diff --git a/src/main/java/com/gxwebsoft/cms/controller/AdController.java b/src/main/java/com/gxwebsoft/cms/controller/AdController.java
index 2ce1af2..4f05279 100644
--- a/src/main/java/com/gxwebsoft/cms/controller/AdController.java
+++ b/src/main/java/com/gxwebsoft/cms/controller/AdController.java
@@ -7,6 +7,7 @@ import com.gxwebsoft.common.core.web.*;
 import com.gxwebsoft.common.system.entity.User;
 import io.swagger.annotations.Api;
 import io.swagger.annotations.ApiOperation;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.*;
 
 import javax.annotation.Resource;
@@ -50,6 +51,7 @@ public class AdController extends BaseController {
         //return success(adService.getByIdRel(id));
     }
 
+    @PreAuthorize("hasAuthority('cms:ad:save')")
     @ApiOperation("添加广告位管理表")
     @PostMapping()
     public ApiResult<?> save(@RequestBody Ad ad) {
@@ -64,6 +66,7 @@ public class AdController extends BaseController {
         return fail("添加失败");
     }
 
+    @PreAuthorize("hasAuthority('cms:ad:update')")
     @ApiOperation("修改广告位管理表")
     @PutMapping()
     public ApiResult<?> update(@RequestBody Ad ad) {
@@ -73,6 +76,7 @@ public class AdController extends BaseController {
         return fail("修改失败");
     }
 
+    @PreAuthorize("hasAuthority('cms:ad:remove')")
     @ApiOperation("删除广告位管理表")
     @DeleteMapping("/{id}")
     public ApiResult<?> remove(@PathVariable("id") Integer id) {
@@ -82,6 +86,7 @@ public class AdController extends BaseController {
         return fail("删除失败");
     }
 
+    @PreAuthorize("hasAuthority('cms:ad:save')")
     @ApiOperation("批量添加广告位管理表")
     @PostMapping("/batch")
     public ApiResult<?> saveBatch(@RequestBody List<Ad> list) {
@@ -91,6 +96,7 @@ public class AdController extends BaseController {
         return fail("添加失败");
     }
 
+    @PreAuthorize("hasAuthority('cms:ad:update')")
     @ApiOperation("批量修改广告位管理表")
     @PutMapping("/batch")
     public ApiResult<?> removeBatch(@RequestBody BatchParam<Ad> batchParam) {
@@ -100,6 +106,7 @@ public class AdController extends BaseController {
         return fail("修改失败");
     }
 
+    @PreAuthorize("hasAuthority('cms:ad:remove')")
     @ApiOperation("批量删除广告位管理表")
     @DeleteMapping("/batch")
     public ApiResult<?> removeBatch(@RequestBody List<Integer> ids) {
diff --git a/src/main/java/com/gxwebsoft/cms/entity/Form.java b/src/main/java/com/gxwebsoft/cms/entity/Form.java
index 898608f..6320fbc 100644
--- a/src/main/java/com/gxwebsoft/cms/entity/Form.java
+++ b/src/main/java/com/gxwebsoft/cms/entity/Form.java
@@ -36,6 +36,9 @@ public class Form implements Serializable {
     @ApiModelProperty(value = "背景图片")
     private String background;
 
+    @ApiModelProperty(value = "视频文件")
+    private String video;
+
     @ApiModelProperty(value = "提交次数")
     private Integer submitNumber;
 
@@ -60,6 +63,9 @@ public class Form implements Serializable {
     @ApiModelProperty(value = "是否隐藏背景图片")
     private Integer hideBackground;
 
+    @ApiModelProperty(value = "是否隐藏视频")
+    private Integer hideVideo;
+
     @ApiModelProperty(value = "背景图片透明度")
     private BigDecimal opacity;
 
diff --git a/src/main/java/com/gxwebsoft/common/system/entity/FileRecord.java b/src/main/java/com/gxwebsoft/common/system/entity/FileRecord.java
index 52a3f76..d422f41 100644
--- a/src/main/java/com/gxwebsoft/common/system/entity/FileRecord.java
+++ b/src/main/java/com/gxwebsoft/common/system/entity/FileRecord.java
@@ -45,6 +45,9 @@ public class FileRecord implements Serializable {
     @ApiModelProperty("创建人")
     private Integer createUserId;
 
+    @ApiModelProperty(value = "AppId")
+    private Integer appId;
+
     @ApiModelProperty("是否删除, 0否, 1是")
     @TableLogic
     private Integer deleted;
diff --git a/src/main/java/com/gxwebsoft/oa/controller/AppController.java b/src/main/java/com/gxwebsoft/oa/controller/AppController.java
index 62cea50..16334e3 100644
--- a/src/main/java/com/gxwebsoft/oa/controller/AppController.java
+++ b/src/main/java/com/gxwebsoft/oa/controller/AppController.java
@@ -1,15 +1,23 @@
 package com.gxwebsoft.oa.controller;
 
+import cn.hutool.core.net.url.UrlBuilder;
+import cn.hutool.core.net.url.UrlQuery;
 import cn.hutool.core.util.DesensitizedUtil;
 import cn.hutool.core.util.StrUtil;
+import cn.hutool.http.HttpRequest;
+import com.alibaba.fastjson.JSONObject;
+import com.alibaba.fastjson.TypeReference;
 import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
+import com.gxwebsoft.common.core.security.JwtUtil;
 import com.gxwebsoft.common.core.utils.CommonUtil;
 import com.gxwebsoft.common.core.utils.RedisUtil;
 import com.gxwebsoft.common.core.web.ApiResult;
 import com.gxwebsoft.common.core.web.BaseController;
 import com.gxwebsoft.common.core.web.BatchParam;
 import com.gxwebsoft.common.core.web.PageResult;
+import com.gxwebsoft.common.system.entity.FileRecord;
 import com.gxwebsoft.common.system.entity.User;
+import com.gxwebsoft.common.system.service.FileRecordService;
 import com.gxwebsoft.oa.entity.App;
 import com.gxwebsoft.oa.entity.AppUrl;
 import com.gxwebsoft.oa.entity.AppUser;
@@ -23,6 +31,7 @@ import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.*;
 
 import javax.annotation.Resource;
+import javax.servlet.http.HttpServletRequest;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
@@ -48,6 +57,8 @@ public class AppController extends BaseController {
     @Resource
     private AppUrlService appUrlService;
     @Resource
+    private FileRecordService fileRecordService;
+    @Resource
     private RedisUtil redisUtil;
 
     @ApiOperation("统计信息")
@@ -95,10 +106,12 @@ public class AppController extends BaseController {
 
     @ApiOperation("分页查询应用管理记录表")
     @GetMapping("/page")
-    public ApiResult<PageResult<App>> page(AppParam param) {
+    public ApiResult<PageResult<App>> page(AppParam param, HttpServletRequest request) {
         final User loginUser = getLoginUser();
         // 未登录情况
         if(loginUser == null){
+          String access_token = JwtUtil.getAccessToken(request);
+          param.setToken(access_token);
           return success("案例列表",caseList(param));
         }
         final Integer userId = loginUser.getUserId();
@@ -125,8 +138,22 @@ public class AppController extends BaseController {
       final PageResult<App> appPageResult = appService.pageRel(param);
       appPageResult.getList().forEach(d -> {
         d.setContent(null);
-        // 读取链接列表
+        // 读取账号列表
         d.setAppUrlList(appUrlService.list(new LambdaQueryWrapper<AppUrl>().eq(AppUrl::getAppId,d.getAppId())));
+        // 读取项目附件（链式构建GET请求）
+        HashMap<String, Object> map = new HashMap<>();
+        map.put("appId", d.getAppId());
+        final String build = UrlBuilder.of("https://server.gxwebsoft.com/api/file/page").setQuery(new UrlQuery(map)).build();
+        String response = HttpRequest.get(build)
+          .header("Authorization", param.getToken())
+          .header("Tenantid", d.getTenantId().toString())
+          .body(JSONObject.toJSONString(map))//表单内容
+          .timeout(20000)//超时，毫秒
+          .execute().body();
+
+        final ApiResult<PageResult<FileRecord>> userResult = JSONObject.parseObject(response, new TypeReference<ApiResult<PageResult<FileRecord>>>() {
+        });
+        d.setAppFiles(userResult.getData().getList());
       });
       return appPageResult;
     }
diff --git a/src/main/java/com/gxwebsoft/oa/entity/App.java b/src/main/java/com/gxwebsoft/oa/entity/App.java
index 2be4e45..6817841 100644
--- a/src/main/java/com/gxwebsoft/oa/entity/App.java
+++ b/src/main/java/com/gxwebsoft/oa/entity/App.java
@@ -1,6 +1,7 @@
 package com.gxwebsoft.oa.entity;
 
 import com.baomidou.mybatisplus.annotation.*;
+import com.gxwebsoft.common.system.entity.FileRecord;
 import io.swagger.annotations.ApiModel;
 import io.swagger.annotations.ApiModelProperty;
 import lombok.Data;
@@ -243,6 +244,10 @@ public class App implements Serializable {
     @TableField(exist = false)
     private List<AppUrl> appUrlList;
 
+    @ApiModelProperty(value = "项目附件")
+    @TableField(exist = false)
+    private List<FileRecord> appFiles;
+
     @ApiModelProperty(value = "主体名称")
     @TableField(exist = false)
     private String tenantName;
diff --git a/src/main/resources/application.yml b/src/main/resources/application.yml
index 14d2781..2c46f3b 100644
--- a/src/main/resources/application.yml
+++ b/src/main/resources/application.yml
@@ -1,6 +1,6 @@
 # 端口
 server:
-  port: 9090
+  port: 9099
 # socketIo
 socketio:
   port: 9190
diff --git a/src/test/java/com/gxwebsoft/generator/templates/controller.java.btl b/src/test/java/com/gxwebsoft/generator/templates/controller.java.btl
index 108d46c..4de4d52 100644
--- a/src/test/java/com/gxwebsoft/generator/templates/controller.java.btl
+++ b/src/test/java/com/gxwebsoft/generator/templates/controller.java.btl
@@ -110,6 +110,12 @@ public class ${table.controllerName} {
      * 添加${table.comment!}
      */
     <% } %>
+    <% if(cfg.authAnnotation) { %>
+    @PreAuthorize("hasAuthority('${authPre}:save')")
+    <% } %>
+    <% if(cfg.logAnnotation) { %>
+    @OperationLog
+    <% } %>
     <% if(swagger2) { %>
     @ApiOperation("添加${table.comment!}")
     <% } %>
@@ -134,6 +140,12 @@ public class ${table.controllerName} {
      * 修改${table.comment!}
      */
     <% } %>
+    <% if(cfg.authAnnotation) { %>
+    @PreAuthorize("hasAuthority('${authPre}:update')")
+    <% } %>
+    <% if(cfg.logAnnotation) { %>
+    @OperationLog
+    <% } %>
     <% if(swagger2) { %>
     @ApiOperation("修改${table.comment!}")
     <% } %>
@@ -153,6 +165,12 @@ public class ${table.controllerName} {
      * 删除${table.comment!}
      */
     <% } %>
+    <% if(cfg.authAnnotation) { %>
+    @PreAuthorize("hasAuthority('${authPre}:remove')")
+    <% } %>
+    <% if(cfg.logAnnotation) { %>
+    @OperationLog
+    <% } %>
     <% if(swagger2) { %>
     @ApiOperation("删除${table.comment!}")
     <% } %>
@@ -172,6 +190,12 @@ public class ${table.controllerName} {
      * 批量添加${table.comment!}
      */
     <% } %>
+    <% if(cfg.authAnnotation) { %>
+    @PreAuthorize("hasAuthority('${authPre}:save')")
+    <% } %>
+    <% if(cfg.logAnnotation) { %>
+    @OperationLog
+    <% } %>
     <% if(swagger2) { %>
     @ApiOperation("批量添加${table.comment!}")
     <% } %>
@@ -191,6 +215,12 @@ public class ${table.controllerName} {
      * 批量修改${table.comment!}
      */
     <% } %>
+    <% if(cfg.authAnnotation) { %>
+    @PreAuthorize("hasAuthority('${authPre}:update')")
+    <% } %>
+    <% if(cfg.logAnnotation) { %>
+    @OperationLog
+    <% } %>
     <% if(swagger2) { %>
     @ApiOperation("批量修改${table.comment!}")
     <% } %>
@@ -210,6 +240,12 @@ public class ${table.controllerName} {
      * 批量删除${table.comment!}
      */
     <% } %>
+    <% if(cfg.authAnnotation) { %>
+    @PreAuthorize("hasAuthority('${authPre}:remove')")
+    <% } %>
+    <% if(cfg.logAnnotation) { %>
+    @OperationLog
+    <% } %>
     <% if(swagger2) { %>
     @ApiOperation("批量删除${table.comment!}")
     <% } %>