fix: complete platform admin audit remediation

frontend/platform_admin/scripts/audit-check.test.mjs

@@ -0,0 +1,48 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { auditPlatform, scanInternalIdLeaks } from './audit-check.mjs';
+
+test('只读页面将状态变更视为违规写操作', () => {
+  const failures = auditPlatform({
+    manifest: { resources: [], routes: [] },
+    resources: [],
+    readOnlyPage: '<script setup>resourceApi.updateStatus(resource, identity, status)</script>',
+    routeSources: [],
+    viewSources: new Map(),
+    apiSources: new Map(),
+  });
+
+  assert.deepEqual(failures, ['readonly: mutation action exposed (updateStatus)']);
+});
+
+test('扫描 API 和页面中用于展示或请求的内部 ID', () => {
+  const failures = scanInternalIdLeaks(new Map([
+    ['src/api/leak.ts', "resourceApi.create('/gas/gas_basic', { gas_basic_id: 7 })"],
+    ['src/views/leak.vue', '<a-table-column data-index="id" />'],
+  ]));
+
+  assert.deepEqual(failures, [
+    'src/api/leak.ts: internal identifier gas_basic_id',
+    'src/views/leak.vue: internal identifier id',
+  ]);
+});
+
+test('每个资源必须由带菜单元数据的路由实际加载对应页面', () => {
+  const failures = auditPlatform({
+    manifest: { resources: [{ domain: 'gas', name: 'gas_basic', path: '/gas/gas_basic', mode: 'writable', pageKind: 'list' }], routes: [
+      { method: 'GET', path: '/gas/gas_basic' },
+      { method: 'POST', path: '/gas/gas_basic' },
+      { method: 'GET', path: '/gas/gas_basic/:identity' },
+      { method: 'PUT', path: '/gas/gas_basic/:identity' },
+      { method: 'PATCH', path: '/gas/gas_basic/:identity/status' },
+      { method: 'DELETE', path: '/gas/gas_basic/:identity' },
+    ] },
+    resources: [{ name: 'gas_basic', resource: '/gas/gas_basic', mode: 'writable', pageKind: 'list', title: '气站管理', fields: [{ key: 'name', label: '名称' }] }],
+    readOnlyPage: '',
+    routeSources: ["{ component: () => import('@/views/gas/gas_basic/ListPage.vue') }"],
+    viewSources: new Map([['src/views/gas/gas_basic/ListPage.vue', "getResource('/gas/gas_basic')"]]),
+    apiSources: new Map(),
+  });
+
+  assert.deepEqual(failures, ['gas/gas_basic: missing menu route']);
+});