diff --git a/oa/models/app.gen.go b/oa/models/app.gen.go
index 39451b1..948024a 100644
--- a/oa/models/app.gen.go
+++ b/oa/models/app.gen.go
@@ -2,19 +2,11 @@ package models
 
 import "time"
 
-type AppDelete struct {
-	ID string `json:"id" gorm:"primaryKey;type:varchar(32)"  parse:"path@app_id"`
-}
-
 type AppGet struct {
 	ID   string `json:"id" gorm:"primaryKey;type:varchar(32)"  parse:"path@app_id"`
 	Name string `json:"name"  parse:"json"`
 }
 
-type AppList struct {
-	Name *string `json:"name"  parse:"json"`
-}
-
 type AppPatch struct {
 	ID          string  `json:"id" gorm:"primaryKey;type:varchar(32)"  parse:"path@app_id"`
 	Name        *string `json:"name"  parse:"json"`
@@ -24,6 +16,10 @@ type AppPatch struct {
 	InitRoleID  *string `json:"init_role_id" gorm:"index;type:varchar(32)"  parse:"json"`
 }
 
+type AppDelete struct {
+	ID string `json:"id" gorm:"primaryKey;type:varchar(32)"  parse:"path@app_id"`
+}
+
 type AppPost struct {
 	Name        string `json:"name"  parse:"json"`
 	Icon        string `json:"icon"  parse:"json"`
@@ -31,8 +27,8 @@ type AppPost struct {
 	Participate string `json:"participate" gorm:"default:auto"  parse:"json"`
 }
 
-type AppUserDelete struct {
-	ID string `json:"id" gorm:"primaryKey;type:varchar(32)"  parse:"path@app_user_id"`
+type AppList struct {
+	Name *string `json:"name"  parse:"json"`
 }
 
 type AppUserGet struct {
@@ -41,14 +37,18 @@ type AppUserGet struct {
 	UserID string `json:"user_id"  parse:"path"`
 }
 
-type AppUserList struct {
+type AppUserPatch struct {
+	ID     string  `json:"id" gorm:"primaryKey;type:varchar(32)"  parse:"path@app_user_id"`
 	AppID  *string `json:"app_id"  parse:"path"`
 	UserID *string `json:"user_id"  parse:"path"`
 	Status *string `json:"status"  parse:"json"`
 }
 
-type AppUserPatch struct {
-	ID     string  `json:"id" gorm:"primaryKey;type:varchar(32)"  parse:"path@app_user_id"`
+type AppUserDelete struct {
+	ID string `json:"id" gorm:"primaryKey;type:varchar(32)"  parse:"path@app_user_id"`
+}
+
+type AppUserList struct {
 	AppID  *string `json:"app_id"  parse:"path"`
 	UserID *string `json:"user_id"  parse:"path"`
 	Status *string `json:"status"  parse:"json"`
@@ -60,11 +60,6 @@ type AppUserPost struct {
 	Status string `json:"status"  parse:"json"`
 }
 
-type ResourceDelete struct {
-	AppID string `json:"app_id" gorm:"primaryKey;type:varchar(32)"  parse:"json"`
-	Name  string `json:"name" gorm:"primaryKey"  parse:"json"`
-}
-
 type ResourceList struct {
 	CreatedAt *time.Time `json:"created_at"  parse:"query"`
 	UpdatedAt *time.Time `json:"updated_at"  parse:"query"`
@@ -76,3 +71,8 @@ type ResourcePost struct {
 	Name  string `json:"name" gorm:"primaryKey"  parse:"json"`
 	Des   string `json:"des"  parse:"json"`
 }
+
+type ResourceDelete struct {
+	AppID string `json:"app_id" gorm:"primaryKey;type:varchar(32)"  parse:"json"`
+	Name  string `json:"name" gorm:"primaryKey"  parse:"json"`
+}
diff --git a/oa/models/init.go b/oa/models/init.go
index d708ba3..8a0bb95 100644
--- a/oa/models/init.go
+++ b/oa/models/init.go
@@ -31,5 +31,6 @@ func init() {
 	cfg.ObjList = append(cfg.ObjList, &Role{})
 	cfg.ObjList = append(cfg.ObjList, &User{})
 	cfg.ObjList = append(cfg.ObjList, &UserRole{})
+	cfg.ObjList = append(cfg.ObjList, &Token{})
 	cfg.ObjList = append(cfg.ObjList, &App{})
 }
diff --git a/oa/models/role.gen.go b/oa/models/role.gen.go
index 262ccc1..0713154 100644
--- a/oa/models/role.gen.go
+++ b/oa/models/role.gen.go
@@ -1,19 +1,9 @@
 package models
 
-import ()
-
-type RoleDelete struct {
-	ID string `json:"id" gorm:"primaryKey;type:varchar(32)"  parse:"path@role_id"`
-}
-
 type RoleGet struct {
 	ID string `json:"id" gorm:"primaryKey;type:varchar(32)"  parse:"path@role_id"`
 }
 
-type RoleList struct {
-	Name *string `json:"name"  parse:"json"`
-}
-
 type RolePatch struct {
 	ID    string  `json:"id" gorm:"primaryKey;type:varchar(32)"  parse:"path@role_id"`
 	Name  *string `json:"name"  parse:"json"`
@@ -21,8 +11,16 @@ type RolePatch struct {
 	AppID *string `json:"app_id" gorm:"index;type:varchar(32)"  parse:"json"`
 }
 
+type RoleDelete struct {
+	ID string `json:"id" gorm:"primaryKey;type:varchar(32)"  parse:"path@role_id"`
+}
+
 type RolePost struct {
 	Name  string `json:"name"  parse:"json"`
 	Des   string `json:"des"  parse:"json"`
 	AppID string `json:"app_id" gorm:"index;type:varchar(32)"  parse:"json"`
 }
+
+type RoleList struct {
+	Name *string `json:"name"  parse:"json"`
+}
diff --git a/oa/models/token.gen.go b/oa/models/token.gen.go
new file mode 100644
index 0000000..65cfd65
--- /dev/null
+++ b/oa/models/token.gen.go
@@ -0,0 +1,32 @@
+package models
+
+import "time"
+
+type TokenSalt struct {
+	ID string `json:"id" gorm:"primaryKey;type:varchar(32)"  parse:"path"`
+}
+type TokenGet struct {
+	ID string `json:"id" gorm:"primaryKey;type:varchar(32)"  parse:"path@token_id"`
+}
+
+type TokenPatch struct {
+	ID        string     `json:"id" gorm:"primaryKey;type:varchar(32)"  parse:"path@token_id"`
+	ExpiredAt *time.Time `json:"expired_at"  parse:"json"`
+	OverPerm  *string    `json:"over_perm"  parse:"json"`
+}
+
+type TokenDelete struct {
+	ID string `json:"id" gorm:"primaryKey;type:varchar(32)"  parse:"path@token_id"`
+}
+
+type TokenPost struct {
+	UserID    string     `json:"user_id" gorm:"index;type:varchar(32)"  parse:"json"`
+	AppID     string     `json:"app_id" gorm:"index;type:varchar(32)"  parse:"json"`
+	ExpiredAt *time.Time `json:"expired_at"  parse:"json"`
+	OverPerm  *string    `json:"over_perm"  parse:"json"`
+}
+
+type TokenList struct {
+	UserID string `json:"user_id" gorm:"index;type:varchar(32)"  parse:"json"`
+	AppID  string `json:"app_id" gorm:"index;type:varchar(32)"  parse:"json"`
+}
diff --git a/oa/models/token.go b/oa/models/token.go
new file mode 100644
index 0000000..86e4cdc
--- /dev/null
+++ b/oa/models/token.go
@@ -0,0 +1,16 @@
+package models
+
+import "time"
+
+// refresh token，由oa 秘钥签发，有效期长, 存储在token表
+// app token, 由app 秘钥签发，有效期短, 不存储
+// OverPerm 非oa应用获取oa数据的权限，由用户设定
+type Token struct {
+	BaseModel
+	UserID    string    `json:"user_id" gorm:"index;type:varchar(32)" methods:"post,list" parse:"json"`
+	User      *User     `json:"-"`
+	AppID     string    `json:"app_id" gorm:"index;type:varchar(32)" methods:"post,list" parse:"json"`
+	App       *App      `json:"-"`
+	ExpiredAt time.Time `json:"expired_at" methods:"*post,*patch" parse:"json"`
+	OverPerm  string    `json:"over_perm" methods:"*post,*patch" parse:"json"`
+}
diff --git a/oa/models/user.gen.go b/oa/models/user.gen.go
index 4298cbb..1be4e38 100644
--- a/oa/models/user.gen.go
+++ b/oa/models/user.gen.go
@@ -2,22 +2,16 @@ package models
 
 import ()
 
-type UserDelete struct {
-	ID string `json:"id" gorm:"primaryKey;type:varchar(32)"  parse:"path@user_id"`
+type UserLogin struct {
+	ID  string `json:"id" parse:"path@user_id"`
+	Pwd string `json:"pwd" parse:"json"`
+	Typ string `json:"typ" parse:"json"`
 }
 
 type UserGet struct {
 	ID string `json:"id" gorm:"primaryKey;type:varchar(32)"  parse:"path@user_id"`
 }
 
-type UserList struct {
-	Username *string `json:"username" gorm:"varchar(100);unique;default:not null"  parse:"json"`
-	Nickname *string `json:"nickname"  parse:"json"`
-	Email    *string `json:"email" gorm:"varchar(20);unique;default:null"  parse:"json"`
-	Phone    *string `json:"phone" gorm:"varchar(50);unique;default:null"  parse:"json"`
-	Status   *uint   `json:"status"  parse:"json"`
-}
-
 type UserPatch struct {
 	ID       string  `json:"id" gorm:"primaryKey;type:varchar(32)"  parse:"path@user_id"`
 	Username *string `json:"username" gorm:"varchar(100);unique;default:not null"  parse:"json"`
@@ -28,35 +22,49 @@ type UserPatch struct {
 	Status   *uint   `json:"status"  parse:"json"`
 }
 
+type UserDelete struct {
+	ID string `json:"id" gorm:"primaryKey;type:varchar(32)"  parse:"path@user_id"`
+}
+
 type UserPost struct {
 	Username string  `json:"username" gorm:"varchar(100);unique;default:not null"  parse:"json"`
 	Nickname *string `json:"nickname"  parse:"json"`
 	Icon     *string `json:"icon"  parse:"json"`
 	Email    *string `json:"email" gorm:"varchar(20);unique;default:null"  parse:"json"`
 	Phone    *string `json:"phone" gorm:"varchar(50);unique;default:null"  parse:"json"`
+	Salt     string  `json:"salt" gorm:"varchar(32)"  parse:"json"`
+	Code     string  `json:"code" gorm:"varchar(128)"  parse:"json"`
 }
 
-type UserRoleDelete struct {
-	ID     string `json:"id" gorm:"primaryKey;type:varchar(32)"  parse:"path@user_role_id"`
-	UserID string `json:"user_id"  parse:"path"`
-	RoleID string `json:"role_id"  parse:"path"`
+type UserList struct {
+	Username *string `json:"username" gorm:"varchar(100);unique;default:not null"  parse:"json"`
+	Nickname *string `json:"nickname"  parse:"json"`
+	Email    *string `json:"email" gorm:"varchar(20);unique;default:null"  parse:"json"`
+	Phone    *string `json:"phone" gorm:"varchar(50);unique;default:null"  parse:"json"`
+	Status   *uint   `json:"status"  parse:"json"`
 }
 
 type UserRoleGet struct {
 	ID string `json:"id" gorm:"primaryKey;type:varchar(32)"  parse:"path@user_role_id"`
 }
 
-type UserRoleList struct {
-	Status *string `json:"status"  parse:"json"`
-}
-
 type UserRolePatch struct {
 	ID     string  `json:"id" gorm:"primaryKey;type:varchar(32)"  parse:"path@user_role_id"`
 	Status *string `json:"status"  parse:"json"`
 }
 
+type UserRoleDelete struct {
+	ID     string `json:"id" gorm:"primaryKey;type:varchar(32)"  parse:"path@user_role_id"`
+	UserID string `json:"user_id"  parse:"path"`
+	RoleID string `json:"role_id"  parse:"path"`
+}
+
 type UserRolePost struct {
 	UserID string `json:"user_id"  parse:"path"`
 	RoleID string `json:"role_id"  parse:"path"`
 	Status string `json:"status"  parse:"json"`
 }
+
+type UserRoleList struct {
+	Status *string `json:"status"  parse:"json"`
+}
diff --git a/oa/models/user.go b/oa/models/user.go
index 243c483..5f9d90e 100644
--- a/oa/models/user.go
+++ b/oa/models/user.go
@@ -2,17 +2,17 @@ package models
 
 type User struct {
 	BaseModel
-	Username string `json:"username" gorm:"varchar(100);unique;default:not null" methods:"post,*patch,*list" parse:"json"`
-	Nickname string `json:"nickname" methods:"*post,*patch,*list" parse:"json"`
+	Username string `json:"username" gorm:"type:varchar(100);unique;default:not null" methods:"post,*patch,*list" parse:"json"`
+	Nickname string `json:"nickname" gorm:"type:varchar(100)" methods:"*post,*patch,*list" parse:"json"`
 	Icon     string `json:"icon" methods:"*post,*patch" parse:"json"`
 
-	Email string `json:"email" gorm:"varchar(20);unique;default:null" methods:"*post,*patch,*list" parse:"json"`
-	Phone string `json:"phone" gorm:"varchar(50);unique;default:null" methods:"*post,*patch,*list" parse:"json"`
+	Email string `json:"email" gorm:"unique;type:varchar(50);default:null" methods:"*post,*patch,*list" parse:"json"`
+	Phone string `json:"phone" gorm:"type:varchar(30);unique;default:null" methods:"*post,*patch,*list" parse:"json"`
 
 	Status uint `json:"status" methods:"*patch,*list" parse:"json"`
 
-	RealCode  string `json:"-"`
-	CheckCode string `json:"-"`
+	Salt string `json:"-" gorm:"type:varchar(32)" methods:"post" parse:"json"`
+	Code string `json:"-" gorm:"type:varchar(256)" methods:"post" parse:"json"`
 }
 
 type UserRole struct {