diff --git a/crm-auth/src/main/java/com/crm/auth/config/SecurityConfig.java b/crm-auth/src/main/java/com/crm/auth/config/SecurityConfig.java
index e86c009..fe244fa 100644
--- a/crm-auth/src/main/java/com/crm/auth/config/SecurityConfig.java
+++ b/crm-auth/src/main/java/com/crm/auth/config/SecurityConfig.java
@@ -29,8 +29,6 @@ public class SecurityConfig {
     private static final String[] DEFAULT_IGNORE_URLS = {
             // 登录接口
             "/api/auth/login/**",
-            // 资源树管理接口（ADR-0011）
-            "/api/resources/**",
             // 接口文档
             "/doc.html",
             "/webjars/**",
diff --git a/crm-auth/src/main/java/com/crm/auth/controller/ResourceController.java b/crm-auth/src/main/java/com/crm/auth/controller/ResourceController.java
index 93849e3..ca82cd9 100644
--- a/crm-auth/src/main/java/com/crm/auth/controller/ResourceController.java
+++ b/crm-auth/src/main/java/com/crm/auth/controller/ResourceController.java
@@ -5,6 +5,7 @@ import com.crm.auth.service.IResourceService;
 import com.crm.base.domain.result.Result;
 import com.crm.file.domain.dto.FileInfoDTO;
 import lombok.RequiredArgsConstructor;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.*;
 import org.springframework.web.multipart.MultipartFile;
 
@@ -16,6 +17,7 @@ import java.util.List;
 @RestController
 @RequestMapping("/api/resources")
 @RequiredArgsConstructor
+@PreAuthorize("hasRole('ADMIN')")
 public class ResourceController {
 
     private final IResourceService resourceService;
diff --git a/crm-auth/src/main/java/com/crm/auth/service/impl/PermissionServiceImpl.java b/crm-auth/src/main/java/com/crm/auth/service/impl/PermissionServiceImpl.java
index 202d36e..4d5673a 100644
--- a/crm-auth/src/main/java/com/crm/auth/service/impl/PermissionServiceImpl.java
+++ b/crm-auth/src/main/java/com/crm/auth/service/impl/PermissionServiceImpl.java
@@ -4,6 +4,7 @@ import cn.hutool.core.collection.CollUtil;
 import cn.hutool.core.util.StrUtil;
 import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
 import com.crm.auth.domain.entity.*;
+import com.crm.auth.domain.enums.MenuType;
 import com.crm.auth.mapper.*;
 import com.crm.auth.service.DeptTreeCache;
 import com.crm.base.security.DataScopeLevel;
@@ -83,7 +84,7 @@ public class PermissionServiceImpl {
                             .map(SysRoleMenu::getMenuId).collect(Collectors.toSet());
                     List<SysMenu> menus = sysMenuMapper.selectBatchIds(menuIds);
                     menus.stream()
-                            .filter(m -> m.getMenuType() != null && m.getMenuType() == 3)
+                            .filter(m -> m.getMenuType() != null && m.getMenuType() == MenuType.BUTTON.getCode())
                             .filter(m -> "enabled".equals(m.getStatus()))
                             .map(SysMenu::getPerms)
                             .filter(StrUtil::isNotBlank)
@@ -114,7 +115,7 @@ public class PermissionServiceImpl {
         List<SysMenu> allMenus = sysMenuMapper.selectBatchIds(menuIds);
         List<SysMenu> visibleMenus = allMenus.stream()
                 .filter(m -> Boolean.TRUE.equals(m.getVisible()))
-                .filter(m -> m.getMenuType() != 3)
+                .filter(m -> m.getMenuType() != MenuType.BUTTON.getCode())
                 .sorted(Comparator.comparingInt(m -> m.getSort() != null ? m.getSort() : 0))
                 .collect(Collectors.toList());
         return TreeUtils.buildTree(visibleMenus, SysMenu::getId, SysMenu::getParentId, SysMenu::setChildren);
diff --git a/crm-auth/src/main/java/com/crm/auth/service/impl/ResourceServiceImpl.java b/crm-auth/src/main/java/com/crm/auth/service/impl/ResourceServiceImpl.java
index d0705fb..041c789 100644
--- a/crm-auth/src/main/java/com/crm/auth/service/impl/ResourceServiceImpl.java
+++ b/crm-auth/src/main/java/com/crm/auth/service/impl/ResourceServiceImpl.java
@@ -162,12 +162,11 @@ public class ResourceServiceImpl implements IResourceService {
 
     // ==================== 校验逻辑 ====================
 
-    /** 层级约束：6 种非法父子组合 */
+    /** 层级约束：复用 {@link MenuType#isLegalChild}，根节点单独处理 */
     private void validateHierarchy(ResourceNode node) {
         MenuType childType = node.getType();
 
         if (node.getParentId() == null || node.getParentId() == 0) {
-            // 根节点：只允许 catalog / menu
             if (childType == MenuType.BUTTON) {
                 throw new BusinessErrorException(CODE_RESOURCE_INVALID, "根节点不允许添加 button 类型");
             }
@@ -180,17 +179,13 @@ public class ResourceServiceImpl implements IResourceService {
         }
         MenuType parentType = MenuType.fromCode(parent.getMenuType());
 
-        // 叶子节点
-        if (parentType == MenuType.BUTTON) {
-            throw new BusinessErrorException(CODE_RESOURCE_INVALID, "button 是叶子节点，不可添加子节点");
-        }
-        // catalog 只能挂 menu
-        if (parentType == MenuType.CATALOG && childType != MenuType.MENU) {
-            throw new BusinessErrorException(CODE_RESOURCE_INVALID, "catalog 节点下只能添加 menu 类型");
-        }
-        // menu 只能挂 button
-        if (parentType == MenuType.MENU && childType != MenuType.BUTTON) {
-            throw new BusinessErrorException(CODE_RESOURCE_INVALID, "menu 节点下只能添加 button 类型");
+        if (!MenuType.isLegalChild(parentType, childType)) {
+            String msg = switch (parentType) {
+                case CATALOG -> "catalog 节点下只能添加 menu 类型";
+                case MENU -> "menu 节点下只能添加 button 类型";
+                case BUTTON -> "button 是叶子节点，不可添加子节点";
+            };
+            throw new BusinessErrorException(CODE_RESOURCE_INVALID, msg);
         }
     }
 
@@ -233,8 +228,8 @@ public class ResourceServiceImpl implements IResourceService {
             entity.setMenuType(node.getType().getCode());
         }
 
-        // route / path：若未传则保留原有值
-        if (node.getRoute() != null) {
+        // route / path：非空值覆盖，空串/空白保留原有值
+        if (StrUtil.isNotBlank(node.getRoute())) {
             entity.setPath(node.getRoute());
         }