From 092dc44bf1b0d66f7a53c3a27684d98936706c7f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E8=90=9D=E5=8D=9C?= <dev@saasshop.local>
Date: Fri, 13 Mar 2026 18:45:02 +0000
Subject: [PATCH] Enhance: site subscriptions index show safe back link

---
 .../admin/site_subscriptions/index.blade.php  | 10 +++++
 ...AdminSiteSubscriptionIndexBackLinkTest.php | 40 +++++++++++++++++++
 2 files changed, 50 insertions(+)
 create mode 100644 tests/Feature/AdminSiteSubscriptionIndexBackLinkTest.php

diff --git a/resources/views/admin/site_subscriptions/index.blade.php b/resources/views/admin/site_subscriptions/index.blade.php
index ed63023..a5cb96c 100644
--- a/resources/views/admin/site_subscriptions/index.blade.php
+++ b/resources/views/admin/site_subscriptions/index.blade.php
@@ -37,6 +37,16 @@
 <div class="card mb-20">
     <p class="muted muted-tight">这里是总台视角的订阅目录页，承接“套餐 -> 订阅 -> 平台订单”的收费主链中间层。</p>
     <p class="muted">当前阶段先做到：可访问列表、可筛选、统计摘要；后续再接：订阅激活服务 / 续费 / 取消 / 对账。</p>
+
+    @php
+        $incomingBack = (string) request()->query('back', '');
+        $safeBack = str_starts_with($incomingBack, '/') ? $incomingBack : '';
+    @endphp
+    @if($safeBack)
+        <div class="mt-10">
+            <a href="{{ $safeBack }}" class="muted">← 返回上一页（保留上下文）</a>
+        </div>
+    @endif
 </div>
 
 <div class="card mb-20">
diff --git a/tests/Feature/AdminSiteSubscriptionIndexBackLinkTest.php b/tests/Feature/AdminSiteSubscriptionIndexBackLinkTest.php
new file mode 100644
index 0000000..868b9c1
--- /dev/null
+++ b/tests/Feature/AdminSiteSubscriptionIndexBackLinkTest.php
@@ -0,0 +1,40 @@
+<?php
+
+namespace Tests\Feature;
+
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class AdminSiteSubscriptionIndexBackLinkTest extends TestCase
+{
+    use RefreshDatabase;
+
+    protected function loginAsPlatformAdmin(): void
+    {
+        $this->seed();
+
+        $this->post('/admin/login', [
+            'email' => 'platform.admin@demo.local',
+            'password' => 'Platform@123456',
+        ])->assertRedirect('/admin');
+    }
+
+    public function test_index_should_show_safe_back_link_when_back_is_relative_path(): void
+    {
+        $this->loginAsPlatformAdmin();
+
+        $this->get('/admin/site-subscriptions?status=activated&back=' . urlencode('/admin/platform-orders?status=pending'))
+            ->assertOk()
+            ->assertSee('返回上一页（保留上下文）')
+            ->assertSee('href="/admin/platform-orders?status=pending"', false);
+    }
+
+    public function test_index_should_not_show_back_link_when_back_is_external_url(): void
+    {
+        $this->loginAsPlatformAdmin();
+
+        $this->get('/admin/site-subscriptions?back=' . urlencode('https://evil.example.com/'))
+            ->assertOk()
+            ->assertDontSee('返回上一页（保留上下文）');
+    }
+}