v 0.3 Preview: Update admin

backend/accounts/test_serializers.py

@@ -5,7 +5,7 @@ from django.utils import timezone
 from rest_framework import serializers
 
 from accounts.models import InviteCode, InviteCodeUsage, User
-from accounts.serializers import RegisterSerializer
+from accounts.serializers import RegisterSerializer, UserSerializer
 
 
 def registration_data(code="VALID-CODE", username="math_user"):
@@ -74,3 +74,21 @@ def test_register_serializer_游客迁移字段类型错误时拒绝():
 
     assert not serializer.is_valid()
     assert "favorites 必须是数组" in str(serializer.errors["visitor_data"])
+
+
+@pytest.mark.django_db
+def test_user_serializer_返回员工身份且客户端不能提权():
+    user = User.objects.create_user(
+        username="operator",
+        password="StrongPass_2026",
+        nickname="运营人员",
+        is_staff=False,
+    )
+
+    serializer = UserSerializer(user, data={"is_staff": True}, partial=True)
+
+    assert serializer.is_valid(), serializer.errors
+    serializer.save()
+    user.refresh_from_db()
+    assert user.is_staff is False
+    assert UserSerializer(user).data["is_staff"] is False