From 0ee835ba25a350a85cc7d4b82aec57b6e765c2e6 Mon Sep 17 00:00:00 2001
From: anweat <anweat@163.com>
Date: Mon, 8 Jun 2026 00:00:48 +0800
Subject: [PATCH 1/2] Polish attachment and assignment UI

---
 frontend/src/styles.css                   | 119 ++++++++++++++++++++++
 frontend/src/views/ContractCreateView.vue |  39 ++++++-
 frontend/src/views/ContractDetailView.vue | 102 +++++++++++++++----
 3 files changed, 237 insertions(+), 23 deletions(-)

diff --git a/frontend/src/styles.css b/frontend/src/styles.css
index b56ea0a..84ad9e2 100644
--- a/frontend/src/styles.css
+++ b/frontend/src/styles.css
@@ -323,6 +323,125 @@ th {
   flex-wrap: wrap;
 }
 
+.assignment-panel {
+  display: grid;
+  gap: 18px;
+  margin-bottom: 18px;
+}
+
+.assign-section {
+  display: grid;
+  gap: 10px;
+}
+
+.assign-section-head {
+  display: flex;
+  align-items: baseline;
+  justify-content: space-between;
+  gap: 12px;
+}
+
+.assign-section-head h3 {
+  margin: 0;
+  font-size: 16px;
+}
+
+.people-grid {
+  display: grid;
+  grid-template-columns: repeat(auto-fill, minmax(168px, 1fr));
+  gap: 10px;
+}
+
+.person-option {
+  min-height: 64px;
+  display: grid;
+  gap: 4px;
+  justify-items: start;
+  padding: 10px 12px;
+  border: 1px solid #d8e1ea;
+  border-radius: 6px;
+  background: #fff;
+  color: #26364d;
+  text-align: left;
+}
+
+.person-option span {
+  font-weight: 800;
+}
+
+.person-option small {
+  color: #64748b;
+}
+
+.person-option.selected {
+  border-color: #126f67;
+  background: #edf7f5;
+  color: #126f67;
+}
+
+.attachment-box {
+  display: grid;
+  gap: 12px;
+  padding: 14px;
+  border: 1px dashed #bfd0dd;
+  border-radius: 8px;
+  background: #f8fafc;
+}
+
+.attachment-head {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 16px;
+}
+
+.attachment-head p {
+  margin: 4px 0 0;
+}
+
+.attach-trigger {
+  cursor: pointer;
+}
+
+.attachment-list {
+  display: grid;
+  gap: 8px;
+}
+
+.attachment-item {
+  min-height: 42px;
+  display: grid;
+  grid-template-columns: auto minmax(0, 1fr) auto auto;
+  align-items: center;
+  gap: 10px;
+  padding: 8px 10px;
+  border: 1px solid #e2e8f0;
+  border-radius: 6px;
+  background: #fff;
+}
+
+.attachment-item span {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+  font-weight: 700;
+}
+
+.attachment-item small,
+.empty-hint {
+  color: #64748b;
+}
+
+.empty-hint {
+  margin: 0;
+}
+
+.icon.mini {
+  width: 30px;
+  height: 30px;
+  min-height: 30px;
+}
+
 .link-button {
   width: auto;
   min-height: auto;
diff --git a/frontend/src/views/ContractCreateView.vue b/frontend/src/views/ContractCreateView.vue
index 23f42f7..4cfbc7b 100644
--- a/frontend/src/views/ContractCreateView.vue
+++ b/frontend/src/views/ContractCreateView.vue
@@ -1,7 +1,7 @@
 <script setup>
 import { reactive, ref, onMounted } from 'vue'
 import { useRouter } from 'vue-router'
-import { ArrowLeft } from 'lucide-vue-next'
+import { ArrowLeft, Paperclip, Upload, X } from 'lucide-vue-next'
 import { api } from '../api'
 
 const router = useRouter()
@@ -63,6 +63,16 @@ function handleFiles(e) {
   files.value = Array.from(e.target.files || [])
 }
 
+function removeFile(index) {
+  files.value.splice(index, 1)
+}
+
+function fileSizeLabel(bytes) {
+  if (bytes < 1024) return bytes + ' B'
+  if (bytes < 1024 * 1024) return (bytes / 1024).toFixed(1) + ' KB'
+  return (bytes / (1024 * 1024)).toFixed(1) + ' MB'
+}
+
 onMounted(loadCustomers)
 </script>
 
@@ -85,10 +95,29 @@ onMounted(loadCustomers)
         <label>开始日期<input v-model="form.beginDate" type="date" required /></label>
         <label>结束日期<input v-model="form.endDate" type="date" required /></label>
         <label class="full">合同内容<textarea v-model="form.content" rows="8" placeholder="输入合同正文内容" required /></label>
-        <label class="full">附件
-          <input type="file" multiple accept=".doc,.docx,.jpg,.jpeg,.png,.bmp,.gif,.pdf" @change="handleFiles" />
-          <span class="muted">支持 doc/docx/jpg/png/pdf，最大 10MB</span>
-        </label>
+        <div class="full attachment-box">
+          <div class="attachment-head">
+            <div>
+              <strong>附件</strong>
+              <p class="muted">支持 doc/docx/jpg/png/pdf，最大 10MB，可随合同一起提交。</p>
+            </div>
+            <label class="secondary attach-trigger">
+              <Upload :size="16" /> 选择附件
+              <input type="file" hidden multiple accept=".doc,.docx,.jpg,.jpeg,.png,.bmp,.gif,.pdf" @change="handleFiles" />
+            </label>
+          </div>
+          <div v-if="files.length" class="attachment-list">
+            <div v-for="(file, index) in files" :key="file.name + index" class="attachment-item">
+              <Paperclip :size="16" />
+              <span>{{ file.name }}</span>
+              <small>{{ fileSizeLabel(file.size) }}</small>
+              <button class="icon mini" type="button" @click="removeFile(index)" title="移除附件">
+                <X :size="14" />
+              </button>
+            </div>
+          </div>
+          <p v-else class="empty-hint">尚未选择附件</p>
+        </div>
       </div>
       <button class="primary" :disabled="loading" @click="submit">{{ loading ? '提交中...' : '提交起草' }}</button>
     </div>
diff --git a/frontend/src/views/ContractDetailView.vue b/frontend/src/views/ContractDetailView.vue
index 755c2b0..9bf659e 100644
--- a/frontend/src/views/ContractDetailView.vue
+++ b/frontend/src/views/ContractDetailView.vue
@@ -73,7 +73,15 @@ async function loadUsers() {
 
 async function assign() {
   try {
-    await api.post(`/contracts/${route.params.id}/assign`, assignForm)
+    if (!assignForm.countersignUserIds.length || !assignForm.approvalUserIds.length || !assignForm.signUserId) {
+      error.value = '请选择会签人员、审批人员和签订人员'
+      return
+    }
+    await api.post(`/contracts/${route.params.id}/assign`, {
+      countersignUserIds: assignForm.countersignUserIds,
+      approvalUserIds: assignForm.approvalUserIds,
+      signUserId: Number(assignForm.signUserId)
+    })
     success.value = '分配成功'
     await loadDetail()
     activeTab.value = 'info'
@@ -195,6 +203,21 @@ const canApproveCurrent = computed(() => hasPermission('contract:approve') && co
 const canSignCurrent = computed(() => hasPermission('contract:sign') && contract.value?.status === 'APPROVED' && pendingTask('SIGN'))
 const canResubmitCurrent = computed(() => hasPermission('contract:update') && contract.value?.status === 'REJECTED' && contract.value?.drafterId === auth.user?.id)
 
+function userName(user) {
+  return user.displayName || user.username
+}
+
+function toggleUser(field, userId) {
+  const list = assignForm[field]
+  const idx = list.indexOf(userId)
+  if (idx >= 0) list.splice(idx, 1)
+  else list.push(userId)
+}
+
+function isSelected(field, userId) {
+  return assignForm[field].includes(userId)
+}
+
 onMounted(() => {
   if (route.query.tab) activeTab.value = route.query.tab
   loadDetail()
@@ -308,23 +331,66 @@ onMounted(() => {
       </div>
 
       <div v-if="activeTab === 'assign' && canAssignCurrent" class="tab-content">
-        <div class="form-grid single">
-          <label>会签人员
-            <select v-model="assignForm.countersignUserIds" multiple style="min-height:100px">
-              <option v-for="u in assignableUsers" :key="u.id" :value="u.id">{{ u.displayName || u.username }}</option>
-            </select>
-          </label>
-          <label>审批人员
-            <select v-model="assignForm.approvalUserIds" multiple style="min-height:100px">
-              <option v-for="u in assignableUsers" :key="u.id" :value="u.id">{{ u.displayName || u.username }}</option>
-            </select>
-          </label>
-          <label>签订人员
-            <select v-model="assignForm.signUserId">
-              <option value="" disabled>请选择签订人员</option>
-              <option v-for="u in assignableUsers" :key="u.id" :value="u.id">{{ u.displayName || u.username }}</option>
-            </select>
-          </label>
+        <div class="assignment-panel">
+          <section class="assign-section">
+            <div class="assign-section-head">
+              <h3>会签人员</h3>
+              <span class="muted">可多选，全部完成后进入定稿</span>
+            </div>
+            <div class="people-grid">
+              <button
+                v-for="u in assignableUsers"
+                :key="'counter-' + u.id"
+                type="button"
+                class="person-option"
+                :class="{ selected: isSelected('countersignUserIds', u.id) }"
+                @click="toggleUser('countersignUserIds', u.id)"
+              >
+                <span>{{ userName(u) }}</span>
+                <small>{{ u.username }}</small>
+              </button>
+            </div>
+          </section>
+
+          <section class="assign-section">
+            <div class="assign-section-head">
+              <h3>审批人员</h3>
+              <span class="muted">可多选，全部通过后进入签订</span>
+            </div>
+            <div class="people-grid">
+              <button
+                v-for="u in assignableUsers"
+                :key="'approval-' + u.id"
+                type="button"
+                class="person-option"
+                :class="{ selected: isSelected('approvalUserIds', u.id) }"
+                @click="toggleUser('approvalUserIds', u.id)"
+              >
+                <span>{{ userName(u) }}</span>
+                <small>{{ u.username }}</small>
+              </button>
+            </div>
+          </section>
+
+          <section class="assign-section">
+            <div class="assign-section-head">
+              <h3>签订人员</h3>
+              <span class="muted">单选</span>
+            </div>
+            <div class="people-grid">
+              <button
+                v-for="u in assignableUsers"
+                :key="'sign-' + u.id"
+                type="button"
+                class="person-option"
+                :class="{ selected: assignForm.signUserId === u.id }"
+                @click="assignForm.signUserId = u.id"
+              >
+                <span>{{ userName(u) }}</span>
+                <small>{{ u.username }}</small>
+              </button>
+            </div>
+          </section>
         </div>
         <button class="primary" @click="assign">确认分配</button>
       </div>

From 9c312953b0ddad81d502e5dbd9b7a2ebf1dfa5b7 Mon Sep 17 00:00:00 2001
From: anweat <anweat@163.com>
Date: Mon, 8 Jun 2026 13:50:06 +0800
Subject: [PATCH 2/2] Accept PR2 workflow improvements

---
 .../contractsys/auth/dto/RegisterRequest.java |   6 +-
 .../contract/ContractController.java          |  12 +-
 .../contractsys/contract/ContractService.java |  48 ++++-
 .../user/PermissionController.java            |  87 +++++++-
 .../com/contractsys/user/RoleRepository.java  |   1 +
 .../com/contractsys/user/UserController.java  |   3 +
 .../user/dto/PermissionRequest.java           |  13 ++
 .../user/dto/UserCreateRequest.java           |   3 +-
 frontend/src/layouts/MainLayout.vue           |   3 +-
 frontend/src/router.js                        |   2 +
 frontend/src/styles.css                       |  83 +++++--
 frontend/src/views/ContractDetailView.vue     | 147 +++++++++----
 frontend/src/views/RegisterView.vue           |   8 +-
 .../views/system/PermissionManagementView.vue | 157 ++++++++++++++
 .../src/views/system/RoleManagementView.vue   |  45 +++-
 .../src/views/system/UserManagementView.vue   |   4 +-
 scripts/smoke-pr2.ps1                         | 203 ++++++++++++++++++
 17 files changed, 736 insertions(+), 89 deletions(-)
 create mode 100644 backend/src/main/java/com/contractsys/user/dto/PermissionRequest.java
 create mode 100644 frontend/src/views/system/PermissionManagementView.vue
 create mode 100644 scripts/smoke-pr2.ps1

diff --git a/backend/src/main/java/com/contractsys/auth/dto/RegisterRequest.java b/backend/src/main/java/com/contractsys/auth/dto/RegisterRequest.java
index f3db46e..0a2a8e3 100644
--- a/backend/src/main/java/com/contractsys/auth/dto/RegisterRequest.java
+++ b/backend/src/main/java/com/contractsys/auth/dto/RegisterRequest.java
@@ -4,8 +4,8 @@
 import jakarta.validation.constraints.Size;
 
 public record RegisterRequest(
-        @NotBlank @Size(max = 40) String username,
-        @NotBlank @Size(max = 100) String password,
-        @NotBlank @Size(max = 100) String confirmPassword
+        @NotBlank @Size(min = 3, max = 40) String username,
+        @NotBlank @Size(min = 6, max = 100) String password,
+        @NotBlank @Size(min = 6, max = 100) String confirmPassword
 ) {
 }
diff --git a/backend/src/main/java/com/contractsys/contract/ContractController.java b/backend/src/main/java/com/contractsys/contract/ContractController.java
index c42b9b8..a41c414 100644
--- a/backend/src/main/java/com/contractsys/contract/ContractController.java
+++ b/backend/src/main/java/com/contractsys/contract/ContractController.java
@@ -167,6 +167,14 @@ public ApiResponse<Void> delete(@PathVariable Long id) {
         return ApiResponse.ok(null);
     }
 
+    @PostMapping("/contracts/{id}/cancel")
+    @RequirePermission("contract:delete")
+    public ApiResponse<Void> cancel(@PathVariable Long id) {
+        SysUser user = authService.requireUser();
+        contractService.cancel(id, user);
+        return ApiResponse.ok(null);
+    }
+
     @GetMapping("/logs")
     @RequirePermission("log:view")
     public ApiResponse<PageResponse<OperationLog>> logs(@RequestParam(defaultValue = "") String keyword,
@@ -198,7 +206,7 @@ public ApiResponse<Map<String, Object>> uploadAttachment(@PathVariable Long id,
                                                               @RequestParam("file") MultipartFile file) {
         SysUser user = authService.requireUser();
         Contract contract = contractService.getContract(id);
-        contractService.ensureCanViewContract(contract.getId(), user);
+        contractService.ensureCanModifyContract(contract.getId(), user);
         Attachment attachment = saveAttachment(contract, file, user);
         return ApiResponse.ok("上传成功", Map.of("id", attachment.getId(), "originalName", attachment.getOriginalName()));
     }
@@ -225,7 +233,7 @@ public ResponseEntity<Resource> downloadAttachment(@PathVariable Long id) {
         SysUser user = authService.requireUser();
         Attachment attachment = attachmentRepository.findById(id)
                 .orElseThrow(() -> com.contractsys.common.ApiException.notFound("附件不存在"));
-        contractService.ensureCanViewContract(attachment.getContract().getId(), user);
+        contractService.ensureCanModifyContract(attachment.getContract().getId(), user);
         Path filePath = fileStorageService.resolve(attachment.getStoredName());
         if (!Files.exists(filePath)) {
             throw com.contractsys.common.ApiException.notFound("附件文件不存在");
diff --git a/backend/src/main/java/com/contractsys/contract/ContractService.java b/backend/src/main/java/com/contractsys/contract/ContractService.java
index f291363..aee6f60 100644
--- a/backend/src/main/java/com/contractsys/contract/ContractService.java
+++ b/backend/src/main/java/com/contractsys/contract/ContractService.java
@@ -102,6 +102,7 @@ public ContractView create(ContractCreateRequest request, SysUser operator) {
     @Transactional
     public ContractDetailView assign(Long id, AssignRequest request, SysUser operator) {
         Contract contract = getContract(id);
+        ensureMutableContract(contract);
         requireStatus(contract, ContractStatus.DRAFT);
         finishTask(id, operator, TaskType.ASSIGN, TaskStatus.DONE, "已完成分配");
         completeRemainingPendingTasks(id, TaskType.ASSIGN, "其他分配待办已关闭");
@@ -124,6 +125,7 @@ public List<TaskView> myTasks(SysUser user) {
     @Transactional
     public ContractDetailView countersign(Long id, OpinionRequest request, SysUser operator) {
         Contract contract = getContract(id);
+        ensureMutableContract(contract);
         requireStatus(contract, ContractStatus.ASSIGNED);
         finishTask(id, operator, TaskType.COUNTERSIGN, TaskStatus.DONE, request.opinion());
         if (!taskRepository.existsByContractIdAndTaskTypeAndTaskStatus(id, TaskType.COUNTERSIGN, TaskStatus.PENDING)) {
@@ -136,6 +138,7 @@ public ContractDetailView countersign(Long id, OpinionRequest request, SysUser o
     @Transactional
     public ContractDetailView finalizeContract(Long id, FinalizeRequest request, SysUser operator) {
         Contract contract = getContract(id);
+        ensureMutableContract(contract);
         requireStatus(contract, ContractStatus.COUNTERSIGNED, ContractStatus.REJECTED);
         if (!contract.getDrafter().getId().equals(operator.getId())) {
             throw ApiException.forbidden("只有起草人可以定稿");
@@ -149,6 +152,7 @@ public ContractDetailView finalizeContract(Long id, FinalizeRequest request, Sys
     @Transactional
     public ContractDetailView approve(Long id, ApproveRequest request, SysUser operator) {
         Contract contract = getContract(id);
+        ensureMutableContract(contract);
         requireStatus(contract, ContractStatus.FINALIZED);
         TaskStatus taskStatus = request.result() == ApproveResult.APPROVED ? TaskStatus.DONE : TaskStatus.REJECTED;
         finishTask(id, operator, TaskType.APPROVAL, taskStatus, request.opinion());
@@ -163,6 +167,7 @@ public ContractDetailView approve(Long id, ApproveRequest request, SysUser opera
     @Transactional
     public ContractDetailView sign(Long id, SignRequest request, SysUser operator) {
         Contract contract = getContract(id);
+        ensureMutableContract(contract);
         requireStatus(contract, ContractStatus.APPROVED);
         finishTask(id, operator, TaskType.SIGN, TaskStatus.DONE, request.signInfo());
         contract.setSignedDate(request.signedDate());
@@ -176,6 +181,7 @@ public ContractDetailView sign(Long id, SignRequest request, SysUser operator) {
     @Transactional
     public ContractView update(Long id, ContractCreateRequest request, SysUser operator) {
         Contract contract = getContract(id);
+        ensureMutableContract(contract);
         requireStatus(contract, ContractStatus.DRAFT, ContractStatus.COUNTERSIGNED, ContractStatus.REJECTED);
         if (!contract.getDrafter().getId().equals(operator.getId())) {
             throw ApiException.forbidden("只有起草人可以修改合同");
@@ -206,6 +212,16 @@ public void delete(Long id, SysUser operator) {
         recordState(contract, contract.getStatus(), contract.getStatus(), operator, "删除合同");
     }
 
+    @Transactional
+    public void cancel(Long id, SysUser operator) {
+        Contract contract = getContract(id);
+        if (contract.getStatus() == ContractStatus.SIGNED || contract.getStatus() == ContractStatus.CANCELLED) {
+            throw ApiException.conflict("当前合同状态不允许取消");
+        }
+        completeRemainingPendingTasks(id, "合同已取消，待办已关闭");
+        changeStatus(contract, ContractStatus.CANCELLED, operator, "取消合同");
+    }
+
     public Page<ContractStateHistory> logs(String keyword, int page, int size) {
         var pr = PageRequests.of(page, size);
         if (keyword == null || keyword.isEmpty()) {
@@ -217,15 +233,13 @@ public Page<ContractStateHistory> logs(String keyword, int page, int size) {
     @Transactional
     public ContractDetailView resubmit(Long id, SysUser operator) {
         Contract contract = getContract(id);
+        ensureMutableContract(contract);
         requireStatus(contract, ContractStatus.REJECTED);
-        // Reset rejected approval tasks back to PENDING
         List<ContractTask> approvalTasks = taskRepository.findByContractIdAndTaskType(contract.getId(), TaskType.APPROVAL);
         for (ContractTask task : approvalTasks) {
-            if (task.getTaskStatus() == TaskStatus.REJECTED) {
-                task.setTaskStatus(TaskStatus.PENDING);
-                task.setOpinion(null);
-                task.setOperatedAt(null);
-            }
+            task.setTaskStatus(TaskStatus.PENDING);
+            task.setOpinion(null);
+            task.setOperatedAt(null);
         }
         taskRepository.saveAll(approvalTasks);
         changeStatus(contract, ContractStatus.FINALIZED, operator, "重新提交审批");
@@ -324,6 +338,12 @@ public void ensureCanViewContract(Long contractId, SysUser user) {
         ensureCanViewContract(getContract(contractId), user);
     }
 
+    public void ensureCanModifyContract(Long contractId, SysUser user) {
+        Contract contract = getContract(contractId);
+        ensureCanViewContract(contract, user);
+        ensureMutableContract(contract);
+    }
+
     public boolean canViewContract(Contract contract, SysUser user) {
         return hasPermission(user, "contract:query")
                 || contract.getDrafter().getId().equals(user.getId())
@@ -411,6 +431,22 @@ private void completeRemainingPendingTasks(Long contractId, TaskType taskType, S
         taskRepository.saveAll(tasks);
     }
 
+    private void completeRemainingPendingTasks(Long contractId, String opinion) {
+        List<ContractTask> tasks = taskRepository.findByContractIdAndTaskStatus(contractId, TaskStatus.PENDING);
+        for (ContractTask task : tasks) {
+            task.setTaskStatus(TaskStatus.DONE);
+            task.setOpinion(opinion);
+            task.setOperatedAt(LocalDateTime.now());
+        }
+        taskRepository.saveAll(tasks);
+    }
+
+    private void ensureMutableContract(Contract contract) {
+        if (contract.getStatus() == ContractStatus.CANCELLED) {
+            throw ApiException.conflict("已取消合同不能继续操作");
+        }
+    }
+
     private void requireStatus(Contract contract, ContractStatus... statuses) {
         for (ContractStatus status : statuses) {
             if (contract.getStatus() == status) {
diff --git a/backend/src/main/java/com/contractsys/user/PermissionController.java b/backend/src/main/java/com/contractsys/user/PermissionController.java
index f974252..6109549 100644
--- a/backend/src/main/java/com/contractsys/user/PermissionController.java
+++ b/backend/src/main/java/com/contractsys/user/PermissionController.java
@@ -2,22 +2,49 @@
 
 import com.contractsys.auth.AuthService;
 import com.contractsys.auth.RequirePermission;
+import com.contractsys.common.ApiException;
 import com.contractsys.common.ApiResponse;
+import com.contractsys.log.OperationLogService;
+import com.contractsys.user.dto.PermissionRequest;
 import com.contractsys.user.dto.PermissionView;
+import jakarta.validation.Valid;
 import org.springframework.web.bind.annotation.*;
 
 import java.util.List;
+import java.util.Set;
 
 @RestController
 @RequestMapping("/api/v1/permissions")
 @RequirePermission({"permission:manage", "role:manage"})
 public class PermissionController {
+    private static final Set<String> CORE_PERMISSION_CODES = Set.of(
+            "contract:create",
+            "contract:update",
+            "contract:delete",
+            "contract:view",
+            "contract:query",
+            "contract:assign",
+            "contract:countersign",
+            "contract:approve",
+            "contract:sign",
+            "customer:manage",
+            "user:manage",
+            "role:manage",
+            "permission:manage",
+            "log:view"
+    );
+
     private final PermissionRepository permissionRepository;
+    private final RoleRepository roleRepository;
     private final AuthService authService;
+    private final OperationLogService operationLogService;
 
-    public PermissionController(PermissionRepository permissionRepository, AuthService authService) {
+    public PermissionController(PermissionRepository permissionRepository, RoleRepository roleRepository,
+                                AuthService authService, OperationLogService operationLogService) {
         this.permissionRepository = permissionRepository;
+        this.roleRepository = roleRepository;
         this.authService = authService;
+        this.operationLogService = operationLogService;
     }
 
     @GetMapping
@@ -25,4 +52,62 @@ public ApiResponse<List<PermissionView>> list() {
         authService.requireUser();
         return ApiResponse.ok(permissionRepository.findAll().stream().map(PermissionView::from).toList());
     }
+
+    @PostMapping
+    @RequirePermission("permission:manage")
+    public ApiResponse<PermissionView> create(@Valid @RequestBody PermissionRequest request) {
+        SysUser operator = authService.requireUser();
+        if (permissionRepository.existsByPermissionCode(request.permissionCode())) {
+            throw ApiException.conflict("权限编码已存在");
+        }
+        SysPermission permission = new SysPermission();
+        permission.setPermissionCode(request.permissionCode());
+        applyRequest(permission, request);
+        permissionRepository.save(permission);
+        operationLogService.record(operator, "SYSTEM", "新增权限", "PERMISSION", permission.getId(),
+                permission.getPermissionCode());
+        return ApiResponse.ok("创建成功", PermissionView.from(permission));
+    }
+
+    @PutMapping("/{id}")
+    @RequirePermission("permission:manage")
+    public ApiResponse<PermissionView> update(@PathVariable Long id,
+                                              @Valid @RequestBody PermissionRequest request) {
+        SysUser operator = authService.requireUser();
+        SysPermission permission = permissionRepository.findById(id)
+                .orElseThrow(() -> ApiException.notFound("权限不存在"));
+        if (!permission.getPermissionCode().equals(request.permissionCode())) {
+            throw ApiException.conflict("权限编码创建后不可修改");
+        }
+        applyRequest(permission, request);
+        permissionRepository.save(permission);
+        operationLogService.record(operator, "SYSTEM", "修改权限", "PERMISSION", permission.getId(),
+                permission.getPermissionCode());
+        return ApiResponse.ok("更新成功", PermissionView.from(permission));
+    }
+
+    @DeleteMapping("/{id}")
+    @RequirePermission("permission:manage")
+    public ApiResponse<Void> delete(@PathVariable Long id) {
+        SysUser operator = authService.requireUser();
+        SysPermission permission = permissionRepository.findById(id)
+                .orElseThrow(() -> ApiException.notFound("权限不存在"));
+        if (CORE_PERMISSION_CODES.contains(permission.getPermissionCode())) {
+            throw ApiException.conflict("系统核心权限不能删除");
+        }
+        if (roleRepository.existsByPermissions_Id(id)) {
+            throw ApiException.conflict("该权限已分配给角色，不能删除");
+        }
+        permissionRepository.delete(permission);
+        operationLogService.record(operator, "SYSTEM", "删除权限", "PERMISSION", id,
+                permission.getPermissionCode());
+        return ApiResponse.ok(null);
+    }
+
+    private void applyRequest(SysPermission permission, PermissionRequest request) {
+        permission.setPermissionName(request.permissionName());
+        permission.setModule(request.module());
+        permission.setUrl(request.url());
+        permission.setDescription(request.description());
+    }
 }
diff --git a/backend/src/main/java/com/contractsys/user/RoleRepository.java b/backend/src/main/java/com/contractsys/user/RoleRepository.java
index b3b791d..58b3f05 100644
--- a/backend/src/main/java/com/contractsys/user/RoleRepository.java
+++ b/backend/src/main/java/com/contractsys/user/RoleRepository.java
@@ -7,4 +7,5 @@
 public interface RoleRepository extends JpaRepository<SysRole, Long> {
     Optional<SysRole> findByRoleCode(String roleCode);
     boolean existsByRoleCode(String roleCode);
+    boolean existsByPermissions_Id(Long permissionId);
 }
diff --git a/backend/src/main/java/com/contractsys/user/UserController.java b/backend/src/main/java/com/contractsys/user/UserController.java
index 91ecf1d..2fe42fd 100644
--- a/backend/src/main/java/com/contractsys/user/UserController.java
+++ b/backend/src/main/java/com/contractsys/user/UserController.java
@@ -112,6 +112,9 @@ public ApiResponse<UserView> update(@PathVariable Long id,
         if (request.phone() != null) user.setPhone(request.phone());
         if (request.email() != null) user.setEmail(request.email());
         if (request.password() != null && !request.password().isBlank()) {
+            if (request.password().length() < 6) {
+                throw ApiException.badRequest("密码长度不能少于6位");
+            }
             user.setPasswordHash(passwordEncoder.encode(request.password()));
         }
         userRepository.save(user);
diff --git a/backend/src/main/java/com/contractsys/user/dto/PermissionRequest.java b/backend/src/main/java/com/contractsys/user/dto/PermissionRequest.java
new file mode 100644
index 0000000..41fc462
--- /dev/null
+++ b/backend/src/main/java/com/contractsys/user/dto/PermissionRequest.java
@@ -0,0 +1,13 @@
+package com.contractsys.user.dto;
+
+import jakarta.validation.constraints.NotBlank;
+import jakarta.validation.constraints.Size;
+
+public record PermissionRequest(
+        @NotBlank @Size(max = 80) String permissionCode,
+        @NotBlank @Size(max = 40) String permissionName,
+        @NotBlank @Size(max = 40) String module,
+        @Size(max = 200) String url,
+        @Size(max = 100) String description
+) {
+}
diff --git a/backend/src/main/java/com/contractsys/user/dto/UserCreateRequest.java b/backend/src/main/java/com/contractsys/user/dto/UserCreateRequest.java
index bd0ea9a..97c41f5 100644
--- a/backend/src/main/java/com/contractsys/user/dto/UserCreateRequest.java
+++ b/backend/src/main/java/com/contractsys/user/dto/UserCreateRequest.java
@@ -1,12 +1,13 @@
 package com.contractsys.user.dto;
 
 import jakarta.validation.constraints.NotBlank;
+import jakarta.validation.constraints.Size;
 
 import java.util.List;
 
 public record UserCreateRequest(
         @NotBlank String username,
-        @NotBlank String password,
+        @NotBlank @Size(min = 6, max = 100) String password,
         String displayName,
         String phone,
         String email,
diff --git a/frontend/src/layouts/MainLayout.vue b/frontend/src/layouts/MainLayout.vue
index 358d256..f5113b7 100644
--- a/frontend/src/layouts/MainLayout.vue
+++ b/frontend/src/layouts/MainLayout.vue
@@ -3,7 +3,7 @@ import { ref, computed, watch, onMounted } from 'vue'
 import { useRouter, useRoute } from 'vue-router'
 import {
   ClipboardList, UsersRound, Handshake, LogOut,
-  LayoutDashboard, Settings, ShieldCheck, UserCog, ScrollText, ChevronDown, Search
+  LayoutDashboard, Settings, ShieldCheck, UserCog, ScrollText, ChevronDown, Search, KeyRound
 } from 'lucide-vue-next'
 import { useAuthStore } from '../stores/auth'
 import { api } from '../api'
@@ -23,6 +23,7 @@ const menuItems = [
 const sysItems = [
   { path: '/system/users', label: '用户管理', icon: UserCog, permission: 'user:manage' },
   { path: '/system/roles', label: '角色管理', icon: ShieldCheck, permission: 'role:manage' },
+  { path: '/system/permissions', label: '权限管理', icon: KeyRound, permission: 'permission:manage' },
   { path: '/system/logs', label: '操作日志', icon: ScrollText, permission: 'log:view' },
 ]
 
diff --git a/frontend/src/router.js b/frontend/src/router.js
index 721fd30..e5976b5 100644
--- a/frontend/src/router.js
+++ b/frontend/src/router.js
@@ -12,6 +12,7 @@ import CustomerListView from './views/CustomerListView.vue'
 import MyTasksView from './views/MyTasksView.vue'
 import UserManagementView from './views/system/UserManagementView.vue'
 import RoleManagementView from './views/system/RoleManagementView.vue'
+import PermissionManagementView from './views/system/PermissionManagementView.vue'
 import LogView from './views/system/LogView.vue'
 
 function hasAccess(required, permissions) {
@@ -39,6 +40,7 @@ const router = createRouter({
         { path: 'tasks', component: MyTasksView, meta: { title: '我的待办', permission: ['contract:assign', 'contract:countersign', 'contract:approve', 'contract:sign', 'contract:update'] } },
         { path: 'system/users', component: UserManagementView, meta: { title: '用户管理', permission: 'user:manage' } },
         { path: 'system/roles', component: RoleManagementView, meta: { title: '角色管理', permission: 'role:manage' } },
+        { path: 'system/permissions', component: PermissionManagementView, meta: { title: '权限管理', permission: 'permission:manage' } },
         { path: 'system/logs', component: LogView, meta: { title: '操作日志', permission: 'log:view' } },
       ]
     }
diff --git a/frontend/src/styles.css b/frontend/src/styles.css
index 84ad9e2..92be4c0 100644
--- a/frontend/src/styles.css
+++ b/frontend/src/styles.css
@@ -346,37 +346,78 @@ th {
   font-size: 16px;
 }
 
-.people-grid {
-  display: grid;
-  grid-template-columns: repeat(auto-fill, minmax(168px, 1fr));
-  gap: 10px;
-}
-
-.person-option {
-  min-height: 64px;
-  display: grid;
-  gap: 4px;
-  justify-items: start;
-  padding: 10px 12px;
+.tag-picker {
   border: 1px solid #d8e1ea;
   border-radius: 6px;
   background: #fff;
-  color: #26364d;
-  text-align: left;
+  overflow: hidden;
 }
 
-.person-option span {
-  font-weight: 800;
+.selected-tags {
+  min-height: 44px;
+  display: flex;
+  align-items: center;
+  flex-wrap: wrap;
+  gap: 7px;
+  padding: 8px 10px;
+  border-bottom: 1px solid #edf1f5;
+  background: #f8fafc;
 }
 
-.person-option small {
-  color: #64748b;
+.tag-placeholder {
+  color: #94a3b8;
+  font-size: 14px;
 }
 
-.person-option.selected {
-  border-color: #126f67;
+.selected-tag {
+  min-height: 28px;
+  padding: 0 9px;
+  border: 1px solid #9dc7c1;
+  border-radius: 999px;
   background: #edf7f5;
   color: #126f67;
+  font-size: 13px;
+  font-weight: 700;
+}
+
+.selected-tag span {
+  margin-left: 6px;
+  color: #64748b;
+}
+
+.checkbox-list {
+  max-height: 176px;
+  overflow-y: auto;
+  padding: 6px;
+}
+
+.check-option {
+  min-height: 34px;
+  display: grid;
+  grid-template-columns: 20px minmax(90px, 1fr) auto;
+  align-items: center;
+  gap: 8px;
+  padding: 6px 8px;
+  border-radius: 5px;
+  color: #26364d;
+}
+
+.check-option:hover {
+  background: #f3f7f9;
+}
+
+.check-option input {
+  width: 15px;
+  height: 15px;
+  accent-color: #126f67;
+}
+
+.check-option span {
+  font-weight: 700;
+}
+
+.check-option small {
+  color: #64748b;
 }
 
 .attachment-box {
@@ -628,6 +669,7 @@ th {
 .status-APPROVED { background: #e8f5e9; color: #2e7d32; }
 .status-SIGNED { background: #edf7f5; color: #126f67; }
 .status-REJECTED { background: #ffebee; color: #c62828; }
+.status-CANCELLED { background: #f1f5f9; color: #475569; }
 .status-draft { background: #e8f4f8; color: #2b6e8a; }
 .status-assigned { background: #fff3e0; color: #b85c00; }
 .status-countersigned { background: #e8f5e9; color: #2e7d32; }
@@ -635,6 +677,7 @@ th {
 .status-approved { background: #e8f5e9; color: #2e7d32; }
 .status-signed { background: #edf7f5; color: #126f67; }
 .status-rejected { background: #ffebee; color: #c62828; }
+.status-cancelled { background: #f1f5f9; color: #475569; }
 
 /* success */
 .success-msg {
diff --git a/frontend/src/views/ContractDetailView.vue b/frontend/src/views/ContractDetailView.vue
index 9bf659e..8b06a13 100644
--- a/frontend/src/views/ContractDetailView.vue
+++ b/frontend/src/views/ContractDetailView.vue
@@ -1,7 +1,7 @@
 <script setup>
 import { ref, reactive, computed, onMounted } from 'vue'
 import { useRoute, useRouter } from 'vue-router'
-import { ArrowLeft, UserCheck, Paperclip, Download, Trash2, Upload, RotateCcw } from 'lucide-vue-next'
+import { ArrowLeft, UserCheck, Paperclip, Download, Trash2, Upload, RotateCcw, XCircle } from 'lucide-vue-next'
 import { api } from '../api'
 import { useAuthStore } from '../stores/auth'
 
@@ -25,7 +25,7 @@ const assignForm = reactive({
 })
 
 function statusLabel(s) {
-  const map = { DRAFT:'待分配', ASSIGNED:'待会签', COUNTERSIGNED:'待定稿', FINALIZED:'待审批', APPROVED:'待签订', SIGNED:'已签订', REJECTED:'已拒绝' }
+  const map = { DRAFT:'待分配', ASSIGNED:'待会签', COUNTERSIGNED:'待定稿', FINALIZED:'待审批', APPROVED:'待签订', SIGNED:'已签订', REJECTED:'已拒绝', CANCELLED:'已取消' }
   return map[s] || s
 }
 
@@ -140,7 +140,7 @@ async function doSign() {
 }
 
 async function doResubmit() {
-  if (!confirm('确认重新提交审批？系统将清除旧的审批任务。')) return
+  if (!confirm('确认重新提交审批？所有审批人都需要重新审批，旧审批意见将被清空。')) return
   try {
     await api.post(`/contracts/${route.params.id}/resubmit`)
     success.value = '已重新提交审批'
@@ -150,6 +150,17 @@ async function doResubmit() {
   }
 }
 
+async function doCancel() {
+  if (!confirm('确认取消该合同？取消后会关闭所有待办任务。')) return
+  try {
+    await api.post(`/contracts/${route.params.id}/cancel`)
+    success.value = '合同已取消'
+    await loadDetail()
+  } catch (err) {
+    error.value = err.message
+  }
+}
+
 async function handleUpload(e) {
   const file = e.target.files[0]
   if (!file) return
@@ -195,18 +206,28 @@ async function deleteAttachment(a) {
 }
 
 const assignableUsers = computed(() => users.value.filter(u => u.id !== contract.value?.drafterId))
-const pendingTask = (type) => tasks.value.some(t => t.taskType === type && t.taskStatus === 'PENDING' && t.assigneeId === auth.user?.id)
+const pendingTask = (type) => tasks.value.some(t => t.taskType === type && t.taskStatus === 'PENDING' && Number(t.assigneeId) === Number(auth.user?.id))
 const canAssignCurrent = computed(() => hasPermission('contract:assign') && contract.value?.status === 'DRAFT' && pendingTask('ASSIGN'))
 const canCountersignCurrent = computed(() => hasPermission('contract:countersign') && contract.value?.status === 'ASSIGNED' && pendingTask('COUNTERSIGN'))
 const canFinalizeCurrent = computed(() => hasPermission('contract:update') && contract.value?.status === 'COUNTERSIGNED' && pendingTask('FINALIZE'))
 const canApproveCurrent = computed(() => hasPermission('contract:approve') && contract.value?.status === 'FINALIZED' && pendingTask('APPROVAL'))
 const canSignCurrent = computed(() => hasPermission('contract:sign') && contract.value?.status === 'APPROVED' && pendingTask('SIGN'))
-const canResubmitCurrent = computed(() => hasPermission('contract:update') && contract.value?.status === 'REJECTED' && contract.value?.drafterId === auth.user?.id)
+const canResubmitCurrent = computed(() => hasPermission('contract:update') && contract.value?.status === 'REJECTED' && Number(contract.value?.drafterId) === Number(auth.user?.id))
+const canCancelCurrent = computed(() => hasPermission('contract:delete') && !['SIGNED', 'CANCELLED'].includes(contract.value?.status))
+const canModifyAttachments = computed(() => hasPermission('contract:update') && contract.value?.status !== 'CANCELLED')
 
 function userName(user) {
   return user.displayName || user.username
 }
 
+function selectedUsers(field) {
+  return assignableUsers.value.filter(u => assignForm[field].includes(u.id))
+}
+
+function selectedSignUser() {
+  return assignableUsers.value.find(u => u.id === assignForm.signUserId)
+}
+
 function toggleUser(field, userId) {
   const list = assignForm[field]
   const idx = list.indexOf(userId)
@@ -214,8 +235,10 @@ function toggleUser(field, userId) {
   else list.push(userId)
 }
 
-function isSelected(field, userId) {
-  return assignForm[field].includes(userId)
+function removeUser(field, userId) {
+  const list = assignForm[field]
+  const idx = list.indexOf(userId)
+  if (idx >= 0) list.splice(idx, 1)
 }
 
 onMounted(() => {
@@ -279,6 +302,9 @@ onMounted(() => {
           <button v-if="canApproveCurrent" @click="doApprove('REJECTED')">审批拒绝</button>
           <button v-if="canCountersignCurrent" @click="doCountersign">会签</button>
           <button v-if="canSignCurrent" @click="doSign">签订</button>
+          <button v-if="canCancelCurrent" @click="doCancel" style="color:#b42318">
+            <XCircle :size="14" /> 取消合同
+          </button>
         </div>
       </div>
 
@@ -304,7 +330,7 @@ onMounted(() => {
 
       <div v-if="activeTab === 'attachments'" class="tab-content">
         <div style="margin-bottom:14px">
-          <label v-if="hasPermission('contract:update')" class="secondary" style="display:inline-flex;cursor:pointer;min-height:38px;align-items:center;gap:8px;padding:0 14px;border-radius:6px;font-weight:700">
+          <label v-if="canModifyAttachments" class="secondary" style="display:inline-flex;cursor:pointer;min-height:38px;align-items:center;gap:8px;padding:0 14px;border-radius:6px;font-weight:700">
             <Upload :size="16" />
             {{ uploading ? '上传中...' : '选择文件' }}
             <input type="file" hidden accept=".doc,.docx,.jpg,.jpeg,.png,.bmp,.gif,.pdf" @change="handleUpload" :disabled="uploading" />
@@ -323,7 +349,7 @@ onMounted(() => {
               <td>{{ a.uploadedAt?.slice(0, 16) }}</td>
               <td class="row-actions">
                 <button @click="downloadAttachment(a)"><Download :size="14" /> 下载</button>
-                <button v-if="hasPermission('contract:update')" @click="deleteAttachment(a)"><Trash2 :size="14" /> 删除</button>
+                <button v-if="canModifyAttachments" @click="deleteAttachment(a)"><Trash2 :size="14" /> 删除</button>
               </td>
             </tr>
           </tbody>
@@ -337,18 +363,30 @@ onMounted(() => {
               <h3>会签人员</h3>
               <span class="muted">可多选，全部完成后进入定稿</span>
             </div>
-            <div class="people-grid">
-              <button
-                v-for="u in assignableUsers"
-                :key="'counter-' + u.id"
-                type="button"
-                class="person-option"
-                :class="{ selected: isSelected('countersignUserIds', u.id) }"
-                @click="toggleUser('countersignUserIds', u.id)"
-              >
-                <span>{{ userName(u) }}</span>
-                <small>{{ u.username }}</small>
-              </button>
+            <div class="tag-picker">
+              <div class="selected-tags">
+                <span v-if="selectedUsers('countersignUserIds').length === 0" class="tag-placeholder">请选择会签人员</span>
+                <button
+                  v-for="u in selectedUsers('countersignUserIds')"
+                  :key="'counter-tag-' + u.id"
+                  type="button"
+                  class="selected-tag"
+                  @click="removeUser('countersignUserIds', u.id)"
+                >
+                  {{ userName(u) }} <span aria-hidden="true">x</span>
+                </button>
+              </div>
+              <div class="checkbox-list">
+                <label v-for="u in assignableUsers" :key="'counter-' + u.id" class="check-option">
+                  <input
+                    type="checkbox"
+                    :checked="assignForm.countersignUserIds.includes(u.id)"
+                    @change="toggleUser('countersignUserIds', u.id)"
+                  />
+                  <span>{{ userName(u) }}</span>
+                  <small>{{ u.username }}</small>
+                </label>
+              </div>
             </div>
           </section>
 
@@ -357,18 +395,30 @@ onMounted(() => {
               <h3>审批人员</h3>
               <span class="muted">可多选，全部通过后进入签订</span>
             </div>
-            <div class="people-grid">
-              <button
-                v-for="u in assignableUsers"
-                :key="'approval-' + u.id"
-                type="button"
-                class="person-option"
-                :class="{ selected: isSelected('approvalUserIds', u.id) }"
-                @click="toggleUser('approvalUserIds', u.id)"
-              >
-                <span>{{ userName(u) }}</span>
-                <small>{{ u.username }}</small>
-              </button>
+            <div class="tag-picker">
+              <div class="selected-tags">
+                <span v-if="selectedUsers('approvalUserIds').length === 0" class="tag-placeholder">请选择审批人员</span>
+                <button
+                  v-for="u in selectedUsers('approvalUserIds')"
+                  :key="'approval-tag-' + u.id"
+                  type="button"
+                  class="selected-tag"
+                  @click="removeUser('approvalUserIds', u.id)"
+                >
+                  {{ userName(u) }} <span aria-hidden="true">x</span>
+                </button>
+              </div>
+              <div class="checkbox-list">
+                <label v-for="u in assignableUsers" :key="'approval-' + u.id" class="check-option">
+                  <input
+                    type="checkbox"
+                    :checked="assignForm.approvalUserIds.includes(u.id)"
+                    @change="toggleUser('approvalUserIds', u.id)"
+                  />
+                  <span>{{ userName(u) }}</span>
+                  <small>{{ u.username }}</small>
+                </label>
+              </div>
             </div>
           </section>
 
@@ -377,18 +427,25 @@ onMounted(() => {
               <h3>签订人员</h3>
               <span class="muted">单选</span>
             </div>
-            <div class="people-grid">
-              <button
-                v-for="u in assignableUsers"
-                :key="'sign-' + u.id"
-                type="button"
-                class="person-option"
-                :class="{ selected: assignForm.signUserId === u.id }"
-                @click="assignForm.signUserId = u.id"
-              >
-                <span>{{ userName(u) }}</span>
-                <small>{{ u.username }}</small>
-              </button>
+            <div class="tag-picker">
+              <div class="selected-tags">
+                <span v-if="!selectedSignUser()" class="tag-placeholder">请选择签订人员</span>
+                <button v-else type="button" class="selected-tag" @click="assignForm.signUserId = ''">
+                  {{ userName(selectedSignUser()) }} <span aria-hidden="true">x</span>
+                </button>
+              </div>
+              <div class="checkbox-list">
+                <label v-for="u in assignableUsers" :key="'sign-' + u.id" class="check-option">
+                  <input
+                    type="radio"
+                    name="signUser"
+                    :checked="assignForm.signUserId === u.id"
+                    @change="assignForm.signUserId = u.id"
+                  />
+                  <span>{{ userName(u) }}</span>
+                  <small>{{ u.username }}</small>
+                </label>
+              </div>
             </div>
           </section>
         </div>
diff --git a/frontend/src/views/RegisterView.vue b/frontend/src/views/RegisterView.vue
index 061ae5b..2d3b8a4 100644
--- a/frontend/src/views/RegisterView.vue
+++ b/frontend/src/views/RegisterView.vue
@@ -15,6 +15,10 @@ async function register() {
     error.value = '两次输入的密码不一致'
     return
   }
+  if (form.password.length < 6) {
+    error.value = '密码长度不能少于6位'
+    return
+  }
   loading.value = true
   try {
     await api.post('/auth/register', form)
@@ -51,14 +55,14 @@ async function register() {
           <span>密码</span>
           <div class="input">
             <LockKeyhole :size="18" />
-            <input v-model="form.password" type="password" autocomplete="new-password" required />
+            <input v-model="form.password" type="password" autocomplete="new-password" minlength="6" required />
           </div>
         </label>
         <label>
           <span>确认密码</span>
           <div class="input">
             <LockKeyhole :size="18" />
-            <input v-model="form.confirmPassword" type="password" required />
+            <input v-model="form.confirmPassword" type="password" minlength="6" required />
           </div>
         </label>
         <p v-if="error" class="error">{{ error }}</p>
diff --git a/frontend/src/views/system/PermissionManagementView.vue b/frontend/src/views/system/PermissionManagementView.vue
new file mode 100644
index 0000000..a12a838
--- /dev/null
+++ b/frontend/src/views/system/PermissionManagementView.vue
@@ -0,0 +1,157 @@
+<script setup>
+import { ref, reactive, computed, onMounted } from 'vue'
+import { Plus, Pencil, Trash2, Search, RefreshCcw } from 'lucide-vue-next'
+import { api } from '../../api'
+
+const corePermissions = new Set([
+  'contract:create',
+  'contract:update',
+  'contract:delete',
+  'contract:view',
+  'contract:query',
+  'contract:assign',
+  'contract:countersign',
+  'contract:approve',
+  'contract:sign',
+  'customer:manage',
+  'user:manage',
+  'role:manage',
+  'permission:manage',
+  'log:view'
+])
+
+const permissions = ref([])
+const keyword = ref('')
+const error = ref('')
+const showForm = ref(false)
+const editingId = ref(null)
+const form = reactive({ permissionCode: '', permissionName: '', module: '', url: '', description: '' })
+
+async function loadPermissions() {
+  error.value = ''
+  try {
+    const res = await api.get('/permissions')
+    permissions.value = res.data || []
+  } catch (err) {
+    error.value = err.message
+  }
+}
+
+const filteredPermissions = computed(() => {
+  const kw = keyword.value.trim().toLowerCase()
+  if (!kw) return permissions.value
+  return permissions.value.filter(p =>
+    p.permissionCode?.toLowerCase().includes(kw) ||
+    p.permissionName?.toLowerCase().includes(kw) ||
+    p.module?.toLowerCase().includes(kw)
+  )
+})
+
+function isCorePermission(permission) {
+  return corePermissions.has(permission.permissionCode)
+}
+
+function openCreate() {
+  editingId.value = null
+  Object.keys(form).forEach(k => form[k] = '')
+  showForm.value = true
+}
+
+function openEdit(permission) {
+  editingId.value = permission.id
+  form.permissionCode = permission.permissionCode
+  form.permissionName = permission.permissionName
+  form.module = permission.module
+  form.url = permission.url || ''
+  form.description = permission.description || ''
+  showForm.value = true
+}
+
+async function save() {
+  error.value = ''
+  if (!form.permissionCode || !form.permissionName || !form.module) {
+    error.value = '权限编码、权限名称和模块不能为空'
+    return
+  }
+  try {
+    if (editingId.value) {
+      await api.put(`/permissions/${editingId.value}`, form)
+    } else {
+      await api.post('/permissions', form)
+    }
+    showForm.value = false
+    await loadPermissions()
+  } catch (err) {
+    error.value = err.message
+  }
+}
+
+async function remove(permission) {
+  if (isCorePermission(permission)) return
+  if (!confirm(`确认删除权限「${permission.permissionName}」？`)) return
+  try {
+    await api.delete(`/permissions/${permission.id}`)
+    await loadPermissions()
+  } catch (err) {
+    error.value = err.message
+  }
+}
+
+onMounted(loadPermissions)
+</script>
+
+<template>
+  <div>
+    <div class="section-title">
+      <h2>权限管理</h2>
+      <div class="actions">
+        <div class="input" style="max-width:240px">
+          <Search :size="16" />
+          <input v-model="keyword" placeholder="搜索权限编码/名称/模块" />
+        </div>
+        <button class="secondary" @click="loadPermissions"><RefreshCcw :size="16" /></button>
+        <button class="primary" @click="openCreate"><Plus :size="16" /> 新增权限</button>
+      </div>
+    </div>
+
+    <p v-if="error" class="error">{{ error }}</p>
+
+    <div v-if="showForm" class="panel narrow" style="margin-bottom:18px">
+      <h2>{{ editingId ? '编辑权限' : '新增权限' }}</h2>
+      <div class="form-grid single" style="margin-top:14px">
+        <label>权限编码 *<input v-model="form.permissionCode" :disabled="!!editingId" placeholder="如 report:view" /></label>
+        <label>权限名称 *<input v-model="form.permissionName" placeholder="如 查看报表" /></label>
+        <label>模块 *<input v-model="form.module" placeholder="如 REPORT" /></label>
+        <label>URL<input v-model="form.url" placeholder="可选" /></label>
+        <label>描述<input v-model="form.description" placeholder="可选" /></label>
+      </div>
+      <div class="row-actions">
+        <button class="primary" @click="save">保存</button>
+        <button class="secondary" @click="showForm = false">取消</button>
+      </div>
+    </div>
+
+    <div class="panel">
+      <table>
+        <thead><tr><th>权限编码</th><th>名称</th><th>模块</th><th>描述</th><th>操作</th></tr></thead>
+        <tbody>
+          <tr v-for="p in filteredPermissions" :key="p.id">
+            <td><code>{{ p.permissionCode }}</code></td>
+            <td>{{ p.permissionName }}</td>
+            <td><span class="status">{{ p.module }}</span></td>
+            <td class="muted">{{ p.description || '-' }}</td>
+            <td class="row-actions">
+              <button @click="openEdit(p)"><Pencil :size="14" /> 编辑</button>
+              <button :disabled="isCorePermission(p)" @click="remove(p)">
+                <Trash2 :size="14" /> {{ isCorePermission(p) ? '核心权限' : '删除' }}
+              </button>
+            </td>
+          </tr>
+          <tr v-if="filteredPermissions.length === 0">
+            <td colspan="5" class="muted" style="text-align:center">暂无权限</td>
+          </tr>
+        </tbody>
+      </table>
+    </div>
+  </div>
+</template>
diff --git a/frontend/src/views/system/RoleManagementView.vue b/frontend/src/views/system/RoleManagementView.vue
index a077f55..a52baaa 100644
--- a/frontend/src/views/system/RoleManagementView.vue
+++ b/frontend/src/views/system/RoleManagementView.vue
@@ -1,5 +1,5 @@
 <script setup>
-import { ref, reactive, onMounted } from 'vue'
+import { ref, reactive, computed, onMounted } from 'vue'
 import { Plus, Pencil, Trash2, ShieldCheck } from 'lucide-vue-next'
 import { api } from '../../api'
 
@@ -14,6 +14,16 @@ const selectedPermIds = ref([])
 
 const form = reactive({ roleCode: '', roleName: '', description: '' })
 
+const groupedPermissions = computed(() => {
+  const groups = {}
+  for (const permission of permissions.value) {
+    const module = permission.module || 'OTHER'
+    if (!groups[module]) groups[module] = []
+    groups[module].push(permission)
+  }
+  return groups
+})
+
 async function loadRoles() {
   error.value = ''
   try {
@@ -89,6 +99,18 @@ function togglePerm(permId) {
   else selectedPermIds.value.push(permId)
 }
 
+function selectAllInModule(module) {
+  const ids = groupedPermissions.value[module]?.map(p => p.id) || []
+  ids.forEach(id => {
+    if (!selectedPermIds.value.includes(id)) selectedPermIds.value.push(id)
+  })
+}
+
+function deselectAllInModule(module) {
+  const ids = groupedPermissions.value[module]?.map(p => p.id) || []
+  selectedPermIds.value = selectedPermIds.value.filter(id => !ids.includes(id))
+}
+
 async function savePerms() {
   try {
     await api.put(`/roles/${permRoleId.value}/permissions`, { permissionIds: selectedPermIds.value })
@@ -127,12 +149,21 @@ onMounted(() => { loadRoles(); loadPermissions() })
     <div v-if="showPermForm" class="panel narrow" style="margin-bottom:18px">
       <h2>分配权限</h2>
       <div style="margin-top:14px">
-        <div v-for="p in permissions" :key="p.id" style="margin-bottom:8px">
-          <label style="display:flex;align-items:center;gap:8px;cursor:pointer;font-weight:400">
-            <input type="checkbox" :checked="selectedPermIds.includes(p.id)" @change="togglePerm(p.id)" />
-            <strong>{{ p.permissionName }}</strong>
-            <span class="muted">{{ p.permissionCode }} · {{ p.module }}</span>
-          </label>
+        <div v-for="(items, module) in groupedPermissions" :key="module" style="margin-bottom:16px;padding:12px;background:#f8fafc;border:1px solid #edf1f5;border-radius:6px">
+          <div style="display:flex;align-items:center;justify-content:space-between;gap:10px;margin-bottom:8px">
+            <strong>{{ module }}</strong>
+            <div class="row-actions">
+              <button class="secondary" style="min-height:28px;padding:0 10px;font-size:12px" @click="selectAllInModule(module)">全选</button>
+              <button class="secondary" style="min-height:28px;padding:0 10px;font-size:12px" @click="deselectAllInModule(module)">取消全选</button>
+            </div>
+          </div>
+          <div v-for="p in items" :key="p.id" style="margin-bottom:8px">
+            <label style="display:flex;align-items:center;gap:8px;cursor:pointer;font-weight:400">
+              <input type="checkbox" :checked="selectedPermIds.includes(p.id)" @change="togglePerm(p.id)" />
+              <strong>{{ p.permissionName }}</strong>
+              <span class="muted">{{ p.permissionCode }}</span>
+            </label>
+          </div>
         </div>
       </div>
       <div class="row-actions" style="margin-top:14px">
diff --git a/frontend/src/views/system/UserManagementView.vue b/frontend/src/views/system/UserManagementView.vue
index 4be5de7..b44ce7b 100644
--- a/frontend/src/views/system/UserManagementView.vue
+++ b/frontend/src/views/system/UserManagementView.vue
@@ -67,9 +67,11 @@ async function save() {
   }
   try {
     if (editingId.value) {
+      if (form.password && form.password.length < 6) { error.value = '密码长度不能少于6位'; return }
       await api.put(`/users/${editingId.value}`, form)
     } else {
       if (!form.password) { error.value = '密码不能为空'; return }
+      if (form.password.length < 6) { error.value = '密码长度不能少于6位'; return }
       await api.post('/users', form)
     }
     showForm.value = false
@@ -153,7 +155,7 @@ onMounted(() => { loadUsers(); loadRoles() })
       <h2>{{ editingId ? '编辑用户' : '新增用户' }}</h2>
       <div class="form-grid" style="margin-top:14px">
         <label>用户名 *<input v-model="form.username" :disabled="!!editingId" /></label>
-        <label>密码 {{ editingId ? '(留空不修改)' : '*' }}<input v-model="form.password" type="password" /></label>
+        <label>密码 {{ editingId ? '(留空不修改)' : '*' }}<input v-model="form.password" type="password" minlength="6" /></label>
         <label>显示名称<input v-model="form.displayName" /></label>
         <label>电话<input v-model="form.phone" /></label>
         <label>邮箱<input v-model="form.email" /></label>
diff --git a/scripts/smoke-pr2.ps1 b/scripts/smoke-pr2.ps1
new file mode 100644
index 0000000..bf4b17c
--- /dev/null
+++ b/scripts/smoke-pr2.ps1
@@ -0,0 +1,203 @@
+param(
+  [string]$BaseUrl = "http://127.0.0.1:8080/api/v1",
+  [string]$AdminUsername = "admin",
+  [string]$AdminPassword = "123456"
+)
+
+$ErrorActionPreference = "Stop"
+$script:Passed = 0
+$script:Failed = 0
+
+function Write-Step([string]$Message) {
+  Write-Host "[smoke] $Message"
+}
+
+function Assert-True([bool]$Condition, [string]$Message) {
+  if (-not $Condition) {
+    $script:Failed++
+    throw "ASSERT FAILED: $Message"
+  }
+  $script:Passed++
+  Write-Host "  OK - $Message"
+}
+
+function Invoke-Api {
+  param(
+    [ValidateSet("GET", "POST", "PUT", "PATCH", "DELETE")]
+    [string]$Method,
+    [string]$Path,
+    [object]$Body = $null,
+    [string]$Token = "",
+    [int]$ExpectedStatus = 200
+  )
+
+  $headers = @{}
+  if ($Token) {
+    $headers.Authorization = "Bearer $Token"
+  }
+
+  $params = @{
+    Method = $Method
+    Uri = "$BaseUrl$Path"
+    Headers = $headers
+    SkipHttpErrorCheck = $true
+  }
+  if ($null -ne $Body) {
+    $params.ContentType = "application/json; charset=utf-8"
+    $params.Body = ($Body | ConvertTo-Json -Depth 20)
+  }
+
+  $response = Invoke-WebRequest @params
+  $json = $null
+  if ($response.Content) {
+    $json = $response.Content | ConvertFrom-Json
+  }
+
+  Assert-True ($response.StatusCode -eq $ExpectedStatus) "$Method $Path returned HTTP $ExpectedStatus"
+  return $json
+}
+
+function Login([string]$Username, [string]$Password) {
+  $result = Invoke-Api POST "/auth/login" @{ username = $Username; password = $Password }
+  Assert-True ($result.code -eq 0) "login succeeds for $Username"
+  return $result.data.token
+}
+
+function New-SmokeUser([string]$Username, [long]$RoleId, [string]$Token) {
+  Invoke-Api POST "/users" @{
+    username = $Username
+    password = "123456"
+    displayName = $Username
+    roleId = $RoleId
+  } $Token | Out-Null
+  return Login $Username "123456"
+}
+
+function Get-Task([object[]]$Tasks, [string]$Type, [long]$AssigneeId) {
+  return @($Tasks | Where-Object {
+    $_.taskType -eq $Type -and [long]$_.assigneeId -eq $AssigneeId
+  })[0]
+}
+
+$suffix = [DateTimeOffset]::UtcNow.ToUnixTimeMilliseconds()
+
+Write-Step "Login as admin"
+$adminToken = Login $AdminUsername $AdminPassword
+
+Write-Step "Validate short password rejection"
+$shortPassword = Invoke-Api POST "/auth/register" @{
+  username = "smoke_short_$suffix"
+  password = "123"
+  confirmPassword = "123"
+} "" 400
+Assert-True ($shortPassword.code -eq 40000) "register rejects passwords shorter than 6 chars"
+
+Write-Step "Validate permission CRUD and delete guards"
+$permissions = Invoke-Api GET "/permissions" $null $adminToken
+$contractView = @($permissions.data | Where-Object { $_.permissionCode -eq "contract:view" })[0]
+Assert-True ($null -ne $contractView) "core permission contract:view exists"
+$coreDelete = Invoke-Api DELETE "/permissions/$($contractView.id)" $null $adminToken 409
+Assert-True ($coreDelete.code -eq 40900) "core permission cannot be deleted"
+
+$smokePermissionCode = "smoke:test:$suffix"
+$createdPermission = Invoke-Api POST "/permissions" @{
+  permissionCode = $smokePermissionCode
+  permissionName = "Smoke Test"
+  module = "SMOKE"
+  url = "/smoke"
+  description = "created by smoke-pr2.ps1"
+} $adminToken
+Assert-True ($createdPermission.data.permissionCode -eq $smokePermissionCode) "custom permission can be created"
+
+$updatedPermission = Invoke-Api PUT "/permissions/$($createdPermission.data.id)" @{
+  permissionCode = $smokePermissionCode
+  permissionName = "Smoke Test Updated"
+  module = "SMOKE"
+  url = "/smoke"
+  description = "updated by smoke-pr2.ps1"
+} $adminToken
+Assert-True ($updatedPermission.data.permissionName -eq "Smoke Test Updated") "custom permission can be updated without changing code"
+
+Invoke-Api DELETE "/permissions/$($createdPermission.data.id)" $null $adminToken | Out-Null
+
+Write-Step "Create workflow users"
+$roles = Invoke-Api GET "/roles" $null $adminToken
+$operatorRole = @($roles.data | Where-Object { $_.roleCode -eq "ROLE_OPERATOR" })[0]
+Assert-True ($null -ne $operatorRole) "ROLE_OPERATOR exists"
+
+$counterToken = New-SmokeUser "smoke_counter_$suffix" $operatorRole.id $adminToken
+$approve1Token = New-SmokeUser "smoke_approve1_$suffix" $operatorRole.id $adminToken
+$approve2Token = New-SmokeUser "smoke_approve2_$suffix" $operatorRole.id $adminToken
+$signToken = New-SmokeUser "smoke_sign_$suffix" $operatorRole.id $adminToken
+
+$counter = Invoke-Api GET "/auth/me" $null $counterToken
+$approve1 = Invoke-Api GET "/auth/me" $null $approve1Token
+$approve2 = Invoke-Api GET "/auth/me" $null $approve2Token
+$sign = Invoke-Api GET "/auth/me" $null $signToken
+
+Write-Step "Create and assign contract for resubmit test"
+$customer = Invoke-Api POST "/customers" @{
+  name = "Smoke Customer $suffix"
+  tel = "13800000000"
+  address = "Smoke Address"
+  fax = ""
+  postalCode = ""
+  bankName = ""
+  bankAccount = ""
+  remark = "smoke"
+} $adminToken
+
+$today = (Get-Date).ToString("yyyy-MM-dd")
+$tomorrow = (Get-Date).AddDays(1).ToString("yyyy-MM-dd")
+$contract = Invoke-Api POST "/contracts" @{
+  name = "Smoke Resubmit $suffix"
+  customerId = $customer.data.id
+  beginDate = $today
+  endDate = $tomorrow
+  content = "smoke contract"
+} $adminToken
+
+Invoke-Api POST "/contracts/$($contract.data.id)/assign" @{
+  countersignUserIds = @([long]$counter.data.id)
+  approvalUserIds = @([long]$approve1.data.id, [long]$approve2.data.id)
+  signUserId = [long]$sign.data.id
+} $adminToken | Out-Null
+
+Invoke-Api POST "/contracts/$($contract.data.id)/countersign" @{ opinion = "counter ok" } $counterToken | Out-Null
+Invoke-Api POST "/contracts/$($contract.data.id)/finalize" @{ content = "final content" } $adminToken | Out-Null
+Invoke-Api POST "/contracts/$($contract.data.id)/approve" @{ result = "APPROVED"; opinion = "approve1 ok" } $approve1Token | Out-Null
+Invoke-Api POST "/contracts/$($contract.data.id)/approve" @{ result = "REJECTED"; opinion = "approve2 reject" } $approve2Token | Out-Null
+
+$beforeResubmit = Invoke-Api GET "/contracts/$($contract.data.id)" $null $adminToken
+$approvalBefore = @($beforeResubmit.data.tasks | Where-Object { $_.taskType -eq "APPROVAL" })
+Assert-True (($approvalBefore | Where-Object { $_.taskStatus -eq "DONE" }).Count -eq 1) "one approval task is DONE before resubmit"
+Assert-True (($approvalBefore | Where-Object { $_.taskStatus -eq "REJECTED" }).Count -eq 1) "one approval task is REJECTED before resubmit"
+
+Invoke-Api POST "/contracts/$($contract.data.id)/resubmit" $null $adminToken | Out-Null
+$afterResubmit = Invoke-Api GET "/contracts/$($contract.data.id)" $null $adminToken
+$approvalAfter = @($afterResubmit.data.tasks | Where-Object { $_.taskType -eq "APPROVAL" })
+Assert-True (($approvalAfter | Where-Object { $_.taskStatus -eq "PENDING" }).Count -eq 2) "all approval tasks are PENDING after resubmit"
+Assert-True (($approvalAfter | Where-Object { $_.opinion -or $_.operatedAt }).Count -eq 0) "resubmit clears approval opinions and operatedAt"
+
+Write-Step "Create and cancel contract"
+$cancelContract = Invoke-Api POST "/contracts" @{
+  name = "Smoke Cancel $suffix"
+  customerId = $customer.data.id
+  beginDate = $today
+  endDate = $tomorrow
+  content = "cancel smoke contract"
+} $adminToken
+
+Invoke-Api POST "/contracts/$($cancelContract.data.id)/cancel" $null $adminToken | Out-Null
+$cancelDetail = Invoke-Api GET "/contracts/$($cancelContract.data.id)" $null $adminToken
+Assert-True ($cancelDetail.data.contract.status -eq "CANCELLED") "cancel endpoint sets contract status to CANCELLED"
+Assert-True (($cancelDetail.data.tasks | Where-Object { $_.taskStatus -eq "PENDING" }).Count -eq 0) "cancel endpoint closes pending tasks"
+
+$assignCancelled = Invoke-Api POST "/contracts/$($cancelContract.data.id)/assign" @{
+  countersignUserIds = @([long]$counter.data.id)
+  approvalUserIds = @([long]$approve1.data.id)
+  signUserId = [long]$sign.data.id
+} $adminToken 409
+Assert-True ($assignCancelled.code -eq 40900) "cancelled contract rejects further assignment"
+
+Write-Step "Smoke tests completed: $script:Passed passed, $script:Failed failed"