feat: site subscriptions export require download=1 safety valve

app/Http/Controllers/Admin/SiteSubscriptionController.php

@@ -211,6 +211,11 @@ class SiteSubscriptionController extends Controller
     {
         $this->ensurePlatformAdmin($request);
 
+        // 安全阀：必须显式声明 download=1，避免浏览器预取/误触发导致频繁导出
+        if ((string) $request->query('download', '') !== '1') {
+            abort(400, 'download=1 required');
+        }
+
         $filters = [
             'status' => trim((string) $request->query('status', '')),
             'keyword' => trim((string) $request->query('keyword', '')),

resources/views/admin/site_subscriptions/index.blade.php

@@ -131,6 +131,7 @@
     <h3>工具</h3>
     <div class="grid-2">
         <form method="get" action="/admin/site-subscriptions/export">
+            <input type="hidden" name="download" value="1">
             <input type="hidden" name="status" value="{{ $filters['status'] ?? '' }}">
             <input type="hidden" name="merchant_id" value="{{ $filters['merchant_id'] ?? '' }}">
             <input type="hidden" name="plan_id" value="{{ $filters['plan_id'] ?? '' }}">

tests/Feature/AdminSiteSubscriptionExportDownloadSafetyValveTest.php

@@ -0,0 +1,33 @@
+<?php
+
+namespace Tests\Feature;
+
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class AdminSiteSubscriptionExportDownloadSafetyValveTest extends TestCase
+{
+    use RefreshDatabase;
+
+    protected function loginAsPlatformAdmin(): void
+    {
+        $this->seed();
+
+        $this->post('/admin/login', [
+            'email' => 'platform.admin@demo.local',
+            'password' => 'Platform@123456',
+        ])->assertRedirect('/admin');
+    }
+
+    public function test_export_should_require_download_flag(): void
+    {
+        $this->loginAsPlatformAdmin();
+
+        $this->get('/admin/site-subscriptions/export')
+            ->assertStatus(400)
+            ->assertSee('download=1 required');
+
+        $this->get('/admin/site-subscriptions/export?download=1')
+            ->assertOk();
+    }
+}

tests/Feature/AdminSiteSubscriptionExportTest.php

@@ -53,7 +53,7 @@ class AdminSiteSubscriptionExportTest extends TestCase
             'activated_at' => now()->subDays(1),
         ]);
 
-        $res = $this->get('/admin/site-subscriptions/export');
+        $res = $this->get('/admin/site-subscriptions/export?download=1');
 
         $res->assertOk();
         $res->assertHeader('content-type', 'text/csv; charset=UTF-8');