diff --git a/apps/web-antd/src/views/erp/purchase/order/index.vue b/apps/web-antd/src/views/erp/purchase/order/index.vue
index bc9552c80..3cb0130a6 100644
--- a/apps/web-antd/src/views/erp/purchase/order/index.vue
+++ b/apps/web-antd/src/views/erp/purchase/order/index.vue
@@ -129,13 +129,8 @@ function handleUpdateStatus(
 
 /** 导出 */
 async function handleExport() {
-  try {
-    const formValues = gridApi.getFormData();
-    const data = await exportPurchaseOrder(formValues);
-    downloadFileFromBlobPart({ fileName: '采购订单.xls', source: data });
-  } catch {
-    // 处理错误
-  }
+  const data = await exportPurchaseOrder(await gridApi.formApi.getValues());
+  downloadFileFromBlobPart({ fileName: '采购订单.xls', source: data });
 }
 
 const [Grid, gridApi] = useVbenVxeGrid({
diff --git a/apps/web-antd/src/views/erp/purchase/supplier/index.vue b/apps/web-antd/src/views/erp/purchase/supplier/index.vue
index b0d6d79ef..98288f4ab 100644
--- a/apps/web-antd/src/views/erp/purchase/supplier/index.vue
+++ b/apps/web-antd/src/views/erp/purchase/supplier/index.vue
@@ -113,12 +113,14 @@ const [Grid, gridApi] = useVbenVxeGrid({
               label: $t('ui.actionTitle.create', ['供应商']),
               type: 'primary',
               icon: ACTION_ICON.ADD,
+              auth: ['erp:supplier:create'],
               onClick: handleCreate,
             },
             {
               label: $t('ui.actionTitle.export'),
               type: 'primary',
               icon: ACTION_ICON.DOWNLOAD,
+              auth: ['erp:supplier:export'],
               onClick: handleExport,
             },
           ]"
@@ -132,6 +134,7 @@ const [Grid, gridApi] = useVbenVxeGrid({
               label: '编辑',
               type: 'link',
               icon: ACTION_ICON.EDIT,
+              auth: ['erp:supplier:update'],
               onClick: handleEdit.bind(null, row),
             },
             {
@@ -139,6 +142,7 @@ const [Grid, gridApi] = useVbenVxeGrid({
               type: 'link',
               danger: true,
               icon: ACTION_ICON.DELETE,
+              auth: ['erp:supplier:delete'],
               popConfirm: {
                 title: $t('ui.actionMessage.deleteConfirm', [row.name]),
                 confirm: handleDelete.bind(null, row),