diff --git a/README.md b/README.md
index 0ee50f6..ae50d1a 100644
--- a/README.md
+++ b/README.md
@@ -3,6 +3,8 @@ sailsProject
 
 a [Sails](http://sailsjs.org) application
 
+> 須使用 npm@3 安裝相依模組
+
 gem install
 -----------
 
diff --git a/api/controllers/FriendController.js b/api/controllers/FriendController.js
new file mode 100644
index 0000000..330cf70
--- /dev/null
+++ b/api/controllers/FriendController.js
@@ -0,0 +1,46 @@
+module.exports = {
+  create: async (req, res) => {
+    try {
+      let friend = await Friend.create(req.body);
+      res.ok(friend);
+    } catch (e) {
+      res.serverError(e);
+    }
+  },
+
+  findAll: async (req, res) => {
+    try {
+      let friends = await Friend.findAll();
+      res.ok({friends});
+    } catch (e) {
+      res.serverError(e);
+    }
+  },
+
+  update: async (req, res) => {
+    try {
+      let result = await Friend.update(req.body,{
+        where: {
+          id: req.params.id
+        }
+      });
+      res.ok(result);
+    } catch (e) {
+      res.serverError(e);
+    }
+  },
+
+  destroy: async (req, res) => {
+    try {
+      let result = await Friend.destroy({
+        where: {
+          id: req.params.id
+        }
+      });
+      res.ok(true);
+    } catch (e) {
+      res.serverError(e);
+    }
+  },
+
+}
diff --git a/api/models/Friend.js b/api/models/Friend.js
new file mode 100644
index 0000000..38dea2b
--- /dev/null
+++ b/api/models/Friend.js
@@ -0,0 +1,14 @@
+module.exports = {
+  attributes: {
+    name: Sequelize.STRING,
+    email: Sequelize.STRING,
+    facebookId: Sequelize.INTEGER
+  },
+  associations: function() {
+  },
+  options: {
+    classMethods: {},
+    instanceMethods: {},
+    hooks: {}
+  }
+};
diff --git a/config/policies.js b/config/policies.js
index fd8e96e..f09fe92 100644
--- a/config/policies.js
+++ b/config/policies.js
@@ -26,6 +26,12 @@ module.exports.policies = {
     'index': [],
     'find': []
   },
+  'FriendController': {
+    'create': [],
+    'findAll': [],
+    'update': [],
+    'destroy': []
+  },
   'DashboardController': {
     '*': []
   }
diff --git a/config/routes.js b/config/routes.js
index 9a6885d..ada604b 100644
--- a/config/routes.js
+++ b/config/routes.js
@@ -57,6 +57,12 @@ module.exports.routes = {
   'get /api/arrow/authOfFirstPost': 'DashboardController.get_arrow',
   'get /api/async/authOfFirstPost': 'DashboardController.get_async',
 
+  'post /friend/create': 'FriendController.create',
+  'get /friend/find': 'FriendController.findAll',
+  'put /friend/update/:id': 'FriendController.update',
+  'delete /friend/destroy/:id': 'FriendController.destroy',
+
+
   /***************************************************************************
   *                                                                          *
   * Custom routes here...                                                    *
diff --git a/package.json b/package.json
index 4e4c810..5eb56a6 100644
--- a/package.json
+++ b/package.json
@@ -65,6 +65,7 @@
   "author": "spooky",
   "license": "",
   "devDependencies": {
+    "babel-cli": "^6.11.4",
     "chai": "^3.4.1",
     "grunt-bower-task": "^0.4.0",
     "grunt-cli": "^0.1.13",
diff --git a/test/unit/controllers/FriendController.spec.js b/test/unit/controllers/FriendController.spec.js
new file mode 100644
index 0000000..f0da8e9
--- /dev/null
+++ b/test/unit/controllers/FriendController.spec.js
@@ -0,0 +1,81 @@
+describe('test Friend CRUD', () => {
+  let friendId = null;
+  before(async (done) => {
+    try {
+      const newFriend = {
+        name: 'wahaha',
+        email: 'wahaha@gm.com',
+        facebookId: '1234567'
+      };
+      const result = await Friend.create(newFriend);
+      friendId = result.id;
+      done();
+    }catch (e){
+      done();
+    }
+  });
+
+  it('create a friend', async (done) => {
+    try{
+      const newFriend = {
+        name: 'wahaha',
+        email: 'wahaha@gm.com',
+        facebookId: '1234567'
+      }
+      let res = await request(sails.hooks.http.app)
+      .post(`/friend/create`)
+      .send(newFriend).expect(200);
+      res.body.should.have.keys('id', 'name', 'email', 'facebookId', 'updatedAt', 'createdAt');
+      done();
+    }catch(e){
+      done();
+    }
+  });
+
+  it('get friends', async (done) => {
+    try{
+      let res = await request(sails.hooks.http.app).get(`/friend/find`).expect(200);
+      let {friends} = res.body;
+      friends.should.be.Array;
+      friends[0].should.have.keys('id', 'name', 'email', 'facebookId', 'updatedAt', 'createdAt');
+      done();
+    }catch(e){
+      done();
+    }
+  });
+
+  it('update a friend', async (done) => {
+    try{
+      let newInfo = {
+        name: 'haha'
+      }
+      let res = await request(sails.hooks.http.app)
+      .put(`/friend/update/${friendId}`)
+      .send(newInfo)
+      .expect(200);
+      res.body.should.be.Array;
+      res.body[0].should.be.eq(1);
+
+      let friend = await Friend.findById(friendId);
+      friend.name.should.be.eq('haha');
+      done();
+    }catch(e){
+      done();
+    }
+  });
+
+  it('delete a friend', async (done) => {
+    try{
+      let res = await request(sails.hooks.http.app)
+      .delete(`/friend/destroy/${friendId}`)
+      .expect(200);
+
+      let friend = await Friend.findById(friendId);
+      (friend === null).should.be.true;
+      done();
+    }catch(e){
+      done();
+    }
+  });
+
+});