diff --git a/samples/user/src/main/java/com/supwisdom/leaveschool/user/controller/api/security/Api1SecurityUserController.java b/samples/user/src/main/java/com/supwisdom/leaveschool/user/controller/api/security/Api1SecurityUserController.java
index a259749..ba76b0b 100644
--- a/samples/user/src/main/java/com/supwisdom/leaveschool/user/controller/api/security/Api1SecurityUserController.java
+++ b/samples/user/src/main/java/com/supwisdom/leaveschool/user/controller/api/security/Api1SecurityUserController.java
@@ -8,6 +8,7 @@
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PathVariable;
 import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.ResponseBody;
 import org.springframework.web.bind.annotation.ResponseStatus;
 import org.springframework.web.bind.annotation.RestController;
@@ -105,6 +106,7 @@
   /**
    * 
    * curl -i -s -X GET -H 'Accept:application/json' 'http://localhost:10010/api/v1/security/users/test001/app001'
+   * curl -i -s -X GET -H 'Accept:application/json' 'http://localhost:10010/api/v1/security/users/test001/app001?type=2'
    * 
    * response success:
    * 
@@ -146,11 +148,18 @@
    * }
    * </pre>
    * 
+   * @param username
+   * @param applicationCode
+   * @param type 权限类型，1 应用，2 页面，3 操作
+   * @return
    */
   @GetMapping(path = "/{username}/{applicationCode}", produces = MimeTypeUtils.APPLICATION_JSON_VALUE)
   @ResponseStatus(value = HttpStatus.OK)
   @ResponseBody
-  public SecurityUser loadPermissionsByUsernameAppcode(@PathVariable("username") String username, @PathVariable("applicationCode") String applicationCode) {
+  public SecurityUser loadPermissionsByUsernameAppcode(
+      @PathVariable("username") String username, 
+      @PathVariable("applicationCode") String applicationCode, 
+      @RequestParam(value = "type", required = false) String type) {
     
     if (username == null || username.length() == 0) {
       throw new RuntimeException("exception.get.username.must.not.empty"); // FIXME: RestException
@@ -164,7 +173,7 @@
     
     List<Role> roles = roleRepository.selectByUsername(username);
     
-    List<Permission> permissions = permissionRepository.selectByUsername(username, applicationCode);
+    List<Permission> permissions = permissionRepository.selectByUsername(username, applicationCode, type);
     
     SecurityUser securityUser = new SecurityUser();
     securityUser.setUser(user);
diff --git a/samples/user/src/main/java/com/supwisdom/leaveschool/user/repository/PermissionRepository.java b/samples/user/src/main/java/com/supwisdom/leaveschool/user/repository/PermissionRepository.java
index 4b0b622..84e49a5 100644
--- a/samples/user/src/main/java/com/supwisdom/leaveschool/user/repository/PermissionRepository.java
+++ b/samples/user/src/main/java/com/supwisdom/leaveschool/user/repository/PermissionRepository.java
@@ -102,7 +102,7 @@
     int lft = applicationPermission.getLft();
     int rgt = applicationPermission.getRgt();
     
-    List<Permission> userRolePermissions = selectUserRolePermissionByUsername(username, lft, rgt, );
+    List<Permission> userRolePermissions = selectUserRolePermissionByUsername(username, lft, rgt, type);
     permissions.addAll(userRolePermissions);
     
     List<Permission> userGroupRolePermissions = selectUserGroupRolePermissionByUsername(username, lft, rgt, type);