setFfrId(SecurityUtils.getUserId());
@@ -132,6 +141,7 @@ public class GspController extends BaseController {
      * 发放
      */
     @PostMapping("/ff")
+    @RequiresPermissions("business:resource:gsp:ff")
     public AjaxResult ff(@RequestBody @Validated FfGspForm form) {
         gspService.ff(form);
         return AjaxResult.success("操作成功");
@@ -141,6 +151,7 @@ public class GspController extends BaseController {
      * 批量发放
      */
     @PostMapping("/plff")
+    @RequiresPermissions("business:resource:gsp:ff")
     public AjaxResult plff(@RequestBody GspPlffForm form)
     {
         gspService.plff(form);
@@ -151,6 +162,7 @@ public class GspController extends BaseController {
      * 归还
      */
     @PostMapping("gh")
+    @RequiresPermissions("business:resource:gsp:gh")
     public AjaxResult gh(@RequestBody GspGhForm form)
     {
         gspService.gh(form);
@@ -161,6 +173,7 @@ public class GspController extends BaseController {
      * 修改库存
      */
     @PostMapping("xgkc")
+    @RequiresPermissions("business:resource:gsp:xgkc")
     public AjaxResult xgkc(@RequestBody GspXgkcForm form)
     {
         form.setQmrId(SecurityUtils.getUserId());
@@ -172,6 +185,7 @@ public class GspController extends BaseController {
      * 审核修改库存
      */
     @PostMapping("shxgkc")
+    @RequiresPermissions("business:resource:gsp:shxgkc")
     public AjaxResult shxgkc(@RequestBody GspShxgkcForm form)
     {
         form.setQmrId(SecurityUtils.getUserId());
@@ -183,6 +197,7 @@ public class GspController extends BaseController {
      * 批量锁定
      */
     @PostMapping("/plsd")
+    @RequiresPermissions("business:resource:gsp:sd")
     public AjaxResult plsd(@RequestBody GspSdForm form)
     {
         form.setQmrId(SecurityUtils.getUserId());
@@ -194,6 +209,7 @@ public class GspController extends BaseController {
      * 锁定
      */
     @PostMapping("/sd")
+    @RequiresPermissions("business:resource:gsp:sd")
     public AjaxResult sd(@RequestBody GspSdForm form)
     {
         form.setQmrId(SecurityUtils.getUserId());
@@ -206,6 +222,7 @@ public class GspController extends BaseController {
      * 解锁
      */
     @PostMapping("/js")
+    @RequiresPermissions("business:resource:gsp:js")
     public AjaxResult js(@RequestBody GspJsForm form)
     {
         form.setQmrId(SecurityUtils.getUserId());
@@ -215,6 +232,7 @@ public class GspController extends BaseController {
 
     /** 处置 */
     @PostMapping("/cz")
+    @RequiresPermissions("business:resource:gsp:cz")
     public AjaxResult cz(@RequestBody @Validated GspCzForm form)
     {
         form.setQmrId(SecurityUtils.getUserId());
@@ -224,6 +242,7 @@ public class GspController extends BaseController {
 
     /** 批量处置 */
     @PostMapping("/plcz")
+    @RequiresPermissions("business:resource:gsp:cz")
     public AjaxResult plcz(@RequestBody @Validated GspPlczForm form)
     {
         form.setQmrId(SecurityUtils.getUserId());
@@ -235,6 +254,7 @@ public class GspController extends BaseController {
      * 借阅
      */
     @PostMapping("/jy")
+    @RequiresPermissions("business:resource:gsp:jy")
     public AjaxResult jy(@RequestBody @Validated GspJyForm form)
     {
         form.setQmrId(SecurityUtils.getUserId());
@@ -246,6 +266,7 @@ public class GspController extends BaseController {
      * 解档
      */
     @PostMapping("/jd")
+    @RequiresPermissions("business:resource:gsp:jd")
     public AjaxResult jd(@RequestBody @Validated GspJdForm form)
     {
         form.setQmrId(SecurityUtils.getUserId());
@@ -257,6 +278,7 @@ public class GspController extends BaseController {
      * 批量归档
      */
     @PostMapping("/plgd")
+    @RequiresPermissions("business:resource:gsp:gd")
     public AjaxResult plgd(@RequestBody GspGdForm form)
     {
         form.setQmrId(SecurityUtils.getUserId());
@@ -268,6 +290,7 @@ public class GspController extends BaseController {
      * 归档
      */
     @PostMapping("/gd")
+    @RequiresPermissions("business:resource:gsp:gd")
     public AjaxResult gd(@RequestBody @Validated GspGdForm form)
     {
         form.setQmrId(SecurityUtils.getUserId());
diff --git a/hxhq-modules/hxhq-system/src/main/java/com/hxhq/business/controller/GspFfjlController.java b/hxhq-modules/hxhq-system/src/main/java/com/hxhq/business/controller/GspFfjlController.java
index 15d5615..f1c3107 100644
--- a/hxhq-modules/hxhq-system/src/main/java/com/hxhq/business/controller/GspFfjlController.java
+++ b/hxhq-modules/hxhq-system/src/main/java/com/hxhq/business/controller/GspFfjlController.java
@@ -38,6 +38,7 @@ public class GspFfjlController extends BaseController
      * 查询供试品发放记录列表
      */
     @GetMapping("/list")
+    @RequiresPermissions("business:resource:gsp:ffjllist")
     public TableDataInfo list(GspFfjl gspFfjl)
     {
         startPage();
@@ -49,6 +50,7 @@ public class GspFfjlController extends BaseController
      * 详细信息
      */
     @GetMapping(value = "/info")
+    @RequiresPermissions("business:resource:gsp:ffjllist")
     public AjaxResult getInfo(Long id)
     {
         return AjaxResult.success(gspFfjlService.getById(id));
@@ -58,6 +60,7 @@ public class GspFfjlController extends BaseController
      * 稽查轨迹列表
      */
     @GetMapping("/jcgjList")
+    @RequiresPermissions("business:resource:gsp:ffjllist")
     public TableDataInfo jcgjList(GspFfjlJcgj form)
     {
         startPage();
@@ -69,6 +72,7 @@ public class GspFfjlController extends BaseController
      * 解档
      */
     @PostMapping("/jd")
+    @RequiresPermissions("business:resource:gsp:ffjljd")
     public AjaxResult jd(@RequestBody FfjlJdForm form)
     {
         form.setQmrId(SecurityUtils.getUserId());
@@ -80,6 +84,7 @@ public class GspFfjlController extends BaseController
      * 批量归档
      */
     @PostMapping("/plgd")
+    @RequiresPermissions("business:resource:gsp:ffjlgd")
     public AjaxResult plgd(@RequestBody FfjlGdForm form)
     {
         form.setQmrId(SecurityUtils.getUserId());
@@ -91,6 +96,7 @@ public class GspFfjlController extends BaseController
      * 归档
      */
     @PostMapping("/gd")
+    @RequiresPermissions("business:resource:gsp:ffjlgd")
     public AjaxResult gd(@RequestBody FfjlGdForm form)
     {
         form.setQmrId(SecurityUtils.getUserId());
@@ -102,6 +108,7 @@ public class GspFfjlController extends BaseController
      * 批量锁定
      */
     @PostMapping("/plsd")
+    @RequiresPermissions("business:resource:gsp:ffjlsd")
     public AjaxResult plsd(@RequestBody FfjlSdForm form)
     {
         form.setQmrId(SecurityUtils.getUserId());
@@ -113,6 +120,7 @@ public class GspFfjlController extends BaseController
      * 锁定
      */
     @PostMapping("/sd")
+    @RequiresPermissions("business:resource:gsp:ffjlsd")
     public AjaxResult sd(@RequestBody FfjlSdForm form)
     {
         form.setQmrId(SecurityUtils.getUserId());
@@ -124,6 +132,7 @@ public class GspFfjlController extends BaseController
      * 解锁
      */
     @PostMapping("/js")
+    @RequiresPermissions("business:resource:gsp:ffjljs")
     public AjaxResult js(@RequestBody FfjlJsForm form)
     {
         form.setQmrId(SecurityUtils.getUserId());
@@ -134,6 +143,7 @@ public class GspFfjlController extends BaseController
     /**
      * 借阅
      */
+    @RequiresPermissions("business:resource:gsp:ffjljy")
     @PostMapping("/jy")
     public AjaxResult jy(@RequestBody FfjlJyForm form)
     {
@@ -146,6 +156,7 @@ public class GspFfjlController extends BaseController
      * 加签
      */
     @PostMapping("/jq")
+    @RequiresPermissions("business:resource:gsp:ffjljq")
     public AjaxResult jq(@RequestBody FfjlJqForm form)
     {
         form.setQmrId(SecurityUtils.getUserId());
diff --git a/hxhq-modules/hxhq-system/src/main/java/com/hxhq/business/controller/GspRkjlController.java b/hxhq-modules/hxhq-system/src/main/java/com/hxhq/business/controller/GspRkjlController.java
index 6af5da1..a26efde 100644
--- a/hxhq-modules/hxhq-system/src/main/java/com/hxhq/business/controller/GspRkjlController.java
+++ b/hxhq-modules/hxhq-system/src/main/java/com/hxhq/business/controller/GspRkjlController.java
@@ -8,6 +8,7 @@ import com.hxhq.business.domain.GspRkjlJcgj;
 import com.hxhq.business.form.gsp.*;
 import com.hxhq.business.form.mjy.*;
 import com.hxhq.business.service.IGspRkjlJcgjService;
+import com.hxhq.common.security.annotation.RequiresPermissions;
 import com.hxhq.common.security.utils.SecurityUtils;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.web.bind.annotation.*;
@@ -38,6 +39,7 @@ public class GspRkjlController extends BaseController
      * 查询供试品入库记录列表
      */
     @GetMapping("/list")
+    @RequiresPermissions("business:resource:gsp:rklist")
     public TableDataInfo list(GspRkjl gspRkjl)
     {
         startPage();
@@ -48,6 +50,7 @@ public class GspRkjlController extends BaseController
     /**
      * 获取供试品入库记录详细信息
      */
+    @RequiresPermissions("business:resource:gsp:rkxq")
     @GetMapping(value = "/info")
     public AjaxResult getInfo(Long id)
     {
@@ -57,6 +60,7 @@ public class GspRkjlController extends BaseController
      * 稽查轨迹列表
      */
     @GetMapping("/jcgjList")
+    @RequiresPermissions("business:resource:gsp:rklist")
     public TableDataInfo jcgjList(GspRkjlJcgj form)
     {
         startPage();
@@ -68,6 +72,7 @@ public class GspRkjlController extends BaseController
      * 新增供试品入库记录信息
      */
     @PostMapping("/xz")
+    @RequiresPermissions("business:resource:gsp:rkxz")
     public AjaxResult save(@RequestBody GspRkjlForm form)
     {
         form.setQmrId(SecurityUtils.getUserId());
@@ -78,6 +83,7 @@ public class GspRkjlController extends BaseController
      * 编辑供试品入库记录信息
      */
     @PostMapping("/bj")
+    @RequiresPermissions("business:resource:gsp:rkbj")
     public AjaxResult bj(@RequestBody GspRkjlForm form)
     {
         form.setQmrId(SecurityUtils.getUserId());
@@ -89,6 +95,7 @@ public class GspRkjlController extends BaseController
      * 锁定
      */
     @PostMapping("/sd")
+    @RequiresPermissions("business:resource:gsp:rksd")
     public AjaxResult sd(@RequestBody GspSdForm form)
     {
         form.setQmrId(SecurityUtils.getUserId());
@@ -100,6 +107,7 @@ public class GspRkjlController extends BaseController
      * 批量锁定
      */
     @PostMapping("/plsd")
+    @RequiresPermissions("business:resource:gsp:rksd")
     public AjaxResult plsd(@RequestBody GspSdForm form)
     {
         form.setQmrId(SecurityUtils.getUserId());
@@ -111,6 +119,7 @@ public class GspRkjlController extends BaseController
      * 解锁
      */
     @PostMapping("/js")
+    @RequiresPermissions("business:resource:gsp:rkjs")
     public AjaxResult js(@RequestBody GspJsForm form)
     {
         form.setQmrId(SecurityUtils.getUserId());
@@ -123,6 +132,7 @@ public class GspRkjlController extends BaseController
      * 解档
      */
     @PostMapping("/jd")
+    @RequiresPermissions("business:resource:gsp:rkjd")
     public AjaxResult jd(@RequestBody GspJdForm form)
     {
         form.setQmrId(SecurityUtils.getUserId());
@@ -134,6 +144,7 @@ public class GspRkjlController extends BaseController
      * 批量归档
      */
     @PostMapping("/plgd")
+    @RequiresPermissions("business:resource:gsp:rkgd")
     public AjaxResult plgd(@RequestBody GspGdForm form)
     {
         form.setQmrId(SecurityUtils.getUserId());
@@ -145,6 +156,7 @@ public class GspRkjlController extends BaseController
      * 归档
      */
     @PostMapping("/gd")
+    @RequiresPermissions("business:resource:gsp:rkgd")
     public AjaxResult gd(@RequestBody GspGdForm form)
     {
         form.setQmrId(SecurityUtils.getUserId());
@@ -156,6 +168,7 @@ public class GspRkjlController extends BaseController
      * 借阅
      */
     @PostMapping("/jy")
+    @RequiresPermissions("business:resource:gsp:rkjy")
     public AjaxResult jy(@RequestBody GspJyForm form)
     {
         form.setQmrId(SecurityUtils.getUserId());