diff --git a/app/model/SysFileRecord.php b/app/model/SysFileRecord.php
index ca2ff33..005143f 100644
--- a/app/model/SysFileRecord.php
+++ b/app/model/SysFileRecord.php
@@ -46,7 +46,11 @@ class SysFileRecord extends BaseModel
 
     public function getPreviewUrlAttr($previewUrl, $data)
     {
-       return filesystem()->getFileUrl($data['rule_id'], $data['path'].'/'.$data['name']);
+        if(!in_array($data['extension'],['jpg','jpeg','png','gif','txt'])){
+            // 仅部分文件支持 preview
+            return '';
+        }
+       return filesystem()->getFileUrl($data['rule_id'], $data['id'], $data['path'].'/'.$data['name']);
     }
 
     public function getDownloadUrlAttr($downloadUrl, $data)
diff --git a/app/service/file/FilesystemService.php b/app/service/file/FilesystemService.php
index 2005a00..9d93952 100644
--- a/app/service/file/FilesystemService.php
+++ b/app/service/file/FilesystemService.php
@@ -31,7 +31,7 @@ class FilesystemService
 
     public function getDownloadUrl($fileId)
     {
-        return $this->getFilesystemApiUrl()."/i/down/".hashids(4)->encode($fileId)."?token=".md5(uniqid());
+        return $this->getFilesystemApiUrl()."/i/down/".hashids(12)->encode($fileId)."?token=".md5(uniqid());
     }
     public function getFilesystemApiUrl()
     {
@@ -43,12 +43,21 @@ class FilesystemService
         }
         return $filesystem_apiUrl;
     }
-    public function getFileUrl($rule_id, $file_path)
+    public function getFileUrl($rule_id, $fileId, $file_path, $zlink = false)
     {
         $rule = SysFileRule::find($rule_id);
         if ($rule) {
             $putUrl = $rule->url ? $rule->url : $this->getFilesystemApiUrl();
-            return $putUrl.$file_path;
+            if($zlink){
+                return $putUrl.$file_path;
+            }
+            // 是否需要安全访问
+            if ($rule->permissions) {
+                $uploadPath = "i/" . hashids(12)->encode($fileId);
+                return $putUrl . '/' . ltrim($uploadPath, '/');
+            }else{
+                return $putUrl.$file_path;
+            }
         }
         return "";
     }
diff --git a/route/api.php b/route/api.php
index fb179df..2d05168 100644
--- a/route/api.php
+++ b/route/api.php
@@ -23,6 +23,47 @@ use app\http\middleware\AuthMiddleware;
 use think\facade\Route;
 use think\middleware\AllowCrossDomain;
 
+Route::get("/i/down/:fileId", function (){
+//    return json(['message'=>'暂不支持下载']);
+    $fileId = \request()->route('fileId');
+    $fileExt = hashids(12)->decode($fileId)[0] ?? '';
+    $data = \app\entity\SysFileRecord::find($fileExt);
+
+    $fileUrl = filesystem()->getFileUrl($data['rule_id'], $data['id'], $data['path'].'/'.$data['name'], true);
+    if(empty($fileUrl)){
+        return json(['message'=>'文件不存在']);
+    }
+    $mime = "image/jpeg";
+    header('Content-Type: ' . $mime);
+    header('Content-Disposition: attachment; filename="b7b9f5caae81dc32ba2a062e00247270.jpg"');
+    header('Content-Length: 928318');
+
+    echo file_get_contents($fileUrl);
+    exit;
+
+});
+
+Route::get("/i/:fileId", function (){
+    $fileId = \request()->route('fileId');
+    $fileExt = hashids(12)->decode($fileId)[0] ?? '';
+    $data = \app\entity\SysFileRecord::find($fileExt);
+
+    $fileUrl = filesystem()->getFileUrl($data['rule_id'], $data['id'], $data['path'].'/'.$data['name'], true);
+    if(empty($fileUrl)){
+        return json(['message'=>'文件不存在']);
+    }
+    $mime = "image/jpeg";
+    header('Content-Type: ' . $mime);
+//    header('Content-Disposition: attachment; filename="b7b9f5caae81dc32ba2a062e00247270.jpg"');
+//    header('Content-Length: 928318');
+    echo file_get_contents($fileUrl);
+    exit;
+//    $fileCo =  file_get_contents($fileUrl);
+//    $base64Image = base64_encode($fileCo);
+//    echo '<img src="data:image/jpeg;base64,' . $base64Image . '" alt="My Image">';
+//    exit;
+});
+
 Route::group("adminapi", function () {
     /*
      * 用户