diff --git a/spug_api/apps/account/models.py b/spug_api/apps/account/models.py
index 106ba8d..a0437d3 100644
--- a/spug_api/apps/account/models.py
+++ b/spug_api/apps/account/models.py
@@ -98,12 +98,6 @@ class Role(models.Model, ModelMixin):
         self.deploy_perms = json.dumps(perms)
         self.save()
 
-    def add_host_perm(self, value):
-        perms = json.loads(self.host_perms) if self.host_perms else []
-        perms.append(value)
-        self.host_perms = json.dumps(perms)
-        self.save()
-
     def __repr__(self):
         return '<Role name=%r>' % self.name
 
diff --git a/spug_api/apps/host/group.py b/spug_api/apps/host/group.py
index 8509454..7f63065 100644
--- a/spug_api/apps/host/group.py
+++ b/spug_api/apps/host/group.py
@@ -28,6 +28,14 @@ def merge_children(data, prefix, childes):
             data[item['key']] = name
 
 
+def filter_by_perm(data, result, ids):
+    for item in data:
+        if item['key'] in ids:
+            result.append(item)
+        elif item['children']:
+            filter_by_perm(item['children'], result, ids)
+
+
 class GroupView(View):
     def get(self, request):
         with_hosts = request.GET.get('with_hosts')
@@ -38,10 +46,13 @@ class GroupView(View):
         if not data:
             grp = Group.objects.create(name='Default', sort_id=1)
             data[grp.id] = grp.to_view()
-
-        data = list(data.values())
-        merge_children(data2, '', data)
-        return json_response({'treeData': data, 'groups': data2})
+        if request.user.is_supper:
+            tree_data = list(data.values())
+        else:
+            tree_data, ids = [], request.user.host_perms
+            filter_by_perm(data.values(), tree_data, ids)
+        merge_children(data2, '', tree_data)
+        return json_response({'treeData': tree_data, 'groups': data2})
 
     def post(self, request):
         form, error = JsonParser(
diff --git a/spug_api/apps/host/views.py b/spug_api/apps/host/views.py
index dd93512..b1fbb40 100644
--- a/spug_api/apps/host/views.py
+++ b/spug_api/apps/host/views.py
@@ -18,11 +18,6 @@ from openpyxl import load_workbook
 
 class HostView(View):
     def get(self, request):
-        host_id = request.GET.get('id')
-        if host_id:
-            if not request.user.has_host_perm(host_id):
-                return json_response(error='无权访问该主机，请联系管理员')
-            return json_response(Host.objects.get(pk=host_id))
         hosts = {x.id: x.to_view() for x in Host.objects.select_related('hostextend').all()}
         for rel in Group.hosts.through.objects.all():
             hosts[rel.host_id]['group_ids'].append(rel.group_id)
@@ -130,8 +125,6 @@ def post_import(request):
             pass
         host = Host.objects.create(created_by=request.user, **data)
         host.groups.add(group_id)
-        if request.user.role:
-            request.user.role.add_host_perm(host.id)
         summary['success'].append(i)
     return json_response(summary)