Prevent class from being changed via PUT /user

test/api/user/PUT-user.test.js

@@ -53,4 +53,23 @@ describe.only('PUT /user', () => {
       });
     });
   });
+
+  context('sub-level protected paths', () => {
+    let protectedPaths = {
+      'class stat': {'stats.class': 'wizard'},
+    };
+
+    each(protectedPaths, (data, testName) => {
+      it(`does not allow updating ${testName}`, () => {
+        let errorText = [];
+        each(data, (value, path) => {
+          errorText.push(`path \`${path}\` was not saved, as it's a protected path. See https://github.com/HabitRPG/habitrpg/blob/develop/API.md for PUT /api/v2/user.`);
+        });
+        return expect(api.put('/user', data)).to.eventually.be.rejected.and.eql({
+          code: 401,
+          text: errorText,
+        });
+      });
+    });
+  });
 });