From dcf1e3d226cd384414a535e0c998edde00750383 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E8=90=9D=E5=8D=9C?= <dev@saasshop.local>
Date: Fri, 13 Mar 2026 21:05:23 +0000
Subject: [PATCH] =?UTF-8?q?=E5=AF=B9=E8=B4=A6=E6=98=8E=E7=BB=86=E5=AF=BC?=
 =?UTF-8?q?=E5=87=BA=EF=BC=9A=E5=A2=9E=E5=8A=A0=20download=3D1=20=E5=AE=89?=
 =?UTF-8?q?=E5=85=A8=E9=98=80=E5=B9=B6=E8=A1=A5=E6=8A=A4=E6=A0=8F=E6=B5=8B?=
 =?UTF-8?q?=E8=AF=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../Admin/PlatformOrderController.php         |  5 ++
 .../admin/platform_orders/show.blade.php      |  4 +-
 ...derExportLedgerDownloadSafetyValveTest.php | 61 +++++++++++++++++++
 .../AdminPlatformOrderExportLedgerTest.php    |  8 +--
 4 files changed, 72 insertions(+), 6 deletions(-)
 create mode 100644 tests/Feature/AdminPlatformOrderExportLedgerDownloadSafetyValveTest.php

diff --git a/app/Http/Controllers/Admin/PlatformOrderController.php b/app/Http/Controllers/Admin/PlatformOrderController.php
index 3c9f5db..e0ea3ec 100644
--- a/app/Http/Controllers/Admin/PlatformOrderController.php
+++ b/app/Http/Controllers/Admin/PlatformOrderController.php
@@ -421,6 +421,11 @@ class PlatformOrderController extends Controller
     {
         $this->ensurePlatformAdmin($request);
 
+        // 安全阀：必须显式声明 download=1，避免浏览器预取/误触发导致频繁导出
+        if ((string) $request->query('download', '') !== '1') {
+            abort(400, 'download=1 required');
+        }
+
         $order->loadMissing(['merchant', 'plan', 'siteSubscription']);
 
         $paymentReceipts = (array) (data_get($order->meta, 'payment_receipts', []) ?? []);
diff --git a/resources/views/admin/platform_orders/show.blade.php b/resources/views/admin/platform_orders/show.blade.php
index 82dbdd8..ebd17da 100644
--- a/resources/views/admin/platform_orders/show.blade.php
+++ b/resources/views/admin/platform_orders/show.blade.php
@@ -327,8 +327,8 @@
     <div class="flex-between" style="align-items:center;">
         <h3 style="margin:0;">支付回执（对账留痕）</h3>
         <div class="muted" style="display:flex; gap:10px;">
-            <a class="muted" href="/admin/platform-orders/{{ $order->id }}/export-ledger">导出对账明细（CSV）</a>
-            <a class="muted" href="/admin/platform-orders/{{ $order->id }}/export-ledger?include_order_snapshot=1">导出含订单摘要（CSV）</a>
+            <a class="muted" href="/admin/platform-orders/{{ $order->id }}/export-ledger?download=1">导出对账明细（CSV）</a>
+            <a class="muted" href="/admin/platform-orders/{{ $order->id }}/export-ledger?download=1&include_order_snapshot=1">导出含订单摘要（CSV）</a>
         </div>
     </div>
     <p class="muted muted-tight">用于“线下收款/转账/人工核对”的留痕记录（当前阶段先落 meta，不引入独立表）。</p>
diff --git a/tests/Feature/AdminPlatformOrderExportLedgerDownloadSafetyValveTest.php b/tests/Feature/AdminPlatformOrderExportLedgerDownloadSafetyValveTest.php
new file mode 100644
index 0000000..599d774
--- /dev/null
+++ b/tests/Feature/AdminPlatformOrderExportLedgerDownloadSafetyValveTest.php
@@ -0,0 +1,61 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\Merchant;
+use App\Models\Plan;
+use App\Models\PlatformOrder;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class AdminPlatformOrderExportLedgerDownloadSafetyValveTest extends TestCase
+{
+    use RefreshDatabase;
+
+    protected function loginAsPlatformAdmin(): void
+    {
+        $this->seed();
+
+        $this->post('/admin/login', [
+            'email' => 'platform.admin@demo.local',
+            'password' => 'Platform@123456',
+        ])->assertRedirect('/admin');
+    }
+
+    public function test_export_ledger_should_require_download_flag(): void
+    {
+        $this->loginAsPlatformAdmin();
+
+        $merchant = Merchant::query()->firstOrFail();
+        $plan = Plan::query()->create([
+            'code' => 'po_export_ledger_safety_valve_plan',
+            'name' => '平台订单导出对账明细 download 安全阀测试套餐',
+            'billing_cycle' => 'monthly',
+            'price' => 10,
+            'list_price' => 10,
+            'status' => 'active',
+            'sort' => 10,
+            'published_at' => now(),
+        ]);
+
+        $order = PlatformOrder::query()->create([
+            'merchant_id' => $merchant->id,
+            'plan_id' => $plan->id,
+            'order_no' => 'PO_EXPORT_LEDGER_SAFETY_0001',
+            'order_type' => 'new_purchase',
+            'status' => 'pending',
+            'payment_status' => 'unpaid',
+            'plan_name' => $plan->name,
+            'billing_cycle' => $plan->billing_cycle,
+            'period_months' => 1,
+            'quantity' => 1,
+            'payable_amount' => 10,
+            'paid_amount' => 0,
+            'placed_at' => now(),
+            'meta' => [],
+        ]);
+
+        $this->get('/admin/platform-orders/' . $order->id . '/export-ledger')->assertStatus(400);
+        $this->get('/admin/platform-orders/' . $order->id . '/export-ledger?download=1')->assertOk();
+    }
+}
diff --git a/tests/Feature/AdminPlatformOrderExportLedgerTest.php b/tests/Feature/AdminPlatformOrderExportLedgerTest.php
index 01a3c26..6d4674f 100644
--- a/tests/Feature/AdminPlatformOrderExportLedgerTest.php
+++ b/tests/Feature/AdminPlatformOrderExportLedgerTest.php
@@ -78,12 +78,12 @@ class AdminPlatformOrderExportLedgerTest extends TestCase
             ],
         ]);
 
-        $res = $this->get('/admin/platform-orders/' . $order->id . '/export-ledger');
+        $res = $this->get('/admin/platform-orders/' . $order->id . '/export-ledger?download=1');
         $res->assertOk();
 
         $content = $res->streamedContent();
 
-        $res2 = $this->get('/admin/platform-orders/' . $order->id . '/export-ledger?include_order_snapshot=1');
+        $res2 = $this->get('/admin/platform-orders/' . $order->id . '/export-ledger?download=1&include_order_snapshot=1');
         $res2->assertOk();
 
         $content2 = $res2->streamedContent();
@@ -146,8 +146,8 @@ class AdminPlatformOrderExportLedgerTest extends TestCase
         $res = $this->get('/admin/platform-orders/' . $order->id);
         $res->assertOk();
 
-        $res->assertSee('/admin/platform-orders/' . $order->id . '/export-ledger', false);
-        $res->assertSee('/admin/platform-orders/' . $order->id . '/export-ledger?include_order_snapshot=1', false);
+        $res->assertSee('/admin/platform-orders/' . $order->id . '/export-ledger?download=1', false);
+        $res->assertSee('/admin/platform-orders/' . $order->id . '/export-ledger?download=1&include_order_snapshot=1', false);
         $res->assertSee('导出对账明细（CSV）', false);
         $res->assertSee('导出含订单摘要（CSV）', false);
     }