diff --git a/boot-web/src/main/java/com/xwbing/controller/sys/SysAuthorityControl.java b/boot-web/src/main/java/com/xwbing/controller/sys/SysAuthorityControl.java
new file mode 100644
index 0000000..ed3c880
--- /dev/null
+++ b/boot-web/src/main/java/com/xwbing/controller/sys/SysAuthorityControl.java
@@ -0,0 +1,107 @@
+package com.xwbing.controller.sys;
+
+import com.alibaba.fastjson.JSONObject;
+import com.xwbing.annotation.LogInfo;
+import com.xwbing.constant.CommonConstant;
+import com.xwbing.constant.CommonEnum;
+import com.xwbing.entity.SysAuthority;
+import com.xwbing.entity.vo.SysAuthVo;
+import com.xwbing.service.sys.SysAuthorityService;
+import com.xwbing.util.JSONObjResult;
+import com.xwbing.util.RestMessage;
+import io.swagger.annotations.Api;
+import io.swagger.annotations.ApiImplicitParam;
+import io.swagger.annotations.ApiOperation;
+import org.apache.commons.lang3.StringUtils;
+import org.springframework.web.bind.annotation.*;
+
+import javax.annotation.Resource;
+import java.util.List;
+
+/**
+ * 项目名称: boot-module-demo
+ * 创建时间: 2017/11/15 10:36
+ * 作者: xiangwb
+ * 说明: 权限控制层
+ */
+@Api(tags = "authorityApi", description = "权限相关接口")
+@RestController
+@RequestMapping("/authority/")
+public class SysAuthorityControl {
+    @Resource
+    private SysAuthorityService sysAuthorityService;
+
+    @LogInfo("添加权限")
+    @PostMapping("save")
+    @ApiOperation(value = "添加权限")
+    public JSONObject save(@RequestBody SysAuthority sysAuthority) {
+        RestMessage save = sysAuthorityService.save(sysAuthority);
+        return JSONObjResult.toJSONObj(save);
+    }
+
+    @LogInfo("删除权限")
+    @GetMapping("removeById")
+    @ApiOperation(value = "删除权限")
+    public JSONObject removeById(@RequestParam String id) {
+        if (StringUtils.isEmpty(id))
+            return JSONObjResult.toJSONObj("主键不能为空");
+        RestMessage result = sysAuthorityService.removeById(id);
+        return JSONObjResult.toJSONObj(result);
+    }
+
+    @LogInfo("修改权限")
+    @PostMapping("update")
+    @ApiOperation(value = "修改权限")
+    public JSONObject update(@RequestBody SysAuthority sysAuthority) {
+        if (StringUtils.isEmpty(sysAuthority.getId()))
+            return JSONObjResult.toJSONObj("主键不能为空");
+        String enable = sysAuthority.getEnable();
+        // 如果禁用，查询是否有子节点，如果有，子节点也要被禁用
+        if (CommonConstant.ISNOTENABLE.equals(enable)) {
+            // 子节点的权限都禁用
+            if (!sysAuthorityService.disableChildrenByParentId(sysAuthority.getId())) {
+                return JSONObjResult.toJSONObj("禁用子节点权限失败");
+            }
+        } else {
+            // 如果是启用看父节点是否被禁用,一级的不需要判断
+            if (!CommonConstant.ROOT.equals(sysAuthority.getParentId())) {
+                SysAuthority parent = sysAuthorityService.getById(sysAuthority.getParentId());
+                if (parent != null && CommonEnum.YesOrNoEnum.NO.getCode().equals(parent.getEnable()))
+                    return JSONObjResult.toJSONObj("父节点已被禁用，请先启用父节点");
+            }
+        }
+        RestMessage result = sysAuthorityService.update(sysAuthority);
+        return JSONObjResult.toJSONObj(result);
+    }
+
+    @LogInfo("根据是否启用查询所有权限")
+    @GetMapping("listByEnable")
+    @ApiOperation(value = "根据是否启用查询所有权限")
+    @ApiImplicitParam(name = "enable", value = "是否启用,格式Y|N", paramType = "query", dataType = "string")
+    public JSONObject listByEnable(String enable) {
+        List<SysAuthority> authoritys = sysAuthorityService.listByEnable(enable);
+        return JSONObjResult.toJSONObj(authoritys, true, "");
+    }
+
+    @LogInfo("根据父节点查询子节点")
+    @GetMapping("listByParentId")
+    @ApiOperation(value = "根据父节点查询子节点")
+    @ApiImplicitParam(name = "parentId", value = "父id,可为空", paramType = "query", dataType = "string")
+    public JSONObject listByParentId(String parentId) {
+        if (StringUtils.isEmpty(parentId))
+            parentId = CommonConstant.ROOT;
+        if (!CommonConstant.ROOT.equals(parentId) && sysAuthorityService.getById(parentId) == null)
+            return JSONObjResult.toJSONObj("父节点不存在");
+        List<SysAuthority> queryByParentId = sysAuthorityService.listByParentEnable(parentId, null);
+        return JSONObjResult.toJSONObj(queryByParentId, true, "");
+    }
+
+    @LogInfo("递归查询所有权限")
+    @GetMapping("listTree")
+    @ApiOperation(value = "递归查询所有权限")
+    @ApiImplicitParam(name = "enable", value = "是否启用,格式Y|N", paramType = "query", dataType = "string")
+    public JSONObject listTree(String enable) {
+        List<SysAuthVo> authoritys = sysAuthorityService.listChildren(CommonConstant.ROOT, enable);
+        return JSONObjResult.toJSONObj(authoritys, true, "");
+    }
+}
diff --git a/boot-web/src/main/java/com/xwbing/controller/sys/SysConfigControl.java b/boot-web/src/main/java/com/xwbing/controller/sys/SysConfigControl.java
new file mode 100644
index 0000000..531fcf9
--- /dev/null
+++ b/boot-web/src/main/java/com/xwbing/controller/sys/SysConfigControl.java
@@ -0,0 +1,107 @@
+package com.xwbing.controller.sys;
+
+import com.alibaba.fastjson.JSONObject;
+import com.xwbing.entity.SysConfig;
+import com.xwbing.service.sys.SysConfigService;
+import com.xwbing.util.JSONObjResult;
+import com.xwbing.util.RestMessage;
+import io.swagger.annotations.Api;
+import io.swagger.annotations.ApiImplicitParam;
+import io.swagger.annotations.ApiImplicitParams;
+import io.swagger.annotations.ApiOperation;
+import org.apache.commons.lang3.StringUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.web.bind.annotation.*;
+
+import javax.annotation.Resource;
+import javax.validation.Valid;
+import java.util.List;
+
+/**
+ * 说明: 系统配置控制层
+ * 项目名称: boot-module-demo
+ * 创建时间: 2017/5/10 16:36
+ * 作者:  xiangwb
+ */
+@Api(tags = "configApi", description = "系统配置相关接口")
+@RestController
+@RequestMapping("/config/")
+public class SysConfigControl {
+    private final Logger logger = LoggerFactory.getLogger(SysConfigControl.class);
+    @Resource
+    private SysConfigService sysConfigService;
+
+    @ApiOperation(value = "新增", notes = "新增系统配置信息")
+//    @ApiImplicitParams({
+//            @ApiImplicitParam(name = "code", value = "配置项的key，长度为1-50", paramType = "query", required = true, dataType = "string"),
+//            @ApiImplicitParam(name = "value", value = "配置项的值", paramType = "query", required = true, dataType = "string"),
+//            @ApiImplicitParam(name = "enable", value = "是否启用，格式为Y|N", paramType = "query", required = true, dataType = "string"),
+//            @ApiImplicitParam(name = "name", value = "配置名称，长度为1-10", paramType = "query", required = true, dataType = "string")
+//    })
+    @PostMapping("save")
+    public JSONObject save(@RequestBody @Valid SysConfig sysConfig) {
+        String logMsg = "新增系统配置信息";
+        logger.info(logMsg);
+        RestMessage result = sysConfigService.save(sysConfig);
+        return JSONObjResult.toJSONObj(result);
+    }
+
+    @ApiOperation(value = "删除", notes = "根据code删除系统配置信息")
+    @ApiImplicitParam(name = "code", value = "配置项的code", paramType = "query", required = true, dataType = "string")
+    @GetMapping("removeByCode")
+    public JSONObject removeByCode(@RequestParam String code) {
+        String logMsg = "删除系统配置信息";
+        logger.info(logMsg + " code:{}", code);
+        if (StringUtils.isEmpty(code)) {
+            return JSONObjResult.toJSONObj("code不能为空");
+        }
+        RestMessage result = sysConfigService.removeByCode(code);
+        return JSONObjResult.toJSONObj(result);
+    }
+
+    @ApiOperation(value = "修改", notes = "修改系统配置信息")
+    @ApiImplicitParams({
+            @ApiImplicitParam(name = "code", value = "配置项的key，长度为1-50", paramType = "query", required = true, dataType = "string"),
+            @ApiImplicitParam(name = "value", value = "配置项的值", paramType = "query", required = true, dataType = "string"),
+            @ApiImplicitParam(name = "enable", value = "是否启用，格式为Y|N", paramType = "query", required = true, dataType = "string"),
+    })
+    @PostMapping("update")
+    public JSONObject update(SysConfig sysConfig) {
+        String logMsg = "修改系统配置信息";
+        logger.info(logMsg);
+        if (StringUtils.isEmpty(sysConfig.getCode()))
+            return JSONObjResult.toJSONObj("配置项的code不能为空");
+        RestMessage result = sysConfigService.update(sysConfig);
+        return JSONObjResult.toJSONObj(result);
+    }
+
+    @ApiOperation(value = "查找", notes = "根据key查找系统配置信息")
+    @ApiImplicitParam(name = "code", value = "配置项的code", paramType = "query", required = true, dataType = "string")
+    @GetMapping("getByCode")
+    public JSONObject getByCode(@RequestParam String code) {
+        String logMsg = "根据code查找系统配置信息";
+        logger.info(logMsg + " code:{}", code);
+        if (StringUtils.isEmpty(code)) {
+            return JSONObjResult.toJSONObj("code不能为空");
+        }
+        SysConfig one = sysConfigService.getByCode(code);
+        if (one == null) {
+            return JSONObjResult.toJSONObj("该配置不存在");
+        }
+        return JSONObjResult.toJSONObj(one, true, "");
+    }
+
+    @ApiOperation(value = "查找列表", notes = "根据是否启用查找配置列表")
+    @ApiImplicitParam(name = "enable", value = "是否启用，格式为Y|N", paramType = "query", required = true, dataType = "string")
+    @GetMapping("listByEnable")
+    public JSONObject listByEnable(@RequestParam String enable) {
+        String logMsg = "根据是否启用查找配置列表";
+        logger.info(logMsg + " enable:{}", enable);
+        if (StringUtils.isEmpty(enable)) {
+            return JSONObjResult.toJSONObj("是否启用不能为空");
+        }
+        List<SysConfig> byEnable = sysConfigService.listByEnable(enable);
+        return JSONObjResult.toJSONObj(byEnable, true, "");
+    }
+}
diff --git a/boot-web/src/main/java/com/xwbing/controller/sys/SysRoleControl.java b/boot-web/src/main/java/com/xwbing/controller/sys/SysRoleControl.java
new file mode 100644
index 0000000..d77ef51
--- /dev/null
+++ b/boot-web/src/main/java/com/xwbing/controller/sys/SysRoleControl.java
@@ -0,0 +1,125 @@
+package com.xwbing.controller.sys;
+
+import com.alibaba.fastjson.JSONObject;
+import com.xwbing.annotation.LogInfo;
+import com.xwbing.entity.SysAuthority;
+import com.xwbing.entity.SysRole;
+import com.xwbing.entity.SysRoleAuthority;
+import com.xwbing.service.sys.SysAuthorityService;
+import com.xwbing.service.sys.SysRoleAuthorityService;
+import com.xwbing.service.sys.SysRoleService;
+import com.xwbing.util.JSONObjResult;
+import com.xwbing.util.RestMessage;
+import io.swagger.annotations.Api;
+import io.swagger.annotations.ApiImplicitParam;
+import io.swagger.annotations.ApiOperation;
+import org.apache.commons.lang3.StringUtils;
+import org.springframework.web.bind.annotation.*;
+
+import javax.annotation.Resource;
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * 项目名称: boot-module-demo
+ * 创建时间: 2017/11/14 10:41
+ * 作者: xiangwb
+ * 说明:
+ */
+@Api(tags = "sysRoleApi", description = "角色相关接口")
+@RestController
+@RequestMapping("/role/")
+public class SysRoleControl {
+    @Resource
+    private SysRoleService sysRoleService;
+    @Resource
+    private SysAuthorityService sysAuthorityService;
+    @Resource
+    private SysRoleAuthorityService sysRoleAuthorityService;
+
+    @LogInfo("添加角色")
+    @PostMapping("save")
+    @ApiOperation(value = "添加角色")
+    public JSONObject save(@RequestBody SysRole sysRole) {
+        RestMessage result = sysRoleService.save(sysRole);
+        return JSONObjResult.toJSONObj(result);
+    }
+
+    @LogInfo("删除角色")
+    @GetMapping("removeById")
+    @ApiOperation(value = "删除角色")
+    public JSONObject removeById(@RequestParam String id) {
+        if (StringUtils.isEmpty(id))
+            return JSONObjResult.toJSONObj("主键不能为空");
+        RestMessage result = sysRoleService.removeById(id);
+        return JSONObjResult.toJSONObj(result);
+    }
+
+    @LogInfo("修改角色")
+    @PostMapping("update")
+    @ApiOperation(value = "修改角色")
+    public JSONObject update(@RequestBody SysRole sysRole) {
+        if (StringUtils.isEmpty(sysRole.getId()))
+            return JSONObjResult.toJSONObj("主键不能为空");
+        RestMessage result = sysRoleService.update(sysRole);
+        return JSONObjResult.toJSONObj(result);
+    }
+
+    @LogInfo("获取角色详情")
+    @GetMapping("getById")
+    @ApiOperation(value = "获取角色详情")
+    public JSONObject getById(@RequestParam String id) {
+        if (StringUtils.isEmpty(id))
+            return JSONObjResult.toJSONObj("主键不能为空");
+        SysRole sysRole = sysRoleService.getById(id);
+        if (sysRole == null)
+            return JSONObjResult.toJSONObj("该角色不存在");
+        return JSONObjResult.toJSONObj(sysRole, true, "");
+    }
+
+    @LogInfo("根据是否启用查询所有角色")
+    @GetMapping("listByEnable")
+    @ApiOperation(value = "根据是否启用查询所有角色")
+    @ApiImplicitParam(name = "enable", value = "是否启用,格式Y|N", paramType = "query", dataType = "string")
+    public JSONObject listByEnable(String enable) {
+        List<SysRole> sysRoles = sysRoleService.listAllByEnable(enable);
+        return JSONObjResult.toJSONObj(sysRoles, true, "");
+    }
+
+    @LogInfo("根据角色主键查找权限")
+    @PostMapping("listAuthorityByRoleId")
+    @ApiOperation(value = "根据角色主键查找权限")
+    @ApiImplicitParam(name = "enable", value = "是否启用,格式Y|N", paramType = "query", dataType = "string")
+    public JSONObject listAuthorityByRoleId(@RequestParam String roleId, String enable) {
+        if (StringUtils.isEmpty(roleId))
+            return JSONObjResult.toJSONObj("角色主键不能为空");
+        SysRole sysRole = sysRoleService.getById(roleId);
+        if (sysRole == null)
+            return JSONObjResult.toJSONObj("该角色不存在");
+        List<SysAuthority> authoritys = sysAuthorityService.listByRoleIdEnable(roleId, enable);
+        return JSONObjResult.toJSONObj(authoritys, true, "");
+    }
+
+    @LogInfo("保存角色权限")
+    @PostMapping("saveAuthority")
+    @ApiOperation(value = "保存角色权限")
+    public JSONObject saveAuthority(@RequestParam String authorityIds, @RequestParam String roleId) {
+        if (StringUtils.isEmpty(authorityIds))
+            return JSONObjResult.toJSONObj("权限主键集合不能为空");
+        if (StringUtils.isEmpty(roleId))
+            return JSONObjResult.toJSONObj("角色主键不能为空");
+        SysRole sysRole = sysRoleService.getById(roleId);
+        if (sysRole == null)
+            return JSONObjResult.toJSONObj("该角色不存在");
+        String ids[] = authorityIds.split(",");
+        List<SysRoleAuthority> list = new ArrayList<>();
+        for (String id : ids) {
+            SysRoleAuthority roleAuthority = new SysRoleAuthority();
+            roleAuthority.setRoleId(roleId);
+            roleAuthority.setAuthorityId(id);
+            list.add(roleAuthority);
+        }
+        RestMessage restMessage = sysRoleAuthorityService.saveBatch(list, roleId);
+        return JSONObjResult.toJSONObj(restMessage);
+    }
+}
diff --git a/boot-web/src/main/java/com/xwbing/controller/sys/SysUserControl.java b/boot-web/src/main/java/com/xwbing/controller/sys/SysUserControl.java
new file mode 100644
index 0000000..2d2d2bf
--- /dev/null
+++ b/boot-web/src/main/java/com/xwbing/controller/sys/SysUserControl.java
@@ -0,0 +1,213 @@
+package com.xwbing.controller.sys;
+
+import com.alibaba.fastjson.JSONObject;
+import com.xwbing.annotation.LogInfo;
+import com.xwbing.constant.CommonConstant;
+import com.xwbing.constant.CommonEnum;
+import com.xwbing.entity.SysAuthority;
+import com.xwbing.entity.SysRole;
+import com.xwbing.entity.SysUser;
+import com.xwbing.entity.SysUserRole;
+import com.xwbing.service.sys.SysAuthorityService;
+import com.xwbing.service.sys.SysRoleService;
+import com.xwbing.service.sys.SysUserRoleService;
+import com.xwbing.service.sys.SysUserService;
+import com.xwbing.util.CommonDataUtil;
+import com.xwbing.util.JSONObjResult;
+import com.xwbing.util.RestMessage;
+import io.swagger.annotations.Api;
+import io.swagger.annotations.ApiImplicitParam;
+import io.swagger.annotations.ApiOperation;
+import org.apache.commons.collections.CollectionUtils;
+import org.apache.commons.lang3.StringUtils;
+import org.springframework.web.bind.annotation.*;
+
+import javax.annotation.Resource;
+import javax.servlet.http.HttpServletRequest;
+import javax.validation.Valid;
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * 说明: 用户控制层
+ * 项目名称: boot-module-demo
+ * 创建时间: 2017/5/10 16:36
+ * 作者:  xiangwb
+ */
+@Api(tags = "userApi", description = "用户相关接口")
+@RestController
+@RequestMapping("/user/")
+public class SysUserControl {
+    @Resource
+    private SysUserService sysUserService;
+    @Resource
+    private SysUserRoleService sysUserRoleService;
+    @Resource
+    private SysRoleService sysRoleService;
+    @Resource
+    private SysAuthorityService sysAuthorityService;
+
+    @LogInfo("添加用户")
+    @PostMapping("save")
+    @ApiOperation(value = "添加用户")
+    public JSONObject save(@RequestBody @Valid SysUser sysUser) {
+        RestMessage result = sysUserService.save(sysUser);
+        return JSONObjResult.toJSONObj(result);
+    }
+
+    @LogInfo("删除用户")
+    @GetMapping("removeById")
+    @ApiOperation(value = "删除用户")
+    public JSONObject removeById(@RequestParam String id) {
+        if (StringUtils.isEmpty(id))
+            return JSONObjResult.toJSONObj("主键不能为空");
+        RestMessage result = sysUserService.removeById(id);
+        return JSONObjResult.toJSONObj(result);
+    }
+
+    @LogInfo("修改用户信息")
+    @PostMapping("update")
+    @ApiOperation(value = "修改用户信息")
+    public JSONObject update(@RequestBody @Valid SysUser sysUser) {
+        if (StringUtils.isEmpty(sysUser.getId()))
+            return JSONObjResult.toJSONObj("主键不能为空");
+        RestMessage result = sysUserService.update(sysUser);
+        return JSONObjResult.toJSONObj(result);
+    }
+
+    @LogInfo("获取用户详情")
+    @GetMapping("getById")
+    @ApiOperation(value = "获取用户详情")
+    public JSONObject getById(@RequestParam String id) {
+        if (StringUtils.isEmpty(id))
+            return JSONObjResult.toJSONObj("主键不能为空");
+        SysUser sysUser = sysUserService.getOne(id);
+        if (sysUser == null)
+            return JSONObjResult.toJSONObj("未查到该对象");
+        return JSONObjResult.toJSONObj(sysUser, true, "");
+    }
+
+    @LogInfo("列表查询所有用户")
+    @GetMapping("listAll")
+    @ApiOperation(value = "列表查询所有用户")
+    public JSONObject listAll() {
+        List<SysUser> list = sysUserService.listAll();
+        return JSONObjResult.toJSONObj(list, true, "");
+    }
+
+    @LogInfo("登录")
+    @PostMapping("login")
+    @ApiOperation(value = "登录")
+    public JSONObject login(HttpServletRequest request, @RequestParam String userName, @RequestParam String passWord, @RequestParam String checkCode) {
+        if (StringUtils.isEmpty(userName) || StringUtils.isEmpty(passWord))
+            return JSONObjResult.toJSONObj("用户名或密码不能为空");
+        if (StringUtils.isEmpty(checkCode))
+            return JSONObjResult.toJSONObj("请输入验证码");
+        RestMessage login = sysUserService.login(request, userName, passWord, checkCode);
+        return JSONObjResult.toJSONObj(login);
+    }
+
+    @LogInfo("登出")
+    @GetMapping("logout")
+    @ApiOperation(value = "登出")
+    public JSONObject logout(HttpServletRequest request) {
+        RestMessage logout = sysUserService.logout(request);
+        return JSONObjResult.toJSONObj(logout);
+    }
+
+    @LogInfo("修改密码")
+    @PostMapping("updatePassWord")
+    @ApiOperation(value = "修改密码")
+    public JSONObject updatePassWord(@RequestParam String newPassWord, @RequestParam String oldPassWord, @RequestParam String id) {
+        if (StringUtils.isEmpty(id))
+            return JSONObjResult.toJSONObj("主键不能为空");
+        if (StringUtils.isEmpty(newPassWord) || StringUtils.isEmpty(oldPassWord))
+            return JSONObjResult.toJSONObj("原密码或新密码不能为空");
+        RestMessage restMessage = sysUserService.updatePassWord(newPassWord, oldPassWord, id);
+        return JSONObjResult.toJSONObj(restMessage);
+    }
+
+    @LogInfo("重置密码")
+    @GetMapping("resetPassWord")
+    @ApiOperation(value = "重置密码")
+    public JSONObject resetPassWord(@RequestParam String id) {
+        if (StringUtils.isEmpty(id))
+            return JSONObjResult.toJSONObj("主键不能为空");
+        RestMessage restMessage = sysUserService.resetPassWord(id);
+        return JSONObjResult.toJSONObj(restMessage);
+    }
+
+    @LogInfo("获取当前登录用户信息")
+    @GetMapping("getLoginUserInfo")
+    @ApiOperation(value = "获取当前登录用户信息")
+    public JSONObject getLoginUserInfo() {
+        SysUser sysUser = sysUserService.getOne((String) CommonDataUtil.getToken(CommonConstant.CURRENT_USER_ID));
+        if (sysUser == null)
+            return JSONObjResult.toJSONObj("未获取到当前登录用户信息");
+        List<SysAuthority> button = new ArrayList<>();
+        List<SysAuthority> menu = new ArrayList<>();
+        List<SysAuthority> list;
+        if (CommonEnum.YesOrNoEnum.YES.getCode().equalsIgnoreCase(sysUser.getAdmin()))
+            list = sysAuthorityService.listByEnable(CommonEnum.YesOrNoEnum.YES.getCode());
+        else
+            list = sysUserService.queryAuthority(sysUser.getId(), CommonEnum.YesOrNoEnum.YES.getCode());
+        if (CollectionUtils.isNotEmpty(list)) {
+            for (SysAuthority sysAuthority : list) {
+                if (sysAuthority.getType() == CommonEnum.MenuOrButtonEnum.MENU.getCode())
+                    menu.add(sysAuthority);
+                else
+                    button.add(sysAuthority);
+            }
+        }
+        sysUser.setMenuArray(menu);
+        sysUser.setButtonArray(button);
+        return JSONObjResult.toJSONObj(sysUser, true, "");
+    }
+
+    @LogInfo("保存用户角色")
+    @PostMapping("saveRole")
+    @ApiOperation(value = "保存用户角色")
+    public JSONObject saveRole(@RequestParam String roleIds, @RequestParam String userId) {
+        if (StringUtils.isEmpty(roleIds))
+            return JSONObjResult.toJSONObj("角色主键不能为空");
+        if (StringUtils.isEmpty(userId))
+            return JSONObjResult.toJSONObj("用户主键不能为空");
+        SysUser old = sysUserService.getOne(userId);
+        if (old == null)
+            return JSONObjResult.toJSONObj("该用户不存在");
+        if (CommonEnum.YesOrNoEnum.YES.getCode().equalsIgnoreCase(old.getAdmin()))
+            return JSONObjResult.toJSONObj("不能对管理员进行操作");
+        String ids[] = roleIds.split(",");
+        List<SysUserRole> list = new ArrayList<>();
+        for (String id : ids) {
+            SysUserRole userRole = new SysUserRole();
+            userRole.setRoleId(id);
+            userRole.setUserId(userId);
+            list.add(userRole);
+        }
+        RestMessage restMessage = sysUserRoleService.saveBatch(list, userId);
+        return JSONObjResult.toJSONObj(restMessage);
+    }
+
+    @LogInfo("根据用户主键查找所拥有的角色")
+    @PostMapping("listRoleByUserId")
+    @ApiOperation(value = "根据用户主键查找所拥有的角色")
+    @ApiImplicitParam(name = "enable", value = "是否启用,格式Y|N", paramType = "query", dataType = "string")
+    public JSONObject listRoleByUserId(@RequestParam String userId, String enable) {
+        if (StringUtils.isEmpty(userId))
+            return JSONObjResult.toJSONObj("用户主键不能为空");
+        List<SysRole> list = sysRoleService.listByUserIdEnable(userId, enable);
+        return JSONObjResult.toJSONObj(list, true, "");
+    }
+
+    @LogInfo("根据用户主键查找所拥有的权限")
+    @PostMapping("listAuthorityByUserId")
+    @ApiOperation(value = "根据用户主键查找所拥有的权限")
+    @ApiImplicitParam(name = "enable", value = "是否启用,格式Y|N", paramType = "query", dataType = "string")
+    public JSONObject listAuthorityByUserId(@RequestParam String userId, String enable) {
+        if (StringUtils.isEmpty(userId))
+            return JSONObjResult.toJSONObj("用户主键不能为空");
+        List<SysAuthority> list = sysUserService.queryAuthority(userId, enable);
+        return JSONObjResult.toJSONObj(list, true, "");
+    }
+}
diff --git a/boot-web/src/main/java/com/xwbing/controller/sys/SysUserLoginInOutControl.java b/boot-web/src/main/java/com/xwbing/controller/sys/SysUserLoginInOutControl.java
new file mode 100644
index 0000000..3e78d41
--- /dev/null
+++ b/boot-web/src/main/java/com/xwbing/controller/sys/SysUserLoginInOutControl.java
@@ -0,0 +1,38 @@
+package com.xwbing.controller.sys;
+
+import com.alibaba.fastjson.JSONObject;
+import com.xwbing.annotation.LogInfo;
+import com.xwbing.entity.SysUserLoginInOut;
+import com.xwbing.service.sys.SysUserLoginInOutService;
+import com.xwbing.util.JSONObjResult;
+import io.swagger.annotations.Api;
+import io.swagger.annotations.ApiOperation;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+
+import javax.annotation.Resource;
+import java.util.List;
+
+/**
+ * 项目名称: boot-module-demo
+ * 创建时间: 2017/11/7 11:16
+ * 作者: xiangwb
+ * 说明: 用户登录登出控制层
+ */
+@Api(tags = "inoutApi", description = "登陆登出相关接口")
+@RestController
+@RequestMapping("/inout/")
+public class SysUserLoginInOutControl {
+    @Resource
+    private SysUserLoginInOutService inOutService;
+
+    @LogInfo("获取登录或登出信息")
+    @GetMapping("listByType")
+    @ApiOperation(value = "获取登录或登出信息")
+    public JSONObject listByType(@RequestParam int inout) {
+        List<SysUserLoginInOut> sysUserLoginInOuts = inOutService.listByType(inout);
+        return JSONObjResult.toJSONObj(sysUserLoginInOuts, true, "获取列表成功");
+    }
+}