diff --git a/pjcloud-hardware/pjcloud-hardware-biz/src/main/resources/mapper/HardInvoiceMapper.xml b/pjcloud-hardware/pjcloud-hardware-biz/src/main/resources/mapper/HardInvoiceMapper.xml
index fa2ae0103..9f2c57a10 100644
--- a/pjcloud-hardware/pjcloud-hardware-biz/src/main/resources/mapper/HardInvoiceMapper.xml
+++ b/pjcloud-hardware/pjcloud-hardware-biz/src/main/resources/mapper/HardInvoiceMapper.xml
@@ -19,7 +19,7 @@
 
     <sql id="selectA">
         select a.id,
-               a.dept_id,
+               a.dept_id as invoiceDeptId,
                a.hard_id,
                a.order_id,
                a.status,
diff --git a/pjcloud-upms/pjcloud-upms-biz/src/main/java/com/bsd/pjcloud/admin/controller/SysUserFaceController.java b/pjcloud-upms/pjcloud-upms-biz/src/main/java/com/bsd/pjcloud/admin/controller/SysUserFaceController.java
index 471b733ae..4388f5ed3 100644
--- a/pjcloud-upms/pjcloud-upms-biz/src/main/java/com/bsd/pjcloud/admin/controller/SysUserFaceController.java
+++ b/pjcloud-upms/pjcloud-upms-biz/src/main/java/com/bsd/pjcloud/admin/controller/SysUserFaceController.java
@@ -23,6 +23,7 @@ import org.springframework.http.HttpHeaders;
 import io.swagger.v3.oas.annotations.tags.Tag;
 import io.swagger.v3.oas.annotations.Operation;
 import lombok.RequiredArgsConstructor;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.*;
 
 import java.util.List;
@@ -98,13 +99,14 @@ public class SysUserFaceController {
     @Operation(summary = "设置为全局人脸", description = "设置为全局人脸")
     @PostMapping("/global-face")
     @SysLog("设置为全局人脸")
+    @PreAuthorize("@pms.hasPermission('userFace_sysUserFace_global_face')")
     public R editGlobalFace(@RequestBody SysUserFaceDto dto) {
         return R.ok(sysUserFaceService.editGlobalFace(dto));
     }
 
     @Operation(summary = "分页查询", description = "分页查询")
     @GetMapping("/page")
-    // @PreAuthorize("@pms.hasPermission('userFace_sysUserFace_view')")
+    @PreAuthorize("@pms.hasPermission('userFace_sysUserFace_view')")
     public R getSysUserFacePage(@ParameterObject Page page, @ParameterObject SysUserFaceEntity sysUserFace) {
         LambdaQueryWrapper<SysUserFaceEntity> wrapper = Wrappers.lambdaQuery();
         return R.ok(sysUserFaceService.page(page, wrapper));
@@ -112,14 +114,14 @@ public class SysUserFaceController {
 
     @Operation(summary = "分页复杂查询", description = "分页复杂查询")
     @GetMapping("/page-join")
-    // @PreAuthorize("@pms.hasPermission('userFace_sysUserFace_view')")
+    @PreAuthorize("@pms.hasPermission('userFace_sysUserFace_view')")
     public R getSysUserFacePageJoin(@ParameterObject Page page, @ParameterObject SysUserFaceDto dto) {
         return R.ok(sysUserFaceService.pageJoin(page, dto));
     }
 
     @Operation(summary = "通过id查询", description = "通过id查询")
     @GetMapping("/{id}")
-    // @PreAuthorize("@pms.hasPermission('userFace_sysUserFace_view')")
+    @PreAuthorize("@pms.hasPermission('userFace_sysUserFace_view')")
     public R getById(@PathVariable("id") Long id) {
         return R.ok(sysUserFaceService.getById(id));
     }
@@ -127,7 +129,7 @@ public class SysUserFaceController {
     @Operation(summary = "新增人脸样本表", description = "新增人脸样本表")
     @SysLog("新增人脸样本表")
     @PostMapping
-    // @PreAuthorize("@pms.hasPermission('userFace_sysUserFace_add')")
+    @PreAuthorize("@pms.hasPermission('userFace_sysUserFace_add')")
     @Idempotent(expireTime = 10, info = "正在处理中，请勿重复操作")
     public R save(@RequestBody SysUserFaceEntity sysUserFace) {
         return R.ok(sysUserFaceService.create(sysUserFace));
@@ -136,7 +138,7 @@ public class SysUserFaceController {
     @Operation(summary = "修改人脸样本表", description = "修改人脸样本表")
     @SysLog("修改人脸样本表")
     @PutMapping
-    // @PreAuthorize("@pms.hasPermission('userFace_sysUserFace_edit')")
+    @PreAuthorize("@pms.hasPermission('userFace_sysUserFace_edit')")
     public R updateById(@RequestBody SysUserFaceEntity sysUserFace) {
         sysUserFaceService.edit(sysUserFace);
         return R.ok(true);
@@ -145,7 +147,7 @@ public class SysUserFaceController {
     @Operation(summary = "通过id删除人脸样本表", description = "通过id删除人脸样本表")
     @SysLog("通过id删除人脸样本表")
     @DeleteMapping
-    // @PreAuthorize("@pms.hasPermission('userFace_sysUserFace_del')")
+    @PreAuthorize("@pms.hasPermission('userFace_sysUserFace_del')")
     public R removeById(@RequestBody Long[] ids) {
         sysUserFaceService.delByIds(CollUtil.toList(ids));
         return R.ok(true);
@@ -153,7 +155,7 @@ public class SysUserFaceController {
 
     @ResponseExcel
     @GetMapping("/export")
-    // @PreAuthorize("@pms.hasPermission('userFace_sysUserFace_export')")
+    @PreAuthorize("@pms.hasPermission('userFace_sysUserFace_export')")
     public List<SysUserFaceEntity> export(SysUserFaceEntity sysUserFace, Long[] ids) {
         return sysUserFaceService.list(Wrappers.lambdaQuery(sysUserFace).in(ArrayUtil.isNotEmpty(ids), SysUserFaceEntity::getId, ids));
     }