diff --git a/news/views.py b/news/views.py
index 6f2e409..39ab368 100644
--- a/news/views.py
+++ b/news/views.py
@@ -1,12 +1,16 @@
 from django.shortcuts import render
+from loguru import logger
 
 # Create your views here.
 from ninja import Router
 from django.shortcuts import get_object_or_404
 from typing import List
 
+from ninja.errors import HttpError
 from ninja.pagination import paginate, PageNumberPagination
 
+from users.permission import has_permission, require_permissions
+from utils.dept_utils import get_dept_children_ids
 from .models import NewsSection, News
 from .schema import (
     NewsSectionSchema, NewsSectionCreateSchema, NewsSectionUpdateSchema,
@@ -55,25 +59,47 @@ def delete_section(request, section_id: int):
 
 @router.get("/news/", response=List[NewsSchema])
 @paginate(PageNumberPagination, page_size=20)
+@require_permissions("news:list")
 def list_news(request, section_id: int = 0, title: str = ''):
-    news = News.objects.filter(title__contains=title)
+    user = request.auth
+    if not has_permission(user.id, "news:list"):
+        raise
+    news = News.objects.all()
+
+    # 板块筛选
     if section_id > 0:
         return news.filter(section_id=section_id).all()
+
+    # 根据用户权限筛选
+    if has_permission(user.id, 'news:manage'):
+        dept_ids = get_dept_children_ids(user.dept_id)
+        # 筛选：作者属于这些部门中的任意一个
+        news = news.filter(author__dept_id__in=dept_ids)
+    else:
+        logger.info(user)
+        news = news.filter(author=user)
+
+    # 根据新闻标题筛选
+    if title:
+        news = news.filter(title__contains=title)
     return news
 
 
 @router.get("/news/{news_id}", response=NewsSchema)
+@require_permissions("news:view")
 def retrieve_news(request, news_id: int):
     return get_object_or_404(News, id=news_id)
 
 
 @router.post("/news/", response=NewsSchema)
+@require_permissions("news:create")
 def create_news(request, data: NewsCreateSchema):
     news = News.objects.create(**data.dict())
     return news
 
 
 @router.put("/news/{news_id}", response=NewsSchema)
+@require_permissions("news:update")
 def update_news(request, news_id: int, data: NewsUpdateSchema):
     news = get_object_or_404(News, id=news_id)
     for attr, value in data.dict(exclude_unset=True).items():
@@ -83,6 +109,7 @@ def update_news(request, news_id: int, data: NewsUpdateSchema):
 
 
 @router.delete("/news/{news_id}", response={"success": bool})
+@require_permissions("news:delete")
 def delete_news(request, news_id: int):
     news = get_object_or_404(News, id=news_id)
     news.delete()