diff --git a/cjpm.lock b/cjpm.lock
index c60bec9..db5ce18 100644
--- a/cjpm.lock
+++ b/cjpm.lock
@@ -1,19 +1,19 @@
 version = 0
 
 [requires]
-  soulsoft_web_http = {version = "1.0.20260528"}
   soulsoft_extensions_options_configuration = {version = "1.0.20260528"}
-  soulsoft_web_routing = {version = "1.0.20260528"}
-  soulsoft_web_cors = {version = "1.0.20260528"}
+  soulsoft_extensions_configuration = {version = "1.0.20260528"}
+  soulsoft_extensions_injection = {version = "1.0.20260528"}
+  soulsoft_web_http = {version = "1.0.20260528"}
   soulsoft_extensions_options = {version = "1.0.20260528"}
+  redis = {version = "1.0.20260627"}
+  soulsoft_serialization = {version = "1.0.20260528"}
+  soulsoft_web_routing = {version = "1.0.20260528"}
+  soulsoft_web_hosting = {version = "1.0.20260528"}
+  soulsoft_web_mvc = {version = "1.0.20260528"}
+  soulsoft_web_cors = {version = "1.0.20260528"}
   soulsoft_extensions_logging = {version = "1.0.20260528"}
   soulsoft_identity_claims = {version = "1.0.20260528"}
+  soulsoft_extensions_logging_configuration = {version = "1.0.20260528"}
   soulsoft_extensions_logging_console = {version = "1.0.20260528"}
   soulsoft_extensions_hosting = {version = "1.0.20260528"}
-  soulsoft_web_hosting = {version = "1.0.20260528"}
-  soulsoft_extensions_logging_configuration = {version = "1.0.20260528"}
-  redis = {version = "1.0.20260627"}
-  soulsoft_web_mvc = {version = "1.0.20260528"}
-  soulsoft_extensions_injection = {version = "1.0.20260528"}
-  soulsoft_extensions_configuration = {version = "1.0.20260528"}
-  soulsoft_serialization = {version = "1.0.20260528"}
diff --git a/src/helpers/SimApiRequestDelegateFactory.cj b/src/helpers/SimApiRequestDelegateFactory.cj
index f4cb520..77b2742 100644
--- a/src/helpers/SimApiRequestDelegateFactory.cj
+++ b/src/helpers/SimApiRequestDelegateFactory.cj
@@ -242,7 +242,7 @@ struct SimApiActionInvoker {
     }
 
     /// 检查 @SimApiAuth 注解并执行鉴权（对齐 C# SimApiAuthAttribute.OnActionExecuting）：
-    /// 未登录 401 → 类型权限 403 → 遍历执行 ISimApiAuthChecker
+    /// 未登录 401 → 遍历执行 ISimApiAuthChecker → 类型权限 403
     private func checkSimApiAuth() {
         var auth: ?SimApiAuthAttribute = None
         for (item in actionDescriptor.endpointMetadata) {
@@ -265,7 +265,20 @@ struct SimApiActionInvoker {
                     SimApiError.error(code: 401, message: "需要登录")
             }
 
-            // 2. 类型权限校验 → 403（对齐 C# Types.Intersect(loginInfo.Type).Any()，支持逗号分隔多类型）
+            // 2. 遍历执行 ISimApiAuthChecker（对齐 C#：先执行 checker，可修改 loginItem，再做类型判断）
+            let token = match (context.items.get("LoginToken")) {
+                case Some(v) => if (let s: String <- v) { s } else { "" }
+                case None => ""
+            }
+            let options = context.services.getOrThrow<SimApiOptions>()
+            for (checkerType in options.authCheckers) {
+                let instance = context.services.getOrThrow(checkerType)
+                if (let checker: ISimApiAuthChecker <- instance) {
+                    checker.run(loginItem, token)
+                }
+            }
+
+            // 3. 类型权限校验 → 403（对齐 C# Types.Intersect(loginInfo.Type).Any()，支持逗号分隔多类型）
             if (!auth.`type`.isEmpty()) {
                 let requiredTypes = auth.`type`.split(",")
                 var matched = false
@@ -279,19 +292,6 @@ struct SimApiActionInvoker {
                     SimApiError.error(code: 403, message: "无权访问")
                 }
             }
-
-            // 3. 遍历执行 ISimApiAuthChecker（从 DI 按注册类型解析）
-            let token = match (context.items.get("LoginToken")) {
-                case Some(v) => if (let s: String <- v) { s } else { "" }
-                case None => ""
-            }
-            let options = context.services.getOrThrow<SimApiOptions>()
-            for (checkerType in options.authCheckers) {
-                let instance = context.services.getOrThrow(checkerType)
-                if (let checker: ISimApiAuthChecker <- instance) {
-                    checker.run(loginItem, token)
-                }
-            }
         }
     }