feat(platform): 线索/订单页增加 back 与来源线索上下文提示

resources/views/admin/platform_leads/index.blade.php

@@ -5,6 +5,16 @@
 
 @section('content')
 @php
+    $incomingBack = (string) request()->query('back', '');
+    // 为避免 & 被 Blade escape 成 & 导致回退上下文丢失，这里需要原样输出 href。
+    // 安全护栏：必须为站内相对路径，并拒绝引号/尖括号，且拒绝 nested back。
+    $safeBack = (str_starts_with($incomingBack, '/')
+        && !preg_match('/["\'<>]/', $incomingBack)
+        && !preg_match('/(?:^|[?&])back=/', $incomingBack))
+        ? $incomingBack
+        : '';
+
+
     // back 参数用于“返回上一页（保留上下文）”，但 back 本身不应再包含 back（避免无限嵌套导致 URL 膨胀）
     $currentQuery = request()->query();
     unset($currentQuery['back']);
@@ -50,6 +60,12 @@
 
 <div class="card mb-20">
     <p class="muted muted-tight">对外平台（/platform）收集的开通意向线索，用于前期 A（站点开通型）人工运营承接。</p>
+
+    @if($safeBack)
+        <div class="mt-10">
+            <a href="{!! $safeBack !!}" class="muted">← 返回上一页（保留上下文）</a>
+        </div>
+    @endif
     <p class="muted">后续会在此处逐步接入：一键生成站点/订阅/平台订单、跟进记录、转化漏斗与治理提示。</p>
 </div>
 

resources/views/admin/platform_orders/show.blade.php

@@ -32,6 +32,23 @@
 @endphp
 <div class="card mb-20">
     <p class="muted muted-tight">这里用于运营排查：订单核心字段、关联订阅、以及订阅同步元数据（meta）。</p>
+
+    @php
+        $platformLeadId = (int) (data_get($order->meta, 'platform_lead_id') ?? 0);
+        $leadIndexUrl = '';
+        if ($platformLeadId > 0) {
+            $leadIndexUrl = '/admin/platform-leads?' . \Illuminate\Support\Arr::query([
+                'lead_id' => $platformLeadId,
+                'back' => $orderShowSelf,
+            ]);
+        }
+    @endphp
+    @if($platformLeadId > 0)
+        <div class="mt-10 actions">
+            <span class="badge">来源线索：#{{ $platformLeadId }}</span>
+            <a class="btn-secondary btn-sm" href="{!! $leadIndexUrl !!}">查看线索</a>
+        </div>
+    @endif
 </div>
 
 <div class="card mb-20">

tests/Feature/AdminPlatformLeadIndexBackLinkNotEscapedTest.php

@@ -0,0 +1,43 @@
+<?php
+
+namespace Tests\Feature;
+
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Arr;
+use Tests\TestCase;
+
+class AdminPlatformLeadIndexBackLinkNotEscapedTest extends TestCase
+{
+    use RefreshDatabase;
+
+    protected function loginAsPlatformAdmin(): void
+    {
+        $this->seed();
+
+        $this->post('/admin/login', [
+            'email' => 'platform.admin@demo.local',
+            'password' => 'Platform@123456',
+        ])->assertRedirect('/admin');
+    }
+
+    public function test_index_should_render_back_link_with_ampersand_not_escaped(): void
+    {
+        $this->loginAsPlatformAdmin();
+
+        $back = '/admin/platform-orders?' . Arr::query([
+            'lead_id' => 12,
+            'payment_status' => 'paid',
+        ]);
+
+        $url = '/admin/platform-leads?' . Arr::query([
+            'back' => $back,
+        ]);
+
+        $res = $this->get($url);
+        $res->assertOk();
+
+        $res->assertSee('← 返回上一页（保留上下文）', false);
+        $res->assertSee('href="' . $back . '"', false);
+        $res->assertDontSee('&amp;', false);
+    }
+}

tests/Feature/AdminPlatformOrderShowLeadContextLinkTest.php

@@ -0,0 +1,92 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\Merchant;
+use App\Models\Plan;
+use App\Models\PlatformLead;
+use App\Models\PlatformOrder;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Arr;
+use Tests\TestCase;
+
+class AdminPlatformOrderShowLeadContextLinkTest extends TestCase
+{
+    use RefreshDatabase;
+
+    protected function loginAsPlatformAdmin(): void
+    {
+        $this->seed();
+
+        $this->post('/admin/login', [
+            'email' => 'platform.admin@demo.local',
+            'password' => 'Platform@123456',
+        ])->assertRedirect('/admin');
+    }
+
+    public function test_show_should_render_lead_context_badge_and_view_link(): void
+    {
+        $this->loginAsPlatformAdmin();
+
+        $merchant = Merchant::query()->firstOrFail();
+
+        $plan = Plan::query()->create([
+            'code' => 'order_show_lead_plan',
+            'name' => '订单详情线索提示测试套餐',
+            'billing_cycle' => 'monthly',
+            'price' => 10,
+            'list_price' => 10,
+            'status' => 'active',
+            'sort' => 10,
+            'published_at' => now(),
+        ]);
+
+        $lead = PlatformLead::query()->create([
+            'name' => '订单详情线索',
+            'mobile' => '',
+            'email' => '',
+            'company' => '',
+            'source' => 'test',
+            'status' => 'new',
+            'plan_id' => $plan->id,
+            'meta' => ['from' => 'test'],
+        ]);
+
+        $order = PlatformOrder::query()->create([
+            'merchant_id' => $merchant->id,
+            'plan_id' => $plan->id,
+            'site_subscription_id' => null,
+            'created_by_admin_id' => 1,
+            'order_no' => 'PO_SHOW_LEAD_0001',
+            'order_type' => 'new_purchase',
+            'status' => 'pending',
+            'payment_status' => 'unpaid',
+            'payment_channel' => null,
+            'plan_name' => $plan->name,
+            'billing_cycle' => $plan->billing_cycle,
+            'period_months' => 1,
+            'quantity' => 1,
+            'list_amount' => 10,
+            'discount_amount' => 0,
+            'payable_amount' => 10,
+            'paid_amount' => 0,
+            'placed_at' => now(),
+            'plan_snapshot' => ['plan_id' => $plan->id],
+            'meta' => ['platform_lead_id' => $lead->id],
+            'remark' => 'from lead',
+        ]);
+
+        $res = $this->get('/admin/platform-orders/' . $order->id);
+        $res->assertOk();
+
+        $res->assertSee('来源线索：#' . $lead->id, false);
+
+        $expectedLeadUrl = '/admin/platform-leads?' . Arr::query([
+            'lead_id' => $lead->id,
+            'back' => '/admin/platform-orders/' . $order->id,
+        ]);
+
+        $res->assertSee('href="' . $expectedLeadUrl . '"', false);
+        $res->assertSee('查看线索', false);
+    }
+}