diff --git a/src/main/java/com/mosquito/project/permission/ApprovalController.java b/src/main/java/com/mosquito/project/permission/ApprovalController.java
new file mode 100644
index 0000000..2f9969c
--- /dev/null
+++ b/src/main/java/com/mosquito/project/permission/ApprovalController.java
@@ -0,0 +1,87 @@
+package com.mosquito.project.permission;
+
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.*;
+
+import java.util.List;
+import java.util.Map;
+
+/**
+ * 审批流程控制器
+ */
+@RestController
+@RequestMapping("/api/approval")
+public class ApprovalController {
+
+    /**
+     * 获取审批流列表
+     */
+    @GetMapping("/flows")
+    public ResponseEntity<List<Map<String, Object>>> getFlows() {
+        return ResponseEntity.ok(List.of());
+    }
+
+    /**
+     * 获取待审批列表
+     */
+    @GetMapping("/pending")
+    public ResponseEntity<List<Map<String, Object>>> getPendingApprovals() {
+        return ResponseEntity.ok(List.of());
+    }
+
+    /**
+     * 获取已审批列表
+     */
+    @GetMapping("/approved")
+    public ResponseEntity<List<Map<String, Object>>> getApprovedList() {
+        return ResponseEntity.ok(List.of());
+    }
+
+    /**
+     * 获取我发起的审批
+     */
+    @GetMapping("/my")
+    public ResponseEntity<List<Map<String, Object>>> getMyApplications() {
+        return ResponseEntity.ok(List.of());
+    }
+
+    /**
+     * 处理审批
+     */
+    @PostMapping("/handle")
+    public ResponseEntity<Void> handleApproval(@RequestBody ApprovalHandleRequest request) {
+        return ResponseEntity.ok().build();
+    }
+
+    /**
+     * 获取审批记录详情
+     */
+    @GetMapping("/records/{id}")
+    public ResponseEntity<Map<String, Object>> getRecordById(@PathVariable Long id) {
+        return ResponseEntity.ok(Map.of());
+    }
+
+    /**
+     * 获取审批历史
+     */
+    @GetMapping("/records/{recordId}/history")
+    public ResponseEntity<List<Map<String, Object>>> getApprovalHistory(@PathVariable Long recordId) {
+        return ResponseEntity.ok(List.of());
+    }
+
+    /**
+     * 审批请求体
+     */
+    public static class ApprovalHandleRequest {
+        private Long recordId;
+        private String action; // approve, reject, transfer
+        private String comment;
+
+        public Long getRecordId() { return recordId; }
+        public void setRecordId(Long recordId) { this.recordId = recordId; }
+        public String getAction() { return action; }
+        public void setAction(String action) { this.action = action; }
+        public String getComment() { return comment; }
+        public void setComment(String comment) { this.comment = comment; }
+    }
+}
diff --git a/src/main/java/com/mosquito/project/permission/PermissionController.java b/src/main/java/com/mosquito/project/permission/PermissionController.java
new file mode 100644
index 0000000..e04efd8
--- /dev/null
+++ b/src/main/java/com/mosquito/project/permission/PermissionController.java
@@ -0,0 +1,133 @@
+package com.mosquito.project.permission;
+
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.*;
+
+import java.util.List;
+
+/**
+ * 权限管理控制器
+ */
+@RestController
+@RequestMapping("/api/permissions")
+public class PermissionController {
+
+    private final PermissionService permissionService;
+    private final PermissionCheckService permissionCheckService;
+
+    public PermissionController(PermissionService permissionService, PermissionCheckService permissionCheckService) {
+        this.permissionService = permissionService;
+        this.permissionCheckService = permissionCheckService;
+    }
+
+    /**
+     * 获取所有权限列表
+     */
+    @GetMapping
+    public ResponseEntity<List<SysPermission>> getAllPermissions() {
+        return ResponseEntity.ok(permissionService.findAll());
+    }
+
+    /**
+     * 根据模块获取权限
+     */
+    @GetMapping("/module/{moduleCode}")
+    public ResponseEntity<List<SysPermission>> getPermissionsByModule(@PathVariable String moduleCode) {
+        return ResponseEntity.ok(permissionService.findByModuleCode(moduleCode));
+    }
+
+    /**
+     * 获取当前用户权限信息
+     */
+    @GetMapping("/current")
+    public ResponseEntity<CurrentUserPermissions> getCurrentUserPermissions() {
+        Long userId = 1L;
+        var permissions = new java.util.ArrayList<>(permissionCheckService.getUserPermissions(userId));
+        var dataScope = permissionCheckService.getUserDataScope(userId);
+
+        CurrentUserPermissions result = new CurrentUserPermissions();
+        result.setUserId(userId);
+        result.setPermissions(permissions);
+        result.setDataScope(dataScope);
+        result.setRoles(List.of());
+
+        return ResponseEntity.ok(result);
+    }
+
+    /**
+     * 检查用户是否拥有指定权限
+     */
+    @GetMapping("/check")
+    public ResponseEntity<Boolean> checkPermission(@RequestParam String permissionCode) {
+        Long userId = 1L;
+        boolean hasPermission = permissionCheckService.hasPermission(userId, permissionCode);
+        return ResponseEntity.ok(hasPermission);
+    }
+
+    /**
+     * 检查用户是否拥有指定角色
+     */
+    @GetMapping("/role")
+    public ResponseEntity<Boolean> checkRole(@RequestParam String roleCode) {
+        Long userId = 1L;
+        boolean hasRole = permissionCheckService.hasRole(userId, roleCode);
+        return ResponseEntity.ok(hasRole);
+    }
+
+    /**
+     * 获取用户数据权限范围
+     */
+    @GetMapping("/datascope")
+    public ResponseEntity<String> getDataScope() {
+        Long userId = 1L;
+        String dataScope = permissionCheckService.getUserDataScope(userId);
+        return ResponseEntity.ok(dataScope);
+    }
+
+    /**
+     * 创建权限
+     */
+    @PostMapping
+    public ResponseEntity<Long> createPermission(@RequestBody SysPermission permission) {
+        SysPermission saved = permissionService.save(permission);
+        return ResponseEntity.ok(saved.getId());
+    }
+
+    /**
+     * 更新权限
+     */
+    @PutMapping("/{id}")
+    public ResponseEntity<Void> updatePermission(@PathVariable Long id, @RequestBody SysPermission permission) {
+        permission.setId(id);
+        permissionService.update(id, permission);
+        return ResponseEntity.ok().build();
+    }
+
+    /**
+     * 删除权限
+     */
+    @DeleteMapping("/{id}")
+    public ResponseEntity<Void> deletePermission(@PathVariable Long id) {
+        permissionService.delete(id);
+        return ResponseEntity.ok().build();
+    }
+
+    /**
+     * 当前用户权限
+     */
+    public static class CurrentUserPermissions {
+        private Long userId;
+        private List<String> roles;
+        private List<String> permissions;
+        private String dataScope;
+
+        public Long getUserId() { return userId; }
+        public void setUserId(Long userId) { this.userId = userId; }
+        public List<String> getRoles() { return roles; }
+        public void setRoles(List<String> roles) { this.roles = roles; }
+        public List<String> getPermissions() { return permissions; }
+        public void setPermissions(List<String> permissions) { this.permissions = permissions; }
+        public String getDataScope() { return dataScope; }
+        public void setDataScope(String dataScope) { this.dataScope = dataScope; }
+    }
+}
diff --git a/src/main/java/com/mosquito/project/permission/UserController.java b/src/main/java/com/mosquito/project/permission/UserController.java
new file mode 100644
index 0000000..24b0e0b
--- /dev/null
+++ b/src/main/java/com/mosquito/project/permission/UserController.java
@@ -0,0 +1,66 @@
+package com.mosquito.project.permission;
+
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.*;
+
+import java.util.List;
+
+/**
+ * 用户权限控制器 - 处理用户角色分配
+ */
+@RestController
+@RequestMapping("/api/users")
+public class UserController {
+
+    private final UserRoleRepository userRoleRepository;
+    private final RoleRepository roleRepository;
+
+    public UserController(UserRoleRepository userRoleRepository, RoleRepository roleRepository) {
+        this.userRoleRepository = userRoleRepository;
+        this.roleRepository = roleRepository;
+    }
+
+    /**
+     * 获取用户角色
+     */
+    @GetMapping("/{userId}/roles")
+    public ResponseEntity<List<String>> getUserRoles(@PathVariable Long userId) {
+        List<Long> roleIds = userRoleRepository.findRoleIdsByUserId(userId);
+        List<String> roleCodes = roleIds.stream()
+                .map(id -> roleRepository.findById(id))
+                .filter(java.util.Optional::isPresent)
+                .map(java.util.Optional::get)
+                .map(SysRole::getRoleCode)
+                .toList();
+        return ResponseEntity.ok(roleCodes);
+    }
+
+    /**
+     * 分配角色给用户
+     */
+    @PostMapping("/{userId}/roles")
+    public ResponseEntity<Void> assignRoles(@PathVariable Long userId, @RequestBody AssignRolesRequest request) {
+        // 删除现有角色关联
+        userRoleRepository.deleteByUserId(userId);
+
+        // 创建新的角色关联
+        for (Long roleId : request.getRoleIds()) {
+            SysUserRole userRole = new SysUserRole();
+            userRole.setUserId(userId);
+            userRole.setRoleId(roleId);
+            userRoleRepository.save(userRole);
+        }
+
+        return ResponseEntity.ok().build();
+    }
+
+    /**
+     * 角色分配请求
+     */
+    public static class AssignRolesRequest {
+        private List<Long> roleIds;
+
+        public List<Long> getRoleIds() { return roleIds; }
+        public void setRoleIds(List<Long> roleIds) { this.roleIds = roleIds; }
+    }
+}