From e6e99b86a6e864070df91546f61fb138dbde543e Mon Sep 17 00:00:00 2001
From: Jin Hai <haijin.chn@gmail.com>
Date: Sat, 11 Jul 2026 14:57:26 +0800
Subject: [PATCH] PY: fix admin error (#16827)

### Summary

Sync code from EE

Signed-off-by: Jin Hai <haijin.chn@gmail.com>
---
 admin/client/pyproject.toml | 2 +-
 admin/server/auth.py        | 6 +++---
 admin/server/routes.py      | 2 ++
 3 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/admin/client/pyproject.toml b/admin/client/pyproject.toml
index fa9cf04c5c..8c7cef1f01 100644
--- a/admin/client/pyproject.toml
+++ b/admin/client/pyproject.toml
@@ -8,7 +8,7 @@ readme = "README.md"
 requires-python = ">=3.13,<3.14"
 dependencies = [
     "requests>=2.30.0,<3.0.0",
-    "beartype>=0.20.0,<1.0.0",
+    "beartype>=0.22.9,<1.0.0",
     "pycryptodomex>=3.10.0",
     "lark>=1.1.0",
     "requests-toolbelt>=1.0.0",
diff --git a/admin/server/auth.py b/admin/server/auth.py
index 891020077a..6b140ac34f 100644
--- a/admin/server/auth.py
+++ b/admin/server/auth.py
@@ -152,13 +152,13 @@ def check_admin_auth(func):
 def login_admin(email: str, password: str):
     """
     :param email: admin email
-    :param password: string before decrypt
+    :param password: string before decrypt (RSA encrypted + base64 encoded)
     """
     users = UserService.query(email=email)
     if not users:
         raise UserNotFoundError(email)
-    psw = decrypt(password)
-    user = UserService.query_user(email, psw)
+    decrypted = decrypt(password)
+    user = UserService.query_user(email, decrypted)
     if not user:
         raise AdminException("Email and password do not match!")
     if not user.is_superuser:
diff --git a/admin/server/routes.py b/admin/server/routes.py
index 0313d8230b..f0a74ac7ee 100644
--- a/admin/server/routes.py
+++ b/admin/server/routes.py
@@ -153,6 +153,8 @@ def change_password(username):
 def alter_user_activate_status(username):
     try:
         data = request.get_json()
+        if current_user.email == username:
+            return error_response(f"can't alter current user status: {username}", 409)
         if not data or "activate_status" not in data:
             return error_response("Activation status is required", 400)
         activate_status = data["activate_status"]