diff --git a/resources/views/admin/platform_orders/index.blade.php b/resources/views/admin/platform_orders/index.blade.php index 41c9f66..b0cb2eb 100644 --- a/resources/views/admin/platform_orders/index.blade.php +++ b/resources/views/admin/platform_orders/index.blade.php @@ -1544,7 +1544,7 @@ @endif -
+ @csrf
@@ -1552,12 +1552,12 @@ @php $canMarkActivatedOnly = ($order->payment_status === 'paid') && ($order->status !== 'activated'); @endphp -
+ @csrf
-
+ @csrf
diff --git a/tests/Feature/AdminPlatformOrderIndexRowActionFormsShouldDisableOnSubmitTest.php b/tests/Feature/AdminPlatformOrderIndexRowActionFormsShouldDisableOnSubmitTest.php new file mode 100644 index 0000000..59a87a5 --- /dev/null +++ b/tests/Feature/AdminPlatformOrderIndexRowActionFormsShouldDisableOnSubmitTest.php @@ -0,0 +1,69 @@ +seed(); + + $this->post('/admin/login', [ + 'email' => 'platform.admin@demo.local', + 'password' => 'Platform@123456', + ])->assertRedirect('/admin'); + } + + public function test_platform_orders_index_row_action_forms_should_have_disable_on_submit_marker(): void + { + $this->loginAsPlatformAdmin(); + + $merchant = Merchant::query()->firstOrFail(); + $plan = Plan::query()->create([ + 'code' => 'po_index_row_disable_submit_plan_01', + 'name' => '平台订单列表行内动作防重复提交测试套餐', + 'billing_cycle' => 'monthly', + 'price' => 10, + 'list_price' => 10, + 'status' => 'active', + 'sort' => 10, + 'published_at' => now(), + ]); + + $order = PlatformOrder::query()->create([ + 'merchant_id' => $merchant->id, + 'plan_id' => $plan->id, + 'order_no' => 'PO_INDEX_ROW_DISABLE_SUBMIT_0001', + 'order_type' => 'new_purchase', + 'status' => 'pending', + 'payment_status' => 'unpaid', + 'plan_name' => $plan->name, + 'billing_cycle' => $plan->billing_cycle, + 'period_months' => 1, + 'quantity' => 1, + 'payable_amount' => 10, + 'paid_amount' => 0, + 'placed_at' => now(), + ]); + + $res = $this->get('/admin/platform-orders'); + $res->assertOk(); + + $html = (string) $res->getContent(); + + // 行内动作表单(高风险动作):必须具备防重复提交标记。 + $this->assertStringContainsString('action="/admin/platform-orders/' . $order->id . '/mark-paid-and-activate"', $html); + $this->assertStringContainsString('action="/admin/platform-orders/' . $order->id . '/mark-activated"', $html); + $this->assertStringContainsString('action="/admin/platform-orders/' . $order->id . '/activate-subscription"', $html); + + $this->assertStringContainsString('data-action="disable-on-submit"', $html); + } +}