diff --git a/internal/handler/system_ee.go b/internal/handler/system_ee.go
new file mode 100644
index 0000000000..489f8a0486
--- /dev/null
+++ b/internal/handler/system_ee.go
@@ -0,0 +1,32 @@
+//
+//  Copyright 2026 The InfiniFlow Authors. All Rights Reserved.
+//
+//  Licensed under the Apache License, Version 2.0 (the "License");
+//  you may not use this file except in compliance with the License.
+//  You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+//  Unless required by applicable law or agreed to in writing, software
+//  distributed under the License is distributed on an "AS IS" BASIS,
+//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//  See the License for the specific language governing permissions and
+//  limitations under the License.
+//
+
+package handler
+
+import (
+	"ragflow/internal/common"
+
+	"github.com/gin-gonic/gin"
+)
+
+// GetEnableAdmin admin access endpoint
+// @Description Enable admin access endpoint
+// @Tags system
+// @Produce plain
+// @Router /api/v1/system/enable-admin [GET]
+func (h *SystemHandler) GetEnableAdmin(c *gin.Context) {
+	common.ErrorWithCode(c, common.CodeNotImplemented, "EnableAdmin not implemented")
+}
diff --git a/internal/handler/oauth_login.go b/internal/handler/user_auth.go
similarity index 98%
rename from internal/handler/oauth_login.go
rename to internal/handler/user_auth.go
index 68c1b29271..2027339514 100644
--- a/internal/handler/oauth_login.go
+++ b/internal/handler/user_auth.go
@@ -76,7 +76,7 @@ func (h *UserHandler) OAuthLogin(c *gin.Context) {
 	c.Redirect(http.StatusFound, init.AuthURL)
 }
 
-// OAuthCallback handles the OAuth/OIDC callback for the configured channel.
+// OAuthChannelCallback handles the OAuth/OIDC callback for the configured channel.
 // Mirrors Python's GET /auth/oauth/<channel>/callback: it verifies the
 // state, exchanges the code for an access token, fetches user info, and
 // then either logs in an existing user or registers a new one. On every
@@ -89,7 +89,7 @@ func (h *UserHandler) OAuthLogin(c *gin.Context) {
 // @Param code query string true "authorization code"
 // @Param state query string true "state token"
 // @Router /api/v1/auth/oauth/{channel}/callback [get]
-func (h *UserHandler) OAuthCallback(c *gin.Context) {
+func (h *UserHandler) OAuthChannelCallback(c *gin.Context) {
 	channel := c.Param("channel")
 	// An empty channel segment (/auth/oauth//callback) is a malformed path,
 	// not a real channel. Python's router never matches it and returns 404;
diff --git a/internal/handler/user_auth_ee.go b/internal/handler/user_auth_ee.go
new file mode 100644
index 0000000000..9b3e207d17
--- /dev/null
+++ b/internal/handler/user_auth_ee.go
@@ -0,0 +1,67 @@
+//
+//  Copyright 2026 The InfiniFlow Authors. All Rights Reserved.
+//
+//  Licensed under the Apache License, Version 2.0 (the "License");
+//  you may not use this file except in compliance with the License.
+//  You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+//  Unless required by applicable law or agreed to in writing, software
+//  distributed under the License is distributed on an "AS IS" BASIS,
+//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//  See the License for the specific language governing permissions and
+//  limitations under the License.
+//
+
+package handler
+
+import (
+	"ragflow/internal/common"
+
+	"github.com/gin-gonic/gin"
+)
+
+func (h *UserHandler) OAuthCallback(c *gin.Context) {
+	common.ErrorWithCode(c, common.CodeNotImplemented, "OAuthCallback not implemented")
+}
+
+func (h *UserHandler) GitHubAuthCallback(c *gin.Context) {
+	common.ErrorWithCode(c, common.CodeNotImplemented, "GitHubAuthCallback not implemented")
+}
+
+func (h *UserHandler) LarkAuthCallback(c *gin.Context) {
+	common.ErrorWithCode(c, common.CodeNotImplemented, "LarkAuthCallback not implemented")
+}
+
+func (h *UserHandler) ICBCAuthCallback(c *gin.Context) {
+	common.ErrorWithCode(c, common.CodeNotImplemented, "ICBCAuthCallback not implemented")
+}
+
+func (h *UserHandler) AzureAuthCallback(c *gin.Context) {
+	common.ErrorWithCode(c, common.CodeNotImplemented, "AzureAuthCallback not implemented")
+}
+
+func (h *UserHandler) AzureAuthLogin(c *gin.Context) {
+	common.ErrorWithCode(c, common.CodeNotImplemented, "AzureAuthLogin not implemented")
+}
+
+func (h *UserHandler) Captcha(c *gin.Context) {
+	common.ErrorWithCode(c, common.CodeNotImplemented, "Captcha not implemented")
+}
+
+func (h *UserHandler) SendOTP(c *gin.Context) {
+	common.ErrorWithCode(c, common.CodeNotImplemented, "SendOTP not implemented")
+}
+
+func (h *UserHandler) VerifyOTP(c *gin.Context) {
+	common.ErrorWithCode(c, common.CodeNotImplemented, "VerifyOTP not implemented")
+}
+
+func (h *UserHandler) IsAdmin(c *gin.Context) {
+	common.ErrorWithCode(c, common.CodeNotImplemented, "IsAdmin not implemented")
+}
+
+func (h *UserHandler) GetMeta(c *gin.Context) {
+	common.ErrorWithCode(c, common.CodeNotImplemented, "GetMeta not implemented")
+}
diff --git a/internal/router/router.go b/internal/router/router.go
index 69b2be1c05..5ccb11b34b 100644
--- a/internal/router/router.go
+++ b/internal/router/router.go
@@ -168,7 +168,18 @@ func (r *Router) Setup(engine *gin.Engine) {
 		// /auth/login/channels to GetLoginChannels and other values to
 		// OAuthLogin without conflict.
 		apiNoAuth.GET("/auth/login/:channel", r.userHandler.OAuthLogin)
-		apiNoAuth.GET("/auth/oauth/:channel/callback", r.userHandler.OAuthCallback)
+		apiNoAuth.GET("/auth/oauth/:channel/callback", r.userHandler.OAuthChannelCallback)
+
+		// For EE
+		apiNoAuth.GET("/auth/oauth/callback", r.userHandler.OAuthCallback)
+		apiNoAuth.GET("/auth/oauth/github/callback", r.userHandler.GitHubAuthCallback)
+		apiNoAuth.GET("/auth/oauth/lark/callback", r.userHandler.LarkAuthCallback)
+		apiNoAuth.GET("/auth/icbc/callback", r.userHandler.ICBCAuthCallback)
+		apiNoAuth.GET("/auth/azure/callback", r.userHandler.AzureAuthCallback)
+		apiNoAuth.GET("/auth/azure/login", r.userHandler.AzureAuthLogin)
+		apiNoAuth.POST("/auth/register/captcha", r.userHandler.Captcha)
+		apiNoAuth.POST("/auth/register/otp", r.userHandler.SendOTP)
+		apiNoAuth.POST("/auth/register/otp/verify", r.userHandler.VerifyOTP)
 
 		// Register
 		apiNoAuth.POST("/users", r.userHandler.Register)
@@ -257,6 +268,15 @@ func (r *Router) Setup(engine *gin.Engine) {
 				users.GET("/me/models", r.tenantHandler.TenantInfo)
 				// User set tenant info endpoint
 				users.PATCH("/me/models", r.userHandler.SetTenantInfo)
+
+				// For EE
+				users.GET("/me/admin", r.userHandler.IsAdmin)
+				users.GET("/me/meta", r.userHandler.GetMeta)
+			}
+
+			user := v1.Group("/settings")
+			{
+				user.GET("/enable-admin", r.systemHandler.GetEnableAdmin)
 			}
 
 			tenants := v1.Group("/tenants")