diff --git a/Merge/back_trm/__pycache__/config.cpython-310.pyc b/Merge/back_trm/__pycache__/config.cpython-310.pyc
index 47d55f3..0255d9e 100644
--- a/Merge/back_trm/__pycache__/config.cpython-310.pyc
+++ b/Merge/back_trm/__pycache__/config.cpython-310.pyc
Binary files differ
diff --git a/Merge/back_trm/app.py b/Merge/back_trm/app.py
index af7fefc..f1a9ec1 100644
--- a/Merge/back_trm/app.py
+++ b/Merge/back_trm/app.py
@@ -10,7 +10,11 @@
 from app.functions.Fpost import Fpost;
 
 app = create_app()
-CORS(app, resources={r"/*": {"origins": "*"}})
+CORS(app,
+     resources={r"/*": {"origins": "*"}},
+     supports_credentials=True,
+     allow_headers=["Content-Type"]
+)
 
 proc=psutil.Process(os.getpid())
 @app.before_request
diff --git a/Merge/back_trm/app/__pycache__/routes.cpython-310.pyc b/Merge/back_trm/app/__pycache__/routes.cpython-310.pyc
index e22e52b..8eadf0e 100644
--- a/Merge/back_trm/app/__pycache__/routes.cpython-310.pyc
+++ b/Merge/back_trm/app/__pycache__/routes.cpython-310.pyc
Binary files differ
diff --git a/Merge/back_trm/app/functions/Fpost.py b/Merge/back_trm/app/functions/Fpost.py
index 2237815..248ed13 100644
--- a/Merge/back_trm/app/functions/Fpost.py
+++ b/Merge/back_trm/app/functions/Fpost.py
@@ -6,6 +6,10 @@
 from sqlalchemy.orm import Session
 from ..models.logs import Log
 from ..models.syscost import PerformanceData
+# from ..models.token import Token
+from config import Config
+import requests
+
 class Fpost:
     def __init__(self,session:Session):
         self.session=session
@@ -48,13 +52,30 @@
     def getpost(self,postid):
         res=self.session.query(post).filter(post.id==postid).first()
         return res
-    def checkid(self,userid,status=''):
-        res=self.session.query(users).filter(users.id==userid).first()
-        if(not res):
+    def checkid(self, token, status=''):
+        """
+        使用前端传来的 token 调用 /verify_user 接口校验，
+        如果接口返回 success=False 或者角色不匹配则返回 False，否则 True。
+        """
+        print("---------------------------------------------------------")
+        try:
+            url = f"{Config.API_BASE_URL}/verify_user"
+            headers = {
+                'Authorization': f'Bearer {token}',
+                'Content-Type': 'application/json'
+            }
+            payload = {'token': token}
+            resp = requests.post(url, headers=headers, json=payload)
+        
+            print(resp.json())
+            if resp.status_code != 200:
+                return False
+            data = resp.json()
+            if not data.get('success'):
+                return False
+            return data.get('role') == status,data.get('user_id')
+        except Exception:
             return False
-        if res.role !=status:
-            return False
-        return True
     
     def review(self,postid,status):
         print(status)
@@ -65,43 +86,43 @@
         self.session.commit()
         return True
     
-    def createtoken(self, userid):
-        """
-        根据userid创建token并插入到数据库
-        :param userid: 用户ID
-        :return: 生成的token字符串
-        """
-        # 生成随机盐值
-        salt = secrets.token_hex(16)
+    # def createtoken(self, userid):
+    #     """
+    #     根据userid创建token并插入到数据库
+    #     :param userid: 用户ID
+    #     :return: 生成的token字符串
+    #     """
+    #     # 生成随机盐值
+    #     salt = secrets.token_hex(16)
         
-        # 创建哈希值：userid + 当前时间戳 + 随机盐值
-        current_time = str(datetime.now().timestamp())
-        hash_input = f"{userid}_{current_time}_{salt}"
+    #     # 创建哈希值：userid + 当前时间戳 + 随机盐值
+    #     current_time = str(datetime.now().timestamp())
+    #     hash_input = f"{userid}_{current_time}_{salt}"
         
-        # 生成SHA256哈希值作为token
-        token = hashlib.sha256(hash_input.encode()).hexdigest()
+    #     # 生成SHA256哈希值作为token
+    #     token = hashlib.sha256(hash_input.encode()).hexdigest()
         
-        # 设置时间
-        created_time = datetime.now()
-        expires_time = created_time + timedelta(days=1)  # 一天后过期
+    #     # 设置时间
+    #     created_time = datetime.now()
+    #     expires_time = created_time + timedelta(days=1)  # 一天后过期
         
-        try:
-            # 创建新的token记录
-            new_token = Token(
-                token=token,
-                expires_at=expires_time,
-                created_at=created_time
-            )
+    #     try:
+    #         # 创建新的token记录
+    #         new_token = Token(
+    #             token=token,
+    #             expires_at=expires_time,
+    #             created_at=created_time
+    #         )
             
-            # 假设self.session是数据库会话对象
-            self.session.add(new_token)
-            self.session.commit()
+    #         # 假设self.session是数据库会话对象
+    #         self.session.add(new_token)
+    #         self.session.commit()
             
-            return token
+    #         return token
             
-        except Exception as e:
-            self.session.rollback()
-            raise Exception(f"创建token失败: {str(e)}")
+    #     except Exception as e:
+    #         self.session.rollback()
+    #         raise Exception(f"创建token失败: {str(e)}")
         
     def recordlog(self,user_id,log_type,content,ip):
         """
@@ -152,5 +173,5 @@
             raise Exception(f"记录系统性能消耗失败: {e}")
     
     def getsyscost(self):
-        res= self.session.query(PerformanceData).all()
+        res = self.session.query(PerformanceData).order_by(PerformanceData.record_time.desc()).limit(200).all()
         return res
\ No newline at end of file
diff --git a/Merge/back_trm/app/functions/__pycache__/Fpost.cpython-310.pyc b/Merge/back_trm/app/functions/__pycache__/Fpost.cpython-310.pyc
index 3a49c6c..88279b4 100644
--- a/Merge/back_trm/app/functions/__pycache__/Fpost.cpython-310.pyc
+++ b/Merge/back_trm/app/functions/__pycache__/Fpost.cpython-310.pyc
Binary files differ
diff --git a/Merge/back_trm/app/models/__pycache__/token.cpython-310.pyc b/Merge/back_trm/app/models/__pycache__/token.cpython-310.pyc
new file mode 100644
index 0000000..ab59118
--- /dev/null
+++ b/Merge/back_trm/app/models/__pycache__/token.cpython-310.pyc
Binary files differ
diff --git a/Merge/back_trm/app/routes.py b/Merge/back_trm/app/routes.py
index 20cf99c..b1d1fd6 100644
--- a/Merge/back_trm/app/routes.py
+++ b/Merge/back_trm/app/routes.py
@@ -17,9 +17,9 @@
     SessionLocal = sessionmaker(bind=engine)
     session = SessionLocal()
     f=Fpost(session)
-    checres=f.checkid(data['userid'],'superadmin')
+    checres,userid=f.checkid(data['userid'],'superadmin')
     if(not checres):
-        f.recordlog(data['userid'],
+        f.recordlog(userid,
                      'error', 
                      '系统需要超级管理员才能执行修改用户角色的操作，但是当前用户不是超级管理员',
                      request.remote_addr)
@@ -27,12 +27,12 @@
     
     res=f.giveadmin(data['targetid'])
     if not res:
-        f.recordlog(data['userid'],
+        f.recordlog(userid,
                      'error', 
                      f"尝试修改用户{data['targetid']}角色为admin失败，用户不存在",
                      request.remote_addr)
         return jsonify({'status': 'error', 'message': 'User not found'})
-    f.recordlog(data['userid'],
+    f.recordlog(userid,
                     'behavior', 
                     f'用户角色为admin修改成功，用户ID: {data["targetid"]} 被修改为管理员',
                     request.remote_addr)
@@ -46,9 +46,9 @@
     SessionLocal = sessionmaker(bind=engine)
     session = SessionLocal()
     f=Fpost(session)
-    checres=f.checkid(data['userid'],'superadmin')
+    checres,userid=f.checkid(data['userid'],'superadmin')
     if(not checres):
-        f.recordlog(data['userid'],
+        f.recordlog(userid,
                      'error', 
                      '系统需要超级管理员才能执行修改用户角色的操作，但是当前用户不是超级管理员',
                      request.remote_addr)
@@ -56,12 +56,12 @@
     
     res=f.giveuser(data['targetid'])
     if not res:
-        f.recordlog(data['userid'],
+        f.recordlog(userid,
                      'error', 
                      f"尝试修改用户{data['targetid']}为user失败，用户不存在",
                      request.remote_addr)
         return jsonify({'status': 'error', 'message': 'User not found'})
-    f.recordlog(data['userid'],
+    f.recordlog(userid,
                     'behavior', 
                     f'用户角色修改成功，用户ID: {data["targetid"]} 被修改为普通用户',
                     request.remote_addr)
@@ -76,9 +76,9 @@
     SessionLocal = sessionmaker(bind=engine)
     session = SessionLocal()
     f=Fpost(session)
-    checres=f.checkid(data['userid'],'superadmin')
+    checres,userid=f.checkid(data['userid'],'superadmin')
     if(not checres):
-        f.recordlog(data['userid'],
+        f.recordlog(userid,
                      'error', 
                      '系统需要超级管理员才能执行修改用户角色的操作，但是当前用户不是超级管理员',
                      request.remote_addr)
@@ -86,12 +86,12 @@
     
     res=f.givesuperadmin(data['targetid'])
     if not res:
-        f.recordlog(data['userid'],
+        f.recordlog(userid,
                      'error', 
                      f'尝试修改用户{data["targetid"]}角色为superadmin失败，用户不存在',
                      request.remote_addr)
         return jsonify({'status': 'error', 'message': 'User not found'})
-    f.recordlog(data['userid'],
+    f.recordlog(userid,
                     'behavior', 
                     f'用户角色修改成功，用户ID: {data["targetid"]} 被修改为超级管理员',
                     request.remote_addr)
@@ -105,9 +105,11 @@
     SessionLocal = sessionmaker(bind=engine)
     session = SessionLocal()
     f=Fpost(session)
-    checres=f.checkid(data['userid'],'superadmin')
+    checres,userid=f.checkid(data['userid'],'superadmin')
+    print("+++++++++++++++++++++++++++++++++++++++++++++++++")
+    print(checres)
     if(not checres):
-        f.recordlog(data['userid'],
+        f.recordlog(userid,
                      'error', 
                      '系统需要超级管理员才能执行获取用户列表的操作，但是当前用户不是超级管理员',
                      request.remote_addr)
@@ -121,7 +123,7 @@
             'role': datai[2]
         })
 
-    f.recordlog(data['userid'],
+    f.recordlog(userid,
                     'access', 
                     '获取用户列表成功',
                     request.remote_addr)
@@ -135,9 +137,9 @@
     SessionLocal = sessionmaker(bind=engine)
     session = SessionLocal()
     f=Fpost(session)
-    checres=f.checkid(data['userid'],'admin')
+    checres,userid=f.checkid(data['userid'],'admin')
     if(not checres):
-        f.recordlog(data['userid'],
+        f.recordlog(userid,
                      'error', 
                      '系统需要管理员才能执行获取帖子列表的操作，但是当前用户不是管理员',
                      request.remote_addr)
@@ -150,7 +152,7 @@
             'title': datai[1],
             'status': datai[2]
         })
-    f.recordlog(data['userid'],
+    f.recordlog(userid,
                  'access', 
                  '获取帖子列表成功',
                  request.remote_addr)
@@ -163,21 +165,21 @@
     SessionLocal = sessionmaker(bind=engine)
     session = SessionLocal()
     f=Fpost(session)
-    checres=f.checkid(data['userid'],'admin')
+    checres,userid=f.checkid(data['userid'],'admin')
     if(not checres):
-        f.recordlog(data['userid'],
+        f.recordlog(userid,
                      'error', 
                      '系统需要管理员才能执行获取帖子详情的操作，但是当前用户不是管理员',
                      request.remote_addr)
         return jsonify({'status': 'error', 'message': 'Unauthorized'})
     res=f.getpost(data['postid'])
     if not res:
-        f.recordlog(data['userid'],
+        f.recordlog(userid,
                      'error', 
                      f'尝试获取帖子{data["postid"]}失败，帖子不存在',
                      request.remote_addr)
         return jsonify({'status': 'error', 'message': 'Post not found'})
-    f.recordlog(data['userid'],
+    f.recordlog(userid,
                  'access', 
                  f'获取帖子详情成功，帖子ID: {data["postid"]}',
                  request.remote_addr)
@@ -190,9 +192,9 @@
     SessionLocal = sessionmaker(bind=engine)
     session = SessionLocal()
     f=Fpost(session)
-    checres=f.checkid(data['userid'],'admin')
+    checres,userid=f.checkid(data['userid'],'admin')
     if(not checres):
-        f.recordlog(data['userid'],
+        f.recordlog(userid,
                      'error', 
                      '系统需要管理员才能执行帖子审核的操作，但是当前用户不是管理员',
                      request.remote_addr)
@@ -200,12 +202,12 @@
     
     res=f.review(data['postid'],data['status'])
     if not res:
-        f.recordlog(data['userid'],
+        f.recordlog(userid,
                      'error', 
                      f'尝试审核帖子{data["postid"]}失败，帖子不存在',
                      request.remote_addr)
         return jsonify({'status': 'error', 'message': 'Post not found'})
-    f.recordlog(data['userid'],
+    f.recordlog(userid,
                  'behavior', 
                  f'帖子审核成功，帖子ID: {data["postid"]} 状态更新为 {data["status"]}',
                  request.remote_addr)
@@ -220,9 +222,9 @@
     SessionLocal = sessionmaker(bind=engine)
     session = SessionLocal()
     f=Fpost(session)
-    checres=f.checkid(data['userid'],'admin')
+    checres,userid=f.checkid(data['userid'],'admin')
     if(not checres):
-        f.recordlog(data['userid'],
+        f.recordlog(userid,
                      'error', 
                      '系统需要管理员才能执行Nginx认证的操作，但是当前用户不是管理员',
                      request.remote_addr)
@@ -230,12 +232,12 @@
     
     res=f.nginxauth(data['postid'],data['status'])
     if not res:
-        f.recordlog(data['userid'],
+        f.recordlog(userid,
                      'error', 
                      f'尝试更新Nginx认证状态失败，帖子{data["postid"]}不存在',
                      request.remote_addr)
         return jsonify({'status': 'error', 'message': 'Post not found'})
-    f.recordlog(data['userid'],
+    f.recordlog(userid,
                  'behavior', 
                  f'Nginx认证状态更新成功，帖子ID: {data["postid"]} 状态更新为 {data["status"]}',
                  request.remote_addr)
@@ -248,9 +250,9 @@
     SessionLocal = sessionmaker(bind=engine)
     session = SessionLocal()
     f=Fpost(session)
-    checres=f.checkid(data['userid'],'superadmin')
+    checres,userid=f.checkid(data['userid'],'superadmin')
     if(not checres):
-        f.recordlog(data['userid'],
+        f.recordlog(userid,
                      'error', 
                      '系统需要管理员才能执行获取系统性能消耗的操作，但是当前用户不是管理员',
                      request.remote_addr)
@@ -258,13 +260,13 @@
     
     res=f.getsyscost()
     if not res:
-        f.recordlog(data['userid'],
+        f.recordlog(userid,
                      'error', 
                      '尝试获取系统性能消耗数据失败，数据不存在',
                      request.remote_addr)
         return jsonify({'status': 'error', 'message': 'No performance data found'})
     
-    f.recordlog(data['userid'],
+    f.recordlog(userid,
                  'access', 
                  '获取系统性能消耗数据成功',
                  request.remote_addr)
@@ -287,9 +289,9 @@
     SessionLocal = sessionmaker(bind=engine)
     session = SessionLocal()
     f=Fpost(session)
-    checres=f.checkid(data['userid'],'superadmin')
+    checres,userid=f.checkid(data['userid'],'superadmin')
     if(not checres):
-        f.recordlog(data['userid'],
+        f.recordlog(userid,
                      'error', 
                      '系统需要管理员才能执行获取日志的操作，但是当前用户不是管理员',
                      request.remote_addr)
@@ -297,13 +299,13 @@
     
     res=f.getrecordlog()
     if not res:
-        f.recordlog(data['userid'],
+        f.recordlog(userid,
                      'error', 
                      '尝试获取日志失败，日志不存在',
                      request.remote_addr)
         return jsonify({'status': 'error', 'message': 'No logs found'})
     
-    f.recordlog(data['userid'],
+    f.recordlog(userid,
                  'access', 
                  '获取日志成功',
                  request.remote_addr)
diff --git a/Merge/back_trm/config.py b/Merge/back_trm/config.py
index d4a2e88..424b53e 100644
--- a/Merge/back_trm/config.py
+++ b/Merge/back_trm/config.py
@@ -9,4 +9,5 @@
     SQLPORT=os.getenv('SQLPORT')
     SQLNAME=os.getenv('SQLNAME')
     SQLUSER=os.getenv('SQLUSER')
-    SQLPWD=os.getenv('SQLPWD')
\ No newline at end of file
+    SQLPWD=os.getenv('SQLPWD')
+    API_BASE_URL = 'http://10.126.59.25:8082'
\ No newline at end of file