diff --git a/app/mix/controller/init.go b/app/mix/controller/init.go
index d979d6f7..617d1a8c 100644
--- a/app/mix/controller/init.go
+++ b/app/mix/controller/init.go
@@ -55,6 +55,25 @@ func Init(r *gin.Engine) {
 	// gateway网关，给客户端调用
 	//toCApiGroup := r.Group("/api", PrepareToC())
 
+	// 支付相关
+	vasPayGroup := r.Group("/api/vas", PrepareToC())
+	vasPayGroup.POST("get_coins_product_list", middleware.JSONParamValidator(vasproto.GetCoinsProductListReq{}), middleware.JwtAuthenticator(), GetCoinsProductList)
+	vasPayGroup.POST("create_order", middleware.JSONParamValidator(vasproto.CreateOrderReq{}), middleware.JwtAuthenticator(), CreateOrder)
+	vasPayGroup.POST("one_step_unlock", middleware.JSONParamValidator(vasproto.OneStepUnlockContactReq{}), middleware.JwtAuthenticator(), OneStepUnlock)
+	vasPayGroup.POST("consumer_fill_contact", middleware.JSONParamValidator(vasproto.ConsumerFillContactReq{}), middleware.JwtAuthenticator(), ConsumerFillContact)
+	vasPayGroup.POST("get_add_wechat_list", middleware.JSONParamValidator(vasproto.GetAddWechatListReq{}), middleware.JwtAuthenticator(), GetAddWechatList)
+	vasPayGroup.POST("confirm_add_wechat", middleware.JSONParamValidator(vasproto.ConfirmAddWechatReq{}), middleware.JwtAuthenticator(), ConfirmAddWechat)
+	vasPayGroup.POST("get_unlock_wechat_list", middleware.JSONParamValidator(vasproto.GetUnlockWechatListReq{}), middleware.JwtAuthenticator(), GetUnlockWechatList)
+	vasPayGroup.POST("get_ch_list", middleware.JSONParamValidator(vasproto.GetCHListReq{}), middleware.JwtAuthenticator(), GetCHList)
+	vasPayGroup.POST("update_wechat", middleware.JSONParamValidator(vasproto.UpdateWechatReq{}), middleware.JwtAuthenticator(), UpdateWechat)
+	vasPayGroup.POST("query_wechat", middleware.JSONParamValidator(vasproto.QueryWechatReq{}), middleware.JwtAuthenticator(), QueryWechat)
+	vasPayGroup.POST("h5_direct_unlock_wechat", middleware.JSONParamValidator(vasproto.H5DirectUnlockWechatReq{}), middleware.JwtAuthenticator(), H5DirectUnlockWechat)
+	vasPayGroup.POST("h5_get_unlock_wechat_list", middleware.JSONParamValidator(vasproto.GetUnlockWechatListReq{}), middleware.JwtAuthenticator(), GetUnlockWechatList)
+	vasPayGroup.POST("withdraw_page", middleware.JSONParamValidator(vasproto.WithdrawPageReq{}), middleware.JwtAuthenticator(), WithdrawPage)
+	vasPayGroup.POST("withdraw_send_verifycode", middleware.JSONParamValidator(vasproto.WithdrawSendVerifycodeReq{}), middleware.JwtAuthenticator(), WithdrawSendVerifycode)
+	vasPayGroup.POST("withdraw_apply", middleware.JSONParamValidator(vasproto.WithdrawApplyReq{}), middleware.JwtAuthenticator(), WithdrawApply)
+	vasPayGroup.POST("deal_one_coin_order", middleware.JSONParamValidator(vasproto.DealOneCoinOrderReq{}), middleware.JwtAuthenticator(), DealOneCoinOrder)
+
 	// 验证码
 	apiVeriCodeGroup := r.Group("/api/veri_code", PrepareToC())
 	apiVeriCodeGroup.POST("send", middleware.JSONParamValidator(vericodeproto.ApiSendReq{}), middleware.RequestDecryptor(), ApiSendVeriCode)
@@ -192,36 +211,17 @@ func Init(r *gin.Engine) {
 	// op相关，直接调用服务，不调用gateway
 	// 商品
 	opProductGroup := r.Group("/op/product", PrepareOp())
-	opProductGroup.POST("create", middleware.JSONParamValidator(productproto.OpCreateReq{}), OpCreateProduct)
-	opProductGroup.POST("update", middleware.JSONParamValidator(productproto.OpUpdateReq{}), OpUpdateProduct)
-	opProductGroup.POST("delete", middleware.JSONParamValidator(productproto.OpDeleteReq{}), OpDeleteProduct)
-	opProductGroup.POST("list", middleware.JSONParamValidator(productproto.OpListReq{}), OpGetProductList)
-
-	// 支付相关
-	vasPayGroup := r.Group("/api/vas", PrepareToC())
-	vasPayGroup.POST("get_coins_product_list", middleware.JSONParamValidator(vasproto.GetCoinsProductListReq{}), GetCoinsProductList)
-	vasPayGroup.POST("create_order", middleware.JSONParamValidator(vasproto.CreateOrderReq{}), middleware.JwtAuthenticator(), CreateOrder)
-	vasPayGroup.POST("one_step_unlock", middleware.JSONParamValidator(vasproto.OneStepUnlockContactReq{}), OneStepUnlock)
-	vasPayGroup.POST("consumer_fill_contact", middleware.JSONParamValidator(vasproto.ConsumerFillContactReq{}), ConsumerFillContact)
-	vasPayGroup.POST("get_add_wechat_list", middleware.JSONParamValidator(vasproto.GetAddWechatListReq{}), GetAddWechatList)
-	vasPayGroup.POST("confirm_add_wechat", middleware.JSONParamValidator(vasproto.ConfirmAddWechatReq{}), ConfirmAddWechat)
-	vasPayGroup.POST("get_unlock_wechat_list", middleware.JSONParamValidator(vasproto.GetUnlockWechatListReq{}), GetUnlockWechatList)
-	vasPayGroup.POST("get_ch_list", middleware.JSONParamValidator(vasproto.GetCHListReq{}), GetCHList)
-	vasPayGroup.POST("update_wechat", middleware.JSONParamValidator(vasproto.UpdateWechatReq{}), UpdateWechat)
-	vasPayGroup.POST("query_wechat", middleware.JSONParamValidator(vasproto.QueryWechatReq{}), QueryWechat)
-	vasPayGroup.POST("h5_direct_unlock_wechat", middleware.JSONParamValidator(vasproto.H5DirectUnlockWechatReq{}), H5DirectUnlockWechat)
-	vasPayGroup.POST("h5_get_unlock_wechat_list", middleware.JSONParamValidator(vasproto.GetUnlockWechatListReq{}), GetUnlockWechatList)
-	vasPayGroup.POST("withdraw_page", middleware.JSONParamValidator(vasproto.WithdrawPageReq{}), WithdrawPage)
-	vasPayGroup.POST("withdraw_send_verifycode", middleware.JSONParamValidator(vasproto.WithdrawSendVerifycodeReq{}), WithdrawSendVerifycode)
-	vasPayGroup.POST("withdraw_apply", middleware.JSONParamValidator(vasproto.WithdrawApplyReq{}), WithdrawApply)
-	vasPayGroup.POST("deal_one_coin_order", middleware.JSONParamValidator(vasproto.DealOneCoinOrderReq{}), DealOneCoinOrder)
+	opProductGroup.POST("create", middleware.JSONParamValidator(productproto.OpCreateReq{}), middleware.JwtAuthenticator(), OpCreateProduct)
+	opProductGroup.POST("update", middleware.JSONParamValidator(productproto.OpUpdateReq{}), middleware.JwtAuthenticator(), OpUpdateProduct)
+	opProductGroup.POST("delete", middleware.JSONParamValidator(productproto.OpDeleteReq{}), middleware.JwtAuthenticator(), OpDeleteProduct)
+	opProductGroup.POST("list", middleware.JSONParamValidator(productproto.OpListReq{}), middleware.JwtAuthenticator(), OpGetProductList)
 
 	extVasPayGroup := r.Group("/ext/vas")
-	extVasPayGroup.POST("alipay_callback", AlipayCallback)
+	extVasPayGroup.POST("alipay_callback", middleware.JwtAuthenticator(), AlipayCallback)
 
 	opVasPayGroup := r.Group("/op/vas", PrepareOp())
-	opVasPayGroup.POST("create_order", middleware.JSONParamValidator(vasproto.OpCreateOrderReq{}), OpCreateOrder)
-	opVasPayGroup.POST("coin_order_list", middleware.JSONParamValidator(vasproto.OpCoinOrderListReq{}), OpOrderList)
+	opVasPayGroup.POST("create_order", middleware.JSONParamValidator(vasproto.OpCreateOrderReq{}), middleware.JwtAuthenticator(), OpCreateOrder)
+	opVasPayGroup.POST("coin_order_list", middleware.JSONParamValidator(vasproto.OpCoinOrderListReq{}), middleware.JwtAuthenticator(), OpOrderList)
 
 	// 验证码
 	opVeriCodeGroup := r.Group("/op/veri_code", PrepareOp())
diff --git a/dbstruct/media.go b/dbstruct/media.go
index b3486353..e49235ed 100644
--- a/dbstruct/media.go
+++ b/dbstruct/media.go
@@ -42,6 +42,9 @@ type ToCVideo struct {
 	Id        int64    `json:"id"`         // 视频id
 	Dur       int64    `json:"dur"`        // 视频时
 	CoverUrls []string `json:"cover_urls"` // 视频封面地址
+	CoverW    int64    `json:"cover_w"`    // 封面宽
+	CoverH    int64    `json:"cover_h"`    // 封面高
+	CoverFmt  string   `json:"cover_fmt"`  // 封面图片格式
 	Urls      []string `json:"urls"`       // 视频地址
 }
 
diff --git a/library/mediafiller/mediafillerhelper.go b/library/mediafiller/mediafillerhelper.go
index a3d21a2c..ce657729 100644
--- a/library/mediafiller/mediafillerhelper.go
+++ b/library/mediafiller/mediafillerhelper.go
@@ -67,6 +67,9 @@ func transToCVideo(video *dbstruct.Video, coverImg *dbstruct.Image) *dbstruct.To
 		Urls:      []string{defaultMediaFiller.fileServerDomainName + video.SrcId},
 	}
 	if coverImg != nil {
+		ret.CoverW = coverImg.W
+		ret.CoverH = coverImg.H
+		ret.CoverFmt = coverImg.Fmt
 		ret.CoverUrls = []string{defaultMediaFiller.fileServerDomainName + coverImg.SrcId}
 	}
 	return ret