From bc168d08a9c359e1d2132ba0253cb2a002165b11 Mon Sep 17 00:00:00 2001
From: Wenjie Zhang <xerrors@163.com>
Date: Fri, 2 May 2025 23:56:59 +0800
Subject: [PATCH 01/10] =?UTF-8?q?=E5=9F=BA=E6=9C=AC=E6=9D=83=E9=99=90?=
 =?UTF-8?q?=E6=8E=A7=E5=88=B6=E5=8A=9F=E8=83=BD=E5=AE=9E=E7=8E=B0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pyproject.toml                               |   2 +
 requirements.txt                             |   3 +-
 server/db_manager.py                         |  10 +
 server/main.py                               | 102 +++++-
 server/models/user_model.py                  |  56 +++
 server/routers/__init__.py                   |   4 +-
 server/routers/admin_router.py               |  55 ++-
 server/routers/auth_router.py                | 347 +++++++++++++++++++
 server/routers/chat_router.py                |  98 ++++--
 server/routers/data_router.py                |  36 +-
 server/utils/__init__.py                     |   1 +
 server/utils/auth_middleware.py              | 120 +++++++
 server/utils/auth_utils.py                   |  75 ++++
 src/config/__init__.py                       |   2 +
 web/src/apis/admin_api.js                    | 314 +++++++++++++++++
 web/src/apis/auth_api.js                     | 106 ++++++
 web/src/apis/base.js                         | 142 ++++++++
 web/src/apis/index.js                        |  33 ++
 web/src/apis/public_api.js                   |  59 ++++
 web/src/components/AgentChatComponent.vue    |  29 +-
 web/src/components/ChatComponent.vue         |  44 ++-
 web/src/components/TokenManagerComponent.vue |  54 +--
 web/src/components/UserInfoComponent.vue     | 139 ++++++++
 web/src/layouts/AppLayout.vue                |  13 +-
 web/src/router/index.js                      | 140 +++++---
 web/src/stores/user.js                       | 232 +++++++++++++
 web/src/views/AgentSingleView.vue            | 210 +++++------
 web/src/views/AgentView.vue                  | 159 ++++++---
 web/src/views/DataBaseInfoView.vue           |  81 ++---
 web/src/views/DataBaseView.vue               |  43 +--
 web/src/views/GraphView.vue                  | 130 +++----
 web/src/views/HomeView.vue                   |  44 ++-
 web/src/views/LoginView.vue                  | 303 ++++++++++++++++
 web/src/views/SettingView.vue                | 339 +++++++++++++++++-
 34 files changed, 2994 insertions(+), 531 deletions(-)
 create mode 100644 server/models/user_model.py
 create mode 100644 server/routers/auth_router.py
 create mode 100644 server/utils/__init__.py
 create mode 100644 server/utils/auth_middleware.py
 create mode 100644 server/utils/auth_utils.py
 create mode 100644 web/src/apis/admin_api.js
 create mode 100644 web/src/apis/auth_api.js
 create mode 100644 web/src/apis/base.js
 create mode 100644 web/src/apis/index.js
 create mode 100644 web/src/apis/public_api.js
 create mode 100644 web/src/components/UserInfoComponent.vue
 create mode 100644 web/src/stores/user.js
 create mode 100644 web/src/views/LoginView.vue

diff --git a/pyproject.toml b/pyproject.toml
index 64cc709b1..7651724ae 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -19,9 +19,11 @@ dependencies = [
     "openai>=1.76.0",
     "opencv-python-headless>=4.11.0.86",
     "paddleocr>=2.10.0",
+    "pyjwt>=2.8.0",
     "pymilvus>=2.5.8",
     "pymupdf>=1.25.5",
     "python-dotenv>=1.1.0",
+    "python-jose[cryptography]>=3.4.0",
     "python-multipart>=0.0.20",
     "pyyaml>=6.0.2",
     "qianfan>=0.4.12.3",
diff --git a/requirements.txt b/requirements.txt
index 790c4f8ab..e0a7a1374 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -31,4 +31,5 @@ langchain
 langsmith
 langgraph
 langchain-openai
-langchain-community
\ No newline at end of file
+langchain-community
+PyJWT>=2.10.1
\ No newline at end of file
diff --git a/server/db_manager.py b/server/db_manager.py
index 0a05bcb91..6b526f2c0 100644
--- a/server/db_manager.py
+++ b/server/db_manager.py
@@ -6,6 +6,7 @@
 from sqlalchemy.ext.declarative import declarative_base
 
 from server.models.token_model import Base, AgentToken
+from server.models.user_model import User, OperationLog
 
 class DBManager:
     """数据库管理器"""
@@ -32,6 +33,15 @@ def create_tables(self):
         """创建数据库表"""
         Base.metadata.create_all(self.engine)
 
+    def check_first_run(self):
+        """检查是否首次运行"""
+        session = self.get_session()
+        try:
+            # 检查是否有任何用户存在
+            return session.query(User).count() == 0
+        finally:
+            session.close()
+
     def get_session(self):
         """获取数据库会话"""
         return self.Session()
diff --git a/server/main.py b/server/main.py
index 93277ccf1..5f383fc6e 100644
--- a/server/main.py
+++ b/server/main.py
@@ -1,8 +1,13 @@
 import uvicorn
 
-from fastapi import FastAPI
+from fastapi import FastAPI, Request, HTTPException, status, Depends
 from fastapi.middleware.cors import CORSMiddleware
+from fastapi.responses import JSONResponse
+from starlette.middleware.base import BaseHTTPMiddleware
+
 from server.routers import router
+from server.utils.auth_middleware import get_current_user, is_public_path, is_admin_path
+from server.models.user_model import User
 from src.utils.logging_config import logger
 
 
@@ -18,6 +23,101 @@
     allow_headers=["*"],
 )
 
+# 鉴权中间件
+class AuthMiddleware(BaseHTTPMiddleware):
+    async def dispatch(self, request: Request, call_next):
+        # 获取请求路径
+        path = request.url.path
+
+        # 检查是否为公开路径，公开路径无需身份验证
+        if is_public_path(path):
+            return await call_next(request)
+
+        # 注意：前端代理已经去掉了 /api 前缀，例如 /api/chat 变成了 /chat
+        # 判断是否需要验证的API请求，包括聊天、数据、工具等
+        is_api_path = (
+            path.startswith("/chat") or
+            path.startswith("/data") or
+            path.startswith("/admin") or
+            path.startswith("/auth") and not is_public_path(path)
+        )
+
+        if not is_api_path:
+            # 非API路径，可能是前端路由或静态资源
+            return await call_next(request)
+
+        # 提取Authorization头
+        auth_header = request.headers.get("Authorization")
+        if not auth_header or not auth_header.startswith("Bearer "):
+            return JSONResponse(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                content={"detail": "请先登录"},
+                headers={"WWW-Authenticate": "Bearer"}
+            )
+
+        # 获取token
+        token = auth_header.split("Bearer ")[1]
+
+        # 添加token到请求状态，后续路由可以直接使用
+        request.state.token = token
+
+        # 检查是否需要管理员权限
+        if is_admin_path(path):
+            # 尝试获取数据库会话
+            try:
+                from server.db_manager import db_manager
+                from server.utils.auth_utils import AuthUtils
+
+                db = db_manager.get_session()
+                try:
+                    # 验证token并获取用户信息
+                    payload = AuthUtils.verify_access_token(token)
+                    user_id = payload.get("sub")
+
+                    if not user_id:
+                        return JSONResponse(
+                            status_code=status.HTTP_401_UNAUTHORIZED,
+                            content={"detail": "无效的用户标识"},
+                            headers={"WWW-Authenticate": "Bearer"}
+                        )
+
+                    # 查询用户信息
+                    from server.models.user_model import User
+                    user = db.query(User).filter(User.id == user_id).first()
+
+                    if not user:
+                        return JSONResponse(
+                            status_code=status.HTTP_401_UNAUTHORIZED,
+                            content={"detail": "用户不存在"},
+                            headers={"WWW-Authenticate": "Bearer"}
+                        )
+
+                    # 检查管理员权限
+                    if user.role not in ["admin", "superadmin"]:
+                        return JSONResponse(
+                            status_code=status.HTTP_403_FORBIDDEN,
+                            content={"detail": "需要管理员权限"}
+                        )
+
+                    # 将用户信息添加到请求状态
+                    request.state.user = user
+
+                finally:
+                    db.close()
+
+            except Exception as e:
+                logger.error(f"验证管理员权限出错: {e}")
+                return JSONResponse(
+                    status_code=status.HTTP_401_UNAUTHORIZED,
+                    content={"detail": "验证用户权限出错"},
+                    headers={"WWW-Authenticate": "Bearer"}
+                )
+
+        # 继续处理请求
+        return await call_next(request)
+
+# 添加鉴权中间件
+app.add_middleware(AuthMiddleware)
 
 if __name__ == "__main__":
     uvicorn.run(app, host="0.0.0.0", port=5050, threads=10, workers=10, reload=True)
diff --git a/server/models/user_model.py b/server/models/user_model.py
new file mode 100644
index 000000000..fa0f4dfbe
--- /dev/null
+++ b/server/models/user_model.py
@@ -0,0 +1,56 @@
+from sqlalchemy import Column, Integer, String, DateTime, ForeignKey, Text
+from sqlalchemy.ext.declarative import declarative_base
+from sqlalchemy.sql import func
+from sqlalchemy.orm import relationship
+
+from server.models.token_model import Base
+
+class User(Base):
+    """用户模型"""
+    __tablename__ = 'users'
+
+    id = Column(Integer, primary_key=True, autoincrement=True)
+    username = Column(String, nullable=False, unique=True, index=True)
+    password_hash = Column(String, nullable=False)
+    role = Column(String, nullable=False, default='user')  # 角色: superadmin, admin, user
+    created_at = Column(DateTime, default=func.now())
+    last_login = Column(DateTime, nullable=True)
+
+    # 关联操作日志
+    operation_logs = relationship("OperationLog", back_populates="user")
+
+    def to_dict(self, include_password=False):
+        result = {
+            "id": self.id,
+            "username": self.username,
+            "role": self.role,
+            "created_at": self.created_at.isoformat() if self.created_at else None,
+            "last_login": self.last_login.isoformat() if self.last_login else None
+        }
+        if include_password:
+            result["password_hash"] = self.password_hash
+        return result
+
+class OperationLog(Base):
+    """操作日志模型"""
+    __tablename__ = 'operation_logs'
+
+    id = Column(Integer, primary_key=True, autoincrement=True)
+    user_id = Column(Integer, ForeignKey('users.id'), nullable=False)
+    operation = Column(String, nullable=False)
+    details = Column(Text, nullable=True)
+    ip_address = Column(String, nullable=True)
+    timestamp = Column(DateTime, default=func.now())
+
+    # 关联用户
+    user = relationship("User", back_populates="operation_logs")
+
+    def to_dict(self):
+        return {
+            "id": self.id,
+            "user_id": self.user_id,
+            "operation": self.operation,
+            "details": self.details,
+            "ip_address": self.ip_address,
+            "timestamp": self.timestamp.isoformat() if self.timestamp else None
+        }
\ No newline at end of file
diff --git a/server/routers/__init__.py b/server/routers/__init__.py
index 6878d9347..b11f92745 100644
--- a/server/routers/__init__.py
+++ b/server/routers/__init__.py
@@ -2,12 +2,12 @@
 from server.routers.chat_router import chat
 from server.routers.data_router import data
 from server.routers.base_router import base
-from server.routers.tool_router import tool
 from server.routers.admin_router import admin
+from server.routers.auth_router import auth
 
 router = APIRouter()
 router.include_router(base)
 router.include_router(chat)
 router.include_router(data)
-router.include_router(tool)
 router.include_router(admin)
+router.include_router(auth)
diff --git a/server/routers/admin_router.py b/server/routers/admin_router.py
index 9471b6bc3..1556e00eb 100644
--- a/server/routers/admin_router.py
+++ b/server/routers/admin_router.py
@@ -1,23 +1,18 @@
 import secrets
 import string
-from fastapi import APIRouter, Depends, HTTPException, Query
+from fastapi import APIRouter, Depends, HTTPException, Query, Request
 from pydantic import BaseModel
 from typing import List, Optional
 from sqlalchemy.orm import Session
 
 from server.db_manager import db_manager
 from server.models.token_model import AgentToken
+from server.models.user_model import User, OperationLog
+from server.utils.auth_middleware import get_db, get_current_user, get_admin_user, oauth2_scheme
+from server.routers.auth_router import log_operation
 
 admin = APIRouter(prefix="/admin", tags=["admin"])
 
-# 依赖项：获取数据库会话
-def get_db():
-    db = db_manager.get_session()
-    try:
-        yield db
-    finally:
-        db.close()
-
 # 请求和响应模型
 class TokenCreate(BaseModel):
     agent_id: str
@@ -42,9 +37,10 @@ def generate_token(length=32):
 @admin.get("/tokens", response_model=List[TokenResponse])
 async def get_agent_tokens(
     agent_id: Optional[str] = Query(None),
+    current_user: User = Depends(get_admin_user),
     db: Session = Depends(get_db)
 ):
-    """获取智能体的token列表"""
+    """获取智能体的token列表（需要管理员权限）"""
     query = db.query(AgentToken)
     if agent_id:
         query = query.filter(AgentToken.agent_id == agent_id)
@@ -54,9 +50,11 @@ async def get_agent_tokens(
 @admin.post("/tokens", response_model=TokenResponse)
 async def create_token(
     token_data: TokenCreate,
+    request: Request,
+    current_user: User = Depends(get_admin_user),
     db: Session = Depends(get_db)
 ):
-    """创建新的token"""
+    """创建新的token（需要管理员权限）"""
     # 生成随机token
     token_value = generate_token()
 
@@ -72,15 +70,38 @@ async def create_token(
     db.commit()
     db.refresh(new_token)
 
+    # 记录操作
+    log_operation(
+        db,
+        current_user.id,
+        "创建令牌",
+        f"为智能体 {token_data.agent_id} 创建访问令牌: {token_data.name}",
+        request
+    )
+
     return new_token.to_dict()
 
 @admin.delete("/tokens/{token_id}", response_model=dict)
-async def delete_token(token_id: int, db: Session = Depends(get_db)):
-    """删除token"""
+async def delete_token(
+    token_id: int,
+    request: Request,
+    current_user: User = Depends(get_admin_user),
+    db: Session = Depends(get_db)
+):
+    """删除token（需要管理员权限）"""
     token = db.query(AgentToken).filter(AgentToken.id == token_id).first()
     if not token:
         raise HTTPException(status_code=404, detail="Token not found")
 
+    # 记录操作信息
+    log_operation(
+        db,
+        current_user.id,
+        "删除令牌",
+        f"删除令牌ID: {token_id}, 智能体: {token.agent_id}, 名称: {token.name}",
+        request
+    )
+
     db.delete(token)
     db.commit()
 
@@ -89,15 +110,17 @@ async def delete_token(token_id: int, db: Session = Depends(get_db)):
 @admin.post("/verify_token")
 async def verify_agent_token(
     token_data: TokenVerify,
+    token: Optional[str] = Depends(oauth2_scheme),
     db: Session = Depends(get_db)
 ):
-    """验证智能体访问令牌"""
-    token = db.query(AgentToken).filter(
+    """验证智能体访问令牌（所有用户都可访问）"""
+    # 查找令牌
+    agent_token = db.query(AgentToken).filter(
         AgentToken.agent_id == token_data.agent_id,
         AgentToken.token == token_data.token
     ).first()
 
-    if not token:
+    if not agent_token:
         raise HTTPException(status_code=401, detail="Invalid token")
 
     return {"success": True, "message": "Token verified"}
\ No newline at end of file
diff --git a/server/routers/auth_router.py b/server/routers/auth_router.py
new file mode 100644
index 000000000..08654bf81
--- /dev/null
+++ b/server/routers/auth_router.py
@@ -0,0 +1,347 @@
+from fastapi import APIRouter, Depends, HTTPException, Request, status
+from fastapi.security import OAuth2PasswordRequestForm
+from pydantic import BaseModel
+from typing import List, Optional
+from sqlalchemy.orm import Session
+from datetime import datetime, timedelta
+
+from server.db_manager import db_manager
+from server.models.user_model import User, OperationLog
+from server.utils.auth_utils import AuthUtils
+from server.utils.auth_middleware import get_db, get_current_user, get_admin_user, get_superadmin_user, oauth2_scheme
+
+# 创建路由器
+auth = APIRouter(prefix="/auth", tags=["auth"])
+
+# 请求和响应模型
+class Token(BaseModel):
+    access_token: str
+    token_type: str
+    user_id: int
+    username: str
+    role: str
+
+class UserCreate(BaseModel):
+    username: str
+    password: str
+    role: str = "user"
+
+class UserUpdate(BaseModel):
+    username: Optional[str] = None
+    password: Optional[str] = None
+    role: Optional[str] = None
+
+class UserResponse(BaseModel):
+    id: int
+    username: str
+    role: str
+    created_at: str
+    last_login: Optional[str] = None
+
+class InitializeAdmin(BaseModel):
+    username: str
+    password: str
+
+# 记录操作日志
+def log_operation(db: Session, user_id: int, operation: str, details: str = None, request: Request = None):
+    ip_address = None
+    if request:
+        ip_address = request.client.host if request.client else None
+
+    log = OperationLog(
+        user_id=user_id,
+        operation=operation,
+        details=details,
+        ip_address=ip_address
+    )
+    db.add(log)
+    db.commit()
+
+# 路由：登录获取令牌
+@auth.post("/token", response_model=Token)
+async def login_for_access_token(
+    form_data: OAuth2PasswordRequestForm = Depends(),
+    db: Session = Depends(get_db)
+):
+    # 查找用户
+    user = db.query(User).filter(User.username == form_data.username).first()
+
+    # 验证用户存在且密码正确
+    if not user or not AuthUtils.verify_password(user.password_hash, form_data.password):
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="用户名或密码错误",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+
+    # 更新最后登录时间
+    user.last_login = datetime.now()
+    db.commit()
+
+    # 生成访问令牌
+    token_data = {"sub": str(user.id)}
+    access_token = AuthUtils.create_access_token(token_data)
+
+    # 记录登录操作
+    log_operation(db, user.id, "登录")
+
+    return {
+        "access_token": access_token,
+        "token_type": "bearer",
+        "user_id": user.id,
+        "username": user.username,
+        "role": user.role
+    }
+
+# 路由：校验是否需要初始化管理员
+@auth.get("/check-first-run")
+async def check_first_run():
+    is_first_run = db_manager.check_first_run()
+    return {"first_run": is_first_run}
+
+# 路由：初始化管理员账户
+@auth.post("/initialize", response_model=Token)
+async def initialize_admin(
+    admin_data: InitializeAdmin,
+    db: Session = Depends(get_db)
+):
+    # 检查是否是首次运行
+    if not db_manager.check_first_run():
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="系统已经初始化，无法再次创建初始管理员",
+        )
+
+    # 创建管理员账户
+    hashed_password = AuthUtils.hash_password(admin_data.password)
+
+    new_admin = User(
+        username=admin_data.username,
+        password_hash=hashed_password,
+        role="superadmin",
+        last_login=datetime.now()
+    )
+
+    db.add(new_admin)
+    db.commit()
+    db.refresh(new_admin)
+
+    # 生成访问令牌
+    token_data = {"sub": str(new_admin.id)}
+    access_token = AuthUtils.create_access_token(token_data)
+
+    # 记录操作
+    log_operation(db, new_admin.id, "系统初始化", "创建超级管理员账户")
+
+    return {
+        "access_token": access_token,
+        "token_type": "bearer",
+        "user_id": new_admin.id,
+        "username": new_admin.username,
+        "role": new_admin.role
+    }
+
+# 路由：获取当前用户信息
+@auth.get("/me", response_model=UserResponse)
+async def read_users_me(current_user: User = Depends(get_current_user)):
+    return current_user.to_dict()
+
+# 路由：创建新用户（管理员权限）
+@auth.post("/users", response_model=UserResponse)
+async def create_user(
+    user_data: UserCreate,
+    request: Request,
+    current_user: User = Depends(get_admin_user),
+    db: Session = Depends(get_db)
+):
+    # 检查用户名是否已存在
+    existing_user = db.query(User).filter(User.username == user_data.username).first()
+    if existing_user:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="用户名已存在",
+        )
+
+    # 创建新用户
+    hashed_password = AuthUtils.hash_password(user_data.password)
+
+    # 检查角色权限
+    # 超级管理员可以创建任何类型的用户
+    if user_data.role == "superadmin" and current_user.role != "superadmin":
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="只有超级管理员才能创建超级管理员账户",
+        )
+
+    # 管理员只能创建普通用户
+    if current_user.role == "admin" and user_data.role != "user":
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="管理员只能创建普通用户账户",
+        )
+
+    new_user = User(
+        username=user_data.username,
+        password_hash=hashed_password,
+        role=user_data.role
+    )
+
+    db.add(new_user)
+    db.commit()
+    db.refresh(new_user)
+
+    # 记录操作
+    log_operation(
+        db,
+        current_user.id,
+        "创建用户",
+        f"创建用户: {user_data.username}, 角色: {user_data.role}",
+        request
+    )
+
+    return new_user.to_dict()
+
+# 路由：获取所有用户（管理员权限）
+@auth.get("/users", response_model=List[UserResponse])
+async def read_users(
+    skip: int = 0,
+    limit: int = 100,
+    current_user: User = Depends(get_admin_user),
+    db: Session = Depends(get_db)
+):
+    users = db.query(User).offset(skip).limit(limit).all()
+    return [user.to_dict() for user in users]
+
+# 路由：获取特定用户信息（管理员权限）
+@auth.get("/users/{user_id}", response_model=UserResponse)
+async def read_user(
+    user_id: int,
+    current_user: User = Depends(get_admin_user),
+    db: Session = Depends(get_db)
+):
+    user = db.query(User).filter(User.id == user_id).first()
+    if user is None:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="用户不存在",
+        )
+    return user.to_dict()
+
+# 路由：更新用户信息（管理员权限）
+@auth.put("/users/{user_id}", response_model=UserResponse)
+async def update_user(
+    user_id: int,
+    user_data: UserUpdate,
+    request: Request,
+    current_user: User = Depends(get_admin_user),
+    db: Session = Depends(get_db)
+):
+    user = db.query(User).filter(User.id == user_id).first()
+    if user is None:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="用户不存在",
+        )
+
+    # 检查权限
+    if user.role == "superadmin" and current_user.role != "superadmin":
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="只有超级管理员才能修改超级管理员账户",
+        )
+
+    # 超级管理员账户不能被降级（只能由其他超级管理员修改）
+    if user.role == "superadmin" and user_data.role and user_data.role != "superadmin" and current_user.id != user.id:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="不能降级超级管理员账户",
+        )
+
+    # 更新信息
+    update_details = []
+
+    if user_data.username is not None:
+        # 检查用户名是否已被其他用户使用
+        existing_user = db.query(User).filter(User.username == user_data.username, User.id != user_id).first()
+        if existing_user:
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail="用户名已存在",
+            )
+        user.username = user_data.username
+        update_details.append(f"用户名: {user_data.username}")
+
+    if user_data.password is not None:
+        user.password_hash = AuthUtils.hash_password(user_data.password)
+        update_details.append("密码已更新")
+
+    if user_data.role is not None:
+        user.role = user_data.role
+        update_details.append(f"角色: {user_data.role}")
+
+    db.commit()
+
+    # 记录操作
+    log_operation(
+        db,
+        current_user.id,
+        "更新用户",
+        f"更新用户ID {user_id}: {', '.join(update_details)}",
+        request
+    )
+
+    return user.to_dict()
+
+# 路由：删除用户（管理员权限）
+@auth.delete("/users/{user_id}", response_model=dict)
+async def delete_user(
+    user_id: int,
+    request: Request,
+    current_user: User = Depends(get_admin_user),
+    db: Session = Depends(get_db)
+):
+    user = db.query(User).filter(User.id == user_id).first()
+    if user is None:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="用户不存在",
+        )
+
+    # 检查权限
+    if user.role == "superadmin":
+        # 只有超级管理员可以删除超级管理员
+        if current_user.role != "superadmin":
+            raise HTTPException(
+                status_code=status.HTTP_403_FORBIDDEN,
+                detail="只有超级管理员才能删除超级管理员账户",
+            )
+
+        # 检查是否是最后一个超级管理员
+        superadmin_count = db.query(User).filter(User.role == "superadmin").count()
+        if superadmin_count <= 1:
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail="不能删除最后一个超级管理员账户",
+            )
+
+    # 不能删除自己的账户
+    if user.id == current_user.id:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="不能删除自己的账户",
+        )
+
+    # 记录操作
+    log_operation(
+        db,
+        current_user.id,
+        "删除用户",
+        f"删除用户: {user.username}, ID: {user.id}, 角色: {user.role}",
+        request
+    )
+
+    # 删除用户
+    db.delete(user)
+    db.commit()
+
+    return {"success": True, "message": "用户已删除"}
\ No newline at end of file
diff --git a/server/routers/chat_router.py b/server/routers/chat_router.py
index 9c5fb82d3..8fe2fb23f 100644
--- a/server/routers/chat_router.py
+++ b/server/routers/chat_router.py
@@ -13,11 +13,54 @@
 from src.models import select_model
 from src.utils.logging_config import logger
 from src.agents.tools_factory import get_all_tools
+from server.routers.auth_router import get_admin_user
+from server.utils.auth_middleware import get_required_user
+from server.models.user_model import User
 
 chat = APIRouter(prefix="/chat")
 
+@chat.get("/default_agent")
+async def get_default_agent(current_user: User = Depends(get_required_user)):
+    """获取默认智能体ID（需要登录）"""
+    try:
+        default_agent_id = config.default_agent_id
+        # 如果没有设置默认智能体，尝试获取第一个可用的智能体
+        if not default_agent_id:
+            agents = [agent.get_info() for agent in agent_manager.agents.values()]
+            if agents:
+                default_agent_id = agents[0].get("name", "")
+
+        return {"default_agent_id": default_agent_id}
+    except Exception as e:
+        logger.error(f"获取默认智能体出错: {e}")
+        raise HTTPException(status_code=500, detail=f"获取默认智能体出错: {str(e)}")
+
+@chat.post("/set_default_agent")
+async def set_default_agent(agent_id: str = Body(..., embed=True), current_user = Depends(get_admin_user)):
+    """设置默认智能体ID (仅管理员)"""
+    try:
+        # 验证智能体是否存在
+        agents = [agent.get_info() for agent in agent_manager.agents.values()]
+        agent_ids = [agent.get("name", "") for agent in agents]
+
+        if agent_id not in agent_ids:
+            raise HTTPException(status_code=404, detail=f"智能体 {agent_id} 不存在")
+
+        # 设置默认智能体ID
+        config.default_agent_id = agent_id
+        # 保存配置
+        config.save()
+
+        return {"success": True, "default_agent_id": agent_id}
+    except HTTPException as he:
+        raise he
+    except Exception as e:
+        logger.error(f"设置默认智能体出错: {e}")
+        raise HTTPException(status_code=500, detail=f"设置默认智能体出错: {str(e)}")
+
 @chat.get("/")
-async def chat_get():
+async def chat_get(current_user: User = Depends(get_required_user)):
+    """聊天服务健康检查（需要登录）"""
     return "Chat Get!"
 
 @chat.post("/")
@@ -25,29 +68,9 @@ async def chat_post(
         query: str = Body(...),
         meta: dict = Body(None),
         history: list[dict] | None = Body(None),
-        thread_id: str | None = Body(None)):
-    """处理聊天请求的主要端点。
-    Args:
-        query: 用户的输入查询文本
-        meta: 包含请求元数据的字典，可以包含以下字段：
-            - use_web: 是否使用网络搜索
-            - use_graph: 是否使用知识图谱
-            - db_id: 数据库ID
-            - history_round: 历史对话轮数限制
-            - system_prompt: 系统提示词（str，不含变量）
-        history: 对话历史记录列表
-        thread_id: 对话线程ID
-    Returns:
-        StreamingResponse: 返回一个流式响应，包含以下状态：
-            - searching: 正在搜索知识库
-            - generating: 正在生成回答
-            - reasoning: 正在推理
-            - loading: 正在加载回答
-            - finished: 回答完成
-            - error: 发生错误
-    Raises:
-        HTTPException: 当检索器或模型发生错误时抛出
-    """
+        thread_id: str | None = Body(None),
+        current_user: User = Depends(get_required_user)):
+    """处理聊天请求的主要端点（需要登录）"""
 
     model = select_model()
     meta["server_model_name"] = model.model_name
@@ -117,7 +140,8 @@ def generate_response():
     return StreamingResponse(generate_response(), media_type='application/json')
 
 @chat.post("/call")
-async def call(query: str = Body(...), meta: dict = Body(None)):
+async def call(query: str = Body(...), meta: dict = Body(None), current_user: User = Depends(get_required_user)):
+    """调用模型进行简单问答（需要登录）"""
     meta = meta or {}
     model = select_model(model_provider=meta.get("model_provider"), model_name=meta.get("model_name"))
     async def predict_async(query):
@@ -130,7 +154,8 @@ async def predict_async(query):
     return {"response": response.content}
 
 @chat.post("/call_lite")
-async def call_lite(query: str = Body(...), meta: dict = Body(None)):
+async def call_lite(query: str = Body(...), meta: dict = Body(None), current_user: User = Depends(get_required_user)):
+    """使用轻量版模型进行问答（需要登录）"""
     meta = meta or {}
     async def predict_async(query):
         loop = asyncio.get_event_loop()
@@ -145,7 +170,8 @@ async def predict_async(query):
     return {"response": response.content}
 
 @chat.get("/agent")
-async def get_agent():
+async def get_agent(current_user: User = Depends(get_required_user)):
+    """获取所有可用智能体（需要登录）"""
     agents = [agent.get_info() for agent in agent_manager.agents.values()]
     return {"agents": agents}
 
@@ -154,12 +180,14 @@ def chat_agent(agent_name: str,
                query: str = Body(...),
                history: list = Body(...),
                config: dict = Body({}),
-               meta: dict = Body({})):
+               meta: dict = Body({}),
+               current_user: User = Depends(get_required_user)):
+    """使用特定智能体进行对话（需要登录）"""
 
     meta.update({
         "query": query,
         "agent_name": agent_name,
-        "server_model_name": config.get("model", agent_name) ,
+        "server_model_name": config.get("model", agent_name),
         "thread_id": config.get("thread_id"),
     })
 
@@ -223,19 +251,19 @@ def stream_messages():
     return StreamingResponse(stream_messages(), media_type='application/json')
 
 @chat.get("/models")
-async def get_chat_models(model_provider: str):
-    """获取指定模型提供商的模型列表"""
+async def get_chat_models(model_provider: str, current_user: User = Depends(get_admin_user)):
+    """获取指定模型提供商的模型列表（需要登录）"""
     model = select_model(model_provider=model_provider)
     return {"models": model.get_models()}
 
 @chat.post("/models/update")
-async def update_chat_models(model_provider: str, model_names: list[str]):
-    """更新指定模型提供商的模型列表"""
+async def update_chat_models(model_provider: str, model_names: list[str], current_user = Depends(get_admin_user)):
+    """更新指定模型提供商的模型列表 (仅管理员)"""
     config.model_names[model_provider]["models"] = model_names
     config._save_models_to_file()
     return {"models": config.model_names[model_provider]["models"]}
 
 @chat.get("/tools")
-async def get_tools():
-    """获取所有工具"""
+async def get_tools(current_user: User = Depends(get_admin_user)):
+    """获取所有可用工具（需要登录）"""
     return {"tools": list(get_all_tools().keys())}
diff --git a/server/routers/data_router.py b/server/routers/data_router.py
index 699ed9681..3b5534080 100644
--- a/server/routers/data_router.py
+++ b/server/routers/data_router.py
@@ -6,12 +6,14 @@
 
 from src.utils import logger, hashstr
 from src import executor, retriever, config, knowledge_base, graph_base
+from server.utils.auth_middleware import get_admin_user
+from server.models.user_model import User
 
 data = APIRouter(prefix="/data")
 
 
 @data.get("/")
-async def get_databases():
+async def get_databases(current_user: User = Depends(get_admin_user)):
     try:
         database = knowledge_base.get_databases()
     except Exception as e:
@@ -23,7 +25,8 @@ async def get_databases():
 async def create_database(
     database_name: str = Body(...),
     description: str = Body(...),
-    dimension: Optional[int] = Body(None)
+    dimension: Optional[int] = Body(None),
+    current_user: User = Depends(get_admin_user)
 ):
     logger.debug(f"Create database {database_name}")
     try:
@@ -38,25 +41,25 @@ async def create_database(
     return database_info
 
 @data.delete("/")
-async def delete_database(db_id):
+async def delete_database(db_id, current_user: User = Depends(get_admin_user)):
     logger.debug(f"Delete database {db_id}")
     knowledge_base.delete_database(db_id)
     return {"message": "删除成功"}
 
 @data.post("/query-test")
-async def query_test(query: str = Body(...), meta: dict = Body(...)):
+async def query_test(query: str = Body(...), meta: dict = Body(...), current_user: User = Depends(get_admin_user)):
     logger.debug(f"Query test in {meta}: {query}")
     result = retriever.query_knowledgebase(query, history=None, refs={"meta": meta})
     return result
 
 @data.post("/file-to-chunk")
-async def file_to_chunk(files: List[str] = Body(...), params: dict = Body(...)):
+async def file_to_chunk(files: List[str] = Body(...), params: dict = Body(...), current_user: User = Depends(get_admin_user)):
     logger.debug(f"File to chunk: {files}")
     result = knowledge_base.file_to_chunk(files, params=params)
     return result
 
 @data.post("/add-by-file")
-async def create_document_by_file(db_id: str = Body(...), files: List[str] = Body(...)):
+async def create_document_by_file(db_id: str = Body(...), files: List[str] = Body(...), current_user: User = Depends(get_admin_user)):
     logger.debug(f"Add document in {db_id} by file: {files}")
     try:
         # 使用线程池执行耗时操作
@@ -71,7 +74,7 @@ async def create_document_by_file(db_id: str = Body(...), files: List[str] = Bod
         return {"message": f"添加文件失败: {e}", "status": "failed"}
 
 @data.post("/add-by-chunks")
-async def add_by_chunks(db_id: str = Body(...), file_chunks: dict = Body(...)):
+async def add_by_chunks(db_id: str = Body(...), file_chunks: dict = Body(...), current_user: User = Depends(get_admin_user)):
     # logger.debug(f"Add chunks in {db_id}: {len(file_chunks)} chunks")
     try:
         loop = asyncio.get_event_loop()
@@ -85,7 +88,7 @@ async def add_by_chunks(db_id: str = Body(...), file_chunks: dict = Body(...)):
         return {"message": f"添加分块失败: {e}", "status": "failed"}
 
 @data.get("/info")
-async def get_database_info(db_id: str):
+async def get_database_info(db_id: str, current_user: User = Depends(get_admin_user)):
     # logger.debug(f"Get database {db_id} info")
     database = knowledge_base.get_database_info(db_id)
     if database is None:
@@ -93,13 +96,13 @@ async def get_database_info(db_id: str):
     return database
 
 @data.delete("/document")
-async def delete_document(db_id: str = Body(...), file_id: str = Body(...)):
+async def delete_document(db_id: str = Body(...), file_id: str = Body(...), current_user: User = Depends(get_admin_user)):
     logger.debug(f"DELETE document {file_id} info in {db_id}")
     knowledge_base.delete_file(db_id, file_id)
     return {"message": "删除成功"}
 
 @data.get("/document")
-async def get_document_info(db_id: str, file_id: str):
+async def get_document_info(db_id: str, file_id: str, current_user: User = Depends(get_admin_user)):
     logger.debug(f"GET document {file_id} info in {db_id}")
 
     try:
@@ -113,7 +116,8 @@ async def get_document_info(db_id: str, file_id: str):
 @data.post("/upload")
 async def upload_file(
     file: UploadFile = File(...),
-    db_id: Optional[str] = Query(None)
+    db_id: Optional[str] = Query(None),
+    current_user: User = Depends(get_admin_user)
 ):
     if not file.filename:
         raise HTTPException(status_code=400, detail="No selected file")
@@ -135,14 +139,14 @@ async def upload_file(
     return {"message": "File successfully uploaded", "file_path": file_path, "db_id": db_id}
 
 @data.get("/graph")
-async def get_graph_info():
+async def get_graph_info(current_user: User = Depends(get_admin_user)):
     graph_info = graph_base.get_graph_info()
     if graph_info is None:
         raise HTTPException(status_code=400, detail="图数据库获取出错")
     return graph_info
 
 @data.post("/graph/index-nodes")
-async def index_nodes(data: dict = Body(default={})):
+async def index_nodes(data: dict = Body(default={}), current_user: User = Depends(get_admin_user)):
     if not graph_base.is_running():
         raise HTTPException(status_code=400, detail="图数据库未启动")
 
@@ -155,12 +159,12 @@ async def index_nodes(data: dict = Body(default={})):
     return {"status": "success", "message": f"已成功为{count}个节点添加嵌入向量", "indexed_count": count}
 
 @data.get("/graph/node")
-async def get_graph_node(entity_name: str):
+async def get_graph_node(entity_name: str, current_user: User = Depends(get_admin_user)):
     result = graph_base.query_node(entity_name=entity_name)
     return {"result": graph_base.format_query_result_to_graph(result), "message": "success"}
 
 @data.get("/graph/nodes")
-async def get_graph_nodes(kgdb_name: str, num: int):
+async def get_graph_nodes(kgdb_name: str, num: int, current_user: User = Depends(get_admin_user)):
     if not config.enable_knowledge_graph:
         raise HTTPException(status_code=400, detail="Knowledge graph is not enabled")
 
@@ -169,7 +173,7 @@ async def get_graph_nodes(kgdb_name: str, num: int):
     return {"result": graph_base.format_general_results(result), "message": "success"}
 
 @data.post("/graph/add-by-jsonl")
-async def add_graph_entity(file_path: str = Body(...), kgdb_name: Optional[str] = Body(None)):
+async def add_graph_entity(file_path: str = Body(...), kgdb_name: Optional[str] = Body(None), current_user: User = Depends(get_admin_user)):
     if not config.enable_knowledge_graph:
         return {"message": "知识图谱未启用", "status": "failed"}
 
diff --git a/server/utils/__init__.py b/server/utils/__init__.py
new file mode 100644
index 000000000..4901b7189
--- /dev/null
+++ b/server/utils/__init__.py
@@ -0,0 +1 @@
+# utils包初始化文件 
\ No newline at end of file
diff --git a/server/utils/auth_middleware.py b/server/utils/auth_middleware.py
new file mode 100644
index 000000000..692f872fb
--- /dev/null
+++ b/server/utils/auth_middleware.py
@@ -0,0 +1,120 @@
+from typing import Optional, List
+from fastapi import Depends, HTTPException, status
+from fastapi.security import OAuth2PasswordBearer
+from sqlalchemy.orm import Session
+from jose import JWTError, jwt
+import re
+
+from server.db_manager import db_manager
+from server.models.user_model import User
+from server.utils.auth_utils import AuthUtils
+
+# 定义OAuth2密码承载器，指定token URL
+oauth2_scheme = OAuth2PasswordBearer(tokenUrl="/api/auth/token", auto_error=False)
+
+# 公开路径列表，无需登录即可访问
+PUBLIC_PATHS = [
+    r"^/auth/token$",            # 登录
+    r"^/auth/check-first-run$",  # 检查是否首次运行
+    r"^/auth/initialize$",       # 初始化系统
+    r"^/docs$", r"^/redoc$", r"^/openapi.json$",  # API文档
+    r"^/static/.*$",                # 静态资源
+    r"^/assets/.*$",                # 前端资源文件
+    r"^/$",                         # 根路径（登录页）
+    r"^/login$",                    # 登录页面
+    r"^/home$",                     # 首页
+    r"^/home/.*$",                  # 首页下的所有路径
+    r"^/favicon\.ico$",             # 网站图标
+    r"^/_nuxt/.*$",                 # Nuxt.js生成的资源文件
+    r"^/js/.*$",                    # JavaScript文件
+    r"^/css/.*$",                   # CSS文件
+    r"^/img/.*$"                    # 图片文件
+]
+
+# 获取数据库会话
+def get_db():
+    db = db_manager.get_session()
+    try:
+        yield db
+    finally:
+        db.close()
+
+# 获取当前用户
+async def get_current_user(token: Optional[str] = Depends(oauth2_scheme), db: Session = Depends(get_db)):
+    credentials_exception = HTTPException(
+        status_code=status.HTTP_401_UNAUTHORIZED,
+        detail="无效的凭证",
+        headers={"WWW-Authenticate": "Bearer"},
+    )
+
+    # 允许无token访问公开路径
+    if token is None:
+        return None
+
+    try:
+        # 验证token
+        payload = AuthUtils.verify_access_token(token)
+        user_id = payload.get("sub")
+        if user_id is None:
+            raise credentials_exception
+    except JWTError:
+        raise credentials_exception
+
+    # 查找用户
+    user = db.query(User).filter(User.id == user_id).first()
+    if user is None:
+        raise credentials_exception
+
+    return user
+
+# 获取已登录用户（抛出401如果未登录）
+async def get_required_user(user: Optional[User] = Depends(get_current_user)):
+    if user is None:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="请登录后再访问",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+    return user
+
+# 获取管理员用户
+async def get_admin_user(current_user: User = Depends(get_required_user)):
+    if current_user.role not in ["admin", "superadmin"]:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="需要管理员权限",
+        )
+    return current_user
+
+# 获取超级管理员用户
+async def get_superadmin_user(current_user: User = Depends(get_required_user)):
+    if current_user.role != "superadmin":
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="需要超级管理员权限",
+        )
+    return current_user
+
+# 检查路径是否为公开路径
+def is_public_path(path: str) -> bool:
+    path = path.rstrip('/')  # 去除尾部斜杠以便于匹配
+    for pattern in PUBLIC_PATHS:
+        if re.match(pattern, path):
+            return True
+    return False
+
+# 路径是否需要管理员权限
+ADMIN_PATHS = [
+    r"^/admin/.*$",              # 管理员接口
+    r"^/data/.*$",               # 数据操作接口，所有数据操作都需要管理员权限
+    r"^/chat/set_default_agent$", # 设置默认智能体
+    r"^/chat/models/update$"      # 更新模型列表
+]
+
+# 检查路径是否需要管理员权限
+def is_admin_path(path: str) -> bool:
+    path = path.rstrip('/')  # 去除尾部斜杠以便于匹配
+    for pattern in ADMIN_PATHS:
+        if re.match(pattern, path):
+            return True
+    return False
\ No newline at end of file
diff --git a/server/utils/auth_utils.py b/server/utils/auth_utils.py
new file mode 100644
index 000000000..18ce903a3
--- /dev/null
+++ b/server/utils/auth_utils.py
@@ -0,0 +1,75 @@
+import hashlib
+import os
+import jwt
+from datetime import datetime, timedelta
+from typing import Optional, Dict, Any
+
+# JWT配置
+JWT_SECRET_KEY = os.environ.get("JWT_SECRET_KEY", "yuxi_know_secure_key")
+JWT_ALGORITHM = "HS256"
+JWT_EXPIRATION = 24 * 60 * 60  # 24小时过期
+
+class AuthUtils:
+    """认证工具类"""
+
+    @staticmethod
+    def hash_password(password: str) -> str:
+        """使用SHA-256哈希密码"""
+        # 生成盐
+        salt = os.urandom(32).hex()
+        # 哈希密码
+        hashed = hashlib.sha256((password + salt).encode()).hexdigest()
+        # 返回格式: "哈希值:盐"
+        return f"{hashed}:{salt}"
+
+    @staticmethod
+    def verify_password(stored_password: str, provided_password: str) -> bool:
+        """验证密码"""
+        # 分离哈希值和盐
+        if ":" not in stored_password:
+            return False
+
+        hashed, salt = stored_password.split(":")
+
+        # 使用相同的盐哈希提供的密码
+        check_hash = hashlib.sha256((provided_password + salt).encode()).hexdigest()
+
+        # 比较哈希值
+        return hashed == check_hash
+
+    @staticmethod
+    def create_access_token(data: Dict[str, Any], expires_delta: Optional[timedelta] = None) -> str:
+        """创建JWT访问令牌"""
+        to_encode = data.copy()
+
+        # 设置过期时间
+        if expires_delta:
+            expire = datetime.utcnow() + expires_delta
+        else:
+            expire = datetime.utcnow() + timedelta(seconds=JWT_EXPIRATION)
+
+        to_encode.update({"exp": expire})
+
+        # 编码JWT
+        encoded_jwt = jwt.encode(to_encode, JWT_SECRET_KEY, algorithm=JWT_ALGORITHM)
+        return encoded_jwt
+
+    @staticmethod
+    def decode_token(token: str) -> Optional[Dict[str, Any]]:
+        """解码验证JWT令牌"""
+        try:
+            payload = jwt.decode(token, JWT_SECRET_KEY, algorithms=[JWT_ALGORITHM])
+            return payload
+        except jwt.PyJWTError:
+            return None
+
+    @staticmethod
+    def verify_access_token(token: str) -> Dict[str, Any]:
+        """验证访问令牌，如果无效则抛出异常"""
+        try:
+            payload = jwt.decode(token, JWT_SECRET_KEY, algorithms=[JWT_ALGORITHM])
+            return payload
+        except jwt.ExpiredSignatureError:
+            raise ValueError("令牌已过期")
+        except jwt.InvalidTokenError:
+            raise ValueError("无效的令牌")
\ No newline at end of file
diff --git a/src/config/__init__.py b/src/config/__init__.py
index b0df13178..99969c385 100644
--- a/src/config/__init__.py
+++ b/src/config/__init__.py
@@ -47,6 +47,8 @@ def __init__(self):
         self.add_item("enable_knowledge_base", default=False, des="是否开启知识库")
         self.add_item("enable_knowledge_graph", default=False, des="是否开启知识图谱")
         self.add_item("enable_web_search", default=False, des="是否开启网页搜索（注：现阶段会根据 TAVILY_API_KEY 自动开启，无法手动配置，将会在下个版本移除此配置项）")
+        # 默认智能体配置
+        self.add_item("default_agent_id", default="", des="默认智能体ID")
         # 模型配置
         ## 注意这里是模型名，而不是具体的模型路径，默认使用 HuggingFace 的路径
         ## 如果需要自定义本地模型路径，则在 src/.env 中配置 MODEL_DIR
diff --git a/web/src/apis/admin_api.js b/web/src/apis/admin_api.js
new file mode 100644
index 000000000..5b4177cea
--- /dev/null
+++ b/web/src/apis/admin_api.js
@@ -0,0 +1,314 @@
+import { apiGet, apiPost, apiPut, apiDelete } from './base'
+import { useUserStore } from '@/stores/user'
+
+/**
+ * 管理员API模块
+ * 只有管理员和超级管理员可以访问的API
+ * 权限要求: admin 或 superadmin
+ * 
+ * 注意: 请确保在使用这些API之前检查用户是否具有管理员权限
+ */
+
+// 检查当前用户是否有管理员权限
+const checkAdminPermission = () => {
+  const userStore = useUserStore()
+  if (!userStore.isAdmin) {
+    throw new Error('需要管理员权限')
+  }
+  return true
+}
+
+// 检查当前用户是否有超级管理员权限
+const checkSuperAdminPermission = () => {
+  const userStore = useUserStore()
+  if (!userStore.isSuperAdmin) {
+    throw new Error('需要超级管理员权限')
+  }
+  return true
+}
+
+// 用户管理API
+export const userManagementApi = {
+  /**
+   * 获取用户列表
+   * @returns {Promise} - 用户列表
+   */
+  getUsers: async () => {
+    checkAdminPermission()
+    return apiGet('/api/auth/users', {}, true)
+  },
+
+  /**
+   * 创建新用户
+   * @param {Object} userData - 用户数据
+   * @returns {Promise} - 创建结果
+   */
+  createUser: async (userData) => {
+    checkAdminPermission()
+    return apiPost('/api/auth/users', userData, {}, true)
+  },
+
+  /**
+   * 更新用户
+   * @param {number} userId - 用户ID 
+   * @param {Object} userData - 用户数据
+   * @returns {Promise} - 更新结果
+   */
+  updateUser: async (userId, userData) => {
+    checkAdminPermission()
+    return apiPut(`/api/auth/users/${userId}`, userData, {}, true)
+  },
+
+  /**
+   * 删除用户
+   * @param {number} userId - 用户ID
+   * @returns {Promise} - 删除结果
+   */
+  deleteUser: async (userId) => {
+    checkAdminPermission()
+    return apiDelete(`/api/auth/users/${userId}`, {}, true)
+  },
+}
+
+// 令牌管理API
+export const tokenApi = {
+  /**
+   * 获取令牌列表
+   * @param {string} agentId - 智能体ID
+   * @returns {Promise} - 令牌列表
+   */
+  getTokens: async (agentId) => {
+    checkAdminPermission()
+    return apiGet(`/api/admin/tokens?agent_id=${agentId}`, {}, true)
+  },
+
+  /**
+   * 创建新令牌
+   * @param {string} agentId - 智能体ID
+   * @param {string} name - 令牌名称
+   * @returns {Promise} - 创建结果
+   */
+  createToken: async (agentId, name) => {
+    checkAdminPermission()
+    return apiPost('/api/admin/tokens', { agent_id: agentId, name }, {}, true)
+  },
+
+  /**
+   * 删除令牌
+   * @param {string} tokenId - 令牌ID
+   * @returns {Promise} - 删除结果
+   */
+  deleteToken: async (tokenId) => {
+    checkAdminPermission()
+    return apiDelete(`/api/admin/tokens/${tokenId}`, {}, true)
+  },
+}
+
+// 知识库管理API
+export const knowledgeBaseApi = {
+  /**
+   * 获取所有知识库
+   * @returns {Promise} - 知识库列表
+   */
+  getDatabases: async () => {
+    checkAdminPermission()
+    return apiGet('/api/data/', {}, true)
+  },
+
+  /**
+   * 创建知识库
+   * @param {Object} databaseData - 知识库数据
+   * @returns {Promise} - 创建结果
+   */
+  createDatabase: async (databaseData) => {
+    checkAdminPermission()
+    return apiPost('/api/data/', databaseData, {}, true)
+  },
+
+  /**
+   * 获取知识库详情
+   * @param {string} dbId - 知识库ID
+   * @returns {Promise} - 知识库详情
+   */
+  getDatabaseInfo: async (dbId) => {
+    checkAdminPermission()
+    return apiGet(`/api/data/info?db_id=${dbId}`, {}, true)
+  },
+
+  /**
+   * 删除知识库
+   * @param {string} dbId - 知识库ID 
+   * @returns {Promise} - 删除结果
+   */
+  deleteDatabase: async (dbId) => {
+    checkAdminPermission()
+    return apiDelete(`/api/data/?db_id=${dbId}`, {}, true)
+  },
+
+  /**
+   * 上传文件到知识库
+   * @param {FormData} formData - 包含文件的FormData
+   * @param {string} dbId - 知识库ID
+   * @returns {Promise} - 上传结果
+   */
+  uploadFile: async (formData, dbId) => {
+    checkAdminPermission()
+    return fetch(`/api/data/upload?db_id=${dbId}`, {
+      method: 'POST',
+      headers: {
+        ...useUserStore().getAuthHeaders()
+      },
+      body: formData
+    }).then(res => res.json())
+  },
+
+  /**
+   * 删除文件
+   * @param {string} dbId - 知识库ID
+   * @param {string} fileId - 文件ID 
+   * @returns {Promise} - 删除结果
+   */
+  deleteFile: async (dbId, fileId) => {
+    checkAdminPermission()
+    return apiDelete('/api/data/document', {
+      body: JSON.stringify({ db_id: dbId, file_id: fileId })
+    }, true)
+  },
+
+  /**
+   * 将文件分块
+   * @param {Object} data - 分块参数
+   * @returns {Promise} - 分块结果
+   */
+  fileToChunk: async (data) => {
+    checkAdminPermission()
+    return apiPost('/api/data/file-to-chunk', data, {}, true)
+  },
+
+  /**
+   * 将分块添加到数据库
+   * @param {Object} data - 包含db_id和file_chunks的数据
+   * @returns {Promise} - 添加结果
+   */
+  addByChunks: async (data) => {
+    checkAdminPermission()
+    return apiPost('/api/data/add-by-chunks', data, {}, true)
+  },
+
+  /**
+   * 查询测试
+   * @param {Object} data - 查询参数
+   * @returns {Promise} - 查询结果
+   */
+  queryTest: async (data) => {
+    checkAdminPermission()
+    return apiPost('/api/data/query-test', data, {}, true)
+  },
+}
+
+// 图数据库管理API
+export const graphApi = {
+  /**
+   * 获取图数据库状态
+   * @returns {Promise} - 图数据库状态
+   */
+  getGraphInfo: async () => {
+    checkAdminPermission()
+    return apiGet('/api/data/graph', {}, true)
+  },
+
+  /**
+   * 获取节点
+   * @param {string} dbName - 图数据库名称
+   * @param {number} num - 节点数量
+   * @returns {Promise} - 节点数据
+   */
+  getNodes: async (dbName, num) => {
+    checkAdminPermission()
+    return apiGet(`/api/data/graph/nodes?kgdb_name=${dbName}&num=${num}`, {}, true)
+  },
+
+  /**
+   * 查询实体
+   * @param {string} entityName - 实体名称
+   * @returns {Promise} - 查询结果
+   */
+  queryNode: async (entityName) => {
+    checkAdminPermission()
+    return apiGet(`/api/data/graph/node?entity_name=${entityName}`, {}, true)
+  },
+
+  /**
+   * 添加JSONL文件到图数据库
+   * @param {string} filePath - 文件路径
+   * @returns {Promise} - 添加结果
+   */
+  addByJsonl: async (filePath) => {
+    checkAdminPermission()
+    return apiPost('/api/data/graph/add-by-jsonl', { file_path: filePath }, {}, true)
+  },
+
+  /**
+   * 为未索引节点添加索引
+   * @param {string} dbName - 图数据库名称
+   * @returns {Promise} - 索引结果
+   */
+  indexNodes: async (dbName) => {
+    checkAdminPermission()
+    return apiPost('/api/data/graph/index-nodes', { kgdb_name: dbName }, {}, true)
+  },
+}
+
+// 系统配置API
+export const systemConfigApi = {
+  /**
+   * 设置默认智能体
+   * @param {string} agentId - 智能体ID
+   * @returns {Promise} - 设置结果
+   */
+  setDefaultAgent: async (agentId) => {
+    checkAdminPermission()
+    return apiPost('/api/chat/set_default_agent', { agent_id: agentId }, {}, true)
+  },
+
+  /**
+   * 获取系统配置
+   * @returns {Promise} - 系统配置
+   */
+  getSystemConfig: async () => {
+    checkAdminPermission()
+    return apiGet('/api/config', {}, true)
+  },
+
+  /**
+   * 更新系统配置
+   * @param {Object} config - 配置项
+   * @returns {Promise} - 更新结果
+   */
+  updateSystemConfig: async (config) => {
+    checkAdminPermission()
+    return apiPut('/api/config', config, {}, true)
+  },
+
+  /**
+   * 重启服务
+   * @returns {Promise} - 重启结果
+   */
+  restartServer: async () => {
+    checkSuperAdminPermission()
+    return apiPost('/api/restart', {}, {}, true)
+  }
+}
+
+// 日志API
+export const logApi = {
+  /**
+   * 获取系统日志
+   * @param {Object} params - 日志查询参数
+   * @returns {Promise} - 日志数据
+   */
+  getLogs: async (params = {}) => {
+    checkAdminPermission()
+    return apiGet('/api/admin/logs', { params }, true)
+  },
+} 
\ No newline at end of file
diff --git a/web/src/apis/auth_api.js b/web/src/apis/auth_api.js
new file mode 100644
index 000000000..f971d5c7e
--- /dev/null
+++ b/web/src/apis/auth_api.js
@@ -0,0 +1,106 @@
+import { apiGet, apiPost, apiDelete } from './base'
+
+/**
+ * 需要用户认证的API模块
+ * 用户必须登录才能访问的API
+ * 权限要求: 任何已登录用户（普通用户、管理员、超级管理员）
+ */
+
+// 聊天相关API
+export const chatApi = {
+  /**
+   * 发送聊天消息
+   * @param {Object} params - 聊天参数 
+   * @returns {Promise} - 聊天响应流
+   */
+  sendMessage: (params) => {
+    return fetch('/api/chat/', {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify(params),
+    })
+  },
+
+  /**
+   * 简单聊天调用（非流式）
+   * @param {string} query - 查询内容
+   * @returns {Promise} - 聊天响应
+   */
+  simpleCall: (query) => apiPost('/api/chat/call', { query }, {}, true),
+
+  /**
+   * 获取默认智能体
+   * @returns {Promise} - 默认智能体信息
+   */
+  getDefaultAgent: () => apiGet('/api/chat/default_agent', {}, true),
+
+  /**
+   * 获取智能体列表
+   * @returns {Promise} - 智能体列表
+   */
+  getAgents: () => apiGet('/api/chat/agent', {}, true),
+
+  /**
+   * 获取单个智能体详情
+   * @param {string} agentId - 智能体ID
+   * @returns {Promise} - 智能体详情
+   */
+  getAgentDetail: (agentId) => apiGet(`/api/chat/agent/${agentId}`, {}, true),
+
+  /**
+   * 获取可用工具列表
+   * @returns {Promise} - 工具列表
+   */
+  getTools: () => apiGet('/api/chat/tools', {}, true),
+
+  /**
+   * 获取对话历史
+   * @returns {Promise} - 对话历史列表
+   */
+  getConversations: () => apiGet('/api/chat/conversations', {}, true),
+
+  /**
+   * 获取特定对话
+   * @param {string} conversationId - 对话ID
+   * @returns {Promise} - 对话详情
+   */
+  getConversation: (conversationId) => 
+    apiGet(`/api/chat/conversations/${conversationId}`, {}, true),
+
+  /**
+   * 删除对话
+   * @param {string} conversationId - 对话ID
+   * @returns {Promise} - 删除结果
+   */
+  deleteConversation: (conversationId) => 
+    apiDelete(`/api/chat/conversations/${conversationId}`, {}, true),
+
+  /**
+   * 更新对话标题
+   * @param {string} conversationId - 对话ID
+   * @param {string} title - 新标题
+   * @returns {Promise} - 更新结果
+   */
+  updateConversationTitle: (conversationId, title) => 
+    apiPost(`/api/chat/conversations/${conversationId}/title`, { title }, {}, true),
+}
+
+// 用户设置API
+export const userSettingsApi = {
+  /**
+   * 获取用户设置
+   * @returns {Promise} - 用户设置
+   */
+  getSettings: () => apiGet('/api/user/settings', {}, true),
+  
+  /**
+   * 更新用户设置
+   * @param {Object} settings - 新设置
+   * @returns {Promise} - 更新结果
+   */
+  updateSettings: (settings) => apiPost('/api/user/settings', settings, {}, true),
+}
+
+// 其他需要用户认证的API可以继续添加到这里 
\ No newline at end of file
diff --git a/web/src/apis/base.js b/web/src/apis/base.js
new file mode 100644
index 000000000..78e4bdf82
--- /dev/null
+++ b/web/src/apis/base.js
@@ -0,0 +1,142 @@
+import { useUserStore } from '@/stores/user'
+import { message } from 'ant-design-vue'
+
+/**
+ * 基础API请求封装
+ * 提供统一的请求方法，自动处理认证头和错误
+ */
+
+/**
+ * 发送API请求的基础函数
+ * @param {string} url - API端点
+ * @param {Object} options - 请求选项
+ * @param {boolean} requiresAuth - 是否需要认证头
+ * @returns {Promise} - 请求结果
+ */
+export async function apiRequest(url, options = {}, requiresAuth = false) {
+  try {
+    // 默认请求配置
+    const requestOptions = {
+      ...options,
+      headers: {
+        'Content-Type': 'application/json',
+        ...options.headers,
+      },
+    }
+
+    // 如果需要认证，添加认证头
+    if (requiresAuth) {
+      const userStore = useUserStore()
+      if (!userStore.isLoggedIn) {
+        throw new Error('用户未登录')
+      }
+      
+      Object.assign(requestOptions.headers, userStore.getAuthHeaders())
+    }
+
+    // 发送请求
+    const response = await fetch(url, requestOptions)
+    
+    // 处理API返回的错误
+    if (!response.ok) {
+      // 尝试解析错误信息
+      let errorMessage = `请求失败: ${response.status}`
+      try {
+        const errorData = await response.json()
+        errorMessage = errorData.detail || errorData.message || errorMessage
+      } catch (e) {
+        // 如果无法解析JSON，使用默认错误信息
+      }
+
+      // 特殊处理401和403错误
+      if (response.status === 401) {
+        // 如果是认证失败，可能需要重新登录
+        const userStore = useUserStore()
+        if (userStore.isLoggedIn) {
+          // 如果用户认为自己已登录，但收到401，则可能是令牌过期
+          message.error('登录已过期，请重新登录')
+          userStore.logout()
+          window.location.href = '/login'
+        }
+        throw new Error('未授权，请先登录')
+      } else if (response.status === 403) {
+        throw new Error('没有权限执行此操作')
+      }
+
+      throw new Error(errorMessage)
+    }
+
+    // 检查Content-Type以确定如何处理响应
+    const contentType = response.headers.get('Content-Type')
+    if (contentType && contentType.includes('application/json')) {
+      return await response.json()
+    }
+
+    return await response.text()
+  } catch (error) {
+    console.error('API请求错误:', error)
+    throw error
+  }
+}
+
+/**
+ * 发送GET请求
+ * @param {string} url - API端点 
+ * @param {Object} options - 请求选项
+ * @param {boolean} requiresAuth - 是否需要认证
+ * @returns {Promise} - 请求结果
+ */
+export function apiGet(url, options = {}, requiresAuth = false) {
+  return apiRequest(url, { method: 'GET', ...options }, requiresAuth)
+}
+
+/**
+ * 发送POST请求
+ * @param {string} url - API端点
+ * @param {Object} data - 请求体数据
+ * @param {Object} options - 其他请求选项
+ * @param {boolean} requiresAuth - 是否需要认证
+ * @returns {Promise} - 请求结果
+ */
+export function apiPost(url, data = {}, options = {}, requiresAuth = false) {
+  return apiRequest(
+    url, 
+    { 
+      method: 'POST', 
+      body: JSON.stringify(data),
+      ...options 
+    }, 
+    requiresAuth
+  )
+}
+
+/**
+ * 发送PUT请求
+ * @param {string} url - API端点
+ * @param {Object} data - 请求体数据
+ * @param {Object} options - 其他请求选项
+ * @param {boolean} requiresAuth - 是否需要认证
+ * @returns {Promise} - 请求结果
+ */
+export function apiPut(url, data = {}, options = {}, requiresAuth = false) {
+  return apiRequest(
+    url, 
+    { 
+      method: 'PUT', 
+      body: JSON.stringify(data),
+      ...options 
+    }, 
+    requiresAuth
+  )
+}
+
+/**
+ * 发送DELETE请求
+ * @param {string} url - API端点
+ * @param {Object} options - 请求选项
+ * @param {boolean} requiresAuth - 是否需要认证
+ * @returns {Promise} - 请求结果
+ */
+export function apiDelete(url, options = {}, requiresAuth = false) {
+  return apiRequest(url, { method: 'DELETE', ...options }, requiresAuth)
+} 
\ No newline at end of file
diff --git a/web/src/apis/index.js b/web/src/apis/index.js
new file mode 100644
index 000000000..ffa124ccb
--- /dev/null
+++ b/web/src/apis/index.js
@@ -0,0 +1,33 @@
+/**
+ * API模块索引文件
+ * 导出所有API模块，方便统一引入
+ */
+
+// 导出公共API模块
+export * from './public_api'
+
+// 导出需要用户认证的API模块
+export * from './auth_api'
+
+// 导出需要管理员权限的API模块
+export * from './admin_api'
+
+// 导出基础工具函数
+export { apiRequest, apiGet, apiPost, apiPut, apiDelete } from './base'
+
+/**
+ * 权限说明:
+ * 
+ * 1. public_api.js: 不需要认证就可以访问的API
+ *    - 登录、初始化管理员、获取公共配置等
+ * 
+ * 2. auth_api.js: 需要用户认证才能访问的API
+ *    - 权限要求: 任何已登录用户（普通用户、管理员、超级管理员）
+ *    - 聊天功能、个人设置等
+ * 
+ * 3. admin_api.js: 需要管理员权限才能访问的API
+ *    - 权限要求: admin 或 superadmin
+ *    - 用户管理、知识库管理、系统配置等
+ * 
+ * 注意：本模块已处理权限验证和请求头，使用时无需再手动添加认证头
+ */ 
\ No newline at end of file
diff --git a/web/src/apis/public_api.js b/web/src/apis/public_api.js
new file mode 100644
index 000000000..88d759dea
--- /dev/null
+++ b/web/src/apis/public_api.js
@@ -0,0 +1,59 @@
+import { apiGet, apiPost } from './base'
+
+/**
+ * 公共API模块
+ * 包含所有不需要认证的公共接口
+ */
+
+// 登录相关API
+export const authApi = {
+  /**
+   * 用户登录
+   * @param {Object} credentials - 登录凭证
+   * @returns {Promise} - 登录结果
+   */
+  login: (credentials) => {
+    const formData = new FormData()
+    formData.append('username', credentials.username)
+    formData.append('password', credentials.password)
+    
+    return apiRequest('/api/auth/token', {
+      method: 'POST',
+      body: formData
+    }, false)
+  },
+
+  /**
+   * 检查是否是首次运行
+   * @returns {Promise<boolean>} - 是否首次运行
+   */
+  checkFirstRun: () => apiGet('/api/auth/check-first-run'),
+
+  /**
+   * 初始化管理员账户
+   * @param {Object} adminData - 管理员账户数据
+   * @returns {Promise} - 初始化结果
+   */
+  initializeAdmin: (adminData) => apiPost('/api/auth/initialize', adminData),
+}
+
+// 配置相关API
+export const configApi = {
+  /**
+   * 获取系统配置
+   * @returns {Promise} - 系统配置
+   */
+  getConfig: () => apiGet('/api/config'),
+}
+
+// 健康检查API
+export const healthApi = {
+  /**
+   * 系统健康检查
+   * @returns {Promise} - 健康检查结果
+   */
+  check: () => apiGet('/api/health'),
+}
+
+// 从base.js导入apiRequest以支持FormData
+import { apiRequest } from './base' 
\ No newline at end of file
diff --git a/web/src/components/AgentChatComponent.vue b/web/src/components/AgentChatComponent.vue
index 5272d74be..6ca3c1b09 100644
--- a/web/src/components/AgentChatComponent.vue
+++ b/web/src/components/AgentChatComponent.vue
@@ -110,6 +110,8 @@ import {
 import { message } from 'ant-design-vue';
 import MessageInputComponent from '@/components/MessageInputComponent.vue'
 import MessageComponent from '@/components/MessageComponent.vue'
+import { useUserStore } from '@/stores/user'
+import { chatApi } from '@/apis/auth_api'
 
 // 新增props属性，允许父组件传入agentId
 const props = defineProps({
@@ -127,6 +129,9 @@ const props = defineProps({
   }
 });
 
+// 初始化userStore
+const userStore = useUserStore();
+
 // ==================== 状态管理 ====================
 
 // UI状态
@@ -356,7 +361,10 @@ const sendMessageWithText = async (text) => {
     // 发送请求
     const response = await fetch(`/api/chat/agent/${currentAgent.value.name}`, {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
+      headers: { 
+        'Content-Type': 'application/json',
+        ...userStore.getAuthHeaders()
+      },
       body: JSON.stringify(requestData)
     });
 
@@ -752,18 +760,13 @@ const appendToolMessageToExistingAssistant = async (data) => {
 // 获取智能体列表
 const fetchAgents = async () => {
   try {
-    const response = await fetch('/api/chat/agent');
-    if (response.ok) {
-      const data = await response.json();
-      // 将数组转换为对象
-      agents.value = data.agents.reduce((acc, agent) => {
-        acc[agent.name] = agent;
-        return acc;
-      }, {});
-      console.log("agents", agents.value);
-    } else {
-      console.error('获取智能体失败');
-    }
+    const data = await chatApi.getAgents();
+    // 将数组转换为对象
+    agents.value = data.agents.reduce((acc, agent) => {
+      acc[agent.name] = agent;
+      return acc;
+    }, {});
+    console.log("agents", agents.value);
   } catch (error) {
     console.error('获取智能体错误:', error);
   }
diff --git a/web/src/components/ChatComponent.vue b/web/src/components/ChatComponent.vue
index 6ef374008..b314cfc4a 100644
--- a/web/src/components/ChatComponent.vue
+++ b/web/src/components/ChatComponent.vue
@@ -184,10 +184,12 @@ import {
 } from '@ant-design/icons-vue'
 import { onClickOutside } from '@vueuse/core'
 import { useConfigStore } from '@/stores/config'
+import { useUserStore } from '@/stores/user'
 import { message } from 'ant-design-vue'
 import MessageInputComponent from '@/components/MessageInputComponent.vue'
 import MessageComponent from '@/components/MessageComponent.vue'
 import RefsSidebar from '@/components/RefsSidebar.vue'
+import { chatApi } from '@/apis/auth_api'
 
 const props = defineProps({
   conv: Object,
@@ -196,6 +198,7 @@ const props = defineProps({
 
 const emit = defineEmits(['rename-title', 'newconv']);
 const configStore = useConfigStore()
+const userStore = useUserStore()
 
 const { conv, state } = toRefs(props)
 const chatContainer = ref(null)
@@ -475,50 +478,56 @@ const groupRefs = (id) => {
   scrollToBottom()
 }
 
-const simpleCall = (msg) => {
-  return new Promise((resolve, reject) => {
-    fetch('/api/chat/call', {
-      method: 'POST',
-      body: JSON.stringify({ query: msg, }),
-      headers: { 'Content-Type': 'application/json' }
-    })
-    .then((response) => response.json())
-    .then((data) => resolve(data))
-    .catch((error) => reject(error))
-  })
-}
-
 const loadDatabases = () => {
-  fetch('/api/data/', { method: "GET", })
+  fetch('/api/data/', { 
+    method: "GET",
+    headers: userStore.getAuthHeaders()
+  })
     .then(response => response.json())
     .then(data => {
       console.log(data)
       opts.databases = data.databases
     })
+    .catch(error => {
+      console.error('加载数据库列表失败:', error)
+    })
 }
 
-// 新函数用于处理 fetch 请求
+const simpleCall = (msg) => {
+  return new Promise((resolve, reject) => {
+    chatApi.simpleCall(msg)
+      .then(data => resolve(data))
+      .catch(error => reject(error))
+  })
+}
+
+// 替换fetchChatResponse函数
 const fetchChatResponse = (user_input, cur_res_id) => {
   const controller = new AbortController();
   const signal = controller.signal;
 
   const params = {
     query: user_input,
-    history: getHistory().slice(0, -1), // 去掉最后一条刚添加的用户消息,
+    history: getHistory().slice(0, -1), // 去掉最后一条刚添加的用户消息
     meta: meta,
     cur_res_id: cur_res_id,
   }
   console.log(params)
 
+  // 使用fetch带上认证头和信号控制
   fetch('/api/chat/', {
     method: 'POST',
     body: JSON.stringify(params),
     headers: {
-      'Content-Type': 'application/json'
+      'Content-Type': 'application/json',
+      ...userStore.getAuthHeaders()
     },
     signal // 添加 signal 用于中断请求
   })
   .then((response) => {
+    if (!response.ok) {
+      throw new Error(`请求失败: ${response.status} ${response.statusText}`)
+    }
     if (!response.body) throw new Error("ReadableStream not supported.");
     const reader = response.body.getReader();
     const decoder = new TextDecoder("utf-8");
@@ -587,6 +596,7 @@ const fetchChatResponse = (user_input, cur_res_id) => {
       updateMessage({
         id: cur_res_id,
         status: "error",
+        message: error.message || '请求失败',
       });
     }
     isStreaming.value = false;
diff --git a/web/src/components/TokenManagerComponent.vue b/web/src/components/TokenManagerComponent.vue
index 4b074f859..c29b7d4ea 100644
--- a/web/src/components/TokenManagerComponent.vue
+++ b/web/src/components/TokenManagerComponent.vue
@@ -61,6 +61,7 @@
 import { ref, onMounted, watch } from 'vue';
 import { message, Empty } from 'ant-design-vue';
 import { PlusOutlined, DeleteOutlined, CopyOutlined } from '@ant-design/icons-vue';
+import { tokenApi } from '@/apis/admin_api';
 
 const props = defineProps({
   agentId: {
@@ -81,16 +82,11 @@ const newToken = ref({
 const fetchTokens = async () => {
   loading.value = true;
   try {
-    const response = await fetch(`/api/admin/tokens?agent_id=${props.agentId}`);
-    if (response.ok) {
-      const data = await response.json();
-      tokens.value = data;
-    } else {
-      message.error('获取令牌列表失败');
-    }
+    const data = await tokenApi.getTokens(props.agentId);
+    tokens.value = data;
   } catch (error) {
     console.error('获取令牌列表出错:', error);
-    message.error('获取令牌列表出错');
+    message.error(error.message || '获取令牌列表出错');
   } finally {
     loading.value = false;
   }
@@ -104,48 +100,26 @@ const createToken = async () => {
   }
 
   try {
-    const response = await fetch('/api/admin/tokens', {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json'
-      },
-      body: JSON.stringify({
-        agent_id: props.agentId,
-        name: newToken.value.name
-      })
-    });
-
-    if (response.ok) {
-      const data = await response.json();
-      tokens.value.push(data);
-      message.success('令牌创建成功');
-      addTokenModalVisible.value = false;
-      newToken.value.name = '';
-    } else {
-      message.error('创建令牌失败');
-    }
+    const data = await tokenApi.createToken(props.agentId, newToken.value.name);
+    tokens.value.push(data);
+    message.success('令牌创建成功');
+    addTokenModalVisible.value = false;
+    newToken.value.name = '';
   } catch (error) {
     console.error('创建令牌出错:', error);
-    message.error('创建令牌出错');
+    message.error(error.message || '创建令牌出错');
   }
 };
 
 // 删除令牌
 const deleteToken = async (tokenId) => {
   try {
-    const response = await fetch(`/api/admin/tokens/${tokenId}`, {
-      method: 'DELETE'
-    });
-
-    if (response.ok) {
-      tokens.value = tokens.value.filter(token => token.id !== tokenId);
-      message.success('令牌已删除');
-    } else {
-      message.error('删除令牌失败');
-    }
+    await tokenApi.deleteToken(tokenId);
+    tokens.value = tokens.value.filter(token => token.id !== tokenId);
+    message.success('令牌已删除');
   } catch (error) {
     console.error('删除令牌出错:', error);
-    message.error('删除令牌出错');
+    message.error(error.message || '删除令牌出错');
   }
 };
 
diff --git a/web/src/components/UserInfoComponent.vue b/web/src/components/UserInfoComponent.vue
new file mode 100644
index 000000000..9afe0d941
--- /dev/null
+++ b/web/src/components/UserInfoComponent.vue
@@ -0,0 +1,139 @@
+<template>
+  <div class="user-info-component">
+    <a-dropdown :trigger="['click']" v-if="userStore.isLoggedIn">
+      <div class="user-avatar">
+        <div class="user-initial">{{ userInitial }}</div>
+        <div class="user-role-badge" :class="userRoleClass"></div>
+      </div>
+      <template #overlay>
+        <a-menu>
+          <a-menu-item key="username" disabled>
+            <span class="user-menu-username">{{ userStore.username }}</span>
+          </a-menu-item>
+          <a-menu-item key="role" disabled>
+            <span class="user-menu-role">{{ userRoleText }}</span>
+          </a-menu-item>
+          <a-menu-divider />
+          <a-menu-item key="logout" @click="logout">
+            <LogoutOutlined /> 退出登录
+          </a-menu-item>
+        </a-menu>
+      </template>
+    </a-dropdown>
+    <a-button v-else type="link" @click="goToLogin">
+      <UserOutlined /> 登录
+    </a-button>
+  </div>
+</template>
+
+<script setup>
+import { computed } from 'vue';
+import { useRouter } from 'vue-router';
+import { useUserStore } from '@/stores/user';
+import { UserOutlined, LogoutOutlined } from '@ant-design/icons-vue';
+import { message } from 'ant-design-vue';
+
+const router = useRouter();
+const userStore = useUserStore();
+
+// 用户名首字母（用于显示在头像中）
+const userInitial = computed(() => {
+  if (!userStore.username) return '?';
+  return userStore.username.charAt(0).toUpperCase();
+});
+
+// 用户角色显示文本
+const userRoleText = computed(() => {
+  switch (userStore.userRole) {
+    case 'superadmin':
+      return '超级管理员';
+    case 'admin':
+      return '管理员';
+    case 'user':
+      return '普通用户';
+    default:
+      return '未知角色';
+  }
+});
+
+// 用户角色徽章样式类
+const userRoleClass = computed(() => {
+  return {
+    'superadmin': userStore.userRole === 'superadmin',
+    'admin': userStore.userRole === 'admin',
+    'user': userStore.userRole === 'user'
+  };
+});
+
+// 退出登录
+const logout = () => {
+  userStore.logout();
+  message.success('已退出登录');
+  // 跳转到首页
+  router.push('/login');
+};
+
+// 前往登录页
+const goToLogin = () => {
+  router.push('/login');
+};
+</script>
+
+<style lang="less" scoped>
+.user-info-component {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  margin-bottom: 16px;
+}
+
+.user-avatar {
+  width: 30px;
+  height: 30px;
+  border-radius: 50%;
+  background-color: var(--main-color);
+  color: white;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  font-weight: bold;
+  font-size: 18px;
+  cursor: pointer;
+  position: relative;
+
+  &:hover {
+    opacity: 0.9;
+  }
+}
+
+.user-role-badge {
+  position: absolute;
+  width: 12px;
+  height: 12px;
+  border-radius: 50%;
+  right: 0;
+  bottom: 0;
+  border: 2px solid white;
+
+  &.superadmin {
+    background-color: #c1bd00; // 红色，超管
+  }
+
+  &.admin {
+    background-color: #1890ff; // 蓝色，管理员
+  }
+
+  &.user {
+    background-color: #52c41a; // 绿色，普通用户
+  }
+}
+
+.user-menu-username {
+  font-weight: bold;
+}
+
+.user-menu-role {
+  font-size: 12px;
+  color: rgba(0, 0, 0, 0.45);
+}
+</style>
\ No newline at end of file
diff --git a/web/src/layouts/AppLayout.vue b/web/src/layouts/AppLayout.vue
index e29115ce1..e17bf6b34 100644
--- a/web/src/layouts/AppLayout.vue
+++ b/web/src/layouts/AppLayout.vue
@@ -29,6 +29,8 @@ import { themeConfig } from '@/assets/theme'
 import { useConfigStore } from '@/stores/config'
 import { useDatabaseStore } from '@/stores/database'
 import DebugComponent from '@/components/DebugComponent.vue'
+import UserInfoComponent from '@/components/UserInfoComponent.vue'
+import { configApi } from '@/apis/public_api'
 
 const configStore = useConfigStore()
 const databaseStore = useDatabaseStore()
@@ -57,11 +59,12 @@ const getRemoteDatabase = () => {
 const fetchGithubStars = async () => {
   try {
     isLoadingStars.value = true
+    // 公共API，可以直接使用fetch
     const response = await fetch('https://api.github.com/repos/xerrors/Yuxi-Know')
     const data = await response.json()
     githubStars.value = data.stargazers_count
   } catch (error) {
-    console.error('Error fetching GitHub stars:', error)
+    console.error('获取GitHub stars失败:', error)
   } finally {
     isLoadingStars.value = false
   }
@@ -102,8 +105,8 @@ const mainList = [{
     activeIcon: BookFilled,
     // hidden: !configStore.config.enable_knowledge_base,
   }, {
-    name: '工具',
-    path: '/tools',
+    name: '智能体',
+    path: '/agent',
     icon: ToolOutlined,
     activeIcon: ToolFilled,
   }
@@ -163,6 +166,10 @@ const mainList = [{
         </a-tooltip>
       </div>
       <div class="fill" style="flex-grow: 1;"></div>
+
+      <!-- 用户信息组件 -->
+      <UserInfoComponent />
+
       <div class="github nav-item">
         <a-tooltip placement="right">
           <template #title>GitHub</template>
diff --git a/web/src/router/index.js b/web/src/router/index.js
index 0c3c631e7..2f6a8b3c2 100644
--- a/web/src/router/index.js
+++ b/web/src/router/index.js
@@ -1,6 +1,7 @@
 import { createRouter, createWebHistory } from 'vue-router'
 import AppLayout from '@/layouts/AppLayout.vue';
 import BlankLayout from '@/layouts/BlankLayout.vue';
+import { useUserStore } from '@/stores/user';
 
 const router = createRouter({
   history: createWebHistory(import.meta.env.BASE_URL),
@@ -14,10 +15,16 @@ const router = createRouter({
           path: '',
           name: 'Home',
           component: () => import('../views/HomeView.vue'),
-          meta: { keepAlive: true }
+          meta: { keepAlive: true, requiresAuth: false }
         }
       ]
     },
+    {
+      path: '/login',
+      name: 'login',
+      component: () => import('../views/LoginView.vue'),
+      meta: { requiresAuth: false }
+    },
     {
       path: '/chat',
       name: 'chat',
@@ -27,33 +34,21 @@ const router = createRouter({
           path: '',
           name: 'ChatComp',
           component: () => import('../views/ChatView.vue'),
-          meta: { keepAlive: true }
+          meta: { keepAlive: true, requiresAuth: true, requiresAdmin: true }
         }
       ]
     },
-    // {
-    //   path: '/agent',
-    //   name: 'agent',
-    //   component: AppLayout,
-    //   children: [
-    //     {
-    //       path: '',
-    //       name: 'AgentMain',
-    //       component: () => import('../views/AgentView.vue'),
-    //       meta: { keepAlive: true }
-    //     },
-    //     {
-    //       path: ':agent_id',
-    //       name: 'AgentSinglePage',
-    //       component: () => import('../components/AgentSingleViewComponent.vue'),
-    //       meta: { keepAlive: false }
-    //     }
-    //   ]
-    // },
+    {
+      path: '/agent',
+      name: 'AgentMain',
+      component: () => import('../views/AgentView.vue'),
+      meta: { keepAlive: true, requiresAuth: true, requiresAdmin: true }
+    },
     {
       path: '/agent/:agent_id',
       name: 'AgentSinglePage',
       component: () => import('../views/AgentSingleView.vue'),
+      meta: { requiresAuth: true }
     },
     {
       path: '/graph',
@@ -64,7 +59,7 @@ const router = createRouter({
           path: '',
           name: 'GraphComp',
           component: () => import('../views/GraphView.vue'),
-          meta: { keepAlive: false }
+          meta: { keepAlive: false, requiresAuth: true, requiresAdmin: true }
         }
       ]
     },
@@ -77,13 +72,13 @@ const router = createRouter({
           path: '',
           name: 'DatabaseComp',
           component: () => import('../views/DataBaseView.vue'),
-          meta: { keepAlive: true }
+          meta: { keepAlive: true, requiresAuth: true, requiresAdmin: true }
         },
         {
           path: ':database_id',
           name: 'DatabaseInfoComp',
           component: () => import('../views/DataBaseInfoView.vue'),
-          meta: { keepAlive: false }
+          meta: { keepAlive: false, requiresAuth: true, requiresAdmin: true }
         }
       ]
     },
@@ -96,45 +91,80 @@ const router = createRouter({
           path: '',
           name: 'SettingComp',
           component: () => import('../views/SettingView.vue'),
-          meta: { keepAlive: true }
-        }
-      ]
-    },
-    {
-      path: '/tools',
-      name: 'tools',
-      component: AppLayout,
-      children: [
-        {
-          path: '',
-          name: 'ToolsComp',
-          component: () => import('../views/ToolsView.vue'),
-          meta: { keepAlive: true }
-        },
-        {
-          path: 'text-chunking',
-          name: 'TextChunking',
-          component: () => import('../components/tools/TextChunkingComponent.vue'),
-        },
-        {
-          path: 'pdf2txt',
-          name: 'PDF_to_TXT',
-          component: () => import('../components/tools/ConvertToTxtComponent.vue'),
-        },
-        {
-          path: 'agent',
-          name: 'Agent',
-          component: () => import('../views/AgentView.vue'),
-          meta: { keepAlive: true }
+          meta: { keepAlive: true, requiresAuth: true, requiresAdmin: true }
         }
       ]
     },
     {
       path: '/:pathMatch(.*)*',
       name: 'NotFound',
-      component: () => import('../views/EmptyView.vue')
+      component: () => import('../views/EmptyView.vue'),
+      meta: { requiresAuth: false }
     },
   ]
 })
 
+// 全局前置守卫
+router.beforeEach(async (to, from, next) => {
+  // 检查路由是否需要认证
+  const requiresAuth = to.matched.some(record => record.meta.requiresAuth === true);
+  const requiresAdmin = to.matched.some(record => record.meta.requiresAdmin);
+
+  const userStore = useUserStore();
+  const isLoggedIn = userStore.isLoggedIn;
+  const isAdmin = userStore.isAdmin;
+
+  // 如果路由需要认证但用户未登录
+  if (requiresAuth && !isLoggedIn) {
+    // 保存尝试访问的路径，登录后跳转
+    sessionStorage.setItem('redirect', to.fullPath);
+    next('/login');
+    return;
+  }
+
+  // 如果路由需要管理员权限但用户不是管理员
+  if (requiresAdmin && !isAdmin) {
+    // 如果是普通用户，跳转到默认智能体页面
+    try {
+      // 先尝试获取默认智能体
+      const response = await fetch('/api/chat/default_agent');
+      if (response.ok) {
+        const data = await response.json();
+        if (data.default_agent_id) {
+          // 如果存在默认智能体，直接跳转
+          next(`/agent/${data.default_agent_id}`);
+          return;
+        }
+      }
+
+      // 如果没有默认智能体，则获取第一个可用智能体
+      const agentResponse = await fetch('/api/chat/agent');
+      if (agentResponse.ok) {
+        const agentData = await agentResponse.json();
+        if (agentData.agents && agentData.agents.length > 0) {
+          const firstAgentId = agentData.agents[0].name;
+          next(`/agent/${firstAgentId}`);
+        } else {
+          next('/');
+        }
+      } else {
+        next('/');
+      }
+    } catch (error) {
+      console.error('获取智能体信息失败:', error);
+      next('/');
+    }
+    return;
+  }
+
+  // 如果用户已登录但访问登录页
+  if (to.path === '/login' && isLoggedIn) {
+    next('/');
+    return;
+  }
+
+  // 其他情况正常导航
+  next();
+});
+
 export default router
diff --git a/web/src/stores/user.js b/web/src/stores/user.js
new file mode 100644
index 000000000..1dfa02041
--- /dev/null
+++ b/web/src/stores/user.js
@@ -0,0 +1,232 @@
+import { defineStore } from 'pinia'
+import { ref, computed } from 'vue'
+
+export const useUserStore = defineStore('user', () => {
+  // 状态
+  const token = ref(localStorage.getItem('user_token') || '')
+  const userId = ref(parseInt(localStorage.getItem('user_id') || '0') || null)
+  const username = ref(localStorage.getItem('username') || '')
+  const userRole = ref(localStorage.getItem('user_role') || '')
+
+  // 计算属性
+  const isLoggedIn = computed(() => !!token.value)
+  const isAdmin = computed(() => userRole.value === 'admin' || userRole.value === 'superadmin')
+  const isSuperAdmin = computed(() => userRole.value === 'superadmin')
+
+  // 动作
+  async function login(credentials) {
+    try {
+      const formData = new FormData()
+      formData.append('username', credentials.username)
+      formData.append('password', credentials.password)
+
+      const response = await fetch('/api/auth/token', {
+        method: 'POST',
+        body: formData
+      })
+
+      if (!response.ok) {
+        const error = await response.json()
+        throw new Error(error.detail || '登录失败')
+      }
+
+      const data = await response.json()
+
+      // 更新状态
+      token.value = data.access_token
+      userId.value = data.user_id
+      username.value = data.username
+      userRole.value = data.role
+
+      // 保存到本地存储
+      localStorage.setItem('user_token', data.access_token)
+      localStorage.setItem('user_id', data.user_id)
+      localStorage.setItem('username', data.username)
+      localStorage.setItem('user_role', data.role)
+
+      return true
+    } catch (error) {
+      console.error('登录错误:', error)
+      throw error
+    }
+  }
+
+  function logout() {
+    // 清除状态
+    token.value = ''
+    userId.value = null
+    username.value = ''
+    userRole.value = ''
+
+    // 清除本地存储
+    localStorage.removeItem('user_token')
+    localStorage.removeItem('user_id')
+    localStorage.removeItem('username')
+    localStorage.removeItem('user_role')
+  }
+
+  async function initialize(admin) {
+    try {
+      const response = await fetch('/api/auth/initialize', {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json'
+        },
+        body: JSON.stringify(admin)
+      })
+
+      if (!response.ok) {
+        const error = await response.json()
+        throw new Error(error.detail || '初始化管理员失败')
+      }
+
+      const data = await response.json()
+
+      // 更新状态
+      token.value = data.access_token
+      userId.value = data.user_id
+      username.value = data.username
+      userRole.value = data.role
+
+      // 保存到本地存储
+      localStorage.setItem('user_token', data.access_token)
+      localStorage.setItem('user_id', data.user_id)
+      localStorage.setItem('username', data.username)
+      localStorage.setItem('user_role', data.role)
+
+      return true
+    } catch (error) {
+      console.error('初始化管理员错误:', error)
+      throw error
+    }
+  }
+
+  async function checkFirstRun() {
+    try {
+      const response = await fetch('/api/auth/check-first-run')
+      const data = await response.json()
+      return data.first_run
+    } catch (error) {
+      console.error('检查首次运行状态错误:', error)
+      return false
+    }
+  }
+
+  // 用于API请求的授权头
+  function getAuthHeaders() {
+    return {
+      'Authorization': `Bearer ${token.value}`
+    }
+  }
+
+  // 用户管理功能
+  async function getUsers() {
+    try {
+      const response = await fetch('/api/auth/users', {
+        headers: {
+          ...getAuthHeaders()
+        }
+      })
+
+      if (!response.ok) {
+        throw new Error('获取用户列表失败')
+      }
+
+      return await response.json()
+    } catch (error) {
+      console.error('获取用户列表错误:', error)
+      throw error
+    }
+  }
+
+  async function createUser(userData) {
+    try {
+      const response = await fetch('/api/auth/users', {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+          ...getAuthHeaders()
+        },
+        body: JSON.stringify(userData)
+      })
+
+      if (!response.ok) {
+        const error = await response.json()
+        throw new Error(error.detail || '创建用户失败')
+      }
+
+      return await response.json()
+    } catch (error) {
+      console.error('创建用户错误:', error)
+      throw error
+    }
+  }
+
+  async function updateUser(userId, userData) {
+    try {
+      const response = await fetch(`/api/auth/users/${userId}`, {
+        method: 'PUT',
+        headers: {
+          'Content-Type': 'application/json',
+          ...getAuthHeaders()
+        },
+        body: JSON.stringify(userData)
+      })
+
+      if (!response.ok) {
+        const error = await response.json()
+        throw new Error(error.detail || '更新用户失败')
+      }
+
+      return await response.json()
+    } catch (error) {
+      console.error('更新用户错误:', error)
+      throw error
+    }
+  }
+
+  async function deleteUser(userId) {
+    try {
+      const response = await fetch(`/api/auth/users/${userId}`, {
+        method: 'DELETE',
+        headers: {
+          ...getAuthHeaders()
+        }
+      })
+
+      if (!response.ok) {
+        const error = await response.json()
+        throw new Error(error.detail || '删除用户失败')
+      }
+
+      return await response.json()
+    } catch (error) {
+      console.error('删除用户错误:', error)
+      throw error
+    }
+  }
+
+  return {
+    // 状态
+    token,
+    userId,
+    username,
+    userRole,
+
+    // 计算属性
+    isLoggedIn,
+    isAdmin,
+    isSuperAdmin,
+
+    // 方法
+    login,
+    logout,
+    initialize,
+    checkFirstRun,
+    getAuthHeaders,
+    getUsers,
+    createUser,
+    updateUser,
+    deleteUser
+  }
+})
\ No newline at end of file
diff --git a/web/src/views/AgentSingleView.vue b/web/src/views/AgentSingleView.vue
index 6820a4dfb..d0d6c8d77 100644
--- a/web/src/views/AgentSingleView.vue
+++ b/web/src/views/AgentSingleView.vue
@@ -1,138 +1,53 @@
 <template>
   <div class="agent-single-view">
-    <!-- Token验证弹窗 -->
-    <a-modal
-      v-model:open="tokenModalVisible"
-      title="访问验证"
-      :closable="false"
-      :maskClosable="false"
-      :keyboard="false"
-      :footer="null"
-      width="500px"
-    >
-      <div class="token-verify-form">
-        <p>需要输入访问令牌才能使用该智能体</p>
-        <a-input-password
-          v-model:value="tokenInput"
-          placeholder="请输入访问令牌"
-          @pressEnter="verifyToken"
-        />
-        <div class="error-message" v-if="errorMessage">{{ errorMessage }}</div>
-        <div class="token-actions">
-          <a-button type="primary" :loading="verifying" @click="verifyToken">验证</a-button>
+    <!-- 侧边栏 -->
+    <div class="sidebar" :class="{ 'collapsed': isSidebarCollapsed }">
+      <div class="sidebar-content">
+        <div class="user-icon">
+          <img :src="sidebarLeftIcon" alt="用户信息" @click="toggleUserInfo" />
         </div>
+        <!-- 这里可以添加更多侧边栏内容 -->
+         <UserInfoComponent />
       </div>
-    </a-modal>
+      <div class="toggle-button" @click="toggleSidebar">
+        <img :src="isSidebarCollapsed ? sidebarRightIcon : sidebarLeftIcon" alt="折叠/展开" />
+      </div>
+    </div>
+
+    <!-- 用户信息组件 -->
+    <div class="user-info-wrapper">
+      <UserInfoComponent />
+    </div>
 
     <!-- 智能体聊天界面 -->
-    <AgentChatComponent v-if="isVerified" :agent-id="agentId" />
+    <AgentChatComponent :agent-id="agentId" />
   </div>
 </template>
 
 <script setup>
-import { ref, computed, onMounted } from 'vue';
-import { useRoute, useRouter } from 'vue-router';
+import { computed, ref } from 'vue';
+import { useRoute } from 'vue-router';
 import AgentChatComponent from '@/components/AgentChatComponent.vue';
-import { message } from 'ant-design-vue';
+import UserInfoComponent from '@/components/UserInfoComponent.vue';
+import sidebarLeftIcon from '@/assets/icons/sidebar_left.svg';
+import sidebarRightIcon from '@/assets/icons/sidebar_right.svg';
 
 const route = useRoute();
-const router = useRouter();
 const agentId = computed(() => route.params.agent_id);
 
-// Token验证相关状态
-const tokenModalVisible = ref(false);
-const tokenInput = ref('');
-const isVerified = ref(false);
-const verifying = ref(false);
-const errorMessage = ref('');
-
-// 验证Token
-const verifyToken = async () => {
-  if (!tokenInput.value) {
-    errorMessage.value = '请输入访问令牌';
-    return;
-  }
+// 侧边栏状态
+const isSidebarCollapsed = ref(false);
 
-  verifying.value = true;
-  errorMessage.value = '';
-
-  try {
-    const response = await fetch('/api/admin/verify_token', {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json'
-      },
-      body: JSON.stringify({
-        agent_id: agentId.value,
-        token: tokenInput.value
-      })
-    });
-
-    if (response.ok) {
-      // 验证成功
-      isVerified.value = true;
-      tokenModalVisible.value = false;
-
-      // 保存令牌到localStorage
-      localStorage.setItem(`agent-token-${agentId.value}`, tokenInput.value);
-    } else {
-      // 验证失败
-      const data = await response.json();
-      errorMessage.value = data.detail || '令牌验证失败';
-    }
-  } catch (error) {
-    console.error('验证令牌出错:', error);
-    errorMessage.value = '验证令牌时发生错误';
-  } finally {
-    verifying.value = false;
-  }
+// 切换侧边栏展开/折叠状态
+const toggleSidebar = () => {
+  isSidebarCollapsed.value = !isSidebarCollapsed.value;
 };
 
-// 检查是否已经验证
-const checkVerification = async () => {
-  const savedToken = localStorage.getItem(`agent-token-${agentId.value}`);
-
-  if (savedToken) {
-    // 即使有保存的令牌，也要重新验证其有效性
-    verifying.value = true;
-
-    try {
-      const response = await fetch('/api/admin/verify_token', {
-        method: 'POST',
-        headers: {
-          'Content-Type': 'application/json'
-        },
-        body: JSON.stringify({
-          agent_id: agentId.value,
-          token: savedToken
-        })
-      });
-
-      if (response.ok) {
-        // 验证成功
-        isVerified.value = true;
-        tokenInput.value = savedToken; // 保存已验证的令牌到输入框
-      } else {
-        // 令牌无效，清除本地存储并显示输入框
-        localStorage.removeItem(`agent-token-${agentId.value}`);
-        tokenModalVisible.value = true;
-      }
-    } catch (error) {
-      console.error('验证令牌出错:', error);
-      tokenModalVisible.value = true;
-    } finally {
-      verifying.value = false;
-    }
-  } else {
-    // 没有保存的令牌，显示输入框
-    tokenModalVisible.value = true;
-  }
+// 用户信息点击事件
+const toggleUserInfo = () => {
+  // 此处可以添加用户信息相关的逻辑
+  console.log('用户信息图标被点击');
 };
-
-// 组件挂载时检查验证状态
-onMounted(() => {
-  checkVerification();
-});
 </script>
 
 <style lang="less" scoped>
@@ -140,22 +55,67 @@ onMounted(() => {
   width: 100%;
   height: 100vh;
   overflow: hidden;
+  position: relative;
 }
 
-.token-verify-form {
+.user-info-wrapper {
+  position: absolute;
+  top: 10px;
+  right: 20px;
+  z-index: 10;
+}
+
+// 侧边栏样式
+.sidebar {
+  position: absolute;
+  left: 0;
+  top: 0;
+  height: 100%;
+  width: 240px;
+  background-color: #f5f5f5;
+  transition: all 0.3s ease;
+  z-index: 20;
   display: flex;
-  flex-direction: column;
-  gap: 1rem;
 
-  .error-message {
-    color: #ff4d4f;
-    font-size: 0.85rem;
+  &.collapsed {
+    width: 60px;
+  }
+
+  .sidebar-content {
+    flex: 1;
+    padding: 20px 10px;
+    overflow-y: auto;
+  }
+
+  .user-icon {
+    cursor: pointer;
+    margin-bottom: 20px;
+
+    img {
+      width: 32px;
+      height: 32px;
+    }
   }
 
-  .token-actions {
+  .toggle-button {
+    position: absolute;
+    right: -15px;
+    top: 50%;
+    transform: translateY(-50%);
+    width: 30px;
+    height: 30px;
+    background-color: #fff;
+    border-radius: 50%;
     display: flex;
-    justify-content: space-between;
-    margin-top: 0.5rem;
+    align-items: center;
+    justify-content: center;
+    cursor: pointer;
+    box-shadow: 0 2px 4px rgba(0, 0, 0, 0.1);
+
+    img {
+      width: 16px;
+      height: 16px;
+    }
   }
 }
 </style>
diff --git a/web/src/views/AgentView.vue b/web/src/views/AgentView.vue
index 7a2fcc437..b7328fd4e 100644
--- a/web/src/views/AgentView.vue
+++ b/web/src/views/AgentView.vue
@@ -20,7 +20,10 @@
             :key="name"
             :value="name"
           >
-            {{ agent.name }}
+            <div class="agent-option">
+              {{ agent.name }}
+              <StarFilled v-if="name === defaultAgentId" class="default-icon" />
+            </div>
           </a-select-option>
         </a-select>
         <p style="padding: 0 4px;">
@@ -45,6 +48,16 @@
             访问令牌
           </a-button>
 
+          <a-button
+            class="action-button primary-action"
+            @click="setAsDefaultAgent"
+            v-if="selectedAgentId && userStore.isAdmin"
+            :disabled="isDefaultAgent"
+          >
+            <template #icon><StarOutlined /></template>
+            {{ isDefaultAgent ? '当前为默认智能体' : '设为默认智能体' }}
+          </a-button>
+
           <a-button
             class="action-button"
             @click="goToAgentPage"
@@ -213,19 +226,27 @@ import {
   CloseOutlined,
   SettingOutlined,
   KeyOutlined,
-  LinkOutlined
+  LinkOutlined,
+  StarOutlined,
+  StarFilled
 } from '@ant-design/icons-vue';
 import { message } from 'ant-design-vue';
 import AgentChatComponent from '@/components/AgentChatComponent.vue';
 import TokenManagerComponent from '@/components/TokenManagerComponent.vue';
+import UserInfoComponent from '@/components/UserInfoComponent.vue';
+import { useUserStore } from '@/stores/user';
+import { chatApi } from '@/apis/auth_api';
+import { systemConfigApi } from '@/apis/admin_api';
 
 // 路由
 const router = useRouter();
+const userStore = useUserStore();
 
 // 状态
 const agents = ref({});
 const selectedAgentId = ref(null);
 const availableTools = ref([]); // 存储所有可用的工具列表
+const defaultAgentId = ref(null); // 存储默认智能体ID
 const state = reactive({
   debug_mode: false,
   isSidebarOpen: JSON.parse(localStorage.getItem('agent-sidebar-open') || 'true'),
@@ -243,50 +264,50 @@ const configurableItems = computed(() => configSchema.value.configurable_items |
 // 配置状态
 const agentConfig = ref({});
 
-// 调试模式
-const toggleDebugMode = () => {
-  state.debug_mode = !state.debug_mode;
-};
-
-// 打开配置弹窗
-const openConfigModal = () => {
-  state.configModalVisible = true;
-};
+// 检查是否为默认智能体
+const isDefaultAgent = computed(() => {
+  return selectedAgentId.value === defaultAgentId.value;
+});
 
-// 关闭配置弹窗
-const closeConfigModal = () => {
-  state.configModalVisible = false;
-};
+// 设置为默认智能体
+const setAsDefaultAgent = async () => {
+  if (!selectedAgentId.value || !userStore.isAdmin) return;
 
-// 打开令牌管理弹窗
-const openTokenModal = () => {
-  state.tokenModalVisible = true;
+  try {
+    await systemConfigApi.setDefaultAgent(selectedAgentId.value);
+    defaultAgentId.value = selectedAgentId.value;
+    message.success('已将当前智能体设为默认');
+  } catch (error) {
+    console.error('设置默认智能体错误:', error);
+    message.error(error.message || '设置默认智能体时发生错误');
+  }
 };
 
-// 关闭令牌管理弹窗
-const closeTokenModal = () => {
-  state.tokenModalVisible = false;
+// 获取默认智能体ID
+const fetchDefaultAgent = async () => {
+  try {
+    const data = await chatApi.getDefaultAgent();
+    defaultAgentId.value = data.default_agent_id;
+    console.log("Default agent ID:", defaultAgentId.value);
+  } catch (error) {
+    console.error('获取默认智能体错误:', error);
+  }
 };
 
 // 获取智能体列表
 const fetchAgents = async () => {
   try {
-    const response = await fetch('/api/chat/agent');
-    if (response.ok) {
-      const data = await response.json();
-      // 将数组转换为对象
-      agents.value = data.agents.reduce((acc, agent) => {
-        acc[agent.name] = agent;
-        return acc;
-      }, {});
-      // console.log("agents", agents.value);
-
-      // 加载当前选中智能体的配置
-      if (selectedAgentId.value) {
-        loadAgentConfig();
-      }
-    } else {
-      console.error('获取智能体失败');
+    const data = await chatApi.getAgents();
+    // 将数组转换为对象
+    agents.value = data.agents.reduce((acc, agent) => {
+      acc[agent.name] = agent;
+      return acc;
+    }, {});
+    // console.log("agents", agents.value);
+
+    // 加载当前选中智能体的配置
+    if (selectedAgentId.value) {
+      loadAgentConfig();
     }
   } catch (error) {
     console.error('获取智能体错误:', error);
@@ -296,14 +317,9 @@ const fetchAgents = async () => {
 // 获取所有可用工具
 const fetchTools = async () => {
   try {
-    const response = await fetch('/api/chat/tools');
-    if (response.ok) {
-      const data = await response.json();
-      availableTools.value = data.tools;
-      console.log("Available tools:", availableTools.value);
-    } else {
-      console.error('获取工具列表失败');
-    }
+    const data = await chatApi.getTools();
+    availableTools.value = data.tools;
+    console.log("Available tools:", availableTools.value);
   } catch (error) {
     console.error('获取工具列表错误:', error);
   }
@@ -420,6 +436,8 @@ const selectAgent = (agentId) => {
 
 // 初始化
 onMounted(async () => {
+  // 获取默认智能体
+  await fetchDefaultAgent();
   // 获取智能体列表
   await fetchAgents();
   // 获取工具列表
@@ -429,6 +447,9 @@ onMounted(async () => {
   const lastSelectedAgent = localStorage.getItem('last-selected-agent');
   if (lastSelectedAgent && agents.value[lastSelectedAgent]) {
     selectedAgentId.value = lastSelectedAgent;
+  } else if (defaultAgentId.value && agents.value[defaultAgentId.value]) {
+    // 如果有默认智能体，优先选择默认智能体
+    selectedAgentId.value = defaultAgentId.value;
   } else if (Object.keys(agents.value).length > 0) {
     // 默认选择第一个智能体
     selectedAgentId.value = Object.keys(agents.value)[0];
@@ -484,6 +505,31 @@ const toggleTool = (tool, checked) => {
     agentConfig.value.tools = agentConfig.value.tools.filter(item => item !== tool);
   }
 };
+
+// 调试模式
+const toggleDebugMode = () => {
+  state.debug_mode = !state.debug_mode;
+};
+
+// 打开配置弹窗
+const openConfigModal = () => {
+  state.configModalVisible = true;
+};
+
+// 关闭配置弹窗
+const closeConfigModal = () => {
+  state.configModalVisible = false;
+};
+
+// 打开令牌管理弹窗
+const openTokenModal = () => {
+  state.tokenModalVisible = true;
+};
+
+// 关闭令牌管理弹窗
+const closeTokenModal = () => {
+  state.tokenModalVisible = false;
+};
 </script>
 
 <style lang="less" scoped>
@@ -752,11 +798,34 @@ const toggleTool = (tool, checked) => {
     background-color: var(--main-light-4);
   }
 
+  &.primary-action {
+    color: var(--main-color);
+    border-color: var(--main-color);
+
+    &:disabled {
+      color: var(--main-600);
+      background-color: var(--main-light-4);
+      cursor: not-allowed;
+      opacity: 0.7;
+    }
+  }
+
   .anticon {
     margin-right: 8px;
   }
 }
 
+.agent-option {
+  display: flex;
+  justify-content: space-between;
+  align-items: center;
+
+  .default-icon {
+    color: #faad14;
+    font-size: 14px;
+  }
+}
+
 .tools-switches {
   display: flex;
   flex-direction: column;
diff --git a/web/src/views/DataBaseInfoView.vue b/web/src/views/DataBaseInfoView.vue
index 119054dca..39ec9c67d 100644
--- a/web/src/views/DataBaseInfoView.vue
+++ b/web/src/views/DataBaseInfoView.vue
@@ -286,6 +286,8 @@ import { onMounted, reactive, ref, watch, toRaw, onUnmounted, computed } from 'v
 import { message, Modal } from 'ant-design-vue';
 import { useRoute, useRouter } from 'vue-router';
 import { useConfigStore } from '@/stores/config'
+import { useUserStore } from '@/stores/user'
+import { knowledgeBaseApi } from '@/apis/admin_api'
 import HeaderComponent from '@/components/HeaderComponent.vue';
 import {
   ReadOutlined,
@@ -449,7 +451,6 @@ const handleRefresh = () => {
 }
 
 const deleteDatabse = () => {
-
   Modal.confirm({
     title: '删除数据库',
     content: '确定要删除该数据库吗？',
@@ -457,28 +458,19 @@ const deleteDatabse = () => {
     cancelText: '取消',
     onOk: () => {
       state.lock = true
-      fetch(`/api/data/?db_id=${databaseId.value}`, {
-        method: "DELETE",
-        headers: {
-          "Content-Type": "application/json"
-        },
-        body: JSON.stringify({
-          db_id: databaseId.value
-        }),
-      })
-      .then(response => response.json())
-      .then(data => {
-        console.log(data)
-        message.success(data.message)
-        router.push('/database')
-      })
-      .catch(error => {
-        console.error(error)
-        message.error(error.message)
-      })
-      .finally(() => {
-        state.lock = false
-      })
+      knowledgeBaseApi.deleteDatabase(databaseId.value)
+        .then(data => {
+          console.log(data)
+          message.success(data.message || '删除成功')
+          router.push('/database')
+        })
+        .catch(error => {
+          console.error(error)
+          message.error(error.message || '删除失败')
+        })
+        .finally(() => {
+          state.lock = false
+        })
     },
     onCancel: () => {
       console.log('Cancel');
@@ -537,17 +529,14 @@ const getDatabaseInfo = () => {
   }
   state.lock = true
   return new Promise((resolve, reject) => {
-    fetch(`/api/data/info?db_id=${db_id}`, {
-      method: "GET",
-    })
-      .then(response => response.json())
+    knowledgeBaseApi.getDatabaseInfo(db_id)
       .then(data => {
         database.value = data
         resolve(data)
       })
       .catch(error => {
         console.error(error)
-        message.error(error.message)
+        message.error(error.message || '获取数据库信息失败')
         reject(error)
       })
       .finally(() => {
@@ -565,30 +554,20 @@ const deleteFile = (fileId) => {
     okText: '确认',
     cancelText: '取消',
     onOk: () => {
-        state.lock = true
-        fetch('/api/data/document', {
-          method: "DELETE",
-          headers: {
-            "Content-Type": "application/json"  // 添加 Content-Type 头
-          },
-          body: JSON.stringify({
-            db_id: databaseId.value,
-            file_id: fileId
-          }),
+      state.lock = true
+      knowledgeBaseApi.deleteFile(databaseId.value, fileId)
+        .then(data => {
+          console.log(data)
+          message.success(data.message || '删除成功')
+          getDatabaseInfo()
+        })
+        .catch(error => {
+          console.error(error)
+          message.error(error.message || '删除失败')
+        })
+        .finally(() => {
+          state.lock = false
         })
-          .then(response => response.json())
-          .then(data => {
-            console.log(data)
-            message.success(data.message)
-            getDatabaseInfo()
-          })
-          .catch(error => {
-            console.error(error)
-              message.error(error.message)
-            })
-            .finally(() => {
-              state.lock = false
-            })
     },
     onCancel: () => {
       console.log('Cancel');
diff --git a/web/src/views/DataBaseView.vue b/web/src/views/DataBaseView.vue
index a47328b56..8489f1318 100644
--- a/web/src/views/DataBaseView.vue
+++ b/web/src/views/DataBaseView.vue
@@ -1,9 +1,6 @@
 <template>
   <div class="database-container layout-container" v-if="configStore.config.enable_knowledge_base">
-    <HeaderComponent
-      title="文档知识库"
-      description="知识型数据库，主要是非结构化的文本组成，使用向量检索使用。如果出现问题，可以检查 saves/data/database.json 查看配置。"
-    >
+    <HeaderComponent title="文档知识库">
       <template #actions>
         <a-button type="primary" @click="newDatabase.open=true">新建知识库</a-button>
       </template>
@@ -92,13 +89,16 @@ import { useRouter, useRoute } from 'vue-router';
 import { message, Button } from 'ant-design-vue'
 import { ReadFilled, PlusOutlined, AppstoreFilled, LoadingOutlined } from '@ant-design/icons-vue'
 import { useConfigStore } from '@/stores/config';
+import { useUserStore } from '@/stores/user';
 import HeaderComponent from '@/components/HeaderComponent.vue';
+import { knowledgeBaseApi } from '@/apis/admin_api';
 
 const route = useRoute()
 const router = useRouter()
 const databases = ref([])
 const graph = ref(null)
 const graphloading = ref(false)
+const userStore = useUserStore()
 
 const indicator = h(LoadingOutlined, {spin: true});
 const configStore = useConfigStore()
@@ -112,15 +112,17 @@ const newDatabase = reactive({
 
 const loadDatabases = () => {
   // loadGraph()
-  fetch('/api/data/', {
-    method: "GET",
-  })
-    .then(response => response.json())
+  knowledgeBaseApi.getDatabases()
     .then(data => {
       console.log(data)
       databases.value = data.databases
-    }
-  )
+    })
+    .catch(error => {
+      console.error('加载数据库列表失败:', error);
+      if (error.message.includes('权限')) {
+        message.error('需要管理员权限访问知识库')
+      }
+    })
 }
 
 const createDatabase = () => {
@@ -131,18 +133,12 @@ const createDatabase = () => {
     newDatabase.loading = false
     return
   }
-  fetch('/api/data/', {
-    method: "POST",
-    headers: {
-      'Content-Type': 'application/json'
-    },
-    body: JSON.stringify({
-      database_name: newDatabase.name,
-      description: newDatabase.description,
-      dimension: newDatabase.dimension ? parseInt(newDatabase.dimension) : null,
-    })
+
+  knowledgeBaseApi.createDatabase({
+    database_name: newDatabase.name,
+    description: newDatabase.description,
+    dimension: newDatabase.dimension ? parseInt(newDatabase.dimension) : null,
   })
-  .then(response => response.json())
   .then(data => {
     console.log(data)
     loadDatabases()
@@ -150,6 +146,11 @@ const createDatabase = () => {
     newDatabase.name = ''
     newDatabase.description = '',
     newDatabase.dimension = ''
+    message.success('创建成功')
+  })
+  .catch(error => {
+    console.error('创建数据库失败:', error)
+    message.error(error.message || '创建失败')
   })
   .finally(() => {
     newDatabase.loading = false
diff --git a/web/src/views/GraphView.vue b/web/src/views/GraphView.vue
index 08f84e441..a0448a9e0 100644
--- a/web/src/views/GraphView.vue
+++ b/web/src/views/GraphView.vue
@@ -91,11 +91,14 @@ import { Graph } from "@antv/g6";
 import { computed, onMounted, reactive, ref } from 'vue';
 import { message, Button as AButton } from 'ant-design-vue';
 import { useConfigStore } from '@/stores/config';
+import { useUserStore } from '@/stores/user';
 import { UploadOutlined, SyncOutlined } from '@ant-design/icons-vue';
 import HeaderComponent from '@/components/HeaderComponent.vue';
+import { graphApi } from '@/apis/admin_api';
 
-const configStore = useConfigStore()
-const cur_embed_model = computed(() => configStore.config?.embed_model_names?.[configStore.config?.embed_model]?.name || '')
+const configStore = useConfigStore();
+const userStore = useUserStore();
+const cur_embed_model = computed(() => configStore.config?.embed_model_names?.[configStore.config?.embed_model]?.name || '');
 const modelMatched = computed(() => !graphInfo?.value?.embed_model_name || graphInfo.value.embed_model_name === cur_embed_model.value)
 const disabled = computed(() => state.precessing || !modelMatched.value)
 
@@ -127,10 +130,7 @@ const unindexedCount = computed(() => {
 
 const loadGraphInfo = () => {
   state.loadingGraphInfo = true
-  fetch('/api/data/graph', {
-    method: "GET",
-  })
-    .then(response => response.json())
+  graphApi.getGraphInfo()
     .then(data => {
       console.log(data)
       graphInfo.value = data
@@ -138,7 +138,7 @@ const loadGraphInfo = () => {
     })
     .catch(error => {
       console.error(error)
-      message.error(error.message)
+      message.error(error.message || '加载图数据库信息失败')
       state.loadingGraphInfo = false
     })
 }
@@ -187,43 +187,25 @@ const getGraphData = () => {
 const addDocumentByFile = () => {
   state.precessing = true
   const files = fileList.value.filter(file => file.status === 'done').map(file => file.response.file_path)
-  fetch('/api/data/graph/add-by-jsonl', {
-    method: 'POST',
-    headers: {
-      "Content-Type": "application/json"  // 添加 Content-Type 头
-    },
-    body: JSON.stringify({
-      file_path: files[0]
-    }),
-  })
-  .then(response => response.json())
-  .then((data) => {
-    if (data.status === 'success') {
-      message.success(data.message);
-      state.showModal = false;
-    } else {
-      throw new Error(data.message);
-    }
-  })
-  .catch((error) => {
-    console.error(error)
-    message.error(error.message);
-  })
-  .finally(() => state.precessing = false)
+  graphApi.addByJsonl(files[0])
+    .then((data) => {
+      if (data.status === 'success') {
+        message.success(data.message);
+        state.showModal = false;
+      } else {
+        throw new Error(data.message);
+      }
+    })
+    .catch((error) => {
+      console.error(error)
+      message.error(error.message || '添加文件失败');
+    })
+    .finally(() => state.precessing = false)
 };
 
 const loadSampleNodes = () => {
   state.fetching = true
-  fetch(`/api/data/graph/nodes?kgdb_name=neo4j&num=${sampleNodeCount.value}`)
-    .then((res) => {
-      if (res.ok) {
-        return res.json();
-      } else if (configStore?.config && !configStore?.config.enable_knowledge_graph) {
-        throw new Error('请前往设置页面配置启用知识图谱')
-      } else {
-        throw new Error("加载失败");
-      }
-    })
+  graphApi.getNodes('neo4j', sampleNodeCount.value)
     .then((data) => {
       graphData.nodes = data.result.nodes
       graphData.edges = data.result.edges
@@ -231,7 +213,11 @@ const loadSampleNodes = () => {
       setTimeout(() => randerGraph(), 500)
     })
     .catch((error) => {
-      message.error(error.message);
+      console.error(error)
+      message.error(error.message || '加载节点失败');
+      if (configStore?.config && !configStore?.config.enable_knowledge_graph) {
+        message.error('请前往设置页面配置启用知识图谱')
+      }
     })
     .finally(() => state.fetching = false)
 }
@@ -243,10 +229,10 @@ const onSearch = () => {
   }
 
   if (graphInfo?.value?.embed_model_name !== cur_embed_model.value) {
-    if (!graphInfo?.value?.embed_model_name) {
-      message.error('请先上传文件(jsonl)')
-      return
-    }
+    // if (!graphInfo?.value?.embed_model_name) {
+    //   message.error('请先上传文件(jsonl)')
+    //   return
+    // }
 
     if (!confirm(`构建图数据库时向量模型为 ${graphInfo?.value?.embed_model_name}，当前向量模型为 ${cur_embed_model.value}，是否继续查询？`)) {
       return
@@ -259,15 +245,7 @@ const onSearch = () => {
   }
 
   state.searchLoading = true
-  fetch(`/api/data/graph/node?entity_name=${state.searchInput}`)
-    .then((res) => {
-      if (!res.ok) {
-        return res.json().then(errorData => {
-          throw new Error(errorData.message || `查询失败：${res.status} ${res.statusText}`);
-        });
-      }
-      return res.json();
-    })
+  graphApi.queryNode(state.searchInput)
     .then((data) => {
       if (!data.result || !data.result.nodes || !data.result.edges) {
         throw new Error('返回数据格式不正确');
@@ -283,7 +261,7 @@ const onSearch = () => {
     })
     .catch((error) => {
       console.error('查询错误:', error);
-      message.error(`查询出错：${error.message}`);
+      message.error(`查询出错：${error.message || '未知错误'}`);
     })
     .finally(() => state.searchLoading = false)
 };
@@ -393,35 +371,19 @@ const indexNodes = () => {
   }
 
   state.indexing = true;
-  fetch('/api/data/graph/index-nodes', {
-    method: 'POST',
-    headers: {
-      'Content-Type': 'application/json'
-    },
-    body: JSON.stringify({
-      kgdb_name: 'neo4j'
-    }),
-  })
-  .then(response => {
-    if (!response.ok) {
-      return response.json().then(errorData => {
-        throw new Error(errorData.detail || `请求失败：${response.status} ${response.statusText}`);
-      });
-    }
-    return response.json();
-  })
-  .then(data => {
-    message.success(data.message);
-    // 刷新图谱信息
-    loadGraphInfo();
-  })
-  .catch(error => {
-    console.error(error);
-    message.error(error.message || '添加索引失败');
-  })
-  .finally(() => {
-    state.indexing = false;
-  });
+  graphApi.indexNodes('neo4j')
+    .then(data => {
+      message.success(data.message || '索引添加成功');
+      // 刷新图谱信息
+      loadGraphInfo();
+    })
+    .catch(error => {
+      console.error(error);
+      message.error(error.message || '添加索引失败');
+    })
+    .finally(() => {
+      state.indexing = false;
+    });
 };
 
 </script>
diff --git a/web/src/views/HomeView.vue b/web/src/views/HomeView.vue
index 55e34ab19..ac116398b 100644
--- a/web/src/views/HomeView.vue
+++ b/web/src/views/HomeView.vue
@@ -51,15 +51,53 @@
 <script setup>
 import { ref, onMounted } from 'vue'
 import { useRouter } from 'vue-router'
+import { useUserStore } from '@/stores/user'
+import { chatApi } from '@/apis/auth_api'
 
 const title = ref('Yuxi-Know')
 const router = useRouter()
+const userStore = useUserStore()
 const githubStars = ref(0)
 const isLoadingStars = ref(false)
 
-const goToChat = () => {
-  router.push("/chat")
-}
+const goToChat = async () => {
+  // 检查用户是否登录
+  if (!userStore.isLoggedIn) {
+    // 登录后应该跳转到默认智能体而不是/agent
+    sessionStorage.setItem('redirect', '/');  // 设置为首页，登录后会通过路由守卫处理重定向
+    router.push('/login');
+    return;
+  }
+
+  // 根据用户角色进行跳转
+  if (userStore.isAdmin) {
+    // 管理员用户跳转到聊天页面
+    router.push('/chat');
+    return;
+  }
+
+  // 普通用户跳转到默认智能体
+  try {
+    // 获取默认智能体
+    const data = await chatApi.getDefaultAgent();
+    if (data.default_agent_id) {
+      // 使用后端设置的默认智能体
+      router.push(`/agent/${data.default_agent_id}`);
+    } else {
+      // 如果没有设置默认智能体，则获取智能体列表选择第一个
+      const agentData = await chatApi.getAgents();
+      if (agentData.agents && agentData.agents.length > 0) {
+        router.push(`/agent/${agentData.agents[0].name}`);
+      } else {
+        // 没有可用智能体，回退到chat页面
+        router.push("/chat");
+      }
+    }
+  } catch (error) {
+    console.error('跳转到智能体页面失败:', error);
+    router.push("/chat");
+  }
+};
 
 // 获取GitHub stars数量
 const fetchGithubStars = async () => {
diff --git a/web/src/views/LoginView.vue b/web/src/views/LoginView.vue
new file mode 100644
index 000000000..26922784b
--- /dev/null
+++ b/web/src/views/LoginView.vue
@@ -0,0 +1,303 @@
+<template>
+  <div class="login-view">
+    <div class="login-container">
+      <div class="login-logo">
+        <img src="@/assets/logo.png" alt="Logo" v-if="false" />
+        <h1>知识库管理系统</h1>
+      </div>
+
+      <!-- 初始化管理员表单 -->
+      <div v-if="isFirstRun" class="login-form">
+        <h2>系统初始化</h2>
+        <p class="init-desc">系统首次运行，请创建超级管理员账户：</p>
+
+        <a-form
+          :model="adminForm"
+          @finish="handleInitialize"
+          layout="vertical"
+        >
+          <a-form-item
+            label="用户名"
+            name="username"
+            :rules="[{ required: true, message: '请输入用户名' }]"
+          >
+            <a-input v-model:value="adminForm.username" />
+          </a-form-item>
+
+          <a-form-item
+            label="密码"
+            name="password"
+            :rules="[{ required: true, message: '请输入密码' }]"
+          >
+            <a-input-password v-model:value="adminForm.password" />
+          </a-form-item>
+
+          <a-form-item
+            label="确认密码"
+            name="confirmPassword"
+            :rules="[
+              { required: true, message: '请确认密码' },
+              { validator: validateConfirmPassword }
+            ]"
+          >
+            <a-input-password v-model:value="adminForm.confirmPassword" />
+          </a-form-item>
+
+          <a-form-item>
+            <a-button type="primary" html-type="submit" :loading="loading" block>创建管理员账户</a-button>
+          </a-form-item>
+        </a-form>
+      </div>
+
+      <!-- 登录表单 -->
+      <div v-else class="login-form">
+        <h2>用户登录</h2>
+
+        <a-form
+          :model="loginForm"
+          @finish="handleLogin"
+          layout="vertical"
+        >
+          <a-form-item
+            label="用户名"
+            name="username"
+            :rules="[{ required: true, message: '请输入用户名' }]"
+          >
+            <a-input v-model:value="loginForm.username" />
+          </a-form-item>
+
+          <a-form-item
+            label="密码"
+            name="password"
+            :rules="[{ required: true, message: '请输入密码' }]"
+          >
+            <a-input-password v-model:value="loginForm.password" />
+          </a-form-item>
+
+          <a-form-item>
+            <a-button type="primary" html-type="submit" :loading="loading" block>登录</a-button>
+          </a-form-item>
+        </a-form>
+      </div>
+
+      <!-- 错误提示 -->
+      <div v-if="errorMessage" class="error-message">
+        {{ errorMessage }}
+      </div>
+    </div>
+  </div>
+</template>
+
+<script setup>
+import { ref, reactive, onMounted } from 'vue';
+import { useRouter } from 'vue-router';
+import { useUserStore } from '@/stores/user';
+import { message } from 'ant-design-vue';
+import { chatApi } from '@/apis/auth_api';
+import { authApi } from '@/apis/public_api';
+
+const router = useRouter();
+const userStore = useUserStore();
+
+// 状态
+const isFirstRun = ref(false);
+const loading = ref(false);
+const errorMessage = ref('');
+
+// 登录表单
+const loginForm = reactive({
+  username: '',
+  password: ''
+});
+
+// 管理员初始化表单
+const adminForm = reactive({
+  username: '',
+  password: '',
+  confirmPassword: ''
+});
+
+// 密码确认验证
+const validateConfirmPassword = (rule, value) => {
+  if (value === '') {
+    return Promise.reject('请确认密码');
+  }
+  if (value !== adminForm.password) {
+    return Promise.reject('两次输入的密码不一致');
+  }
+  return Promise.resolve();
+};
+
+// 处理登录
+const handleLogin = async () => {
+  try {
+    loading.value = true;
+    errorMessage.value = '';
+
+    await userStore.login({
+      username: loginForm.username,
+      password: loginForm.password
+    });
+
+    message.success('登录成功');
+
+    // 获取重定向路径
+    const redirectPath = sessionStorage.getItem('redirect') || '/';
+    sessionStorage.removeItem('redirect'); // 清除重定向信息
+    
+    // 根据用户角色决定重定向目标
+    if (redirectPath === '/') {
+      // 如果是管理员，直接跳转到/chat页面
+      if (userStore.isAdmin) {
+        router.push('/chat');
+        return;
+      }
+      
+      // 普通用户跳转到默认智能体
+      try {
+        // 尝试获取默认智能体
+        const data = await chatApi.getDefaultAgent();
+        if (data.default_agent_id) {
+          // 如果存在默认智能体，直接跳转
+          router.push(`/agent/${data.default_agent_id}`);
+          return;
+        }
+        
+        // 没有默认智能体，获取第一个可用智能体
+        const agentData = await chatApi.getAgents();
+        if (agentData.agents && agentData.agents.length > 0) {
+          router.push(`/agent/${agentData.agents[0].name}`);
+          return;
+        }
+        
+        // 没有可用智能体，回退到首页
+        router.push('/');
+      } catch (error) {
+        console.error('获取智能体信息失败:', error);
+        router.push('/');
+      }
+    } else {
+      // 跳转到其他预设的路径
+      router.push(redirectPath);
+    }
+  } catch (error) {
+    console.error('登录失败:', error);
+    errorMessage.value = error.message || '登录失败，请检查用户名和密码';
+  } finally {
+    loading.value = false;
+  }
+};
+
+// 处理初始化管理员
+const handleInitialize = async () => {
+  try {
+    loading.value = true;
+    errorMessage.value = '';
+
+    if (adminForm.password !== adminForm.confirmPassword) {
+      errorMessage.value = '两次输入的密码不一致';
+      return;
+    }
+
+    await userStore.initialize({
+      username: adminForm.username,
+      password: adminForm.password
+    });
+
+    message.success('管理员账户创建成功');
+    router.push('/');
+  } catch (error) {
+    console.error('初始化失败:', error);
+    errorMessage.value = error.message || '初始化失败，请重试';
+  } finally {
+    loading.value = false;
+  }
+};
+
+// 检查是否是首次运行
+const checkFirstRunStatus = async () => {
+  try {
+    loading.value = true;
+    const isFirst = await userStore.checkFirstRun();
+    isFirstRun.value = isFirst;
+  } catch (error) {
+    console.error('检查首次运行状态失败:', error);
+    errorMessage.value = '系统出错，请稍后重试';
+  } finally {
+    loading.value = false;
+  }
+};
+
+// 组件挂载时
+onMounted(async () => {
+  // 如果已登录，跳转到首页
+  if (userStore.isLoggedIn) {
+    router.push('/');
+    return;
+  }
+
+  // 检查是否是首次运行
+  await checkFirstRunStatus();
+});
+</script>
+
+<style lang="less" scoped>
+.login-view {
+  height: 100vh;
+  width: 100%;
+  display: flex;
+  justify-content: center;
+  align-items: center;
+  background-color: #f5f5f5;
+}
+
+.login-container {
+  width: 400px;
+  padding: 40px;
+  background-color: white;
+  border-radius: 8px;
+  box-shadow: 0 4px 12px rgba(0, 0, 0, 0.1);
+}
+
+.login-logo {
+  text-align: center;
+  margin-bottom: 30px;
+
+  img {
+    height: 60px;
+    margin-bottom: 16px;
+  }
+
+  h1 {
+    font-size: 24px;
+    font-weight: 600;
+    color: #333;
+    margin: 0;
+  }
+}
+
+.login-form {
+  h2 {
+    text-align: center;
+    margin-bottom: 24px;
+    font-size: 20px;
+    font-weight: 500;
+  }
+}
+
+.init-desc {
+  margin-bottom: 24px;
+  color: #666;
+  text-align: center;
+}
+
+.error-message {
+  margin-top: 16px;
+  padding: 8px 12px;
+  background-color: #fff2f0;
+  border: 1px solid #ffccc7;
+  border-radius: 4px;
+  color: #ff4d4f;
+  font-size: 14px;
+}
+</style>
\ No newline at end of file
diff --git a/web/src/views/SettingView.vue b/web/src/views/SettingView.vue
index d2fdb82c7..488e6b457 100644
--- a/web/src/views/SettingView.vue
+++ b/web/src/views/SettingView.vue
@@ -1,9 +1,7 @@
 <template>
   <div class="">
     <HeaderComponent title="设置" class="setting-header">
-      <template #description>
-        <p>配置文件也可以在 <code>saves/config/base.yaml</code> 中修改</p>
-      </template>
+
       <template #actions>
         <a-button :type="isNeedRestart ? 'primary' : 'default'" @click="sendRestart" :icon="h(ReloadOutlined)">
           {{ isNeedRestart ? '需要刷新' : '重新加载' }}
@@ -15,6 +13,7 @@
         <a-button type="text" :class="{ activesec: state.section === 'base'}" @click="state.section='base'" :icon="h(SettingOutlined)"> 基本设置 </a-button>
         <a-button type="text" :class="{ activesec: state.section === 'model'}" @click="state.section='model'" :icon="h(CodeOutlined)"> 模型配置 </a-button>
         <a-button type="text" :class="{ activesec: state.section === 'path'}" @click="state.section='path'" :icon="h(FolderOutlined)"> 路径配置 </a-button>
+        <a-button type="text" :class="{ activesec: state.section === 'user'}" @click="state.section='user'" :icon="h(UserOutlined)" v-if="userStore.isAdmin"> 用户管理 </a-button>
       </div>
       <div class="setting" v-if="state.windowWidth <= 520 || state.section === 'base'">
         <h3>功能配置</h3>
@@ -222,6 +221,94 @@
           @update:config="handleModelLocalPathsUpdate"
         />
       </div>
+      <div class="setting" v-if="state.section === 'user'">
+        <div class="section-header">
+          <h2>用户管理</h2>
+          <a-button type="primary" @click="showAddUserModal">
+            <template #icon><PlusOutlined /></template>
+            添加用户
+          </a-button>
+        </div>
+
+        <a-spin :spinning="userManagement.loading">
+          <div v-if="userManagement.error" class="error-message">
+            {{ userManagement.error }}
+          </div>
+
+          <a-table
+            :dataSource="userManagement.users"
+            :columns="userColumns"
+            rowKey="id"
+            :pagination="{ pageSize: 10 }"
+          >
+            <!-- 角色列自定义渲染 -->
+            <template #bodyCell="{ column, record }">
+              <template v-if="column.key === 'role'">
+                <a-tag :color="getRoleColor(record.role)">{{ getRoleLabel(record.role) }}</a-tag>
+              </template>
+
+              <!-- 操作列 -->
+              <template v-if="column.key === 'action'">
+                <div class="table-actions">
+                  <a-button type="link" @click="showEditUserModal(record)">
+                    <EditOutlined />
+                  </a-button>
+                  <a-button
+                    type="link"
+                    danger
+                    @click="confirmDeleteUser(record)"
+                    :disabled="record.id === userStore.userId || (record.role === 'superadmin' && userStore.userRole !== 'superadmin')"
+                  >
+                    <DeleteOutlined />
+                  </a-button>
+                </div>
+              </template>
+            </template>
+          </a-table>
+        </a-spin>
+
+        <!-- 用户表单模态框 -->
+        <a-modal
+          v-model:visible="userManagement.modalVisible"
+          :title="userManagement.modalTitle"
+          @ok="handleUserFormSubmit"
+          :confirmLoading="userManagement.loading"
+          @cancel="userManagement.modalVisible = false"
+          :maskClosable="false"
+        >
+          <a-form layout="vertical">
+            <a-form-item label="用户名" required>
+              <a-input v-model:value="userManagement.form.username" placeholder="请输入用户名" />
+            </a-form-item>
+
+            <template v-if="userManagement.editMode">
+              <div class="password-toggle">
+                <a-checkbox @change="togglePasswordFields" v-model:checked="userManagement.displayPasswordFields">
+                  修改密码
+                </a-checkbox>
+              </div>
+            </template>
+
+            <template v-if="!userManagement.editMode || userManagement.displayPasswordFields">
+              <a-form-item label="密码" required>
+                <a-input-password v-model:value="userManagement.form.password" placeholder="请输入密码" />
+              </a-form-item>
+
+              <a-form-item label="确认密码" required>
+                <a-input-password v-model:value="userManagement.form.confirmPassword" placeholder="请再次输入密码" />
+              </a-form-item>
+            </template>
+
+            <a-form-item label="角色">
+              <a-select v-model:value="userManagement.form.role">
+                <a-select-option value="user">普通用户</a-select-option>
+                <a-select-option value="admin" v-if="userStore.isSuperAdmin">管理员</a-select-option>
+                <a-select-option value="superadmin" v-if="userStore.isSuperAdmin">超级管理员</a-select-option>
+              </a-select>
+            </a-form-item>
+          </a-form>
+        </a-modal>
+      </div>
     </div>
     <a-modal
       class="provider-config-modal"
@@ -270,6 +357,7 @@
 import { message } from 'ant-design-vue';
 import { computed, reactive, ref, h, watch, onMounted, onUnmounted } from 'vue'
 import { useConfigStore } from '@/stores/config';
+import { useUserStore } from '@/stores/user'
 import {
   ReloadOutlined,
   SettingOutlined,
@@ -284,6 +372,8 @@ import {
   LoadingOutlined,
   UpCircleOutlined,
   DownCircleOutlined,
+  UserOutlined,
+  PlusOutlined
 } from '@ant-design/icons-vue';
 import HeaderComponent from '@/components/HeaderComponent.vue';
 import TableConfigComponent from '@/components/TableConfigComponent.vue';
@@ -292,6 +382,7 @@ import { modelIcons } from '@/utils/modelIcon'
 
 
 const configStore = useConfigStore()
+const userStore = useUserStore()
 const items = computed(() => configStore.config._config_items)
 const modelNames = computed(() => configStore.config?.model_names)
 const modelStatus = computed(() => configStore.config?.model_provider_status)
@@ -321,6 +412,24 @@ const state = reactive({
   windowWidth: window?.innerWidth || 0
 })
 
+// 用户管理相关状态
+const userManagement = reactive({
+  loading: false,
+  users: [],
+  error: null,
+  modalVisible: false,
+  modalTitle: '添加用户',
+  editMode: false,
+  editUserId: null,
+  form: {
+    username: '',
+    password: '',
+    confirmPassword: '',
+    role: 'user' // 默认角色
+  },
+  displayPasswordFields: true, // 编辑时是否显示密码字段
+})
+
 // 筛选 modelStatus 中为真的key
 const modelKeys = computed(() => {
   return Object.keys(modelStatus.value || {}).filter(key => modelStatus.value?.[key])
@@ -578,6 +687,230 @@ const saveProviderConfig = async () => {
 const cancelProviderConfig = () => {
   providerConfig.visible = false;
 }
+
+// 获取用户列表
+const fetchUsers = async () => {
+  try {
+    userManagement.loading = true
+    const users = await userStore.getUsers()
+    userManagement.users = users
+    userManagement.error = null
+  } catch (error) {
+    console.error('获取用户列表失败:', error)
+    userManagement.error = '获取用户列表失败'
+  } finally {
+    userManagement.loading = false
+  }
+}
+
+// 打开添加用户模态框
+const showAddUserModal = () => {
+  userManagement.modalTitle = '添加用户'
+  userManagement.editMode = false
+  userManagement.editUserId = null
+  userManagement.form = {
+    username: '',
+    password: '',
+    confirmPassword: '',
+    role: 'user'  // 默认角色为普通用户
+  }
+  userManagement.displayPasswordFields = true
+  userManagement.modalVisible = true
+}
+
+// 打开编辑用户模态框
+const showEditUserModal = (user) => {
+  userManagement.modalTitle = '编辑用户'
+  userManagement.editMode = true
+  userManagement.editUserId = user.id
+  userManagement.form = {
+    username: user.username,
+    password: '',
+    confirmPassword: '',
+    role: user.role
+  }
+  userManagement.displayPasswordFields = true // 默认显示密码字段
+  userManagement.modalVisible = true
+}
+
+// 处理用户表单提交
+const handleUserFormSubmit = async () => {
+  try {
+    // 简单验证
+    if (!userManagement.form.username) {
+      notification.error({ message: '用户名不能为空' })
+      return
+    }
+
+    if (userManagement.displayPasswordFields) {
+      if (!userManagement.form.password) {
+        notification.error({ message: '密码不能为空' })
+        return
+      }
+
+      if (userManagement.form.password !== userManagement.form.confirmPassword) {
+        notification.error({ message: '两次输入的密码不一致' })
+        return
+      }
+    }
+
+    userManagement.loading = true
+
+    // 根据模式决定创建还是更新用户
+    if (userManagement.editMode) {
+      // 创建更新数据对象
+      const updateData = {
+        username: userManagement.form.username,
+        role: userManagement.form.role
+      }
+
+      // 如果显示了密码字段并且填写了密码，才更新密码
+      if (userManagement.displayPasswordFields && userManagement.form.password) {
+        updateData.password = userManagement.form.password
+      }
+
+      await userStore.updateUser(userManagement.editUserId, updateData)
+      notification.success({ message: '用户更新成功' })
+    } else {
+      await userStore.createUser({
+        username: userManagement.form.username,
+        password: userManagement.form.password,
+        role: userManagement.form.role
+      })
+      notification.success({ message: '用户创建成功' })
+    }
+
+    // 重新获取用户列表
+    await fetchUsers()
+    userManagement.modalVisible = false
+  } catch (error) {
+    console.error('用户操作失败:', error)
+    notification.error({
+      message: '操作失败',
+      description: error.message || '请稍后重试'
+    })
+  } finally {
+    userManagement.loading = false
+  }
+}
+
+// 切换是否显示密码字段（编辑用户时使用）
+const togglePasswordFields = () => {
+  userManagement.displayPasswordFields = !userManagement.displayPasswordFields
+  if (!userManagement.displayPasswordFields) {
+    userManagement.form.password = ''
+    userManagement.form.confirmPassword = ''
+  }
+}
+
+// 删除用户
+const confirmDeleteUser = (user) => {
+  // 自己不能删除自己
+  if (user.id === userStore.userId) {
+    notification.error({ message: '不能删除自己的账户' })
+    return
+  }
+
+  // 确认对话框
+  const { modal } = notification
+
+  modal.confirm({
+    title: '确认删除用户',
+    content: `确定要删除用户 "${user.username}" 吗？此操作不可撤销。`,
+    okText: '删除',
+    okType: 'danger',
+    cancelText: '取消',
+    async onOk() {
+      try {
+        userManagement.loading = true
+        await userStore.deleteUser(user.id)
+        notification.success({ message: '用户删除成功' })
+        // 重新获取用户列表
+        await fetchUsers()
+      } catch (error) {
+        console.error('删除用户失败:', error)
+        notification.error({
+          message: '删除失败',
+          description: error.message || '请稍后重试'
+        })
+      } finally {
+        userManagement.loading = false
+      }
+    }
+  })
+}
+
+// 在组件挂载时，如果选择了用户管理部分，则获取用户列表
+const loadUserManagement = async () => {
+  if (state.section === 'user') {
+    await fetchUsers()
+  }
+}
+
+// 监听部分切换
+watch(() => state.section, async (newSection) => {
+  if (newSection === 'user') {
+    await fetchUsers()
+  }
+})
+
+// 用户表格列定义
+const userColumns = [
+  {
+    title: 'ID',
+    dataIndex: 'id',
+    key: 'id',
+    width: 80
+  },
+  {
+    title: '用户名',
+    dataIndex: 'username',
+    key: 'username'
+  },
+  {
+    title: '角色',
+    dataIndex: 'role',
+    key: 'role',
+    width: 120
+  },
+  {
+    title: '创建时间',
+    dataIndex: 'created_at',
+    key: 'created_at',
+    width: 180
+  },
+  {
+    title: '最后登录',
+    dataIndex: 'last_login',
+    key: 'last_login',
+    width: 180
+  },
+  {
+    title: '操作',
+    key: 'action',
+    width: 120
+  }
+]
+
+// 角色显示辅助函数
+const getRoleLabel = (role) => {
+  switch (role) {
+    case 'superadmin': return '超级管理员'
+    case 'admin': return '管理员'
+    case 'user': return '普通用户'
+    default: return role
+  }
+}
+
+// 角色标签颜色
+const getRoleColor = (role) => {
+  switch (role) {
+    case 'superadmin': return 'red'
+    case 'admin': return 'blue'
+    case 'user': return 'green'
+    default: return 'default'
+  }
+}
 </script>
 
 <style lang="less" scoped>

From a20143b09c3f5d4de798020ecbed18cf6f1fc0dc Mon Sep 17 00:00:00 2001
From: Wenjie Zhang <xerrors@163.com>
Date: Fri, 2 May 2025 23:59:34 +0800
Subject: [PATCH 02/10] star

---
 web/src/layouts/AppLayout.vue | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/web/src/layouts/AppLayout.vue b/web/src/layouts/AppLayout.vue
index e29115ce1..898218e1b 100644
--- a/web/src/layouts/AppLayout.vue
+++ b/web/src/layouts/AppLayout.vue
@@ -169,7 +169,7 @@ const mainList = [{
           <a href="https://github.com/xerrors/Yuxi-Know" target="_blank" class="github-link">
             <GithubOutlined class="icon" style="color: #222;"/>
             <span v-if="githubStars > 0" class="github-stars">
-            <span class="star-count">{{ githubStars }}</span>
+              <span class="star-count">{{ githubStars.toFixed(1) }}</span>
             </span>
           </a>
         </a-tooltip>

From 1213cd58d2311c40be79a0c1bf668fad1cf30acd Mon Sep 17 00:00:00 2001
From: Wenjie Zhang <xerrors@163.com>
Date: Sun, 4 May 2025 21:04:01 +0800
Subject: [PATCH 03/10] =?UTF-8?q?=E7=BB=9F=E4=B8=80=E5=89=8D=E7=AB=AF?=
 =?UTF-8?q?=E5=AF=B9=E4=BA=8E=E6=8E=A5=E5=8F=A3=E7=9A=84=E4=BD=BF=E7=94=A8?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 README.md                                     |   6 +
 server/utils/auth_middleware.py               |  26 +-
 web/src/apis/admin_api.js                     |  23 +-
 web/src/apis/auth_api.js                      |  49 +++-
 web/src/apis/base.js                          |  46 +--
 web/src/apis/index.js                         |  10 +-
 web/src/apis/public_api.js                    |   4 +-
 web/src/components/AgentChatComponent.vue     |  13 +-
 web/src/components/ChatComponent.vue          |  80 +++--
 web/src/components/DebugComponent.vue         |  42 ++-
 web/src/components/UserInfoComponent.vue      |  35 ++-
 .../tools/ConvertToTxtComponent.vue           | 183 ------------
 .../tools/TextChunkingComponent.vue           | 276 ------------------
 web/src/layouts/AppLayout.vue                 |  23 +-
 web/src/router/index.js                       |  11 +-
 web/src/views/AgentSingleView.vue             |  24 +-
 web/src/views/AgentView.vue                   |  19 +-
 web/src/views/DataBaseInfoView.vue            | 108 ++++---
 web/src/views/DataBaseView.vue                |  10 +-
 web/src/views/HomeView.vue                    |   2 +-
 web/src/views/SettingView.vue                 |  23 +-
 web/src/views/ToolsView.vue                   | 111 -------
 22 files changed, 352 insertions(+), 772 deletions(-)
 delete mode 100644 web/src/components/tools/ConvertToTxtComponent.vue
 delete mode 100644 web/src/components/tools/TextChunkingComponent.vue
 delete mode 100644 web/src/views/ToolsView.vue

diff --git a/README.md b/README.md
index cf3984469..53784b014 100644
--- a/README.md
+++ b/README.md
@@ -12,6 +12,12 @@
 
 ## 📝 项目概述
 
+DEV 更新待办：
+
+- 智能体的消息加载有问题
+- 智能体的管理员的配置无法更新到用户层面
+
+
 语析是一个强大的问答平台，结合了大模型 RAG 知识库与知识图谱技术，基于 Llamaindex + VueJS + FastAPI + Neo4j 构建。
 
 **核心特点：**
diff --git a/server/utils/auth_middleware.py b/server/utils/auth_middleware.py
index 692f872fb..f78aa1d20 100644
--- a/server/utils/auth_middleware.py
+++ b/server/utils/auth_middleware.py
@@ -59,6 +59,14 @@ async def get_current_user(token: Optional[str] = Depends(oauth2_scheme), db: Se
             raise credentials_exception
     except JWTError:
         raise credentials_exception
+    except ValueError as e:
+        # 捕获AuthUtils.verify_access_token可能抛出的ValueError
+        # 例如令牌过期或无效
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail=str(e),  # 将错误信息直接传递给客户端
+            headers={"WWW-Authenticate": "Bearer"},
+        )
 
     # 查找用户
     user = db.query(User).filter(User.id == user_id).first()
@@ -108,7 +116,15 @@ def is_public_path(path: str) -> bool:
     r"^/admin/.*$",              # 管理员接口
     r"^/data/.*$",               # 数据操作接口，所有数据操作都需要管理员权限
     r"^/chat/set_default_agent$", # 设置默认智能体
-    r"^/chat/models/update$"      # 更新模型列表
+    r"^/chat/models/update$",     # 更新模型列表
+    r"^/auth/users.*$",           # 用户管理相关API
+    r"^/config$"                  # 系统配置API
+]
+
+# 路径是否需要超级管理员权限
+SUPERADMIN_PATHS = [
+    r"^/restart$",                # 系统重启
+    r"^/auth/users/\d+/role$"     # 修改用户角色（仅超级管理员可操作）
 ]
 
 # 检查路径是否需要管理员权限
@@ -117,4 +133,12 @@ def is_admin_path(path: str) -> bool:
     for pattern in ADMIN_PATHS:
         if re.match(pattern, path):
             return True
+    return False
+
+# 检查路径是否需要超级管理员权限
+def is_superadmin_path(path: str) -> bool:
+    path = path.rstrip('/')  # 去除尾部斜杠以便于匹配
+    for pattern in SUPERADMIN_PATHS:
+        if re.match(pattern, path):
+            return True
     return False
\ No newline at end of file
diff --git a/web/src/apis/admin_api.js b/web/src/apis/admin_api.js
index 5b4177cea..9e2985242 100644
--- a/web/src/apis/admin_api.js
+++ b/web/src/apis/admin_api.js
@@ -5,7 +5,7 @@ import { useUserStore } from '@/stores/user'
  * 管理员API模块
  * 只有管理员和超级管理员可以访问的API
  * 权限要求: admin 或 superadmin
- * 
+ *
  * 注意: 请确保在使用这些API之前检查用户是否具有管理员权限
  */
 
@@ -50,7 +50,7 @@ export const userManagementApi = {
 
   /**
    * 更新用户
-   * @param {number} userId - 用户ID 
+   * @param {number} userId - 用户ID
    * @param {Object} userData - 用户数据
    * @returns {Promise} - 更新结果
    */
@@ -137,7 +137,7 @@ export const knowledgeBaseApi = {
 
   /**
    * 删除知识库
-   * @param {string} dbId - 知识库ID 
+   * @param {string} dbId - 知识库ID
    * @returns {Promise} - 删除结果
    */
   deleteDatabase: async (dbId) => {
@@ -165,7 +165,7 @@ export const knowledgeBaseApi = {
   /**
    * 删除文件
    * @param {string} dbId - 知识库ID
-   * @param {string} fileId - 文件ID 
+   * @param {string} fileId - 文件ID
    * @returns {Promise} - 删除结果
    */
   deleteFile: async (dbId, fileId) => {
@@ -204,6 +204,17 @@ export const knowledgeBaseApi = {
     checkAdminPermission()
     return apiPost('/api/data/query-test', data, {}, true)
   },
+
+  /**
+   * 获取文档详情
+   * @param {string} dbId - 知识库ID
+   * @param {string} fileId - 文件ID
+   * @returns {Promise} - 文档详情
+   */
+  getDocumentDetail: async (dbId, fileId) => {
+    checkAdminPermission()
+    return apiGet(`/api/data/document?db_id=${dbId}&file_id=${fileId}`, {}, true)
+  }
 }
 
 // 图数据库管理API
@@ -309,6 +320,6 @@ export const logApi = {
    */
   getLogs: async (params = {}) => {
     checkAdminPermission()
-    return apiGet('/api/admin/logs', { params }, true)
+    return apiGet('/api/log', { params }, true)
   },
-} 
\ No newline at end of file
+}
\ No newline at end of file
diff --git a/web/src/apis/auth_api.js b/web/src/apis/auth_api.js
index f971d5c7e..920108208 100644
--- a/web/src/apis/auth_api.js
+++ b/web/src/apis/auth_api.js
@@ -1,4 +1,5 @@
 import { apiGet, apiPost, apiDelete } from './base'
+import { useUserStore } from '@/stores/user'
 
 /**
  * 需要用户认证的API模块
@@ -10,7 +11,7 @@ import { apiGet, apiPost, apiDelete } from './base'
 export const chatApi = {
   /**
    * 发送聊天消息
-   * @param {Object} params - 聊天参数 
+   * @param {Object} params - 聊天参数
    * @returns {Promise} - 聊天响应流
    */
   sendMessage: (params) => {
@@ -18,11 +19,47 @@ export const chatApi = {
       method: 'POST',
       headers: {
         'Content-Type': 'application/json',
+        ...useUserStore().getAuthHeaders()
       },
       body: JSON.stringify(params),
     })
   },
 
+  /**
+   * 发送可中断的聊天消息
+   * @param {Object} params - 聊天参数
+   * @param {AbortSignal} signal - 用于中断请求的信号控制器
+   * @returns {Promise} - 聊天响应流
+   */
+  sendMessageWithAbort: (params, signal) => {
+    return fetch('/api/chat/', {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        ...useUserStore().getAuthHeaders()
+      },
+      body: JSON.stringify(params),
+      signal // 添加 signal 用于中断请求
+    })
+  },
+
+  /**
+   * 发送聊天消息到指定智能体（流式响应）
+   * @param {string} agentId - 智能体ID
+   * @param {Object} data - 聊天数据
+   * @returns {Promise} - 聊天响应流
+   */
+  sendAgentMessage: (agentId, data) => {
+    return fetch(`/api/chat/agent/${agentId}`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        ...useUserStore().getAuthHeaders()
+      },
+      body: JSON.stringify(data)
+    })
+  },
+
   /**
    * 简单聊天调用（非流式）
    * @param {string} query - 查询内容
@@ -66,7 +103,7 @@ export const chatApi = {
    * @param {string} conversationId - 对话ID
    * @returns {Promise} - 对话详情
    */
-  getConversation: (conversationId) => 
+  getConversation: (conversationId) =>
     apiGet(`/api/chat/conversations/${conversationId}`, {}, true),
 
   /**
@@ -74,7 +111,7 @@ export const chatApi = {
    * @param {string} conversationId - 对话ID
    * @returns {Promise} - 删除结果
    */
-  deleteConversation: (conversationId) => 
+  deleteConversation: (conversationId) =>
     apiDelete(`/api/chat/conversations/${conversationId}`, {}, true),
 
   /**
@@ -83,7 +120,7 @@ export const chatApi = {
    * @param {string} title - 新标题
    * @returns {Promise} - 更新结果
    */
-  updateConversationTitle: (conversationId, title) => 
+  updateConversationTitle: (conversationId, title) =>
     apiPost(`/api/chat/conversations/${conversationId}/title`, { title }, {}, true),
 }
 
@@ -94,7 +131,7 @@ export const userSettingsApi = {
    * @returns {Promise} - 用户设置
    */
   getSettings: () => apiGet('/api/user/settings', {}, true),
-  
+
   /**
    * 更新用户设置
    * @param {Object} settings - 新设置
@@ -103,4 +140,4 @@ export const userSettingsApi = {
   updateSettings: (settings) => apiPost('/api/user/settings', settings, {}, true),
 }
 
-// 其他需要用户认证的API可以继续添加到这里 
\ No newline at end of file
+// 其他需要用户认证的API可以继续添加到这里
\ No newline at end of file
diff --git a/web/src/apis/base.js b/web/src/apis/base.js
index 78e4bdf82..5b403d8ae 100644
--- a/web/src/apis/base.js
+++ b/web/src/apis/base.js
@@ -30,19 +30,21 @@ export async function apiRequest(url, options = {}, requiresAuth = false) {
       if (!userStore.isLoggedIn) {
         throw new Error('用户未登录')
       }
-      
+
       Object.assign(requestOptions.headers, userStore.getAuthHeaders())
     }
 
     // 发送请求
     const response = await fetch(url, requestOptions)
-    
+
     // 处理API返回的错误
     if (!response.ok) {
       // 尝试解析错误信息
       let errorMessage = `请求失败: ${response.status}`
+      let errorData = null
+      
       try {
-        const errorData = await response.json()
+        errorData = await response.json()
         errorMessage = errorData.detail || errorData.message || errorMessage
       } catch (e) {
         // 如果无法解析JSON，使用默认错误信息
@@ -54,9 +56,19 @@ export async function apiRequest(url, options = {}, requiresAuth = false) {
         const userStore = useUserStore()
         if (userStore.isLoggedIn) {
           // 如果用户认为自己已登录，但收到401，则可能是令牌过期
-          message.error('登录已过期，请重新登录')
+          const isTokenExpired = errorData && 
+            (errorData.detail?.includes('令牌已过期') || 
+             errorData.detail?.includes('token expired') ||
+             errorMessage?.includes('令牌已过期') ||
+             errorMessage?.includes('token expired'))
+          
+          message.error(isTokenExpired ? '登录已过期，请重新登录' : '认证失败，请重新登录')
           userStore.logout()
-          window.location.href = '/login'
+          
+          // 使用setTimeout确保消息显示后再跳转
+          setTimeout(() => {
+            window.location.href = '/login'
+          }, 1500)
         }
         throw new Error('未授权，请先登录')
       } else if (response.status === 403) {
@@ -81,7 +93,7 @@ export async function apiRequest(url, options = {}, requiresAuth = false) {
 
 /**
  * 发送GET请求
- * @param {string} url - API端点 
+ * @param {string} url - API端点
  * @param {Object} options - 请求选项
  * @param {boolean} requiresAuth - 是否需要认证
  * @returns {Promise} - 请求结果
@@ -100,12 +112,12 @@ export function apiGet(url, options = {}, requiresAuth = false) {
  */
 export function apiPost(url, data = {}, options = {}, requiresAuth = false) {
   return apiRequest(
-    url, 
-    { 
-      method: 'POST', 
+    url,
+    {
+      method: 'POST',
       body: JSON.stringify(data),
-      ...options 
-    }, 
+      ...options
+    },
     requiresAuth
   )
 }
@@ -120,12 +132,12 @@ export function apiPost(url, data = {}, options = {}, requiresAuth = false) {
  */
 export function apiPut(url, data = {}, options = {}, requiresAuth = false) {
   return apiRequest(
-    url, 
-    { 
-      method: 'PUT', 
+    url,
+    {
+      method: 'PUT',
       body: JSON.stringify(data),
-      ...options 
-    }, 
+      ...options
+    },
     requiresAuth
   )
 }
@@ -139,4 +151,4 @@ export function apiPut(url, data = {}, options = {}, requiresAuth = false) {
  */
 export function apiDelete(url, options = {}, requiresAuth = false) {
   return apiRequest(url, { method: 'DELETE', ...options }, requiresAuth)
-} 
\ No newline at end of file
+}
\ No newline at end of file
diff --git a/web/src/apis/index.js b/web/src/apis/index.js
index ffa124ccb..6acfb3fc0 100644
--- a/web/src/apis/index.js
+++ b/web/src/apis/index.js
@@ -17,17 +17,17 @@ export { apiRequest, apiGet, apiPost, apiPut, apiDelete } from './base'
 
 /**
  * 权限说明:
- * 
+ *
  * 1. public_api.js: 不需要认证就可以访问的API
  *    - 登录、初始化管理员、获取公共配置等
- * 
+ *
  * 2. auth_api.js: 需要用户认证才能访问的API
  *    - 权限要求: 任何已登录用户（普通用户、管理员、超级管理员）
  *    - 聊天功能、个人设置等
- * 
+ *
  * 3. admin_api.js: 需要管理员权限才能访问的API
  *    - 权限要求: admin 或 superadmin
  *    - 用户管理、知识库管理、系统配置等
- * 
+ *
  * 注意：本模块已处理权限验证和请求头，使用时无需再手动添加认证头
- */ 
\ No newline at end of file
+ */
\ No newline at end of file
diff --git a/web/src/apis/public_api.js b/web/src/apis/public_api.js
index 88d759dea..66cb04122 100644
--- a/web/src/apis/public_api.js
+++ b/web/src/apis/public_api.js
@@ -16,7 +16,7 @@ export const authApi = {
     const formData = new FormData()
     formData.append('username', credentials.username)
     formData.append('password', credentials.password)
-    
+
     return apiRequest('/api/auth/token', {
       method: 'POST',
       body: formData
@@ -56,4 +56,4 @@ export const healthApi = {
 }
 
 // 从base.js导入apiRequest以支持FormData
-import { apiRequest } from './base' 
\ No newline at end of file
+import { apiRequest } from './base'
\ No newline at end of file
diff --git a/web/src/components/AgentChatComponent.vue b/web/src/components/AgentChatComponent.vue
index 6ca3c1b09..df496bd2e 100644
--- a/web/src/components/AgentChatComponent.vue
+++ b/web/src/components/AgentChatComponent.vue
@@ -12,11 +12,11 @@
           <slot name="header-center"></slot>
         </div>
         <div class="header__right">
-          <div class="current-agent nav-btn" @click="sayHi">
+          <!-- <div class="current-agent nav-btn" @click="sayHi">
             <RobotOutlined />&nbsp;
             <span v-if="currentAgent">{{ currentAgent.name }}</span>
             <span v-else>加载中...</span>
-          </div>
+          </div> -->
           <slot name="header-right"></slot>
         </div>
       </div>
@@ -359,14 +359,7 @@ const sendMessageWithText = async (text) => {
     };
 
     // 发送请求
-    const response = await fetch(`/api/chat/agent/${currentAgent.value.name}`, {
-      method: 'POST',
-      headers: { 
-        'Content-Type': 'application/json',
-        ...userStore.getAuthHeaders()
-      },
-      body: JSON.stringify(requestData)
-    });
+    const response = await chatApi.sendAgentMessage(currentAgent.value.name, requestData);
 
     // console.log("requestData", requestData);
     if (!response.ok) {
diff --git a/web/src/components/ChatComponent.vue b/web/src/components/ChatComponent.vue
index b314cfc4a..546ce5dd6 100644
--- a/web/src/components/ChatComponent.vue
+++ b/web/src/components/ChatComponent.vue
@@ -190,6 +190,7 @@ import MessageInputComponent from '@/components/MessageInputComponent.vue'
 import MessageComponent from '@/components/MessageComponent.vue'
 import RefsSidebar from '@/components/RefsSidebar.vue'
 import { chatApi } from '@/apis/auth_api'
+import { knowledgeBaseApi } from '@/apis/admin_api'
 
 const props = defineProps({
   conv: Object,
@@ -479,18 +480,24 @@ const groupRefs = (id) => {
 }
 
 const loadDatabases = () => {
-  fetch('/api/data/', { 
-    method: "GET",
-    headers: userStore.getAuthHeaders()
-  })
-    .then(response => response.json())
-    .then(data => {
-      console.log(data)
-      opts.databases = data.databases
-    })
-    .catch(error => {
-      console.error('加载数据库列表失败:', error)
-    })
+  // 由于这是管理功能，需要检查用户是否有管理权限
+  if (!userStore.isAdmin) {
+    console.log('非管理员用户，跳过加载数据库列表');
+    return;
+  }
+
+  try {
+    knowledgeBaseApi.getDatabases()
+      .then(data => {
+        console.log(data)
+        opts.databases = data.databases
+      })
+      .catch(error => {
+        console.error('加载数据库列表失败:', error)
+      })
+  } catch (error) {
+    console.error('获取数据库列表失败:', error);
+  }
 }
 
 const simpleCall = (msg) => {
@@ -514,20 +521,27 @@ const fetchChatResponse = (user_input, cur_res_id) => {
   }
   console.log(params)
 
-  // 使用fetch带上认证头和信号控制
-  fetch('/api/chat/', {
-    method: 'POST',
-    body: JSON.stringify(params),
-    headers: {
-      'Content-Type': 'application/json',
-      ...userStore.getAuthHeaders()
-    },
-    signal // 添加 signal 用于中断请求
-  })
+  // 使用API函数发送请求
+  chatApi.sendMessageWithAbort(params, signal)
   .then((response) => {
     if (!response.ok) {
-      throw new Error(`请求失败: ${response.status} ${response.statusText}`)
+      // 检查是否是401错误（令牌过期）
+      if (response.status === 401) {
+        const userStore = useUserStore();
+        if (userStore.isLoggedIn) {
+          message.error('登录已过期，请重新登录');
+          userStore.logout();
+
+          // 使用setTimeout确保消息显示后再跳转
+          setTimeout(() => {
+            window.location.href = '/login';
+          }, 1500);
+        }
+        throw new Error('未授权，请先登录');
+      }
+      throw new Error(`请求失败: ${response.status} ${response.statusText}`);
     }
+
     if (!response.body) throw new Error("ReadableStream not supported.");
     const reader = response.body.getReader();
     const decoder = new TextDecoder("utf-8");
@@ -568,8 +582,6 @@ const fetchChatResponse = (user_input, cur_res_id) => {
                 meta: data.meta,
                 ...data,
               });
-              // console.log("Last message", conv.value.messages[conv.value.messages.length - 1].content)
-              // console.log("Last message", conv.value.messages[conv.value.messages.length - 1].status)
 
               if (data.history) {
                 conv.value.history = data.history;
@@ -592,12 +604,18 @@ const fetchChatResponse = (user_input, cur_res_id) => {
     if (error.name === 'AbortError') {
       console.log('Fetch aborted');
     } else {
-      console.error(error);
-      updateMessage({
-        id: cur_res_id,
-        status: "error",
-        message: error.message || '请求失败',
-      });
+      console.error('聊天请求错误:', error);
+
+      // 检查是否是认证错误
+      if (error.message.includes('未授权') || error.message.includes('令牌已过期')) {
+        // 已在上面处理，这里不需要重复处理
+      } else {
+        updateMessage({
+          id: cur_res_id,
+          status: "error",
+          message: error.message || '请求失败',
+        });
+      }
     }
     isStreaming.value = false;
   });
diff --git a/web/src/components/DebugComponent.vue b/web/src/components/DebugComponent.vue
index 07b0d9eee..d7bb3640f 100644
--- a/web/src/components/DebugComponent.vue
+++ b/web/src/components/DebugComponent.vue
@@ -22,7 +22,7 @@
           {{ state.isFullscreen ? '退出全屏' : '全屏' }}
         </a-button>
         <a-tooltip :title="state.autoRefresh ? '点击停止自动刷新' : '点击开启自动刷新'">
-          <a-button 
+          <a-button
             :type="state.autoRefresh ? 'primary' : 'default'"
             @click="toggleAutoRefresh(!state.autoRefresh)"
           >
@@ -72,9 +72,11 @@
 <script setup>
 import { ref, onMounted, onActivated, onUnmounted, nextTick, reactive, computed } from 'vue';
 import { useConfigStore } from '@/stores/config';
+import { useUserStore } from '@/stores/user';
 import { useThrottleFn } from '@vueuse/core';
-import { 
-  FullscreenOutlined, 
+import { message } from 'ant-design-vue';
+import {
+  FullscreenOutlined,
   FullscreenExitOutlined,
   ReloadOutlined,
   ClearOutlined,
@@ -82,10 +84,21 @@ import {
   SyncOutlined
 } from '@ant-design/icons-vue';
 import dayjs from 'dayjs';
+import { logApi } from '@/apis/admin_api';
 
 const configStore = useConfigStore()
+const userStore = useUserStore();
 const config = configStore.config;
 
+// 权限检查
+const checkAdminPermission = () => {
+  if (!userStore.isAdmin) {
+    message.error('需要管理员权限才能查看日志');
+    return false;
+  }
+  return true;
+};
+
 // 定义日志级别
 const logLevels = [
   { value: 'INFO', label: 'INFO' },
@@ -153,16 +166,13 @@ const processedLogs = computed(() => {
 
 // 获取日志数据
 const fetchLogs = async () => {
+  if (!checkAdminPermission()) return;
+
   state.fetching = true;
   try {
     error.value = '';
-    const response = await fetch('/api/log');
-    if (!response.ok) {
-      throw new Error('获取日志失败');
-    }
-
-    const data = await response.json();
-    state.rawLogs = data.log.split('\n').filter(line => line.trim());
+    const logData = await logApi.getLogs();
+    state.rawLogs = logData.log.split('\n').filter(line => line.trim());
 
     await nextTick();
     const scrollToBottom = useThrottleFn(() => {
@@ -180,6 +190,7 @@ const fetchLogs = async () => {
 
 // 清空日志
 const clearLogs = () => {
+  if (!checkAdminPermission()) return;
   state.rawLogs = [];
 };
 
@@ -195,6 +206,8 @@ const filterLogs = () => {
 
 // 自动刷新
 const toggleAutoRefresh = (value) => {
+  if (!checkAdminPermission()) return;
+
   if (value) {
     autoRefreshInterval = setInterval(fetchLogs, 5000);
     state.autoRefresh = true;
@@ -209,6 +222,8 @@ const toggleAutoRefresh = (value) => {
 
 // 全屏切换
 const toggleFullscreen = async () => {
+  if (!checkAdminPermission()) return;
+
   try {
     if (!state.isFullscreen) {
       if (logViewer.value.requestFullscreen) {
@@ -242,13 +257,17 @@ const handleFullscreenChange = () => {
 };
 
 onMounted(() => {
-  fetchLogs();
+  if (checkAdminPermission()) {
+    fetchLogs();
+  }
   document.addEventListener('fullscreenchange', handleFullscreenChange);
   document.addEventListener('webkitfullscreenchange', handleFullscreenChange);
   document.addEventListener('msfullscreenchange', handleFullscreenChange);
 });
 
 onActivated(() => {
+  if (!checkAdminPermission()) return;
+
   if (state.autoRefresh) {
     toggleAutoRefresh(true);
   } else {
@@ -267,6 +286,7 @@ onUnmounted(() => {
 });
 
 const printConfig = () => {
+  if (!checkAdminPermission()) return;
   console.log('Current config:', config);
 };
 </script>
diff --git a/web/src/components/UserInfoComponent.vue b/web/src/components/UserInfoComponent.vue
index 9afe0d941..5f5565891 100644
--- a/web/src/components/UserInfoComponent.vue
+++ b/web/src/components/UserInfoComponent.vue
@@ -1,12 +1,15 @@
 <template>
   <div class="user-info-component">
     <a-dropdown :trigger="['click']" v-if="userStore.isLoggedIn">
-      <div class="user-avatar">
-        <div class="user-initial">{{ userInitial }}</div>
-        <div class="user-role-badge" :class="userRoleClass"></div>
+      <div class="user-info-dropdown" :data-align="showRole ? 'left' : 'center'">
+        <div class="user-avatar">
+          <UserOutlined />
+          <div class="user-role-badge" :class="userRoleClass"></div>
+        </div>
+        <div v-if="showRole">{{ userStore.username }}</div>
       </div>
       <template #overlay>
-        <a-menu>
+          <a-menu>
           <a-menu-item key="username" disabled>
             <span class="user-menu-username">{{ userStore.username }}</span>
           </a-menu-item>
@@ -36,6 +39,13 @@ import { message } from 'ant-design-vue';
 const router = useRouter();
 const userStore = useUserStore();
 
+const props = defineProps({
+  showRole: {
+    type: Boolean,
+    default: false
+  }
+})
+
 // 用户名首字母（用于显示在头像中）
 const userInitial = computed(() => {
   if (!userStore.username) return '?';
@@ -84,7 +94,22 @@ const goToLogin = () => {
   display: flex;
   align-items: center;
   justify-content: center;
-  margin-bottom: 16px;
+  // margin-bottom: 16px;
+}
+
+.user-info-dropdown {
+  width: 100%;
+  display: flex;
+  align-items: center;
+  gap: 12px;
+
+  &[data-align="center"] {
+    justify-content: center;
+  }
+
+  &[data-align="left"] {
+    justify-content: flex-start;
+  }
 }
 
 .user-avatar {
diff --git a/web/src/components/tools/ConvertToTxtComponent.vue b/web/src/components/tools/ConvertToTxtComponent.vue
deleted file mode 100644
index a95ce38cf..000000000
--- a/web/src/components/tools/ConvertToTxtComponent.vue
+++ /dev/null
@@ -1,183 +0,0 @@
-<template>
-  <div class="pdf2txt-container">
-    <div class="sidebar">
-      <div class="additional-params">
-        <h4>相关参数</h4>
-        <p>暂无相关参数</p>
-      </div>
-    </div>
-    <div class="result-container">
-      <div class="input-container">
-        <div class="upload">
-          <a-upload-dragger
-            class="upload-dragger"
-            v-model:fileList="fileList"
-            name="file"
-            :max-count="1"
-            :disabled="state.uploading"
-            action="/api/data/upload"
-            @change="handleFileUpload"
-            @drop="handleDrop"
-          >
-            <p class="ant-upload-text">点击或者把PDF文件拖拽到这里上传</p>
-            <p class="ant-upload-hint">
-              仅支持上传PDF文件。同名文件无法重复添加
-            </p>
-          </a-upload-dragger>
-        </div>
-        <a-button type="primary" @click="convertPdfToText" :loading="state.loading">Convert PDF to Text</a-button>
-      </div>
-      <div class="output-container">
-        <textarea v-model="convertedText" placeholder="Converted text will appear here" readonly></textarea>
-        <div class="infos">
-          <span>字符数: {{ charCount }}</span>
-          <span>Token 数：{{ estimatedTokenCount }}</span>
-        </div>
-      </div>
-    </div>
-  </div>
-</template>
-
-<script setup>
-import { reactive, ref, computed } from 'vue';
-import { message } from 'ant-design-vue';
-
-const state = reactive({
-  loading: false,
-  uploading: false,
-});
-
-const fileList = ref([]);
-const convertedText = ref('');
-
-const charCount = computed(() => convertedText.value.length);
-const estimatedTokenCount = computed(() => {
-  const chars = convertedText.value.split('');
-  let tokenCount = 0;
-  for (let char of chars) {
-    if (/[\u4e00-\u9fff]/.test(char)) {
-      tokenCount += 1;
-    } else if (/[a-zA-Z]/.test(char)) {
-      tokenCount += 0.25;
-    } else {
-      tokenCount += 0.5;
-    }
-  }
-  return Math.ceil(tokenCount);
-});
-
-const handleFileUpload = (info) => {
-  const { status } = info.file;
-  if (status !== 'uploading') {
-    console.log(info.file, info.fileList);
-  }
-  if (status === 'done') {
-    message.success(`${info.file.name} file uploaded successfully.`);
-  } else if (status === 'error') {
-    message.error(`${info.file.name} file upload failed.`);
-  }
-};
-
-const handleDrop = (e) => {
-  console.log(e);
-};
-
-const convertPdfToText = async () => {
-  if (fileList.value.length === 0) {
-    message.error("请上传PDF文件");
-    return;
-  }
-
-  const file = fileList.value[0].response.file_path;
-
-  try {
-    state.loading = true;
-    const response = await fetch('/api/tool/pdf2txt', {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify(file.toString())
-    });
-
-    if (!response.ok) {
-      throw new Error(`HTTP error! Status: ${response.status}`);
-    }
-
-    const data = await response.json();
-    convertedText.value = data.text;
-    state.loading = false;
-  } catch (error) {
-    console.error('Error converting PDF to text:', error);
-    message.error('PDF转换失败，请重试');
-    state.loading = false;
-  }
-};
-</script>
-
-<style lang="less" scoped>
-.pdf2txt-container {
-  display: flex;
-  border-radius: 8px;
-  font-family: 'Arial', sans-serif;
-
-  .sidebar {
-    position: sticky;
-    top: 0;
-    width: 350px;
-    background-color: var(--bg-sider);
-    border-right: 1px solid var(--main-light-3);
-    padding: 20px;
-    min-width: 250px;
-    flex: 1;
-
-    .additional-params {
-      h4 {
-        font-size: 1.2em;
-        margin-bottom: 10px;
-      }
-    }
-  }
-
-  .result-container {
-    flex: 3;
-    padding: 20px;
-
-    .input-container {
-      display: flex;
-      flex-direction: column;
-      margin-bottom: 15px;
-
-      .upload {
-        margin-bottom: 15px;
-      }
-    }
-
-    .output-container {
-      textarea {
-        width: 100%;
-        height: 300px;
-        resize: vertical;
-        padding: 1rem;
-        border: 1px solid var(--gray-300);
-        border-radius: 8px;
-        font-size: 1rem;
-        transition: border-color 0.3s;
-        background-color: var(--gray-100);
-
-        &:focus {
-          border-color: var(--main-color);
-          outline: none;
-        }
-      }
-
-      .infos {
-        padding: 10px;
-        margin-top: 10px;
-        font-size: 1em;
-        color: var(--gray-800);
-        display: flex;
-        gap: 16px;
-      }
-    }
-  }
-}
-</style>
diff --git a/web/src/components/tools/TextChunkingComponent.vue b/web/src/components/tools/TextChunkingComponent.vue
deleted file mode 100644
index d06c5dfd6..000000000
--- a/web/src/components/tools/TextChunkingComponent.vue
+++ /dev/null
@@ -1,276 +0,0 @@
-<template>
-  <div class="text-chunking-container">
-    <div class="sidebar">
-      <div class="additional-params">
-        <h4>相关参数</h4>
-        <a-form
-          :model="params"
-          name="basic"
-          autocomplete="off"
-          layout="vertical"
-          @finish="chunkText"
-        >
-          <a-form-item label="Chunk Size" name="chunkSize" >
-            <a-input v-model:value="params.chunkSize" :disabled="params.useParser && state.useFile" />
-          </a-form-item>
-          <a-form-item label="Chunk Overlap" name="chunkOverlap" >
-            <a-input v-model:value="params.chunkOverlap" :disabled="params.useParser && state.useFile" />
-          </a-form-item>
-          <a-form-item label="使用文件节点解析器" name="useParser" v-if="state.useFile">
-            <a-switch v-model:checked="params.useParser" />
-          </a-form-item>
-
-          <a-form-item>
-            <a-button type="primary" html-type="submit" :loading="state.loading">Chunk Text</a-button>
-          </a-form-item>
-        </a-form>
-        <!-- Future parameters can be added here -->
-      </div>
-    </div>
-    <div class="result-container">
-      <div class="input-container">
-        <div class="actions">
-          <span :class="{'active': !state.useFile}" @click="state.useFile = false">输入文本</span>
-          <span :class="{'active': state.useFile}" @click="state.useFile = true">上传文件</span>
-        </div>
-        <div class="upload" v-if="state.useFile">
-          <a-upload-dragger
-            class="upload-dragger"
-            v-model:fileList="fileList"
-            name="file"
-            :max-count="1"
-            :disabled="state.uploading"
-            action="/api/data/upload"
-            @change="handleFileUpload"
-            @drop="handleDrop"
-          >
-            <p class="ant-upload-text">点击或者把文件拖拽到这里上传</p>
-            <p class="ant-upload-hint">
-              目前仅支持上传文本文件，如 .pdf, .txt, .md。且同名文件无法重复添加
-            </p>
-          </a-upload-dragger>
-        </div>
-        <textarea v-if="!state.useFile" v-model="text" placeholder="Enter text to chunk"></textarea>
-        <div class="infos" v-if="!state.useFile">
-          <!-- <span>字数: {{ wordCount }}</span> -->
-          <span>字符数: {{ charCount }}</span>
-          <span>Token 数：{{ estimatedTokenCount }}</span>
-        </div>
-      </div>
-      <!-- <div>{{ chunks[0] }}</div> -->
-      <div id="result-cards" class="result-cards">
-        <div v-for="(chunk, index) in chunks" :key="index" class="chunk">
-          <p><strong>#{{ index + 1 }}</strong> {{ chunk.text }}</p>
-        </div>
-      </div>
-    </div>
-  </div>
-</template>
-
-<script setup>
-import { reactive, ref, computed } from 'vue';
-import { message } from 'ant-design-vue'
-
-const text = ref('');
-const state = reactive({
-  loading: false,
-  uploading: false,
-  useFile: false,
-})
-
-const params = reactive({
-  chunkSize: 500,
-  chunkOverlap: 20,
-  useParser: false,
-})
-const chunks = ref([]);
-const fileList = ref([]);
-
-const wordCount = computed(() => text.value.split(/\s+/).filter(Boolean).length);
-const charCount = computed(() => text.value.length)
-const estimatedTokenCount = computed(() => {
-  // 将文本分割成字符数组
-  const chars = text.value.split('');
-  let tokenCount = 0;
-  for (let char of chars) {
-    if (/[\u4e00-\u9fff]/.test(char)) {
-      tokenCount += 1; // 对于中文字符，通常计为一个 token
-    }
-    else if (/[a-zA-Z]/.test(char)) {
-      tokenCount += 0.25; // 对于英文单词，大约每 4 个字符算作一个 token
-    }
-    else {
-      tokenCount += 0.5; // 对于中文字符，通常计为一个 token
-    }
-  }
-  return Math.ceil(tokenCount);
-})
-
-const chunkText = async () => {
-  let text_or_file = ''
-  if (state.useFile) {
-    if (fileList.value.length === 0) {
-      message.error("请上传文件")
-      return
-    }
-    console.log(fileList.value)
-    text_or_file = fileList.value.filter(file => file.status === 'done').map(file => file.response.file_path)[0]
-  } else {
-    if (text.value.length === 0) {
-      message.error("请输入文本")
-      return
-    }
-    text_or_file = text.value
-  }
-
-  try {
-    state.loading = true
-    const response = await fetch('/api/tool/text-chunking', {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({
-        text: text_or_file,
-        params: {
-          chunk_size: params.chunkSize,
-          chunk_overlap: params.chunkOverlap,
-          use_parser: params.useParser
-        }
-      })
-    });
-
-    if (!response.ok) {
-      throw new Error(`HTTP error! Status: ${response.status}`);
-    }
-
-    const data = await response.json();
-    chunks.value = data.nodes;
-    state.loading = false
-  } catch (error) {
-    console.error('Error chunking text:', error);
-    state.loading = false
-  }
-};
-</script>
-
-<style lang="less" scoped>
-.text-chunking-container {
-  display: flex;
-  border-radius: 8px;
-  font-family: 'Arial', sans-serif;
-
-  .sidebar {
-    position: sticky;
-    top: 0;
-    width: 350px; /* 初始宽度 */
-    background-color: var(--bg-sider);
-    border-right: 1px solid var(--main-light-3);
-    padding: 20px;
-    min-width: 250px;
-    flex: 1;
-
-    .additional-params {
-      h4 {
-        font-size: 1.2em;
-        margin-bottom: 10px;
-      }
-    }
-  }
-
-  .result-container {
-    flex: 3;
-    padding: 20px;
-
-    .input-container {
-      display: flex;
-      flex-direction: column;
-      margin-bottom: 15px;
-
-      .actions {
-        display: flex;
-        justify-content: space-between;
-        margin-bottom: 10px;
-        width: fit-content;
-        background-color: var(--gray-200);
-        padding: 4px;
-        border-radius: 4px;
-
-        span {
-          color: var(--gray-900);
-          cursor: pointer;
-          padding: 4px 10px;
-          border-radius: 4px;
-          transition: background-color 0.3s;
-
-          &.active {
-            background-color: white;
-            box-shadow: 0 1px 2px 0 rgba(0, 0, 0, 0.03),0 1px 6px -1px rgba(0, 0, 0, 0.02),0 2px 4px 0 rgba(0, 0, 0, 0.02)
-          }
-        }
-      }
-
-      textarea {
-        resize: vertical;
-        height: 300px;
-        padding: 1rem;
-        border: 1px solid var(--gray-300);
-        border-radius: 8px;
-        font-size: 1rem;
-        transition: border-color 0.3s;
-        background-color: var(--gray-100);
-
-        &:focus {
-          border-color: var(--main-color);
-          outline: none;
-        }
-      }
-
-      .infos {
-        padding: 10px; /* Padding for spacing */
-        margin-top: 10px; /* Space above the infos */
-        font-size: 1em; /* Font size */
-        color: var(--gray-800); /* Text color */
-        display: flex;
-        gap: 16px;
-      }
-
-    }
-
-    .result-cards {
-      column-count: 3; /* 设置列数 */
-      column-gap: 10px; /* 列之间的间距 */
-    }
-
-    .chunk {
-      background-color: var(--main-5);
-      border: 1px solid var(--main-light-3);
-      border-radius: 8px;
-      padding: 16px;
-      margin-bottom: 10px;
-      box-shadow: 0 0 10px 2px rgba(0, 0, 0, 0.01);
-      break-inside: avoid; /* 避免元素被分割到不同列 */
-      // 强制换行
-      word-wrap: break-word;
-      word-break: break-all;
-    }
-  }
-}
-
-
-@media (max-width: 980px) {
-  #result-cards {
-    column-count: 1;
-  }
-}
-
-@media (min-width: 981px) and (max-width: 1500px) {
-  #result-cards {
-    column-count: 2;
-  }
-}
-
-@media (min-width: 1501px){
-  #result-cards {
-    column-count: 3;
-  }
-}
-</style>
\ No newline at end of file
diff --git a/web/src/layouts/AppLayout.vue b/web/src/layouts/AppLayout.vue
index 86a68f080..23705db2e 100644
--- a/web/src/layouts/AppLayout.vue
+++ b/web/src/layouts/AppLayout.vue
@@ -92,6 +92,11 @@ const mainList = [{
     path: '/chat',
     icon: MessageOutlined,
     activeIcon: MessageFilled,
+  }, {
+    name: '智能体',
+    path: '/agent',
+    icon: ToolOutlined,
+    activeIcon: ToolFilled,
   }, {
     name: '图谱',
     path: '/graph',
@@ -104,11 +109,6 @@ const mainList = [{
     icon: BookOutlined,
     activeIcon: BookFilled,
     // hidden: !configStore.config.enable_knowledge_base,
-  }, {
-    name: '智能体',
-    path: '/agent',
-    icon: ToolOutlined,
-    activeIcon: ToolFilled,
   }
 ]
 </script>
@@ -168,7 +168,9 @@ const mainList = [{
       <div class="fill" style="flex-grow: 1;"></div>
 
       <!-- 用户信息组件 -->
-      <UserInfoComponent />
+      <div class="nav-item user-info">
+        <UserInfoComponent />
+      </div>
 
       <div class="github nav-item">
         <a-tooltip placement="right">
@@ -176,19 +178,19 @@ const mainList = [{
           <a href="https://github.com/xerrors/Yuxi-Know" target="_blank" class="github-link">
             <GithubOutlined class="icon" style="color: #222;"/>
             <span v-if="githubStars > 0" class="github-stars">
-              <span class="star-count">{{ githubStars.toFixed(1) }}</span>
+              <span class="star-count">{{ (githubStars / 1000).toFixed(1) }}k</span>
             </span>
           </a>
         </a-tooltip>
       </div>
-      <div class="nav-item api-docs">
+      <!-- <div class="nav-item api-docs">
         <a-tooltip placement="right">
           <template #title>接口文档 {{ apiDocsUrl }}</template>
           <a :href="apiDocsUrl" target="_blank" class="github-link">
             <ApiOutlined class="icon" style="color: #222;"/>
           </a>
         </a-tooltip>
-      </div>
+      </div> -->
       <RouterLink class="nav-item setting" to="/setting" active-class="active">
         <a-tooltip placement="right">
           <template #title>设置</template>
@@ -365,8 +367,7 @@ div.header, #app-router-view {
     width: auto;
     font-size: 20px;
     color: #333;
-    margin-bottom: 20px;
-    margin-top: 10px;
+    margin-bottom: 8px;
     padding: 16px 12px;
 
     &:hover {
diff --git a/web/src/router/index.js b/web/src/router/index.js
index 2f6a8b3c2..5c095dd5b 100644
--- a/web/src/router/index.js
+++ b/web/src/router/index.js
@@ -41,8 +41,15 @@ const router = createRouter({
     {
       path: '/agent',
       name: 'AgentMain',
-      component: () => import('../views/AgentView.vue'),
-      meta: { keepAlive: true, requiresAuth: true, requiresAdmin: true }
+      component: AppLayout,
+      children: [
+        {
+          path: '',
+          name: 'AgentComp',
+          component: () => import('../views/AgentView.vue'),
+          meta: { keepAlive: true, requiresAuth: true, requiresAdmin: true }
+        }
+      ]
     },
     {
       path: '/agent/:agent_id',
diff --git a/web/src/views/AgentSingleView.vue b/web/src/views/AgentSingleView.vue
index d0d6c8d77..093b0446f 100644
--- a/web/src/views/AgentSingleView.vue
+++ b/web/src/views/AgentSingleView.vue
@@ -1,26 +1,23 @@
 <template>
   <div class="agent-single-view">
     <!-- 侧边栏 -->
-    <div class="sidebar" :class="{ 'collapsed': isSidebarCollapsed }">
+    <!-- <div class="sidebar" :class="{ 'collapsed': isSidebarCollapsed }">
       <div class="sidebar-content">
         <div class="user-icon">
-          <img :src="sidebarLeftIcon" alt="用户信息" @click="toggleUserInfo" />
+          <UserInfoComponent :show-role="!isSidebarCollapsed" />
         </div>
-        <!-- 这里可以添加更多侧边栏内容 -->
-         <UserInfoComponent />
       </div>
       <div class="toggle-button" @click="toggleSidebar">
         <img :src="isSidebarCollapsed ? sidebarRightIcon : sidebarLeftIcon" alt="折叠/展开" />
       </div>
-    </div>
-
-    <!-- 用户信息组件 -->
-    <div class="user-info-wrapper">
-      <UserInfoComponent />
-    </div>
+    </div> -->
 
     <!-- 智能体聊天界面 -->
-    <AgentChatComponent :agent-id="agentId" />
+    <AgentChatComponent :agent-id="agentId">
+      <template #header-right>
+        <UserInfoComponent />
+      </template>
+    </AgentChatComponent>
   </div>
 </template>
 
@@ -56,6 +53,8 @@ const toggleUserInfo = () => {
   height: 100vh;
   overflow: hidden;
   position: relative;
+  display: flex;
+  flex-direction: row;
 }
 
 .user-info-wrapper {
@@ -67,7 +66,7 @@ const toggleUserInfo = () => {
 
 // 侧边栏样式
 .sidebar {
-  position: absolute;
+  // position: absolute;
   left: 0;
   top: 0;
   height: 100%;
@@ -90,6 +89,7 @@ const toggleUserInfo = () => {
   .user-icon {
     cursor: pointer;
     margin-bottom: 20px;
+    padding-left: 4px 8px;
 
     img {
       width: 32px;
diff --git a/web/src/views/AgentView.vue b/web/src/views/AgentView.vue
index b7328fd4e..2f5149cb0 100644
--- a/web/src/views/AgentView.vue
+++ b/web/src/views/AgentView.vue
@@ -30,7 +30,7 @@
           {{ agents[selectedAgentId]?.description }}
         </p>
 
-        <!-- 添加配置按钮 -->
+        <!-- 添加配置按钮 TODO 这里的配置修改还无法影响到独立接口的对话-->
         <div class="agent-action-buttons">
           <a-button
             class="action-button"
@@ -48,6 +48,15 @@
             访问令牌
           </a-button>
 
+          <a-button
+            class="action-button"
+            @click="goToAgentPage"
+            v-if="selectedAgentId"
+          >
+            <template #icon><LinkOutlined /></template>
+            打开独立页面
+          </a-button>
+
           <a-button
             class="action-button primary-action"
             @click="setAsDefaultAgent"
@@ -58,14 +67,6 @@
             {{ isDefaultAgent ? '当前为默认智能体' : '设为默认智能体' }}
           </a-button>
 
-          <a-button
-            class="action-button"
-            @click="goToAgentPage"
-            v-if="selectedAgentId"
-          >
-            <template #icon><LinkOutlined /></template>
-            打开独立页面
-          </a-button>
         </div>
 
         <!-- 添加requirements显示部分 -->
diff --git a/web/src/views/DataBaseInfoView.vue b/web/src/views/DataBaseInfoView.vue
index 39ec9c67d..a4f74bc8e 100644
--- a/web/src/views/DataBaseInfoView.vue
+++ b/web/src/views/DataBaseInfoView.vue
@@ -397,29 +397,29 @@ const onQuery = () => {
     return
   }
   meta.db_id = database.value.db_id
-  fetch('/api/data/query-test', {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json"  // 添加 Content-Type 头
-    },
-    body: JSON.stringify({
+  
+  try {
+    knowledgeBaseApi.queryTest({
       query: queryText.value.trim(),
       meta: meta
-    }),
-  })
-  .then(response => response.json())
-  .then(data => {
-    console.log(data)
-    queryResult.value = data
-    filterQueryResults()
-  })
-  .catch(error => {
+    })
+    .then(data => {
+      console.log(data)
+      queryResult.value = data
+      filterQueryResults()
+    })
+    .catch(error => {
+      console.error(error)
+      message.error(error.message)
+    })
+    .finally(() => {
+      state.searchLoading = false
+    })
+  } catch (error) {
     console.error(error)
     message.error(error.message)
-  })
-  .finally(() => {
     state.searchLoading = false
-  })
+  }
 }
 
 const handleFileUpload = (event) => {
@@ -480,27 +480,31 @@ const deleteDatabse = () => {
 
 const openFileDetail = (record) => {
   state.lock = true
-  fetch(`/api/data/document?db_id=${databaseId.value}&file_id=${record.file_id}`, {
-    method: "GET",
-  })
-    .then(response => response.json())
-    .then(data => {
-      console.log(data)
-      if (data.status == "failed") {
-        message.error(data.message)
-        return
-      }
-      state.lock = false
-      selectedFile.value = {
-        ...record,
-        lines: data.lines || []
-      }
-      state.drawer = true
-    })
-    .catch(error => {
-      console.error(error)
-      message.error(error.message)
-    })
+  
+  try {
+    knowledgeBaseApi.getDocumentDetail(databaseId.value, record.file_id)
+      .then(data => {
+        console.log(data)
+        if (data.status == "failed") {
+          message.error(data.message)
+          return
+        }
+        state.lock = false
+        selectedFile.value = {
+          ...record,
+          lines: data.lines || []
+        }
+        state.drawer = true
+      })
+      .catch(error => {
+        console.error(error)
+        message.error(error.message)
+      })
+  } catch (error) {
+    console.error(error)
+    message.error('获取文件详情失败')
+    state.lock = false
+  }
 }
 
 const formatRelativeTime = (timestamp) => {
@@ -603,17 +607,10 @@ const chunkFiles = () => {
   state.loading = true
 
   // 调用file-to-chunk接口获取分块信息
-  fetch('/api/data/file-to-chunk', {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json"
-    },
-    body: JSON.stringify({
-      files: files,
-      params: chunkParams.value
-    }),
+  knowledgeBaseApi.fileToChunk({
+    files: files,
+    params: chunkParams.value
   })
-  .then(response => response.json())
   .then(data => {
     console.log('文件分块信息:', data)
     chunkResults.value = Object.values(data);
@@ -645,17 +642,10 @@ const addToDatabase = () => {
   });
 
   // 调用add-by-chunks接口将分块添加到数据库
-  fetch('/api/data/add-by-chunks', {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json"
-    },
-    body: JSON.stringify({
-      db_id: databaseId.value,
-      file_chunks: fileChunks
-    }),
+  knowledgeBaseApi.addByChunks({
+    db_id: databaseId.value,
+    file_chunks: fileChunks
   })
-  .then(response => response.json())
   .then(data => {
     console.log(data)
 
diff --git a/web/src/views/DataBaseView.vue b/web/src/views/DataBaseView.vue
index 8489f1318..1a9526b7c 100644
--- a/web/src/views/DataBaseView.vue
+++ b/web/src/views/DataBaseView.vue
@@ -121,7 +121,7 @@ const loadDatabases = () => {
       console.error('加载数据库列表失败:', error);
       if (error.message.includes('权限')) {
         message.error('需要管理员权限访问知识库')
-      }
+    }
     })
 }
 
@@ -135,10 +135,10 @@ const createDatabase = () => {
   }
 
   knowledgeBaseApi.createDatabase({
-    database_name: newDatabase.name,
-    description: newDatabase.description,
-    dimension: newDatabase.dimension ? parseInt(newDatabase.dimension) : null,
-  })
+      database_name: newDatabase.name,
+      description: newDatabase.description,
+      dimension: newDatabase.dimension ? parseInt(newDatabase.dimension) : null,
+    })
   .then(data => {
     console.log(data)
     loadDatabases()
diff --git a/web/src/views/HomeView.vue b/web/src/views/HomeView.vue
index ac116398b..58b668613 100644
--- a/web/src/views/HomeView.vue
+++ b/web/src/views/HomeView.vue
@@ -91,7 +91,7 @@ const goToChat = async () => {
       } else {
         // 没有可用智能体，回退到chat页面
         router.push("/chat");
-      }
+}
     }
   } catch (error) {
     console.error('跳转到智能体页面失败:', error);
diff --git a/web/src/views/SettingView.vue b/web/src/views/SettingView.vue
index 488e6b457..0a0fd6ae4 100644
--- a/web/src/views/SettingView.vue
+++ b/web/src/views/SettingView.vue
@@ -379,6 +379,7 @@ import HeaderComponent from '@/components/HeaderComponent.vue';
 import TableConfigComponent from '@/components/TableConfigComponent.vue';
 import { notification, Button } from 'ant-design-vue';
 import { modelIcons } from '@/utils/modelIcon'
+import { systemConfigApi } from '@/apis/admin_api'
 
 
 const configStore = useConfigStore()
@@ -584,15 +585,19 @@ onUnmounted(() => {
 const sendRestart = () => {
   console.log('Restarting...')
   message.loading({ content: '重新加载模型中', key: "restart", duration: 0 });
-  fetch('/api/restart', {
-    method: 'POST',
-  }).then(() => {
-    console.log('Restarted')
-    message.success({ content: '重新加载完成!', key: "restart", duration: 2 });
-    setTimeout(() => {
-      window.location.reload()
-    }, 200)
-  })
+  
+  systemConfigApi.restartServer()
+    .then(() => {
+      console.log('Restarted')
+      message.success({ content: '重新加载完成!', key: "restart", duration: 2 });
+      setTimeout(() => {
+        window.location.reload()
+      }, 200)
+    })
+    .catch(error => {
+      console.error('重启服务失败:', error)
+      message.error({ content: `重启失败: ${error.message}`, key: "restart", duration: 2 });
+    });
 }
 
 // 获取模型提供商的模型列表
diff --git a/web/src/views/ToolsView.vue b/web/src/views/ToolsView.vue
deleted file mode 100644
index bee5f4b3d..000000000
--- a/web/src/views/ToolsView.vue
+++ /dev/null
@@ -1,111 +0,0 @@
-<template>
-  <div class="tools-container layout-container">
-    <HeaderComponent
-      title="工具箱"
-      description="这里展示了各种可用的工具，重点是为了测试部分功能的页面。(注：不是大模型的工具)"
-    >
-    </HeaderComponent>
-    <div class="tools-grid">
-      <div v-for="tool in tools" :key="tool.id" class="tool-card" @click="navigateToTool(tool.url)">
-        <div class="tool-header">
-          <h3>{{ tool.title }}</h3>
-        </div>
-        <div class="tool-info">
-          <p>{{ tool.description }}</p>
-        </div>
-      </div>
-    </div>
-  </div>
-</template>
-
-<script setup>
-import { onMounted, reactive, ref } from 'vue';
-import { useRouter } from 'vue-router';
-import { CalculatorOutlined, FileSearchOutlined, TranslationOutlined } from '@ant-design/icons-vue';
-import HeaderComponent from '@/components/HeaderComponent.vue';
-
-const router = useRouter();
-const tools = ref([]);
-const iconMap = ref({
-  "text-chunking": FileSearchOutlined
-})
-
-const state = reactive({
-  loadingTools: true,
-})
-
-const getTools = () => {
-  state.loadingTools = true
-  fetch('/api/tool/')
-    .then(response => response.json())
-    .then(data => {
-      tools.value = data;
-      state.loadingTools = false;
-    })
-    .catch(error => {
-      console.error('Error fetching tools:', error);
-      state.loadingTools = false;
-    });
-};
-
-const navigateToTool = (toolUrl) => {
-  router.push(toolUrl);
-};
-
-onMounted(() => {
-  getTools();
-});
-</script>
-
-<style scoped lang="less">
-.tools-container {
-  padding: 0;
-}
-
-.tools-grid {
-  display: grid;
-  grid-template-columns: repeat(auto-fill, minmax(250px, 1fr));
-  gap: 20px;
-  padding: 20px;
-
-  .tool-card {
-    display: flex;
-    flex-direction: column;
-    background-color: white;
-    border: 1px solid var(--gray-300);
-    border-radius: 8px;
-    padding: 20px;
-    transition: transform 0.1s ease, box-shadow 0.1s ease;
-    cursor: pointer;
-
-    &:hover {
-      // transform: translateY(-1px);
-      box-shadow: 0 5px 15px rgba(0,0,0,0.05);
-    }
-
-    .tool-header {
-      display: flex;
-      align-items: center;
-      margin-bottom: 15px;
-      font-size: 15px;
-
-      .tool-icon {
-        margin-right: 10px;
-      }
-
-      h3 {
-        margin: 0;
-      }
-    }
-
-    .tool-info {
-      flex-grow: 1;
-
-      p {
-        margin: 0;
-        color: var(--gray-800);
-      }
-    }
-  }
-}
-</style>

From 0fd83d179f4b87c8cc877ed18aea3c5351e6549d Mon Sep 17 00:00:00 2001
From: Wenjie Zhang <xerrors@163.com>
Date: Sun, 4 May 2025 22:09:38 +0800
Subject: [PATCH 04/10] =?UTF-8?q?=E7=A7=BB=E9=99=A4=E6=97=A0=E5=85=B3?=
 =?UTF-8?q?=E5=BC=95=E5=85=A5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 web/src/components/AgentChatComponent.vue | 4 ----
 web/src/views/GraphView.vue               | 2 --
 2 files changed, 6 deletions(-)

diff --git a/web/src/components/AgentChatComponent.vue b/web/src/components/AgentChatComponent.vue
index df496bd2e..33615a87d 100644
--- a/web/src/components/AgentChatComponent.vue
+++ b/web/src/components/AgentChatComponent.vue
@@ -110,7 +110,6 @@ import {
 import { message } from 'ant-design-vue';
 import MessageInputComponent from '@/components/MessageInputComponent.vue'
 import MessageComponent from '@/components/MessageComponent.vue'
-import { useUserStore } from '@/stores/user'
 import { chatApi } from '@/apis/auth_api'
 
 // 新增props属性，允许父组件传入agentId
@@ -129,9 +128,6 @@ const props = defineProps({
   }
 });
 
-// 初始化userStore
-const userStore = useUserStore();
-
 // ==================== 状态管理 ====================
 
 // UI状态
diff --git a/web/src/views/GraphView.vue b/web/src/views/GraphView.vue
index a0448a9e0..61b2970fd 100644
--- a/web/src/views/GraphView.vue
+++ b/web/src/views/GraphView.vue
@@ -91,13 +91,11 @@ import { Graph } from "@antv/g6";
 import { computed, onMounted, reactive, ref } from 'vue';
 import { message, Button as AButton } from 'ant-design-vue';
 import { useConfigStore } from '@/stores/config';
-import { useUserStore } from '@/stores/user';
 import { UploadOutlined, SyncOutlined } from '@ant-design/icons-vue';
 import HeaderComponent from '@/components/HeaderComponent.vue';
 import { graphApi } from '@/apis/admin_api';
 
 const configStore = useConfigStore();
-const userStore = useUserStore();
 const cur_embed_model = computed(() => configStore.config?.embed_model_names?.[configStore.config?.embed_model]?.name || '');
 const modelMatched = computed(() => !graphInfo?.value?.embed_model_name || graphInfo.value.embed_model_name === cur_embed_model.value)
 const disabled = computed(() => state.precessing || !modelMatched.value)

From 7b6a1b4458791096c2410ffb2dae1e99bb420d81 Mon Sep 17 00:00:00 2001
From: Wenjie Zhang <xerrors@163.com>
Date: Mon, 5 May 2025 16:31:35 +0800
Subject: [PATCH 05/10] =?UTF-8?q?=E7=BB=A7=E7=BB=AD=E4=BC=98=E5=8C=96?=
 =?UTF-8?q?=E6=8E=A5=E5=8F=A3=EF=BC=8C=E7=A7=BB=E9=99=A4=E6=97=A0=E5=85=B3?=
 =?UTF-8?q?=E6=A8=A1=E5=9D=97=EF=BC=9A=EF=BC=881=EF=BC=89=E7=A7=BB?=
 =?UTF-8?q?=E9=99=A4=E5=8E=9F=E6=9C=AC=E7=9A=84=20Token=20=E7=AE=A1?=
 =?UTF-8?q?=E7=90=86=E6=A8=A1=E5=9D=97=EF=BC=9B=EF=BC=882=EF=BC=89?=
 =?UTF-8?q?=E6=89=80=E6=9C=89=20API=20=E8=AF=B7=E6=B1=82=E4=BD=BF=E7=94=A8?=
 =?UTF-8?q?=20/api=20=E5=89=8D=E7=BC=80=EF=BC=9B=EF=BC=883=EF=BC=89?=
 =?UTF-8?q?=E7=A7=BB=E9=99=A4=E9=87=8D=E5=A4=8D=E7=9A=84=E4=B8=AD=E9=97=B4?=
 =?UTF-8?q?=E4=BB=B6=E9=AA=8C=E8=AF=81=EF=BC=9B=EF=BC=884=EF=BC=89?=
 =?UTF-8?q?=E5=89=8D=E5=90=8E=E7=AB=AF=E9=83=BD=E7=A7=BB=E9=99=A4=E5=B7=A5?=
 =?UTF-8?q?=E5=85=B7=E6=A8=A1=E5=9D=97=EF=BC=9B=EF=BC=885=EF=BC=89?=
 =?UTF-8?q?=E7=A7=BB=E9=99=A4=E5=8E=9F=E6=9C=AC=E7=9A=84=20safe=5Fconfig?=
 =?UTF-8?q?=20=E6=A8=A1=E5=9D=97=EF=BC=9B=EF=BC=886=EF=BC=89=E5=85=B6?=
 =?UTF-8?q?=E4=BB=96=E5=B0=8F=E7=BB=86=E8=8A=82=E4=BC=98=E5=8C=96?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 server/db_manager.py                         |   6 +-
 server/main.py                               |  92 ++------
 server/models/__init__.py                    |   3 +
 server/models/token_model.py                 |  24 --
 server/models/user_model.py                  |   3 +-
 server/routers/__init__.py                   |   2 -
 server/routers/admin_router.py               | 126 ----------
 server/routers/base_router.py                |  23 +-
 server/routers/tool_router.py                |  70 ------
 server/utils/auth_middleware.py              |  56 +----
 src/config/__init__.py                       |  14 +-
 web/src/apis/admin_api.js                    |  34 ---
 web/src/apis/base.js                         |  10 +-
 web/src/components/TokenManagerComponent.vue | 232 -------------------
 web/src/components/UserInfoComponent.vue     |   4 +-
 web/src/layouts/AppLayout.vue                |  20 +-
 web/src/stores/config.js                     |  29 +--
 web/src/views/AgentView.vue                  |  37 ---
 web/src/views/DataBaseInfoView.vue           |   6 +-
 web/vite.config.js                           |   2 +-
 20 files changed, 72 insertions(+), 721 deletions(-)
 create mode 100644 server/models/__init__.py
 delete mode 100644 server/models/token_model.py
 delete mode 100644 server/routers/admin_router.py
 delete mode 100644 server/routers/tool_router.py
 delete mode 100644 web/src/components/TokenManagerComponent.vue

diff --git a/server/db_manager.py b/server/db_manager.py
index 6b526f2c0..af1350fdb 100644
--- a/server/db_manager.py
+++ b/server/db_manager.py
@@ -1,12 +1,10 @@
 import os
-import sqlite3
 import pathlib
 from sqlalchemy import create_engine
 from sqlalchemy.orm import sessionmaker
-from sqlalchemy.ext.declarative import declarative_base
 
-from server.models.token_model import Base, AgentToken
-from server.models.user_model import User, OperationLog
+from server.models import Base
+from server.models.user_model import User
 
 class DBManager:
     """数据库管理器"""
diff --git a/server/main.py b/server/main.py
index 5f383fc6e..bfcc41db0 100644
--- a/server/main.py
+++ b/server/main.py
@@ -6,13 +6,12 @@
 from starlette.middleware.base import BaseHTTPMiddleware
 
 from server.routers import router
-from server.utils.auth_middleware import get_current_user, is_public_path, is_admin_path
-from server.models.user_model import User
+from server.utils.auth_middleware import is_public_path
 from src.utils.logging_config import logger
 
 
 app = FastAPI()
-app.include_router(router)
+app.include_router(router, prefix="/api")
 
 # CORS 设置
 app.add_middleware(
@@ -33,85 +32,24 @@ async def dispatch(self, request: Request, call_next):
         if is_public_path(path):
             return await call_next(request)
 
-        # 注意：前端代理已经去掉了 /api 前缀，例如 /api/chat 变成了 /chat
-        # 判断是否需要验证的API请求，包括聊天、数据、工具等
-        is_api_path = (
-            path.startswith("/chat") or
-            path.startswith("/data") or
-            path.startswith("/admin") or
-            path.startswith("/auth") and not is_public_path(path)
-        )
-
-        if not is_api_path:
+        if not path.startswith("/api"):
             # 非API路径，可能是前端路由或静态资源
             return await call_next(request)
 
-        # 提取Authorization头
-        auth_header = request.headers.get("Authorization")
-        if not auth_header or not auth_header.startswith("Bearer "):
-            return JSONResponse(
-                status_code=status.HTTP_401_UNAUTHORIZED,
-                content={"detail": "请先登录"},
-                headers={"WWW-Authenticate": "Bearer"}
-            )
-
-        # 获取token
-        token = auth_header.split("Bearer ")[1]
-
-        # 添加token到请求状态，后续路由可以直接使用
-        request.state.token = token
-
-        # 检查是否需要管理员权限
-        if is_admin_path(path):
-            # 尝试获取数据库会话
-            try:
-                from server.db_manager import db_manager
-                from server.utils.auth_utils import AuthUtils
-
-                db = db_manager.get_session()
-                try:
-                    # 验证token并获取用户信息
-                    payload = AuthUtils.verify_access_token(token)
-                    user_id = payload.get("sub")
-
-                    if not user_id:
-                        return JSONResponse(
-                            status_code=status.HTTP_401_UNAUTHORIZED,
-                            content={"detail": "无效的用户标识"},
-                            headers={"WWW-Authenticate": "Bearer"}
-                        )
-
-                    # 查询用户信息
-                    from server.models.user_model import User
-                    user = db.query(User).filter(User.id == user_id).first()
-
-                    if not user:
-                        return JSONResponse(
-                            status_code=status.HTTP_401_UNAUTHORIZED,
-                            content={"detail": "用户不存在"},
-                            headers={"WWW-Authenticate": "Bearer"}
-                        )
-
-                    # 检查管理员权限
-                    if user.role not in ["admin", "superadmin"]:
-                        return JSONResponse(
-                            status_code=status.HTTP_403_FORBIDDEN,
-                            content={"detail": "需要管理员权限"}
-                        )
-
-                    # 将用户信息添加到请求状态
-                    request.state.user = user
+        # # 提取Authorization头
+        # auth_header = request.headers.get("Authorization")
+        # if not auth_header or not auth_header.startswith("Bearer "):
+        #     return JSONResponse(
+        #         status_code=status.HTTP_401_UNAUTHORIZED,
+        #         content={"detail": f"请先登录。Path: {path}"},
+        #         headers={"WWW-Authenticate": "Bearer"}
+        #     )
 
-                finally:
-                    db.close()
+        # # 获取token
+        # token = auth_header.split("Bearer ")[1]
 
-            except Exception as e:
-                logger.error(f"验证管理员权限出错: {e}")
-                return JSONResponse(
-                    status_code=status.HTTP_401_UNAUTHORIZED,
-                    content={"detail": "验证用户权限出错"},
-                    headers={"WWW-Authenticate": "Bearer"}
-                )
+        # # 添加token到请求状态，后续路由可以直接使用
+        # request.state.token = token
 
         # 继续处理请求
         return await call_next(request)
diff --git a/server/models/__init__.py b/server/models/__init__.py
new file mode 100644
index 000000000..7c2377aec
--- /dev/null
+++ b/server/models/__init__.py
@@ -0,0 +1,3 @@
+from sqlalchemy.ext.declarative import declarative_base
+
+Base = declarative_base()
\ No newline at end of file
diff --git a/server/models/token_model.py b/server/models/token_model.py
deleted file mode 100644
index 74ee1d596..000000000
--- a/server/models/token_model.py
+++ /dev/null
@@ -1,24 +0,0 @@
-from sqlalchemy import Column, Integer, String, DateTime, ForeignKey
-from sqlalchemy.ext.declarative import declarative_base
-from sqlalchemy.sql import func
-
-Base = declarative_base()
-
-class AgentToken(Base):
-    """智能体访问令牌模型"""
-    __tablename__ = 'agent_tokens'
-
-    id = Column(Integer, primary_key=True, autoincrement=True)
-    agent_id = Column(String, nullable=False, index=True)  # 智能体ID
-    name = Column(String, nullable=False)  # 令牌名称
-    token = Column(String, nullable=False, unique=True)  # 令牌值
-    created_at = Column(DateTime, default=func.now())  # 创建时间
-
-    def to_dict(self):
-        return {
-            "id": self.id,
-            "agent_id": self.agent_id,
-            "name": self.name,
-            "token": self.token,
-            "created_at": self.created_at.isoformat() if self.created_at else None
-        }
\ No newline at end of file
diff --git a/server/models/user_model.py b/server/models/user_model.py
index fa0f4dfbe..527d1f817 100644
--- a/server/models/user_model.py
+++ b/server/models/user_model.py
@@ -1,9 +1,8 @@
 from sqlalchemy import Column, Integer, String, DateTime, ForeignKey, Text
-from sqlalchemy.ext.declarative import declarative_base
 from sqlalchemy.sql import func
 from sqlalchemy.orm import relationship
 
-from server.models.token_model import Base
+from server.models import Base
 
 class User(Base):
     """用户模型"""
diff --git a/server/routers/__init__.py b/server/routers/__init__.py
index b11f92745..017bb2b52 100644
--- a/server/routers/__init__.py
+++ b/server/routers/__init__.py
@@ -2,12 +2,10 @@
 from server.routers.chat_router import chat
 from server.routers.data_router import data
 from server.routers.base_router import base
-from server.routers.admin_router import admin
 from server.routers.auth_router import auth
 
 router = APIRouter()
 router.include_router(base)
 router.include_router(chat)
 router.include_router(data)
-router.include_router(admin)
 router.include_router(auth)
diff --git a/server/routers/admin_router.py b/server/routers/admin_router.py
deleted file mode 100644
index 1556e00eb..000000000
--- a/server/routers/admin_router.py
+++ /dev/null
@@ -1,126 +0,0 @@
-import secrets
-import string
-from fastapi import APIRouter, Depends, HTTPException, Query, Request
-from pydantic import BaseModel
-from typing import List, Optional
-from sqlalchemy.orm import Session
-
-from server.db_manager import db_manager
-from server.models.token_model import AgentToken
-from server.models.user_model import User, OperationLog
-from server.utils.auth_middleware import get_db, get_current_user, get_admin_user, oauth2_scheme
-from server.routers.auth_router import log_operation
-
-admin = APIRouter(prefix="/admin", tags=["admin"])
-
-# 请求和响应模型
-class TokenCreate(BaseModel):
-    agent_id: str
-    name: str
-
-class TokenVerify(BaseModel):
-    agent_id: str
-    token: str
-
-class TokenResponse(BaseModel):
-    id: int
-    agent_id: str
-    name: str
-    token: str
-    created_at: str
-
-# 生成随机token
-def generate_token(length=32):
-    alphabet = string.ascii_letters + string.digits
-    return ''.join(secrets.choice(alphabet) for _ in range(length))
-
-@admin.get("/tokens", response_model=List[TokenResponse])
-async def get_agent_tokens(
-    agent_id: Optional[str] = Query(None),
-    current_user: User = Depends(get_admin_user),
-    db: Session = Depends(get_db)
-):
-    """获取智能体的token列表（需要管理员权限）"""
-    query = db.query(AgentToken)
-    if agent_id:
-        query = query.filter(AgentToken.agent_id == agent_id)
-    tokens = query.all()
-    return [token.to_dict() for token in tokens]
-
-@admin.post("/tokens", response_model=TokenResponse)
-async def create_token(
-    token_data: TokenCreate,
-    request: Request,
-    current_user: User = Depends(get_admin_user),
-    db: Session = Depends(get_db)
-):
-    """创建新的token（需要管理员权限）"""
-    # 生成随机token
-    token_value = generate_token()
-
-    # 创建token记录
-    new_token = AgentToken(
-        agent_id=token_data.agent_id,
-        name=token_data.name,
-        token=token_value
-    )
-
-    # 保存到数据库
-    db.add(new_token)
-    db.commit()
-    db.refresh(new_token)
-
-    # 记录操作
-    log_operation(
-        db,
-        current_user.id,
-        "创建令牌",
-        f"为智能体 {token_data.agent_id} 创建访问令牌: {token_data.name}",
-        request
-    )
-
-    return new_token.to_dict()
-
-@admin.delete("/tokens/{token_id}", response_model=dict)
-async def delete_token(
-    token_id: int,
-    request: Request,
-    current_user: User = Depends(get_admin_user),
-    db: Session = Depends(get_db)
-):
-    """删除token（需要管理员权限）"""
-    token = db.query(AgentToken).filter(AgentToken.id == token_id).first()
-    if not token:
-        raise HTTPException(status_code=404, detail="Token not found")
-
-    # 记录操作信息
-    log_operation(
-        db,
-        current_user.id,
-        "删除令牌",
-        f"删除令牌ID: {token_id}, 智能体: {token.agent_id}, 名称: {token.name}",
-        request
-    )
-
-    db.delete(token)
-    db.commit()
-
-    return {"success": True, "message": "Token deleted"}
-
-@admin.post("/verify_token")
-async def verify_agent_token(
-    token_data: TokenVerify,
-    token: Optional[str] = Depends(oauth2_scheme),
-    db: Session = Depends(get_db)
-):
-    """验证智能体访问令牌（所有用户都可访问）"""
-    # 查找令牌
-    agent_token = db.query(AgentToken).filter(
-        AgentToken.agent_id == token_data.agent_id,
-        AgentToken.token == token_data.token
-    ).first()
-
-    if not agent_token:
-        raise HTTPException(status_code=401, detail="Invalid token")
-
-    return {"success": True, "message": "Token verified"}
\ No newline at end of file
diff --git a/server/routers/base_router.py b/server/routers/base_router.py
index 8ee6f3283..632e46850 100644
--- a/server/routers/base_router.py
+++ b/server/routers/base_router.py
@@ -1,4 +1,4 @@
-from fastapi import Request, Body
+from fastapi import Request, Body, Depends
 from fastapi import APIRouter
 from fastapi import Request, Body
 
@@ -6,6 +6,8 @@
 
 from src import config, retriever, knowledge_base, graph_base
 from src.utils import logger
+from server.utils.auth_middleware import get_admin_user, get_superadmin_user
+from server.models.user_model import User
 
 
 @base.get("/")
@@ -13,27 +15,28 @@ async def route_index():
     return {"message": "You Got It!"}
 
 @base.get("/config")
-def get_config():
-    return config.get_safe_config()
+def get_config(current_user: User = Depends(get_admin_user)):
+    return config.dump_config()
 
 @base.post("/config")
-async def update_config(key = Body(...), value = Body(...)):
-    if key == "custom_models":
-        value = config.compare_custom_models(value)
-
+async def update_config(
+    key = Body(...),
+    value = Body(...),
+    current_user: User = Depends(get_admin_user)
+) -> dict:
     config[key] = value
     config.save()
-    return config.get_safe_config()
+    return config.dump_config()
 
 @base.post("/restart")
-async def restart():
+async def restart(current_user: User = Depends(get_superadmin_user)):
     knowledge_base.restart()
     graph_base.start()
     retriever.restart()
     return {"message": "Restarted!"}
 
 @base.get("/log")
-def get_log():
+def get_log(current_user: User = Depends(get_admin_user)):
     from src.utils.logging_config import LOG_FILE
     from collections import deque
 
diff --git a/server/routers/tool_router.py b/server/routers/tool_router.py
deleted file mode 100644
index a587db7a0..000000000
--- a/server/routers/tool_router.py
+++ /dev/null
@@ -1,70 +0,0 @@
-import os
-from fastapi import APIRouter, Body
-from pydantic import BaseModel
-from typing import List, Dict, Any, Optional
-
-from src.agents import agent_manager
-
-tool = APIRouter(prefix="/tool")
-
-
-class Tool(BaseModel):
-    name: str
-    title: str
-    description: str
-    url: str
-    method: Optional[str] = "POST"
-    params: Optional[Dict[str, Any]] = None
-    metadata: Optional[Dict[str, Any]] = None
-
-@tool.get("/", response_model=List[Tool])
-async def route_index():
-    tools = [
-        Tool(
-            name="text-chunking",
-            title="文本分块",
-            description="将文本分块以更好地理解。可以输入文本或者上传文件。",
-            url="/tools/text-chunking",
-            method="POST",
-        ),
-        Tool(
-            name="pdf2txt",
-            title="PDF转文本",
-            description="将PDF文件转换为文本文件。",
-            url="/tools/pdf2txt",
-            method="POST",
-        ),
-        Tool(
-            name="agent",
-            title="智能体（Dev）",
-            description="智能体演练平台，现在还处于开发预览状态，欢迎提 Issue，但先不要用于正式场景。",
-            url="/tools/agent",
-        )
-    ]
-
-    for agent in agent_manager.agents.values():
-        tools.append(
-            Tool(
-                name=agent.name,
-                title=agent.name,
-                description=agent.description,
-                url=f"/agent/{agent.name}",
-                method="POST",
-                metadata=agent.config_schema.to_dict(),
-            )
-        )
-
-    return tools
-
-@tool.post("/text-chunking")
-async def text_chunking(text: str = Body(...), params: Dict[str, Any] = Body(...)):
-    from src.core.indexing import chunk
-    nodes = chunk(text, params=params)
-    return {"nodes": [node.to_dict() for node in nodes]}
-
-@tool.post("/pdf2txt")
-async def handle_pdf2txt(file: str = Body(...)):
-    from src.plugins import ocr
-    text = ocr.process_pdf(file)
-    return {"text": text}
-
diff --git a/server/utils/auth_middleware.py b/server/utils/auth_middleware.py
index f78aa1d20..6bc69d049 100644
--- a/server/utils/auth_middleware.py
+++ b/server/utils/auth_middleware.py
@@ -1,5 +1,5 @@
-from typing import Optional, List
-from fastapi import Depends, HTTPException, status
+from typing import Optional, List, Callable
+from fastapi import Depends, HTTPException, status, APIRouter
 from fastapi.security import OAuth2PasswordBearer
 from sqlalchemy.orm import Session
 from jose import JWTError, jwt
@@ -14,21 +14,11 @@
 
 # 公开路径列表，无需登录即可访问
 PUBLIC_PATHS = [
-    r"^/auth/token$",            # 登录
-    r"^/auth/check-first-run$",  # 检查是否首次运行
-    r"^/auth/initialize$",       # 初始化系统
-    r"^/docs$", r"^/redoc$", r"^/openapi.json$",  # API文档
-    r"^/static/.*$",                # 静态资源
-    r"^/assets/.*$",                # 前端资源文件
-    r"^/$",                         # 根路径（登录页）
-    r"^/login$",                    # 登录页面
-    r"^/home$",                     # 首页
-    r"^/home/.*$",                  # 首页下的所有路径
-    r"^/favicon\.ico$",             # 网站图标
-    r"^/_nuxt/.*$",                 # Nuxt.js生成的资源文件
-    r"^/js/.*$",                    # JavaScript文件
-    r"^/css/.*$",                   # CSS文件
-    r"^/img/.*$"                    # 图片文件
+    r"^/api/auth/token$",            # 登录
+    r"^/api/auth/check-first-run$",  # 检查是否首次运行
+    r"^/api/auth/initialize$",       # 初始化系统
+    r"^/api$",                      # Health Check
+    r"^/api/login$",                # 登录页面
 ]
 
 # 获取数据库会话
@@ -110,35 +100,3 @@ def is_public_path(path: str) -> bool:
         if re.match(pattern, path):
             return True
     return False
-
-# 路径是否需要管理员权限
-ADMIN_PATHS = [
-    r"^/admin/.*$",              # 管理员接口
-    r"^/data/.*$",               # 数据操作接口，所有数据操作都需要管理员权限
-    r"^/chat/set_default_agent$", # 设置默认智能体
-    r"^/chat/models/update$",     # 更新模型列表
-    r"^/auth/users.*$",           # 用户管理相关API
-    r"^/config$"                  # 系统配置API
-]
-
-# 路径是否需要超级管理员权限
-SUPERADMIN_PATHS = [
-    r"^/restart$",                # 系统重启
-    r"^/auth/users/\d+/role$"     # 修改用户角色（仅超级管理员可操作）
-]
-
-# 检查路径是否需要管理员权限
-def is_admin_path(path: str) -> bool:
-    path = path.rstrip('/')  # 去除尾部斜杠以便于匹配
-    for pattern in ADMIN_PATHS:
-        if re.match(pattern, path):
-            return True
-    return False
-
-# 检查路径是否需要超级管理员权限
-def is_superadmin_path(path: str) -> bool:
-    path = path.rstrip('/')  # 去除尾部斜杠以便于匹配
-    for pattern in SUPERADMIN_PATHS:
-        if re.match(pattern, path):
-            return True
-    return False
\ No newline at end of file
diff --git a/src/config/__init__.py b/src/config/__init__.py
index 99969c385..38dee3efc 100644
--- a/src/config/__init__.py
+++ b/src/config/__init__.py
@@ -214,18 +214,8 @@ def save(self):
 
         logger.info(f"Config file {self.filename} saved")
 
-    def get_safe_config(self):
-        """
-        获取安全的配置，即过滤掉 api_key
-        """
-
-        config = json.loads(str(self))
-
-        # 过滤掉 api_key
-        for model in config.get("custom_models", []):
-            model["api_key"] = DEFAULT_MOCK_API if model.get("api_key") else ""
-
-        return config
+    def dump_config(self):
+        return json.loads(str(self))
 
     def compare_custom_models(self, value):
         """
diff --git a/web/src/apis/admin_api.js b/web/src/apis/admin_api.js
index 9e2985242..8b48d8964 100644
--- a/web/src/apis/admin_api.js
+++ b/web/src/apis/admin_api.js
@@ -70,40 +70,6 @@ export const userManagementApi = {
   },
 }
 
-// 令牌管理API
-export const tokenApi = {
-  /**
-   * 获取令牌列表
-   * @param {string} agentId - 智能体ID
-   * @returns {Promise} - 令牌列表
-   */
-  getTokens: async (agentId) => {
-    checkAdminPermission()
-    return apiGet(`/api/admin/tokens?agent_id=${agentId}`, {}, true)
-  },
-
-  /**
-   * 创建新令牌
-   * @param {string} agentId - 智能体ID
-   * @param {string} name - 令牌名称
-   * @returns {Promise} - 创建结果
-   */
-  createToken: async (agentId, name) => {
-    checkAdminPermission()
-    return apiPost('/api/admin/tokens', { agent_id: agentId, name }, {}, true)
-  },
-
-  /**
-   * 删除令牌
-   * @param {string} tokenId - 令牌ID
-   * @returns {Promise} - 删除结果
-   */
-  deleteToken: async (tokenId) => {
-    checkAdminPermission()
-    return apiDelete(`/api/admin/tokens/${tokenId}`, {}, true)
-  },
-}
-
 // 知识库管理API
 export const knowledgeBaseApi = {
   /**
diff --git a/web/src/apis/base.js b/web/src/apis/base.js
index 5b403d8ae..9e6a7eee0 100644
--- a/web/src/apis/base.js
+++ b/web/src/apis/base.js
@@ -42,7 +42,7 @@ export async function apiRequest(url, options = {}, requiresAuth = false) {
       // 尝试解析错误信息
       let errorMessage = `请求失败: ${response.status}`
       let errorData = null
-      
+
       try {
         errorData = await response.json()
         errorMessage = errorData.detail || errorData.message || errorMessage
@@ -56,15 +56,15 @@ export async function apiRequest(url, options = {}, requiresAuth = false) {
         const userStore = useUserStore()
         if (userStore.isLoggedIn) {
           // 如果用户认为自己已登录，但收到401，则可能是令牌过期
-          const isTokenExpired = errorData && 
-            (errorData.detail?.includes('令牌已过期') || 
+          const isTokenExpired = errorData &&
+            (errorData.detail?.includes('令牌已过期') ||
              errorData.detail?.includes('token expired') ||
              errorMessage?.includes('令牌已过期') ||
              errorMessage?.includes('token expired'))
-          
+
           message.error(isTokenExpired ? '登录已过期，请重新登录' : '认证失败，请重新登录')
           userStore.logout()
-          
+
           // 使用setTimeout确保消息显示后再跳转
           setTimeout(() => {
             window.location.href = '/login'
diff --git a/web/src/components/TokenManagerComponent.vue b/web/src/components/TokenManagerComponent.vue
deleted file mode 100644
index c29b7d4ea..000000000
--- a/web/src/components/TokenManagerComponent.vue
+++ /dev/null
@@ -1,232 +0,0 @@
-<template>
-  <div class="token-manager">
-    <div class="token-tools">
-      <a-button type="primary" size="small" @click="showAddTokenModal">
-        <PlusOutlined /> 创建 Token
-      </a-button>
-    </div>
-    <!-- 令牌列表 -->
-    <div class="token-list" v-if="tokens.length > 0">
-      <a-spin :spinning="loading">
-        <a-list size="small">
-          <a-list-item v-for="token in tokens" :key="token.id">
-            <div class="token-item">
-              <div class="token-info">
-                <div class="token-name">{{ token.name }}</div>
-                <div class="token-value">
-                  <code>{{ token.token }}</code>
-                  <a-button type="link" size="small" @click="copyToken(token.token)">
-                    <CopyOutlined />
-                  </a-button>
-                </div>
-                <div class="token-time">创建时间: {{ formatDate(token.created_at) }}</div>
-              </div>
-              <div class="token-actions">
-                <a-popconfirm
-                  title="确定要删除这个令牌吗?"
-                  ok-text="确定"
-                  cancel-text="取消"
-                  @confirm="deleteToken(token.id)"
-                >
-                  <a-button type="text" danger size="small">
-                    <DeleteOutlined />
-                  </a-button>
-                </a-popconfirm>
-              </div>
-            </div>
-          </a-list-item>
-        </a-list>
-      </a-spin>
-    </div>
-    <a-empty v-else description="暂无访问令牌" :image="Empty.PRESENTED_IMAGE_SIMPLE" />
-
-    <!-- 添加令牌弹窗 -->
-    <a-modal
-      v-model:open="addTokenModalVisible"
-      title="添加访问令牌"
-      ok-text="创建"
-      cancel-text="取消"
-      @ok="createToken"
-    >
-      <a-form :model="newToken" layout="vertical">
-        <a-form-item label="令牌名称" name="name">
-          <a-input v-model:value="newToken.name" placeholder="请输入令牌名称" />
-        </a-form-item>
-      </a-form>
-    </a-modal>
-  </div>
-</template>
-
-<script setup>
-import { ref, onMounted, watch } from 'vue';
-import { message, Empty } from 'ant-design-vue';
-import { PlusOutlined, DeleteOutlined, CopyOutlined } from '@ant-design/icons-vue';
-import { tokenApi } from '@/apis/admin_api';
-
-const props = defineProps({
-  agentId: {
-    type: String,
-    required: true
-  }
-});
-
-// 状态
-const tokens = ref([]);
-const loading = ref(false);
-const addTokenModalVisible = ref(false);
-const newToken = ref({
-  name: ''
-});
-
-// 获取令牌列表
-const fetchTokens = async () => {
-  loading.value = true;
-  try {
-    const data = await tokenApi.getTokens(props.agentId);
-    tokens.value = data;
-  } catch (error) {
-    console.error('获取令牌列表出错:', error);
-    message.error(error.message || '获取令牌列表出错');
-  } finally {
-    loading.value = false;
-  }
-};
-
-// 创建新令牌
-const createToken = async () => {
-  if (!newToken.value.name.trim()) {
-    message.warning('请输入令牌名称');
-    return;
-  }
-
-  try {
-    const data = await tokenApi.createToken(props.agentId, newToken.value.name);
-    tokens.value.push(data);
-    message.success('令牌创建成功');
-    addTokenModalVisible.value = false;
-    newToken.value.name = '';
-  } catch (error) {
-    console.error('创建令牌出错:', error);
-    message.error(error.message || '创建令牌出错');
-  }
-};
-
-// 删除令牌
-const deleteToken = async (tokenId) => {
-  try {
-    await tokenApi.deleteToken(tokenId);
-    tokens.value = tokens.value.filter(token => token.id !== tokenId);
-    message.success('令牌已删除');
-  } catch (error) {
-    console.error('删除令牌出错:', error);
-    message.error(error.message || '删除令牌出错');
-  }
-};
-
-// 复制令牌到剪贴板
-const copyToken = (token) => {
-  navigator.clipboard.writeText(token).then(() => {
-    message.success('令牌已复制到剪贴板');
-  });
-};
-
-// 显示添加令牌弹窗
-const showAddTokenModal = () => {
-  newToken.value.name = '';
-  addTokenModalVisible.value = true;
-};
-
-// 格式化日期
-const formatDate = (dateString) => {
-  if (!dateString) return '';
-  const date = new Date(dateString);
-  return date.toLocaleString();
-};
-
-// 监听agentId变化
-watch(() => props.agentId, (newAgentId) => {
-  if (newAgentId) {
-    fetchTokens();
-  } else {
-    tokens.value = [];
-  }
-}, { immediate: true });
-
-// 组件挂载时获取令牌列表
-onMounted(() => {
-  if (props.agentId) {
-    fetchTokens();
-  }
-});
-</script>
-
-<style lang="less" scoped>
-.token-manager {
-  margin-top: 1rem;
-  // padding: 0 0.5rem;
-}
-
-.manager-title {
-  font-size: 1rem;
-  margin-bottom: 1rem;
-}
-
-.token-tools {
-  margin-bottom: 1rem;
-  display: flex;
-  justify-content: flex-end;
-}
-
-.token-list {
-  max-height: calc(100vh - 400px);
-  overflow-y: auto;
-  li.ant-list-item {
-    background-color: var(--gray-100);
-    border-radius: 0.5rem;
-    padding: 0.5rem;
-    margin-bottom: 0.5rem;
-  }
-}
-
-.token-item {
-  display: flex;
-  justify-content: space-between;
-  width: 100%;
-}
-
-.token-info {
-  flex: 1;
-}
-
-.token-name {
-  font-weight: 500;
-  margin-bottom: 0.25rem;
-}
-
-.token-value {
-  display: flex;
-  align-items: center;
-  gap: 0.5rem;
-  font-size: 0.8rem;
-  background-color: var(--main-light-4);
-  padding: 0.25rem 0.5rem;
-  border-radius: 4px;
-  margin-bottom: 0.25rem;
-  overflow-x: auto;
-  user-select: all;
-
-  code {
-    flex: 1;
-  }
-}
-
-.token-time {
-  font-size: 0.75rem;
-  color: var(--gray-500);
-}
-
-.token-actions {
-  display: flex;
-  align-items: center;
-}
-</style>
\ No newline at end of file
diff --git a/web/src/components/UserInfoComponent.vue b/web/src/components/UserInfoComponent.vue
index 5f5565891..e22e36e9b 100644
--- a/web/src/components/UserInfoComponent.vue
+++ b/web/src/components/UserInfoComponent.vue
@@ -4,7 +4,7 @@
       <div class="user-info-dropdown" :data-align="showRole ? 'left' : 'center'">
         <div class="user-avatar">
           <UserOutlined />
-          <div class="user-role-badge" :class="userRoleClass"></div>
+          <!-- <div class="user-role-badge" :class="userRoleClass"></div> -->
         </div>
         <div v-if="showRole">{{ userStore.username }}</div>
       </div>
@@ -116,8 +116,6 @@ const goToLogin = () => {
   width: 30px;
   height: 30px;
   border-radius: 50%;
-  background-color: var(--main-color);
-  color: white;
   display: flex;
   align-items: center;
   justify-content: center;
diff --git a/web/src/layouts/AppLayout.vue b/web/src/layouts/AppLayout.vue
index 23705db2e..6e325463f 100644
--- a/web/src/layouts/AppLayout.vue
+++ b/web/src/layouts/AppLayout.vue
@@ -30,7 +30,6 @@ import { useConfigStore } from '@/stores/config'
 import { useDatabaseStore } from '@/stores/database'
 import DebugComponent from '@/components/DebugComponent.vue'
 import UserInfoComponent from '@/components/UserInfoComponent.vue'
-import { configApi } from '@/apis/public_api'
 
 const configStore = useConfigStore()
 const databaseStore = useDatabaseStore()
@@ -80,12 +79,6 @@ onMounted(() => {
 const route = useRoute()
 console.log(route)
 
-const apiDocsUrl = computed(() => {
-  // return `${import.meta.env.VITE_API_URL || `http://${window.location.hostname}:${window.location.port}`}/docs`
-  return `http://localhost:5050/docs`
-})
-
-
 // 下面是导航菜单部分，添加智能体项
 const mainList = [{
     name: '对话',
@@ -167,10 +160,6 @@ const mainList = [{
       </div>
       <div class="fill" style="flex-grow: 1;"></div>
 
-      <!-- 用户信息组件 -->
-      <div class="nav-item user-info">
-        <UserInfoComponent />
-      </div>
 
       <div class="github nav-item">
         <a-tooltip placement="right">
@@ -191,6 +180,15 @@ const mainList = [{
           </a>
         </a-tooltip>
       </div> -->
+
+      <!-- 用户信息组件 -->
+      <div class="nav-item user-info">
+        <a-tooltip placement="right">
+          <template #title>用户信息</template>
+          <UserInfoComponent />
+        </a-tooltip>
+      </div>
+
       <RouterLink class="nav-item setting" to="/setting" active-class="active">
         <a-tooltip placement="right">
           <template #title>设置</template>
diff --git a/web/src/stores/config.js b/web/src/stores/config.js
index 578f1fbf4..44496a9e8 100644
--- a/web/src/stores/config.js
+++ b/web/src/stores/config.js
@@ -1,5 +1,6 @@
 import { ref, computed } from 'vue'
 import { defineStore } from 'pinia'
+import { systemConfigApi } from '@/apis/admin_api'
 
 export const useCounterStore = defineStore('counter', () => {
   const count = ref(0)
@@ -20,27 +21,19 @@ export const useConfigStore = defineStore('config', () => {
 
   function setConfigValue(key, value) {
     config.value[key] = value
-    fetch('/api/config', {
-      method: 'POST',
-      body: JSON.stringify({ key, value }),
-      headers: {
-        'Content-Type': 'application/json'
-      }
-    })
-    .then(response => response.json())
-    .then(data => {
-      console.debug('Success:', data)
-      setConfig(data)
-    })
+    systemConfigApi.updateSystemConfig({ key, value })
+      .then(data => {
+        console.debug('Success:', data)
+        setConfig(data)
+      })
   }
 
   function refreshConfig() {
-    fetch('/api/config')
-    .then(response => response.json())
-    .then(data => {
-      console.log("config", data)
-      setConfig(data)
-    })
+    systemConfigApi.getSystemConfig()
+      .then(data => {
+        console.log("config", data)
+        setConfig(data)
+      })
   }
 
   return { config, setConfig, setConfigValue, refreshConfig }
diff --git a/web/src/views/AgentView.vue b/web/src/views/AgentView.vue
index 2f5149cb0..946ccd269 100644
--- a/web/src/views/AgentView.vue
+++ b/web/src/views/AgentView.vue
@@ -40,14 +40,6 @@
             智能体配置
           </a-button>
 
-          <a-button
-            class="action-button"
-            @click="openTokenModal"
-          >
-            <template #icon><KeyOutlined /></template>
-            访问令牌
-          </a-button>
-
           <a-button
             class="action-button"
             @click="goToAgentPage"
@@ -204,16 +196,6 @@
       </div>
     </a-modal>
 
-    <!-- 令牌管理弹窗 -->
-    <a-modal
-      v-model:open="state.tokenModalVisible"
-      title="访问令牌管理"
-      width="650px"
-      :footer="null"
-      @cancel="closeTokenModal"
-    >
-      <TokenManagerComponent v-if="selectedAgentId" :agent-id="selectedAgentId" />
-    </a-modal>
   </div>
 </template>
 
@@ -233,8 +215,6 @@ import {
 } from '@ant-design/icons-vue';
 import { message } from 'ant-design-vue';
 import AgentChatComponent from '@/components/AgentChatComponent.vue';
-import TokenManagerComponent from '@/components/TokenManagerComponent.vue';
-import UserInfoComponent from '@/components/UserInfoComponent.vue';
 import { useUserStore } from '@/stores/user';
 import { chatApi } from '@/apis/auth_api';
 import { systemConfigApi } from '@/apis/admin_api';
@@ -253,7 +233,6 @@ const state = reactive({
   isSidebarOpen: JSON.parse(localStorage.getItem('agent-sidebar-open') || 'true'),
   isConfigSidebarOpen: false,
   configModalVisible: false,
-  tokenModalVisible: false,
   isEmptyConfig: computed(() =>
     !selectedAgentId.value ||
     Object.keys(configurableItems.value).length === 0
@@ -521,16 +500,6 @@ const openConfigModal = () => {
 const closeConfigModal = () => {
   state.configModalVisible = false;
 };
-
-// 打开令牌管理弹窗
-const openTokenModal = () => {
-  state.tokenModalVisible = true;
-};
-
-// 关闭令牌管理弹窗
-const closeTokenModal = () => {
-  state.tokenModalVisible = false;
-};
 </script>
 
 <style lang="less" scoped>
@@ -580,12 +549,6 @@ const closeTokenModal = () => {
     min-width: calc(var(--config-sidebar-width) - 16px);
     overflow-y: auto;
     max-height: calc(100vh - 100px);
-
-    .token-section {
-      margin-top: 1.5rem;
-      border-top: 1px solid var(--main-light-3);
-      padding-top: 1rem;
-    }
   }
 
   .no-agent-selected {
diff --git a/web/src/views/DataBaseInfoView.vue b/web/src/views/DataBaseInfoView.vue
index a4f74bc8e..bcf58d4d7 100644
--- a/web/src/views/DataBaseInfoView.vue
+++ b/web/src/views/DataBaseInfoView.vue
@@ -286,7 +286,6 @@ import { onMounted, reactive, ref, watch, toRaw, onUnmounted, computed } from 'v
 import { message, Modal } from 'ant-design-vue';
 import { useRoute, useRouter } from 'vue-router';
 import { useConfigStore } from '@/stores/config'
-import { useUserStore } from '@/stores/user'
 import { knowledgeBaseApi } from '@/apis/admin_api'
 import HeaderComponent from '@/components/HeaderComponent.vue';
 import {
@@ -300,7 +299,6 @@ import {
   CloudUploadOutlined,
   SearchOutlined,
   LoadingOutlined,
-  CaretUpOutlined
 } from '@ant-design/icons-vue'
 
 
@@ -397,7 +395,7 @@ const onQuery = () => {
     return
   }
   meta.db_id = database.value.db_id
-  
+
   try {
     knowledgeBaseApi.queryTest({
       query: queryText.value.trim(),
@@ -480,7 +478,7 @@ const deleteDatabse = () => {
 
 const openFileDetail = (record) => {
   state.lock = true
-  
+
   try {
     knowledgeBaseApi.getDocumentDetail(databaseId.value, record.file_id)
       .then(data => {
diff --git a/web/vite.config.js b/web/vite.config.js
index d318dcb7c..823e8324e 100644
--- a/web/vite.config.js
+++ b/web/vite.config.js
@@ -16,7 +16,7 @@ export default defineConfig(({ mode }) => {
         '^/api': {
           target: env.VITE_API_URL || 'http://127.0.0.1:5050',
           changeOrigin: true,
-          rewrite: (path) => path.replace(/^\/api/, '')
+          rewrite: (path) => path.replace(/^\/api/, '/api')
         }
       },
       watch: {

From 39bfc3d7860c0eea73eef8c5815f5640eb91c4c2 Mon Sep 17 00:00:00 2001
From: Wenjie Zhang <xerrors@163.com>
Date: Mon, 5 May 2025 16:34:23 +0800
Subject: [PATCH 06/10] =?UTF-8?q?=E6=9A=82=E6=97=B6=E5=B1=8F=E8=94=BD?=
 =?UTF-8?q?=E5=AF=B9=E8=AF=9D=E5=8E=86=E5=8F=B2=E7=AE=A1=E7=90=86=EF=BC=88?=
 =?UTF-8?q?=E6=95=B0=E6=8D=AE=E5=BA=93=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 web/src/apis/auth_api.js | 60 ++++++++++++++++++++--------------------
 1 file changed, 30 insertions(+), 30 deletions(-)

diff --git a/web/src/apis/auth_api.js b/web/src/apis/auth_api.js
index 920108208..1e2f34b7b 100644
--- a/web/src/apis/auth_api.js
+++ b/web/src/apis/auth_api.js
@@ -92,36 +92,36 @@ export const chatApi = {
    */
   getTools: () => apiGet('/api/chat/tools', {}, true),
 
-  /**
-   * 获取对话历史
-   * @returns {Promise} - 对话历史列表
-   */
-  getConversations: () => apiGet('/api/chat/conversations', {}, true),
-
-  /**
-   * 获取特定对话
-   * @param {string} conversationId - 对话ID
-   * @returns {Promise} - 对话详情
-   */
-  getConversation: (conversationId) =>
-    apiGet(`/api/chat/conversations/${conversationId}`, {}, true),
-
-  /**
-   * 删除对话
-   * @param {string} conversationId - 对话ID
-   * @returns {Promise} - 删除结果
-   */
-  deleteConversation: (conversationId) =>
-    apiDelete(`/api/chat/conversations/${conversationId}`, {}, true),
-
-  /**
-   * 更新对话标题
-   * @param {string} conversationId - 对话ID
-   * @param {string} title - 新标题
-   * @returns {Promise} - 更新结果
-   */
-  updateConversationTitle: (conversationId, title) =>
-    apiPost(`/api/chat/conversations/${conversationId}/title`, { title }, {}, true),
+  // /**
+  //  * 获取对话历史
+  //  * @returns {Promise} - 对话历史列表
+  //  */
+  // getConversations: () => apiGet('/api/chat/conversations', {}, true),
+
+  // /**
+  //  * 获取特定对话
+  //  * @param {string} conversationId - 对话ID
+  //  * @returns {Promise} - 对话详情
+  //  */
+  // getConversation: (conversationId) =>
+  //   apiGet(`/api/chat/conversations/${conversationId}`, {}, true),
+
+  // /**
+  //  * 删除对话
+  //  * @param {string} conversationId - 对话ID
+  //  * @returns {Promise} - 删除结果
+  //  */
+  // deleteConversation: (conversationId) =>
+  //   apiDelete(`/api/chat/conversations/${conversationId}`, {}, true),
+
+  // /**
+  //  * 更新对话标题
+  //  * @param {string} conversationId - 对话ID
+  //  * @param {string} title - 新标题
+  //  * @returns {Promise} - 更新结果
+  //  */
+  // updateConversationTitle: (conversationId, title) =>
+  //   apiPost(`/api/chat/conversations/${conversationId}/title`, { title }, {}, true),
 }
 
 // 用户设置API

From 36b8cc80a50dbc76889340fe0cc307f335c88d8e Mon Sep 17 00:00:00 2001
From: Wenjie Zhang <xerrors@163.com>
Date: Mon, 5 May 2025 19:40:23 +0800
Subject: [PATCH 07/10] =?UTF-8?q?=E4=BC=98=E5=8C=96=E9=85=8D=E7=BD=AE?=
 =?UTF-8?q?=E6=9B=B4=E6=96=B0=E6=96=B9=E6=B3=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 server/routers/base_router.py |  9 ++++++
 src/config/__init__.py        |  4 +++
 web/src/apis/admin_api.js     | 10 +++---
 web/src/stores/config.js      | 18 +++++++++--
 web/src/views/SettingView.vue | 58 ++++++++++++++++++++++-------------
 5 files changed, 72 insertions(+), 27 deletions(-)

diff --git a/server/routers/base_router.py b/server/routers/base_router.py
index 632e46850..ea70877b9 100644
--- a/server/routers/base_router.py
+++ b/server/routers/base_router.py
@@ -28,6 +28,15 @@ async def update_config(
     config.save()
     return config.dump_config()
 
+@base.post("/config/update")
+async def update_config_item(
+    items: dict = Body(...),
+    current_user: User = Depends(get_admin_user)
+) -> dict:
+    config.update(items)
+    config.save()
+    return config.dump_config()
+
 @base.post("/restart")
 async def restart(current_user: User = Depends(get_superadmin_user)):
     knowledge_base.restart()
diff --git a/src/config/__init__.py b/src/config/__init__.py
index 38dee3efc..6bc14fdda 100644
--- a/src/config/__init__.py
+++ b/src/config/__init__.py
@@ -29,6 +29,10 @@ def __setitem__(self, key, value):
     def __dict__(self):
         return {k: v for k, v in self.items()}
 
+    def update(self, other):
+        for key, value in other.items():
+            self[key] = value
+
 
 class Config(SimpleConfig):
 
diff --git a/web/src/apis/admin_api.js b/web/src/apis/admin_api.js
index 8b48d8964..102656343 100644
--- a/web/src/apis/admin_api.js
+++ b/web/src/apis/admin_api.js
@@ -257,14 +257,16 @@ export const systemConfigApi = {
     return apiGet('/api/config', {}, true)
   },
 
+
   /**
-   * 更新系统配置
-   * @param {Object} config - 配置项
+   * 更新某个配置
+   * @param {Object} items - 配置项
    * @returns {Promise} - 更新结果
    */
-  updateSystemConfig: async (config) => {
+  updateConfigItems: async (items) => {
     checkAdminPermission()
-    return apiPut('/api/config', config, {}, true)
+    console.log("updateConfigItems", items)
+    return apiPost('/api/config/update', items, {}, true)
   },
 
   /**
diff --git a/web/src/stores/config.js b/web/src/stores/config.js
index 44496a9e8..91b78a54e 100644
--- a/web/src/stores/config.js
+++ b/web/src/stores/config.js
@@ -21,7 +21,21 @@ export const useConfigStore = defineStore('config', () => {
 
   function setConfigValue(key, value) {
     config.value[key] = value
-    systemConfigApi.updateSystemConfig({ key, value })
+    systemConfigApi.updateConfigItems({ [key]: value })
+      .then(data => {
+        console.debug('Success:', data)
+        setConfig(data)
+      })
+  }
+
+  function setConfigValues(items) {
+    // 更新本地配置
+    for (const key in items) {
+      config.value[key] = items[key]
+    }
+
+    // 发送到服务器
+    systemConfigApi.updateConfigItems(items)
       .then(data => {
         console.debug('Success:', data)
         setConfig(data)
@@ -36,5 +50,5 @@ export const useConfigStore = defineStore('config', () => {
       })
   }
 
-  return { config, setConfig, setConfigValue, refreshConfig }
+  return { config, setConfig, setConfigValue, refreshConfig, setConfigValues }
 })
\ No newline at end of file
diff --git a/web/src/views/SettingView.vue b/web/src/views/SettingView.vue
index 0a0fd6ae4..f4c32856c 100644
--- a/web/src/views/SettingView.vue
+++ b/web/src/views/SettingView.vue
@@ -92,7 +92,7 @@
             <div
               :class="{'model_selected': modelProvider == 'custom' && configStore.config.model_name == item.custom_id, 'card-models': true, 'custom-model': true}"
               v-for="(item, key) in configStore.config.custom_models" :key="item.custom_id"
-              @click="handleChange('model_provider', 'custom'); handleChange('model_name', item.custom_id)"
+              @click="handleChanges({ model_provider: 'custom', model_name: item.custom_id })"
             >
               <div class="card-models__header">
                 <div class="name" :title="item.name">{{ item.name }}</div>
@@ -181,7 +181,7 @@
               <div
                 :class="{'model_selected': modelProvider == item && configStore.config.model_name == model, 'card-models': true}"
                 v-for="(model, idx) in modelNames[item].models" :key="idx"
-                @click="handleChange('model_provider', item); handleChange('model_name', model)"
+                @click="handleChanges({ model_provider: item, model_name: model })"
               >
                 <div class="model_name">{{ model }}</div>
               </div>
@@ -470,7 +470,7 @@ const handleModelLocalPathsUpdate = (config) => {
   handleChange('model_local_paths', config)
 }
 
-const handleChange = (key, e) => {
+const preHandleChange = (key, e) => {
   if (key == 'enable_knowledge_graph' && e && !configStore.config.enable_knowledge_base) {
     message.error('启动知识图谱必须请先启用知识库功能')
     return
@@ -481,29 +481,45 @@ const handleChange = (key, e) => {
     return
   }
 
-  // 这些都是需要重启的配置
+  if (key == 'enable_reranker' && e && !configStore.config.enable_reranker) {
+    message.error('启动重排序必须请先启用重排序功能')
+    return
+  }
+
   if (key == 'enable_reranker'
-        || key == 'enable_knowledge_graph'
-        || key == 'enable_knowledge_base'
-        || key == 'enable_web_search'
-        || key == 'embed_model'
-        || key == 'reranker'
-        || key == 'model_local_paths') {
-    if (!isNeedRestart.value) {
-      isNeedRestart.value = true
-      notification.info({
-        message: '需要重新加载模型',
-        description: '请点击右下角按钮重新加载模型',
-        placement: 'topLeft',
-        duration: 0,
-        btn: h(Button, { type: 'primary', onClick: sendRestart }, '立即重新加载')
-      })
-    }
+    || key == 'enable_knowledge_graph'
+    || key == 'enable_knowledge_base'
+    || key == 'embed_model'
+    || key == 'reranker'
+    || key == 'model_local_paths') {
+    isNeedRestart.value = true
+    notification.info({
+      message: '需要重新加载模型',
+      description: '请点击右下角按钮重新加载模型',
+      placement: 'topLeft',
+      duration: 0,
+      btn: h(Button, { type: 'primary', onClick: sendRestart }, '立即重新加载')
+    })
   }
+  return true
+}
 
+const handleChange = (key, e) => {
+  if (!preHandleChange(key, e)) {
+    return
+  }
   configStore.setConfigValue(key, e)
 }
 
+const handleChanges = (items) => {
+  for (const key in items) {
+    if (!preHandleChange(key, items[key])) {
+      return
+    }
+  }
+  configStore.setConfigValues(items)
+}
+
 const handleAddOrEditCustomModel = async () => {
   if (!customModel.name || !customModel.api_base) {
     message.error('请填写完整的模型名称和API Base信息。')
@@ -585,7 +601,7 @@ onUnmounted(() => {
 const sendRestart = () => {
   console.log('Restarting...')
   message.loading({ content: '重新加载模型中', key: "restart", duration: 0 });
-  
+
   systemConfigApi.restartServer()
     .then(() => {
       console.log('Restarted')

From cde6a2565f4d0a9b390618cf91f68224548b254d Mon Sep 17 00:00:00 2001
From: Wenjie Zhang <xerrors@163.com>
Date: Mon, 5 May 2025 19:40:58 +0800
Subject: [PATCH 08/10] =?UTF-8?q?=E4=BF=AE=E5=A4=8Dsystem=20prompt=20?=
 =?UTF-8?q?=E5=AF=B9=E4=BA=8E=20DeepSeek=20=E6=8E=A5=E5=8F=A3=E8=A6=81?=
 =?UTF-8?q?=E6=B1=82=20system=20prompt=20=E5=BF=85=E9=A1=BB=E5=9C=A8?=
 =?UTF-8?q?=E7=AC=AC=E4=B8=80=E4=B8=AA=E7=9A=84=20bug?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/core/history.py | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/core/history.py b/src/core/history.py
index 277a8d385..6e5c597e3 100644
--- a/src/core/history.py
+++ b/src/core/history.py
@@ -3,11 +3,14 @@
 
 class HistoryManager():
     def __init__(self, history=None, system_prompt=None):
-        self.messages = history or []
+        self.messages = []
 
         system_prompt = system_prompt or get_system_prompt()
         self.add_system(system_prompt)
 
+        if history:
+            self.messages.extend(history)
+
     def add(self, role, content):
         self.messages.append({"role": role, "content": content})
         return self.messages

From b7ea0a454eaa197cfea833867143267c48f53f0f Mon Sep 17 00:00:00 2001
From: Wenjie Zhang <xerrors@163.com>
Date: Mon, 5 May 2025 19:48:55 +0800
Subject: [PATCH 09/10] =?UTF-8?q?=E6=B7=BB=E5=8A=A0=E4=BB=BB=E5=8A=A1?=
 =?UTF-8?q?=E5=BE=85=E5=8A=9E?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 web/src/views/LoginView.vue   | 9 +++++----
 web/src/views/SettingView.vue | 2 ++
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/web/src/views/LoginView.vue b/web/src/views/LoginView.vue
index 26922784b..a7b913255 100644
--- a/web/src/views/LoginView.vue
+++ b/web/src/views/LoginView.vue
@@ -1,4 +1,5 @@
 <template>
+  <!-- TODO 登录页面样式优化；（1）风格和整个系统统一； -->
   <div class="login-view">
     <div class="login-container">
       <div class="login-logo">
@@ -144,7 +145,7 @@ const handleLogin = async () => {
     // 获取重定向路径
     const redirectPath = sessionStorage.getItem('redirect') || '/';
     sessionStorage.removeItem('redirect'); // 清除重定向信息
-    
+
     // 根据用户角色决定重定向目标
     if (redirectPath === '/') {
       // 如果是管理员，直接跳转到/chat页面
@@ -152,7 +153,7 @@ const handleLogin = async () => {
         router.push('/chat');
         return;
       }
-      
+
       // 普通用户跳转到默认智能体
       try {
         // 尝试获取默认智能体
@@ -162,14 +163,14 @@ const handleLogin = async () => {
           router.push(`/agent/${data.default_agent_id}`);
           return;
         }
-        
+
         // 没有默认智能体，获取第一个可用智能体
         const agentData = await chatApi.getAgents();
         if (agentData.agents && agentData.agents.length > 0) {
           router.push(`/agent/${agentData.agents[0].name}`);
           return;
         }
-        
+
         // 没有可用智能体，回退到首页
         router.push('/');
       } catch (error) {
diff --git a/web/src/views/SettingView.vue b/web/src/views/SettingView.vue
index f4c32856c..cc8098c35 100644
--- a/web/src/views/SettingView.vue
+++ b/web/src/views/SettingView.vue
@@ -1,4 +1,5 @@
 <template>
+  <!-- TODO 优化样式，表格优化，添加一个 utils 的函数，用来把时间戳转换为东 8 区的时间，并格式化显示出来 -->
   <div class="">
     <HeaderComponent title="设置" class="setting-header">
 
@@ -221,6 +222,7 @@
           @update:config="handleModelLocalPathsUpdate"
         />
       </div>
+      <!-- TODO 用户管理优化，添加姓名（默认使用用户名配置项） -->
       <div class="setting" v-if="state.section === 'user'">
         <div class="section-header">
           <h2>用户管理</h2>

From cd356f60a382c31e40c470bbde0821f77b745a24 Mon Sep 17 00:00:00 2001
From: Wenjie Zhang <xerrors@163.com>
Date: Tue, 6 May 2025 10:37:39 +0800
Subject: [PATCH 10/10] =?UTF-8?q?=E4=BC=98=E5=8C=96=E6=A0=B7=E5=BC=8F?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 web/src/views/SettingView.vue | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/web/src/views/SettingView.vue b/web/src/views/SettingView.vue
index cc8098c35..f46eb9dcf 100644
--- a/web/src/views/SettingView.vue
+++ b/web/src/views/SettingView.vue
@@ -140,7 +140,7 @@
                     <a-input v-model:value="customModel.api_base" />
                   </a-form-item>
                   <a-form-item label="API KEY" name="api_key">
-                    <a-input-password v-model:value="customModel.api_key" :visibilityToggle="false" autocomplete="new-password"/>
+                    <a-input-password v-model:value="customModel.api_key" :visibilityToggle="true" autocomplete="new-password"/>
                   </a-form-item>
                 </a-form>
               </a-modal>
@@ -937,8 +937,8 @@ const getRoleColor = (role) => {
 </script>
 
 <style lang="less" scoped>
-:root {
-  --setting-header-height: 200px;
+.setting-container {
+  --setting-header-height: 65px;
 }
 
 .setting-header {
@@ -962,7 +962,7 @@ const getRoleColor = (role) => {
   height: 100%;
   padding: 0 20px;
   position: sticky;
-  top: 100px;
+  top: var(--setting-header-height);
   display: flex;
   flex-direction: column;
   align-items: center;