diff --git a/backend/src/test/java/com/xly/erp/module/usr/service/UserServiceImplTest.java b/backend/src/test/java/com/xly/erp/module/usr/service/UserServiceImplTest.java
index 071b2eb..7ac1e5d 100644
--- a/backend/src/test/java/com/xly/erp/module/usr/service/UserServiceImplTest.java
+++ b/backend/src/test/java/com/xly/erp/module/usr/service/UserServiceImplTest.java
@@ -244,6 +244,78 @@ class UserServiceImplTest {
         assertThat(uc.getValue().getBCanModifyDocs()).isFalse();
     }
 
+    @Test
+    void updateWithInvalidUserType_throws40001() {
+        when(userMapper.selectById(10)).thenReturn(stubExistingUser(10));
+        UpdateUserDTO dto = baseUpdateDto();
+        dto.setSUserType("火星");
+        assertThatThrownBy(() -> service.update(10, dto))
+                .isInstanceOf(BizException.class)
+                .hasFieldOrPropertyWithValue("code", 40001);
+        verify(userMapper, never()).updateById(any(User.class));
+    }
+
+    @Test
+    void updateWithInvalidLanguage_throws40001() {
+        when(userMapper.selectById(10)).thenReturn(stubExistingUser(10));
+        UpdateUserDTO dto = baseUpdateDto();
+        dto.setSLanguage("ja");
+        assertThatThrownBy(() -> service.update(10, dto))
+                .isInstanceOf(BizException.class)
+                .hasFieldOrPropertyWithValue("code", 40001);
+        verify(userMapper, never()).updateById(any(User.class));
+    }
+
+    @Test
+    void updateWithStaffNotFound_throws40022() {
+        when(userMapper.selectById(10)).thenReturn(stubExistingUser(10));
+        when(staffMapper.existsActiveById(99)).thenReturn(false);
+        UpdateUserDTO dto = baseUpdateDto();
+        dto.setIStaffId(99);
+        assertThatThrownBy(() -> service.update(10, dto))
+                .isInstanceOf(BizException.class)
+                .hasFieldOrPropertyWithValue("code", 40022);
+        verify(userMapper, never()).updateById(any(User.class));
+    }
+
+    @Test
+    void updateWithSomeInvalidPermissionIds_throws40023() {
+        when(userMapper.selectById(10)).thenReturn(stubExistingUser(10));
+        when(permissionCategoryMapper.countActiveByIds(List.of(1, 2, 3))).thenReturn(2);
+        UpdateUserDTO dto = baseUpdateDto();
+        dto.setPermissionCategoryIds(List.of(1, 2, 3));
+        assertThatThrownBy(() -> service.update(10, dto))
+                .isInstanceOf(BizException.class)
+                .hasFieldOrPropertyWithValue("code", 40023);
+        verify(userMapper, never()).updateById(any(User.class));
+    }
+
+    @Test
+    void updateWithDuplicateUserNo_throws40020() {
+        when(userMapper.selectById(10)).thenReturn(stubExistingUser(10));
+        when(userMapper.updateById(any(User.class)))
+                .thenThrow(new DuplicateKeyException("uk_user_no"));
+        UpdateUserDTO dto = baseUpdateDto();
+        assertThatThrownBy(() -> service.update(10, dto))
+                .isInstanceOf(BizException.class)
+                .hasFieldOrPropertyWithValue("code", 40020);
+        verify(userPermissionMapper, never()).deleteByUserId(any());
+    }
+
+    @Test
+    void updateWithEmptyPermissionIds_clearsExisting() {
+        when(userMapper.selectById(10)).thenReturn(stubExistingUser(10));
+        when(userMapper.updateById(any(User.class))).thenReturn(1);
+        when(userPermissionMapper.deleteByUserId(10)).thenReturn(2);
+        UpdateUserDTO dto = baseUpdateDto();
+        dto.setPermissionCategoryIds(null);
+
+        service.update(10, dto);
+
+        verify(userPermissionMapper, times(1)).deleteByUserId(10);
+        verify(userPermissionMapper, never()).insert(any(UserPermission.class));
+    }
+
     private UpdateUserDTO baseUpdateDto() {
         UpdateUserDTO dto = new UpdateUserDTO();
         dto.setSUserNo("u_new");