src/main/java/com/imyeyu/api/annotation/RequireCoreRole.java

@@ -1,29 +0,0 @@
-package com.imyeyu.api.annotation;
-
-import com.imyeyu.api.bean.RoleMatchMode;
-import com.imyeyu.api.bean.CoreRoleCode;
-
-import java.lang.annotation.ElementType;
-import java.lang.annotation.Retention;
-import java.lang.annotation.RetentionPolicy;
-import java.lang.annotation.Target;
-
-///
-/// 要求 CORE 模块角色
-///
-/// @author Codex
-/// @since 2026-07-26
-@Target({ElementType.METHOD, ElementType.TYPE})
-@Retention(RetentionPolicy.RUNTIME)
-public @interface RequireCoreRole {
-
-	/// 所需角色
-	///
-	/// @return 角色列表
-	CoreRoleCode[] value();
-
-	/// 匹配模式
-	///
-	/// @return 匹配模式
-	RoleMatchMode mode() default RoleMatchMode.ALL;
-}

src/main/java/com/imyeyu/api/annotation/RequireCoreRoleInterceptor.java

@@ -1,46 +0,0 @@
-package com.imyeyu.api.annotation;
-
-import com.imyeyu.api.bean.ModuleCode;
-import com.imyeyu.api.bean.RoleMatchMode;
-import com.imyeyu.api.bean.CoreRoleCode;
-import com.imyeyu.api.modules.user.service.RoleChecker;
-import com.imyeyu.java.TimiJava;
-import jakarta.servlet.http.HttpServletRequest;
-import jakarta.servlet.http.HttpServletResponse;
-import org.springframework.lang.NonNull;
-import org.springframework.stereotype.Component;
-import org.springframework.web.method.HandlerMethod;
-import org.springframework.web.servlet.HandlerInterceptor;
-
-///
-/// CORE 角色注解处理器
-///
-/// @author Codex
-/// @since 2026-07-27
-@Component
-public class RequireCoreRoleInterceptor implements HandlerInterceptor {
-
-	private final RoleChecker roleChecker;
-
-	public RequireCoreRoleInterceptor(RoleChecker roleChecker) {
-		this.roleChecker = roleChecker;
-	}
-
-	@Override
-	public boolean preHandle(@NonNull HttpServletRequest req, @NonNull HttpServletResponse resp, @NonNull Object handler) {
-		if (!(handler instanceof HandlerMethod handlerMethod)) {
-			return true;
-		}
-		RequireCoreRole annotation = handlerMethod.getMethodAnnotation(RequireCoreRole.class);
-		if (annotation == null || TimiJava.isEmpty(annotation.value())) {
-			return true;
-		}
-		String[] roleCodeList = java.util.Arrays.stream(annotation.value()).map(CoreRoleCode::name).toArray(String[]::new);
-		if (annotation.mode() == RoleMatchMode.ANY) {
-			roleChecker.checkAny(ModuleCode.CORE, roleCodeList);
-		} else {
-			roleChecker.checkAll(ModuleCode.CORE, roleCodeList);
-		}
-		return true;
-	}
-}

src/main/java/com/imyeyu/api/bean/CorePermissionCode.java

@@ -25,9 +25,9 @@ public enum CorePermissionCode implements BuiltinPermissionCode {
 	ROLE_PERMISSION_READ("ROLE_PERMISSION:READ", "角色权限读取", false, true),
 	ROLE_PERMISSION_DELETE("ROLE_PERMISSION:DELETE", "角色权限删除", false, true),
 
-	ROLE_RELATION_CREATE("ROLE_RELATION:CREATE", "角色关联创建", false, true),
+	ROLE_PERMISSION_INHERIT_CREATE("ROLE_PERMISSION_INHERIT:CREATE", "角色权限继承创建", false, true),
-	ROLE_RELATION_READ("ROLE_RELATION:READ", "角色关联读取", false, true),
+	ROLE_PERMISSION_INHERIT_READ("ROLE_PERMISSION_INHERIT:READ", "角色权限继承读取", false, true),
-	ROLE_RELATION_DELETE("ROLE_RELATION:DELETE", "角色关联删除", false, true),
+	ROLE_PERMISSION_INHERIT_DELETE("ROLE_PERMISSION_INHERIT:DELETE", "角色权限继承删除", false, true),
 
 	SETTING_CREATE("SETTING:CREATE", "设置创建", false, true),
 	SETTING_READ("SETTING:READ", "设置读取", false, true),

src/main/java/com/imyeyu/api/bean/CoreRoleCode.java

@@ -13,9 +13,7 @@ public enum CoreRoleCode implements BuiltinRoleCode {
 
 	SYSTEM("系统", true, null),
 
-	ADMIN("管理员", false, SYSTEM.name()),
+	ADMIN("管理员", false, SYSTEM.name());
-
-	USER_ROLE_ADMIN("授权管理", false, ADMIN.name());
 
 	final String defaultName;
 	final boolean protectedRole;
@@ -40,4 +38,5 @@ public enum CoreRoleCode implements BuiltinRoleCode {
 	public String getParentCode() {
 		return parentCode;
 	}
+
 }

src/main/java/com/imyeyu/api/config/WebConfig.java

@@ -9,7 +9,6 @@ import com.fasterxml.jackson.datatype.jsr310.JavaTimeModule;
 import com.imyeyu.api.annotation.EnableSettingInterceptor;
 import com.imyeyu.api.annotation.RequestRateLimitInterceptor;
 import com.imyeyu.api.annotation.RequireCorePermissionInterceptor;
-import com.imyeyu.api.annotation.RequireCoreRoleInterceptor;
 import com.imyeyu.api.modules.gao.annotation.RequireGaoPermissionInterceptor;
 import com.imyeyu.api.modules.gao.annotation.RequireGaoRoleInterceptor;
 import com.imyeyu.api.modules.journal.util.JournalAPIInterceptor;
@@ -44,7 +43,6 @@ public class WebConfig implements WebMvcConfigurer {
 	private final JournalAPIInterceptor journalAPIInterceptor;
 	private final EnableSettingInterceptor enableSettingInterceptor;
 	private final RequireGaoRoleInterceptor requireGaoRoleInterceptor;
-	private final RequireCoreRoleInterceptor requireCoreRoleInterceptor;
 	private final RequestRateLimitInterceptor requestRateLimitInterceptor;
 	private final RequireGaoPermissionInterceptor requireGaoPermissionInterceptor;
 	private final RequireCorePermissionInterceptor requireCorePermissionInterceptor;
@@ -59,7 +57,6 @@ public class WebConfig implements WebMvcConfigurer {
 		registry.addInterceptor(systemAPIInterceptor).addPathPatterns(SystemAPIInterceptor.PATH);
 		registry.addInterceptor(journalAPIInterceptor).addPathPatterns(JournalAPIInterceptor.PATH);
 		registry.addInterceptor(enableSettingInterceptor).addPathPatterns("/**");
-		registry.addInterceptor(requireCoreRoleInterceptor).addPathPatterns("/**");
 		registry.addInterceptor(requireCorePermissionInterceptor).addPathPatterns("/**");
 		registry.addInterceptor(requireGaoRoleInterceptor).addPathPatterns("/**");
 		registry.addInterceptor(requireGaoPermissionInterceptor).addPathPatterns("/**");

src/main/java/com/imyeyu/api/modules/common/controller/MultilingualController.java

@@ -2,9 +2,7 @@ package com.imyeyu.api.modules.common.controller;
 
 import com.fasterxml.jackson.annotation.JsonView;
 import com.imyeyu.api.annotation.RequireCorePermission;
-import com.imyeyu.api.annotation.RequireCoreRole;
 import com.imyeyu.api.bean.CorePermissionCode;
-import com.imyeyu.api.bean.CoreRoleCode;
 import com.imyeyu.api.modules.common.entity.Multilingual;
 import com.imyeyu.api.modules.common.service.MultilingualService;
 import com.imyeyu.spring.annotation.AOPLog;
@@ -40,7 +38,6 @@ public class MultilingualController {
 	 */
 	@JsonView(ResponseView.Admin.class)
 	@RequestRateLimit
-	@RequireCoreRole(CoreRoleCode.ADMIN)
 	@RequireCorePermission(CorePermissionCode.MULTILINGUAL_READ)
 	@PostMapping("/detail")
 	public Multilingual detail(@RequestParam String id) {
@@ -56,7 +53,6 @@ public class MultilingualController {
 	@AOPLog
 	@JsonView(ResponseView.Admin.class)
 	@RequestRateLimit
-	@RequireCoreRole(CoreRoleCode.ADMIN)
 	@RequireCorePermission(CorePermissionCode.MULTILINGUAL_CREATE)
 	@PostMapping("/create")
 	public Multilingual create(@RequestBody Multilingual multilingual) {
@@ -71,7 +67,6 @@ public class MultilingualController {
 	 */
 	@AOPLog
 	@RequestRateLimit
-	@RequireCoreRole(CoreRoleCode.ADMIN)
 	@RequireCorePermission(CorePermissionCode.MULTILINGUAL_UPDATE)
 	@PostMapping("/update")
 	public void update(@RequestBody Multilingual multilingual) {
@@ -85,7 +80,6 @@ public class MultilingualController {
 	 */
 	@AOPLog
 	@RequestRateLimit
-	@RequireCoreRole(CoreRoleCode.ADMIN)
 	@RequireCorePermission(CorePermissionCode.MULTILINGUAL_DELETE)
 	@PostMapping("/delete")
 	public void delete(@RequestParam String id) {

src/main/java/com/imyeyu/api/modules/common/service/implement/AttachmentServiceImplement.java

@@ -41,6 +41,7 @@ import java.io.ByteArrayOutputStream;
 import java.io.File;
 import java.io.IOException;
 import java.io.InputStream;
+import java.util.ArrayList;
 import java.util.Collection;
 import java.util.List;
 import java.util.Map;
@@ -347,6 +348,8 @@ public class AttachmentServiceImplement extends AbstractEntityService<Attachment
 	@Transactional(TimiServerDBConfig.ROLLBACKER)
 	@Override
 	public void updateByBizId(Attachment.BizType bizType, String bizId, List<Attachment> list) {
+		list = TimiJava.defaultIfNull(list, new ArrayList<>());
+
 		// 数据库现有附件
 		List<Attachment> dbList = mapper.selectAllByBizId(bizType, bizId);
 		Set<String> dbIds = dbList.stream().map(Attachment::getId).collect(Collectors.toSet());

src/main/java/com/imyeyu/api/modules/gao/bean/GaoPermissionCode.java

@@ -21,45 +21,45 @@ public enum GaoPermissionCode implements BuiltinPermissionCode {
 
 	STORE_DELETE("STORE:DELETE", "门店删除", false, true),
 
-	CUSTOMER_CREATE("CUSTOMER:CREATE", "客户创建"),
+	CUSTOMER_CREATE("CUSTOMER:CREATE", "客户创建", false, false),
 
-	CUSTOMER_READ("CUSTOMER:READ", "客户读取"),
+	CUSTOMER_READ("CUSTOMER:READ", "客户读取", false, false),
 
-	CUSTOMER_EXPORT("CUSTOMER:EXPORT", "客户导出", true),
+	CUSTOMER_EXPORT("CUSTOMER:EXPORT", "客户导出", true, false),
 
-	CUSTOMER_UPDATE("CUSTOMER:UPDATE", "客户修改"),
+	CUSTOMER_UPDATE("CUSTOMER:UPDATE", "客户修改", false, false),
 
-	CUSTOMER_DELETE("CUSTOMER:DELETE", "客户删除"),
+	CUSTOMER_DELETE("CUSTOMER:DELETE", "客户删除", false, false),
 
-	EVENT_CREATE("EVENT:CREATE", "登记事件创建"),
+	EVENT_CREATE("EVENT:CREATE", "登记事件创建", false, false),
 
-	EVENT_READ("EVENT:READ", "登记事件读取"),
+	EVENT_READ("EVENT:READ", "登记事件读取", false, false),
 
-	EVENT_UPDATE("EVENT:UPDATE", "登记事件修改"),
+	EVENT_UPDATE("EVENT:UPDATE", "登记事件修改", false, false),
 
-	EVENT_DELETE("EVENT:DELETE", "登记事件删除"),
+	EVENT_DELETE("EVENT:DELETE", "登记事件删除", false, false),
 
-	EVENT_RECORD_CREATE("EVENT_RECORD:CREATE", "登记事件记录创建"),
+	EVENT_RECORD_CREATE("EVENT_RECORD:CREATE", "登记事件记录创建", false, false),
 
-	EVENT_RECORD_READ("EVENT_RECORD:READ", "登记事件记录读取"),
+	EVENT_RECORD_READ("EVENT_RECORD:READ", "登记事件记录读取", false, false),
 
-	EVENT_RECORD_EXPORT("EVENT_RECORD:EXPORT", "登记事件记录导出", true),
+	EVENT_RECORD_EXPORT("EVENT_RECORD:EXPORT", "登记事件记录导出", true, false),
 
-	EVENT_RECORD_UPDATE("EVENT_RECORD:UPDATE", "登记事件记录修改"),
+	EVENT_RECORD_UPDATE("EVENT_RECORD:UPDATE", "登记事件记录修改", false, false),
 
-	EVENT_RECORD_DELETE("EVENT_RECORD:DELETE", "登记事件记录删除"),
+	EVENT_RECORD_DELETE("EVENT_RECORD:DELETE", "登记事件记录删除", false, false),
 
-	STAT_READ("STAT:READ", "统计读取"),
+	STAT_READ("STAT:READ", "统计读取", false, false),
 
-	QR_CODE_CREATE("QR_CODE:CREATE", "二维码创建"),
+	QR_CODE_CREATE("QR_CODE:CREATE", "二维码创建", false, false),
 
-	USER_CREATE("USER:CREATE", "用户创建", true),
+	USER_CREATE("USER:CREATE", "用户创建", true, false),
 
-	USER_READ("USER:READ", "用户读取", true),
+	USER_READ("USER:READ", "用户读取", true, false),
 
-	USER_UPDATE("USER:UPDATE", "用户修改", true),
+	USER_UPDATE("USER:UPDATE", "用户修改", true, false),
 
-	USER_DELETE("USER:DELETE", "用户删除", true);
+	USER_DELETE("USER:DELETE", "用户删除", true, false);
 
 	final String value;
 	final String defaultName;
@@ -72,14 +72,6 @@ public enum GaoPermissionCode implements BuiltinPermissionCode {
 	@Getter
 	final boolean grantToGlobalManager;
 
-	GaoPermissionCode(String value, String defaultName) {
-		this(value, defaultName, false, false);
-	}
-
-	GaoPermissionCode(String value, String defaultName, boolean grantToStoreManager) {
-		this(value, defaultName, grantToStoreManager, false);
-	}
-
 	GaoPermissionCode(String value, String defaultName, boolean grantToStoreManager, boolean grantToGlobalManager) {
 		this.value = value;
 		this.defaultName = defaultName;
@@ -111,4 +103,5 @@ public enum GaoPermissionCode implements BuiltinPermissionCode {
 	public boolean isGrantToAdmin() {
 		return false;
 	}
+
 }

src/main/java/com/imyeyu/api/modules/gao/bean/GaoRoleCode.java

@@ -16,9 +16,7 @@ public enum GaoRoleCode implements BuiltinRoleCode {
 	GLOBAL_MANAGER("全局管理员", null),
 
 	/// 店长
-	STORE_MANAGER("店长", GLOBAL_MANAGER.name()),
+	STORE_MANAGER("店长", GLOBAL_MANAGER.name());
-
-	EMPLOYEE("员工", STORE_MANAGER.name());
 
 	final String defaultName;
 	final String parentCode;
@@ -42,4 +40,5 @@ public enum GaoRoleCode implements BuiltinRoleCode {
 	public String getParentCode() {
 		return parentCode;
 	}
+
 }

src/main/java/com/imyeyu/api/modules/gao/controller/GaoCustomerController.java

@@ -2,11 +2,9 @@ package com.imyeyu.api.modules.gao.controller;
 
 import com.fasterxml.jackson.annotation.JsonView;
 import com.imyeyu.api.bean.ModuleCode;
-import com.imyeyu.api.bean.RoleMatchMode;
 import com.imyeyu.api.modules.common.entity.Attachment;
 import com.imyeyu.api.modules.common.service.AttachmentService;
 import com.imyeyu.api.modules.gao.annotation.RequireGaoPermission;
-import com.imyeyu.api.modules.gao.annotation.RequireGaoRole;
 import com.imyeyu.api.modules.gao.bean.GaoPermissionCode;
 import com.imyeyu.api.modules.gao.bean.GaoRoleCode;
 import com.imyeyu.api.modules.gao.entity.GaoCustomer;
@@ -46,7 +44,6 @@ import java.util.Map;
 /// @author 夜雨
 /// @since 2026-07-27 14:12
 @RestController
-@RequireGaoRole(value = {GaoRoleCode.GLOBAL_MANAGER, GaoRoleCode.STORE_MANAGER, GaoRoleCode.EMPLOYEE}, mode = RoleMatchMode.ANY)
 @RequiredArgsConstructor
 @RequestMapping("/gao/customer")
 public class GaoCustomerController {

src/main/java/com/imyeyu/api/modules/gao/controller/GaoEventController.java

@@ -1,9 +1,7 @@
 package com.imyeyu.api.modules.gao.controller;
 
 import com.imyeyu.api.bean.ModuleCode;
-import com.imyeyu.api.bean.RoleMatchMode;
 import com.imyeyu.api.modules.gao.annotation.RequireGaoPermission;
-import com.imyeyu.api.modules.gao.annotation.RequireGaoRole;
 import com.imyeyu.api.modules.gao.bean.GaoPermissionCode;
 import com.imyeyu.api.modules.gao.bean.GaoRoleCode;
 import com.imyeyu.api.modules.gao.entity.GaoEvent;
@@ -30,7 +28,6 @@ import java.util.Map;
 /// @author 夜雨
 /// @since 2026-07-27 14:13
 @RestController
-@RequireGaoRole(value = {GaoRoleCode.GLOBAL_MANAGER, GaoRoleCode.STORE_MANAGER, GaoRoleCode.EMPLOYEE}, mode = RoleMatchMode.ANY)
 @RequiredArgsConstructor
 @RequestMapping("/gao/event")
 public class GaoEventController {

src/main/java/com/imyeyu/api/modules/gao/controller/GaoEventRecordController.java

@@ -2,11 +2,9 @@ package com.imyeyu.api.modules.gao.controller;
 
 import com.fasterxml.jackson.annotation.JsonView;
 import com.imyeyu.api.bean.ModuleCode;
-import com.imyeyu.api.bean.RoleMatchMode;
 import com.imyeyu.api.modules.common.entity.Attachment;
 import com.imyeyu.api.modules.common.service.AttachmentService;
 import com.imyeyu.api.modules.gao.annotation.RequireGaoPermission;
-import com.imyeyu.api.modules.gao.annotation.RequireGaoRole;
 import com.imyeyu.api.modules.gao.bean.GaoPermissionCode;
 import com.imyeyu.api.modules.gao.bean.GaoRoleCode;
 import com.imyeyu.api.modules.gao.entity.GaoCustomer;
@@ -48,7 +46,6 @@ import java.util.Map;
 /// @author 夜雨
 /// @since 2026-07-27 14:11
 @RestController
-@RequireGaoRole(value = {GaoRoleCode.GLOBAL_MANAGER, GaoRoleCode.STORE_MANAGER, GaoRoleCode.EMPLOYEE}, mode = RoleMatchMode.ANY)
 @RequiredArgsConstructor
 @RequestMapping("/gao/event/record")
 public class GaoEventRecordController {

src/main/java/com/imyeyu/api/modules/gao/controller/GaoRoleController.java

@@ -4,7 +4,8 @@ import com.imyeyu.api.bean.ModuleCode;
 import com.imyeyu.api.modules.gao.annotation.RequireGaoRole;
 import com.imyeyu.api.modules.gao.bean.GaoRoleCode;
 import com.imyeyu.api.modules.user.entity.Role;
-import com.imyeyu.api.modules.user.service.RoleService;
+import com.imyeyu.api.modules.user.service.AuthorizationScopeService;
+import com.imyeyu.api.modules.user.service.UserLoginService;
 import com.imyeyu.spring.annotation.AOPLog;
 import com.imyeyu.spring.annotation.RequestRateLimit;
 import lombok.RequiredArgsConstructor;
@@ -24,12 +25,13 @@ import java.util.List;
 @RequestMapping("/gao/role")
 public class GaoRoleController {
 
-	private final RoleService roleService;
+	private final UserLoginService userLoginService;
+	private final AuthorizationScopeService authorizationScopeService;
 
 	@AOPLog
 	@RequestRateLimit
 	@PostMapping("/available/list")
 	public List<Role> availableList() {
-		return roleService.listByModuleCode(ModuleCode.GAO);
+		return authorizationScopeService.listGrantableRole(userLoginService.getRequireLoginUserId(), ModuleCode.GAO);
 	}
 }

src/main/java/com/imyeyu/api/modules/gao/controller/GaoStoreController.java

@@ -1,6 +1,5 @@
 package com.imyeyu.api.modules.gao.controller;
 
-import com.imyeyu.api.bean.RoleMatchMode;
 import com.imyeyu.api.modules.gao.annotation.RequireGaoPermission;
 import com.imyeyu.api.modules.gao.annotation.RequireGaoRole;
 import com.imyeyu.api.modules.gao.bean.GaoPermissionCode;
@@ -34,13 +33,13 @@ import java.util.List;
 @RestController
 @RequiredArgsConstructor
 @RequestMapping("/gao/store")
-@RequireGaoRole(GaoRoleCode.GLOBAL_MANAGER)
 public class GaoStoreController {
 
 	private final GaoStoreService service;
 	private final UserLoginService userLoginService;
 
 	@AOPLog
+	@RequireGaoRole(GaoRoleCode.GLOBAL_MANAGER)
 	@RequestRateLimit
 	@RequireGaoPermission(GaoPermissionCode.STORE_READ)
 	@PostMapping("/list")
@@ -49,6 +48,7 @@ public class GaoStoreController {
 	}
 
 	@AOPLog
+	@RequireGaoRole(GaoRoleCode.STORE_MANAGER)
 	@RequestRateLimit
 	@RequireGaoPermission(GaoPermissionCode.STORE_READ)
 	@PostMapping("/detail")
@@ -66,6 +66,7 @@ public class GaoStoreController {
 	}
 
 	@AOPLog
+	@RequireGaoRole(GaoRoleCode.STORE_MANAGER)
 	@RequestRateLimit
 	@RequireGaoPermission(GaoPermissionCode.STORE_UPDATE)
 	@PostMapping("/update")
@@ -74,6 +75,7 @@ public class GaoStoreController {
 	}
 
 	@AOPLog
+	@RequireGaoRole(GaoRoleCode.GLOBAL_MANAGER)
 	@RequestRateLimit
 	@RequireGaoPermission(GaoPermissionCode.STORE_DELETE)
 	@PostMapping("/delete")
@@ -82,6 +84,7 @@ public class GaoStoreController {
 	}
 
 	@AOPLog
+	@RequireGaoRole(GaoRoleCode.GLOBAL_MANAGER)
 	@RequestRateLimit
 	@RequireGaoPermission(GaoPermissionCode.STORE_UPDATE)
 	@PostMapping("/sort")
@@ -104,7 +107,6 @@ public class GaoStoreController {
 
 	@AOPLog
 	@RequestRateLimit
-	@RequireGaoRole(value = {GaoRoleCode.GLOBAL_MANAGER, GaoRoleCode.STORE_MANAGER, GaoRoleCode.EMPLOYEE}, mode = RoleMatchMode.ANY)
 	@PostMapping("/user")
 	public GaoStore getLoginStore() {
 		return service.getByUserId(userLoginService.getRequireLoginUserId());

src/main/java/com/imyeyu/api/modules/gao/controller/GaoUserController.java

@@ -39,7 +39,6 @@ import java.util.Map;
 /// @author 夜雨
 /// @since 2026-07-30 14:15
 @RestController
-@RequireGaoRole(GaoRoleCode.STORE_MANAGER)
 @RequiredArgsConstructor
 @RequestMapping("/gao/user")
 public class GaoUserController {

src/main/java/com/imyeyu/api/modules/gao/service/implement/GaoCustomerServiceImplement.java

@@ -65,6 +65,7 @@ public class GaoCustomerServiceImplement extends AbstractEntityService<GaoCustom
 		return mapper;
 	}
 
+	@Transactional(TimiServerDBConfig.ROLLBACKER)
 	@Override
 	public void create(GaoCustomer customer) {
 		TimiException.required(customer.getName(), "not found customer.name");
@@ -118,6 +119,7 @@ public class GaoCustomerServiceImplement extends AbstractEntityService<GaoCustom
 		}
 	}
 
+	@Transactional(TimiServerDBConfig.ROLLBACKER)
 	@Override
 	public void update(GaoCustomer customer) {
 		TimiException.required(customer, "not found customer");
@@ -196,6 +198,7 @@ public class GaoCustomerServiceImplement extends AbstractEntityService<GaoCustom
 		}
 	}
 
+	@Transactional(TimiServerDBConfig.ROLLBACKER)
 	@Override
 	public void updateWithAttachment(GaoCustomer customer) {
 		update(customer);

src/main/java/com/imyeyu/api/modules/gao/service/implement/GaoResourceScopeResolver.java

@@ -0,0 +1,113 @@
+package com.imyeyu.api.modules.gao.service.implement;
+
+import com.imyeyu.api.bean.ModuleCode;
+import com.imyeyu.api.bean.CoreRoleCode;
+import com.imyeyu.api.modules.gao.bean.GaoRoleCode;
+import com.imyeyu.api.modules.gao.entity.GaoStore;
+import com.imyeyu.api.modules.gao.service.GaoStoreService;
+import com.imyeyu.api.modules.user.bean.AuthOwnerType;
+import com.imyeyu.api.modules.user.entity.Role;
+import com.imyeyu.api.modules.user.entity.UserRole;
+import com.imyeyu.api.modules.user.mapper.RoleMapper;
+import com.imyeyu.api.modules.user.mapper.UserRoleMapper;
+import com.imyeyu.api.modules.user.service.ModuleResourceScopeResolver;
+import com.imyeyu.api.modules.user.service.RoleHierarchyService;
+import com.imyeyu.java.TimiJava;
+import lombok.RequiredArgsConstructor;
+import org.springframework.stereotype.Service;
+
+import java.util.List;
+
+/// GAO 资源范围解析器
+///
+/// @author Codex
+/// @since 2026-08-07
+@Service
+@RequiredArgsConstructor
+public class GaoResourceScopeResolver implements ModuleResourceScopeResolver {
+
+	private final RoleMapper roleMapper;
+	private final UserRoleMapper userRoleMapper;
+	private final GaoStoreService gaoStoreService;
+	private final RoleHierarchyService roleHierarchyService;
+
+	@Override
+	public ModuleCode moduleCode() {
+		return ModuleCode.GAO;
+	}
+
+	@Override
+	public boolean canManageUser(String operatorUserId, String targetUserId) {
+		if (hasCoreRole(operatorUserId, CoreRoleCode.ADMIN)) {
+			return true;
+		}
+		if (hasGaoRole(operatorUserId, GaoRoleCode.GLOBAL_MANAGER)) {
+			return true;
+		}
+		if (!hasGaoRole(operatorUserId, GaoRoleCode.STORE_MANAGER)) {
+			return false;
+		}
+		GaoStore operatorStore = gaoStoreService.getByUserId(operatorUserId);
+		GaoStore targetStore = gaoStoreService.getByUserId(targetUserId);
+		return operatorStore != null && targetStore != null && operatorStore.getId().equals(targetStore.getId());
+	}
+
+	@Override
+	public boolean canManageRole(String operatorUserId, Role role) {
+		if (hasCoreRole(operatorUserId, CoreRoleCode.ADMIN)) {
+			return true;
+		}
+		if (hasGaoRole(operatorUserId, GaoRoleCode.GLOBAL_MANAGER)) {
+			return true;
+		}
+		if (!hasGaoRole(operatorUserId, GaoRoleCode.STORE_MANAGER)) {
+			return false;
+		}
+		if (canUseOwnerScope(operatorUserId, role.getOwnerType(), role.getOwnerId())) {
+			return true;
+		}
+		return ModuleCode.GAO == role.getModuleCode()
+			&& role.getOwnerType() == AuthOwnerType.MODULE
+			&& (TimiJava.isEmpty(role.getOwnerId()) || ModuleCode.GAO.name().equals(role.getOwnerId()));
+	}
+
+	@Override
+	public boolean canUseOwnerScope(String operatorUserId, AuthOwnerType ownerType, String ownerId) {
+		if (hasCoreRole(operatorUserId, CoreRoleCode.ADMIN)) {
+			return ownerType == AuthOwnerType.MODULE && ModuleCode.GAO.name().equals(ownerId) || ownerType == AuthOwnerType.STORE;
+		}
+		if (hasGaoRole(operatorUserId, GaoRoleCode.GLOBAL_MANAGER)) {
+			return ownerType == AuthOwnerType.MODULE && ModuleCode.GAO.name().equals(ownerId) || ownerType == AuthOwnerType.STORE;
+		}
+		if (!hasGaoRole(operatorUserId, GaoRoleCode.STORE_MANAGER) || ownerType != AuthOwnerType.STORE) {
+			return false;
+		}
+		GaoStore store = gaoStoreService.getByUserId(operatorUserId);
+		return store != null && store.getId().equals(ownerId);
+	}
+
+	private boolean hasGaoRole(String userId, GaoRoleCode roleCode) {
+		if (TimiJava.isEmpty(userId)) {
+			return false;
+		}
+		List<String> roleIdList = userRoleMapper.selectByUserIdList(List.of(userId)).stream().map(UserRole::getRoleId).toList();
+		if (TimiJava.isEmpty(roleIdList)) {
+			return false;
+		}
+		// 身份角色只依赖系统、模块级继承，不能依赖当前正在计算的门店作用域
+		List<String> allRoleIdList = roleHierarchyService.listAllRoleIdIncludingChildren(roleIdList);
+		return roleMapper.selectByIdList(allRoleIdList).stream().anyMatch(role -> ModuleCode.GAO == role.getModuleCode() && roleCode.name().equals(role.getCode()));
+	}
+
+	private boolean hasCoreRole(String userId, CoreRoleCode roleCode) {
+		if (TimiJava.isEmpty(userId)) {
+			return false;
+		}
+		List<String> roleIdList = userRoleMapper.selectByUserIdList(List.of(userId)).stream().map(UserRole::getRoleId).toList();
+		if (TimiJava.isEmpty(roleIdList)) {
+			return false;
+		}
+		List<String> allRoleIdList = roleHierarchyService.listAllRoleIdIncludingChildren(roleIdList);
+		return roleMapper.selectByIdList(allRoleIdList).stream().anyMatch(role -> ModuleCode.CORE == role.getModuleCode() && roleCode.name().equals(role.getCode()));
+	}
+}

src/main/java/com/imyeyu/api/modules/gao/service/implement/GaoStoreServiceImplement.java

@@ -50,6 +50,7 @@ public class GaoStoreServiceImplement extends AbstractEntityService<GaoStore, St
 		return mapper;
 	}
 
+	@Transactional(TimiServerDBConfig.ROLLBACKER)
 	@Override
 	public void create(GaoStore store) {
 		TimiException.required(store, "not found store");
@@ -79,6 +80,7 @@ public class GaoStoreServiceImplement extends AbstractEntityService<GaoStore, St
 		}
 	}
 
+	@Transactional(TimiServerDBConfig.ROLLBACKER)
 	@Override
 	public void update(GaoStore store) {
 		TimiException.required(store, "not found store");
@@ -114,6 +116,7 @@ public class GaoStoreServiceImplement extends AbstractEntityService<GaoStore, St
 		}
 	}
 
+	@Transactional(TimiServerDBConfig.ROLLBACKER)
 	@Override
 	public void delete(String id) {
 		Logger logger = new Logger(Logger.Module.GAO, "GAO_STORE_DELETE");

src/main/java/com/imyeyu/api/modules/system/service/implement/LoggerServiceImplement.java

@@ -3,10 +3,14 @@ package com.imyeyu.api.modules.system.service.implement;
 import com.imyeyu.api.modules.system.entity.Logger;
 import com.imyeyu.api.modules.system.mapper.LoggerMapper;
 import com.imyeyu.api.modules.system.service.LoggerService;
+import com.imyeyu.api.modules.user.entity.User;
 import com.imyeyu.api.modules.user.service.UserLoginService;
+import com.imyeyu.java.TimiJava;
+import com.imyeyu.spring.TimiSpring;
 import com.imyeyu.spring.mapper.BaseMapper;
 import com.imyeyu.spring.service.AbstractEntityService;
 import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
 import org.springframework.stereotype.Service;
 
 /**
@@ -15,6 +19,7 @@ import org.springframework.stereotype.Service;
  * @author 夜雨
  * @since 2026-05-13 14:46
  */
+@Slf4j
 @Service
 @RequiredArgsConstructor
 public class LoggerServiceImplement extends AbstractEntityService<Logger, String> implements LoggerService {
@@ -31,19 +36,13 @@ public class LoggerServiceImplement extends AbstractEntityService<Logger, String
 	@Override
 	public void create(Logger logger) {
 		// 默认异步
+		fillContext(logger);
 		Thread.startVirtualThread(() -> createSync(logger));
 	}
 
 	@Override
 	public void createSync(Logger logger) {
-		// TODO 异步请求上下文已丢失
+		fillContext(logger);
-//		if (TimiJava.isEmpty(logger.getUserId())) {
-//			User loginUser = userLoginService.getLoginUser();
-//			if (TimiJava.isNotEmpty(loginUser)) {
-//				logger.setUserId(loginUser.getId());
-//			}
-//		}
-//		logger.setIp(TimiJava.defaultIfEmpty(logger.getIp(), TimiSpring.getRequestIP()));
 		super.create(logger);
 	}
 
@@ -53,4 +52,18 @@ public class LoggerServiceImplement extends AbstractEntityService<Logger, String
 		log.setResult(result);
 		create(log);
 	}
+
+	private void fillContext(Logger logger) {
+		try {
+			if (TimiJava.isEmpty(logger.getUserId())) {
+				User loginUser = userLoginService.getLoginUser();
+				if (TimiJava.isNotEmpty(loginUser)) {
+					logger.setUserId(loginUser.getId());
+				}
+			}
+			logger.setIp(TimiJava.defaultIfEmpty(logger.getIp(), TimiSpring.getRequestIP()));
+		} catch (Exception e) {
+			// 无请求上下文的后台任务允许继续写日志
+		}
+	}
 }

src/main/java/com/imyeyu/api/modules/user/bean/AuthOwnerType.java

@@ -0,0 +1,23 @@
+package com.imyeyu.api.modules.user.bean;
+
+/// 授权对象归属类型
+///
+/// @author Codex
+/// @since 2026-08-07
+public enum AuthOwnerType {
+
+	/// 系统级
+	SYSTEM,
+
+	/// 模块级
+	MODULE,
+
+	/// 租户级
+	TENANT,
+
+	/// 门店级
+	STORE,
+
+	/// 用户级
+	USER
+}

src/main/java/com/imyeyu/api/modules/user/bean/BuiltinPermissionCode.java

@@ -33,4 +33,25 @@ public interface BuiltinPermissionCode {
 	///
 	/// @return 是否授权给 ADMIN 角色
 	boolean isGrantToAdmin();
+
+	/// true 为受保护权限
+	///
+	/// @return 是否受保护
+	default boolean isProtected() {
+		return false;
+	}
+
+	/// 归属类型
+	///
+	/// @return 归属类型
+	default AuthOwnerType getOwnerType() {
+		return AuthOwnerType.MODULE;
+	}
+
+	/// 归属 ID
+	///
+	/// @return 归属 ID
+	default String getOwnerId() {
+		return getModuleCode().name();
+	}
 }

src/main/java/com/imyeyu/api/modules/user/bean/BuiltinRoleCode.java

@@ -28,4 +28,18 @@ public interface BuiltinRoleCode {
 	///
 	/// @return 父角色代码
 	String getParentCode();
+
+	/// 归属类型
+	///
+	/// @return 归属类型
+	default AuthOwnerType getOwnerType() {
+		return AuthOwnerType.MODULE;
+	}
+
+	/// 归属 ID
+	///
+	/// @return 归属 ID
+	default String getOwnerId() {
+		return getModuleCode().name();
+	}
 }

src/main/java/com/imyeyu/api/modules/user/controller/PermissionController.java

@@ -1,12 +1,12 @@
 package com.imyeyu.api.modules.user.controller;
 
 import com.imyeyu.api.annotation.RequireCorePermission;
-import com.imyeyu.api.annotation.RequireCoreRole;
 import com.imyeyu.api.bean.CorePermissionCode;
-import com.imyeyu.api.bean.CoreRoleCode;
+import com.imyeyu.api.bean.ModuleCode;
-import com.imyeyu.api.bean.RoleMatchMode;
 import com.imyeyu.api.modules.user.entity.Permission;
+import com.imyeyu.api.modules.user.service.AuthorizationScopeService;
 import com.imyeyu.api.modules.user.service.PermissionService;
+import com.imyeyu.api.modules.user.service.UserLoginService;
 import com.imyeyu.api.modules.user.vo.permission.BatchCreateReq;
 import com.imyeyu.spring.annotation.AOPLog;
 import com.imyeyu.spring.bean.Page;
@@ -19,6 +19,8 @@ import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.RestController;
 
+import java.util.List;
+
 /**
  * 权限 SDK 控制器
  *
@@ -32,16 +34,22 @@ import org.springframework.web.bind.annotation.RestController;
 public class PermissionController {
 
 	private final PermissionService service;
+	private final UserLoginService userLoginService;
+	private final AuthorizationScopeService authorizationScopeService;
 
-	@RequireCoreRole(value = {CoreRoleCode.ADMIN, CoreRoleCode.USER_ROLE_ADMIN}, mode = RoleMatchMode.ANY)
 	@RequireCorePermission(CorePermissionCode.PERMISSION_READ)
 	@PostMapping("/list")
 	public PageResult<Permission> list(@RequestBody Page<Permission> page) {
 		return service.page(page);
 	}
 
+	@RequireCorePermission(CorePermissionCode.ROLE_PERMISSION_READ)
+	@PostMapping("/grantable/list")
+	public List<Permission> listGrantable(@RequestParam ModuleCode moduleCode) {
+		return authorizationScopeService.listGrantablePermission(userLoginService.getRequireLoginUserId(), moduleCode);
+	}
+
 	@AOPLog
-	@RequireCoreRole(CoreRoleCode.ADMIN)
 	@RequireCorePermission(CorePermissionCode.PERMISSION_READ)
 	@PostMapping("/create")
 	public void create(@RequestBody Permission permission) {
@@ -49,7 +57,6 @@ public class PermissionController {
 	}
 
 	@AOPLog
-	@RequireCoreRole(CoreRoleCode.ADMIN)
 	@RequireCorePermission(CorePermissionCode.PERMISSION_CREATE)
 	@PostMapping("/create/batch")
 	public void createBatch(@RequestBody BatchCreateReq req) {
@@ -57,7 +64,6 @@ public class PermissionController {
 	}
 
 	@AOPLog
-	@RequireCoreRole(CoreRoleCode.ADMIN)
 	@RequireCorePermission(CorePermissionCode.PERMISSION_UPDATE)
 	@PostMapping("/update")
 	public void update(@RequestBody Permission permission) {
@@ -65,7 +71,6 @@ public class PermissionController {
 	}
 
 	@AOPLog
-	@RequireCoreRole(CoreRoleCode.ADMIN)
 	@RequireCorePermission(CorePermissionCode.PERMISSION_DELETE)
 	@PostMapping("/delete")
 	public void delete(@RequestParam("id") String id) {

src/main/java/com/imyeyu/api/modules/user/controller/RoleController.java

@@ -1,18 +1,19 @@
 package com.imyeyu.api.modules.user.controller;
 
 import com.imyeyu.api.annotation.RequireCorePermission;
-import com.imyeyu.api.annotation.RequireCoreRole;
 import com.imyeyu.api.bean.CorePermissionCode;
-import com.imyeyu.api.bean.CoreRoleCode;
 import com.imyeyu.api.bean.ModuleCode;
-import com.imyeyu.api.bean.RoleMatchMode;
 import com.imyeyu.api.modules.user.entity.Permission;
 import com.imyeyu.api.modules.user.entity.Role;
 import com.imyeyu.api.modules.user.service.PermissionService;
 import com.imyeyu.api.modules.user.service.RoleService;
+import com.imyeyu.api.modules.user.service.UserLoginService;
 import com.imyeyu.api.modules.user.service.UserRoleService;
 import com.imyeyu.api.modules.user.vo.role.UserRoleAuthorizeRequest;
+import com.imyeyu.java.bean.timi.TimiCode;
+import com.imyeyu.java.bean.timi.TimiException;
 import com.imyeyu.spring.annotation.AOPLog;
+import com.imyeyu.spring.annotation.RequiredToken;
 import com.imyeyu.spring.bean.Page;
 import com.imyeyu.spring.bean.PageResult;
 import lombok.RequiredArgsConstructor;
@@ -23,7 +24,10 @@ import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.RestController;
 
+import java.util.Arrays;
 import java.util.List;
+import java.util.Set;
+import java.util.stream.Collectors;
 
 /**
  * 角色 SDK 控制器
@@ -39,30 +43,52 @@ public class RoleController {
 
 	private final RoleService service;
 	private final UserRoleService userRoleService;
+	private final UserLoginService userLoginService;
 	private final PermissionService permissionService;
 
-	@RequireCoreRole(value = {CoreRoleCode.ADMIN, CoreRoleCode.USER_ROLE_ADMIN}, mode = RoleMatchMode.ANY)
 	@RequireCorePermission(CorePermissionCode.ROLE_READ)
 	@PostMapping("/list")
 	public PageResult<Role> list(@RequestBody Page<Role> page) {
+		Set<String> manageableRoleIdSet = listManageableRoleId();
 		PageResult<Role> result = service.page(page);
 		if (result.getList() != null) {
+			result.setList(result.getList().stream().filter(role -> manageableRoleIdSet.contains(role.getId())).toList());
 			result.getList().forEach(this::fillRoleDetail);
 		}
 		return result;
 	}
 
-	@RequireCoreRole(value = {CoreRoleCode.ADMIN, CoreRoleCode.USER_ROLE_ADMIN}, mode = RoleMatchMode.ANY)
+	@RequireCorePermission(CorePermissionCode.ROLE_READ)
+	@PostMapping("/manageable/list")
+	public List<Role> listManageableRole(@RequestParam ModuleCode moduleCode) {
+		return service.listManageableRole(moduleCode);
+	}
+
+	@RequireCorePermission(CorePermissionCode.USER_ROLE_READ)
+	@PostMapping("/grantable/list")
+	public List<Role> listGrantableRole(@RequestParam ModuleCode moduleCode) {
+		return service.listGrantableRole(moduleCode);
+	}
+
+	@RequiredToken
+	@PostMapping("/current/detail/list")
+	public List<Role> listCurrentRoleDetail(@RequestParam(required = false) ModuleCode moduleCode) {
+		String loginUserId = userLoginService.getRequireLoginUserId();
+		List<Role> roleList = moduleCode == null ? userRoleService.listRoleByUserId(loginUserId) : userRoleService.listRoleByUserId(moduleCode, loginUserId);
+		roleList.forEach(this::fillRoleDetail);
+		return roleList;
+	}
+
 	@RequireCorePermission(CorePermissionCode.ROLE_READ)
 	@PostMapping("/detail")
 	public Role detail(@RequestParam String id) {
 		Role role = service.get(id);
+		requireManageableRole(role.getId());
 		fillRoleDetail(role);
 		return role;
 	}
 
 	@AOPLog
-	@RequireCoreRole(CoreRoleCode.ADMIN)
 	@RequireCorePermission(CorePermissionCode.ROLE_CREATE)
 	@PostMapping("/create")
 	public void create(@RequestBody Role role) {
@@ -70,49 +96,110 @@ public class RoleController {
 	}
 
 	@AOPLog
-	@RequireCoreRole(CoreRoleCode.ADMIN)
 	@RequireCorePermission(CorePermissionCode.ROLE_UPDATE)
 	@PostMapping("/update")
 	public void update(@RequestBody Role role) {
 		service.update(role);
 	}
 
+	@RequireCorePermission(CorePermissionCode.ROLE_PERMISSION_READ)
+	@PostMapping("/permission/grantable/list")
+	public List<Permission> listGrantableRolePermission(@RequestParam String roleId) {
+		requireManageableRole(roleId);
+		return service.listGrantableRolePermission(roleId);
+	}
+
+	@RequireCorePermission(CorePermissionCode.ROLE_PERMISSION_READ)
+	@PostMapping("/delegation/list")
+	public List<Permission> listDelegationPermission(@RequestParam String roleId) {
+		requireManageableRole(roleId);
+		return service.listDelegationPermissionByRoleId(roleId);
+	}
+
+	@RequireCorePermission(CorePermissionCode.ROLE_PERMISSION_READ)
+	@PostMapping("/delegation/grantable/list")
+	public List<Permission> listGrantableDelegationPermission(@RequestParam String roleId) {
+		requireManageableRole(roleId);
+		return service.listGrantableDelegationPermission(roleId);
+	}
+
+	@AOPLog
+	@RequireCorePermission(value = {CorePermissionCode.ROLE_PERMISSION_CREATE, CorePermissionCode.ROLE_PERMISSION_DELETE})
+	@PostMapping("/delegation/update")
+	public void updateRoleDelegation(@RequestBody Role role) {
+		service.updateRoleDelegation(role);
+	}
+
+	@RequireCorePermission(CorePermissionCode.ROLE_READ)
+	@PostMapping("/parent/grantable/list")
+	public List<Role> listGrantableParentRole(@RequestParam String roleId) {
+		requireManageableRole(roleId);
+		return service.listGrantableParentRole(roleId);
+	}
+
+	@AOPLog
+	@RequireCorePermission(CorePermissionCode.ROLE_UPDATE)
+	@PostMapping("/parent/update")
+	public void updateRoleParent(@RequestBody Role role) {
+		service.updateRoleParent(role);
+	}
+
 	@AOPLog
-	@RequireCoreRole(CoreRoleCode.ADMIN)
 	@RequireCorePermission(CorePermissionCode.ROLE_DELETE)
 	@PostMapping("/delete")
 	public void delete(@RequestParam String id) {
 		service.delete(id);
 	}
 
-	@RequireCoreRole(value = {CoreRoleCode.ADMIN, CoreRoleCode.USER_ROLE_ADMIN}, mode = RoleMatchMode.ANY)
 	@RequireCorePermission(CorePermissionCode.USER_ROLE_READ)
 	@PostMapping("/authorized/list")
 	public List<Role> listUserRole(@RequestParam(required = false) ModuleCode moduleCode, @RequestParam String userId) {
+		Set<String> manageableRoleIdSet = listManageableRoleId();
 		if (moduleCode != null) {
-			return userRoleService.listRoleByUserId(moduleCode, userId);
+			return userRoleService.listRoleByUserId(moduleCode, userId).stream().filter(role -> manageableRoleIdSet.contains(role.getId())).toList();
 		}
-		return userRoleService.listRoleByUserId(userId);
+		return userRoleService.listRoleByUserId(userId).stream().filter(role -> manageableRoleIdSet.contains(role.getId())).toList();
 	}
 
 	@AOPLog
-	@RequireCoreRole(value = {CoreRoleCode.ADMIN, CoreRoleCode.USER_ROLE_ADMIN}, mode = RoleMatchMode.ANY)
 	@RequireCorePermission(value = {CorePermissionCode.USER_ROLE_CREATE, CorePermissionCode.USER_ROLE_DELETE})
 	@PostMapping("/authorized/create")
 	public void authorizeUserRole(@RequestBody UserRoleAuthorizeRequest req) {
 		userRoleService.authorizeUserRole(req);
 	}
 
-	@RequireCoreRole(value = {CoreRoleCode.ADMIN, CoreRoleCode.USER_ROLE_ADMIN}, mode = RoleMatchMode.ANY)
 	@RequireCorePermission(CorePermissionCode.USER_ROLE_READ)
 	@PostMapping("/authorized/permission")
 	public List<Permission> listAuthorizedPermission(@RequestParam String userId) {
-		return userRoleService.listAllPermissionByUserId(userId);
+		Set<String> manageableRoleIdSet = listManageableRoleId();
+		List<String> roleIdList = userRoleService.listRoleByUserId(userId)
+		                                         .stream()
+		                                         .filter(role -> manageableRoleIdSet.contains(role.getId()))
+		                                         .map(Role::getId)
+		                                         .toList();
+		return roleIdList.isEmpty() ? List.of() : permissionService.listByRoleId(service.listAllRoleIdIncludingChildren(roleIdList));
 	}
 
 	private void fillRoleDetail(Role role) {
 		role.setPermissionList(permissionService.listByRoleId(role.getId()));
 		role.setAllPermissionList(service.listPermissionByRoleId(role.getId()));
 		role.setChildRoleList(service.listChildByParentRoleId(role.getId()));
+		if (role.getParentRoleId() != null) {
+			role.setParentRole(service.get(role.getParentRoleId()));
+		}
+		role.setDelegationPermissionList(service.listDelegationPermissionByRoleId(role.getId()));
+	}
+
+	private Set<String> listManageableRoleId() {
+		return Arrays.stream(ModuleCode.values())
+		             .flatMap(moduleCode -> service.listManageableRole(moduleCode).stream())
+		             .map(Role::getId)
+		             .collect(Collectors.toSet());
+	}
+
+	private void requireManageableRole(String roleId) {
+		if (!listManageableRoleId().contains(roleId)) {
+			throw new TimiException(TimiCode.PERMISSION_ERROR);
+		}
 	}
 }

src/main/java/com/imyeyu/api/modules/user/controller/UserController.java

@@ -2,9 +2,7 @@ package com.imyeyu.api.modules.user.controller;
 
 import com.fasterxml.jackson.annotation.JsonView;
 import com.imyeyu.api.annotation.RequireCorePermission;
-import com.imyeyu.api.annotation.RequireCoreRole;
 import com.imyeyu.api.bean.CorePermissionCode;
-import com.imyeyu.api.bean.CoreRoleCode;
 import com.imyeyu.api.modules.common.entity.Attachment;
 import com.imyeyu.api.modules.common.service.AttachmentService;
 import com.imyeyu.api.modules.user.entity.User;
@@ -56,7 +54,6 @@ public class UserController {
 	private final UserLoginService userLoginService;
 	private final AttachmentService attachmentService;
 
-	@RequireCoreRole(CoreRoleCode.ADMIN)
 	@RequestRateLimit
 	@RequireCorePermission(CorePermissionCode.USER_READ)
 	@PostMapping("/list")
@@ -65,7 +62,6 @@ public class UserController {
 	}
 
 	@AOPLog
-	@RequireCoreRole(CoreRoleCode.ADMIN)
 	@RequestRateLimit
 	@RequireCorePermission(CorePermissionCode.USER_READ)
 	@RequestMapping("/detail")
@@ -74,7 +70,6 @@ public class UserController {
 	}
 
 	@AOPLog
-	@RequireCoreRole(CoreRoleCode.ADMIN)
 	@RequestRateLimit
 	@RequireCorePermission(CorePermissionCode.USER_CREATE)
 	@PostMapping("/create")
@@ -83,7 +78,6 @@ public class UserController {
 	}
 
 	@AOPLog
-	@RequireCoreRole(CoreRoleCode.ADMIN)
 	@RequestRateLimit
 	@RequireCorePermission(CorePermissionCode.USER_UPDATE)
 	@PostMapping("/update")
@@ -92,7 +86,6 @@ public class UserController {
 	}
 
 	@AOPLog
-	@RequireCoreRole(CoreRoleCode.ADMIN)
 	@RequestRateLimit
 	@RequestMapping("/delete")
 	public void delete(@RequestParam String id) {
@@ -125,6 +118,7 @@ public class UserController {
 	@AOPLog
 	@JsonView(ResponseView.Public.class)
 	@RequestRateLimit
+	@CaptchaValid
 	@PostMapping("/login")
 	public LoginResponse login(@RequestBody @Valid CaptchaData<LoginRequest> req) {
 		return userLoginService.login(req.getData());

src/main/java/com/imyeyu/api/modules/user/entity/Permission.java

@@ -2,6 +2,7 @@ package com.imyeyu.api.modules.user.entity;
 
 import com.imyeyu.api.annotation.MultilingualField;
 import com.imyeyu.api.bean.ModuleCode;
+import com.imyeyu.api.modules.user.bean.AuthOwnerType;
 import com.imyeyu.spring.annotation.table.Transient;
 import com.imyeyu.spring.entity.UUIDEntity;
 import lombok.Data;
@@ -29,6 +30,21 @@ public class Permission extends UUIDEntity {
 	/** 说明 */
 	private String description;
 
+	/// true 为系统内置权限
+	private Boolean builtin;
+
+	/// true 为受保护权限
+	private Boolean protectedPermission;
+
+	/// 归属类型
+	private AuthOwnerType ownerType;
+
+	/// 归属 ID
+	private String ownerId;
+
+	/// 创建人用户 ID
+	private String createdBy;
+
 	@Transient
 	@MultilingualField("nameLangId")
 	private String name;

src/main/java/com/imyeyu/api/modules/user/entity/Role.java

@@ -2,6 +2,7 @@ package com.imyeyu.api.modules.user.entity;
 
 import com.imyeyu.api.annotation.MultilingualField;
 import com.imyeyu.api.bean.ModuleCode;
+import com.imyeyu.api.modules.user.bean.AuthOwnerType;
 import com.imyeyu.spring.annotation.table.Transient;
 import com.imyeyu.spring.entity.UUIDEntity;
 import lombok.Data;
@@ -32,6 +33,24 @@ public class Role extends UUIDEntity {
 	/** 说明 */
 	private String description;
 
+	/// true 为系统内置角色
+	private Boolean builtin;
+
+	/// true 为受保护角色
+	private Boolean protectedRole;
+
+	/// 管理父角色 ID
+	private String parentRoleId;
+
+	/// 归属类型
+	private AuthOwnerType ownerType;
+
+	/// 归属 ID
+	private String ownerId;
+
+	/// 创建人用户 ID
+	private String createdBy;
+
 	@Transient
 	@MultilingualField("nameLangId")
 	private String name;
@@ -48,6 +67,14 @@ public class Role extends UUIDEntity {
 	@Transient
 	protected List<Role> childRoleList;
 
+	/// 管理父角色
+	@Transient
+	protected Role parentRole;
+
+	/// 角色允许继续转授的权限列表
+	@Transient
+	protected List<Permission> delegationPermissionList;
+
 	/** 权限 ID 列表 */
 	@Transient
 	protected Set<String> permissionIdList;
@@ -55,4 +82,8 @@ public class Role extends UUIDEntity {
 	/** 子角色 ID 列表 */
 	@Transient
 	protected Set<String> childRoleIdList;
+
+	/// 转授权限 ID 列表
+	@Transient
+	protected Set<String> delegationPermissionIdList;
 }

src/main/java/com/imyeyu/api/modules/user/entity/RolePermissionDelegation.java

@@ -0,0 +1,45 @@
+package com.imyeyu.api.modules.user.entity;
+
+import com.imyeyu.spring.annotation.table.AutoUUID;
+import com.imyeyu.spring.annotation.table.DeleteColumn;
+import com.imyeyu.spring.annotation.table.Id;
+import com.imyeyu.spring.annotation.table.Transient;
+import com.imyeyu.spring.entity.Creatable;
+import com.imyeyu.spring.entity.Deletable;
+import com.imyeyu.spring.entity.IDEntity;
+import lombok.Data;
+
+/// 角色转授权限
+///
+/// @author Codex
+/// @since 2026-08-08
+@Data
+public class RolePermissionDelegation implements IDEntity<String>, Creatable, Deletable {
+
+	/// 主键
+	@Id
+	@AutoUUID
+	protected String id;
+
+	/// 角色 ID
+	protected String roleId;
+
+	/// 权限 ID
+	protected String permissionId;
+
+	/// 创建人用户 ID
+	protected String createdBy;
+
+	/// 创建时间
+	protected Long createdAt;
+
+	/// 删除时间
+	@DeleteColumn
+	protected Long deletedAt;
+
+	@Transient
+	protected Role role;
+
+	@Transient
+	protected Permission permission;
+}

src/main/java/com/imyeyu/api/modules/user/entity/RolePermissionInherit.java

@@ -1,5 +1,6 @@
 package com.imyeyu.api.modules.user.entity;
 
+import com.imyeyu.api.modules.user.bean.AuthOwnerType;
 import com.imyeyu.spring.annotation.table.AutoUUID;
 import com.imyeyu.spring.annotation.table.DeleteColumn;
 import com.imyeyu.spring.annotation.table.Id;
@@ -8,30 +9,37 @@ import com.imyeyu.spring.entity.Deletable;
 import com.imyeyu.spring.entity.IDEntity;
 import lombok.Data;
 
-/**
+/// 角色权限继承
- * 角色关联
+///
- *
+/// @author 夜雨
- * @author 夜雨
+/// @since 2026-05-13 14:40
- * @since 2026-05-13 14:40
- */
 @Data
-public class RoleRelation implements IDEntity<String>, Creatable, Deletable {
+public class RolePermissionInherit implements IDEntity<String>, Creatable, Deletable {
 
-	/** 主键 */
+	/// 主键
 	@Id
 	@AutoUUID
 	private String id;
 
-	/** 上级角色 ID */
+	/// 继承方角色 ID
 	private String parentRoleId;
 
-	/** 子级角色 ID */
+	/// 被继承角色 ID
 	private String childRoleId;
 
-	/** 创建时间 */
+	/// 归属类型
+	private AuthOwnerType ownerType;
+
+	/// 归属 ID
+	private String ownerId;
+
+	/// 创建人用户 ID
+	private String createdBy;
+
+	/// 创建时间
 	private Long createdAt;
 
-	/** 删除时间 */
+	/// 删除时间
 	@DeleteColumn
 	private Long deletedAt;
 }

src/main/java/com/imyeyu/api/modules/user/mapper/PermissionMapper.java

@@ -2,6 +2,8 @@ package com.imyeyu.api.modules.user.mapper;
 
 import com.imyeyu.api.modules.user.entity.Permission;
 import com.imyeyu.spring.mapper.BaseMapper;
+import com.imyeyu.api.bean.ModuleCode;
+import org.apache.ibatis.annotations.Param;
 
 import java.util.List;
 
@@ -13,5 +15,7 @@ import java.util.List;
  */
 public interface PermissionMapper extends BaseMapper<Permission, String> {
 
-	List<Permission> selectByIdList(List<String> list);
+	List<Permission> selectByIdList(@Param("idList") List<String> idList);
+
+	List<Permission> selectByModuleCode(@Param("moduleCode") ModuleCode moduleCode);
 }

src/main/java/com/imyeyu/api/modules/user/mapper/RoleMapper.java

@@ -3,6 +3,7 @@ package com.imyeyu.api.modules.user.mapper;
 import com.imyeyu.api.bean.ModuleCode;
 import com.imyeyu.api.modules.user.entity.Role;
 import com.imyeyu.spring.mapper.BaseMapper;
+import org.apache.ibatis.annotations.Param;
 
 import java.util.Collection;
 import java.util.List;
@@ -15,7 +16,13 @@ import java.util.List;
  */
 public interface RoleMapper extends BaseMapper<Role, String> {
 
-	List<Role> selectByIdList(Collection<String> idList);
+	Role selectById(String id);
 
-	List<Role> selectByModuleCode(ModuleCode moduleCode);
+	List<Role> selectByIdList(@Param("idList") Collection<String> idList);
+
+	List<Role> selectByModuleCode(@Param("moduleCode") ModuleCode moduleCode);
+
+	List<Role> selectByParentRoleId(@Param("parentRoleId") String parentRoleId);
+
+	List<Role> selectAll();
 }

src/main/java/com/imyeyu/api/modules/user/mapper/RolePermissionDelegationMapper.java

@@ -0,0 +1,27 @@
+package com.imyeyu.api.modules.user.mapper;
+
+import com.imyeyu.api.modules.user.entity.Permission;
+import com.imyeyu.api.modules.user.entity.RolePermissionDelegation;
+import com.imyeyu.spring.mapper.BaseMapper;
+import org.apache.ibatis.annotations.Param;
+
+import java.util.List;
+
+/// 角色转授权限 Mapper
+///
+/// @author Codex
+/// @since 2026-08-08
+public interface RolePermissionDelegationMapper extends BaseMapper<RolePermissionDelegation, String> {
+
+	default List<RolePermissionDelegation> selectByRoleId(String roleId) {
+		return selectByRoleIdList(List.of(roleId));
+	}
+
+	List<RolePermissionDelegation> selectByRoleIdList(@Param("roleIdList") List<String> roleIdList);
+
+	List<Permission> selectPermissionByRoleIdList(@Param("roleIdList") List<String> roleIdList);
+
+	void createBatch(@Param("rolePermissionDelegationList") List<RolePermissionDelegation> rolePermissionDelegationList);
+
+	void deleteByPermissionIdList(@Param("roleId") String roleId, @Param("permissionIdList") List<String> permissionIdList);
+}

src/main/java/com/imyeyu/api/modules/user/mapper/RolePermissionInheritMapper.java

@@ -0,0 +1,32 @@
+package com.imyeyu.api.modules.user.mapper;
+
+import com.imyeyu.api.modules.user.bean.AuthOwnerType;
+import com.imyeyu.api.modules.user.entity.RolePermissionInherit;
+import com.imyeyu.spring.mapper.BaseMapper;
+import org.apache.ibatis.annotations.Param;
+
+import java.util.List;
+
+/// 角色权限继承 Mapper
+///
+/// @author 夜雨
+/// @since 2026-05-13 14:46
+public interface RolePermissionInheritMapper extends BaseMapper<RolePermissionInherit, String> {
+
+	List<RolePermissionInherit> selectByParentRoleId(@Param("parentRoleId") String parentRoleId);
+
+	List<String> selectChildRoleIdListByParentRoleId(@Param("parentRoleId") String parentRoleId);
+
+	List<RolePermissionInherit> selectByParentRoleIdList(@Param("parentRoleIdList") List<String> parentRoleIdList);
+
+	List<String> selectChildRoleIdListByParentRoleIdList(@Param("parentRoleIdList") List<String> parentRoleIdList);
+
+	void createBatch(@Param("rolePermissionInheritList") List<RolePermissionInherit> rolePermissionInheritList);
+
+	void deleteByChildRoleIdList(
+		@Param("parentRoleId") String parentRoleId,
+		@Param("childRoleIdList") List<String> childRoleIdList,
+		@Param("ownerType") AuthOwnerType ownerType,
+		@Param("ownerId") String ownerId
+	);
+}

src/main/java/com/imyeyu/api/modules/user/mapper/RolePermissionMapper.java

@@ -3,6 +3,7 @@ package com.imyeyu.api.modules.user.mapper;
 import com.imyeyu.api.modules.user.entity.Permission;
 import com.imyeyu.api.modules.user.entity.RolePermission;
 import com.imyeyu.spring.mapper.BaseMapper;
+import org.apache.ibatis.annotations.Param;
 
 import java.util.List;
 
@@ -18,11 +19,11 @@ public interface RolePermissionMapper extends BaseMapper<RolePermission, String>
 		return selectByRoleIdList(List.of(roleId));
 	}
 
-	List<RolePermission> selectByRoleIdList(List<String> roleIdList);
+	List<RolePermission> selectByRoleIdList(@Param("roleIdList") List<String> roleIdList);
 
-	List<Permission> selectPermissionByRoleIdList(List<String> roleIdList);
+	List<Permission> selectPermissionByRoleIdList(@Param("roleIdList") List<String> roleIdList);
 
-	void createBatch(List<RolePermission> rolePermissionList);
+	void createBatch(@Param("rolePermissionList") List<RolePermission> rolePermissionList);
 
-	void deleteByPermissionIdList(String roleId, List<String> permissionIdList);
+	void deleteByPermissionIdList(@Param("roleId") String roleId, @Param("permissionIdList") List<String> permissionIdList);
 }

src/main/java/com/imyeyu/api/modules/user/mapper/RoleRelationMapper.java

@@ -1,25 +0,0 @@
-package com.imyeyu.api.modules.user.mapper;
-
-import com.imyeyu.api.modules.user.entity.RoleRelation;
-import com.imyeyu.spring.mapper.BaseMapper;
-
-import java.util.List;
-
-/**
- * 角色关联 Mapper
- *
- * @author 夜雨
- * @since 2026-05-13 14:46
- */
-public interface RoleRelationMapper extends BaseMapper<RoleRelation, String> {
-
-	List<RoleRelation> selectByParentRoleId(String parentRoleId);
-
-	List<String> selectChildRoleIdListByParentRoleId(String parentRoleId);
-
-	List<String> selectChildRoleIdListByParentRoleIdList(List<String> parentRoleIdList);
-
-	void createBatch(List<RoleRelation> roleRelationList);
-
-	void deleteByChildRoleIdList(String parentRoleId, List<String> childRoleIdList);
-}

src/main/java/com/imyeyu/api/modules/user/mapper/UserRoleMapper.java

@@ -19,5 +19,5 @@ public interface UserRoleMapper extends BaseMapper<UserRole, String> {
 
 	List<UserRole> selectByUserIdList(@Param("userIdList") Collection<String> userIdList);
 
-	void deleteByRoleIdList(String userId, List<String> roleIdList);
+	void deleteByRoleIdList(@Param("userId") String userId, @Param("roleIdList") List<String> roleIdList);
 }

src/main/java/com/imyeyu/api/modules/user/service/AuthorizationBoundaryService.java

@@ -0,0 +1,79 @@
+package com.imyeyu.api.modules.user.service;
+
+import com.imyeyu.api.modules.user.entity.Role;
+
+import java.util.Collection;
+
+/// 授权边界服务
+///
+/// @author Codex
+/// @since 2026-08-07
+public interface AuthorizationBoundaryService {
+
+	/// 校验是否可以授予用户角色
+	///
+	/// @param operatorUserId 操作者用户 ID
+	/// @param targetUserId 目标用户 ID
+	/// @param roleIdList 角色 ID 列表
+	void checkCanGrantRoles(String operatorUserId, String targetUserId, Collection<String> roleIdList);
+
+	/// 校验是否可以移除用户角色
+	///
+	/// @param operatorUserId 操作者用户 ID
+	/// @param targetUserId 目标用户 ID
+	/// @param roleIdList 角色 ID 列表
+	void checkCanRevokeRoles(String operatorUserId, String targetUserId, Collection<String> roleIdList);
+
+	/// 校验是否可以创建角色
+	///
+	/// @param operatorUserId 操作者用户 ID
+	/// @param role 角色
+	void checkCanCreateRole(String operatorUserId, Role role);
+
+	/// 校验是否可以修改角色基础信息
+	///
+	/// @param operatorUserId 操作者用户 ID
+	/// @param role 角色
+	void checkCanUpdateRole(String operatorUserId, Role role);
+
+	/// 校验是否可以删除角色
+	///
+	/// @param operatorUserId 操作者用户 ID
+	/// @param roleId 角色 ID
+	void checkCanDeleteRole(String operatorUserId, String roleId);
+
+	/// 校验是否可以授予角色权限
+	///
+	/// @param operatorUserId 操作者用户 ID
+	/// @param roleId 角色 ID
+	/// @param permissionIdList 权限 ID 列表
+	void checkCanGrantPermissions(String operatorUserId, String roleId, Collection<String> permissionIdList);
+
+	/// 校验是否可以移除角色权限
+	///
+	/// @param operatorUserId 操作者用户 ID
+	/// @param roleId 角色 ID
+	/// @param permissionIdList 权限 ID 列表
+	void checkCanRevokePermissions(String operatorUserId, String roleId, Collection<String> permissionIdList);
+
+	/// 校验是否可以修改角色转授权限
+	///
+	/// @param operatorUserId 操作者用户 ID
+	/// @param roleId 角色 ID
+	/// @param permissionIdList 转授权限 ID 列表
+	void checkCanUpdateRoleDelegation(String operatorUserId, String roleId, Collection<String> permissionIdList);
+
+	/// 校验是否可以更新角色管理父级
+	///
+	/// @param operatorUserId 操作者用户 ID
+	/// @param roleId 角色 ID
+	/// @param parentRoleId 管理父角色 ID
+	void checkCanUpdateRoleParent(String operatorUserId, String roleId, String parentRoleId);
+
+	/// 校验是否可以更新角色继承关系
+	///
+	/// @param operatorUserId 操作者用户 ID
+	/// @param parentRoleId 父角色 ID
+	/// @param childRoleIdList 子角色 ID 列表
+	void checkCanUpdateRolePermissionInherits(String operatorUserId, String parentRoleId, Collection<String> childRoleIdList);
+}

src/main/java/com/imyeyu/api/modules/user/service/AuthorizationScopeService.java

@@ -0,0 +1,42 @@
+package com.imyeyu.api.modules.user.service;
+
+import com.imyeyu.api.bean.ModuleCode;
+import com.imyeyu.api.modules.user.entity.Permission;
+import com.imyeyu.api.modules.user.entity.Role;
+
+import java.util.List;
+
+/// 授权范围服务
+///
+/// @author Codex
+/// @since 2026-08-07
+public interface AuthorizationScopeService {
+
+	/// 查询可授权角色
+	///
+	/// @param operatorUserId 操作者用户 ID
+	/// @param moduleCode 模块代码
+	/// @return 角色列表
+	List<Role> listGrantableRole(String operatorUserId, ModuleCode moduleCode);
+
+	/// 查询可授权权限
+	///
+	/// @param operatorUserId 操作者用户 ID
+	/// @param moduleCode 模块代码
+	/// @return 权限列表
+	List<Permission> listGrantablePermission(String operatorUserId, ModuleCode moduleCode);
+
+	/// 查询可管理角色
+	///
+	/// @param operatorUserId 操作者用户 ID
+	/// @param moduleCode 模块代码
+	/// @return 角色列表
+	List<Role> listManageableRole(String operatorUserId, ModuleCode moduleCode);
+
+	/// 判断是否为系统管理员
+	///
+	/// @param operatorUserId 操作者用户 ID
+	/// @return true 为系统管理员
+	boolean isSystemAdmin(String operatorUserId);
+
+}

src/main/java/com/imyeyu/api/modules/user/service/ModuleResourceScopeResolver.java

@@ -0,0 +1,39 @@
+package com.imyeyu.api.modules.user.service;
+
+import com.imyeyu.api.bean.ModuleCode;
+import com.imyeyu.api.modules.user.bean.AuthOwnerType;
+import com.imyeyu.api.modules.user.entity.Role;
+
+/// 模块资源范围解析器
+///
+/// @author Codex
+/// @since 2026-08-07
+public interface ModuleResourceScopeResolver {
+
+	/// 模块代码
+	///
+	/// @return 模块代码
+	ModuleCode moduleCode();
+
+	/// 判断是否可以管理目标用户
+	///
+	/// @param operatorUserId 操作者用户 ID
+	/// @param targetUserId 目标用户 ID
+	/// @return true 为可以管理
+	boolean canManageUser(String operatorUserId, String targetUserId);
+
+	/// 判断是否可以管理角色
+	///
+	/// @param operatorUserId 操作者用户 ID
+	/// @param role 角色
+	/// @return true 为可以管理
+	boolean canManageRole(String operatorUserId, Role role);
+
+	/// 判断是否可以使用指定归属范围
+	///
+	/// @param operatorUserId 操作者用户 ID
+	/// @param ownerType 归属类型
+	/// @param ownerId 归属 ID
+	/// @return true 为可以使用
+	boolean canUseOwnerScope(String operatorUserId, AuthOwnerType ownerType, String ownerId);
+}

src/main/java/com/imyeyu/api/modules/user/service/PermissionService.java

@@ -2,6 +2,7 @@ package com.imyeyu.api.modules.user.service;
 
 import com.imyeyu.api.modules.user.entity.Permission;
 import com.imyeyu.api.modules.user.vo.permission.BatchCreateReq;
+import com.imyeyu.api.bean.ModuleCode;
 import com.imyeyu.spring.service.BaseService;
 
 import java.util.List;
@@ -30,4 +31,10 @@ public interface PermissionService extends BaseService<Permission, String> {
 	/// @param roleIdList 角色 ID 列表
 	/// @return 权限列表
 	List<Permission> listByRoleId(List<String> roleIdList);
+
+	/// 查询模块权限
+	///
+	/// @param moduleCode 模块代码
+	/// @return 权限列表
+	List<Permission> listByModuleCode(ModuleCode moduleCode);
 }

src/main/java/com/imyeyu/api/modules/user/service/RoleHierarchyService.java

@@ -0,0 +1,39 @@
+package com.imyeyu.api.modules.user.service;
+
+import java.util.Collection;
+import java.util.List;
+
+/// 角色继承服务
+///
+/// @author Codex
+/// @since 2026-08-07
+public interface RoleHierarchyService {
+
+	/// 递归查询角色及其系统、模块作用域内的所有子角色 ID
+	///
+	/// 此方法不依赖用户资源范围，不会展开门店、用户等需要操作者上下文的作用域关系
+	///
+	/// @param roleIdList 角色 ID 列表
+	/// @return 角色 ID 列表
+	List<String> listAllRoleIdIncludingChildren(Collection<String> roleIdList);
+
+	/// 递归查询用户作用域内的角色及其所有子角色 ID
+	///
+	/// @param userId 用户 ID
+	/// @param roleIdList 角色 ID 列表
+	/// @return 角色 ID 列表
+	List<String> listAllRoleIdIncludingChildren(String userId, Collection<String> roleIdList);
+
+	/// 校验角色继承关系不存在环
+	///
+	/// @param parentRoleId 父角色 ID
+	/// @param childRoleIdList 子角色 ID 列表
+	void checkNoCycle(String parentRoleId, Collection<String> childRoleIdList);
+
+	/// 判断目标角色是否为子孙角色
+	///
+	/// @param parentRoleId 父角色 ID
+	/// @param childRoleId 子角色 ID
+	/// @return true 为子孙角色
+	boolean isDescendant(String parentRoleId, String childRoleId);
+}

src/main/java/com/imyeyu/api/modules/user/service/RolePermissionInheritService.java

@@ -0,0 +1,31 @@
+package com.imyeyu.api.modules.user.service;
+
+import com.imyeyu.api.modules.user.entity.RolePermissionInherit;
+import com.imyeyu.spring.service.BaseService;
+
+import java.util.List;
+
+/// 角色权限继承服务
+///
+/// @author 夜雨
+/// @since 2026-05-13 14:46
+public interface RolePermissionInheritService extends BaseService<RolePermissionInherit, String> {
+
+	/// 查询直属权限继承
+	///
+	/// @param parentRoleId 继承方角色 ID
+	/// @return 权限继承列表
+	List<RolePermissionInherit> listByParentRoleId(String parentRoleId);
+
+	/// 查询直属被继承角色 ID 列表
+	///
+	/// @param parentRoleId 继承方角色 ID
+	/// @return 被继承角色 ID 列表
+	List<String> listChildRoleIdByParentRoleId(String parentRoleId);
+
+	/// 递归展开全部被继承角色 ID
+	///
+	/// @param parentRoleIdList 继承方角色 ID 列表
+	/// @return 全部被继承角色 ID 列表
+	List<String> listAllChildRoleIdByParentRoleIdList(List<String> parentRoleIdList);
+}

src/main/java/com/imyeyu/api/modules/user/service/RoleRelationService.java

@@ -1,31 +0,0 @@
-package com.imyeyu.api.modules.user.service;
-
-import com.imyeyu.api.modules.user.entity.RoleRelation;
-import com.imyeyu.spring.service.BaseService;
-
-import java.util.List;
-
-/// 角色继承关系服务
-///
-/// @author 夜雨
-/// @since 2026-05-13 14:46
-public interface RoleRelationService extends BaseService<RoleRelation, String> {
-
-	/// 查询直属子角色关联
-	///
-	/// @param parentRoleId 父角色 ID
-	/// @return 角色关联列表
-	List<RoleRelation> listByParentRoleId(String parentRoleId);
-
-	/// 查询直属子角色 ID 列表
-	///
-	/// @param parentRoleId 父角色 ID
-	/// @return 子角色 ID 列表
-	List<String> listChildRoleIdByParentRoleId(String parentRoleId);
-
-	/// 递归展开全部子角色 ID
-	///
-	/// @param parentRoleIdList 父角色 ID 列表
-	/// @return 全部子角色 ID 列表
-	List<String> listAllChildRoleIdByParentRoleIdList(List<String> parentRoleIdList);
-}

src/main/java/com/imyeyu/api/modules/user/service/RoleService.java

@@ -22,6 +22,18 @@ public interface RoleService extends BaseService<Role, String> {
 
 	List<Role> listByIdList(Collection<String> idList);
 
+	/// 查询当前用户可管理的模块角色
+	///
+	/// @param moduleCode 模块代码
+	/// @return 角色列表
+	List<Role> listManageableRole(ModuleCode moduleCode);
+
+	/// 查询当前用户可授权给账号的模块角色
+	///
+	/// @param moduleCode 模块代码
+	/// @return 角色列表
+	List<Role> listGrantableRole(ModuleCode moduleCode);
+
 	/// 查询直属子角色
 	///
 	/// @param parentRoleId 父角色 ID
@@ -34,6 +46,40 @@ public interface RoleService extends BaseService<Role, String> {
 	/// @return 权限列表
 	List<Permission> listPermissionByRoleId(String roleId);
 
+	/// 查询可配置给目标角色的直接权限
+	///
+	/// @param roleId 角色 ID
+	/// @return 权限列表
+	List<Permission> listGrantableRolePermission(String roleId);
+
+	/// 查询角色转授权限
+	///
+	/// @param roleId 角色 ID
+	/// @return 权限列表
+	List<Permission> listDelegationPermissionByRoleId(String roleId);
+
+	/// 查询可配置给目标角色的转授权限
+	///
+	/// @param roleId 角色 ID
+	/// @return 权限列表
+	List<Permission> listGrantableDelegationPermission(String roleId);
+
+	/// 修改角色转授权限
+	///
+	/// @param role 角色
+	void updateRoleDelegation(Role role);
+
+	/// 查询可配置给目标角色的管理父级角色
+	///
+	/// @param roleId 角色 ID
+	/// @return 角色列表
+	List<Role> listGrantableParentRole(String roleId);
+
+	/// 修改角色管理父级
+	///
+	/// @param role 角色
+	void updateRoleParent(Role role);
+
 	/// 递归获取角色及其所有子角色的 ID 列表
 	///
 	/// @param idList 角色 ID 列表

src/main/java/com/imyeyu/api/modules/user/service/implement/AuthorizationBoundaryServiceImplement.java

@@ -0,0 +1,378 @@
+package com.imyeyu.api.modules.user.service.implement;
+
+import com.imyeyu.api.bean.CorePermissionCode;
+import com.imyeyu.api.bean.CoreRoleCode;
+import com.imyeyu.api.bean.ModuleCode;
+import com.imyeyu.api.modules.user.bean.AuthOwnerType;
+import com.imyeyu.api.modules.user.entity.Permission;
+import com.imyeyu.api.modules.user.entity.Role;
+import com.imyeyu.api.modules.user.entity.UserRole;
+import com.imyeyu.api.modules.user.mapper.PermissionMapper;
+import com.imyeyu.api.modules.user.mapper.RoleMapper;
+import com.imyeyu.api.modules.user.mapper.RolePermissionDelegationMapper;
+import com.imyeyu.api.modules.user.mapper.RolePermissionMapper;
+import com.imyeyu.api.modules.user.mapper.UserRoleMapper;
+import com.imyeyu.api.modules.user.service.AuthorizationBoundaryService;
+import com.imyeyu.api.modules.user.service.AuthorizationScopeService;
+import com.imyeyu.api.modules.user.service.ModuleResourceScopeResolver;
+import com.imyeyu.api.modules.user.service.RoleHierarchyService;
+import com.imyeyu.java.TimiJava;
+import com.imyeyu.java.bean.timi.TimiCode;
+import com.imyeyu.java.bean.timi.TimiException;
+import lombok.RequiredArgsConstructor;
+import org.springframework.stereotype.Service;
+
+import java.util.Collection;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+import java.util.function.Function;
+import java.util.stream.Collectors;
+
+/// 授权边界服务实现
+///
+/// @author Codex
+/// @since 2026-08-07
+@Service
+@RequiredArgsConstructor
+public class AuthorizationBoundaryServiceImplement implements AuthorizationBoundaryService {
+
+	private final RoleMapper roleMapper;
+	private final UserRoleMapper userRoleMapper;
+	private final PermissionMapper permissionMapper;
+	private final RolePermissionMapper rolePermissionMapper;
+	private final RolePermissionDelegationMapper rolePermissionDelegationMapper;
+	private final AuthorizationScopeService authorizationScopeService;
+	private final RoleHierarchyService roleHierarchyService;
+	private final List<ModuleResourceScopeResolver> moduleResourceScopeResolverList;
+
+	@Override
+	public void checkCanGrantRoles(String operatorUserId, String targetUserId, Collection<String> roleIdList) {
+		if (TimiJava.isEmpty(roleIdList)) {
+			return;
+		}
+		checkCorePermission(operatorUserId, CorePermissionCode.USER_ROLE_CREATE);
+		if (authorizationScopeService.isSystemAdmin(operatorUserId)) {
+			return;
+		}
+		List<Role> roleList = roleMapper.selectByIdList(roleIdList);
+		checkRoleIdListComplete(roleIdList, roleList);
+		for (Role role : roleList) {
+			checkCanManageUserInModule(operatorUserId, targetUserId, role.getModuleCode());
+			checkGrantableRole(operatorUserId, role);
+		}
+	}
+
+	@Override
+	public void checkCanRevokeRoles(String operatorUserId, String targetUserId, Collection<String> roleIdList) {
+		if (TimiJava.isEmpty(roleIdList)) {
+			return;
+		}
+		checkCorePermission(operatorUserId, CorePermissionCode.USER_ROLE_DELETE);
+		if (authorizationScopeService.isSystemAdmin(operatorUserId)) {
+			return;
+		}
+		List<Role> roleList = roleMapper.selectByIdList(roleIdList);
+		checkRoleIdListComplete(roleIdList, roleList);
+		for (Role role : roleList) {
+			checkCanManageUserInModule(operatorUserId, targetUserId, role.getModuleCode());
+			checkManageableRole(operatorUserId, role);
+		}
+	}
+
+	@Override
+	public void checkCanCreateRole(String operatorUserId, Role role) {
+		checkCorePermission(operatorUserId, CorePermissionCode.ROLE_CREATE);
+		if (authorizationScopeService.isSystemAdmin(operatorUserId)) {
+			return;
+		}
+		TimiException.required(role.getModuleCode(), "not found role.moduleCode");
+		TimiException.required(role.getOwnerType(), "not found role.ownerType");
+		TimiException.requiredTrue(!Boolean.TRUE.equals(role.getBuiltin()), "不能创建内置角色");
+		TimiException.requiredTrue(!Boolean.TRUE.equals(role.getProtectedRole()), "不能创建受保护角色");
+		checkOwnerScope(operatorUserId, role.getModuleCode(), role.getOwnerType(), role.getOwnerId());
+	}
+
+	@Override
+	public void checkCanUpdateRole(String operatorUserId, Role role) {
+		checkCorePermission(operatorUserId, CorePermissionCode.ROLE_UPDATE);
+		Role dbRole = roleMapper.selectById(role.getId());
+		TimiException.required(dbRole, "not found role");
+		if (authorizationScopeService.isSystemAdmin(operatorUserId)) {
+			return;
+		}
+		checkManageableRole(operatorUserId, dbRole);
+		TimiException.requiredTrue(!Boolean.TRUE.equals(role.getBuiltin()), "不能设置内置角色");
+		TimiException.requiredTrue(!Boolean.TRUE.equals(role.getProtectedRole()), "不能设置受保护角色");
+		if (role.getModuleCode() != null) {
+			TimiException.requiredTrue(role.getModuleCode() == dbRole.getModuleCode(), "不能修改角色模块");
+		}
+		if (role.getOwnerType() != null) {
+			checkOwnerScope(operatorUserId, dbRole.getModuleCode(), role.getOwnerType(), role.getOwnerId());
+		}
+	}
+
+	@Override
+	public void checkCanDeleteRole(String operatorUserId, String roleId) {
+		checkCorePermission(operatorUserId, CorePermissionCode.ROLE_DELETE);
+		Role role = roleMapper.selectById(roleId);
+		TimiException.required(role, "not found role");
+		if (authorizationScopeService.isSystemAdmin(operatorUserId)) {
+			return;
+		}
+		checkManageableRole(operatorUserId, role);
+		TimiException.requiredTrue(!Boolean.TRUE.equals(role.getBuiltin()), "不能删除内置角色");
+		TimiException.requiredTrue(!Boolean.TRUE.equals(role.getProtectedRole()), "不能删除受保护角色");
+	}
+
+	@Override
+	public void checkCanGrantPermissions(String operatorUserId, String roleId, Collection<String> permissionIdList) {
+		if (TimiJava.isEmpty(permissionIdList)) {
+			return;
+		}
+		checkCorePermission(operatorUserId, CorePermissionCode.ROLE_PERMISSION_CREATE);
+		Role role = roleMapper.selectById(roleId);
+		TimiException.required(role, "not found role");
+		boolean systemAdmin = authorizationScopeService.isSystemAdmin(operatorUserId);
+		if (!systemAdmin) {
+			checkManageableRole(operatorUserId, role);
+		}
+		List<Permission> permissionList = permissionMapper.selectByIdList(permissionIdList.stream().toList());
+		checkPermissionIdListComplete(permissionIdList, permissionList);
+		Set<String> grantablePermissionIdSet = listRoleDirectGrantablePermissionId(operatorUserId, role);
+		for (Permission permission : permissionList) {
+			TimiException.requiredTrue(grantablePermissionIdSet.contains(permission.getId()), "权限不在上级下放边界内：%s".formatted(permission.getCode()));
+		}
+	}
+
+	@Override
+	public void checkCanRevokePermissions(String operatorUserId, String roleId, Collection<String> permissionIdList) {
+		if (TimiJava.isEmpty(permissionIdList)) {
+			return;
+		}
+		checkCorePermission(operatorUserId, CorePermissionCode.ROLE_PERMISSION_DELETE);
+		Role role = roleMapper.selectById(roleId);
+		TimiException.required(role, "not found role");
+		if (authorizationScopeService.isSystemAdmin(operatorUserId)) {
+			return;
+		}
+		checkManageableRole(operatorUserId, role);
+	}
+
+	@Override
+	public void checkCanUpdateRoleDelegation(String operatorUserId, String roleId, Collection<String> permissionIdList) {
+		checkCorePermission(operatorUserId, CorePermissionCode.ROLE_PERMISSION_CREATE);
+		Role role = roleMapper.selectById(roleId);
+		TimiException.required(role, "not found role");
+		boolean systemAdmin = authorizationScopeService.isSystemAdmin(operatorUserId);
+		if (!systemAdmin) {
+			checkManageableRole(operatorUserId, role);
+		}
+		if (TimiJava.isEmpty(permissionIdList)) {
+			return;
+		}
+		List<Permission> permissionList = permissionMapper.selectByIdList(permissionIdList.stream().toList());
+		checkPermissionIdListComplete(permissionIdList, permissionList);
+		Set<String> allPermissionIdSet = listRoleAllPermissionId(operatorUserId, roleId);
+		boolean hasParentRole = TimiJava.isNotEmpty(role.getParentRoleId());
+		Set<String> parentDelegationPermissionIdSet = listParentDelegationPermissionId(roleId);
+		if (!isCoreDelegationRoot(role)) {
+			TimiException.requiredTrue(hasParentRole, "目标角色缺少管理父级");
+		}
+		Set<String> operatorGrantablePermissionIdSet = listGrantablePermissionId(operatorUserId, permissionList);
+		for (Permission permission : permissionList) {
+			TimiException.requiredTrue(role.getModuleCode() == permission.getModuleCode() || isCoreDelegationRoot(role) || isCoreAuthorizationPermission(permission), "不能配置其他模块转授权限");
+			TimiException.requiredTrue(isCoreDelegationRoot(role) || allPermissionIdSet.contains(permission.getId()), "转授权限必须先属于目标角色有效权限：%s".formatted(permission.getCode()));
+			if (hasParentRole) {
+				TimiException.requiredTrue(parentDelegationPermissionIdSet.contains(permission.getId()), "转授权限超过上级边界：%s".formatted(permission.getCode()));
+			}
+			if (!systemAdmin) {
+				TimiException.requiredTrue(operatorGrantablePermissionIdSet.contains(permission.getId()), "权限不在可转授范围内：%s".formatted(permission.getCode()));
+			}
+		}
+	}
+
+	@Override
+	public void checkCanUpdateRoleParent(String operatorUserId, String roleId, String parentRoleId) {
+		checkCorePermission(operatorUserId, CorePermissionCode.ROLE_UPDATE);
+		Role targetRole = roleMapper.selectById(roleId);
+		TimiException.required(targetRole, "not found role");
+		boolean systemAdmin = authorizationScopeService.isSystemAdmin(operatorUserId);
+		if (!systemAdmin) {
+			checkManageableRole(operatorUserId, targetRole);
+		}
+		if (TimiJava.isEmpty(parentRoleId)) {
+			TimiException.requiredTrue(isCoreDelegationRoot(targetRole), "非根角色必须设置管理父级");
+			return;
+		}
+		Role parentRole = roleMapper.selectById(parentRoleId);
+		TimiException.required(parentRole, "not found parent role");
+		TimiException.requiredTrue(!roleId.equals(parentRoleId), "管理父级不能指向自身");
+		TimiException.requiredTrue(!isManagementDescendant(roleId, parentRoleId), "管理父级不能指向自己的下级");
+		if (!systemAdmin && !isOperatorRole(operatorUserId, parentRole)) {
+			checkManageableRole(operatorUserId, parentRole);
+		}
+	}
+
+	@Override
+	public void checkCanUpdateRolePermissionInherits(String operatorUserId, String parentRoleId, Collection<String> childRoleIdList) {
+		if (TimiJava.isEmpty(childRoleIdList)) {
+			return;
+		}
+		checkCorePermission(operatorUserId, CorePermissionCode.ROLE_PERMISSION_INHERIT_CREATE);
+		Role parentRole = roleMapper.selectById(parentRoleId);
+		TimiException.required(parentRole, "not found parent role");
+		roleHierarchyService.checkNoCycle(parentRoleId, childRoleIdList);
+		if (authorizationScopeService.isSystemAdmin(operatorUserId)) {
+			return;
+		}
+		if (!isOperatorRole(operatorUserId, parentRole)) {
+			checkManageableRole(operatorUserId, parentRole);
+		}
+		List<Role> childRoleList = roleMapper.selectByIdList(childRoleIdList);
+		checkRoleIdListComplete(childRoleIdList, childRoleList);
+		for (Role childRole : childRoleList) {
+			TimiException.requiredTrue(parentRole.getModuleCode() == childRole.getModuleCode(), "不能继承其他模块角色");
+			checkManageableRole(operatorUserId, childRole);
+		}
+	}
+
+	private void checkGrantableRole(String operatorUserId, Role role) {
+		Set<String> grantableRoleIdSet = authorizationScopeService.listGrantableRole(operatorUserId, role.getModuleCode())
+		                                                          .stream()
+		                                                          .map(Role::getId)
+		                                                          .collect(Collectors.toSet());
+		TimiException.requiredTrue(grantableRoleIdSet.contains(role.getId()), "角色不在可授权范围内：%s".formatted(role.getCode()));
+	}
+
+	private void checkManageableRole(String operatorUserId, Role role) {
+		Set<String> manageableRoleIdSet = authorizationScopeService.listManageableRole(operatorUserId, role.getModuleCode())
+		                                                           .stream()
+		                                                           .map(Role::getId)
+		                                                           .collect(Collectors.toSet());
+		TimiException.requiredTrue(manageableRoleIdSet.contains(role.getId()), "角色不在可管理范围内：%s".formatted(role.getCode()));
+	}
+
+	private Set<String> listRoleAllPermissionId(String operatorUserId, String roleId) {
+		List<String> allRoleIdList = roleHierarchyService.listAllRoleIdIncludingChildren(operatorUserId, List.of(roleId));
+		return rolePermissionMapper.selectPermissionByRoleIdList(allRoleIdList)
+		                           .stream()
+		                           .map(Permission::getId)
+		                           .collect(Collectors.toSet());
+	}
+
+	private Set<String> listGrantablePermissionId(String operatorUserId, List<Permission> permissionList) {
+		if (TimiJava.isEmpty(permissionList)) {
+			return Set.of();
+		}
+		return permissionList.stream()
+		                     .map(Permission::getModuleCode)
+		                     .distinct()
+		                     .flatMap(moduleCode -> authorizationScopeService.listGrantablePermission(operatorUserId, moduleCode).stream())
+		                     .map(Permission::getId)
+		                     .collect(Collectors.toSet());
+	}
+
+	private Set<String> listRoleDirectGrantablePermissionId(String operatorUserId, Role role) {
+		boolean systemAdmin = authorizationScopeService.isSystemAdmin(operatorUserId);
+		if (systemAdmin && isCoreDelegationRoot(role) && TimiJava.isEmpty(role.getParentRoleId())) {
+			return permissionMapper.selectAll().stream().map(Permission::getId).collect(Collectors.toSet());
+		}
+		TimiException.requiredTrue(TimiJava.isNotEmpty(role.getParentRoleId()), "目标角色缺少管理父级");
+		Set<String> parentDelegationPermissionIdSet = listParentDelegationPermissionId(role.getId());
+		if (systemAdmin) {
+			return parentDelegationPermissionIdSet;
+		}
+		List<Permission> parentDelegationPermissionList = TimiJava.isEmpty(parentDelegationPermissionIdSet)
+			? List.of()
+			: permissionMapper.selectByIdList(parentDelegationPermissionIdSet.stream().toList());
+		Set<String> operatorGrantablePermissionIdSet = listGrantablePermissionId(operatorUserId, parentDelegationPermissionList);
+		return parentDelegationPermissionIdSet.stream()
+		                                      .filter(operatorGrantablePermissionIdSet::contains)
+		                                      .collect(Collectors.toSet());
+	}
+
+	private Set<String> listParentDelegationPermissionId(String roleId) {
+		Role role = roleMapper.selectById(roleId);
+		if (role == null || TimiJava.isEmpty(role.getParentRoleId())) {
+			return Set.of();
+		}
+		return rolePermissionDelegationMapper.selectPermissionByRoleIdList(List.of(role.getParentRoleId()))
+		                                     .stream()
+		                                     .map(Permission::getId)
+		                                     .collect(Collectors.toSet());
+	}
+
+	private boolean isOperatorRole(String operatorUserId, Role role) {
+		List<String> roleIdList = userRoleMapper.selectByUserIdList(List.of(operatorUserId)).stream().map(UserRole::getRoleId).toList();
+		if (TimiJava.isEmpty(roleIdList)) {
+			return false;
+		}
+		return roleHierarchyService.listAllRoleIdIncludingChildren(operatorUserId, roleIdList).contains(role.getId());
+	}
+
+	private boolean isCoreDelegationRoot(Role role) {
+		return role != null
+			&& ModuleCode.CORE == role.getModuleCode()
+			&& (CoreRoleCode.SYSTEM.name().equals(role.getCode()) || CoreRoleCode.ADMIN.name().equals(role.getCode()));
+	}
+
+	private boolean isManagementDescendant(String parentRoleId, String childRoleId) {
+		List<Role> childRoleList = roleMapper.selectByParentRoleId(parentRoleId);
+		for (Role childRole : childRoleList) {
+			if (childRoleId.equals(childRole.getId()) || isManagementDescendant(childRole.getId(), childRoleId)) {
+				return true;
+			}
+		}
+		return false;
+	}
+
+	private boolean isCoreAuthorizationPermission(Permission permission) {
+		return permission != null && ModuleCode.CORE == permission.getModuleCode();
+	}
+
+	private void checkCanManageUserInModule(String operatorUserId, String targetUserId, ModuleCode moduleCode) {
+		ModuleResourceScopeResolver resolver = getResolver(moduleCode);
+		TimiException.requiredTrue(resolver == null || resolver.canManageUser(operatorUserId, targetUserId), "目标用户不在可管理范围内");
+	}
+
+	private void checkOwnerScope(String operatorUserId, ModuleCode moduleCode, AuthOwnerType ownerType, String ownerId) {
+		ModuleResourceScopeResolver resolver = getResolver(moduleCode);
+		TimiException.requiredTrue(resolver == null || resolver.canUseOwnerScope(operatorUserId, ownerType, ownerId), "归属范围不在可管理范围内");
+	}
+
+	private void checkCorePermission(String operatorUserId, CorePermissionCode permissionCode) {
+		TimiException.requiredTrue(hasPermission(operatorUserId, ModuleCode.CORE, permissionCode.getValue()), "权限不足：%s".formatted(permissionCode.getValue()));
+	}
+
+	private boolean hasPermission(String userId, ModuleCode moduleCode, String permissionCode) {
+		List<String> roleIdList = userRoleMapper.selectByUserIdList(List.of(userId)).stream().map(UserRole::getRoleId).toList();
+		if (TimiJava.isEmpty(roleIdList)) {
+			return false;
+		}
+		List<String> allRoleIdList = roleHierarchyService.listAllRoleIdIncludingChildren(userId, roleIdList);
+		return rolePermissionMapper.selectPermissionByRoleIdList(allRoleIdList)
+		                           .stream()
+		                           .anyMatch(permission -> moduleCode == permission.getModuleCode() && permissionCode.equals(permission.getCode()));
+	}
+
+	private ModuleResourceScopeResolver getResolver(ModuleCode moduleCode) {
+		return moduleResourceScopeResolverList.stream()
+		                                      .filter(resolver -> moduleCode == resolver.moduleCode())
+		                                      .findFirst()
+		                                      .orElse(null);
+	}
+
+	private void checkRoleIdListComplete(Collection<String> idList, List<Role> roleList) {
+		Set<String> foundIdSet = roleList.stream().map(Role::getId).collect(Collectors.toSet());
+		Set<String> idSet = new HashSet<>(idList);
+		TimiException.requiredTrue(foundIdSet.containsAll(idSet), "存在无效角色 ID");
+	}
+
+	private void checkPermissionIdListComplete(Collection<String> idList, List<Permission> permissionList) {
+		Set<String> foundIdSet = permissionList.stream().map(Permission::getId).collect(Collectors.toSet());
+		Set<String> idSet = new HashSet<>(idList);
+		TimiException.requiredTrue(foundIdSet.containsAll(idSet), "存在无效权限 ID");
+	}
+
+}

src/main/java/com/imyeyu/api/modules/user/service/implement/AuthorizationScopeServiceImplement.java

@@ -0,0 +1,178 @@
+package com.imyeyu.api.modules.user.service.implement;
+
+import com.imyeyu.api.bean.CoreRoleCode;
+import com.imyeyu.api.bean.ModuleCode;
+import com.imyeyu.api.modules.user.entity.Permission;
+import com.imyeyu.api.modules.user.entity.Role;
+import com.imyeyu.api.modules.user.entity.UserRole;
+import com.imyeyu.api.modules.user.mapper.PermissionMapper;
+import com.imyeyu.api.modules.user.mapper.RoleMapper;
+import com.imyeyu.api.modules.user.mapper.RolePermissionDelegationMapper;
+import com.imyeyu.api.modules.user.mapper.RolePermissionMapper;
+import com.imyeyu.api.modules.user.mapper.UserRoleMapper;
+import com.imyeyu.api.modules.user.service.AuthorizationScopeService;
+import com.imyeyu.api.modules.user.service.ModuleResourceScopeResolver;
+import com.imyeyu.api.modules.user.service.RoleHierarchyService;
+import com.imyeyu.java.TimiJava;
+import lombok.RequiredArgsConstructor;
+import org.springframework.stereotype.Service;
+
+import java.util.ArrayDeque;
+import java.util.Collection;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.function.Function;
+import java.util.stream.Collectors;
+
+/// 授权范围服务实现
+///
+/// @author Codex
+/// @since 2026-08-07
+@Service
+@RequiredArgsConstructor
+public class AuthorizationScopeServiceImplement implements AuthorizationScopeService {
+
+	private final RoleMapper roleMapper;
+	private final UserRoleMapper userRoleMapper;
+	private final PermissionMapper permissionMapper;
+	private final RolePermissionMapper rolePermissionMapper;
+	private final RolePermissionDelegationMapper rolePermissionDelegationMapper;
+	private final RoleHierarchyService roleHierarchyService;
+	private final List<ModuleResourceScopeResolver> moduleResourceScopeResolverList;
+
+	@Override
+	public List<Role> listGrantableRole(String operatorUserId, ModuleCode moduleCode) {
+		List<Role> roleList = listManageableRole(operatorUserId, moduleCode);
+		if (isSystemAdmin(operatorUserId)) {
+			return roleList;
+		}
+		Set<String> operatorDelegationPermissionIdSet = listOperatorDelegationPermissionId(operatorUserId);
+		return roleList.stream()
+		               .filter(role -> operatorDelegationPermissionIdSet.containsAll(listRoleAllPermissionId(operatorUserId, role.getId())))
+		               .toList();
+	}
+
+	@Override
+	public List<Permission> listGrantablePermission(String operatorUserId, ModuleCode moduleCode) {
+		List<Permission> permissionList = permissionMapper.selectByModuleCode(moduleCode);
+		if (isSystemAdmin(operatorUserId)) {
+			return permissionList;
+		}
+		Set<String> delegationPermissionIdSet = listOperatorDelegationPermissionId(operatorUserId, moduleCode);
+		return permissionList.stream()
+		                     .filter(permission -> !Boolean.TRUE.equals(permission.getProtectedPermission()))
+		                     .filter(permission -> delegationPermissionIdSet.contains(permission.getId()))
+		                     .toList();
+	}
+
+	@Override
+	public List<Role> listManageableRole(String operatorUserId, ModuleCode moduleCode) {
+		List<Role> roleList = roleMapper.selectByModuleCode(moduleCode);
+		if (isSystemAdmin(operatorUserId)) {
+			return roleList;
+		}
+		Set<String> manageableRoleIdSet = listManagementDescendantRoleId(operatorUserId);
+		ModuleResourceScopeResolver resolver = getResolver(moduleCode);
+		return roleList.stream()
+		               .filter(role -> manageableRoleIdSet.contains(role.getId()))
+		               .filter(role -> !Boolean.TRUE.equals(role.getProtectedRole()))
+		               .filter(role -> resolver == null || resolver.canManageRole(operatorUserId, role))
+		               .toList();
+	}
+
+	@Override
+	public boolean isSystemAdmin(String operatorUserId) {
+		return listAllOperatorRole(operatorUserId).stream()
+		                                         .anyMatch(role -> ModuleCode.CORE == role.getModuleCode()
+			                                         && CoreRoleCode.SYSTEM.name().equals(role.getCode()));
+	}
+
+	private Set<String> listManagementDescendantRoleId(String operatorUserId) {
+		List<String> operatorRoleIdList = listOperatorRoleId(operatorUserId);
+		if (TimiJava.isEmpty(operatorRoleIdList)) {
+			return Set.of();
+		}
+		Map<String, List<Role>> childRoleMap = roleMapper.selectAll()
+		                                                 .stream()
+		                                                 .filter(role -> TimiJava.isNotEmpty(role.getParentRoleId()))
+		                                                 .collect(Collectors.groupingBy(Role::getParentRoleId));
+		Set<String> result = new HashSet<>();
+		ArrayDeque<String> queue = new ArrayDeque<>(operatorRoleIdList);
+		while (!queue.isEmpty()) {
+			String roleId = queue.removeFirst();
+			for (Role childRole : childRoleMap.getOrDefault(roleId, List.of())) {
+				if (result.add(childRole.getId())) {
+					queue.addLast(childRole.getId());
+				}
+			}
+		}
+		return result;
+	}
+
+	private List<Role> listAllOperatorRole(String operatorUserId) {
+		List<String> allRoleIdList = listAllOperatorRoleId(operatorUserId);
+		if (TimiJava.isEmpty(allRoleIdList)) {
+			return List.of();
+		}
+		Map<String, Role> roleMap = roleMapper.selectByIdList(allRoleIdList).stream().collect(Collectors.toMap(Role::getId, Function.identity()));
+		return allRoleIdList.stream().map(roleMap::get).filter(java.util.Objects::nonNull).toList();
+	}
+
+	private List<String> listAllOperatorRoleId(String operatorUserId) {
+		List<String> roleIdList = listOperatorRoleId(operatorUserId);
+		if (TimiJava.isEmpty(roleIdList)) {
+			return List.of();
+		}
+		return roleHierarchyService.listAllRoleIdIncludingChildren(operatorUserId, roleIdList);
+	}
+
+	private List<String> listOperatorRoleId(String operatorUserId) {
+		if (TimiJava.isEmpty(operatorUserId)) {
+			return List.of();
+		}
+		return userRoleMapper.selectByUserIdList(List.of(operatorUserId)).stream().map(UserRole::getRoleId).toList();
+	}
+
+	private Set<String> listOperatorDelegationPermissionId(String operatorUserId, ModuleCode moduleCode) {
+		List<String> roleIdList = listOperatorRoleId(operatorUserId);
+		if (TimiJava.isEmpty(roleIdList)) {
+			return Set.of();
+		}
+		return rolePermissionDelegationMapper.selectPermissionByRoleIdList(roleIdList)
+		                                     .stream()
+		                                     .filter(permission -> moduleCode == permission.getModuleCode())
+		                                     .map(Permission::getId)
+		                                     .collect(Collectors.toCollection(HashSet::new));
+	}
+
+	private Set<String> listOperatorDelegationPermissionId(String operatorUserId) {
+		List<String> roleIdList = listOperatorRoleId(operatorUserId);
+		if (TimiJava.isEmpty(roleIdList)) {
+			return Set.of();
+		}
+		return rolePermissionDelegationMapper.selectPermissionByRoleIdList(roleIdList)
+		                                     .stream()
+		                                     .map(Permission::getId)
+		                                     .collect(Collectors.toCollection(HashSet::new));
+	}
+
+	private Set<String> listRoleAllPermissionId(String operatorUserId, String roleId) {
+		List<String> allRoleIdList = roleHierarchyService.listAllRoleIdIncludingChildren(operatorUserId, List.of(roleId));
+		if (TimiJava.isEmpty(allRoleIdList)) {
+			return Set.of();
+		}
+		return rolePermissionMapper.selectPermissionByRoleIdList(allRoleIdList)
+		                           .stream()
+		                           .map(Permission::getId)
+		                           .collect(Collectors.toSet());
+	}
+
+	private ModuleResourceScopeResolver getResolver(ModuleCode moduleCode) {
+		return moduleResourceScopeResolverList.stream()
+		                                      .filter(resolver -> moduleCode == resolver.moduleCode())
+		                                      .findFirst()
+		                                      .orElse(null);
+	}
+}

src/main/java/com/imyeyu/api/modules/user/service/implement/PermissionServiceImplement.java

@@ -1,8 +1,10 @@
 package com.imyeyu.api.modules.user.service.implement;
 
 import com.imyeyu.api.config.dbsource.TimiServerDBConfig;
+import com.imyeyu.api.bean.ModuleCode;
 import com.imyeyu.api.modules.common.mapper.MultilingualMapper;
 import com.imyeyu.api.modules.common.service.MultilingualService;
+import com.imyeyu.api.modules.user.bean.AuthOwnerType;
 import com.imyeyu.api.modules.user.entity.Permission;
 import com.imyeyu.api.modules.user.mapper.PermissionMapper;
 import com.imyeyu.api.modules.user.mapper.RolePermissionMapper;
@@ -45,6 +47,7 @@ public class PermissionServiceImplement extends AbstractEntityService<Permission
 	@Transactional(TimiServerDBConfig.ROLLBACKER)
 	@Override
 	public void create(Permission permission) {
+		fillPermissionDefault(permission);
 		permission.setNameLangId(multilingualService.create(permission.getName()));
 		super.create(permission);
 	}
@@ -62,6 +65,7 @@ public class PermissionServiceImplement extends AbstractEntityService<Permission
 			permission.setModuleCode(req.getModuleCode());
 			permission.setCode(req.getPrefixCode() + "_" + type.name());
 			permission.setName(req.getPrefixName() + messageResolver.resolve(type.name().toLowerCase(), null, TimiSpring.getLanguage()));
+			fillPermissionDefault(permission);
 			permission.setCreatedAt(Time.now());
 			permissionList.add(permission);
 		}
@@ -84,4 +88,16 @@ public class PermissionServiceImplement extends AbstractEntityService<Permission
 		}
 		return rolePermissionMapper.selectPermissionByRoleIdList(roleIdList);
 	}
+
+	@Override
+	public List<Permission> listByModuleCode(ModuleCode moduleCode) {
+		return mapper.selectByModuleCode(moduleCode);
+	}
+
+	private void fillPermissionDefault(Permission permission) {
+		permission.setBuiltin(TimiJava.defaultIfNull(permission.getBuiltin(), false));
+		permission.setProtectedPermission(TimiJava.defaultIfNull(permission.getProtectedPermission(), false));
+		permission.setOwnerType(TimiJava.defaultIfNull(permission.getOwnerType(), AuthOwnerType.MODULE));
+		permission.setOwnerId(TimiJava.defaultIfEmpty(permission.getOwnerId(), permission.getModuleCode() == null ? null : permission.getModuleCode().name()));
+	}
 }

src/main/java/com/imyeyu/api/modules/user/service/implement/RoleHierarchyServiceImplement.java

@@ -0,0 +1,109 @@
+package com.imyeyu.api.modules.user.service.implement;
+
+import com.imyeyu.api.modules.user.bean.AuthOwnerType;
+import com.imyeyu.api.modules.user.entity.Role;
+import com.imyeyu.api.modules.user.entity.RolePermissionInherit;
+import com.imyeyu.api.modules.user.mapper.RoleMapper;
+import com.imyeyu.api.modules.user.mapper.RolePermissionInheritMapper;
+import com.imyeyu.api.modules.user.service.ModuleResourceScopeResolver;
+import com.imyeyu.api.modules.user.service.RoleHierarchyService;
+import com.imyeyu.java.TimiJava;
+import com.imyeyu.java.bean.timi.TimiCode;
+import com.imyeyu.java.bean.timi.TimiException;
+import org.springframework.beans.factory.ObjectProvider;
+import lombok.RequiredArgsConstructor;
+import org.springframework.stereotype.Service;
+
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Set;
+import java.util.function.Function;
+import java.util.stream.Collectors;
+
+/// 角色继承服务实现
+///
+/// @author Codex
+/// @since 2026-08-07
+@Service
+@RequiredArgsConstructor
+public class RoleHierarchyServiceImplement implements RoleHierarchyService {
+
+	private final RolePermissionInheritMapper rolePermissionInheritMapper;
+	private final RoleMapper roleMapper;
+	private final ObjectProvider<ModuleResourceScopeResolver> moduleResourceScopeResolverProvider;
+
+	@Override
+	public List<String> listAllRoleIdIncludingChildren(Collection<String> roleIdList) {
+		return listAllRoleIdIncludingChildren(null, roleIdList);
+	}
+
+	@Override
+	public List<String> listAllRoleIdIncludingChildren(String userId, Collection<String> roleIdList) {
+		if (TimiJava.isEmpty(roleIdList)) {
+			return List.of();
+		}
+		Set<String> allRoleIdSet = new HashSet<>(roleIdList);
+		List<String> currentLevelRoleIdList = new ArrayList<>(roleIdList);
+		while (TimiJava.isNotEmpty(currentLevelRoleIdList)) {
+			List<RolePermissionInherit> relationList = rolePermissionInheritMapper.selectByParentRoleIdList(currentLevelRoleIdList);
+			List<String> parentAndChildRoleIdList = relationList.stream()
+			                                                    .flatMap(relation -> java.util.stream.Stream.of(relation.getParentRoleId(), relation.getChildRoleId()))
+			                                                    .distinct()
+			                                                    .toList();
+			Map<String, Role> roleMap = roleMapper.selectByIdList(parentAndChildRoleIdList).stream().collect(Collectors.toMap(Role::getId, Function.identity()));
+			List<String> childRoleIdList = relationList.stream()
+			                                           .filter(relation -> isVisible(userId, relation, roleMap.get(relation.getParentRoleId())))
+			                                           .map(RolePermissionInherit::getChildRoleId)
+			                                           .toList();
+			if (TimiJava.isEmpty(childRoleIdList)) {
+				break;
+			}
+			List<String> newChildRoleIdList = childRoleIdList.stream().filter(id -> !allRoleIdSet.contains(id)).toList();
+			if (TimiJava.isEmpty(newChildRoleIdList)) {
+				break;
+			}
+			allRoleIdSet.addAll(newChildRoleIdList);
+			currentLevelRoleIdList = newChildRoleIdList;
+		}
+		return new ArrayList<>(allRoleIdSet);
+	}
+
+	@Override
+	public void checkNoCycle(String parentRoleId, Collection<String> childRoleIdList) {
+		if (TimiJava.isEmpty(childRoleIdList)) {
+			return;
+		}
+		for (String childRoleId : childRoleIdList) {
+			if (parentRoleId.equals(childRoleId) || isDescendant(childRoleId, parentRoleId)) {
+				throw new TimiException(TimiCode.PERMISSION_ERROR, "角色继承关系不能形成循环");
+			}
+		}
+	}
+
+	@Override
+	public boolean isDescendant(String parentRoleId, String childRoleId) {
+		return listAllRoleIdIncludingChildren(List.of(parentRoleId)).contains(childRoleId);
+	}
+
+	private boolean isVisible(String userId, RolePermissionInherit relation, Role parentRole) {
+		if (relation.getOwnerType() == null) {
+			return true;
+		}
+		if (relation.getOwnerType() == AuthOwnerType.MODULE && parentRole != null && Objects.equals(relation.getOwnerId(), parentRole.getModuleCode().name())) {
+			return true;
+		}
+		if (TimiJava.isEmpty(userId) || parentRole == null) {
+			return false;
+		}
+		ModuleResourceScopeResolver resolver = moduleResourceScopeResolverProvider.orderedStream()
+		                                                                      .filter(item -> parentRole.getModuleCode() == item.moduleCode())
+		                                                                      .findFirst()
+		                                                                      .orElse(null);
+		return resolver != null && resolver.canUseOwnerScope(userId, relation.getOwnerType(), relation.getOwnerId());
+	}
+}
+

src/main/java/com/imyeyu/api/modules/user/service/implement/RolePermissionInheritServiceImplement.java

@@ -1,8 +1,8 @@
 package com.imyeyu.api.modules.user.service.implement;
 
-import com.imyeyu.api.modules.user.entity.RoleRelation;
+import com.imyeyu.api.modules.user.entity.RolePermissionInherit;
-import com.imyeyu.api.modules.user.mapper.RoleRelationMapper;
+import com.imyeyu.api.modules.user.mapper.RolePermissionInheritMapper;
-import com.imyeyu.api.modules.user.service.RoleRelationService;
+import com.imyeyu.api.modules.user.service.RolePermissionInheritService;
 import com.imyeyu.java.TimiJava;
 import com.imyeyu.spring.mapper.BaseMapper;
 import com.imyeyu.spring.service.AbstractEntityService;
@@ -14,34 +14,34 @@ import java.util.HashSet;
 import java.util.List;
 import java.util.Set;
 
-/// 角色关联服务实现
+/// 角色权限继承服务实现
 ///
 /// @author 夜雨
 /// @since 2026-05-13 14:46
 @Service
 @RequiredArgsConstructor
-public class RoleRelationServiceImplement extends AbstractEntityService<RoleRelation, String> implements RoleRelationService {
+public class RolePermissionInheritServiceImplement extends AbstractEntityService<RolePermissionInherit, String> implements RolePermissionInheritService {
 
-	private final RoleRelationMapper mapper;
+	private final RolePermissionInheritMapper mapper;
 
 	@Override
-	protected BaseMapper<RoleRelation, String> mapper() {
+	protected BaseMapper<RolePermissionInherit, String> mapper() {
 		return mapper;
 	}
 
 	@Override
-	public List<RoleRelation> listByParentRoleId(String parentRoleId) {
+	public List<RolePermissionInherit> listByParentRoleId(String parentRoleId) {
 		if (TimiJava.isEmpty(parentRoleId)) {
 			return List.of();
 		}
-		RoleRelation example = new RoleRelation();
+		RolePermissionInherit example = new RolePermissionInherit();
 		example.setParentRoleId(parentRoleId);
 		return mapper.selectAllByExample(example);
 	}
 
 	@Override
 	public List<String> listChildRoleIdByParentRoleId(String parentRoleId) {
-		return listByParentRoleId(parentRoleId).stream().map(RoleRelation::getChildRoleId).distinct().toList();
+		return listByParentRoleId(parentRoleId).stream().map(RolePermissionInherit::getChildRoleId).distinct().toList();
 	}
 
 	@Override

src/main/java/com/imyeyu/api/modules/user/service/implement/RoleServiceImplement.java

@@ -3,15 +3,27 @@ package com.imyeyu.api.modules.user.service.implement;
 import com.imyeyu.api.bean.ModuleCode;
 import com.imyeyu.api.config.dbsource.TimiServerDBConfig;
 import com.imyeyu.api.modules.common.service.MultilingualService;
+import com.imyeyu.api.modules.system.entity.Logger;
+import com.imyeyu.api.modules.system.service.LoggerService;
+import com.imyeyu.api.modules.user.bean.AuthOwnerType;
 import com.imyeyu.api.modules.user.entity.Permission;
 import com.imyeyu.api.modules.user.entity.Role;
 import com.imyeyu.api.modules.user.entity.RolePermission;
-import com.imyeyu.api.modules.user.entity.RoleRelation;
+import com.imyeyu.api.modules.user.entity.RolePermissionDelegation;
+import com.imyeyu.api.modules.user.entity.RolePermissionInherit;
+import com.imyeyu.api.modules.user.entity.UserRole;
 import com.imyeyu.api.modules.user.mapper.RoleMapper;
+import com.imyeyu.api.modules.user.mapper.RolePermissionDelegationMapper;
 import com.imyeyu.api.modules.user.mapper.RolePermissionMapper;
-import com.imyeyu.api.modules.user.mapper.RoleRelationMapper;
+import com.imyeyu.api.modules.user.mapper.RolePermissionInheritMapper;
+import com.imyeyu.api.modules.user.mapper.UserRoleMapper;
+import com.imyeyu.api.modules.user.service.AuthorizationBoundaryService;
+import com.imyeyu.api.modules.user.service.AuthorizationScopeService;
+import com.imyeyu.api.modules.user.service.ModuleResourceScopeResolver;
 import com.imyeyu.api.modules.user.service.PermissionService;
+import com.imyeyu.api.modules.user.service.RoleHierarchyService;
 import com.imyeyu.api.modules.user.service.RoleService;
+import com.imyeyu.api.modules.user.service.UserLoginService;
 import com.imyeyu.java.TimiJava;
 import com.imyeyu.java.bean.timi.TimiException;
 import com.imyeyu.spring.mapper.BaseMapper;
@@ -22,11 +34,16 @@ import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
 
 import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.Collection;
 import java.util.HashSet;
+import java.util.LinkedHashMap;
 import java.util.List;
+import java.util.Map;
+import java.util.Objects;
 import java.util.Set;
 import java.util.UUID;
+import java.util.function.Function;
 import java.util.stream.Collectors;
 
 /// 角色服务实现
@@ -39,10 +56,18 @@ public class RoleServiceImplement extends AbstractEntityService<Role, String> im
 
 	private final PermissionService permissionService;
 	private final MultilingualService multilingualService;
+	private final LoggerService loggerService;
+	private final UserLoginService userLoginService;
+	private final RoleHierarchyService roleHierarchyService;
+	private final AuthorizationBoundaryService authorizationBoundaryService;
+	private final AuthorizationScopeService authorizationScopeService;
+	private final List<ModuleResourceScopeResolver> moduleResourceScopeResolverList;
 
 	private final RoleMapper mapper;
-	private final RoleRelationMapper roleRelationMapper;
+	private final RolePermissionInheritMapper rolePermissionInheritMapper;
 	private final RolePermissionMapper rolePermissionMapper;
+	private final RolePermissionDelegationMapper rolePermissionDelegationMapper;
+	private final UserRoleMapper userRoleMapper;
 
 	@Override
 	protected BaseMapper<Role, String> mapper() {
@@ -52,8 +77,20 @@ public class RoleServiceImplement extends AbstractEntityService<Role, String> im
 	@Transactional(TimiServerDBConfig.ROLLBACKER)
 	@Override
 	public void create(Role role) {
+		fillRoleDefault(role);
+		if (!Boolean.TRUE.equals(role.getBuiltin())) {
+			String loginUserId = userLoginService.getRequireLoginUserId();
+			role.setCreatedBy(TimiJava.defaultIfEmpty(role.getCreatedBy(), loginUserId));
+			authorizationBoundaryService.checkCanCreateRole(loginUserId, role);
+		}
 		role.setNameLangId(multilingualService.create(role.getName()));
 		super.create(role);
+		if (!Boolean.TRUE.equals(role.getBuiltin())) {
+			String loginUserId = userLoginService.getRequireLoginUserId();
+			authorizationBoundaryService.checkCanUpdateRoleParent(loginUserId, role.getId(), role.getParentRoleId());
+			authorizationBoundaryService.checkCanGrantPermissions(loginUserId, role.getId(), role.getPermissionIdList());
+			authorizationBoundaryService.checkCanUpdateRolePermissionInherits(loginUserId, role.getId(), role.getChildRoleIdList());
+		}
 
 		if (TimiJava.isNotEmpty(role.getPermissionIdList())) {
 			List<RolePermission> rolePermissionList = new ArrayList<>();
@@ -70,37 +107,51 @@ public class RoleServiceImplement extends AbstractEntityService<Role, String> im
 		}
 
 		if (TimiJava.isNotEmpty(role.getChildRoleIdList())) {
-			List<RoleRelation> roleRelationList = new ArrayList<>();
+			List<RolePermissionInherit> rolePermissionInheritList = new ArrayList<>();
 			long now = Time.now();
+			Map<String, Role> childRoleMap = mapper.selectByIdList(role.getChildRoleIdList()).stream().collect(Collectors.toMap(Role::getId, Function.identity()));
 			for (String childRoleId : role.getChildRoleIdList()) {
-				RoleRelation roleRelation = new RoleRelation();
+				RolePermissionInherit rolePermissionInherit = new RolePermissionInherit();
-				roleRelation.setId(UUID.randomUUID().toString());
+				rolePermissionInherit.setId(UUID.randomUUID().toString());
-				roleRelation.setParentRoleId(role.getId());
+				rolePermissionInherit.setParentRoleId(role.getId());
-				roleRelation.setChildRoleId(childRoleId);
+				rolePermissionInherit.setChildRoleId(childRoleId);
-				roleRelation.setCreatedAt(now);
+				fillRelationScope(rolePermissionInherit, childRoleMap.get(childRoleId), role.getCreatedBy());
-				roleRelationList.add(roleRelation);
+				rolePermissionInherit.setCreatedAt(now);
+				rolePermissionInheritList.add(rolePermissionInherit);
 			}
-			roleRelationMapper.createBatch(roleRelationList);
+			rolePermissionInheritMapper.createBatch(rolePermissionInheritList);
 		}
 	}
 
 	@Transactional(TimiServerDBConfig.ROLLBACKER)
 	@Override
 	public void update(Role role) {
-		role.setNameLangId(multilingualService.createIfDifferent(role.getNameLangId(), role.getName()));
+		String loginUserId = userLoginService.getRequireLoginUserId();
-		mapper.updateSelective(role);
+		Role dbRole = mapper.selectById(role.getId());
-		{
+		if (dbRole != null && Boolean.TRUE.equals(dbRole.getBuiltin())) {
+			// 内建角色允许修改名称和说明，但角色代码必须保持不变。
+			role.setCode(null);
+		}
+		if (hasRoleBaseField(role)) {
+			authorizationBoundaryService.checkCanUpdateRole(loginUserId, role);
+			role.setNameLangId(multilingualService.createIfDifferent(role.getNameLangId(), role.getName()));
+			mapper.updateSelective(role);
+		}
+		if (role.getPermissionIdList() != null) {
 			Set<String> dbIdSet = rolePermissionMapper.selectByRoleId(role.getId()).stream().map(RolePermission::getPermissionId).collect(Collectors.toSet());
-			Set<String> newIdSet = TimiJava.defaultIfEmpty(new HashSet<>(role.getPermissionIdList()), new HashSet<>());
+			Set<String> newIdSet = TimiJava.isEmpty(role.getPermissionIdList()) ? new HashSet<>() : new HashSet<>(role.getPermissionIdList());
 
 			Set<String> deleteIdList = new HashSet<>(dbIdSet);
 			deleteIdList.removeAll(newIdSet);
 
 			Set<String> addIdList = new HashSet<>(newIdSet);
 			addIdList.removeAll(dbIdSet);
+			authorizationBoundaryService.checkCanRevokePermissions(loginUserId, role.getId(), deleteIdList);
+			authorizationBoundaryService.checkCanGrantPermissions(loginUserId, role.getId(), addIdList);
 
 			if (TimiJava.isNotEmpty(deleteIdList)) {
 				rolePermissionMapper.deleteByPermissionIdList(role.getId(), new ArrayList<>(deleteIdList));
+				rolePermissionDelegationMapper.deleteByPermissionIdList(role.getId(), new ArrayList<>(deleteIdList));
 			}
 			if (TimiJava.isNotEmpty(addIdList)) {
 				List<RolePermission> rolePermissionList = new ArrayList<>();
@@ -115,37 +166,58 @@ public class RoleServiceImplement extends AbstractEntityService<Role, String> im
 				}
 				rolePermissionMapper.createBatch(rolePermissionList);
 			}
+			logRoleAuthorizationChange("USER_ROLE_PERMISSION_UPDATE", loginUserId, role.getId(), addIdList, deleteIdList);
 		}
 
-		{
+		if (role.getChildRoleIdList() != null) {
-			Set<String> dbIdSet = roleRelationMapper.selectByParentRoleId(role.getId()).stream().map(RoleRelation::getChildRoleId).collect(Collectors.toSet());
+			Role parentRole = mapper.selectById(role.getId());
-			Set<String> newIdSet = TimiJava.defaultIfEmpty(new HashSet<>(role.getChildRoleIdList()), new HashSet<>());
+			List<RolePermissionInherit> dbRelationList = rolePermissionInheritMapper.selectByParentRoleId(role.getId());
+			List<RolePermissionInherit> touchableRelationList = dbRelationList.stream()
+			                                                                  .filter(relation -> canTouchRelation(loginUserId, parentRole, relation))
+			                                                                  .toList();
+			Set<String> newIdSet = TimiJava.isEmpty(role.getChildRoleIdList()) ? new HashSet<>() : new HashSet<>(role.getChildRoleIdList());
+			Map<String, Role> childRoleMap = mapper.selectByIdList(newIdSet).stream().collect(Collectors.toMap(Role::getId, Function.identity()));
+			Set<String> dbKeySet = dbRelationList.stream().map(this::relationKey).collect(Collectors.toSet());
+			Set<String> newKeySet = newIdSet.stream().map(childRoleId -> relationKey(childRoleId, childRoleMap.get(childRoleId))).collect(Collectors.toSet());
 
-			Set<String> deleteIdList = new HashSet<>(dbIdSet);
+			Set<String> deleteKeyList = new HashSet<>(dbKeySet);
-			deleteIdList.removeAll(newIdSet);
+			deleteKeyList.removeAll(newKeySet);
 
-			Set<String> addIdList = new HashSet<>(newIdSet);
+			Set<String> addKeyList = new HashSet<>(newKeySet);
-			addIdList.removeAll(dbIdSet);
+			addKeyList.removeAll(dbKeySet);
+			Set<String> addIdList = addKeyList.stream().map(key -> key.split("\\|", 2)[0]).collect(Collectors.toSet());
+			authorizationBoundaryService.checkCanUpdateRolePermissionInherits(loginUserId, role.getId(), addIdList);
 
-			if (TimiJava.isNotEmpty(deleteIdList)) {
+			if (TimiJava.isNotEmpty(deleteKeyList)) {
-				roleRelationMapper.deleteByChildRoleIdList(role.getId(), new ArrayList<>(deleteIdList));
+				for (RolePermissionInherit relation : touchableRelationList) {
+					if (deleteKeyList.contains(relationKey(relation))) {
+						rolePermissionInheritMapper.deleteByChildRoleIdList(role.getId(), List.of(relation.getChildRoleId()), relation.getOwnerType(), relation.getOwnerId());
+					}
+				}
 			}
 			if (TimiJava.isNotEmpty(addIdList)) {
-				List<RoleRelation> roleRelationList = new ArrayList<>();
+				List<RolePermissionInherit> rolePermissionInheritList = new ArrayList<>();
 				long now = Time.now();
 				for (String childRoleId : addIdList) {
-					RoleRelation roleRelation = new RoleRelation();
+					RolePermissionInherit rolePermissionInherit = new RolePermissionInherit();
-					roleRelation.setId(UUID.randomUUID().toString());
+					rolePermissionInherit.setId(UUID.randomUUID().toString());
-					roleRelation.setParentRoleId(role.getId());
+					rolePermissionInherit.setParentRoleId(role.getId());
-					roleRelation.setChildRoleId(childRoleId);
+					rolePermissionInherit.setChildRoleId(childRoleId);
-					roleRelation.setCreatedAt(now);
+					fillRelationScope(rolePermissionInherit, childRoleMap.get(childRoleId), loginUserId);
-					roleRelationList.add(roleRelation);
+					rolePermissionInherit.setCreatedAt(now);
+					rolePermissionInheritList.add(rolePermissionInherit);
 				}
-				roleRelationMapper.createBatch(roleRelationList);
+				rolePermissionInheritMapper.createBatch(rolePermissionInheritList);
 			}
 		}
 	}
 
+	@Override
+	public void delete(String id) {
+		authorizationBoundaryService.checkCanDeleteRole(userLoginService.getRequireLoginUserId(), id);
+		super.delete(id);
+	}
+
 	@Override
 	public List<Role> listByModuleCode(ModuleCode moduleCode) {
 		TimiException.required(moduleCode, "not found moduleCode");
@@ -157,9 +229,25 @@ public class RoleServiceImplement extends AbstractEntityService<Role, String> im
 		return mapper.selectByIdList(new HashSet<>(idList));
 	}
 
+	@Override
+	public List<Role> listManageableRole(ModuleCode moduleCode) {
+		String loginUserId = userLoginService.getRequireLoginUserId();
+		return authorizationScopeService.listManageableRole(loginUserId, moduleCode);
+	}
+
+	@Override
+	public List<Role> listGrantableRole(ModuleCode moduleCode) {
+		String loginUserId = userLoginService.getRequireLoginUserId();
+		return authorizationScopeService.listGrantableRole(loginUserId, moduleCode);
+	}
+
 	@Override
 	public List<Role> listChildByParentRoleId(String parentRoleId) {
-		List<String> childRoleIdList = roleRelationMapper.selectChildRoleIdListByParentRoleId(parentRoleId);
+		List<String> childRoleIdList = rolePermissionInheritMapper.selectByParentRoleId(parentRoleId)
+		                                                  .stream()
+		                                                  .map(RolePermissionInherit::getChildRoleId)
+		                                                  .distinct()
+		                                                  .toList();
 		if (TimiJava.isEmpty(childRoleIdList)) {
 			return new ArrayList<>();
 		}
@@ -168,26 +256,277 @@ public class RoleServiceImplement extends AbstractEntityService<Role, String> im
 
 	@Override
 	public List<Permission> listPermissionByRoleId(String roleId) {
-		List<String> allRoleIdList = listAllRoleIdIncludingChildren(List.of(roleId));
+		List<String> allRoleIdList = roleHierarchyService.listAllRoleIdIncludingChildren(userLoginService.getRequireLoginUserId(), List.of(roleId));
 		return permissionService.listByRoleId(allRoleIdList);
 	}
 
-	public List<String> listAllRoleIdIncludingChildren(Collection<String> idList) {
+	@Override
-		Set<String> allRoleIdSet = new HashSet<>(idList);
+	public List<Permission> listGrantableRolePermission(String roleId) {
-		List<String> currentLevelRoleIdList = new ArrayList<>(idList);
+		String loginUserId = userLoginService.getRequireLoginUserId();
+		Role role = mapper.selectById(roleId);
+		TimiException.required(role, "not found role");
+		checkManageableRole(loginUserId, role);
+		Set<String> candidateIdSet = listRoleDirectGrantablePermissionId(loginUserId, role);
+		return listPermissionById(candidateIdSet).stream()
+		                    .collect(Collectors.toMap(Permission::getId, Function.identity(), (oldValue, newValue) -> oldValue, LinkedHashMap::new))
+		                    .values()
+		                    .stream()
+		                    .toList();
+	}
 
-		while (TimiJava.isNotEmpty(currentLevelRoleIdList)) {
+	@Override
-			List<String> childRoleIdList = roleRelationMapper.selectChildRoleIdListByParentRoleIdList(currentLevelRoleIdList);
+	public List<Permission> listDelegationPermissionByRoleId(String roleId) {
-			if (TimiJava.isEmpty(childRoleIdList)) {
+		return rolePermissionDelegationMapper.selectPermissionByRoleIdList(List.of(roleId));
-				break;
+	}
-			}
+
-			List<String> newChildRoleIdList = childRoleIdList.stream().filter(id -> !allRoleIdSet.contains(id)).toList();
+	@Override
-			if (TimiJava.isEmpty(newChildRoleIdList)) {
+	public List<Permission> listGrantableDelegationPermission(String roleId) {
-				break;
+		String loginUserId = userLoginService.getRequireLoginUserId();
-			}
+		Role role = mapper.selectById(roleId);
-			allRoleIdSet.addAll(newChildRoleIdList);
+		TimiException.required(role, "not found role");
-			currentLevelRoleIdList = newChildRoleIdList;
+		List<Permission> allPermissionList = isCoreDelegationRoot(role)
+			? Arrays.stream(ModuleCode.values()).flatMap(moduleCode -> permissionService.listByModuleCode(moduleCode).stream()).toList()
+			: listPermissionByRoleId(roleId);
+		Set<String> allPermissionIdSet = allPermissionList.stream().map(Permission::getId).collect(Collectors.toSet());
+		Set<String> operatorGrantableIdSet = listOperatorGrantablePermissionId(loginUserId, allPermissionList);
+		boolean hasParentRole = TimiJava.isNotEmpty(role.getParentRoleId());
+		Set<String> parentDelegationIdSet = listDelegationParentPermissionId(roleId);
+		boolean systemAdmin = authorizationScopeService.isSystemAdmin(loginUserId);
+		return allPermissionList.stream()
+		                        .filter(permission -> allPermissionIdSet.contains(permission.getId()))
+		                        .filter(permission -> parentDelegationIdSet.contains(permission.getId()) || isCoreDelegationRoot(role) && systemAdmin && !hasParentRole)
+		                        .filter(permission -> operatorGrantableIdSet.contains(permission.getId()) || systemAdmin)
+		                        .toList();
+	}
+
+	@Transactional(TimiServerDBConfig.ROLLBACKER)
+	@Override
+	public void updateRoleDelegation(Role role) {
+		String loginUserId = userLoginService.getRequireLoginUserId();
+		TimiException.required(role.getId(), "not found role.id");
+		Set<String> newIdSet = TimiJava.isEmpty(role.getDelegationPermissionIdList()) ? new HashSet<>() : new HashSet<>(role.getDelegationPermissionIdList());
+		authorizationBoundaryService.checkCanUpdateRoleDelegation(loginUserId, role.getId(), newIdSet);
+		Set<String> dbIdSet = rolePermissionDelegationMapper.selectByRoleId(role.getId()).stream().map(RolePermissionDelegation::getPermissionId).collect(Collectors.toSet());
+
+		Set<String> deleteIdList = new HashSet<>(dbIdSet);
+		deleteIdList.removeAll(newIdSet);
+
+		Set<String> addIdList = new HashSet<>(newIdSet);
+		addIdList.removeAll(dbIdSet);
+		if (TimiJava.isNotEmpty(deleteIdList)) {
+			rolePermissionDelegationMapper.deleteByPermissionIdList(role.getId(), new ArrayList<>(deleteIdList));
 		}
-		return new ArrayList<>(allRoleIdSet);
+		if (TimiJava.isNotEmpty(addIdList)) {
+			List<RolePermissionDelegation> delegationList = new ArrayList<>();
+			long now = Time.now();
+			for (String permissionId : addIdList) {
+				RolePermissionDelegation delegation = new RolePermissionDelegation();
+				delegation.setId(UUID.randomUUID().toString());
+				delegation.setRoleId(role.getId());
+				delegation.setPermissionId(permissionId);
+				delegation.setCreatedBy(loginUserId);
+				delegation.setCreatedAt(now);
+				delegationList.add(delegation);
+			}
+			rolePermissionDelegationMapper.createBatch(delegationList);
+		}
+		logRoleAuthorizationChange("USER_ROLE_DELEGATION_PERMISSION_UPDATE", loginUserId, role.getId(), addIdList, deleteIdList);
+	}
+
+	@Override
+	public List<Role> listGrantableParentRole(String roleId) {
+		String loginUserId = userLoginService.getRequireLoginUserId();
+		Role targetRole = mapper.selectById(roleId);
+		TimiException.required(targetRole, "not found role");
+		boolean systemAdmin = authorizationScopeService.isSystemAdmin(loginUserId);
+		Set<String> manageableRoleIdSet = Arrays.stream(ModuleCode.values())
+		                                        .flatMap(moduleCode -> authorizationScopeService.listManageableRole(loginUserId, moduleCode).stream())
+		                                                           .map(Role::getId)
+		                                                           .collect(Collectors.toSet());
+		Set<String> operatorRoleIdSet = listOperatorRoleId(loginUserId);
+		return mapper.selectAll()
+		             .stream()
+		             .filter(role -> !Objects.equals(role.getId(), targetRole.getId()))
+		             .filter(role -> !isManagementDescendant(targetRole.getId(), role.getId()))
+		             .filter(role -> systemAdmin || operatorRoleIdSet.contains(role.getId()) || manageableRoleIdSet.contains(role.getId()))
+		             .collect(Collectors.toMap(Role::getId, Function.identity(), (oldValue, newValue) -> oldValue, LinkedHashMap::new))
+		             .values()
+		             .stream()
+		             .toList();
+	}
+
+	@Transactional(TimiServerDBConfig.ROLLBACKER)
+	@Override
+	public void updateRoleParent(Role role) {
+		String loginUserId = userLoginService.getRequireLoginUserId();
+		TimiException.required(role.getId(), "not found role.id");
+		Role dbRole = mapper.selectById(role.getId());
+		TimiException.required(dbRole, "not found role");
+		authorizationBoundaryService.checkCanUpdateRoleParent(loginUserId, role.getId(), role.getParentRoleId());
+		mapper.updateSelective(role);
+		Logger logger = new Logger(Logger.Module.USER, Logger.Level.INFO, "USER_ROLE_PARENT_UPDATE");
+		logger.setUserId(loginUserId);
+		logger.setContent("roleId=%s;oldParentRoleId=%s;newParentRoleId=%s".formatted(role.getId(), dbRole.getParentRoleId(), role.getParentRoleId()));
+		logger.setResult(role.getId());
+		loggerService.createSync(logger);
+	}
+
+	public List<String> listAllRoleIdIncludingChildren(Collection<String> idList) {
+		return roleHierarchyService.listAllRoleIdIncludingChildren(idList);
+	}
+
+	private void fillRoleDefault(Role role) {
+		role.setBuiltin(TimiJava.defaultIfNull(role.getBuiltin(), false));
+		role.setProtectedRole(TimiJava.defaultIfNull(role.getProtectedRole(), false));
+		role.setOwnerType(TimiJava.defaultIfNull(role.getOwnerType(), AuthOwnerType.MODULE));
+		role.setOwnerId(TimiJava.defaultIfEmpty(role.getOwnerId(), role.getModuleCode() == null ? null : role.getModuleCode().name()));
+	}
+
+	private void fillRelationScope(RolePermissionInherit relation, Role childRole, String createdBy) {
+		if (childRole == null) {
+			return;
+		}
+		relation.setOwnerType(childRole.getOwnerType());
+		relation.setOwnerId(childRole.getOwnerId());
+		relation.setCreatedBy(createdBy);
+	}
+
+	private boolean canTouchRelation(String userId, Role parentRole, RolePermissionInherit relation) {
+		if (authorizationScopeService.isSystemAdmin(userId)) {
+			return true;
+		}
+		if (relation.getOwnerType() == AuthOwnerType.MODULE && parentRole != null && Objects.equals(relation.getOwnerId(), parentRole.getModuleCode().name())) {
+			return false;
+		}
+		ModuleResourceScopeResolver resolver = moduleResourceScopeResolverList.stream()
+		                                                                      .filter(item -> parentRole != null && parentRole.getModuleCode() == item.moduleCode())
+		                                                                      .findFirst()
+		                                                                      .orElse(null);
+		return resolver != null && resolver.canUseOwnerScope(userId, relation.getOwnerType(), relation.getOwnerId());
+	}
+
+	private boolean isCoreDelegationRoot(Role role) {
+		return role != null
+			&& ModuleCode.CORE == role.getModuleCode()
+			&& (com.imyeyu.api.bean.CoreRoleCode.SYSTEM.name().equals(role.getCode()) || com.imyeyu.api.bean.CoreRoleCode.ADMIN.name().equals(role.getCode()));
+	}
+
+	private Set<String> listOperatorGrantablePermissionId(String loginUserId, List<Permission> permissionList) {
+		if (TimiJava.isEmpty(permissionList)) {
+			return Set.of();
+		}
+		return permissionList.stream()
+		                     .map(Permission::getModuleCode)
+		                     .distinct()
+		                     .flatMap(moduleCode -> authorizationScopeService.listGrantablePermission(loginUserId, moduleCode).stream())
+		                     .map(Permission::getId)
+		                     .collect(Collectors.toSet());
+	}
+
+	private Set<String> listRoleDirectGrantablePermissionId(String loginUserId, Role role) {
+		boolean systemAdmin = authorizationScopeService.isSystemAdmin(loginUserId);
+		if (systemAdmin && isCoreDelegationRoot(role) && TimiJava.isEmpty(role.getParentRoleId())) {
+			return Arrays.stream(ModuleCode.values())
+			             .flatMap(moduleCode -> permissionService.listByModuleCode(moduleCode).stream())
+			             .map(Permission::getId)
+			             .collect(Collectors.toSet());
+		}
+		TimiException.requiredTrue(TimiJava.isNotEmpty(role.getParentRoleId()), "目标角色缺少管理父级");
+		Set<String> parentDelegationPermissionIdSet = listDelegationParentPermissionId(role.getId());
+		if (systemAdmin) {
+			return parentDelegationPermissionIdSet;
+		}
+		List<Permission> parentDelegationPermissionList = listPermissionById(parentDelegationPermissionIdSet);
+		Set<String> operatorGrantablePermissionIdSet = listOperatorGrantablePermissionId(loginUserId, parentDelegationPermissionList);
+		return parentDelegationPermissionIdSet.stream()
+		                                      .filter(operatorGrantablePermissionIdSet::contains)
+		                                      .collect(Collectors.toSet());
+	}
+
+	private List<Permission> listPermissionById(Set<String> permissionIdSet) {
+		if (TimiJava.isEmpty(permissionIdSet)) {
+			return List.of();
+		}
+		return Arrays.stream(ModuleCode.values())
+		             .flatMap(moduleCode -> permissionService.listByModuleCode(moduleCode).stream())
+		             .filter(permission -> permissionIdSet.contains(permission.getId()))
+		             .toList();
+	}
+
+	private Set<String> listDelegationParentPermissionId(String roleId) {
+		Role role = mapper.selectById(roleId);
+		if (role == null || TimiJava.isEmpty(role.getParentRoleId())) {
+			return Set.of();
+		}
+		return rolePermissionDelegationMapper.selectPermissionByRoleIdList(List.of(role.getParentRoleId()))
+			.stream()
+			.map(Permission::getId)
+			.collect(Collectors.toSet());
+	}
+
+	private Set<String> listOperatorRoleId(String loginUserId) {
+		List<String> roleIdList = userRoleMapper.selectByUserIdList(List.of(loginUserId)).stream().map(UserRole::getRoleId).toList();
+		if (TimiJava.isEmpty(roleIdList)) {
+			return Set.of();
+		}
+		return new HashSet<>(roleHierarchyService.listAllRoleIdIncludingChildren(loginUserId, roleIdList));
+	}
+
+	private boolean hasRoleBaseField(Role role) {
+		return role.getModuleCode() != null
+			|| role.getCode() != null
+			|| role.getNameLangId() != null
+			|| role.getDescription() != null
+			|| role.getBuiltin() != null
+			|| role.getProtectedRole() != null
+			|| role.getParentRoleId() != null
+			|| role.getOwnerType() != null
+			|| role.getOwnerId() != null
+			|| role.getCreatedBy() != null
+			|| role.getName() != null;
+	}
+
+	private void checkManageableRole(String loginUserId, Role role) {
+		Set<String> manageableRoleIdSet = authorizationScopeService.listManageableRole(loginUserId, role.getModuleCode())
+		                                                           .stream()
+		                                                           .map(Role::getId)
+		                                                           .collect(Collectors.toSet());
+		TimiException.requiredTrue(manageableRoleIdSet.contains(role.getId()), "角色不在可管理范围内：%s".formatted(role.getCode()));
+	}
+
+	private boolean isManagementDescendant(String parentRoleId, String childRoleId) {
+		List<Role> childRoleList = mapper.selectByParentRoleId(parentRoleId);
+		for (Role childRole : childRoleList) {
+			if (childRoleId.equals(childRole.getId()) || isManagementDescendant(childRole.getId(), childRoleId)) {
+				return true;
+			}
+		}
+		return false;
+	}
+
+	private void logRoleAuthorizationChange(String operation, String loginUserId, String roleId, Collection<String> addIdList, Collection<String> deleteIdList) {
+		if (TimiJava.isEmpty(addIdList) && TimiJava.isEmpty(deleteIdList)) {
+			return;
+		}
+		Logger logger = new Logger(Logger.Module.USER, Logger.Level.INFO, operation);
+		logger.setUserId(loginUserId);
+		logger.setContent("roleId=%s;addCount=%d;deleteCount=%d;addIdList=%s;deleteIdList=%s".formatted(
+			roleId,
+			TimiJava.isEmpty(addIdList) ? 0 : addIdList.size(),
+			TimiJava.isEmpty(deleteIdList) ? 0 : deleteIdList.size(),
+			TimiJava.isEmpty(addIdList) ? "" : String.join(",", addIdList),
+			TimiJava.isEmpty(deleteIdList) ? "" : String.join(",", deleteIdList)
+		));
+		logger.setResult(roleId);
+		loggerService.createSync(logger);
+	}
+
+	private String relationKey(RolePermissionInherit relation) {
+		return "%s|%s|%s".formatted(relation.getChildRoleId(), relation.getOwnerType(), relation.getOwnerId());
+	}
+
+	private String relationKey(String childRoleId, Role childRole) {
+		return "%s|%s|%s".formatted(childRoleId, childRole == null ? null : childRole.getOwnerType(), childRole == null ? null : childRole.getOwnerId());
 	}
 }
+

src/main/java/com/imyeyu/api/modules/user/service/implement/UserRoleServiceImplement.java

@@ -2,12 +2,16 @@ package com.imyeyu.api.modules.user.service.implement;
 
 import com.imyeyu.api.bean.ModuleCode;
 import com.imyeyu.api.config.dbsource.TimiServerDBConfig;
+import com.imyeyu.api.modules.user.bean.BootstrapData;
 import com.imyeyu.api.modules.user.entity.Permission;
 import com.imyeyu.api.modules.user.entity.Role;
 import com.imyeyu.api.modules.user.entity.UserRole;
 import com.imyeyu.api.modules.user.mapper.UserRoleMapper;
+import com.imyeyu.api.modules.user.service.AuthorizationBoundaryService;
 import com.imyeyu.api.modules.user.service.PermissionService;
+import com.imyeyu.api.modules.user.service.RoleHierarchyService;
 import com.imyeyu.api.modules.user.service.RoleService;
+import com.imyeyu.api.modules.user.service.UserLoginService;
 import com.imyeyu.api.modules.user.service.UserRoleService;
 import com.imyeyu.api.modules.user.vo.role.UserRoleAuthorizeRequest;
 import com.imyeyu.java.TimiJava;
@@ -40,6 +44,9 @@ public class UserRoleServiceImplement extends AbstractEntityService<UserRole, St
 
 	private final RoleService roleService;
 	private final PermissionService permissionService;
+	private final UserLoginService userLoginService;
+	private final AuthorizationBoundaryService authorizationBoundaryService;
+	private final RoleHierarchyService roleHierarchyService;
 
 	private final UserRoleMapper mapper;
 
@@ -78,7 +85,17 @@ public class UserRoleServiceImplement extends AbstractEntityService<UserRole, St
 		Set<String> addIdList = new HashSet<>(newIdSet);
 		addIdList.removeAll(dbIdSet);
 
+		String loginUserId = userLoginService.getRequireLoginUserId();
+		authorizationBoundaryService.checkCanRevokeRoles(loginUserId, req.getUserId(), deleteIdList);
+		authorizationBoundaryService.checkCanGrantRoles(loginUserId, req.getUserId(), addIdList);
+
 		if (TimiJava.isNotEmpty(deleteIdList)) {
+			for (String roleId : deleteIdList) {
+				UserRole userRole = new UserRole();
+				userRole.setUserId(req.getUserId());
+				userRole.setRoleId(roleId);
+				BootstrapData.checkProtectedUserRole(userRole);
+			}
 			deleteByRoleIdList(req.getUserId(), new ArrayList<>(deleteIdList));
 		}
 		if (TimiJava.isNotEmpty(addIdList)) {
@@ -123,7 +140,7 @@ public class UserRoleServiceImplement extends AbstractEntityService<UserRole, St
 	@Override
 	public List<String> listAllRoleCodeByUserId(String userId) {
 		List<String> roleIdList = listRoleByUserId(userId).stream().map(Role::getId).toList();
-		List<String> allRoleIdList = roleService.listAllRoleIdIncludingChildren(roleIdList);
+		List<String> allRoleIdList = roleHierarchyService.listAllRoleIdIncludingChildren(userId, roleIdList);
 		if (TimiJava.isEmpty(allRoleIdList)) {
 			return List.of();
 		}
@@ -133,7 +150,7 @@ public class UserRoleServiceImplement extends AbstractEntityService<UserRole, St
 	@Override
 	public List<Permission> listAllPermissionByUserId(String userId) {
 		List<String> roleIdList = listRoleByUserId(userId).stream().map(Role::getId).toList();
-		List<String> allRoleIdList = roleService.listAllRoleIdIncludingChildren(roleIdList);
+		List<String> allRoleIdList = roleHierarchyService.listAllRoleIdIncludingChildren(userId, roleIdList);
 		return permissionService.listByRoleId(allRoleIdList);
 	}
 

src/main/java/com/imyeyu/api/util/InitBuiltinUser.java

@@ -1,5 +1,7 @@
 package com.imyeyu.api.util;
 
+import com.imyeyu.api.bean.CorePermissionCode;
+import com.imyeyu.api.bean.CoreRoleCode;
 import com.imyeyu.api.bean.ModuleCode;
 import com.imyeyu.api.config.dbsource.TimiServerDBConfig;
 import com.imyeyu.api.modules.common.bean.ImageType;
@@ -14,16 +16,18 @@ import com.imyeyu.api.modules.user.bean.BuiltinRoleCode;
 import com.imyeyu.api.modules.user.entity.Permission;
 import com.imyeyu.api.modules.user.entity.Role;
 import com.imyeyu.api.modules.user.entity.RolePermission;
-import com.imyeyu.api.modules.user.entity.RoleRelation;
+import com.imyeyu.api.modules.user.entity.RolePermissionDelegation;
+import com.imyeyu.api.modules.user.entity.RolePermissionInherit;
 import com.imyeyu.api.modules.user.entity.User;
 import com.imyeyu.api.modules.user.entity.UserRole;
 import com.imyeyu.api.modules.user.mapper.PermissionMapper;
 import com.imyeyu.api.modules.user.mapper.RoleMapper;
+import com.imyeyu.api.modules.user.mapper.RolePermissionDelegationMapper;
+import com.imyeyu.api.modules.user.mapper.RolePermissionInheritMapper;
 import com.imyeyu.api.modules.user.mapper.RolePermissionMapper;
-import com.imyeyu.api.modules.user.mapper.RoleRelationMapper;
 import com.imyeyu.api.modules.user.mapper.UserRoleMapper;
 import com.imyeyu.api.modules.user.service.PermissionService;
-import com.imyeyu.api.modules.user.service.RoleRelationService;
+import com.imyeyu.api.modules.user.service.RolePermissionInheritService;
 import com.imyeyu.api.modules.user.service.RoleService;
 import com.imyeyu.api.modules.user.service.UserRoleService;
 import com.imyeyu.api.modules.user.service.UserService;
@@ -53,13 +57,14 @@ public class InitBuiltinUser implements ApplicationRunner {
 	private final LoggerService loggerService;
 	private final UserRoleService userRoleService;
 	private final PermissionService permissionService;
-	private final RoleRelationService roleRelationService;
+	private final RolePermissionInheritService rolePermissionInheritService;
 
 	private final RoleMapper roleMapper;
 	private final UserRoleMapper userRoleMapper;
 	private final PermissionMapper permissionMapper;
 	private final RolePermissionMapper rolePermissionMapper;
-	private final RoleRelationMapper roleRelationMapper;
+	private final RolePermissionDelegationMapper rolePermissionDelegationMapper;
+	private final RolePermissionInheritMapper rolePermissionInheritMapper;
 
 	/**
 	 * 初始化内建数据
@@ -73,8 +78,10 @@ public class InitBuiltinUser implements ApplicationRunner {
 		// 先同步所有内建权限和角色，再补齐继承与默认授权关系
 		Map<String, Permission> permissionMap = initBuiltinPermissionMap();
 		Map<String, Role> roleMap = initBuiltinRoleMap();
-		bindBuiltinRoleRelation(roleMap);
+		bindBuiltinRolePermissionInherit(roleMap);
+		bindBuiltinRoleParent(roleMap);
 		bindBuiltinPermission(roleMap, permissionMap);
+		bindBuiltinPermissionDelegation(roleMap, permissionMap);
 
 		Role systemRole = roleMap.get(BuiltinAuthRegistry.toRoleKey(BootstrapData.SYS_ROLE_MODULE_CODE, BootstrapData.SYS_ROLE_CODE));
 		// 初始化系统用户
@@ -94,9 +101,7 @@ public class InitBuiltinUser implements ApplicationRunner {
 
 			String logContent = "初始化 %s 自举用户成功，请立即修改密码：%s".formatted(BootstrapData.SYS_USER_NAME, password);
 
-			Logger logger = new Logger();
+			Logger logger = Logger.info(Logger.Module.SYSTEM, "INITIALIZE_SYSTEM_USER");
-			logger.setModule(Logger.Module.SYSTEM);
-			logger.setOperation("INITIALIZE_SYSTEM_USER");
 			logger.setUserId(user.getId());
 			logger.setContent(logContent);
 			loggerService.create(logger);
@@ -131,8 +136,12 @@ public class InitBuiltinUser implements ApplicationRunner {
 				permission.setModuleCode(item.getModuleCode());
 				permission.setCode(item.getValue());
 				permission.setName(item.getDefaultName());
+				fillBuiltinPermission(permission, item);
 				permissionService.create(permission);
 				permission = permissionMapper.selectByExample(example);
+			} else {
+				fillBuiltinPermission(permission, item);
+				permissionMapper.updateSelective(permission);
 			}
 			permissionMap.put(BuiltinAuthRegistry.toPermissionKey(item.getModuleCode(), item.getValue()), permission);
 		}
@@ -155,8 +164,12 @@ public class InitBuiltinUser implements ApplicationRunner {
 				role.setModuleCode(item.getModuleCode());
 				role.setCode(code);
 				role.setName(item.getDefaultName());
+				fillBuiltinRole(role, item);
 				roleService.create(role);
 				role = roleMapper.selectByExample(example);
+			} else {
+				fillBuiltinRole(role, item);
+				roleMapper.updateSelective(role);
 			}
 			roleMap.put(BuiltinAuthRegistry.toRoleKey(item.getModuleCode(), code), role);
 		}
@@ -166,7 +179,7 @@ public class InitBuiltinUser implements ApplicationRunner {
 	/// 按角色定义补齐父子角色关系
 	///
 	/// @param roleMap 已同步的角色映射
-	private void bindBuiltinRoleRelation(Map<String, Role> roleMap) {
+	private void bindBuiltinRolePermissionInherit(Map<String, Role> roleMap) {
 		for (BuiltinRoleCode item : BuiltinAuthRegistry.ROLE_CODE_LIST) {
 			if (TimiJava.isEmpty(item.getParentCode())) {
 				continue;
@@ -176,15 +189,26 @@ public class InitBuiltinUser implements ApplicationRunner {
 			if (parentRole == null || childRole == null) {
 				continue;
 			}
-			RoleRelation relation = new RoleRelation();
+			RolePermissionInherit relation = new RolePermissionInherit();
 			relation.setParentRoleId(parentRole.getId());
 			relation.setChildRoleId(childRole.getId());
-			if (roleRelationMapper.selectByExample(relation) == null) {
+			relation.setOwnerType(item.getOwnerType());
-				roleRelationService.create(relation);
+			relation.setOwnerId(item.getOwnerId());
+			if (rolePermissionInheritMapper.selectByExample(relation) == null) {
+				rolePermissionInheritService.create(relation);
 			}
 		}
 	}
 
+	/// 补齐内置角色管理父级
+	///
+	/// @param roleMap 已同步的角色映射
+	private void bindBuiltinRoleParent(Map<String, Role> roleMap) {
+		setRoleParent(roleMap, ModuleCode.CORE, CoreRoleCode.ADMIN.name(), ModuleCode.CORE, CoreRoleCode.SYSTEM.name());
+		setRoleParent(roleMap, ModuleCode.GAO, GaoRoleCode.GLOBAL_MANAGER.name(), ModuleCode.CORE, CoreRoleCode.ADMIN.name());
+		setRoleParent(roleMap, ModuleCode.GAO, GaoRoleCode.STORE_MANAGER.name(), ModuleCode.GAO, GaoRoleCode.GLOBAL_MANAGER.name());
+	}
+
 	/// 按权限定义补齐 SYSTEM 和 ADMIN 的默认权限
 	///
 	/// @param roleMap 已同步的角色映射
@@ -205,6 +229,12 @@ public class InitBuiltinUser implements ApplicationRunner {
 			if (item.isGrantToAdmin() && adminRole != null) {
 				createRolePermissionIfAbsent(adminRole.getId(), permission.getId());
 			}
+			if (item instanceof CorePermissionCode corePermission && isGrantToModuleRoleManager(corePermission) && gaoGlobalManagerRole != null) {
+				createRolePermissionIfAbsent(gaoGlobalManagerRole.getId(), permission.getId());
+			}
+			if (item instanceof CorePermissionCode corePermission && isGrantToModuleRoleManager(corePermission) && gaoStoreManagerRole != null) {
+				createRolePermissionIfAbsent(gaoStoreManagerRole.getId(), permission.getId());
+			}
 			if (item instanceof GaoPermissionCode gaoPermission && gaoPermission.isGrantToGlobalManager() && gaoGlobalManagerRole != null) {
 				createRolePermissionIfAbsent(gaoGlobalManagerRole.getId(), permission.getId());
 			}
@@ -214,6 +244,35 @@ public class InitBuiltinUser implements ApplicationRunner {
 		}
 	}
 
+	/// 按内置策略补齐角色转授权限
+	///
+	/// @param roleMap 已同步的角色映射
+	/// @param permissionMap 已同步的权限映射
+	private void bindBuiltinPermissionDelegation(Map<String, Role> roleMap, Map<String, Permission> permissionMap) {
+		Role systemRole = roleMap.get(BuiltinAuthRegistry.toRoleKey(BootstrapData.SYS_ROLE_MODULE_CODE, BootstrapData.SYS_ROLE_CODE));
+		Role adminRole = roleMap.get(BuiltinAuthRegistry.toRoleKey(BootstrapData.ADMIN_ROLE_MODULE_CODE, BootstrapData.ADMIN_ROLE_CODE));
+		Role gaoGlobalManagerRole = roleMap.get(BuiltinAuthRegistry.toRoleKey(ModuleCode.GAO, GaoRoleCode.GLOBAL_MANAGER.name()));
+		Role gaoStoreManagerRole = roleMap.get(BuiltinAuthRegistry.toRoleKey(ModuleCode.GAO, GaoRoleCode.STORE_MANAGER.name()));
+		for (BuiltinPermissionCode item : BuiltinAuthRegistry.PERMISSION_CODE_LIST) {
+			Permission permission = permissionMap.get(BuiltinAuthRegistry.toPermissionKey(item.getModuleCode(), item.getValue()));
+			if (permission == null) {
+				continue;
+			}
+			if (systemRole != null) {
+				createRolePermissionDelegationIfAbsent(systemRole.getId(), permission.getId());
+			}
+			if (adminRole != null) {
+				createRolePermissionDelegationIfAbsent(adminRole.getId(), permission.getId());
+			}
+			if (item instanceof GaoPermissionCode gaoPermission && gaoPermission.isGrantToStoreManager() && gaoGlobalManagerRole != null) {
+				createRolePermissionDelegationIfAbsent(gaoGlobalManagerRole.getId(), permission.getId());
+			}
+			if (item instanceof GaoPermissionCode gaoPermission && gaoPermission.isGrantToStoreManager() && gaoStoreManagerRole != null) {
+				createRolePermissionDelegationIfAbsent(gaoStoreManagerRole.getId(), permission.getId());
+			}
+		}
+	}
+
 	/// 角色权限关系不存在时才创建
 	///
 	/// @param roleId 角色 ID
@@ -230,4 +289,70 @@ public class InitBuiltinUser implements ApplicationRunner {
 		rolePermission.setPermissionId(permissionId);
 		rolePermissionMapper.insert(rolePermission);
 	}
+
+	/// 角色转授权限关系不存在时才创建
+	///
+	/// @param roleId 角色 ID
+	/// @param permissionId 权限 ID
+	private void createRolePermissionDelegationIfAbsent(String roleId, String permissionId) {
+		RolePermissionDelegation example = new RolePermissionDelegation();
+		example.setRoleId(roleId);
+		example.setPermissionId(permissionId);
+		if (rolePermissionDelegationMapper.selectByExample(example) != null) {
+			return;
+		}
+		RolePermissionDelegation rolePermissionDelegation = new RolePermissionDelegation();
+		rolePermissionDelegation.setRoleId(roleId);
+		rolePermissionDelegation.setPermissionId(permissionId);
+		rolePermissionDelegationMapper.insert(rolePermissionDelegation);
+	}
+
+	/// 填充内置权限元数据
+	///
+	/// @param permission 权限
+	/// @param item 内置权限定义
+	private void fillBuiltinPermission(Permission permission, BuiltinPermissionCode item) {
+		permission.setBuiltin(true);
+		permission.setProtectedPermission(item.isProtected());
+		permission.setOwnerType(item.getOwnerType());
+		permission.setOwnerId(item.getOwnerId());
+	}
+
+	/// 填充内置角色元数据
+	///
+	/// @param role 角色
+	/// @param item 内置角色定义
+	private void fillBuiltinRole(Role role, BuiltinRoleCode item) {
+		role.setBuiltin(true);
+		role.setProtectedRole(item.isProtected());
+		role.setOwnerType(item.getOwnerType());
+		role.setOwnerId(item.getOwnerId());
+	}
+
+	/// 设置角色管理父级
+	///
+	/// @param roleMap 已同步的角色映射
+	/// @param moduleCode 角色模块
+	/// @param roleCode 角色代码
+	/// @param parentModuleCode 父角色模块
+	/// @param parentRoleCode 父角色代码
+	private void setRoleParent(Map<String, Role> roleMap, ModuleCode moduleCode, String roleCode, ModuleCode parentModuleCode, String parentRoleCode) {
+		Role role = roleMap.get(BuiltinAuthRegistry.toRoleKey(moduleCode, roleCode));
+		Role parentRole = roleMap.get(BuiltinAuthRegistry.toRoleKey(parentModuleCode, parentRoleCode));
+		if (role == null || parentRole == null || parentRole.getId().equals(role.getParentRoleId())) {
+			return;
+		}
+		role.setParentRoleId(parentRole.getId());
+		roleMapper.updateSelective(role);
+	}
+
+	/// 判断权限是否默认授予模块角色管理员
+	///
+	/// @param permissionCode 核心权限
+	/// @return true 为授予
+	private boolean isGrantToModuleRoleManager(CorePermissionCode permissionCode) {
+		return permissionCode.name().startsWith("ROLE_")
+			|| permissionCode.name().startsWith("USER_ROLE_")
+			|| CorePermissionCode.PERMISSION_READ == permissionCode;
+	}
 }

src/main/resources/db/migration/timiserver/V26__add_authorization_boundary_fields.sql

@@ -0,0 +1,39 @@
+ALTER TABLE `role`
+	ADD COLUMN `builtin` BOOLEAN NOT NULL DEFAULT FALSE COMMENT 'true 为系统内置角色' AFTER `description`,
+	ADD COLUMN `protected_role` BOOLEAN NOT NULL DEFAULT FALSE COMMENT 'true 为受保护角色' AFTER `builtin`,
+	ADD COLUMN `parent_role_id` VARCHAR(36) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci COMMENT '管理父角色 ID' AFTER `protected_role`,
+	ADD COLUMN `owner_type` VARCHAR(32) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT 'MODULE' COMMENT '归属类型' AFTER `parent_role_id`,
+	ADD COLUMN `owner_id` VARCHAR(64) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci COMMENT '归属 ID' AFTER `owner_type`,
+	ADD COLUMN `created_by` VARCHAR(36) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci COMMENT '创建人用户 ID' AFTER `owner_id`,
+	ADD INDEX `idx_role_parent_role_id` (`parent_role_id`),
+	ADD INDEX `idx_role_owner` (`owner_type`, `owner_id`);
+
+ALTER TABLE `permission`
+	ADD COLUMN `builtin` BOOLEAN NOT NULL DEFAULT FALSE COMMENT 'true 为系统内置权限' AFTER `description`,
+	ADD COLUMN `protected_permission` BOOLEAN NOT NULL DEFAULT FALSE COMMENT 'true 为受保护权限' AFTER `builtin`,
+	ADD COLUMN `owner_type` VARCHAR(32) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT 'MODULE' COMMENT '归属类型' AFTER `protected_permission`,
+	ADD COLUMN `owner_id` VARCHAR(64) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci COMMENT '归属 ID' AFTER `owner_type`,
+	ADD COLUMN `created_by` VARCHAR(36) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci COMMENT '创建人用户 ID' AFTER `owner_id`,
+	ADD INDEX `idx_permission_owner` (`owner_type`, `owner_id`);
+
+RENAME TABLE `role_relation` TO `role_permission_inherit`;
+
+ALTER TABLE `role_permission_inherit`
+	DROP INDEX `idx_role_relation`,
+	DROP INDEX `idx_child_role_id`,
+	ADD INDEX `idx_role_permission_inherit` (`parent_role_id`, `child_role_id`),
+	ADD INDEX `idx_role_permission_inherit_child_role_id` (`child_role_id`);
+
+ALTER TABLE `role_permission_inherit`
+	ADD COLUMN `owner_type` VARCHAR(32) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT 'MODULE' COMMENT '归属类型' AFTER `child_role_id`,
+	ADD COLUMN `owner_id` VARCHAR(64) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci COMMENT '归属 ID' AFTER `owner_type`,
+	ADD COLUMN `created_by` VARCHAR(36) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci COMMENT '创建人用户 ID' AFTER `owner_id`,
+	ADD INDEX `idx_role_permission_inherit_owner` (`owner_type`, `owner_id`);
+
+UPDATE `role_permission_inherit` inherit
+INNER JOIN `role` child_role ON inherit.`child_role_id` = child_role.`id`
+SET inherit.`owner_id` = child_role.`module_code`
+WHERE
+	inherit.`owner_type` = 'MODULE'
+	AND inherit.`owner_id` IS NULL
+	AND inherit.`deleted_at` IS NULL;

src/main/resources/db/migration/timiserver/V27__add_role_permission_delegation.sql

@@ -0,0 +1,11 @@
+CREATE TABLE `role_permission_delegation` (
+	`id` VARCHAR(36) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
+	`role_id` VARCHAR(36) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '角色 ID',
+	`permission_id` VARCHAR(36) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '允许转授的权限 ID',
+	`created_by` VARCHAR(36) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci COMMENT '创建人用户 ID',
+	`created_at` BIGINT(20) COMMENT '创建时间',
+	`deleted_at` BIGINT(20) COMMENT '删除时间',
+	PRIMARY KEY (`id`) USING BTREE,
+	INDEX `idx_role_permission_delegation` (`role_id` ASC, `permission_id` ASC) USING BTREE,
+	INDEX `idx_permission_id` (`permission_id` ASC) USING BTREE
+) ENGINE = InnoDB CHARACTER SET = utf8mb4 COLLATE = utf8mb4_unicode_ci COMMENT = '角色转授权限' ROW_FORMAT = Dynamic;

src/main/resources/db/migration/timiserver/V28__deduplicate_permission_inherit_and_delegation.sql

@@ -0,0 +1,40 @@
+UPDATE `role_permission_delegation` target
+JOIN (
+	SELECT
+		id,
+		ROW_NUMBER() OVER (
+			PARTITION BY role_id, permission_id
+			ORDER BY created_at DESC, id DESC
+		) AS rn
+	FROM `role_permission_delegation`
+	WHERE deleted_at IS NULL
+) duplicate ON duplicate.id = target.id
+SET target.deleted_at = UNIX_TIMESTAMP() * 1000
+WHERE duplicate.rn > 1;
+
+ALTER TABLE `role_permission_delegation`
+	ADD COLUMN `active_key` TINYINT(1) GENERATED ALWAYS AS (IF(`deleted_at` IS NULL, 1, NULL)) STORED COMMENT '未删除唯一键';
+
+CREATE UNIQUE INDEX `uk_role_permission_delegation`
+	ON `role_permission_delegation` (`role_id`, `permission_id`, `active_key`);
+
+UPDATE `role_permission_inherit` target
+JOIN (
+	SELECT
+		id,
+		ROW_NUMBER() OVER (
+			PARTITION BY parent_role_id, child_role_id, owner_type, IFNULL(owner_id, '')
+			ORDER BY created_at DESC, id DESC
+		) AS rn
+	FROM `role_permission_inherit`
+	WHERE deleted_at IS NULL
+) duplicate ON duplicate.id = target.id
+SET target.deleted_at = UNIX_TIMESTAMP() * 1000
+WHERE duplicate.rn > 1;
+
+ALTER TABLE `role_permission_inherit`
+	ADD COLUMN `active_key` TINYINT(1) GENERATED ALWAYS AS (IF(`deleted_at` IS NULL, 1, NULL)) STORED COMMENT '未删除唯一键',
+	ADD COLUMN `owner_key` VARCHAR(64) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci GENERATED ALWAYS AS (IFNULL(`owner_id`, '')) STORED COMMENT '归属唯一键';
+
+CREATE UNIQUE INDEX `uk_role_permission_inherit`
+	ON `role_permission_inherit` (`parent_role_id`, `child_role_id`, `owner_type`, `owner_key`, `active_key`);

src/main/resources/mapper/timi-server/PermissionMapper.xml

@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd" >
+<mapper namespace="com.imyeyu.api.modules.user.mapper.PermissionMapper">
+	<select id="selectByIdList" resultType="com.imyeyu.api.modules.user.entity.Permission">
+		SELECT
+			*
+		FROM `permission`
+		WHERE
+			TRUE
+			<if test="idList != null and !idList.isEmpty()">
+				AND `id` IN
+				<foreach collection="idList" item="item" separator="," open="(" close=")">
+					#{item}
+				</foreach>
+			</if>
+			<if test="idList == null or idList.isEmpty()">
+				AND FALSE
+			</if>
+			AND `deleted_at` IS NULL
+	</select>
+	<select id="selectByModuleCode" resultType="com.imyeyu.api.modules.user.entity.Permission">
+		SELECT
+			*
+		FROM `permission`
+		WHERE
+			`module_code` = #{moduleCode}
+			AND `deleted_at` IS NULL
+		ORDER BY `code`
+	</select>
+</mapper>

src/main/resources/mapper/timi-server/RoleMapper.xml

@@ -1,6 +1,15 @@
 <?xml version="1.0" encoding="UTF-8" ?>
 <!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd" >
 <mapper namespace="com.imyeyu.api.modules.user.mapper.RoleMapper">
+	<select id="selectById" resultType="com.imyeyu.api.modules.user.entity.Role">
+		SELECT
+			*
+		FROM `role`
+		WHERE
+			`id` = #{id}
+			AND `deleted_at` IS NULL
+		LIMIT 1
+	</select>
 	<select id="selectByIdList" resultType="com.imyeyu.api.modules.user.entity.Role">
 		SELECT
 			*
@@ -27,4 +36,26 @@
 			AND `deleted_at` IS NULL
 		ORDER BY `created_at`
 	</select>
+	<select id="selectByParentRoleId" resultType="com.imyeyu.api.modules.user.entity.Role">
+		SELECT
+			*
+		FROM `role`
+		WHERE
+			<if test="parentRoleId != null">
+				`parent_role_id` = #{parentRoleId}
+			</if>
+			<if test="parentRoleId == null">
+				`parent_role_id` IS NULL
+			</if>
+			AND `deleted_at` IS NULL
+		ORDER BY `module_code`, `created_at`
+	</select>
+	<select id="selectAll" resultType="com.imyeyu.api.modules.user.entity.Role">
+		SELECT
+			*
+		FROM `role`
+		WHERE
+			`deleted_at` IS NULL
+		ORDER BY `module_code`, `created_at`
+	</select>
 </mapper>

src/main/resources/mapper/timi-server/RolePermissionDelegationMapper.xml

@@ -0,0 +1,53 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd" >
+<mapper namespace="com.imyeyu.api.modules.user.mapper.RolePermissionDelegationMapper">
+	<select id="selectByRoleIdList" resultType="com.imyeyu.api.modules.user.entity.RolePermissionDelegation">
+		SELECT
+			*
+		FROM `role_permission_delegation`
+		WHERE
+			`role_id` IN
+			<foreach collection="roleIdList" item="item" separator="," open="(" close=")">
+				#{item}
+			</foreach>
+			AND `deleted_at` IS NULL
+	</select>
+	<select id="selectPermissionByRoleIdList" resultType="com.imyeyu.api.modules.user.entity.Permission">
+		SELECT DISTINCT
+			permission.*
+		FROM `role_permission_delegation`
+		LEFT JOIN `permission` ON permission.id = role_permission_delegation.permission_id
+		WHERE
+			`role_permission_delegation`.`role_id` IN
+			<foreach collection="roleIdList" item="item" separator="," open="(" close=")">
+				#{item}
+			</foreach>
+			AND `role_permission_delegation`.`deleted_at` IS NULL
+			AND `permission`.`deleted_at` IS NULL
+		ORDER BY
+			`permission`.code ASC
+	</select>
+	<insert id="createBatch">
+		INSERT INTO `role_permission_delegation` (
+			id,
+			role_id,
+			permission_id,
+			created_by,
+			created_at
+		) VALUES
+			<foreach collection="rolePermissionDelegationList" item="item" separator=",">
+				(#{item.id}, #{item.roleId}, #{item.permissionId}, #{item.createdBy}, #{item.createdAt})
+			</foreach>
+	</insert>
+	<update id="deleteByPermissionIdList">
+		UPDATE `role_permission_delegation`
+		SET `deleted_at` = UNIX_TIMESTAMP()
+		WHERE
+			`role_id` = #{roleId}
+			AND `permission_id` IN
+			<foreach collection="permissionIdList" item="item" separator="," open="(" close=")">
+				#{item}
+			</foreach>
+			AND `deleted_at` IS NULL
+	</update>
+</mapper>

src/main/resources/mapper/timi-server/RolePermissionInheritMapper.xml

@@ -1,10 +1,10 @@
 <?xml version="1.0" encoding="UTF-8" ?>
 <!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd" >
-<mapper namespace="com.imyeyu.api.modules.user.mapper.RoleRelationMapper">
+<mapper namespace="com.imyeyu.api.modules.user.mapper.RolePermissionInheritMapper">
-	<select id="selectByParentRoleId" resultType="com.imyeyu.api.modules.user.entity.RoleRelation">
+	<select id="selectByParentRoleId" resultType="com.imyeyu.api.modules.user.entity.RolePermissionInherit">
 		SELECT
 			*
-		FROM `role_relation`
+		FROM `role_permission_inherit`
 		WHERE
 			`parent_role_id` = #{parentRoleId}
 			AND `deleted_at` IS NULL
@@ -12,15 +12,26 @@
 	<select id="selectChildRoleIdListByParentRoleId" resultType="java.lang.String">
 		SELECT
 			`child_role_id`
-		FROM `role_relation`
+		FROM `role_permission_inherit`
 		WHERE
 			`parent_role_id` = #{parentRoleId}
 			AND `deleted_at` IS NULL
 	</select>
+	<select id="selectByParentRoleIdList" resultType="com.imyeyu.api.modules.user.entity.RolePermissionInherit">
+		SELECT
+			*
+		FROM `role_permission_inherit`
+		WHERE
+			`parent_role_id` IN
+			<foreach collection="parentRoleIdList" item="item" separator="," open="(" close=")">
+				#{item}
+			</foreach>
+			AND `deleted_at` IS NULL
+	</select>
 	<select id="selectChildRoleIdListByParentRoleIdList" resultType="java.lang.String">
 		SELECT
 			`child_role_id`
-		FROM `role_relation`
+		FROM `role_permission_inherit`
 		WHERE
 			`parent_role_id` IN
 			<foreach collection="parentRoleIdList" item="item" separator="," open="(" close=")">
@@ -29,24 +40,34 @@
 			AND `deleted_at` IS NULL
 	</select>
 	<insert id="createBatch">
-		INSERT INTO `role_relation` (
+		INSERT INTO `role_permission_inherit` (
 			id,
 			parent_role_id,
 			child_role_id,
+			owner_type,
+			owner_id,
+			created_by,
 			created_at
 		) VALUES
-			<foreach collection="roleRelationList" item="item" separator=",">
+			<foreach collection="rolePermissionInheritList" item="item" separator=",">
-				(#{item.id}, #{item.parentRoleId}, #{item.childRoleId}, #{item.createdAt})
+				(#{item.id}, #{item.parentRoleId}, #{item.childRoleId}, #{item.ownerType}, #{item.ownerId}, #{item.createdBy}, #{item.createdAt})
 			</foreach>
 	</insert>
 	<update id="deleteByChildRoleIdList">
-		UPDATE `role_relation`
+		UPDATE `role_permission_inherit`
-		SET `deleted_at` = UNIX_TIMESTAMP()
+		SET `deleted_at` = UNIX_TIMESTAMP() * 1000
 		WHERE
 			`parent_role_id` = #{parentRoleId}
 			AND `child_role_id` IN
 			<foreach collection="childRoleIdList" item="item" separator="," open="(" close=")">
 				#{item}
 			</foreach>
+			AND `owner_type` = #{ownerType}
+			<if test="ownerId != null">
+				AND `owner_id` = #{ownerId}
+			</if>
+			<if test="ownerId == null">
+				AND `owner_id` IS NULL
+			</if>
 	</update>
 </mapper>

src/main/resources/mapper/timi-server/RolePermissionMapper.xml

@@ -13,7 +13,7 @@
 			AND `role_permission`.`deleted_at` IS NULL
 	</select>
 	<select id="selectPermissionByRoleIdList" resultType="com.imyeyu.api.modules.user.entity.Permission">
-		SELECT
+		SELECT DISTINCT
 			permission.*
 		FROM `role_permission`
 		LEFT JOIN `permission` ON permission.id = role_permission.permission_id