diff --git a/xtools-app-standalone/src/main/resources/application-app-sys.yaml b/xtools-app-standalone/src/main/resources/application-app-sys.yaml
index 8730f9f..7f70313 100644
--- a/xtools-app-standalone/src/main/resources/application-app-sys.yaml
+++ b/xtools-app-standalone/src/main/resources/application-app-sys.yaml
@@ -16,12 +16,25 @@ sys:
       - /**/page
       - /**/tree-table
       - /**/trees
+      - /**/stats/**
+      - /**/monitor/**
       # sys
-      - /sys/dict-item/get-by-code/*
       - /sys/base/get*
       - /sys/base/is-ignore-mask
-      - /sys/jar/get-all
+      - /sys/dict-item/get-by-code/*
       - /sys/role/all
-      - /sys/monitor/**
       - /sys/risk/get-ip/*
       - /sys/risk/get-uri/*
+      - /sys/opt-log/get-*
+      - /sys/jar/get-all
+      # site
+      - /site/visit-total/**
+      - /site/visit-uri-total/**
+      - /site/visit-risk-total/**
+      - /site/info/base/*
+      - /site/link/get
+      - /site/manager/get
+      # asset
+      - /asset/info/base
+      - /asset/note-type/get-all
+      - /asset/grab/get
diff --git a/xtools-app-sys/xtools-app-sys-auth/src/main/java/xtools/app/sys/auth/filter/AuthFilter.java b/xtools-app-sys/xtools-app-sys-auth/src/main/java/xtools/app/sys/auth/filter/AuthFilter.java
index b81ebaf..55435ff 100644
--- a/xtools-app-sys/xtools-app-sys-auth/src/main/java/xtools/app/sys/auth/filter/AuthFilter.java
+++ b/xtools-app-sys/xtools-app-sys-auth/src/main/java/xtools/app/sys/auth/filter/AuthFilter.java
@@ -186,6 +186,18 @@ public class AuthFilter extends BaseFilter implements Ordered, BootCommonConstan
         // 校验登录白名单
         if (checkLoginWhiteList(uri)) {
             filterChain.doFilter(request, response);
+            // 记录登录日志
+            if (Objects.equals("/sys/login/passwd", uri)) {
+                LoginUserDto loginUser = AuthUtils.getDefNull();
+                if (loginUser == null) {
+                    log.setTitle("系统登录-密码登录失败");
+                } else {
+                    log.setAccountId(loginUser.getId());
+                    log.setAccount(loginUser.getAccount());
+                    log.setTitle("系统登录-密码登录成功");
+                }
+                saveOptLog(log);
+            }
             return;
         }
 
@@ -208,7 +220,8 @@ public class AuthFilter extends BaseFilter implements Ordered, BootCommonConstan
         // 校验 uri 访问权限
         String method = request.getMethod();
         if (!PremUtils.checkInterfacePerm(uri, method, loginUser.getRoleIds())) {
-            saveOptLog(log, "URI访问权限校验失败");
+            log.setTitle("权限异常-URI访问权限校验失败");
+            saveOptLog(log);
             HttpServletUtils.respWriter(response, JSONObject.from(new Result<>(ResultType.FORBIDDEN, null)));
             return;
         }
@@ -221,23 +234,21 @@ public class AuthFilter extends BaseFilter implements Ordered, BootCommonConstan
         checkIgnoreMask();
         CommonHolder.set(GET_SWAGGER_TAG, true);
         filterChain.doFilter(request, response);
-        saveOptLog(log, null);
+        saveOptLog(log);
     }
 
     /**
      * 保存操作日志
      *
-     * @param log  日志
-     * @param memo 备注
+     * @param log 日志
      */
-    private void saveOptLog(OptLogDto log, String memo) {
-        Object tag = CommonHolder.get(SWAGGER_TAG);
-        if (Objects.nonNull(tag)) {
-            {
+    private void saveOptLog(OptLogDto log) {
+        if (StringUtils.isBlank(log.getTitle())) {
+            Object tag = CommonHolder.get(SWAGGER_TAG);
+            if (Objects.nonNull(tag)) {
                 log.setTitle(tag.toString());
             }
         }
-        log.setMemo(memo);
         log.setGmtCreate(Instant.now());
         LogBus.init(LogLevel.INFO, LogBusBaseType.OPT_LOG).data(log).save();
     }
diff --git a/xtools-app-sys/xtools-app-sys-auth/src/main/java/xtools/app/sys/auth/utils/AuthJwtUtils.java b/xtools-app-sys/xtools-app-sys-auth/src/main/java/xtools/app/sys/auth/utils/AuthJwtUtils.java
index 890db30..b0be15e 100644
--- a/xtools-app-sys/xtools-app-sys-auth/src/main/java/xtools/app/sys/auth/utils/AuthJwtUtils.java
+++ b/xtools-app-sys/xtools-app-sys-auth/src/main/java/xtools/app/sys/auth/utils/AuthJwtUtils.java
@@ -5,6 +5,9 @@ import com.auth0.jwt.algorithms.Algorithm;
 import com.auth0.jwt.interfaces.JWTVerifier;
 import xtools.app.sys.auth.config.AuthConfig;
 import xtools.boot.core.utils.SpringContextUtils;
+import xtools.boot.log.LogBus;
+import xtools.boot.log.enums.LogBusBaseType;
+import xtools.core.enums.LogLevel;
 import xtools.extend.JwtUtils;
 
 /**
@@ -64,7 +67,12 @@ public class AuthJwtUtils {
                 }
             }
         }
-        return JwtUtils.verifyToken(verifier, token);
+        try {
+            return JwtUtils.verifyToken(verifier, token);
+        } catch (Exception e) {
+            LogBus.init(LogLevel.WARN, LogBusBaseType.OTHER).title("Token验证失败").data(JSONObject.of("token", token)).error(e).print(false).save();
+        }
+        return JSONObject.of();
     }
 
 }
diff --git a/xtools-app-sys/xtools-app-sys-auth/src/main/java/xtools/app/sys/auth/utils/AuthUtils.java b/xtools-app-sys/xtools-app-sys-auth/src/main/java/xtools/app/sys/auth/utils/AuthUtils.java
index 3dbead0..f381660 100644
--- a/xtools-app-sys/xtools-app-sys-auth/src/main/java/xtools/app/sys/auth/utils/AuthUtils.java
+++ b/xtools-app-sys/xtools-app-sys-auth/src/main/java/xtools/app/sys/auth/utils/AuthUtils.java
@@ -124,22 +124,6 @@ public class AuthUtils {
         return HeaderUtils.getRequestParam(request, BootCommonConstant.UID);
     }
 
-    /**
-     * 从Jwt 中获取 token
-     *
-     * @param jwt Jwt信息
-     * @param uid Uid
-     * @param id  Id
-     * @return token
-     */
-    public static String getTokenByJwt(String jwt, String uid, Long id) {
-        JSONObject jwtToken = AuthJwtUtils.verifyToken(jwt);
-        if (checkJwtToken(jwtToken, uid, id)) {
-            return jwtToken.getString(JWT_TOKEN);
-        }
-        return null;
-    }
-
     /**
      * 验证 JwtToken
      *
@@ -152,10 +136,7 @@ public class AuthUtils {
         if (!Objects.equals(jwtToken.getString(UID), uid)) {
             return false;
         }
-        if (!Objects.equals(jwtToken.getLong(USER), id)) {
-            return false;
-        }
-        return true;
+        return Objects.equals(jwtToken.getLong(USER), id);
     }
 
     /**
diff --git a/xtools-app-sys/xtools-app-sys-biz/src/main/java/xtools/app/sys/controller/SysLoginController.java b/xtools-app-sys/xtools-app-sys-biz/src/main/java/xtools/app/sys/controller/SysLoginController.java
index bea64c4..105b307 100644
--- a/xtools-app-sys/xtools-app-sys-biz/src/main/java/xtools/app/sys/controller/SysLoginController.java
+++ b/xtools-app-sys/xtools-app-sys-biz/src/main/java/xtools/app/sys/controller/SysLoginController.java
@@ -1,25 +1,21 @@
 package xtools.app.sys.controller;
 
 import io.swagger.v3.oas.annotations.Operation;
-import io.swagger.v3.oas.annotations.media.Schema;
 import io.swagger.v3.oas.annotations.tags.Tag;
-import jakarta.annotation.Resource;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.validation.Valid;
-import jakarta.validation.constraints.NotNull;
 import lombok.RequiredArgsConstructor;
 import org.springframework.web.bind.annotation.GetMapping;
-import org.springframework.web.bind.annotation.PathVariable;
 import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.RequestBody;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
 import xtools.app.sys.auth.model.dto.TokenDto;
 import xtools.app.sys.auth.utils.AuthUtils;
+import xtools.app.sys.model.dto.req.SysLoginRefreshReq;
 import xtools.app.sys.model.dto.req.SysLoginReq;
 import xtools.app.sys.service.SysLoginService;
 import xtools.boot.api.model.dto.Result;
-import xtools.boot.cache.redis.base.RedisService;
 
 /**
  * <p>Title : SysLoginController</p>
@@ -39,8 +35,6 @@ import xtools.boot.cache.redis.base.RedisService;
 public class SysLoginController {
 
     private final SysLoginService sysLoginService;
-    @Resource
-    private RedisService redisService;
 
     @Operation(summary = "获取验证码")
     @GetMapping("captcha/*")
@@ -51,21 +45,23 @@ public class SysLoginController {
 
     @Operation(summary = "密码登录")
     @PostMapping("passwd")
-    public Result<TokenDto> passwd(HttpServletRequest request, @RequestBody @Valid SysLoginReq req) {
+    public Result<TokenDto> passwd(
+            @RequestBody @Valid SysLoginReq req,
+            HttpServletRequest request
+    ) {
         String uid = AuthUtils.getUid(request);
         req.setUid(uid);
         return sysLoginService.passwd(req);
     }
 
     @Operation(summary = "刷新令牌")
-    @GetMapping("refresh/{refreshToken}")
+    @PostMapping("refresh")
     public Result<TokenDto> refresh(
-            @Schema(description = "刷新令牌", example = "refreshToken")
-            @NotNull(message = "不能为空")
-            @PathVariable String refreshToken,
+            @RequestBody @Valid SysLoginRefreshReq req,
             HttpServletRequest request
     ) {
-        return Result.ok(AuthUtils.refreshToken(refreshToken, AuthUtils.getUid(request)));
+        String uid = AuthUtils.getUid(request);
+        return Result.ok(AuthUtils.refreshToken(req.getRefreshToken(), uid));
     }
 
 }
diff --git a/xtools-app-sys/xtools-app-sys-biz/src/main/java/xtools/app/sys/model/dto/req/SysLoginRefreshReq.java b/xtools-app-sys/xtools-app-sys-biz/src/main/java/xtools/app/sys/model/dto/req/SysLoginRefreshReq.java
new file mode 100644
index 0000000..37ab9ba
--- /dev/null
+++ b/xtools-app-sys/xtools-app-sys-biz/src/main/java/xtools/app/sys/model/dto/req/SysLoginRefreshReq.java
@@ -0,0 +1,33 @@
+package xtools.app.sys.model.dto.req;
+
+import io.swagger.v3.oas.annotations.media.Schema;
+import jakarta.validation.constraints.NotEmpty;
+import lombok.AllArgsConstructor;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+import java.io.Serializable;
+
+/**
+ * <p>Title : SysLoginRefreshReq</p>
+ * <p>Description : SysLoginRefreshReq</p>
+ * <p>DevelopTools : Idea_x64_v2026.1</p>
+ * <p>DevelopSystem : macOS Sequoia 15.7.5</p>
+ * <p>Company : org.xujun</p>
+ *
+ * @author : XuJun
+ * @version : 1.0.0
+ * @date : 2026/1/31 14:04
+ */
+@Data
+@NoArgsConstructor
+@AllArgsConstructor
+public class SysLoginRefreshReq implements Serializable {
+
+    /**
+     * 刷新令牌
+     */
+    @NotEmpty(message = "不能为空")
+    @Schema(description = "刷新令牌", example = "xxxx")
+    private String refreshToken;
+}
diff --git a/xtools-app-sys/xtools-app-sys-biz/src/main/java/xtools/app/sys/service/impl/SysLoginServiceImpl.java b/xtools-app-sys/xtools-app-sys-biz/src/main/java/xtools/app/sys/service/impl/SysLoginServiceImpl.java
index 5051121..9da3502 100644
--- a/xtools-app-sys/xtools-app-sys-biz/src/main/java/xtools/app/sys/service/impl/SysLoginServiceImpl.java
+++ b/xtools-app-sys/xtools-app-sys-biz/src/main/java/xtools/app/sys/service/impl/SysLoginServiceImpl.java
@@ -22,10 +22,12 @@ import xtools.app.sys.service.SysUserPasswdRuleService;
 import xtools.app.sys.service.base.SysUserBaseService;
 import xtools.app.sys.service.base.SysUserRoleBaseService;
 import xtools.app.sys.utils.PasswdUtils;
+import xtools.boot.api.constant.BootCommonConstant;
 import xtools.boot.api.exection.BizError;
 import xtools.boot.api.exection.BizWarning;
 import xtools.boot.api.model.dto.Result;
 import xtools.boot.cache.redis.base.RedisService;
+import xtools.boot.core.holder.CommonHolder;
 import xtools.core.BytesUtils;
 import xtools.core.StringUtils;
 import xtools.core.dto.ArithmeticDto;
@@ -209,10 +211,12 @@ public class SysLoginServiceImpl implements SysLoginService {
             passwdError(user.getId(), rule);
             throw new BizWarning("密码错误");
         }
-        LoginUserDto loginUserDto = sysLoginConvert.entityToCacheDto(user);
-        loginUserDto.setRoleIds(sysUserRoleBaseService.getUserRole(user.getId()));
+        LoginUserDto loginUser = sysLoginConvert.entityToCacheDto(user);
+        loginUser.setRoleIds(sysUserRoleBaseService.getUserRole(user.getId()));
         redisService.del(captchaKey);
-        return Result.ok(AuthUtils.createToken(loginUserDto, uid));
+        TokenDto token = AuthUtils.createToken(loginUser, uid);
+        CommonHolder.set(BootCommonConstant.AUTH, loginUser);
+        return Result.ok(token);
     }