diff --git a/src/main/java/xyz/playedu/api/checks/AdminPermissionCheck.java b/src/main/java/xyz/playedu/api/checks/AdminPermissionCheck.java
index efdf917..c33d68b 100644
--- a/src/main/java/xyz/playedu/api/checks/AdminPermissionCheck.java
+++ b/src/main/java/xyz/playedu/api/checks/AdminPermissionCheck.java
@@ -147,6 +147,22 @@ public class AdminPermissionCheck implements ApplicationRunner {
                                                         setSlug(BPermissionConstant.COURSE);
                                                     }
                                                 },
+                                                new AdminPermission() {
+                                                    {
+                                                        setSort(10);
+                                                        setName("学员学习记录-列表");
+                                                        setSlug(BPermissionConstant.COURSE_USER);
+                                                    }
+                                                },
+                                                new AdminPermission() {
+                                                    {
+                                                        setSort(20);
+                                                        setName("学员学习记录-删除");
+                                                        setSlug(
+                                                                BPermissionConstant
+                                                                        .COURSE_USER_DESTROY);
+                                                    }
+                                                },
                                             });
                                 }
                             });
diff --git a/src/main/java/xyz/playedu/api/constant/BPermissionConstant.java b/src/main/java/xyz/playedu/api/constant/BPermissionConstant.java
index 31f0962..39470a6 100644
--- a/src/main/java/xyz/playedu/api/constant/BPermissionConstant.java
+++ b/src/main/java/xyz/playedu/api/constant/BPermissionConstant.java
@@ -30,6 +30,7 @@ public class BPermissionConstant {
 
     public static final String COURSE = "course";
     public static final String COURSE_USER = "course-user";
+    public static final String COURSE_USER_DESTROY = "course-user-destroy";
 
     public static final String RESOURCE_DESTROY = "resource-destroy";
 
diff --git a/src/main/java/xyz/playedu/api/controller/backend/CourseUserController.java b/src/main/java/xyz/playedu/api/controller/backend/CourseUserController.java
index a3277f3..b551377 100644
--- a/src/main/java/xyz/playedu/api/controller/backend/CourseUserController.java
+++ b/src/main/java/xyz/playedu/api/controller/backend/CourseUserController.java
@@ -10,8 +10,10 @@ import org.springframework.context.ApplicationContext;
 import org.springframework.validation.annotation.Validated;
 import org.springframework.web.bind.annotation.*;
 
+import xyz.playedu.api.constant.BPermissionConstant;
 import xyz.playedu.api.domain.UserCourseRecord;
 import xyz.playedu.api.event.UserCourseRecordDestroyEvent;
+import xyz.playedu.api.middleware.BackendPermissionMiddleware;
 import xyz.playedu.api.request.backend.CourseUserDestroyRequest;
 import xyz.playedu.api.service.UserCourseRecordService;
 import xyz.playedu.api.service.UserService;
@@ -38,6 +40,7 @@ public class CourseUserController {
 
     @Autowired private ApplicationContext ctx;
 
+    @BackendPermissionMiddleware(slug = BPermissionConstant.COURSE_USER)
     @GetMapping("/index")
     public JsonResponse index(
             @PathVariable(name = "courseId") Integer courseId,
@@ -72,6 +75,7 @@ public class CourseUserController {
         return JsonResponse.data(data);
     }
 
+    @BackendPermissionMiddleware(slug = BPermissionConstant.COURSE_USER_DESTROY)
     @PostMapping("/destroy")
     public JsonResponse destroy(
             @PathVariable(name = "courseId") Integer courseId,
diff --git a/src/main/resources/application.yml b/src/main/resources/application.yml
index 9e40a1d..af12145 100644
--- a/src/main/resources/application.yml
+++ b/src/main/resources/application.yml
@@ -6,6 +6,11 @@ spring:
   aop:
     auto: true
     proxy-target-class: true
+  servlet:
+    multipart:
+      enabled: true
+      max-request-size: 5MB
+      max-file-size: 5MB
   datasource:
     driver-class-name: com.mysql.cj.jdbc.Driver
     url: "jdbc:mysql://127.0.0.1:3306/dbname?useUnicode=true&characterEncoding=UTF-8&autoReconnect=true&useSSL=false"