feat: plans export require download=1 safety valve

app/Http/Controllers/Admin/PlanController.php

@@ -22,6 +22,11 @@ class PlanController extends Controller
     {
         $this->ensurePlatformAdmin($request);
 
+        // 安全阀：必须显式声明 download=1，避免浏览器预取/误触发导致频繁导出
+        if ((string) $request->query('download', '') !== '1') {
+            abort(400, 'download=1 required');
+        }
+
         $filters = [
             'status' => trim((string) $request->query('status', '')),
             'billing_cycle' => trim((string) $request->query('billing_cycle', '')),

resources/views/admin/plans/index.blade.php

@@ -45,6 +45,7 @@
     <h3>工具</h3>
     <div class="grid-2">
         <form method="get" action="/admin/plans/export">
+            <input type="hidden" name="download" value="1">
             <input type="hidden" name="status" value="{{ $filters['status'] ?? '' }}">
             <input type="hidden" name="published" value="{{ $filters['published'] ?? '' }}">
             <input type="hidden" name="billing_cycle" value="{{ $filters['billing_cycle'] ?? '' }}">

tests/Feature/AdminPlanExportDownloadSafetyValveTest.php

@@ -0,0 +1,33 @@
+<?php
+
+namespace Tests\Feature;
+
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class AdminPlanExportDownloadSafetyValveTest extends TestCase
+{
+    use RefreshDatabase;
+
+    protected function loginAsPlatformAdmin(): void
+    {
+        $this->seed();
+
+        $this->post('/admin/login', [
+            'email' => 'platform.admin@demo.local',
+            'password' => 'Platform@123456',
+        ])->assertRedirect('/admin');
+    }
+
+    public function test_export_should_require_download_flag(): void
+    {
+        $this->loginAsPlatformAdmin();
+
+        $this->get('/admin/plans/export')
+            ->assertStatus(400)
+            ->assertSee('download=1 required');
+
+        $this->get('/admin/plans/export?download=1')
+            ->assertOk();
+    }
+}

tests/Feature/AdminPlanExportTest.php

@@ -36,7 +36,7 @@ class AdminPlanExportTest extends TestCase
             'description' => '用于导出断言',
         ]);
 
-        $res = $this->get('/admin/plans/export');
+        $res = $this->get('/admin/plans/export?download=1');
 
         $res->assertOk();
         $res->assertHeader('content-type', 'text/csv; charset=UTF-8');