From 5a9d98282aab00e4ea07db248b7c2efc2f307257 Mon Sep 17 00:00:00 2001
From: Viajero-tect <2737079298@qq.com>
Date: Tue, 18 Nov 2025 15:20:30 +0800
Subject: [PATCH] =?UTF-8?q?=E6=9B=B4=E6=96=B0=E7=94=A8=E6=88=B7=E7=AE=A1?=
 =?UTF-8?q?=E7=90=86=EF=BC=8C=E7=8E=B0=E5=9C=A8=E8=83=BD=E9=80=9A=E8=BF=87?=
 =?UTF-8?q?=E7=8F=AD=E5=AF=BC=E5=B8=88=EF=BC=8C=E7=AE=A1=E7=90=86=E5=91=98?=
 =?UTF-8?q?=EF=BC=8C=E5=AD=A6=E7=94=9F=E8=BF=9B=E5=85=A5=E5=AF=B9=E5=BA=94?=
 =?UTF-8?q?=E7=9A=84=E9=A1=B5=E9=9D=A2=E8=BF=9B=E8=A1=8C=E5=AF=86=E7=A0=81?=
 =?UTF-8?q?=E4=BF=AE=E6=94=B9?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 db.sqlite3                           | Bin 131072 -> 139264 bytes
 elastic/es_connect.py                |   8 +-
 elastic/indexes.py                   |   6 +-
 elastic/templates/elastic/users.html | 106 +++++++++++++++++++++------
 elastic/views.py                     |  85 ++++++++++++++-------
 main/templates/main/home.html        |   2 +-
 6 files changed, 156 insertions(+), 51 deletions(-)

diff --git a/db.sqlite3 b/db.sqlite3
index d01f075d2940e3f52afb5142ee3231b87ea94eff..d2e15124d43359afef60249528108c0ae656d918 100644
GIT binary patch
delta 8467
zcmchb%g^iRUB}Pq%o%ktGcO3SVS#2Ukl1+S`{hU=94EdfcI?=R15)aHe7|2eo)PQ;
zodvAuqQJI-K^i1Bh)q}g1+XaUe}LFSrh=*{Q?=3iiYVU1PM%+$-(x?Y&-e4szy0|?
zefv*;<Kx%Wt5>hS^FPP8{_J<~Z@sSm_Pc-eCm+7|(T`s}$shm4M?e1XKfZ*1<?r5K
z-o4Y_yi-1Sv;7-@o_Zf0N}_Sz{ob25@7{j>;d```g)ouj9nwX1nP6Bw*drW31B6p?
z5C-pl?RME;V>C?V80KZ*IJyB;g~`xHSWWqn?;u_f)!t{mI6`Ry>&0B?R}V<rc`Gyi
zGU0@k7n-%vcCj6S(nTwiZCJ##p2=d#U3#up`@-urI4$<avtnTw*^>a(LuF1W&}HY%
z0HRhJ1V9;3JC_UQRa&T~g0+Fs$ty6)DZyrC@WgrJOw`y}*3isTVuqp6%7-Nqvj*aL
zToTsp)GD*BfYFNSic}7rW1d$-zMX_^Y9y;o>5WNGks23O*49aPbqHUss!U!yI!cbx
z*h3=MY(#H_@W^3iJT+S*VsVnQ+*a$maFwP_r$mDwR*}QHnCI_@rOVoUos6JI3{bXD
zOa*mJ_CR(uZX@AY?9`BUr!x`@IV+VYa6(d>-k;bU_ok6j`Hdy0wz(QbhjNoVG@Rzx
z`59)|4Y7*w1P(ClNK+M`^37hkjwNVQ%E5FwJRJqA-HZ!qo+dA4NB8RL_OzA^V!dqu
zZ#IqH3db2)Tyqp(6c7kdg`Nvdv1!o67iaju*gRG26)w8+fTU3Yu_7}K5^v3FRelS}
zGJOP?@<7wI=4nG?^hYagHXLW+hkdp_@7V!TkY%j-GsksA-p+PP9+ZNXA@o*GF=W&J
zFv5ia&(+x=oRl_tNkLgG6Z~Kr`KGW!BzN{holQrZ!}pDO>x-J}@=5`BglC^u7Yqm*
zoKJ=<3CcYTjILfNRDI>IzB=+}LNJwO53{udNwKkC1t+k>ile7RF{2>IT4rM{+zi=K
zbs=ONOa5}&cJ&GfG~C{tL1QyBCzRdrrm;GkLuBa(A=JV%;Sl-R@`xR@5pq#XCz_U|
zB5f!y+yv+r9IjS-Xh&V_YR6fq$-87$Pv#uq$6yY)dGBHu-}S(`pF~R<yb3tRp0XCi
ze1mWd4yi{bXhgm3%!4g(SKCr~lQ<s5>w%9a{~YU=iAz*P-`~E9Rc#*~*9g%eBE4=|
zcl6SR5mrVyonk!X?4{V3Lx`&ej%J+JB>rtlnTik}vJLGU-3)q4Pqk=Qu_&ktYXpVo
z>C7G=sy=SB6k4CLU9QKlNmCNR_|b$!VzKI3@hb1M(#v(cR@VoNHf=R$Sc4APAqi>N
zlLjTN-B?hT9uBPX+~s(DsA63(y97@fJ~{(=bz2KFc~mw`HF*wP=W)HY*SJAplW1;O
zP^P`LE|(bQ&Y{>FXJs<$a|1(Rgl|t;cEpGTq&JGGq_9ZM9U?(7k|{w+DeU27*PHdm
z8;*;gqAspn;d4GBzGuRM*o|>*sXztzMu~->G1&(U<cX<Yw{nyOK?jG#p>8p@6luB0
z5zh73mpoYId_bStbJGW=)E%1Wyj5ir?sJ)h&jDZ!5<6^49SdcbjIY$r*dqRESTb?;
zvptz18Asuetgfd$(`}KJSe;8VV*qJO<gn_ykQB|U4hlwU&8HQsjB8c)iQAI*Bg#uW
zVCu*%7Iqu}25tsQD!>{XIryB-<*47C;iwCbfuj=`o5hzMPZNByQM+cz*?q;c07)3T
zM#Kt~#(KzxyQw{dxjB%Qt)?9A>@mGq`&zZu`Png3T*?lRr8<};9U|>qHk}TKr@0O*
zC)g9Y7XsVcO%;dhPGdK;6AG>*K+ej&uC=SDNn6Kl^1vATGFwP;1Nc!INr|v(un|%L
zp~^uZTNP$FM;W86F(s;UNhLY%oJ&2s0}eGP0mbHopQ949$kTDZ+r`p}WFQzcec$7#
z#DlW2KIevSZ7t-sR~gu;>TdmaDpH%P&{RmEKTgdkE<Q6^4BPEI1kI}5A+aJx=QR!I
zrBobEg1!O@t$JyWld@Ju0p-A^Tp?|}M&g~(ZL5vLoayqCo<IcWAXpX-_KuR~tHi~+
z=LVRy>fDG99I^K<a6~w6CmJ##1T<6AQ@CExaZmJXkxR(@IB~IB)TVUZn(L<A=k6ql
zxSX&xRCEa#%gqYk87#d=z2xe3;VH#h6TN`en#!U>gr?T)lxo`_c5*h6<D4D=7t5*1
zj3x|<a+wjD>WnKLaAH!F@!A9`<wY%5Og7`3Sn(@c9No~8{Vr^}Yr4q`bzh!UftnyH
zflnvP%#Y;G$hJzC8kiUQx>ui-!_J#Tt`+>K7yw&oZv=3J8Eo9bYqepU@BkDcpQGlQ
zSGq7uT7MiT;ZR+)(Uf=4ve_Y8hXmE7b6a4Zs6so<N$3wJ`8Ecd?kP{|w8nN;J~pIq
z-uPEf<WFTf^LbOYT}{=6Rb--l3~;d8o>_$7jbt~&KBlUYrYNOR@#W~~;P!IRAOY|4
z^GuHxQwa@0lg=Ly80nQDDw+D47<^M;j%>2hv1*956!r@=oZ1_M=t0Q_sR6<~a7w>`
zZ^-jS^9zyZ-9P^2r%T2r&N1z_x5*dsRqAF?=_0$*fze2bS?Vp+%WQvoYe4mA$E%ZC
zT!~|F@xkfpm!zWgSzF5>E|*MEiA+ENNC<;420$<X!k>V|TL^uNQJ;|%iel6k(EGQ-
zDjKB9s&@w}CCOi}kkWSQnMjk4LgBXVDR3^{wclHbQqNr9MseI9n{{|>)9n<7KqNHE
zE(DBIfH$?i=2{D!PmDd1)c&XALZ5)t+pmYFKEp|pAc%MJ_x|C-_n!DyPuUay^wrZ>
zUw--t`Lz7jd)wE)2n#>>`l6qy_Z!Q7|LNae{r2FELkhK2f;i2UfWgQfN~kD3>e`TP
z10ip|{-p`?di?hE%5oI@qaXg@s~`U0_3!@vt+emIdiwXLe}4M@(;t8NtKV&({_r>7
zqhJ5@|NQJc;vfp4AN<_YKbhwLd-`rR{`^P(_4<>KKf2NP>kr~rxA%A6|JNI9|I3ZF
ze>tS4ZmfK3UIO*)tufbtlA#(LjE!EVnWZt;Mq<){;D|}2ciXGQ#6D9cs@AKw%>ksc
ztD&=L;QHi^)%y$O_Hd_SP7UD;<aa2L-tKlAq7a#w$b8jW2XerSOc*bkp>NGAD}ox=
z=_*96T4#-O=2mCPwLdY8md{%(F6or25Zp-{0@gMuU3eQSjkgs(lP=g?)+c?xId2F@
zxy%56+bVk0VR+vcL~ysDIL0Xq)U*jJ;Vo*PFP?QH#!Sy6+y))Xi-k)n4^yeCkloyH
zM@cUS1xFZNs$wNlLLe-`(+$7DJj*=0RHa6}`WyIA6r9dw^M>DUcZbM5R4dG5vQ6yG
z6sMAig{<7IdR+STS)%bRup?7er;j$tKhs_wlb7Yi?d36fSzg>;9+Q{l#qH%Wd0AfE
zULKQ|<;CsgF?m^D++H4&m*vIn<uQ3#Uff<Dlb7Yi?d36fSzg>;9+Q{l#qH%Wd0AfE
zULKQ|<;CsgF?m^D++H4&m*vIn<uQ3#Uff<Dlb7Yi?d36fS$<+K6ben)4&%uHz)mxE
zxu`KrzyLz!7I7l&fbe3nRgifeSVO%yxsvd^eh&amT^%XPKw}EYiD2*H^#vS(G9U<>
zxF{!N!(f*{?fc6>>-89+|7$jvX&^_`(%ezVB_+X*^1v&I2r#nc=ZxD(Evg&ySPPj>
z{(L0A(e&4^*SF)-H{ZJ9^nc!P`gzgwWAJv*Zp$;H=f~jfp52ybM$eDI+daE2&y1cQ
zgSUHjTb>y`KL&62?6y2JdVUPv?%8d5X7v0Ryxp_g^33S@F?hRYx8<49^JDOK&u+^z
zqvyxq?VjD1XGYJD!P`B%EzgXeAA`4hc3YkqJwFC-_w2SjGkSgu-tO6Ld1mzd7`)xH
z+w#ol`7wCAXSd~<(eq>QcF%6hGo$Cn;O(B>mj73HyJxrkFAZ<skV}7K&inGQ^xywC
DG<*`4

delta 752
zcmaixO>Yum5XTp2lcuI@JQx!Xh9;VLq1oqI_Kj%bmOzE>Qea^LJ<xqC>}!|ZWnnRq
zVn2WyG~V=}7f+4pfvf4~=s~|gzk+Tx-m0C<B$G@s^Z)<m=-b-S(c0@fY2*SykW5^^
z<IMvyiClc$|NLq_nO-0$mtJhVJ>ASa+?dT@tgiCMH(029gii&OESajK24NV&zAfpb
zYrw$jV_-|GM4qT022CCAPO(YDH@G@0*QQ0M+O(voRh)NMR{57KOUdq(VSq!(^nfvZ
zd=x}LGe^@1*YSahMSnJ#-k!iuD>Fd>Tr-E)BAVfvRy%4LWex~*DD<<#0&kWTqt4S&
z7}2K3RXaOaAa;bhSW(*UM6xPcw*blqmTPw{aoCb!;ZS6KwqYL1#d;ouyThiCClsc-
zo%KgzQ7#G9TG66L4T(2<UCsB@nO(BC$*~nk9kDTPK@1XE0J9j#V7YvpfZn2L0Et}8
z@%++VFu?J#c@UVI4j9E5O7;YrwnutEnUgVq`SWW5Xi)_yP>edzG8eZ$+?rWW-EP~p
z6q_FNLfJ1n+i?$E1+Tg?%;|eZiTP_r8X6@TS9`oe6$QH_wk_AtCN8I9PihRSDN{_}
z>8T`TEB&jz&<p@`kc@>6*@#d>5{?$nK7LtGqBers=n`F?Zel&OaxcXvuKVN)dXC)x
z4-joa;7;mzd9qxdB>2bijWY!Ofu5nCPH*nNLm%Buv5BiyUJ_sV_xRGp`|m#!nO~RD
B>ni{N

diff --git a/elastic/es_connect.py b/elastic/es_connect.py
index 9abac50..cd4e0f7 100644
--- a/elastic/es_connect.py
+++ b/elastic/es_connect.py
@@ -730,7 +730,10 @@ def get_all_users():
             users.append({
                 "user_id": hit.user_id,
                 "username": hit.username,
-                "permission": int(hit.permission)
+                "permission": int(hit.permission),
+                "email": getattr(hit, 'email', None),
+                "key": list(getattr(hit, 'key', []) or []),
+                "manage_key": list(getattr(hit, 'manage_key', []) or []),
             })
         
         return users
@@ -749,6 +752,9 @@ def get_user_by_id(user_id):
                 "user_id": hit.user_id,
                 "username": hit.username,
                 "permission": int(hit.permission),
+                "email": getattr(hit, 'email', None),
+                "key": list(getattr(hit, 'key', []) or []),
+                "manage_key": list(getattr(hit, 'manage_key', []) or []),
             }
         return None
     except Exception as e:
diff --git a/elastic/indexes.py b/elastic/indexes.py
index ce9f83a..d03006e 100644
--- a/elastic/indexes.py
+++ b/elastic/indexes.py
@@ -1,5 +1,5 @@
-INDEX_NAME = "wordsearch2666661"
-USER_NAME = "users11111666789"
+INDEX_NAME = "wordsearch21"
+USER_NAME = "users16"
 ACHIEVEMENT_INDEX_NAME = INDEX_NAME
 USER_INDEX_NAME = USER_NAME
-GLOBAL_INDEX_NAME = "global11111111"
+GLOBAL_INDEX_NAME = "global11121"
diff --git a/elastic/templates/elastic/users.html b/elastic/templates/elastic/users.html
index fb3e7fd..9e8bf48 100644
--- a/elastic/templates/elastic/users.html
+++ b/elastic/templates/elastic/users.html
@@ -216,20 +216,49 @@
     </div>
   </div>
 
-  <!-- 主内容区域 -->
   <div class="main-content">
+    {% if is_student %}
+    <div class="card">
+      <div class="header"><h2>修改密码</h2></div>
+      <form id="selfPwdForm">
+        <input type="hidden" id="selfUserId" name="user_id" value="{{ user_id }}">
+        <div class="form-group">
+          <label for="password">新密码</label>
+          <input type="password" id="password" name="password" required>
+        </div>
+        <div class="form-group">
+          <label for="confirmPassword">确认密码</label>
+          <input type="password" id="confirmPassword" name="confirmPassword" required>
+        </div>
+        <button type="submit" class="btn btn-primary">保存</button>
+      </form>
+    </div>
+    {% else %}
+    {% if is_tutor %}
+    <div class="card">
+      <div class="header"><h2>修改本人密码</h2></div>
+      <form id="selfPwdForm">
+        <input type="hidden" id="selfUserId" name="user_id" value="{{ user_id }}">
+        <div class="form-group">
+          <label for="password">新密码</label>
+          <input type="password" id="password" name="password" required>
+        </div>
+        <div class="form-group">
+          <label for="confirmPassword">确认密码</label>
+          <input type="password" id="confirmPassword" name="confirmPassword" required>
+        </div>
+        <button type="submit" class="btn btn-primary">保存</button>
+      </form>
+    </div>
+    {% endif %}
     <div class="card">
       <div class="header">
         <h2>用户管理</h2>
-        <button id="addUserBtn" class="btn btn-primary">添加用户</button>
+        {% if is_admin %}<button id="addUserBtn" class="btn btn-primary">添加用户</button>{% endif %}
       </div>
 
-      <div class="notification success" id="successNotification">
-        操作成功！
-      </div>
-      <div class="notification error" id="errorNotification">
-        操作失败！
-      </div>
+      <div class="notification success" id="successNotification">操作成功！</div>
+      <div class="notification error" id="errorNotification">操作失败！</div>
 
       <div class="search-container">
         <input type="text" id="searchInput" placeholder="搜索用户名...">
@@ -247,12 +276,11 @@
               <th>操作</th>
             </tr>
           </thead>
-          <tbody id="usersTableBody">
-            <!-- 用户数据将通过JavaScript加载 -->
-          </tbody>
+          <tbody id="usersTableBody"></tbody>
         </table>
       </div>
     </div>
+    {% endif %}
   </div>
 
   <!-- 添加/编辑用户模态框 -->
@@ -511,7 +539,10 @@
     }
 
     // 事件监听器
-    document.getElementById('addUserBtn').addEventListener('click', openAddModal);
+    const addBtn = document.getElementById('addUserBtn');
+    if (addBtn) {
+        addBtn.addEventListener('click', openAddModal);
+    }
 
     document.getElementById('userForm').addEventListener('submit', saveUser);
 
@@ -523,15 +554,21 @@
         });
     });
 
-    document.getElementById('searchBtn').addEventListener('click', function() {
-        const searchTerm = document.getElementById('searchInput').value;
-        loadUsers(searchTerm);
-    });
+    const searchBtn = document.getElementById('searchBtn');
+    if (searchBtn) {
+        searchBtn.addEventListener('click', function() {
+            const searchTerm = document.getElementById('searchInput').value;
+            loadUsers(searchTerm);
+        });
+    }
 
-    document.getElementById('resetBtn').addEventListener('click', function() {
-        document.getElementById('searchInput').value = '';
-        loadUsers();
-    });
+    const resetBtn = document.getElementById('resetBtn');
+    if (resetBtn) {
+        resetBtn.addEventListener('click', function() {
+            document.getElementById('searchInput').value = '';
+            loadUsers();
+        });
+    }
 
     // 点击模态框外部关闭模态框
     window.addEventListener('click', function(event) {
@@ -572,7 +609,34 @@
 
     // 页面加载时获取用户列表
     document.addEventListener('DOMContentLoaded', function() {
-        loadUsers();
+        const selfForm = document.getElementById('selfPwdForm');
+        if (selfForm) {
+            selfForm.addEventListener('submit', async (e) => {
+                e.preventDefault();
+                const uid = document.getElementById('selfUserId').value;
+                const pwd = document.getElementById('password').value;
+                const cpwd = document.getElementById('confirmPassword').value;
+                if (pwd !== cpwd) { showNotification('密码和确认密码不匹配', false); return; }
+                if ((pwd || '').length < 6) { showNotification('密码长度至少为6位', false); return; }
+                try {
+                    const csrftoken = getCookie('csrftoken');
+                    const resp = await fetch(`/elastic/users/${uid}/update/`, {
+                        method: 'POST', credentials: 'same-origin',
+                        headers: { 'Content-Type': 'application/json', 'X-CSRFToken': csrftoken || '' },
+                        body: JSON.stringify({ password: pwd })
+                    });
+                    const result = await resp.json();
+                    if (resp.ok && result.status === 'success') { showNotification('修改成功'); }
+                    else { showNotification(result.message || '操作失败', false); }
+                } catch (error) {
+                    showNotification('保存失败', false);
+                }
+            });
+        }
+        const tbody = document.getElementById('usersTableBody');
+        if (tbody) {
+            loadUsers();
+        }
     });
 
     // 为表格中的编辑和删除按钮添加事件监听器
diff --git a/elastic/views.py b/elastic/views.py
index b79f6cd..cfb06af 100644
--- a/elastic/views.py
+++ b/elastic/views.py
@@ -222,16 +222,27 @@ def add_user(request):
 
 @require_http_methods(["GET"])
 def get_users(request):
-    if request.session.get("user_id") is None:
+    uid = request.session.get("user_id")
+    if uid is None:
         return JsonResponse({"status": "error", "message": "未登录"}, status=401)
-    if int(request.session.get("permission", 1)) != 0:
-        return JsonResponse({"status": "error", "message": "无权限"}, status=403)
     try:
+        is_admin = int(request.session.get("permission", 1)) == 0
+        requester = get_user_by_id(uid) or {}
+        mgr_keys = set(requester.get("manage_key") or [])
         q = (request.GET.get("search") or "").strip()
         users = get_all_users()
+        if is_admin:
+            filtered = users
+        elif mgr_keys:
+            def match_manage(user):
+                ukeys = set(user.get("key") or [])
+                return bool(ukeys & mgr_keys)
+            filtered = [u for u in users if match_manage(u)]
+        else:
+            filtered = [u for u in users if str(u.get("user_id")) == str(uid)]
         if q:
-            users = [u for u in users if q in str(u.get("username", ""))]
-        return JsonResponse({"status": "success", "data": users})
+            filtered = [u for u in filtered if q in str(u.get("username", ""))]
+        return JsonResponse({"status": "success", "data": filtered})
     except Exception as e:
         return JsonResponse({"status": "error", "message": str(e)}, status=500)
 
@@ -239,10 +250,9 @@ def get_users(request):
 @require_http_methods(["POST"])
 @csrf_protect
 def update_user_by_id_view(request, user_id):
-    if request.session.get("user_id") is None:
+    uid = request.session.get("user_id")
+    if uid is None:
         return JsonResponse({"status": "error", "message": "未登录"}, status=401)
-    if int(request.session.get("permission", 1)) != 0:
-        return JsonResponse({"status": "error", "message": "无权限"}, status=403)
     try:
         payload = json.loads(request.body.decode("utf-8"))
     except Exception:
@@ -250,21 +260,41 @@ def update_user_by_id_view(request, user_id):
     new_username = (payload.get("username") or "").strip()
     new_permission = payload.get("permission")
     new_password = (payload.get("password") or "").strip()
-    if new_username:
-        other = get_user_by_username(new_username)
-        if other and int(other.get("user_id", -1)) != int(user_id):
-            return JsonResponse({"status": "error", "message": "用户名已存在"}, status=409)
     if new_password and len(new_password) < 6:
         return JsonResponse({"status": "error", "message": "密码长度至少为6位"}, status=400)
-    ok = es_update_user_by_id(
-        user_id,
-        username=new_username if new_username else None,
-        permission=int(new_permission) if new_permission is not None else None,
-        password=new_password if new_password else None,
-    )
-    if not ok:
-        return JsonResponse({"status": "error", "message": "用户更新失败"}, status=500)
-    return JsonResponse({"status": "success", "message": "用户更新成功"})
+
+    is_admin = int(request.session.get("permission", 1)) == 0
+    requester = get_user_by_id(uid) or {}
+    target = get_user_by_id(user_id) or {}
+    requester_mgr = set(requester.get("manage_key") or [])
+    target_keys = set(target.get("key") or [])
+
+    if is_admin:
+        if new_username:
+            other = get_user_by_username(new_username)
+            if other and int(other.get("user_id", -1)) != int(user_id):
+                return JsonResponse({"status": "error", "message": "用户名已存在"}, status=409)
+        ok = es_update_user_by_id(
+            user_id,
+            username=new_username if new_username else None,
+            permission=int(new_permission) if new_permission is not None else None,
+            password=new_password if new_password else None,
+        )
+        return JsonResponse({"status": "success"}) if ok else JsonResponse({"status": "error", "message": "用户更新失败"}, status=500)
+
+    if str(uid) == str(user_id):
+        if not new_password:
+            return JsonResponse({"status": "error", "message": "仅允许修改密码"}, status=400)
+        ok = es_update_user_by_id(user_id, password=new_password)
+        return JsonResponse({"status": "success"}) if ok else JsonResponse({"status": "error", "message": "用户更新失败"}, status=500)
+
+    if requester_mgr and (target_keys & requester_mgr):
+        if not new_password or new_username or new_permission is not None:
+            return JsonResponse({"status": "error", "message": "导师仅允许修改密码"}, status=403)
+        ok = es_update_user_by_id(user_id, password=new_password)
+        return JsonResponse({"status": "success"}) if ok else JsonResponse({"status": "error", "message": "用户更新失败"}, status=500)
+
+    return JsonResponse({"status": "error", "message": "无权限"}, status=403)
 
 @require_http_methods(["POST"])
 @csrf_protect
@@ -598,11 +628,16 @@ def user_manage(request):
     if session_user_id is None:
         from django.shortcuts import redirect
         return redirect("/accounts/login/")
-    if int(request.session.get("permission", 1)) != 0:
-        from django.shortcuts import redirect
-        return redirect("/main/home/")
+    is_admin = int(request.session.get("permission", 1)) == 0
+    me = get_user_by_id(session_user_id) or {}
+    has_manage = bool(me.get("manage_key"))
     user_id_qs = request.GET.get("user_id")
-    context = {"user_id": user_id_qs or session_user_id}
+    context = {
+        "user_id": user_id_qs or session_user_id,
+        "is_admin": is_admin,
+        "is_tutor": (not is_admin) and has_manage,
+        "is_student": (not is_admin) and (not has_manage),
+    }
     return render(request, "elastic/users.html", context)
 
 @require_http_methods(["GET"])
diff --git a/main/templates/main/home.html b/main/templates/main/home.html
index b0d5afb..61348f7 100644
--- a/main/templates/main/home.html
+++ b/main/templates/main/home.html
@@ -42,8 +42,8 @@
       <a href="{% url 'main:home' %}" onclick="return handleNavClick(this, '/');">主页</a>
       <a href="{% url 'elastic:upload_page' %}" onclick="return handleNavClick(this, '/elastic/upload/');">图片上传与识别</a>
       <a href="{% url 'elastic:manage_page' %}" onclick="return handleNavClick(this, '/elastic/manage/');">数据管理</a>
-      {% if is_admin %}
       <a href="{% url 'elastic:user_manage' %}" onclick="return handleNavClick(this, '/elastic/user_manage/');">用户管理</a>
+      {% if is_admin %}
       <a href="{% url 'elastic:registration_code_manage_page' %}" onclick="return handleNavClick(this, '/elastic/registration-codes/manage/');">注册码管理</a>
       {% endif %}
       <a id="logoutBtn">退出登录</a>