diff --git a/hb_server/apps/mtm/serializers.py b/hb_server/apps/mtm/serializers.py
index 538e70f..72bc685 100644
--- a/hb_server/apps/mtm/serializers.py
+++ b/hb_server/apps/mtm/serializers.py
@@ -42,6 +42,7 @@ class ProcessSimpleSerializer(serializers.ModelSerializer):
         model = Process
         fields = ['id', 'name', 'number', 'type']
 
+
 class StepSerializer(serializers.ModelSerializer):
     class Meta:
         model = Step
@@ -138,7 +139,7 @@ class UsedStepCreateSerializer(serializers.ModelSerializer):
     """
     class Meta:
         model = UsedStep
-        fields =  ['step', 'subproduction', 'remark']
+        fields =  ['step', 'subproduction', 'remark', 'need_test']
 
 class UsedStepUpdateSerializer(serializers.ModelSerializer):
     """
@@ -146,7 +147,7 @@ class UsedStepUpdateSerializer(serializers.ModelSerializer):
     """
     class Meta:
         model = UsedStep
-        fields =  ['remark']
+        fields =  ['remark', 'need_test']
 
 class UsedStepListSerializer(serializers.ModelSerializer):
     """
diff --git a/hb_server/apps/mtm/views.py b/hb_server/apps/mtm/views.py
index 0923f65..6fcf054 100644
--- a/hb_server/apps/mtm/views.py
+++ b/hb_server/apps/mtm/views.py
@@ -91,8 +91,8 @@ class InputMaterialViewSet(CreateUpdateModelAMixin, ModelViewSet):
     """
     输入物料-增删改查
     """
-    perms_map = {'get':'*', 'post':'subproduction_material_create',
-                'put':'subproduction_update', 'delete':'subproduction_delete'}
+    perms_map = {'get':'*', 'post':'subproduction_update',
+                'put':'subproduction_update', 'delete':'subproduction_update'}
     queryset = SubprodctionMaterial.objects.select_related('material').filter(type=SubprodctionMaterial.SUB_MA_TYPE_IN)
     serializer_class = InputMaterialSerializer
     filterset_fields = ['subproduction']
@@ -109,7 +109,8 @@ class OutputMaterialViewSet(CreateUpdateModelAMixin, ModelViewSet):
     """
     输出物料-增删改查
     """
-    perms_map = {'*':'*'}
+    perms_map = {'get':'*', 'post':'subproduction_update',
+                'put':'subproduction_update', 'delete':'subproduction_update'}
     queryset = SubprodctionMaterial.objects.select_related('material').filter(type=SubprodctionMaterial.SUB_MA_TYPE_OUT)
     serializer_class = OutputMaterialSerializer
     filterset_fields = ['subproduction']
@@ -126,7 +127,8 @@ class OtherMaterialViewSet(CreateUpdateModelAMixin, ListModelMixin, DestroyModel
     """
     其他物料-增删改查
     """
-    perms_map = {'*':'*'}
+    perms_map = {'get':'*', 'post':'subproduction_update',
+                'put':'subproduction_update', 'delete':'subproduction_update'}
     queryset = SubprodctionMaterial.objects.select_related('material').filter(type=SubprodctionMaterial.SUB_MA_TYPE_TOOL)
     serializer_class = OutputMaterialSerializer
     filterset_fields = ['subproduction']
@@ -141,7 +143,8 @@ class UsedStepViewSet(OptimizationMixin, CreateModelMixin, DestroyModelMixin, Li
     """
     产品生产子工序表
     """
-    perms_map = {'*':'*'}
+    perms_map = {'get':'*', 'post':'subproduction_update',
+                'put':'subproduction_update', 'delete':'subproduction_update'}
     queryset = UsedStep.objects.all()
     filterset_fields = ['subproduction', 'step']
     ordering = ['step__sort', '-step__create_time']
@@ -157,7 +160,8 @@ class RecordFormViewSet(OptimizationMixin, CreateUpdateModelAMixin, ModelViewSet
     """
     记录表格增删改查
     """
-    perms_map = {'*':'*'}
+    perms_map = {'get':'*', 'post':'recordform_create',
+                'put':'recordform_update', 'delete':'recordform_delete'}
     queryset = RecordForm.objects.all()
     filterset_fields = ['step', 'type', 'material', 'number', 'enabled']
     search_fields = ['name']
@@ -189,7 +193,8 @@ class RecordFormFieldViewSet(OptimizationMixin, CreateUpdateModelAMixin, ModelVi
     """
     表格字段表 增删改查
     """
-    perms_map = {'*':'*'}
+    perms_map = {'get':'*', 'post':'recordform_update',
+                'put':'recordform_update', 'delete':'recordform_update'}
     queryset = RecordFormField.objects.all()
     filterset_fields = ['field_type', 'form']
     search_fields = ['field_name', 'field_key']
@@ -207,7 +212,8 @@ class TechDocViewSet(OptimizationMixin, CreateUpdateModelAMixin, ModelViewSet):
     """
     技术文件增删改查
     """
-    perms_map = {'*':'*'}
+    perms_map = {'get':'*', 'post':'subproduction_update',
+                'put':'subproduction_update', 'delete':'subproduction_update'}
     queryset = TechDoc.objects.select_related('file').all()
     filterset_class = TechDocFilterset
     search_fields = ['name']
diff --git a/hb_server/apps/pm/views.py b/hb_server/apps/pm/views.py
index 449cb2d..44eea4d 100644
--- a/hb_server/apps/pm/views.py
+++ b/hb_server/apps/pm/views.py
@@ -39,7 +39,7 @@ class ProductionPlanViewSet(CreateUpdateModelAMixin, ListModelMixin, CreateModel
     """
     生产计划
     """
-    perms_map = {'*': '*'}
+    perms_map = {'get': '*', 'post':'plan_create'}
     queryset = ProductionPlan.objects.select_related('order', 'order__contract', 'product')
     serializer_class = ProductionPlanSerializer
     search_fields = ['number', 'order__number', 'order__contract__number', 'product__number']
@@ -69,7 +69,7 @@ class ProductionPlanViewSet(CreateUpdateModelAMixin, ListModelMixin, CreateModel
             updateOrderPlanedCount(instance.order)
         return Response()
     
-    @action(methods=['post'], detail=False, perms_map={'post':'*'}, serializer_class=PlanDestorySerializer)
+    @action(methods=['post'], detail=False, perms_map={'post':'plan_delete'}, serializer_class=PlanDestorySerializer)
     def deletes(self, request, pk=None):
         """
         批量物理删除
@@ -77,7 +77,7 @@ class ProductionPlanViewSet(CreateUpdateModelAMixin, ListModelMixin, CreateModel
         ProductionPlan.objects.filter(id__in=request.data.get('ids', [])).delete(soft=False)
         return Response()
     
-    @action(methods=['post'], detail=True, perms_map={'post':'*'}, serializer_class=GenSubPlanSerializer)
+    @action(methods=['post'], detail=True, perms_map={'post':'gen_subplan'}, serializer_class=GenSubPlanSerializer)
     @transaction.atomic
     def gen_subplan(self, request, pk=None):
         """
@@ -109,7 +109,7 @@ class SubProductionPlanViewSet(CreateUpdateModelAMixin, ListModelMixin, UpdateMo
     """
     子生产计划-列表/修改
     """
-    perms_map = {'*': '*'}
+    perms_map = {'get': '*', 'put':'subplan_update'}
     queryset = SubProductionPlan.objects.select_related('process', 'workshop', 'subproduction', 'product', 'production_plan__product')
     search_fields = []
     serializer_class = SubProductionPlanListSerializer
@@ -133,7 +133,7 @@ class SubProductionPlanViewSet(CreateUpdateModelAMixin, ListModelMixin, UpdateMo
         serializer = SubProductionProgressSerializer(instance=obj.progress_subplan, many=True)
         return Response(serializer.data)
 
-    @action(methods=['post'], detail=True, perms_map={'post':'*'}, serializer_class=serializers.Serializer)
+    @action(methods=['post'], detail=True, perms_map={'post':'subplan_issue'}, serializer_class=serializers.Serializer)
     @transaction.atomic
     def issue(self, request, pk=None):
         """
@@ -150,7 +150,7 @@ class SubProductionPlanViewSet(CreateUpdateModelAMixin, ListModelMixin, UpdateMo
             return Response()
         raise APIException('计划状态有误')
     
-    @action(methods=['post'], detail=True, perms_map={'post':'*'}, serializer_class=serializers.Serializer)
+    @action(methods=['post'], detail=True, perms_map={'post':'subplan_start'}, serializer_class=serializers.Serializer)
     def start(self, request, pk=None):
         """
         开始生产
@@ -197,7 +197,7 @@ class SubProductionProgressViewSet(ListModelMixin, GenericViewSet):
     """
     生产进度
     """
-    perms_map = {'*': '*'}
+    perms_map = {'get': '*'}
     queryset = SubProductionProgress.objects.select_related('material', 'subproduction_plan')
     search_fields = []
     serializer_class = SubProductionProgressSerializer
@@ -208,7 +208,7 @@ class SubProductionProgressViewSet(ListModelMixin, GenericViewSet):
 class ResourceViewSet(GenericViewSet):
     
     perms_map = {'*': '*'}
-    @action(methods=['post'], detail=False, perms_map={'post':'*'}, serializer_class=ResourceCalListSerializer)
+    @action(methods=['post'], detail=False, perms_map={'post':'resource_cal'}, serializer_class=ResourceCalListSerializer)
     def cal(self, request, pk=None):
         """
         物料消耗计算
@@ -240,7 +240,7 @@ class ResourceViewSet(GenericViewSet):
                      'count_safe':m['material__count_safe']})
         return Response(res)
 
-    @action(methods=['post'], detail=False, perms_map={'post':'*'}, serializer_class=ResourceCalListSerializer)
+    @action(methods=['post'], detail=False, perms_map={'post':'resource_cal_equip'}, serializer_class=ResourceCalListSerializer)
     def cal_equip(self, request, pk=None):
         """
         设备状态查看
diff --git a/hb_server/apps/pum/views.py b/hb_server/apps/pum/views.py
index 6f13f39..3d15a5b 100644
--- a/hb_server/apps/pum/views.py
+++ b/hb_server/apps/pum/views.py
@@ -31,8 +31,8 @@ class PuOrderViewSet(CreateUpdateModelAMixin, ModelViewSet):
     """
     采购订单-增删改查
     """
-    perms_map = {'get': '*', 'post': '*',
-                 'put': '*', 'delete': '*'}
+    perms_map = {'get': '*', 'post': 'puorder_create',
+                 'put': 'puorder_update', 'delete': 'puorder_delete'}
     queryset = PuOrder.objects.select_related('vendor').\
         prefetch_related('item_pu_order').all()
     serializer_class = PuOrderSerializer
@@ -57,7 +57,7 @@ class PuOrderViewSet(CreateUpdateModelAMixin, ModelViewSet):
             raise ValidationError('该采购订单已审核')
         return super().destroy(request, *args, **kwargs)
 
-    @action(methods=['post'], detail=True, perms_map={'post':'*'}, 
+    @action(methods=['post'], detail=True, perms_map={'post':'puorder_audit'}, 
         serializer_class=serializers.Serializer)
     def audit(self, request, pk=None):
         obj = self.get_object()
@@ -72,8 +72,8 @@ class PuOrderItemViewSet(CreateModelMixin, ListModelMixin, DestroyModelMixin, Ge
     """
     采购订单条目
     """
-    perms_map = {'get': '*', 'post': '*',
-                 'put': '*', 'delete': '*'}
+    perms_map = {'get': '*', 'post': 'puorder_update',
+                 'put': 'puorder_update', 'delete': 'puorder_update'}
     queryset = PuOrderItem.objects.select_related('material').all()
     serializer_class = PuOrderItemSerializer
     filterset_fields = ['pu_order', 'material']
diff --git a/hb_server/apps/qm/views.py b/hb_server/apps/qm/views.py
index 7cb1f40..4c653a1 100644
--- a/hb_server/apps/qm/views.py
+++ b/hb_server/apps/qm/views.py
@@ -52,7 +52,7 @@ class TestRecordViewSet(ListModelMixin, UpdateModelMixin, RetrieveModelMixin, De
     """
     检验记录
     """
-    perms_map = {'*': '*'}
+    perms_map = {'get': '*', 'post':'testrecord_update', 'delete':'testrecord_delete'}
     queryset = TestRecord.objects.select_related('fifo_item', 'form').prefetch_related('item_test_record').all()
     serializer_class = TestRecordListSerializer
     filterset_fields = ['wproduct', 'material', 'step', 'subproduction_plan', 'fifo_item', 'origin_test', 'type']
@@ -80,7 +80,7 @@ class TestRecordViewSet(ListModelMixin, UpdateModelMixin, RetrieveModelMixin, De
         WpmService.add_wproduct_flow_log(obj.wproduct, 'test_delete')
         return super().destroy(request, *args, **kwargs)
 
-    @action(methods=['post'], detail=True, perms_map={'post':'*'}, serializer_class=TestRecordUpdateSerializer)
+    @action(methods=['post'], detail=True, perms_map={'post':'testrecord_submit'}, serializer_class=TestRecordUpdateSerializer)
     def submit(self, request, pk=None):
         obj = self.get_object()
         if obj.is_submited and obj.is_midtesting is False: