fix: harden platform audit coverage

frontend/platform_admin/scripts/audit-check.test.mjs

@@ -27,6 +27,18 @@ test('扫描 API 和页面中用于展示或请求的内部 ID', () => {
   ]);
 });
 
+test('防护表达式不能掩盖同一行的内部 ID 泄漏', () => {
+  const failures = scanInternalIdLeaks(new Map([
+    ['src/views/leak.vue', "const visible = row.id; const safe = key !== 'id';"],
+    ['src/api/leak.ts', "send({ gas_basic_id: 7 }); const safe = key.endsWith('_id');"],
+  ]));
+
+  assert.deepEqual(failures, [
+    'src/views/leak.vue: internal identifier id',
+    'src/api/leak.ts: internal identifier gas_basic_id',
+  ]);
+});
+
 test('每个资源必须由带菜单元数据的路由实际加载对应页面', () => {
   const failures = auditPlatform({
     manifest: { resources: [{ domain: 'gas', name: 'gas_basic', path: '/gas/gas_basic', mode: 'writable', pageKind: 'list' }], routes: [
@@ -46,3 +58,37 @@ test('每个资源必须由带菜单元数据的路由实际加载对应页面',
 
   assert.deepEqual(failures, ['gas/gas_basic: missing menu route']);
 });
+
+test('仅追加处置必须挂在安全事件详情动作且不得有独立页面', () => {
+  const failures = auditPlatform({
+    manifest: { resources: [{ domain: 'safety', name: 'saf_event_disposal', path: '/safety/saf_event/:identity/disposals', mode: 'append_only', pageKind: 'list' }], routes: [
+      { method: 'GET', path: '/safety/saf_event/:identity/disposals' },
+      { method: 'POST', path: '/safety/saf_event/:identity/disposals' },
+    ] },
+    resources: [{ name: 'saf_event_disposal', resource: '/safety/saf_event/:identity/disposals', mode: 'append_only', pageKind: 'list', title: '事件处置', fields: [{ key: 'action', label: '处置动作' }] }],
+    readOnlyPage: '',
+    routeSources: [],
+    viewSources: new Map([['src/views/safety/saf_event_disposal/ListPage.vue', '<template />']]),
+    apiSources: new Map(),
+  });
+
+  assert.deepEqual(failures, [
+    'safety/saf_event_disposal: missing saf_event detail action',
+    'safety/saf_event_disposal: independent page exposed',
+  ]);
+});
+
+test('只读资源拒绝 API 或路由中的状态写入', () => {
+  const failures = auditPlatform({
+    manifest: { resources: [{ domain: 'wallet', name: 'wallet', path: '/wallet/wallet', mode: 'readonly', pageKind: 'list' }], routes: [
+      { method: 'GET', path: '/wallet/wallet' }, { method: 'GET', path: '/wallet/wallet/:identity' },
+    ] },
+    resources: [{ name: 'wallet', resource: '/wallet/wallet', mode: 'readonly', pageKind: 'list', title: '钱包', fields: [{ key: 'balance_amount', label: '余额' }] }],
+    readOnlyPage: '',
+    routeSources: ["{ component: () => import('@/views/wallet/wallet/ListPage.vue'), meta: { locale: 'menu.platform.wallet' } }"],
+    viewSources: new Map([['src/views/wallet/wallet/ListPage.vue', "getResource('/wallet/wallet')"]]),
+    apiSources: new Map([['src/api/wallet.ts', "resourceApi.updateStatus('/wallet/wallet', identity, 'disabled')"]]),
+  });
+
+  assert.deepEqual(failures, ['wallet/wallet: readonly status mutation in src/api/wallet.ts']);
+});