diff --git a/backend/src/main/java/com/example/erp/module/usr/dto/UserUpdateReqDTO.java b/backend/src/main/java/com/example/erp/module/usr/dto/UserUpdateReqDTO.java
index 57fd866..27783c3 100644
--- a/backend/src/main/java/com/example/erp/module/usr/dto/UserUpdateReqDTO.java
+++ b/backend/src/main/java/com/example/erp/module/usr/dto/UserUpdateReqDTO.java
@@ -1,5 +1,8 @@
 package com.example.erp.module.usr.dto;
 
+import jakarta.validation.constraints.NotBlank;
+import jakarta.validation.constraints.NotNull;
+import jakarta.validation.constraints.Pattern;
 import lombok.Getter;
 import lombok.Setter;
 
@@ -9,10 +12,16 @@ import java.util.List;
 @Setter
 public class UserUpdateReqDTO {
 
+    @NotBlank(message = "用户类型不能为空")
+    @Pattern(regexp = "普通用户|超级管理员", message = "用户类型无效")
     private String userType;
+
+    @NotBlank(message = "语言不能为空")
+    @Pattern(regexp = "中文|英文|繁体", message = "语言无效")
     private String language;
     private boolean canEditDoc;
     private boolean isDisabled;
     private String employeeId;
+    @NotNull(message = "权限组列表不能为空")
     private List<String> permGroupIds;
 }
diff --git a/backend/src/main/java/com/example/erp/module/usr/vo/UserListItemVO.java b/backend/src/main/java/com/example/erp/module/usr/vo/UserListItemVO.java
index 28678b7..dfba429 100644
--- a/backend/src/main/java/com/example/erp/module/usr/vo/UserListItemVO.java
+++ b/backend/src/main/java/com/example/erp/module/usr/vo/UserListItemVO.java
@@ -25,6 +25,9 @@ public class UserListItemVO {
     @JsonProperty("sLanguage")
     private String sLanguage;
 
+    @JsonProperty("bCanEditDoc")
+    private Integer bCanEditDoc;
+
     @JsonProperty("bIsDisabled")
     private Integer bIsDisabled;
 
diff --git a/backend/src/main/resources/mapper/UsrUserMapper.xml b/backend/src/main/resources/mapper/UsrUserMapper.xml
index 661a7d4..a6ec4e9 100644
--- a/backend/src/main/resources/mapper/UsrUserMapper.xml
+++ b/backend/src/main/resources/mapper/UsrUserMapper.xml
@@ -6,7 +6,7 @@
     <!-- REQ-USR-003: 查询用户 -->
     <select id="selectUserList" resultType="com.example.erp.module.usr.vo.UserListItemVO">
         SELECT u.sId, u.sUsername, u.sUserCode, u.sUserType, u.sLanguage,
-               u.bIsDisabled, u.tLastLoginDate, u.sCreatorUsername, u.tCreateDate,
+               u.bCanEditDoc, u.bIsDisabled, u.tLastLoginDate, u.sCreatorUsername, u.tCreateDate,
                s.sStaffName, s.sDepartment
         FROM usr_user u
         LEFT JOIN tStaff s ON u.sEmployeeId = s.sId
diff --git a/backend/src/test/java/com/example/erp/module/usr/UserServiceTest.java b/backend/src/test/java/com/example/erp/module/usr/UserServiceTest.java
index 04b9ad1..88ab7fa 100644
--- a/backend/src/test/java/com/example/erp/module/usr/UserServiceTest.java
+++ b/backend/src/test/java/com/example/erp/module/usr/UserServiceTest.java
@@ -233,6 +233,22 @@ class UserServiceTest {
     }
 
     @Test
+    void updateUser_selfAdminKeepType_doesNotThrow() {
+        UserUpdateReqDTO dto = new UserUpdateReqDTO();
+        dto.setUserType("超级管理员");
+        dto.setLanguage("中文");
+        dto.setPermGroupIds(List.of());
+        UsrUserEntity existing = new UsrUserEntity();
+        existing.setSId("u1");
+        existing.setSUsername("admin");
+        when(userMapper.selectOne(any())).thenReturn(existing);
+        when(userMapper.update(any(), any())).thenReturn(1);
+
+        // 自己保持 超级管理员 角色 → 不应抛 40301
+        assertDoesNotThrow(() -> userService.updateUser("u1", dto, superAdmin));
+    }
+
+    @Test
     void updateUser_invalidEmployee_throws40001() {
         UserUpdateReqDTO dto = new UserUpdateReqDTO();
         dto.setUserType("普通用户");
diff --git a/docs/superpowers/reviews/2026-05-08-REQ-USR-002.md b/docs/superpowers/reviews/2026-05-08-REQ-USR-002.md
new file mode 100644
index 0000000..e27fd1c
--- /dev/null
+++ b/docs/superpowers/reviews/2026-05-08-REQ-USR-002.md
@@ -0,0 +1,27 @@
+---
+req_id: REQ-USR-002
+date: 2026-05-08
+round: 1
+reviewer: superpower-code-reviewer
+---
+
+# Review: REQ-USR-002 — round 1
+
+## 结论
+request-changes
+
+## Must-fix
+- [HIGH] backend/src/main/java/com/example/erp/module/usr/dto/UserUpdateReqDTO.java:12-13 — userType / language 缺少 @NotBlank + @Pattern 校验，非法值直接写库（建议：参照 UserCreateReqDTO 添加 @NotBlank + @Pattern 注解）
+- [HIGH] frontend/src/pages/usr/UserFormDrawer.tsx:8-14 — InitialData 接口缺少 permGroupIds 字段，导致有权限组的用户打开编辑抽屉时权限组无法被预填（建议：添加 permGroupIds?: string[]，useEffect 改为 setSelectedPermIds(initialData.permGroupIds ?? [])）
+- [HIGH] frontend/src/pages/usr/UserListPage.tsx:124 — canEditDoc 写死为 false，每次保存会将已有用户的 canEditDoc 覆盖为 false（建议：在列表查询中加入 bCanEditDoc，传入 initialData 时使用真实值）
+- [MEDIUM] backend/src/test/java/com/example/erp/module/usr/UserServiceTest.java — 缺少测试 userId==自己 但 userType 仍为 "超级管理员" 时不抛出 40301（建议：补充 updateUser_selfAdminKeepType_doesNotThrow 测试，确认允许路径）
+
+## Nice-to-have
+- backend/.../vo/UserUpdateRespVO.java — updatedAt 建议加 @JsonFormat(pattern="yyyy-MM-dd'T'HH:mm:ss") 确保序列化格式显式
+- backend/.../dto/UserUpdateReqDTO.java — permGroupIds 建议加 @NotNull，防止调用方传 null 时静默跳过权限组删除
+- frontend/src/test/UserListPage.test.tsx:106 — editMode_submit_callsUpdateUser 只断言调用次数，建议补充 toHaveBeenCalledWith('u1', ...) 验证 userId 传值正确
+
+## 反例 / 测试覆盖缺口
+- 缺 "自己修改自己 userType 但保持 超级管理员" 的无异常路径测试（G1）
+- controller 层无 BizException → 错误码映射测试（G4，40300/40400/40301 未被 controller 测试覆盖）
+- canEditDoc/isDisabled 写入 DB 的 int 映射值（0/1）未在 service happy-path 测试中验证
diff --git a/frontend/src/api/usr.ts b/frontend/src/api/usr.ts
index 0918529..3e28945 100644
--- a/frontend/src/api/usr.ts
+++ b/frontend/src/api/usr.ts
@@ -54,6 +54,7 @@ export interface UserListItemVO {
   sUserCode: string
   sUserType: string
   sLanguage: string
+  bCanEditDoc: number
   bIsDisabled: number
   tLastLoginDate: string | null
   sCreatorUsername: string | null
diff --git a/frontend/src/pages/usr/UserFormDrawer.tsx b/frontend/src/pages/usr/UserFormDrawer.tsx
index f15736e..872eb0c 100644
--- a/frontend/src/pages/usr/UserFormDrawer.tsx
+++ b/frontend/src/pages/usr/UserFormDrawer.tsx
@@ -11,6 +11,7 @@ interface InitialData {
   canEditDoc: boolean
   isDisabled: boolean
   employeeId?: string | null
+  permGroupIds?: string[]
 }
 
 interface Props {
@@ -42,7 +43,7 @@ export default function UserFormDrawer({ open, onClose, onSuccess, userId, initi
           isDisabled: initialData.isDisabled,
           employeeId: initialData.employeeId ?? null,
         })
-        setSelectedPermIds([])
+        setSelectedPermIds(initialData.permGroupIds ?? [])
       } else {
         form.resetFields()
         setSelectedPermIds([])
diff --git a/frontend/src/pages/usr/UserListPage.tsx b/frontend/src/pages/usr/UserListPage.tsx
index b60e859..1444727 100644
--- a/frontend/src/pages/usr/UserListPage.tsx
+++ b/frontend/src/pages/usr/UserListPage.tsx
@@ -121,7 +121,7 @@ export default function UserListPage() {
         initialData={editingUser ? {
           userType: editingUser.sUserType,
           language: editingUser.sLanguage,
-          canEditDoc: false,
+          canEditDoc: editingUser.bCanEditDoc === 1,
           isDisabled: editingUser.bIsDisabled === 1,
           employeeId: null,
         } : undefined}
diff --git a/frontend/src/test/UserListPage.test.tsx b/frontend/src/test/UserListPage.test.tsx
index 16206a6..75b502d 100644
--- a/frontend/src/test/UserListPage.test.tsx
+++ b/frontend/src/test/UserListPage.test.tsx
@@ -70,7 +70,7 @@ describe('UserListPage', () => {
       total: 1, page: 1, pageSize: 20,
       list: [{
         sId: 'u1', sUsername: 'alice', sUserCode: 'UC001', sUserType: '普通用户',
-        sLanguage: '中文', bIsDisabled: 0, tLastLoginDate: null,
+        sLanguage: '中文', bCanEditDoc: 0, bIsDisabled: 0, tLastLoginDate: null,
         sCreatorUsername: 'admin', tCreateDate: '2026-01-01T00:00:00',
         sStaffName: '张三', sDepartment: '研发部'
       }]
@@ -93,7 +93,7 @@ describe('UserListPage', () => {
       total: 1, page: 1, pageSize: 20,
       list: [{
         sId: 'u1', sUsername: 'alice', sUserCode: 'UC001', sUserType: '普通用户',
-        sLanguage: '中文', bIsDisabled: 0, tLastLoginDate: null,
+        sLanguage: '中文', bCanEditDoc: 0, bIsDisabled: 0, tLastLoginDate: null,
         sCreatorUsername: 'admin', tCreateDate: '2026-01-01T00:00:00',
         sStaffName: null, sDepartment: null
       }]