diff --git a/app/Console/Commands/UpdateSuperPermissions.php b/app/Console/Commands/UpdateSuperPermissions.php
index 637d6f8..c662b0b 100644
--- a/app/Console/Commands/UpdateSuperPermissions.php
+++ b/app/Console/Commands/UpdateSuperPermissions.php
@@ -2,6 +2,7 @@
 
 namespace App\Console\Commands;
 
+use App\Models\User;
 use Illuminate\Console\Command;
 use Spatie\Permission\Models\Permission;
 use Spatie\Permission\Models\Role;
@@ -39,9 +40,12 @@ class UpdateSuperPermissions extends Command
      */
     public function handle()
     {
-        $role = Role::query()->where('name', '超级管理员')->find(1);
+        $roleName = '超级管理员';
+        $role = Role::query()->where('name', $roleName)->find(1);
         $permissions = Permission::query()->get();
         $role->syncPermissions($permissions);
+        $user = User::query()->find(1);
+        $user->assignRole($role);
         $this->info('更新成功');
     }
 }
diff --git a/app/Http/Controllers/Goods/GoodsSkusController.php b/app/Http/Controllers/Goods/GoodsSkusController.php
index 97053f1..e04ad52 100644
--- a/app/Http/Controllers/Goods/GoodsSkusController.php
+++ b/app/Http/Controllers/Goods/GoodsSkusController.php
@@ -25,7 +25,6 @@ class GoodsSkusController extends Controller
 {
     public function __construct(Request $request)
     {
-//        $this->middleware(['role:super-admin','permission:publish articles|edit articles']);
         $this->log = new LogModel([
             'module' => 'goods',
             'action' => $request->getMethod(),
diff --git a/app/Http/Controllers/Menu/MenusController.php b/app/Http/Controllers/Menu/MenusController.php
index ee53406..dd50b68 100644
--- a/app/Http/Controllers/Menu/MenusController.php
+++ b/app/Http/Controllers/Menu/MenusController.php
@@ -6,6 +6,8 @@ use App\Http\Controllers\Controller;
 use App\Models\Log as LogModel;
 use App\Models\Menu;
 use App\Http\Resources\MenusResource;
+use App\Models\User;
+use App\Utils\ArrayUtils;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Validator;
 use Illuminate\Validation\Rule;
@@ -22,10 +24,18 @@ class MenusController extends Controller
         ]);
     }
 
-    public function index()
+    public function index(Request $request)
     {
-        $menus = Menu::query()->get();
-        $menus = FormatUtils::formatTreeData($menus, 0);
+        $permissions = $request->user()->getPermissionsViaRoles()->toArray();
+        $permissions = array_column($permissions, 'name');
+        $menus = Menu::query()->get()->toArray();
+        $hasPermissionMenus = [];
+        foreach ($menus as $menu) {
+            if (in_array($menu['code'], $permissions, true)) {
+                $hasPermissionMenus[] = $menu;
+            }
+        }
+        $menus = FormatUtils::formatTreeData($hasPermissionMenus, 0);
 
         return MenusResource::collection($menus);
     }
diff --git a/app/Http/Controllers/Permission/PermissionsController.php b/app/Http/Controllers/Permission/PermissionsController.php
index 7507489..112f82b 100644
--- a/app/Http/Controllers/Permission/PermissionsController.php
+++ b/app/Http/Controllers/Permission/PermissionsController.php
@@ -4,6 +4,8 @@ namespace App\Http\Controllers\Permission;
 
 use App\Http\Controllers\Controller;
 use App\Models\Log as LogModel;
+use App\Utils\ArrayUtils;
+use App\Utils\FormatUtils;
 use Spatie\Permission\Models\Permission;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Validator;
@@ -23,9 +25,15 @@ class PermissionsController extends Controller
 
     public function index()
     {
-        $permissions = Permission::query()->get();
+        $permissions = Permission::query()->get()->toArray();
+        $permissions = ArrayUtils::index($permissions, 'name');
+        $routes = include(resource_path('lang/zh-CN/permission.php'));
+        foreach ($routes as $key => &$route) {
+            $route['id'] = $permissions[$key]['id'];
+        }
+        $routes = FormatUtils::formatTreeData($routes, 0);
 
-        return PermissionsResource::collection($permissions);
+        return PermissionsResource::collection($routes);
     }
 
     public function store(Request $request)
diff --git a/app/Http/Kernel.php b/app/Http/Kernel.php
index b1c73d6..cf52c70 100644
--- a/app/Http/Kernel.php
+++ b/app/Http/Kernel.php
@@ -63,6 +63,7 @@ class Kernel extends HttpKernel
         'verified' => \Illuminate\Auth\Middleware\EnsureEmailIsVerified::class,
         'role' => \Spatie\Permission\Middlewares\RoleMiddleware::class,
         'permission' => \Spatie\Permission\Middlewares\PermissionMiddleware::class,
+        'check.permissions' => \App\Http\Middleware\CheckPermissions::class,
     ];
 
     /**
diff --git a/app/Http/Middleware/CheckPermissions.php b/app/Http/Middleware/CheckPermissions.php
new file mode 100644
index 0000000..b8f8ae4
--- /dev/null
+++ b/app/Http/Middleware/CheckPermissions.php
@@ -0,0 +1,38 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Support\Facades\Route;
+
+class CheckPermissions
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param \Illuminate\Http\Request $request
+     * @param \Closure $next
+     * @return mixed
+     */
+    public function handle($request, Closure $next)
+    {
+        // 获取当前路由名称
+        $currentRouteName = Route::currentRouteName();
+        // 引入当前守卫的权限文件
+        $routes = include(resource_path('lang/zh-CN/permission.php'));
+        if (is_array($routes) && array_key_exists($currentRouteName, $routes)) {
+            $permissions = $request->user()->getPermissionsViaRoles()->toArray();
+            $permissions = array_column($permissions, 'name');
+            if (in_array($currentRouteName, $permissions, true)) {
+                return $next($request);
+            }
+        }
+
+        $res = [
+            'httpCode' => 403,
+            'errorCode' => 403403,
+            'errorMessage' => '您没有使用此功能的权限',
+        ];
+        return response($res, 403);
+    }
+}
diff --git a/app/Models/User.php b/app/Models/User.php
index b6d8d5e..88194f2 100644
--- a/app/Models/User.php
+++ b/app/Models/User.php
@@ -43,4 +43,9 @@ class User extends Authenticatable
     {
         $this->attributes['password'] = Hash::make($value);
     }
+
+    public function isRoot()
+    {
+        return $this->name === 'erpAdmin';
+    }
 }
diff --git a/config/filesystems.php b/config/filesystems.php
index 9df9941..b2f1d2f 100644
--- a/config/filesystems.php
+++ b/config/filesystems.php
@@ -76,6 +76,10 @@ return [
             'isCName'       => false, // 是否使用自定义域名,true: 则Storage.url()会使用自定义的cdn或域名生成文件url， false: 则使用外部节点生成url
             'debug'         => true
         ],
+        'root' => [
+            'driver' => 'local',
+            'root' => '/'
+        ]
     ],
 
 ];
diff --git a/database/migrations/2022_07_26_105818_create_logs_table.php b/database/migrations/2022_07_26_105818_create_logs_table.php
index 2a30d1c..da9c3c2 100644
--- a/database/migrations/2022_07_26_105818_create_logs_table.php
+++ b/database/migrations/2022_07_26_105818_create_logs_table.php
@@ -24,7 +24,7 @@ class CreateLogsTable extends Migration
             $table->text('after_update')->nullable()->comment('更新后数据');
             $table->text('message')->nullable()->comment('备注信息');
             $table->bigInteger('user_id')->comment('操作人id');
-            $table->index('target_type', 'target_id', 'target_field');
+            $table->index(['target_type', 'target_id', 'target_field']);
             $table->timestamps();
         });
     }
diff --git a/database/seeds/PermissionsTableSeeder.php b/database/seeds/PermissionsTableSeeder.php
index 0df8a79..c0aa0f7 100644
--- a/database/seeds/PermissionsTableSeeder.php
+++ b/database/seeds/PermissionsTableSeeder.php
@@ -12,17 +12,11 @@ class PermissionsTableSeeder extends Seeder
      */
     public function run()
     {
-        DB::table('permissions')->insert([
-            ['name' => 'GOODS_MANAGE', 'guard_name' => 'api'],
-            ['name' => 'GOODS_LIST', 'guard_name' => 'api'],
-            ['name' => 'GOODS_TYPE', 'guard_name' => 'api'],
-            ['name' => 'GOODS_BRAND', 'guard_name' => 'api'],
-            ['name' => 'SHOP_MANAGE', 'guard_name' => 'api'],
-            ['name' => 'USER_MANAGE', 'guard_name' => 'api'],
-            ['name' => 'SYSTEM_MANAGE', 'guard_name' => 'api'],
-            ['name' => 'ROLE_MANAGE', 'guard_name' => 'api'],
-            ['name' => 'PERMISSION_MANAGE', 'guard_name' => 'api'],
-            ['name' => 'SYSTEM_LOG', 'guard_name' => 'api'],
-        ]);
+        $routes = include(resource_path('lang/zh-CN/permission.php'));
+        $data = [];
+        foreach ($routes as $key => $route) {
+            $data[] = ['name' => $key, 'guard_name' => 'api'];
+        }
+        DB::table('permissions')->insert($data);
     }
 }
diff --git a/resources/lang/zh-CN/permission.php b/resources/lang/zh-CN/permission.php
new file mode 100644
index 0000000..7493111
--- /dev/null
+++ b/resources/lang/zh-CN/permission.php
@@ -0,0 +1,234 @@
+<?php
+
+return [
+    // 商品管理
+    'GOODS_MANAGE' => [
+        'id' => 1,
+        'name' => '商品管理',
+        'parent_id' => 0,
+    ],
+    'GOODS_LIST' => [
+        'id' => 2,
+        'name' => '商品列表',
+        'parent_id' => 1,
+    ],
+    'goods.index' => [
+        'id' => 20,
+        'name' => '商品列表',
+        'parent_id' => 2,
+    ],
+    'goods.store' => [
+        'id' => 21,
+        'name' => '新增商品',
+        'parent_id' => 2,
+    ],
+    'goods_skus.index' => [
+        'id' => 22,
+        'name' => '规格列表',
+        'parent_id' => 2,
+    ],
+    'goods_skus.store' => [
+        'id' => 23,
+        'name' => '新增规格',
+        'parent_id' => 2,
+    ],
+    'goods_skus.show' => [
+        'id' => 24,
+        'name' => '规格查看',
+        'parent_id' => 2,
+    ],
+    'goods_skus.udpate' => [
+        'id' => 25,
+        'name' => '规格更新',
+        'parent_id' => 2,
+    ],
+    'goods_sku.batch_update' => [
+        'id' => 26,
+        'name' => '上新/盘点',
+        'parent_id' => 2,
+    ],
+    'goods_sku.single_update' => [
+        'id' => 27,
+        'name' => '字段更新',
+        'parent_id' => 2,
+    ],
+    'GOODS_TYPE' => [
+        'id' => 3,
+        'name' => '商品种类',
+        'parent_id' => 1,
+    ],
+    'goods_types.index' => [
+        'id' => 30,
+        'name' => '列表',
+        'parent_id' => 3,
+    ],
+    'goods_types.store' => [
+        'id' => 31,
+        'name' => '新增',
+        'parent_id' => 3,
+    ],
+    'goods_types.show' => [
+        'id' => 32,
+        'name' => '查看',
+        'parent_id' => 3,
+    ],
+    'goods_types.update' => [
+        'id' => 33,
+        'name' => '更新',
+        'parent_id' => 3,
+    ],
+    'goods_types.destroy' => [
+        'id' => 34,
+        'name' => '删除',
+        'parent_id' => 3,
+    ],
+    'GOODS_BRAND' => [
+        'id' => 4,
+        'name' => '商品品牌',
+        'parent_id' => 1,
+    ],
+    'goods_brands.index' => [
+        'id' => 40,
+        'name' => '列表',
+        'parent_id' => 4,
+    ],
+    'goods_brands.store' => [
+        'id' => 41,
+        'name' => '新增',
+        'parent_id' => 4,
+    ],
+    'goods_brands.show' => [
+        'id' => 42,
+        'name' => '查看',
+        'parent_id' => 4,
+    ],
+    'goods_brands.update' => [
+        'id' => 43,
+        'name' => '更新',
+        'parent_id' => 4,
+    ],
+    'goods_brands.destroy' => [
+        'id' => 44,
+        'name' => '删除',
+        'parent_id' => 4,
+    ],
+    // 店铺管理
+    'SHOP_MANAGE' => [
+        'id' => 5,
+        'name' => '店铺管理',
+        'parent_id' => 0,
+    ],
+    'shops.index' => [
+        'id' => 50,
+        'name' => '列表',
+        'parent_id' => 5,
+    ],
+    'shops.store' => [
+        'id' => 51,
+        'name' => '新增',
+        'parent_id' => 5,
+    ],
+    'shops.show' => [
+        'id' => 52,
+        'name' => '查看',
+        'parent_id' => 5,
+    ],
+    'shops.update' => [
+        'id' => 53,
+        'name' => '更新',
+        'parent_id' => 5,
+    ],
+    'shops.destroy' => [
+        'id' => 54,
+        'name' => '删除',
+        'parent_id' => 5,
+    ],
+    // 用户管理
+    'USER_MANAGE' => [
+        'id' => 6,
+        'name' => '用户管理',
+        'parent_id' => 0,
+    ],
+    'user.index' => [
+        'id' => 60,
+        'name' => '列表',
+        'parent_id' => 6,
+    ],
+    'user.store' => [
+        'id' => 61,
+        'name' => '新增',
+        'parent_id' => 6,
+    ],
+    'user.show' => [
+        'id' => 62,
+        'name' => '查看',
+        'parent_id' => 6,
+    ],
+    'user.update' => [
+        'id' => 63,
+        'name' => '更新',
+        'parent_id' => 6,
+    ],
+    'user.destroy' => [
+        'id' => 64,
+        'name' => '删除',
+        'parent_id' => 6,
+    ],
+    // 系统管理
+    'SYSTEM_MANAGE' => [
+        'id' => 7,
+        'name' => '系统管理',
+        'parent_id' => 0,
+    ],
+    'ROLE_MANAGE' => [
+        'id' => 8,
+        'name' => '角色管理',
+        'parent_id' => 7,
+    ],
+    'role.index' => [
+        'id' => 80,
+        'name' => '列表',
+        'parent_id' => 8,
+    ],
+    'role.store' => [
+        'id' => 81,
+        'name' => '新增',
+        'parent_id' => 8,
+    ],
+    'role.show' => [
+        'id' => 82,
+        'name' => '查看',
+        'parent_id' => 8,
+    ],
+    'role.update' => [
+        'id' => 83,
+        'name' => '更新',
+        'parent_id' => 8,
+    ],
+    'role.permission' => [
+        'id' => 84,
+        'name' => '设置权限',
+        'parent_id' => 8,
+    ],
+    'PERMISSION_MANAGE' => [
+        'id' => 9,
+        'name' => '权限管理',
+        'parent_id' => 7,
+    ],
+    'permissions.index' => [
+        'id' => 90,
+        'name' => '列表',
+        'parent_id' => 9,
+    ],
+    // 系统日志
+    'SYSTEM_LOG' => [
+        'id' => 10,
+        'name' => '系统日志',
+        'parent_id' => 0,
+    ],
+    'logs.index' => [
+        'id' => 100,
+        'name' => '列表',
+        'parent_id' => 10,
+    ],
+];
diff --git a/resources/templates/goods_skus_import.xlsx b/resources/templates/goods_skus_import.xlsx
new file mode 100644
index 0000000..16d6c96
Binary files /dev/null and b/resources/templates/goods_skus_import.xlsx differ
diff --git a/routes/api.php b/routes/api.php
index 5c5adc8..4a047f0 100644
--- a/routes/api.php
+++ b/routes/api.php
@@ -16,7 +16,7 @@ use App\Http\Controllers\Goods\GoodsSkusController;
 | is assigned the "api" middleware group. Enjoy building your API!
 |
 */
-Route::middleware('auth:api')->group(function () {
+Route::middleware(['auth:api', 'check.permissions'])->group(function () {
     // 用户
     Route::resource('users', 'User\UsersController', ['only' => ['index', 'store', 'show', 'update', 'destroy']]);
     // 商品种类
@@ -33,17 +33,20 @@ Route::middleware('auth:api')->group(function () {
     Route::patch('single/goods_skus/{id}', [GoodsSkusController::class, 'updateField'])->name('goods_sku.single_update');
     // 店铺
     Route::resource('shops', 'Shop\ShopsController', ['only' => ['index', 'store', 'show', 'update', 'destroy']]);
-    Route::get('shop_platforms', [ShopsController::class, 'getPlatList'])->name('plat.list');
     // 角色
     Route::resource('roles', 'Role\RolesController', ['only' => ['index', 'store', 'show', 'update']]);
     Route::post('roles/{id}/permissions', [RolesController::class, 'addPermissions'])->name('role.permission');
     // 权限
-    Route::resource('permissions', 'Permission\PermissionsController', ['only' => ['index', 'store', 'show', 'update', 'destroy']]);
-    // 菜单
-    Route::resource('menus', 'Menu\MenusController', ['only' => ['index',
+    Route::resource('permissions', 'Permission\PermissionsController', ['only' => ['index',
 //        'store', 'show', 'update', 'destroy'
     ]]);
     Route::post('upload', [UploadController::class, 'store'])->name('upload.file');
 });
 
 Route::post('/auth/login', [LoginController::class, 'login'])->name('auth.login');
+
+// 菜单
+Route::resource('menus', 'Menu\MenusController', ['only' => ['index',
+//        'store', 'show', 'update', 'destroy'
+]])->middleware('auth:api');
+Route::get('shop_platforms', [ShopsController::class, 'getPlatList'])->name('plat.list')->middleware('auth:api');
diff --git a/routes/web.php b/routes/web.php
index 0af6dd8..b342af8 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -29,4 +29,4 @@ Route::get('/register', function () {
     return view('welcome');
 })->name('register');
 
-Route::get('goods_skus/export', [GoodsSkusController::class, 'export'])->name('goods_skus.export');
+Route::get('goods_skus/export', [GoodsSkusController::class, 'export'])->name('goods_skus.export')->middleware('check.permissions');