diff --git a/src/com/engine/salary/entity/auth/dto/AuthOptDTO.java b/src/com/engine/salary/entity/auth/dto/AuthOptDTO.java
index 547e6fb5c..c50e1bf33 100644
--- a/src/com/engine/salary/entity/auth/dto/AuthOptDTO.java
+++ b/src/com/engine/salary/entity/auth/dto/AuthOptDTO.java
@@ -25,49 +25,49 @@ public class AuthOptDTO {
     private String key;
 
     @XStreamImplicit(itemFieldName = "module")
-    private List<module> module;
+    private List<Module> modules;
 
+    @Data
+    public static class Module {
+        @XStreamAlias("name")
+        @XStreamAsAttribute
+        private String name;
+
+        @XStreamAlias("key")
+        @XStreamAsAttribute
+        private String key;
+
+        @XStreamImplicit(itemFieldName = "page")
+        private List<Page> pages;
+
+        @Data
+        public static class Page {
+            @XStreamAlias("name")
+            @XStreamAsAttribute
+            private String name;
+
+            @XStreamAlias("key")
+            @XStreamAsAttribute
+            private String key;
+
+            @XStreamImplicit(itemFieldName = "opt")
+            private List<Opt> opts;
+
+            @Data
+            public static class Opt {
+                @XStreamAlias("name")
+                @XStreamAsAttribute
+                private String name;
+
+                @XStreamAlias("key")
+                @XStreamAsAttribute
+                private String key;
+
+                @XStreamAlias("able")
+                @XStreamAsAttribute
+                private boolean able;
+            }
+        }
+    }
 }
 
-@Data
-class module {
-    @XStreamAlias("name")
-    @XStreamAsAttribute
-    private String name;
-
-    @XStreamAlias("key")
-    @XStreamAsAttribute
-    private String key;
-
-    @XStreamImplicit(itemFieldName = "page")
-    private List<page> pages;
-}
-
-@Data
-class page {
-    @XStreamAlias("name")
-    @XStreamAsAttribute
-    private String name;
-
-    @XStreamAlias("key")
-    @XStreamAsAttribute
-    private String key;
-
-    @XStreamImplicit(itemFieldName = "opt")
-    private List<opt> opts;
-}
-
-@Data
-class opt {
-    @XStreamAlias("name")
-    @XStreamAsAttribute
-    private String name;
-
-    @XStreamAlias("key")
-    @XStreamAsAttribute
-    private String key;
-
-    @XStreamAlias("able")
-    @XStreamAsAttribute
-    private boolean able;
-}
\ No newline at end of file
diff --git a/src/com/engine/salary/entity/auth/param/AuthOptSaveParam.java b/src/com/engine/salary/entity/auth/param/AuthOptSaveParam.java
new file mode 100644
index 000000000..cea3df117
--- /dev/null
+++ b/src/com/engine/salary/entity/auth/param/AuthOptSaveParam.java
@@ -0,0 +1,25 @@
+package com.engine.salary.entity.auth.param;
+
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+import java.util.List;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+public class AuthOptSaveParam {
+    private Long roleId;
+    private List<Opt> opts;
+
+    @Data
+    public static class Opt {
+        private String page;
+
+        private String opt;
+    }
+}
\ No newline at end of file
diff --git a/src/com/engine/salary/entity/auth/po/AuthOptPO.java b/src/com/engine/salary/entity/auth/po/AuthOptPO.java
new file mode 100644
index 000000000..10da3aed9
--- /dev/null
+++ b/src/com/engine/salary/entity/auth/po/AuthOptPO.java
@@ -0,0 +1,75 @@
+package com.engine.salary.entity.auth.po;
+
+import com.engine.hrmelog.annotation.ElogTransform;
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+import java.util.Collection;
+import java.util.Date;
+
+/**
+ * 权限项
+ */
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+public class AuthOptPO {
+    @ElogTransform(name = "id")
+    private Long id;
+
+    /**
+     * 角色id
+     */
+    @ElogTransform(name = "角色id")
+    private Long roleId;
+
+    /**
+     * 页面
+     */
+    @ElogTransform(name = "页面")
+    private String page;
+
+    /**
+     * 权限项
+     */
+    @ElogTransform(name = "权限项")
+    private String opt;
+
+    /**
+     * 创建人
+     */
+    @ElogTransform(name = "创建人")
+    private Long creator;
+
+    /**
+     * 创建时间
+     */
+    @ElogTransform(name = "创建时间")
+    private Date createTime;
+
+    /**
+     * 更新时间
+     */
+    @ElogTransform(name = "更新时间")
+    private Date updateTime;
+
+    /**
+     * 是否已删除。0：未删除、1：已删除
+     */
+    @ElogTransform(name = "是否已删除。0：未删除、1：已删除")
+    private Integer deleteType;
+
+    /**
+     * 租户ID
+     */
+    @ElogTransform(name = "租户ID")
+    private String tenantKey;
+
+
+    //主键id集合
+    private Collection<Long> ids;
+
+}
\ No newline at end of file
diff --git a/src/com/engine/salary/mapper/auth/AuthOptMapper.java b/src/com/engine/salary/mapper/auth/AuthOptMapper.java
new file mode 100644
index 000000000..7dcc172ea
--- /dev/null
+++ b/src/com/engine/salary/mapper/auth/AuthOptMapper.java
@@ -0,0 +1,79 @@
+package com.engine.salary.mapper.auth;
+
+import com.engine.salary.entity.auth.po.AuthOptPO;
+import org.apache.ibatis.annotations.Param;
+
+import java.util.Collection;
+import java.util.List;
+
+public interface AuthOptMapper {
+
+	/**
+     * 查询所有记录
+     *
+     * @return 返回集合，没有返回空List
+     */
+	List<AuthOptPO> listAll();
+    
+    /**
+     * 条件查询
+     *
+     * @return 返回集合，没有返回空List
+     */
+    List<AuthOptPO> listSome(AuthOptPO authOpt);
+    
+
+	/**
+     * 根据主键查询
+     *
+     * @param id 主键
+     * @return 返回记录，没有返回null
+     */
+	AuthOptPO getById(Long id);
+	
+	/**
+     * 新增，忽略null字段
+     *
+     * @param authOpt 新增的记录
+     * @return 返回影响行数
+     */
+	int insertIgnoreNull(AuthOptPO authOpt);
+
+	/**
+     * 修改，修改所有字段
+     *
+     * @param authOpt 修改的记录
+     * @return 返回影响行数
+     */
+	int update(AuthOptPO authOpt);
+	
+	/**
+     * 修改，忽略null字段
+     *
+     * @param authOpt 修改的记录
+     * @return 返回影响行数
+     */
+	int updateIgnoreNull(AuthOptPO authOpt);
+	
+	/**
+     * 删除记录
+     *
+     * @param authOpt 待删除的记录
+     * @return 返回影响行数
+     */
+	int delete(AuthOptPO authOpt);
+    
+    /**
+     * 批量删除记录
+     * @param ids 主键id集合
+     */
+    void deleteByIds(@Param("ids") Collection<Long> ids);
+
+
+	/**
+	 * 根据角色id删除
+	 * @param roleId roleId
+	 */
+	void deleteByRoleId(Long roleId);
+	
+}
\ No newline at end of file
diff --git a/src/com/engine/salary/mapper/auth/AuthOptMapper.xml b/src/com/engine/salary/mapper/auth/AuthOptMapper.xml
new file mode 100644
index 000000000..8ee16cf89
--- /dev/null
+++ b/src/com/engine/salary/mapper/auth/AuthOptMapper.xml
@@ -0,0 +1,230 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<!DOCTYPE  mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd" >
+<mapper namespace="com.engine.salary.mapper.auth.AuthOptMapper">
+    <resultMap id="BaseResultMap" type="com.engine.salary.entity.auth.po.AuthOptPO">
+        <result column="id" property="id"/>
+        <result column="role_id" property="roleId"/>
+        <result column="page" property="page"/>
+        <result column="opt" property="opt"/>
+        <result column="creator" property="creator"/>
+        <result column="create_time" property="createTime"/>
+        <result column="update_time" property="updateTime"/>
+        <result column="delete_type" property="deleteType"/>
+        <result column="tenant_key" property="tenantKey"/>
+    </resultMap>
+
+    <!-- 表字段 -->
+    <sql id="baseColumns">
+        t
+        .
+        id
+        , t.role_id
+        , t.page
+        , t.opt
+        , t.creator
+        , t.create_time
+        , t.update_time
+        , t.delete_type
+        , t.tenant_key
+    </sql>
+
+    <!-- 查询全部 -->
+    <select id="listAll" resultMap="BaseResultMap">
+        SELECT
+        <include refid="baseColumns"/>
+        FROM hrsa_auth_opt t
+        WHERE delete_type = 0
+    </select>
+
+    <!-- 根据主键获取单条记录 -->
+    <select id="getById" resultMap="BaseResultMap" parameterType="Long">
+        SELECT
+        <include refid="baseColumns"/>
+        FROM hrsa_auth_opt t
+        WHERE id = #{id} AND delete_type = 0
+    </select>
+
+    <!-- 条件查询 -->
+    <select id="listSome" resultMap="BaseResultMap" parameterType="com.engine.salary.entity.auth.po.AuthOptPO">
+        SELECT
+        <include refid="baseColumns"/>
+        FROM hrsa_auth_opt t
+        WHERE delete_type = 0
+        <if test="id != null">
+            AND id = #{id}
+        </if>
+        <if test="roleId != null">
+            AND role_id = #{roleId}
+        </if>
+        <if test="page != null">
+            AND page = #{page}
+        </if>
+        <if test="opt != null">
+            AND opt = #{opt}
+        </if>
+        <if test="creator != null">
+            AND creator = #{creator}
+        </if>
+        <if test="createTime != null">
+            AND create_time = #{createTime}
+        </if>
+        <if test="updateTime != null">
+            AND update_time = #{updateTime}
+        </if>
+        <if test="deleteType != null">
+            AND delete_type = #{deleteType}
+        </if>
+        <if test="tenantKey != null">
+            AND tenant_key = #{tenantKey}
+        </if>
+        <if test="ids != null and ids.size()>0">
+            AND id IN
+            <foreach collection="ids" open="(" item="id" separator="," close=")">
+                #{id}
+            </foreach>
+        </if>
+        ORDER BY id DESC
+    </select>
+
+
+    <!-- 插入不为NULL的字段 -->
+    <insert id="insertIgnoreNull" parameterType="com.engine.salary.entity.auth.po.AuthOptPO">
+        INSERT INTO hrsa_auth_opt
+        <trim prefix="(" suffix=")" suffixOverrides=",">
+
+            <if test="id != null">
+                id,
+            </if>
+            <if test="roleId != null">
+                role_id,
+            </if>
+            <if test="page != null">
+                page,
+            </if>
+            <if test="opt != null">
+                opt,
+            </if>
+            <if test="creator != null">
+                creator,
+            </if>
+            <if test="createTime != null">
+                create_time,
+            </if>
+            <if test="updateTime != null">
+                update_time,
+            </if>
+            <if test="deleteType != null">
+                delete_type,
+            </if>
+            <if test="tenantKey != null">
+                tenant_key,
+            </if>
+        </trim>
+        <trim prefix="VALUES (" suffix=")" suffixOverrides=",">
+            <if test="id != null">
+                #{id},
+            </if>
+            <if test="roleId != null">
+                #{roleId},
+            </if>
+            <if test="page != null">
+                #{page},
+            </if>
+            <if test="opt != null">
+                #{opt},
+            </if>
+            <if test="creator != null">
+                #{creator},
+            </if>
+            <if test="createTime != null">
+                #{createTime},
+            </if>
+            <if test="updateTime != null">
+                #{updateTime},
+            </if>
+            <if test="deleteType != null">
+                #{deleteType},
+            </if>
+            <if test="tenantKey != null">
+                #{tenantKey},
+            </if>
+        </trim>
+    </insert>
+
+    <!-- 更新,更新全部字段 -->
+    <update id="update" parameterType="com.engine.salary.entity.auth.po.AuthOptPO">
+        UPDATE hrsa_auth_opt
+        <set>
+            role_id=#{roleId},
+            page=#{page},
+            opt=#{opt},
+            creator=#{creator},
+            create_time=#{createTime},
+            update_time=#{updateTime},
+            delete_type=#{deleteType},
+            tenant_key=#{tenantKey},
+        </set>
+        WHERE id = #{id} AND delete_type = 0
+    </update>
+
+
+    <!-- 更新不为NULL的字段 -->
+    <update id="updateIgnoreNull" parameterType="com.engine.salary.entity.auth.po.AuthOptPO">
+        UPDATE hrsa_auth_opt
+        <set>
+            <if test="roleId != null">
+                role_id=#{roleId},
+            </if>
+            <if test="page != null">
+                page=#{page},
+            </if>
+            <if test="opt != null">
+                opt=#{opt},
+            </if>
+            <if test="creator != null">
+                creator=#{creator},
+            </if>
+            <if test="createTime != null">
+                create_time=#{createTime},
+            </if>
+            <if test="updateTime != null">
+                update_time=#{updateTime},
+            </if>
+            <if test="deleteType != null">
+                delete_type=#{deleteType},
+            </if>
+            <if test="tenantKey != null">
+                tenant_key=#{tenantKey},
+            </if>
+        </set>
+        WHERE id = #{id} AND delete_type = 0
+    </update>
+
+
+    <!-- 根据主键删除记录 -->
+    <delete id="delete">
+        UPDATE hrsa_auth_opt
+        SET delete_type=1
+        WHERE id = #{id}
+          AND delete_type = 0
+    </delete>
+
+    <delete id="deleteByIds">
+        UPDATE hrsa_auth_opt
+        SET delete_type = 1
+        WHERE delete_type = 0
+        AND id IN
+        <foreach collection="ids" open="(" item="id" separator="," close=")">
+            #{id}
+        </foreach>
+    </delete>
+
+    <delete id="deleteByRoleId">
+        UPDATE hrsa_auth_opt
+        SET delete_type=1
+        WHERE role_id = #{roleId} AND delete_type = 0
+    </delete>
+
+
+
+</mapper>
\ No newline at end of file
diff --git a/src/com/engine/salary/service/auth/AuthOptService.java b/src/com/engine/salary/service/auth/AuthOptService.java
new file mode 100644
index 000000000..82a6f3e4f
--- /dev/null
+++ b/src/com/engine/salary/service/auth/AuthOptService.java
@@ -0,0 +1,29 @@
+package com.engine.salary.service.auth;
+
+import com.engine.salary.entity.auth.dto.AuthOptDTO;
+import com.engine.salary.entity.auth.param.AuthOptSaveParam;
+
+/**
+ * 权限项
+ * <p>Copyright: Copyright (c) 2024</p>
+ * <p>Company: 泛微软件</p>
+ *
+ * @author qiantao
+ * @version 1.0
+ **/
+public interface AuthOptService {
+    /**
+     * 权限树
+     * @param roleId
+     * @return
+     */
+    AuthOptDTO optTree(Long roleId);
+
+    /**
+     * 保存权限项
+     * @param param
+     * @return
+     */
+    void save(AuthOptSaveParam param);
+
+}
diff --git a/src/com/engine/salary/service/auth/AuthOptServiceImpl.java b/src/com/engine/salary/service/auth/AuthOptServiceImpl.java
new file mode 100644
index 000000000..ed96d0b62
--- /dev/null
+++ b/src/com/engine/salary/service/auth/AuthOptServiceImpl.java
@@ -0,0 +1,90 @@
+package com.engine.salary.service.auth;
+
+import com.engine.core.impl.Service;
+import com.engine.salary.constant.SalaryDefaultTenantConstant;
+import com.engine.salary.entity.auth.dto.AuthOptDTO;
+import com.engine.salary.entity.auth.param.AuthOptSaveParam;
+import com.engine.salary.entity.auth.po.AuthOptPO;
+import com.engine.salary.entity.auth.po.AuthRolePO;
+import com.engine.salary.exception.SalaryRunTimeException;
+import com.engine.salary.mapper.auth.AuthOptMapper;
+import com.engine.salary.mapper.auth.AuthRoleMapper;
+import com.engine.salary.util.SalaryEntityUtil;
+import com.engine.salary.util.db.IdGenerator;
+import com.engine.salary.util.db.MapperProxyFactory;
+import com.thoughtworks.xstream.XStream;
+import com.thoughtworks.xstream.security.AnyTypePermission;
+import weaver.general.GCONST;
+
+import java.io.File;
+import java.util.Date;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+public class AuthOptServiceImpl extends Service implements AuthOptService {
+
+
+
+    private AuthOptMapper getAuthOptMapper() {
+        return MapperProxyFactory.getProxy(AuthOptMapper.class);
+    }
+
+    private AuthRoleMapper getAuthRoleMapper() {
+        return MapperProxyFactory.getProxy(AuthRoleMapper.class);
+    }
+
+
+    @Override
+    public AuthOptDTO optTree(Long roleId) {
+        List<AuthOptPO> authOptPOS = getAuthOptMapper().listSome(AuthOptPO.builder().roleId(roleId).build());
+        Map<String, Set<String>> pageOpts = SalaryEntityUtil.group2Map(authOptPOS, AuthOptPO::getPage, AuthOptPO::getOpt);
+        XStream xStream = new XStream();
+        String resource = GCONST.getRootPath() + "WEB-INF" + File.separatorChar + "salaryoptconfig.xml";
+        File file = new File("H:\\code\\salary\\resource\\WEB-INF\\salaryoptconfig.xml");
+
+        xStream.addPermission(AnyTypePermission.ANY);
+        xStream.processAnnotations(AuthOptDTO.class);
+        AuthOptDTO dto = (AuthOptDTO)xStream.fromXML(file);
+
+        dto.getModules().forEach(module -> {
+            module.getPages().forEach(page -> {
+                Set<String> opts = pageOpts.get(page.getKey());
+                page.getOpts().forEach(opt -> {
+                    if(opts.contains(opt.getKey())){
+                        opt.setAble(true);
+                    }
+                });
+            });
+        });
+
+        return dto;
+    }
+
+    @Override
+    public void save(AuthOptSaveParam param) {
+        Date now = new Date();
+        Long roleId = param.getRoleId();
+        AuthRolePO rolePO = getAuthRoleMapper().getById(roleId);
+        if (rolePO == null) {
+            throw new SalaryRunTimeException("角色不存在！");
+        }
+
+        getAuthOptMapper().deleteByRoleId(roleId);
+
+        param.getOpts().forEach(opt -> {
+            AuthOptPO po = AuthOptPO.builder()
+                    .id(IdGenerator.generate())
+                    .roleId(roleId)
+                    .page(opt.getPage())
+                    .opt(opt.getOpt())
+                    .creator((long) user.getUID())
+                    .createTime(now)
+                    .updateTime(now)
+                    .deleteType(0)
+                    .tenantKey(SalaryDefaultTenantConstant.DEFAULT_TENANT_KEY)
+                    .build();
+            getAuthOptMapper().insertIgnoreNull(po);
+        });
+    }
+}
diff --git a/src/com/engine/salary/web/AuthController.java b/src/com/engine/salary/web/AuthController.java
index 50fea8860..a165bbd03 100644
--- a/src/com/engine/salary/web/AuthController.java
+++ b/src/com/engine/salary/web/AuthController.java
@@ -2,8 +2,10 @@ package com.engine.salary.web;
 
 import com.engine.common.util.ServiceUtil;
 import com.engine.salary.entity.auth.dto.AuthMemberDTO;
+import com.engine.salary.entity.auth.dto.AuthOptDTO;
 import com.engine.salary.entity.auth.param.AuthMemberQueryParam;
 import com.engine.salary.entity.auth.param.AuthMemberSaveParam;
+import com.engine.salary.entity.auth.param.AuthOptSaveParam;
 import com.engine.salary.entity.auth.param.AuthRoleSaveParam;
 import com.engine.salary.util.ResponseResult;
 import com.engine.salary.util.page.PageInfo;
@@ -15,9 +17,7 @@ import weaver.hrm.User;
 
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
-import javax.ws.rs.POST;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
+import javax.ws.rs.*;
 import javax.ws.rs.core.Context;
 import javax.ws.rs.core.MediaType;
 
@@ -85,13 +85,21 @@ public class AuthController {
     }
 
 
-//    @GET
-//    @Path("/opt/tree")
-//    @Produces(MediaType.APPLICATION_JSON)
-//    public String syncMember(@Context HttpServletRequest request, @Context HttpServletResponse response, @RequestBody Long roleId) {
-//        User user = HrmUserVarify.getUser(request, response);
-//        return new ResponseResult<Long, Long>(user).run(getAuthWrapper(user)::syncMember, roleId);
-//    }
+    @GET
+    @Path("/opt/tree")
+    @Produces(MediaType.APPLICATION_JSON)
+    public String optTree(@Context HttpServletRequest request, @Context HttpServletResponse response, @QueryParam(value = "roleId") Long roleId) {
+        User user = HrmUserVarify.getUser(request, response);
+        return new ResponseResult<Long, AuthOptDTO>(user).run(getAuthWrapper(user)::optTree, roleId);
+    }
+
+    @POST
+    @Path("/opt/save")
+    @Produces(MediaType.APPLICATION_JSON)
+    public String saveOpt(@Context HttpServletRequest request, @Context HttpServletResponse response, @RequestBody AuthOptSaveParam opt) {
+        User user = HrmUserVarify.getUser(request, response);
+        return new ResponseResult<AuthOptSaveParam, AuthOptDTO>(user).run(getAuthWrapper(user)::saveOpt, opt);
+    }
 
 
 }
diff --git a/src/com/engine/salary/wrapper/AuthWrapper.java b/src/com/engine/salary/wrapper/AuthWrapper.java
index 8f25108a2..0098220e5 100644
--- a/src/com/engine/salary/wrapper/AuthWrapper.java
+++ b/src/com/engine/salary/wrapper/AuthWrapper.java
@@ -3,15 +3,14 @@ package com.engine.salary.wrapper;
 import com.engine.common.util.ServiceUtil;
 import com.engine.core.impl.Service;
 import com.engine.salary.entity.auth.dto.AuthMemberDTO;
+import com.engine.salary.entity.auth.dto.AuthOptDTO;
 import com.engine.salary.entity.auth.param.AuthMemberQueryParam;
 import com.engine.salary.entity.auth.param.AuthMemberSaveParam;
+import com.engine.salary.entity.auth.param.AuthOptSaveParam;
 import com.engine.salary.entity.auth.param.AuthRoleSaveParam;
 import com.engine.salary.entity.auth.po.AuthMemberPO;
 import com.engine.salary.enums.auth.TargetTypeEnum;
-import com.engine.salary.service.auth.AuthMemberService;
-import com.engine.salary.service.auth.AuthMemberServiceImpl;
-import com.engine.salary.service.auth.AuthRoleService;
-import com.engine.salary.service.auth.AuthRoleServiceImpl;
+import com.engine.salary.service.auth.*;
 import com.engine.salary.util.page.PageInfo;
 import com.engine.salary.util.page.SalaryPageUtil;
 import com.engine.salary.util.valid.ValidUtil;
@@ -32,6 +31,10 @@ public class AuthWrapper extends Service {
         return ServiceUtil.getService(AuthMemberServiceImpl.class, user);
     }
 
+    private AuthOptService getAuthOptService(User user) {
+        return ServiceUtil.getService(AuthOptServiceImpl.class, user);
+    }
+
     public Long saveRole(AuthRoleSaveParam param) {
         ValidUtil.doValidator(param);
         return getAuthRoleService(user).saveRole(param);
@@ -66,4 +69,11 @@ public class AuthWrapper extends Service {
         getAuthMemberService(user).syncMember(roleId);
     }
 
+    public AuthOptDTO optTree(Long roleId) {
+        return getAuthOptService(user).optTree(roleId);
+    }
+
+    public void saveOpt(AuthOptSaveParam opt) {
+        getAuthOptService(user).save(opt);
+    }
 }