diff --git a/orion-ops-framework/orion-ops-common/src/main/java/com/orion/ops/framework/common/constant/ErrorCode.java b/orion-ops-framework/orion-ops-common/src/main/java/com/orion/ops/framework/common/constant/ErrorCode.java
new file mode 100644
index 00000000..2f9d8005
--- /dev/null
+++ b/orion-ops-framework/orion-ops-common/src/main/java/com/orion/ops/framework/common/constant/ErrorCode.java
@@ -0,0 +1,128 @@
+package com.orion.ops.framework.common.constant;
+
+import com.orion.lang.define.wrapper.CodeInfo;
+import com.orion.lang.define.wrapper.HttpWrapper;
+
+/**
+ * 错误码
+ *
+ * @author Jiahang Li
+ * @version 1.0.0
+ * @since 2023/7/6 16:14
+ */
+@SuppressWarnings("ALL")
+public enum ErrorCode implements CodeInfo {
+
+    BAD_REQUEST(400, "参数验证失败"),
+
+    UNAUTHORIZED(401, "会话过期"),
+
+    FORBIDDEN(403, "无操作权限"),
+
+    NOT_FOUND(404, "未找到该资源"),
+
+    METHOD_NOT_ALLOWED(405, "不支持此方法"),
+
+    REQUEST_TIMEOUT(408, "处理超时"),
+
+    CONFLICT(409, "状态发生改变, 请刷新后重试"),
+
+    PAYLOAD_TOO_LARGE(413, "请求过大"),
+
+    LOCKED(423, "当前已被锁定"),
+
+    TOO_MANY_REQUESTS(429, "请求过快"),
+
+    INTERNAL_SERVER_ERROR(500, "系统异常"),
+
+    // -------------------- 自定义 --------------------
+
+    NETWORK_FLUCTUATION(700, "当前环境网路波动"),
+
+    HTTP_API(701, "api 调用异常"),
+
+    IO_EXCEPTION(702, "网络异常"),
+
+    SQL_EXCEPTION(703, "数据异常"),
+
+    SFTP_EXCEPTION(704, "操作失败"),
+
+    EXCEL_PASSWORD_ERROR(705, "文档密码错误"),
+
+    PASER_FAILED(706, "解析失败"),
+
+    ENCRYPT_ERROR(707, "数据加密异常"),
+
+    DECRYPT_ERROR(708, "数据解密异常"),
+
+    EXPRESSION_ERROR(709, "表达式错误"),
+
+    TASK_EXECUTE_ERROR(710, "任务执行异常"),
+
+    CONNECT_ERROR(711, "建立连接失败"),
+
+    INTERRUPT_ERROR(712, "操作中断"),
+
+    UNSAFE_OPERATOR(713, "不安全的操作"),
+
+    VCS_OPETATOR_ERROR(714, "仓库操作执行失败"),
+
+    ;
+
+    ErrorCode(int code, String message) {
+        this.code = code;
+        this.message = message;
+        this.wrapper = HttpWrapper.of(this);
+    }
+
+    /**
+     * 错误码
+     */
+    private final int code;
+
+    /**
+     * 错误信息
+     */
+    private final String message;
+
+    private final HttpWrapper<?> wrapper;
+
+    /**
+     * 获取 wapper
+     *
+     * @param data data
+     * @return HttpWrapper
+     */
+    public HttpWrapper<?> wrapper() {
+        return HttpWrapper.of(this);
+    }
+
+    /**
+     * 获取 wapper
+     *
+     * @param data data
+     * @param <T>  T
+     * @return HttpWrapper
+     */
+    public <T> HttpWrapper<T> wrapper(T data) {
+        return HttpWrapper.of(this, data);
+    }
+
+    @Override
+    public int code() {
+        return code;
+    }
+
+    @Override
+    public String message() {
+        return message;
+    }
+
+    /**
+     * @return 获取单例 wapper
+     */
+    public HttpWrapper<?> getWrapper() {
+        return wrapper;
+    }
+
+}
diff --git a/orion-ops-framework/orion-ops-common/src/main/java/com/orion/ops/framework/common/constant/ExceptionMessageConst.java b/orion-ops-framework/orion-ops-common/src/main/java/com/orion/ops/framework/common/constant/ExceptionMessageConst.java
deleted file mode 100644
index 88e5685e..00000000
--- a/orion-ops-framework/orion-ops-common/src/main/java/com/orion/ops/framework/common/constant/ExceptionMessageConst.java
+++ /dev/null
@@ -1,50 +0,0 @@
-package com.orion.ops.framework.common.constant;
-
-/**
- * 消息常量
- *
- * @author Jiahang Li
- * @version 1.0.0
- * @since 2021/6/4 18:26
- */
-public interface ExceptionMessageConst {
-
-    String INVALID_PARAM = "非法参数";
-
-    String OPERATOR_ERROR = "操作失败";
-
-    String HTTP_API = "api 调用异常";
-
-    String NETWORK_FLUCTUATION = "当前环境网路波动";
-
-    String OPEN_TEMPLATE_ERROR = "模板解析失败 请检查模板和密码";
-
-    String PARSE_TEMPLATE_DATA_ERROR = "模板解析失败 请检查模板数据";
-
-    String REPOSITORY_OPERATOR_ERROR = "应用版本仓库操作执行失败";
-
-    String TASK_ERROR = "任务执行异常";
-
-    String CONNECT_ERROR = "建立连接失败";
-
-    String TIMEOUT_ERROR = "处理超时";
-
-    String INTERRUPT_ERROR = "操作中断";
-
-    String UNSAFE_OPERATOR = "不安全的操作";
-
-    String ENCRYPT_ERROR = "数据加密异常";
-
-    String DECRYPT_ERROR = "数据解密异常";
-
-    String EXCEPTION_MESSAGE = "系统异常";
-
-    String IO_EXCEPTION_MESSAGE = "网络异常";
-
-    String SQL_EXCEPTION_MESSAGE = "数据异常";
-
-    String FILE_TOO_LARGE = "文件过大";
-
-    String ERROR_EXPRESSION = "表达式错误";
-
-}
diff --git a/orion-ops-framework/orion-ops-common/src/main/java/com/orion/ops/framework/common/meta/TraceIdHolder.java b/orion-ops-framework/orion-ops-common/src/main/java/com/orion/ops/framework/common/meta/TraceIdHolder.java
index 2c663ea9..611f421b 100644
--- a/orion-ops-framework/orion-ops-common/src/main/java/com/orion/ops/framework/common/meta/TraceIdHolder.java
+++ b/orion-ops-framework/orion-ops-common/src/main/java/com/orion/ops/framework/common/meta/TraceIdHolder.java
@@ -1,5 +1,7 @@
 package com.orion.ops.framework.common.meta;
 
+import com.alibaba.ttl.TransmittableThreadLocal;
+
 /**
  * traceId 持有者
  *
@@ -15,8 +17,7 @@ public class TraceIdHolder {
     /**
      * 请求序列
      */
-    private static final ThreadLocal<String> HOLDER = new ThreadLocal<>();
-    ;
+    private static final ThreadLocal<String> HOLDER = new TransmittableThreadLocal<>();
 
     public static String get() {
         return HOLDER.get();
diff --git a/orion-ops-framework/orion-ops-spring-boot-starter-job/src/main/java/com/orion/ops/framework/job/config/OrionSchedulerAutoConfiguration.java b/orion-ops-framework/orion-ops-spring-boot-starter-job/src/main/java/com/orion/ops/framework/job/config/OrionSchedulerAutoConfiguration.java
index c63214be..3da87e22 100644
--- a/orion-ops-framework/orion-ops-spring-boot-starter-job/src/main/java/com/orion/ops/framework/job/config/OrionSchedulerAutoConfiguration.java
+++ b/orion-ops-framework/orion-ops-spring-boot-starter-job/src/main/java/com/orion/ops/framework/job/config/OrionSchedulerAutoConfiguration.java
@@ -20,7 +20,7 @@ import org.springframework.scheduling.concurrent.ThreadPoolTaskScheduler;
 public class OrionSchedulerAutoConfiguration {
 
     /**
-     * @return 调取器
+     * @return 任务调度器
      */
     @Bean
     public TaskScheduler taskScheduler() {
diff --git a/orion-ops-framework/orion-ops-spring-boot-starter-log/src/main/java/com/orion/ops/framework/log/core/interceptor/AbstractLogPrinterInterceptor.java b/orion-ops-framework/orion-ops-spring-boot-starter-log/src/main/java/com/orion/ops/framework/log/core/interceptor/AbstractLogPrinterInterceptor.java
index 577ad9fd..d6cf36b9 100644
--- a/orion-ops-framework/orion-ops-spring-boot-starter-log/src/main/java/com/orion/ops/framework/log/core/interceptor/AbstractLogPrinterInterceptor.java
+++ b/orion-ops-framework/orion-ops-spring-boot-starter-log/src/main/java/com/orion/ops/framework/log/core/interceptor/AbstractLogPrinterInterceptor.java
@@ -12,11 +12,13 @@ import com.orion.lang.utils.collect.Maps;
 import com.orion.lang.utils.reflect.Classes;
 import com.orion.ops.framework.common.annotation.IgnoreLog;
 import com.orion.ops.framework.common.meta.TraceIdHolder;
+import com.orion.ops.framework.common.security.SecurityHolder;
 import com.orion.ops.framework.log.core.config.LogPrinterConfig;
 import org.aopalliance.intercept.MethodInvocation;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Qualifier;
 
+import javax.annotation.Resource;
 import javax.servlet.ServletRequest;
 import javax.servlet.ServletResponse;
 import java.lang.annotation.Annotation;
@@ -55,6 +57,9 @@ public abstract class AbstractLogPrinterInterceptor implements LogPrinterInterce
      */
     private final Map<String, boolean[]> ignoreParameter;
 
+    @Resource
+    protected SecurityHolder securityHolder;
+
     @SuppressWarnings("ALL")
     @Autowired(required = false)
     @Qualifier("desensitizeValueSerializeFilter")
diff --git a/orion-ops-framework/orion-ops-spring-boot-starter-log/src/main/java/com/orion/ops/framework/log/core/interceptor/PrettyLogPrinterInterceptor.java b/orion-ops-framework/orion-ops-spring-boot-starter-log/src/main/java/com/orion/ops/framework/log/core/interceptor/PrettyLogPrinterInterceptor.java
index e0d8f952..1daa68bf 100644
--- a/orion-ops-framework/orion-ops-spring-boot-starter-log/src/main/java/com/orion/ops/framework/log/core/interceptor/PrettyLogPrinterInterceptor.java
+++ b/orion-ops-framework/orion-ops-spring-boot-starter-log/src/main/java/com/orion/ops/framework/log/core/interceptor/PrettyLogPrinterInterceptor.java
@@ -52,7 +52,11 @@ public class PrettyLogPrinterInterceptor extends AbstractLogPrinterInterceptor {
         if (!Strings.isEmpty(summary)) {
             requestLog.append("\tsummary: ").append(summary).append('\n');
         }
-        // FIXME 登陆用户
+        // 登陆用户
+        Long loginUserId = securityHolder.getLoginUserId();
+        if (loginUserId != null) {
+            requestLog.append("\tuser: ").append(loginUserId).append('\n');
+        }
         // http
         if (request != null) {
             // remoteAddr
diff --git a/orion-ops-framework/orion-ops-spring-boot-starter-log/src/main/java/com/orion/ops/framework/log/core/interceptor/RowLogPrinterInterceptor.java b/orion-ops-framework/orion-ops-spring-boot-starter-log/src/main/java/com/orion/ops/framework/log/core/interceptor/RowLogPrinterInterceptor.java
index c51b5e5b..a224b938 100644
--- a/orion-ops-framework/orion-ops-spring-boot-starter-log/src/main/java/com/orion/ops/framework/log/core/interceptor/RowLogPrinterInterceptor.java
+++ b/orion-ops-framework/orion-ops-spring-boot-starter-log/src/main/java/com/orion/ops/framework/log/core/interceptor/RowLogPrinterInterceptor.java
@@ -56,7 +56,8 @@ public class RowLogPrinterInterceptor extends AbstractLogPrinterInterceptor impl
         if (!Strings.isEmpty(summary)) {
             fields.put(SUMMARY, summary);
         }
-        // FIXME 登陆用户
+        // 登陆用户
+        fields.put(USER, securityHolder.getLoginUserId());
         // http
         if (request != null) {
             // remoteAddr
diff --git a/orion-ops-framework/orion-ops-spring-boot-starter-mybatis/src/main/java/com/orion/ops/framework/mybatis/core/handler/FieldFillHandler.java b/orion-ops-framework/orion-ops-spring-boot-starter-mybatis/src/main/java/com/orion/ops/framework/mybatis/core/handler/FieldFillHandler.java
index bf964c76..b4a4c14c 100644
--- a/orion-ops-framework/orion-ops-spring-boot-starter-mybatis/src/main/java/com/orion/ops/framework/mybatis/core/handler/FieldFillHandler.java
+++ b/orion-ops-framework/orion-ops-spring-boot-starter-mybatis/src/main/java/com/orion/ops/framework/mybatis/core/handler/FieldFillHandler.java
@@ -1,9 +1,11 @@
 package com.orion.ops.framework.mybatis.core.handler;
 
 import com.baomidou.mybatisplus.core.handlers.MetaObjectHandler;
+import com.orion.ops.framework.common.security.SecurityHolder;
 import com.orion.ops.framework.mybatis.core.domain.BaseDO;
 import org.apache.ibatis.reflection.MetaObject;
 
+import javax.annotation.Resource;
 import java.util.Date;
 import java.util.Objects;
 
@@ -16,6 +18,9 @@ import java.util.Objects;
  */
 public class FieldFillHandler implements MetaObjectHandler {
 
+    @Resource
+    private SecurityHolder securityHolder;
+
     @Override
     public void insertFill(MetaObject metaObject) {
         if (Objects.nonNull(metaObject) && metaObject.getOriginalObject() instanceof BaseDO) {
@@ -31,8 +36,8 @@ public class FieldFillHandler implements MetaObjectHandler {
                 baseDO.setUpdateTime(now);
             }
 
-            // FIXME 当前用户
-            Long userId = null;
+            // TODO TEST
+            Long userId = securityHolder.getLoginUserId();
             // 创建人
             if (Objects.nonNull(userId) && Objects.isNull(baseDO.getCreator())) {
                 baseDO.setCreator(userId.toString());
@@ -46,18 +51,20 @@ public class FieldFillHandler implements MetaObjectHandler {
 
     @Override
     public void updateFill(MetaObject metaObject) {
-        // 更新时间
-        Object modifyTime = getFieldValByName("updateTime", metaObject);
-        if (Objects.isNull(modifyTime)) {
-            setFieldValByName("updateTime", new Date(), metaObject);
-        }
+        if (Objects.nonNull(metaObject) && metaObject.getOriginalObject() instanceof BaseDO) {
+            // 更新时间
+            Object updateTime = getFieldValByName("updateTime", metaObject);
+            if (Objects.isNull(updateTime)) {
+                setFieldValByName("updateTime", new Date(), metaObject);
+            }
 
-        // 更新人
-        Object updater = getFieldValByName("updater", metaObject);
-        // FIXME 当前用户
-        Long userId = null;
-        if (Objects.nonNull(userId) && Objects.isNull(updater)) {
-            setFieldValByName("updater", userId.toString(), metaObject);
+            // 更新人
+            Object updater = getFieldValByName("updater", metaObject);
+            // TODO TEST
+            Long userId = securityHolder.getLoginUserId();
+            if (Objects.nonNull(userId) && Objects.isNull(updater)) {
+                setFieldValByName("updater", userId.toString(), metaObject);
+            }
         }
     }
 
diff --git a/orion-ops-framework/orion-ops-spring-boot-starter-security/pom.xml b/orion-ops-framework/orion-ops-spring-boot-starter-security/pom.xml
index 924aad7f..a3ab9c29 100644
--- a/orion-ops-framework/orion-ops-spring-boot-starter-security/pom.xml
+++ b/orion-ops-framework/orion-ops-spring-boot-starter-security/pom.xml
@@ -22,14 +22,16 @@
             <artifactId>orion-ops-common</artifactId>
         </dependency>
 
+        <!-- security -->
         <dependency>
             <groupId>org.springframework.boot</groupId>
-            <artifactId>spring-boot-starter</artifactId>
+            <artifactId>spring-boot-starter-security</artifactId>
         </dependency>
 
+        <!-- web -->
         <dependency>
             <groupId>org.springframework.boot</groupId>
-            <artifactId>spring-boot-starter-websocket</artifactId>
+            <artifactId>spring-boot-starter-web</artifactId>
         </dependency>
     </dependencies>
 
diff --git a/orion-ops-framework/orion-ops-spring-boot-starter-security/src/main/java/com/orion/ops/framework/security/core/utils/SecurityUtils.java b/orion-ops-framework/orion-ops-spring-boot-starter-security/src/main/java/com/orion/ops/framework/security/core/utils/SecurityUtils.java
index bd468654..57a3d4de 100644
--- a/orion-ops-framework/orion-ops-spring-boot-starter-security/src/main/java/com/orion/ops/framework/security/core/utils/SecurityUtils.java
+++ b/orion-ops-framework/orion-ops-spring-boot-starter-security/src/main/java/com/orion/ops/framework/security/core/utils/SecurityUtils.java
@@ -33,12 +33,10 @@ public class SecurityUtils {
      */
     public static String obtainAuthorization(HttpServletRequest request) {
         String authorization = request.getHeader(StandardHttpHeader.AUTHORIZATION);
-        // todo mock
-        authorization = "Bearer 1213";
         if (Strings.isEmpty(authorization)) {
             return null;
         }
-        if (!authorization.contains(Const.BEARER)) {
+        if (!authorization.contains(Const.BEARER) || authorization.length() <= 7) {
             return null;
         }
         return authorization.substring(7).trim();
diff --git a/orion-ops-framework/orion-ops-spring-boot-starter-web/src/main/java/com/orion/ops/framework/web/config/OrionWebAutoConfiguration.java b/orion-ops-framework/orion-ops-spring-boot-starter-web/src/main/java/com/orion/ops/framework/web/config/OrionWebAutoConfiguration.java
index 5ae273cb..8f78a9b1 100644
--- a/orion-ops-framework/orion-ops-spring-boot-starter-web/src/main/java/com/orion/ops/framework/web/config/OrionWebAutoConfiguration.java
+++ b/orion-ops-framework/orion-ops-spring-boot-starter-web/src/main/java/com/orion/ops/framework/web/config/OrionWebAutoConfiguration.java
@@ -49,7 +49,7 @@ public class OrionWebAutoConfiguration implements WebMvcConfigurer {
         // 公共 api 前缀
         AntPathMatcher antPathMatcher = new AntPathMatcher(".");
         configurer.addPathPrefix(orionApiPrefix, clazz -> clazz.isAnnotationPresent(RestController.class)
-                && antPathMatcher.match("com.orion.ops.**.controller.**", clazz.getPackage().getName())); // 仅仅匹配 controller 包
+                && antPathMatcher.match("com.orion.ops.**.controller.**", clazz.getPackage().getName()));
     }
 
     /**
diff --git a/orion-ops-framework/orion-ops-spring-boot-starter-web/src/main/java/com/orion/ops/framework/web/core/handler/GlobalExceptionHandler.java b/orion-ops-framework/orion-ops-spring-boot-starter-web/src/main/java/com/orion/ops/framework/web/core/handler/GlobalExceptionHandler.java
index 2bf0ea6a..5a9671d2 100644
--- a/orion-ops-framework/orion-ops-spring-boot-starter-web/src/main/java/com/orion/ops/framework/web/core/handler/GlobalExceptionHandler.java
+++ b/orion-ops-framework/orion-ops-spring-boot-starter-web/src/main/java/com/orion/ops/framework/web/core/handler/GlobalExceptionHandler.java
@@ -7,12 +7,14 @@ import com.orion.lang.exception.argument.HttpWrapperException;
 import com.orion.lang.exception.argument.InvalidArgumentException;
 import com.orion.lang.exception.argument.RpcWrapperException;
 import com.orion.lang.utils.Exceptions;
-import com.orion.ops.framework.common.constant.ExceptionMessageConst;
+import com.orion.ops.framework.common.constant.ErrorCode;
 import lombok.extern.slf4j.Slf4j;
 import org.apache.poi.EncryptedDocumentException;
 import org.springframework.dao.DataAccessResourceFailureException;
 import org.springframework.http.converter.HttpMessageNotReadableException;
+import org.springframework.security.access.AccessDeniedException;
 import org.springframework.validation.BindException;
+import org.springframework.web.HttpRequestMethodNotSupportedException;
 import org.springframework.web.bind.MethodArgumentNotValidException;
 import org.springframework.web.bind.annotation.ExceptionHandler;
 import org.springframework.web.bind.annotation.RestControllerAdvice;
@@ -36,134 +38,147 @@ import java.sql.SQLException;
 public class GlobalExceptionHandler {
 
     @ExceptionHandler(value = Exception.class)
-    public HttpWrapper<?> normalExceptionHandler(HttpServletRequest request, Exception ex) {
-        log.error("normalExceptionHandler url: {}, 抛出异常: {}, message: {}", request.getRequestURI(), ex.getClass(), ex.getMessage(), ex);
-        return HttpWrapper.error(ExceptionMessageConst.EXCEPTION_MESSAGE).data(ex.getMessage());
+    public HttpWrapper<?> defaultExceptionHandler(HttpServletRequest request, Exception ex) {
+        log.error("defaultExceptionHandler url: {}", request.getRequestURI(), ex);
+        return ErrorCode.INTERNAL_SERVER_ERROR.wrapper(ex.getMessage());
     }
 
     @ExceptionHandler(value = ApplicationException.class)
     public HttpWrapper<?> applicationExceptionHandler(HttpServletRequest request, Exception ex) {
-        log.error("applicationExceptionHandler url: {}, 抛出异常: {}, message: {}", request.getRequestURI(), ex.getClass(), ex.getMessage(), ex);
+        log.error("applicationExceptionHandler url: {}", request.getRequestURI(), ex);
         return HttpWrapper.error(ex.getMessage());
     }
 
     @ExceptionHandler(value = DataAccessResourceFailureException.class)
     public HttpWrapper<?> dataAccessResourceFailureExceptionHandler(HttpServletRequest request, Exception ex) {
-        log.error("dataAccessResourceFailureExceptionHandler url: {}, 抛出异常: {}, message: {}", request.getRequestURI(), ex.getClass(), ex.getMessage(), ex);
-        return HttpWrapper.error(ExceptionMessageConst.NETWORK_FLUCTUATION);
+        log.error("dataAccessResourceFailureExceptionHandler url: {}", request.getRequestURI(), ex);
+        return ErrorCode.NETWORK_FLUCTUATION.getWrapper();
     }
 
+    @ExceptionHandler(value = AccessDeniedException.class)
+    public void accessDeniedExceptionHandler(AccessDeniedException ex) throws AccessDeniedException {
+        // 会拦截异常导致 Security 策略不生效 需要重新抛出
+        throw ex;
+    }
+
+    // FIXME @validated
     @ExceptionHandler(value = {HttpMessageNotReadableException.class, MethodArgumentTypeMismatchException.class,
             HttpMessageNotReadableException.class, MethodArgumentNotValidException.class, BindException.class})
-    public HttpWrapper<?> httpRequestExceptionHandler(HttpServletRequest request, Exception ex) {
-        log.error("httpRequestExceptionHandler url: {}, http请求异常: {}, message: {}", request.getRequestURI(), ex.getClass(), ex.getMessage(), ex);
-        return HttpWrapper.error(ExceptionMessageConst.INVALID_PARAM);
+    public HttpWrapper<?> httpRequestParameterExceptionHandler(HttpServletRequest request, Exception ex) {
+        log.error("httpRequestParameterExceptionHandler url: {}", request.getRequestURI(), ex);
+        return ErrorCode.BAD_REQUEST.getWrapper();
+    }
+
+    @ExceptionHandler(value = {HttpRequestMethodNotSupportedException.class})
+    public HttpWrapper<?> httpRequestMethodNotSupportedExceptionHandler(HttpServletRequest request, Exception ex) {
+        log.error("httpRequestMethodNotSupportedExceptionHandler url: {}", request.getRequestURI(), ex);
+        return ErrorCode.METHOD_NOT_ALLOWED.getWrapper();
     }
 
     @ExceptionHandler(value = {HttpRequestException.class})
     public HttpWrapper<?> httpApiRequestExceptionHandler(HttpServletRequest request, Exception ex) {
-        log.error("httpApiRequestExceptionHandler url: {}, http-api请求异常: {}, message: {}", request.getRequestURI(), ex.getClass(), ex.getMessage(), ex);
-        return HttpWrapper.error(ExceptionMessageConst.HTTP_API);
+        log.error("httpApiRequestExceptionHandler url: {}", request.getRequestURI(), ex);
+        return ErrorCode.HTTP_API.getWrapper();
     }
 
     @ExceptionHandler(value = {InvalidArgumentException.class, IllegalArgumentException.class, DisabledException.class})
     public HttpWrapper<?> invalidArgumentExceptionHandler(HttpServletRequest request, Exception ex) {
-        log.error("invalidArgumentExceptionHandler url: {}, 参数异常: {}, message: {}", request.getRequestURI(), ex.getClass(), ex.getMessage(), ex);
-        return HttpWrapper.error(ex.getMessage());
+        log.error("invalidArgumentExceptionHandler url: {}", request.getRequestURI(), ex);
+        return ErrorCode.BAD_REQUEST.wrapper().msg(ex.getMessage());
     }
 
     @ExceptionHandler(value = {IOException.class, IORuntimeException.class})
     public HttpWrapper<?> ioExceptionHandler(HttpServletRequest request, Exception ex) {
-        log.error("ioExceptionHandler url: {}, io异常: {}, message: {}", request.getRequestURI(), ex.getClass(), ex.getMessage(), ex);
-        return HttpWrapper.error(ExceptionMessageConst.IO_EXCEPTION_MESSAGE).data(ex.getMessage());
+        log.error("ioExceptionHandler url: {}", request.getRequestURI(), ex);
+        return ErrorCode.IO_EXCEPTION.wrapper(ex.getMessage());
     }
 
     @ExceptionHandler(value = SQLException.class)
     public HttpWrapper<?> sqlExceptionHandler(HttpServletRequest request, Exception ex) {
-        log.error("sqlExceptionHandler url: {}, sql异常: {}, message: {}", request.getRequestURI(), ex.getClass(), ex.getMessage(), ex);
-        return HttpWrapper.error(ExceptionMessageConst.SQL_EXCEPTION_MESSAGE);
+        log.error("sqlExceptionHandler url: {}", request.getRequestURI(), ex);
+        return ErrorCode.SQL_EXCEPTION.getWrapper();
     }
 
     @ExceptionHandler(value = {SftpException.class, com.jcraft.jsch.SftpException.class})
     public HttpWrapper<?> sftpExceptionHandler(HttpServletRequest request, Exception ex) {
-        log.error("sftpExceptionHandler url: {}, sftp处理异常: {}, message: {}", request.getRequestURI(), ex.getClass(), ex.getMessage(), ex);
-        return HttpWrapper.error(ExceptionMessageConst.OPERATOR_ERROR).data(ex.getMessage());
+        log.error("sftpExceptionHandler url: {}", request.getRequestURI(), ex);
+        return ErrorCode.SFTP_EXCEPTION.wrapper(ex.getMessage());
     }
 
     @ExceptionHandler(value = ParseRuntimeException.class)
     public HttpWrapper<?> parseExceptionHandler(HttpServletRequest request, Exception ex) {
-        log.error("parseExceptionHandler url: {}, 解析异常: {}, message: {}", request.getRequestURI(), ex.getClass(), ex.getMessage(), ex);
+        log.error("parseExceptionHandler url: {}", request.getRequestURI(), ex);
         if (Exceptions.isCausedBy(ex, EncryptedDocumentException.class)) {
             // excel 密码错误
-            return HttpWrapper.error(ExceptionMessageConst.OPEN_TEMPLATE_ERROR).data(ex.getMessage());
+            return ErrorCode.EXCEL_PASSWORD_ERROR.wrapper(ex.getMessage());
         } else {
-            return HttpWrapper.error(ExceptionMessageConst.PARSE_TEMPLATE_DATA_ERROR).data(ex.getMessage());
+            return ErrorCode.PASER_FAILED.wrapper(ex.getMessage());
         }
     }
 
     @ExceptionHandler(value = EncryptException.class)
     public HttpWrapper<?> encryptExceptionHandler(HttpServletRequest request, Exception ex) {
-        log.error("encryptExceptionHandler url: {}, 数据加密异常: {}, message: {}", request.getRequestURI(), ex.getClass(), ex.getMessage(), ex);
-        return HttpWrapper.error(ExceptionMessageConst.ENCRYPT_ERROR).data(ex.getMessage());
+        log.error("encryptExceptionHandler url: {}", request.getRequestURI(), ex);
+        return ErrorCode.ENCRYPT_ERROR.wrapper(ex.getMessage());
     }
 
     @ExceptionHandler(value = DecryptException.class)
     public HttpWrapper<?> decryptExceptionHandler(HttpServletRequest request, Exception ex) {
-        log.error("decryptExceptionHandler url: {}, 数据解密异常: {}, message: {}", request.getRequestURI(), ex.getClass(), ex.getMessage(), ex);
-        return HttpWrapper.error(ExceptionMessageConst.DECRYPT_ERROR).data(ex.getMessage());
+        log.error("decryptExceptionHandler url: {}", request.getRequestURI(), ex);
+        return ErrorCode.DECRYPT_ERROR.wrapper(ex.getMessage());
     }
 
     @ExceptionHandler(value = VcsException.class)
     public HttpWrapper<?> vcsExceptionHandler(HttpServletRequest request, Exception ex) {
-        log.error("vcsExceptionHandler url: {}, vcs处理异常: {}, message: {}", request.getRequestURI(), ex.getClass(), ex.getMessage(), ex);
-        return HttpWrapper.error(ExceptionMessageConst.REPOSITORY_OPERATOR_ERROR).data(ex.getMessage());
+        log.error("vcsExceptionHandler url: {}", request.getRequestURI(), ex);
+        return ErrorCode.VCS_OPETATOR_ERROR.wrapper(ex.getMessage());
     }
 
     @ExceptionHandler(value = {TaskExecuteException.class, ExecuteException.class})
     public HttpWrapper<?> taskExceptionHandler(HttpServletRequest request, Exception ex) {
-        log.error("taskExceptionHandler url: {}, task处理异常: {}, message: {}", request.getRequestURI(), ex.getClass(), ex.getMessage(), ex);
-        return HttpWrapper.error(ExceptionMessageConst.TASK_ERROR).data(ex.getMessage());
+        log.error("taskExceptionHandler url: {}", request.getRequestURI(), ex);
+        return ErrorCode.TASK_EXECUTE_ERROR.wrapper(ex.getMessage());
     }
 
     @ExceptionHandler(value = ConnectionRuntimeException.class)
     public HttpWrapper<?> connectionExceptionHandler(HttpServletRequest request, Exception ex) {
-        log.error("connectionExceptionHandler url: {}, connect异常: {}, message: {}", request.getRequestURI(), ex.getClass(), ex.getMessage(), ex);
-        return HttpWrapper.error(ExceptionMessageConst.CONNECT_ERROR).data(ex.getMessage());
+        log.error("connectionExceptionHandler url: {}", request.getRequestURI(), ex);
+        return ErrorCode.CONNECT_ERROR.wrapper(ex.getMessage());
     }
 
     @ExceptionHandler(value = {TimeoutException.class, java.util.concurrent.TimeoutException.class})
     public HttpWrapper<?> timeoutExceptionHandler(HttpServletRequest request, Exception ex) {
-        log.error("timeoutExceptionHandler url: {}, timeout异常: {}, message: {}", request.getRequestURI(), ex.getClass(), ex.getMessage(), ex);
-        return HttpWrapper.error(ExceptionMessageConst.TIMEOUT_ERROR).data(ex.getMessage());
+        log.error("timeoutExceptionHandler url: {}", request.getRequestURI(), ex);
+        return ErrorCode.REQUEST_TIMEOUT.wrapper(ex.getMessage());
     }
 
     @ExceptionHandler(value = {InterruptedException.class, InterruptedRuntimeException.class, InterruptedIOException.class})
     public HttpWrapper<?> interruptExceptionHandler(HttpServletRequest request, Exception ex) {
-        log.error("interruptExceptionHandler url: {}, interrupt异常: {}, message: {}", request.getRequestURI(), ex.getClass(), ex.getMessage(), ex);
-        return HttpWrapper.error(ExceptionMessageConst.INTERRUPT_ERROR).data(ex.getMessage());
+        log.error("interruptExceptionHandler url: {}", request.getRequestURI(), ex);
+        return ErrorCode.INTERRUPT_ERROR.wrapper(ex.getMessage());
     }
 
     @ExceptionHandler(value = UnsafeException.class)
     public HttpWrapper<?> unsafeExceptionHandler(HttpServletRequest request, Exception ex) {
-        log.error("unsafeExceptionHandler url: {}, unsafe异常: {}, message: {}", request.getRequestURI(), ex.getClass(), ex.getMessage(), ex);
-        return HttpWrapper.error(ExceptionMessageConst.UNSAFE_OPERATOR).data(ex.getMessage());
+        log.error("unsafeExceptionHandler url: {}", request.getRequestURI(), ex);
+        return ErrorCode.UNSAFE_OPERATOR.wrapper(ex.getMessage());
     }
 
     @ExceptionHandler(value = LogException.class)
     public HttpWrapper<?> logExceptionHandler(HttpServletRequest request, LogException ex) {
-        log.error("logExceptionHandler url: {}, 处理异常打印日志: {}, message: {}", request.getRequestURI(), ex.getClass(), ex.getMessage(), ex);
-        return HttpWrapper.error(ExceptionMessageConst.EXCEPTION_MESSAGE).data(ex.getMessage());
+        log.error("logExceptionHandler url: {}", request.getRequestURI(), ex);
+        return ErrorCode.INTERNAL_SERVER_ERROR.wrapper(ex.getMessage());
     }
 
     @ExceptionHandler(value = ParseCronException.class)
     public HttpWrapper<?> parseCronExceptionHandler(ParseCronException ex) {
-        return HttpWrapper.error(ExceptionMessageConst.ERROR_EXPRESSION).data(ex.getMessage());
+        return ErrorCode.EXPRESSION_ERROR.wrapper(ex.getMessage());
     }
 
     @ExceptionHandler(value = MaxUploadSizeExceededException.class)
     public HttpWrapper<?> maxUploadSizeExceededExceptionHandler(HttpServletRequest request, MaxUploadSizeExceededException ex) {
-        log.error("maxUploadSizeExceededExceptionHandler url: {}, 上传异常: {}, message: {}", request.getRequestURI(), ex.getClass(), ex.getMessage(), ex);
-        return HttpWrapper.error(ExceptionMessageConst.FILE_TOO_LARGE).data(ex.getMessage());
+        log.error("maxUploadSizeExceededExceptionHandler url: {}", request.getRequestURI(), ex);
+        return ErrorCode.PAYLOAD_TOO_LARGE.wrapper(ex.getMessage());
     }
 
     @ExceptionHandler(value = CodeArgumentException.class)
diff --git a/orion-ops-framework/orion-ops-spring-boot-starter-websocket/src/main/java/com/orion/ops/framework/websocket/interceptor/UserHandshakeInterceptor.java b/orion-ops-framework/orion-ops-spring-boot-starter-websocket/src/main/java/com/orion/ops/framework/websocket/interceptor/UserHandshakeInterceptor.java
index b1e370da..45d94c42 100644
--- a/orion-ops-framework/orion-ops-spring-boot-starter-websocket/src/main/java/com/orion/ops/framework/websocket/interceptor/UserHandshakeInterceptor.java
+++ b/orion-ops-framework/orion-ops-spring-boot-starter-websocket/src/main/java/com/orion/ops/framework/websocket/interceptor/UserHandshakeInterceptor.java
@@ -1,11 +1,13 @@
 package com.orion.ops.framework.websocket.interceptor;
 
+import com.orion.ops.framework.common.security.SecurityHolder;
 import com.orion.ops.framework.websocket.constant.WsAttr;
 import org.springframework.http.server.ServerHttpRequest;
 import org.springframework.http.server.ServerHttpResponse;
 import org.springframework.web.socket.WebSocketHandler;
 import org.springframework.web.socket.server.HandshakeInterceptor;
 
+import javax.annotation.Resource;
 import java.util.Map;
 
 /**
@@ -17,10 +19,13 @@ import java.util.Map;
  */
 public class UserHandshakeInterceptor implements HandshakeInterceptor {
 
+    @Resource
+    private SecurityHolder securityHolder;
+
     @Override
     public boolean beforeHandshake(ServerHttpRequest request, ServerHttpResponse response, WebSocketHandler wsHandler, Map<String, Object> attributes) {
-        // FIXME 获取当前用户
-        attributes.put(WsAttr.USER, 1);
+        // TODO TEST
+        attributes.put(WsAttr.USER, securityHolder.getLoginUserId());
         // if (user == null){
         //     return false;
         // response.setStatusCode(HttpStatus.MULTI_STATUS);
diff --git a/orion-ops-launch/pom.xml b/orion-ops-launch/pom.xml
index 9424c250..4c2cbfa4 100644
--- a/orion-ops-launch/pom.xml
+++ b/orion-ops-launch/pom.xml
@@ -22,6 +22,11 @@
             <artifactId>spring-boot-configuration-processor</artifactId>
             <optional>true</optional>
         </dependency>
+        <!-- starter -->
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter</artifactId>
+        </dependency>
 
         <!-- orion-ops starter -->
         <dependency>