diff --git a/fp-admin/src/main/java/com/zf/foodpurchase/fdsafe/web/school/SchoolOrderController.java b/fp-admin/src/main/java/com/zf/foodpurchase/fdsafe/web/school/SchoolOrderController.java
index 0042c2a..e9b848b 100644
--- a/fp-admin/src/main/java/com/zf/foodpurchase/fdsafe/web/school/SchoolOrderController.java
+++ b/fp-admin/src/main/java/com/zf/foodpurchase/fdsafe/web/school/SchoolOrderController.java
@@ -1,8 +1,11 @@
 package com.zf.foodpurchase.fdsafe.web.school;
 
 
+import com.zf.foodpurchase.common.constant.WxAPPAccountConstants;
 import com.zf.foodpurchase.common.core.controller.BaseController;
 import com.zf.foodpurchase.common.core.domain.AjaxResult;
+import com.zf.foodpurchase.common.core.domain.entity.SysUser;
+import com.zf.foodpurchase.common.core.domain.model.LoginUser;
 import com.zf.foodpurchase.common.core.page.TableDataInfo;
 import com.zf.foodpurchase.fdsafe.service.ISchoolOrderItemService;
 import com.zf.foodpurchase.fdsafe.service.ISchoolOrderService;
@@ -47,11 +50,21 @@ public class SchoolOrderController extends BaseController {
      * 1.校验:商品有效性校验,订单金额校验
      * 2.订单入库:订单表,订单详情表,购物车表
      * 3.订单入库成功后,删除购物车项
+     *
+     * 非学校账户不可调用,管理员除外
      * @param submitOrderVO
      * @return
      */
     @PostMapping("/submitOrder")
     public AjaxResult submitOrder(@RequestBody @Valid SchoolSubmitOrderVO submitOrderVO) {
+        SysUser user = getLoginUser().getUser();
+        if(!user.isAdmin()){
+            Integer accountType =getLoginUser().getUser().getAccountType();
+            if(!WxAPPAccountConstants.SCHOOL.equals(accountType)){
+                return error("非学校账号无法提交订单");
+            }
+        }
+
         return schoolOrderService.submitOrder(submitOrderVO);
     }
 
@@ -60,6 +73,13 @@ public class SchoolOrderController extends BaseController {
      */
     @PostMapping("/cancelOrder")
     public AjaxResult cancelOrder(@RequestBody @Valid SchoolCancelOrderVO cancelOrderVO) {
+        SysUser user = getLoginUser().getUser();
+        if(!user.isAdmin()){
+            Integer accountType =getLoginUser().getUser().getAccountType();
+            if(!WxAPPAccountConstants.SCHOOL.equals(accountType)){
+                return error("非学校账号无法取消订单");
+            }
+        }
         return schoolOrderService.cancelOrder(cancelOrderVO);
     }
 
@@ -68,6 +88,13 @@ public class SchoolOrderController extends BaseController {
      */
     @PostMapping("/updateOrderRemark")
     public AjaxResult updateOrderRemark(@RequestBody @Valid SchoolModifyOrderRemarkVO remarkVO) {
+        SysUser user = getLoginUser().getUser();
+        if(!user.isAdmin()){
+            Integer accountType =getLoginUser().getUser().getAccountType();
+            if(!WxAPPAccountConstants.SCHOOL.equals(accountType)){
+                return error("非学校账号无法修改订单备注");
+            }
+        }
         return schoolOrderService.updateOrderRemark(remarkVO);
     }
 
@@ -89,6 +116,13 @@ public class SchoolOrderController extends BaseController {
     public AjaxResult supplierAcceptOrder(@Validated SupplierAcceptOrderVO supplierAcceptOrderVO) {
         // 填充学校id,教育局id等数据
         dealCommonVO(supplierAcceptOrderVO);
+        SysUser user = getLoginUser().getUser();
+        if(!user.isAdmin()){
+            Integer accountType =getLoginUser().getUser().getAccountType();
+            if(!WxAPPAccountConstants.SUPPLIER.equals(accountType)){
+                return error("非供货商账号无法接单");
+            }
+        }
         return schoolOrderService.supplierAcceptOrder(supplierAcceptOrderVO);
     }
 }
diff --git a/fp-admin/src/main/java/com/zf/foodpurchase/fdsafe/web/school/SchoolRefundController.java b/fp-admin/src/main/java/com/zf/foodpurchase/fdsafe/web/school/SchoolRefundController.java
index 35471e9..d8cd0df 100644
--- a/fp-admin/src/main/java/com/zf/foodpurchase/fdsafe/web/school/SchoolRefundController.java
+++ b/fp-admin/src/main/java/com/zf/foodpurchase/fdsafe/web/school/SchoolRefundController.java
@@ -1,8 +1,10 @@
 package com.zf.foodpurchase.fdsafe.web.school;
 
 
+import com.zf.foodpurchase.common.constant.WxAPPAccountConstants;
 import com.zf.foodpurchase.common.core.controller.BaseController;
 import com.zf.foodpurchase.common.core.domain.AjaxResult;
+import com.zf.foodpurchase.common.core.domain.entity.SysUser;
 import com.zf.foodpurchase.common.core.page.TableDataInfo;
 import com.zf.foodpurchase.common.utils.StringUtils;
 import com.zf.foodpurchase.common.valigroud.AddGroup;
@@ -65,11 +67,19 @@ public class SchoolRefundController extends BaseController {
      * 1.子单编号
      * 2.退货原因
      * 3.退货数量
+     * 学校账号创建
      * @param refundItemAddUpdateVO
      * @return
      */
     @PostMapping("/addRefundItem")
     public AjaxResult addRefundItem(@RequestBody @Validated(AddGroup.class) RefundItemAddUpdateVO refundItemAddUpdateVO) {
+        SysUser user = getLoginUser().getUser();
+        if(!user.isAdmin()){
+            Integer accountType =getLoginUser().getUser().getAccountType();
+            if(!WxAPPAccountConstants.SCHOOL.equals(accountType)){
+                return error("非学校账号无法创建退货单");
+            }
+        }
         return schoolRefundItemService.addRefundItem(refundItemAddUpdateVO);
     }
 
@@ -78,6 +88,13 @@ public class SchoolRefundController extends BaseController {
      */
     @PostMapping("/updateRefundItem")
     public AjaxResult updateRefundItem(@RequestBody @Validated(UpdateGroup.class) RefundItemAddUpdateVO refundItemAddUpdateVO) {
+        SysUser user = getLoginUser().getUser();
+        if(!user.isAdmin()){
+            Integer accountType =getLoginUser().getUser().getAccountType();
+            if(!WxAPPAccountConstants.SCHOOL.equals(accountType)){
+                return error("非学校账号无法修改退货单");
+            }
+        }
         return schoolRefundItemService.updateRefundItem(refundItemAddUpdateVO);
     }
 
@@ -86,6 +103,13 @@ public class SchoolRefundController extends BaseController {
      */
     @PostMapping("/checkSchoolRefund")
     public AjaxResult checkSchoolRefund(@RequestBody @Valid RefundCheckVO checkVO) {
+        SysUser user = getLoginUser().getUser();
+        if(!user.isAdmin()){
+            Integer accountType =getLoginUser().getUser().getAccountType();
+            if(!WxAPPAccountConstants.SUPPLIER.equals(accountType)){
+                return error("非供货商账号无法审核退货单");
+            }
+        }
         return schoolRefundService.checkSchoolRefund(checkVO);
     }
 }
diff --git a/fp-admin/src/main/java/com/zf/foodpurchase/fdsafe/web/supplier/SupplierDeliveryController.java b/fp-admin/src/main/java/com/zf/foodpurchase/fdsafe/web/supplier/SupplierDeliveryController.java
index fc34977..3971426 100644
--- a/fp-admin/src/main/java/com/zf/foodpurchase/fdsafe/web/supplier/SupplierDeliveryController.java
+++ b/fp-admin/src/main/java/com/zf/foodpurchase/fdsafe/web/supplier/SupplierDeliveryController.java
@@ -1,8 +1,10 @@
 package com.zf.foodpurchase.fdsafe.web.supplier;
 
 
+import com.zf.foodpurchase.common.constant.WxAPPAccountConstants;
 import com.zf.foodpurchase.common.core.controller.BaseController;
 import com.zf.foodpurchase.common.core.domain.AjaxResult;
+import com.zf.foodpurchase.common.core.domain.entity.SysUser;
 import com.zf.foodpurchase.common.core.page.TableDataInfo;
 import com.zf.foodpurchase.common.valigroud.AddGroup;
 import com.zf.foodpurchase.common.valigroud.UpdateGroup;
@@ -42,18 +44,44 @@ public class SupplierDeliveryController extends BaseController {
         return getDataTable(list);
     }
 
+    /**
+     * 添加送货单
+     * @param deliveryAddVO
+     * @return
+     */
     @PostMapping("/addOrderDelivery")
     public AjaxResult addOrderDelivery(@RequestBody  @Validated(AddGroup.class) SupplierDeliveryAddUpdateVO deliveryAddVO){
+        SysUser user = getLoginUser().getUser();
+        if(!user.isAdmin()){
+            Integer accountType =getLoginUser().getUser().getAccountType();
+            if(!WxAPPAccountConstants.SUPPLIER.equals(accountType)){
+                return error("非供货商账号无法添加送货单");
+            }
+        }
         return supplierDeliveryService.addOrderDelivery(deliveryAddVO);
     }
 
     @PostMapping("/supplierUpdateDelivery")
     public AjaxResult supplierUpdateDelivery(@RequestBody  @Validated(UpdateGroup.class) SupplierDeliveryAddUpdateVO supplierDeliveryVO){
+        SysUser user = getLoginUser().getUser();
+        if(!user.isAdmin()){
+            Integer accountType =getLoginUser().getUser().getAccountType();
+            if(!WxAPPAccountConstants.SUPPLIER.equals(accountType)){
+                return error("非供货商账号无法修改送货单");
+            }
+        }
         return supplierDeliveryService.supplierUpdateDelivery(supplierDeliveryVO);
     }
 
     @PostMapping("/schoolSignDelivery")
     public AjaxResult schoolUpdateDelivery(@RequestBody     @Validated(UpdateGroup.class) SchoolDeliveryVO schoolDeliveryVO){
+        SysUser user = getLoginUser().getUser();
+        if(!user.isAdmin()){
+            Integer accountType =getLoginUser().getUser().getAccountType();
+            if(!WxAPPAccountConstants.SCHOOL.equals(accountType)){
+                return error("非学校账号无法签收送货单");
+            }
+        }
         // wxImage形式
         List<WxImg> images = schoolDeliveryVO.getWxSignImage();
         if(!CollectionUtils.isEmpty( images)){
diff --git a/fp-admin/src/main/java/com/zf/foodpurchase/fdsafe/web/supplier/SupplierDeliveryItemController.java b/fp-admin/src/main/java/com/zf/foodpurchase/fdsafe/web/supplier/SupplierDeliveryItemController.java
index 5dde6b5..c7606d1 100644
--- a/fp-admin/src/main/java/com/zf/foodpurchase/fdsafe/web/supplier/SupplierDeliveryItemController.java
+++ b/fp-admin/src/main/java/com/zf/foodpurchase/fdsafe/web/supplier/SupplierDeliveryItemController.java
@@ -1,8 +1,10 @@
 package com.zf.foodpurchase.fdsafe.web.supplier;
 
 
+import com.zf.foodpurchase.common.constant.WxAPPAccountConstants;
 import com.zf.foodpurchase.common.core.controller.BaseController;
 import com.zf.foodpurchase.common.core.domain.AjaxResult;
+import com.zf.foodpurchase.common.core.domain.entity.SysUser;
 import com.zf.foodpurchase.common.core.page.TableDataInfo;
 import com.zf.foodpurchase.common.valigroud.UpdateGroup;
 import com.zf.foodpurchase.fdsafe.service.ISupplierDeliveryItemService;
@@ -45,8 +47,20 @@ public class SupplierDeliveryItemController extends BaseController {
         return getDataTable(list);
     }
 
+    /**
+     * 修改送货单详情项
+     * @param supplierDeliveryItemUpdateVO
+     * @return
+     */
     @PostMapping("/update")
     public AjaxResult update(@RequestBody  @Validated(UpdateGroup.class) SupplierDeliveryItemUpdateVO supplierDeliveryItemUpdateVO) {
+        SysUser user = getLoginUser().getUser();
+        if(!user.isAdmin()){
+            Integer accountType =getLoginUser().getUser().getAccountType();
+            if(!WxAPPAccountConstants.SUPPLIER.equals(accountType)){
+                return error("非供货商账号无法修改子送货单信息");
+            }
+        }
         // 检测报告图片数据处理
         List<WxImg> images = supplierDeliveryItemUpdateVO.getWxCheckReportImage();
         if(!CollectionUtils.isEmpty( images)){