From 2e4c0c5ea8795917c0b1444931f6c512e680e75d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E8=90=9D=E5=8D=9C?= <dev@saasshop.local>
Date: Sun, 15 Mar 2026 03:05:42 +0000
Subject: [PATCH] PlatformOrder create: lock merchant/plan when subscription
 context present

---
 .../admin/platform_orders/form.blade.php      | 26 +++++--
 ...chantAndPlanWhenSubscriptionLockedTest.php | 67 +++++++++++++++++++
 2 files changed, 89 insertions(+), 4 deletions(-)
 create mode 100644 tests/Feature/AdminPlatformOrderCreateShouldDisableMerchantAndPlanWhenSubscriptionLockedTest.php

diff --git a/resources/views/admin/platform_orders/form.blade.php b/resources/views/admin/platform_orders/form.blade.php
index 1ecf4b2..476d242 100644
--- a/resources/views/admin/platform_orders/form.blade.php
+++ b/resources/views/admin/platform_orders/form.blade.php
@@ -79,27 +79,45 @@
         <input type="hidden" name="back" value="{{ $backValSafe }}">
     @endif
 
+    @php
+        $hasLockedSubscription = (bool) (($siteSubscription ?? null) && ($siteSubscription->id ?? 0));
+        $merchantIdVal = (string) old('merchant_id', $defaults['merchant_id'] ?? '');
+        $planIdVal = (string) old('plan_id', $defaults['plan_id'] ?? '');
+    @endphp
+
     <label>
         <span>站点</span>
-        <select name="merchant_id" required>
+        @if($hasLockedSubscription)
+            <input type="hidden" name="merchant_id" value="{{ $merchantIdVal }}">
+        @endif
+        <select name="merchant_id" required @disabled($hasLockedSubscription)>
             <option value="">请选择站点</option>
             @foreach(($merchants ?? []) as $m)
-                <option value="{{ $m->id }}" @selected((string)old('merchant_id', $defaults['merchant_id'] ?? '') === (string)$m->id)>{{ $m->name }}</option>
+                <option value="{{ $m->id }}" @selected($merchantIdVal === (string)$m->id)>{{ $m->name }}</option>
             @endforeach
         </select>
+        @if($hasLockedSubscription)
+            <small class="muted">已从订阅上下文锁定站点（避免误选导致续费串单）。</small>
+        @endif
     </label>
 
     <label>
         <span>套餐</span>
-        <select name="plan_id" required>
+        @if($hasLockedSubscription)
+            <input type="hidden" name="plan_id" value="{{ $planIdVal }}">
+        @endif
+        <select name="plan_id" required @disabled($hasLockedSubscription)>
             <option value="">请选择套餐</option>
             @foreach(($plans ?? []) as $p)
-                <option value="{{ $p->id }}" @selected((string)old('plan_id', $defaults['plan_id'] ?? '') === (string)$p->id)>
+                <option value="{{ $p->id }}" @selected($planIdVal === (string)$p->id)>
                     {{ $p->name }}（{{ $billingCycleLabels[$p->billing_cycle] ?? $p->billing_cycle }} / ¥{{ number_format((float)$p->price, 2) }}）
                 </option>
             @endforeach
         </select>
         <small class="muted">订单会写入套餐快照（plan_name / billing_cycle / plan_snapshot），便于后续套餐变更时追溯。</small>
+        @if($hasLockedSubscription)
+            <small class="muted">已从订阅上下文锁定套餐（当前阶段不支持跨套餐续费；升级/降级后续再建）。</small>
+        @endif
     </label>
 
     <label>
diff --git a/tests/Feature/AdminPlatformOrderCreateShouldDisableMerchantAndPlanWhenSubscriptionLockedTest.php b/tests/Feature/AdminPlatformOrderCreateShouldDisableMerchantAndPlanWhenSubscriptionLockedTest.php
new file mode 100644
index 0000000..68e45f0
--- /dev/null
+++ b/tests/Feature/AdminPlatformOrderCreateShouldDisableMerchantAndPlanWhenSubscriptionLockedTest.php
@@ -0,0 +1,67 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\Merchant;
+use App\Models\Plan;
+use App\Models\SiteSubscription;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class AdminPlatformOrderCreateShouldDisableMerchantAndPlanWhenSubscriptionLockedTest extends TestCase
+{
+    use RefreshDatabase;
+
+    protected function loginAsPlatformAdmin(): void
+    {
+        $this->seed();
+
+        $this->post('/admin/login', [
+            'email' => 'platform.admin@demo.local',
+            'password' => 'Platform@123456',
+        ])->assertRedirect('/admin');
+    }
+
+    public function test_create_should_disable_merchant_and_plan_selects_when_subscription_present(): void
+    {
+        $this->loginAsPlatformAdmin();
+
+        $merchant = Merchant::query()->firstOrFail();
+        $plan = Plan::query()->create([
+            'code' => 'po_create_lock_plan',
+            'name' => '创建订单锁定站点套餐测试套餐',
+            'billing_cycle' => 'monthly',
+            'price' => 10,
+            'list_price' => 10,
+            'status' => 'active',
+            'sort' => 10,
+            'published_at' => now(),
+        ]);
+
+        $sub = SiteSubscription::query()->create([
+            'merchant_id' => $merchant->id,
+            'plan_id' => $plan->id,
+            'status' => 'activated',
+            'source' => 'manual',
+            'subscription_no' => 'SUB_LOCK_0001',
+            'plan_name' => $plan->name,
+            'billing_cycle' => $plan->billing_cycle,
+            'period_months' => 1,
+            'amount' => 10,
+            'starts_at' => now()->subDay(),
+            'ends_at' => now()->addMonth(),
+            'activated_at' => now()->subDay(),
+        ]);
+
+        $res = $this->get('/admin/platform-orders/create?site_subscription_id=' . $sub->id);
+        $res->assertOk();
+
+        // select disabled
+        $res->assertSee('select name="merchant_id" required disabled', false);
+        $res->assertSee('select name="plan_id" required disabled', false);
+
+        // hidden inputs should exist to ensure values are still submitted
+        $res->assertSee('type="hidden" name="merchant_id" value="' . $merchant->id . '"', false);
+        $res->assertSee('type="hidden" name="plan_id" value="' . $plan->id . '"', false);
+    }
+}