diff --git a/db.js b/db.js
index ab5eee2..1dd75df 100644
--- a/db.js
+++ b/db.js
@@ -268,11 +268,12 @@ async function seedDepartmentsAndPermissions() {
     { name: 'operations_manager',   description: '运营部' },
     { name: 'procurement_manager',  description: '采购部' },
     { name: 'finance',              description: '财务部' },
+    { name: 'hr',                   description: '人力资源部' },
   ]
   for (const d of deptList) {
     await pool.query('INSERT INTO departments (name, description) VALUES (?, ?)', [d.name, d.description])
   }
-  console.log('[init] 已初始化 6 个部门')
+  console.log('[init] 已初始化 7 个部门')
 
   const permissionList = [
     { name: 'customer:read',    description: '查看加盟商',   resource: 'customer',   action: 'read' },
@@ -310,9 +311,12 @@ async function seedDepartmentsAndPermissions() {
   console.log('[init] 已初始化 25 个权限')
 
   // 部门-权限映射
-  const allPerms = permissionList.map(p => p.name)
   const deptPermMap = {
-    admin:               allPerms,
+    admin: [
+      'user:manage',
+      'customer:read', 'contract:read', 'after_sale:read',
+      'product:read', 'supplier:read', 'employee:read',
+    ],
     general_manager: [
       'customer:read', 'contract:read', 'after_sale:read',
       'product:read', 'supplier:read', 'employee:read',
@@ -324,6 +328,7 @@ async function seedDepartmentsAndPermissions() {
     ],
     operations_manager: [
       'customer:read',
+      'contract:read',
       'after_sale:read', 'after_sale:create', 'after_sale:update', 'after_sale:delete',
       'employee:read',
     ],
@@ -336,6 +341,12 @@ async function seedDepartmentsAndPermissions() {
     ],
     finance: [
       'customer:read', 'contract:read', 'after_sale:read', 'product:read', 'employee:read',
+      'supplier:read',
+    ],
+    hr: [
+      'employee:read', 'employee:create', 'employee:update', 'employee:delete',
+      'user:manage',
+      'customer:read',
     ],
   }
 
@@ -369,6 +380,7 @@ async function seedDefaultUsers() {
     { name: '赵强',     gender: '男', age: 36, education: '本科', department: '采购部',       entry_date: '2017-09-20', position: '采购经理',   salary: 18000, phone: '13800001004', email: 'zhaoqiang@mixue.com' },
     { name: '陈芳',     gender: '女', age: 30, education: '本科', department: '财务部',       entry_date: '2020-03-05', position: '财务主管',   salary: 15000, phone: '13800001005', email: 'chenfang@mixue.com' },
     { name: '系统管理员', gender: '男', age: 28, education: '本科', department: '信息技术部',   entry_date: '2022-07-01', position: '系统管理员', salary: 12000, phone: '13800001006', email: 'admin@mixue.com' },
+    { name: '杨帆',     gender: '女', age: 34, education: '本科', department: '人力资源部',   entry_date: '2019-05-01', position: '人力资源经理', salary: 15000, phone: '13800001007', email: 'yangfan@mixue.com' },
   ]
 
   const seedUsers = [
@@ -378,6 +390,7 @@ async function seedDefaultUsers() {
     { username: 'zhaoqiang', deptName: 'procurement_manager' },
     { username: 'chenfang',  deptName: 'finance' },
     { username: 'admin',     deptName: 'admin' },
+    { username: 'yangfan',   deptName: 'hr' },
   ]
 
   for (let i = 0; i < seedUsers.length; i++) {
diff --git a/middleware/permissions.js b/middleware/permissions.js
index 855a1d2..f71b8ee 100644
--- a/middleware/permissions.js
+++ b/middleware/permissions.js
@@ -51,11 +51,15 @@ function dataScope(resource) {
         break
 
       case 'employees':
+        if (deptName === 'hr') {
+          // 人力资源部可查看全量员工
+          break
+        }
         if (['franchise_manager', 'operations_manager', 'procurement_manager'].includes(deptName)) {
           sql = 'AND department = ?'
           params = [req.user.departmentDesc] // 如 '招商部'
         }
-        // finance 全量看员工
+        // admin / general_manager / finance 全量看员工
         break
     }