diff --git a/spug_api/apps/account/models.py b/spug_api/apps/account/models.py
index d79f474..b8ff524 100644
--- a/spug_api/apps/account/models.py
+++ b/spug_api/apps/account/models.py
@@ -12,6 +12,7 @@ class User(models.Model, ModelMixin):
     access_token = models.CharField(max_length=32)
     token_expired = models.IntegerField(null=True)
     last_login = models.CharField(max_length=20)
+    role = models.ForeignKey('Role', on_delete=models.PROTECT, null=True)
 
     created_at = models.CharField(max_length=20, default=human_datetime)
     created_by = models.ForeignKey('User', models.PROTECT, related_name='+', null=True)
@@ -35,3 +36,19 @@ class User(models.Model, ModelMixin):
     class Meta:
         db_table = 'users'
         ordering = ('-id',)
+
+
+class Role(models.Model, ModelMixin):
+    name = models.CharField(max_length=50)
+    desc = models.CharField(max_length=255, null=True)
+    permissions = models.TextField(null=True)
+
+    created_at = models.CharField(max_length=20, default=human_datetime)
+    created_by = models.ForeignKey(User, on_delete=models.PROTECT, related_name='+')
+
+    def __repr__(self):
+        return '<Role name=%r>' % self.name
+
+    class Meta:
+        db_table = 'roles'
+        ordering = ('-id',)
diff --git a/spug_api/apps/account/urls.py b/spug_api/apps/account/urls.py
index d907f03..cda6563 100644
--- a/spug_api/apps/account/urls.py
+++ b/spug_api/apps/account/urls.py
@@ -6,4 +6,5 @@ urlpatterns = [
     url(r'^login/', login),
     url(r'^logout/', logout),
     url(r'^user/$', UserView.as_view()),
+    url(r'^role/$', RoleView.as_view()),
 ]
diff --git a/spug_api/apps/account/views.py b/spug_api/apps/account/views.py
index 1e1f1bc..0185971 100644
--- a/spug_api/apps/account/views.py
+++ b/spug_api/apps/account/views.py
@@ -1,7 +1,7 @@
 from django.core.cache import cache
 from django.views.generic import View
 from libs import JsonParser, Argument, human_datetime, json_response
-from .models import User
+from .models import User, Role
 import time
 import uuid
 
@@ -49,6 +49,35 @@ class UserView(View):
         return json_response(error=error)
 
 
+class RoleView(View):
+    def get(self, request):
+        roles = Role.objects.all()
+        return json_response(roles)
+
+    def post(self, request):
+        form, error = JsonParser(
+            Argument('id', type=int, required=False),
+            Argument('name', help='请输入角色名称'),
+            Argument('desc', required=False)
+        ).parse(request.body)
+        if error is None:
+            if form.id:
+                Role.objects.filter(pk=form.id).update(**form)
+            else:
+                Role.objects.create(created_by=request.user, **form)
+        return json_response(error=error)
+
+    def delete(self, request):
+        form, error = JsonParser(
+            Argument('id', type=int, help='参数错误')
+        ).parse(request.GET)
+        if error is None:
+            if User.objects.filter(role_id=form.id).exists():
+                return json_response(error='已有用户使用了该角色，请解除关联后再尝试删除')
+            Role.objects.filter(pk=form.id).delete()
+        return json_response(error=error)
+
+
 def login(request):
     form, error = JsonParser(
         Argument('username', help='请输入用户名'),