fix

app/Services/Manage/ManageUserService.php

@@ -280,7 +280,7 @@ class ManageUserService
     public function updateUser(array $params): array
     {
         $role = (string)Site::getRole();
-        if (!in_array($role, ['superadmin', 'admin'], true)) {
+        if (!in_array($role, ['superadmin', 'admin', 'user'], true)) {
             Utils::throwError('1005:当前角色无权修改用户');
         }
 
@@ -289,6 +289,11 @@ class ManageUserService
             Utils::throwError('1002:请传入目标用户uid');
         }
 
+        // 普通组员仅可修改自己
+        if ($role === 'user' && $uid !== (int)Site::getUid()) {
+            Utils::throwError('1005:权限不足');
+        }
+
         $target = DB::table('mp_manage_users')->where('id', $uid)->where('is_deleted', 0)->first();
         if (!$target) {
             Utils::throwError(ErrorConst::USER_IS_NOT_EXIST);
@@ -320,12 +325,12 @@ class ManageUserService
             }
         }
 
-        if (array_key_exists('is_enabled', $params) && $params['is_enabled'] !== '' && $params['is_enabled'] !== null) {
+        if ($role !== 'user' && array_key_exists('is_enabled', $params) && $params['is_enabled'] !== '' && $params['is_enabled'] !== null) {
             $update['is_enabled'] = (int)$params['is_enabled'];
         }
 
         $newRole = getProp($params, 'role');
-        if ($newRole !== null && $newRole !== '') {
+        if ($role !== 'user' && $newRole !== null && $newRole !== '') {
             if ($role !== 'superadmin') {
                 Utils::throwError('1005:仅超管可调整用户角色');
             }