diff --git a/tyr-server/src/main/java/cn/axzo/tyr/server/controller/PrivateController.java b/tyr-server/src/main/java/cn/axzo/tyr/server/controller/PrivateController.java
new file mode 100644
index 00000000..865ae3c8
--- /dev/null
+++ b/tyr-server/src/main/java/cn/axzo/tyr/server/controller/PrivateController.java
@@ -0,0 +1,151 @@
+package cn.axzo.tyr.server.controller;
+
+import cn.axzo.tyr.client.model.req.CommonDictQueryReq;
+import cn.axzo.tyr.client.model.req.QuerySaasRoleGroupReq;
+import cn.axzo.tyr.client.model.res.CommonDictResp;
+import cn.axzo.tyr.client.model.res.SaasRoleRes;
+import cn.axzo.tyr.client.model.vo.SaasRoleGroupVO;
+import cn.axzo.tyr.server.repository.dao.SaasRoleGroupRelationDao;
+import cn.axzo.tyr.server.repository.entity.SaasRole;
+import cn.axzo.tyr.server.repository.entity.SaasRoleGroup;
+import cn.axzo.tyr.server.repository.entity.SaasRoleGroupRelation;
+import cn.axzo.tyr.server.service.RoleService;
+import cn.axzo.tyr.server.service.SaasCommonDictService;
+import cn.axzo.tyr.server.service.SaasRoleGroupService;
+import com.google.common.collect.Lists;
+import lombok.RequiredArgsConstructor;
+import org.apache.commons.collections.CollectionUtils;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.Collection;
+import java.util.Comparator;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.function.Function;
+import java.util.stream.Collectors;
+import java.util.stream.IntStream;
+
+@RestController
+@RequiredArgsConstructor
+public class PrivateController {
+
+    @Autowired
+    private SaasCommonDictService saasCommonDictService;
+    @Autowired
+    private SaasRoleGroupService saasRoleGroupService;
+    @Autowired
+    private SaasRoleGroupRelationDao saasRoleGroupRelationDao;
+    @Autowired
+    private RoleService roleService;
+
+    /**
+     * 统一层级的roleGroup按照id升序，sort从1递增
+     * @return
+     * @throws Exception
+     */
+    @PostMapping("/private/role/group/sort/refresh")
+    public Object refreshRoleGroupSort() {
+        List<CommonDictResp> commonDicts = saasCommonDictService.query(CommonDictQueryReq.builder()
+                .scope("role")
+                .build());
+
+        if (CollectionUtils.isEmpty(commonDicts)) {
+            return "ok";
+        }
+
+        Map<String, List<SaasRoleGroupVO>> roleGroups = saasRoleGroupService.getList(QuerySaasRoleGroupReq.builder()
+                        .workspaceTypeCode(Lists.transform(commonDicts, CommonDictResp::getDictCode))
+                        .build())
+                .stream()
+                .collect(Collectors.groupingBy(SaasRoleGroupVO::getWorkspaceTypeCode));
+
+        roleGroups.entrySet()
+                .forEach(e -> {
+                    List<SaasRoleGroupVO> saasRoleGroups = e.getValue().stream()
+                            .sorted(Comparator.comparing(SaasRoleGroupVO::getId))
+                            .collect(Collectors.toList());
+
+                    List<SaasRoleGroup> update = IntStream.range(0, saasRoleGroups.size())
+                            .mapToObj(i -> {
+                                SaasRoleGroupVO saasRoleGroup = saasRoleGroups.get(i);
+                                SaasRoleGroup result = SaasRoleGroup.builder()
+                                        .sort(i + 1)
+                                        .build();
+                                result.setId(saasRoleGroup.getId());
+                                return result;
+                            })
+                            .collect(Collectors.toList());
+
+                    saasRoleGroupService.updateBatchById(update);
+                });
+
+        return "ok";
+    }
+
+    /**
+     * 刷新role的sort，
+     * @return
+     * @throws Exception
+     */
+    @PostMapping("/private/role/sort/refresh")
+    public Object refreshRoleSort() {
+        List<CommonDictResp> commonDicts = saasCommonDictService.query(CommonDictQueryReq.builder()
+                .scope("role")
+                .build());
+
+        if (CollectionUtils.isEmpty(commonDicts)) {
+            return "ok";
+        }
+
+        List<SaasRoleGroupVO> roleGroups = saasRoleGroupService.getList(QuerySaasRoleGroupReq.builder()
+                .workspaceTypeCode(Lists.transform(commonDicts, CommonDictResp::getDictCode))
+                .build());
+
+        List<Long> roleGroupIds = roleGroups.stream().map(SaasRoleGroupVO::getId).collect(Collectors.toList());
+        if (CollectionUtils.isEmpty(roleGroupIds)) {
+            return "ok";
+        }
+
+        List<SaasRoleGroupRelation> saasRoleGroupRelations = saasRoleGroupRelationDao.getByGroupIds(roleGroupIds);
+        if (CollectionUtils.isEmpty(saasRoleGroupRelations)) {
+            return "ok";
+        }
+
+        Map<Long, SaasRoleRes> saasRoles = roleService.list(RoleService.ListSaasRoleParam.builder()
+                        .roleIds(Lists.transform(saasRoleGroupRelations, SaasRoleGroupRelation::getRoleId))
+                        .build())
+                .stream()
+                .collect(Collectors.toMap(SaasRoleRes::getId, Function.identity()));
+
+        List<SaasRole> updateSaasRoles = saasRoleGroupRelations.stream()
+                .collect(Collectors.groupingBy(SaasRoleGroupRelation::getSaasRoleGroupId))
+                .values()
+                .stream()
+                .map(e -> {
+                    List<SaasRoleRes> sortedRoles = e.stream()
+                            .map(rr -> saasRoles.get(rr.getRoleId()))
+                            .filter(Objects::nonNull)
+                            .sorted(Comparator.comparing(SaasRoleRes::getId))
+                            .collect(Collectors.toList());
+
+                    List<SaasRole> update = IntStream.range(0, sortedRoles.size())
+                            .mapToObj(i -> {
+                                SaasRoleRes saasRole = sortedRoles.get(i);
+                                SaasRole result = new SaasRole();
+                                result.setSort(i + 1);
+                                result.setId(saasRole.getId());
+                                return result;
+                            })
+                            .collect(Collectors.toList());
+                    return update;
+                })
+                .flatMap(Collection::stream)
+                .collect(Collectors.toList());
+
+        roleService.updateBatchById(updateSaasRoles);
+        return "ok";
+    }
+}
diff --git a/tyr-server/src/main/java/cn/axzo/tyr/server/service/SaasRoleGroupService.java b/tyr-server/src/main/java/cn/axzo/tyr/server/service/SaasRoleGroupService.java
index 29936bef..653745b7 100644
--- a/tyr-server/src/main/java/cn/axzo/tyr/server/service/SaasRoleGroupService.java
+++ b/tyr-server/src/main/java/cn/axzo/tyr/server/service/SaasRoleGroupService.java
@@ -2,6 +2,8 @@ package cn.axzo.tyr.server.service;
 
 import cn.axzo.tyr.client.model.req.QuerySaasRoleGroupReq;
 import cn.axzo.tyr.client.model.vo.SaasRoleGroupVO;
+import cn.axzo.tyr.server.repository.entity.SaasRoleGroup;
+import com.baomidou.mybatisplus.extension.service.IService;
 
 import java.util.List;
 /**
@@ -10,7 +12,7 @@ import java.util.List;
  * @description
  * @date 2023/12/1 16:37
  */
-public interface SaasRoleGroupService {
+public interface SaasRoleGroupService extends IService<SaasRoleGroup> {
 
     List<SaasRoleGroupVO> getList(QuerySaasRoleGroupReq req);
 
diff --git a/tyr-server/src/main/java/cn/axzo/tyr/server/service/impl/SaasRoleGroupServiceImpl.java b/tyr-server/src/main/java/cn/axzo/tyr/server/service/impl/SaasRoleGroupServiceImpl.java
index 7ccc9388..9087e0b0 100644
--- a/tyr-server/src/main/java/cn/axzo/tyr/server/service/impl/SaasRoleGroupServiceImpl.java
+++ b/tyr-server/src/main/java/cn/axzo/tyr/server/service/impl/SaasRoleGroupServiceImpl.java
@@ -8,8 +8,10 @@ import cn.axzo.tyr.server.repository.dao.SaasRoleGroupDao;
 import cn.axzo.tyr.server.repository.dao.SaasRoleGroupRelationDao;
 import cn.axzo.tyr.server.repository.entity.SaasRoleGroup;
 import cn.axzo.tyr.server.repository.entity.SaasRoleGroupRelation;
+import cn.axzo.tyr.server.repository.mapper.SaasRoleGroupMapper;
 import cn.axzo.tyr.server.service.SaasRoleGroupService;
 import cn.hutool.core.bean.BeanUtil;
+import com.baomidou.mybatisplus.extension.service.impl.ServiceImpl;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import org.apache.commons.collections.CollectionUtils;
@@ -28,7 +30,8 @@ import java.util.stream.Collectors;
 @Slf4j
 @RequiredArgsConstructor
 @Service
-public class SaasRoleGroupServiceImpl implements SaasRoleGroupService {
+public class SaasRoleGroupServiceImpl extends ServiceImpl<SaasRoleGroupMapper, SaasRoleGroup>
+        implements SaasRoleGroupService {
     private final SaasRoleGroupDao saasRoleGroupDao;
     private final SaasRoleGroupRelationDao saasRoleGroupRelationDao;