diff --git a/app/README.md b/rbac/README.md
similarity index 100%
rename from app/README.md
rename to rbac/README.md
diff --git a/rbac/__init__.py b/rbac/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/rbac/check_perm.py b/rbac/check_perm.py
new file mode 100644
index 0000000..1337d9b
--- /dev/null
+++ b/rbac/check_perm.py
@@ -0,0 +1,41 @@
+from sqlor.dbpools import DBPools
+from appPublic.registerfunction import RegisterFunction
+from ahserver.auth_api import AuthAPI
+
+class CheckPerms:
+	def __init__(self):
+		self.users = []
+		self.userrole = []
+		self.roleperms = []
+		self.permissions = []
+		self._need_refresh = True
+		self.rfexe = RegisterFunction().exe
+	
+	async def load(self):
+		db = DBPools()
+		dbname = self.rfexe('get_module_dbname', 'rbac')
+		async with db.sqlorContext(dbname) as sor:
+			self.users = await sor.R('users',{})
+			self.userrole = await sor.R('userrole',{})
+			self.roleperms = await sor.R('roleperms', {})
+			perms = await sor.R('permission', {})
+			self.permissions = {p.path:p.id for p in perms}
+	
+	async def checkperm(self, userid, path):
+		if self._need_refresh:
+			await self.load()
+		if not self.permissions.get(path):
+			return True
+		roleids = [ rp.roleid for rp in self.roleperms ]
+		userroles = [ ur.roleid for ur in self.userrole if ur.userid == userid ]
+		for ur in userroles:
+			if ur in roleids:
+				return True
+		return False
+
+def objcheckperm(obj, userid, path):
+	cp = CheckPerm()
+	return cp.checkperm(userid, path)
+
+AuthAPI.checkUserPermission = objcheckperm
+