diff --git a/data/bindata.go b/data/bindata.go
index 67b7dcb5fd..df41e5cc02 100644
--- a/data/bindata.go
+++ b/data/bindata.go
@@ -1,6 +1,7 @@
 // Code generated for package data by go-bindata DO NOT EDIT. (@generated)
 // sources:
 // .tmp/data/ui/index.html
+// .tmp/data/yao/.DS_Store
 // .tmp/data/yao/apis/README.md
 // .tmp/data/yao/apis/chart.http.json
 // .tmp/data/yao/apis/import.http.json
@@ -18,8 +19,8 @@
 // .tmp/data/yao/data/icons/icon.png
 // .tmp/data/yao/data/index.html
 // .tmp/data/yao/flows/README.md
+// .tmp/data/yao/flows/admin/guard.flow.json
 // .tmp/data/yao/flows/menu.flow.json
-// .tmp/data/yao/flows/user/find.flow.json
 // .tmp/data/yao/langs/en-US.json
 // .tmp/data/yao/models/README.md
 // .tmp/data/yao/models/menu.mod.json
@@ -206,7 +207,27 @@ func uiIndexHtml() (*asset, error) {
 		return nil, err
 	}
 
-	info := bindataFileInfo{name: "ui/index.html", size: 22, mode: os.FileMode(420), modTime: time.Unix(1644852770, 0)}
+	info := bindataFileInfo{name: "ui/index.html", size: 22, mode: os.FileMode(420), modTime: time.Unix(1645088485, 0)}
+	a := &asset{bytes: bytes, info: info}
+	return a, nil
+}
+
+var _yaoDs_store = []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\xec\x98\x41\x4b\xc3\x30\x14\x80\x5f\xba\x6a\x5b\x86\xd0\x83\x82\xde\x0a\x5e\x07\xae\x53\xe7\xc1\x4b\xa9\xf3\x0f\x58\xd1\xc3\x94\x99\xd0\xa1\xc5\x9a\x8c\xb6\xb3\x87\x31\xd8\x5d\xff\x90\x7f\xc4\xdf\x23\x35\x6f\xac\xe8\xf4\x26\x4e\x79\x1f\x94\x2f\x25\x4d\xfa\xd2\x42\xf2\x12\x00\x60\xe1\x38\xf6\x01\x5c\x00\xb0\x41\x9b\x55\x85\x25\xd8\x78\x7d\xc2\xa8\x99\x55\x7d\x88\x32\x1f\x89\x54\x09\x00\x78\x59\xde\xd7\xca\x51\xc5\x6e\x42\x0c\x1c\x0a\xe0\xf5\xf8\xc5\x28\x4d\xf2\xa2\xdd\x7e\x65\x46\xc3\x5c\x5b\xb7\x2c\xc7\x6a\x5a\xd7\xd1\x9d\x2a\xa3\x82\x17\xe3\x3c\xe4\x59\xbf\xba\x3b\x57\x2a\x15\xf3\x32\x17\x17\xc9\xb0\x1c\xb8\x9b\x27\x4a\x16\x3c\x91\xc3\xec\xbd\x41\x12\x0f\x05\xcf\xae\x2e\x13\x19\xab\x32\x54\x63\x19\xe7\xfd\x5a\x85\xe3\xd8\xce\xc0\xdd\x99\x4c\xba\xed\x83\x96\xd7\x39\xdc\x9f\xb6\xbc\x89\xef\x77\x3b\x2d\xef\xc8\xef\x4e\xa7\x8e\xbd\xb5\xbb\x77\x7c\x36\xb8\x4f\x1f\xa4\x7a\xd2\x71\x33\x86\x03\xd8\xf8\x30\xa0\xe7\xfa\x80\x1e\xa3\x4c\xa6\x4a\xde\xea\x1f\x44\x10\x04\x41\x10\xb0\x58\x12\xec\xe6\x6f\x07\x42\x10\xc4\xca\x51\xcd\x0f\x1e\x3a\x40\xcf\xb4\x19\xd6\x1b\x68\xb3\xd6\xc6\x45\x7b\xe8\x00\x3d\xd3\x66\xf8\x9c\x81\x36\xd1\x36\xda\x45\x7b\xe8\x00\x3d\xd3\xc6\x49\x8b\xe1\xe6\x83\xe1\x9b\xe7\x9b\x17\xe6\xa2\x3d\x74\xf0\x33\xdf\x86\x20\xfe\x3a\x0d\x2d\xb7\x5a\xff\x4f\xbf\xde\xff\x13\x04\xf1\x8f\x61\x66\x2f\xea\x85\xdf\x9c\x11\x19\x98\x08\xdc\xcc\x1b\x60\x22\x00\x4b\x92\x00\x43\x1f\x16\x6e\xc3\xa2\x9e\x12\x01\x82\x58\x31\xde\x02\x00\x00\xff\xff\x85\xd3\xa7\x45\x04\x18\x00\x00")
+
+func yaoDs_storeBytes() ([]byte, error) {
+	return bindataRead(
+		_yaoDs_store,
+		"yao/.DS_Store",
+	)
+}
+
+func yaoDs_store() (*asset, error) {
+	bytes, err := yaoDs_storeBytes()
+	if err != nil {
+		return nil, err
+	}
+
+	info := bindataFileInfo{name: "yao/.DS_Store", size: 6148, mode: os.FileMode(420), modTime: time.Unix(1645088485, 0)}
 	a := &asset{bytes: bytes, info: info}
 	return a, nil
 }
@@ -226,7 +247,7 @@ func yaoApisReadmeMd() (*asset, error) {
 		return nil, err
 	}
 
-	info := bindataFileInfo{name: "yao/apis/README.md", size: 13, mode: os.FileMode(420), modTime: time.Unix(1644852770, 0)}
+	info := bindataFileInfo{name: "yao/apis/README.md", size: 13, mode: os.FileMode(420), modTime: time.Unix(1645088485, 0)}
 	a := &asset{bytes: bytes, info: info}
 	return a, nil
 }
@@ -246,7 +267,7 @@ func yaoApisChartHttpJson() (*asset, error) {
 		return nil, err
 	}
 
-	info := bindataFileInfo{name: "yao/apis/chart.http.json", size: 624, mode: os.FileMode(420), modTime: time.Unix(1644852770, 0)}
+	info := bindataFileInfo{name: "yao/apis/chart.http.json", size: 624, mode: os.FileMode(420), modTime: time.Unix(1645088485, 0)}
 	a := &asset{bytes: bytes, info: info}
 	return a, nil
 }
@@ -266,7 +287,7 @@ func yaoApisImportHttpJson() (*asset, error) {
 		return nil, err
 	}
 
-	info := bindataFileInfo{name: "yao/apis/import.http.json", size: 1676, mode: os.FileMode(420), modTime: time.Unix(1644852770, 0)}
+	info := bindataFileInfo{name: "yao/apis/import.http.json", size: 1676, mode: os.FileMode(420), modTime: time.Unix(1645088485, 0)}
 	a := &asset{bytes: bytes, info: info}
 	return a, nil
 }
@@ -286,7 +307,7 @@ func yaoApisPageHttpJson() (*asset, error) {
 		return nil, err
 	}
 
-	info := bindataFileInfo{name: "yao/apis/page.http.json", size: 609, mode: os.FileMode(420), modTime: time.Unix(1644852770, 0)}
+	info := bindataFileInfo{name: "yao/apis/page.http.json", size: 609, mode: os.FileMode(420), modTime: time.Unix(1645088485, 0)}
 	a := &asset{bytes: bytes, info: info}
 	return a, nil
 }
@@ -306,7 +327,7 @@ func yaoApisStorageHttpJson() (*asset, error) {
 		return nil, err
 	}
 
-	info := bindataFileInfo{name: "yao/apis/storage.http.json", size: 1092, mode: os.FileMode(420), modTime: time.Unix(1644852770, 0)}
+	info := bindataFileInfo{name: "yao/apis/storage.http.json", size: 1092, mode: os.FileMode(420), modTime: time.Unix(1645088485, 0)}
 	a := &asset{bytes: bytes, info: info}
 	return a, nil
 }
@@ -326,7 +347,7 @@ func yaoApisTableHttpJson() (*asset, error) {
 		return nil, err
 	}
 
-	info := bindataFileInfo{name: "yao/apis/table.http.json", size: 3196, mode: os.FileMode(420), modTime: time.Unix(1644852770, 0)}
+	info := bindataFileInfo{name: "yao/apis/table.http.json", size: 3196, mode: os.FileMode(420), modTime: time.Unix(1645088485, 0)}
 	a := &asset{bytes: bytes, info: info}
 	return a, nil
 }
@@ -346,7 +367,7 @@ func yaoApisUserHttpJson() (*asset, error) {
 		return nil, err
 	}
 
-	info := bindataFileInfo{name: "yao/apis/user.http.json", size: 1453, mode: os.FileMode(420), modTime: time.Unix(1644852770, 0)}
+	info := bindataFileInfo{name: "yao/apis/user.http.json", size: 1453, mode: os.FileMode(420), modTime: time.Unix(1645088485, 0)}
 	a := &asset{bytes: bytes, info: info}
 	return a, nil
 }
@@ -366,12 +387,12 @@ func yaoApisXiangHttpJson() (*asset, error) {
 		return nil, err
 	}
 
-	info := bindataFileInfo{name: "yao/apis/xiang.http.json", size: 1239, mode: os.FileMode(420), modTime: time.Unix(1644852770, 0)}
+	info := bindataFileInfo{name: "yao/apis/xiang.http.json", size: 1239, mode: os.FileMode(420), modTime: time.Unix(1645088485, 0)}
 	a := &asset{bytes: bytes, info: info}
 	return a, nil
 }
 
-var _yaoDataDs_store = []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\xec\x97\xdf\x4e\x13\x4d\x14\xc0\xcf\x29\xe5\xeb\x2e\x7c\xc8\x14\xa8\x42\xf4\xa2\xb1\x37\x26\x90\x88\xd0\x18\x89\x31\xd4\x82\x51\x42\x0c\x95\x12\x2c\x29\xb8\xee\xb6\x43\x99\xb0\xcc\x34\xbb\x5b\x2a\x10\x12\xae\xf5\xca\x07\xf0\x01\xbc\xf6\xc6\xc4\x17\xf0\x09\xbc\x33\x3e\x82\xde\x7a\x67\x96\x3d\x1b\x28\x7f\xbc\x31\x46\x34\xf3\x4b\xc8\x6f\xd8\x3d\x73\xba\x67\x26\xbb\x33\x03\x00\x58\x6c\xd5\x6f\x01\x30\x00\x30\x20\x72\xb2\x07\xce\xc4\xa0\xbf\x53\x24\xc8\x5d\x61\xbe\xc3\x1c\xbe\xd3\xf6\x9b\x8e\xab\x9c\xb3\x33\x69\x34\x9a\x0b\x45\xf8\xee\x76\x83\x80\x1a\x28\x90\x1d\xef\xef\x7b\xa7\xe9\x0a\x3f\x18\x1f\xff\x84\x89\xae\x64\xf7\x7f\xa9\x94\x99\xea\x4d\xad\x95\x37\x54\xbb\x1c\xd8\x41\xcb\x2f\xda\x5e\x35\xfc\x6f\x49\x29\xd7\x89\xdb\xb6\xb3\x2c\x78\xdb\x62\x43\x33\x4a\x06\xb6\x90\xdc\x3b\xec\x20\xea\xdc\xb1\xbd\xd5\xa7\x42\xd6\x55\xbb\xa8\x5a\xb2\xee\x57\x8f\xdd\x30\x4d\xc3\xb4\xd8\xf0\xde\xde\xed\xc9\xc9\xb1\x6c\x3e\x7f\x67\x7f\x2c\xbb\x37\x35\x31\x3e\x96\xcd\x4f\x4d\xec\xef\x9b\x46\x26\x77\xf3\xee\xa2\xb5\xe9\x6e\x49\xf5\x32\x7a\x70\x44\xaa\xa0\xef\x44\x45\xaf\x3a\x2b\x12\xb5\x6d\xaa\x08\xdf\xc5\x15\x7d\x61\x8c\x6a\x32\xcc\x9e\xde\xff\xfb\x2e\xf5\xb3\xf4\xc0\x60\x7a\x28\x9d\xc9\xa4\x2f\x5f\xc9\x0c\x8f\x8c\x5c\xb5\xd8\xa0\x63\xd7\x36\x1b\x5e\xf8\xac\x33\xca\x55\x5e\xd1\x6d\xf1\x6a\xc3\x13\xf5\x72\xd3\xae\x09\xd9\xa8\x04\xfc\x45\x50\x16\xbb\xdc\x62\x03\x27\x42\x17\x79\xfd\xd9\xd1\xa5\xa5\x9d\x26\xb7\xd8\xd0\x89\x98\x87\x1e\xe7\xf2\x30\xdf\xc2\xfa\xba\xcf\x83\xca\xb1\xf6\x8a\xc5\xfa\xfd\x9a\xa7\x5c\xb7\xa4\x7c\x11\x08\x25\x57\x56\xfd\x0d\xd5\x9e\x0b\xf8\xd6\x9c\x5c\x57\x16\x1b\xd8\x16\xbc\xbd\xd0\x0c\x6f\xf9\xcb\xdc\xf3\x85\x92\xa7\xfa\x54\x56\x6c\xcf\xb3\x65\x83\x17\x77\xd6\x5c\xdb\xe1\xee\x82\x2c\xaa\x20\x50\x5b\x61\x64\x98\xad\xa6\x64\xc9\xe3\x61\xa6\x8a\xa8\x29\x19\xd6\x92\x9b\xfe\x16\x8d\x62\xae\x30\x1f\x37\x6e\x44\x0d\x06\xb9\x78\x88\x0d\x86\x4b\x52\x49\x6e\x9a\xb9\x42\x29\xbe\x06\xa3\x70\x1f\x1e\xc3\x32\x6c\xc2\x2e\xbc\x86\x37\xf0\x16\x3e\xc0\x47\xf8\x0c\x5f\xe1\x3b\xa6\x70\x04\xaf\xe3\x28\xe6\xf1\x1e\x4e\xe3\x23\x9c\xc3\x79\x2c\xe1\x13\x5c\x8c\x3a\x27\xe2\xc9\xbc\xd6\x39\x97\x58\xed\x9c\xcc\xed\xb2\x27\x5d\x25\x1b\xd1\x82\xa3\xf9\x35\x68\x08\x8d\xde\x3f\xfd\x20\x1a\x8d\xe6\xc2\x11\x7e\x1f\xb2\xe4\x02\xf9\x20\x32\xd2\xfd\x04\x39\x79\xac\x0f\x23\x67\xc9\x05\xf2\x41\x64\xa4\xb8\x04\x39\x49\x36\xc8\x8c\x9c\x25\x17\xc8\x07\x91\xe9\xa3\x85\x74\xf8\x40\xfa\x65\xa4\x13\x0a\x32\x72\x96\x5c\xf8\x3d\x63\xa3\xd1\xfc\xed\x74\x45\x62\xe1\xfa\xff\xe0\xfc\xf3\xbf\x46\xa3\xf9\x87\xc1\xe4\x6c\x79\xb6\xf8\x93\x33\x55\x82\x36\x02\xcf\xe3\x0e\xe7\x6c\x04\x28\x36\x5c\x8a\x87\xe1\x28\x56\x6f\x04\x34\x9a\x0b\xc6\x8f\x00\x00\x00\xff\xff\xd6\xbc\x4f\xf1\x04\x18\x00\x00")
+var _yaoDataDs_store = []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\xec\x97\x4f\x4f\x13\x4d\x18\xc0\x9f\x29\xe5\xed\x2e\xbc\xc8\x14\xa8\xd2\xe8\x61\x63\x2f\x26\x90\x48\x11\xf1\x60\x0c\x75\xc1\x28\x21\x86\x4a\x09\x96\x14\x5c\x77\xb7\x43\x99\xb0\xcc\x34\xbb\x5b\x2a\x10\x12\xee\x7a\xf1\x03\xf8\x01\x3c\x7b\x32\x7e\x01\x3f\x81\x37\xe3\x47\xd0\xab\x37\xb3\xec\xb3\x81\xf2\xc7\x8b\x31\x56\x33\xbf\x84\xfc\x86\xdd\x67\x9e\xee\x33\x93\xdd\x99\x01\x00\x62\xb6\xea\x45\x00\x0a\x00\x1a\xc4\x4e\xf7\xc1\xb9\x68\xf8\x77\x86\x14\xba\x27\xca\x77\x94\x23\x70\xda\x41\xd3\xf1\xa4\x73\x7e\x26\x85\x42\xd1\x55\x44\xef\x6e\x2f\x70\x70\x41\x82\xe8\x78\x7f\xdf\x3b\x4d\x8f\x07\xe1\xc4\xc4\x27\x92\xea\x49\xf7\xfe\x97\xc9\xe8\x99\xfe\xcc\x7a\x65\x53\xb6\x2b\xa1\x1d\xb6\x02\xd3\xf6\x6b\xd1\x7f\xcb\x52\x7a\x4e\xd2\xb6\x9d\x15\xce\xda\x16\x1d\x99\x95\x22\xb4\xb9\x60\xfe\x51\x07\x5e\x67\x8e\xed\xaf\x3d\xe5\xa2\x2e\xdb\xa6\x6c\x89\x7a\x50\x3b\x71\x43\xd7\x35\xdd\xa2\xf9\xfd\xfd\xe9\x89\xa9\x71\x63\xf2\xf6\xad\x83\x71\x63\xbf\x58\x9c\x9e\x1c\x37\xee\x14\xa7\x0f\x0e\x74\x2d\x57\xb8\x79\x77\xc9\xda\xf2\xb6\x85\x7c\x19\x3f\x39\x21\x58\xc2\xc0\xa9\x92\x5e\x75\x96\xc4\xdd\x1d\x2c\x89\xbc\x4b\x4a\xfa\x42\x29\x16\xa5\xe9\x7d\xfd\xff\x0f\x5c\x1a\xa4\xd9\xa1\xe1\xec\x48\x36\x97\xcb\x5e\xbe\x92\x1b\xcd\xe7\xaf\x5a\x74\xd8\xb1\xdd\xad\x86\x1f\x3d\xec\xac\xf4\xa4\x6f\x7a\x2d\x56\x6b\xf8\xbc\x5e\x69\xda\x2e\x17\x8d\x6a\xc8\x5e\x84\x15\xbe\xc7\x2c\x3a\x74\x2a\x74\x89\xd5\x9f\x1d\x5f\x5a\xde\x6d\x32\x8b\x8e\x9c\x8a\x79\xe8\x33\x26\x8e\xf2\x2d\x6e\x6c\x04\x2c\xac\x9e\x68\xaf\x5a\x74\x30\x70\x7d\xe9\x79\x65\x19\xf0\x90\x4b\xb1\xba\x16\x6c\xca\xf6\x7c\xc8\xb6\xe7\xc5\x86\xb4\xe8\xd0\x0e\x67\xed\xc5\x66\x74\x2b\x58\x61\x7e\xc0\xa5\x38\xd3\xa7\xba\x6a\xfb\xbe\x2d\x1a\xcc\xdc\x5d\xf7\x6c\x87\x79\x8b\xc2\x94\x61\x28\xb7\xa3\xc8\x28\x9b\x2b\x45\xd9\x67\x51\xa6\x2a\x77\xa5\x88\x6a\x29\xcc\x7c\x8b\x47\xb1\x50\x5a\x48\x1a\x37\xe2\x06\x85\x42\x32\xc4\x1a\x25\xcb\x42\x0a\xa6\xeb\x85\x52\x39\xb9\x06\x63\x70\x1f\x1e\xc3\x0a\x6c\xc1\x1e\xbc\x86\x37\xf0\x16\x3e\xc0\x47\xf8\x0c\x5f\xe1\x3b\xc9\x90\x3c\xb9\x4e\xc6\xc8\x14\xb9\x47\x66\xc8\x23\x32\x4f\x16\x48\x99\x3c\x21\x4b\x71\xe7\x54\x32\x99\xd7\x3a\xe7\x92\xd4\x3a\x27\x73\xa7\xe2\x0b\x4f\x8a\x46\xbc\xe2\x28\x7e\x09\x1c\x41\xad\xff\x4f\x3f\x88\x42\xa1\xe8\x3a\xa2\xef\x83\x81\x2e\xa1\x0f\x63\x13\xbc\x9f\x42\xa7\x4f\xf4\xa1\x68\x03\x5d\x42\x1f\xc6\x26\x18\x97\x42\xa7\xd1\x1a\x9a\xa2\x0d\x74\x09\x7d\x18\x1b\x3f\x5a\x04\x0f\x1f\x04\x7f\x99\xe0\x09\x85\x50\xb4\x81\x2e\xfd\x9e\xb1\x51\x28\xfe\x76\x7a\x62\xd1\x68\xfd\x7f\x70\xf1\xf9\x5f\xa1\x50\xfc\xc3\x90\xf4\x5c\x65\xce\xfc\xc9\x91\x2a\x85\x1b\x81\xe7\x49\x87\x0b\x36\x02\x18\x1b\x2d\xc5\xa3\x70\x1c\xab\x36\x02\x0a\x45\x97\xf1\x23\x00\x00\xff\xff\xd7\x59\xc2\xed\x04\x18\x00\x00")
 
 func yaoDataDs_storeBytes() ([]byte, error) {
 	return bindataRead(
@@ -386,7 +407,7 @@ func yaoDataDs_store() (*asset, error) {
 		return nil, err
 	}
 
-	info := bindataFileInfo{name: "yao/data/.DS_Store", size: 6148, mode: os.FileMode(420), modTime: time.Unix(1644852770, 0)}
+	info := bindataFileInfo{name: "yao/data/.DS_Store", size: 6148, mode: os.FileMode(420), modTime: time.Unix(1645088485, 0)}
 	a := &asset{bytes: bytes, info: info}
 	return a, nil
 }
@@ -406,7 +427,7 @@ func yaoDataAppJson() (*asset, error) {
 		return nil, err
 	}
 
-	info := bindataFileInfo{name: "yao/data/app.json", size: 277, mode: os.FileMode(420), modTime: time.Unix(1644852770, 0)}
+	info := bindataFileInfo{name: "yao/data/app.json", size: 277, mode: os.FileMode(420), modTime: time.Unix(1645088485, 0)}
 	a := &asset{bytes: bytes, info: info}
 	return a, nil
 }
@@ -426,7 +447,7 @@ func yaoDataIconsDs_store() (*asset, error) {
 		return nil, err
 	}
 
-	info := bindataFileInfo{name: "yao/data/icons/.DS_Store", size: 6148, mode: os.FileMode(420), modTime: time.Unix(1644852770, 0)}
+	info := bindataFileInfo{name: "yao/data/icons/.DS_Store", size: 6148, mode: os.FileMode(420), modTime: time.Unix(1645088485, 0)}
 	a := &asset{bytes: bytes, info: info}
 	return a, nil
 }
@@ -446,7 +467,7 @@ func yaoDataIcons404Png() (*asset, error) {
 		return nil, err
 	}
 
-	info := bindataFileInfo{name: "yao/data/icons/404.png", size: 9342, mode: os.FileMode(420), modTime: time.Unix(1644852770, 0)}
+	info := bindataFileInfo{name: "yao/data/icons/404.png", size: 9342, mode: os.FileMode(420), modTime: time.Unix(1645088485, 0)}
 	a := &asset{bytes: bytes, info: info}
 	return a, nil
 }
@@ -466,7 +487,7 @@ func yaoDataIconsIconIcns() (*asset, error) {
 		return nil, err
 	}
 
-	info := bindataFileInfo{name: "yao/data/icons/icon.icns", size: 67465, mode: os.FileMode(420), modTime: time.Unix(1644852770, 0)}
+	info := bindataFileInfo{name: "yao/data/icons/icon.icns", size: 67465, mode: os.FileMode(420), modTime: time.Unix(1645088485, 0)}
 	a := &asset{bytes: bytes, info: info}
 	return a, nil
 }
@@ -486,7 +507,7 @@ func yaoDataIconsIconIco() (*asset, error) {
 		return nil, err
 	}
 
-	info := bindataFileInfo{name: "yao/data/icons/icon.ico", size: 54993, mode: os.FileMode(420), modTime: time.Unix(1644852770, 0)}
+	info := bindataFileInfo{name: "yao/data/icons/icon.ico", size: 54993, mode: os.FileMode(420), modTime: time.Unix(1645088485, 0)}
 	a := &asset{bytes: bytes, info: info}
 	return a, nil
 }
@@ -506,7 +527,7 @@ func yaoDataIconsIconPng() (*asset, error) {
 		return nil, err
 	}
 
-	info := bindataFileInfo{name: "yao/data/icons/icon.png", size: 34558, mode: os.FileMode(420), modTime: time.Unix(1644852770, 0)}
+	info := bindataFileInfo{name: "yao/data/icons/icon.png", size: 34558, mode: os.FileMode(420), modTime: time.Unix(1645088485, 0)}
 	a := &asset{bytes: bytes, info: info}
 	return a, nil
 }
@@ -526,7 +547,7 @@ func yaoDataIndexHtml() (*asset, error) {
 		return nil, err
 	}
 
-	info := bindataFileInfo{name: "yao/data/index.html", size: 282, mode: os.FileMode(420), modTime: time.Unix(1644852770, 0)}
+	info := bindataFileInfo{name: "yao/data/index.html", size: 282, mode: os.FileMode(420), modTime: time.Unix(1645088485, 0)}
 	a := &asset{bytes: bytes, info: info}
 	return a, nil
 }
@@ -546,47 +567,47 @@ func yaoFlowsReadmeMd() (*asset, error) {
 		return nil, err
 	}
 
-	info := bindataFileInfo{name: "yao/flows/README.md", size: 12, mode: os.FileMode(420), modTime: time.Unix(1644852770, 0)}
+	info := bindataFileInfo{name: "yao/flows/README.md", size: 12, mode: os.FileMode(420), modTime: time.Unix(1645088485, 0)}
 	a := &asset{bytes: bytes, info: info}
 	return a, nil
 }
 
-var _yaoFlowsMenuFlowJson = []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\x74\x93\xb1\x6e\x83\x30\x10\x86\x77\x9e\xc2\x3a\x75\x8c\x10\xed\x98\x57\xa9\xa2\xca\x98\x53\xb0\x62\x6c\xea\x33\x69\x2b\xc4\xde\xa5\xea\x54\x75\xe9\xd2\xad\x2f\x16\x29\x8f\x51\xd9\x40\x82\x81\x30\x20\xf9\xff\xef\xce\xe7\xcf\xe7\x36\x61\x0c\x14\xcf\x51\xc1\x96\xc1\xf9\xf3\xe7\xf4\xf1\x75\x7a\xff\x3e\xff\xfe\xc1\xc6\x5b\x47\xb4\x24\x8d\xf6\xe6\x7d\x9a\xa5\x59\xaf\x16\x48\xc2\xca\xda\x0d\xce\x32\x4d\x9b\x02\x09\xb6\xec\x31\x61\x8c\xb1\x36\xfc\xbd\xcc\x2b\xf4\x09\x15\xea\x86\x42\x64\x90\x6b\x6b\x04\x12\x05\xc7\x14\xa8\x28\x7d\x95\x5c\xef\x53\x1f\x96\xee\xd1\x5d\x23\xb9\xdd\x5f\xcb\x4e\x4b\x07\x97\x50\xa1\x70\x91\x1f\x74\x59\x5c\x2a\x4c\x1b\x99\x69\x52\x18\x3d\xd7\x6a\x6e\x51\xbb\xa5\xea\xca\xb9\x96\x2b\x23\x0e\x34\x57\x8f\x92\x64\xae\xf0\xc9\x9f\x04\x26\xd6\x6e\x1a\x07\x2f\xd2\x95\xfe\x58\x6d\x9c\x2c\x4a\xa9\x0a\x8b\x7a\xe1\x30\x06\xcf\x0d\xda\xb7\x15\xc3\xdf\xa6\xac\xa4\x87\xf0\x90\x65\xd9\x66\x69\xdf\x80\x34\x42\x98\xa3\x1a\xf4\x15\x60\x63\xc6\x12\xdb\xe0\xac\xc2\xbb\x78\x0b\x84\x83\xb3\x0a\x72\xf0\x6e\xe1\xec\xbf\xdd\x4c\xe9\x92\x5b\xab\x2e\xc6\x5f\xa2\x45\x5a\x10\x69\x19\x08\xa3\x9a\x2a\x8c\x38\x39\xee\xfc\xc8\x32\x38\x72\xd5\x84\x21\x46\xcd\x73\x85\x05\xc4\xd5\x66\x79\x23\x03\x06\xa6\xf6\x6b\xdd\x28\x05\x51\x2f\xf1\x28\x4c\x2e\x2f\xd2\x8d\x2d\xd0\x86\x1e\xa3\xf2\x96\xeb\x43\x5f\x7c\x7c\x8b\x9c\x04\xb0\xee\x8a\x62\xdc\xaa\x57\xfc\x2a\x6c\x08\xa6\x71\x75\xe3\x77\x82\xb6\xbd\xb3\x48\xe1\xb1\x51\xd7\x41\xd2\x25\xff\x01\x00\x00\xff\xff\xfc\x81\x95\xc1\x15\x04\x00\x00")
+var _yaoFlowsAdminGuardFlowJson = []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\x74\x51\x3f\x4b\xc3\x40\x14\xdf\xf3\x29\x9e\x0f\xc7\x70\x54\x74\x2a\xb8\x2a\xee\x6e\xa5\x43\x6c\x9f\x6d\xb0\xe6\xca\x5d\x62\x84\x70\x93\x0e\x75\xd0\x56\xd0\x82\x88\xbb\x20\x82\x60\x45\x89\xe8\xa7\x49\xae\xf5\x5b\xc8\x5d\x63\xda\x6a\x5d\x42\xf2\x7e\x7f\xdf\x4b\xe2\x00\x60\xc7\xdb\xa3\x0e\x56\x01\xf3\xc1\x45\xde\x7f\x1a\x5f\xdd\xeb\xde\xeb\xd7\xd9\x48\xdf\x9d\xa0\x6b\x08\x47\x24\xa4\xcf\x03\x43\x59\x63\x15\x56\x99\x4e\x9b\x24\x1b\xc2\xef\x86\x05\xf2\x9f\x38\xe0\x4d\x92\x58\x85\x9a\x03\x00\x90\xd8\xa7\x19\x7b\x87\x64\x64\xe3\xc7\xcf\xbc\x7f\x99\xa5\xa9\x65\x5b\xa8\x2b\x78\x83\xa4\xd1\xa0\x24\x69\x92\xd9\x36\x85\x33\xdc\x13\x2d\x6b\x88\xbe\x94\x11\x09\xac\x5b\x40\xb9\xcb\x03\xe6\xba\xfc\x76\x3f\xf6\xbd\xa0\xc5\xf6\x3b\x3c\x66\x3b\x5b\x7f\xfd\x8b\xef\x99\xa7\x45\xe3\x36\x99\x7d\x6b\x09\xe0\x74\xd9\x49\xfa\x90\xbd\x7f\x18\xbf\x24\x59\x15\x24\x59\xb9\x92\x52\xe8\x02\xae\x6c\x96\x59\x08\xaa\xee\xce\x9b\xfd\x94\xd4\xb7\x23\x3d\x2c\x8e\x37\x79\x39\xd5\xc3\x1b\x5c\xe0\x2d\x2f\xbd\xdb\x16\x3c\x5e\x24\x96\xb7\x09\xf9\x01\x05\x50\x56\xc9\xde\xce\xf3\x41\x4f\x3f\x5f\xa3\x0b\x1b\x95\xf5\x7a\xa9\x51\xc5\x5b\x71\x44\x07\xc0\x36\x44\x1e\x85\xdd\x28\xb4\xff\x20\x6a\xd8\x6c\x47\x39\xdf\x01\x00\x00\xff\xff\x59\x69\x9a\x9f\x2f\x02\x00\x00")
 
-func yaoFlowsMenuFlowJsonBytes() ([]byte, error) {
+func yaoFlowsAdminGuardFlowJsonBytes() ([]byte, error) {
 	return bindataRead(
-		_yaoFlowsMenuFlowJson,
-		"yao/flows/menu.flow.json",
+		_yaoFlowsAdminGuardFlowJson,
+		"yao/flows/admin/guard.flow.json",
 	)
 }
 
-func yaoFlowsMenuFlowJson() (*asset, error) {
-	bytes, err := yaoFlowsMenuFlowJsonBytes()
+func yaoFlowsAdminGuardFlowJson() (*asset, error) {
+	bytes, err := yaoFlowsAdminGuardFlowJsonBytes()
 	if err != nil {
 		return nil, err
 	}
 
-	info := bindataFileInfo{name: "yao/flows/menu.flow.json", size: 1045, mode: os.FileMode(420), modTime: time.Unix(1644852770, 0)}
+	info := bindataFileInfo{name: "yao/flows/admin/guard.flow.json", size: 559, mode: os.FileMode(420), modTime: time.Unix(1645088485, 0)}
 	a := &asset{bytes: bytes, info: info}
 	return a, nil
 }
 
-var _yaoFlowsUserFindFlowJson = []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\x44\x8f\x3d\x6a\xc4\x30\x10\x85\x7b\x9f\x62\x18\x52\x1a\xe1\xb4\x7b\x80\x5c\x22\xb8\xd0\x5a\xc3\x22\x90\x25\xa3\x91\x43\x82\x50\x97\x62\x9b\x90\x26\x3f\x04\xd2\xa4\xdb\x0b\x84\x9c\x68\x37\x3e\x46\x18\xad\xc9\x36\x9a\xd1\x7b\x9f\xde\x68\x72\x03\x80\x4e\x6f\xc9\xe1\x06\xf0\xf7\xe5\x70\xda\xff\x2c\xdf\x8f\xa7\xb7\x0f\x6c\xc5\xba\xa3\xc8\x36\x78\x31\xaf\x55\xa7\xba\xb3\x6a\x88\x87\x68\xa7\xb4\x3a\xcb\xf3\xe7\xf1\xe9\xf5\xb8\x7f\x5f\xbe\x0e\x67\xc0\x07\x43\x8c\x1b\xb8\x6d\x00\x00\x72\x3d\x45\xd6\x23\xc9\x83\x99\x29\x56\xb0\xaa\x53\x0c\x03\xb1\xe0\x38\x06\x43\x8e\xd5\xbd\xd5\x7e\xa7\x84\x52\x37\xd6\x9b\x0b\xaa\xe3\xee\x12\x5b\x95\x9c\xaf\xac\x57\x5d\x29\xff\x10\x40\x06\x64\x72\x34\x24\x41\xd1\x1a\x6c\xd7\xd1\x2d\x60\x7a\x98\x6a\x1d\xc3\xd6\xba\xda\xd1\xa8\xad\x93\x86\x93\x4e\x33\x63\x0f\x65\x4d\xea\x6b\x95\x5b\x5f\xb7\x0a\x73\x9a\x66\x09\x95\xa9\x91\xb8\xfe\xb0\x14\x6c\x4a\xf3\x17\x00\x00\xff\xff\x0f\xa0\x22\x82\x48\x01\x00\x00")
+var _yaoFlowsMenuFlowJson = []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\x74\x93\xb1\x6e\x83\x30\x10\x86\x77\x9e\xc2\x3a\x75\x8c\x10\xed\x98\x57\xa9\xa2\xca\x98\x53\xb0\x62\x6c\xea\x33\x69\x2b\xc4\xde\xa5\xea\x54\x75\xe9\xd2\xad\x2f\x16\x29\x8f\x51\xd9\x40\x82\x81\x30\x20\xf9\xff\xef\xce\xe7\xcf\xe7\x36\x61\x0c\x14\xcf\x51\xc1\x96\xc1\xf9\xf3\xe7\xf4\xf1\x75\x7a\xff\x3e\xff\xfe\xc1\xc6\x5b\x47\xb4\x24\x8d\xf6\xe6\x7d\x9a\xa5\x59\xaf\x16\x48\xc2\xca\xda\x0d\xce\x32\x4d\x9b\x02\x09\xb6\xec\x31\x61\x8c\xb1\x36\xfc\xbd\xcc\x2b\xf4\x09\x15\xea\x86\x42\x64\x90\x6b\x6b\x04\x12\x05\xc7\x14\xa8\x28\x7d\x95\x5c\xef\x53\x1f\x96\xee\xd1\x5d\x23\xb9\xdd\x5f\xcb\x4e\x4b\x07\x97\x50\xa1\x70\x91\x1f\x74\x59\x5c\x2a\x4c\x1b\x99\x69\x52\x18\x3d\xd7\x6a\x6e\x51\xbb\xa5\xea\xca\xb9\x96\x2b\x23\x0e\x34\x57\x8f\x92\x64\xae\xf0\xc9\x9f\x04\x26\xd6\x6e\x1a\x07\x2f\xd2\x95\xfe\x58\x6d\x9c\x2c\x4a\xa9\x0a\x8b\x7a\xe1\x30\x06\xcf\x0d\xda\xb7\x15\xc3\xdf\xa6\xac\xa4\x87\xf0\x90\x65\xd9\x66\x69\xdf\x80\x34\x42\x98\xa3\x1a\xf4\x15\x60\x63\xc6\x12\xdb\xe0\xac\xc2\xbb\x78\x0b\x84\x83\xb3\x0a\x72\xf0\x6e\xe1\xec\xbf\xdd\x4c\xe9\x92\x5b\xab\x2e\xc6\x5f\xa2\x45\x5a\x10\x69\x19\x08\xa3\x9a\x2a\x8c\x38\x39\xee\xfc\xc8\x32\x38\x72\xd5\x84\x21\x46\xcd\x73\x85\x05\xc4\xd5\x66\x79\x23\x03\x06\xa6\xf6\x6b\xdd\x28\x05\x51\x2f\xf1\x28\x4c\x2e\x2f\xd2\x8d\x2d\xd0\x86\x1e\xa3\xf2\x96\xeb\x43\x5f\x7c\x7c\x8b\x9c\x04\xb0\xee\x8a\x62\xdc\xaa\x57\xfc\x2a\x6c\x08\xa6\x71\x75\xe3\x77\x82\xb6\xbd\xb3\x48\xe1\xb1\x51\xd7\x41\xd2\x25\xff\x01\x00\x00\xff\xff\xfc\x81\x95\xc1\x15\x04\x00\x00")
 
-func yaoFlowsUserFindFlowJsonBytes() ([]byte, error) {
+func yaoFlowsMenuFlowJsonBytes() ([]byte, error) {
 	return bindataRead(
-		_yaoFlowsUserFindFlowJson,
-		"yao/flows/user/find.flow.json",
+		_yaoFlowsMenuFlowJson,
+		"yao/flows/menu.flow.json",
 	)
 }
 
-func yaoFlowsUserFindFlowJson() (*asset, error) {
-	bytes, err := yaoFlowsUserFindFlowJsonBytes()
+func yaoFlowsMenuFlowJson() (*asset, error) {
+	bytes, err := yaoFlowsMenuFlowJsonBytes()
 	if err != nil {
 		return nil, err
 	}
 
-	info := bindataFileInfo{name: "yao/flows/user/find.flow.json", size: 328, mode: os.FileMode(420), modTime: time.Unix(1644852770, 0)}
+	info := bindataFileInfo{name: "yao/flows/menu.flow.json", size: 1045, mode: os.FileMode(420), modTime: time.Unix(1645088485, 0)}
 	a := &asset{bytes: bytes, info: info}
 	return a, nil
 }
@@ -606,7 +627,7 @@ func yaoLangsEnUsJson() (*asset, error) {
 		return nil, err
 	}
 
-	info := bindataFileInfo{name: "yao/langs/en-US.json", size: 66, mode: os.FileMode(420), modTime: time.Unix(1644852770, 0)}
+	info := bindataFileInfo{name: "yao/langs/en-US.json", size: 66, mode: os.FileMode(420), modTime: time.Unix(1645088485, 0)}
 	a := &asset{bytes: bytes, info: info}
 	return a, nil
 }
@@ -626,7 +647,7 @@ func yaoModelsReadmeMd() (*asset, error) {
 		return nil, err
 	}
 
-	info := bindataFileInfo{name: "yao/models/README.md", size: 15, mode: os.FileMode(420), modTime: time.Unix(1644852770, 0)}
+	info := bindataFileInfo{name: "yao/models/README.md", size: 15, mode: os.FileMode(420), modTime: time.Unix(1645088485, 0)}
 	a := &asset{bytes: bytes, info: info}
 	return a, nil
 }
@@ -646,7 +667,7 @@ func yaoModelsMenuModJson() (*asset, error) {
 		return nil, err
 	}
 
-	info := bindataFileInfo{name: "yao/models/menu.mod.json", size: 2378, mode: os.FileMode(420), modTime: time.Unix(1644852770, 0)}
+	info := bindataFileInfo{name: "yao/models/menu.mod.json", size: 2378, mode: os.FileMode(420), modTime: time.Unix(1645088485, 0)}
 	a := &asset{bytes: bytes, info: info}
 	return a, nil
 }
@@ -666,7 +687,7 @@ func yaoModelsUserModJson() (*asset, error) {
 		return nil, err
 	}
 
-	info := bindataFileInfo{name: "yao/models/user.mod.json", size: 8826, mode: os.FileMode(420), modTime: time.Unix(1644852770, 0)}
+	info := bindataFileInfo{name: "yao/models/user.mod.json", size: 8826, mode: os.FileMode(420), modTime: time.Unix(1645088485, 0)}
 	a := &asset{bytes: bytes, info: info}
 	return a, nil
 }
@@ -686,7 +707,7 @@ func yaoModelsWorkflowModJson() (*asset, error) {
 		return nil, err
 	}
 
-	info := bindataFileInfo{name: "yao/models/workflow.mod.json", size: 3333, mode: os.FileMode(420), modTime: time.Unix(1644852770, 0)}
+	info := bindataFileInfo{name: "yao/models/workflow.mod.json", size: 3333, mode: os.FileMode(420), modTime: time.Unix(1645088485, 0)}
 	a := &asset{bytes: bytes, info: info}
 	return a, nil
 }
@@ -706,12 +727,12 @@ func yaoTablesReadmeMd() (*asset, error) {
 		return nil, err
 	}
 
-	info := bindataFileInfo{name: "yao/tables/README.md", size: 15, mode: os.FileMode(420), modTime: time.Unix(1644852770, 0)}
+	info := bindataFileInfo{name: "yao/tables/README.md", size: 15, mode: os.FileMode(420), modTime: time.Unix(1645088485, 0)}
 	a := &asset{bytes: bytes, info: info}
 	return a, nil
 }
 
-var _yaoTablesMenuTabJson = []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\xec\x5a\x41\x6f\xdb\x36\x14\xbe\xfb\x57\x10\x3c\xbb\x41\x3a\x6c\x3b\xe4\xdc\x4b\x6f\x03\x76\xd8\x61\x08\x0a\x5a\xa4\x63\x22\xb4\xa4\x51\x94\x93\xa0\x30\x90\x76\x87\x66\x1d\xba\x05\xc3\xd6\x64\xc8\x86\xa5\x40\xd1\x61\x87\x25\x29\x50\xa4\x9d\x8b\xa5\x7f\x26\x92\x9d\x7f\x31\x88\x94\x2d\x52\xa6\x6d\xd9\xb5\x0c\x04\xd3\xcd\x7e\x7c\xe4\x47\x7e\x7c\xef\xf1\x3d\x8a\x0f\x6b\x00\x40\x17\xb5\x09\xdc\x00\x70\xf0\xe3\x6f\xd1\xb3\x5f\x60\x3d\x91\x75\x08\x0f\xa8\xe7\x26\xe2\xbb\x6b\xeb\x6b\xeb\x4a\x8a\x89\xc3\xa9\x2f\xd2\x06\xa5\x3f\x38\xbb\xea\xff\x7b\xa6\xda\x1b\xd4\xc5\x70\x03\x24\xa3\x02\x00\xdb\x1e\x26\x2c\x51\xdc\xa5\xc8\xdd\x5a\x6b\x13\x37\x84\x35\x00\xba\x52\x15\xf9\x34\xc8\x54\x03\x82\xb8\xd3\x1a\xfd\x07\x00\xfa\xdc\x73\x48\x90\xa8\xa8\x71\x82\xb5\x6c\x94\xb5\x2f\xd0\x16\x75\x91\x20\x12\x55\xaa\x6f\x85\x88\x27\xd0\xf0\x4e\x26\xc3\xa4\x89\x42\x26\xe0\x06\xf8\x3a\x15\x81\xd1\xf8\x52\x61\x87\x8a\x56\xa0\x81\xa6\x62\xa7\x45\x19\xe6\xc4\x1d\x6b\x01\x00\x7e\x13\x12\xbe\x67\x69\x90\x6b\x60\xc4\x91\x68\x8a\xd1\x3a\x80\x14\xc3\xcd\x9c\x62\xb7\x36\xe9\x5f\xb7\x6e\xcc\xad\x45\x38\x09\x8c\xb9\xe7\xe7\xaf\x26\xeb\xb1\xb0\x2d\xb7\xc3\x47\x9c\xb8\x02\xd6\xf3\x1a\x9e\x9f\xb4\xba\x21\x63\x70\x22\x76\x36\x4b\x6d\x16\x49\x97\xec\xdf\xdd\xcf\x6a\xba\x6e\x77\xb4\x93\x6a\x06\xda\x66\xde\xbf\xa7\x6f\x24\x43\x0d\x65\x05\xf7\xef\x65\x5b\xd3\xa1\x64\xc7\x60\x11\x8a\x3d\x5f\x1a\xa1\x52\xcf\x60\x13\x43\xf0\xf3\x9b\x04\x3b\x88\x85\x52\x7d\x83\xe2\x6c\x55\xc3\x15\x8d\xd6\x00\x09\xa6\xc2\x8e\x43\x5d\x3f\x14\x4b\xc3\x69\x7a\xbc\x9d\xf4\x55\x2d\xa9\x1c\x36\x98\xe7\x6c\x07\x56\x32\x64\x53\xf4\xee\xdb\xe8\xf5\x7e\x19\xac\xa4\xc8\x0b\x31\xe3\xb4\x88\xb3\xdd\xf0\x76\xad\x70\x73\x2d\x3d\x5d\xdf\x2d\x5b\x7f\xea\xc7\x73\x83\x19\xee\xeb\x33\xe4\x90\x96\xc7\x30\xe1\x32\x54\x9e\xbf\xbd\xd9\xff\x2e\xfe\xfe\xaf\xf8\xf8\x3c\x3a\x7c\x75\xfd\xae\x67\x23\x00\x28\x77\x4d\xe2\x6b\x01\xcf\x1f\x71\x19\x1f\x9f\x8f\x7b\xfd\x70\x7a\x77\x4d\x9f\xaf\x17\x1c\x33\x3a\x7c\x35\x79\xcc\xf5\x22\x71\xa4\xa0\xa1\x38\x9c\x20\x41\xf0\x03\x24\xac\x76\x12\x1d\x9c\x44\xef\x7b\xf1\xd1\xe5\xcd\xd1\x9b\x32\x0c\x45\x83\x5f\xc8\x58\x30\x12\x44\xd0\x36\x59\x3a\xa4\x9d\x2d\x4c\x18\x99\xca\xd6\xe9\xcd\xaf\x2f\xe3\xd3\x27\x83\xb3\x8b\x32\xd8\xd2\xe0\x57\xc5\x56\x31\x48\x3b\x5b\xd4\xf1\x5c\x3b\x4f\x27\x57\xf1\xe9\x93\x52\x8e\xa3\x04\x72\x35\x07\xd2\x0c\xa4\x09\x94\xe0\xea\x6c\x96\xd2\x34\xe9\xb5\xd8\xc6\xe1\xb3\xfe\x9f\xa5\x78\x8f\x84\x5c\x09\x21\xb3\x90\xec\x94\xa4\x09\xa4\x8d\x94\xfe\xc1\xe5\xe0\xe9\xe3\xfe\xe3\x7f\xca\xe0\x25\xc5\x5d\x09\x33\xb3\xb1\x26\x71\x23\x5a\x56\x66\x06\x6f\xcf\xfb\x3f\xbf\x2e\x87\x16\xd1\x5a\x15\x29\xd3\x91\xec\x94\x70\xe4\x6e\x5b\x29\x89\x7f\xf8\x29\x3a\x38\x2a\x83\x12\x09\xb9\x12\x4a\x66\x21\xd9\x29\x09\x04\x12\xa1\x3d\xe1\xef\x3f\xbd\x8c\xf7\x1f\x95\x41\x4a\x0a\xba\x10\x2d\x05\x73\xdd\xf9\x73\x52\xe2\xa2\x06\x23\x78\x72\x0e\x39\xd2\x30\x14\x0a\xe7\xa7\x98\x06\xb3\x00\x46\x2a\x26\x82\xf6\x6f\xb3\xbe\x28\xa3\xf6\xed\x0f\x7d\x3c\x2d\x97\x8d\x4f\xde\xc4\xcf\x2f\xca\xcb\x65\x35\xf8\x85\x8c\x61\x81\xec\xac\x18\xa4\x9d\xad\x0e\x0d\x68\x83\x91\x07\xf2\x5e\xc8\xca\xd7\xf1\x55\xff\x65\xaf\x0c\xa6\x0c\xe8\x85\xb8\x9a\x5a\x24\x7f\x1c\xa8\x9d\x2d\xa3\x10\xaa\x2a\xa5\x02\x7c\x69\xa5\x50\x55\x2b\xcd\xe6\x4b\xa5\xbd\x55\x46\x6c\x90\xa2\xea\xc4\xaa\x84\xd4\x49\x49\xd3\xbb\x2a\xf3\x33\x48\x51\x67\xd5\x6d\x3b\xc6\xe6\xbe\xeb\x34\x20\xe7\xb8\xf1\xcc\x91\x00\x16\xcb\x2a\x6f\xf5\x4d\xa7\x91\xfe\x55\xf9\xe1\x4c\xbe\xb2\x3b\x87\xea\x46\xc2\x46\x8f\x2a\x28\xab\x5a\xf3\xff\x59\x6b\xa6\xf7\x4e\xd5\x95\x14\x30\x3e\x46\x37\x29\x13\x84\xab\x4f\x95\x52\xc0\x68\x90\x4d\x09\xfa\x9c\xb6\x91\xfc\x80\x0f\xe9\x70\x3f\x21\x43\x7b\x5e\x68\x94\xec\xd9\x27\xed\x09\x2f\x07\x86\x4f\x26\x72\xa9\xb1\x6c\xdb\xa1\x58\xde\x15\xc2\x4f\x3e\x5d\xf7\x77\xb5\x45\xd4\xa7\x8f\x95\x45\xb4\xc2\x5d\xd2\x24\xb4\x38\x84\x0a\x0c\x85\xf5\x53\x4b\x2a\xac\x9f\xe6\x7f\x85\xf5\xf5\x8f\xa0\xc5\x41\x54\x2a\x31\x66\x1c\x9b\x99\x71\x8c\x8c\xe0\x23\xb6\xef\xf3\x71\x00\xc3\x01\x91\x33\x8c\x53\x99\xd9\xc8\x7a\xd5\xee\x00\x8d\x50\x08\xcf\x9d\xe9\x01\x59\x32\xf0\xfc\x22\x7a\xdf\xd3\x9e\xe4\x8c\x54\xd2\xaf\x5a\xb0\x89\x02\xd0\x44\x77\x7c\x36\x3d\x7c\x0c\xbd\x7f\xdc\x4b\x33\x09\x6d\xfb\x1e\xcf\xc9\xd4\xd1\x6d\xca\x54\x81\x99\xeb\xeb\x06\xc4\xde\xf7\xab\x16\xe1\xd6\x01\x2c\x0d\xaa\xc7\x97\xc3\x27\x34\x63\x5d\x6c\x2d\xbe\x7a\x05\xa4\x5e\x23\x69\xf2\x80\x08\x41\xdd\xad\xf1\x98\xe9\x0d\x9f\x2e\x3d\x4c\x7e\x13\x8e\xb2\xbf\xa1\xdb\xf4\x18\x86\x1b\x40\xf0\x90\x80\xae\x16\x51\x8c\x98\x56\x34\x80\x34\x29\x61\x38\x20\x53\xde\x1e\x09\x2a\x98\xb2\xc1\x3f\x7a\xfd\x17\xfb\xd7\x1f\x5e\xc4\x8f\xcc\xe4\x16\x62\x12\xe8\xcf\xad\xcc\x46\x5b\x88\xca\x83\x80\x19\xb6\x0e\xec\xf6\x0e\x0a\x1c\x8e\xb9\x08\xb4\xe4\x51\x73\x27\xd8\x92\x46\xcd\x55\xa7\x4b\x1a\x75\xd2\x43\x8e\x65\x4c\x78\xbc\x68\x9a\x36\xaa\x9e\x6d\x2c\x10\xbc\x90\xeb\xc8\xd0\xa3\x7b\x12\xea\x2c\x29\x9c\x5d\x7f\xf8\x3d\xfa\xfb\x78\x5a\x9c\xd2\x62\x4b\xee\x4c\xcf\x45\x98\x2c\xa2\xd5\xba\xb5\xff\x02\x00\x00\xff\xff\x34\xf9\xf5\x03\xc1\x28\x00\x00")
+var _yaoTablesMenuTabJson = []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\xec\x5a\x41\x6f\xdb\x36\x14\xbe\xfb\x57\x10\x3c\xbb\x46\x3a\x6c\x3b\xf8\xdc\x4b\x6f\x03\x76\xd8\x61\x08\x0a\x5a\xa4\x63\x22\xb4\xa4\x49\x94\x93\xa0\x30\x90\x76\x87\x66\x1d\xba\x05\xc3\xd6\x64\xc8\x86\xa5\x40\xd1\x61\x87\x25\x29\x50\xa4\x9d\x8b\xa5\x7f\x26\x92\x9d\x7f\x31\x88\x94\x25\x52\xa6\x6d\xd9\xb5\x0c\x04\xd3\xcd\x26\x1f\xdf\x47\x7e\x7c\xef\xf1\x3d\x8a\x0f\x6b\x00\x40\x1b\x75\x09\x6c\x02\x38\xfa\xf1\xb7\xf0\xd9\x2f\xb0\x1e\xb7\xf5\x88\xe7\x53\xc7\x8e\x9b\xef\x36\x36\x1a\x1b\xb2\x15\x13\xcb\xa3\x2e\x4f\x3a\xa4\xfc\xe8\xec\x6a\xf8\xef\x99\xec\x6f\x51\x1b\xc3\x26\x88\xb5\x02\x00\xbb\x0e\x26\x2c\x16\xdc\xa5\xc8\xde\x6a\x74\x89\x1d\xc0\x1a\x00\x7d\x21\xba\x15\x20\x2f\x96\x85\x6d\xe6\xec\xf8\x0d\x29\x82\x70\x97\xda\x0d\xd9\x25\xa4\x90\x4b\xfd\x4c\xa1\x4f\x90\x67\x75\xd2\xff\x00\x40\xd7\x73\x2c\xe2\xc7\x22\x12\x6d\xac\x28\xc6\x6a\x7c\x81\xb6\xa8\x8d\x38\x11\xaa\x84\x78\x0a\x7a\x27\x6b\xc3\xa4\x8d\x02\xc6\x61\x13\x7c\x9d\x34\x81\x54\xbf\x10\xd8\xa1\xbc\xe3\x2b\xa0\x49\xb3\xd5\xa1\x0c\x7b\xc4\x9e\xe8\x01\x00\x7e\x13\x10\x6f\xcf\xd0\x21\xd6\xc0\x88\x25\xd0\x24\xef\x75\x00\x29\x86\x9b\x39\xc1\x7e\x6d\xda\xbf\x7e\x5d\x9b\x5b\x87\x78\xc4\xd7\xe6\x9e\x9f\xbf\x9c\xac\xc3\x82\xae\xd8\x34\x17\x79\xc4\xe6\xb0\x9e\x97\x70\xdc\xb8\xd7\x0e\x18\x83\x53\xb1\xb3\x59\x2a\xb3\x88\x87\x64\xff\xee\x7e\x56\x53\x65\xfb\xe9\x7e\xcb\x19\x28\x9b\x79\xff\x9e\xba\x91\x0c\xb5\xa4\xad\xdc\xbf\x97\x6d\x4d\x8f\x92\x1d\x8d\x45\xc8\xf7\x5c\x61\xaa\x52\x3c\x83\x8d\x0d\xc1\xcd\x6f\x12\xec\x21\x16\x08\xf1\x26\xc5\xd9\xaa\xc6\x2b\x4a\xd7\x00\x09\xa6\xdc\x8c\x43\x6d\x37\xe0\x2b\xc3\x69\x3b\x5e\x37\x1e\x2b\x7b\x92\x76\xd8\x62\x8e\xb5\xed\x1b\xc9\x10\x5d\xe1\xbb\x6f\xc3\xd7\xfb\x65\xb0\x92\x20\x2f\xc5\x8c\xd5\x21\xd6\x76\xcb\xd9\x35\xc2\x2d\xb4\xf4\x64\x7d\xb7\x6c\xfd\x89\x1f\x2f\x0c\xa6\xb9\xaf\xcb\x90\x45\x3a\x0e\xc3\xc4\x13\x01\xf5\xfc\xed\xcd\xfe\x77\xd1\xf7\x7f\x45\xc7\xe7\xe1\xe1\xab\xeb\x77\x03\x13\x01\x40\xba\x6b\x1c\x85\x0b\x78\x7e\xca\x65\x74\x7c\x3e\xe9\xf5\xe3\xe9\xdd\xd5\x7d\xbe\x5e\x50\x67\x78\xf8\x6a\xba\xce\x8d\x22\x71\xa4\xa0\xa1\x58\x1e\x41\x9c\xe0\x07\x88\x1b\xed\x24\x3c\x38\x09\xdf\x0f\xa2\xa3\xcb\x9b\xa3\x37\x65\x18\x8a\x02\xbf\x94\xb1\x60\xc4\x09\xa7\x5d\xb2\x72\x48\x33\x5b\x98\x30\x32\x93\xad\xd3\x9b\x5f\x5f\x46\xa7\x4f\x46\x67\x17\x65\xb0\xa5\xc0\xaf\x8b\xad\x62\x90\x66\xb6\xa8\xe5\xd8\x66\x9e\x4e\xae\xa2\xd3\x27\xa5\x1c\x47\x31\xe4\x7a\x0e\xa4\x39\x48\x53\x28\xc1\xd5\xd9\x2c\x5a\x93\xd4\xd8\x60\x1b\x87\xcf\x86\x7f\x96\xe2\x3d\x02\x72\x2d\x84\xcc\x43\x32\x53\x92\x24\x90\x26\x52\x86\x07\x97\xa3\xa7\x8f\x87\x8f\xff\x29\x83\x97\x04\x77\x2d\xcc\xcc\xc7\x9a\xc6\x0d\xef\x18\x99\x19\xbd\x3d\x1f\xfe\xfc\xba\x1c\x5a\x78\x67\x5d\xa4\xcc\x46\x32\x53\xe2\x21\x7b\xdb\x48\x49\xf4\xc3\x4f\xe1\xc1\x51\x19\x94\x08\xc8\xb5\x50\x32\x0f\xc9\x4c\x89\xcf\x11\x0f\xcc\x09\xff\xf0\xe9\x65\xb4\xff\xa8\x0c\x52\x12\xd0\xa5\x68\x29\x98\xeb\x2e\x9e\x93\x12\x1b\xb5\x18\xc1\xd3\x73\xc8\x54\x42\x13\x28\x9c\x9f\x62\xea\xcf\x03\x48\x45\x74\x04\xe5\xdf\x66\x7d\x59\x46\xcd\xdb\x1f\xb8\x78\x56\x2e\x1b\x9d\xbc\x89\x9e\x5f\x94\x97\xcb\x2a\xf0\x4b\x19\xc3\x12\xd9\x59\x31\x48\x33\x5b\x3d\xea\xd3\x16\x23\x0f\xc4\xed\x91\x91\xaf\xe3\xab\xe1\xcb\x41\x19\x4c\x69\xd0\x4b\x71\x35\xb3\x48\xfe\x38\x50\x33\x5b\x5a\x21\x54\x55\x4a\x05\xf8\x52\x4a\xa1\xaa\x56\x9a\xcf\x97\x4c\x7b\xab\x8c\x58\x23\x45\xd6\x89\x55\x09\xa9\x92\x92\xa4\x77\x55\xe6\xa7\x91\x22\xcf\xaa\xdb\x76\x8c\x2d\x7c\xd7\xa9\x41\x2e\x70\xe3\x99\x23\x01\x2c\x97\x55\xde\xea\x9b\x4e\x2d\xfd\xab\xf2\xc3\xb9\x7c\x65\x77\x0e\xd5\x8d\x84\x89\x1e\x59\x50\x56\xb5\xe6\xff\xb3\xd6\x4c\xee\x9d\xaa\x2b\x29\xa0\x7d\x8c\x6e\x53\xc6\x89\x27\x3f\x55\x8a\x06\x46\xfd\x6c\x4a\xd0\xf5\x68\x17\x89\x0f\xf8\x90\x8e\xf7\x13\x32\xb4\xe7\x04\x5a\xc9\x9e\x7d\xd2\x9e\xf2\x72\x60\xfc\xb0\x22\x97\x1a\x8b\xbe\x1d\x8a\xc5\x5d\x21\xfc\xe4\xd3\x0d\x77\x57\x59\x44\x7d\xb6\xae\x2c\xa2\x15\x1e\x92\x24\xa1\xc5\x21\x64\x60\x28\x2c\x9f\x58\x52\x61\xf9\x24\xff\x2b\x2c\xaf\x7e\x04\x2d\x0e\x22\x53\x89\x09\xe3\xd8\xcc\x8c\x23\x35\x82\x8f\xd8\xbe\xcf\x27\x01\x34\x07\x44\xd6\x38\x4e\x65\x66\x23\xea\x55\xb3\x03\xb4\x02\xce\x1d\x7b\xae\x07\x64\xc9\xc0\xf3\x8b\xf0\xfd\x40\x79\xb8\x93\x8a\x24\x5f\xb5\x60\x1b\xf9\xa0\x8d\xee\xb8\x6c\x76\xf8\x18\x7b\xff\xa4\x97\x66\x2d\xb4\xeb\x3a\x5e\xae\x4d\x1e\xdd\x7a\x9b\x2c\x30\x73\x63\x6d\x9f\x98\xc7\x7e\xd5\x21\x9e\x51\x81\xa1\x43\x8e\xf8\x72\xfc\x84\x66\x62\x88\xa9\xc7\x95\xaf\x80\xe4\x9b\x25\xa5\xdd\x27\x9c\x53\x7b\x6b\x32\x66\x3a\xe3\x07\x4e\x0f\xe3\xdf\xc4\x43\xd9\xdf\xc0\x6e\x3b\x0c\xc3\x26\xe0\x5e\x40\x40\x5f\x89\x28\x5a\x4c\x2b\x1a\x40\xda\x94\x30\xec\x93\x19\x6f\x8f\x38\xe5\x4c\xda\xe0\x1f\x83\xe1\x8b\xfd\xeb\x0f\x2f\xa2\x47\x7a\x72\x0b\x31\xf1\xd5\x47\x59\x7a\xa7\x29\x44\xe5\x41\xc0\x1c\x5b\x07\x66\x7b\x07\x05\x0e\xc7\x5c\x04\x5a\xb1\xd6\xdc\x09\xb6\x22\xad\xb9\xea\x74\x45\x5a\xa7\x3d\xe4\x58\xc5\x84\x27\x8b\xa6\x59\x5a\xd5\x6c\x63\x89\xe0\x85\x6c\x4b\x84\x1e\xd5\x93\x50\x6f\x45\xe1\xec\xfa\xc3\xef\xe1\xdf\xc7\xb3\xe2\x94\x12\x5b\x72\x67\x7a\x2e\xc2\x64\x11\xad\xd6\xaf\xfd\x17\x00\x00\xff\xff\x29\xf3\x12\x5f\xe7\x28\x00\x00")
 
 func yaoTablesMenuTabJsonBytes() ([]byte, error) {
 	return bindataRead(
@@ -726,12 +747,12 @@ func yaoTablesMenuTabJson() (*asset, error) {
 		return nil, err
 	}
 
-	info := bindataFileInfo{name: "yao/tables/menu.tab.json", size: 10433, mode: os.FileMode(420), modTime: time.Unix(1644852770, 0)}
+	info := bindataFileInfo{name: "yao/tables/menu.tab.json", size: 10471, mode: os.FileMode(420), modTime: time.Unix(1645088485, 0)}
 	a := &asset{bytes: bytes, info: info}
 	return a, nil
 }
 
-var _yaoTablesUserTabJson = []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\xa4\x55\xdd\x6a\xdb\x3e\x14\xbf\xcf\x53\x08\x5d\xe7\x6f\xd2\x5e\xfc\x2f\xf2\x1a\xbb\xd8\x45\xc9\x85\x62\x1f\x37\x02\xd9\x16\x92\xdc\xac\x94\xc0\x3a\xe8\xe8\x5a\xca\x06\xed\x60\x85\x6d\x74\xb0\xb1\xdd\xac\xa5\x0c\x16\x58\xf7\xf1\x32\x75\xd2\xbe\xc5\x90\x2d\x5b\xb2\xe3\x25\x61\xcb\x8d\x95\x73\x7e\xe7\xe8\x7c\xfd\x8e\xf6\x3a\x08\xe1\x98\x44\x80\xfb\x08\xcf\xcf\x3e\xcd\x0e\xa7\xb8\xab\x65\x3b\x20\x24\x4d\x62\x2d\xde\xf0\x7a\x5e\xaf\x90\x06\xe0\x0b\xca\x95\x51\xdc\x5d\xbf\xbb\xfd\x7e\xe1\x5a\x0d\x69\x1c\xe0\x3e\xd2\x5e\x11\xc2\x51\x12\x00\xd3\xc0\x47\x94\xc4\xdb\x5e\x2a\x41\xe0\x0e\x42\x93\x1c\x4a\x38\x95\x16\x1a\x1a\x43\x84\xb9\x48\x7c\x90\x5a\x85\x43\x96\x8c\xa5\x67\x8d\xbd\x1c\x55\xd8\x23\x84\x25\x10\xe1\x8f\x2a\x1f\x79\x78\x21\x49\x99\xc2\x7d\xb4\x65\x44\x48\xbb\x94\xc0\xc0\xcf\xa5\x98\x06\xb8\x6b\x12\xee\x22\xac\x76\x79\xfe\x8d\x92\x21\x65\xf9\x09\x22\x42\x19\x1e\x94\x77\xe8\xdf\x86\x73\xec\x99\xe3\x20\xff\x4e\xaa\x64\xfc\x84\xa5\x51\xec\xe4\x33\x3f\xbf\xc9\x7e\xbc\xcc\xae\x9e\xce\x2f\xf6\xdd\x08\x19\x19\x16\x25\xa9\x01\xca\x1b\xf0\x0e\x85\xb1\x03\x47\x26\xc4\x7e\x69\x68\x43\xd1\x75\xe2\xb2\x86\xd5\xf6\x84\xa5\x39\xbc\xcf\x89\x94\xe3\x44\x04\xb8\x52\x4f\xcc\xa9\x4a\x0d\x43\x40\x55\xfb\x6d\x34\xe6\xa9\xfa\x9b\xdb\xba\xae\xbe\xf4\xb6\x24\x96\x46\x1d\x43\xca\x14\x08\xa7\x8e\xd9\xc1\x97\xfb\xb3\xcb\xbb\xab\x93\xd6\x22\x5a\x6d\x95\x93\x99\x40\x3c\x1e\x81\x00\x4f\x37\xda\x8b\x88\xf2\x47\x16\x51\xe4\xf6\x0f\x69\x73\x46\x7c\x18\x25\x2c\x00\x91\xb3\xe0\x6a\x7a\xf7\xf3\x34\x3b\xf8\x60\xa3\x59\x99\x27\xa3\xd2\x86\x80\xb9\xa0\x11\x11\xbb\x79\x04\x65\x09\x31\x23\xbb\x49\x2d\x4e\x67\xc8\x6a\xd3\x5d\xb2\x37\xfb\x78\x9a\xbd\x38\xd1\x43\x3c\xa6\x81\xd2\xbc\xd8\xe8\xf5\xdc\x41\x76\xb0\xf3\xeb\x9b\xec\xed\xb1\x8b\xdd\xfc\x23\x76\xf6\xec\x78\xf6\xfa\x5b\xf6\x7c\xba\x1e\xfc\xfe\xc9\xe5\xfc\xf2\x7a\x3d\xec\xfc\xe8\xeb\xec\xf1\x3e\xae\xca\x34\xa8\x9a\x64\x07\x61\xcb\x4d\xd1\xf6\xdb\xba\xff\x1f\x4d\x0c\x1d\x4d\xe5\x88\xaf\x17\x94\xac\x95\x4e\x00\x51\xd0\xde\xf4\x61\xaa\x54\x12\xaf\xec\x7a\x35\x74\xb3\xe9\x4d\x76\xe4\x6e\xbd\x0a\x42\xfd\x62\x2f\x86\x44\xa2\x90\xfc\xc7\x59\x2a\x97\xd1\xaf\x24\xfb\x22\x21\xad\x84\x46\x3c\x11\x0d\x59\xca\x03\x93\x8c\x95\x05\xc0\xa0\x29\xa3\xb1\x84\x76\xdb\x87\x9a\x1c\x6d\x0e\x5a\x14\x85\xc5\x83\x72\x85\x2e\x98\xb4\x69\x38\xd9\xa6\x31\x31\xcf\x84\x23\x97\xa0\x14\x8d\xb7\x73\x61\xad\x65\x49\xf9\xa6\xec\xe9\x33\x08\x62\xff\xa6\x71\x98\x30\x4d\x69\x25\x52\x40\x13\x87\x44\xb5\xf5\xb5\x2e\x89\x42\x0a\x2c\x90\xd0\x78\x23\xdc\x2e\xb6\xd1\x6c\x35\xd5\x36\xdd\x11\x6f\x8e\xf9\x02\xdb\x96\xc2\x5b\x09\xb7\xd4\x62\x91\x73\xcb\xe3\xa9\xbd\x3d\x75\x23\xc7\x66\xb0\x30\xbb\xab\x79\x46\x62\x3f\x67\x89\xdb\x74\xb2\x03\x45\x2b\x9b\x8c\x73\x98\xe6\xf0\xeb\xf6\xd7\x9b\xec\xf3\x2b\xac\x5b\xdd\x32\xde\xeb\x7a\xc9\x0e\x2f\xee\xcf\xdf\x63\x33\x30\xee\xee\x6d\xd0\xc2\xd2\xb0\x33\xe9\xfc\x0e\x00\x00\xff\xff\x75\xad\xb1\xc2\x0f\x09\x00\x00")
+var _yaoTablesUserTabJson = []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\xa4\x55\xcd\x6a\x1b\x3b\x14\xde\xfb\x29\x84\xd6\xbe\x83\x93\xc5\x5d\xf8\x35\xee\xe2\x2e\x82\x17\xf2\xcc\x19\x5b\xa0\xf9\x41\xd2\xc4\x37\x04\xc3\x4d\x21\x25\x4d\x08\x2d\x24\x85\x06\xda\x92\x42\x4b\xbb\x69\x42\x28\xd4\xd0\xf4\xe7\x65\x32\x76\xf2\x16\x45\x1a\xcd\x48\x33\x9e\xda\xa6\xf5\x66\xe4\x73\xbe\x4f\x3a\x7f\x9f\xb4\xdf\x41\x08\xc7\x24\x02\xdc\x47\x78\x71\xfe\x61\x7e\x34\xc3\x5d\x65\xdb\x05\x2e\x68\x12\x2b\xf3\x96\xd7\xf3\x7a\x85\x35\x00\x9f\xd3\x54\x1a\xc7\xfd\xcd\x9b\xbb\xaf\x97\x2e\x6b\x94\x11\x1e\x28\x57\xc8\x92\x89\xf0\xfe\xa3\x24\x1e\x79\x24\x88\x68\xec\x15\x2e\x8d\x1a\xd2\x58\x81\xd4\xd9\x08\xe1\x28\x09\x80\x29\x4e\x81\xce\x04\x70\xdc\x41\x68\xaa\xa1\x24\xa5\xc2\x42\x43\x43\x44\x38\xe5\x89\x0f\x42\x34\x8f\x52\x64\x4f\xa3\x0a\x3e\x42\x58\x00\xe1\xfe\xb8\xda\x43\x27\x11\x92\x8c\x49\xdc\x47\x3b\xc6\x84\xd4\x96\x02\x18\xf8\xda\x8a\x69\x80\xbb\xa6\x2c\x5d\x84\xe5\x5e\xaa\xbf\x51\x32\xa4\x4c\xaf\x20\x22\x94\xe1\x41\x79\x86\xfa\x6d\x39\xcb\x9e\x59\x0e\xf4\x77\x5a\x25\xe3\x27\x2c\x8b\x62\x27\x9f\xc5\xc5\x6d\xfe\xed\x79\x7e\xfd\x78\x71\x79\xe0\x46\xc8\xc8\xb0\x28\x49\x0d\x50\x9e\x80\x77\x29\x4c\x1c\x38\x32\x21\xf6\x4b\xa2\x0d\x45\xd5\x29\x15\x35\xac\xe2\x13\x96\x69\x78\x3f\x25\x42\x4c\x12\x1e\xe0\xca\x3d\x35\xab\x2a\x35\x0c\x01\x95\xed\xa7\xd1\x38\xcd\xe4\xef\x9c\xd6\x75\xfd\xe5\x6e\x2b\x62\x69\xd4\x31\xa4\x4c\x02\x77\xea\x98\x1f\x7e\x7a\x38\xbf\xba\xbf\x3e\x6d\x2d\xa2\xf5\x56\x39\x99\x09\xc4\x93\x31\x70\xf0\x54\xa3\xbd\x88\x48\x7f\x6c\x11\x45\x6e\x7f\x90\x76\xca\x88\x0f\xe3\x84\x05\xc0\xb5\x56\xae\x67\xf7\xdf\xcf\xf2\xc3\x77\x36\x9a\xb5\x79\x32\x2a\x6c\x08\x38\xe5\x34\x22\x7c\x4f\x47\x50\x96\x10\x33\xb2\x97\xd4\xe2\x74\x86\xac\x36\xdd\xa5\xc6\xf3\xf7\x67\xf9\xb3\x53\x35\xc4\x13\x1a\x48\xa5\x8b\xad\x5e\xcf\x1d\x64\x07\xbb\xb8\xb9\xcd\x5f\x9f\xb8\xd8\xed\x5f\x62\xe7\x4f\x4e\xe6\x2f\xbf\xe4\x4f\x67\x9b\xc1\x1f\x1e\x5d\x2d\xae\x6e\x36\xc3\x2e\x8e\x3f\xcf\xff\x3f\xc0\x55\x99\x06\x55\x93\xec\x20\xec\xb8\x29\xda\x7e\xdb\xed\xff\x46\x53\x23\x47\x53\x39\xe2\xab\x6b\x4c\xd4\x4a\xc7\x81\x48\x68\x6f\xfa\x30\x93\x32\x89\xd7\x76\xbd\x1a\xba\xf9\xec\x36\x3f\x76\xef\xc6\x0a\x42\xfd\xe2\xf6\x0c\x89\x40\x21\xf9\x2b\x65\x99\x58\x25\xbf\x52\xec\xcb\x82\xb4\x16\x1a\xa5\x09\x6f\xd8\xb2\x34\x30\xc9\x58\x5b\x00\x0c\x9a\x36\x1a\x0b\x68\xe7\xfe\xab\xc4\xd1\xb6\x41\x8b\xa3\x60\xfc\x53\x5e\xa1\x4b\x94\x36\x4f\x4a\x46\x34\x26\xe6\x31\x71\xec\x02\xa4\xa4\xf1\x48\x1b\x6b\x2d\x4b\xca\x97\x67\x5f\xad\x81\x13\xfb\x37\x8b\xc3\x84\x29\x49\x4b\x9e\x01\x9a\x3a\x22\xaa\x5d\x5f\x9b\x8a\x28\xa4\xc0\x02\x01\x8d\x37\xc2\xed\x62\x9b\xcc\xd6\x4b\x6d\xdb\x1d\xf1\xe6\x98\x2f\xa9\x6d\x25\xbc\x55\x70\x2b\x19\xcb\x9a\x5b\x1d\x4f\xed\xed\xa9\x93\x1c\xce\x60\x69\x76\xd7\xeb\x8c\xc4\xbe\x56\x89\xdb\x74\xb2\x0b\x45\x2b\x9b\x8a\x73\x94\xe6\xe8\xeb\xee\xc7\xab\xfc\xe3\x0b\xac\x5a\xdd\x32\xde\x9b\xee\x92\x1f\x5d\x3e\x5c\xbc\xc5\x66\x60\xdc\xbb\xb7\x21\x0b\x2b\xc3\xce\xb4\xf3\x33\x00\x00\xff\xff\x5b\xf0\xe6\xe8\x35\x09\x00\x00")
 
 func yaoTablesUserTabJsonBytes() ([]byte, error) {
 	return bindataRead(
@@ -746,7 +767,7 @@ func yaoTablesUserTabJson() (*asset, error) {
 		return nil, err
 	}
 
-	info := bindataFileInfo{name: "yao/tables/user.tab.json", size: 2319, mode: os.FileMode(420), modTime: time.Unix(1644852770, 0)}
+	info := bindataFileInfo{name: "yao/tables/user.tab.json", size: 2357, mode: os.FileMode(420), modTime: time.Unix(1645088485, 0)}
 	a := &asset{bytes: bytes, info: info}
 	return a, nil
 }
@@ -803,34 +824,35 @@ func AssetNames() []string {
 
 // _bindata is a table, holding each asset generator, mapped to its name.
 var _bindata = map[string]func() (*asset, error){
-	"ui/index.html":                 uiIndexHtml,
-	"yao/apis/README.md":            yaoApisReadmeMd,
-	"yao/apis/chart.http.json":      yaoApisChartHttpJson,
-	"yao/apis/import.http.json":     yaoApisImportHttpJson,
-	"yao/apis/page.http.json":       yaoApisPageHttpJson,
-	"yao/apis/storage.http.json":    yaoApisStorageHttpJson,
-	"yao/apis/table.http.json":      yaoApisTableHttpJson,
-	"yao/apis/user.http.json":       yaoApisUserHttpJson,
-	"yao/apis/xiang.http.json":      yaoApisXiangHttpJson,
-	"yao/data/.DS_Store":            yaoDataDs_store,
-	"yao/data/app.json":             yaoDataAppJson,
-	"yao/data/icons/.DS_Store":      yaoDataIconsDs_store,
-	"yao/data/icons/404.png":        yaoDataIcons404Png,
-	"yao/data/icons/icon.icns":      yaoDataIconsIconIcns,
-	"yao/data/icons/icon.ico":       yaoDataIconsIconIco,
-	"yao/data/icons/icon.png":       yaoDataIconsIconPng,
-	"yao/data/index.html":           yaoDataIndexHtml,
-	"yao/flows/README.md":           yaoFlowsReadmeMd,
-	"yao/flows/menu.flow.json":      yaoFlowsMenuFlowJson,
-	"yao/flows/user/find.flow.json": yaoFlowsUserFindFlowJson,
-	"yao/langs/en-US.json":          yaoLangsEnUsJson,
-	"yao/models/README.md":          yaoModelsReadmeMd,
-	"yao/models/menu.mod.json":      yaoModelsMenuModJson,
-	"yao/models/user.mod.json":      yaoModelsUserModJson,
-	"yao/models/workflow.mod.json":  yaoModelsWorkflowModJson,
-	"yao/tables/README.md":          yaoTablesReadmeMd,
-	"yao/tables/menu.tab.json":      yaoTablesMenuTabJson,
-	"yao/tables/user.tab.json":      yaoTablesUserTabJson,
+	"ui/index.html":                   uiIndexHtml,
+	"yao/.DS_Store":                   yaoDs_store,
+	"yao/apis/README.md":              yaoApisReadmeMd,
+	"yao/apis/chart.http.json":        yaoApisChartHttpJson,
+	"yao/apis/import.http.json":       yaoApisImportHttpJson,
+	"yao/apis/page.http.json":         yaoApisPageHttpJson,
+	"yao/apis/storage.http.json":      yaoApisStorageHttpJson,
+	"yao/apis/table.http.json":        yaoApisTableHttpJson,
+	"yao/apis/user.http.json":         yaoApisUserHttpJson,
+	"yao/apis/xiang.http.json":        yaoApisXiangHttpJson,
+	"yao/data/.DS_Store":              yaoDataDs_store,
+	"yao/data/app.json":               yaoDataAppJson,
+	"yao/data/icons/.DS_Store":        yaoDataIconsDs_store,
+	"yao/data/icons/404.png":          yaoDataIcons404Png,
+	"yao/data/icons/icon.icns":        yaoDataIconsIconIcns,
+	"yao/data/icons/icon.ico":         yaoDataIconsIconIco,
+	"yao/data/icons/icon.png":         yaoDataIconsIconPng,
+	"yao/data/index.html":             yaoDataIndexHtml,
+	"yao/flows/README.md":             yaoFlowsReadmeMd,
+	"yao/flows/admin/guard.flow.json": yaoFlowsAdminGuardFlowJson,
+	"yao/flows/menu.flow.json":        yaoFlowsMenuFlowJson,
+	"yao/langs/en-US.json":            yaoLangsEnUsJson,
+	"yao/models/README.md":            yaoModelsReadmeMd,
+	"yao/models/menu.mod.json":        yaoModelsMenuModJson,
+	"yao/models/user.mod.json":        yaoModelsUserModJson,
+	"yao/models/workflow.mod.json":    yaoModelsWorkflowModJson,
+	"yao/tables/README.md":            yaoTablesReadmeMd,
+	"yao/tables/menu.tab.json":        yaoTablesMenuTabJson,
+	"yao/tables/user.tab.json":        yaoTablesUserTabJson,
 }
 
 // AssetDir returns the file names below a certain
@@ -878,6 +900,7 @@ var _bintree = &bintree{nil, map[string]*bintree{
 		"index.html": {uiIndexHtml, map[string]*bintree{}},
 	}},
 	"yao": {nil, map[string]*bintree{
+		".DS_Store": {yaoDs_store, map[string]*bintree{}},
 		"apis": {nil, map[string]*bintree{
 			"README.md":         {yaoApisReadmeMd, map[string]*bintree{}},
 			"chart.http.json":   {yaoApisChartHttpJson, map[string]*bintree{}},
@@ -901,11 +924,11 @@ var _bintree = &bintree{nil, map[string]*bintree{
 			"index.html": {yaoDataIndexHtml, map[string]*bintree{}},
 		}},
 		"flows": {nil, map[string]*bintree{
-			"README.md":      {yaoFlowsReadmeMd, map[string]*bintree{}},
-			"menu.flow.json": {yaoFlowsMenuFlowJson, map[string]*bintree{}},
-			"user": {nil, map[string]*bintree{
-				"find.flow.json": {yaoFlowsUserFindFlowJson, map[string]*bintree{}},
+			"README.md": {yaoFlowsReadmeMd, map[string]*bintree{}},
+			"admin": {nil, map[string]*bintree{
+				"guard.flow.json": {yaoFlowsAdminGuardFlowJson, map[string]*bintree{}},
 			}},
+			"menu.flow.json": {yaoFlowsMenuFlowJson, map[string]*bintree{}},
 		}},
 		"langs": {nil, map[string]*bintree{
 			"en-US.json": {yaoLangsEnUsJson, map[string]*bintree{}},
diff --git a/go.mod b/go.mod
index c38fc68a92..c41c60d88c 100644
--- a/go.mod
+++ b/go.mod
@@ -10,7 +10,6 @@ require (
 	github.com/buraksezer/consistent v0.9.0 // indirect
 	github.com/buraksezer/olric v0.4.2
 	github.com/caarlos0/env/v6 v6.9.1
-	github.com/dgrijalva/jwt-go v3.2.0+incompatible
 	github.com/elazarl/go-bindata-assetfs v1.0.1
 	github.com/fatih/color v1.13.0
 	github.com/fsnotify/fsnotify v1.5.1
@@ -56,4 +55,4 @@ replace github.com/yaoapp/xun => ../xun // gou local
 
 replace github.com/yaoapp/gou => ../gou // gou local
 
-replace rogchap.com/v8go  => ../v8go
\ No newline at end of file
+replace rogchap.com/v8go => ../v8go
diff --git a/go.sum b/go.sum
index 3e67e4d743..971128fe12 100644
--- a/go.sum
+++ b/go.sum
@@ -101,8 +101,6 @@ github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ3
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/dgrijalva/jwt-go v3.2.0+incompatible h1:7qlOGliEKZXTDg6OTjfoBKDXWrumCAMpl/TFQ4/5kLM=
-github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
 github.com/elazarl/go-bindata-assetfs v1.0.1 h1:m0kkaHRKEu7tUIUFVwhGGGYClXvyl4RE03qmvRTNfbw=
 github.com/elazarl/go-bindata-assetfs v1.0.1/go.mod h1:v+YaWX3bdea5J/mo8dSETolEo7R71Vk1u8bnjau5yw4=
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
@@ -884,8 +882,6 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
 honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-rogchap.com/v8go v0.7.0 h1:kgjbiO4zE5itA962ze6Hqmbs4HgZbGzmueCXsZtremg=
-rogchap.com/v8go v0.7.0/go.mod h1:MxgP3pL2MW4dpme/72QRs8sgNMmM0pRc8DPhcuLWPAs=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
diff --git a/helper/jwt.go b/helper/jwt.go
index 21254b1d67..8a978e2669 100644
--- a/helper/jwt.go
+++ b/helper/jwt.go
@@ -9,6 +9,7 @@ import (
 	"github.com/yaoapp/gou/session"
 	"github.com/yaoapp/kun/any"
 	"github.com/yaoapp/kun/exception"
+	"github.com/yaoapp/kun/log"
 	"github.com/yaoapp/yao/config"
 )
 
@@ -33,7 +34,8 @@ func JwtValidate(tokenString string) *JwtClaims {
 	})
 
 	if err != nil {
-		exception.New("令牌无效", 403).Ctx(err.Error()).Throw()
+		log.Error("JWT ParseWithClaims Error: %s", err)
+		exception.New("Invalid token", 403).Ctx(err.Error()).Throw()
 		return nil
 	}
 
@@ -41,7 +43,7 @@ func JwtValidate(tokenString string) *JwtClaims {
 		return claims
 	}
 
-	exception.New("令牌无效", 403).Ctx(token.Claims).Throw()
+	exception.New("Invalid token", 403).Ctx(token.Claims).Throw()
 	return nil
 }
 
diff --git a/service/guard.go b/service/guard.go
index 87c89d50fd..ce187a3a6d 100644
--- a/service/guard.go
+++ b/service/guard.go
@@ -1,13 +1,9 @@
 package service
 
 import (
-	"fmt"
 	"strings"
 
-	"github.com/dgrijalva/jwt-go"
 	"github.com/gin-gonic/gin"
-	"github.com/yaoapp/kun/log"
-	"github.com/yaoapp/yao/config"
 	"github.com/yaoapp/yao/helper"
 )
 
@@ -20,35 +16,16 @@ var Guards = map[string]gin.HandlerFunc{
 // JWT 鉴权
 func bearerJWT(c *gin.Context) {
 	tokenString := c.Request.Header.Get("Authorization")
+	tokenString = strings.TrimSpace(strings.TrimPrefix(tokenString, "Bearer "))
 	if tokenString == "" {
 		c.JSON(403, gin.H{"code": 403, "message": "无权访问该页面"})
 		c.Abort()
 		return
 	}
 
-	tokenString = strings.TrimSpace(strings.TrimPrefix(tokenString, "Bearer "))
-	log.Debug("JWT: %s Secret: %s", tokenString, config.Conf.JWTSecret)
-	token, err := jwt.ParseWithClaims(tokenString, &helper.JwtClaims{}, func(token *jwt.Token) (interface{}, error) {
-		return []byte(config.Conf.JWTSecret), nil
-	})
-
-	if err != nil {
-		log.Error("JWT ParseWithClaims Error: %s", err)
-		c.JSON(403, gin.H{"code": 403, "message": fmt.Sprintf("登录已过期或令牌失效(%s)", err)})
-		c.Abort()
-		return
-	}
-
-	if claims, ok := token.Claims.(*helper.JwtClaims); ok && token.Valid {
-		c.Set("__sid", claims.SID)
-		c.Next()
-		return
-	}
-
-	// fmt.Println("bearer-JWT", token.Claims.Valid())
-	c.JSON(403, gin.H{"code": 403, "message": "无权访问该页面"})
-	c.Abort()
-	return
+	claims := helper.JwtValidate(tokenString)
+	c.Set("__sid", claims.SID)
+	c.Next()
 }
 
 // crossDomain 跨域访问
diff --git a/share/api.go b/share/api.go
index f445ba1ace..3034e3d4be 100644
--- a/share/api.go
+++ b/share/api.go
@@ -15,7 +15,7 @@ import (
 	"github.com/yaoapp/kun/utils"
 )
 
-// IsAllow 鉴权处理程序
+// IsAllow 鉴权处理程序 (废弃)
 func (api API) IsAllow(v interface{}) bool {
 	c, ok := v.(*gin.Context)
 	if !ok {
diff --git a/table/api.go b/table/api.go
index 5a29787794..609b964d44 100644
--- a/table/api.go
+++ b/table/api.go
@@ -21,8 +21,8 @@ func apiSearchDefault(model *gou.Model, withs map[string]gou.With) share.API {
 	}
 
 	return share.API{
-		Name:    "search",
-		Guard:   "bearer-jwt",
+		Name: "search",
+		// Guard:   "bearer-jwt",
 		Process: fmt.Sprintf("models.%s.Paginate", model.Name),
 		Default: []interface{}{query, 1, 20},
 	}
@@ -37,8 +37,8 @@ func apiFindDefault(model *gou.Model, withs map[string]gou.With) share.API {
 	}
 
 	return share.API{
-		Name:    "find",
-		Guard:   "bearer-jwt",
+		Name: "find",
+		// Guard:   "bearer-jwt",
 		Process: fmt.Sprintf("models.%s.Find", model.Name),
 		Default: []interface{}{nil, query},
 	}
@@ -47,8 +47,8 @@ func apiFindDefault(model *gou.Model, withs map[string]gou.With) share.API {
 // apiDefault 接口默认值
 func apiDefault(model *gou.Model, name string, process string) share.API {
 	return share.API{
-		Name:    name,
-		Guard:   "bearer-jwt",
+		Name: name,
+		// Guard:   "bearer-jwt",
 		Process: fmt.Sprintf("models.%s.%s", model.Name, process),
 	}
 }
@@ -62,8 +62,8 @@ func apiDefaultWhere(model *gou.Model, withs map[string]gou.With, name string, p
 	}
 
 	return share.API{
-		Name:    name,
-		Guard:   "bearer-jwt",
+		Name: name,
+		// Guard:   "bearer-jwt",
 		Process: fmt.Sprintf("models.%s.%s", model.Name, process),
 		Default: []interface{}{query},
 	}
@@ -72,8 +72,8 @@ func apiDefaultWhere(model *gou.Model, withs map[string]gou.With, name string, p
 // apiDefaultSetting 数据表格配置默认值
 func apiDefaultSetting() share.API {
 	return share.API{
-		Name:    "setting",
-		Guard:   "bearer-jwt",
+		Name: "setting",
+		// Guard:   "bearer-jwt",
 		Process: fmt.Sprintf("xiang.table.setting"),
 	}
 }
diff --git a/table/process.go b/table/process.go
index 129bc1fa45..82a071be82 100644
--- a/table/process.go
+++ b/table/process.go
@@ -35,9 +35,11 @@ func ProcessSearch(process *gou.Process) interface{} {
 	table := Select(name)
 
 	api := table.APIs["search"].ValidateLoop("xiang.table.search")
-	if process.NumOfArgsIs(5) && api.IsAllow(process.Args[4]) {
-		return nil
-	}
+	table.APIGuard(api.Guard, process.Sid, process.Global)
+
+	// if process.NumOfArgsIs(5) && api.IsAllow(process.Args[4]) {
+	// 	return nil
+	// }
 
 	// Before Hook
 	process.Args = table.Before(table.Hooks.BeforeSearch, process.Args, process.Sid)
@@ -64,9 +66,7 @@ func ProcessFind(process *gou.Process) interface{} {
 	name := process.ArgsString(0)
 	table := Select(name)
 	api := table.APIs["find"].ValidateLoop("xiang.table.find")
-	if process.NumOfArgsIs(3) && api.IsAllow(process.Args[2]) {
-		return nil
-	}
+	table.APIGuard(api.Guard, process.Sid, process.Global)
 
 	// Before Hook
 	process.Args = table.Before(table.Hooks.BeforeFind, process.Args, process.Sid)
@@ -92,9 +92,7 @@ func ProcessSave(process *gou.Process) interface{} {
 	name := process.ArgsString(0)
 	table := Select(name)
 	api := table.APIs["save"].ValidateLoop("xiang.table.save")
-	// if process.NumOfArgsIs(3) && api.IsAllow(process.Args[2]) {
-	// 	return nil
-	// }
+	table.APIGuard(api.Guard, process.Sid, process.Global)
 
 	// Before Hook
 	process.Args = table.Before(table.Hooks.BeforeSave, process.Args, process.Sid)
@@ -116,9 +114,7 @@ func ProcessDelete(process *gou.Process) interface{} {
 	name := process.ArgsString(0)
 	table := Select(name)
 	api := table.APIs["delete"].ValidateLoop("xiang.table.delete")
-	if process.NumOfArgsIs(3) && api.IsAllow(process.Args[2]) {
-		return nil
-	}
+	table.APIGuard(api.Guard, process.Sid, process.Global)
 
 	id := process.Args[1]
 	return gou.NewProcess(api.Process, id).Run()
@@ -132,9 +128,7 @@ func ProcessDeleteWhere(process *gou.Process) interface{} {
 	name := process.ArgsString(0)
 	table := Select(name)
 	api := table.APIs["delete-where"].ValidateLoop("xiang.table.DeleteWhere")
-	if process.NumOfArgsIs(3) && api.IsAllow(process.Args[2]) {
-		return nil
-	}
+	table.APIGuard(api.Guard, process.Sid, process.Global)
 
 	// 批量删除
 	param := api.MergeDefaultQueryParam(process.ArgsQueryParams(1), 0, process.Sid)
@@ -153,9 +147,7 @@ func ProcessDeleteIn(process *gou.Process) interface{} {
 	name := process.ArgsString(0)
 	table := Select(name)
 	api := table.APIs["delete-in"].ValidateLoop("xiang.table.DeleteIn")
-	if process.NumOfArgsIs(4) && api.IsAllow(process.Args[3]) {
-		return nil
-	}
+	table.APIGuard(api.Guard, process.Sid, process.Global)
 
 	// 批量删除
 	ids := strings.Split(process.ArgsString(1), ",")
@@ -177,9 +169,7 @@ func ProcessUpdateWhere(process *gou.Process) interface{} {
 	name := process.ArgsString(0)
 	table := Select(name)
 	api := table.APIs["update-where"].ValidateLoop("xiang.table.UpdateWhere")
-	if process.NumOfArgsIs(4) && api.IsAllow(process.Args[3]) {
-		return nil
-	}
+	table.APIGuard(api.Guard, process.Sid, process.Global)
 
 	// 批量更新
 	param := api.MergeDefaultQueryParam(process.ArgsQueryParams(1), 0, process.Sid)
@@ -197,9 +187,7 @@ func ProcessUpdateIn(process *gou.Process) interface{} {
 	name := process.ArgsString(0)
 	table := Select(name)
 	api := table.APIs["update-in"].ValidateLoop("xiang.table.UpdateIn")
-	if process.NumOfArgsIs(5) && api.IsAllow(process.Args[4]) {
-		return nil
-	}
+	table.APIGuard(api.Guard, process.Sid, process.Global)
 
 	// 批量删除
 	ids := strings.Split(process.ArgsString(1), ",")
@@ -219,9 +207,7 @@ func ProcessInsert(process *gou.Process) interface{} {
 	name := process.ArgsString(0)
 	table := Select(name)
 	api := table.APIs["insert"].ValidateLoop("xiang.table.Insert")
-	if process.NumOfArgsIs(4) && api.IsAllow(process.Args[3]) {
-		return nil
-	}
+	table.APIGuard(api.Guard, process.Sid, process.Global)
 	return gou.NewProcess(api.Process, process.Args[1:]...).Run()
 }
 
@@ -233,9 +219,7 @@ func ProcessSetting(process *gou.Process) interface{} {
 	field := process.ArgsString(1)
 	table := Select(name)
 	api := table.APIs["setting"]
-	if process.NumOfArgsIs(2) && api.IsAllow(process.Args[1]) {
-		return nil
-	}
+	table.APIGuard(api.Guard, process.Sid, process.Global)
 
 	fields := strings.Split(field, ",")
 	if api.ProcessIs("xiang.table.Setting") {
@@ -280,9 +264,7 @@ func ProcessQuickSave(process *gou.Process) interface{} {
 	name := process.ArgsString(0)
 	table := Select(name)
 	api := table.APIs["quicksave"].ValidateLoop("xiang.table.quicksave")
-	if process.NumOfArgsIs(3) && api.IsAllow(process.Args[2]) {
-		return nil
-	}
+	table.APIGuard(api.Guard, process.Sid, process.Global)
 
 	args := []interface{}{}
 	payload := process.ArgsMap(1)
@@ -312,9 +294,7 @@ func ProcessSelect(process *gou.Process) interface{} {
 	name := process.ArgsString(0)
 	table := Select(name)
 	api := table.APIs["select"].ValidateLoop("xiang.table.select")
-	if process.NumOfArgsIs(5) && api.IsAllow(process.Args[4]) {
-		return nil
-	}
+	table.APIGuard(api.Guard, process.Sid, process.Global)
 
 	// Before Hook
 	process.Args = table.Before(table.Hooks.BeforeSelect, process.Args, process.Sid)
diff --git a/table/table.go b/table/table.go
index ac3dbd3aa8..b98347bb39 100644
--- a/table/table.go
+++ b/table/table.go
@@ -125,9 +125,10 @@ func (table *Table) loadAPIs() {
 			api.Process = table.APIs[name].Process
 		}
 
-		if table.APIs[name].Guard != "" {
-			api.Guard = table.APIs[name].Guard
-		}
+		// if table.APIs[name].Guard != "" {
+		// 	api.Guard = table.APIs[name].Guard
+		// }
+
 		if table.APIs[name].Default != nil {
 			// fmt.Printf("\n%s.APIs[%s].Default: entry\n", table.Table, name)
 			if len(table.APIs[name].Default) == len(api.Default) {
@@ -208,6 +209,22 @@ func (table *Table) After(process string, data interface{}, args []interface{},
 	return response
 }
 
+// APIGuard API鉴权
+func (table *Table) APIGuard(guard string, sid string, global map[string]interface{}, args ...interface{}) {
+	if guard == "" {
+		guard = table.Guard
+	}
+	if guard == "-" || guard == "" {
+		return
+	}
+
+	log.With(log.F{"args": args}).Debug(guard)
+	gou.NewProcess(guard, args...).
+		WithSID(sid).
+		WithGlobal(global).
+		Run()
+}
+
 // loadFilters 加载查询过滤器
 func (table *Table) loadFilters() {
 	if table.Bind.Model == "" {
diff --git a/table/types.go b/table/types.go
index 7b0cd55716..1df50c15e8 100644
--- a/table/types.go
+++ b/table/types.go
@@ -9,6 +9,7 @@ import (
 type Table struct {
 	Table      string                  `json:"-"`
 	Source     string                  `json:"-"`
+	Guard      string                  `json:"guard,omitempty"`
 	Name       string                  `json:"name"`
 	Version    string                  `json:"version"`
 	Title      string                  `json:"title,omitempty"`
diff --git a/user/user.go b/user/user.go
index d3a0439de4..df29f11fa1 100644
--- a/user/user.go
+++ b/user/user.go
@@ -72,6 +72,7 @@ func Auth(field string, value string, password string) maps.Map {
 	})
 	session.Global().Expire(time.Duration(token.ExpiresAt)*time.Second).ID(sid).Set("user_id", id)
 	session.Global().ID(sid).Set("user", row)
+	session.Global().ID(sid).Set("issuer", "xiang")
 
 	// 读取菜单
 	menus := gou.NewProcess("flows.xiang.menu").Run()
diff --git a/yao/flows/admin/guard.flow.json b/yao/flows/admin/guard.flow.json
new file mode 100644
index 0000000000..83e70243c4
--- /dev/null
+++ b/yao/flows/admin/guard.flow.json
@@ -0,0 +1,25 @@
+{
+  "label": "后台用户鉴权",
+  "version": "1.0.0",
+  "description": "后台用户鉴权",
+  "nodes": [
+    {
+      "name": "签发人",
+      "process": "session.Get",
+      "args": ["issuer"]
+    },
+    {
+      "name": "鉴权",
+      "process": "xiang.flow.IF",
+      "args": [
+        {
+          "when": [{ "用户身份": "{{$res.签发人}}", "!=": "xiang" }],
+          "name": "更新用户资料",
+          "process": "xiang.flow.Throw",
+          "args": ["token 签发人不合法", 403]
+        }
+      ]
+    }
+  ],
+  "output": "success"
+}
diff --git a/yao/flows/user/find.flow.json b/yao/flows/user/find.flow.json
deleted file mode 100644
index 96416830ed..0000000000
--- a/yao/flows/user/find.flow.json
+++ /dev/null
@@ -1,16 +0,0 @@
-{
-  "label": "用户资料",
-  "version": "1.0.0",
-  "description": "菜单列表",
-  "nodes": [
-    {
-      "name": "user",
-      "process": "models.xiang.user.Find",
-      "args": [
-        "{{$in.0}}",
-        { "select": ["id", "name", "type", "mobile", "email", "status"] }
-      ]
-    }
-  ],
-  "output": "{{$res.user}}"
-}
diff --git a/yao/tables/menu.tab.json b/yao/tables/menu.tab.json
index 1f54aa5c7b..4062068036 100644
--- a/yao/tables/menu.tab.json
+++ b/yao/tables/menu.tab.json
@@ -5,6 +5,7 @@
   "bind": {
     "model": "xiang.menu"
   },
+  "guard": "flows.xiang.admin.guard",
   "apis": {
     "search": {
       "process": "models.xiang.menu.Paginate",
diff --git a/yao/tables/user.tab.json b/yao/tables/user.tab.json
index e791d1379b..90899b1c29 100644
--- a/yao/tables/user.tab.json
+++ b/yao/tables/user.tab.json
@@ -2,6 +2,7 @@
   "name": "用户",
   "version": "1.0.0",
   "decription": "象传用户",
+  "guard": "flows.xiang.admin.guard",
   "bind": {
     "model": "xiang.user"
   },