diff --git a/cf-gateway/src/main/java/com/cf/imes/gateway/filter/security/TokenAuthenticationFilter.java b/cf-gateway/src/main/java/com/cf/imes/gateway/filter/security/TokenAuthenticationFilter.java
index e500cebec..c8c934604 100644
--- a/cf-gateway/src/main/java/com/cf/imes/gateway/filter/security/TokenAuthenticationFilter.java
+++ b/cf-gateway/src/main/java/com/cf/imes/gateway/filter/security/TokenAuthenticationFilter.java
@@ -23,6 +23,7 @@ import org.springframework.web.server.ServerWebExchange;
 import reactor.core.publisher.Mono;
 
 import java.time.Duration;
+import java.util.List;
 import java.util.Objects;
 import java.util.function.Function;
 
@@ -70,6 +71,14 @@ public class TokenAuthenticationFilter implements GlobalFilter, Ordered {
 
             });
 
+    private final LoadingCache<String, Long> organIdCache = CacheUtils.buildAsyncReloadingCache(Duration.ofMinutes(1L), // 过期时间 1 分钟
+            new CacheLoader<>() {
+                @Override
+                public Long load(String token) {
+                    return getOrganIdByToken(token).block();
+                }
+            });
+
     public TokenAuthenticationFilter(ReactorLoadBalancerExchangeFilterFunction lbFunction) {
         // Q：为什么不使用 OAuth2TokenApi 进行调用？
         // A1：Spring Cloud OpenFeign 官方未内置 Reactive 的支持 https://docs.spring.io/spring-cloud-openfeign/docs/current/reference/html/#reactive-support
@@ -101,12 +110,15 @@ public class TokenAuthenticationFilter implements GlobalFilter, Ordered {
             SecurityFrameworkUtils.setLoginUser(exchange, user);
             // 2.2 将 user 并设置到 login-user 的请求头，使用 json 存储值
             ServerWebExchange newExchange = exchange.mutate()
-                    .request(builder -> SecurityFrameworkUtils.setLoginUserHeader(builder, user)).build();
+                    .request(builder -> SecurityFrameworkUtils.setLoginUserHeader(builder, user))
+                    .request(builder -> SecurityFrameworkUtils.setOrganHeader(builder, user))
+                    .build();
             return chain.filter(newExchange);
         });
     }
 
     private Mono<LoginUser> getLoginUser(ServerWebExchange exchange, String token) {
+        //Long organId = organIdCache.getIfPresent(token);
         // 从缓存中，获取 LoginUser
         Long organId = WebFrameworkUtils.getOrganId(exchange);
         KeyValue<Long, String> cacheKey = new KeyValue<Long, String>().setKey(organId).setValue(token);
@@ -130,10 +142,17 @@ public class TokenAuthenticationFilter implements GlobalFilter, Ordered {
     private Mono<String> checkAccessToken(Long organId, String token) {
         return webClient.get()
                 .uri(OAuth2TokenApi.URL_CHECK, uriBuilder -> uriBuilder.queryParam("accessToken", token).build())
-                .headers(httpHeaders -> WebFrameworkUtils.setOrganIdHeader(organId, httpHeaders)) // 设置组织的 Header
+      //          .headers(httpHeaders -> WebFrameworkUtils.setOrganIdHeader(organId, httpHeaders)) // 设置组织的 Header
                 .retrieve().bodyToMono(String.class);
     }
 
+    private Mono<Long> getOrganIdByToken(String token) {
+        return webClient.get()
+                .uri(OAuth2TokenApi.URL_ORGAN, uriBuilder -> uriBuilder.queryParam("accessToken", token).build())
+                .retrieve()
+                .bodyToMono(Long.class);
+    }
+
     private LoginUser buildUser(String body) {
         // 处理结果，结果不正确
         CommonResult<OAuth2AccessTokenCheckRespDTO> result = JsonUtils.parseObject(body, CHECK_RESULT_TYPE_REFERENCE);
diff --git a/cf-gateway/src/main/java/com/cf/imes/gateway/util/SecurityFrameworkUtils.java b/cf-gateway/src/main/java/com/cf/imes/gateway/util/SecurityFrameworkUtils.java
index ebc50708a..60bc83dcc 100644
--- a/cf-gateway/src/main/java/com/cf/imes/gateway/util/SecurityFrameworkUtils.java
+++ b/cf-gateway/src/main/java/com/cf/imes/gateway/util/SecurityFrameworkUtils.java
@@ -25,6 +25,7 @@ public class SecurityFrameworkUtils {
     private static final String LOGIN_USER_ID_ATTR = "login-user-id";
     private static final String LOGIN_USER_TYPE_ATTR = "login-user-type";
     private static final String DATA_CODE = "data-code";
+    private static final String ORGAN_ID = "organ-id";
 
     private SecurityFrameworkUtils() {}
 
@@ -105,4 +106,8 @@ public class SecurityFrameworkUtils {
         builder.header(DATA_CODE, user.getDataCode());
     }
 
+    public static void setOrganHeader(ServerHttpRequest.Builder builder, LoginUser user) {
+        builder.header(ORGAN_ID, user.getOrganId().toString());
+    }
+
 }
diff --git a/cf-module-system/cf-module-system-api/src/main/java/com/cf/imes/module/system/api/oauth2/OAuth2TokenApi.java b/cf-module-system/cf-module-system-api/src/main/java/com/cf/imes/module/system/api/oauth2/OAuth2TokenApi.java
index c0f7e0c89..420d8f021 100644
--- a/cf-module-system/cf-module-system-api/src/main/java/com/cf/imes/module/system/api/oauth2/OAuth2TokenApi.java
+++ b/cf-module-system/cf-module-system-api/src/main/java/com/cf/imes/module/system/api/oauth2/OAuth2TokenApi.java
@@ -26,6 +26,8 @@ public interface OAuth2TokenApi {
     @SuppressWarnings("HttpUrlsUsage")
     String URL_CHECK = "http://" + ApiConstants.NAME + PREFIX + "/check";
 
+    String URL_ORGAN = "http://" + ApiConstants.NAME + PREFIX + "/getOrganIdByToken";
+
     @PostMapping(PREFIX + "/create")
     @Operation(summary = "创建访问令牌")
     CommonResult<OAuth2AccessTokenRespDTO> createAccessToken(@Valid @RequestBody OAuth2AccessTokenCreateReqDTO reqDTO);
@@ -49,4 +51,10 @@ public interface OAuth2TokenApi {
     CommonResult<OAuth2AccessTokenRespDTO> refreshAccessToken(@RequestParam("refreshToken") String refreshToken,
                                                               @RequestParam("clientId") String clientId);
 
+
+    @GetMapping(PREFIX + "/getOrganIdByToken")
+    @Operation(summary = "通过访问令牌获取组织id")
+    @Parameter(name = "accessToken", description = "访问令牌", required = true, example = "tudou")
+    CommonResult<Long> getOrganIdByToken(@RequestParam("accessToken") String accessToken);
+
 }
diff --git a/cf-module-system/cf-module-system-api/src/main/java/com/cf/imes/module/system/enums/ErrorCodeConstants.java b/cf-module-system/cf-module-system-api/src/main/java/com/cf/imes/module/system/enums/ErrorCodeConstants.java
index 585dfcd01..724d8e99e 100644
--- a/cf-module-system/cf-module-system-api/src/main/java/com/cf/imes/module/system/enums/ErrorCodeConstants.java
+++ b/cf-module-system/cf-module-system-api/src/main/java/com/cf/imes/module/system/enums/ErrorCodeConstants.java
@@ -32,6 +32,7 @@ public interface ErrorCodeConstants {
     ErrorCode ROLE_CAN_NOT_UPDATE_SYSTEM_TYPE_ROLE = new ErrorCode(1_002_002_003, "不能操作类型为系统内置的角色");
     ErrorCode ROLE_IS_DISABLE = new ErrorCode(1_002_002_004, "名字为【{}】的角色已被禁用");
     ErrorCode ROLE_ADMIN_CODE_ERROR = new ErrorCode(1_002_002_005, "编码【{}】不能使用");
+    ErrorCode ROLE_ME_ERROR = new ErrorCode(1_002_002_006, "不可为自身分配角色");
 
     // ========== 用户模块 1-002-003-000 ==========
     ErrorCode USER_USERNAME_EXISTS = new ErrorCode(1_002_003_000, "用户账号已经存在");
@@ -42,6 +43,7 @@ public interface ErrorCodeConstants {
     ErrorCode USER_PASSWORD_FAILED = new ErrorCode(1_002_003_005, "用户密码校验失败");
     ErrorCode USER_IS_DISABLE = new ErrorCode(1_002_003_006, "名字为【{}】的用户已被禁用");
     ErrorCode USER_COUNT_MAX = new ErrorCode(1_002_003_008, "创建用户失败，原因：超过组织最大组织配额({})！");
+    ErrorCode USER_ME_ERROR = new ErrorCode(1_002_003_009, "不可操作用户自身");
 
     // ========== 部门模块 1-002-004-000 ==========
     ErrorCode DEPT_NAME_DUPLICATE = new ErrorCode(1_002_004_000, "已经存在该名字的部门");
@@ -115,6 +117,8 @@ public interface ErrorCodeConstants {
     ErrorCode TENANT_PACKAGE_NOT_EXISTS = new ErrorCode(1_002_016_000, "组织套餐不存在");
     ErrorCode TENANT_PACKAGE_USED = new ErrorCode(1_002_016_001, "组织正在使用该套餐，请给组织重新设置套餐后再尝试删除");
     ErrorCode TENANT_PACKAGE_DISABLE = new ErrorCode(1_002_016_002, "名字为【{}】的组织套餐已被禁用");
+    ErrorCode TENANT_PACKAGE_DEPT_EXIT = new ErrorCode(1_002_016_003, "无法修改内置组织权限套餐");
+    ErrorCode TENANT_PACKAGE_DELETED_EXIT = new ErrorCode(1_002_016_004, "无法删除内置组织权限套餐");
 
     // ========== 错误码模块 1-002-017-000 ==========
     ErrorCode ERROR_CODE_NOT_EXISTS = new ErrorCode(1_002_017_000, "错误码不存在");
diff --git a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/api/oauth2/OAuth2TokenApiImpl.java b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/api/oauth2/OAuth2TokenApiImpl.java
index d4c6d8568..91a52301f 100644
--- a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/api/oauth2/OAuth2TokenApiImpl.java
+++ b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/api/oauth2/OAuth2TokenApiImpl.java
@@ -63,4 +63,10 @@ public class OAuth2TokenApiImpl implements OAuth2TokenApi {
         return success(BeanUtils.toBean(accessTokenDO, OAuth2AccessTokenRespDTO.class));
     }
 
+    @Override
+    public CommonResult<Long> getOrganIdByToken(String accessToken) {
+        OAuth2AccessTokenDO accessTokenDO = oauth2TokenService.checkAccessToken(accessToken);
+        return success(accessTokenDO.getOrganId());
+    }
+
 }
diff --git a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/dept/DeptController.java b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/dept/DeptController.java
index 6a58dbb2a..1739bf031 100644
--- a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/dept/DeptController.java
+++ b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/dept/DeptController.java
@@ -58,7 +58,7 @@ public class DeptController {
 
     @GetMapping("/list")
     @Operation(summary = "获取部门列表")
-    @PreAuthorize("@ss.hasPermission('system:dept:query')")
+    //@PreAuthorize("@ss.hasPermission('system:dept:query')")
     public CommonResult<List<DeptRespVO>> getDeptList(DeptListReqVO reqVO) {
         List<DeptDO> list = deptService.getDeptList(reqVO);
         return success(BeanUtils.toBean(list, DeptRespVO.class));
diff --git a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/labeltemplate/LabelTemplateController.java b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/labeltemplate/LabelTemplateController.java
index ce993f06a..44f5706a7 100644
--- a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/labeltemplate/LabelTemplateController.java
+++ b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/labeltemplate/LabelTemplateController.java
@@ -87,7 +87,7 @@ public class LabelTemplateController {
     @GetMapping("/getDefault")
     @Operation(summary = "获得默认标签模板")
     @Parameter(name = "type", description = "标签类型", required = true, example = "1024")
-    @PreAuthorize("@ss.hasPermission('system:label-template:query')")
+    //@PreAuthorize("@ss.hasPermission('system:label-template:query')")
     @OperateLog(enable = false)
     public CommonResult<LabelTemplateRespVO> getDefaultLabelTemplate(@RequestParam("type") String type) {
         return success(labelTemplateService.getDefaultLabelTemplate(type));
diff --git a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/permission/PermissionController.java b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/permission/PermissionController.java
index b6458985f..efe2d66b4 100644
--- a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/permission/PermissionController.java
+++ b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/permission/PermissionController.java
@@ -26,6 +26,7 @@ import java.util.Set;
 import java.util.stream.Collectors;
 
 import static com.cf.imes.framework.common.pojo.CommonResult.success;
+import static com.cf.imes.module.system.enums.ErrorCodeConstants.ROLE_ME_ERROR;
 import static com.cf.imes.module.system.service.organ.OrganServiceImpl.ORGAN_ADMIN_ROLE_ID;
 import static com.cf.imes.module.system.service.organ.OrganServiceImpl.ORGAN_STAFF_ROLE_ID;
 
@@ -58,8 +59,16 @@ public class PermissionController {
     public CommonResult<Boolean> assignRoleMenu(@Validated @RequestBody PermissionAssignRoleMenuReqVO reqVO) {
         LoginUser loginUser = SecurityFrameworkUtils.getLoginUser();
         if(!loginUser.getIsSupAdmin() && ( Objects.equals(reqVO.getRoleId(), ORGAN_ADMIN_ROLE_ID) || Objects.equals(reqVO.getRoleId(), ORGAN_STAFF_ROLE_ID))) {
-            throw new ServiceException(11541, "内置角色无权修改");
+            throw new ServiceException(11541, "内置角色无权修改菜单权限");
         }
+        if(Objects.equals(reqVO.getRoleId(), 1L)) {
+            throw new ServiceException(11541, "内置角色无权修改菜单权限");
+        }
+        Set<Long> roleIds = permissionService.getUserRoleIdListByUserId(loginUser.getId());
+        if (roleIds.contains(reqVO.getRoleId())) {
+            throw new ServiceException(11541, "无法修改自身的角色菜单权限");
+        }
+
         if(Objects.equals(reqVO.getRoleId(), ORGAN_ADMIN_ROLE_ID) || Objects.equals(reqVO.getRoleId(), ORGAN_STAFF_ROLE_ID)) {
         } else {
             // 开启多组织的情况下，需要过滤掉未开通的菜单
@@ -100,9 +109,14 @@ public class PermissionController {
     @PostMapping("/bath-assign-user-role")
     @PreAuthorize("@ss.hasPermission('system:permission:assign-user-role')")
     public CommonResult<Boolean> bathAssignUserRole(@Validated @RequestBody List<PermissionAssignUserRoleReqVO> listReqVO) {
+        LoginUser loginUser = SecurityFrameworkUtils.getLoginUser();
+        Set<Long> userIds = listReqVO.stream().map(PermissionAssignUserRoleReqVO::getUserId).collect(Collectors.toSet());
+        if (userIds.contains(loginUser.getId())) {
+            throw new ServiceException(ROLE_ME_ERROR);
+        }
         Set<Long> roleIds = listReqVO.stream().flatMap(e -> e.getRoleIds().stream()).collect(Collectors.toSet());
-        if(!SecurityFrameworkUtils.getLoginUser().getIsSupAdmin()) {
-            if(roleIds.contains(ORGAN_ADMIN_ROLE_ID) || roleIds.contains(ORGAN_STAFF_ROLE_ID)) {
+        if(!loginUser.getIsSupAdmin()) {
+            if(roleIds.contains(ORGAN_ADMIN_ROLE_ID) ) {
                 throw new ServiceException(11541, "内置角色无权修改");
             }
         }
diff --git a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/permission/RoleController.java b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/permission/RoleController.java
index f5a125669..7ff7fc762 100644
--- a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/permission/RoleController.java
+++ b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/permission/RoleController.java
@@ -32,6 +32,7 @@ import java.io.IOException;
 import java.util.Comparator;
 import java.util.List;
 import java.util.Objects;
+import java.util.stream.Collectors;
 
 import static com.cf.imes.framework.common.pojo.CommonResult.success;
 import static com.cf.imes.framework.operatelog.core.enums.OperateTypeEnum.EXPORT;
@@ -109,8 +110,9 @@ public class RoleController {
 
     @GetMapping({"/list-all-simple", "/simple-list"})
     @Operation(summary = "获取角色精简信息列表", description = "只包含被开启的角色，主要用于前端的下拉选项")
-    public CommonResult<List<RoleSimpleRespVO>> getSimpleRoleList() {
-        List<RoleDO> list = roleService.getRoleListByStatus(singleton(CommonStatusEnum.ENABLE.getStatus()));
+    public CommonResult<List<RoleSimpleRespVO>> getSimpleRoleList(@RequestParam(value = "organId", required = false) Long organId) {
+        List<RoleDO> list = roleService.getRoleListByStatus(singleton(CommonStatusEnum.ENABLE.getStatus()), organId);
+        //List<RoleDO> roleDOS = list.stream().filter(f -> !Objects.equals(f.getId(), 1L)).sorted(Comparator.comparing(RoleDO::getSort)).toList();
         list.sort(Comparator.comparing(RoleDO::getSort));
         return success(BeanUtils.toBean(list, RoleSimpleRespVO.class));
     }
diff --git a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/permission/vo/role/RoleSaveReqVO.java b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/permission/vo/role/RoleSaveReqVO.java
index 2078538f3..b677f3237 100644
--- a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/permission/vo/role/RoleSaveReqVO.java
+++ b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/controller/admin/permission/vo/role/RoleSaveReqVO.java
@@ -31,6 +31,9 @@ public class RoleSaveReqVO {
     @Schema(description = "备注", example = "我是一个角色")
     private String remark;
 
+    @Schema(description = "状态 0开启1关闭" )
+    private Integer status;
+
     private Long organId;
 
 }
diff --git a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/dal/mysql/permission/RoleMapper.java b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/dal/mysql/permission/RoleMapper.java
index 70b835a48..6bb522ceb 100644
--- a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/dal/mysql/permission/RoleMapper.java
+++ b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/dal/mysql/permission/RoleMapper.java
@@ -39,7 +39,8 @@ public interface RoleMapper extends BaseMapperX<RoleDO> {
         lambdaQueryWrapperX.likeIfPresent(RoleDO::getName, reqVO.getName())
                 .likeIfPresent(RoleDO::getCode, reqVO.getCode())
                 .eqIfPresent(RoleDO::getStatus, reqVO.getStatus())
-                .betweenIfPresent(BaseDO::getCreateTime, reqVO.getCreateTime())
+                .betweenIfPresent(RoleDO::getCreateTime, reqVO.getCreateTime())
+                .ne(RoleDO::getId, 1)
                 .orderByDesc(RoleDO::getId);
 
         return selectPage(reqVO, lambdaQueryWrapperX);
@@ -53,8 +54,12 @@ public interface RoleMapper extends BaseMapperX<RoleDO> {
         return selectOne(RoleDO::getCode, code, RoleDO::getOrganId, organId);
     }
 
-    default List<RoleDO> selectListByStatus(@Nullable Collection<Integer> statuses) {
-        return selectList(RoleDO::getStatus, statuses);
+    default List<RoleDO> selectListByStatus(@Nullable Collection<Integer> statuses, Long organId) {
+        return selectList(new LambdaQueryWrapperX<RoleDO>()
+                .eqIfPresent(RoleDO::getOrganId, organId)
+                .eq(RoleDO::getStatus, statuses)
+                .ne(RoleDO::getId, 1)
+        );
     }
 
 }
diff --git a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/organ/OrganServiceImpl.java b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/organ/OrganServiceImpl.java
index a6fd9b09c..64bfaa975 100644
--- a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/organ/OrganServiceImpl.java
+++ b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/organ/OrganServiceImpl.java
@@ -242,8 +242,8 @@ public class OrganServiceImpl implements OrganService {
     public void updateOrganRoleMenu(Long organId, Set<Long> menuIds) {
         OrganUtils.execute(organId, () -> {
             // 获得所有角色
-            List<RoleDO> roles = roleService.getRoleList();
-            roles.forEach(role -> Assert.isTrue(organId.equals(role.getOrganId()), "角色({}/{}) 组织不匹配",
+            List<RoleDO> roles = roleService.getMeAndDefaultRoleList();
+            roles.forEach(role -> Assert.isTrue(organId.equals(role.getOrganId()) || role.getOrganId().equals(0L), "角色({}/{}) 组织不匹配",
                     role.getId(), role.getOrganId(), organId)); // 兜底校验
             // 重新分配每个角色的权限
             roles.forEach(role -> {
diff --git a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/organ/TenantPackageService.java b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/organ/TenantPackageService.java
index ce2efad46..0bf009cdf 100644
--- a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/organ/TenantPackageService.java
+++ b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/organ/TenantPackageService.java
@@ -15,6 +15,9 @@ import java.util.List;
  */
 public interface TenantPackageService {
 
+    long SYSTEM_ORGAN_PACKAGE_ID = 116;
+    long SYSTEM_SUPER_PACKAGE_ID = 0;
+
     /**
      * 创建组织套餐
      *
diff --git a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/organ/TenantPackageServiceImpl.java b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/organ/TenantPackageServiceImpl.java
index a95afbb9c..b5275b52b 100644
--- a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/organ/TenantPackageServiceImpl.java
+++ b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/organ/TenantPackageServiceImpl.java
@@ -16,6 +16,7 @@ import org.springframework.validation.annotation.Validated;
 
 import javax.annotation.Resource;
 import java.util.List;
+import java.util.Objects;
 
 import static com.cf.imes.framework.common.exception.util.ServiceExceptionUtil.exception;
 import static com.cf.imes.module.system.enums.ErrorCodeConstants.*;
@@ -50,6 +51,10 @@ public class TenantPackageServiceImpl implements TenantPackageService {
     public void updateTenantPackage(TenantPackageSaveReqVO updateReqVO) {
         // 校验存在
         TenantPackageDO tenantPackage = validateTenantPackageExists(updateReqVO.getId());
+        if(Objects.equals(tenantPackage.getId(), SYSTEM_ORGAN_PACKAGE_ID) || Objects.equals(tenantPackage.getId(), SYSTEM_SUPER_PACKAGE_ID)) {
+            throw exception(TENANT_PACKAGE_DEPT_EXIT);
+        }
+
         // 更新
         TenantPackageDO updateObj = BeanUtils.toBean(updateReqVO, TenantPackageDO.class);
         tenantPackageMapper.updateById(updateObj);
@@ -64,6 +69,10 @@ public class TenantPackageServiceImpl implements TenantPackageService {
     public void deleteTenantPackage(Long id) {
         // 校验存在
         validateTenantPackageExists(id);
+        if(Objects.equals(id, SYSTEM_ORGAN_PACKAGE_ID) || Objects.equals(id, SYSTEM_SUPER_PACKAGE_ID)) {
+            throw exception(TENANT_PACKAGE_DELETED_EXIT);
+        }
+
         // 校验正在使用
         validateOrganUsed(id);
         // 删除
diff --git a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/permission/MenuServiceImpl.java b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/permission/MenuServiceImpl.java
index c032c8454..451cd61b3 100644
--- a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/permission/MenuServiceImpl.java
+++ b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/permission/MenuServiceImpl.java
@@ -19,6 +19,7 @@ import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
 
 import javax.annotation.Resource;
+import java.util.ArrayList;
 import java.util.Collection;
 import java.util.List;
 
@@ -136,6 +137,9 @@ public class MenuServiceImpl implements MenuService {
     @Override
     @OrganIgnore
     public List<MenuDO> getMenuList1(Collection<Long> ids) {
+        if(CollUtil.isEmpty(ids)) {
+            return new ArrayList<>();
+        }
         return menuMapper.selectBatchIds(ids);
     }
 
diff --git a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/permission/PermissionServiceImpl.java b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/permission/PermissionServiceImpl.java
index 38d65c2f0..587524f4d 100644
--- a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/permission/PermissionServiceImpl.java
+++ b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/permission/PermissionServiceImpl.java
@@ -11,6 +11,7 @@ import com.cf.imes.framework.mybatis.core.query.LambdaQueryWrapperX;
 import com.cf.imes.framework.organ.core.aop.OrganIgnore;
 import com.cf.imes.framework.organ.core.context.OrganContextHolder;
 import com.cf.imes.framework.organ.core.db.OrganBaseDO;
+import com.cf.imes.framework.security.core.util.SecurityFrameworkUtils;
 import com.cf.imes.module.system.api.permission.dto.DeptDataPermissionRespDTO;
 import com.cf.imes.module.system.controller.admin.permission.vo.permission.PermissionAssignUserRoleReqVO;
 import com.cf.imes.module.system.dal.dataobject.permission.MenuDO;
@@ -39,8 +40,10 @@ import java.util.*;
 import java.util.function.Function;
 import java.util.function.Supplier;
 
+import static com.cf.imes.framework.common.exception.util.ServiceExceptionUtil.exception;
 import static com.cf.imes.framework.common.util.collection.CollectionUtils.convertSet;
 import static com.cf.imes.framework.common.util.json.JsonUtils.toJsonString;
+import static com.cf.imes.module.system.enums.ErrorCodeConstants.ROLE_ME_ERROR;
 import static com.cf.imes.module.system.service.organ.OrganServiceImpl.ORGAN_ADMIN_ROLE_ID;
 import static com.cf.imes.module.system.service.organ.OrganServiceImpl.ORGAN_STAFF_ROLE_ID;
 
@@ -251,7 +254,9 @@ public class PermissionServiceImpl implements PermissionService {
     @Cacheable(value = RedisKeyConstants.MENU_ROLE_ID_LIST, key = "#menuId")
     @OrganIgnore
     public Set<Long> getMenuRoleIdListByMenuIdFromCache1(Long menuId) {
-        List<RoleMenuDO> roleMenuDOS = roleMenuMapper.selectList(new LambdaQueryWrapperX<RoleMenuDO>().in(RoleMenuDO::getOrganId, 0l, OrganContextHolder.getOrganId())
+       //todo 这里应该过滤组织id为0的和自己的
+        List<RoleMenuDO> roleMenuDOS = roleMenuMapper.selectList(new LambdaQueryWrapperX<RoleMenuDO>()
+                //.in(RoleMenuDO::getOrganId, 0l, organId)
                 .eq(RoleMenuDO::getMenuId, menuId)
         );
         return convertSet(roleMenuDOS, RoleMenuDO::getRoleId);
@@ -264,6 +269,9 @@ public class PermissionServiceImpl implements PermissionService {
     @DSTransactional // 多数据源，使用 @DSTransactional 保证本地事务，以及数据源的切换
     @CacheEvict(value = RedisKeyConstants.USER_ROLE_ID_LIST, key = "#userId")
     public void assignUserRole(Long userId, Set<Long> roleIds, Long organId) {
+        if(Objects.equals(userId, SecurityFrameworkUtils.getLoginUserId())) {
+            throw exception(ROLE_ME_ERROR);
+        }
         // 获得用户拥有角色编号
         Set<Long> dbRoleIds = convertSet(userRoleMapper.selectListByUserId(userId),
                 UserRoleDO::getRoleId);
diff --git a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/permission/RoleService.java b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/permission/RoleService.java
index 02e4960ab..589d13952 100644
--- a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/permission/RoleService.java
+++ b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/permission/RoleService.java
@@ -105,7 +105,7 @@ public interface RoleService {
      * @param statuses 筛选的状态
      * @return 角色列表
      */
-    List<RoleDO> getRoleListByStatus(Collection<Integer> statuses);
+    List<RoleDO> getRoleListByStatus(Collection<Integer> statuses, Long organId);
 
     /**
      * 获得所有角色列表
@@ -114,6 +114,13 @@ public interface RoleService {
      */
     List<RoleDO> getRoleList();
 
+    /**
+     * 获得自己组织与0号组织的所有角色列表
+     *
+     * @return 角色列表
+     */
+    List<RoleDO> getMeAndDefaultRoleList();
+
     /**
      * 获得角色分页
      *
diff --git a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/permission/RoleServiceImpl.java b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/permission/RoleServiceImpl.java
index e33e1126a..243adec19 100644
--- a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/permission/RoleServiceImpl.java
+++ b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/permission/RoleServiceImpl.java
@@ -62,7 +62,7 @@ public class RoleServiceImpl implements RoleService {
         // 插入到数据库
         RoleDO role = BeanUtils.toBean(createReqVO, RoleDO.class);
         role.setType(ObjectUtil.defaultIfNull(type, RoleTypeEnum.CUSTOM.getType()));
-        role.setStatus(CommonStatusEnum.ENABLE.getStatus());
+        //role.setStatus(CommonStatusEnum.ENABLE.getStatus());
         role.setDataScope(DataScopeEnum.ALL.getScope()); // 默认可查看所有数据。原因是，可能一些项目不需要项目权限
         role.setOrganId(createReqVO.getOrganId());
         roleMapper.insert(role);
@@ -197,16 +197,17 @@ public class RoleServiceImpl implements RoleService {
 
     @Override
     @OrganIgnore
-    public List<RoleDO> getRoleListByStatus(Collection<Integer> statuses) {
+    public List<RoleDO> getRoleListByStatus(Collection<Integer> statuses, Long organId) {
         LoginUser loginUser = SecurityFrameworkUtils.getLoginUser();
         assert loginUser != null;
         if(!loginUser.getIsSupAdmin()) {
             return roleMapper.selectList(new LambdaQueryWrapperX<RoleDO>()
                     .in(RoleDO::getStatus, statuses)
                     .in(RoleDO::getOrganId, loginUser.getOrganId(), 0L)
+                    .ne(RoleDO::getId, 1)
             );
         }
-        return roleMapper.selectListByStatus(statuses);
+        return roleMapper.selectListByStatus(statuses, organId);
     }
 
     @Override
@@ -214,6 +215,13 @@ public class RoleServiceImpl implements RoleService {
         return roleMapper.selectList();
     }
 
+    @Override
+    public List<RoleDO> getMeAndDefaultRoleList() {
+        return roleMapper.selectList(new LambdaQueryWrapperX<RoleDO>()
+                .in(RoleDO::getOrganId, Arrays.asList(0L, OrganContextHolder.getOrganId()))
+        );
+    }
+
     @Override
     public List<RoleDO> getRoleList(Collection<Long> ids) {
         if (CollectionUtil.isEmpty(ids)) {
diff --git a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/user/AdminUserServiceImpl.java b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/user/AdminUserServiceImpl.java
index c8f96c92c..064d073b7 100644
--- a/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/user/AdminUserServiceImpl.java
+++ b/cf-module-system/cf-module-system-biz/src/main/java/com/cf/imes/module/system/service/user/AdminUserServiceImpl.java
@@ -53,6 +53,7 @@ import java.util.stream.Collectors;
 import static com.cf.imes.framework.common.exception.util.ServiceExceptionUtil.exception;
 import static com.cf.imes.framework.common.util.collection.CollectionUtils.convertList;
 import static com.cf.imes.framework.common.util.collection.CollectionUtils.convertSet;
+import static com.cf.imes.module.system.enums.ErrorCodeConstants.USER_ME_ERROR;
 import static com.cf.imes.module.system.service.organ.OrganServiceImpl.ORGAN_ADMIN_ROLE_ID;
 
 /**
@@ -102,7 +103,7 @@ public class AdminUserServiceImpl implements AdminUserService {
         });
         // 校验正确性
         validateUserForCreateOrUpdate(null, createReqVO.getUsername(),
-                createReqVO.getMobile(), createReqVO.getEmail(), createReqVO.getDeptId(), createReqVO.getPostIds(), createReqVO.getOrganId());
+                createReqVO.getMobile(), createReqVO.getEmail(), createReqVO.getDeptId(), createReqVO.getPostIds(), organId);
         // 插入用户
         AdminUserDO user = BeanUtils.toBean(createReqVO, AdminUserDO.class);
         user.setOrganId(createReqVO.getOrganId());
@@ -229,6 +230,9 @@ public class AdminUserServiceImpl implements AdminUserService {
     @Override
     @Transactional(rollbackFor = Exception.class)
     public void deleteUser(Long id) {
+        if(Objects.equals(id, SecurityFrameworkUtils.getLoginUserId())) {
+            throw exception(USER_ME_ERROR);
+        }
         // 校验用户存在
         validateUserExists(id);
         // 删除用户