chore(admin-platform-orders): disable on submit for index action forms

resources/views/admin/platform_orders/index.blade.php

@@ -1544,7 +1544,7 @@
                         </div>
                     @endif
 
-                    <form method="post" action="/admin/platform-orders/{{ $order->id }}/mark-paid-and-activate" onsubmit="return confirm('确认将该订单标记为已支付并生效？此操作会推进状态并尝试同步订阅');" class="mb-6">
+                    <form method="post" action="/admin/platform-orders/{{ $order->id }}/mark-paid-and-activate" data-action="disable-on-submit" onsubmit="return confirm('确认将该订单标记为已支付并生效？此操作会推进状态并尝试同步订阅');" class="mb-6">
                         @csrf
                         <button class="btn btn-sm" type="submit" @disabled(! $canMarkPaid)>标记支付并生效</button>
                     </form>
@@ -1552,12 +1552,12 @@
                     @php
                         $canMarkActivatedOnly = ($order->payment_status === 'paid') && ($order->status !== 'activated');
                     @endphp
-                    <form method="post" action="/admin/platform-orders/{{ $order->id }}/mark-activated" onsubmit="return confirm('确认将该订单标记为已生效？（不修改支付状态，不自动同步订阅）');" class="mb-6">
+                    <form method="post" action="/admin/platform-orders/{{ $order->id }}/mark-activated" data-action="disable-on-submit" onsubmit="return confirm('确认将该订单标记为已生效？（不修改支付状态，不自动同步订阅）');" class="mb-6">
                         @csrf
                         <button class="btn btn-secondary btn-sm" type="submit" @disabled(! $canMarkActivatedOnly)>仅标记为已生效</button>
                     </form>
 
-                    <form method="post" action="/admin/platform-orders/{{ $order->id }}/activate-subscription" onsubmit="return confirm('确认同步订阅？将根据该订单创建/续期订阅');">
+                    <form method="post" action="/admin/platform-orders/{{ $order->id }}/activate-subscription" data-action="disable-on-submit" onsubmit="return confirm('确认同步订阅？将根据该订单创建/续期订阅');">
                         @csrf
                         <button class="btn btn-secondary btn-sm" type="submit" @disabled(! $canActivate || $alreadySynced)>{{ $alreadySynced ? '已同步' : '同步订阅' }}</button>
                     </form>

tests/Feature/AdminPlatformOrderIndexRowActionFormsShouldDisableOnSubmitTest.php

@@ -0,0 +1,69 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\Merchant;
+use App\Models\Plan;
+use App\Models\PlatformOrder;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class AdminPlatformOrderIndexRowActionFormsShouldDisableOnSubmitTest extends TestCase
+{
+    use RefreshDatabase;
+
+    protected function loginAsPlatformAdmin(): void
+    {
+        $this->seed();
+
+        $this->post('/admin/login', [
+            'email' => 'platform.admin@demo.local',
+            'password' => 'Platform@123456',
+        ])->assertRedirect('/admin');
+    }
+
+    public function test_platform_orders_index_row_action_forms_should_have_disable_on_submit_marker(): void
+    {
+        $this->loginAsPlatformAdmin();
+
+        $merchant = Merchant::query()->firstOrFail();
+        $plan = Plan::query()->create([
+            'code' => 'po_index_row_disable_submit_plan_01',
+            'name' => '平台订单列表行内动作防重复提交测试套餐',
+            'billing_cycle' => 'monthly',
+            'price' => 10,
+            'list_price' => 10,
+            'status' => 'active',
+            'sort' => 10,
+            'published_at' => now(),
+        ]);
+
+        $order = PlatformOrder::query()->create([
+            'merchant_id' => $merchant->id,
+            'plan_id' => $plan->id,
+            'order_no' => 'PO_INDEX_ROW_DISABLE_SUBMIT_0001',
+            'order_type' => 'new_purchase',
+            'status' => 'pending',
+            'payment_status' => 'unpaid',
+            'plan_name' => $plan->name,
+            'billing_cycle' => $plan->billing_cycle,
+            'period_months' => 1,
+            'quantity' => 1,
+            'payable_amount' => 10,
+            'paid_amount' => 0,
+            'placed_at' => now(),
+        ]);
+
+        $res = $this->get('/admin/platform-orders');
+        $res->assertOk();
+
+        $html = (string) $res->getContent();
+
+        // 行内动作表单（高风险动作）：必须具备防重复提交标记。
+        $this->assertStringContainsString('action="/admin/platform-orders/' . $order->id . '/mark-paid-and-activate"', $html);
+        $this->assertStringContainsString('action="/admin/platform-orders/' . $order->id . '/mark-activated"', $html);
+        $this->assertStringContainsString('action="/admin/platform-orders/' . $order->id . '/activate-subscription"', $html);
+
+        $this->assertStringContainsString('data-action="disable-on-submit"', $html);
+    }
+}