diff --git a/par-api/src/main/java/com/par/api/controller/ConfigController.java b/par-api/src/main/java/com/par/api/controller/ConfigController.java
index fef54d5..103097c 100644
--- a/par-api/src/main/java/com/par/api/controller/ConfigController.java
+++ b/par-api/src/main/java/com/par/api/controller/ConfigController.java
@@ -47,6 +47,14 @@ public class ConfigController {
         return ApiResponse.success(dtos);
     }
 
+    /**
+     * 列出所有站点最新已批准配置（供概览统计）
+     */
+    @GetMapping
+    public ApiResponse<List<SiteConfigDTO>> listAllConfigs() {
+        return ApiResponse.success(configService.listAllApprovedConfigs());
+    }
+
     /**
      * 获取站点最新配置版本列表
      */
diff --git a/par-core/src/main/java/com/par/core/interceptor/HmacAuthInterceptor.java b/par-core/src/main/java/com/par/core/interceptor/HmacAuthInterceptor.java
index 3b9fe72..12b7e74 100644
--- a/par-core/src/main/java/com/par/core/interceptor/HmacAuthInterceptor.java
+++ b/par-core/src/main/java/com/par/core/interceptor/HmacAuthInterceptor.java
@@ -46,13 +46,10 @@ public class HmacAuthInterceptor implements HandlerInterceptor {
 
     @Override
     public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
-        // 只拦截写入操作（PUT/POST/DELETE/PATCH），GET/HEAD/OPTIONS 直接放行
         String method = request.getMethod().toUpperCase();
-        if ("GET".equals(method) || "HEAD".equals(method) || "OPTIONS".equals(method)) {
-            return true;
-        }
+        boolean isWrite = !("GET".equals(method) || "HEAD".equals(method) || "OPTIONS".equals(method));
 
-        // 方式 1：Bearer Token
+        // 1. 尝试 Bearer Token 鉴权（读取/写入均尝试，解析成功则写入 trustLevel 供后续 checkAdmin 使用）
         String authHeader = request.getHeader("Authorization");
         if (authHeader != null && authHeader.startsWith("Bearer ")) {
             String email = verifyBearerToken(authHeader.substring(7));
@@ -68,7 +65,7 @@ public class HmacAuthInterceptor implements HandlerInterceptor {
             return false;
         }
 
-        // 方式 2：PSK 签名（无需账户，clientId 即身份）
+        // 2. PSK 签名鉴权（外部集成客户端，仅用于写入操作）
         String sig = request.getHeader(HEADER_SIGNATURE);
         String ts = request.getHeader(HEADER_TIMESTAMP);
         if (sig != null && ts != null) {
@@ -90,6 +87,11 @@ public class HmacAuthInterceptor implements HandlerInterceptor {
             return false;
         }
 
+        // 3. 读取请求（GET/HEAD/OPTIONS）未携带任何凭证：放行，由具体接口决定是否要求权限
+        if (!isWrite) {
+            return true;
+        }
+
         writeError(response, 401, "Missing or invalid authentication");
         return false;
     }
diff --git a/par-core/src/main/java/com/par/core/service/ConfigService.java b/par-core/src/main/java/com/par/core/service/ConfigService.java
index 8089f42..3f89816 100644
--- a/par-core/src/main/java/com/par/core/service/ConfigService.java
+++ b/par-core/src/main/java/com/par/core/service/ConfigService.java
@@ -25,6 +25,11 @@ public interface ConfigService {
      */
     List<SiteConfigDTO> listApprovedConfigs(String siteId);
 
+    /**
+     * 获取所有站点最新已批准配置（供概览统计）
+     */
+    List<SiteConfigDTO> listAllApprovedConfigs();
+
     /**
      * 获取指定版本配置
      */
diff --git a/par-core/src/main/java/com/par/core/service/impl/ConfigServiceImpl.java b/par-core/src/main/java/com/par/core/service/impl/ConfigServiceImpl.java
index 99391ea..22cc1a7 100644
--- a/par-core/src/main/java/com/par/core/service/impl/ConfigServiceImpl.java
+++ b/par-core/src/main/java/com/par/core/service/impl/ConfigServiceImpl.java
@@ -46,6 +46,15 @@ public class ConfigServiceImpl implements ConfigService {
                 .stream().map(this::toDTO).collect(Collectors.toList());
     }
 
+    @Override
+    public List<SiteConfigDTO> listAllApprovedConfigs() {
+        return siteConfigMapper.selectList(
+                        new com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper<SiteConfig>()
+                                .eq(SiteConfig::getStatus, com.par.core.enums.ConfigStatus.APPROVED)
+                                .eq(SiteConfig::getDeleted, 0))
+                .stream().map(this::toDTO).collect(Collectors.toList());
+    }
+
     @Override
     public SiteConfig getConfig(String siteId, String version) {
         return siteConfigMapper.selectOne(