对账明细导出：增加 download=1 安全阀并补护栏测试

app/Http/Controllers/Admin/PlatformOrderController.php

@@ -421,6 +421,11 @@ class PlatformOrderController extends Controller
     {
         $this->ensurePlatformAdmin($request);
 
+        // 安全阀：必须显式声明 download=1，避免浏览器预取/误触发导致频繁导出
+        if ((string) $request->query('download', '') !== '1') {
+            abort(400, 'download=1 required');
+        }
+
         $order->loadMissing(['merchant', 'plan', 'siteSubscription']);
 
         $paymentReceipts = (array) (data_get($order->meta, 'payment_receipts', []) ?? []);

resources/views/admin/platform_orders/show.blade.php

@@ -327,8 +327,8 @@
     <div class="flex-between" style="align-items:center;">
         <h3 style="margin:0;">支付回执（对账留痕）</h3>
         <div class="muted" style="display:flex; gap:10px;">
-            <a class="muted" href="/admin/platform-orders/{{ $order->id }}/export-ledger">导出对账明细（CSV）</a>
+            <a class="muted" href="/admin/platform-orders/{{ $order->id }}/export-ledger?download=1">导出对账明细（CSV）</a>
-            <a class="muted" href="/admin/platform-orders/{{ $order->id }}/export-ledger?include_order_snapshot=1">导出含订单摘要（CSV）</a>
+            <a class="muted" href="/admin/platform-orders/{{ $order->id }}/export-ledger?download=1&include_order_snapshot=1">导出含订单摘要（CSV）</a>
         </div>
     </div>
     <p class="muted muted-tight">用于“线下收款/转账/人工核对”的留痕记录（当前阶段先落 meta，不引入独立表）。</p>

tests/Feature/AdminPlatformOrderExportLedgerDownloadSafetyValveTest.php

@@ -0,0 +1,61 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\Merchant;
+use App\Models\Plan;
+use App\Models\PlatformOrder;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class AdminPlatformOrderExportLedgerDownloadSafetyValveTest extends TestCase
+{
+    use RefreshDatabase;
+
+    protected function loginAsPlatformAdmin(): void
+    {
+        $this->seed();
+
+        $this->post('/admin/login', [
+            'email' => 'platform.admin@demo.local',
+            'password' => 'Platform@123456',
+        ])->assertRedirect('/admin');
+    }
+
+    public function test_export_ledger_should_require_download_flag(): void
+    {
+        $this->loginAsPlatformAdmin();
+
+        $merchant = Merchant::query()->firstOrFail();
+        $plan = Plan::query()->create([
+            'code' => 'po_export_ledger_safety_valve_plan',
+            'name' => '平台订单导出对账明细 download 安全阀测试套餐',
+            'billing_cycle' => 'monthly',
+            'price' => 10,
+            'list_price' => 10,
+            'status' => 'active',
+            'sort' => 10,
+            'published_at' => now(),
+        ]);
+
+        $order = PlatformOrder::query()->create([
+            'merchant_id' => $merchant->id,
+            'plan_id' => $plan->id,
+            'order_no' => 'PO_EXPORT_LEDGER_SAFETY_0001',
+            'order_type' => 'new_purchase',
+            'status' => 'pending',
+            'payment_status' => 'unpaid',
+            'plan_name' => $plan->name,
+            'billing_cycle' => $plan->billing_cycle,
+            'period_months' => 1,
+            'quantity' => 1,
+            'payable_amount' => 10,
+            'paid_amount' => 0,
+            'placed_at' => now(),
+            'meta' => [],
+        ]);
+
+        $this->get('/admin/platform-orders/' . $order->id . '/export-ledger')->assertStatus(400);
+        $this->get('/admin/platform-orders/' . $order->id . '/export-ledger?download=1')->assertOk();
+    }
+}

tests/Feature/AdminPlatformOrderExportLedgerTest.php

@@ -78,12 +78,12 @@ class AdminPlatformOrderExportLedgerTest extends TestCase
             ],
         ]);
 
-        $res = $this->get('/admin/platform-orders/' . $order->id . '/export-ledger');
+        $res = $this->get('/admin/platform-orders/' . $order->id . '/export-ledger?download=1');
         $res->assertOk();
 
         $content = $res->streamedContent();
 
-        $res2 = $this->get('/admin/platform-orders/' . $order->id . '/export-ledger?include_order_snapshot=1');
+        $res2 = $this->get('/admin/platform-orders/' . $order->id . '/export-ledger?download=1&include_order_snapshot=1');
         $res2->assertOk();
 
         $content2 = $res2->streamedContent();
@@ -146,8 +146,8 @@ class AdminPlatformOrderExportLedgerTest extends TestCase
         $res = $this->get('/admin/platform-orders/' . $order->id);
         $res->assertOk();
 
-        $res->assertSee('/admin/platform-orders/' . $order->id . '/export-ledger', false);
+        $res->assertSee('/admin/platform-orders/' . $order->id . '/export-ledger?download=1', false);
-        $res->assertSee('/admin/platform-orders/' . $order->id . '/export-ledger?include_order_snapshot=1', false);
+        $res->assertSee('/admin/platform-orders/' . $order->id . '/export-ledger?download=1&include_order_snapshot=1', false);
         $res->assertSee('导出对账明细（CSV）', false);
         $res->assertSee('导出含订单摘要（CSV）', false);
     }