diff --git a/src/main/java/com/iflytop/colortitration/app/controller/AuthController.java b/src/main/java/com/iflytop/colortitration/app/controller/AuthController.java
new file mode 100644
index 0000000..303f5ad
--- /dev/null
+++ b/src/main/java/com/iflytop/colortitration/app/controller/AuthController.java
@@ -0,0 +1,55 @@
+package com.iflytop.colortitration.app.controller;
+
+import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
+import com.iflytop.colortitration.app.model.dto.LoginDTO;
+import com.iflytop.colortitration.common.enums.EnableStatus;
+import com.iflytop.colortitration.common.model.entity.User;
+import com.iflytop.colortitration.common.result.Result;
+import com.iflytop.colortitration.common.result.ResultCode;
+import com.iflytop.colortitration.common.service.UserService;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import jakarta.validation.Valid;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.web.bind.annotation.*;
+
+import java.util.Objects;
+
+/**
+ * 认证控制
+ */
+@Tag(name = "认证")
+@RestController
+@RequestMapping("/api/auth")
+@RequiredArgsConstructor
+@Slf4j
+public class AuthController {
+
+    private final UserService userService;
+
+    @Operation(summary = "账号密码登录")
+    @PostMapping("/login")
+    public Result<User> login(@Valid @RequestBody LoginDTO loginDTO) {
+        User user = userService.getOne(new LambdaQueryWrapper<>(User.class).eq(User::getUsername, loginDTO.getUsername()));
+        if (user != null && !Objects.equals(user.getDeleted(), EnableStatus.ENABLE) && user.getPassword().equals(loginDTO.getPassword())) {
+            userService.setCurrentUser(user);
+            user.setPassword(null);
+            return Result.success(user);
+        }
+        return Result.failed(ResultCode.INVALID_CREDENTIALS);
+    }
+
+    @Operation(summary = "用户登出")
+    @PostMapping("/logout")
+    public Result<String> logout() {
+        userService.setCurrentUser(null);
+        return Result.success();
+    }
+
+    @Operation(summary = "获取当前登录用户")
+    @GetMapping("/current")
+    public Result<User> current() {
+        return Result.success(userService.getCurrentUser());
+    }
+}
diff --git a/src/main/java/com/iflytop/colortitration/app/model/dto/LoginDTO.java b/src/main/java/com/iflytop/colortitration/app/model/dto/LoginDTO.java
new file mode 100644
index 0000000..3d8d993
--- /dev/null
+++ b/src/main/java/com/iflytop/colortitration/app/model/dto/LoginDTO.java
@@ -0,0 +1,22 @@
+package com.iflytop.colortitration.app.model.dto;
+
+import io.swagger.v3.oas.annotations.media.Schema;
+import jakarta.validation.constraints.NotNull;
+import lombok.Data;
+
+/**
+ * 用户登录表单
+ */
+@Schema(description = "用户登录")
+@Data
+public class LoginDTO {
+
+    @NotNull
+    @Schema(description = "用户名", example = "admin")
+    private String username;
+
+    @NotNull
+    @Schema(description = "用户密码", example = "12345")
+    private String password;
+
+}
diff --git a/src/main/java/com/iflytop/colortitration/common/service/UserService.java b/src/main/java/com/iflytop/colortitration/common/service/UserService.java
index 837e234..b2cbe04 100644
--- a/src/main/java/com/iflytop/colortitration/common/service/UserService.java
+++ b/src/main/java/com/iflytop/colortitration/common/service/UserService.java
@@ -1,8 +1,8 @@
 package com.iflytop.colortitration.common.service;
 
 import com.baomidou.mybatisplus.extension.service.impl.ServiceImpl;
-import com.iflytop.colortitration.common.model.entity.User;
 import com.iflytop.colortitration.common.mapper.UserMapper;
+import com.iflytop.colortitration.common.model.entity.User;
 import lombok.RequiredArgsConstructor;
 import org.springframework.stereotype.Service;
 
@@ -12,5 +12,13 @@ import org.springframework.stereotype.Service;
 @Service
 @RequiredArgsConstructor
 public class UserService extends ServiceImpl<UserMapper, User> {
+    private User currentUser;
+
+    public User getCurrentUser() {
+        return currentUser;
+    }
 
+    public void setCurrentUser(User currentUser) {
+        this.currentUser = currentUser;
+    }
 }
\ No newline at end of file