diff --git a/app/mix/controller/init.go b/app/mix/controller/init.go
index adb5f009..3443874b 100644
--- a/app/mix/controller/init.go
+++ b/app/mix/controller/init.go
@@ -224,13 +224,13 @@ func Init(r *gin.Engine) {
 	apiZoneGroup.POST("list_by_mid", middleware.JSONParamValidator(zoneproto.ApiListByMidReq{}), middleware.JwtAuthenticator(), ApiGetZoneListByMid)
 	apiZoneGroup.POST("list_by_visitor_mid", middleware.JSONParamValidator(zoneproto.ApiListByVisitorMidReq{}), middleware.JwtAuthenticator(), ApiGetZoneListByVisitorMid)
 	apiZoneGroup.POST("list_by_user_id_from_outside", middleware.JSONParamValidator(zoneproto.ApiListByUserIdFromOutsideReq{}), ApiGetZoneListByUserIdFromOutside)
-	apiZoneGroup.POST("get_cashier", middleware.JSONParamValidator(vasproto.ZoneGetCashierReq{}), ZoneGetCashier)
-	apiZoneGroup.POST("create_order", middleware.JSONParamValidator(vasproto.ZoneCreateOrderReq{}), ZoneCreateOrder)
-	apiZoneGroup.POST("refund_page", middleware.JSONParamValidator(vasproto.ZoneRefundPageReq{}), ZoneRefundPage)
-	apiZoneGroup.POST("refund", middleware.JSONParamValidator(vasproto.ZoneRefundReq{}), ZoneRefund)
-	apiZoneGroup.POST("member_list", middleware.JSONParamValidator(vasproto.GetZoneMemberListReq{}), ZoneMemberList)
-	apiZoneGroup.POST("free_join", middleware.JSONParamValidator(vasproto.ZoneFreeJoinReq{}), ZoneFreeJoin)
-	apiZoneGroup.POST("exit", middleware.JSONParamValidator(vasproto.ZoneExitReq{}), ZoneExit)
+	apiZoneGroup.POST("get_cashier", middleware.JSONParamValidator(vasproto.ZoneGetCashierReq{}), middleware.JwtAuthenticator(), ZoneGetCashier)
+	apiZoneGroup.POST("create_order", middleware.JSONParamValidator(vasproto.ZoneCreateOrderReq{}), middleware.JwtAuthenticator(), ZoneCreateOrder)
+	apiZoneGroup.POST("refund_page", middleware.JSONParamValidator(vasproto.ZoneRefundPageReq{}), middleware.JwtAuthenticator(), ZoneRefundPage)
+	apiZoneGroup.POST("refund", middleware.JSONParamValidator(vasproto.ZoneRefundReq{}), middleware.JwtAuthenticator(), ZoneRefund)
+	apiZoneGroup.POST("member_list", middleware.JSONParamValidator(vasproto.GetZoneMemberListReq{}), middleware.JwtAuthenticator(), ZoneMemberList)
+	apiZoneGroup.POST("free_join", middleware.JSONParamValidator(vasproto.ZoneFreeJoinReq{}), middleware.JwtAuthenticator(), ZoneFreeJoin)
+	apiZoneGroup.POST("exit", middleware.JSONParamValidator(vasproto.ZoneExitReq{}), middleware.JwtAuthenticator(), ZoneExit)
 
 	// 私密圈动态
 	apiZoneMomentGroup := r.Group("/api/zone_moment", PrepareToC())
@@ -295,13 +295,23 @@ func Init(r *gin.Engine) {
 	vasPayGroup.POST("query_wechat", middleware.JSONParamValidator(vasproto.QueryWechatReq{}), middleware.JwtAuthenticator(), QueryWechat)
 	vasPayGroup.POST("h5_direct_unlock_wechat", middleware.JSONParamValidator(vasproto.H5DirectUnlockWechatReq{}), middleware.JwtAuthenticator(), H5DirectUnlockWechat)
 	vasPayGroup.POST("h5_get_unlock_wechat_list", middleware.JSONParamValidator(vasproto.GetUnlockWechatListReq{}), middleware.JwtAuthenticator(), GetUnlockWechatList)
+	vasPayGroup.POST("one_step_unlock", middleware.JSONParamValidator(vasproto.OneStepUnlockContactReq{}), middleware.JwtAuthenticator(), OneStepUnlock)
+	vasPayGroup.POST("consumer_fill_contact", middleware.JSONParamValidator(vasproto.ConsumerFillContactReq{}), middleware.JwtAuthenticator(), ConsumerFillContact)
+	vasPayGroup.POST("get_add_wechat_list", middleware.JSONParamValidator(vasproto.GetAddWechatListReq{}), middleware.JwtAuthenticator(), GetAddWechatList)
+	vasPayGroup.POST("confirm_add_wechat", middleware.JSONParamValidator(vasproto.ConfirmAddWechatReq{}), middleware.JwtAuthenticator(), ConfirmAddWechat)
+	vasPayGroup.POST("get_unlock_wechat_list", middleware.JSONParamValidator(vasproto.GetUnlockWechatListReq{}), middleware.JwtAuthenticator(), GetUnlockWechatList)
+	vasPayGroup.POST("get_ch_list", middleware.JSONParamValidator(vasproto.GetCHListReq{}), middleware.JwtAuthenticator(), GetCHList)
+	vasPayGroup.POST("update_wechat", middleware.JSONParamValidator(vasproto.UpdateWechatReq{}), middleware.JwtAuthenticator(), UpdateWechat)
+	vasPayGroup.POST("query_wechat", middleware.JSONParamValidator(vasproto.QueryWechatReq{}), middleware.JwtAuthenticator(), QueryWechat)
+	vasPayGroup.POST("h5_direct_unlock_wechat", middleware.JSONParamValidator(vasproto.H5DirectUnlockWechatReq{}), middleware.JwtAuthenticator(), H5DirectUnlockWechat)
+	vasPayGroup.POST("h5_get_unlock_wechat_list", middleware.JSONParamValidator(vasproto.GetUnlockWechatListReq{}), middleware.JwtAuthenticator(), GetUnlockWechatList)
 	vasPayGroup.POST("withdraw_page", middleware.JSONParamValidator(vasproto.WithdrawPageReq{}), middleware.JwtAuthenticator(), WithdrawPage)
 	vasPayGroup.POST("withdraw_send_verifycode", middleware.JSONParamValidator(vasproto.WithdrawSendVerifycodeReq{}), middleware.JwtAuthenticator(), WithdrawSendVerifycode)
 	vasPayGroup.POST("withdraw_apply", middleware.JSONParamValidator(vasproto.WithdrawApplyReq{}), middleware.JwtAuthenticator(), WithdrawApply)
 	vasPayGroup.POST("deal_one_coin_order", middleware.JSONParamValidator(vasproto.DealOneCoinOrderReq{}), middleware.JwtAuthenticator(), DealOneCoinOrder)
 	vasPayGroup.POST("deal_one_order", middleware.JSONParamValidator(vasproto.DealOneOrderReq{}), DealOneOrder)
-	vasPayGroup.POST("moment_order_list", middleware.JSONParamValidator(vasproto.ZoneMomentOrderListReq{}), ZoneMomentOrderList)
-	vasPayGroup.POST("income_page", middleware.JSONParamValidator(vasproto.IncomePageReq{}), IncomePage)
+	vasPayGroup.POST("moment_order_list", middleware.JSONParamValidator(vasproto.ZoneMomentOrderListReq{}), middleware.JwtAuthenticator(), ZoneMomentOrderList)
+	vasPayGroup.POST("income_page", middleware.JSONParamValidator(vasproto.IncomePageReq{}), middleware.JwtAuthenticator(), IncomePage)
 
 	extVasPayGroup := r.Group("/ext/vas")
 	extVasPayGroup.POST("alipay_callback", AlipayCallback)